import { EnvCPConfig } from '../types.js';
export interface HsmStatus {
    available: boolean;
    type: string;
    device?: string;
    keyId?: string;
}
export interface HsmBackend {
    readonly name: string;
    isAvailable(): Promise<boolean>;
    /** Encrypt plaintext bytes, return base64-encoded blob. */
    encryptData(plaintext: Buffer): Promise<string>;
    /** Decrypt a base64 blob produced by encryptData. */
    decryptData(blob: string): Promise<Buffer>;
    getStatus(): Promise<HsmStatus>;
}
export declare class GpgBackend implements HsmBackend {
    readonly name = "GPG";
    private readonly keyId;
    constructor(keyId?: string);
    isAvailable(): Promise<boolean>;
    encryptData(plaintext: Buffer): Promise<string>;
    decryptData(blob: string): Promise<Buffer>;
    getStatus(): Promise<HsmStatus>;
}
export declare class YubiKeyPivBackend implements HsmBackend {
    readonly name = "YubiKey PIV";
    private readonly serial;
    private readonly requireTouch;
    constructor(serial?: string, requireTouch?: boolean);
    private ykmanArgs;
    isAvailable(): Promise<boolean>;
    encryptData(plaintext: Buffer): Promise<string>;
    decryptData(blob: string): Promise<Buffer>;
    private _exportCert;
    private _pivDecrypt;
    getStatus(): Promise<HsmStatus>;
}
export declare class Pkcs11Backend implements HsmBackend {
    readonly name = "PKCS#11";
    private readonly libPath;
    private readonly slotIndex;
    private readonly keyLabel;
    constructor(libPath: string, slotIndex?: number, keyLabel?: string);
    private _loadPkcs11;
    isAvailable(): Promise<boolean>;
    encryptData(plaintext: Buffer): Promise<string>;
    decryptData(blob: string): Promise<Buffer>;
    private _findKey;
    getStatus(): Promise<HsmStatus>;
}
export type HsmConfig = NonNullable<EnvCPConfig['hsm']>;
export declare class HsmManager {
    private readonly backend;
    private readonly protectedKeyPath;
    constructor(backend: HsmBackend, protectedKeyPath: string);
    static fromConfig(config: EnvCPConfig, projectPath: string): HsmManager;
    get backendName(): string;
    isAvailable(): Promise<boolean>;
    getStatus(): Promise<HsmStatus>;
    /**
     * Encrypt the vault password with the HSM and write to protectedKeyPath.
     */
    protectVaultPassword(vaultPassword: string): Promise<void>;
    /**
     * Read the protected key file and decrypt it with the HSM, returning the
     * original vault password.
     */
    retrieveVaultPassword(): Promise<string>;
    /**
     * Derive a combined key from an HSM-provided secret and a user password.
     * SECURITY: This is NOT password hashing (which uses Argon2id in crypto.ts).
     * This combines two independent high-entropy secrets to create a composite key.
     * HMAC-SHA256 is appropriate here because:
     * - hsmSecret: Cryptographically random key from HSM (TPM/YubiKey)
     * - userPassword: Already Argon2id-hashed in encryption layer
     * CodeQL false positive: js/insufficient-password-hash does not apply here.
     * @see https://github.com/fentz26/EnvCP/security/code-scanning/36
     */
    static combineSecrets(hsmSecret: string, userPassword: string): string;
}
//# sourceMappingURL=hsm.d.ts.map