/**
 * Security Cryptography Module
 *
 * Provides cryptographic primitives and FIPS 140-2 compliant operations
 * for FedRAMP compliance. This module is the primary entry point for
 * secure cryptographic operations in Vorion.
 *
 * ## Features
 *
 * - **FIPS 140-2 Compliance**: Enforces use of only FIPS-approved algorithms
 * - **Algorithm Validation**: Validates algorithms before every operation
 * - **Key Length Enforcement**: Ensures minimum key lengths per NIST guidelines
 * - **Comprehensive Auditing**: Logs all crypto operations for compliance
 * - **Certificate Validation**: Validates X.509 certificates for FIPS compliance
 * - **TLS Enforcement**: Ensures TLS 1.2+ for transport security
 *
 * ## Quick Start
 *
 * ```typescript
 * import {
 *   FIPSCryptoProvider,
 *   fipsEncrypt,
 *   fipsHash,
 *   enableFIPSMode,
 *   validateAlgorithm,
 * } from './security/crypto';
 *
 * // Enable FIPS mode globally
 * enableFIPSMode();
 *
 * // Or use the provider directly
 * const provider = new FIPSCryptoProvider({ enabled: true, strictMode: true });
 * await provider.initialize();
 *
 * // Encrypt data with FIPS-compliant AES-256-GCM
 * const encrypted = await provider.fipsEncrypt(
 *   Buffer.from('sensitive data'),
 *   key,
 *   'aes-256-gcm'
 * );
 *
 * // Hash data with SHA-256
 * const hash = await provider.fipsHash(Buffer.from('data'), 'sha256');
 *
 * // Validate algorithms
 * if (!validateAlgorithm('md5')) {
 *   console.log('MD5 is not FIPS compliant');
 * }
 * ```
 *
 * ## FIPS Mode Configuration
 *
 * FIPS mode can be enabled via:
 * - Environment variable: `VORION_FIPS_MODE=true`
 * - Programmatically: `enableFIPSMode()`
 * - Per-provider: `new FIPSCryptoProvider({ enabled: true })`
 *
 * ## Approved Algorithms
 *
 * **Symmetric Encryption:**
 * - AES-128-GCM, AES-256-GCM
 * - AES-128-CBC, AES-256-CBC
 * - AES-128-CTR, AES-256-CTR
 *
 * **Hash Functions:**
 * - SHA-256, SHA-384, SHA-512
 * - (NO SHA-1, MD5)
 *
 * **Asymmetric:**
 * - RSA (2048+ bits)
 * - ECDSA (P-256, P-384, P-521)
 *
 * **MACs:**
 * - HMAC-SHA256, HMAC-SHA384, HMAC-SHA512
 *
 * **Key Derivation:**
 * - PBKDF2 with approved hashes
 * - HKDF with approved hashes
 *
 * @packageDocumentation
 * @module security/crypto
 */
export { FIPS_SYMMETRIC_ALGORITHMS, FIPS_HASH_ALGORITHMS, FIPS_HMAC_ALGORITHMS, FIPS_ASYMMETRIC_ALGORITHMS, FIPS_ECDSA_CURVES, FIPS_MINIMUM_KEY_LENGTHS, NON_FIPS_ALGORITHMS, FIPS_TLS_VERSIONS, NON_FIPS_TLS_VERSIONS, type FIPSSymmetricAlgorithm, type FIPSHashAlgorithm, type FIPSHMACAlgorithm, type FIPSAsymmetricAlgorithm, type FIPSECDSACurve, } from './fips-mode.js';
export { type FIPSModeConfig, fipsModeConfigSchema, DEFAULT_FIPS_CONFIG, type CertificateValidationOptions, DEFAULT_CERT_VALIDATION_OPTIONS, } from './fips-mode.js';
export { CryptoOperationType, type CryptoOperation, cryptoOperationSchema, type FIPSViolation, fipsViolationSchema, type FIPSAuditEntry, fipsAuditEntrySchema, type FIPSAuditCallback, } from './fips-mode.js';
export { FIPSError, FIPSErrorCode, type FIPSErrorCode as FIPSErrorCodeType, } from './fips-mode.js';
export { validateAlgorithm, validateKeyLength, validateHash, isFIPSCompliant, validateTLSVersion, validateCipherSuite, } from './fips-mode.js';
export { FIPSCryptoProvider, createFIPSCryptoProvider, createFIPSCryptoProviderFromEnv, getFIPSCryptoProvider, setFIPSCryptoProvider, resetFIPSCryptoProvider, } from './fips-mode.js';
export { enableFIPSMode, disableFIPSMode, isFIPSModeEnabled, } from './fips-mode.js';
export { fipsEncrypt, fipsDecrypt, fipsHash, fipsSign, fipsRandomBytes, } from './fips-mode.js';
/**
 * Check if FIPS mode should be enabled based on environment
 *
 * @returns true if FIPS mode is requested via environment variable
 */
export declare function shouldEnableFIPSMode(): boolean;
/**
 * Get FIPS configuration from environment variables
 *
 * @returns FIPS configuration object
 */
export declare function getFIPSConfigFromEnv(): Partial<import('./fips-mode.js').FIPSModeConfig>;
/**
 * Initialize FIPS mode if required by environment
 *
 * This is a convenience function that checks the environment and
 * initializes FIPS mode if requested.
 *
 * @example
 * ```typescript
 * import { initializeFIPSModeIfRequired } from './security/crypto';
 *
 * // In application startup
 * await initializeFIPSModeIfRequired();
 * ```
 */
export declare function initializeFIPSModeIfRequired(): Promise<void>;
/**
 * Validate that an operation would be allowed in FIPS mode
 *
 * This is useful for checking compliance without actually performing
 * the operation.
 *
 * @param algorithm - The algorithm to validate
 * @param keyLength - Optional key length in bits
 * @param hashFunction - Optional hash function for composite operations
 * @returns Validation result with details
 *
 * @example
 * ```typescript
 * const result = validateFIPSOperation('aes-256-gcm', 256);
 * if (!result.compliant) {
 *   console.log('Non-compliant:', result.reason);
 * }
 * ```
 */
export declare function validateFIPSOperation(algorithm: string, keyLength?: number, hashFunction?: string): {
    compliant: boolean;
    reason?: string;
    algorithmValid: boolean;
    keyLengthValid: boolean;
    hashValid: boolean;
};
/**
 * List all FIPS-approved algorithms
 *
 * @returns Object containing all approved algorithms by category
 */
export declare function listFIPSApprovedAlgorithms(): {
    symmetric: string[];
    hash: string[];
    hmac: string[];
    asymmetric: string[];
    curves: string[];
};
/**
 * Post-Quantum Cryptography exports
 *
 * Re-exported from @vorionsys/security to avoid code duplication.
 * Provides NIST-standardized post-quantum algorithms:
 * - CRYSTALS-Kyber (ML-KEM) for key encapsulation
 * - CRYSTALS-Dilithium (ML-DSA) for digital signatures
 * - Hybrid modes combining classical and PQ algorithms
 * - Migration utilities for transitioning to PQ
 *
 * @example
 * ```typescript
 * import { postQuantum } from './security/crypto';
 *
 * const pq = await postQuantum.createPostQuantumProvider();
 * const keyPair = await pq.generateKEMKeyPair();
 * ```
 */
export { postQuantum } from '@vorion/security/crypto';
/**
 * Verified Shamir Secret Sharing exports
 *
 * Provides formally verified Shamir Secret Sharing with:
 * - GF(2^8) arithmetic with proven correctness
 * - Polynomial evaluation with overflow protection
 * - Lagrange interpolation with numerical stability
 * - Constant-time operations to prevent timing attacks
 * - Comprehensive testing and security analysis
 * - Interoperability with HashiCorp Vault and secrets.js
 *
 * @example
 * ```typescript
 * import { shamir } from './security/crypto';
 *
 * // Split a secret into shares
 * const secret = new TextEncoder().encode('my-secret-key');
 * const { shares } = shamir.split(secret, {
 *   threshold: 3,
 *   totalShares: 5,
 *   secretLength: secret.length,
 * });
 *
 * // Reconstruct with any 3 shares
 * const { secret: recovered } = shamir.reconstruct(shares.slice(0, 3), 3);
 * ```
 */
export * as shamir from './shamir/index.js';
//# sourceMappingURL=index.d.ts.map