/**
 * Hardware Security Module (HSM) Integration Layer
 *
 * This module provides a unified interface for enterprise key management
 * across multiple HSM providers including:
 * - AWS CloudHSM
 * - Azure Dedicated/Managed HSM
 * - Google Cloud HSM
 * - Thales Luna Network HSM
 * - SoftHSM (for development)
 *
 * Features:
 * - Provider abstraction with automatic failover
 * - Key lifecycle management
 * - Multi-party key ceremonies with Shamir's Secret Sharing
 * - Health monitoring and audit logging
 * - Transparent integration with application code
 *
 * @module security/hsm
 */
export { IHSMProvider, HSMProviderConfig, HSMStatus, KeySpec, KeyHandle, KeyType, KeyUsage, ECCurve, EncryptionOptions, EncryptionAlgorithm, SigningAlgorithm, RetryConfig, AuditLogEntry, BaseHSMProvider, HSMError, HSMConnectionError, HSMKeyNotFoundError, HSMOperationError, HSMPermissionError, } from './provider';
export { AWSCloudHSMProvider, AWSCloudHSMConfig, } from './aws-cloudhsm';
export { AzureHSMProvider, AzureHSMConfig, AzureHSMRole, RoleAssignment, } from './azure-hsm';
export { GCPHSMProvider, GCPHSMConfig, GCPKeyAlgorithm, KeyVersionState, CloudKMSRole, IAMBinding, } from './gcp-hsm';
export { ThalesLunaProvider, ThalesLunaConfig, HAGroupMember, PartitionInfo, } from './thales-luna';
export { SoftHSMProvider, SoftHSMConfig, } from './local-softHSM';
export { KeyCeremonyManager, CeremonyConfig, Ceremony, CeremonyType, CeremonyStatus, CeremonyAction, CeremonyAuditEntry, KeyCustodian, CustodianRole, KeyShare, } from './key-ceremony';
export { KeyOperationsService, createKeyOperationsService, KeyPurpose, FIPSComplianceLevel, KeyGenerationOptions, EnvelopeEncryptionResult, KeyDerivationParams, SignatureOptions, KeyOperationMetrics, getFIPSKeySpec, } from './key-operations';
export { PKCS11WrapperProvider, PKCS11WrapperConfig, createPKCS11Provider, CKM, CKO, CKK, CKA, CKU, CKR, TokenInfo, SlotInfo, MechanismInfo, } from './pkcs11-wrapper';
export { HSMService, HSMServiceConfig, HSMProviderSelector, createHSMService, } from './hsm-service';
/**
 * Standard key specifications for common use cases
 */
export declare const StandardKeySpecs: {
    /**
     * AES-256 key for data encryption
     */
    DataEncryptionKey: {
        type: "AES";
        size: number;
        usage: ("encrypt" | "decrypt")[];
        extractable: boolean;
    };
    /**
     * AES-256 key for wrapping other keys
     */
    KeyEncryptionKey: {
        type: "AES";
        size: number;
        usage: ("wrap" | "unwrap")[];
        extractable: boolean;
    };
    /**
     * RSA-2048 key pair for signing
     */
    RSASigningKey: {
        type: "RSA";
        size: number;
        usage: ("sign" | "verify")[];
        extractable: boolean;
    };
    /**
     * RSA-2048 key pair for encryption
     */
    RSAEncryptionKey: {
        type: "RSA";
        size: number;
        usage: ("encrypt" | "decrypt")[];
        extractable: boolean;
    };
    /**
     * ECDSA P-256 key pair for signing
     */
    ECDSASigningKey: {
        type: "EC";
        curve: "P-256";
        usage: ("sign" | "verify")[];
        extractable: boolean;
    };
    /**
     * HMAC-SHA256 key for message authentication
     */
    HMACKey: {
        type: "HMAC";
        size: number;
        usage: ("sign" | "verify")[];
        extractable: boolean;
    };
};
/**
 * Environment-based provider recommendations
 */
export declare const ProviderRecommendations: {
    readonly development: readonly ["softhsm"];
    readonly staging: readonly ["softhsm", "aws", "azure", "gcp"];
    readonly production: readonly ["aws", "azure", "gcp", "thales"];
};
import { HSMService } from './hsm-service';
/**
 * Quick start: Create and initialize HSM service for the current environment
 *
 * @example
 * ```typescript
 * const hsm = await quickStart('development');
 * const key = await hsm.generateMasterKey('my-app-key');
 * const encrypted = await hsm.encrypt(key.id, Buffer.from('secret data'));
 * ```
 */
export declare function quickStart(environment?: 'development' | 'staging' | 'production'): Promise<HSMService>;
/**
 * Create a simple encryption service using SoftHSM
 * Useful for development and testing
 *
 * @example
 * ```typescript
 * const crypto = await createSimpleCryptoService();
 * const { keyId, ciphertext } = await crypto.encrypt('my-data', Buffer.from('hello'));
 * const plaintext = await crypto.decrypt(keyId, ciphertext);
 * ```
 */
export declare function createSimpleCryptoService(): Promise<{
    encrypt: (label: string, data: Buffer) => Promise<{
        keyId: string;
        ciphertext: Buffer;
    }>;
    decrypt: (keyId: string, ciphertext: Buffer) => Promise<Buffer>;
    sign: (label: string, data: Buffer) => Promise<{
        keyId: string;
        signature: Buffer;
    }>;
    verify: (keyId: string, data: Buffer, signature: Buffer) => Promise<boolean>;
    destroy: () => Promise<void>;
}>;
import type { HealthCheck } from '../../observability/health.js';
/**
 * Create HSM health check for observability integration
 *
 * @example
 * ```typescript
 * import { registerHealthCheck } from '@vorionsys/platform-core/observability';
 * import { createHSMHealthCheck } from '@vorionsys/platform-core/security/hsm';
 *
 * const hsmService = await createHSMService('production');
 * await hsmService.initialize();
 *
 * registerHealthCheck(createHSMHealthCheck(hsmService));
 * ```
 */
export declare function createHSMHealthCheck(service: HSMService, options?: {
    /** Whether this is a critical health check (affects overall status) */
    critical?: boolean;
    /** Custom name for the health check */
    name?: string;
    /** Timeout for health check in ms */
    timeoutMs?: number;
}): HealthCheck;
/**
 * HSM Configuration Schema for config integration
 *
 * Use this with Zod for configuration validation:
 *
 * @example
 * ```typescript
 * import { z } from 'zod';
 * import { hsmConfigSchema } from '@vorionsys/platform-core/security/hsm';
 *
 * const configSchema = z.object({
 *   // ... other config
 *   hsm: hsmConfigSchema,
 * });
 * ```
 */
export declare const HSMConfigDefaults: {
    /** Default HSM provider type */
    readonly defaultProvider: "softhsm";
    /** Available provider types */
    readonly providerTypes: readonly ["aws", "azure", "gcp", "thales", "softhsm", "pkcs11"];
    /** Default health check interval in milliseconds */
    readonly healthCheckIntervalMs: 30000;
    /** Default retry configuration */
    readonly retryConfig: {
        readonly maxAttempts: 3;
        readonly initialDelayMs: 100;
        readonly maxDelayMs: 5000;
        readonly backoffMultiplier: 2;
    };
    /** Default key cache TTL in seconds */
    readonly keyCacheTTLSeconds: 300;
    /** Default connection timeout in milliseconds */
    readonly connectionTimeoutMs: 30000;
    /** Default operation timeout in milliseconds */
    readonly operationTimeoutMs: 60000;
};
/**
 * HSM Configuration interface
 */
export interface HSMConfig {
    /** Enable HSM integration */
    enabled: boolean;
    /** HSM provider type */
    provider: 'aws' | 'azure' | 'gcp' | 'thales' | 'softhsm' | 'pkcs11';
    /** Enable failover to secondary providers */
    enableFailover: boolean;
    /** Failover provider types in priority order */
    failoverProviders?: Array<'aws' | 'azure' | 'gcp' | 'thales' | 'softhsm'>;
    /** Health check interval in milliseconds */
    healthCheckIntervalMs: number;
    /** Enable key caching */
    enableKeyCache: boolean;
    /** Key cache TTL in seconds */
    keyCacheTTLSeconds: number;
    /** Enable audit logging */
    enableAuditLogging: boolean;
    /** FIPS 140-3 compliance mode */
    fipsMode: boolean;
    /** Connection timeout in milliseconds */
    connectionTimeoutMs: number;
    /** Operation timeout in milliseconds */
    operationTimeoutMs: number;
    /** Provider-specific configuration */
    aws?: {
        clusterId: string;
        region: string;
        cryptoUser: string;
        cryptoUserPassword?: string;
    };
    azure?: {
        hsmName: string;
        region: string;
        tenantId: string;
        clientId: string;
    };
    gcp?: {
        projectId: string;
        location: string;
        keyRing: string;
    };
    thales?: {
        partitionName: string;
        hsmIpAddresses: string[];
    };
    pkcs11?: {
        libraryPath: string;
        slot?: number;
        fipsMode?: boolean;
    };
}
//# sourceMappingURL=index.d.ts.map