/**
 * @fileoverview Software-based key rotation system for the Vorion platform.
 *
 * This module provides comprehensive key lifecycle management including:
 * - Key generation for signing purposes
 * - Automatic and manual key rotation with configurable intervals
 * - Key versioning and history tracking
 * - Redis-backed key metadata storage
 * - Graceful key retirement with overlap periods
 * - Emergency key compromise handling
 *
 * The implementation uses the existing crypto module for key generation
 * and Redis for metadata storage. Key material is stored encrypted
 * using the platform's encryption utilities.
 *
 * @module security/key-rotation
 */
import { type EncryptedEnvelope } from '../common/encryption.js';
/**
 * Supported key types in the rotation system.
 */
export type KeyType = 'signing' | 'encryption' | 'jwt';
/**
 * Key lifecycle status values.
 */
export type KeyStatus = 'pending' | 'active' | 'rotating' | 'retired' | 'compromised';
/**
 * Metadata describing a cryptographic key's properties and lifecycle state.
 */
export interface KeyMetadata {
    /** Unique identifier for the key (UUID v4) */
    id: string;
    /** The purpose/type of this key */
    type: KeyType;
    /** Cryptographic algorithm used */
    algorithm: string;
    /** Timestamp when the key was generated */
    createdAt: Date;
    /** Timestamp when the key became active for signing/encryption */
    activatedAt?: Date;
    /** Timestamp when the key should be rotated */
    expiresAt?: Date;
    /** Timestamp when rotation was initiated */
    rotatedAt?: Date;
    /** Timestamp when the key was retired from use */
    retiredAt?: Date;
    /** Current lifecycle status of the key */
    status: KeyStatus;
    /** Monotonically increasing version number for this key type */
    version: number;
    /** SHA-256 hash of the public key for identification */
    fingerprint: string;
}
/**
 * Configuration options for automatic key rotation.
 */
export interface KeyRotationConfig {
    /** Days before signing keys should be rotated (default: 90) */
    signingKeyRotationDays: number;
    /** Days before encryption keys should be rotated (default: 365) */
    encryptionKeyRotationDays: number;
    /** Days before JWT keys should be rotated (default: 30) */
    jwtKeyRotationDays: number;
    /** Days to keep old keys valid after rotation for verification (default: 7) */
    keyOverlapDays: number;
    /** Enable automatic rotation scheduling (default: false) */
    autoRotate: boolean;
    /** Days before expiration to send rotation notifications (default: 14) */
    notifyBeforeDays: number;
}
/**
 * Complete stored key including encrypted key material.
 */
export interface StoredKey {
    /** Key metadata and lifecycle information */
    metadata: KeyMetadata;
    /** Encrypted private key (JSON envelope) */
    encryptedPrivateKey?: EncryptedEnvelope;
    /** Public key in base64 format */
    publicKey?: string;
}
/**
 * Status information for a key type's rotation state.
 */
export interface RotationStatus {
    /** The key type this status applies to */
    type: KeyType;
    /** Current active key metadata */
    activeKey: KeyMetadata | null;
    /** Number of keys in the overlap/grace period */
    keysInGracePeriod: number;
    /** Days until the active key expires */
    daysUntilExpiration: number | null;
    /** Whether rotation is needed based on configuration */
    rotationNeeded: boolean;
    /** Whether rotation is currently in progress */
    rotationInProgress: boolean;
    /** Timestamp of last successful rotation */
    lastRotation: Date | null;
    /** Timestamp of next scheduled rotation */
    nextScheduledRotation: Date | null;
}
/** Default rotation configuration */
declare const DEFAULT_CONFIG: KeyRotationConfig;
/**
 * Manages the complete lifecycle of cryptographic keys for the Vorion platform.
 *
 * This class provides comprehensive key management capabilities including:
 * - Generation of signing keys (Ed25519/ECDSA)
 * - Automatic and manual key rotation with configurable intervals
 * - Key versioning to support signature verification during rotation
 * - Redis-backed metadata storage with encrypted key material
 * - Emergency key compromise procedures
 *
 * @example
 * ```typescript
 * const manager = getKeyRotationManager();
 * await manager.initialize();
 *
 * // Generate initial keys
 * await manager.generateKey('signing');
 *
 * // Get active key for signing
 * const activeKey = await manager.getActiveKey('signing');
 *
 * // Check rotation status
 * const statuses = await manager.getRotationStatus();
 * ```
 */
export declare class KeyRotationManager {
    private config;
    private initialized;
    private rotationTimers;
    private redis;
    /**
     * Initializes the key rotation manager.
     */
    initialize(): Promise<void>;
    /**
     * Validates that the manager has been initialized.
     */
    private ensureInitialized;
    /**
     * Gets the Redis client.
     */
    private getRedis;
    /**
     * Gets the next version number for a key type.
     */
    private getNextVersion;
    /**
     * Gets the rotation days for a specific key type.
     */
    private getRotationDays;
    /**
     * Generates a new cryptographic key of the specified type.
     */
    generateKey(type: KeyType): Promise<KeyMetadata>;
    /**
     * Rotates the active key for a specific type.
     */
    rotateKey(type: KeyType): Promise<KeyMetadata>;
    /**
     * Retrieves a key by its ID.
     */
    private getKeyById;
    /**
     * Retrieves the currently active key for a specific type.
     */
    getActiveKey(type: KeyType): Promise<StoredKey | null>;
    /**
     * Retrieves all keys that are currently valid for verification.
     */
    getActiveKeys(type: KeyType): Promise<StoredKey[]>;
    /**
     * Retrieves metadata for all key versions of a specific type.
     */
    getAllKeyVersions(type: KeyType): Promise<KeyMetadata[]>;
    /**
     * Retires a key, making it unavailable for new operations.
     */
    retireKey(keyId: string, reason: string): Promise<void>;
    /**
     * Marks a key as compromised, immediately revoking it.
     */
    compromiseKey(keyId: string, reason: string): Promise<void>;
    /**
     * Configures and starts automatic key rotation scheduling.
     */
    scheduleRotation(config: KeyRotationConfig): void;
    /**
     * Checks if a key type needs rotation and performs it if necessary.
     */
    private checkAndRotate;
    /**
     * Gets the current rotation status for all key types.
     */
    getRotationStatus(): Promise<RotationStatus[]>;
    /**
     * Stops all scheduled rotation timers.
     */
    shutdown(): void;
}
/**
 * Gets the singleton instance of the KeyRotationManager.
 */
export declare function getKeyRotationManager(): KeyRotationManager;
/**
 * Resets the singleton instance (primarily for testing).
 */
export declare function resetKeyRotationManager(): void;
export { DEFAULT_CONFIG as defaultKeyRotationConfig };
//# sourceMappingURL=key-rotation.d.ts.map