/**
 * HSM Service - Orchestration Layer
 * Provides unified interface for HSM operations with automatic failover,
 * health monitoring, circuit breaker protection, and audit logging
 */
import { EventEmitter } from 'events';
import { HSMStatus, KeySpec, KeyHandle, EncryptionOptions, AuditLogEntry, ECCurve } from './provider';
import { AWSCloudHSMConfig } from './aws-cloudhsm';
import { AzureHSMConfig } from './azure-hsm';
import { GCPHSMConfig } from './gcp-hsm';
import { ThalesLunaConfig } from './thales-luna';
import { SoftHSMConfig } from './local-softHSM';
import { KeyCeremonyManager, CeremonyConfig, Ceremony } from './key-ceremony';
export interface HSMServiceConfig {
    /** Primary HSM provider configuration */
    primary: HSMProviderSelector;
    /** Failover HSM providers (in priority order) */
    failover?: HSMProviderSelector[];
    /** Enable automatic failover */
    enableFailover?: boolean;
    /** Health check interval in milliseconds */
    healthCheckInterval?: number;
    /** Maximum retries before failover */
    maxRetriesBeforeFailover?: number;
    /** Enable audit logging */
    enableAuditLogging?: boolean;
    /** Audit log destination */
    auditLogDestination?: 'memory' | 'file' | 'external';
    /** Audit log file path (if destination is 'file') */
    auditLogPath?: string;
    /** External audit log callback */
    auditLogCallback?: (entry: AuditLogEntry) => void;
    /** Enable key caching for metadata */
    enableKeyCache?: boolean;
    /** Key cache TTL in seconds */
    keyCacheTTL?: number;
    /** Environment (affects default provider selection) */
    environment?: 'development' | 'staging' | 'production';
}
/**
 * Provider type selector
 */
export type HSMProviderSelector = {
    type: 'aws';
    config: AWSCloudHSMConfig;
} | {
    type: 'azure';
    config: AzureHSMConfig;
} | {
    type: 'gcp';
    config: GCPHSMConfig;
} | {
    type: 'thales';
    config: ThalesLunaConfig;
} | {
    type: 'softhsm';
    config: SoftHSMConfig;
};
/**
 * Operation metrics
 */
interface OperationMetrics {
    totalOperations: number;
    successfulOperations: number;
    failedOperations: number;
    averageLatency: number;
    operationsByType: Record<string, number>;
    failoverCount: number;
}
export declare class HSMService extends EventEmitter {
    private config;
    private providers;
    private activeProvider;
    private keyCache;
    private auditLogs;
    private healthCheckTimer;
    private metrics;
    private ceremonyManager;
    private initialized;
    constructor(config: HSMServiceConfig);
    /**
     * Initialize the HSM service
     */
    initialize(): Promise<void>;
    /**
     * Create provider from configuration
     */
    private createProvider;
    /**
     * Shutdown the HSM service
     */
    shutdown(): Promise<void>;
    /**
     * Start health check timer
     */
    private startHealthChecks;
    /**
     * Stop health check timer
     */
    private stopHealthChecks;
    /**
     * Perform health checks on all providers
     */
    private performHealthChecks;
    /**
     * Perform failover to next available provider
     */
    private performFailover;
    /**
     * Execute operation with circuit breaker, retry, and failover
     *
     * The circuit breaker provides:
     * - Fast failure when HSM is known to be unavailable
     * - Protection against cascading failures
     * - Automatic recovery testing via half-open state
     */
    private executeWithFailover;
    /**
     * Get the type of the currently active provider
     */
    private getProviderType;
    /**
     * Internal method for retry and failover logic
     */
    private executeWithRetryAndFailover;
    /**
     * Update operation metrics
     */
    private updateMetrics;
    /**
     * Log audit entry
     */
    private logAudit;
    /**
     * Generate a new key
     */
    generateKey(spec: KeySpec): Promise<KeyHandle>;
    /**
     * Import a key
     */
    importKey(keyMaterial: Buffer, spec: KeySpec): Promise<KeyHandle>;
    /**
     * Get key metadata
     */
    getKey(keyHandle: string): Promise<KeyHandle | null>;
    /**
     * List all keys
     */
    listKeys(filter?: Partial<KeySpec>): Promise<KeyHandle[]>;
    /**
     * Export public key
     */
    exportPublicKey(keyHandle: string): Promise<Buffer>;
    /**
     * Destroy a key
     */
    destroyKey(keyHandle: string): Promise<void>;
    /**
     * Sign data
     */
    sign(keyHandle: string, data: Buffer, algorithm: string): Promise<Buffer>;
    /**
     * Verify signature
     */
    verify(keyHandle: string, data: Buffer, signature: Buffer, algorithm: string): Promise<boolean>;
    /**
     * Encrypt data
     */
    encrypt(keyHandle: string, data: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Decrypt data
     */
    decrypt(keyHandle: string, ciphertext: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Wrap key
     */
    wrapKey(wrappingKeyHandle: string, keyToWrap: string, algorithm?: string): Promise<Buffer>;
    /**
     * Unwrap key
     */
    unwrapKey(wrappingKeyHandle: string, wrappedKey: Buffer, spec: KeySpec, algorithm?: string): Promise<string>;
    /**
     * Create a key ceremony
     */
    createCeremony(config: CeremonyConfig): Promise<Ceremony>;
    /**
     * Start a key ceremony
     */
    startCeremony(ceremonyId: string): Promise<void>;
    /**
     * Get ceremony
     */
    getCeremony(ceremonyId: string): Ceremony | undefined;
    /**
     * Get ceremony manager for advanced operations
     */
    getCeremonyManager(): KeyCeremonyManager | null;
    /**
     * Get service status
     */
    getStatus(): Promise<{
        initialized: boolean;
        activeProvider: string | null;
        providers: Array<{
            name: string;
            status: HSMStatus;
            isActive: boolean;
        }>;
        metrics: OperationMetrics;
    }>;
    /**
     * Get operation metrics
     */
    getMetrics(): OperationMetrics;
    /**
     * Get audit logs
     */
    getAuditLogs(startTime?: Date, endTime?: Date): AuditLogEntry[];
    /**
     * Clear metrics
     */
    resetMetrics(): void;
    /**
     * Cache a key
     */
    private cacheKey;
    /**
     * Clear key cache
     */
    clearKeyCache(): void;
    /**
     * Remove expired cache entries
     */
    cleanupCache(): void;
    /**
     * Generate a master encryption key
     */
    generateMasterKey(label: string): Promise<KeyHandle>;
    /**
     * Generate a signing key pair
     */
    generateSigningKeyPair(label: string, algorithm?: 'RSA' | 'EC', curve?: ECCurve): Promise<KeyHandle>;
    /**
     * Generate a key encryption key (KEK)
     */
    generateKEK(label: string): Promise<KeyHandle>;
    /**
     * Encrypt data with automatic key selection
     */
    encryptData(keyLabel: string, data: Buffer): Promise<{
        keyId: string;
        ciphertext: Buffer;
    }>;
    /**
     * Check if running in production mode
     */
    isProductionMode(): boolean;
}
/**
 * Create HSM service with default configuration based on environment
 */
export declare function createHSMService(environment: 'development' | 'staging' | 'production'): HSMService;
export {};
//# sourceMappingURL=hsm-service.d.ts.map