import { BaseHSMProvider, HSMProviderConfig, HSMStatus, KeySpec, KeyHandle, EncryptionOptions } from './provider';
export interface AWSCloudHSMConfig extends HSMProviderConfig {
    /** CloudHSM cluster ID */
    clusterId: string;
    /** AWS region */
    region: string;
    /** HSM IP addresses for direct connection */
    hsmIpAddresses?: string[];
    /** Path to customer CA certificate */
    customerCaCert?: string;
    /** Crypto user credentials */
    cryptoUser: {
        username: string;
        password: string;
    };
    /** PKCS#11 library path */
    pkcs11LibPath?: string;
    /** Partition label */
    partitionLabel?: string;
    /** Enable key synchronization across cluster */
    enableKeySync?: boolean;
    /** Client certificate for mTLS */
    clientCert?: string;
    /** Client key for mTLS */
    clientKey?: string;
}
export declare class AWSCloudHSMProvider extends BaseHSMProvider {
    readonly name = "AWS CloudHSM";
    readonly isProduction = true;
    private hsmConfig;
    private session;
    private keyHandleMap;
    private pkcs11Initialized;
    private handleCounter;
    constructor(config: AWSCloudHSMConfig);
    /**
     * Initialize PKCS#11 library and connect to HSM
     */
    connect(): Promise<void>;
    /**
     * Initialize PKCS#11 library
     */
    private initializePKCS11;
    /**
     * Find HSM slot
     */
    private findSlot;
    /**
     * Open PKCS#11 session
     */
    private openSession;
    /**
     * Login to HSM
     */
    private login;
    /**
     * Sync keys from HSM
     */
    private syncKeys;
    /**
     * Disconnect from HSM
     */
    disconnect(): Promise<void>;
    /**
     * Get HSM status
     */
    getStatus(): Promise<HSMStatus>;
    /**
     * Generate key using PKCS#11
     */
    generateKey(spec: KeySpec): Promise<KeyHandle>;
    /**
     * Generate AES key
     */
    private generateAESKey;
    /**
     * Generate RSA key pair
     */
    private generateRSAKeyPair;
    /**
     * Generate EC key pair
     */
    private generateECKeyPair;
    /**
     * Generate HMAC key
     */
    private generateHMACKey;
    /**
     * Import key into HSM
     */
    importKey(keyMaterial: Buffer, spec: KeySpec): Promise<KeyHandle>;
    /**
     * Export public key
     */
    exportPublicKey(keyHandle: string): Promise<Buffer>;
    /**
     * Get key metadata
     */
    getKey(keyHandle: string): Promise<KeyHandle | null>;
    /**
     * List keys
     */
    listKeys(filter?: Partial<KeySpec>): Promise<KeyHandle[]>;
    /**
     * Sign data
     */
    sign(keyHandle: string, data: Buffer, algorithm: string): Promise<Buffer>;
    /**
     * Verify signature
     */
    verify(keyHandle: string, data: Buffer, signature: Buffer, algorithm: string): Promise<boolean>;
    /**
     * Encrypt data
     */
    encrypt(keyHandle: string, data: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Decrypt data
     */
    decrypt(keyHandle: string, ciphertext: Buffer, options?: EncryptionOptions): Promise<Buffer>;
    /**
     * Wrap key for export
     */
    wrapKey(wrappingKeyHandle: string, keyToWrap: string, algorithm?: string): Promise<Buffer>;
    /**
     * Unwrap and import key
     */
    unwrapKey(wrappingKeyHandle: string, wrappedKey: Buffer, spec: KeySpec, algorithm?: string): Promise<string>;
    /**
     * Destroy key
     */
    destroyKey(keyHandle: string): Promise<void>;
    /**
     * Get cluster information
     */
    getClusterInfo(): Promise<{
        clusterId: string;
        state: string;
        hsms: Array<{
            hsmId: string;
            state: string;
            ipAddress: string;
        }>;
    }>;
    /**
     * Create a new partition
     */
    createPartition(label: string): Promise<void>;
    /**
     * Replicate key to all HSMs in cluster
     */
    replicateKey(keyHandle: string): Promise<void>;
}
//# sourceMappingURL=aws-cloudhsm.d.ts.map