/**
 * KMS-backed Signing
 *
 * Alternative to Sigstore for air-gapped deployments.
 * Supports AWS KMS, GCP KMS, and HashiCorp Vault.
 *
 * @module enterprise/signing/kms
 */
/**
 * Supported KMS providers
 */
export type KMSProvider = "aws" | "gcp" | "vault" | "local";
/**
 * Base KMS configuration
 */
export interface KMSConfig {
    /** Provider type */
    provider: KMSProvider;
    /** Key identifier (ARN, resource name, or key path) */
    keyId: string;
    /** AWS-specific config */
    aws?: {
        region: string;
        accessKeyId?: string;
        secretAccessKey?: string;
        sessionToken?: string;
    };
    /** GCP-specific config */
    gcp?: {
        projectId: string;
        locationId: string;
        keyRingId: string;
        credentials?: string;
    };
    /** Vault-specific config */
    vault?: {
        address: string;
        token?: string;
        namespace?: string;
        mountPath?: string;
    };
    /** Local key (for testing) */
    local?: {
        privateKeyPem: string;
        publicKeyPem: string;
    };
}
/**
 * Signed artifact
 */
export interface KMSSignedArtifact {
    /** Original content */
    content: string;
    /** SHA-256 digest */
    digest: string;
    /** Base64-encoded signature */
    signature: string;
    /** KMS provider used */
    provider: KMSProvider;
    /** Key identifier */
    keyId: string;
    /** Signing timestamp */
    signedAt: string;
    /** Algorithm used */
    algorithm: string;
    /** Key version (if applicable) */
    keyVersion?: string;
}
/**
 * Verification result
 */
export interface KMSVerificationResult {
    /** Whether signature is valid */
    valid: boolean;
    /** Key used for verification */
    keyId?: string;
    /** Error message if invalid */
    error?: string;
    /** Verification timestamp */
    verifiedAt: string;
}
/**
 * AWS KMS signing client
 */
export declare class AWSKMSClient {
    private config;
    constructor(config: KMSConfig);
    /**
     * Sign content using AWS KMS
     */
    sign(content: string): Promise<KMSSignedArtifact>;
    /**
     * Verify signature using AWS KMS
     */
    verify(artifact: KMSSignedArtifact): Promise<KMSVerificationResult>;
    /**
     * Make AWS KMS API request
     */
    private kmsRequest;
    /**
     * Sign AWS request (simplified SigV4)
     */
    private signRequest;
}
/**
 * GCP KMS signing client
 */
export declare class GCPKMSClient {
    private config;
    private accessToken;
    constructor(config: KMSConfig);
    /**
     * Sign content using GCP KMS
     */
    sign(content: string): Promise<KMSSignedArtifact>;
    /**
     * Verify signature using GCP KMS
     */
    verify(artifact: KMSSignedArtifact): Promise<KMSVerificationResult>;
    /**
     * Make GCP KMS API request
     */
    private kmsRequest;
    /**
     * Get GCP access token
     */
    private getAccessToken;
}
/**
 * HashiCorp Vault signing client
 */
export declare class VaultClient {
    private config;
    constructor(config: KMSConfig);
    /**
     * Sign content using Vault Transit
     */
    sign(content: string): Promise<KMSSignedArtifact>;
    /**
     * Verify signature using Vault Transit
     */
    verify(artifact: KMSSignedArtifact): Promise<KMSVerificationResult>;
}
/**
 * Local key signing client (for testing/development)
 */
export declare class LocalKeyClient {
    private config;
    constructor(config: KMSConfig);
    /**
     * Sign content using local private key
     */
    sign(content: string): Promise<KMSSignedArtifact>;
    /**
     * Verify signature using local public key
     */
    verify(artifact: KMSSignedArtifact): Promise<KMSVerificationResult>;
}
/**
 * Unified KMS client
 */
export declare class KMSClient {
    private client;
    private provider;
    constructor(config: KMSConfig);
    /**
     * Sign content
     */
    sign(content: string): Promise<KMSSignedArtifact>;
    /**
     * Verify signature
     */
    verify(artifact: KMSSignedArtifact): Promise<KMSVerificationResult>;
    /**
     * Get provider name
     */
    getProvider(): KMSProvider;
}
/**
 * Create KMS client
 */
export declare function createKMSClient(config: KMSConfig): KMSClient;
/**
 * Create AWS KMS client
 */
export declare function createAWSKMSClient(keyId: string, options: {
    region: string;
    accessKeyId?: string;
    secretAccessKey?: string;
}): AWSKMSClient;
/**
 * Create GCP KMS client
 */
export declare function createGCPKMSClient(keyId: string, options: {
    projectId: string;
    locationId: string;
    keyRingId: string;
}): GCPKMSClient;
/**
 * Create Vault client
 */
export declare function createVaultClient(keyId: string, options: {
    address: string;
    token: string;
    namespace?: string;
}): VaultClient;
/**
 * Create local key client (for testing)
 */
export declare function createLocalKeyClient(keyId: string, privateKeyPem: string, publicKeyPem: string): LocalKeyClient;
//# sourceMappingURL=kms.d.ts.map