namespace ZB.MOM.WW.Secrets.Abstractions;

/// <summary>
/// Supplies the AES-256 master key (KEK) used to wrap and unwrap per-secret data-encryption
/// keys. Implementations resolve the key material from a configured source (environment,
/// file, external KMS) and expose a stable, non-secret identifier for the active key so
/// rotation can be recorded per row and reasoned about later.
/// </summary>
public interface IMasterKeyProvider
{
    /// <summary>
    /// Returns the 32-byte AES-256 master key material.
    /// </summary>
    /// <returns>The 32-byte master key.</returns>
    /// <exception cref="MasterKeyUnavailableException">The master key cannot be resolved.</exception>
    ReadOnlyMemory<byte> GetMasterKey();

    /// <summary>
    /// The stable, non-secret identifier of the active key-encryption key (KEK). This value
    /// is recorded on each stored row so that key rotation is legible and rows can be matched
    /// to the KEK that wrapped their DEK.
    /// </summary>
    string KekId { get; }
}