defmodule Kryptex do
  @moduledoc """
  Public API for encrypting/decrypting field payloads.

  This package ports the same core mechanism from the Phoenix Ecto encryption
  example:

  - AES-256-GCM
  - random IV on every write
  - key id embedded in ciphertext for key rotation
  - encryption wired into `Ecto.ParameterizedType`
  """

  alias Kryptex.Cipher

  @spec encrypt(binary()) :: {:ok, binary()} | {:error, term()}
  def encrypt(plaintext) when is_binary(plaintext) do
    Cipher.encrypt(plaintext)
  end

  @spec decrypt(binary()) :: {:ok, binary()} | {:error, term()}
  def decrypt(ciphertext) when is_binary(ciphertext) do
    Cipher.decrypt(ciphertext)
  end
end