@vorionsys/security 1.0.0

package/dist/security/encryption/types.d.ts

@@ -0,0 +1,745 @@
+/**
+ * Field-Level Encryption Types
+ *
+ * Type definitions for transparent field-level encryption of sensitive data.
+ * Provides interfaces for encrypting individual fields stored in the database
+ * with support for:
+ * - Multiple encryption algorithms (AES-256-GCM, AES-256-CBC, ChaCha20-Poly1305)
+ * - Key versioning for rotation support
+ * - Data classification levels
+ * - Field-specific encryption policies
+ * - Deterministic encryption for searchable fields
+ *
+ * @packageDocumentation
+ * @module security/encryption/types
+ */
+import { z } from 'zod';
+/**
+ * Supported encryption algorithms for field-level encryption
+ *
+ * - AES_256_GCM: Authenticated encryption with associated data (AEAD), recommended default
+ * - AES_256_CBC: Block cipher mode, requires separate HMAC for authentication
+ * - CHACHA20_POLY1305: Modern stream cipher with authentication, good performance
+ */
+export declare const EncryptionAlgorithm: {
+    /** AES-256-GCM - Recommended default with built-in authentication */
+    readonly AES_256_GCM: "aes-256-gcm";
+    /** AES-256-CBC - Legacy mode, requires separate HMAC */
+    readonly AES_256_CBC: "aes-256-cbc";
+    /** ChaCha20-Poly1305 - Modern authenticated encryption */
+    readonly CHACHA20_POLY1305: "chacha20-poly1305";
+};
+export type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm];
+export declare const encryptionAlgorithmSchema: z.ZodNativeEnum<{
+    /** AES-256-GCM - Recommended default with built-in authentication */
+    readonly AES_256_GCM: "aes-256-gcm";
+    /** AES-256-CBC - Legacy mode, requires separate HMAC */
+    readonly AES_256_CBC: "aes-256-cbc";
+    /** ChaCha20-Poly1305 - Modern authenticated encryption */
+    readonly CHACHA20_POLY1305: "chacha20-poly1305";
+}>;
+/**
+ * Data classification levels for determining encryption requirements
+ *
+ * Classification hierarchy (lowest to highest sensitivity):
+ * - PUBLIC: No encryption required, publicly available data
+ * - INTERNAL: Internal use only, encryption optional
+ * - CONFIDENTIAL: Business-sensitive data, encryption required
+ * - RESTRICTED: Highly sensitive data (PII, PHI, PCI), strongest encryption
+ */
+export declare const DataClassification: {
+    /** Public data - no encryption required */
+    readonly PUBLIC: "public";
+    /** Internal data - encryption optional */
+    readonly INTERNAL: "internal";
+    /** Confidential business data - encryption required */
+    readonly CONFIDENTIAL: "confidential";
+    /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
+    readonly RESTRICTED: "restricted";
+};
+export type DataClassification = (typeof DataClassification)[keyof typeof DataClassification];
+export declare const dataClassificationSchema: z.ZodNativeEnum<{
+    /** Public data - no encryption required */
+    readonly PUBLIC: "public";
+    /** Internal data - encryption optional */
+    readonly INTERNAL: "internal";
+    /** Confidential business data - encryption required */
+    readonly CONFIDENTIAL: "confidential";
+    /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
+    readonly RESTRICTED: "restricted";
+}>;
+/**
+ * Classification level ordering for comparison
+ */
+export declare const CLASSIFICATION_LEVELS: Record<DataClassification, number>;
+/**
+ * Encrypted field structure containing all components needed for decryption
+ *
+ * This structure is stored in the database in place of the plaintext value.
+ * It contains all cryptographic material needed to decrypt the field,
+ * except for the actual encryption key which is managed separately.
+ */
+export interface EncryptedField {
+    /** Base64-encoded ciphertext */
+    ciphertext: string;
+    /** Base64-encoded initialization vector (unique per encryption) */
+    iv: string;
+    /** Base64-encoded authentication tag (for AEAD algorithms) */
+    authTag: string;
+    /** Algorithm used for encryption */
+    algorithm: EncryptionAlgorithm;
+    /** Version of the key used for encryption (for rotation support) */
+    keyVersion: number;
+    /** Optional field name for AAD binding verification */
+    fieldName?: string;
+    /** Optional timestamp of when the field was encrypted */
+    encryptedAt?: string;
+    /** Whether this is deterministic encryption (for searchable fields) */
+    deterministic?: boolean;
+}
+export declare const encryptedFieldSchema: z.ZodObject<{
+    ciphertext: z.ZodString;
+    iv: z.ZodString;
+    authTag: z.ZodString;
+    algorithm: z.ZodNativeEnum<{
+        /** AES-256-GCM - Recommended default with built-in authentication */
+        readonly AES_256_GCM: "aes-256-gcm";
+        /** AES-256-CBC - Legacy mode, requires separate HMAC */
+        readonly AES_256_CBC: "aes-256-cbc";
+        /** ChaCha20-Poly1305 - Modern authenticated encryption */
+        readonly CHACHA20_POLY1305: "chacha20-poly1305";
+    }>;
+    keyVersion: z.ZodNumber;
+    fieldName: z.ZodOptional<z.ZodString>;
+    encryptedAt: z.ZodOptional<z.ZodString>;
+    deterministic: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    ciphertext?: string;
+    iv?: string;
+    authTag?: string;
+    keyVersion?: number;
+    fieldName?: string;
+    encryptedAt?: string;
+    deterministic?: boolean;
+}, {
+    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    ciphertext?: string;
+    iv?: string;
+    authTag?: string;
+    keyVersion?: number;
+    fieldName?: string;
+    encryptedAt?: string;
+    deterministic?: boolean;
+}>;
+/**
+ * Marker interface to identify encrypted fields in JSON
+ */
+export interface EncryptedFieldMarker {
+    __encrypted: true;
+    __version: 2;
+    field: EncryptedField;
+}
+export declare const encryptedFieldMarkerSchema: z.ZodObject<{
+    __encrypted: z.ZodLiteral<true>;
+    __version: z.ZodLiteral<2>;
+    field: z.ZodObject<{
+        ciphertext: z.ZodString;
+        iv: z.ZodString;
+        authTag: z.ZodString;
+        algorithm: z.ZodNativeEnum<{
+            /** AES-256-GCM - Recommended default with built-in authentication */
+            readonly AES_256_GCM: "aes-256-gcm";
+            /** AES-256-CBC - Legacy mode, requires separate HMAC */
+            readonly AES_256_CBC: "aes-256-cbc";
+            /** ChaCha20-Poly1305 - Modern authenticated encryption */
+            readonly CHACHA20_POLY1305: "chacha20-poly1305";
+        }>;
+        keyVersion: z.ZodNumber;
+        fieldName: z.ZodOptional<z.ZodString>;
+        encryptedAt: z.ZodOptional<z.ZodString>;
+        deterministic: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+        ciphertext?: string;
+        iv?: string;
+        authTag?: string;
+        keyVersion?: number;
+        fieldName?: string;
+        encryptedAt?: string;
+        deterministic?: boolean;
+    }, {
+        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+        ciphertext?: string;
+        iv?: string;
+        authTag?: string;
+        keyVersion?: number;
+        fieldName?: string;
+        encryptedAt?: string;
+        deterministic?: boolean;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    field?: {
+        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+        ciphertext?: string;
+        iv?: string;
+        authTag?: string;
+        keyVersion?: number;
+        fieldName?: string;
+        encryptedAt?: string;
+        deterministic?: boolean;
+    };
+    __encrypted?: true;
+    __version?: 2;
+}, {
+    field?: {
+        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+        ciphertext?: string;
+        iv?: string;
+        authTag?: string;
+        keyVersion?: number;
+        fieldName?: string;
+        encryptedAt?: string;
+        deterministic?: boolean;
+    };
+    __encrypted?: true;
+    __version?: 2;
+}>;
+/**
+ * Check if a value is an encrypted field marker
+ */
+export declare function isEncryptedFieldMarker(value: unknown): value is EncryptedFieldMarker;
+/**
+ * Key version metadata
+ */
+export interface KeyVersion {
+    /** Version number (monotonically increasing) */
+    version: number;
+    /** When this key version was created */
+    createdAt: Date;
+    /** When this key version was activated for encryption */
+    activatedAt?: Date;
+    /** When this key version was deprecated (no longer used for new encryption) */
+    deprecatedAt?: Date;
+    /** When this key version expires (can no longer be used for decryption) */
+    expiresAt?: Date;
+    /** Status of this key version */
+    status: 'pending' | 'active' | 'deprecated' | 'expired';
+}
+export declare const keyVersionSchema: z.ZodObject<{
+    version: z.ZodNumber;
+    createdAt: z.ZodDate;
+    activatedAt: z.ZodOptional<z.ZodDate>;
+    deprecatedAt: z.ZodOptional<z.ZodDate>;
+    expiresAt: z.ZodOptional<z.ZodDate>;
+    status: z.ZodEnum<["pending", "active", "deprecated", "expired"]>;
+}, "strip", z.ZodTypeAny, {
+    status?: "pending" | "deprecated" | "active" | "expired";
+    createdAt?: Date;
+    expiresAt?: Date;
+    version?: number;
+    activatedAt?: Date;
+    deprecatedAt?: Date;
+}, {
+    status?: "pending" | "deprecated" | "active" | "expired";
+    createdAt?: Date;
+    expiresAt?: Date;
+    version?: number;
+    activatedAt?: Date;
+    deprecatedAt?: Date;
+}>;
+/**
+ * Configuration for the encryption service
+ */
+export interface EncryptionConfig {
+    /** Default algorithm to use for encryption */
+    defaultAlgorithm: EncryptionAlgorithm;
+    /** Whether to enable encryption (can be disabled for testing) */
+    enabled: boolean;
+    /** Key derivation info string prefix */
+    keyDerivationInfo: string;
+    /** HKDF hash algorithm */
+    hkdfHash: 'sha256' | 'sha384' | 'sha512';
+    /** Length of derived keys in bytes */
+    keyLength: number;
+    /** IV length in bytes */
+    ivLength: number;
+    /** Auth tag length in bytes (for AEAD algorithms) */
+    authTagLength: number;
+    /** Whether to include field name in AAD */
+    includeFieldNameInAAD: boolean;
+    /** Whether to include timestamp in encrypted field */
+    includeTimestamp: boolean;
+    /** Redis key prefix for key storage */
+    redisKeyPrefix?: string;
+    /** Enable audit logging for encryption operations */
+    auditLogging: boolean;
+    /** Minimum classification level that requires encryption */
+    minimumEncryptionLevel: DataClassification;
+}
+export declare const encryptionConfigSchema: z.ZodObject<{
+    defaultAlgorithm: z.ZodDefault<z.ZodNativeEnum<{
+        /** AES-256-GCM - Recommended default with built-in authentication */
+        readonly AES_256_GCM: "aes-256-gcm";
+        /** AES-256-CBC - Legacy mode, requires separate HMAC */
+        readonly AES_256_CBC: "aes-256-cbc";
+        /** ChaCha20-Poly1305 - Modern authenticated encryption */
+        readonly CHACHA20_POLY1305: "chacha20-poly1305";
+    }>>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    keyDerivationInfo: z.ZodDefault<z.ZodString>;
+    hkdfHash: z.ZodDefault<z.ZodEnum<["sha256", "sha384", "sha512"]>>;
+    keyLength: z.ZodDefault<z.ZodNumber>;
+    ivLength: z.ZodDefault<z.ZodNumber>;
+    authTagLength: z.ZodDefault<z.ZodNumber>;
+    includeFieldNameInAAD: z.ZodDefault<z.ZodBoolean>;
+    includeTimestamp: z.ZodDefault<z.ZodBoolean>;
+    redisKeyPrefix: z.ZodDefault<z.ZodString>;
+    auditLogging: z.ZodDefault<z.ZodBoolean>;
+    minimumEncryptionLevel: z.ZodDefault<z.ZodNativeEnum<{
+        /** Public data - no encryption required */
+        readonly PUBLIC: "public";
+        /** Internal data - encryption optional */
+        readonly INTERNAL: "internal";
+        /** Confidential business data - encryption required */
+        readonly CONFIDENTIAL: "confidential";
+        /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
+        readonly RESTRICTED: "restricted";
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean;
+    redisKeyPrefix?: string;
+    includeTimestamp?: boolean;
+    keyLength?: number;
+    defaultAlgorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    keyDerivationInfo?: string;
+    hkdfHash?: "sha256" | "sha384" | "sha512";
+    ivLength?: number;
+    authTagLength?: number;
+    includeFieldNameInAAD?: boolean;
+    auditLogging?: boolean;
+    minimumEncryptionLevel?: "internal" | "public" | "confidential" | "restricted";
+}, {
+    enabled?: boolean;
+    redisKeyPrefix?: string;
+    includeTimestamp?: boolean;
+    keyLength?: number;
+    defaultAlgorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    keyDerivationInfo?: string;
+    hkdfHash?: "sha256" | "sha384" | "sha512";
+    ivLength?: number;
+    authTagLength?: number;
+    includeFieldNameInAAD?: boolean;
+    auditLogging?: boolean;
+    minimumEncryptionLevel?: "internal" | "public" | "confidential" | "restricted";
+}>;
+/**
+ * Default encryption configuration
+ */
+export declare const DEFAULT_ENCRYPTION_CONFIG: EncryptionConfig;
+/**
+ * Policy for a single field
+ */
+export interface FieldPolicy {
+    /** Field name or path (supports dot notation for nested fields) */
+    fieldName: string;
+    /** Data classification for this field */
+    classification: DataClassification;
+    /** Whether encryption is required for this field */
+    encrypted: boolean;
+    /** Algorithm to use (overrides default) */
+    algorithm?: EncryptionAlgorithm;
+    /** Whether to use deterministic encryption (for searchable fields) */
+    deterministic?: boolean;
+    /** Custom key derivation info suffix */
+    keyDerivationSuffix?: string;
+}
+export declare const fieldPolicySchema: z.ZodObject<{
+    fieldName: z.ZodString;
+    classification: z.ZodNativeEnum<{
+        /** Public data - no encryption required */
+        readonly PUBLIC: "public";
+        /** Internal data - encryption optional */
+        readonly INTERNAL: "internal";
+        /** Confidential business data - encryption required */
+        readonly CONFIDENTIAL: "confidential";
+        /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
+        readonly RESTRICTED: "restricted";
+    }>;
+    encrypted: z.ZodBoolean;
+    algorithm: z.ZodOptional<z.ZodNativeEnum<{
+        /** AES-256-GCM - Recommended default with built-in authentication */
+        readonly AES_256_GCM: "aes-256-gcm";
+        /** AES-256-CBC - Legacy mode, requires separate HMAC */
+        readonly AES_256_CBC: "aes-256-cbc";
+        /** ChaCha20-Poly1305 - Modern authenticated encryption */
+        readonly CHACHA20_POLY1305: "chacha20-poly1305";
+    }>>;
+    deterministic: z.ZodOptional<z.ZodBoolean>;
+    keyDerivationSuffix: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    fieldName?: string;
+    deterministic?: boolean;
+    classification?: "internal" | "public" | "confidential" | "restricted";
+    encrypted?: boolean;
+    keyDerivationSuffix?: string;
+}, {
+    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    fieldName?: string;
+    deterministic?: boolean;
+    classification?: "internal" | "public" | "confidential" | "restricted";
+    encrypted?: boolean;
+    keyDerivationSuffix?: string;
+}>;
+/**
+ * Encryption policy for a table or entity
+ */
+export interface FieldEncryptionPolicy {
+    /** Name of the table or entity */
+    entityName: string;
+    /** Description of the policy */
+    description?: string;
+    /** Field-specific policies */
+    fields: FieldPolicy[];
+    /** Default classification for unlisted fields */
+    defaultClassification?: DataClassification;
+    /** Whether to fail on unlisted fields */
+    strictMode?: boolean;
+}
+export declare const fieldEncryptionPolicySchema: z.ZodObject<{
+    entityName: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    fields: z.ZodArray<z.ZodObject<{
+        fieldName: z.ZodString;
+        classification: z.ZodNativeEnum<{
+            /** Public data - no encryption required */
+            readonly PUBLIC: "public";
+            /** Internal data - encryption optional */
+            readonly INTERNAL: "internal";
+            /** Confidential business data - encryption required */
+            readonly CONFIDENTIAL: "confidential";
+            /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
+            readonly RESTRICTED: "restricted";
+        }>;
+        encrypted: z.ZodBoolean;
+        algorithm: z.ZodOptional<z.ZodNativeEnum<{
+            /** AES-256-GCM - Recommended default with built-in authentication */
+            readonly AES_256_GCM: "aes-256-gcm";
+            /** AES-256-CBC - Legacy mode, requires separate HMAC */
+            readonly AES_256_CBC: "aes-256-cbc";
+            /** ChaCha20-Poly1305 - Modern authenticated encryption */
+            readonly CHACHA20_POLY1305: "chacha20-poly1305";
+        }>>;
+        deterministic: z.ZodOptional<z.ZodBoolean>;
+        keyDerivationSuffix: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+        fieldName?: string;
+        deterministic?: boolean;
+        classification?: "internal" | "public" | "confidential" | "restricted";
+        encrypted?: boolean;
+        keyDerivationSuffix?: string;
+    }, {
+        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+        fieldName?: string;
+        deterministic?: boolean;
+        classification?: "internal" | "public" | "confidential" | "restricted";
+        encrypted?: boolean;
+        keyDerivationSuffix?: string;
+    }>, "many">;
+    defaultClassification: z.ZodOptional<z.ZodNativeEnum<{
+        /** Public data - no encryption required */
+        readonly PUBLIC: "public";
+        /** Internal data - encryption optional */
+        readonly INTERNAL: "internal";
+        /** Confidential business data - encryption required */
+        readonly CONFIDENTIAL: "confidential";
+        /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
+        readonly RESTRICTED: "restricted";
+    }>>;
+    strictMode: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    description?: string;
+    fields?: {
+        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+        fieldName?: string;
+        deterministic?: boolean;
+        classification?: "internal" | "public" | "confidential" | "restricted";
+        encrypted?: boolean;
+        keyDerivationSuffix?: string;
+    }[];
+    strictMode?: boolean;
+    entityName?: string;
+    defaultClassification?: "internal" | "public" | "confidential" | "restricted";
+}, {
+    description?: string;
+    fields?: {
+        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+        fieldName?: string;
+        deterministic?: boolean;
+        classification?: "internal" | "public" | "confidential" | "restricted";
+        encrypted?: boolean;
+        keyDerivationSuffix?: string;
+    }[];
+    strictMode?: boolean;
+    entityName?: string;
+    defaultClassification?: "internal" | "public" | "confidential" | "restricted";
+}>;
+/**
+ * Options for encryption operation
+ */
+export interface EncryptOptions {
+    /** Field name for AAD binding */
+    fieldName?: string;
+    /** Data classification (determines if encryption is needed) */
+    classification?: DataClassification;
+    /** Algorithm to use (overrides default) */
+    algorithm?: EncryptionAlgorithm;
+    /** Key version to use (defaults to current active version) */
+    keyVersion?: number;
+    /** Use deterministic encryption (for searchable fields) */
+    deterministic?: boolean;
+    /** Additional authenticated data */
+    additionalData?: string;
+    /** Tenant ID for multi-tenant key derivation */
+    tenantId?: string;
+}
+export declare const encryptOptionsSchema: z.ZodObject<{
+    fieldName: z.ZodOptional<z.ZodString>;
+    classification: z.ZodOptional<z.ZodNativeEnum<{
+        /** Public data - no encryption required */
+        readonly PUBLIC: "public";
+        /** Internal data - encryption optional */
+        readonly INTERNAL: "internal";
+        /** Confidential business data - encryption required */
+        readonly CONFIDENTIAL: "confidential";
+        /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
+        readonly RESTRICTED: "restricted";
+    }>>;
+    algorithm: z.ZodOptional<z.ZodNativeEnum<{
+        /** AES-256-GCM - Recommended default with built-in authentication */
+        readonly AES_256_GCM: "aes-256-gcm";
+        /** AES-256-CBC - Legacy mode, requires separate HMAC */
+        readonly AES_256_CBC: "aes-256-cbc";
+        /** ChaCha20-Poly1305 - Modern authenticated encryption */
+        readonly CHACHA20_POLY1305: "chacha20-poly1305";
+    }>>;
+    keyVersion: z.ZodOptional<z.ZodNumber>;
+    deterministic: z.ZodOptional<z.ZodBoolean>;
+    additionalData: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    tenantId?: string;
+    keyVersion?: number;
+    fieldName?: string;
+    deterministic?: boolean;
+    classification?: "internal" | "public" | "confidential" | "restricted";
+    additionalData?: string;
+}, {
+    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    tenantId?: string;
+    keyVersion?: number;
+    fieldName?: string;
+    deterministic?: boolean;
+    classification?: "internal" | "public" | "confidential" | "restricted";
+    additionalData?: string;
+}>;
+/**
+ * Options for decryption operation
+ */
+export interface DecryptOptions {
+    /** Field name for AAD verification */
+    fieldName?: string;
+    /** Additional authenticated data for verification */
+    additionalData?: string;
+    /** Tenant ID for multi-tenant key derivation */
+    tenantId?: string;
+}
+export declare const decryptOptionsSchema: z.ZodObject<{
+    fieldName: z.ZodOptional<z.ZodString>;
+    additionalData: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    tenantId?: string;
+    fieldName?: string;
+    additionalData?: string;
+}, {
+    tenantId?: string;
+    fieldName?: string;
+    additionalData?: string;
+}>;
+/**
+ * Options for re-encryption operation
+ */
+export interface ReencryptOptions {
+    /** New key version to encrypt with */
+    newKeyVersion: number;
+    /** New algorithm to use (optional) */
+    newAlgorithm?: EncryptionAlgorithm;
+    /** Field name for AAD binding */
+    fieldName?: string;
+    /** Tenant ID for multi-tenant key derivation */
+    tenantId?: string;
+}
+export declare const reencryptOptionsSchema: z.ZodObject<{
+    newKeyVersion: z.ZodNumber;
+    newAlgorithm: z.ZodOptional<z.ZodNativeEnum<{
+        /** AES-256-GCM - Recommended default with built-in authentication */
+        readonly AES_256_GCM: "aes-256-gcm";
+        /** AES-256-CBC - Legacy mode, requires separate HMAC */
+        readonly AES_256_CBC: "aes-256-cbc";
+        /** ChaCha20-Poly1305 - Modern authenticated encryption */
+        readonly CHACHA20_POLY1305: "chacha20-poly1305";
+    }>>;
+    fieldName: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    tenantId?: string;
+    fieldName?: string;
+    newKeyVersion?: number;
+    newAlgorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+}, {
+    tenantId?: string;
+    fieldName?: string;
+    newKeyVersion?: number;
+    newAlgorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+}>;
+/**
+ * Encryption operation types for audit logging
+ */
+export declare const EncryptionOperation: {
+    readonly ENCRYPT: "encrypt";
+    readonly DECRYPT: "decrypt";
+    readonly REENCRYPT: "reencrypt";
+    readonly KEY_ROTATE: "key_rotate";
+    readonly KEY_DERIVE: "key_derive";
+};
+export type EncryptionOperation = (typeof EncryptionOperation)[keyof typeof EncryptionOperation];
+/**
+ * Audit log entry for encryption operations
+ */
+export interface EncryptionAuditEntry {
+    /** Unique audit entry ID */
+    id: string;
+    /** Timestamp of the operation */
+    timestamp: Date;
+    /** Type of operation */
+    operation: EncryptionOperation;
+    /** Field name if applicable */
+    fieldName?: string;
+    /** Entity/table name if applicable */
+    entityName?: string;
+    /** Key version used */
+    keyVersion: number;
+    /** Algorithm used */
+    algorithm: EncryptionAlgorithm;
+    /** Whether the operation succeeded */
+    success: boolean;
+    /** Error message if failed */
+    error?: string;
+    /** Duration in milliseconds */
+    durationMs: number;
+    /** User ID if available */
+    userId?: string;
+    /** Tenant ID if available */
+    tenantId?: string;
+    /** Request ID for correlation */
+    requestId?: string;
+}
+export declare const encryptionAuditEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodDate;
+    operation: z.ZodNativeEnum<{
+        readonly ENCRYPT: "encrypt";
+        readonly DECRYPT: "decrypt";
+        readonly REENCRYPT: "reencrypt";
+        readonly KEY_ROTATE: "key_rotate";
+        readonly KEY_DERIVE: "key_derive";
+    }>;
+    fieldName: z.ZodOptional<z.ZodString>;
+    entityName: z.ZodOptional<z.ZodString>;
+    keyVersion: z.ZodNumber;
+    algorithm: z.ZodNativeEnum<{
+        /** AES-256-GCM - Recommended default with built-in authentication */
+        readonly AES_256_GCM: "aes-256-gcm";
+        /** AES-256-CBC - Legacy mode, requires separate HMAC */
+        readonly AES_256_CBC: "aes-256-cbc";
+        /** ChaCha20-Poly1305 - Modern authenticated encryption */
+        readonly CHACHA20_POLY1305: "chacha20-poly1305";
+    }>;
+    success: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    durationMs: z.ZodNumber;
+    userId: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    userId?: string;
+    error?: string;
+    timestamp?: Date;
+    operation?: "encrypt" | "decrypt" | "key_derive" | "reencrypt" | "key_rotate";
+    success?: boolean;
+    requestId?: string;
+    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    tenantId?: string;
+    durationMs?: number;
+    keyVersion?: number;
+    fieldName?: string;
+    entityName?: string;
+}, {
+    id?: string;
+    userId?: string;
+    error?: string;
+    timestamp?: Date;
+    operation?: "encrypt" | "decrypt" | "key_derive" | "reencrypt" | "key_rotate";
+    success?: boolean;
+    requestId?: string;
+    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
+    tenantId?: string;
+    durationMs?: number;
+    keyVersion?: number;
+    fieldName?: string;
+    entityName?: string;
+}>;
+/**
+ * Callback for audit logging
+ */
+export type AuditCallback = (entry: EncryptionAuditEntry) => void | Promise<void>;
+/**
+ * Callback for key rotation events
+ */
+export type KeyRotationCallback = (oldVersion: number, newVersion: number, fieldCount: number) => void | Promise<void>;
+/**
+ * Error codes for encryption operations
+ */
+export declare const EncryptionErrorCode: {
+    /** Invalid algorithm specified */
+    readonly INVALID_ALGORITHM: "INVALID_ALGORITHM";
+    /** Key version not found */
+    readonly KEY_VERSION_NOT_FOUND: "KEY_VERSION_NOT_FOUND";
+    /** Key derivation failed */
+    readonly KEY_DERIVATION_FAILED: "KEY_DERIVATION_FAILED";
+    /** Encryption failed */
+    readonly ENCRYPTION_FAILED: "ENCRYPTION_FAILED";
+    /** Decryption failed */
+    readonly DECRYPTION_FAILED: "DECRYPTION_FAILED";
+    /** Authentication tag verification failed */
+    readonly AUTH_TAG_MISMATCH: "AUTH_TAG_MISMATCH";
+    /** Field name mismatch in AAD */
+    readonly FIELD_NAME_MISMATCH: "FIELD_NAME_MISMATCH";
+    /** Invalid encrypted field format */
+    readonly INVALID_FORMAT: "INVALID_FORMAT";
+    /** Key provider not initialized */
+    readonly KEY_PROVIDER_NOT_INITIALIZED: "KEY_PROVIDER_NOT_INITIALIZED";
+    /** Re-encryption failed */
+    readonly REENCRYPT_FAILED: "REENCRYPT_FAILED";
+    /** Policy violation */
+    readonly POLICY_VIOLATION: "POLICY_VIOLATION";
+    /** Configuration error */
+    readonly CONFIG_ERROR: "CONFIG_ERROR";
+};
+export type EncryptionErrorCode = (typeof EncryptionErrorCode)[keyof typeof EncryptionErrorCode];
+//# sourceMappingURL=types.d.ts.map