/**
 * TEE Production Attestation Verifiers
 *
 * Production-grade attestation verification for:
 * - Intel SGX (DCAP/ECDSA attestation)
 * - AWS Nitro Enclaves (COSE_Sign1 signature verification)
 * - AMD SEV-SNP (VCEK certificate chain)
 *
 * Each verifier performs two levels of validation:
 *
 * 1. **Structural validation** (always performed): Parses the binary attestation
 *    format, validates headers and version fields, extracts measurement hashes,
 *    and checks internal consistency. This catches malformed, truncated, or
 *    fabricated data without any network access.
 *
 * 2. **Cryptographic chain verification** (production mode): When enabled via config,
 *    verifies the attestation signature chain against the manufacturer's root of trust.
 *    This requires network access to external services:
 *    - SGX: Intel PCCS (Provisioning Certificate Caching Service) for TCB info + QE identity
 *    - Nitro: AWS Nitro root CA certificate chain verification
 *    - SEV-SNP: AMD KDS (Key Distribution Service) for VCEK -> ASK -> ARK chain
 *
 *    These external services are architectural boundaries. The verification code in this
 *    file handles the protocol and request format. The actual cryptographic operations
 *    (ECDSA signature verification, X.509 certificate chain validation) require a crypto
 *    library with certificate parsing support (e.g., node:crypto X509Certificate APIs).
 *
 * @packageDocumentation
 */
import { type TEEAttestation, type TEEVerificationResult } from './types.js';
/**
 * Production attestation configuration
 */
export interface ProductionAttestationConfig {
    /** Enable production verification (requires network access for crypto chain verification) */
    productionMode: boolean;
    /** Intel SGX configuration */
    sgx?: {
        /** PCCS (Provisioning Certificate Caching Service) URL for DCAP collateral retrieval */
        pccsUrl?: string;
        /** Use Intel Attestation Service (IAS) for EPID (legacy v2 quotes) */
        useIAS?: boolean;
        /** IAS API key (for EPID). Required if useIAS is true. */
        iasApiKey?: string;
        /** Trusted TCB Info JSON (for offline TCB level verification) */
        trustedTcbInfo?: string;
    };
    /** AWS Nitro configuration */
    nitro?: {
        /** Override AWS Nitro root certificate (PEM). Uses embedded root cert if not provided. */
        rootCertificate?: string;
        /** Expected PCR0 values by enclave ID for allowlist enforcement */
        expectedPcr0?: Record<string, string>;
    };
    /** AMD SEV-SNP configuration */
    sev?: {
        /** AMD SEV Signing Key certificate (ASK) in PEM format */
        askCertificate?: string;
        /** AMD Root Key certificate (ARK) in PEM format */
        arkCertificate?: string;
        /** AMD KDS URL for VCEK certificate retrieval. Default: https://kdsintf.amd.com */
        kdsUrl?: string;
    };
    /** Network timeout in milliseconds for external service calls */
    networkTimeoutMs?: number;
    /** Allow fallback to structural-only validation if cryptographic chain verification fails
     * due to network errors. When false, network failures cause verification to fail. */
    allowStructuralFallback?: boolean;
}
/**
 * Production SGX DCAP verifier
 *
 * Performs:
 * 1. Full binary parsing of the SGX Quote v2/v3 format
 * 2. Version and attestation key type validation
 * 3. QE Vendor ID validation for DCAP quotes (must match Intel GUID)
 * 4. MRENCLAVE and MRSIGNER extraction and cross-checking
 * 5. Signature data length validation
 * 6. (Production mode) PCCS collateral retrieval for TCB level + QE identity verification
 *
 * The PCCS call verifies the TCB level of the SGX platform using Intel's Provisioning
 * Certificate Caching Service. The ECDSA signature verification of the quote itself
 * requires the Intel DCAP Quote Verification Library, which is a native C library.
 * This is an architectural boundary: we fetch collateral and validate the response,
 * but the actual ECDSA P-256 signature verification over the quote body requires
 * linking the Intel QVL or implementing ECDSA verification with the attestation key
 * from the certification data.
 */
export declare function verifySGXProduction(attestation: TEEAttestation, config: ProductionAttestationConfig): Promise<TEEVerificationResult>;
/**
 * Production Nitro attestation verifier
 *
 * Performs:
 * 1. COSE_Sign1 envelope structural validation (CBOR tag 18 + 4-element array)
 * 2. Attestation document size validation (minimum realistic size)
 * 3. Required PCR validation (PCR0, PCR1, PCR2 as SHA-384 = 96 hex chars)
 * 4. PCR0 zero-check (all-zero PCR0 means no enclave image loaded)
 * 5. PCR0 cross-check against declared measurementHash
 * 6. PCR0 allowlist enforcement via config.nitro.expectedPcr0
 * 7. (Production mode) Certificate chain validation against AWS Nitro root CA
 *
 * Full COSE_Sign1 ECDSA-384 signature verification requires a COSE library (e.g., cose-js)
 * and X.509 certificate chain verification requires a crypto library with cert parsing.
 * These are architectural boundaries: we validate the envelope structure and PCR values,
 * and in production mode we validate the certificate chain structure.
 */
export declare function verifyNitroProduction(attestation: TEEAttestation, config: ProductionAttestationConfig): Promise<TEEVerificationResult>;
/**
 * Production SEV-SNP attestation verifier
 *
 * Performs:
 * 1. Full binary parsing of the 1184-byte SEV-SNP attestation report
 * 2. Version validation (must be 2 for SEV-SNP)
 * 3. Signature algorithm validation (must be 1 = ECDSA P-384 with SHA-384)
 * 4. MEASUREMENT extraction (bytes 144-192) and zero-check
 * 5. Guest policy analysis (debug bit detection)
 * 6. VMPL validation (must be 0-3)
 * 7. Cross-check measurement against declared measurementHash
 * 8. (Production mode) VCEK certificate chain verification via AMD KDS
 *
 * Full ECDSA P-384 signature verification of the report requires:
 * 1. Fetching the VCEK certificate from AMD KDS using the chip ID and TCB values
 * 2. Verifying VCEK is signed by ASK (AMD SEV Signing Key)
 * 3. Verifying ASK is signed by ARK (AMD Root Key)
 * 4. Using VCEK's public key to verify the report signature (bytes 768-1183)
 * This chain verification requires the AMD SEV Tool or equivalent PKI library.
 * It is an architectural boundary.
 */
export declare function verifySEVProduction(attestation: TEEAttestation, config: ProductionAttestationConfig): Promise<TEEVerificationResult>;
/**
 * Production attestation verifier that routes to platform-specific verifiers.
 *
 * For SGX, Nitro, and SEV-SNP: performs full structural + optional crypto verification.
 * For TrustZone and Secure Enclave: these platforms lack standardized remote attestation
 * services, so the production verifier defers to the structural verifiers in tee.ts.
 */
export declare class ProductionAttestationVerifier {
    private config;
    constructor(config?: Partial<ProductionAttestationConfig>);
    /**
     * Verify attestation using production verification when available
     */
    verify(attestation: TEEAttestation): Promise<TEEVerificationResult>;
    /**
     * Check if production mode is enabled
     */
    isProductionMode(): boolean;
    /**
     * Update configuration at runtime
     */
    updateConfig(config: Partial<ProductionAttestationConfig>): void;
}
/**
 * Create a production attestation verifier
 */
export declare function createProductionVerifier(config?: Partial<ProductionAttestationConfig>): ProductionAttestationVerifier;
//# sourceMappingURL=tee-production.d.ts.map