// Authors — demonstrates `.encrypted()` field encryption.
//
// `bio` is flagged `.encrypted()`: the store middleware transparently
// encrypts it on write (AES-256-GCM) and decrypts on read, so handlers
// always see plaintext while the column stores an opaque `enc:v1:…` string
// on disk on every dialect.
//
// ‼️ This column ONLY works because `app.config.ts` wires
//    `governancePlugin({ fieldEncryption: true })`, which registers the
//    cipher (key from the secret VOLTRO_FIELD_ENCRYPTION_KEY). Boot fails
//    loud if an `.encrypted()` column exists but no cipher is registered.
//
// An `.encrypted()` column is ciphertext on disk — you CANNOT filter or
// sort by its plaintext in SQL. Encrypt only what you read back whole
// (PII, tokens, notes). A book search never touches `bio`, so this is safe.

import { id, table, text } from '@voltro/database'
import { tenant } from '@voltro/plugin-multitenancy/mixin'

export const authors = table('authors', {
  id:   id({ prefix: 'author' }),
  name: text(),
  // Encrypted at rest. Requires governancePlugin({ fieldEncryption: true }).
  bio:  text().encrypted().nullable(),
})
  // tenant() pulls audit() transitively → adds tenantId + createdAt /
  // updatedAt / createdBy / updatedBy (auto-stamped by the runtime).
  .with(tenant())