@vorionsys/platform-core 0.1.0

package/dist/security/encryption/decorators.js

@@ -0,0 +1,359 @@
+/**
+ * Field-Level Encryption Decorators
+ *
+ * TypeScript decorators for marking class fields that require encryption.
+ * These decorators provide metadata that can be used by ORM middleware
+ * or other systems to automatically encrypt/decrypt fields.
+ *
+ * Features:
+ * - @Encrypted() - Mark a field for encryption with classification
+ * - @SearchableEncrypted() - Mark a field for deterministic encryption
+ * - Metadata reflection for runtime field discovery
+ * - Policy generation from decorated classes
+ *
+ * @example
+ * ```typescript
+ * class User {
+ *   @Encrypted(DataClassification.RESTRICTED)
+ *   ssn: string;
+ *
+ *   @SearchableEncrypted()
+ *   email: string;
+ *
+ *   @Encrypted(DataClassification.CONFIDENTIAL, { algorithm: 'chacha20-poly1305' })
+ *   phoneNumber: string;
+ * }
+ *
+ * // Get encrypted fields metadata
+ * const fields = getEncryptedFields(User);
+ * ```
+ *
+ * @packageDocumentation
+ * @module security/encryption/decorators
+ */
+import { DataClassification as Classification, } from './types.js';
+// =============================================================================
+// Metadata Storage
+// =============================================================================
+/**
+ * Symbol for storing encrypted field metadata
+ */
+const ENCRYPTED_FIELDS_KEY = Symbol('encryptedFields');
+/**
+ * Get or create the encrypted fields metadata array for a class
+ */
+function getOrCreateMetadataArray(target) {
+    // Use Object.getOwnPropertyDescriptor to check for own property
+    const existing = Object.getOwnPropertyDescriptor(target, ENCRYPTED_FIELDS_KEY);
+    if (existing && Array.isArray(existing.value)) {
+        return existing.value;
+    }
+    // Check prototype chain for inherited metadata
+    const inherited = target[ENCRYPTED_FIELDS_KEY];
+    const baseArray = Array.isArray(inherited)
+        ? [...inherited]
+        : [];
+    // Define own property
+    Object.defineProperty(target, ENCRYPTED_FIELDS_KEY, {
+        value: baseArray,
+        enumerable: false,
+        writable: true,
+        configurable: true,
+    });
+    return baseArray;
+}
+/**
+ * Get encrypted fields metadata from a class
+ */
+function getMetadataArray(target) {
+    const metadata = target[ENCRYPTED_FIELDS_KEY];
+    return Array.isArray(metadata) ? metadata : [];
+}
+// =============================================================================
+// Decorators
+// =============================================================================
+/**
+ * Decorator to mark a field for encryption
+ *
+ * Fields marked with this decorator will be automatically encrypted
+ * when stored and decrypted when retrieved, based on their classification.
+ *
+ * @param classification - The data classification level
+ * @param options - Additional encryption options
+ *
+ * @example
+ * ```typescript
+ * class Patient {
+ *   @Encrypted(DataClassification.RESTRICTED)
+ *   medicalRecordNumber: string;
+ *
+ *   @Encrypted(DataClassification.CONFIDENTIAL, {
+ *     algorithm: EncryptionAlgorithm.CHACHA20_POLY1305,
+ *     description: 'Patient phone number for contact'
+ *   })
+ *   phoneNumber: string;
+ * }
+ * ```
+ */
+export function Encrypted(classification, options = {}) {
+    return function (target, propertyKey) {
+        if (typeof propertyKey !== 'string') {
+            throw new Error('@Encrypted decorator can only be applied to string-named properties');
+        }
+        const metadata = getOrCreateMetadataArray(target.constructor.prototype);
+        // Check if this field already has metadata (from parent class)
+        const existingIndex = metadata.findIndex((m) => m.propertyKey === propertyKey);
+        const fieldMetadata = {
+            propertyKey,
+            classification,
+            encrypted: true,
+            deterministic: false,
+            algorithm: options.algorithm,
+            keyDerivationSuffix: options.keyDerivationSuffix,
+            description: options.description,
+        };
+        if (existingIndex >= 0) {
+            // Override inherited metadata
+            metadata[existingIndex] = fieldMetadata;
+        }
+        else {
+            metadata.push(fieldMetadata);
+        }
+    };
+}
+/**
+ * Decorator to mark a field for searchable (deterministic) encryption
+ *
+ * Fields marked with this decorator use deterministic encryption,
+ * which allows searching for exact matches while still encrypting data.
+ *
+ * Security note: Deterministic encryption is less secure than random IV
+ * encryption because identical plaintexts produce identical ciphertexts.
+ * Use only when searchability is required.
+ *
+ * @param options - Searchable encryption options
+ *
+ * @example
+ * ```typescript
+ * class User {
+ *   @SearchableEncrypted({
+ *     classification: DataClassification.CONFIDENTIAL,
+ *     description: 'User email for login lookup'
+ *   })
+ *   email: string;
+ *
+ *   @SearchableEncrypted()
+ *   externalId: string;
+ * }
+ * ```
+ */
+export function SearchableEncrypted(options = {}) {
+    return function (target, propertyKey) {
+        if (typeof propertyKey !== 'string') {
+            throw new Error('@SearchableEncrypted decorator can only be applied to string-named properties');
+        }
+        const metadata = getOrCreateMetadataArray(target.constructor.prototype);
+        // Check if this field already has metadata
+        const existingIndex = metadata.findIndex((m) => m.propertyKey === propertyKey);
+        const fieldMetadata = {
+            propertyKey,
+            classification: options.classification ?? Classification.CONFIDENTIAL,
+            encrypted: true,
+            deterministic: true,
+            keyDerivationSuffix: options.keyDerivationSuffix,
+            description: options.description,
+        };
+        if (existingIndex >= 0) {
+            metadata[existingIndex] = fieldMetadata;
+        }
+        else {
+            metadata.push(fieldMetadata);
+        }
+    };
+}
+/**
+ * Decorator to explicitly mark a field as not encrypted
+ *
+ * Useful when a parent class has encryption but a subclass field should not be encrypted.
+ *
+ * @param classification - The data classification (for documentation/policy)
+ *
+ * @example
+ * ```typescript
+ * class PublicProfile extends User {
+ *   @NotEncrypted(DataClassification.PUBLIC)
+ *   displayName: string;
+ * }
+ * ```
+ */
+export function NotEncrypted(classification) {
+    return function (target, propertyKey) {
+        if (typeof propertyKey !== 'string') {
+            throw new Error('@NotEncrypted decorator can only be applied to string-named properties');
+        }
+        const metadata = getOrCreateMetadataArray(target.constructor.prototype);
+        const existingIndex = metadata.findIndex((m) => m.propertyKey === propertyKey);
+        const fieldMetadata = {
+            propertyKey,
+            classification,
+            encrypted: false,
+            deterministic: false,
+        };
+        if (existingIndex >= 0) {
+            metadata[existingIndex] = fieldMetadata;
+        }
+        else {
+            metadata.push(fieldMetadata);
+        }
+    };
+}
+// =============================================================================
+// Metadata Access Functions
+// =============================================================================
+/**
+ * Get all encrypted field metadata from a class
+ *
+ * @param target - The class constructor or instance
+ * @returns Array of encrypted field metadata
+ *
+ * @example
+ * ```typescript
+ * class User {
+ *   @Encrypted(DataClassification.RESTRICTED)
+ *   ssn: string;
+ *
+ *   @SearchableEncrypted()
+ *   email: string;
+ * }
+ *
+ * const fields = getEncryptedFields(User);
+ * // [
+ * //   { propertyKey: 'ssn', classification: 'restricted', encrypted: true, deterministic: false },
+ * //   { propertyKey: 'email', classification: 'confidential', encrypted: true, deterministic: true }
+ * // ]
+ * ```
+ */
+export function getEncryptedFields(target) {
+    const prototype = typeof target === 'function' ? target.prototype : Object.getPrototypeOf(target);
+    return getMetadataArray(prototype);
+}
+/**
+ * Check if a class has any encrypted fields
+ *
+ * @param target - The class constructor or instance
+ * @returns True if the class has encrypted fields
+ */
+export function hasEncryptedFields(target) {
+    const fields = getEncryptedFields(target);
+    return fields.some((f) => f.encrypted);
+}
+/**
+ * Get metadata for a specific field
+ *
+ * @param target - The class constructor or instance
+ * @param propertyKey - The property name
+ * @returns Field metadata or undefined
+ */
+export function getFieldMetadata(target, propertyKey) {
+    const fields = getEncryptedFields(target);
+    return fields.find((f) => f.propertyKey === propertyKey);
+}
+/**
+ * Check if a specific field is encrypted
+ *
+ * @param target - The class constructor or instance
+ * @param propertyKey - The property name
+ * @returns True if the field is marked for encryption
+ */
+export function isFieldEncrypted(target, propertyKey) {
+    const metadata = getFieldMetadata(target, propertyKey);
+    return metadata?.encrypted ?? false;
+}
+/**
+ * Check if a specific field uses deterministic encryption
+ *
+ * @param target - The class constructor or instance
+ * @param propertyKey - The property name
+ * @returns True if the field uses deterministic encryption
+ */
+export function isFieldSearchable(target, propertyKey) {
+    const metadata = getFieldMetadata(target, propertyKey);
+    return metadata?.deterministic ?? false;
+}
+// =============================================================================
+// Policy Generation
+// =============================================================================
+/**
+ * Generate a FieldEncryptionPolicy from a decorated class
+ *
+ * This creates a policy object that can be used with the encryption service
+ * to encrypt/decrypt objects based on decorator metadata.
+ *
+ * @param target - The class constructor
+ * @param entityName - Optional entity name (defaults to class name)
+ * @returns Field encryption policy
+ *
+ * @example
+ * ```typescript
+ * class User {
+ *   @Encrypted(DataClassification.RESTRICTED)
+ *   ssn: string;
+ *
+ *   @SearchableEncrypted()
+ *   email: string;
+ * }
+ *
+ * const policy = generatePolicy(User);
+ * // {
+ * //   entityName: 'User',
+ * //   fields: [
+ * //     { fieldName: 'ssn', classification: 'restricted', encrypted: true },
+ * //     { fieldName: 'email', classification: 'confidential', encrypted: true, deterministic: true }
+ * //   ]
+ * // }
+ *
+ * // Use with encryption service
+ * const encrypted = await service.encryptObject(user, policy);
+ * ```
+ */
+export function generatePolicy(target, entityName) {
+    const fields = getEncryptedFields(target);
+    const name = entityName ?? target.name;
+    const fieldPolicies = fields.map((metadata) => ({
+        fieldName: metadata.propertyKey,
+        classification: metadata.classification,
+        encrypted: metadata.encrypted,
+        algorithm: metadata.algorithm,
+        deterministic: metadata.deterministic,
+        keyDerivationSuffix: metadata.keyDerivationSuffix,
+    }));
+    return {
+        entityName: name,
+        fields: fieldPolicies,
+    };
+}
+/**
+ * Generate policies for multiple classes
+ *
+ * @param classes - Array of class constructors
+ * @returns Map of entity names to policies
+ *
+ * @example
+ * ```typescript
+ * const policies = generatePolicies([User, Patient, Account]);
+ * // Map {
+ * //   'User' => { entityName: 'User', fields: [...] },
+ * //   'Patient' => { entityName: 'Patient', fields: [...] },
+ * //   'Account' => { entityName: 'Account', fields: [...] }
+ * // }
+ * ```
+ */
+export function generatePolicies(classes) {
+    const policies = new Map();
+    for (const cls of classes) {
+        const policy = generatePolicy(cls);
+        policies.set(policy.entityName, policy);
+    }
+    return policies;
+}
+//# sourceMappingURL=decorators.js.map

package/dist/security/encryption/decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../../src/security/encryption/decorators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAQH,OAAO,EACL,kBAAkB,IAAI,cAAc,GAErC,MAAM,YAAY,CAAC;AAEpB,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAsBvD;;GAEG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,gEAAgE;IAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAE/E,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,KAAiC,CAAC;IACpD,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAI,MAAkC,CAAC,oBAAoB,CAAC,CAAC;IAC5E,MAAM,SAAS,GAA6B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAClE,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;IAEP,sBAAsB;IACtB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,oBAAoB,EAAE;QAClD,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,QAAQ,GAAI,MAAkC,CAAC,oBAAoB,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AA8BD,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,SAAS,CACvB,cAAkC,EAClC,UAA4B,EAAE;IAE9B,OAAO,UAAU,MAAc,EAAE,WAA4B;QAC3D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAExE,+DAA+D;QAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QAE/E,MAAM,aAAa,GAA2B;YAC5C,WAAW;YACX,cAAc;YACd,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QAEF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACvB,8BAA8B;YAC9B,QAAQ,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAsC,EAAE;IAExC,OAAO,UAAU,MAAc,EAAE,WAA4B;QAC3D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAExE,2CAA2C;QAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QAE/E,MAAM,aAAa,GAA2B;YAC5C,WAAW;YACX,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,cAAc,CAAC,YAAY;YACrE,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QAEF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,cAAkC;IAC7D,OAAO,UAAU,MAAc,EAAE,WAA4B;QAC3D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QAE/E,MAAM,aAAa,GAA2B;YAC5C,WAAW;YACX,cAAc;YACd,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,KAAK;SACrB,CAAC;QAEF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAsD;IAEtD,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClG,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAsD;IAEtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAsD,EACtD,WAAmB;IAEnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAsD,EACtD,WAAmB;IAEnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,QAAQ,EAAE,SAAS,IAAI,KAAK,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAsD,EACtD,WAAmB;IAEnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,QAAQ,EAAE,aAAa,IAAI,KAAK,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA2C,EAC3C,UAAmB;IAEnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC;IAEvC,MAAM,aAAa,GAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7D,SAAS,EAAE,QAAQ,CAAC,WAAW;QAC/B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;KAClD,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmD;IAEnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/security/encryption/index.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Field-Level Encryption Module
+ *
+ * Provides transparent encryption for sensitive data fields stored in the database.
+ * This module implements secure field-level encryption with the following features:
+ *
+ * - **Multiple Algorithms**: AES-256-GCM (default), AES-256-CBC, ChaCha20-Poly1305
+ * - **Key Management**: Version-based key rotation with HKDF field-specific derivation
+ * - **Data Classification**: PUBLIC, INTERNAL, CONFIDENTIAL, RESTRICTED levels
+ * - **Decorator Support**: @Encrypted() and @SearchableEncrypted() for marking fields
+ * - **Database Middleware**: Transparent encryption/decryption with Drizzle ORM hooks
+ * - **Security Controls**: AAD binding, unique IVs, audit logging
+ *
+ * ## Quick Start
+ *
+ * ```typescript
+ * import {
+ *   FieldEncryptionService,
+ *   Encrypted,
+ *   SearchableEncrypted,
+ *   DataClassification,
+ *   createEncryptionMiddleware,
+ * } from './security/encryption';
+ *
+ * // 1. Define entity with encrypted fields
+ * class User {
+ *   @Encrypted(DataClassification.RESTRICTED)
+ *   ssn: string;
+ *
+ *   @SearchableEncrypted()
+ *   email: string;
+ * }
+ *
+ * // 2. Initialize service
+ * const service = getFieldEncryptionService();
+ * await service.initialize();
+ *
+ * // 3. Encrypt/decrypt fields
+ * const encrypted = await service.encrypt('123-45-6789', {
+ *   fieldName: 'ssn',
+ *   classification: DataClassification.RESTRICTED,
+ * });
+ *
+ * const plaintext = await service.decrypt(encrypted, { fieldName: 'ssn' });
+ * ```
+ *
+ * ## Database Integration
+ *
+ * ```typescript
+ * import { createMiddlewareFromClasses } from './security/encryption';
+ *
+ * const middleware = createMiddlewareFromClasses({
+ *   users: User,
+ *   patients: Patient,
+ * });
+ *
+ * await middleware.initialize();
+ *
+ * // Use with database operations
+ * const result = await middleware.beforeInsert(userData, {
+ *   tableName: 'users',
+ *   operation: 'insert',
+ * });
+ * ```
+ *
+ * ## Security Considerations
+ *
+ * - Master keys must be stored securely (environment variables, secrets manager)
+ * - Key rotation is supported via versioning
+ * - AAD binding prevents field swapping attacks
+ * - Deterministic encryption is less secure but enables searching
+ * - All operations are audit logged when enabled
+ *
+ * @packageDocumentation
+ * @module security/encryption
+ */
+export { EncryptionAlgorithm, DataClassification, EncryptionOperation, EncryptionErrorCode, CLASSIFICATION_LEVELS, type EncryptedField, type EncryptedFieldMarker, isEncryptedFieldMarker, encryptedFieldSchema, encryptedFieldMarkerSchema, type KeyVersion, keyVersionSchema, type EncryptionConfig, encryptionConfigSchema, DEFAULT_ENCRYPTION_CONFIG, type FieldPolicy, type FieldEncryptionPolicy, fieldPolicySchema, fieldEncryptionPolicySchema, type EncryptOptions, type DecryptOptions, type ReencryptOptions, encryptOptionsSchema, decryptOptionsSchema, reencryptOptionsSchema, type EncryptionAuditEntry, type AuditCallback, type KeyRotationCallback, encryptionAuditEntrySchema, encryptionAlgorithmSchema, dataClassificationSchema, } from './types.js';
+export { type KeyProvider, EnvKeyProvider, createEnvKeyProvider, KMSKeyProvider, createKMSKeyProvider, type KMSKeyProviderConfig, getKeyProvider, getInitializedKeyProvider, setKeyProvider, resetKeyProvider, createKeyProvider, } from './key-provider.js';
+export { type KMSProvider, type KMSConfig, type AWSKMSConfig, type VaultKMSConfig, type LocalKMSConfig, type KeyMetadata as KMSKeyMetadata, type DataKey, KMSProviderType, KMSErrorCode, KMSOperation, AWSKMSProvider, HashiCorpVaultProvider, LocalKMSProvider, createKMSProvider, createKMSProviderFromEnv, getKMSProvider, getInitializedKMSProvider, setKMSProvider, resetKMSProvider, checkKMSHealth, type KMSHealthStatus, isKMSConfigured, detectKMSProviderType, } from '../kms/index.js';
+export { FieldEncryptionError, FieldEncryptionService, createFieldEncryptionService, getFieldEncryptionService, setFieldEncryptionService, resetFieldEncryptionService, } from './service.js';
+export { Encrypted, SearchableEncrypted, NotEncrypted, getEncryptedFields, hasEncryptedFields, getFieldMetadata, isFieldEncrypted, isFieldSearchable, generatePolicy, generatePolicies, type EncryptedFieldMetadata, type EncryptedOptions, type SearchableEncryptedOptions, type EncryptedFieldNames, type WithEncryptedFields, } from './decorators.js';
+export { EncryptionMiddleware, createEncryptionMiddleware, createMiddlewareFromClasses, getEncryptionMiddleware, setEncryptionMiddleware, resetEncryptionMiddleware, PolicyBuilder, policyBuilder, type TablePolicy, type EncryptionMiddlewareConfig, type OperationContext, type HookResult, type DrizzleEncryptionConfig, } from './middleware.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/encryption/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/encryption/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAMH,OAAO,EAEL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EAGrB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAG1B,KAAK,UAAU,EACf,gBAAgB,EAGhB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,yBAAyB,EAGzB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,iBAAiB,EACjB,2BAA2B,EAG3B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EAGtB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,0BAA0B,EAG1B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAEL,KAAK,WAAW,EAGhB,cAAc,EACd,oBAAoB,EAGpB,cAAc,EACd,oBAAoB,EACpB,KAAK,oBAAoB,EAGzB,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,IAAI,cAAc,EAClC,KAAK,OAAO,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EAGZ,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAGhB,iBAAiB,EACjB,wBAAwB,EAGxB,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,gBAAgB,EAGhB,cAAc,EACd,KAAK,eAAe,EAGpB,eAAe,EACf,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAEL,oBAAoB,EAGpB,sBAAsB,EACtB,4BAA4B,EAG5B,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAMtB,OAAO,EAEL,SAAS,EACT,mBAAmB,EACnB,YAAY,EAGZ,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EAGjB,cAAc,EACd,gBAAgB,EAGhB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAEL,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAG3B,uBAAuB,EACvB,uBAAuB,EACvB,yBAAyB,EAGzB,aAAa,EACb,aAAa,EAGb,KAAK,WAAW,EAChB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC"}

package/dist/security/encryption/index.js

@@ -0,0 +1,140 @@
+/**
+ * Field-Level Encryption Module
+ *
+ * Provides transparent encryption for sensitive data fields stored in the database.
+ * This module implements secure field-level encryption with the following features:
+ *
+ * - **Multiple Algorithms**: AES-256-GCM (default), AES-256-CBC, ChaCha20-Poly1305
+ * - **Key Management**: Version-based key rotation with HKDF field-specific derivation
+ * - **Data Classification**: PUBLIC, INTERNAL, CONFIDENTIAL, RESTRICTED levels
+ * - **Decorator Support**: @Encrypted() and @SearchableEncrypted() for marking fields
+ * - **Database Middleware**: Transparent encryption/decryption with Drizzle ORM hooks
+ * - **Security Controls**: AAD binding, unique IVs, audit logging
+ *
+ * ## Quick Start
+ *
+ * ```typescript
+ * import {
+ *   FieldEncryptionService,
+ *   Encrypted,
+ *   SearchableEncrypted,
+ *   DataClassification,
+ *   createEncryptionMiddleware,
+ * } from './security/encryption';
+ *
+ * // 1. Define entity with encrypted fields
+ * class User {
+ *   @Encrypted(DataClassification.RESTRICTED)
+ *   ssn: string;
+ *
+ *   @SearchableEncrypted()
+ *   email: string;
+ * }
+ *
+ * // 2. Initialize service
+ * const service = getFieldEncryptionService();
+ * await service.initialize();
+ *
+ * // 3. Encrypt/decrypt fields
+ * const encrypted = await service.encrypt('123-45-6789', {
+ *   fieldName: 'ssn',
+ *   classification: DataClassification.RESTRICTED,
+ * });
+ *
+ * const plaintext = await service.decrypt(encrypted, { fieldName: 'ssn' });
+ * ```
+ *
+ * ## Database Integration
+ *
+ * ```typescript
+ * import { createMiddlewareFromClasses } from './security/encryption';
+ *
+ * const middleware = createMiddlewareFromClasses({
+ *   users: User,
+ *   patients: Patient,
+ * });
+ *
+ * await middleware.initialize();
+ *
+ * // Use with database operations
+ * const result = await middleware.beforeInsert(userData, {
+ *   tableName: 'users',
+ *   operation: 'insert',
+ * });
+ * ```
+ *
+ * ## Security Considerations
+ *
+ * - Master keys must be stored securely (environment variables, secrets manager)
+ * - Key rotation is supported via versioning
+ * - AAD binding prevents field swapping attacks
+ * - Deterministic encryption is less secure but enables searching
+ * - All operations are audit logged when enabled
+ *
+ * @packageDocumentation
+ * @module security/encryption
+ */
+// =============================================================================
+// Types
+// =============================================================================
+export { 
+// Enums
+EncryptionAlgorithm, DataClassification, EncryptionOperation, EncryptionErrorCode, CLASSIFICATION_LEVELS, isEncryptedFieldMarker, encryptedFieldSchema, encryptedFieldMarkerSchema, keyVersionSchema, encryptionConfigSchema, DEFAULT_ENCRYPTION_CONFIG, fieldPolicySchema, fieldEncryptionPolicySchema, encryptOptionsSchema, decryptOptionsSchema, reencryptOptionsSchema, encryptionAuditEntrySchema, 
+// Zod Schemas
+encryptionAlgorithmSchema, dataClassificationSchema, } from './types.js';
+// =============================================================================
+// Key Provider
+// =============================================================================
+export { 
+// Environment-based Implementation
+EnvKeyProvider, createEnvKeyProvider, 
+// KMS-based Implementation (Envelope Encryption)
+KMSKeyProvider, createKMSKeyProvider, 
+// Singleton
+getKeyProvider, getInitializedKeyProvider, setKeyProvider, resetKeyProvider, createKeyProvider, } from './key-provider.js';
+// =============================================================================
+// KMS Integration
+// =============================================================================
+// Re-export KMS module for convenient access
+export { KMSProviderType, KMSErrorCode, KMSOperation, 
+// Providers
+AWSKMSProvider, HashiCorpVaultProvider, LocalKMSProvider, 
+// Factory
+createKMSProvider, createKMSProviderFromEnv, 
+// Singleton
+getKMSProvider, getInitializedKMSProvider, setKMSProvider, resetKMSProvider, 
+// Health
+checkKMSHealth, 
+// Utilities
+isKMSConfigured, detectKMSProviderType, } from '../kms/index.js';
+// =============================================================================
+// Encryption Service
+// =============================================================================
+export { 
+// Error
+FieldEncryptionError, 
+// Service
+FieldEncryptionService, createFieldEncryptionService, 
+// Singleton
+getFieldEncryptionService, setFieldEncryptionService, resetFieldEncryptionService, } from './service.js';
+// =============================================================================
+// Decorators
+// =============================================================================
+export { 
+// Decorators
+Encrypted, SearchableEncrypted, NotEncrypted, 
+// Metadata Access
+getEncryptedFields, hasEncryptedFields, getFieldMetadata, isFieldEncrypted, isFieldSearchable, 
+// Policy Generation
+generatePolicy, generatePolicies, } from './decorators.js';
+// =============================================================================
+// Middleware
+// =============================================================================
+export { 
+// Middleware
+EncryptionMiddleware, createEncryptionMiddleware, createMiddlewareFromClasses, 
+// Singleton
+getEncryptionMiddleware, setEncryptionMiddleware, resetEncryptionMiddleware, 
+// Policy Builder
+PolicyBuilder, policyBuilder, } from './middleware.js';
+//# sourceMappingURL=index.js.map

package/dist/security/encryption/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/encryption/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,gFAAgF;AAChF,QAAQ;AACR,gFAAgF;AAEhF,OAAO;AACL,QAAQ;AACR,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EAKrB,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAI1B,gBAAgB,EAIhB,sBAAsB,EACtB,yBAAyB,EAKzB,iBAAiB,EACjB,2BAA2B,EAM3B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EAMtB,0BAA0B;AAE1B,cAAc;AACd,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAEpB,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,OAAO;AAIL,mCAAmC;AACnC,cAAc,EACd,oBAAoB;AAEpB,iDAAiD;AACjD,cAAc,EACd,oBAAoB;AAGpB,YAAY;AACZ,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,6CAA6C;AAC7C,OAAO,EASL,eAAe,EACf,YAAY,EACZ,YAAY;AAEZ,YAAY;AACZ,cAAc,EACd,sBAAsB,EACtB,gBAAgB;AAEhB,UAAU;AACV,iBAAiB,EACjB,wBAAwB;AAExB,YAAY;AACZ,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,gBAAgB;AAEhB,SAAS;AACT,cAAc;AAGd,YAAY;AACZ,eAAe,EACf,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,OAAO;AACL,QAAQ;AACR,oBAAoB;AAEpB,UAAU;AACV,sBAAsB,EACtB,4BAA4B;AAE5B,YAAY;AACZ,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,OAAO;AACL,aAAa;AACb,SAAS,EACT,mBAAmB,EACnB,YAAY;AAEZ,kBAAkB;AAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB;AAEjB,oBAAoB;AACpB,cAAc,EACd,gBAAgB,GAQjB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,OAAO;AACL,aAAa;AACb,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B;AAE3B,YAAY;AACZ,uBAAuB,EACvB,uBAAuB,EACvB,yBAAyB;AAEzB,iBAAiB;AACjB,aAAa,EACb,aAAa,GAQd,MAAM,iBAAiB,CAAC"}