/**
 * AAuth attestation revocation service (FU-2026-Q4-aauth-attestation-revocation).
 *
 * Provides a shared, format-aware revocation lookup for the AAuth
 * attestation pipeline. Every format-specific verifier
 * (`apple-secure-enclave`, `webauthn-packed`, `tpm2`) calls
 * {@link checkRevocation} after chain validation and before returning a
 * verified outcome. The result is one of:
 *
 *   - `good`     — no evidence of revocation; the attestation may keep
 *                  its current tier mapping.
 *   - `revoked`  — the chain (or its underlying root of trust) is
 *                  revoked. In `enforce` mode the verifier demotes the
 *                  request from `hardware` to `software`; in `log_only`
 *                  mode the result is surfaced in diagnostics only.
 *   - `unknown`  — the responder could not be reached, returned an
 *                  inconclusive answer, or the cert carries no
 *                  AIA/CDP/Apple endpoint to consult. Behaviour on
 *                  `unknown` follows
 *                  `NEOTOMA_AAUTH_REVOCATION_FAIL_OPEN` (default
 *                  `true`): when fail-open is enabled `unknown` is
 *                  treated as `good`; when disabled (and the mode is
 *                  `enforce`) it is treated as `revoked`.
 *
 * Operational modes are gated by `NEOTOMA_AAUTH_REVOCATION_MODE`:
 *
 *   - `disabled` — the service short-circuits to `{ status: "good",
 *                  source: "disabled" }` without making network calls.
 *                  Default until v0.11.0.
 *   - `log_only` — checks run; revocation status is included in the
 *                  outcome and surfaced in diagnostics, but tier
 *                  resolution is unchanged. Default in v0.11.0.
 *   - `enforce`  — checks run; `revoked` (and, when fail-open is
 *                  disabled, `unknown`) demotes `hardware` to
 *                  `software`. Default in v0.12.0.
 *
 * The service maintains an in-memory LRU cache keyed by the SHA-256
 * fingerprint of the leaf certificate. TTL defaults to 1 hour and is
 * configurable via `NEOTOMA_AAUTH_REVOCATION_CACHE_TTL_SECONDS`. Per-call
 * timeouts default to 1500ms and can be tuned with
 * `NEOTOMA_AAUTH_REVOCATION_TIMEOUT_MS`.
 *
 * Out of scope (per spec):
 *   - Persistent revocation cache across processes (in-memory only).
 *   - Active polling / pre-warming of revocation evidence.
 *   - OCSP signature pinning beyond standard responder validation.
 */
import { X509Certificate } from "node:crypto";
import type { AttestationFormat } from "./aauth_attestation_verifier.js";
/** Operational mode for the revocation service. */
export type RevocationMode = "disabled" | "log_only" | "enforce";
/** Outcome status for a single revocation lookup. */
export type RevocationStatus = "good" | "revoked" | "unknown";
/**
 * Source classifying which evidence channel produced this outcome. The
 * Inspector renders this tag alongside the status so operators can
 * triage `unknown` results without parsing raw responder responses.
 */
export type RevocationSource = "disabled" | "cache" | "apple" | "ocsp" | "crl" | "no_endpoint" | "error";
/** Structured outcome returned by {@link checkRevocation}. */
export interface RevocationOutcome {
    /** Resolved revocation status. */
    status: RevocationStatus;
    /** Channel the status came from. */
    source: RevocationSource;
    /** Optional diagnostic detail (e.g. responder URL, error category). */
    detail?: string;
    /**
     * When the result was served from cache, the original `checked_at`
     * timestamp (epoch milliseconds) of the underlying lookup. Absent on
     * fresh lookups; the call site can stamp its own `checked_at`.
     */
    cached_at?: number;
}
/**
 * Per-call context passed by each format verifier. The verifier owns
 * chain validation; the revocation service consumes the validated chain
 * (leaf-first) plus the format discriminator and consults the right
 * channel.
 */
export interface RevocationCheckContext {
    /** Validated certificate chain, leaf-first. */
    chain: X509Certificate[];
    /** Format discriminator from the parent envelope. */
    format: AttestationFormat;
    /**
     * Optional override for testing — when supplied the service uses this
     * mode instead of reading {@link readRevocationMode}. Production code
     * leaves this unset.
     */
    modeOverride?: RevocationMode;
    /**
     * Optional fetcher injection seam used by tests to avoid real network
     * traffic. Defaults to the built-in HTTP/2 fetcher.
     */
    fetcher?: RevocationFetcher;
}
/**
 * Pluggable fetcher seam. Implementations must respect the per-call
 * timeout and resolve to a structured response rather than throwing on
 * network errors so the service can record `unknown` reliably.
 */
export interface RevocationFetcher {
    fetch(input: {
        url: string;
        method: "GET" | "POST";
        body?: Buffer;
        headers?: Record<string, string>;
        timeoutMs: number;
    }): Promise<{
        ok: boolean;
        status: number;
        body: Buffer;
        error?: string;
    }>;
}
/**
 * Read and validate the revocation operational mode from the
 * environment. Unknown values fall back to `disabled` to preserve the
 * v0.10.x posture until operators opt in.
 */
export declare function readRevocationMode(env?: NodeJS.ProcessEnv): RevocationMode;
/**
 * Read the cache TTL in milliseconds. Default: 1 hour. Negative or
 * non-finite values reset to the default so a typo cannot disable the
 * cache implicitly.
 */
export declare function readCacheTtlMs(env?: NodeJS.ProcessEnv): number;
/**
 * Read the per-lookup network timeout in milliseconds. Default:
 * 1500ms. Floors at 100ms so a misconfiguration cannot effectively
 * disable the service.
 */
export declare function readTimeoutMs(env?: NodeJS.ProcessEnv): number;
/**
 * Read the fail-open flag. When `true` (default) `unknown` outcomes are
 * treated as `good` for tier-resolution purposes; when `false`,
 * `unknown` is treated as `revoked` in `enforce` mode.
 */
export declare function readFailOpen(env?: NodeJS.ProcessEnv): boolean;
/** Test helper: clear the cache between tests. Production code never calls this. */
export declare function resetRevocationCacheForTests(): void;
/**
 * Snapshot the current cache size. Exposed for tests and metrics; not
 * part of the public service contract.
 */
export declare function getRevocationCacheSizeForTests(): number;
/**
 * Top-level entry point. Idempotent and safe to call from any format
 * verifier; honours the operational mode and cache.
 */
export declare function checkRevocation(ctx: RevocationCheckContext): Promise<RevocationOutcome>;
/**
 * Default fetcher implementation. Uses `node:http2` for HTTPS and
 * falls back to `node:http` for plaintext (used in tests). All paths
 * resolve to a structured response so the caller never observes a
 * thrown error.
 */
export declare const defaultFetcher: RevocationFetcher;
//# sourceMappingURL=aauth_attestation_revocation.d.ts.map