namespace SwBLL.OfflineRollout;

/// <summary>Encrypts an Offline Rollout Package's plaintext bundle to one on-prem/BYOC client's
/// own registered public key (SW.MSWCLIENTDATABASEKEY). Mirrors
/// GB5Framework.FrameworkBLL.Promotion.PromotionPackageCrypto's exact container format
/// (RSA-OAEP-SHA256-wrapped AES-256-GCM) for the opposite direction — central-to-client instead
/// of client-to-central — but takes the recipient's PublicKeyPem directly rather than resolving
/// one via MPROMOTIONCOUNTERPARTY/EnvironmentCode, since SqlWorkbench has no equivalent
/// "environment" concept, only a ClientDbId. Decrypt intentionally lives only in the standalone
/// apply tool (Phase 4) — that tool must run with zero GB5 live-infra dependency (no Vault, no
/// Dapr, no network call to this deployment), so this interface is encrypt-only.</summary>
public interface IRolloutPackageCrypto
{
    Task<byte[]> EncryptPackageAsync(byte[] plaintext, string recipientPublicKeyPem, CancellationToken ct);
}