/**
 * Field-Level Encryption Types
 *
 * Type definitions for transparent field-level encryption of sensitive data.
 * Provides interfaces for encrypting individual fields stored in the database
 * with support for:
 * - Multiple encryption algorithms (AES-256-GCM, AES-256-CBC, ChaCha20-Poly1305)
 * - Key versioning for rotation support
 * - Data classification levels
 * - Field-specific encryption policies
 * - Deterministic encryption for searchable fields
 *
 * @packageDocumentation
 * @module security/encryption/types
 */
import { z } from 'zod';
/**
 * Supported encryption algorithms for field-level encryption
 *
 * - AES_256_GCM: Authenticated encryption with associated data (AEAD), recommended default
 * - AES_256_CBC: Block cipher mode, requires separate HMAC for authentication
 * - CHACHA20_POLY1305: Modern stream cipher with authentication, good performance
 */
export declare const EncryptionAlgorithm: {
    /** AES-256-GCM - Recommended default with built-in authentication */
    readonly AES_256_GCM: "aes-256-gcm";
    /** AES-256-CBC - Legacy mode, requires separate HMAC */
    readonly AES_256_CBC: "aes-256-cbc";
    /** ChaCha20-Poly1305 - Modern authenticated encryption */
    readonly CHACHA20_POLY1305: "chacha20-poly1305";
};
export type EncryptionAlgorithm = (typeof EncryptionAlgorithm)[keyof typeof EncryptionAlgorithm];
export declare const encryptionAlgorithmSchema: z.ZodNativeEnum<{
    /** AES-256-GCM - Recommended default with built-in authentication */
    readonly AES_256_GCM: "aes-256-gcm";
    /** AES-256-CBC - Legacy mode, requires separate HMAC */
    readonly AES_256_CBC: "aes-256-cbc";
    /** ChaCha20-Poly1305 - Modern authenticated encryption */
    readonly CHACHA20_POLY1305: "chacha20-poly1305";
}>;
/**
 * Data classification levels for determining encryption requirements
 *
 * Classification hierarchy (lowest to highest sensitivity):
 * - PUBLIC: No encryption required, publicly available data
 * - INTERNAL: Internal use only, encryption optional
 * - CONFIDENTIAL: Business-sensitive data, encryption required
 * - RESTRICTED: Highly sensitive data (PII, PHI, PCI), strongest encryption
 */
export declare const DataClassification: {
    /** Public data - no encryption required */
    readonly PUBLIC: "public";
    /** Internal data - encryption optional */
    readonly INTERNAL: "internal";
    /** Confidential business data - encryption required */
    readonly CONFIDENTIAL: "confidential";
    /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
    readonly RESTRICTED: "restricted";
};
export type DataClassification = (typeof DataClassification)[keyof typeof DataClassification];
export declare const dataClassificationSchema: z.ZodNativeEnum<{
    /** Public data - no encryption required */
    readonly PUBLIC: "public";
    /** Internal data - encryption optional */
    readonly INTERNAL: "internal";
    /** Confidential business data - encryption required */
    readonly CONFIDENTIAL: "confidential";
    /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
    readonly RESTRICTED: "restricted";
}>;
/**
 * Classification level ordering for comparison
 */
export declare const CLASSIFICATION_LEVELS: Record<DataClassification, number>;
/**
 * Encrypted field structure containing all components needed for decryption
 *
 * This structure is stored in the database in place of the plaintext value.
 * It contains all cryptographic material needed to decrypt the field,
 * except for the actual encryption key which is managed separately.
 */
export interface EncryptedField {
    /** Base64-encoded ciphertext */
    ciphertext: string;
    /** Base64-encoded initialization vector (unique per encryption) */
    iv: string;
    /** Base64-encoded authentication tag (for AEAD algorithms) */
    authTag: string;
    /** Algorithm used for encryption */
    algorithm: EncryptionAlgorithm;
    /** Version of the key used for encryption (for rotation support) */
    keyVersion: number;
    /** Optional field name for AAD binding verification */
    fieldName?: string;
    /** Optional timestamp of when the field was encrypted */
    encryptedAt?: string;
    /** Whether this is deterministic encryption (for searchable fields) */
    deterministic?: boolean;
}
export declare const encryptedFieldSchema: z.ZodObject<{
    ciphertext: z.ZodString;
    iv: z.ZodString;
    authTag: z.ZodString;
    algorithm: z.ZodNativeEnum<{
        /** AES-256-GCM - Recommended default with built-in authentication */
        readonly AES_256_GCM: "aes-256-gcm";
        /** AES-256-CBC - Legacy mode, requires separate HMAC */
        readonly AES_256_CBC: "aes-256-cbc";
        /** ChaCha20-Poly1305 - Modern authenticated encryption */
        readonly CHACHA20_POLY1305: "chacha20-poly1305";
    }>;
    keyVersion: z.ZodNumber;
    fieldName: z.ZodOptional<z.ZodString>;
    encryptedAt: z.ZodOptional<z.ZodString>;
    deterministic: z.ZodOptional<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    ciphertext?: string;
    iv?: string;
    authTag?: string;
    keyVersion?: number;
    fieldName?: string;
    encryptedAt?: string;
    deterministic?: boolean;
}, {
    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    ciphertext?: string;
    iv?: string;
    authTag?: string;
    keyVersion?: number;
    fieldName?: string;
    encryptedAt?: string;
    deterministic?: boolean;
}>;
/**
 * Marker interface to identify encrypted fields in JSON
 */
export interface EncryptedFieldMarker {
    __encrypted: true;
    __version: 2;
    field: EncryptedField;
}
export declare const encryptedFieldMarkerSchema: z.ZodObject<{
    __encrypted: z.ZodLiteral<true>;
    __version: z.ZodLiteral<2>;
    field: z.ZodObject<{
        ciphertext: z.ZodString;
        iv: z.ZodString;
        authTag: z.ZodString;
        algorithm: z.ZodNativeEnum<{
            /** AES-256-GCM - Recommended default with built-in authentication */
            readonly AES_256_GCM: "aes-256-gcm";
            /** AES-256-CBC - Legacy mode, requires separate HMAC */
            readonly AES_256_CBC: "aes-256-cbc";
            /** ChaCha20-Poly1305 - Modern authenticated encryption */
            readonly CHACHA20_POLY1305: "chacha20-poly1305";
        }>;
        keyVersion: z.ZodNumber;
        fieldName: z.ZodOptional<z.ZodString>;
        encryptedAt: z.ZodOptional<z.ZodString>;
        deterministic: z.ZodOptional<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
        ciphertext?: string;
        iv?: string;
        authTag?: string;
        keyVersion?: number;
        fieldName?: string;
        encryptedAt?: string;
        deterministic?: boolean;
    }, {
        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
        ciphertext?: string;
        iv?: string;
        authTag?: string;
        keyVersion?: number;
        fieldName?: string;
        encryptedAt?: string;
        deterministic?: boolean;
    }>;
}, "strip", z.ZodTypeAny, {
    field?: {
        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
        ciphertext?: string;
        iv?: string;
        authTag?: string;
        keyVersion?: number;
        fieldName?: string;
        encryptedAt?: string;
        deterministic?: boolean;
    };
    __encrypted?: true;
    __version?: 2;
}, {
    field?: {
        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
        ciphertext?: string;
        iv?: string;
        authTag?: string;
        keyVersion?: number;
        fieldName?: string;
        encryptedAt?: string;
        deterministic?: boolean;
    };
    __encrypted?: true;
    __version?: 2;
}>;
/**
 * Check if a value is an encrypted field marker
 */
export declare function isEncryptedFieldMarker(value: unknown): value is EncryptedFieldMarker;
/**
 * Key version metadata
 */
export interface KeyVersion {
    /** Version number (monotonically increasing) */
    version: number;
    /** When this key version was created */
    createdAt: Date;
    /** When this key version was activated for encryption */
    activatedAt?: Date;
    /** When this key version was deprecated (no longer used for new encryption) */
    deprecatedAt?: Date;
    /** When this key version expires (can no longer be used for decryption) */
    expiresAt?: Date;
    /** Status of this key version */
    status: 'pending' | 'active' | 'deprecated' | 'expired';
}
export declare const keyVersionSchema: z.ZodObject<{
    version: z.ZodNumber;
    createdAt: z.ZodDate;
    activatedAt: z.ZodOptional<z.ZodDate>;
    deprecatedAt: z.ZodOptional<z.ZodDate>;
    expiresAt: z.ZodOptional<z.ZodDate>;
    status: z.ZodEnum<["pending", "active", "deprecated", "expired"]>;
}, "strip", z.ZodTypeAny, {
    version?: number;
    status?: "pending" | "deprecated" | "active" | "expired";
    createdAt?: Date;
    expiresAt?: Date;
    activatedAt?: Date;
    deprecatedAt?: Date;
}, {
    version?: number;
    status?: "pending" | "deprecated" | "active" | "expired";
    createdAt?: Date;
    expiresAt?: Date;
    activatedAt?: Date;
    deprecatedAt?: Date;
}>;
/**
 * Configuration for the encryption service
 */
export interface EncryptionConfig {
    /** Default algorithm to use for encryption */
    defaultAlgorithm: EncryptionAlgorithm;
    /** Whether to enable encryption (can be disabled for testing) */
    enabled: boolean;
    /** Key derivation info string prefix */
    keyDerivationInfo: string;
    /** HKDF hash algorithm */
    hkdfHash: 'sha256' | 'sha384' | 'sha512';
    /** Length of derived keys in bytes */
    keyLength: number;
    /** IV length in bytes */
    ivLength: number;
    /** Auth tag length in bytes (for AEAD algorithms) */
    authTagLength: number;
    /** Whether to include field name in AAD */
    includeFieldNameInAAD: boolean;
    /** Whether to include timestamp in encrypted field */
    includeTimestamp: boolean;
    /** Redis key prefix for key storage */
    redisKeyPrefix?: string;
    /** Enable audit logging for encryption operations */
    auditLogging: boolean;
    /** Minimum classification level that requires encryption */
    minimumEncryptionLevel: DataClassification;
}
export declare const encryptionConfigSchema: z.ZodObject<{
    defaultAlgorithm: z.ZodDefault<z.ZodNativeEnum<{
        /** AES-256-GCM - Recommended default with built-in authentication */
        readonly AES_256_GCM: "aes-256-gcm";
        /** AES-256-CBC - Legacy mode, requires separate HMAC */
        readonly AES_256_CBC: "aes-256-cbc";
        /** ChaCha20-Poly1305 - Modern authenticated encryption */
        readonly CHACHA20_POLY1305: "chacha20-poly1305";
    }>>;
    enabled: z.ZodDefault<z.ZodBoolean>;
    keyDerivationInfo: z.ZodDefault<z.ZodString>;
    hkdfHash: z.ZodDefault<z.ZodEnum<["sha256", "sha384", "sha512"]>>;
    keyLength: z.ZodDefault<z.ZodNumber>;
    ivLength: z.ZodDefault<z.ZodNumber>;
    authTagLength: z.ZodDefault<z.ZodNumber>;
    includeFieldNameInAAD: z.ZodDefault<z.ZodBoolean>;
    includeTimestamp: z.ZodDefault<z.ZodBoolean>;
    redisKeyPrefix: z.ZodDefault<z.ZodString>;
    auditLogging: z.ZodDefault<z.ZodBoolean>;
    minimumEncryptionLevel: z.ZodDefault<z.ZodNativeEnum<{
        /** Public data - no encryption required */
        readonly PUBLIC: "public";
        /** Internal data - encryption optional */
        readonly INTERNAL: "internal";
        /** Confidential business data - encryption required */
        readonly CONFIDENTIAL: "confidential";
        /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
        readonly RESTRICTED: "restricted";
    }>>;
}, "strip", z.ZodTypeAny, {
    enabled?: boolean;
    keyLength?: number;
    redisKeyPrefix?: string;
    includeTimestamp?: boolean;
    defaultAlgorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    keyDerivationInfo?: string;
    hkdfHash?: "sha256" | "sha512" | "sha384";
    ivLength?: number;
    authTagLength?: number;
    includeFieldNameInAAD?: boolean;
    auditLogging?: boolean;
    minimumEncryptionLevel?: "confidential" | "public" | "internal" | "restricted";
}, {
    enabled?: boolean;
    keyLength?: number;
    redisKeyPrefix?: string;
    includeTimestamp?: boolean;
    defaultAlgorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    keyDerivationInfo?: string;
    hkdfHash?: "sha256" | "sha512" | "sha384";
    ivLength?: number;
    authTagLength?: number;
    includeFieldNameInAAD?: boolean;
    auditLogging?: boolean;
    minimumEncryptionLevel?: "confidential" | "public" | "internal" | "restricted";
}>;
/**
 * Default encryption configuration
 */
export declare const DEFAULT_ENCRYPTION_CONFIG: EncryptionConfig;
/**
 * Policy for a single field
 */
export interface FieldPolicy {
    /** Field name or path (supports dot notation for nested fields) */
    fieldName: string;
    /** Data classification for this field */
    classification: DataClassification;
    /** Whether encryption is required for this field */
    encrypted: boolean;
    /** Algorithm to use (overrides default) */
    algorithm?: EncryptionAlgorithm;
    /** Whether to use deterministic encryption (for searchable fields) */
    deterministic?: boolean;
    /** Custom key derivation info suffix */
    keyDerivationSuffix?: string;
}
export declare const fieldPolicySchema: z.ZodObject<{
    fieldName: z.ZodString;
    classification: z.ZodNativeEnum<{
        /** Public data - no encryption required */
        readonly PUBLIC: "public";
        /** Internal data - encryption optional */
        readonly INTERNAL: "internal";
        /** Confidential business data - encryption required */
        readonly CONFIDENTIAL: "confidential";
        /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
        readonly RESTRICTED: "restricted";
    }>;
    encrypted: z.ZodBoolean;
    algorithm: z.ZodOptional<z.ZodNativeEnum<{
        /** AES-256-GCM - Recommended default with built-in authentication */
        readonly AES_256_GCM: "aes-256-gcm";
        /** AES-256-CBC - Legacy mode, requires separate HMAC */
        readonly AES_256_CBC: "aes-256-cbc";
        /** ChaCha20-Poly1305 - Modern authenticated encryption */
        readonly CHACHA20_POLY1305: "chacha20-poly1305";
    }>>;
    deterministic: z.ZodOptional<z.ZodBoolean>;
    keyDerivationSuffix: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    classification?: "confidential" | "public" | "internal" | "restricted";
    fieldName?: string;
    deterministic?: boolean;
    encrypted?: boolean;
    keyDerivationSuffix?: string;
}, {
    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    classification?: "confidential" | "public" | "internal" | "restricted";
    fieldName?: string;
    deterministic?: boolean;
    encrypted?: boolean;
    keyDerivationSuffix?: string;
}>;
/**
 * Encryption policy for a table or entity
 */
export interface FieldEncryptionPolicy {
    /** Name of the table or entity */
    entityName: string;
    /** Description of the policy */
    description?: string;
    /** Field-specific policies */
    fields: FieldPolicy[];
    /** Default classification for unlisted fields */
    defaultClassification?: DataClassification;
    /** Whether to fail on unlisted fields */
    strictMode?: boolean;
}
export declare const fieldEncryptionPolicySchema: z.ZodObject<{
    entityName: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
    fields: z.ZodArray<z.ZodObject<{
        fieldName: z.ZodString;
        classification: z.ZodNativeEnum<{
            /** Public data - no encryption required */
            readonly PUBLIC: "public";
            /** Internal data - encryption optional */
            readonly INTERNAL: "internal";
            /** Confidential business data - encryption required */
            readonly CONFIDENTIAL: "confidential";
            /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
            readonly RESTRICTED: "restricted";
        }>;
        encrypted: z.ZodBoolean;
        algorithm: z.ZodOptional<z.ZodNativeEnum<{
            /** AES-256-GCM - Recommended default with built-in authentication */
            readonly AES_256_GCM: "aes-256-gcm";
            /** AES-256-CBC - Legacy mode, requires separate HMAC */
            readonly AES_256_CBC: "aes-256-cbc";
            /** ChaCha20-Poly1305 - Modern authenticated encryption */
            readonly CHACHA20_POLY1305: "chacha20-poly1305";
        }>>;
        deterministic: z.ZodOptional<z.ZodBoolean>;
        keyDerivationSuffix: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
        classification?: "confidential" | "public" | "internal" | "restricted";
        fieldName?: string;
        deterministic?: boolean;
        encrypted?: boolean;
        keyDerivationSuffix?: string;
    }, {
        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
        classification?: "confidential" | "public" | "internal" | "restricted";
        fieldName?: string;
        deterministic?: boolean;
        encrypted?: boolean;
        keyDerivationSuffix?: string;
    }>, "many">;
    defaultClassification: z.ZodOptional<z.ZodNativeEnum<{
        /** Public data - no encryption required */
        readonly PUBLIC: "public";
        /** Internal data - encryption optional */
        readonly INTERNAL: "internal";
        /** Confidential business data - encryption required */
        readonly CONFIDENTIAL: "confidential";
        /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
        readonly RESTRICTED: "restricted";
    }>>;
    strictMode: z.ZodOptional<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    description?: string;
    fields?: {
        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
        classification?: "confidential" | "public" | "internal" | "restricted";
        fieldName?: string;
        deterministic?: boolean;
        encrypted?: boolean;
        keyDerivationSuffix?: string;
    }[];
    strictMode?: boolean;
    entityName?: string;
    defaultClassification?: "confidential" | "public" | "internal" | "restricted";
}, {
    description?: string;
    fields?: {
        algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
        classification?: "confidential" | "public" | "internal" | "restricted";
        fieldName?: string;
        deterministic?: boolean;
        encrypted?: boolean;
        keyDerivationSuffix?: string;
    }[];
    strictMode?: boolean;
    entityName?: string;
    defaultClassification?: "confidential" | "public" | "internal" | "restricted";
}>;
/**
 * Options for encryption operation
 */
export interface EncryptOptions {
    /** Field name for AAD binding */
    fieldName?: string;
    /** Data classification (determines if encryption is needed) */
    classification?: DataClassification;
    /** Algorithm to use (overrides default) */
    algorithm?: EncryptionAlgorithm;
    /** Key version to use (defaults to current active version) */
    keyVersion?: number;
    /** Use deterministic encryption (for searchable fields) */
    deterministic?: boolean;
    /** Additional authenticated data */
    additionalData?: string;
    /** Tenant ID for multi-tenant key derivation */
    tenantId?: string;
}
export declare const encryptOptionsSchema: z.ZodObject<{
    fieldName: z.ZodOptional<z.ZodString>;
    classification: z.ZodOptional<z.ZodNativeEnum<{
        /** Public data - no encryption required */
        readonly PUBLIC: "public";
        /** Internal data - encryption optional */
        readonly INTERNAL: "internal";
        /** Confidential business data - encryption required */
        readonly CONFIDENTIAL: "confidential";
        /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
        readonly RESTRICTED: "restricted";
    }>>;
    algorithm: z.ZodOptional<z.ZodNativeEnum<{
        /** AES-256-GCM - Recommended default with built-in authentication */
        readonly AES_256_GCM: "aes-256-gcm";
        /** AES-256-CBC - Legacy mode, requires separate HMAC */
        readonly AES_256_CBC: "aes-256-cbc";
        /** ChaCha20-Poly1305 - Modern authenticated encryption */
        readonly CHACHA20_POLY1305: "chacha20-poly1305";
    }>>;
    keyVersion: z.ZodOptional<z.ZodNumber>;
    deterministic: z.ZodOptional<z.ZodBoolean>;
    additionalData: z.ZodOptional<z.ZodString>;
    tenantId: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    tenantId?: string;
    classification?: "confidential" | "public" | "internal" | "restricted";
    keyVersion?: number;
    fieldName?: string;
    deterministic?: boolean;
    additionalData?: string;
}, {
    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    tenantId?: string;
    classification?: "confidential" | "public" | "internal" | "restricted";
    keyVersion?: number;
    fieldName?: string;
    deterministic?: boolean;
    additionalData?: string;
}>;
/**
 * Options for decryption operation
 */
export interface DecryptOptions {
    /** Field name for AAD verification */
    fieldName?: string;
    /** Additional authenticated data for verification */
    additionalData?: string;
    /** Tenant ID for multi-tenant key derivation */
    tenantId?: string;
}
export declare const decryptOptionsSchema: z.ZodObject<{
    fieldName: z.ZodOptional<z.ZodString>;
    additionalData: z.ZodOptional<z.ZodString>;
    tenantId: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    tenantId?: string;
    fieldName?: string;
    additionalData?: string;
}, {
    tenantId?: string;
    fieldName?: string;
    additionalData?: string;
}>;
/**
 * Options for re-encryption operation
 */
export interface ReencryptOptions {
    /** New key version to encrypt with */
    newKeyVersion: number;
    /** New algorithm to use (optional) */
    newAlgorithm?: EncryptionAlgorithm;
    /** Field name for AAD binding */
    fieldName?: string;
    /** Tenant ID for multi-tenant key derivation */
    tenantId?: string;
}
export declare const reencryptOptionsSchema: z.ZodObject<{
    newKeyVersion: z.ZodNumber;
    newAlgorithm: z.ZodOptional<z.ZodNativeEnum<{
        /** AES-256-GCM - Recommended default with built-in authentication */
        readonly AES_256_GCM: "aes-256-gcm";
        /** AES-256-CBC - Legacy mode, requires separate HMAC */
        readonly AES_256_CBC: "aes-256-cbc";
        /** ChaCha20-Poly1305 - Modern authenticated encryption */
        readonly CHACHA20_POLY1305: "chacha20-poly1305";
    }>>;
    fieldName: z.ZodOptional<z.ZodString>;
    tenantId: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    tenantId?: string;
    fieldName?: string;
    newKeyVersion?: number;
    newAlgorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
}, {
    tenantId?: string;
    fieldName?: string;
    newKeyVersion?: number;
    newAlgorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
}>;
/**
 * Encryption operation types for audit logging
 */
export declare const EncryptionOperation: {
    readonly ENCRYPT: "encrypt";
    readonly DECRYPT: "decrypt";
    readonly REENCRYPT: "reencrypt";
    readonly KEY_ROTATE: "key_rotate";
    readonly KEY_DERIVE: "key_derive";
};
export type EncryptionOperation = (typeof EncryptionOperation)[keyof typeof EncryptionOperation];
/**
 * Audit log entry for encryption operations
 */
export interface EncryptionAuditEntry {
    /** Unique audit entry ID */
    id: string;
    /** Timestamp of the operation */
    timestamp: Date;
    /** Type of operation */
    operation: EncryptionOperation;
    /** Field name if applicable */
    fieldName?: string;
    /** Entity/table name if applicable */
    entityName?: string;
    /** Key version used */
    keyVersion: number;
    /** Algorithm used */
    algorithm: EncryptionAlgorithm;
    /** Whether the operation succeeded */
    success: boolean;
    /** Error message if failed */
    error?: string;
    /** Duration in milliseconds */
    durationMs: number;
    /** User ID if available */
    userId?: string;
    /** Tenant ID if available */
    tenantId?: string;
    /** Request ID for correlation */
    requestId?: string;
}
export declare const encryptionAuditEntrySchema: z.ZodObject<{
    id: z.ZodString;
    timestamp: z.ZodDate;
    operation: z.ZodNativeEnum<{
        readonly ENCRYPT: "encrypt";
        readonly DECRYPT: "decrypt";
        readonly REENCRYPT: "reencrypt";
        readonly KEY_ROTATE: "key_rotate";
        readonly KEY_DERIVE: "key_derive";
    }>;
    fieldName: z.ZodOptional<z.ZodString>;
    entityName: z.ZodOptional<z.ZodString>;
    keyVersion: z.ZodNumber;
    algorithm: z.ZodNativeEnum<{
        /** AES-256-GCM - Recommended default with built-in authentication */
        readonly AES_256_GCM: "aes-256-gcm";
        /** AES-256-CBC - Legacy mode, requires separate HMAC */
        readonly AES_256_CBC: "aes-256-cbc";
        /** ChaCha20-Poly1305 - Modern authenticated encryption */
        readonly CHACHA20_POLY1305: "chacha20-poly1305";
    }>;
    success: z.ZodBoolean;
    error: z.ZodOptional<z.ZodString>;
    durationMs: z.ZodNumber;
    userId: z.ZodOptional<z.ZodString>;
    tenantId: z.ZodOptional<z.ZodString>;
    requestId: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    error?: string;
    durationMs?: number;
    id?: string;
    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    tenantId?: string;
    success?: boolean;
    operation?: "encrypt" | "decrypt" | "key_derive" | "reencrypt" | "key_rotate";
    userId?: string;
    requestId?: string;
    timestamp?: Date;
    keyVersion?: number;
    fieldName?: string;
    entityName?: string;
}, {
    error?: string;
    durationMs?: number;
    id?: string;
    algorithm?: "aes-256-gcm" | "aes-256-cbc" | "chacha20-poly1305";
    tenantId?: string;
    success?: boolean;
    operation?: "encrypt" | "decrypt" | "key_derive" | "reencrypt" | "key_rotate";
    userId?: string;
    requestId?: string;
    timestamp?: Date;
    keyVersion?: number;
    fieldName?: string;
    entityName?: string;
}>;
/**
 * Callback for audit logging
 */
export type AuditCallback = (entry: EncryptionAuditEntry) => void | Promise<void>;
/**
 * Callback for key rotation events
 */
export type KeyRotationCallback = (oldVersion: number, newVersion: number, fieldCount: number) => void | Promise<void>;
/**
 * Error codes for encryption operations
 */
export declare const EncryptionErrorCode: {
    /** Invalid algorithm specified */
    readonly INVALID_ALGORITHM: "INVALID_ALGORITHM";
    /** Key version not found */
    readonly KEY_VERSION_NOT_FOUND: "KEY_VERSION_NOT_FOUND";
    /** Key derivation failed */
    readonly KEY_DERIVATION_FAILED: "KEY_DERIVATION_FAILED";
    /** Encryption failed */
    readonly ENCRYPTION_FAILED: "ENCRYPTION_FAILED";
    /** Decryption failed */
    readonly DECRYPTION_FAILED: "DECRYPTION_FAILED";
    /** Authentication tag verification failed */
    readonly AUTH_TAG_MISMATCH: "AUTH_TAG_MISMATCH";
    /** Field name mismatch in AAD */
    readonly FIELD_NAME_MISMATCH: "FIELD_NAME_MISMATCH";
    /** Invalid encrypted field format */
    readonly INVALID_FORMAT: "INVALID_FORMAT";
    /** Key provider not initialized */
    readonly KEY_PROVIDER_NOT_INITIALIZED: "KEY_PROVIDER_NOT_INITIALIZED";
    /** Re-encryption failed */
    readonly REENCRYPT_FAILED: "REENCRYPT_FAILED";
    /** Policy violation */
    readonly POLICY_VIOLATION: "POLICY_VIOLATION";
    /** Configuration error */
    readonly CONFIG_ERROR: "CONFIG_ERROR";
};
export type EncryptionErrorCode = (typeof EncryptionErrorCode)[keyof typeof EncryptionErrorCode];
//# sourceMappingURL=types.d.ts.map