import { BaseHSMProvider, HSMProviderConfig, HSMStatus, KeySpec, KeyHandle, EncryptionOptions } from './provider';
export interface GCPHSMConfig extends HSMProviderConfig {
    /** GCP project ID */
    projectId: string;
    /** Location (region) */
    location: string;
    /** Key ring name */
    keyRing: string;
    /** Service account credentials JSON path or object */
    credentials?: string | object;
    /** Use ADC (Application Default Credentials) */
    useADC?: boolean;
    /** Protection level (HSM or SOFTWARE for dev) */
    protectionLevel?: 'HSM' | 'SOFTWARE';
    /** IAM bindings for keys */
    iamBindings?: IAMBinding[];
}
/**
 * GCP IAM binding
 */
export interface IAMBinding {
    role: string;
    members: string[];
}
/**
 * GCP IAM roles for Cloud KMS
 */
export declare enum CloudKMSRole {
    ADMIN = "roles/cloudkms.admin",
    CRYPTO_KEY_ENCRYPTER = "roles/cloudkms.cryptoKeyEncrypter",
    CRYPTO_KEY_DECRYPTER = "roles/cloudkms.cryptoKeyDecrypter",
    CRYPTO_KEY_ENCRYPTER_DECRYPTER = "roles/cloudkms.cryptoKeyEncrypterDecrypter",
    SIGNER = "roles/cloudkms.signer",
    SIGNER_VERIFIER = "roles/cloudkms.signerVerifier",
    VIEWER = "roles/cloudkms.viewer",
    PUBLIC_KEY_VIEWER = "roles/cloudkms.publicKeyViewer"
}
/**
 * GCP key version state
 */
export declare enum KeyVersionState {
    PENDING_GENERATION = "CRYPTO_KEY_VERSION_STATE_PENDING_GENERATION",
    ENABLED = "ENABLED",
    DISABLED = "DISABLED",
    DESTROYED = "DESTROYED",
    DESTROY_SCHEDULED = "DESTROY_SCHEDULED",
    PENDING_IMPORT = "PENDING_IMPORT",
    IMPORT_FAILED = "IMPORT_FAILED"
}
/**
 * GCP key algorithm
 */
export declare enum GCPKeyAlgorithm {
    GOOGLE_SYMMETRIC_ENCRYPTION = "GOOGLE_SYMMETRIC_ENCRYPTION",
    RSA_SIGN_PKCS1_2048_SHA256 = "RSA_SIGN_PKCS1_2048_SHA256",
    RSA_SIGN_PKCS1_3072_SHA256 = "RSA_SIGN_PKCS1_3072_SHA256",
    RSA_SIGN_PKCS1_4096_SHA256 = "RSA_SIGN_PKCS1_4096_SHA256",
    RSA_SIGN_PKCS1_4096_SHA512 = "RSA_SIGN_PKCS1_4096_SHA512",
    RSA_SIGN_PSS_2048_SHA256 = "RSA_SIGN_PSS_2048_SHA256",
    RSA_SIGN_PSS_3072_SHA256 = "RSA_SIGN_PSS_3072_SHA256",
    RSA_SIGN_PSS_4096_SHA256 = "RSA_SIGN_PSS_4096_SHA256",
    RSA_SIGN_PSS_4096_SHA512 = "RSA_SIGN_PSS_4096_SHA512",
    RSA_DECRYPT_OAEP_2048_SHA256 = "RSA_DECRYPT_OAEP_2048_SHA256",
    RSA_DECRYPT_OAEP_3072_SHA256 = "RSA_DECRYPT_OAEP_3072_SHA256",
    RSA_DECRYPT_OAEP_4096_SHA256 = "RSA_DECRYPT_OAEP_4096_SHA256",
    RSA_DECRYPT_OAEP_4096_SHA512 = "RSA_DECRYPT_OAEP_4096_SHA512",
    EC_SIGN_P256_SHA256 = "EC_SIGN_P256_SHA256",
    EC_SIGN_P384_SHA384 = "EC_SIGN_P384_SHA384",
    EC_SIGN_SECP256K1_SHA256 = "EC_SIGN_SECP256K1_SHA256",
    HMAC_SHA256 = "HMAC_SHA256",
    HMAC_SHA1 = "HMAC_SHA1",
    HMAC_SHA384 = "HMAC_SHA384",
    HMAC_SHA512 = "HMAC_SHA512",
    HMAC_SHA224 = "HMAC_SHA224"
}
export declare class GCPHSMProvider extends BaseHSMProvider {
    readonly name = "Google Cloud HSM";
    readonly isProduction = true;
    private gcpConfig;
    private keyRingPath;
    private keyMap;
    private authenticated;
    constructor(config: GCPHSMConfig);
    /**
     * Connect to GCP Cloud KMS
     */
    connect(): Promise<void>;
    /**
     * Authenticate with GCP
     */
    private authenticate;
    /**
     * Ensure key ring exists
     */
    private ensureKeyRing;
    /**
     * Disconnect from GCP
     */
    disconnect(): Promise<void>;
    /**
     * Get HSM status
     */
    getStatus(): Promise<HSMStatus>;
    /**
     * Generate key in GCP Cloud KMS
     */
    generateKey(spec: KeySpec): Promise<KeyHandle>;
    /**
     * Map key spec to GCP algorithm
     */
    private mapToGCPAlgorithm;
    /**
     * Import key into GCP
     */
    importKey(keyMaterial: Buffer, spec: KeySpec): Promise<KeyHandle>;
    /**
     * Export public key
     */
    exportPublicKey(keyHandle: string): Promise<Buffer>;
    /**
     * Get key
     */
    getKey(keyHandle: string): Promise<KeyHandle | null>;
    /**
     * List keys
     */
    listKeys(filter?: Partial<KeySpec>): Promise<KeyHandle[]>;
    /**
     * Sign data
     */
    sign(keyHandle: string, data: Buffer, algorithm: string): Promise<Buffer>;
    /**
     * Verify signature
     */
    verify(keyHandle: string, data: Buffer, signature: Buffer, algorithm: string): Promise<boolean>;
    /**
     * Encrypt data
     */
    encrypt(keyHandle: string, data: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Decrypt data
     */
    decrypt(keyHandle: string, ciphertext: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Wrap key (GCP doesn't support direct key wrapping, use envelope encryption)
     */
    wrapKey(wrappingKeyHandle: string, keyToWrap: string, algorithm?: string): Promise<Buffer>;
    /**
     * Unwrap key
     */
    unwrapKey(wrappingKeyHandle: string, wrappedKey: Buffer, spec: KeySpec, algorithm?: string): Promise<string>;
    /**
     * Destroy key (schedule destruction)
     */
    destroyKey(keyHandle: string): Promise<void>;
    /**
     * Rotate key
     */
    rotateKey(keyId: string): Promise<string>;
    /**
     * Set key rotation schedule
     */
    setRotationSchedule(keyId: string, rotationPeriod: string): Promise<void>;
    /**
     * Parse duration string (e.g., "90d", "2592000s")
     */
    private parseDuration;
    /**
     * Set IAM policy on key
     */
    setIAMPolicy(keyId: string, bindings: IAMBinding[]): Promise<void>;
    /**
     * Create import job for bringing external keys
     */
    createImportJob(importJobId: string, protectionLevel?: 'HSM' | 'SOFTWARE'): Promise<{
        publicKey: Buffer;
        importJobName: string;
    }>;
}
//# sourceMappingURL=gcp-hsm.d.ts.map