@chilkat/react-native 11.6.1

package/src/specs/JavaKeyStore.nitro.ts

@@ -0,0 +1,619 @@
+// Generated by ReactNativeNs.RnGenerator -- do not edit.
+import type { HybridObject } from 'react-native-nitro-modules'
+import type { BinData } from './BinData.nitro'
+import type { Cert } from './Cert.nitro'
+import type { CertChain } from './CertChain.nitro'
+import type { JsonObject } from './JsonObject.nitro'
+import type { Pem } from './Pem.nitro'
+import type { Pfx } from './Pfx.nitro'
+import type { PrivateKey } from './PrivateKey.nitro'
+import type { StringBuilder } from './StringBuilder.nitro'
+import type { XmlCertVault } from './XmlCertVault.nitro'
+
+/**
+ * Load, inspect, modify, convert, and save Java keystore data.
+ *
+ * `JavaKeyStore` is the Chilkat class for working with Java
+ * keystore data. It supports private-key entries with aliases and certificate
+ * chains, trusted certificate entries, and secret-key entries. It can load and
+ * save keystores, import private-key entries from PFX, add trusted certificates
+ * and symmetric keys, retrieve private keys and certificate chains, manage
+ * aliases, change private-key passwords, and convert keystore contents to PEM,
+ * PFX, or JWK Set format.
+ *
+ * **Load and save keystores**
+ *
+ * Read Java keystore data into memory, inspect or modify its contents, and
+ * save the updated keystore when changes are complete.
+ *
+ * **Private-key entries**
+ *
+ * Work with private keys stored under aliases, including their associated
+ * certificate chains and entry-specific passwords.
+ *
+ * **Trusted certificates**
+ *
+ * Add, retrieve, and manage trusted certificate entries used for trust
+ * stores, TLS validation, and Java-based security configuration.
+ *
+ * **Secret-key entries**
+ *
+ * Store and retrieve symmetric secret keys when the keystore is used for
+ * application key material in addition to certificates.
+ *
+ * **Import and convert**
+ *
+ * Import private-key entries from PFX/P12 and export or convert keystore
+ * contents to PEM, PFX, or JWK Set format.
+ *
+ * **Alias management**
+ *
+ * Enumerate aliases, locate entries, rename or manage entry names, and
+ * organize keys and certificates by application-specific identifiers.
+ *
+ * **Common pattern:**
+ * Load the keystore with its store password, locate the needed entry by alias,
+ * retrieve the private key, certificate chain, trusted certificate, or secret
+ * key, then save the keystore or export the selected material in the format
+ * required by the target system. Use `JavaKeyStore` when the data is
+ * organized as a Java keystore; use `Cert`, `PrivateKey`,
+ * `Pfx`, or `TrustedRoots` when working directly with
+ * individual certificate or key objects.
+ *
+ * For an extended overview, see
+ * [JavaKeyStore Class Overview](https://www.chilkatsoft.com/javakeystore_class_overview.asp).
+ *
+ * Each `JavaKeyStore` instance owns a native Chilkat object. It is released when the JavaScript
+ * object is
+ * garbage collected, or immediately by `dispose()`; any use after `dispose()` throws.
+ * Create one with `new JavaKeyStore()`.
+ */
+export interface JavaKeyStore extends HybridObject<{ ios: 'c++', android: 'c++' }> {
+  // ---- Properties ----
+
+  /**
+   * Provides HTML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorHtml: string
+
+  /**
+   * Provides plain text information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorText: string
+
+  /**
+   * Provides XML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorXml: string
+
+  /**
+   * Version of the component/library, such as "10.1.0"
+   *
+   * This property is read-only.
+   */
+  readonly version: string
+
+  /**
+   * If set to a file path, this property logs the LastErrorText of each Chilkat method or property
+   * call to the specified file. This logging helps identify the context and history of Chilkat
+   * calls leading up to any crash or hang, aiding in debugging.
+   *
+   * Enabling the VerboseLogging property provides more detailed information.
+   *
+   * This property is mainly used for debugging rare instances where a Chilkat method call causes a
+   * hang or crash, which should generally not happen.
+   *
+   * Possible causes of hangs include:
+   *
+   * - A timeout property set to 0, indicating an infinite timeout.
+   *
+   * - A hang occurring within an event callback in the application code.
+   *
+   * - An internal bug in the Chilkat code causing the hang.
+   */
+  debugLogFilePath: string
+
+  /**
+   * If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may
+   * contain more verbose information. The default value is `false`. Verbose logging should only be
+   * used for debugging. The potentially large quantity of logged information may adversely affect
+   * peformance.
+   */
+  verboseLogging: boolean
+
+  /**
+   * Indicates the success or failure of the most recent method call: `true` means success, `false`
+   * means failure. This property remains unchanged by property setters or getters. This method is
+   * present to address challenges in checking for null or Nothing returns in certain programming
+   * languages. Note: This property does not apply to methods that return integer values or to
+   * boolean-returning methods where the boolean does not indicate success or failure.
+   */
+  lastMethodSuccess: boolean
+
+  /**
+   * Returns the number of private-key entries currently contained in the keystore. Each private-key
+   * entry has an alias, a protected private key, and an associated certificate chain. Valid
+   * private-key indexes range from `0` through `NumPrivateKeys - 1`.
+   *
+   * **Entry password versus store password:** The private key in each entry may have its own
+   * password. That entry password is supplied to methods such as {@link JavaKeyStore.privateKeyAt}
+   * and {@link JavaKeyStore.privateKeyOf}. It is distinct from the store password used when loading
+   * or saving the complete keystore.
+   *
+   * This property is read-only.
+   */
+  readonly numPrivateKeys: number
+
+  /**
+   * Returns the number of trusted-certificate entries currently contained in the keystore. Each
+   * entry contains one certificate and an alias. Valid indexes range from `0` through
+   * `NumTrustedCerts - 1`.
+   *
+   * **A trusted entry is not necessarily a root CA:** Java keystores can mark any certificate as
+   * trusted. The application or Java security configuration decides what that trust means; this
+   * class does not validate the certificate merely because it is stored as a trusted-certificate
+   * entry.
+   *
+   * This property is read-only.
+   */
+  readonly numTrustedCerts: number
+
+  /**
+   * Controls whether a complete certificate chain is required when a private-key entry is added.
+   * The default is `_TRUE_`. When enabled, {@link JavaKeyStore.addPrivateKey} and {@link
+   * JavaKeyStore.addPfx} fail if Chilkat cannot build the chain through the issuing certificates to
+   * a root or self-signed certificate. When set to `_FALSE_`, an incomplete chain may be stored.
+   *
+   * **Providing missing issuers:** Call {@link JavaKeyStore.useCertVault} to make additional
+   * certificates available for chain construction. Trusted CA roots supplied through Chilkat
+   * trusted-root facilities may also help complete the chain. This property affects chain
+   * construction while adding entries; it does not perform application trust-policy validation.
+   */
+  requireCompleteChain: boolean
+
+  /**
+   * Controls validation of the keystore-level integrity digest when a JKS or JCEKS store is loaded.
+   * The default is `_TRUE_`. In this mode, the load method uses the supplied store password to
+   * verify that the serialized keystore has not been altered and that the password is appropriate
+   * for the store.
+   *
+   * When set to `_FALSE_`, a load method may be called with an empty password to read the store
+   * without validating its integrity digest.
+   *
+   * **Security consequence:** Disabling this check does not decrypt private or secret key entries
+   * and does not make their entry passwords unnecessary. It only skips store-level integrity
+   * verification, so corrupted or modified keystore data may be accepted. Leave this property
+   * enabled for normal use.
+   */
+  verifyKeyedDigest: boolean
+
+  /**
+   * Returns the number of symmetric secret-key entries currently contained in the keystore.
+   * Examples include AES, HMAC, Blowfish, and ChaCha key material. Valid indexes range from `0`
+   * through `NumSecretKeys - 1`.
+   *
+   * **JCEKS entry type:** Secret-key entries require the JCEKS format; the traditional JKS format
+   * stores private-key entries and trusted-certificate entries but does not provide the JCEKS
+   * secret-key entry type.
+   *
+   * This property is read-only.
+   */
+  readonly numSecretKeys: number
+
+  // ---- Methods ----
+
+  /**
+   * Imports the private-key entries found in the `Pfx` object supplied in `pfx`. One Java keystore
+   * private-key entry is added for each private key in the PFX/PKCS #12 data. Certificates from the
+   * PFX are used to construct the certificate chain associated with each imported private key.
+   *
+   * `aliasName` specifies the alias for the first imported private key. If it is empty, Chilkat
+   * chooses an alias in this order:
+   *
+   * - The subject common name of the private key certificate.
+   *
+   * - The subject email address.
+   *
+   * - The PKCS #12 friendly-name attribute.
+   *
+   * - The certificate serial number.
+   *
+   * If the PFX contains additional private keys, their aliases are chosen automatically using the
+   * same preference order. `password` becomes the entry password used to protect the imported
+   * private keys in the Java keystore.
+   *
+   * **What is not imported:** Standalone certificates from the PFX are not added as
+   * trusted-certificate entries. They are used only as possible members of private-key certificate
+   * chains. Call {@link JavaKeyStore.addTrustedCert} separately when a certificate should become an
+   * explicit trust entry.
+   *
+   * **Chain completion:** If {@link JavaKeyStore.requireCompleteChain} is enabled, the method fails
+   * when any imported private-key chain cannot be completed. {@link JavaKeyStore.useCertVault} can
+   * supply additional issuer certificates.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  addPfx(pfx: Pfx, aliasName: string, password: string): void
+
+  /**
+   * Adds a private-key entry using the certificate in `cert`. The `Cert` object must have access to
+   * its associated private key. Chilkat obtains that private key and builds the certificate chain
+   * beginning with `cert`.
+   *
+   * `aliasName` is the entry alias. If it is empty, Chilkat chooses an alias from the certificate
+   * in this order: subject common name, subject email address, then certificate serial number.
+   * `password` is the password used to protect the private key inside the keystore.
+   *
+   * **Certificate-chain construction:** A private-key entry consists of the private key and the
+   * certificate chain for its public key. If {@link JavaKeyStore.requireCompleteChain} is enabled,
+   * the method fails unless the chain can be completed. Use {@link JavaKeyStore.useCertVault} when
+   * additional issuer certificates are needed.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  addPrivateKey(cert: Cert, aliasName: string, password: string): void
+
+  /**
+   * Adds `cert` as a trusted-certificate entry under the alias supplied in `aliasName`. A
+   * trusted-certificate entry contains the certificate only; it does not contain a private key or a
+   * certificate chain.
+   *
+   * **Trust is an application decision:** Adding a certificate as a trusted entry does not prove
+   * that it is a CA certificate, validate its signature chain, or make it universally trustworthy.
+   * It records that the keystore owner intends to trust that certificate for the consuming Java
+   * application or security configuration.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  addTrustedCert(cert: Cert, aliasName: string): void
+
+  /**
+   * Changes the password protecting the private-key entry at `index`. Indexing begins at `0`.
+   * `oldPassword` is the current entry password and `newPassword` is the new entry password.
+   *
+   * **This does not change only the store password:** A JKS/JCEKS store can have one password for
+   * store-level integrity and separate passwords for private-key entries. To migrate a keystore
+   * from one common password to another, load it using the old store password, call this method for
+   * each private-key entry that uses the old password, and then save the store using the new store
+   * password.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  changePassword(index: number, oldPassword: string, newPassword: string): void
+
+  /**
+   * Returns the alias of the private-key entry at `index`. Indexing begins at `0`; valid indexes
+   * range from `0` through `
0 - 1`.
+   *
+   * **Alias portability:** Java keystore alias case behavior is implementation-dependent. Avoid
+   * creating aliases that differ only by letter case, even when a Chilkat lookup method offers a
+   * case-sensitive option.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  getPrivateKeyAlias(index: number): string
+
+  /**
+   * Returns the alias of the trusted-certificate entry at `index`. Indexing begins at `0`; valid
+   * indexes range from `0` through `
0 - 1`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  getTrustedCertAlias(index: number): string
+
+  /**
+   * Decodes the serialized keystore text in `jksEncData` using the binary encoding named by
+   * `encoding`, then loads the resulting JKS or JCEKS bytes. Common encodings include `base64`,
+   * `hex`, and `base64url`. `password` is the store password used for integrity verification.
+   *
+   * **Encoding is not encryption:** `encoding` describes how binary keystore bytes are represented
+   * as text. It does not name the keystore format and does not protect the data cryptographically.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  loadEncoded(password: string, jksEncData: string, encoding: string): void
+
+  /**
+   * Loads a JKS or JCEKS keystore from the file at `path`. `password` is the store password used to
+   * verify the keystore-level integrity digest when {@link JavaKeyStore.verifyKeyedDigest} is
+   * enabled.
+   *
+   * **JKS/JCEKS versus PKCS #12:** This class is intended for the proprietary Java JKS and JCEKS
+   * formats. Modern Java releases use PKCS #12 as the default keystore type; use `Chilkat.Pfx` when
+   * the input is a `.p12` or `.pfx` container.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  loadFile(password: string, path: string): void
+
+  /**
+   * Removes an entry selected by type and zero-based index. `entryType` uses the following
+   * documented values:
+   *
+   * `entryType`Entry selected
+   *
+   * | `1` |  | Trusted-certificate entry; `index` indexes the trusted-certificate list. |
+   *
+   * | `2` |  | Private-key entry; `index` indexes the private-key list. |
+   *
+   * `index` is an index within the selected entry category, not an index across all entries in the
+   * keystore.
+   *
+   * **In-memory change:** This method modifies the current object. Call {@link
+   * JavaKeyStore.toFile}, {@link JavaKeyStore.toBd}, or another `To*` method to persist the updated
+   * keystore.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  removeEntry(entryType: number, index: number): void
+
+  /**
+   * Changes the alias of an entry selected by type and zero-based index. `entryType` uses the
+   * following documented values:
+   *
+   * `entryType`Entry selected
+   *
+   * | `1` |  | Trusted-certificate entry; `index` indexes the trusted-certificate list. |
+   *
+   * | `2` |  | Private-key entry; `index` indexes the private-key list. |
+   *
+   * `aliasName` is the new alias. The index is relative to the selected category, not the complete
+   * set of keystore entries.
+   *
+   * **Choose aliases carefully:** Aliases identify entries within a Java keystore, but case
+   * sensitivity is implementation-dependent. Use unique aliases that do not differ only by case.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  setAlias(entryType: number, index: number, aliasName: string): void
+
+  /**
+   * Serializes the current Java keystore and returns the resulting JKS or JCEKS bytes encoded as
+   * text using `encoding`. Common choices include `base64`, `hex`, and `base64url`. `password` is
+   * the store password used to create the keystore-level integrity digest.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  toEncodedString(password: string, encoding: string): string
+
+  /**
+   * Serializes the current Java keystore and writes the complete JKS or JCEKS file image to `path`.
+   * `password` is the store password used to create the keystore-level integrity digest.
+   *
+   * **Password roles:** The store password may differ from the passwords protecting individual
+   * private-key or secret-key entries. Saving with a new store password does not automatically
+   * change each entry password; use {@link JavaKeyStore.changePassword} for private-key entries
+   * when needed.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  toFile(password: string, path: string): void
+
+  /**
+   * Adds `vault` to the certificate sources Chilkat searches when it needs issuer certificates to
+   * build a private-key certificate chain. This is useful before calling {@link
+   * JavaKeyStore.addPrivateKey} or {@link JavaKeyStore.addPfx} when the supplied certificate
+   * material does not already contain the complete chain.
+   *
+   * **Lookup source only:** Registering a certificate vault does not copy all vault certificates
+   * into the Java keystore and does not create trusted-certificate entries. Certificates are
+   * consulted only as candidates for chain construction.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  useCertVault(vault: XmlCertVault): void
+
+  /**
+   * Exports supported private-key and secret-key entries as a JSON Web Key Set and writes the JSON
+   * to `sbJwkSet`. `password` is used to recover protected key entries. Each exported JWK receives
+   * a `kid` value derived from the keystore alias.
+   *
+   * **Sensitive output:** A JWK containing private parameter `d` or symmetric parameter `k`
+   * contains secret key material. Protect the resulting JSON as carefully as the original keystore
+   * and do not log or transmit it over an untrusted channel.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  toJwkSet(password: string, sbJwkSet: StringBuilder): void
+
+  /**
+   * Returns the alias of the secret-key entry at `index`. Indexing begins at `0`; valid indexes
+   * range from `0` through `
0 - 1`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  getSecretKeyAlias(index: number): string
+
+  /**
+   * Recovers the secret-key entry at `index` and returns its raw key bytes encoded using
+   * `encoding`. `password` is the password protecting that entry. Indexing begins at `0`. Common
+   * output encodings include `hex`, `base64`, and `base64url`.
+   *
+   * **Secret material:** The returned text represents the actual symmetric key bytes, not a
+   * fingerprint or identifier. Avoid writing it to logs, command histories, or unprotected
+   * configuration files.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  getSecretKey(password: string, index: number, encoding: string): string
+
+  /**
+   * Adds a symmetric secret-key entry. `encodedKeyBytes` contains the key bytes encoded as text,
+   * and `encoding` names that encoding, such as `hex`, `base64`, or `base64url`. `algorithm`
+   * records the key algorithm, such as `AES`, `HMAC_SHA256`, or `CHACHA`. `aliasName` is the alias,
+   * and `password` is the password used to protect the key entry.
+   *
+   * The algorithm value describes the intended key type; it does not transform the supplied key
+   * bytes. For example, a 128-bit AES key is supplied as exactly 16 decoded bytes and `algorithm`
+   * is set to `AES`.
+   *
+   * **JCEKS and legacy protection:** Secret-key entries are stored in JCEKS form. JCEKS protects
+   * these entries using the legacy `PBEWithMD5AndTripleDES` mechanism defined by that format. Use
+   * this format when interoperability requires JCEKS, and protect both the entry password and the
+   * resulting file.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  addSecretKey(encodedKeyBytes: string, encoding: string, algorithm: string, aliasName: string, password: string): void
+
+  /**
+   * Loads supported keys from the JWK Set in `jwkSet` into this Java keystore object. `password` is
+   * used to protect imported private-key and secret-key entries. A JWK `kid` value is used as the
+   * entry alias when present.
+   *
+   * **JWK Set structure:** `jwkSet` should contain a JSON object with a `keys` array. Private
+   * asymmetric JWKs contain private parameters such as `d`; symmetric JWKs use `kty: "oct"` and
+   * contain the key in `k`. Treat the input as sensitive whenever it contains private or symmetric
+   * key material.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  loadJwkSet(password: string, jwkSet: JsonObject): void
+
+  /**
+   * Loads a JKS or JCEKS keystore from the bytes currently contained in `bd`. `password` is the
+   * store password used for integrity verification when {@link JavaKeyStore.verifyKeyedDigest} is
+   * enabled.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  loadBd(password: string, bd: BinData): void
+
+  /**
+   * Loads `cert` with the trusted certificate at the zero-based index `index`. Valid indexes range
+   * from `0` through `
0 - 1`. The returned certificate is the single certificate stored in the
+   * trust entry and has no private key merely by virtue of being trusted.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  trustedCertAt(index: number, cert: Cert): void
+
+  /**
+   * Loads `privKey` with the private key at zero-based index `index`. `password` is the password
+   * protecting that private-key entry. Valid indexes range from `0` through `
0 - 1`.
+   *
+   * **Use the entry password:** `password` is not necessarily the password used to load the
+   * complete keystore. Java keystores can protect each private-key entry with a different password.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  privateKeyAt(password: string, index: number, privKey: PrivateKey): void
+
+  /**
+   * Loads `certChain` with the certificate chain belonging to the private-key entry at zero-based
+   * index `index`. Valid indexes range from `0` through `
0 - 1`. The first certificate contains
+   * the public key corresponding to the private key; subsequent certificates are issuing
+   * certificates toward the root.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  certChainAt(index: number, certChain: CertChain): void
+
+  /**
+   * Searches the private-key entries for an alias equal to `aliasName` and loads the matching
+   * certificate chain into `certChain`. `caseSensitive` controls whether the alias comparison is
+   * case-sensitive. The first certificate in the chain contains the public key corresponding to the
+   * private key.
+   *
+   * **Alias case behavior:** Java keystore implementations can differ in alias case handling. Avoid
+   * aliases that differ only by case, even when a case-sensitive search is requested.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  certChainOf(aliasName: string, caseSensitive: boolean, certChain: CertChain): void
+
+  /**
+   * Searches the private-key entries for an alias equal to `aliasName` and loads the matching
+   * private key into `privKey`. `password` is the password protecting that key entry, and
+   * `caseSensitive` controls whether the alias comparison is case-sensitive.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  privateKeyOf(password: string, aliasName: string, caseSensitive: boolean, privKey: PrivateKey): void
+
+  /**
+   * Searches the trusted-certificate entries for an alias equal to `aliasName` and loads the
+   * matching certificate into `cert`. `caseSensitive` controls whether the alias comparison is
+   * case-sensitive.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  trustedCertOf(aliasName: string, caseSensitive: boolean, cert: Cert): void
+
+  /**
+   * Converts the keystore material supported by the `Pem` class and loads the result into `pemObj`.
+   * `password` is used to decrypt private-key entries during the conversion.
+   *
+   * **Output handling:** The destination `Pem` object receives the converted material in memory.
+   * Its own export methods and properties control whether later PEM text is encrypted and how it is
+   * formatted. Treat unencrypted private-key PEM as sensitive data.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  toPemObj(password: string, pemObj: Pem): void
+
+  /**
+   * Converts the certificates and recoverable private-key entries in the Java keystore and loads
+   * the result into `pfxObj`. `password` is used to decrypt private-key entries during the
+   * conversion.
+   *
+   * **Conversion password:** `password` is an input password for recovering the Java keystore
+   * entries. It is not automatically the password that will protect a later serialized PFX; use the
+   * destination `Pfx` export method to choose the PFX password.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  toPfxObj(password: string, pfxObj: Pfx): void
+
+  /**
+   * Serializes the current Java keystore and writes the complete JKS or JCEKS file image to `bd`.
+   * `password` is the store password used to create the keystore-level integrity digest.
+   *
+   * **Separate entry protection:** Private-key and secret-key entries may have passwords distinct
+   * from the store password. Serializing with `password` does not automatically change those entry
+   * passwords.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link JavaKeyStore.lastErrorText}.
+   */
+  toBd(password: string, bd: BinData): void
+}