// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * Hardware Security Module (HSM) Integration Layer
 *
 * This module provides a unified interface for enterprise key management
 * across multiple HSM providers including:
 * - AWS CloudHSM
 * - Azure Dedicated/Managed HSM
 * - Google Cloud HSM
 * - Thales Luna Network HSM
 * - SoftHSM (for development)
 *
 * Features:
 * - Provider abstraction with automatic failover
 * - Key lifecycle management
 * - Multi-party key ceremonies with Shamir's Secret Sharing
 * - Health monitoring and audit logging
 * - Transparent integration with application code
 *
 * @module security/hsm
 */
// ============================================================================
// Provider Interface and Base Types
// ============================================================================
export { KeyType, KeyUsage, ECCurve, EncryptionAlgorithm, SigningAlgorithm, 
// Base Implementation
BaseHSMProvider, 
// Error Types
HSMError, HSMConnectionError, HSMKeyNotFoundError, HSMOperationError, HSMPermissionError, } from './provider';
// ============================================================================
// Provider Implementations
// ============================================================================
// AWS CloudHSM
export { AWSCloudHSMProvider, } from './aws-cloudhsm';
// Azure Managed HSM
export { AzureHSMProvider, AzureHSMRole, } from './azure-hsm';
// Google Cloud HSM
export { GCPHSMProvider, GCPKeyAlgorithm, KeyVersionState, CloudKMSRole, } from './gcp-hsm';
// Thales Luna HSM
export { ThalesLunaProvider, } from './thales-luna';
// SoftHSM (Development)
export { SoftHSMProvider, } from './local-softHSM';
// ============================================================================
// Key Ceremony
// ============================================================================
export { KeyCeremonyManager, CeremonyType, CeremonyStatus, CeremonyAction, CustodianRole, } from './key-ceremony';
// ============================================================================
// HSM Service (Orchestration)
// ============================================================================
export { HSMService, createHSMService, } from './hsm-service';
// ============================================================================
// Convenience Types for Common Use Cases
// ============================================================================
/**
 * Standard key specifications for common use cases
 */
export const StandardKeySpecs = {
    /**
     * AES-256 key for data encryption
     */
    DataEncryptionKey: {
        type: 'AES',
        size: 256,
        usage: ['encrypt', 'decrypt'],
        extractable: false,
    },
    /**
     * AES-256 key for wrapping other keys
     */
    KeyEncryptionKey: {
        type: 'AES',
        size: 256,
        usage: ['wrap', 'unwrap'],
        extractable: false,
    },
    /**
     * RSA-2048 key pair for signing
     */
    RSASigningKey: {
        type: 'RSA',
        size: 2048,
        usage: ['sign', 'verify'],
        extractable: false,
    },
    /**
     * RSA-2048 key pair for encryption
     */
    RSAEncryptionKey: {
        type: 'RSA',
        size: 2048,
        usage: ['encrypt', 'decrypt'],
        extractable: false,
    },
    /**
     * ECDSA P-256 key pair for signing
     */
    ECDSASigningKey: {
        type: 'EC',
        curve: 'P-256',
        usage: ['sign', 'verify'],
        extractable: false,
    },
    /**
     * HMAC-SHA256 key for message authentication
     */
    HMACKey: {
        type: 'HMAC',
        size: 256,
        usage: ['sign', 'verify'],
        extractable: false,
    },
};
/**
 * Environment-based provider recommendations
 */
export const ProviderRecommendations = {
    development: ['softhsm'],
    staging: ['softhsm', 'aws', 'azure', 'gcp'],
    production: ['aws', 'azure', 'gcp', 'thales'],
};
// ============================================================================
// Quick Start Functions
// ============================================================================
import { createHSMService as createService } from './hsm-service';
import { KeyType, KeyUsage, ECCurve } from './provider';
/**
 * Quick start: Create and initialize HSM service for the current environment
 *
 * @example
 * ```typescript
 * const hsm = await quickStart('development');
 * const key = await hsm.generateMasterKey('my-app-key');
 * const encrypted = await hsm.encrypt(key.id, Buffer.from('secret data'));
 * ```
 */
export async function quickStart(environment = 'development') {
    const service = createService(environment);
    await service.initialize();
    return service;
}
/**
 * Create a simple encryption service using SoftHSM
 * Useful for development and testing
 *
 * @example
 * ```typescript
 * const crypto = await createSimpleCryptoService();
 * const { keyId, ciphertext } = await crypto.encrypt('my-data', Buffer.from('hello'));
 * const plaintext = await crypto.decrypt(keyId, ciphertext);
 * ```
 */
export async function createSimpleCryptoService() {
    const service = await quickStart('development');
    const keyCache = new Map();
    return {
        async encrypt(label, data) {
            let keyId = keyCache.get(`enc:${label}`);
            if (!keyId) {
                const key = await service.generateKey({
                    label,
                    type: KeyType.AES,
                    size: 256,
                    usage: [KeyUsage.ENCRYPT, KeyUsage.DECRYPT],
                    extractable: false,
                });
                keyId = key.id;
                keyCache.set(`enc:${label}`, keyId);
            }
            const ciphertext = await service.encrypt(keyId, data);
            return { keyId, ciphertext };
        },
        async decrypt(keyId, ciphertext) {
            return service.decrypt(keyId, ciphertext);
        },
        async sign(label, data) {
            let keyId = keyCache.get(`sign:${label}`);
            if (!keyId) {
                const key = await service.generateKey({
                    label,
                    type: KeyType.EC,
                    curve: ECCurve.P256,
                    usage: [KeyUsage.SIGN, KeyUsage.VERIFY],
                    extractable: false,
                });
                keyId = key.id;
                keyCache.set(`sign:${label}`, keyId);
            }
            const signature = await service.sign(keyId, data, 'ECDSA-SHA256');
            return { keyId, signature };
        },
        async verify(keyId, data, signature) {
            return service.verify(keyId, data, signature, 'ECDSA-SHA256');
        },
        async destroy() {
            await service.shutdown();
        },
    };
}
//# sourceMappingURL=index.js.map