/**
 * Apple Secure Enclave attestation verifier.
 *
 * Verifies a JSON-native `cnf.attestation` envelope with
 * `format: "apple-secure-enclave"`. The statement carries a base64url DER
 * X.509 chain (leaf first) terminating at an Apple-rooted intermediate,
 * plus an ECDSA-P256 signature over `SHA-256(challenge || jkt)` produced
 * by the leaf certificate's public key (the credential key generated in
 * the Secure Enclave).
 *
 * Verification ordering follows
 * `docs/subsystems/aauth_attestation.md`:
 *
 * 1. Parse the chain and confirm the leaf carries an EC P-256 public key.
 * 2. Confirm the leaf's RFC 7638 thumbprint matches the JWT-bound
 *    `cnf.jwk` thumbprint (key_binding_failed).
 * 3. Walk the chain (`X509Certificate#verify(issuerKey)`) up to a CA in
 *    the merged trust config; reject otherwise (chain_invalid).
 * 4. Verify the ECDSA signature over `SHA-256(challenge || jkt)` using
 *    the leaf's public key (signature_invalid).
 *
 * Revocation / OCSP is intentionally out of scope for v0.8.0; operators
 * rotate keys to expire trust.
 */
import type { AttestationContext, AttestationOutcome } from "./aauth_attestation_verifier.js";
/**
 * Validate the Apple SE envelope. Returns a structured outcome rather
 * than throwing so the AAuth middleware can record the reason on the
 * decision diagnostic block.
 */
export declare function verifyAppleSecureEnclaveAttestation(envelope: {
    statement: unknown;
    challenge: string;
    format: string;
}, ctx: AttestationContext): Promise<AttestationOutcome>;
//# sourceMappingURL=aauth_attestation_apple_se.d.ts.map