/**
 * Azure Dedicated HSM / Managed HSM Provider Implementation
 * Integrates with Azure Key Vault Managed HSM using REST API
 */
import { BaseHSMProvider, HSMProviderConfig, HSMStatus, KeySpec, KeyHandle, EncryptionOptions } from './provider';
export interface AzureHSMConfig extends HSMProviderConfig {
    /** Managed HSM name */
    hsmName: string;
    /** Azure region */
    region: string;
    /** Tenant ID */
    tenantId: string;
    /** Client ID for authentication */
    clientId: string;
    /** Client secret or certificate */
    clientSecret?: string;
    clientCertificate?: string;
    /** HSM type: dedicated or managed */
    hsmType: 'dedicated' | 'managed';
    /** Enable soft-delete protection */
    softDeleteEnabled?: boolean;
    /** Soft-delete retention days */
    softDeleteRetentionDays?: number;
    /** Enable purge protection */
    purgeProtectionEnabled?: boolean;
    /** RBAC role assignments */
    roleAssignments?: RoleAssignment[];
}
/**
 * Azure RBAC role assignment
 */
export interface RoleAssignment {
    principalId: string;
    roleDefinitionId: string;
    scope: string;
}
/**
 * Azure HSM built-in roles
 */
export declare enum AzureHSMRole {
    MANAGED_HSM_ADMINISTRATOR = "7b123706-7f22-4f2d-9572-5b0b0a7c1b4b",
    MANAGED_HSM_CRYPTO_OFFICER = "515eb02d-2335-4d2d-92f2-b1cbdf9c3778",
    MANAGED_HSM_CRYPTO_USER = "21dbd100-6940-42c2-9190-5d6cb909625b",
    MANAGED_HSM_POLICY_READER = "d6f5c0f3-3e77-4f8c-bf88-2f2d33c91ae3",
    MANAGED_HSM_CRYPTO_SERVICE_ENCRYPTION = "33413926-3206-4cdd-b39a-83574fe37a17",
    MANAGED_HSM_BACKUP = "7b127d3c-77bd-4e3e-bbe0-dbb8971fa7f8"
}
export declare class AzureHSMProvider extends BaseHSMProvider {
    readonly name = "Azure Managed HSM";
    readonly isProduction = true;
    private azureConfig;
    private accessToken;
    private tokenExpiry;
    private baseUrl;
    private keyMap;
    constructor(config: AzureHSMConfig);
    /**
     * Connect to Azure Managed HSM
     */
    connect(): Promise<void>;
    /**
     * Authenticate with Azure AD
     */
    private authenticate;
    /**
     * Verify connection to HSM
     */
    private verifyConnection;
    /**
     * Make authenticated request to Azure HSM API
     */
    private makeRequest;
    /**
     * Disconnect from Azure HSM
     */
    disconnect(): Promise<void>;
    /**
     * Get HSM status
     */
    getStatus(): Promise<HSMStatus>;
    /**
     * Generate key in Azure HSM
     */
    generateKey(spec: KeySpec): Promise<KeyHandle>;
    /**
     * Map key type to Azure format
     */
    private mapKeyType;
    /**
     * Map curve to Azure format
     */
    private mapCurve;
    /**
     * Map key usage to Azure operations
     */
    private mapKeyUsage;
    /**
     * Get default key size
     */
    private getDefaultKeySize;
    /**
     * Import key into Azure HSM
     */
    importKey(keyMaterial: Buffer, spec: KeySpec): Promise<KeyHandle>;
    /**
     * Export public key
     */
    exportPublicKey(keyHandle: string): Promise<Buffer>;
    /**
     * Get key metadata
     */
    getKey(keyHandle: string): Promise<KeyHandle | null>;
    /**
     * List keys
     */
    listKeys(filter?: Partial<KeySpec>): Promise<KeyHandle[]>;
    /**
     * Sign data
     */
    sign(keyHandle: string, data: Buffer, algorithm: string): Promise<Buffer>;
    /**
     * Map signing algorithm to Azure format
     */
    private mapSigningAlgorithm;
    /**
     * Verify signature
     */
    verify(keyHandle: string, data: Buffer, signature: Buffer, algorithm: string): Promise<boolean>;
    /**
     * Encrypt data
     */
    encrypt(keyHandle: string, data: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Decrypt data
     */
    decrypt(keyHandle: string, ciphertext: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Wrap key
     */
    wrapKey(wrappingKeyHandle: string, keyToWrap: string, algorithm?: string): Promise<Buffer>;
    /**
     * Unwrap key
     */
    unwrapKey(wrappingKeyHandle: string, wrappedKey: Buffer, spec: KeySpec, algorithm?: string): Promise<string>;
    /**
     * Destroy key (soft delete)
     */
    destroyKey(keyHandle: string): Promise<void>;
    /**
     * Recover a soft-deleted key
     */
    recoverDeletedKey(keyId: string): Promise<KeyHandle>;
    /**
     * Purge a soft-deleted key (permanent deletion)
     */
    purgeDeletedKey(keyId: string): Promise<void>;
    /**
     * Create role assignment
     */
    createRoleAssignment(assignment: RoleAssignment): Promise<void>;
    /**
     * Get HSM security domain for backup/restore
     */
    getSecurityDomain(): Promise<Buffer>;
    /**
     * Backup key
     */
    backupKey(keyId: string): Promise<Buffer>;
    /**
     * Restore key from backup
     */
    restoreKey(backupBlob: Buffer): Promise<KeyHandle>;
}
//# sourceMappingURL=azure-hsm.d.ts.map