/**
 * Field-Level Encryption Module
 *
 * Provides transparent encryption for sensitive data fields stored in the database.
 * This module implements secure field-level encryption with the following features:
 *
 * - **Multiple Algorithms**: AES-256-GCM (default), AES-256-CBC, ChaCha20-Poly1305
 * - **Key Management**: Version-based key rotation with HKDF field-specific derivation
 * - **Data Classification**: PUBLIC, INTERNAL, CONFIDENTIAL, RESTRICTED levels
 * - **Decorator Support**: @Encrypted() and @SearchableEncrypted() for marking fields
 * - **Database Middleware**: Transparent encryption/decryption with Drizzle ORM hooks
 * - **Security Controls**: AAD binding, unique IVs, audit logging
 *
 * ## Quick Start
 *
 * ```typescript
 * import {
 *   FieldEncryptionService,
 *   Encrypted,
 *   SearchableEncrypted,
 *   DataClassification,
 *   createEncryptionMiddleware,
 * } from './security/encryption';
 *
 * // 1. Define entity with encrypted fields
 * class User {
 *   @Encrypted(DataClassification.RESTRICTED)
 *   ssn: string;
 *
 *   @SearchableEncrypted()
 *   email: string;
 * }
 *
 * // 2. Initialize service
 * const service = getFieldEncryptionService();
 * await service.initialize();
 *
 * // 3. Encrypt/decrypt fields
 * const encrypted = await service.encrypt('123-45-6789', {
 *   fieldName: 'ssn',
 *   classification: DataClassification.RESTRICTED,
 * });
 *
 * const plaintext = await service.decrypt(encrypted, { fieldName: 'ssn' });
 * ```
 *
 * ## Database Integration
 *
 * ```typescript
 * import { createMiddlewareFromClasses } from './security/encryption';
 *
 * const middleware = createMiddlewareFromClasses({
 *   users: User,
 *   patients: Patient,
 * });
 *
 * await middleware.initialize();
 *
 * // Use with database operations
 * const result = await middleware.beforeInsert(userData, {
 *   tableName: 'users',
 *   operation: 'insert',
 * });
 * ```
 *
 * ## Security Considerations
 *
 * - Master keys must be stored securely (environment variables, secrets manager)
 * - Key rotation is supported via versioning
 * - AAD binding prevents field swapping attacks
 * - Deterministic encryption is less secure but enables searching
 * - All operations are audit logged when enabled
 *
 * @packageDocumentation
 * @module security/encryption
 */
export { EncryptionAlgorithm, DataClassification, EncryptionOperation, EncryptionErrorCode, CLASSIFICATION_LEVELS, type EncryptedField, type EncryptedFieldMarker, isEncryptedFieldMarker, encryptedFieldSchema, encryptedFieldMarkerSchema, type KeyVersion, keyVersionSchema, type EncryptionConfig, encryptionConfigSchema, DEFAULT_ENCRYPTION_CONFIG, type FieldPolicy, type FieldEncryptionPolicy, fieldPolicySchema, fieldEncryptionPolicySchema, type EncryptOptions, type DecryptOptions, type ReencryptOptions, encryptOptionsSchema, decryptOptionsSchema, reencryptOptionsSchema, type EncryptionAuditEntry, type AuditCallback, type KeyRotationCallback, encryptionAuditEntrySchema, encryptionAlgorithmSchema, dataClassificationSchema, } from './types.js';
export { type KeyProvider, EnvKeyProvider, createEnvKeyProvider, KMSKeyProvider, createKMSKeyProvider, type KMSKeyProviderConfig, getKeyProvider, getInitializedKeyProvider, setKeyProvider, resetKeyProvider, createKeyProvider, } from './key-provider.js';
export { type KMSProvider, type KMSConfig, type AWSKMSConfig, type VaultKMSConfig, type LocalKMSConfig, type KeyMetadata as KMSKeyMetadata, type DataKey, KMSProviderType, KMSErrorCode, KMSOperation, AWSKMSProvider, HashiCorpVaultProvider, LocalKMSProvider, createKMSProvider, createKMSProviderFromEnv, getKMSProvider, getInitializedKMSProvider, setKMSProvider, resetKMSProvider, checkKMSHealth, type KMSHealthStatus, isKMSConfigured, detectKMSProviderType, } from '../kms/index.js';
export { FieldEncryptionError, FieldEncryptionService, createFieldEncryptionService, getFieldEncryptionService, setFieldEncryptionService, resetFieldEncryptionService, } from './service.js';
export { Encrypted, SearchableEncrypted, NotEncrypted, getEncryptedFields, hasEncryptedFields, getFieldMetadata, isFieldEncrypted, isFieldSearchable, generatePolicy, generatePolicies, type EncryptedFieldMetadata, type EncryptedOptions, type SearchableEncryptedOptions, type EncryptedFieldNames, type WithEncryptedFields, } from './decorators.js';
export { EncryptionMiddleware, createEncryptionMiddleware, createMiddlewareFromClasses, getEncryptionMiddleware, setEncryptionMiddleware, resetEncryptionMiddleware, PolicyBuilder, policyBuilder, type TablePolicy, type EncryptionMiddlewareConfig, type OperationContext, type HookResult, type DrizzleEncryptionConfig, } from './middleware.js';
//# sourceMappingURL=index.d.ts.map