/**
 * Security Hardening Types
 *
 * Type definitions for CAR security hardening controls including:
 * - DPoP (Demonstrating Proof-of-Possession)
 * - TEE (Trusted Execution Environment) binding
 * - Pairwise DID configuration
 * - Revocation SLA configuration
 * - Token lifetime configuration
 *
 * Based on CAR Security Hardening Specification v1.0.0
 *
 * @packageDocumentation
 */
import { z } from 'zod';
/**
 * Trust tiers as defined in CAR specification
 * Maps to security conformance levels:
 * - T0-T1: No minimum security (not recommended)
 * - T2: SH-1 (Basic) - DPoP, short-lived tokens
 * - T3: SH-2 (Standard) - SH-1 + pairwise DIDs, recursive revocation
 * - T4-T5: SH-3 (Hardened) - SH-2 + TEE binding, sync revocation checks
 */
export declare const TrustTier: {
    readonly T0: 0;
    readonly T1: 1;
    readonly T2: 2;
    readonly T3: 3;
    readonly T4: 4;
    readonly T5: 5;
};
export type TrustTier = (typeof TrustTier)[keyof typeof TrustTier];
export declare const trustTierSchema: z.ZodNativeEnum<{
    readonly T0: 0;
    readonly T1: 1;
    readonly T2: 2;
    readonly T3: 3;
    readonly T4: 4;
    readonly T5: 5;
}>;
/**
 * Security conformance levels
 */
export declare const SecurityConformanceLevel: {
    readonly NONE: "none";
    readonly SH1_BASIC: "sh-1";
    readonly SH2_STANDARD: "sh-2";
    readonly SH3_HARDENED: "sh-3";
};
export type SecurityConformanceLevel = (typeof SecurityConformanceLevel)[keyof typeof SecurityConformanceLevel];
export declare const securityConformanceLevelSchema: z.ZodNativeEnum<{
    readonly NONE: "none";
    readonly SH1_BASIC: "sh-1";
    readonly SH2_STANDARD: "sh-2";
    readonly SH3_HARDENED: "sh-3";
}>;
/**
 * DPoP proof JWT payload structure per RFC 9449
 */
export interface DPoPProof {
    /** Unique token ID (MUST be unique, servers MUST reject replays) */
    jti: string;
    /** HTTP method (e.g., 'GET', 'POST') */
    htm: string;
    /** HTTP URI (the target endpoint) */
    htu: string;
    /** Issued at timestamp (Unix seconds) */
    iat: number;
    /** Access token hash (for bound tokens, sha256 of access token) */
    ath?: string;
}
export declare const dpopProofSchema: z.ZodObject<{
    jti: z.ZodString;
    htm: z.ZodString;
    htu: z.ZodString;
    iat: z.ZodNumber;
    ath: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    iat?: number;
    jti?: string;
    htm?: string;
    htu?: string;
    ath?: string;
}, {
    iat?: number;
    jti?: string;
    htm?: string;
    htu?: string;
    ath?: string;
}>;
/**
 * DPoP proof header structure
 */
export interface DPoPHeader {
    /** Type is always 'dpop+jwt' */
    typ: 'dpop+jwt';
    /** Algorithm (ES256 required, ES384/ES512 recommended) */
    alg: 'ES256' | 'ES384' | 'ES512';
    /** JWK public key */
    jwk: JsonWebKey;
}
export declare const dpopHeaderSchema: z.ZodObject<{
    typ: z.ZodLiteral<"dpop+jwt">;
    alg: z.ZodEnum<["ES256", "ES384", "ES512"]>;
    jwk: z.ZodRecord<z.ZodString, z.ZodUnknown>;
}, "strip", z.ZodTypeAny, {
    jwk?: Record<string, unknown>;
    typ?: "dpop+jwt";
    alg?: "ES256" | "ES384" | "ES512";
}, {
    jwk?: Record<string, unknown>;
    typ?: "dpop+jwt";
    alg?: "ES256" | "ES384" | "ES512";
}>;
/**
 * DPoP configuration
 */
export interface DPoPConfig {
    /** Which trust tiers require DPoP (default: T2+) */
    requiredForTiers: TrustTier[];
    /** Maximum proof age in seconds (default: 60) */
    maxProofAge: number;
    /** Whether nonce is required from server */
    nonceRequired: boolean;
    /** Maximum clock skew tolerance in seconds (default: 5) */
    clockSkewTolerance: number;
    /** Supported algorithms */
    allowedAlgorithms: ('ES256' | 'ES384' | 'ES512')[];
}
export declare const dpopConfigSchema: z.ZodObject<{
    requiredForTiers: z.ZodArray<z.ZodNativeEnum<{
        readonly T0: 0;
        readonly T1: 1;
        readonly T2: 2;
        readonly T3: 3;
        readonly T4: 4;
        readonly T5: 5;
    }>, "many">;
    maxProofAge: z.ZodDefault<z.ZodNumber>;
    nonceRequired: z.ZodDefault<z.ZodBoolean>;
    clockSkewTolerance: z.ZodDefault<z.ZodNumber>;
    allowedAlgorithms: z.ZodDefault<z.ZodArray<z.ZodEnum<["ES256", "ES384", "ES512"]>, "many">>;
}, "strip", z.ZodTypeAny, {
    requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
    maxProofAge?: number;
    nonceRequired?: boolean;
    clockSkewTolerance?: number;
    allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
}, {
    requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
    maxProofAge?: number;
    nonceRequired?: boolean;
    clockSkewTolerance?: number;
    allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
}>;
/**
 * DPoP verification result
 */
export interface DPoPVerificationResult {
    /** Whether verification succeeded */
    valid: boolean;
    /** JWK thumbprint of the proof key */
    keyThumbprint?: string;
    /** Error reason if verification failed */
    error?: string;
    /** Error code for programmatic handling */
    errorCode?: 'INVALID_SIGNATURE' | 'EXPIRED' | 'REPLAY' | 'METHOD_MISMATCH' | 'URI_MISMATCH' | 'INVALID_FORMAT';
    /** Verified at timestamp */
    verifiedAt: string;
}
export declare const dpopVerificationResultSchema: z.ZodObject<{
    valid: z.ZodBoolean;
    keyThumbprint: z.ZodOptional<z.ZodString>;
    error: z.ZodOptional<z.ZodString>;
    errorCode: z.ZodOptional<z.ZodEnum<["INVALID_SIGNATURE", "EXPIRED", "REPLAY", "METHOD_MISMATCH", "URI_MISMATCH", "INVALID_FORMAT"]>>;
    verifiedAt: z.ZodString;
}, "strip", z.ZodTypeAny, {
    error?: string;
    valid?: boolean;
    errorCode?: "EXPIRED" | "INVALID_SIGNATURE" | "REPLAY" | "METHOD_MISMATCH" | "URI_MISMATCH" | "INVALID_FORMAT";
    keyThumbprint?: string;
    verifiedAt?: string;
}, {
    error?: string;
    valid?: boolean;
    errorCode?: "EXPIRED" | "INVALID_SIGNATURE" | "REPLAY" | "METHOD_MISMATCH" | "URI_MISMATCH" | "INVALID_FORMAT";
    keyThumbprint?: string;
    verifiedAt?: string;
}>;
/**
 * Supported TEE platforms
 */
export declare const TEEPlatform: {
    readonly SGX: "sgx";
    readonly NITRO: "nitro";
    readonly SEV: "sev";
    readonly TRUSTZONE: "trustzone";
    readonly SECURE_ENCLAVE: "secure-enclave";
};
export type TEEPlatform = (typeof TEEPlatform)[keyof typeof TEEPlatform];
export declare const teePlatformSchema: z.ZodNativeEnum<{
    readonly SGX: "sgx";
    readonly NITRO: "nitro";
    readonly SEV: "sev";
    readonly TRUSTZONE: "trustzone";
    readonly SECURE_ENCLAVE: "secure-enclave";
}>;
/**
 * TEE attestation document
 */
export interface TEEAttestation {
    /** TEE platform type */
    platform: TEEPlatform;
    /** Hash of running code (measurement) */
    measurementHash: string;
    /** Attestation timestamp */
    timestamp: Date;
    /** Enclave identifier */
    enclaveId: string;
    /** Platform Configuration Registers (for SGX/Nitro) */
    pcrs?: Record<string, string>;
    /** Attestation document signature */
    signature?: string;
    /** Certificate chain for verification */
    certificateChain?: string[];
    /** Attestation service endpoint */
    attestationEndpoint?: string;
    /** Validity period end */
    validUntil?: Date;
}
export declare const teeAttestationSchema: z.ZodObject<{
    platform: z.ZodNativeEnum<{
        readonly SGX: "sgx";
        readonly NITRO: "nitro";
        readonly SEV: "sev";
        readonly TRUSTZONE: "trustzone";
        readonly SECURE_ENCLAVE: "secure-enclave";
    }>;
    measurementHash: z.ZodString;
    timestamp: z.ZodDate;
    enclaveId: z.ZodString;
    pcrs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    signature: z.ZodOptional<z.ZodString>;
    certificateChain: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    attestationEndpoint: z.ZodOptional<z.ZodString>;
    validUntil: z.ZodOptional<z.ZodDate>;
}, "strip", z.ZodTypeAny, {
    timestamp?: Date;
    signature?: string;
    platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
    measurementHash?: string;
    enclaveId?: string;
    pcrs?: Record<string, string>;
    certificateChain?: string[];
    attestationEndpoint?: string;
    validUntil?: Date;
}, {
    timestamp?: Date;
    signature?: string;
    platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
    measurementHash?: string;
    enclaveId?: string;
    pcrs?: Record<string, string>;
    certificateChain?: string[];
    attestationEndpoint?: string;
    validUntil?: Date;
}>;
/**
 * TEE key binding - binds a DID key to an enclave
 */
export interface TEEKeyBinding {
    /** DID verification method ID */
    didKeyId: string;
    /** Enclave key identifier */
    enclaveKeyId: string;
    /** Cryptographic binding proof */
    bindingProof: string;
    /** When the binding was created */
    boundAt: Date;
    /** Binding validity period */
    validUntil?: Date;
}
export declare const teeKeyBindingSchema: z.ZodObject<{
    didKeyId: z.ZodString;
    enclaveKeyId: z.ZodString;
    bindingProof: z.ZodString;
    boundAt: z.ZodDate;
    validUntil: z.ZodOptional<z.ZodDate>;
}, "strip", z.ZodTypeAny, {
    validUntil?: Date;
    didKeyId?: string;
    enclaveKeyId?: string;
    bindingProof?: string;
    boundAt?: Date;
}, {
    validUntil?: Date;
    didKeyId?: string;
    enclaveKeyId?: string;
    bindingProof?: string;
    boundAt?: Date;
}>;
/**
 * TEE configuration
 */
export interface TEEConfig {
    /** Which trust tiers require TEE (default: T4+) */
    requiredForTiers: TrustTier[];
    /** Allowed TEE platforms */
    allowedPlatforms: TEEPlatform[];
    /** Maximum attestation age before re-attestation required (seconds) */
    maxAttestationAge: number;
    /** Expected code measurements for verification */
    expectedMeasurements?: Record<string, string>;
    /** Attestation verification endpoint */
    attestationVerificationEndpoint?: string;
}
export declare const teeConfigSchema: z.ZodObject<{
    requiredForTiers: z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
        readonly T0: 0;
        readonly T1: 1;
        readonly T2: 2;
        readonly T3: 3;
        readonly T4: 4;
        readonly T5: 5;
    }>, "many">>;
    allowedPlatforms: z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
        readonly SGX: "sgx";
        readonly NITRO: "nitro";
        readonly SEV: "sev";
        readonly TRUSTZONE: "trustzone";
        readonly SECURE_ENCLAVE: "secure-enclave";
    }>, "many">>;
    maxAttestationAge: z.ZodDefault<z.ZodNumber>;
    expectedMeasurements: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    attestationVerificationEndpoint: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
    allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
    maxAttestationAge?: number;
    expectedMeasurements?: Record<string, string>;
    attestationVerificationEndpoint?: string;
}, {
    requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
    allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
    maxAttestationAge?: number;
    expectedMeasurements?: Record<string, string>;
    attestationVerificationEndpoint?: string;
}>;
/**
 * TEE verification result
 */
export interface TEEVerificationResult {
    /** Whether verification succeeded */
    valid: boolean;
    /** Verification error reason */
    reason?: string;
    /** Platform that was verified */
    platform?: TEEPlatform;
    /** Verified measurement hash */
    measurementHash?: string;
    /** Verification timestamp */
    verifiedAt: string;
    /** Whether production-grade verification was used */
    productionVerified?: boolean;
}
export declare const teeVerificationResultSchema: z.ZodObject<{
    valid: z.ZodBoolean;
    reason: z.ZodOptional<z.ZodString>;
    platform: z.ZodOptional<z.ZodNativeEnum<{
        readonly SGX: "sgx";
        readonly NITRO: "nitro";
        readonly SEV: "sev";
        readonly TRUSTZONE: "trustzone";
        readonly SECURE_ENCLAVE: "secure-enclave";
    }>>;
    measurementHash: z.ZodOptional<z.ZodString>;
    verifiedAt: z.ZodString;
    productionVerified: z.ZodOptional<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    reason?: string;
    valid?: boolean;
    verifiedAt?: string;
    platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
    measurementHash?: string;
    productionVerified?: boolean;
}, {
    reason?: string;
    valid?: boolean;
    verifiedAt?: string;
    platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
    measurementHash?: string;
    productionVerified?: boolean;
}>;
/**
 * Data types that may require pairwise DIDs
 */
export declare const DataClassification: {
    readonly PUBLIC: "public";
    readonly BUSINESS: "business";
    readonly PERSONAL: "personal";
    readonly SENSITIVE: "sensitive";
    readonly REGULATED: "regulated";
};
export type DataClassification = (typeof DataClassification)[keyof typeof DataClassification];
export declare const dataClassificationSchema: z.ZodNativeEnum<{
    readonly PUBLIC: "public";
    readonly BUSINESS: "business";
    readonly PERSONAL: "personal";
    readonly SENSITIVE: "sensitive";
    readonly REGULATED: "regulated";
}>;
/**
 * Pairwise DID derivation algorithm
 */
export declare const PairwiseDerivationAlgorithm: {
    readonly SHA256: "sha256";
    readonly HKDF: "hkdf";
};
export type PairwiseDerivationAlgorithm = (typeof PairwiseDerivationAlgorithm)[keyof typeof PairwiseDerivationAlgorithm];
export declare const pairwiseDerivationAlgorithmSchema: z.ZodNativeEnum<{
    readonly SHA256: "sha256";
    readonly HKDF: "hkdf";
}>;
/**
 * Pairwise DID configuration
 */
export interface PairwiseDIDConfig {
    /** Data types that require pairwise DIDs */
    requiredForDataTypes: DataClassification[];
    /** Derivation algorithm */
    derivationAlgorithm: PairwiseDerivationAlgorithm;
    /** Salt length in bytes */
    saltLength: number;
    /** Info string for HKDF derivation */
    hkdfInfo?: string;
}
export declare const pairwiseDIDConfigSchema: z.ZodObject<{
    requiredForDataTypes: z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
        readonly PUBLIC: "public";
        readonly BUSINESS: "business";
        readonly PERSONAL: "personal";
        readonly SENSITIVE: "sensitive";
        readonly REGULATED: "regulated";
    }>, "many">>;
    derivationAlgorithm: z.ZodDefault<z.ZodNativeEnum<{
        readonly SHA256: "sha256";
        readonly HKDF: "hkdf";
    }>>;
    saltLength: z.ZodDefault<z.ZodNumber>;
    hkdfInfo: z.ZodDefault<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    saltLength?: number;
    requiredForDataTypes?: ("regulated" | "sensitive" | "public" | "business" | "personal")[];
    derivationAlgorithm?: "sha256" | "hkdf";
    hkdfInfo?: string;
}, {
    saltLength?: number;
    requiredForDataTypes?: ("regulated" | "sensitive" | "public" | "business" | "personal")[];
    derivationAlgorithm?: "sha256" | "hkdf";
    hkdfInfo?: string;
}>;
/**
 * Pairwise DID derivation record
 */
export interface PairwiseDerivation {
    /** Agent's root/master DID */
    masterDid: string;
    /** Relying party's DID */
    relyingPartyDid: string;
    /** Random salt for this relationship */
    contextSalt: string;
    /** Derived pairwise DID */
    derivedDid: string;
    /** When the derivation was created */
    createdAt: Date;
}
export declare const pairwiseDerivationSchema: z.ZodObject<{
    masterDid: z.ZodString;
    relyingPartyDid: z.ZodString;
    contextSalt: z.ZodString;
    derivedDid: z.ZodString;
    createdAt: z.ZodDate;
}, "strip", z.ZodTypeAny, {
    createdAt?: Date;
    masterDid?: string;
    relyingPartyDid?: string;
    contextSalt?: string;
    derivedDid?: string;
}, {
    createdAt?: Date;
    masterDid?: string;
    relyingPartyDid?: string;
    contextSalt?: string;
    derivedDid?: string;
}>;
/**
 * Revocation SLA configuration per trust tier
 */
export interface RevocationSLA {
    /** Trust tier this SLA applies to */
    tier: TrustTier;
    /** Maximum propagation latency in milliseconds */
    maxPropagationLatencyMs: number;
    /** Whether synchronous check is required */
    syncCheckRequired: boolean;
    /** Whether token introspection is required */
    introspectionRequired: boolean;
}
export declare const revocationSLASchema: z.ZodObject<{
    tier: z.ZodNativeEnum<{
        readonly T0: 0;
        readonly T1: 1;
        readonly T2: 2;
        readonly T3: 3;
        readonly T4: 4;
        readonly T5: 5;
    }>;
    maxPropagationLatencyMs: z.ZodNumber;
    syncCheckRequired: z.ZodBoolean;
    introspectionRequired: z.ZodBoolean;
}, "strip", z.ZodTypeAny, {
    tier?: 0 | 1 | 2 | 3 | 4 | 5;
    maxPropagationLatencyMs?: number;
    syncCheckRequired?: boolean;
    introspectionRequired?: boolean;
}, {
    tier?: 0 | 1 | 2 | 3 | 4 | 5;
    maxPropagationLatencyMs?: number;
    syncCheckRequired?: boolean;
    introspectionRequired?: boolean;
}>;
/**
 * Default revocation SLAs per CAR spec
 */
export declare const DEFAULT_REVOCATION_SLAS: RevocationSLA[];
/**
 * Revocation propagation policy
 */
export interface RevocationPropagationPolicy {
    /** Whether to terminate descendant delegations */
    terminateDescendants: boolean;
    /** Grace period before termination (milliseconds) */
    gracePeriodMs: number;
    /** Whether to notify webhooks */
    notifyWebhooks: boolean;
}
export declare const revocationPropagationPolicySchema: z.ZodObject<{
    terminateDescendants: z.ZodDefault<z.ZodBoolean>;
    gracePeriodMs: z.ZodDefault<z.ZodNumber>;
    notifyWebhooks: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    terminateDescendants?: boolean;
    gracePeriodMs?: number;
    notifyWebhooks?: boolean;
}, {
    terminateDescendants?: boolean;
    gracePeriodMs?: number;
    notifyWebhooks?: boolean;
}>;
/**
 * Revocation request
 */
export interface RevocationPropagation {
    /** DID of agent to revoke */
    revokedDid: string;
    /** Reason for revocation */
    reason: string;
    /** Propagation policy */
    propagationPolicy: RevocationPropagationPolicy;
}
export declare const revocationPropagationSchema: z.ZodObject<{
    revokedDid: z.ZodString;
    reason: z.ZodString;
    propagationPolicy: z.ZodObject<{
        terminateDescendants: z.ZodDefault<z.ZodBoolean>;
        gracePeriodMs: z.ZodDefault<z.ZodNumber>;
        notifyWebhooks: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        terminateDescendants?: boolean;
        gracePeriodMs?: number;
        notifyWebhooks?: boolean;
    }, {
        terminateDescendants?: boolean;
        gracePeriodMs?: number;
        notifyWebhooks?: boolean;
    }>;
}, "strip", z.ZodTypeAny, {
    reason?: string;
    revokedDid?: string;
    propagationPolicy?: {
        terminateDescendants?: boolean;
        gracePeriodMs?: number;
        notifyWebhooks?: boolean;
    };
}, {
    reason?: string;
    revokedDid?: string;
    propagationPolicy?: {
        terminateDescendants?: boolean;
        gracePeriodMs?: number;
        notifyWebhooks?: boolean;
    };
}>;
/**
 * Revocation result
 */
export interface RevocationResult {
    /** Unique revocation ID */
    revocationId: string;
    /** DID that was revoked */
    revokedDid: string;
    /** DIDs of descendants that were also revoked */
    descendantsRevoked: string[];
    /** Number of tokens invalidated */
    tokensInvalidated: number;
    /** Whether propagation completed successfully */
    propagationComplete: boolean;
    /** Revocation timestamp */
    timestamp: Date;
}
export declare const revocationResultSchema: z.ZodObject<{
    revocationId: z.ZodString;
    revokedDid: z.ZodString;
    descendantsRevoked: z.ZodArray<z.ZodString, "many">;
    tokensInvalidated: z.ZodNumber;
    propagationComplete: z.ZodBoolean;
    timestamp: z.ZodDate;
}, "strip", z.ZodTypeAny, {
    timestamp?: Date;
    revokedDid?: string;
    revocationId?: string;
    descendantsRevoked?: string[];
    tokensInvalidated?: number;
    propagationComplete?: boolean;
}, {
    timestamp?: Date;
    revokedDid?: string;
    revocationId?: string;
    descendantsRevoked?: string[];
    tokensInvalidated?: number;
    propagationComplete?: boolean;
}>;
/**
 * Revocation status
 */
export declare const RevocationStatusEnum: {
    readonly ACTIVE: "active";
    readonly REVOKED: "revoked";
    readonly PENDING: "pending";
};
export type RevocationStatusEnum = (typeof RevocationStatusEnum)[keyof typeof RevocationStatusEnum];
export declare const revocationStatusEnumSchema: z.ZodNativeEnum<{
    readonly ACTIVE: "active";
    readonly REVOKED: "revoked";
    readonly PENDING: "pending";
}>;
/**
 * Revocation status response
 */
export interface RevocationStatus {
    /** DID being checked */
    did: string;
    /** Current status */
    status: RevocationStatusEnum;
    /** Revocation timestamp if revoked */
    revokedAt?: Date;
    /** Revocation reason if revoked */
    reason?: string;
    /** Whether this is from cache or sync check */
    fromCache: boolean;
    /** Cache age in milliseconds */
    cacheAgeMs?: number;
}
export declare const revocationStatusSchema: z.ZodObject<{
    did: z.ZodString;
    status: z.ZodNativeEnum<{
        readonly ACTIVE: "active";
        readonly REVOKED: "revoked";
        readonly PENDING: "pending";
    }>;
    revokedAt: z.ZodOptional<z.ZodDate>;
    reason: z.ZodOptional<z.ZodString>;
    fromCache: z.ZodBoolean;
    cacheAgeMs: z.ZodOptional<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    reason?: string;
    status?: "pending" | "active" | "revoked";
    revokedAt?: Date;
    did?: string;
    fromCache?: boolean;
    cacheAgeMs?: number;
}, {
    reason?: string;
    status?: "pending" | "active" | "revoked";
    revokedAt?: Date;
    did?: string;
    fromCache?: boolean;
    cacheAgeMs?: number;
}>;
/**
 * Revocation event for webhooks/subscriptions
 */
export interface RevocationEvent {
    /** Event type */
    type: 'agent.revoked' | 'delegation.terminated' | 'token.invalidated';
    /** Revocation ID */
    revocationId: string;
    /** Affected DID */
    did: string;
    /** Revocation reason */
    reason: string;
    /** Event timestamp */
    timestamp: Date;
    /** Additional metadata */
    metadata?: Record<string, unknown>;
}
export declare const revocationEventSchema: z.ZodObject<{
    type: z.ZodEnum<["agent.revoked", "delegation.terminated", "token.invalidated"]>;
    revocationId: z.ZodString;
    did: z.ZodString;
    reason: z.ZodString;
    timestamp: z.ZodDate;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    reason?: string;
    type?: "agent.revoked" | "delegation.terminated" | "token.invalidated";
    metadata?: Record<string, unknown>;
    timestamp?: Date;
    did?: string;
    revocationId?: string;
}, {
    reason?: string;
    type?: "agent.revoked" | "delegation.terminated" | "token.invalidated";
    metadata?: Record<string, unknown>;
    timestamp?: Date;
    did?: string;
    revocationId?: string;
}>;
/**
 * Token lifetime configuration per CAR spec
 */
export interface TokenLifetimeConfig {
    /** Access token maximum TTL in seconds (default: 300 = 5 min) */
    accessTokenMaxTTL: number;
    /** Refresh token maximum TTL in seconds (default: 86400 = 24 hr) */
    refreshTokenMaxTTL: number;
    /** ID token maximum TTL in seconds (default: 300 = 5 min) */
    idTokenMaxTTL: number;
    /** TTL for high-value operations L3+ (default: 60 = 1 min) */
    highValueOperationTTL: number;
    /** Threshold for proactive refresh (percentage of TTL remaining) */
    refreshThreshold: number;
}
export declare const tokenLifetimeConfigSchema: z.ZodObject<{
    accessTokenMaxTTL: z.ZodDefault<z.ZodNumber>;
    refreshTokenMaxTTL: z.ZodDefault<z.ZodNumber>;
    idTokenMaxTTL: z.ZodDefault<z.ZodNumber>;
    highValueOperationTTL: z.ZodDefault<z.ZodNumber>;
    refreshThreshold: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    accessTokenMaxTTL?: number;
    refreshTokenMaxTTL?: number;
    idTokenMaxTTL?: number;
    highValueOperationTTL?: number;
    refreshThreshold?: number;
}, {
    accessTokenMaxTTL?: number;
    refreshTokenMaxTTL?: number;
    idTokenMaxTTL?: number;
    highValueOperationTTL?: number;
    refreshThreshold?: number;
}>;
/**
 * Default token lifetime configuration
 */
export declare const DEFAULT_TOKEN_LIFETIME_CONFIG: TokenLifetimeConfig;
/**
 * Token introspection result per RFC 7662
 */
export interface IntrospectionResult {
    /** Whether the token is active */
    active: boolean;
    /** Token scope */
    scope?: string;
    /** Client ID */
    clientId?: string;
    /** Username (subject) */
    username?: string;
    /** Token type */
    tokenType?: string;
    /** Expiration timestamp */
    exp?: number;
    /** Issued at timestamp */
    iat?: number;
    /** Not before timestamp */
    nbf?: number;
    /** Subject identifier */
    sub?: string;
    /** Audience */
    aud?: string | string[];
    /** Issuer */
    iss?: string;
    /** JWT ID */
    jti?: string;
    /** DPoP key confirmation */
    cnf?: {
        jkt?: string;
    };
    /** Introspection timestamp */
    introspectedAt: string;
    /** Whether result is from cache */
    fromCache: boolean;
}
export declare const introspectionResultSchema: z.ZodObject<{
    active: z.ZodBoolean;
    scope: z.ZodOptional<z.ZodString>;
    clientId: z.ZodOptional<z.ZodString>;
    username: z.ZodOptional<z.ZodString>;
    tokenType: z.ZodOptional<z.ZodString>;
    exp: z.ZodOptional<z.ZodNumber>;
    iat: z.ZodOptional<z.ZodNumber>;
    nbf: z.ZodOptional<z.ZodNumber>;
    sub: z.ZodOptional<z.ZodString>;
    aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
    iss: z.ZodOptional<z.ZodString>;
    jti: z.ZodOptional<z.ZodString>;
    cnf: z.ZodOptional<z.ZodObject<{
        jkt: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        jkt?: string;
    }, {
        jkt?: string;
    }>>;
    introspectedAt: z.ZodString;
    fromCache: z.ZodBoolean;
}, "strip", z.ZodTypeAny, {
    sub?: string;
    clientId?: string;
    iat?: number;
    exp?: number;
    active?: boolean;
    jti?: string;
    fromCache?: boolean;
    scope?: string;
    username?: string;
    tokenType?: string;
    nbf?: number;
    aud?: string | string[];
    iss?: string;
    cnf?: {
        jkt?: string;
    };
    introspectedAt?: string;
}, {
    sub?: string;
    clientId?: string;
    iat?: number;
    exp?: number;
    active?: boolean;
    jti?: string;
    fromCache?: boolean;
    scope?: string;
    username?: string;
    tokenType?: string;
    nbf?: number;
    aud?: string | string[];
    iss?: string;
    cnf?: {
        jkt?: string;
    };
    introspectedAt?: string;
}>;
/**
 * Agent identity for security context
 */
export interface AgentIdentity {
    /** Agent DID */
    did: string;
    /** Trust tier */
    trustTier: TrustTier;
    /** Capability level (L0-L5) */
    capabilityLevel: number;
    /** DID document */
    didDocument?: unknown;
    /** TEE binding if present */
    teeBinding?: TEEKeyBinding;
    /** Attestation chain */
    attestationChain?: unknown[];
}
export declare const agentIdentitySchema: z.ZodObject<{
    did: z.ZodString;
    trustTier: z.ZodNativeEnum<{
        readonly T0: 0;
        readonly T1: 1;
        readonly T2: 2;
        readonly T3: 3;
        readonly T4: 4;
        readonly T5: 5;
    }>;
    capabilityLevel: z.ZodNumber;
    didDocument: z.ZodOptional<z.ZodUnknown>;
    teeBinding: z.ZodOptional<z.ZodObject<{
        didKeyId: z.ZodString;
        enclaveKeyId: z.ZodString;
        bindingProof: z.ZodString;
        boundAt: z.ZodDate;
        validUntil: z.ZodOptional<z.ZodDate>;
    }, "strip", z.ZodTypeAny, {
        validUntil?: Date;
        didKeyId?: string;
        enclaveKeyId?: string;
        bindingProof?: string;
        boundAt?: Date;
    }, {
        validUntil?: Date;
        didKeyId?: string;
        enclaveKeyId?: string;
        bindingProof?: string;
        boundAt?: Date;
    }>>;
    attestationChain: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
}, "strip", z.ZodTypeAny, {
    trustTier?: 0 | 1 | 2 | 3 | 4 | 5;
    did?: string;
    capabilityLevel?: number;
    didDocument?: unknown;
    teeBinding?: {
        validUntil?: Date;
        didKeyId?: string;
        enclaveKeyId?: string;
        bindingProof?: string;
        boundAt?: Date;
    };
    attestationChain?: unknown[];
}, {
    trustTier?: 0 | 1 | 2 | 3 | 4 | 5;
    did?: string;
    capabilityLevel?: number;
    didDocument?: unknown;
    teeBinding?: {
        validUntil?: Date;
        didKeyId?: string;
        enclaveKeyId?: string;
        bindingProof?: string;
        boundAt?: Date;
    };
    attestationChain?: unknown[];
}>;
/**
 * Action request for security evaluation
 */
export interface ActionRequest {
    /** Request ID */
    requestId: string;
    /** HTTP method */
    method: string;
    /** Request URI */
    uri: string;
    /** Action type/name */
    actionType: string;
    /** Action level (L0-L5) */
    actionLevel: number;
    /** Domain codes */
    domains?: string[];
    /** Whether this is a high-value operation */
    isHighValue?: boolean;
    /** Data classification */
    dataClassification?: DataClassification;
}
export declare const actionRequestSchema: z.ZodObject<{
    requestId: z.ZodString;
    method: z.ZodString;
    uri: z.ZodString;
    actionType: z.ZodString;
    actionLevel: z.ZodNumber;
    domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    isHighValue: z.ZodOptional<z.ZodBoolean>;
    dataClassification: z.ZodOptional<z.ZodNativeEnum<{
        readonly PUBLIC: "public";
        readonly BUSINESS: "business";
        readonly PERSONAL: "personal";
        readonly SENSITIVE: "sensitive";
        readonly REGULATED: "regulated";
    }>>;
}, "strip", z.ZodTypeAny, {
    requestId?: string;
    method?: string;
    actionType?: string;
    dataClassification?: "regulated" | "sensitive" | "public" | "business" | "personal";
    domains?: string[];
    uri?: string;
    actionLevel?: number;
    isHighValue?: boolean;
}, {
    requestId?: string;
    method?: string;
    actionType?: string;
    dataClassification?: "regulated" | "sensitive" | "public" | "business" | "personal";
    domains?: string[];
    uri?: string;
    actionLevel?: number;
    isHighValue?: boolean;
}>;
/**
 * Security context for validation
 */
export interface SecurityContext {
    /** Agent identity */
    agent: AgentIdentity;
    /** Current action request */
    request: ActionRequest;
    /** Access token */
    accessToken: string;
    /** DPoP proof if present */
    dpopProof?: string;
    /** DPoP public key */
    dpopKey?: JsonWebKey;
    /** TEE attestation if present */
    teeAttestation?: TEEAttestation;
    /** Pairwise DID if used */
    pairwiseDid?: string;
}
export declare const securityContextSchema: z.ZodObject<{
    agent: z.ZodObject<{
        did: z.ZodString;
        trustTier: z.ZodNativeEnum<{
            readonly T0: 0;
            readonly T1: 1;
            readonly T2: 2;
            readonly T3: 3;
            readonly T4: 4;
            readonly T5: 5;
        }>;
        capabilityLevel: z.ZodNumber;
        didDocument: z.ZodOptional<z.ZodUnknown>;
        teeBinding: z.ZodOptional<z.ZodObject<{
            didKeyId: z.ZodString;
            enclaveKeyId: z.ZodString;
            bindingProof: z.ZodString;
            boundAt: z.ZodDate;
            validUntil: z.ZodOptional<z.ZodDate>;
        }, "strip", z.ZodTypeAny, {
            validUntil?: Date;
            didKeyId?: string;
            enclaveKeyId?: string;
            bindingProof?: string;
            boundAt?: Date;
        }, {
            validUntil?: Date;
            didKeyId?: string;
            enclaveKeyId?: string;
            bindingProof?: string;
            boundAt?: Date;
        }>>;
        attestationChain: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
    }, "strip", z.ZodTypeAny, {
        trustTier?: 0 | 1 | 2 | 3 | 4 | 5;
        did?: string;
        capabilityLevel?: number;
        didDocument?: unknown;
        teeBinding?: {
            validUntil?: Date;
            didKeyId?: string;
            enclaveKeyId?: string;
            bindingProof?: string;
            boundAt?: Date;
        };
        attestationChain?: unknown[];
    }, {
        trustTier?: 0 | 1 | 2 | 3 | 4 | 5;
        did?: string;
        capabilityLevel?: number;
        didDocument?: unknown;
        teeBinding?: {
            validUntil?: Date;
            didKeyId?: string;
            enclaveKeyId?: string;
            bindingProof?: string;
            boundAt?: Date;
        };
        attestationChain?: unknown[];
    }>;
    request: z.ZodObject<{
        requestId: z.ZodString;
        method: z.ZodString;
        uri: z.ZodString;
        actionType: z.ZodString;
        actionLevel: z.ZodNumber;
        domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        isHighValue: z.ZodOptional<z.ZodBoolean>;
        dataClassification: z.ZodOptional<z.ZodNativeEnum<{
            readonly PUBLIC: "public";
            readonly BUSINESS: "business";
            readonly PERSONAL: "personal";
            readonly SENSITIVE: "sensitive";
            readonly REGULATED: "regulated";
        }>>;
    }, "strip", z.ZodTypeAny, {
        requestId?: string;
        method?: string;
        actionType?: string;
        dataClassification?: "regulated" | "sensitive" | "public" | "business" | "personal";
        domains?: string[];
        uri?: string;
        actionLevel?: number;
        isHighValue?: boolean;
    }, {
        requestId?: string;
        method?: string;
        actionType?: string;
        dataClassification?: "regulated" | "sensitive" | "public" | "business" | "personal";
        domains?: string[];
        uri?: string;
        actionLevel?: number;
        isHighValue?: boolean;
    }>;
    accessToken: z.ZodString;
    dpopProof: z.ZodOptional<z.ZodString>;
    dpopKey: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    teeAttestation: z.ZodOptional<z.ZodObject<{
        platform: z.ZodNativeEnum<{
            readonly SGX: "sgx";
            readonly NITRO: "nitro";
            readonly SEV: "sev";
            readonly TRUSTZONE: "trustzone";
            readonly SECURE_ENCLAVE: "secure-enclave";
        }>;
        measurementHash: z.ZodString;
        timestamp: z.ZodDate;
        enclaveId: z.ZodString;
        pcrs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
        signature: z.ZodOptional<z.ZodString>;
        certificateChain: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        attestationEndpoint: z.ZodOptional<z.ZodString>;
        validUntil: z.ZodOptional<z.ZodDate>;
    }, "strip", z.ZodTypeAny, {
        timestamp?: Date;
        signature?: string;
        platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
        measurementHash?: string;
        enclaveId?: string;
        pcrs?: Record<string, string>;
        certificateChain?: string[];
        attestationEndpoint?: string;
        validUntil?: Date;
    }, {
        timestamp?: Date;
        signature?: string;
        platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
        measurementHash?: string;
        enclaveId?: string;
        pcrs?: Record<string, string>;
        certificateChain?: string[];
        attestationEndpoint?: string;
        validUntil?: Date;
    }>>;
    pairwiseDid: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    agent?: {
        trustTier?: 0 | 1 | 2 | 3 | 4 | 5;
        did?: string;
        capabilityLevel?: number;
        didDocument?: unknown;
        teeBinding?: {
            validUntil?: Date;
            didKeyId?: string;
            enclaveKeyId?: string;
            bindingProof?: string;
            boundAt?: Date;
        };
        attestationChain?: unknown[];
    };
    accessToken?: string;
    request?: {
        requestId?: string;
        method?: string;
        actionType?: string;
        dataClassification?: "regulated" | "sensitive" | "public" | "business" | "personal";
        domains?: string[];
        uri?: string;
        actionLevel?: number;
        isHighValue?: boolean;
    };
    dpopProof?: string;
    dpopKey?: Record<string, unknown>;
    teeAttestation?: {
        timestamp?: Date;
        signature?: string;
        platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
        measurementHash?: string;
        enclaveId?: string;
        pcrs?: Record<string, string>;
        certificateChain?: string[];
        attestationEndpoint?: string;
        validUntil?: Date;
    };
    pairwiseDid?: string;
}, {
    agent?: {
        trustTier?: 0 | 1 | 2 | 3 | 4 | 5;
        did?: string;
        capabilityLevel?: number;
        didDocument?: unknown;
        teeBinding?: {
            validUntil?: Date;
            didKeyId?: string;
            enclaveKeyId?: string;
            bindingProof?: string;
            boundAt?: Date;
        };
        attestationChain?: unknown[];
    };
    accessToken?: string;
    request?: {
        requestId?: string;
        method?: string;
        actionType?: string;
        dataClassification?: "regulated" | "sensitive" | "public" | "business" | "personal";
        domains?: string[];
        uri?: string;
        actionLevel?: number;
        isHighValue?: boolean;
    };
    dpopProof?: string;
    dpopKey?: Record<string, unknown>;
    teeAttestation?: {
        timestamp?: Date;
        signature?: string;
        platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
        measurementHash?: string;
        enclaveId?: string;
        pcrs?: Record<string, string>;
        certificateChain?: string[];
        attestationEndpoint?: string;
        validUntil?: Date;
    };
    pairwiseDid?: string;
}>;
/**
 * Security validation result
 */
export interface SecurityValidationResult {
    /** Whether validation passed */
    valid: boolean;
    /** Validation errors */
    errors: SecurityValidationError[];
    /** Applied security level */
    securityLevel: SecurityConformanceLevel;
    /** Warnings (non-fatal) */
    warnings: string[];
    /** Validation timestamp */
    validatedAt: string;
}
export interface SecurityValidationError {
    /** Error code */
    code: string;
    /** Error message */
    message: string;
    /** Component that failed */
    component: 'dpop' | 'tee' | 'pairwise' | 'revocation' | 'token' | 'introspection';
}
export declare const securityValidationErrorSchema: z.ZodObject<{
    code: z.ZodString;
    message: z.ZodString;
    component: z.ZodEnum<["dpop", "tee", "pairwise", "revocation", "token", "introspection"]>;
}, "strip", z.ZodTypeAny, {
    component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
    code?: string;
    message?: string;
}, {
    component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
    code?: string;
    message?: string;
}>;
export declare const securityValidationResultSchema: z.ZodObject<{
    valid: z.ZodBoolean;
    errors: z.ZodArray<z.ZodObject<{
        code: z.ZodString;
        message: z.ZodString;
        component: z.ZodEnum<["dpop", "tee", "pairwise", "revocation", "token", "introspection"]>;
    }, "strip", z.ZodTypeAny, {
        component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
        code?: string;
        message?: string;
    }, {
        component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
        code?: string;
        message?: string;
    }>, "many">;
    securityLevel: z.ZodNativeEnum<{
        readonly NONE: "none";
        readonly SH1_BASIC: "sh-1";
        readonly SH2_STANDARD: "sh-2";
        readonly SH3_HARDENED: "sh-3";
    }>;
    warnings: z.ZodArray<z.ZodString, "many">;
    validatedAt: z.ZodString;
}, "strip", z.ZodTypeAny, {
    valid?: boolean;
    errors?: {
        component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
        code?: string;
        message?: string;
    }[];
    warnings?: string[];
    validatedAt?: string;
    securityLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
}, {
    valid?: boolean;
    errors?: {
        component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
        code?: string;
        message?: string;
    }[];
    warnings?: string[];
    validatedAt?: string;
    securityLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
}>;
/**
 * Pre-request security check result
 */
export interface PreRequestResult {
    /** Whether request can proceed */
    allow: boolean;
    /** Required actions before proceeding */
    requiredActions?: ('dpop' | 'tee_attestation' | 'pairwise_did' | 'introspection')[];
    /** Security requirements for this request */
    requirements: SecurityRequirements;
    /** Denial reason if not allowed */
    denyReason?: string;
}
export declare const preRequestResultSchema: z.ZodObject<{
    allow: z.ZodBoolean;
    requiredActions: z.ZodOptional<z.ZodArray<z.ZodEnum<["dpop", "tee_attestation", "pairwise_did", "introspection"]>, "many">>;
    requirements: z.ZodLazy<z.ZodObject<{
        tier: z.ZodNativeEnum<{
            readonly T0: 0;
            readonly T1: 1;
            readonly T2: 2;
            readonly T3: 3;
            readonly T4: 4;
            readonly T5: 5;
        }>;
        conformanceLevel: z.ZodNativeEnum<{
            readonly NONE: "none";
            readonly SH1_BASIC: "sh-1";
            readonly SH2_STANDARD: "sh-2";
            readonly SH3_HARDENED: "sh-3";
        }>;
        dpopRequired: z.ZodBoolean;
        teeRequired: z.ZodBoolean;
        pairwiseRequired: z.ZodBoolean;
        syncRevocationRequired: z.ZodBoolean;
        maxTokenTTL: z.ZodNumber;
        maxChainDepth: z.ZodNumber;
    }, "strip", z.ZodTypeAny, {
        tier?: 0 | 1 | 2 | 3 | 4 | 5;
        conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
        dpopRequired?: boolean;
        teeRequired?: boolean;
        pairwiseRequired?: boolean;
        syncRevocationRequired?: boolean;
        maxTokenTTL?: number;
        maxChainDepth?: number;
    }, {
        tier?: 0 | 1 | 2 | 3 | 4 | 5;
        conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
        dpopRequired?: boolean;
        teeRequired?: boolean;
        pairwiseRequired?: boolean;
        syncRevocationRequired?: boolean;
        maxTokenTTL?: number;
        maxChainDepth?: number;
    }>>;
    denyReason: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    allow?: boolean;
    requiredActions?: ("dpop" | "introspection" | "tee_attestation" | "pairwise_did")[];
    requirements?: {
        tier?: 0 | 1 | 2 | 3 | 4 | 5;
        conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
        dpopRequired?: boolean;
        teeRequired?: boolean;
        pairwiseRequired?: boolean;
        syncRevocationRequired?: boolean;
        maxTokenTTL?: number;
        maxChainDepth?: number;
    };
    denyReason?: string;
}, {
    allow?: boolean;
    requiredActions?: ("dpop" | "introspection" | "tee_attestation" | "pairwise_did")[];
    requirements?: {
        tier?: 0 | 1 | 2 | 3 | 4 | 5;
        conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
        dpopRequired?: boolean;
        teeRequired?: boolean;
        pairwiseRequired?: boolean;
        syncRevocationRequired?: boolean;
        maxTokenTTL?: number;
        maxChainDepth?: number;
    };
    denyReason?: string;
}>;
/**
 * High-value operation check result
 */
export interface HighValueCheckResult {
    /** Whether operation can proceed */
    allow: boolean;
    /** Whether introspection was performed */
    introspectionPerformed: boolean;
    /** Whether revocation was checked synchronously */
    syncRevocationCheck: boolean;
    /** Token remaining TTL in seconds */
    tokenTTLRemaining?: number;
    /** Denial reason if not allowed */
    denyReason?: string;
}
export declare const highValueCheckResultSchema: z.ZodObject<{
    allow: z.ZodBoolean;
    introspectionPerformed: z.ZodBoolean;
    syncRevocationCheck: z.ZodBoolean;
    tokenTTLRemaining: z.ZodOptional<z.ZodNumber>;
    denyReason: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    allow?: boolean;
    denyReason?: string;
    introspectionPerformed?: boolean;
    syncRevocationCheck?: boolean;
    tokenTTLRemaining?: number;
}, {
    allow?: boolean;
    denyReason?: string;
    introspectionPerformed?: boolean;
    syncRevocationCheck?: boolean;
    tokenTTLRemaining?: number;
}>;
/**
 * Security requirements for a trust tier
 */
export interface SecurityRequirements {
    /** Trust tier */
    tier: TrustTier;
    /** Required conformance level */
    conformanceLevel: SecurityConformanceLevel;
    /** Whether DPoP is required */
    dpopRequired: boolean;
    /** Whether TEE binding is required */
    teeRequired: boolean;
    /** Whether pairwise DIDs are required */
    pairwiseRequired: boolean;
    /** Whether sync revocation check is required */
    syncRevocationRequired: boolean;
    /** Maximum token TTL */
    maxTokenTTL: number;
    /** Maximum delegation chain depth */
    maxChainDepth: number;
}
export declare const securityRequirementsSchema: z.ZodObject<{
    tier: z.ZodNativeEnum<{
        readonly T0: 0;
        readonly T1: 1;
        readonly T2: 2;
        readonly T3: 3;
        readonly T4: 4;
        readonly T5: 5;
    }>;
    conformanceLevel: z.ZodNativeEnum<{
        readonly NONE: "none";
        readonly SH1_BASIC: "sh-1";
        readonly SH2_STANDARD: "sh-2";
        readonly SH3_HARDENED: "sh-3";
    }>;
    dpopRequired: z.ZodBoolean;
    teeRequired: z.ZodBoolean;
    pairwiseRequired: z.ZodBoolean;
    syncRevocationRequired: z.ZodBoolean;
    maxTokenTTL: z.ZodNumber;
    maxChainDepth: z.ZodNumber;
}, "strip", z.ZodTypeAny, {
    tier?: 0 | 1 | 2 | 3 | 4 | 5;
    conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
    dpopRequired?: boolean;
    teeRequired?: boolean;
    pairwiseRequired?: boolean;
    syncRevocationRequired?: boolean;
    maxTokenTTL?: number;
    maxChainDepth?: number;
}, {
    tier?: 0 | 1 | 2 | 3 | 4 | 5;
    conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
    dpopRequired?: boolean;
    teeRequired?: boolean;
    pairwiseRequired?: boolean;
    syncRevocationRequired?: boolean;
    maxTokenTTL?: number;
    maxChainDepth?: number;
}>;
/**
 * Get security requirements for a trust tier
 */
export declare function getSecurityRequirementsForTier(tier: TrustTier): SecurityRequirements;
/**
 * Incoming request structure for middleware
 */
export interface IncomingRequest {
    /** Request ID */
    requestId: string;
    /** HTTP method */
    method: string;
    /** Request URI */
    uri: string;
    /** Authorization header */
    authorization?: string;
    /** DPoP header */
    dpop?: string;
    /** Additional headers */
    headers: Record<string, string | string[] | undefined>;
}
export declare const incomingRequestSchema: z.ZodObject<{
    requestId: z.ZodString;
    method: z.ZodString;
    uri: z.ZodString;
    authorization: z.ZodOptional<z.ZodString>;
    dpop: z.ZodOptional<z.ZodString>;
    headers: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">, z.ZodUndefined]>>;
}, "strip", z.ZodTypeAny, {
    authorization?: string;
    requestId?: string;
    method?: string;
    headers?: Record<string, string | string[]>;
    uri?: string;
    dpop?: string;
}, {
    authorization?: string;
    requestId?: string;
    method?: string;
    headers?: Record<string, string | string[]>;
    uri?: string;
    dpop?: string;
}>;
/**
 * JTI cache interface for DPoP replay prevention
 */
export interface JTICache {
    /** Store JTI with expiration */
    store(jti: string, expiresAt: Date): Promise<void>;
    /** Check if JTI has been seen */
    exists(jti: string): Promise<boolean>;
}
/**
 * Security plugin options for Fastify
 */
export interface SecurityPluginOptions {
    /** DPoP configuration */
    dpop?: Partial<DPoPConfig>;
    /** TEE configuration */
    tee?: Partial<TEEConfig>;
    /** Pairwise DID configuration */
    pairwiseDid?: Partial<PairwiseDIDConfig>;
    /** Revocation SLA overrides */
    revocationSLAs?: RevocationSLA[];
    /** Token lifetime configuration */
    tokenLifetime?: Partial<TokenLifetimeConfig>;
    /** Token introspection endpoint */
    introspectionEndpoint?: string;
    /** Skip security checks for certain paths */
    skipPaths?: string[];
    /** Enable metrics collection */
    enableMetrics?: boolean;
}
export declare const securityPluginOptionsSchema: z.ZodObject<{
    dpop: z.ZodOptional<z.ZodObject<{
        requiredForTiers: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<{
            readonly T0: 0;
            readonly T1: 1;
            readonly T2: 2;
            readonly T3: 3;
            readonly T4: 4;
            readonly T5: 5;
        }>, "many">>;
        maxProofAge: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        nonceRequired: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
        clockSkewTolerance: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        allowedAlgorithms: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<["ES256", "ES384", "ES512"]>, "many">>>;
    }, "strip", z.ZodTypeAny, {
        requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
        maxProofAge?: number;
        nonceRequired?: boolean;
        clockSkewTolerance?: number;
        allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
    }, {
        requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
        maxProofAge?: number;
        nonceRequired?: boolean;
        clockSkewTolerance?: number;
        allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
    }>>;
    tee: z.ZodOptional<z.ZodObject<{
        requiredForTiers: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
            readonly T0: 0;
            readonly T1: 1;
            readonly T2: 2;
            readonly T3: 3;
            readonly T4: 4;
            readonly T5: 5;
        }>, "many">>>;
        allowedPlatforms: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
            readonly SGX: "sgx";
            readonly NITRO: "nitro";
            readonly SEV: "sev";
            readonly TRUSTZONE: "trustzone";
            readonly SECURE_ENCLAVE: "secure-enclave";
        }>, "many">>>;
        maxAttestationAge: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        expectedMeasurements: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
        attestationVerificationEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
    }, "strip", z.ZodTypeAny, {
        requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
        allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
        maxAttestationAge?: number;
        expectedMeasurements?: Record<string, string>;
        attestationVerificationEndpoint?: string;
    }, {
        requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
        allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
        maxAttestationAge?: number;
        expectedMeasurements?: Record<string, string>;
        attestationVerificationEndpoint?: string;
    }>>;
    pairwiseDid: z.ZodOptional<z.ZodObject<{
        requiredForDataTypes: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
            readonly PUBLIC: "public";
            readonly BUSINESS: "business";
            readonly PERSONAL: "personal";
            readonly SENSITIVE: "sensitive";
            readonly REGULATED: "regulated";
        }>, "many">>>;
        derivationAlgorithm: z.ZodOptional<z.ZodDefault<z.ZodNativeEnum<{
            readonly SHA256: "sha256";
            readonly HKDF: "hkdf";
        }>>>;
        saltLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        hkdfInfo: z.ZodOptional<z.ZodDefault<z.ZodString>>;
    }, "strip", z.ZodTypeAny, {
        saltLength?: number;
        requiredForDataTypes?: ("regulated" | "sensitive" | "public" | "business" | "personal")[];
        derivationAlgorithm?: "sha256" | "hkdf";
        hkdfInfo?: string;
    }, {
        saltLength?: number;
        requiredForDataTypes?: ("regulated" | "sensitive" | "public" | "business" | "personal")[];
        derivationAlgorithm?: "sha256" | "hkdf";
        hkdfInfo?: string;
    }>>;
    revocationSLAs: z.ZodOptional<z.ZodArray<z.ZodObject<{
        tier: z.ZodNativeEnum<{
            readonly T0: 0;
            readonly T1: 1;
            readonly T2: 2;
            readonly T3: 3;
            readonly T4: 4;
            readonly T5: 5;
        }>;
        maxPropagationLatencyMs: z.ZodNumber;
        syncCheckRequired: z.ZodBoolean;
        introspectionRequired: z.ZodBoolean;
    }, "strip", z.ZodTypeAny, {
        tier?: 0 | 1 | 2 | 3 | 4 | 5;
        maxPropagationLatencyMs?: number;
        syncCheckRequired?: boolean;
        introspectionRequired?: boolean;
    }, {
        tier?: 0 | 1 | 2 | 3 | 4 | 5;
        maxPropagationLatencyMs?: number;
        syncCheckRequired?: boolean;
        introspectionRequired?: boolean;
    }>, "many">>;
    tokenLifetime: z.ZodOptional<z.ZodObject<{
        accessTokenMaxTTL: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        refreshTokenMaxTTL: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        idTokenMaxTTL: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        highValueOperationTTL: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        refreshThreshold: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
    }, "strip", z.ZodTypeAny, {
        accessTokenMaxTTL?: number;
        refreshTokenMaxTTL?: number;
        idTokenMaxTTL?: number;
        highValueOperationTTL?: number;
        refreshThreshold?: number;
    }, {
        accessTokenMaxTTL?: number;
        refreshTokenMaxTTL?: number;
        idTokenMaxTTL?: number;
        highValueOperationTTL?: number;
        refreshThreshold?: number;
    }>>;
    introspectionEndpoint: z.ZodOptional<z.ZodString>;
    skipPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    enableMetrics: z.ZodOptional<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    pairwiseDid?: {
        saltLength?: number;
        requiredForDataTypes?: ("regulated" | "sensitive" | "public" | "business" | "personal")[];
        derivationAlgorithm?: "sha256" | "hkdf";
        hkdfInfo?: string;
    };
    dpop?: {
        requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
        maxProofAge?: number;
        nonceRequired?: boolean;
        clockSkewTolerance?: number;
        allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
    };
    tee?: {
        requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
        allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
        maxAttestationAge?: number;
        expectedMeasurements?: Record<string, string>;
        attestationVerificationEndpoint?: string;
    };
    revocationSLAs?: {
        tier?: 0 | 1 | 2 | 3 | 4 | 5;
        maxPropagationLatencyMs?: number;
        syncCheckRequired?: boolean;
        introspectionRequired?: boolean;
    }[];
    tokenLifetime?: {
        accessTokenMaxTTL?: number;
        refreshTokenMaxTTL?: number;
        idTokenMaxTTL?: number;
        highValueOperationTTL?: number;
        refreshThreshold?: number;
    };
    introspectionEndpoint?: string;
    skipPaths?: string[];
    enableMetrics?: boolean;
}, {
    pairwiseDid?: {
        saltLength?: number;
        requiredForDataTypes?: ("regulated" | "sensitive" | "public" | "business" | "personal")[];
        derivationAlgorithm?: "sha256" | "hkdf";
        hkdfInfo?: string;
    };
    dpop?: {
        requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
        maxProofAge?: number;
        nonceRequired?: boolean;
        clockSkewTolerance?: number;
        allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
    };
    tee?: {
        requiredForTiers?: (0 | 1 | 2 | 3 | 4 | 5)[];
        allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
        maxAttestationAge?: number;
        expectedMeasurements?: Record<string, string>;
        attestationVerificationEndpoint?: string;
    };
    revocationSLAs?: {
        tier?: 0 | 1 | 2 | 3 | 4 | 5;
        maxPropagationLatencyMs?: number;
        syncCheckRequired?: boolean;
        introspectionRequired?: boolean;
    }[];
    tokenLifetime?: {
        accessTokenMaxTTL?: number;
        refreshTokenMaxTTL?: number;
        idTokenMaxTTL?: number;
        highValueOperationTTL?: number;
        refreshThreshold?: number;
    };
    introspectionEndpoint?: string;
    skipPaths?: string[];
    enableMetrics?: boolean;
}>;
//# sourceMappingURL=types.d.ts.map