// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * Key Management Service (KMS) Types
 *
 * Type definitions for KMS provider implementations supporting:
 * - AWS KMS
 * - HashiCorp Vault
 * - Local development provider
 *
 * Implements envelope encryption pattern where data keys are
 * encrypted by master keys stored in the KMS.
 *
 * @packageDocumentation
 * @module security/kms/types
 */
import { z } from 'zod';
// =============================================================================
// Key Status Types
// =============================================================================
/**
 * Status of a KMS key
 */
export const KeyStatus = {
    /** Key is enabled and can be used for encryption/decryption */
    ENABLED: 'enabled',
    /** Key is disabled and cannot be used */
    DISABLED: 'disabled',
    /** Key is pending deletion */
    PENDING_DELETION: 'pending_deletion',
    /** Key is pending import (for imported keys) */
    PENDING_IMPORT: 'pending_import',
    /** Key is unavailable (service issue) */
    UNAVAILABLE: 'unavailable',
};
export const keyStatusSchema = z.nativeEnum(KeyStatus);
export const keyMetadataSchema = z.object({
    id: z.string().min(1),
    arn: z.string().min(1),
    version: z.number().int().nonnegative(),
    createdAt: z.coerce.date(),
    rotatedAt: z.coerce.date().optional(),
    status: keyStatusSchema,
    description: z.string().optional(),
    alias: z.string().optional(),
    keyType: z.string().optional(),
    keyUsage: z.string().optional(),
    providerMetadata: z.record(z.unknown()).optional(),
});
// =============================================================================
// KMS Configuration Types
// =============================================================================
/**
 * KMS provider types
 */
export const KMSProviderType = {
    /** AWS Key Management Service */
    AWS: 'aws',
    /** HashiCorp Vault */
    VAULT: 'vault',
    /** Local development provider */
    LOCAL: 'local',
};
export const kmsProviderTypeSchema = z.nativeEnum(KMSProviderType);
// =============================================================================
// Configuration Schemas
// =============================================================================
const retryConfigSchema = z.object({
    maxAttempts: z.number().int().positive().default(3),
    initialDelayMs: z.number().int().positive().default(100),
    maxDelayMs: z.number().int().positive().default(5000),
}).optional();
const baseConfigSchema = z.object({
    defaultKeyId: z.string().optional(),
    enableCaching: z.boolean().default(true),
    cacheTtlSeconds: z.number().int().positive().default(300),
    maxCacheUsages: z.number().int().positive().default(1000),
    enableAuditLogging: z.boolean().default(true),
    retry: retryConfigSchema,
});
export const awsKmsConfigSchema = baseConfigSchema.extend({
    provider: z.literal('aws'),
    region: z.string().optional(),
    keyArn: z.string().min(1),
    accessKeyId: z.string().optional(),
    secretAccessKey: z.string().optional(),
    endpoint: z.string().url().optional(),
});
export const vaultKmsConfigSchema = baseConfigSchema.extend({
    provider: z.literal('vault'),
    address: z.string().url(),
    token: z.string().optional(),
    tokenFile: z.string().optional(),
    transitMount: z.string().default('transit'),
    keyName: z.string().min(1),
    enableTokenRenewal: z.boolean().default(true),
    tokenRenewalIntervalSeconds: z.number().int().positive().default(3600),
    namespace: z.string().optional(),
    tls: z.object({
        caCert: z.string().optional(),
        clientCert: z.string().optional(),
        clientKey: z.string().optional(),
        skipVerify: z.boolean().default(false),
    }).optional(),
});
export const localKmsConfigSchema = baseConfigSchema.extend({
    provider: z.literal('local'),
    masterKey: z.string().optional(),
    keyFile: z.string().optional(),
    keyEnvVar: z.string().default('VORION_LOCAL_KMS_KEY'),
    suppressWarnings: z.boolean().default(false),
});
export const kmsConfigSchema = z.discriminatedUnion('provider', [
    awsKmsConfigSchema,
    vaultKmsConfigSchema,
    localKmsConfigSchema,
]);
// =============================================================================
// Audit Types
// =============================================================================
/**
 * KMS operation types for audit logging
 */
export const KMSOperation = {
    ENCRYPT: 'kms_encrypt',
    DECRYPT: 'kms_decrypt',
    GENERATE_DATA_KEY: 'kms_generate_data_key',
    DECRYPT_DATA_KEY: 'kms_decrypt_data_key',
    ROTATE_KEY: 'kms_rotate_key',
    GET_KEY: 'kms_get_key',
    LIST_KEYS: 'kms_list_keys',
};
// =============================================================================
// Error Types
// =============================================================================
/**
 * Error codes for KMS operations
 */
export const KMSErrorCode = {
    /** Provider not initialized */
    NOT_INITIALIZED: 'KMS_NOT_INITIALIZED',
    /** Key not found */
    KEY_NOT_FOUND: 'KMS_KEY_NOT_FOUND',
    /** Key is disabled */
    KEY_DISABLED: 'KMS_KEY_DISABLED',
    /** Encryption failed */
    ENCRYPTION_FAILED: 'KMS_ENCRYPTION_FAILED',
    /** Decryption failed */
    DECRYPTION_FAILED: 'KMS_DECRYPTION_FAILED',
    /** Invalid ciphertext */
    INVALID_CIPHERTEXT: 'KMS_INVALID_CIPHERTEXT',
    /** Key rotation failed */
    ROTATION_FAILED: 'KMS_ROTATION_FAILED',
    /** Authentication failed */
    AUTH_FAILED: 'KMS_AUTH_FAILED',
    /** Connection failed */
    CONNECTION_FAILED: 'KMS_CONNECTION_FAILED',
    /** Rate limit exceeded */
    RATE_LIMITED: 'KMS_RATE_LIMITED',
    /** Invalid configuration */
    INVALID_CONFIG: 'KMS_INVALID_CONFIG',
    /** Cache error */
    CACHE_ERROR: 'KMS_CACHE_ERROR',
    /** Token expired */
    TOKEN_EXPIRED: 'KMS_TOKEN_EXPIRED',
    /** Provider not supported */
    UNSUPPORTED_PROVIDER: 'KMS_UNSUPPORTED_PROVIDER',
};
//# sourceMappingURL=types.js.map