/**
 * FIPS 140-2 Compliant Cryptography Mode
 *
 * Provides FIPS 140-2 Level 1 compliant cryptographic operations for FedRAMP
 * compliance. Enforces the use of only FIPS-approved algorithms and key lengths.
 *
 * FIPS 140-2 Approved Algorithms:
 * - Symmetric Encryption: AES-128, AES-256 (GCM, CBC, CTR modes)
 * - Hash Functions: SHA-256, SHA-384, SHA-512 (NO SHA-1, MD5)
 * - Asymmetric: RSA (2048+ bits), ECDSA (P-256, P-384, P-521)
 * - MACs: HMAC-SHA256, HMAC-SHA384, HMAC-SHA512
 * - Key Derivation: PBKDF2, HKDF with approved hash functions
 * - Transport: TLS 1.2+ only
 *
 * Security Guarantees:
 * - Algorithm validation before every operation
 * - Key length enforcement per algorithm
 * - Comprehensive audit logging
 * - Runtime enforcement with configurable strict mode
 *
 * @packageDocumentation
 * @module security/crypto/fips-mode
 */
import * as crypto from 'node:crypto';
import { z } from 'zod';
/**
 * FIPS 140-2 approved symmetric encryption algorithms
 */
export declare const FIPS_SYMMETRIC_ALGORITHMS: {
    readonly 'AES-128-GCM': "aes-128-gcm";
    readonly 'AES-256-GCM': "aes-256-gcm";
    readonly 'AES-128-CBC': "aes-128-cbc";
    readonly 'AES-256-CBC': "aes-256-cbc";
    readonly 'AES-128-CTR': "aes-128-ctr";
    readonly 'AES-256-CTR': "aes-256-ctr";
};
export type FIPSSymmetricAlgorithm = (typeof FIPS_SYMMETRIC_ALGORITHMS)[keyof typeof FIPS_SYMMETRIC_ALGORITHMS];
/**
 * FIPS 140-2 approved hash algorithms
 */
export declare const FIPS_HASH_ALGORITHMS: {
    readonly 'SHA-256': "sha256";
    readonly 'SHA-384': "sha384";
    readonly 'SHA-512': "sha512";
};
export type FIPSHashAlgorithm = (typeof FIPS_HASH_ALGORITHMS)[keyof typeof FIPS_HASH_ALGORITHMS];
/**
 * FIPS 140-2 approved HMAC algorithms
 */
export declare const FIPS_HMAC_ALGORITHMS: {
    readonly 'HMAC-SHA256': "sha256";
    readonly 'HMAC-SHA384': "sha384";
    readonly 'HMAC-SHA512': "sha512";
};
export type FIPSHMACAlgorithm = (typeof FIPS_HMAC_ALGORITHMS)[keyof typeof FIPS_HMAC_ALGORITHMS];
/**
 * FIPS 140-2 approved asymmetric algorithms
 */
export declare const FIPS_ASYMMETRIC_ALGORITHMS: {
    readonly 'RSA-2048': "rsa";
    readonly 'RSA-3072': "rsa";
    readonly 'RSA-4096': "rsa";
    readonly 'ECDSA-P256': "ec";
    readonly 'ECDSA-P384': "ec";
    readonly 'ECDSA-P521': "ec";
};
export type FIPSAsymmetricAlgorithm = (typeof FIPS_ASYMMETRIC_ALGORITHMS)[keyof typeof FIPS_ASYMMETRIC_ALGORITHMS];
/**
 * FIPS 140-2 approved ECDSA curves
 */
export declare const FIPS_ECDSA_CURVES: {
    readonly 'P-256': "prime256v1";
    readonly 'P-384': "secp384r1";
    readonly 'P-521': "secp521r1";
};
export type FIPSECDSACurve = (typeof FIPS_ECDSA_CURVES)[keyof typeof FIPS_ECDSA_CURVES];
/**
 * FIPS 140-2 minimum key lengths by algorithm type
 */
export declare const FIPS_MINIMUM_KEY_LENGTHS: Record<string, number>;
/**
 * Non-FIPS algorithms that should be rejected
 */
export declare const NON_FIPS_ALGORITHMS: readonly ["md5", "sha1", "sha-1", "des", "3des", "des-ede", "des-ede3", "rc2", "rc4", "blowfish", "bf", "idea", "cast", "cast5", "seed"];
/**
 * FIPS-approved TLS versions
 */
export declare const FIPS_TLS_VERSIONS: readonly ["TLSv1.2", "TLSv1.3"];
/**
 * Non-FIPS TLS versions that should be rejected
 */
export declare const NON_FIPS_TLS_VERSIONS: readonly ["SSLv2", "SSLv3", "TLSv1", "TLSv1.1"];
/**
 * FIPS mode configuration
 */
export interface FIPSModeConfig {
    /** Whether FIPS mode is enabled */
    enabled: boolean;
    /** Strict mode: reject all non-FIPS operations (true) vs warn (false) */
    strictMode: boolean;
    /** List of allowed algorithms (defaults to all FIPS-approved) */
    allowedAlgorithms: string[];
    /** Minimum key lengths by algorithm type */
    minimumKeyLengths: Record<string, number>;
    /** Whether to audit log all crypto operations */
    auditAllCryptoOperations: boolean;
    /** Alert on non-compliant attempts */
    alertOnViolations: boolean;
    /** Custom alert callback for violations */
    alertCallback?: (violation: FIPSViolation) => void | Promise<void>;
}
export declare const fipsModeConfigSchema: z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    strictMode: z.ZodDefault<z.ZodBoolean>;
    allowedAlgorithms: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    minimumKeyLengths: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
    auditAllCryptoOperations: z.ZodDefault<z.ZodBoolean>;
    alertOnViolations: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    enabled?: boolean;
    strictMode?: boolean;
    allowedAlgorithms?: string[];
    minimumKeyLengths?: Record<string, number>;
    auditAllCryptoOperations?: boolean;
    alertOnViolations?: boolean;
}, {
    enabled?: boolean;
    strictMode?: boolean;
    allowedAlgorithms?: string[];
    minimumKeyLengths?: Record<string, number>;
    auditAllCryptoOperations?: boolean;
    alertOnViolations?: boolean;
}>;
/**
 * Default FIPS mode configuration
 */
export declare const DEFAULT_FIPS_CONFIG: FIPSModeConfig;
/**
 * Crypto operation types for audit logging
 */
export declare const CryptoOperationType: {
    readonly ENCRYPT: "encrypt";
    readonly DECRYPT: "decrypt";
    readonly HASH: "hash";
    readonly HMAC: "hmac";
    readonly SIGN: "sign";
    readonly VERIFY: "verify";
    readonly KEY_DERIVE: "key_derive";
    readonly RANDOM: "random";
    readonly KEY_GENERATE: "key_generate";
};
export type CryptoOperationType = (typeof CryptoOperationType)[keyof typeof CryptoOperationType];
/**
 * Crypto operation for validation
 */
export interface CryptoOperation {
    /** Operation type */
    type: CryptoOperationType;
    /** Algorithm being used */
    algorithm: string;
    /** Key length in bits (if applicable) */
    keyLength?: number;
    /** Curve name (for ECDSA) */
    curve?: string;
    /** Hash function (for composite operations) */
    hashFunction?: string;
    /** Additional context */
    context?: Record<string, unknown>;
}
export declare const cryptoOperationSchema: z.ZodObject<{
    type: z.ZodNativeEnum<{
        readonly ENCRYPT: "encrypt";
        readonly DECRYPT: "decrypt";
        readonly HASH: "hash";
        readonly HMAC: "hmac";
        readonly SIGN: "sign";
        readonly VERIFY: "verify";
        readonly KEY_DERIVE: "key_derive";
        readonly RANDOM: "random";
        readonly KEY_GENERATE: "key_generate";
    }>;
    algorithm: z.ZodString;
    keyLength: z.ZodOptional<z.ZodNumber>;
    curve: z.ZodOptional<z.ZodString>;
    hashFunction: z.ZodOptional<z.ZodString>;
    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
    algorithm?: string;
    keyLength?: number;
    context?: Record<string, unknown>;
    curve?: string;
    hashFunction?: string;
}, {
    type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
    algorithm?: string;
    keyLength?: number;
    context?: Record<string, unknown>;
    curve?: string;
    hashFunction?: string;
}>;
/**
 * FIPS compliance violation
 */
export interface FIPSViolation {
    /** Unique violation ID */
    id: string;
    /** Timestamp of violation */
    timestamp: Date;
    /** Violation type */
    type: 'algorithm' | 'key_length' | 'hash' | 'tls' | 'certificate';
    /** The operation that was attempted */
    operation: CryptoOperation;
    /** Reason for violation */
    reason: string;
    /** Whether the operation was blocked */
    blocked: boolean;
    /** Stack trace (if available) */
    stackTrace?: string;
}
export declare const fipsViolationSchema: z.ZodObject<{
    id: z.ZodString;
    timestamp: z.ZodDate;
    type: z.ZodEnum<["algorithm", "key_length", "hash", "tls", "certificate"]>;
    operation: z.ZodObject<{
        type: z.ZodNativeEnum<{
            readonly ENCRYPT: "encrypt";
            readonly DECRYPT: "decrypt";
            readonly HASH: "hash";
            readonly HMAC: "hmac";
            readonly SIGN: "sign";
            readonly VERIFY: "verify";
            readonly KEY_DERIVE: "key_derive";
            readonly RANDOM: "random";
            readonly KEY_GENERATE: "key_generate";
        }>;
        algorithm: z.ZodString;
        keyLength: z.ZodOptional<z.ZodNumber>;
        curve: z.ZodOptional<z.ZodString>;
        hashFunction: z.ZodOptional<z.ZodString>;
        context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
        algorithm?: string;
        keyLength?: number;
        context?: Record<string, unknown>;
        curve?: string;
        hashFunction?: string;
    }, {
        type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
        algorithm?: string;
        keyLength?: number;
        context?: Record<string, unknown>;
        curve?: string;
        hashFunction?: string;
    }>;
    reason: z.ZodString;
    blocked: z.ZodBoolean;
    stackTrace: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    reason?: string;
    id?: string;
    type?: "algorithm" | "hash" | "tls" | "certificate" | "key_length";
    operation?: {
        type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
        algorithm?: string;
        keyLength?: number;
        context?: Record<string, unknown>;
        curve?: string;
        hashFunction?: string;
    };
    timestamp?: Date;
    blocked?: boolean;
    stackTrace?: string;
}, {
    reason?: string;
    id?: string;
    type?: "algorithm" | "hash" | "tls" | "certificate" | "key_length";
    operation?: {
        type?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
        algorithm?: string;
        keyLength?: number;
        context?: Record<string, unknown>;
        curve?: string;
        hashFunction?: string;
    };
    timestamp?: Date;
    blocked?: boolean;
    stackTrace?: string;
}>;
/**
 * FIPS audit log entry
 */
export interface FIPSAuditEntry {
    /** Unique audit entry ID */
    id: string;
    /** Timestamp of the operation */
    timestamp: Date;
    /** Type of operation */
    operationType: CryptoOperationType;
    /** Algorithm used */
    algorithm: string;
    /** Key length (if applicable) */
    keyLength?: number;
    /** Whether the operation succeeded */
    success: boolean;
    /** Whether the operation was FIPS compliant */
    fipsCompliant: boolean;
    /** Duration in milliseconds */
    durationMs: number;
    /** Error message if failed */
    error?: string;
    /** Request ID for correlation */
    requestId?: string;
    /** User ID if available */
    userId?: string;
    /** Tenant ID if available */
    tenantId?: string;
}
export declare const fipsAuditEntrySchema: z.ZodObject<{
    id: z.ZodString;
    timestamp: z.ZodDate;
    operationType: z.ZodNativeEnum<{
        readonly ENCRYPT: "encrypt";
        readonly DECRYPT: "decrypt";
        readonly HASH: "hash";
        readonly HMAC: "hmac";
        readonly SIGN: "sign";
        readonly VERIFY: "verify";
        readonly KEY_DERIVE: "key_derive";
        readonly RANDOM: "random";
        readonly KEY_GENERATE: "key_generate";
    }>;
    algorithm: z.ZodString;
    keyLength: z.ZodOptional<z.ZodNumber>;
    success: z.ZodBoolean;
    fipsCompliant: z.ZodBoolean;
    durationMs: z.ZodNumber;
    error: z.ZodOptional<z.ZodString>;
    requestId: z.ZodOptional<z.ZodString>;
    userId: z.ZodOptional<z.ZodString>;
    tenantId: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    error?: string;
    durationMs?: number;
    id?: string;
    algorithm?: string;
    tenantId?: string;
    success?: boolean;
    userId?: string;
    requestId?: string;
    keyLength?: number;
    timestamp?: Date;
    operationType?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
    fipsCompliant?: boolean;
}, {
    error?: string;
    durationMs?: number;
    id?: string;
    algorithm?: string;
    tenantId?: string;
    success?: boolean;
    userId?: string;
    requestId?: string;
    keyLength?: number;
    timestamp?: Date;
    operationType?: "encrypt" | "decrypt" | "hash" | "sign" | "verify" | "random" | "hmac" | "key_derive" | "key_generate";
    fipsCompliant?: boolean;
}>;
/**
 * Certificate validation options
 */
export interface CertificateValidationOptions {
    /** Minimum RSA key size */
    minRSAKeySize: number;
    /** Minimum ECDSA curve (P-256, P-384, P-521) */
    minECDSACurve: string;
    /** Require TLS 1.2+ */
    requireTLS12: boolean;
    /** Reject weak cipher suites */
    rejectWeakCipherSuites: boolean;
    /** Allowed cipher suites (if specified, only these are allowed) */
    allowedCipherSuites?: string[];
}
export declare const DEFAULT_CERT_VALIDATION_OPTIONS: CertificateValidationOptions;
/**
 * Callback for FIPS audit logging
 */
export type FIPSAuditCallback = (entry: FIPSAuditEntry) => void | Promise<void>;
/**
 * Error codes for FIPS operations
 */
export declare const FIPSErrorCode: {
    /** Non-FIPS algorithm attempted */
    readonly NON_FIPS_ALGORITHM: "FIPS_NON_COMPLIANT_ALGORITHM";
    /** Key length below minimum */
    readonly INSUFFICIENT_KEY_LENGTH: "FIPS_INSUFFICIENT_KEY_LENGTH";
    /** Non-FIPS hash function */
    readonly NON_FIPS_HASH: "FIPS_NON_COMPLIANT_HASH";
    /** Non-FIPS TLS version */
    readonly NON_FIPS_TLS: "FIPS_NON_COMPLIANT_TLS";
    /** Weak certificate */
    readonly WEAK_CERTIFICATE: "FIPS_WEAK_CERTIFICATE";
    /** Provider not initialized */
    readonly NOT_INITIALIZED: "FIPS_NOT_INITIALIZED";
    /** Operation failed */
    readonly OPERATION_FAILED: "FIPS_OPERATION_FAILED";
    /** Invalid configuration */
    readonly INVALID_CONFIG: "FIPS_INVALID_CONFIG";
};
export type FIPSErrorCode = (typeof FIPSErrorCode)[keyof typeof FIPSErrorCode];
/**
 * Custom error class for FIPS operations
 */
export declare class FIPSError extends Error {
    readonly code: FIPSErrorCode;
    readonly details?: Record<string, unknown>;
    constructor(message: string, code: FIPSErrorCode, details?: Record<string, unknown>);
}
/**
 * Validate if an algorithm is FIPS 140-2 compliant
 *
 * @param algorithm - The algorithm name to validate
 * @returns true if the algorithm is FIPS compliant
 */
export declare function validateAlgorithm(algorithm: string): boolean;
/**
 * Validate if a key length meets FIPS 140-2 requirements
 *
 * @param algorithm - The algorithm type
 * @param keyLength - The key length in bits
 * @returns true if the key length is FIPS compliant
 */
export declare function validateKeyLength(algorithm: string, keyLength: number): boolean;
/**
 * Validate if a hash function is FIPS 140-2 compliant
 *
 * @param hashFunction - The hash function name
 * @returns true if the hash is FIPS compliant
 */
export declare function validateHash(hashFunction: string): boolean;
/**
 * Validate if a complete crypto operation is FIPS 140-2 compliant
 *
 * @param operation - The crypto operation to validate
 * @returns true if the operation is FIPS compliant
 */
export declare function isFIPSCompliant(operation: CryptoOperation): boolean;
/**
 * Validate TLS version
 *
 * @param tlsVersion - The TLS version string
 * @returns true if the TLS version is FIPS compliant
 */
export declare function validateTLSVersion(tlsVersion: string): boolean;
/**
 * Validate cipher suite
 *
 * @param cipherSuite - The cipher suite string
 * @returns true if the cipher suite is FIPS compliant
 */
export declare function validateCipherSuite(cipherSuite: string): boolean;
/**
 * FIPS 140-2 Compliant Crypto Provider
 *
 * Provides cryptographic operations that enforce FIPS 140-2 compliance.
 * All operations are validated and audited.
 *
 * @example
 * ```typescript
 * const provider = new FIPSCryptoProvider();
 * await provider.initialize();
 *
 * // Encrypt data
 * const encrypted = await provider.fipsEncrypt(
 *   Buffer.from('sensitive data'),
 *   key,
 *   'aes-256-gcm'
 * );
 *
 * // Hash data
 * const hash = await provider.fipsHash(
 *   Buffer.from('data'),
 *   'sha256'
 * );
 * ```
 */
export declare class FIPSCryptoProvider {
    private readonly config;
    private readonly auditCallbacks;
    private readonly violations;
    private initialized;
    constructor(config?: Partial<FIPSModeConfig>);
    /**
     * Initialize the FIPS crypto provider
     */
    initialize(): Promise<void>;
    /**
     * Ensure the provider is initialized
     */
    private ensureInitialized;
    /**
     * Get current configuration
     */
    getConfig(): Readonly<FIPSModeConfig>;
    /**
     * Check if FIPS mode is enabled
     */
    isFIPSModeEnabled(): boolean;
    /**
     * Register an audit callback
     */
    onAudit(callback: FIPSAuditCallback): void;
    /**
     * Get recorded violations
     */
    getViolations(): FIPSViolation[];
    /**
     * Clear recorded violations
     */
    clearViolations(): void;
    /**
     * Emit audit event
     */
    private emitAudit;
    /**
     * Record a FIPS violation
     */
    private recordViolation;
    /**
     * Validate and potentially block a crypto operation
     */
    private validateOperation;
    /**
     * Create audit entry helper
     */
    private createAuditEntry;
    /**
     * FIPS-compliant encryption
     *
     * Only allows FIPS 140-2 approved algorithms (AES-128, AES-256 in GCM, CBC, CTR modes)
     *
     * @param data - Data to encrypt
     * @param key - Encryption key
     * @param algorithm - FIPS-approved algorithm (default: aes-256-gcm)
     * @returns Encrypted data with IV and auth tag
     */
    fipsEncrypt(data: Buffer, key: Buffer, algorithm?: FIPSSymmetricAlgorithm): Promise<{
        ciphertext: Buffer;
        iv: Buffer;
        authTag?: Buffer;
    }>;
    /**
     * FIPS-compliant decryption
     *
     * Only allows FIPS 140-2 approved algorithms
     *
     * @param ciphertext - Encrypted data
     * @param key - Decryption key
     * @param iv - Initialization vector
     * @param algorithm - FIPS-approved algorithm (default: aes-256-gcm)
     * @param authTag - Authentication tag (required for GCM mode)
     * @returns Decrypted data
     */
    fipsDecrypt(ciphertext: Buffer, key: Buffer, iv: Buffer, algorithm?: FIPSSymmetricAlgorithm, authTag?: Buffer): Promise<Buffer>;
    /**
     * FIPS-compliant hashing
     *
     * Only allows SHA-2 family (SHA-256, SHA-384, SHA-512)
     *
     * @param data - Data to hash
     * @param algorithm - FIPS-approved hash algorithm (default: sha256)
     * @returns Hash digest
     */
    fipsHash(data: Buffer | string, algorithm?: FIPSHashAlgorithm): Promise<Buffer>;
    /**
     * FIPS-compliant HMAC
     *
     * Only allows HMAC-SHA256, HMAC-SHA384, HMAC-SHA512
     *
     * @param data - Data to authenticate
     * @param key - HMAC key
     * @param algorithm - Hash algorithm for HMAC (default: sha256)
     * @returns HMAC digest
     */
    fipsHmac(data: Buffer | string, key: Buffer, algorithm?: FIPSHMACAlgorithm): Promise<Buffer>;
    /**
     * FIPS-compliant digital signature
     *
     * Only allows RSA (2048+ bits) and ECDSA (P-256, P-384, P-521)
     *
     * @param data - Data to sign
     * @param privateKey - Private key for signing
     * @param algorithm - Signing algorithm (default: sha256)
     * @returns Digital signature
     */
    fipsSign(data: Buffer | string, privateKey: crypto.KeyObject | string, algorithm?: FIPSHashAlgorithm): Promise<Buffer>;
    /**
     * FIPS-compliant signature verification
     *
     * @param data - Data that was signed
     * @param signature - Signature to verify
     * @param publicKey - Public key for verification
     * @param algorithm - Hash algorithm used for signing (default: sha256)
     * @returns true if signature is valid
     */
    fipsVerify(data: Buffer | string, signature: Buffer, publicKey: crypto.KeyObject | string, algorithm?: FIPSHashAlgorithm): Promise<boolean>;
    /**
     * FIPS-compliant random bytes generation
     *
     * Uses DRBG (Deterministic Random Bit Generator) compliant with SP 800-90A
     *
     * @param length - Number of bytes to generate
     * @returns Random bytes
     */
    fipsRandomBytes(length: number): Promise<Buffer>;
    /**
     * FIPS-compliant key derivation using PBKDF2
     *
     * @param password - Password to derive key from
     * @param salt - Salt value
     * @param iterations - Number of iterations (minimum 1000)
     * @param keyLength - Desired key length in bytes
     * @param digest - Hash algorithm (default: sha256)
     * @returns Derived key
     */
    fipsPBKDF2(password: Buffer | string, salt: Buffer, iterations: number, keyLength: number, digest?: FIPSHashAlgorithm): Promise<Buffer>;
    /**
     * FIPS-compliant key derivation using HKDF
     *
     * @param ikm - Input keying material
     * @param salt - Salt value
     * @param info - Context and application specific information
     * @param keyLength - Desired key length in bytes
     * @param digest - Hash algorithm (default: sha256)
     * @returns Derived key
     */
    fipsHKDF(ikm: Buffer, salt: Buffer, info: Buffer, keyLength: number, digest?: FIPSHashAlgorithm): Promise<Buffer>;
    /**
     * Generate FIPS-compliant key pair
     *
     * @param type - Key type ('rsa' or 'ec')
     * @param options - Key generation options
     * @returns Key pair
     */
    fipsGenerateKeyPair(type: 'rsa' | 'ec', options?: {
        modulusLength?: number;
        namedCurve?: string;
    }): Promise<{
        publicKey: crypto.KeyObject;
        privateKey: crypto.KeyObject;
    }>;
    /**
     * Validate certificate for FIPS compliance
     *
     * @param cert - X.509 certificate (PEM format or X509Certificate object)
     * @param options - Validation options
     * @returns Validation result
     */
    validateCertificate(cert: string | crypto.X509Certificate, options?: CertificateValidationOptions): {
        valid: boolean;
        errors: string[];
        warnings: string[];
    };
    /**
     * Shutdown the provider
     */
    shutdown(): Promise<void>;
}
/**
 * Enable global FIPS mode
 */
export declare function enableFIPSMode(): void;
/**
 * Disable global FIPS mode
 */
export declare function disableFIPSMode(): void;
/**
 * Check if global FIPS mode is enabled
 */
export declare function isFIPSModeEnabled(): boolean;
/**
 * Get the default FIPS crypto provider
 */
export declare function getFIPSCryptoProvider(): FIPSCryptoProvider;
/**
 * Set a custom FIPS crypto provider as the default
 */
export declare function setFIPSCryptoProvider(provider: FIPSCryptoProvider): void;
/**
 * Reset the default FIPS crypto provider (for testing)
 */
export declare function resetFIPSCryptoProvider(): Promise<void>;
/**
 * FIPS-compliant encrypt using default provider
 */
export declare function fipsEncrypt(data: Buffer, key: Buffer, algorithm?: FIPSSymmetricAlgorithm): Promise<{
    ciphertext: Buffer;
    iv: Buffer;
    authTag?: Buffer;
}>;
/**
 * FIPS-compliant decrypt using default provider
 */
export declare function fipsDecrypt(ciphertext: Buffer, key: Buffer, iv: Buffer, algorithm?: FIPSSymmetricAlgorithm, authTag?: Buffer): Promise<Buffer>;
/**
 * FIPS-compliant hash using default provider
 */
export declare function fipsHash(data: Buffer | string, algorithm?: FIPSHashAlgorithm): Promise<Buffer>;
/**
 * FIPS-compliant sign using default provider
 */
export declare function fipsSign(data: Buffer | string, privateKey: crypto.KeyObject | string, algorithm?: FIPSHashAlgorithm): Promise<Buffer>;
/**
 * FIPS-compliant random bytes using default provider
 */
export declare function fipsRandomBytes(length: number): Promise<Buffer>;
/**
 * Create a new FIPSCryptoProvider instance
 */
export declare function createFIPSCryptoProvider(config?: Partial<FIPSModeConfig>): FIPSCryptoProvider;
/**
 * Create FIPSCryptoProvider from environment variables
 */
export declare function createFIPSCryptoProviderFromEnv(): FIPSCryptoProvider;
//# sourceMappingURL=fips-mode.d.ts.map