import { VorionError } from '../common/errors.js';
import { type TEEConfig, type TEEAttestation, type TEEKeyBinding, type TEEVerificationResult, type TrustTier } from './types.js';
/**
 * TEE-specific error
 */
export declare class TEEError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * TEE attestation verification failed
 */
export declare class TEEAttestationError extends TEEError {
    code: string;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * TEE key binding error
 */
export declare class TEEKeyBindingError extends TEEError {
    code: string;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * TEE Binding Service for hardware attestation and key binding
 *
 * @example
 * ```typescript
 * const tee = new TEEBindingService({
 *   requiredForTiers: [TrustTier.T4, TrustTier.T5],
 *   allowedPlatforms: ['sgx', 'nitro'],
 *   maxAttestationAge: 86400, // 24 hours
 * });
 *
 * // Verify attestation
 * const result = await tee.verifyAttestation(attestation);
 *
 * // Bind DID key to enclave
 * const binding = await tee.bindKeyToEnclave(didKeyId, attestation);
 * ```
 */
export declare class TEEBindingService {
    private config;
    private verifiers;
    private bindings;
    /**
     * Create a new TEE binding service
     *
     * @param config - TEE configuration
     */
    constructor(config: Partial<TEEConfig>);
    /**
     * Verify a TEE attestation
     *
     * @param attestation - TEE attestation to verify
     * @returns Verification result
     */
    verifyAttestation(attestation: TEEAttestation): Promise<TEEVerificationResult>;
    /**
     * Bind a DID key to an enclave
     *
     * @param didKeyId - DID verification method ID
     * @param enclaveAttestation - TEE attestation proving enclave validity
     * @returns Key binding record
     */
    bindKeyToEnclave(didKeyId: string, enclaveAttestation: TEEAttestation): Promise<TEEKeyBinding>;
    /**
     * Verify a key binding
     *
     * @param binding - Key binding to verify
     * @returns Whether binding is valid
     */
    verifyKeyBinding(binding: TEEKeyBinding): Promise<boolean>;
    /**
     * Check if TEE binding is required for a trust tier
     *
     * @param trustTier - Trust tier to check
     * @returns Whether TEE binding is required
     */
    isRequired(trustTier: TrustTier): boolean;
    /**
     * Validate that running code matches attestation measurement
     *
     * @param expectedHash - Expected code measurement hash
     * @param attestation - TEE attestation to validate
     * @returns Whether measurement matches
     */
    validateCodeMeasurement(expectedHash: string, attestation: TEEAttestation): boolean;
    /**
     * Get a stored binding
     *
     * @param didKeyId - DID verification method ID
     * @returns Binding if exists
     */
    getBinding(didKeyId: string): TEEKeyBinding | undefined;
    /**
     * Remove a binding
     *
     * @param didKeyId - DID verification method ID
     */
    removeBinding(didKeyId: string): void;
    /**
     * Get current configuration
     */
    getConfig(): Readonly<TEEConfig>;
    /**
     * Create a binding proof
     * In a real implementation, this would be a cryptographic proof
     */
    private createBindingProof;
    /**
     * Verify a binding proof
     */
    private verifyBindingProof;
    /**
     * Get count of bindings for a platform
     */
    private getBindingCount;
}
/**
 * Create a TEE binding service with default configuration for CAR ID
 */
export declare function createTEEBindingService(config?: Partial<TEEConfig>): TEEBindingService;
//# sourceMappingURL=tee.d.ts.map