/**
 * Security Service - Main Coordinator
 *
 * Orchestrates all CAR security hardening components:
 * - DPoP proof validation
 * - TEE attestation verification
 * - Pairwise DID management
 * - Revocation enforcement
 * - Token lifetime validation
 * - Introspection for high-value operations
 *
 * Provides unified security context validation and pre-request checks
 * based on trust tier requirements.
 *
 * Security Conformance Levels:
 * - SH-1 (Basic): DPoP, short-lived tokens (T2)
 * - SH-2 (Standard): SH-1 + pairwise DIDs, recursive revocation (T3)
 * - SH-3 (Hardened): SH-2 + TEE binding, sync revocation checks (T4-T5)
 *
 * @packageDocumentation
 */
import { VorionError } from '../common/errors.js';
import { type SecurityContext, type SecurityValidationResult, type PreRequestResult, type HighValueCheckResult, type SecurityRequirements, type TrustTier, type IncomingRequest, type AgentIdentity, type ActionRequest } from './types.js';
import { DPoPService, createDPoPService } from './dpop.js';
import { TEEBindingService, createTEEBindingService } from './tee.js';
import { PairwiseDIDService, createPairwiseDIDService } from './pairwise-did.js';
import { RevocationService, createRevocationService } from './revocation.js';
import { TokenLifetimeService, createTokenLifetimeService } from './token-lifetime.js';
import { TokenIntrospectionService } from './introspection.js';
/**
 * Security validation error
 */
export declare class SecurityValidationError extends VorionError {
    readonly errors: {
        code: string;
        message: string;
        component: string;
    }[];
    code: string;
    statusCode: number;
    constructor(message: string, errors: {
        code: string;
        message: string;
        component: string;
    }[]);
}
/**
 * Security Service - Main coordinator for CAR security hardening
 *
 * @example
 * ```typescript
 * const security = new SecurityService(
 *   dpopService,
 *   teeService,
 *   pairwiseDIDService,
 *   revocationService,
 *   tokenLifetimeService,
 *   introspectionService
 * );
 *
 * // Validate complete security context
 * const result = await security.validateSecurityContext(context);
 *
 * // Pre-request security check
 * const preResult = await security.preRequestCheck(request);
 *
 * // High-value operation check
 * const highValueResult = await security.highValueOperationCheck(operation, agent);
 * ```
 */
export declare class SecurityService {
    private dpop;
    private tee;
    private pairwiseDID;
    private revocation;
    private tokenLifetime;
    private introspection;
    /**
     * Create a new security service
     *
     * @param dpop - DPoP service
     * @param tee - TEE binding service
     * @param pairwiseDID - Pairwise DID service
     * @param revocation - Revocation service
     * @param tokenLifetime - Token lifetime service
     * @param introspection - Token introspection service
     */
    constructor(dpop: DPoPService, tee: TEEBindingService, pairwiseDID: PairwiseDIDService, revocation: RevocationService, tokenLifetime: TokenLifetimeService, introspection: TokenIntrospectionService);
    /**
     * Validate complete security context
     *
     * Performs comprehensive validation based on trust tier requirements:
     * - Token lifetime validation
     * - Revocation status check
     * - DPoP proof validation (T2+)
     * - TEE attestation validation (T4+)
     * - Pairwise DID validation (T3+ with sensitive data)
     *
     * @param context - Security context to validate
     * @returns Validation result
     */
    validateSecurityContext(context: SecurityContext): Promise<SecurityValidationResult>;
    /**
     * Pre-request security check
     *
     * Lightweight check to determine if a request can proceed
     * and what security requirements apply.
     *
     * @param request - Incoming request
     * @returns Pre-request check result
     */
    preRequestCheck(request: IncomingRequest): Promise<PreRequestResult>;
    /**
     * High-value operation check
     *
     * Performs enhanced security checks for high-value operations:
     * - Token introspection (sync)
     * - Synchronous revocation check
     * - Short token TTL validation
     *
     * @param operation - Action request
     * @param agent - Agent identity
     * @returns High-value check result
     */
    highValueOperationCheck(operation: ActionRequest, agent: AgentIdentity): Promise<HighValueCheckResult>;
    /**
     * Get security requirements for a trust tier
     *
     * @param tier - Trust tier
     * @returns Security requirements
     */
    getRequirements(tier: TrustTier): SecurityRequirements;
    /**
     * Get the DPoP service
     */
    getDPoPService(): DPoPService;
    /**
     * Get the TEE binding service
     */
    getTEEBindingService(): TEEBindingService;
    /**
     * Get the pairwise DID service
     */
    getPairwiseDIDService(): PairwiseDIDService;
    /**
     * Get the revocation service
     */
    getRevocationService(): RevocationService;
    /**
     * Get the token lifetime service
     */
    getTokenLifetimeService(): TokenLifetimeService;
    /**
     * Get the introspection service
     */
    getIntrospectionService(): TokenIntrospectionService;
    /**
     * Build validation result
     */
    private buildValidationResult;
    /**
     * Extract token payload from JWT
     */
    private extractTokenPayload;
    /**
     * Extract trust tier from request (simplified)
     */
    private extractTierFromRequest;
    /**
     * Destroy the service and cleanup all resources.
     * This stops all cleanup intervals and clears caches.
     */
    destroy(): void;
}
/**
 * Create a security service with default configuration
 */
export declare function createSecurityService(options?: {
    introspectionEndpoint?: string;
    dpopConfig?: Parameters<typeof createDPoPService>[0];
    teeConfig?: Parameters<typeof createTEEBindingService>[0];
    pairwiseDIDConfig?: Parameters<typeof createPairwiseDIDService>[0];
    revocationConfig?: Parameters<typeof createRevocationService>[0];
    tokenLifetimeConfig?: Parameters<typeof createTokenLifetimeService>[0];
}): SecurityService;
//# sourceMappingURL=security-service.d.ts.map