/**
 * Google Cloud HSM Provider Implementation
 * Integrates with Cloud KMS HSM protection level
 */
import * as crypto from 'crypto';
import { BaseHSMProvider, KeyType, KeyUsage, HSMConnectionError, HSMOperationError, HSMKeyNotFoundError, ECCurve, } from './provider';
/**
 * GCP IAM roles for Cloud KMS
 */
export var CloudKMSRole;
(function (CloudKMSRole) {
    CloudKMSRole["ADMIN"] = "roles/cloudkms.admin";
    CloudKMSRole["CRYPTO_KEY_ENCRYPTER"] = "roles/cloudkms.cryptoKeyEncrypter";
    CloudKMSRole["CRYPTO_KEY_DECRYPTER"] = "roles/cloudkms.cryptoKeyDecrypter";
    CloudKMSRole["CRYPTO_KEY_ENCRYPTER_DECRYPTER"] = "roles/cloudkms.cryptoKeyEncrypterDecrypter";
    CloudKMSRole["SIGNER"] = "roles/cloudkms.signer";
    CloudKMSRole["SIGNER_VERIFIER"] = "roles/cloudkms.signerVerifier";
    CloudKMSRole["VIEWER"] = "roles/cloudkms.viewer";
    CloudKMSRole["PUBLIC_KEY_VIEWER"] = "roles/cloudkms.publicKeyViewer";
})(CloudKMSRole || (CloudKMSRole = {}));
/**
 * GCP key version state
 */
export var KeyVersionState;
(function (KeyVersionState) {
    KeyVersionState["PENDING_GENERATION"] = "CRYPTO_KEY_VERSION_STATE_PENDING_GENERATION";
    KeyVersionState["ENABLED"] = "ENABLED";
    KeyVersionState["DISABLED"] = "DISABLED";
    KeyVersionState["DESTROYED"] = "DESTROYED";
    KeyVersionState["DESTROY_SCHEDULED"] = "DESTROY_SCHEDULED";
    KeyVersionState["PENDING_IMPORT"] = "PENDING_IMPORT";
    KeyVersionState["IMPORT_FAILED"] = "IMPORT_FAILED";
})(KeyVersionState || (KeyVersionState = {}));
/**
 * GCP key algorithm
 */
export var GCPKeyAlgorithm;
(function (GCPKeyAlgorithm) {
    // Symmetric encryption
    GCPKeyAlgorithm["GOOGLE_SYMMETRIC_ENCRYPTION"] = "GOOGLE_SYMMETRIC_ENCRYPTION";
    // RSA signing
    GCPKeyAlgorithm["RSA_SIGN_PKCS1_2048_SHA256"] = "RSA_SIGN_PKCS1_2048_SHA256";
    GCPKeyAlgorithm["RSA_SIGN_PKCS1_3072_SHA256"] = "RSA_SIGN_PKCS1_3072_SHA256";
    GCPKeyAlgorithm["RSA_SIGN_PKCS1_4096_SHA256"] = "RSA_SIGN_PKCS1_4096_SHA256";
    GCPKeyAlgorithm["RSA_SIGN_PKCS1_4096_SHA512"] = "RSA_SIGN_PKCS1_4096_SHA512";
    GCPKeyAlgorithm["RSA_SIGN_PSS_2048_SHA256"] = "RSA_SIGN_PSS_2048_SHA256";
    GCPKeyAlgorithm["RSA_SIGN_PSS_3072_SHA256"] = "RSA_SIGN_PSS_3072_SHA256";
    GCPKeyAlgorithm["RSA_SIGN_PSS_4096_SHA256"] = "RSA_SIGN_PSS_4096_SHA256";
    GCPKeyAlgorithm["RSA_SIGN_PSS_4096_SHA512"] = "RSA_SIGN_PSS_4096_SHA512";
    // RSA encryption
    GCPKeyAlgorithm["RSA_DECRYPT_OAEP_2048_SHA256"] = "RSA_DECRYPT_OAEP_2048_SHA256";
    GCPKeyAlgorithm["RSA_DECRYPT_OAEP_3072_SHA256"] = "RSA_DECRYPT_OAEP_3072_SHA256";
    GCPKeyAlgorithm["RSA_DECRYPT_OAEP_4096_SHA256"] = "RSA_DECRYPT_OAEP_4096_SHA256";
    GCPKeyAlgorithm["RSA_DECRYPT_OAEP_4096_SHA512"] = "RSA_DECRYPT_OAEP_4096_SHA512";
    // EC signing
    GCPKeyAlgorithm["EC_SIGN_P256_SHA256"] = "EC_SIGN_P256_SHA256";
    GCPKeyAlgorithm["EC_SIGN_P384_SHA384"] = "EC_SIGN_P384_SHA384";
    GCPKeyAlgorithm["EC_SIGN_SECP256K1_SHA256"] = "EC_SIGN_SECP256K1_SHA256";
    // HMAC
    GCPKeyAlgorithm["HMAC_SHA256"] = "HMAC_SHA256";
    GCPKeyAlgorithm["HMAC_SHA1"] = "HMAC_SHA1";
    GCPKeyAlgorithm["HMAC_SHA384"] = "HMAC_SHA384";
    GCPKeyAlgorithm["HMAC_SHA512"] = "HMAC_SHA512";
    GCPKeyAlgorithm["HMAC_SHA224"] = "HMAC_SHA224";
})(GCPKeyAlgorithm || (GCPKeyAlgorithm = {}));
// ============================================================================
// GCP HSM Provider
// ============================================================================
export class GCPHSMProvider extends BaseHSMProvider {
    name = 'Google Cloud HSM';
    isProduction = true;
    gcpConfig;
    keyRingPath;
    keyMap = new Map();
    authenticated = false;
    constructor(config) {
        super(config);
        this.gcpConfig = config;
        this.keyRingPath = `projects/${config.projectId}/locations/${config.location}/keyRings/${config.keyRing}`;
    }
    /**
     * Connect to GCP Cloud KMS
     */
    async connect() {
        try {
            // Authenticate with GCP
            await this.authenticate();
            // Ensure key ring exists
            await this.ensureKeyRing();
            this.connected = true;
            this.logAudit({
                operation: 'connect',
                success: true,
                metadata: {
                    projectId: this.gcpConfig.projectId,
                    location: this.gcpConfig.location,
                    keyRing: this.gcpConfig.keyRing,
                },
            });
            this.emit('connected', { provider: this.name });
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'connect',
                success: false,
                errorMessage: err.message,
            });
            throw new HSMConnectionError(`Failed to connect to GCP Cloud KMS: ${err.message}`, this.name, err);
        }
    }
    /**
     * Authenticate with GCP
     */
    async authenticate() {
        // In real implementation, use @google-cloud/kms
        // const {KeyManagementServiceClient} = require('@google-cloud/kms');
        // this.client = new KeyManagementServiceClient({ credentials });
        this.authenticated = true;
        await this.sleep(50);
    }
    /**
     * Ensure key ring exists
     */
    async ensureKeyRing() {
        // In real implementation:
        // try {
        //   await this.client.getKeyRing({ name: this.keyRingPath });
        // } catch (error) {
        //   if (error.code === 5) { // NOT_FOUND
        //     await this.client.createKeyRing({
        //       parent: `projects/${this.gcpConfig.projectId}/locations/${this.gcpConfig.location}`,
        //       keyRingId: this.gcpConfig.keyRing,
        //     });
        //   }
        // }
        await this.sleep(50);
    }
    /**
     * Disconnect from GCP
     */
    async disconnect() {
        this.authenticated = false;
        this.connected = false;
        this.logAudit({
            operation: 'disconnect',
            success: true,
        });
        this.emit('disconnected', { provider: this.name });
    }
    /**
     * Get HSM status
     */
    async getStatus() {
        return {
            connected: this.connected,
            healthy: this.connected && this.authenticated,
            provider: this.name,
            version: 'v1', // API version
            lastHealthCheck: new Date(),
        };
    }
    /**
     * Generate key in GCP Cloud KMS
     */
    async generateKey(spec) {
        this.ensureConnected();
        this.validateKeySpec(spec);
        const keyId = spec.id || this.generateKeyId();
        try {
            const gcpAlgorithm = this.mapToGCPAlgorithm(spec);
            const protectionLevel = this.gcpConfig.protectionLevel || 'HSM';
            // In real implementation:
            // const [cryptoKey] = await this.client.createCryptoKey({
            //   parent: this.keyRingPath,
            //   cryptoKeyId: keyId,
            //   cryptoKey: {
            //     purpose: this.getPurpose(spec),
            //     versionTemplate: {
            //       algorithm: gcpAlgorithm,
            //       protectionLevel,
            //     },
            //     labels: { label: spec.label },
            //   },
            // });
            const versionId = '1';
            let publicKey;
            if (spec.type === KeyType.RSA || spec.type === KeyType.EC) {
                if (spec.type === KeyType.RSA) {
                    const { publicKey: pk } = crypto.generateKeyPairSync('rsa', {
                        modulusLength: spec.size || 2048,
                    });
                    publicKey = pk.export({ type: 'spki', format: 'der' });
                }
                else {
                    const curveMap = {
                        [ECCurve.P256]: 'prime256v1',
                        [ECCurve.P384]: 'secp384r1',
                        [ECCurve.P521]: 'secp521r1',
                        [ECCurve.SECP256K1]: 'secp256k1',
                        [ECCurve.ED25519]: 'ed25519',
                    };
                    if (spec.curve === ECCurve.ED25519) {
                        const { publicKey: pk } = crypto.generateKeyPairSync('ed25519');
                        publicKey = pk.export({ type: 'spki', format: 'der' });
                    }
                    else {
                        const { publicKey: pk } = crypto.generateKeyPairSync('ec', {
                            namedCurve: curveMap[spec.curve || ECCurve.P256],
                        });
                        publicKey = pk.export({ type: 'spki', format: 'der' });
                    }
                }
            }
            const resourceName = `${this.keyRingPath}/cryptoKeys/${keyId}`;
            const versions = new Map();
            versions.set(versionId, KeyVersionState.ENABLED);
            const keyHandle = {
                id: keyId,
                label: spec.label,
                type: spec.type,
                size: spec.size,
                curve: spec.curve,
                usage: spec.usage,
                extractable: spec.extractable,
                createdAt: new Date(),
                expiresAt: spec.expiresAt,
                publicKey,
                keyRingPath: this.keyRingPath,
                resourceName,
                primaryVersion: versionId,
                versions,
                gcpAlgorithm,
                protectionLevel,
                metadata: {
                    projectId: this.gcpConfig.projectId,
                    location: this.gcpConfig.location,
                },
            };
            this.keyMap.set(keyId, keyHandle);
            this.keys.set(keyId, keyHandle);
            this.logAudit({
                operation: 'generateKey',
                keyId,
                success: true,
                metadata: {
                    algorithm: gcpAlgorithm,
                    protectionLevel,
                },
            });
            return keyHandle;
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'generateKey',
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('generateKey', err.message, this.name, err);
        }
    }
    /**
     * Map key spec to GCP algorithm
     */
    mapToGCPAlgorithm(spec) {
        if (spec.type === KeyType.AES) {
            return GCPKeyAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION;
        }
        if (spec.type === KeyType.HMAC) {
            return GCPKeyAlgorithm.HMAC_SHA256;
        }
        if (spec.type === KeyType.RSA) {
            const size = spec.size || 2048;
            if (spec.usage.includes(KeyUsage.SIGN)) {
                switch (size) {
                    case 2048:
                        return GCPKeyAlgorithm.RSA_SIGN_PKCS1_2048_SHA256;
                    case 3072:
                        return GCPKeyAlgorithm.RSA_SIGN_PKCS1_3072_SHA256;
                    case 4096:
                        return GCPKeyAlgorithm.RSA_SIGN_PKCS1_4096_SHA256;
                    default:
                        return GCPKeyAlgorithm.RSA_SIGN_PKCS1_2048_SHA256;
                }
            }
            else {
                switch (size) {
                    case 2048:
                        return GCPKeyAlgorithm.RSA_DECRYPT_OAEP_2048_SHA256;
                    case 3072:
                        return GCPKeyAlgorithm.RSA_DECRYPT_OAEP_3072_SHA256;
                    case 4096:
                        return GCPKeyAlgorithm.RSA_DECRYPT_OAEP_4096_SHA256;
                    default:
                        return GCPKeyAlgorithm.RSA_DECRYPT_OAEP_2048_SHA256;
                }
            }
        }
        if (spec.type === KeyType.EC) {
            switch (spec.curve) {
                case ECCurve.P256:
                    return GCPKeyAlgorithm.EC_SIGN_P256_SHA256;
                case ECCurve.P384:
                    return GCPKeyAlgorithm.EC_SIGN_P384_SHA384;
                case ECCurve.SECP256K1:
                    return GCPKeyAlgorithm.EC_SIGN_SECP256K1_SHA256;
                default:
                    return GCPKeyAlgorithm.EC_SIGN_P256_SHA256;
            }
        }
        return GCPKeyAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION;
    }
    /**
     * Import key into GCP
     */
    async importKey(keyMaterial, spec) {
        this.ensureConnected();
        this.validateKeySpec(spec);
        const keyId = spec.id || this.generateKeyId();
        try {
            // In GCP, key import requires an import job
            // const [importJob] = await this.client.createImportJob({...});
            // Then wrap and import the key material
            const versionId = '1';
            const resourceName = `${this.keyRingPath}/cryptoKeys/${keyId}`;
            const versions = new Map();
            versions.set(versionId, KeyVersionState.ENABLED);
            const keyHandle = {
                id: keyId,
                label: spec.label,
                type: spec.type,
                size: spec.size,
                curve: spec.curve,
                usage: spec.usage,
                extractable: spec.extractable,
                createdAt: new Date(),
                keyRingPath: this.keyRingPath,
                resourceName,
                primaryVersion: versionId,
                versions,
                gcpAlgorithm: this.mapToGCPAlgorithm(spec),
                protectionLevel: this.gcpConfig.protectionLevel || 'HSM',
                metadata: {
                    imported: true,
                },
            };
            this.keyMap.set(keyId, keyHandle);
            this.keys.set(keyId, keyHandle);
            this.logAudit({
                operation: 'importKey',
                keyId,
                success: true,
            });
            return keyHandle;
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'importKey',
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('importKey', err.message, this.name, err);
        }
    }
    /**
     * Export public key
     */
    async exportPublicKey(keyHandle) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyHandle);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyHandle, this.name);
        }
        if (!keyInfo.publicKey) {
            throw new HSMOperationError('exportPublicKey', 'Not an asymmetric key', this.name);
        }
        return keyInfo.publicKey;
    }
    /**
     * Get key
     */
    async getKey(keyHandle) {
        this.ensureConnected();
        return this.keyMap.get(keyHandle) || null;
    }
    /**
     * List keys
     */
    async listKeys(filter) {
        this.ensureConnected();
        let keys = Array.from(this.keyMap.values());
        if (filter) {
            if (filter.type) {
                keys = keys.filter(k => k.type === filter.type);
            }
            if (filter.label) {
                keys = keys.filter(k => k.label.includes(filter.label));
            }
        }
        return keys;
    }
    /**
     * Sign data
     */
    async sign(keyHandle, data, algorithm) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyHandle);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyHandle, this.name);
        }
        this.validateKeyUsage(keyInfo, KeyUsage.SIGN);
        try {
            // In real implementation:
            // const digest = crypto.createHash('sha256').update(data).digest();
            // const [signResponse] = await this.client.asymmetricSign({
            //   name: `${keyInfo.resourceName}/cryptoKeyVersions/${keyInfo.primaryVersion}`,
            //   digest: { sha256: digest },
            // });
            // Simulated signature
            const signature = crypto.createHash('sha256').update(data).digest();
            this.logAudit({
                operation: 'sign',
                keyId: keyHandle,
                success: true,
                metadata: { algorithm },
            });
            return signature;
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'sign',
                keyId: keyHandle,
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('sign', err.message, this.name, err);
        }
    }
    /**
     * Verify signature
     */
    async verify(keyHandle, data, signature, algorithm) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyHandle);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyHandle, this.name);
        }
        this.validateKeyUsage(keyInfo, KeyUsage.VERIFY);
        try {
            // GCP Cloud KMS doesn't have a verify API - you export the public key
            // and verify locally, or use MAC verify for HMAC keys
            // Simulated verification
            const expectedSig = crypto.createHash('sha256').update(data).digest();
            const result = signature.equals(expectedSig);
            this.logAudit({
                operation: 'verify',
                keyId: keyHandle,
                success: true,
                metadata: { valid: result },
            });
            return result;
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'verify',
                keyId: keyHandle,
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('verify', err.message, this.name, err);
        }
    }
    /**
     * Encrypt data
     */
    async encrypt(keyHandle, data, options) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyHandle);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyHandle, this.name);
        }
        this.validateKeyUsage(keyInfo, KeyUsage.ENCRYPT);
        try {
            // In real implementation:
            // const [encryptResponse] = await this.client.encrypt({
            //   name: keyInfo.resourceName,
            //   plaintext: data,
            //   additionalAuthenticatedData: options?.aad,
            // });
            // Simulated encryption
            const iv = options?.iv || crypto.randomBytes(12);
            const key = crypto.randomBytes(32);
            const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
            if (options?.aad) {
                cipher.setAAD(options.aad);
            }
            const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
            const authTag = cipher.getAuthTag();
            const result = Buffer.concat([iv, authTag, encrypted]);
            this.logAudit({
                operation: 'encrypt',
                keyId: keyHandle,
                success: true,
            });
            return result;
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'encrypt',
                keyId: keyHandle,
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('encrypt', err.message, this.name, err);
        }
    }
    /**
     * Decrypt data
     */
    async decrypt(keyHandle, ciphertext, options) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyHandle);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyHandle, this.name);
        }
        this.validateKeyUsage(keyInfo, KeyUsage.DECRYPT);
        try {
            // In real implementation:
            // const [decryptResponse] = await this.client.decrypt({
            //   name: keyInfo.resourceName,
            //   ciphertext,
            //   additionalAuthenticatedData: options?.aad,
            // });
            // Simulated decryption
            const iv = ciphertext.subarray(0, 12);
            const authTag = ciphertext.subarray(12, 28);
            const encrypted = ciphertext.subarray(28);
            const key = crypto.randomBytes(32);
            const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
            decipher.setAuthTag(authTag);
            if (options?.aad) {
                decipher.setAAD(options.aad);
            }
            const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
            this.logAudit({
                operation: 'decrypt',
                keyId: keyHandle,
                success: true,
            });
            return decrypted;
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'decrypt',
                keyId: keyHandle,
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('decrypt', err.message, this.name, err);
        }
    }
    /**
     * Wrap key (GCP doesn't support direct key wrapping, use envelope encryption)
     */
    async wrapKey(wrappingKeyHandle, keyToWrap, algorithm) {
        this.ensureConnected();
        const wrappingKey = this.keyMap.get(wrappingKeyHandle);
        if (!wrappingKey) {
            throw new HSMKeyNotFoundError(wrappingKeyHandle, this.name);
        }
        const targetKey = this.keyMap.get(keyToWrap);
        if (!targetKey) {
            throw new HSMKeyNotFoundError(keyToWrap, this.name);
        }
        this.validateKeyUsage(wrappingKey, KeyUsage.WRAP);
        if (!targetKey.extractable) {
            throw new HSMOperationError('wrapKey', 'Target key is not extractable', this.name);
        }
        try {
            // Use envelope encryption pattern
            const wrappedKey = crypto.randomBytes(40);
            this.logAudit({
                operation: 'wrapKey',
                keyId: keyToWrap,
                success: true,
            });
            return wrappedKey;
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'wrapKey',
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('wrapKey', err.message, this.name, err);
        }
    }
    /**
     * Unwrap key
     */
    async unwrapKey(wrappingKeyHandle, wrappedKey, spec, algorithm) {
        this.ensureConnected();
        const wrappingKey = this.keyMap.get(wrappingKeyHandle);
        if (!wrappingKey) {
            throw new HSMKeyNotFoundError(wrappingKeyHandle, this.name);
        }
        this.validateKeyUsage(wrappingKey, KeyUsage.UNWRAP);
        this.validateKeySpec(spec);
        try {
            const keyId = spec.id || this.generateKeyId();
            const versionId = '1';
            const resourceName = `${this.keyRingPath}/cryptoKeys/${keyId}`;
            const versions = new Map();
            versions.set(versionId, KeyVersionState.ENABLED);
            const keyHandle = {
                id: keyId,
                label: spec.label,
                type: spec.type,
                size: spec.size,
                curve: spec.curve,
                usage: spec.usage,
                extractable: spec.extractable,
                createdAt: new Date(),
                keyRingPath: this.keyRingPath,
                resourceName,
                primaryVersion: versionId,
                versions,
                gcpAlgorithm: this.mapToGCPAlgorithm(spec),
                protectionLevel: this.gcpConfig.protectionLevel || 'HSM',
                metadata: {
                    unwrapped: true,
                },
            };
            this.keyMap.set(keyId, keyHandle);
            this.keys.set(keyId, keyHandle);
            this.logAudit({
                operation: 'unwrapKey',
                keyId,
                success: true,
            });
            return keyId;
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'unwrapKey',
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('unwrapKey', err.message, this.name, err);
        }
    }
    /**
     * Destroy key (schedule destruction)
     */
    async destroyKey(keyHandle) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyHandle);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyHandle, this.name);
        }
        try {
            // In GCP, destruction is scheduled (24 hours by default)
            // In real implementation:
            // await this.client.destroyCryptoKeyVersion({
            //   name: `${keyInfo.resourceName}/cryptoKeyVersions/${keyInfo.primaryVersion}`,
            // });
            keyInfo.versions.set(keyInfo.primaryVersion, KeyVersionState.DESTROY_SCHEDULED);
            this.keyMap.delete(keyHandle);
            this.keys.delete(keyHandle);
            this.logAudit({
                operation: 'destroyKey',
                keyId: keyHandle,
                success: true,
                metadata: {
                    scheduled: true,
                    destructionTime: new Date(Date.now() + 24 * 60 * 60 * 1000),
                },
            });
        }
        catch (error) {
            const err = error instanceof Error ? error : new Error(String(error));
            this.logAudit({
                operation: 'destroyKey',
                keyId: keyHandle,
                success: false,
                errorMessage: err.message,
            });
            throw new HSMOperationError('destroyKey', err.message, this.name, err);
        }
    }
    // ============================================================================
    // GCP-Specific Methods
    // ============================================================================
    /**
     * Rotate key
     */
    async rotateKey(keyId) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyId);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyId, this.name);
        }
        // In real implementation:
        // const [version] = await this.client.createCryptoKeyVersion({
        //   parent: keyInfo.resourceName,
        //   cryptoKeyVersion: {},
        // });
        const newVersion = String(keyInfo.versions.size + 1);
        keyInfo.versions.set(newVersion, KeyVersionState.ENABLED);
        keyInfo.primaryVersion = newVersion;
        this.logAudit({
            operation: 'rotateKey',
            keyId,
            success: true,
            metadata: { newVersion },
        });
        return newVersion;
    }
    /**
     * Set key rotation schedule
     */
    async setRotationSchedule(keyId, rotationPeriod) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyId);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyId, this.name);
        }
        keyInfo.rotationPeriod = rotationPeriod;
        keyInfo.nextRotationTime = new Date(Date.now() + this.parseDuration(rotationPeriod));
        this.logAudit({
            operation: 'setRotationSchedule',
            keyId,
            success: true,
            metadata: { rotationPeriod },
        });
    }
    /**
     * Parse duration string (e.g., "90d", "2592000s")
     */
    parseDuration(duration) {
        const match = duration.match(/^(\d+)([smhd])$/);
        if (!match)
            return 0;
        const value = parseInt(match[1], 10);
        const unit = match[2];
        switch (unit) {
            case 's':
                return value * 1000;
            case 'm':
                return value * 60 * 1000;
            case 'h':
                return value * 60 * 60 * 1000;
            case 'd':
                return value * 24 * 60 * 60 * 1000;
            default:
                return 0;
        }
    }
    /**
     * Set IAM policy on key
     */
    async setIAMPolicy(keyId, bindings) {
        this.ensureConnected();
        const keyInfo = this.keyMap.get(keyId);
        if (!keyInfo) {
            throw new HSMKeyNotFoundError(keyId, this.name);
        }
        // In real implementation:
        // await this.client.setIamPolicy({
        //   resource: keyInfo.resourceName,
        //   policy: { bindings },
        // });
        this.logAudit({
            operation: 'setIAMPolicy',
            keyId,
            success: true,
            metadata: { bindings },
        });
    }
    /**
     * Create import job for bringing external keys
     */
    async createImportJob(importJobId, protectionLevel = 'HSM') {
        this.ensureConnected();
        // In real implementation:
        // const [importJob] = await this.client.createImportJob({
        //   parent: this.keyRingPath,
        //   importJobId,
        //   importJob: {
        //     protectionLevel,
        //     importMethod: 'RSA_OAEP_3072_SHA256_AES_256',
        //   },
        // });
        const importJobName = `${this.keyRingPath}/importJobs/${importJobId}`;
        const { publicKey } = crypto.generateKeyPairSync('rsa', {
            modulusLength: 3072,
        });
        this.logAudit({
            operation: 'createImportJob',
            success: true,
            metadata: { importJobId, protectionLevel },
        });
        return {
            publicKey: publicKey.export({ type: 'spki', format: 'der' }),
            importJobName,
        };
    }
}
//# sourceMappingURL=gcp-hsm.js.map