/**
 * PKCS#11 Interface Wrapper
 *
 * Provides a standardized PKCS#11 interface wrapper for smart card
 * and hardware token compatibility. This module enables:
 * - Smart card authentication
 * - PIV (Personal Identity Verification) card support
 * - YubiKey HSM integration
 * - Generic PKCS#11 token access
 *
 * FIPS 140-3 Compliance Notes:
 * - All cryptographic operations are performed within the token
 * - Private keys never leave the secure boundary
 * - Supports FIPS-approved algorithms only when in FIPS mode
 *
 * @module security/hsm/pkcs11-wrapper
 */
import { BaseHSMProvider, HSMProviderConfig, HSMStatus, KeySpec, KeyHandle, EncryptionOptions } from './provider';
/**
 * PKCS#11 mechanism types
 */
export declare enum CKM {
    RSA_PKCS_KEY_PAIR_GEN = 0,
    RSA_PKCS = 1,
    RSA_PKCS_OAEP = 9,
    RSA_PKCS_PSS = 13,
    EC_KEY_PAIR_GEN = 4160,
    ECDSA = 4161,
    ECDSA_SHA256 = 4164,
    ECDSA_SHA384 = 4165,
    ECDSA_SHA512 = 4166,
    ECDH1_DERIVE = 4176,
    AES_KEY_GEN = 4224,
    AES_CBC = 4226,
    AES_CBC_PAD = 4229,
    AES_GCM = 4231,
    AES_KEY_WRAP = 8457,
    AES_KEY_WRAP_PAD = 8458,
    SHA256 = 592,
    SHA384 = 608,
    SHA512 = 624,
    SHA256_HMAC = 593,
    SHA384_HMAC = 609,
    SHA512_HMAC = 625,
    GENERIC_SECRET_KEY_GEN = 848,
    EDDSA = 2147486721
}
/**
 * PKCS#11 object class types
 */
export declare enum CKO {
    DATA = 0,
    CERTIFICATE = 1,
    PUBLIC_KEY = 2,
    PRIVATE_KEY = 3,
    SECRET_KEY = 4
}
/**
 * PKCS#11 key types
 */
export declare enum CKK {
    RSA = 0,
    DSA = 1,
    DH = 2,
    EC = 3,
    GENERIC_SECRET = 16,
    AES = 31,
    SHA256_HMAC = 43,
    SHA384_HMAC = 44,
    SHA512_HMAC = 45,
    EC_EDWARDS = 64
}
/**
 * PKCS#11 attribute types
 */
export declare enum CKA {
    CLASS = 0,
    TOKEN = 1,
    PRIVATE = 2,
    LABEL = 3,
    VALUE = 17,
    CERTIFICATE_TYPE = 128,
    ID = 258,
    SENSITIVE = 259,
    ENCRYPT = 260,
    DECRYPT = 261,
    WRAP = 262,
    UNWRAP = 263,
    SIGN = 264,
    VERIFY = 266,
    DERIVE = 268,
    MODULUS = 288,
    MODULUS_BITS = 289,
    PUBLIC_EXPONENT = 290,
    EC_PARAMS = 384,
    EC_POINT = 385,
    EXTRACTABLE = 354,
    KEY_TYPE = 256,
    VALUE_LEN = 353
}
/**
 * PKCS#11 user types
 */
export declare enum CKU {
    SO = 0,// Security Officer
    USER = 1,// Normal user
    CONTEXT_SPECIFIC = 2
}
/**
 * PKCS#11 return values
 */
export declare enum CKR {
    OK = 0,
    CANCEL = 1,
    HOST_MEMORY = 2,
    SLOT_ID_INVALID = 3,
    GENERAL_ERROR = 5,
    FUNCTION_FAILED = 6,
    ARGUMENTS_BAD = 7,
    NO_EVENT = 8,
    ATTRIBUTE_READ_ONLY = 16,
    ATTRIBUTE_SENSITIVE = 17,
    ATTRIBUTE_TYPE_INVALID = 18,
    ATTRIBUTE_VALUE_INVALID = 19,
    DATA_INVALID = 32,
    DATA_LEN_RANGE = 33,
    DEVICE_ERROR = 48,
    DEVICE_MEMORY = 49,
    DEVICE_REMOVED = 50,
    ENCRYPTED_DATA_INVALID = 64,
    ENCRYPTED_DATA_LEN_RANGE = 65,
    FUNCTION_CANCELED = 80,
    FUNCTION_NOT_PARALLEL = 81,
    FUNCTION_NOT_SUPPORTED = 84,
    KEY_HANDLE_INVALID = 96,
    KEY_SIZE_RANGE = 98,
    KEY_TYPE_INCONSISTENT = 99,
    KEY_NOT_NEEDED = 100,
    KEY_CHANGED = 101,
    KEY_NEEDED = 102,
    KEY_INDIGESTIBLE = 103,
    KEY_FUNCTION_NOT_PERMITTED = 104,
    KEY_NOT_WRAPPABLE = 105,
    KEY_UNEXTRACTABLE = 106,
    MECHANISM_INVALID = 112,
    MECHANISM_PARAM_INVALID = 113,
    PIN_INCORRECT = 160,
    PIN_INVALID = 161,
    PIN_LEN_RANGE = 162,
    PIN_EXPIRED = 163,
    PIN_LOCKED = 164,
    SESSION_CLOSED = 176,
    SESSION_COUNT = 177,
    SESSION_HANDLE_INVALID = 179,
    SESSION_PARALLEL_NOT_SUPPORTED = 180,
    SESSION_READ_ONLY = 181,
    SESSION_EXISTS = 182,
    SESSION_READ_ONLY_EXISTS = 183,
    SESSION_READ_WRITE_SO_EXISTS = 184,
    SIGNATURE_INVALID = 192,
    SIGNATURE_LEN_RANGE = 193,
    TOKEN_NOT_PRESENT = 224,
    TOKEN_NOT_RECOGNIZED = 225,
    TOKEN_WRITE_PROTECTED = 226,
    USER_ALREADY_LOGGED_IN = 256,
    USER_NOT_LOGGED_IN = 257,
    USER_PIN_NOT_INITIALIZED = 258,
    USER_TYPE_INVALID = 259,
    CRYPTOKI_NOT_INITIALIZED = 400,
    CRYPTOKI_ALREADY_INITIALIZED = 401
}
/**
 * PKCS#11 token info
 */
export interface TokenInfo {
    label: string;
    manufacturerId: string;
    model: string;
    serialNumber: string;
    flags: number;
    maxSessionCount: number;
    sessionCount: number;
    maxRwSessionCount: number;
    rwSessionCount: number;
    maxPinLen: number;
    minPinLen: number;
    totalPublicMemory: number;
    freePublicMemory: number;
    totalPrivateMemory: number;
    freePrivateMemory: number;
    hardwareVersion: {
        major: number;
        minor: number;
    };
    firmwareVersion: {
        major: number;
        minor: number;
    };
}
/**
 * PKCS#11 slot info
 */
export interface SlotInfo {
    slotId: number;
    slotDescription: string;
    manufacturerId: string;
    flags: number;
    hardwareVersion: {
        major: number;
        minor: number;
    };
    firmwareVersion: {
        major: number;
        minor: number;
    };
    tokenPresent: boolean;
}
/**
 * PKCS#11 mechanism info
 */
export interface MechanismInfo {
    mechanism: CKM;
    minKeySize: number;
    maxKeySize: number;
    flags: number;
}
export interface PKCS11WrapperConfig extends HSMProviderConfig {
    /** Path to the PKCS#11 library (.so/.dylib/.dll) */
    libraryPath: string;
    /** Slot index or label to use */
    slot?: number | string;
    /** User PIN for authentication */
    userPin?: string;
    /** Security Officer PIN (for initialization) */
    soPin?: string;
    /** Whether to use hardware RNG only */
    useHardwareRng?: boolean;
    /** Enable FIPS mode (restrict to FIPS-approved algorithms) */
    fipsMode?: boolean;
    /** Read-only session */
    readOnly?: boolean;
    /** Supported mechanisms whitelist */
    allowedMechanisms?: CKM[];
}
/**
 * PKCS#11 wrapper for smart cards and hardware tokens
 */
export declare class PKCS11WrapperProvider extends BaseHSMProvider {
    readonly name = "PKCS#11 Token";
    readonly isProduction = true;
    private pkcs11Config;
    private session;
    private objectHandles;
    private handleCounter;
    private fipsMode;
    private initialized;
    private slots;
    private tokenInfo;
    private mechanisms;
    constructor(config: PKCS11WrapperConfig);
    /**
     * Initialize and connect to PKCS#11 token
     */
    connect(): Promise<void>;
    /**
     * Initialize PKCS#11 library (C_Initialize)
     */
    private initializeLibrary;
    /**
     * Select slot to use
     */
    private selectSlot;
    /**
     * Open PKCS#11 session (C_OpenSession)
     */
    private openSession;
    /**
     * Login to token (C_Login)
     */
    private login;
    /**
     * Enumerate objects in token
     */
    private enumerateObjects;
    /**
     * Disconnect from token
     */
    disconnect(): Promise<void>;
    /**
     * Get HSM status
     */
    getStatus(): Promise<HSMStatus>;
    /**
     * Generate key using PKCS#11
     */
    generateKey(spec: KeySpec): Promise<KeyHandle>;
    /**
     * Validate FIPS compliance of key spec
     */
    private validateFIPSCompliance;
    /**
     * Generate symmetric key (C_GenerateKey)
     */
    private generateSymmetricKey;
    /**
     * Generate key pair (C_GenerateKeyPair)
     */
    private generateKeyPair;
    /**
     * Import key (C_CreateObject)
     */
    importKey(keyMaterial: Buffer, spec: KeySpec): Promise<KeyHandle>;
    /**
     * Export public key (C_GetAttributeValue)
     */
    exportPublicKey(keyHandle: string): Promise<Buffer>;
    /**
     * Get key metadata
     */
    getKey(keyHandle: string): Promise<KeyHandle | null>;
    /**
     * List keys
     */
    listKeys(filter?: Partial<KeySpec>): Promise<KeyHandle[]>;
    /**
     * Sign data (C_SignInit, C_Sign)
     */
    sign(keyHandle: string, data: Buffer, algorithm: string): Promise<Buffer>;
    /**
     * Verify signature (C_VerifyInit, C_Verify)
     */
    verify(keyHandle: string, data: Buffer, signature: Buffer, algorithm: string): Promise<boolean>;
    /**
     * Encrypt data (C_EncryptInit, C_Encrypt)
     */
    encrypt(keyHandle: string, data: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Decrypt data (C_DecryptInit, C_Decrypt)
     */
    decrypt(keyHandle: string, ciphertext: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Wrap key (C_WrapKey)
     */
    wrapKey(wrappingKeyHandle: string, keyToWrap: string, algorithm?: string): Promise<Buffer>;
    /**
     * Unwrap key (C_UnwrapKey)
     */
    unwrapKey(wrappingKeyHandle: string, wrappedKey: Buffer, spec: KeySpec, algorithm?: string): Promise<string>;
    /**
     * Destroy key (C_DestroyObject)
     */
    destroyKey(keyHandle: string): Promise<void>;
    /**
     * Get token info
     */
    getTokenInfo(): TokenInfo | null;
    /**
     * Get slot info
     */
    getSlotInfo(slotId?: number): SlotInfo | undefined;
    /**
     * List available mechanisms
     */
    getMechanisms(slotId?: number): MechanismInfo[];
    /**
     * Check if mechanism is supported
     */
    isMechanismSupported(mechanism: CKM, slotId?: number): boolean;
    /**
     * Generate random bytes using hardware RNG
     */
    generateRandom(length: number): Promise<Buffer>;
    /**
     * Seed the random number generator
     */
    seedRandom(seed: Buffer): Promise<void>;
    /**
     * Change user PIN
     */
    changePIN(oldPin: string, newPin: string): Promise<void>;
}
/**
 * Create PKCS#11 wrapper provider
 */
export declare function createPKCS11Provider(config: PKCS11WrapperConfig): PKCS11WrapperProvider;
//# sourceMappingURL=pkcs11-wrapper.d.ts.map