@vorionsys/platform-core 0.1.0

package/dist/security/hsm/provider.js

@@ -0,0 +1,264 @@
+/**
+ * HSM Provider Interface and Base Implementations
+ * Provides abstraction layer for Hardware Security Module operations
+ */
+import { EventEmitter } from 'events';
+import * as crypto from 'crypto';
+/**
+ * Supported key types
+ */
+export var KeyType;
+(function (KeyType) {
+    KeyType["AES"] = "AES";
+    KeyType["RSA"] = "RSA";
+    KeyType["EC"] = "EC";
+    KeyType["HMAC"] = "HMAC";
+    KeyType["DES3"] = "3DES";
+    KeyType["CHACHA20"] = "CHACHA20";
+})(KeyType || (KeyType = {}));
+/**
+ * Supported elliptic curves
+ */
+export var ECCurve;
+(function (ECCurve) {
+    ECCurve["P256"] = "P-256";
+    ECCurve["P384"] = "P-384";
+    ECCurve["P521"] = "P-521";
+    ECCurve["SECP256K1"] = "secp256k1";
+    ECCurve["ED25519"] = "Ed25519";
+})(ECCurve || (ECCurve = {}));
+/**
+ * Key usage permissions
+ */
+export var KeyUsage;
+(function (KeyUsage) {
+    KeyUsage["ENCRYPT"] = "encrypt";
+    KeyUsage["DECRYPT"] = "decrypt";
+    KeyUsage["SIGN"] = "sign";
+    KeyUsage["VERIFY"] = "verify";
+    KeyUsage["WRAP"] = "wrap";
+    KeyUsage["UNWRAP"] = "unwrap";
+    KeyUsage["DERIVE"] = "derive";
+})(KeyUsage || (KeyUsage = {}));
+/**
+ * Supported signing algorithms
+ */
+export var SigningAlgorithm;
+(function (SigningAlgorithm) {
+    SigningAlgorithm["RSASSA_PKCS1_V1_5_SHA256"] = "RSASSA-PKCS1-v1_5-SHA256";
+    SigningAlgorithm["RSASSA_PKCS1_V1_5_SHA384"] = "RSASSA-PKCS1-v1_5-SHA384";
+    SigningAlgorithm["RSASSA_PKCS1_V1_5_SHA512"] = "RSASSA-PKCS1-v1_5-SHA512";
+    SigningAlgorithm["RSASSA_PSS_SHA256"] = "RSASSA-PSS-SHA256";
+    SigningAlgorithm["RSASSA_PSS_SHA384"] = "RSASSA-PSS-SHA384";
+    SigningAlgorithm["RSASSA_PSS_SHA512"] = "RSASSA-PSS-SHA512";
+    SigningAlgorithm["ECDSA_SHA256"] = "ECDSA-SHA256";
+    SigningAlgorithm["ECDSA_SHA384"] = "ECDSA-SHA384";
+    SigningAlgorithm["ECDSA_SHA512"] = "ECDSA-SHA512";
+    SigningAlgorithm["ED25519"] = "Ed25519";
+    SigningAlgorithm["HMAC_SHA256"] = "HMAC-SHA256";
+    SigningAlgorithm["HMAC_SHA384"] = "HMAC-SHA384";
+    SigningAlgorithm["HMAC_SHA512"] = "HMAC-SHA512";
+})(SigningAlgorithm || (SigningAlgorithm = {}));
+/**
+ * Supported encryption algorithms
+ */
+export var EncryptionAlgorithm;
+(function (EncryptionAlgorithm) {
+    EncryptionAlgorithm["AES_GCM"] = "AES-GCM";
+    EncryptionAlgorithm["AES_CBC"] = "AES-CBC";
+    EncryptionAlgorithm["AES_CTR"] = "AES-CTR";
+    EncryptionAlgorithm["RSA_OAEP_SHA256"] = "RSA-OAEP-SHA256";
+    EncryptionAlgorithm["RSA_OAEP_SHA384"] = "RSA-OAEP-SHA384";
+    EncryptionAlgorithm["RSA_OAEP_SHA512"] = "RSA-OAEP-SHA512";
+    EncryptionAlgorithm["CHACHA20_POLY1305"] = "CHACHA20-POLY1305";
+})(EncryptionAlgorithm || (EncryptionAlgorithm = {}));
+// ============================================================================
+// Base HSM Provider Implementation
+// ============================================================================
+/**
+ * Abstract base class for HSM providers
+ * Provides common functionality and enforces interface compliance
+ */
+export class BaseHSMProvider extends EventEmitter {
+    config;
+    connected = false;
+    auditLogs = [];
+    keys = new Map();
+    constructor(config) {
+        super();
+        this.config = {
+            connectionTimeout: 30000,
+            operationTimeout: 60000,
+            auditLogging: true,
+            retry: {
+                maxAttempts: 3,
+                initialDelay: 100,
+                maxDelay: 5000,
+                backoffMultiplier: 2,
+            },
+            ...config,
+        };
+    }
+    /**
+     * Log an audit entry
+     */
+    logAudit(entry) {
+        if (!this.config.auditLogging)
+            return;
+        const fullEntry = {
+            ...entry,
+            timestamp: new Date(),
+        };
+        this.auditLogs.push(fullEntry);
+        this.emit('audit', fullEntry);
+        // Keep only last 10000 entries in memory
+        if (this.auditLogs.length > 10000) {
+            this.auditLogs = this.auditLogs.slice(-10000);
+        }
+    }
+    /**
+     * Execute operation with retry
+     */
+    async withRetry(operation, operationName) {
+        const { maxAttempts, initialDelay, maxDelay, backoffMultiplier } = this.config.retry;
+        let lastError;
+        let delay = initialDelay;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                return await operation();
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error : new Error(String(error));
+                if (attempt < maxAttempts) {
+                    this.emit('retry', { operation: operationName, attempt, error: lastError });
+                    await this.sleep(delay);
+                    delay = Math.min(delay * backoffMultiplier, maxDelay);
+                }
+            }
+        }
+        throw lastError;
+    }
+    /**
+     * Sleep utility
+     */
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+    /**
+     * Generate a unique key ID
+     */
+    generateKeyId() {
+        return `key-${Date.now()}-${crypto.randomBytes(8).toString('hex')}`;
+    }
+    /**
+     * Validate key spec
+     */
+    validateKeySpec(spec) {
+        if (!spec.label) {
+            throw new Error('Key label is required');
+        }
+        if (!spec.type) {
+            throw new Error('Key type is required');
+        }
+        if (!spec.usage || spec.usage.length === 0) {
+            throw new Error('At least one key usage must be specified');
+        }
+        // Type-specific validation
+        switch (spec.type) {
+            case KeyType.AES:
+                if (spec.size && ![128, 192, 256].includes(spec.size)) {
+                    throw new Error('AES key size must be 128, 192, or 256 bits');
+                }
+                break;
+            case KeyType.RSA:
+                if (spec.size && spec.size < 2048) {
+                    throw new Error('RSA key size must be at least 2048 bits');
+                }
+                break;
+            case KeyType.EC:
+                if (!spec.curve) {
+                    throw new Error('EC curve must be specified');
+                }
+                break;
+        }
+    }
+    /**
+     * Get key or throw
+     */
+    getKeyOrThrow(keyHandle) {
+        const key = this.keys.get(keyHandle);
+        if (!key) {
+            throw new Error(`Key not found: ${keyHandle}`);
+        }
+        return key;
+    }
+    /**
+     * Validate key usage
+     */
+    validateKeyUsage(key, requiredUsage) {
+        if (!key.usage.includes(requiredUsage)) {
+            throw new Error(`Key ${key.id} does not permit ${requiredUsage} operation`);
+        }
+    }
+    /**
+     * Ensure connected
+     */
+    ensureConnected() {
+        if (!this.connected) {
+            throw new Error('HSM is not connected');
+        }
+    }
+    /**
+     * Get audit logs
+     */
+    async getAuditLogs(startTime, endTime) {
+        let logs = [...this.auditLogs];
+        if (startTime) {
+            logs = logs.filter(log => log.timestamp >= startTime);
+        }
+        if (endTime) {
+            logs = logs.filter(log => log.timestamp <= endTime);
+        }
+        return logs;
+    }
+}
+// ============================================================================
+// HSM Error Types
+// ============================================================================
+export class HSMError extends Error {
+    code;
+    provider;
+    cause;
+    constructor(message, code, provider, cause) {
+        super(message);
+        this.code = code;
+        this.provider = provider;
+        this.cause = cause;
+        this.name = 'HSMError';
+    }
+}
+export class HSMConnectionError extends HSMError {
+    constructor(message, provider, cause) {
+        super(message, 'CONNECTION_ERROR', provider, cause);
+        this.name = 'HSMConnectionError';
+    }
+}
+export class HSMKeyNotFoundError extends HSMError {
+    constructor(keyId, provider) {
+        super(`Key not found: ${keyId}`, 'KEY_NOT_FOUND', provider);
+        this.name = 'HSMKeyNotFoundError';
+    }
+}
+export class HSMOperationError extends HSMError {
+    constructor(operation, message, provider, cause) {
+        super(`${operation} failed: ${message}`, 'OPERATION_ERROR', provider, cause);
+        this.name = 'HSMOperationError';
+    }
+}
+export class HSMPermissionError extends HSMError {
+    constructor(message, provider) {
+        super(message, 'PERMISSION_DENIED', provider);
+        this.name = 'HSMPermissionError';
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/security/hsm/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/security/hsm/provider.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AA8BjC;;GAEG;AACH,MAAM,CAAN,IAAY,OAOX;AAPD,WAAY,OAAO;IACjB,sBAAW,CAAA;IACX,sBAAW,CAAA;IACX,oBAAS,CAAA;IACT,wBAAa,CAAA;IACb,wBAAa,CAAA;IACb,gCAAqB,CAAA;AACvB,CAAC,EAPW,OAAO,KAAP,OAAO,QAOlB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,OAMX;AAND,WAAY,OAAO;IACjB,yBAAc,CAAA;IACd,yBAAc,CAAA;IACd,yBAAc,CAAA;IACd,kCAAuB,CAAA;IACvB,8BAAmB,CAAA;AACrB,CAAC,EANW,OAAO,KAAP,OAAO,QAMlB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,QAQX;AARD,WAAY,QAAQ;IAClB,+BAAmB,CAAA;IACnB,+BAAmB,CAAA;IACnB,yBAAa,CAAA;IACb,6BAAiB,CAAA;IACjB,yBAAa,CAAA;IACb,6BAAiB,CAAA;IACjB,6BAAiB,CAAA;AACnB,CAAC,EARW,QAAQ,KAAR,QAAQ,QAQnB;AA6BD;;GAEG;AACH,MAAM,CAAN,IAAY,gBAcX;AAdD,WAAY,gBAAgB;IAC1B,yEAAqD,CAAA;IACrD,yEAAqD,CAAA;IACrD,yEAAqD,CAAA;IACrD,2DAAuC,CAAA;IACvC,2DAAuC,CAAA;IACvC,2DAAuC,CAAA;IACvC,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,iDAA6B,CAAA;IAC7B,uCAAmB,CAAA;IACnB,+CAA2B,CAAA;IAC3B,+CAA2B,CAAA;IAC3B,+CAA2B,CAAA;AAC7B,CAAC,EAdW,gBAAgB,KAAhB,gBAAgB,QAc3B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,mBAQX;AARD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,0DAAmC,CAAA;IACnC,0DAAmC,CAAA;IACnC,0DAAmC,CAAA;IACnC,8DAAuC,CAAA;AACzC,CAAC,EARW,mBAAmB,KAAnB,mBAAmB,QAQ9B;AA4KD,+EAA+E;AAC/E,mCAAmC;AACnC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAgB,eAAgB,SAAQ,YAAY;IAI9C,MAAM,CAAoB;IAC1B,SAAS,GAAY,KAAK,CAAC;IAC3B,SAAS,GAAoB,EAAE,CAAC;IAChC,IAAI,GAA2B,IAAI,GAAG,EAAE,CAAC;IAEnD,YAAY,MAAyB;QACnC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG;YACZ,iBAAiB,EAAE,KAAK;YACxB,gBAAgB,EAAE,KAAK;YACvB,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE;gBACL,WAAW,EAAE,CAAC;gBACd,YAAY,EAAE,GAAG;gBACjB,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,CAAC;aACrB;YACD,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACO,QAAQ,CAAC,KAAuC;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO;QAEtC,MAAM,SAAS,GAAkB;YAC/B,GAAG,KAAK;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE9B,yCAAyC;QACzC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,SAAS,CACvB,SAA2B,EAC3B,aAAqB;QAErB,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC;QACtF,IAAI,SAA4B,CAAC;QACjC,IAAI,KAAK,GAAG,YAAY,CAAC;QAEzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,OAAO,MAAM,SAAS,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAEtE,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;oBAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC5E,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACxB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,iBAAiB,EAAE,QAAQ,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC;IAClB,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,EAAU;QACxB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACO,aAAa;QACrB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACtE,CAAC;IAED;;OAEG;IACO,eAAe,CAAC,IAAa;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,2BAA2B;QAC3B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,OAAO,CAAC,GAAG;gBACd,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM;YACR,KAAK,OAAO,CAAC,GAAG;gBACd,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YACR,KAAK,OAAO,CAAC,EAAE;gBACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED;;OAEG;IACO,aAAa,CAAC,SAAiB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACO,gBAAgB,CAAC,GAAc,EAAE,aAAuB;QAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,oBAAoB,aAAa,YAAY,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED;;OAEG;IACO,eAAe;QACvB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAqCD;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,SAAgB,EAAE,OAAc;QACjD,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/B,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IACS;IAJ3B,YACE,OAAe,EACC,IAAY,EACZ,QAAiB,EACR,KAAa;QAEtC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QACZ,aAAQ,GAAR,QAAQ,CAAS;QACR,UAAK,GAAL,KAAK,CAAQ;QAGtC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,OAAe,EAAE,QAAiB,EAAE,KAAa;QAC3D,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,KAAa,EAAE,QAAiB;QAC1C,KAAK,CAAC,kBAAkB,KAAK,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,SAAiB,EAAE,OAAe,EAAE,QAAiB,EAAE,KAAa;QAC9E,KAAK,CAAC,GAAG,SAAS,YAAY,OAAO,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/security/hsm/thales-luna.d.ts

@@ -0,0 +1,209 @@
+/**
+ * Thales Luna Network HSM Provider Implementation
+ * Integrates with Luna Network HSM using PKCS#11 interface
+ */
+import { BaseHSMProvider, HSMProviderConfig, HSMStatus, KeySpec, KeyHandle, EncryptionOptions } from './provider';
+export interface ThalesLunaConfig extends HSMProviderConfig {
+    /** Luna HSM hostname or IP */
+    host: string;
+    /** Network port (default 1792) */
+    port?: number;
+    /** Partition name */
+    partition: string;
+    /** Partition password/PIN */
+    partitionPassword: string;
+    /** Client certificate path for mTLS */
+    clientCertPath?: string;
+    /** Client key path */
+    clientKeyPath?: string;
+    /** CA certificate path */
+    caCertPath?: string;
+    /** PKCS#11 library path */
+    pkcs11LibPath?: string;
+    /** Enable HA (High Availability) mode */
+    haEnabled?: boolean;
+    /** HA group members */
+    haGroupMembers?: HAGroupMember[];
+    /** Connection timeout */
+    connectionTimeout?: number;
+    /** Idle timeout */
+    idleTimeout?: number;
+}
+/**
+ * HA group member configuration
+ */
+export interface HAGroupMember {
+    host: string;
+    port?: number;
+    priority?: number;
+    serialNumber?: string;
+}
+/**
+ * Luna partition info
+ */
+export interface PartitionInfo {
+    label: string;
+    serialNumber: string;
+    freeSpace: number;
+    usedSpace: number;
+    objectCount: number;
+    firmwareVersion: string;
+    model: string;
+}
+export declare class ThalesLunaProvider extends BaseHSMProvider {
+    readonly name = "Thales Luna HSM";
+    readonly isProduction = true;
+    private lunaConfig;
+    private sessionHandle;
+    private slotId;
+    private keyMap;
+    private handleCounter;
+    private haActive;
+    private currentHAMember;
+    constructor(config: ThalesLunaConfig);
+    /**
+     * Connect to Luna HSM
+     */
+    connect(): Promise<void>;
+    /**
+     * Initialize PKCS#11 library
+     */
+    private initializePKCS11;
+    /**
+     * Setup HA group
+     */
+    private setupHAGroup;
+    /**
+     * Find slot for partition
+     */
+    private findPartitionSlot;
+    /**
+     * Open PKCS#11 session
+     */
+    private openSession;
+    /**
+     * Login to partition
+     */
+    private login;
+    /**
+     * Disconnect from Luna HSM
+     */
+    disconnect(): Promise<void>;
+    /**
+     * Get HSM status
+     */
+    getStatus(): Promise<HSMStatus>;
+    /**
+     * Get partition information
+     */
+    getPartitionInfo(): Promise<PartitionInfo>;
+    /**
+     * Generate key in Luna HSM
+     */
+    generateKey(spec: KeySpec): Promise<KeyHandle>;
+    /**
+     * Generate AES key
+     */
+    private generateAESKey;
+    /**
+     * Generate RSA key pair
+     */
+    private generateRSAKeyPair;
+    /**
+     * Generate EC key pair
+     */
+    private generateECKeyPair;
+    /**
+     * Generate 3DES key
+     */
+    private generate3DESKey;
+    /**
+     * Generate HMAC key
+     */
+    private generateHMACKey;
+    /**
+     * Import key
+     */
+    importKey(keyMaterial: Buffer, spec: KeySpec): Promise<KeyHandle>;
+    /**
+     * Export public key
+     */
+    exportPublicKey(keyHandle: string): Promise<Buffer>;
+    /**
+     * Get key
+     */
+    getKey(keyHandle: string): Promise<KeyHandle | null>;
+    /**
+     * List keys
+     */
+    listKeys(filter?: Partial<KeySpec>): Promise<KeyHandle[]>;
+    /**
+     * Sign data
+     */
+    sign(keyHandle: string, data: Buffer, algorithm: string): Promise<Buffer>;
+    /**
+     * Verify signature
+     */
+    verify(keyHandle: string, data: Buffer, signature: Buffer, algorithm: string): Promise<boolean>;
+    /**
+     * Encrypt data
+     */
+    encrypt(keyHandle: string, data: Buffer, options?: EncryptionOptions): Promise<Buffer>;
+    /**
+     * Decrypt data
+     */
+    decrypt(keyHandle: string, ciphertext: Buffer, options?: EncryptionOptions): Promise<Buffer>;
+    /**
+     * Wrap key
+     */
+    wrapKey(wrappingKeyHandle: string, keyToWrap: string, algorithm?: string): Promise<Buffer>;
+    /**
+     * Unwrap key
+     */
+    unwrapKey(wrappingKeyHandle: string, wrappedKey: Buffer, spec: KeySpec, algorithm?: string): Promise<string>;
+    /**
+     * Destroy key
+     */
+    destroyKey(keyHandle: string): Promise<void>;
+    /**
+     * Perform HA failover
+     */
+    performFailover(): Promise<void>;
+    /**
+     * Get HA status
+     */
+    getHAStatus(): Promise<{
+        enabled: boolean;
+        active: boolean;
+        currentMember: HAGroupMember | null;
+        members: Array<{
+            member: HAGroupMember;
+            status: 'online' | 'offline';
+        }>;
+    }>;
+    /**
+     * Clone partition to another HSM
+     */
+    clonePartition(targetHost: string, targetPartition: string): Promise<void>;
+    /**
+     * Backup partition
+     */
+    backupPartition(): Promise<Buffer>;
+    /**
+     * Restore partition from backup
+     */
+    restorePartition(backupData: Buffer): Promise<void>;
+    /**
+     * Get audit logs from HSM
+     */
+    getHSMAuditLogs(): Promise<Buffer>;
+    /**
+     * Update partition policy
+     */
+    updatePartitionPolicy(policy: {
+        minPinLength?: number;
+        maxFailedLogins?: number;
+        challengeEnabled?: boolean;
+    }): Promise<void>;
+}
+//# sourceMappingURL=thales-luna.d.ts.map

package/dist/security/hsm/thales-luna.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thales-luna.d.ts","sourceRoot":"","sources":["../../../src/security/hsm/thales-luna.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,SAAS,EACT,OAAO,EACP,SAAS,EAGT,iBAAiB,EAKlB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sBAAsB;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uBAAuB;IACvB,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,yBAAyB;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAgBD,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,YAAY,QAAQ;IAE7B,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,eAAe,CAA8B;gBAEzC,MAAM,EAAE,gBAAgB;IAUpC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA+C9B;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,YAAY;IAoC1B;;OAEG;YACW,iBAAiB;IAa/B;;OAEG;YACW,WAAW;IAOzB;;OAEG;YACW,KAAK;IAOnB;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgCjC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC;IAmBrC;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC;IAiBhD;;OAEG;IACG,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAsFpD;;OAEG;YACW,cAAc;IAqB5B;;OAEG;YACW,kBAAkB;IAchC;;OAEG;YACW,iBAAiB;IA8B/B;;OAEG;YACW,eAAe;IAI7B;;OAEG;YACW,eAAe;IAI7B;;OAEG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAgDvE;;OAEG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAezD;;OAEG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAK1D;;OAEG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAiB/D;;OAEG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAsC/E;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAkCnB;;OAEG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,MAAM,CAAC;IA0ClB;;OAEG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,MAAM,CAAC;IA4ClB;;OAEG;IACG,OAAO,CACX,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA4ClB;;OAEG;IACG,SAAS,CACb,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAoDlB;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuClD;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAgCtC;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,aAAa,CAAC;YAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAA;SAAE,CAAC,CAAC;KACzE,CAAC;IAuBF;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAYxC;;OAEG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzD;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAOxC;;OAEG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAClC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;CASlB"}