@vorionsys/platform-core 0.1.0

package/dist/security/kms/types.d.ts

@@ -0,0 +1,1000 @@
+/**
+ * Key Management Service (KMS) Types
+ *
+ * Type definitions for KMS provider implementations supporting:
+ * - AWS KMS
+ * - HashiCorp Vault
+ * - Local development provider
+ *
+ * Implements envelope encryption pattern where data keys are
+ * encrypted by master keys stored in the KMS.
+ *
+ * @packageDocumentation
+ * @module security/kms/types
+ */
+import { z } from 'zod';
+/**
+ * Status of a KMS key
+ */
+export declare const KeyStatus: {
+    /** Key is enabled and can be used for encryption/decryption */
+    readonly ENABLED: "enabled";
+    /** Key is disabled and cannot be used */
+    readonly DISABLED: "disabled";
+    /** Key is pending deletion */
+    readonly PENDING_DELETION: "pending_deletion";
+    /** Key is pending import (for imported keys) */
+    readonly PENDING_IMPORT: "pending_import";
+    /** Key is unavailable (service issue) */
+    readonly UNAVAILABLE: "unavailable";
+};
+export type KeyStatus = (typeof KeyStatus)[keyof typeof KeyStatus];
+export declare const keyStatusSchema: z.ZodNativeEnum<{
+    /** Key is enabled and can be used for encryption/decryption */
+    readonly ENABLED: "enabled";
+    /** Key is disabled and cannot be used */
+    readonly DISABLED: "disabled";
+    /** Key is pending deletion */
+    readonly PENDING_DELETION: "pending_deletion";
+    /** Key is pending import (for imported keys) */
+    readonly PENDING_IMPORT: "pending_import";
+    /** Key is unavailable (service issue) */
+    readonly UNAVAILABLE: "unavailable";
+}>;
+/**
+ * Metadata for a KMS key
+ */
+export interface KeyMetadata {
+    /** Unique key identifier */
+    id: string;
+    /** ARN or URI for the key (provider-specific) */
+    arn: string;
+    /** Key version number (for rotation tracking) */
+    version: number;
+    /** When the key was created */
+    createdAt: Date;
+    /** When the key was last rotated */
+    rotatedAt?: Date;
+    /** Current key status */
+    status: KeyStatus;
+    /** Key description */
+    description?: string;
+    /** Key alias or name */
+    alias?: string;
+    /** Key type (e.g., 'symmetric', 'asymmetric') */
+    keyType?: string;
+    /** Key usage (e.g., 'encrypt_decrypt', 'sign_verify') */
+    keyUsage?: string;
+    /** Provider-specific metadata */
+    providerMetadata?: Record<string, unknown>;
+}
+export declare const keyMetadataSchema: z.ZodObject<{
+    id: z.ZodString;
+    arn: z.ZodString;
+    version: z.ZodNumber;
+    createdAt: z.ZodDate;
+    rotatedAt: z.ZodOptional<z.ZodDate>;
+    status: z.ZodNativeEnum<{
+        /** Key is enabled and can be used for encryption/decryption */
+        readonly ENABLED: "enabled";
+        /** Key is disabled and cannot be used */
+        readonly DISABLED: "disabled";
+        /** Key is pending deletion */
+        readonly PENDING_DELETION: "pending_deletion";
+        /** Key is pending import (for imported keys) */
+        readonly PENDING_IMPORT: "pending_import";
+        /** Key is unavailable (service issue) */
+        readonly UNAVAILABLE: "unavailable";
+    }>;
+    description: z.ZodOptional<z.ZodString>;
+    alias: z.ZodOptional<z.ZodString>;
+    keyType: z.ZodOptional<z.ZodString>;
+    keyUsage: z.ZodOptional<z.ZodString>;
+    providerMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    version?: number;
+    id?: string;
+    description?: string;
+    status?: "enabled" | "disabled" | "unavailable" | "pending_deletion" | "pending_import";
+    createdAt?: Date;
+    keyType?: string;
+    rotatedAt?: Date;
+    alias?: string;
+    keyUsage?: string;
+    arn?: string;
+    providerMetadata?: Record<string, unknown>;
+}, {
+    version?: number;
+    id?: string;
+    description?: string;
+    status?: "enabled" | "disabled" | "unavailable" | "pending_deletion" | "pending_import";
+    createdAt?: Date;
+    keyType?: string;
+    rotatedAt?: Date;
+    alias?: string;
+    keyUsage?: string;
+    arn?: string;
+    providerMetadata?: Record<string, unknown>;
+}>;
+/**
+ * Data key for envelope encryption
+ *
+ * Contains both the plaintext key (for immediate use) and
+ * encrypted key (for storage). The plaintext should be cleared
+ * from memory after use.
+ */
+export interface DataKey {
+    /** Plaintext data key (clear after use!) */
+    plaintext: Buffer;
+    /** Encrypted data key (safe to store) */
+    ciphertext: Buffer;
+    /** Key ID that encrypted this data key */
+    keyId: string;
+    /** Key version used for encryption */
+    keyVersion: number;
+    /** Algorithm used for the data key */
+    algorithm: string;
+    /** When this data key was generated */
+    generatedAt: Date;
+    /** When this data key expires (for cache TTL) */
+    expiresAt?: Date;
+}
+/**
+ * Cached data key with TTL
+ */
+export interface CachedDataKey {
+    /** The data key */
+    dataKey: DataKey;
+    /** Cache entry creation time */
+    cachedAt: Date;
+    /** Cache entry expiration time */
+    expiresAt: Date;
+    /** Number of times this key has been used */
+    usageCount: number;
+    /** Maximum allowed usages before requiring refresh */
+    maxUsages?: number;
+}
+/**
+ * Options for encrypt operation
+ */
+export interface KMSEncryptOptions {
+    /** Key ID to use for encryption */
+    keyId?: string;
+    /** Encryption context (AAD) */
+    encryptionContext?: Record<string, string>;
+    /** Algorithm to use */
+    algorithm?: string;
+}
+/**
+ * Options for decrypt operation
+ */
+export interface KMSDecryptOptions {
+    /** Key ID to use for decryption (may be auto-detected) */
+    keyId?: string;
+    /** Encryption context (AAD) - must match encryption */
+    encryptionContext?: Record<string, string>;
+    /** Algorithm to use */
+    algorithm?: string;
+}
+/**
+ * Options for data key generation
+ */
+export interface GenerateDataKeyOptions {
+    /** Key ID to use for encrypting the data key */
+    keyId?: string;
+    /** Length of the data key in bytes */
+    keyLength?: number;
+    /** Encryption context (AAD) */
+    encryptionContext?: Record<string, string>;
+}
+/**
+ * Result of encryption operation
+ */
+export interface EncryptResult {
+    /** Encrypted ciphertext */
+    ciphertext: Buffer;
+    /** Key ID used for encryption */
+    keyId: string;
+    /** Key version used */
+    keyVersion: number;
+    /** Algorithm used */
+    algorithm: string;
+}
+/**
+ * Result of decryption operation
+ */
+export interface DecryptResult {
+    /** Decrypted plaintext */
+    plaintext: Buffer;
+    /** Key ID used for decryption */
+    keyId: string;
+    /** Key version used */
+    keyVersion: number;
+}
+/**
+ * Key rotation result
+ */
+export interface KeyRotationResult {
+    /** Key ID that was rotated */
+    keyId: string;
+    /** Previous key version */
+    previousVersion: number;
+    /** New key version */
+    newVersion: number;
+    /** When rotation occurred */
+    rotatedAt: Date;
+}
+/**
+ * Key rotation schedule
+ */
+export interface KeyRotationSchedule {
+    /** Whether automatic rotation is enabled */
+    enabled: boolean;
+    /** Rotation period in days */
+    rotationPeriodDays?: number;
+    /** Next scheduled rotation */
+    nextRotationTime?: Date;
+    /** Last rotation time */
+    lastRotationTime?: Date;
+}
+/**
+ * Interface for KMS providers
+ *
+ * Implementations must provide methods for:
+ * - Getting key metadata
+ * - Encrypting/decrypting data
+ * - Generating data keys (envelope encryption)
+ * - Key rotation
+ * - Listing keys
+ *
+ * @example
+ * ```typescript
+ * const provider = new AWSKMSProvider(config);
+ * await provider.initialize();
+ *
+ * // Generate a data key for envelope encryption
+ * const dataKey = await provider.generateDataKey({
+ *   keyId: 'alias/my-key',
+ *   keyLength: 32,
+ * });
+ *
+ * // Use plaintext for encryption, store ciphertext
+ * const encrypted = encrypt(data, dataKey.plaintext);
+ * store(encrypted, dataKey.ciphertext);
+ *
+ * // Clear plaintext from memory
+ * dataKey.plaintext.fill(0);
+ * ```
+ */
+export interface KMSProvider {
+    /** Provider name (e.g., 'aws', 'vault', 'local') */
+    readonly name: string;
+    /**
+     * Initialize the provider
+     *
+     * Must be called before any other operations.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Shutdown the provider and cleanup resources
+     */
+    shutdown(): Promise<void>;
+    /**
+     * Check if the provider is healthy and connected
+     */
+    healthCheck(): Promise<boolean>;
+    /**
+     * Get metadata for a specific key
+     *
+     * @param keyId - Key ID or alias
+     * @returns Key metadata or null if not found
+     */
+    getKey(keyId: string): Promise<KeyMetadata | null>;
+    /**
+     * List all available keys
+     *
+     * @param options - List options
+     * @returns Array of key metadata
+     */
+    listKeys(options?: ListKeysOptions): Promise<KeyMetadata[]>;
+    /**
+     * Encrypt data using a KMS key
+     *
+     * @param plaintext - Data to encrypt
+     * @param options - Encryption options
+     * @returns Encrypted result
+     */
+    encrypt(plaintext: Buffer, options?: KMSEncryptOptions): Promise<EncryptResult>;
+    /**
+     * Decrypt data using a KMS key
+     *
+     * @param ciphertext - Data to decrypt
+     * @param options - Decryption options
+     * @returns Decrypted result
+     */
+    decrypt(ciphertext: Buffer, options?: KMSDecryptOptions): Promise<DecryptResult>;
+    /**
+     * Generate a data key for envelope encryption
+     *
+     * Returns both plaintext (for immediate use) and encrypted
+     * (for storage) versions of the data key.
+     *
+     * @param options - Data key generation options
+     * @returns Data key with plaintext and ciphertext
+     */
+    generateDataKey(options?: GenerateDataKeyOptions): Promise<DataKey>;
+    /**
+     * Decrypt a previously generated data key
+     *
+     * @param encryptedDataKey - The encrypted data key
+     * @param options - Decryption options
+     * @returns Plaintext data key
+     */
+    decryptDataKey(encryptedDataKey: Buffer, options?: KMSDecryptOptions): Promise<Buffer>;
+    /**
+     * Rotate a key to a new version
+     *
+     * @param keyId - Key ID to rotate
+     * @returns Rotation result
+     */
+    rotateKey(keyId: string): Promise<KeyRotationResult>;
+    /**
+     * Get the rotation schedule for a key
+     *
+     * @param keyId - Key ID
+     * @returns Rotation schedule
+     */
+    getRotationSchedule?(keyId: string): Promise<KeyRotationSchedule>;
+    /**
+     * Enable automatic key rotation
+     *
+     * @param keyId - Key ID
+     * @param rotationPeriodDays - Rotation period in days
+     */
+    enableAutoRotation?(keyId: string, rotationPeriodDays?: number): Promise<void>;
+    /**
+     * Disable automatic key rotation
+     *
+     * @param keyId - Key ID
+     */
+    disableAutoRotation?(keyId: string): Promise<void>;
+}
+/**
+ * Options for listing keys
+ */
+export interface ListKeysOptions {
+    /** Maximum number of keys to return */
+    limit?: number;
+    /** Pagination token */
+    nextToken?: string;
+    /** Filter by key status */
+    status?: KeyStatus;
+}
+/**
+ * KMS provider types
+ */
+export declare const KMSProviderType: {
+    /** AWS Key Management Service */
+    readonly AWS: "aws";
+    /** HashiCorp Vault */
+    readonly VAULT: "vault";
+    /** Local development provider */
+    readonly LOCAL: "local";
+};
+export type KMSProviderType = (typeof KMSProviderType)[keyof typeof KMSProviderType];
+export declare const kmsProviderTypeSchema: z.ZodNativeEnum<{
+    /** AWS Key Management Service */
+    readonly AWS: "aws";
+    /** HashiCorp Vault */
+    readonly VAULT: "vault";
+    /** Local development provider */
+    readonly LOCAL: "local";
+}>;
+/**
+ * Base KMS configuration
+ */
+export interface KMSConfigBase {
+    /** Provider type */
+    provider: KMSProviderType;
+    /** Default key ID to use */
+    defaultKeyId?: string;
+    /** Enable caching of data keys */
+    enableCaching?: boolean;
+    /** Cache TTL in seconds */
+    cacheTtlSeconds?: number;
+    /** Maximum cached data key usages */
+    maxCacheUsages?: number;
+    /** Enable audit logging */
+    enableAuditLogging?: boolean;
+    /** Retry configuration */
+    retry?: {
+        /** Maximum retry attempts */
+        maxAttempts?: number;
+        /** Initial retry delay in ms */
+        initialDelayMs?: number;
+        /** Maximum retry delay in ms */
+        maxDelayMs?: number;
+    };
+}
+/**
+ * AWS KMS specific configuration
+ */
+export interface AWSKMSConfig extends KMSConfigBase {
+    provider: 'aws';
+    /** AWS region */
+    region?: string;
+    /** KMS key ARN or alias */
+    keyArn: string;
+    /** AWS access key ID (optional, uses default credential chain) */
+    accessKeyId?: string;
+    /** AWS secret access key (optional, uses default credential chain) */
+    secretAccessKey?: string;
+    /** AWS endpoint (for LocalStack, etc.) */
+    endpoint?: string;
+}
+/**
+ * HashiCorp Vault specific configuration
+ */
+export interface VaultKMSConfig extends KMSConfigBase {
+    provider: 'vault';
+    /** Vault server address */
+    address: string;
+    /** Vault token */
+    token?: string;
+    /** Path to token file */
+    tokenFile?: string;
+    /** Transit secrets engine mount path */
+    transitMount?: string;
+    /** Key name in transit engine */
+    keyName: string;
+    /** Enable token renewal */
+    enableTokenRenewal?: boolean;
+    /** Token renewal interval in seconds */
+    tokenRenewalIntervalSeconds?: number;
+    /** Vault namespace (enterprise feature) */
+    namespace?: string;
+    /** TLS configuration */
+    tls?: {
+        /** CA certificate path */
+        caCert?: string;
+        /** Client certificate path */
+        clientCert?: string;
+        /** Client key path */
+        clientKey?: string;
+        /** Skip TLS verification (NOT for production) */
+        skipVerify?: boolean;
+    };
+}
+/**
+ * Local KMS specific configuration (development only)
+ */
+export interface LocalKMSConfig extends KMSConfigBase {
+    provider: 'local';
+    /** Master key (base64 encoded) - NOT for production */
+    masterKey?: string;
+    /** Path to key file */
+    keyFile?: string;
+    /** Environment variable containing the key */
+    keyEnvVar?: string;
+    /** Suppress production warnings (for testing) */
+    suppressWarnings?: boolean;
+}
+/**
+ * Union of all KMS configurations
+ */
+export type KMSConfig = AWSKMSConfig | VaultKMSConfig | LocalKMSConfig;
+export declare const awsKmsConfigSchema: z.ZodObject<{
+    defaultKeyId: z.ZodOptional<z.ZodString>;
+    enableCaching: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    maxCacheUsages: z.ZodDefault<z.ZodNumber>;
+    enableAuditLogging: z.ZodDefault<z.ZodBoolean>;
+    retry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodDefault<z.ZodNumber>;
+        initialDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxDelayMs: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }>>;
+} & {
+    provider: z.ZodLiteral<"aws">;
+    region: z.ZodOptional<z.ZodString>;
+    keyArn: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    provider?: "aws";
+    enableAuditLogging?: boolean;
+    region?: string;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    endpoint?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    keyArn?: string;
+}, {
+    provider?: "aws";
+    enableAuditLogging?: boolean;
+    region?: string;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    endpoint?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    keyArn?: string;
+}>;
+export declare const vaultKmsConfigSchema: z.ZodObject<{
+    defaultKeyId: z.ZodOptional<z.ZodString>;
+    enableCaching: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    maxCacheUsages: z.ZodDefault<z.ZodNumber>;
+    enableAuditLogging: z.ZodDefault<z.ZodBoolean>;
+    retry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodDefault<z.ZodNumber>;
+        initialDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxDelayMs: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }>>;
+} & {
+    provider: z.ZodLiteral<"vault">;
+    address: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    tokenFile: z.ZodOptional<z.ZodString>;
+    transitMount: z.ZodDefault<z.ZodString>;
+    keyName: z.ZodString;
+    enableTokenRenewal: z.ZodDefault<z.ZodBoolean>;
+    tokenRenewalIntervalSeconds: z.ZodDefault<z.ZodNumber>;
+    namespace: z.ZodOptional<z.ZodString>;
+    tls: z.ZodOptional<z.ZodObject<{
+        caCert: z.ZodOptional<z.ZodString>;
+        clientCert: z.ZodOptional<z.ZodString>;
+        clientKey: z.ZodOptional<z.ZodString>;
+        skipVerify: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        caCert?: string;
+        clientCert?: string;
+        clientKey?: string;
+        skipVerify?: boolean;
+    }, {
+        caCert?: string;
+        clientCert?: string;
+        clientKey?: string;
+        skipVerify?: boolean;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    token?: string;
+    namespace?: string;
+    provider?: "vault";
+    enableAuditLogging?: boolean;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    keyName?: string;
+    address?: string;
+    tls?: {
+        caCert?: string;
+        clientCert?: string;
+        clientKey?: string;
+        skipVerify?: boolean;
+    };
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    tokenFile?: string;
+    transitMount?: string;
+    enableTokenRenewal?: boolean;
+    tokenRenewalIntervalSeconds?: number;
+}, {
+    token?: string;
+    namespace?: string;
+    provider?: "vault";
+    enableAuditLogging?: boolean;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    keyName?: string;
+    address?: string;
+    tls?: {
+        caCert?: string;
+        clientCert?: string;
+        clientKey?: string;
+        skipVerify?: boolean;
+    };
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    tokenFile?: string;
+    transitMount?: string;
+    enableTokenRenewal?: boolean;
+    tokenRenewalIntervalSeconds?: number;
+}>;
+export declare const localKmsConfigSchema: z.ZodObject<{
+    defaultKeyId: z.ZodOptional<z.ZodString>;
+    enableCaching: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    maxCacheUsages: z.ZodDefault<z.ZodNumber>;
+    enableAuditLogging: z.ZodDefault<z.ZodBoolean>;
+    retry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodDefault<z.ZodNumber>;
+        initialDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxDelayMs: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }>>;
+} & {
+    provider: z.ZodLiteral<"local">;
+    masterKey: z.ZodOptional<z.ZodString>;
+    keyFile: z.ZodOptional<z.ZodString>;
+    keyEnvVar: z.ZodDefault<z.ZodString>;
+    suppressWarnings: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    provider?: "local";
+    enableAuditLogging?: boolean;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    masterKey?: string;
+    keyFile?: string;
+    keyEnvVar?: string;
+    suppressWarnings?: boolean;
+}, {
+    provider?: "local";
+    enableAuditLogging?: boolean;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    masterKey?: string;
+    keyFile?: string;
+    keyEnvVar?: string;
+    suppressWarnings?: boolean;
+}>;
+export declare const kmsConfigSchema: z.ZodDiscriminatedUnion<"provider", [z.ZodObject<{
+    defaultKeyId: z.ZodOptional<z.ZodString>;
+    enableCaching: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    maxCacheUsages: z.ZodDefault<z.ZodNumber>;
+    enableAuditLogging: z.ZodDefault<z.ZodBoolean>;
+    retry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodDefault<z.ZodNumber>;
+        initialDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxDelayMs: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }>>;
+} & {
+    provider: z.ZodLiteral<"aws">;
+    region: z.ZodOptional<z.ZodString>;
+    keyArn: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    provider?: "aws";
+    enableAuditLogging?: boolean;
+    region?: string;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    endpoint?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    keyArn?: string;
+}, {
+    provider?: "aws";
+    enableAuditLogging?: boolean;
+    region?: string;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    endpoint?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    keyArn?: string;
+}>, z.ZodObject<{
+    defaultKeyId: z.ZodOptional<z.ZodString>;
+    enableCaching: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    maxCacheUsages: z.ZodDefault<z.ZodNumber>;
+    enableAuditLogging: z.ZodDefault<z.ZodBoolean>;
+    retry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodDefault<z.ZodNumber>;
+        initialDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxDelayMs: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }>>;
+} & {
+    provider: z.ZodLiteral<"vault">;
+    address: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    tokenFile: z.ZodOptional<z.ZodString>;
+    transitMount: z.ZodDefault<z.ZodString>;
+    keyName: z.ZodString;
+    enableTokenRenewal: z.ZodDefault<z.ZodBoolean>;
+    tokenRenewalIntervalSeconds: z.ZodDefault<z.ZodNumber>;
+    namespace: z.ZodOptional<z.ZodString>;
+    tls: z.ZodOptional<z.ZodObject<{
+        caCert: z.ZodOptional<z.ZodString>;
+        clientCert: z.ZodOptional<z.ZodString>;
+        clientKey: z.ZodOptional<z.ZodString>;
+        skipVerify: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        caCert?: string;
+        clientCert?: string;
+        clientKey?: string;
+        skipVerify?: boolean;
+    }, {
+        caCert?: string;
+        clientCert?: string;
+        clientKey?: string;
+        skipVerify?: boolean;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    token?: string;
+    namespace?: string;
+    provider?: "vault";
+    enableAuditLogging?: boolean;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    keyName?: string;
+    address?: string;
+    tls?: {
+        caCert?: string;
+        clientCert?: string;
+        clientKey?: string;
+        skipVerify?: boolean;
+    };
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    tokenFile?: string;
+    transitMount?: string;
+    enableTokenRenewal?: boolean;
+    tokenRenewalIntervalSeconds?: number;
+}, {
+    token?: string;
+    namespace?: string;
+    provider?: "vault";
+    enableAuditLogging?: boolean;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    keyName?: string;
+    address?: string;
+    tls?: {
+        caCert?: string;
+        clientCert?: string;
+        clientKey?: string;
+        skipVerify?: boolean;
+    };
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    tokenFile?: string;
+    transitMount?: string;
+    enableTokenRenewal?: boolean;
+    tokenRenewalIntervalSeconds?: number;
+}>, z.ZodObject<{
+    defaultKeyId: z.ZodOptional<z.ZodString>;
+    enableCaching: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    maxCacheUsages: z.ZodDefault<z.ZodNumber>;
+    enableAuditLogging: z.ZodDefault<z.ZodBoolean>;
+    retry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodDefault<z.ZodNumber>;
+        initialDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxDelayMs: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }, {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    }>>;
+} & {
+    provider: z.ZodLiteral<"local">;
+    masterKey: z.ZodOptional<z.ZodString>;
+    keyFile: z.ZodOptional<z.ZodString>;
+    keyEnvVar: z.ZodDefault<z.ZodString>;
+    suppressWarnings: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    provider?: "local";
+    enableAuditLogging?: boolean;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    masterKey?: string;
+    keyFile?: string;
+    keyEnvVar?: string;
+    suppressWarnings?: boolean;
+}, {
+    provider?: "local";
+    enableAuditLogging?: boolean;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    enableCaching?: boolean;
+    defaultKeyId?: string;
+    cacheTtlSeconds?: number;
+    maxCacheUsages?: number;
+    masterKey?: string;
+    keyFile?: string;
+    keyEnvVar?: string;
+    suppressWarnings?: boolean;
+}>]>;
+/**
+ * KMS operation types for audit logging
+ */
+export declare const KMSOperation: {
+    readonly ENCRYPT: "kms_encrypt";
+    readonly DECRYPT: "kms_decrypt";
+    readonly GENERATE_DATA_KEY: "kms_generate_data_key";
+    readonly DECRYPT_DATA_KEY: "kms_decrypt_data_key";
+    readonly ROTATE_KEY: "kms_rotate_key";
+    readonly GET_KEY: "kms_get_key";
+    readonly LIST_KEYS: "kms_list_keys";
+};
+export type KMSOperation = (typeof KMSOperation)[keyof typeof KMSOperation];
+/**
+ * Audit log entry for KMS operations
+ */
+export interface KMSAuditEntry {
+    /** Unique audit entry ID */
+    id: string;
+    /** Timestamp of the operation */
+    timestamp: Date;
+    /** Type of operation */
+    operation: KMSOperation;
+    /** KMS provider used */
+    provider: KMSProviderType;
+    /** Key ID used */
+    keyId?: string;
+    /** Key version used */
+    keyVersion?: number;
+    /** Whether the operation succeeded */
+    success: boolean;
+    /** Error message if failed */
+    error?: string;
+    /** Duration in milliseconds */
+    durationMs: number;
+    /** User ID if available */
+    userId?: string;
+    /** Tenant ID if available */
+    tenantId?: string;
+    /** Request ID for correlation */
+    requestId?: string;
+    /** Whether result came from cache */
+    fromCache?: boolean;
+}
+/**
+ * Callback for KMS audit logging
+ */
+export type KMSAuditCallback = (entry: KMSAuditEntry) => void | Promise<void>;
+/**
+ * Error codes for KMS operations
+ */
+export declare const KMSErrorCode: {
+    /** Provider not initialized */
+    readonly NOT_INITIALIZED: "KMS_NOT_INITIALIZED";
+    /** Key not found */
+    readonly KEY_NOT_FOUND: "KMS_KEY_NOT_FOUND";
+    /** Key is disabled */
+    readonly KEY_DISABLED: "KMS_KEY_DISABLED";
+    /** Encryption failed */
+    readonly ENCRYPTION_FAILED: "KMS_ENCRYPTION_FAILED";
+    /** Decryption failed */
+    readonly DECRYPTION_FAILED: "KMS_DECRYPTION_FAILED";
+    /** Invalid ciphertext */
+    readonly INVALID_CIPHERTEXT: "KMS_INVALID_CIPHERTEXT";
+    /** Key rotation failed */
+    readonly ROTATION_FAILED: "KMS_ROTATION_FAILED";
+    /** Authentication failed */
+    readonly AUTH_FAILED: "KMS_AUTH_FAILED";
+    /** Connection failed */
+    readonly CONNECTION_FAILED: "KMS_CONNECTION_FAILED";
+    /** Rate limit exceeded */
+    readonly RATE_LIMITED: "KMS_RATE_LIMITED";
+    /** Invalid configuration */
+    readonly INVALID_CONFIG: "KMS_INVALID_CONFIG";
+    /** Cache error */
+    readonly CACHE_ERROR: "KMS_CACHE_ERROR";
+    /** Token expired */
+    readonly TOKEN_EXPIRED: "KMS_TOKEN_EXPIRED";
+    /** Provider not supported */
+    readonly UNSUPPORTED_PROVIDER: "KMS_UNSUPPORTED_PROVIDER";
+};
+export type KMSErrorCode = (typeof KMSErrorCode)[keyof typeof KMSErrorCode];
+//# sourceMappingURL=types.d.ts.map