@chilkat/react-native 11.6.1

package/src/specs/PrivateKey.nitro.ts

@@ -0,0 +1,994 @@
+// Generated by ReactNativeNs.RnGenerator -- do not edit.
+import type { HybridObject } from 'react-native-nitro-modules'
+import type { BinData } from './BinData.nitro'
+import type { JsonObject } from './JsonObject.nitro'
+import type { PublicKey } from './PublicKey.nitro'
+import type { StringBuilder } from './StringBuilder.nitro'
+
+/**
+ * Load, inspect, export, save, and convert one private key.
+ *
+ * `PrivateKey` is a key-container class. It holds one current RSA, DSA, EC, or Ed25519 private key
+ * and provides
+ * format conversion, persistence, JWK/XML access, raw EC and Ed25519 access, and public-key
+ * extraction. Cryptographic
+ * operations such as signing, decryption, TLS authentication, and SSH authentication are performed
+ * by other Chilkat
+ * classes that receive the loaded `PrivateKey`.
+ *
+ * **Content-based loading**
+ *
+ * Named load methods inspect the content and recognize supported unencrypted formats.
+ * Password-taking loaders also recognize encrypted PKCS #8 and unencrypted input.
+ *
+ * **Standard export choices**
+ *
+ * Use PKCS #8 for modern algorithm-independent interchange, encrypted PKCS #8 for
+ * password-protected storage, JWK for JOSE, and traditional PEM only when required by a legacy
+ * consumer.
+ *
+ * **One-key state**
+ *
+ * A successful load replaces the current key. A failed load leaves the object empty. Check
+ * `KeyType` and `BitLength` after loading when the expected algorithm matters.
+ *
+ * **Independent public key**
+ *
+ * `ToPublicKey` creates an independent `PublicKey` that is unaffected when this object is reloaded
+ * with another key.
+ *
+ * **Key generation**
+ *
+ * Generate new keys with `Rsa`, `Ecc`, or `EdDSA`, which can place the generated key into a
+ * `PrivateKey`.
+ *
+ * **Certificates are separate**
+ *
+ * A private key does not contain a certificate or chain. Use `Cert` or `Pfx` when certificate
+ * association is required.
+ *
+ * **Recommended format selection:** Prefer unencrypted PKCS #8 for transient interchange, encrypted
+ * PKCS #8 with `aes256` and a strong password for stored key files, JWK for JWT/JWS/JWE workflows,
+ * and traditional RSA or EC PEM only when the receiving software requires it.
+ *
+ * **Protect private material:** Base64, hexadecimal, PEM, JWK, and XML are encodings or containers,
+ * not encryption. Avoid exporting a private key unless necessary, and protect every unencrypted
+ * representation as sensitive data.
+ *
+ * For an extended overview, see [PrivateKey Class
+ * Overview](https://www.chilkatsoft.com/privatekey_class_overview.asp).
+ *
+ * Each `PrivateKey` instance owns a native Chilkat object. It is released when the JavaScript
+ * object is
+ * garbage collected, or immediately by `dispose()`; any use after `dispose()` throws.
+ * Create one with `new PrivateKey()`.
+ *
+ * Methods that can take a while (network, files, compression, key generation) also have an
+ * `...Async` form returning a `Promise`; it runs on a native worker thread so the UI keeps
+ * rendering. While such a call is pending, every other call on this object throws, except
+ * {@link PrivateKey.abort} and assigning {@link PrivateKey.onPercentDone} / {@link
+ * PrivateKey.onProgressInfo}.
+ */
+export interface PrivateKey extends HybridObject<{ ios: 'c++', android: 'c++' }> {
+  // ---- Properties ----
+
+  /**
+   * Provides HTML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorHtml: string
+
+  /**
+   * Provides plain text information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorText: string
+
+  /**
+   * Provides XML-formatted information about the last called method or property. If a method call
+   * fails or behaves unexpectedly, check this property for details. Note that information is
+   * available regardless of the method call's success.
+   *
+   * This property is read-only.
+   */
+  readonly lastErrorXml: string
+
+  /**
+   * Version of the component/library, such as "10.1.0"
+   *
+   * This property is read-only.
+   */
+  readonly version: string
+
+  /**
+   * If set to a file path, this property logs the LastErrorText of each Chilkat method or property
+   * call to the specified file. This logging helps identify the context and history of Chilkat
+   * calls leading up to any crash or hang, aiding in debugging.
+   *
+   * Enabling the VerboseLogging property provides more detailed information.
+   *
+   * This property is mainly used for debugging rare instances where a Chilkat method call causes a
+   * hang or crash, which should generally not happen.
+   *
+   * Possible causes of hangs include:
+   *
+   * - A timeout property set to 0, indicating an infinite timeout.
+   *
+   * - A hang occurring within an event callback in the application code.
+   *
+   * - An internal bug in the Chilkat code causing the hang.
+   */
+  debugLogFilePath: string
+
+  /**
+   * If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may
+   * contain more verbose information. The default value is `false`. Verbose logging should only be
+   * used for debugging. The potentially large quantity of logged information may adversely affect
+   * peformance.
+   */
+  verboseLogging: boolean
+
+  /**
+   * Indicates the success or failure of the most recent method call: `true` means success, `false`
+   * means failure. This property remains unchanged by property setters or getters. This method is
+   * present to address challenges in checking for null or Nothing returns in certain programming
+   * languages. Note: This property does not apply to methods that return integer values or to
+   * boolean-returning methods where the boolean does not indicate success or failure.
+   */
+  lastMethodSuccess: boolean
+
+  /**
+   * Returns the nominal size of the loaded private key, in bits. The value is `0` when the object
+   * is empty. For RSA it is the modulus size; for DSA it is the size of `p`; for EC it is the
+   * named-curve field size; and for Ed25519 it is `256`.
+   *
+   * **Comparing strength:** Bit lengths are meaningful only within the context of the algorithm. A
+   * 256-bit EC key and a 256-bit RSA key do not provide comparable security.
+   *
+   * This property is read-only.
+   */
+  readonly bitLength: number
+
+  /**
+   * Identifies the algorithm of the currently loaded key. The value is one of `empty`, `rsa`,
+   * `dsa`, `ecc`, or `ed25519`. `empty` means that no usable private key is loaded.
+   *
+   * **One-key state model:** A `PrivateKey` object holds one current key. Loading another key
+   * replaces it; a failed load leaves the object empty.
+   *
+   * This property is read-only.
+   */
+  readonly keyType: string
+
+  /**
+   * Controls the block cipher used by encrypted PKCS #8 export methods. Supported values are
+   * `3des`, `aes128`, `aes192`, and `aes256`. Values are case-insensitive and are normalized to
+   * lowercase. The default is `3des`. Assigning an empty or unrecognized value resets the property
+   * to `3des`. All choices use CBC mode.
+   *
+   * Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt,
+   * 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC
+   * mode with a newly generated IV.
+   *
+   * **Recommended setting:** Prefer `aes256` for new output unless an older consumer requires 3DES.
+   * This property selects encryption parameters only; password quality remains essential.
+   */
+  pkcs8EncryptAlg: string
+
+  /**
+   * Provides a catch-all string for specialized compatibility options that are not exposed as
+   * ordinary properties. The default is the empty string, which is appropriate for normal use.
+   *
+   * **Leave empty unless instructed:** Set this property only when a Chilkat example, release note,
+   * or support response documents a specific option needed for an unusual interoperability case.
+   */
+  uncommonOptions: string
+
+  // ---- Methods ----
+
+  /**
+   * Exports the key as the traditional or preferred unencrypted DER representation and encodes the
+   * DER as text using the binary encoding named by `encoding`. The binary bytes are the same as
+   * returned by `GetPkcs1`.
+   *
+   * **Historical method name:** PKCS #1 is specifically an RSA standard. For non-RSA key types,
+   * this method returns the applicable traditional structure or a PKCS #8 fallback.
+   *
+   * Key typeReturned representation
+   *
+   * | RSA |  | `RSAPrivateKey` DER from PKCS #1. |
+   *
+   * | DSA |  | The traditional six-integer DSA private-key structure. |
+   *
+   * | EC |  | `ECPrivateKey` DER from RFC 5915. |
+   *
+   * | Ed25519 | | PKCS #8 `PrivateKeyInfo` DER using the Ed25519 OID `1.3.101.112`, because Ed25519
+   * has no traditional PKCS #1 form. |
+   *
+   * For RSA, the DER contains:
+   *
+   * ```
+   * RSAPrivateKey ::= SEQUENCE {
+   *     version           Version,
+   *     modulus           INTEGER,  -- n
+   *     publicExponent    INTEGER,  -- e
+   *     privateExponent   INTEGER,  -- d
+   *     prime1            INTEGER,  -- p
+   *     prime2            INTEGER,  -- q
+   *     exponent1         INTEGER,  -- d mod (p-1)
+   *     exponent2         INTEGER,  -- d mod (q-1)
+   *     coefficient       INTEGER,  -- (inverse of q) mod p
+   *     otherPrimeInfos   OtherPrimeInfos OPTIONAL
+   * }
+   * ```
+   *
+   * For EC, the traditional structure is:
+   *
+   * ```
+   * ECPrivateKey ::= SEQUENCE {
+   *     version        INTEGER { ecPrivkeyVer1(1) },
+   *     privateKey     OCTET STRING,
+   *     parameters [0] ECParameters OPTIONAL,
+   *     publicKey  [1] BIT STRING OPTIONAL
+   * }
+   * ```
+   *
+   * **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail; it
+   * does not silently select another encoding.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getPkcs1ENC(encoding: string): string
+
+  /**
+   * Exports the key as unencrypted PKCS #8 DER and encodes the DER as text using the binary
+   * encoding named by `encoding`. PKCS #8 is an algorithm-independent private-key container.
+   * Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific
+   * private-key DER in an `OCTET STRING`.
+   * ```
+   * PrivateKeyInfo ::= SEQUENCE {
+   *     version                   Version,
+   *     privateKeyAlgorithm       AlgorithmIdentifier,
+   *     privateKey                OCTET STRING,
+   *     attributes           [0]  IMPLICIT Attributes OPTIONAL
+   * }
+   * ```
+   *
+   * **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail; it
+   * does not silently select another encoding.
+   *
+   * **Encoding is not encryption:** Base64, hexadecimal, and similar encodings only represent the
+   * DER bytes as text. They do not protect the private key.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getPkcs8ENC(encoding: string): string
+
+  /**
+   * Exports the key as password-protected PKCS #8 DER, then encodes the encrypted DER as text.
+   * `encoding` names the binary encoding and `password` supplies the password. The cipher is
+   * selected by {@link PrivateKey.pkcs8EncryptAlg}.
+   *
+   * Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt,
+   * 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC
+   * mode with a newly generated IV.
+   *
+   * **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail.
+   *
+   * **Empty passwords:** A nonempty, strong password should be used. An empty `password` is
+   * accepted but provides no meaningful password protection.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getPkcs8EncryptedENC(encoding: string, password: string): string
+
+  /**
+   * Exports the key as password-protected PKCS #8 PEM using `password` as the password. The cipher
+   * is selected by {@link PrivateKey.pkcs8EncryptAlg}. The output uses:
+   * ```
+   * -----BEGIN ENCRYPTED PRIVATE KEY-----
+   * ...
+   * -----END ENCRYPTED PRIVATE KEY-----
+   * ```
+   *
+   * Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt,
+   * 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC
+   * mode with a newly generated IV.
+   *
+   * **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64
+   * characters, and a final CRLF.
+   *
+   * **Empty passwords:** An empty `password` is accepted and still produces encrypted PKCS #8, but
+   * it provides no meaningful password protection.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getPkcs8EncryptedPem(password: string): string
+
+  /**
+   * Exports the key as unencrypted PKCS #8 PEM. For RSA, EC, and Ed25519, the PEM armor is:
+   * ```
+   * -----BEGIN PRIVATE KEY-----
+   * ...
+   * -----END PRIVATE KEY-----
+   * ```
+   * PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0
+   * `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`.
+   * ```
+   * PrivateKeyInfo ::= SEQUENCE {
+   *     version                   Version,
+   *     privateKeyAlgorithm       AlgorithmIdentifier,
+   *     privateKey                OCTET STRING,
+   *     attributes           [0]  IMPLICIT Attributes OPTIONAL
+   * }
+   * ```
+   *
+   * **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64
+   * characters, and a final CRLF.
+   *
+   * **Security note:** This output is not password-protected.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getPkcs8Pem(): string
+
+  /**
+   * Exports the key in Chilkat-compatible XML. The XML is not encrypted. RSA and DSA components use
+   * ordinary Base64.
+   *
+   * RSA keys use:
+   *
+   * ```
+   * <RSAKeyValue>
+   *   <Modulus>...</Modulus>
+   *   <Exponent>...</Exponent>
+   *   <D>...</D>
+   *   <P>...</P>
+   *   <Q>...</Q>
+   *   <DP>...</DP>
+   *   <DQ>...</DQ>
+   *   <InverseQ>...</InverseQ>
+   * </RSAKeyValue>
+   * ```
+   *
+   * DSA keys use:
+   *
+   * ```
+   * <DSAKeyValue>
+   *   <P>...</P>
+   *   <Q>...</Q>
+   *   <G>...</G>
+   *   <Y>...</Y>
+   *   <X>...</X>
+   * </DSAKeyValue>
+   * ```
+   *
+   * EC keys place the named curve in the `curve` attribute and Base64-encode the RFC 5915
+   * `ECPrivateKey` DER in the element content:
+   *
+   * ```
+   * <ECCKeyValue curve="secp256r1">...</ECCKeyValue>
+   * ```
+   *
+   * Ed25519 keys Base64-encode 64 bytes consisting of the 32-byte private seed followed by the
+   * 32-byte public key:
+   *
+   * ```
+   * <Ed25519KeyValue>...</Ed25519KeyValue>
+   * ```
+   *
+   * **Round-trip support:** XML produced by this method can be loaded by {@link
+   * PrivateKey.loadXml}, {@link PrivateKey.loadXmlFile}, or the general format-detection methods.
+   *
+   * **Interoperability note:** These XML forms are Chilkat-compatible representations. Prefer PKCS
+   * #8, PEM, or JWK when interoperating with systems that expect standard key containers.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getXml(): string
+
+  /**
+   * Loads a private key from the PEM text in `pemStr`. `password` supplies the password when the
+   * PEM is encrypted. The method accepts encrypted PKCS #8 PEM and also loads supported unencrypted
+   * PEM.
+   * ```
+   * -----BEGIN ENCRYPTED PRIVATE KEY-----
+   * ...
+   * -----END ENCRYPTED PRIVATE KEY-----
+   * ```
+   *
+   * **Content auto-detection:** Chilkat examines the content rather than relying on the method name
+   * or filename extension. This password-taking method can load both encrypted and unencrypted
+   * supported private-key representations.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * **Password failure:** An incorrect password causes loading to fail and leaves this object
+   * empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadEncryptedPem(pemStr: string, password: string): void
+
+  /**
+   * Loads a private key from the file at `path`, using `password` when the detected key is
+   * encrypted. The file may contain encrypted PKCS #8 PEM or another supported encrypted or
+   * unencrypted representation.
+   *
+   * **Content auto-detection:** Chilkat examines the content rather than relying on the method name
+   * or filename extension. This password-taking method can load both encrypted and unencrypted
+   * supported private-key representations.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadEncryptedPemFile(path: string, password: string): void
+
+  /**
+   * Loads a private key from the PEM text in `str`. This method has no password argument and
+   * therefore cannot load password-protected PEM. Use {@link PrivateKey.loadEncryptedPem} for
+   * encrypted input.
+   *
+   * **Content auto-detection:** The method name identifies the expected or traditional use, but
+   * Chilkat examines the content and can load other supported unencrypted private-key
+   * representations. Encrypted input requires a load method that accepts a password.
+   *
+   * **PEM block selection:** If the text contains multiple PEM blocks, Chilkat selects the first
+   * supported private-key block. It skips preceding public-key or unrelated PEM blocks.
+   *
+   * **Accepted surrounding content:** Leading and trailing whitespace, a UTF-8 BOM, and trailing
+   * non-PEM text are accepted.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadPem(str: string): void
+
+  /**
+   * Loads a private key from the file at `path`. This method has no password argument and therefore
+   * cannot load a password-protected key. Use {@link PrivateKey.loadEncryptedPemFile} or {@link
+   * PrivateKey.loadAnyFormatFile} when a password may be required.
+   *
+   * **Content auto-detection:** The method name identifies the expected or traditional use, but
+   * Chilkat examines the content and can load other supported unencrypted private-key
+   * representations. Encrypted input requires a load method that accepts a password.
+   *
+   * **PEM block selection:** For a file containing multiple PEM blocks, Chilkat selects the first
+   * supported private-key block and skips preceding public-key or unrelated blocks.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadPemFile(path: string): void
+
+  /**
+   * Loads a private key from the file at `path`, using `password` when the detected key is
+   * encrypted. The method can load encrypted PKCS #8 DER or PEM and also supported unencrypted
+   * representations.
+   *
+   * **Content auto-detection:** Chilkat examines the content rather than relying on the method name
+   * or filename extension. This password-taking method can load both encrypted and unencrypted
+   * supported private-key representations.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadPkcs8EncryptedFile(path: string, password: string): void
+
+  /**
+   * Loads a private key from the file at `path`. Although named for unencrypted PKCS #8, the method
+   * examines the file content and accepts other supported unencrypted private-key representations.
+   *
+   * **Content auto-detection:** The method name identifies the expected or traditional use, but
+   * Chilkat examines the content and can load other supported unencrypted private-key
+   * representations. Encrypted input requires a load method that accepts a password.
+   *
+   * **Trailing DER data:** When the file begins with a complete supported DER private-key object,
+   * trailing bytes or a second concatenated DER object are ignored; the first key is loaded.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadPkcs8File(path: string): void
+
+  /**
+   * Loads a private key from the file at `path`, using `password` if the detected representation is
+   * encrypted. This Windows-only method supports Microsoft PVK and also participates in Chilkat
+   * private-key content auto-detection.
+   *
+   * **Content auto-detection:** Chilkat examines the content rather than relying on the method name
+   * or filename extension. This password-taking method can load both encrypted and unencrypted
+   * supported private-key representations.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadPvkFile(path: string, password: string): void
+
+  /**
+   * Loads a private key from the XML text in `xml`. Supported Chilkat-compatible XML roots include
+   * `RSAKeyValue`, `DSAKeyValue`, `ECCKeyValue`, and `Ed25519KeyValue`.
+   *
+   * **Content auto-detection:** The method name identifies the expected or traditional use, but
+   * Chilkat examines the content and can load other supported unencrypted private-key
+   * representations. Encrypted input requires a load method that accepts a password.
+   *
+   * **Ed25519 XML:** The `Ed25519KeyValue` content is ordinary Base64 for the 32-byte private seed
+   * followed by the 32-byte public key.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadXml(xml: string): void
+
+  /**
+   * Loads a private key from the file at `path`. Chilkat recognizes RSA, DSA, EC, and Ed25519 XML
+   * produced by {@link PrivateKey.getXml}, and also auto-detects other supported unencrypted
+   * private-key representations.
+   *
+   * **Content auto-detection:** The method name identifies the expected or traditional use, but
+   * Chilkat examines the content and can load other supported unencrypted private-key
+   * representations. Encrypted input requires a load method that accepts a password.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadXmlFile(path: string): void
+
+  /**
+   * Saves the key as password-protected PKCS #8 DER. `password` supplies the password and `path` is
+   * the destination path. The cipher is selected by {@link PrivateKey.pkcs8EncryptAlg}.
+   *
+   * Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt,
+   * 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC
+   * mode with a newly generated IV.
+   *
+   * **File behavior:** An existing destination file is replaced. Parent directories are not
+   * created; the parent directory must already exist.
+   *
+   * **Empty passwords:** An empty `password` is accepted but provides no meaningful password
+   * protection.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  savePkcs8EncryptedFile(password: string, path: string): void
+
+  /**
+   * Saves the key as password-protected PKCS #8 PEM. `password` supplies the password and `path` is
+   * the destination path. The file uses the `ENCRYPTED PRIVATE KEY` PEM label, and the cipher is
+   * selected by {@link PrivateKey.pkcs8EncryptAlg}.
+   *
+   * Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt,
+   * 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC
+   * mode with a newly generated IV.
+   *
+   * **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64
+   * characters, and a final CRLF.
+   *
+   * **File behavior:** An existing destination file is replaced. Parent directories are not
+   * created; the parent directory must already exist.
+   *
+   * **Empty passwords:** An empty `password` is accepted but provides no meaningful password
+   * protection.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  savePkcs8EncryptedPemFile(password: string, path: string): void
+
+  /**
+   * Saves the key as unencrypted PKCS #8 DER at `path`. PKCS #8 is an algorithm-independent
+   * private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the
+   * algorithm-specific private-key DER in an `OCTET STRING`.
+   * ```
+   * PrivateKeyInfo ::= SEQUENCE {
+   *     version                   Version,
+   *     privateKeyAlgorithm       AlgorithmIdentifier,
+   *     privateKey                OCTET STRING,
+   *     attributes           [0]  IMPLICIT Attributes OPTIONAL
+   * }
+   * ```
+   *
+   * **File behavior:** An existing destination file is replaced. Parent directories are not
+   * created; the parent directory must already exist.
+   *
+   * **macOS Keychain:** Starting in Chilkat v10.0.0, `path` may be formatted as `keychain:<label>`
+   * to save the private key to the Apple Keychain.
+   *
+   * **Security note:** The file contains cleartext private-key material.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  savePkcs8File(path: string): void
+
+  /**
+   * Saves the key as unencrypted PKCS #8 PEM at `path`. The PEM label is `PRIVATE KEY` for RSA, EC,
+   * Ed25519, and other supported PKCS #8 key types.PKCS #8 is an algorithm-independent private-key
+   * container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the
+   * algorithm-specific private-key DER in an `OCTET STRING`.
+   * ```
+   * PrivateKeyInfo ::= SEQUENCE {
+   *     version                   Version,
+   *     privateKeyAlgorithm       AlgorithmIdentifier,
+   *     privateKey                OCTET STRING,
+   *     attributes           [0]  IMPLICIT Attributes OPTIONAL
+   * }
+   * ```
+   *
+   * **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64
+   * characters, and a final CRLF.
+   *
+   * **File behavior:** An existing destination file is replaced. Parent directories are not
+   * created; the parent directory must already exist.
+   *
+   * **Security note:** The file is not password-protected.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  savePkcs8PemFile(path: string): void
+
+  /**
+   * Saves the key as unencrypted Chilkat-compatible XML at `path`. The XML representation is the
+   * same as returned by {@link PrivateKey.getXml}.
+   *
+   * **File behavior:** An existing destination file is replaced. Parent directories are not
+   * created; the parent directory must already exist.
+   *
+   * **Security note:** The XML contains cleartext private-key material.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  saveXmlFile(path: string): void
+
+  /**
+   * Exports the key as unencrypted PEM, preferring the traditional algorithm-specific
+   * representation when one exists.
+   *
+   * Key typePEM labelBody
+   *
+   * | RSA |  | `RSA PRIVATE KEY` |  | PKCS #1 DER |
+   *
+   * | DSA |  | `DSA PRIVATE KEY` |  | Traditional DSA DER |
+   *
+   * | EC |  | `EC PRIVATE KEY` |  | RFC 5915 DER |
+   *
+   * | Ed25519 |  | `PRIVATE KEY` |  | PKCS #8 DER |
+   *
+   * **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64
+   * characters, and a final CRLF.
+   *
+   * **Security note:** The returned private key is not encrypted.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getPkcs1Pem(): string
+
+  /**
+   * Loads a private key from the file at `path`. Despite the historical PKCS #1 name, the method
+   * examines the content and accepts supported unencrypted private-key representations.
+   *
+   * **Content auto-detection:** The method name identifies the expected or traditional use, but
+   * Chilkat examines the content and can load other supported unencrypted private-key
+   * representations. Encrypted input requires a load method that accepts a password.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadPkcs1File(path: string): void
+
+  /**
+   * Saves the key at `path` using the traditional or preferred unencrypted DER representation.
+   *
+   * **Historical method name:** RSA is saved as PKCS #1, EC as RFC 5915, DSA in its traditional
+   * structure, and Ed25519 as PKCS #8 because no traditional PKCS #1 form exists.
+   *
+   * **File behavior:** An existing destination file is replaced. Parent directories are not
+   * created; the parent directory must already exist.
+   *
+   * **Security note:** The file contains cleartext private-key material.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  savePkcs1File(path: string): void
+
+  /**
+   * Saves the key at `path` as unencrypted PEM, preferring a traditional algorithm-specific
+   * representation when one exists. RSA uses `RSA PRIVATE KEY`, DSA uses `DSA PRIVATE KEY`, EC uses
+   * `EC PRIVATE KEY`, and Ed25519 uses the PKCS #8 `PRIVATE KEY` form.
+   *
+   * **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64
+   * characters, and a final CRLF.
+   *
+   * **File behavior:** An existing destination file is replaced. Parent directories are not
+   * created; the parent directory must already exist.
+   *
+   * **PKCS #8 alternative:** Use {@link PrivateKey.savePkcs8PemFile} to always request the
+   * algorithm-independent PKCS #8 `PRIVATE KEY` form.
+   *
+   * **Security note:** The file is not password-protected.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  savePemFile(path: string): void
+
+  /**
+   * Exports the key as a compact JWK (JSON Web Key). Binary integers and byte strings use Base64url
+   * without padding.
+   *
+   * Key typeMembers emitted
+   *
+   * | RSA |  | `kty`, `n`, `e`, `d`, `p`, `q`, `dp`, `dq`, `qi` |
+   *
+   * | EC |  | `kty`, `crv`, `x`, `y`, `d` |
+   *
+   * | Ed25519 |  | `kty`=`OKP`, `crv`=`Ed25519`, `x`, `d`, and `use`=`sig` |
+   *
+   * **Key material only:** Optional JOSE metadata loaded from a JWK, such as `kid`, `alg`,
+   * `key_ops`, or a caller-supplied `use`, is not retained for re-export. The Ed25519 `use`=`sig`
+   * member is emitted by Chilkat.
+   *
+   * **Private output:** The returned JSON contains private key material and must be protected
+   * accordingly.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getJwk(): string
+
+  /**
+   * Loads a private key from the JWK JSON in `jsonStr`. Supported private JWK key types are RSA
+   * (`kty`=`RSA`), EC (`kty`=`EC`), and Ed25519 (`kty`=`OKP`, `crv`=`Ed25519`). An unsupported
+   * `kty` causes the method to fail.
+   *
+   * **Private key material required:** A JWK containing only public members belongs in a
+   * `PublicKey`. This method is for JWKs that contain private key material.
+   *
+   * **Metadata handling:** Optional JOSE metadata such as `kid`, `use`, `alg`, and `key_ops` may be
+   * present but is not retained by `PrivateKey`.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadJwk(jsonStr: string): void
+
+  /**
+   * Computes the RFC 7638 thumbprint of the public portion of the loaded key using the hash
+   * algorithm named by `hashAlg`. Supported values include `md5`, `sha1`, `sha256`, `sha384`, and
+   * `sha512`. An unsupported name causes the method to fail. The returned digest is
+   * Base64url-encoded without padding.
+   *
+   * **Public-key identity:** The canonical thumbprint input contains only the required public JWK
+   * members. Private members and optional metadata such as `kid`, `use`, and `alg` are excluded, so
+   * the result matches the thumbprint of the corresponding `PublicKey`.
+   *
+   * **Recommended hash:** Use `sha256` for normal RFC 7638 interoperability. MD5 and SHA-1 are
+   * available for compatibility but should not be chosen for new security-sensitive identifiers.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getJwkThumbprint(hashAlg: string): string
+
+  /**
+   * Loads a private key from the data in `privKeyData` by inspecting its contents. Recognized
+   * representations include RSA PKCS #1 DER, traditional DSA and EC DER, PKCS #8 DER, encrypted
+   * PKCS #8, PEM, JWK, Chilkat-compatible XML, Microsoft PVK, and supported Ed25519
+   * representations. `password` supplies the password when the detected representation is
+   * encrypted; otherwise it may be empty.
+   *
+   * **Text and binary input:** `privKeyData` contains the exact bytes to inspect. Textual PEM, JWK,
+   * and XML are detected from those bytes; a filename extension is not involved.
+   *
+   * **Trailing DER data:** If the input begins with one complete supported DER key followed by
+   * extra bytes or another DER object, the first key is loaded and trailing data is ignored.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadAnyFormat(privKeyData: BinData, password: string): void
+
+  /**
+   * Loads an Ed25519 key pair from raw hexadecimal values. `privKey` is the 32-byte Ed25519 private
+   * seed. `pubKey` is the 32-byte public key. Each nonempty value must contain exactly 64
+   * hexadecimal digits. Uppercase hexadecimal and an optional `0x` prefix are accepted; embedded
+   * whitespace is not accepted. `pubKey` may be empty, in which case Chilkat derives the public key
+   * from the seed.
+   *
+   * **Supplied public key is not verified:** When `pubKey` is nonempty, Chilkat stores the supplied
+   * public value without checking that it corresponds to `privKey`. Pass an empty `pubKey` when the
+   * public key should be derived and guaranteed to match the private seed.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadEd25519(privKey: string, pubKey: string): void
+
+  /**
+   * Loads a private key from the file at `path` by inspecting its contents. Recognized
+   * representations include RSA PKCS #1 DER, traditional DSA and EC DER, PKCS #8 DER, encrypted
+   * PKCS #8, PEM, JWK, Chilkat-compatible XML, Microsoft PVK, and supported Ed25519
+   * representations. `password` supplies the password when needed.
+   *
+   * **Filename extensions are advisory:** The file content determines the format; a nonstandard or
+   * misleading extension does not prevent recognition.
+   *
+   * **Object state:** A successful load replaces any key already held by this object. If loading
+   * fails, this object is left empty.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  loadAnyFormatFile(path: string, password: string): void
+
+  /**
+   * Exports the raw private value as lowercase hexadecimal and replaces the contents of the
+   * `StringBuilder` in `pubKey` with the corresponding raw public key.
+   *
+   * Key typeReturned private valuePublic value in `pubKey`
+   *
+   * | Ed25519 | | The 32-byte seed accepted by {@link PrivateKey.loadEd25519}, as 64 hex
+   * characters. | | The 32-byte public key, as 64 hex characters. |
+   *
+   * | EC | | The private scalar, padded to the curve size as needed. | | The uncompressed point `04
+   * || HEX(x) || HEX(y)`. |
+   *
+   * **Applicable key types:** This method supports Ed25519 and ordinary EC keys. RSA and DSA keys
+   * do not have a single simple raw representation and cause the method to fail.
+   *
+   * **Output on failure:** If the method fails, `pubKey` is cleared.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getRawHex(pubKey: StringBuilder): string
+
+  /**
+   * Uploads or imports the private key to a supported cloud key-management service. `jsonIn`
+   * supplies service-specific input parameters as a `JsonObject`, and `jsonOut` receives
+   * service-specific result information.
+   *
+   * **Open-ended interface:** The required JSON members and returned JSON depend on the target
+   * service and operation. Follow the corresponding Chilkat example for AWS KMS, Azure Key Vault,
+   * or another supported provider rather than assuming one common schema.
+   *
+   * **Security note:** Cloud import operations may transmit private-key material. Use only the
+   * provider endpoint, authentication, and transport settings documented for the intended service.
+   *
+   * This call blocks the JavaScript thread until Chilkat returns; from UI code prefer
+   * {@link PrivateKey.uploadToCloudAsync}.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  uploadToCloud(jsonIn: JsonObject, jsonOut: JsonObject): void
+
+  /**
+   * Asynchronous form of {@link PrivateKey.uploadToCloud}: the same call on a native worker thread,
+   * settling on the JavaScript thread. While it is pending, other calls on this object throw,
+   * except {@link PrivateKey.abort} (which cancels it) and the {@link PrivateKey.onPercentDone} /
+   * {@link PrivateKey.onProgressInfo} callbacks, which report progress while it runs.
+   *
+   * The promise rejects with an Error if the call fails; the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  uploadToCloudAsync(jsonIn: JsonObject, jsonOut: JsonObject): Promise<void>
+
+  /**
+   * Extracts the public portion of the loaded private key and stores an independent copy in the
+   * `PublicKey` supplied in `pubKey`. The resulting public key is unaffected if this `PrivateKey`
+   * is later reloaded with a different key.
+   *
+   * **Target state on failure:** If extraction fails, an existing key already held by `pubKey` is
+   * preserved.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  toPublicKey(pubKey: PublicKey): void
+
+  /**
+   * Exports the key as DER and replaces the contents of the `BinData` in `bd`.
+   *
+   * `pkcs1``password`Output
+   *
+   * | `true` | | Ignored for encryption. | | RSA PKCS #1, traditional DSA, RFC 5915 EC, or PKCS #8
+   * for Ed25519. |
+   *
+   * | `false` |  | Empty string. |  | Unencrypted PKCS #8 DER. |
+   *
+   * | `false` | | Nonempty password. | | Encrypted PKCS #8 DER using {@link
+   * PrivateKey.pkcs8EncryptAlg}. |
+   *
+   * **Output state:** A successful call replaces any existing `bd` content. If the call fails, `bd`
+   * is cleared.
+   *
+   * **Password behavior:** When `pkcs1` is `true`, `password` does not encrypt the output. To
+   * obtain encrypted output, set `pkcs1` to `false` and provide a nonempty `password`.
+   *
+   * @throws Error if the call fails (the message names the reason); the full log is in
+   * {@link PrivateKey.lastErrorText}.
+   */
+  getPkcsBd(pkcs1: boolean, password: string, bd: BinData): void
+
+  // ---- Events (ReactNativeGen_DESIGN.md §6) ----
+
+  /**
+   * Called with the percent completed (0..100) while a long-running method runs, when Chilkat
+   * can measure progress. Runs on the JavaScript thread, so it is only useful with the
+   * `...Async` methods (during a synchronous call the thread is busy and the events arrive
+   * after it returns). Assign `undefined` to remove.
+   */
+  onPercentDone?: (pctDone: number) => void
+
+  /**
+   * Called with a name/value pair of progress information while a long-running method runs
+   * (what is reported depends on the class and method). Runs on the JavaScript thread; see
+   * {@link PrivateKey.onPercentDone}. Assign `undefined` to remove.
+   */
+  onProgressInfo?: (name: string, value: string) => void
+
+  /**
+   * Requests that the pending `...Async` call on this object stop at its next progress check.
+   * The promise then rejects with Chilkat's abort error. Chilkat checks at least every
+   * `heartbeatMs` milliseconds on the classes that have that property, so set it (e.g. 250)
+   * for a responsive cancel. Harmless when nothing is pending.
+   */
+  abort(): void
+}