@cratis/chronicle 6.2.0 → 6.3.0

package/dist/confidentiality/SecurityMetadata.d.ts

@@ -0,0 +1,18 @@
+import type { SecurityMetadataType } from './SecurityMetadataType';
+/**
+ * Represents metadata related to security.
+ *
+ * This is the security counterpart to {@link ComplianceMetadata} - a deliberately separate type
+ * rather than a shared one. See {@link SecurityMetadataType} for why.
+ */
+export interface SecurityMetadata {
+    /**
+     * The type of security metadata.
+     */
+    readonly metadataType: SecurityMetadataType;
+    /**
+     * Any additional details - can be empty.
+     */
+    readonly details: string;
+}
+//# sourceMappingURL=SecurityMetadata.d.ts.map

package/dist/confidentiality/SecurityMetadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityMetadata.d.ts","sourceRoot":"","sources":["../../confidentiality/SecurityMetadata.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B"}

package/dist/confidentiality/SecurityMetadata.js

@@ -0,0 +1,4 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+export {};
+//# sourceMappingURL=SecurityMetadata.js.map

package/dist/confidentiality/SecurityMetadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityMetadata.js","sourceRoot":"","sources":["../../confidentiality/SecurityMetadata.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,qGAAqG"}

package/dist/confidentiality/SecurityMetadataResolver.d.ts

@@ -0,0 +1,30 @@
+import type { SecurityMetadata } from './SecurityMetadata';
+/**
+ * Resolves security metadata for properties and types.
+ *
+ * This is the security counterpart to {@link ComplianceMetadataResolver} - a deliberately separate
+ * type rather than a shared one. See {@link SecurityMetadataType} for why.
+ */
+export declare class SecurityMetadataResolver {
+    /**
+     * Checks if a property has security metadata.
+     * @param target - The class prototype.
+     * @param propertyKey - The property name.
+     * @returns True if the property has security metadata; false otherwise.
+     */
+    static hasMetadataFor(target: object, propertyKey: string): boolean;
+    /**
+     * Gets all security metadata for a property.
+     * @param target - The class prototype.
+     * @param propertyKey - The property name.
+     * @returns Array of security metadata.
+     */
+    static getMetadataFor(target: object, propertyKey: string): SecurityMetadata[];
+    /**
+     * Gets security metadata for a type (e.g., ConceptAs types).
+     * @param type - The type constructor.
+     * @returns Array of security metadata.
+     */
+    static getMetadataForType(type: Function): SecurityMetadata[];
+}
+//# sourceMappingURL=SecurityMetadataResolver.d.ts.map

package/dist/confidentiality/SecurityMetadataResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityMetadataResolver.d.ts","sourceRoot":"","sources":["../../confidentiality/SecurityMetadataResolver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;;GAKG;AACH,qBAAa,wBAAwB;IACjC;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAInE;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE;IAW9E;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,EAAE;CAQhE"}

package/dist/confidentiality/SecurityMetadataResolver.js

@@ -0,0 +1,48 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+import { getEncryptedMetadata, getTypeEncryptedMetadata } from './encrypted';
+/**
+ * Resolves security metadata for properties and types.
+ *
+ * This is the security counterpart to {@link ComplianceMetadataResolver} - a deliberately separate
+ * type rather than a shared one. See {@link SecurityMetadataType} for why.
+ */
+export class SecurityMetadataResolver {
+    /**
+     * Checks if a property has security metadata.
+     * @param target - The class prototype.
+     * @param propertyKey - The property name.
+     * @returns True if the property has security metadata; false otherwise.
+     */
+    static hasMetadataFor(target, propertyKey) {
+        return getEncryptedMetadata(target, propertyKey) !== undefined;
+    }
+    /**
+     * Gets all security metadata for a property.
+     * @param target - The class prototype.
+     * @param propertyKey - The property name.
+     * @returns Array of security metadata.
+     */
+    static getMetadataFor(target, propertyKey) {
+        const metadata = [];
+        const encryptedMetadata = getEncryptedMetadata(target, propertyKey);
+        if (encryptedMetadata) {
+            metadata.push(encryptedMetadata);
+        }
+        return metadata;
+    }
+    /**
+     * Gets security metadata for a type (e.g., ConceptAs types).
+     * @param type - The type constructor.
+     * @returns Array of security metadata.
+     */
+    static getMetadataForType(type) {
+        const metadata = [];
+        const encryptedMetadata = getTypeEncryptedMetadata(type);
+        if (encryptedMetadata) {
+            metadata.push(encryptedMetadata);
+        }
+        return metadata;
+    }
+}
+//# sourceMappingURL=SecurityMetadataResolver.js.map

package/dist/confidentiality/SecurityMetadataResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityMetadataResolver.js","sourceRoot":"","sources":["../../confidentiality/SecurityMetadataResolver.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,qGAAqG;AAGrG,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IACjC;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,MAAc,EAAE,WAAmB;QACrD,OAAO,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,SAAS,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,MAAc,EAAE,WAAmB;QACrD,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,iBAAiB,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,IAAc;QACpC,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,iBAAiB,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ"}

package/dist/confidentiality/SecurityMetadataType.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Represents a type of security metadata.
+ *
+ * This is the security counterpart to {@link ComplianceMetadataType} - a deliberately separate type
+ * rather than a shared one. A `@pii()` value and an `@encrypted()` value are never the same kind of
+ * thing: one is personal data with a GDPR erasure obligation, the other is an operational secret
+ * with none. Keeping the two vocabularies apart keeps that distinction visible at every call site
+ * that reads a schema's metadata.
+ */
+export declare class SecurityMetadataType {
+    /**
+     * The key is provisioned per compliance identity - the same identity, resolved the same way, a
+     * `@pii()` value on the same document would use. This is what `@encrypted()` (with no explicit
+     * scope, or `EncryptionScope.Subject`) resolves to.
+     */
+    static readonly EncryptedSubject: SecurityMetadataType;
+    /**
+     * The key is provisioned once per event store namespace. This is what
+     * `@encrypted(EncryptionScope.Namespace)` resolves to.
+     */
+    static readonly EncryptedNamespace: SecurityMetadataType;
+    /**
+     * The key is provisioned once for the whole Chronicle installation. This is what
+     * `@encrypted(EncryptionScope.Global)` resolves to.
+     */
+    static readonly EncryptedGlobal: SecurityMetadataType;
+    private readonly _value;
+    /**
+     * Initializes a new instance of SecurityMetadataType.
+     * @param value - The string value of the security metadata type.
+     */
+    constructor(value: string);
+    /**
+     * Gets the underlying string value.
+     */
+    get value(): string;
+    /**
+     * Returns the string representation of the security metadata type.
+     */
+    toString(): string;
+}
+//# sourceMappingURL=SecurityMetadataType.d.ts.map

package/dist/confidentiality/SecurityMetadataType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityMetadataType.d.ts","sourceRoot":"","sources":["../../confidentiality/SecurityMetadataType.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC7B;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,gBAAgB,uBAAgD;IAEhF;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uBAAkD;IAEpF;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,eAAe,uBAA+C;IAE9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC;;;OAGG;gBACS,KAAK,EAAE,MAAM;IAIzB;;OAEG;IACH,IAAI,KAAK,IAAI,MAAM,CAElB;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM;CAGrB"}

package/dist/confidentiality/SecurityMetadataType.js

@@ -0,0 +1,50 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+/**
+ * Represents a type of security metadata.
+ *
+ * This is the security counterpart to {@link ComplianceMetadataType} - a deliberately separate type
+ * rather than a shared one. A `@pii()` value and an `@encrypted()` value are never the same kind of
+ * thing: one is personal data with a GDPR erasure obligation, the other is an operational secret
+ * with none. Keeping the two vocabularies apart keeps that distinction visible at every call site
+ * that reads a schema's metadata.
+ */
+export class SecurityMetadataType {
+    /**
+     * The key is provisioned per compliance identity - the same identity, resolved the same way, a
+     * `@pii()` value on the same document would use. This is what `@encrypted()` (with no explicit
+     * scope, or `EncryptionScope.Subject`) resolves to.
+     */
+    static EncryptedSubject = new SecurityMetadataType('EncryptedSubject');
+    /**
+     * The key is provisioned once per event store namespace. This is what
+     * `@encrypted(EncryptionScope.Namespace)` resolves to.
+     */
+    static EncryptedNamespace = new SecurityMetadataType('EncryptedNamespace');
+    /**
+     * The key is provisioned once for the whole Chronicle installation. This is what
+     * `@encrypted(EncryptionScope.Global)` resolves to.
+     */
+    static EncryptedGlobal = new SecurityMetadataType('EncryptedGlobal');
+    _value;
+    /**
+     * Initializes a new instance of SecurityMetadataType.
+     * @param value - The string value of the security metadata type.
+     */
+    constructor(value) {
+        this._value = value;
+    }
+    /**
+     * Gets the underlying string value.
+     */
+    get value() {
+        return this._value;
+    }
+    /**
+     * Returns the string representation of the security metadata type.
+     */
+    toString() {
+        return this._value;
+    }
+}
+//# sourceMappingURL=SecurityMetadataType.js.map

package/dist/confidentiality/SecurityMetadataType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityMetadataType.js","sourceRoot":"","sources":["../../confidentiality/SecurityMetadataType.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,qGAAqG;AAErG;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IAC7B;;;;OAIG;IACH,MAAM,CAAU,gBAAgB,GAAG,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAEhF;;;OAGG;IACH,MAAM,CAAU,kBAAkB,GAAG,IAAI,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IAEpF;;;OAGG;IACH,MAAM,CAAU,eAAe,GAAG,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAE7D,MAAM,CAAS;IAEhC;;;OAGG;IACH,YAAY,KAAa;QACrB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,QAAQ;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC"}

package/dist/confidentiality/encrypted.d.ts

@@ -0,0 +1,72 @@
+import 'reflect-metadata';
+import type { SecurityMetadata } from './SecurityMetadata';
+import { EncryptionScope } from './EncryptionScope';
+/**
+ * Decorator that marks a property or type as needing plain-confidentiality encryption at rest - a
+ * security measure, not a compliance one.
+ *
+ * Use `@encrypted()` for an operational secret that has no data subject and no lawful basis for
+ * erasure - an API key, a webhook signing secret, a partner credential. Use `@pii()` instead when
+ * the value is personal data about a natural person: only `@pii()` encrypts a value *and* enrolls it
+ * in GDPR right-to-erasure. Marking a secret `@pii()` would make it erasable on a request that was
+ * never about it; marking personal data `@encrypted()` would encrypt it but never erase it. The two
+ * are not interchangeable, and this decorator's key is never provisioned under the same identity a
+ * `@pii()` value for the same subject uses.
+ *
+ * All three {@link EncryptionScope} members are honored by the kernel: `EncryptionScope.Subject`
+ * (the default) provisions a key per compliance identity, exactly matching how a `@pii()` value on
+ * the same document is resolved; `EncryptionScope.Namespace` provisions one key shared by every
+ * value marked with it in a given event store namespace; `EncryptionScope.Global` provisions one key
+ * shared across the whole installation. Choosing a wider scope is safe for `@encrypted()` in a way
+ * it is not for `@pii()`, precisely because an operational secret has no data subject whose erasure
+ * request the wider key could ever need to honor separately from another subject's.
+ *
+ * This decorator can be used in two ways:
+ * - As a property decorator: `@encrypted() propertyName: type`
+ * - As a class decorator: `@encrypted() class TypeName { }`
+ *
+ * @param scope - The {@link EncryptionScope} the key is provisioned under - defaults to `EncryptionScope.Subject`.
+ * @param details - Optional details explaining why or to what purpose/extent the property/type needs encryption.
+ * @returns A decorator function that can be applied to either properties or classes (but not both on the same target).
+ *
+ * @example
+ * Property usage:
+ * ```typescript
+ * @readModel()
+ * class PartnerIntegration {
+ *     @encrypted()
+ *     apiKey: string = '';
+ *
+ *     @encrypted(EncryptionScope.Namespace)
+ *     webhookSigningSecret: string = '';
+ * }
+ * ```
+ */
+export declare function encrypted(scope?: EncryptionScope, details?: string): PropertyDecorator & ClassDecorator;
+/**
+ * Gets the encrypted security metadata for a property.
+ * @param target - The class prototype.
+ * @param propertyKey - The property name.
+ * @returns The security metadata, or undefined if not decorated with @encrypted.
+ */
+export declare function getEncryptedMetadata(target: object, propertyKey: string): SecurityMetadata | undefined;
+/**
+ * Checks whether a property has been decorated with @encrypted.
+ * @param target - The class prototype.
+ * @param propertyKey - The property name.
+ * @returns True if the property has @encrypted decorator; false otherwise.
+ */
+export declare function hasEncryptedMetadata(target: object, propertyKey: string): boolean;
+/**
+ * Gets the encrypted security metadata for a type.
+ * @param type - The type constructor.
+ * @returns The security metadata, or undefined if not decorated with @encrypted.
+ */
+export declare function getTypeEncryptedMetadata(type: Function): SecurityMetadata | undefined;
+/**
+ * Checks whether a type has been decorated with @encrypted.
+ * @param type - The type constructor.
+ * @returns True if the type has @encrypted decorator; false otherwise.
+ */
+export declare function isEncrypted(type: Function): boolean;
+//# sourceMappingURL=encrypted.d.ts.map

package/dist/confidentiality/encrypted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.d.ts","sourceRoot":"","sources":["../../confidentiality/encrypted.ts"],"names":[],"mappings":"AAGA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAwBpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,SAAS,CAAC,KAAK,GAAE,eAAyC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,cAAc,CAiChI;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAEtG;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,GAAG,SAAS,CAErF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAEnD"}

package/dist/confidentiality/encrypted.js

@@ -0,0 +1,130 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+import 'reflect-metadata';
+import { SecurityMetadataType } from './SecurityMetadataType';
+import { EncryptionScope } from './EncryptionScope';
+import { EncryptedNotSupportedOnEventSourceId } from './EncryptedNotSupportedOnEventSourceId';
+import { TypeIntrospector } from '../types';
+/** The property name this client uses everywhere for the event source identifier. */
+const EVENT_SOURCE_ID_PROPERTY = 'eventSourceId';
+/** Metadata key for the encrypted decorator on properties. */
+const ENCRYPTED_PROPERTY_METADATA_KEY = 'chronicle:security:encrypted:property';
+/** Metadata key for the encrypted decorator on types. */
+const ENCRYPTED_TYPE_METADATA_KEY = 'chronicle:security:encrypted:type';
+function metadataTypeFor(scope) {
+    switch (scope) {
+        case EncryptionScope.Subject:
+            return SecurityMetadataType.EncryptedSubject;
+        case EncryptionScope.Namespace:
+            return SecurityMetadataType.EncryptedNamespace;
+        case EncryptionScope.Global:
+            return SecurityMetadataType.EncryptedGlobal;
+    }
+}
+/**
+ * Decorator that marks a property or type as needing plain-confidentiality encryption at rest - a
+ * security measure, not a compliance one.
+ *
+ * Use `@encrypted()` for an operational secret that has no data subject and no lawful basis for
+ * erasure - an API key, a webhook signing secret, a partner credential. Use `@pii()` instead when
+ * the value is personal data about a natural person: only `@pii()` encrypts a value *and* enrolls it
+ * in GDPR right-to-erasure. Marking a secret `@pii()` would make it erasable on a request that was
+ * never about it; marking personal data `@encrypted()` would encrypt it but never erase it. The two
+ * are not interchangeable, and this decorator's key is never provisioned under the same identity a
+ * `@pii()` value for the same subject uses.
+ *
+ * All three {@link EncryptionScope} members are honored by the kernel: `EncryptionScope.Subject`
+ * (the default) provisions a key per compliance identity, exactly matching how a `@pii()` value on
+ * the same document is resolved; `EncryptionScope.Namespace` provisions one key shared by every
+ * value marked with it in a given event store namespace; `EncryptionScope.Global` provisions one key
+ * shared across the whole installation. Choosing a wider scope is safe for `@encrypted()` in a way
+ * it is not for `@pii()`, precisely because an operational secret has no data subject whose erasure
+ * request the wider key could ever need to honor separately from another subject's.
+ *
+ * This decorator can be used in two ways:
+ * - As a property decorator: `@encrypted() propertyName: type`
+ * - As a class decorator: `@encrypted() class TypeName { }`
+ *
+ * @param scope - The {@link EncryptionScope} the key is provisioned under - defaults to `EncryptionScope.Subject`.
+ * @param details - Optional details explaining why or to what purpose/extent the property/type needs encryption.
+ * @returns A decorator function that can be applied to either properties or classes (but not both on the same target).
+ *
+ * @example
+ * Property usage:
+ * ```typescript
+ * @readModel()
+ * class PartnerIntegration {
+ *     @encrypted()
+ *     apiKey: string = '';
+ *
+ *     @encrypted(EncryptionScope.Namespace)
+ *     webhookSigningSecret: string = '';
+ * }
+ * ```
+ */
+export function encrypted(scope = EncryptionScope.Subject, details) {
+    return (target, propertyKey) => {
+        // Class decorator usage (for types like ConceptAs)
+        if (typeof target === 'function' && propertyKey === undefined) {
+            const metadata = {
+                metadataType: metadataTypeFor(scope),
+                details: details ?? ''
+            };
+            Reflect.defineMetadata(ENCRYPTED_TYPE_METADATA_KEY, metadata, target);
+            return;
+        }
+        // Property decorator usage
+        if (propertyKey !== undefined) {
+            const key = propertyKey.toString();
+            const declaringType = target.constructor;
+            // Encrypting the event source identifier would make its own decryption key
+            // unfindable - the identifier is required, in the clear, to correlate events and
+            // look up the key that protects everything else. Mirrors @pii()'s
+            // PIINotSupportedOnEventSourceId guard, for the same reason.
+            if (key === EVENT_SOURCE_ID_PROPERTY) {
+                throw new EncryptedNotSupportedOnEventSourceId(declaringType.name);
+            }
+            TypeIntrospector.trackProperty(declaringType, key);
+            const metadata = {
+                metadataType: metadataTypeFor(scope),
+                details: details ?? ''
+            };
+            Reflect.defineMetadata(ENCRYPTED_PROPERTY_METADATA_KEY, metadata, target, key);
+        }
+    };
+}
+/**
+ * Gets the encrypted security metadata for a property.
+ * @param target - The class prototype.
+ * @param propertyKey - The property name.
+ * @returns The security metadata, or undefined if not decorated with @encrypted.
+ */
+export function getEncryptedMetadata(target, propertyKey) {
+    return Reflect.getMetadata(ENCRYPTED_PROPERTY_METADATA_KEY, target, propertyKey);
+}
+/**
+ * Checks whether a property has been decorated with @encrypted.
+ * @param target - The class prototype.
+ * @param propertyKey - The property name.
+ * @returns True if the property has @encrypted decorator; false otherwise.
+ */
+export function hasEncryptedMetadata(target, propertyKey) {
+    return Reflect.hasMetadata(ENCRYPTED_PROPERTY_METADATA_KEY, target, propertyKey);
+}
+/**
+ * Gets the encrypted security metadata for a type.
+ * @param type - The type constructor.
+ * @returns The security metadata, or undefined if not decorated with @encrypted.
+ */
+export function getTypeEncryptedMetadata(type) {
+    return Reflect.getMetadata(ENCRYPTED_TYPE_METADATA_KEY, type);
+}
+/**
+ * Checks whether a type has been decorated with @encrypted.
+ * @param type - The type constructor.
+ * @returns True if the type has @encrypted decorator; false otherwise.
+ */
+export function isEncrypted(type) {
+    return Reflect.hasMetadata(ENCRYPTED_TYPE_METADATA_KEY, type);
+}
+//# sourceMappingURL=encrypted.js.map

package/dist/confidentiality/encrypted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.js","sourceRoot":"","sources":["../../confidentiality/encrypted.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,qGAAqG;AAErG,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,qFAAqF;AACrF,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAEjD,8DAA8D;AAC9D,MAAM,+BAA+B,GAAG,uCAAuC,CAAC;AAEhF,yDAAyD;AACzD,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAExE,SAAS,eAAe,CAAC,KAAsB;IAC3C,QAAQ,KAAK,EAAE,CAAC;QACZ,KAAK,eAAe,CAAC,OAAO;YACxB,OAAO,oBAAoB,CAAC,gBAAgB,CAAC;QACjD,KAAK,eAAe,CAAC,SAAS;YAC1B,OAAO,oBAAoB,CAAC,kBAAkB,CAAC;QACnD,KAAK,eAAe,CAAC,MAAM;YACvB,OAAO,oBAAoB,CAAC,eAAe,CAAC;IACpD,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,SAAS,CAAC,QAAyB,eAAe,CAAC,OAAO,EAAE,OAAgB;IACxF,OAAO,CAAC,MAAyB,EAAE,WAA6B,EAAE,EAAE;QAChE,mDAAmD;QACnD,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAqB;gBAC/B,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC;gBACpC,OAAO,EAAE,OAAO,IAAI,EAAE;aACzB,CAAC;YACF,OAAO,CAAC,cAAc,CAAC,2BAA2B,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtE,OAAO;QACX,CAAC;QAED,2BAA2B;QAC3B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,aAAa,GAAI,MAAoC,CAAC,WAAW,CAAC;YAExE,2EAA2E;YAC3E,iFAAiF;YACjF,kEAAkE;YAClE,6DAA6D;YAC7D,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;gBACnC,MAAM,IAAI,oCAAoC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACvE,CAAC;YAED,gBAAgB,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAqB;gBAC/B,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC;gBACpC,OAAO,EAAE,OAAO,IAAI,EAAE;aACzB,CAAC;YACF,OAAO,CAAC,cAAc,CAAC,+BAA+B,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB;IACpE,OAAO,OAAO,CAAC,WAAW,CAAC,+BAA+B,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB;IACpE,OAAO,OAAO,CAAC,WAAW,CAAC,+BAA+B,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAc;IACnD,OAAO,OAAO,CAAC,WAAW,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAc;IACtC,OAAO,OAAO,CAAC,WAAW,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC"}

package/dist/confidentiality/index.d.ts

@@ -0,0 +1,8 @@
+export { SecurityMetadataType } from './SecurityMetadataType';
+export type { SecurityMetadata } from './SecurityMetadata';
+export { EncryptionScope } from './EncryptionScope';
+export { encrypted, getEncryptedMetadata, hasEncryptedMetadata, getTypeEncryptedMetadata, isEncrypted } from './encrypted';
+export { EncryptedNotSupportedOnEventSourceId } from './EncryptedNotSupportedOnEventSourceId';
+export { PIIAndEncryptedCombinedNotSupported } from './PIIAndEncryptedCombinedNotSupported';
+export { SecurityMetadataResolver } from './SecurityMetadataResolver';
+//# sourceMappingURL=index.d.ts.map

package/dist/confidentiality/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../confidentiality/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/confidentiality/index.js

@@ -0,0 +1,9 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+export { SecurityMetadataType } from './SecurityMetadataType';
+export { EncryptionScope } from './EncryptionScope';
+export { encrypted, getEncryptedMetadata, hasEncryptedMetadata, getTypeEncryptedMetadata, isEncrypted } from './encrypted';
+export { EncryptedNotSupportedOnEventSourceId } from './EncryptedNotSupportedOnEventSourceId';
+export { PIIAndEncryptedCombinedNotSupported } from './PIIAndEncryptedCombinedNotSupported';
+export { SecurityMetadataResolver } from './SecurityMetadataResolver';
+//# sourceMappingURL=index.js.map

package/dist/confidentiality/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../confidentiality/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,qGAAqG;AAErG,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,EAAE,mCAAmC,EAAE,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/index.d.ts

@@ -20,6 +20,7 @@ import * as correlation from './correlation';
 import * as transactions from './transactions';
 import * as eventStoreSubscriptions from './eventStoreSubscriptions';
 import * as compliance from './compliance';
+import * as confidentiality from './confidentiality';
 export { ChronicleClient } from './ChronicleClient';
 export { IncompatibleChronicleServer } from './connection/IncompatibleChronicleServer';
 export type { IChronicleClient } from './IChronicleClient';
@@ -53,5 +54,6 @@ export * from './correlation';
 export * from './transactions';
 export * from './eventStoreSubscriptions';
 export * from './compliance';
-export { events, eventSequences, reactors, reducers, seeding, readModels, projections, jobs, webhooks, externalServices, identities, observation, sinks, schemas, types, artifacts, identity, auditing, correlation, transactions, eventStoreSubscriptions, compliance, };
+export * from './confidentiality';
+export { events, eventSequences, reactors, reducers, seeding, readModels, projections, jobs, webhooks, externalServices, identities, observation, sinks, schemas, types, artifacts, identity, auditing, correlation, transactions, eventStoreSubscriptions, compliance, confidentiality, };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,cAAc,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,gBAAgB,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,YAAY,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,uBAAuB,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEjF,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAE7B,OAAO,EACH,MAAM,EACN,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,KAAK,EACL,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,UAAU,GACb,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,cAAc,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,gBAAgB,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,YAAY,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,uBAAuB,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,eAAe,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEjF,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAElC,OAAO,EACH,MAAM,EACN,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,KAAK,EACL,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,UAAU,EACV,eAAe,GAClB,CAAC"}

package/dist/index.js

@@ -22,6 +22,7 @@ import * as correlation from './correlation';
 import * as transactions from './transactions';
 import * as eventStoreSubscriptions from './eventStoreSubscriptions';
 import * as compliance from './compliance';
+import * as confidentiality from './confidentiality';
 export { ChronicleClient } from './ChronicleClient';
 export { IncompatibleChronicleServer } from './connection/IncompatibleChronicleServer';
 export { ChronicleOptions } from './ChronicleOptions';
@@ -53,5 +54,6 @@ export * from './correlation';
 export * from './transactions';
 export * from './eventStoreSubscriptions';
 export * from './compliance';
-export { events, eventSequences, reactors, reducers, seeding, readModels, projections, jobs, webhooks, externalServices, identities, observation, sinks, schemas, types, artifacts, identity, auditing, correlation, transactions, eventStoreSubscriptions, compliance, };
+export * from './confidentiality';
+export { events, eventSequences, reactors, reducers, seeding, readModels, projections, jobs, webhooks, externalServices, identities, observation, sinks, schemas, types, artifacts, identity, auditing, correlation, transactions, eventStoreSubscriptions, compliance, confidentiality, };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,qGAAqG;AAErG,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,cAAc,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,gBAAgB,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,YAAY,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,uBAAuB,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEjF,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAE7B,OAAO,EACH,MAAM,EACN,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,KAAK,EACL,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,UAAU,GACb,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,qGAAqG;AAErG,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,cAAc,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,gBAAgB,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,YAAY,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,uBAAuB,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,eAAe,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEjF,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAElC,OAAO,EACH,MAAM,EACN,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,UAAU,EACV,WAAW,EACX,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,KAAK,EACL,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,UAAU,EACV,eAAe,GAClB,CAAC"}

package/dist/schemas/JsonSchema.d.ts

@@ -11,6 +11,23 @@ export interface ComplianceSchemaMetadata {
      */
     details: string;
 }
+/**
+ * Represents a single security classification recorded on a schema node.
+ *
+ * This is the security counterpart to {@link ComplianceSchemaMetadata} - written under its own,
+ * separate `security` schema key rather than merged into `compliance`. See
+ * `Source/confidentiality/SecurityMetadataType.ts` for why.
+ */
+export interface SecuritySchemaMetadata {
+    /**
+     * The type of security metadata (e.g. 'EncryptedSubject', 'EncryptedNamespace', 'EncryptedGlobal').
+     */
+    metadataType: string;
+    /**
+     * Any additional details - can be empty.
+     */
+    details: string;
+}
 /**
  * Represents a JSON Schema object.
  */
@@ -26,5 +43,6 @@ export type JsonSchema = {
     additionalProperties?: boolean | JsonSchema;
     enum?: Array<string | number | boolean | null>;
     compliance?: ComplianceSchemaMetadata[];
+    security?: SecuritySchemaMetadata[];
 };
 //# sourceMappingURL=JsonSchema.d.ts.map

package/dist/schemas/JsonSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JsonSchema.d.ts","sourceRoot":"","sources":["../../schemas/JsonSchema.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACrC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,oBAAoB,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAC3C,CAAC"}
+{"version":3,"file":"JsonSchema.d.ts","sourceRoot":"","sources":["../../schemas/JsonSchema.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACrC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACnC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,oBAAoB,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACxC,QAAQ,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACvC,CAAC"}

package/dist/schemas/JsonSchemaGenerator.d.ts

@@ -87,5 +87,46 @@ export declare class JsonSchemaGenerator {
      * nothing and makes the generated schema noisier to read and to diff.
      */
     private static hasComplianceMetadataOfType;
+    /**
+     * Collects security metadata for a property from every source compliance metadata is resolved
+     * from: the property itself, its declaring class, and its own type (the concept case). This is
+     * the security counterpart to {@link collectComplianceMetadata} - a deliberately separate walk
+     * rather than a shared one, over a completely separate `@encrypted()` decorator vocabulary.
+     * @param target - The class prototype the property is declared on.
+     * @param propertyKey - The property name.
+     * @param propertyType - The property's runtime type, when resolved.
+     * @returns The collected security metadata, in property → declaring-class → type order.
+     */
+    private static collectSecurityMetadata;
+    /**
+     * Adds security metadata to a schema node, descending into an object's properties so that the
+     * metadata always lands on the leaves that actually hold a value. This is the security
+     * counterpart to {@link addComplianceMetadataToSchema} - see its remarks for why metadata is
+     * pushed to leaves and why an array is left as a container.
+     * @param schema - The schema node to add to.
+     * @param metadata - The security metadata to add.
+     */
+    private static addSecurityMetadataToSchema;
+    /**
+     * Checks whether a security array already carries metadata of a given type.
+     * @param security - The security array to check.
+     * @param metadataType - The metadata type to look for.
+     * @returns True when the metadata type is already present, false if not.
+     */
+    private static hasSecurityMetadataOfType;
+    /**
+     * Rejects a property or type that resolved both compliance and security metadata.
+     * @param name - The property or type name, used in the thrown error.
+     * @param complianceMetadata - The compliance metadata collected for the property/type.
+     * @param securityMetadata - The security metadata collected for the property/type.
+     * @remarks
+     * This is not merely redundant - it corrupts the value. The kernel applies every matching
+     * handler for a property in sequence, so a value marked both ways is encrypted first under the
+     * PII key and then again under the Encrypted key; releasing it decrypts with the wrong key
+     * against ciphertext, which fails loudly rather than returning a wrong value. Checked here, at
+     * schema-generation time, the same point C#'s `EncryptedMetadataProvider.ThrowIfAlsoPII` checks
+     * it - this client has no compile-time analyzer, so this runtime check is the only backstop.
+     */
+    private static throwIfBothCompliantAndSecure;
 }
 //# sourceMappingURL=JsonSchemaGenerator.d.ts.map

package/dist/schemas/JsonSchemaGenerator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JsonSchemaGenerator.d.ts","sourceRoot":"","sources":["../../schemas/JsonSchemaGenerator.ts"],"names":[],"mappings":"AAGA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAA4B,UAAU,EAAE,MAAM,cAAc,CAAC;AAKpE;;GAEG;AACH,qBAAa,mBAAmB;IAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAGtC;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAEnC;IAEH;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAWnD;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,GAAG,UAAU;IAmClG,OAAO,CAAC,MAAM,CAAC,sBAAsB;IA2CrC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAiBnC;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IASlC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IASnC,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAgBjC,OAAO,CAAC,MAAM,CAAC,eAAe;IAK9B;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,yBAAyB;IAuBxC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,MAAM,CAAC,6BAA6B;IAyB5C;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,2BAA2B;CAG7C"}
+{"version":3,"file":"JsonSchemaGenerator.d.ts","sourceRoot":"","sources":["../../schemas/JsonSchemaGenerator.ts"],"names":[],"mappings":"AAGA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAA4B,UAAU,EAA0B,MAAM,cAAc,CAAC;AAQ5F;;GAEG;AACH,qBAAa,mBAAmB;IAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAGtC;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAEnC;IAEH;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAWnD;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,GAAG,UAAU;IAuClG,OAAO,CAAC,MAAM,CAAC,sBAAsB;IA2CrC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAoBnC;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IASlC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IASnC,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAgBjC,OAAO,CAAC,MAAM,CAAC,eAAe;IAK9B;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,yBAAyB;IAuBxC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,MAAM,CAAC,6BAA6B;IAyB5C;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,2BAA2B;IAI1C;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAuBtC;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,2BAA2B;IAyB1C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,yBAAyB;IAIxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,6BAA6B;CAK/C"}