/**
 * Wave 0 stub — Broker: AES-GCM app-password encryption
 *
 * These tests are RED stubs. Implementation lives in:
 *   apps/api/src/broker/crypto.ts  (Plan 03)
 *
 * Tests will be filled GREEN in Plan 03 when crypto helpers are implemented.
 */

import { describe, it } from 'vitest'

describe('encryptPassword / decryptPassword', () => {
  it.todo('roundtrip: decrypt(encrypt(plaintext)) === plaintext (Plan 03)')

  it.todo('different IVs produce different ciphertext for the same plaintext (Plan 03)')

  it.todo('decrypting with a tampered authTag throws (Plan 03)')

  it.todo('decrypting with a tampered ciphertext throws (Plan 03)')

  it.todo('stored payload is valid JSON with iv, authTag, ciphertext fields (Plan 03)')
})