import 'reflect-metadata';
import type { SecurityMetadata } from './SecurityMetadata.js';
import { EncryptionScope } from './EncryptionScope.js';
import { ChronicleClassOrPropertyDecorator } from '../types/propertyDecoratorMetadata.js';
/**
 * Decorator that marks a property or type as needing plain-confidentiality encryption at rest - a
 * security measure, not a compliance one.
 *
 * Use `@encrypted()` for an operational secret that has no data subject and no lawful basis for
 * erasure - an API key, a webhook signing secret, a partner credential. Use `@pii()` instead when
 * the value is personal data about a natural person: only `@pii()` encrypts a value *and* enrolls it
 * in GDPR right-to-erasure. Marking a secret `@pii()` would make it erasable on a request that was
 * never about it; marking personal data `@encrypted()` would encrypt it but never erase it. The two
 * are not interchangeable, and this decorator's key is never provisioned under the same identity a
 * `@pii()` value for the same subject uses.
 *
 * All three {@link EncryptionScope} members are honored by the kernel: `EncryptionScope.Subject`
 * (the default) provisions a key per compliance identity, exactly matching how a `@pii()` value on
 * the same document is resolved; `EncryptionScope.Namespace` provisions one key shared by every
 * value marked with it in a given event store namespace; `EncryptionScope.Global` provisions one key
 * shared across the whole installation. Choosing a wider scope is safe for `@encrypted()` in a way
 * it is not for `@pii()`, precisely because an operational secret has no data subject whose erasure
 * request the wider key could ever need to honor separately from another subject's.
 *
 * This decorator can be used in two ways:
 * - As a property decorator: `@encrypted() propertyName: type`
 * - As a class decorator: `@encrypted() class TypeName { }`
 *
 * @param scope - The {@link EncryptionScope} the key is provisioned under - defaults to `EncryptionScope.Subject`.
 * @param details - Optional details explaining why or to what purpose/extent the property/type needs encryption.
 * @returns A decorator function that can be applied to either properties or classes (but not both on the same target).
 *
 * @example
 * Property usage:
 * ```typescript
 * @fromEvent(PartnerIntegrated)
 * class PartnerIntegration {
 *     @encrypted()
 *     apiKey: string = '';
 *
 *     @encrypted(EncryptionScope.Namespace)
 *     webhookSigningSecret: string = '';
 * }
 * ```
 */
export declare function encrypted(scope?: EncryptionScope, details?: string): ChronicleClassOrPropertyDecorator;
/**
 * Gets the encrypted security metadata for a property.
 * @param target - The class prototype.
 * @param propertyKey - The property name.
 * @returns The security metadata, or undefined if not decorated with @encrypted.
 */
export declare function getEncryptedMetadata(target: object, propertyKey: string): SecurityMetadata | undefined;
/**
 * Checks whether a property has been decorated with @encrypted.
 * @param target - The class prototype.
 * @param propertyKey - The property name.
 * @returns True if the property has @encrypted decorator; false otherwise.
 */
export declare function hasEncryptedMetadata(target: object, propertyKey: string): boolean;
/**
 * Gets the encrypted security metadata for a type.
 * @param type - The type constructor.
 * @returns The security metadata, or undefined if not decorated with @encrypted.
 */
export declare function getTypeEncryptedMetadata(type: Function): SecurityMetadata | undefined;
/**
 * Checks whether a type has been decorated with @encrypted.
 * @param type - The type constructor.
 * @returns True if the type has @encrypted decorator; false otherwise.
 */
export declare function isEncrypted(type: Function): boolean;
//# sourceMappingURL=encrypted.d.ts.map