/**
 * Field-Level Encryption Decorators
 *
 * TypeScript decorators for marking class fields that require encryption.
 * These decorators provide metadata that can be used by ORM middleware
 * or other systems to automatically encrypt/decrypt fields.
 *
 * Features:
 * - @Encrypted() - Mark a field for encryption with classification
 * - @SearchableEncrypted() - Mark a field for deterministic encryption
 * - Metadata reflection for runtime field discovery
 * - Policy generation from decorated classes
 *
 * @example
 * ```typescript
 * class User {
 *   @Encrypted(DataClassification.RESTRICTED)
 *   ssn: string;
 *
 *   @SearchableEncrypted()
 *   email: string;
 *
 *   @Encrypted(DataClassification.CONFIDENTIAL, { algorithm: 'chacha20-poly1305' })
 *   phoneNumber: string;
 * }
 *
 * // Get encrypted fields metadata
 * const fields = getEncryptedFields(User);
 * ```
 *
 * @packageDocumentation
 * @module security/encryption/decorators
 */
import type { DataClassification, EncryptionAlgorithm, FieldEncryptionPolicy } from './types.js';
/**
 * Encrypted field metadata
 */
export interface EncryptedFieldMetadata {
    /** Property name */
    propertyKey: string;
    /** Data classification level */
    classification: DataClassification;
    /** Whether encryption is required */
    encrypted: boolean;
    /** Custom algorithm override */
    algorithm?: EncryptionAlgorithm;
    /** Whether to use deterministic encryption */
    deterministic: boolean;
    /** Custom key derivation suffix */
    keyDerivationSuffix?: string;
    /** Field description for documentation */
    description?: string;
}
/**
 * Options for @Encrypted decorator
 */
export interface EncryptedOptions {
    /** Custom encryption algorithm */
    algorithm?: EncryptionAlgorithm;
    /** Custom key derivation suffix */
    keyDerivationSuffix?: string;
    /** Field description for documentation */
    description?: string;
}
/**
 * Options for @SearchableEncrypted decorator
 */
export interface SearchableEncryptedOptions {
    /** Data classification (defaults to CONFIDENTIAL) */
    classification?: DataClassification;
    /** Custom key derivation suffix */
    keyDerivationSuffix?: string;
    /** Field description for documentation */
    description?: string;
}
/**
 * Decorator to mark a field for encryption
 *
 * Fields marked with this decorator will be automatically encrypted
 * when stored and decrypted when retrieved, based on their classification.
 *
 * @param classification - The data classification level
 * @param options - Additional encryption options
 *
 * @example
 * ```typescript
 * class Patient {
 *   @Encrypted(DataClassification.RESTRICTED)
 *   medicalRecordNumber: string;
 *
 *   @Encrypted(DataClassification.CONFIDENTIAL, {
 *     algorithm: EncryptionAlgorithm.CHACHA20_POLY1305,
 *     description: 'Patient phone number for contact'
 *   })
 *   phoneNumber: string;
 * }
 * ```
 */
export declare function Encrypted(classification: DataClassification, options?: EncryptedOptions): PropertyDecorator;
/**
 * Decorator to mark a field for searchable (deterministic) encryption
 *
 * Fields marked with this decorator use deterministic encryption,
 * which allows searching for exact matches while still encrypting data.
 *
 * Security note: Deterministic encryption is less secure than random IV
 * encryption because identical plaintexts produce identical ciphertexts.
 * Use only when searchability is required.
 *
 * @param options - Searchable encryption options
 *
 * @example
 * ```typescript
 * class User {
 *   @SearchableEncrypted({
 *     classification: DataClassification.CONFIDENTIAL,
 *     description: 'User email for login lookup'
 *   })
 *   email: string;
 *
 *   @SearchableEncrypted()
 *   externalId: string;
 * }
 * ```
 */
export declare function SearchableEncrypted(options?: SearchableEncryptedOptions): PropertyDecorator;
/**
 * Decorator to explicitly mark a field as not encrypted
 *
 * Useful when a parent class has encryption but a subclass field should not be encrypted.
 *
 * @param classification - The data classification (for documentation/policy)
 *
 * @example
 * ```typescript
 * class PublicProfile extends User {
 *   @NotEncrypted(DataClassification.PUBLIC)
 *   displayName: string;
 * }
 * ```
 */
export declare function NotEncrypted(classification: DataClassification): PropertyDecorator;
/**
 * Get all encrypted field metadata from a class
 *
 * @param target - The class constructor or instance
 * @returns Array of encrypted field metadata
 *
 * @example
 * ```typescript
 * class User {
 *   @Encrypted(DataClassification.RESTRICTED)
 *   ssn: string;
 *
 *   @SearchableEncrypted()
 *   email: string;
 * }
 *
 * const fields = getEncryptedFields(User);
 * // [
 * //   { propertyKey: 'ssn', classification: 'restricted', encrypted: true, deterministic: false },
 * //   { propertyKey: 'email', classification: 'confidential', encrypted: true, deterministic: true }
 * // ]
 * ```
 */
export declare function getEncryptedFields(target: object | (new (...args: unknown[]) => unknown)): EncryptedFieldMetadata[];
/**
 * Check if a class has any encrypted fields
 *
 * @param target - The class constructor or instance
 * @returns True if the class has encrypted fields
 */
export declare function hasEncryptedFields(target: object | (new (...args: unknown[]) => unknown)): boolean;
/**
 * Get metadata for a specific field
 *
 * @param target - The class constructor or instance
 * @param propertyKey - The property name
 * @returns Field metadata or undefined
 */
export declare function getFieldMetadata(target: object | (new (...args: unknown[]) => unknown), propertyKey: string): EncryptedFieldMetadata | undefined;
/**
 * Check if a specific field is encrypted
 *
 * @param target - The class constructor or instance
 * @param propertyKey - The property name
 * @returns True if the field is marked for encryption
 */
export declare function isFieldEncrypted(target: object | (new (...args: unknown[]) => unknown), propertyKey: string): boolean;
/**
 * Check if a specific field uses deterministic encryption
 *
 * @param target - The class constructor or instance
 * @param propertyKey - The property name
 * @returns True if the field uses deterministic encryption
 */
export declare function isFieldSearchable(target: object | (new (...args: unknown[]) => unknown), propertyKey: string): boolean;
/**
 * Generate a FieldEncryptionPolicy from a decorated class
 *
 * This creates a policy object that can be used with the encryption service
 * to encrypt/decrypt objects based on decorator metadata.
 *
 * @param target - The class constructor
 * @param entityName - Optional entity name (defaults to class name)
 * @returns Field encryption policy
 *
 * @example
 * ```typescript
 * class User {
 *   @Encrypted(DataClassification.RESTRICTED)
 *   ssn: string;
 *
 *   @SearchableEncrypted()
 *   email: string;
 * }
 *
 * const policy = generatePolicy(User);
 * // {
 * //   entityName: 'User',
 * //   fields: [
 * //     { fieldName: 'ssn', classification: 'restricted', encrypted: true },
 * //     { fieldName: 'email', classification: 'confidential', encrypted: true, deterministic: true }
 * //   ]
 * // }
 *
 * // Use with encryption service
 * const encrypted = await service.encryptObject(user, policy);
 * ```
 */
export declare function generatePolicy(target: new (...args: unknown[]) => unknown, entityName?: string): FieldEncryptionPolicy;
/**
 * Generate policies for multiple classes
 *
 * @param classes - Array of class constructors
 * @returns Map of entity names to policies
 *
 * @example
 * ```typescript
 * const policies = generatePolicies([User, Patient, Account]);
 * // Map {
 * //   'User' => { entityName: 'User', fields: [...] },
 * //   'Patient' => { entityName: 'Patient', fields: [...] },
 * //   'Account' => { entityName: 'Account', fields: [...] }
 * // }
 * ```
 */
export declare function generatePolicies(classes: Array<new (...args: unknown[]) => unknown>): Map<string, FieldEncryptionPolicy>;
/**
 * Type utility to get encrypted field names from a class
 */
export type EncryptedFieldNames<T> = {
    [K in keyof T]: T[K] extends string ? K : never;
}[keyof T];
/**
 * Type utility to mark encrypted fields in a type
 */
export type WithEncryptedFields<T, Fields extends keyof T> = Omit<T, Fields> & {
    [K in Fields]: T[K] | {
        __encrypted: true;
    };
};
//# sourceMappingURL=decorators.d.ts.map