/**
 * Key Operations Module
 *
 * Provides high-level cryptographic operations using HSM-backed keys.
 * This module abstracts common key management patterns for:
 * - Key generation with FIPS 140-3 compliant algorithms
 * - Digital signatures (ECDSA, RSA-PSS, Ed25519)
 * - Envelope encryption with automatic key wrapping
 * - Key derivation (HKDF, PBKDF2)
 * - Secure key import/export
 *
 * @module security/hsm/key-operations
 */
import { EventEmitter } from 'events';
import { IHSMProvider, KeySpec, KeyHandle, SigningAlgorithm } from './provider';
/**
 * Key purpose for automatic key specification
 */
export declare enum KeyPurpose {
    /** Data encryption at rest */
    DATA_ENCRYPTION = "DATA_ENCRYPTION",
    /** Key wrapping (KEK) */
    KEY_WRAPPING = "KEY_WRAPPING",
    /** Digital signatures */
    SIGNING = "SIGNING",
    /** Message authentication codes */
    MAC = "MAC",
    /** Key derivation */
    KEY_DERIVATION = "KEY_DERIVATION",
    /** TLS/mTLS certificates */
    TLS_CERTIFICATE = "TLS_CERTIFICATE",
    /** Code signing */
    CODE_SIGNING = "CODE_SIGNING",
    /** Document signing */
    DOCUMENT_SIGNING = "DOCUMENT_SIGNING",
    /** JWT/JWS signing */
    JWT_SIGNING = "JWT_SIGNING",
    /** Root CA key */
    ROOT_CA = "ROOT_CA",
    /** Intermediate CA key */
    INTERMEDIATE_CA = "INTERMEDIATE_CA"
}
/**
 * FIPS 140-3 compliance level
 */
export declare enum FIPSComplianceLevel {
    /** Level 1: Software implementation */
    LEVEL_1 = 1,
    /** Level 2: Tamper-evident hardware */
    LEVEL_2 = 2,
    /** Level 3: Tamper-resistant hardware with identity authentication */
    LEVEL_3 = 3,
    /** Level 4: Complete physical security envelope */
    LEVEL_4 = 4
}
/**
 * Key generation options
 */
export interface KeyGenerationOptions {
    /** Key purpose determines appropriate algorithm selection */
    purpose: KeyPurpose;
    /** Human-readable label */
    label: string;
    /** Optional key ID (auto-generated if not provided) */
    id?: string;
    /** Key expiration date */
    expiresAt?: Date;
    /** Whether key can be exported */
    exportable?: boolean;
    /** Custom attributes */
    attributes?: Record<string, unknown>;
    /** Minimum FIPS compliance level required */
    minFIPSLevel?: FIPSComplianceLevel;
}
/**
 * Envelope encryption result
 */
export interface EnvelopeEncryptionResult {
    /** Encrypted data */
    ciphertext: Buffer;
    /** Encrypted data encryption key */
    encryptedDEK: Buffer;
    /** Key encryption key ID used */
    kekId: string;
    /** Initialization vector */
    iv: Buffer;
    /** Authentication tag (for AEAD) */
    authTag: Buffer;
    /** Algorithm used */
    algorithm: string;
}
/**
 * Key derivation parameters
 */
export interface KeyDerivationParams {
    /** Derivation algorithm */
    algorithm: 'HKDF-SHA256' | 'HKDF-SHA384' | 'HKDF-SHA512' | 'PBKDF2-SHA256' | 'PBKDF2-SHA512';
    /** Salt (optional for HKDF, required for PBKDF2) */
    salt?: Buffer;
    /** Info/context for HKDF */
    info?: Buffer;
    /** Iteration count for PBKDF2 */
    iterations?: number;
    /** Desired output length in bytes */
    outputLength: number;
}
/**
 * Signature options
 */
export interface SignatureOptions {
    /** Signing algorithm */
    algorithm?: SigningAlgorithm;
    /** Pre-hash the data */
    preHash?: boolean;
    /** Hash algorithm for pre-hashing */
    hashAlgorithm?: 'SHA-256' | 'SHA-384' | 'SHA-512';
}
/**
 * Key operation metrics
 */
export interface KeyOperationMetrics {
    totalOperations: number;
    operationsByType: Record<string, number>;
    averageLatencyMs: Record<string, number>;
    failureCount: number;
    lastOperation: Date | null;
}
/**
 * Get FIPS 140-3 compliant key specification for a given purpose
 */
export declare function getFIPSKeySpec(purpose: KeyPurpose, label: string, options?: Partial<KeyGenerationOptions>): KeySpec;
/**
 * High-level key operations service
 */
export declare class KeyOperationsService extends EventEmitter {
    private hsm;
    private metrics;
    private keyCache;
    private kekId;
    constructor(hsm: IHSMProvider);
    /**
     * Initialize the service with a master KEK
     */
    initialize(masterKekLabel?: string): Promise<void>;
    /**
     * Generate a key for a specific purpose with FIPS-compliant parameters
     */
    generateKey(options: KeyGenerationOptions): Promise<KeyHandle>;
    /**
     * Generate a signing key pair (ECDSA or RSA)
     */
    generateSigningKey(label: string, algorithm?: 'ECDSA' | 'RSA' | 'Ed25519', options?: Partial<KeyGenerationOptions>): Promise<KeyHandle>;
    /**
     * Generate an encryption key (AES-256)
     */
    generateEncryptionKey(label: string, options?: Partial<KeyGenerationOptions>): Promise<KeyHandle>;
    /**
     * Envelope encryption: encrypt data with a random DEK, then wrap DEK with KEK
     */
    envelopeEncrypt(data: Buffer, kekId?: string, aad?: Buffer): Promise<EnvelopeEncryptionResult>;
    /**
     * Envelope decryption: unwrap DEK with KEK, then decrypt data
     */
    envelopeDecrypt(envelope: EnvelopeEncryptionResult, aad?: Buffer): Promise<Buffer>;
    /**
     * Sign data using a key in the HSM
     */
    sign(keyId: string, data: Buffer, options?: SignatureOptions): Promise<Buffer>;
    /**
     * Verify a signature using a key in the HSM
     */
    verify(keyId: string, data: Buffer, signature: Buffer, options?: SignatureOptions): Promise<boolean>;
    /**
     * Get default signing algorithm for a key type
     */
    private getDefaultSigningAlgorithm;
    /**
     * Derive a key using HKDF or PBKDF2
     */
    deriveKey(masterKeyId: string, params: KeyDerivationParams, outputKeySpec: Partial<KeySpec>): Promise<KeyHandle>;
    /**
     * HKDF implementation
     */
    private hkdf;
    /**
     * Get a key by ID
     */
    getKey(keyId: string): Promise<KeyHandle | null>;
    /**
     * List keys by purpose
     */
    listKeysByPurpose(purpose: KeyPurpose): Promise<KeyHandle[]>;
    /**
     * Rotate a key
     */
    rotateKey(oldKeyId: string, newLabel?: string): Promise<KeyHandle>;
    /**
     * Export public key in various formats
     */
    exportPublicKey(keyId: string, format?: 'spki' | 'jwk' | 'pem'): Promise<Buffer | string | object>;
    /**
     * Update operation metrics
     */
    private updateMetrics;
    /**
     * Get current metrics
     */
    getMetrics(): KeyOperationMetrics;
    /**
     * Reset metrics
     */
    resetMetrics(): void;
}
/**
 * Create and initialize key operations service
 */
export declare function createKeyOperationsService(hsm: IHSMProvider, masterKekLabel?: string): Promise<KeyOperationsService>;
//# sourceMappingURL=key-operations.d.ts.map