/**
 * TEE (Trusted Execution Environment) Binding Service
 *
 * Implements hardware-bound key attestation for CAR security hardening (SH-3).
 * TEE binding ensures that:
 * 1. Agent keys are generated inside a secure enclave
 * 2. The DID is bound to the enclave's measurement
 * 3. At runtime, the expected code is provably executing
 *
 * Supported platforms:
 * - Intel SGX (DCAP/EPID attestation)
 * - AWS Nitro Enclaves
 * - AMD SEV-SNP
 * - ARM TrustZone
 * - Apple Secure Enclave
 *
 * Verification modes:
 *   - Structural validation (default): real parsing of binary attestation formats,
 *     header validation, measurement extraction, cross-checking. No network access needed.
 *   - Production verification: delegates to tee-production.ts which additionally performs
 *     cryptographic verification against manufacturer root certificates. Requires network
 *     access and external SDK configuration.
 *
 * @packageDocumentation
 */
import { VorionError } from '../common/errors.js';
import { type TEEConfig, type TEEAttestation, type TEEKeyBinding, type TEEVerificationResult, type TrustTier } from './types.js';
import { type ProductionAttestationConfig } from './tee-production.js';
/**
 * TEE-specific error
 */
export declare class TEEError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * TEE attestation verification failed
 */
export declare class TEEAttestationError extends TEEError {
    code: string;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * TEE key binding error
 */
export declare class TEEKeyBindingError extends TEEError {
    code: string;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Extended TEE configuration that supports production-mode delegation
 */
export interface TEEBindingServiceConfig extends TEEConfig {
    /** When set, delegates verification to the ProductionAttestationVerifier
     * for platforms it supports (SGX, Nitro, SEV-SNP), adding full cryptographic
     * signature chain verification on top of structural validation. */
    productionConfig?: ProductionAttestationConfig;
}
/**
 * TEE Binding Service for hardware attestation and key binding
 *
 * Performs real structural validation of attestation data by default.
 * When productionConfig is provided, delegates to the ProductionAttestationVerifier
 * for full cryptographic verification against manufacturer root certificates.
 *
 * @example
 * ```typescript
 * // Structural validation only
 * const tee = new TEEBindingService({
 *   requiredForTiers: [TrustTier.T4, TrustTier.T5],
 *   allowedPlatforms: ['sgx', 'nitro'],
 *   maxAttestationAge: 86400,
 * });
 *
 * // With production crypto verification
 * const teeProd = new TEEBindingService({
 *   requiredForTiers: [TrustTier.T4, TrustTier.T5],
 *   allowedPlatforms: ['sgx', 'nitro'],
 *   maxAttestationAge: 86400,
 *   productionConfig: { productionMode: true, sgx: { pccsUrl: '...' } },
 * });
 *
 * const result = await tee.verifyAttestation(attestation);
 * const binding = await tee.bindKeyToEnclave(didKeyId, attestation);
 * ```
 */
export declare class TEEBindingService {
    private config;
    private verifiers;
    private bindings;
    private productionVerifier;
    /**
     * Create a new TEE binding service
     *
     * @param config - TEE configuration, optionally with productionConfig
     */
    constructor(config: Partial<TEEBindingServiceConfig>);
    /**
     * Verify a TEE attestation
     *
     * When a production verifier is configured, it is used for SGX/Nitro/SEV
     * platforms. The production verifier performs its own structural validation
     * plus cryptographic signature chain verification.
     *
     * Otherwise, the built-in structural verifiers are used. These parse binary
     * formats, validate headers, extract measurements, and cross-check consistency
     * without requiring network access.
     *
     * @param attestation - TEE attestation to verify
     * @returns Verification result
     */
    verifyAttestation(attestation: TEEAttestation): Promise<TEEVerificationResult>;
    /**
     * Bind a DID key to an enclave
     *
     * @param didKeyId - DID verification method ID
     * @param enclaveAttestation - TEE attestation proving enclave validity
     * @returns Key binding record
     */
    bindKeyToEnclave(didKeyId: string, enclaveAttestation: TEEAttestation): Promise<TEEKeyBinding>;
    /**
     * Verify a key binding
     *
     * @param binding - Key binding to verify
     * @returns Whether binding is valid
     */
    verifyKeyBinding(binding: TEEKeyBinding): Promise<boolean>;
    /**
     * Check if TEE binding is required for a trust tier
     *
     * @param trustTier - Trust tier to check
     * @returns Whether TEE binding is required
     */
    isRequired(trustTier: TrustTier): boolean;
    /**
     * Validate that running code matches attestation measurement
     *
     * @param expectedHash - Expected code measurement hash
     * @param attestation - TEE attestation to validate
     * @returns Whether measurement matches
     */
    validateCodeMeasurement(expectedHash: string, attestation: TEEAttestation): boolean;
    /**
     * Get a stored binding
     *
     * @param didKeyId - DID verification method ID
     * @returns Binding if exists
     */
    getBinding(didKeyId: string): TEEKeyBinding | undefined;
    /**
     * Remove a binding
     *
     * @param didKeyId - DID verification method ID
     */
    removeBinding(didKeyId: string): void;
    /**
     * Get current configuration
     */
    getConfig(): Readonly<TEEConfig>;
    /**
     * Check whether production verification is active
     */
    isProductionMode(): boolean;
    /**
     * Create a binding proof using SHA-256 hash of binding context
     */
    private createBindingProof;
    /**
     * Verify a binding proof exists and has valid format
     */
    private verifyBindingProof;
    /**
     * Get count of bindings for a platform
     */
    private getBindingCount;
}
/**
 * Create a TEE binding service with default configuration for CAR
 */
export declare function createTEEBindingService(config?: Partial<TEEBindingServiceConfig>): TEEBindingService;
//# sourceMappingURL=tee.d.ts.map