/**
 * AAuth attestation trust configuration loader.
 *
 * Builds the merged trust set used by attestation verifiers:
 *
 * - Always includes the bundled Apple Attestation Root at
 *   `config/aauth/apple_attestation_root.pem` (under the repository
 *   root, resolved relative to the running process).
 * - Optionally appends operator-supplied CAs from
 *   `NEOTOMA_AAUTH_ATTESTATION_CA_PATH` (path to a single PEM file or a
 *   directory of PEM files).
 * - Optionally exposes a WebAuthn AAGUID allowlist from
 *   `NEOTOMA_AAUTH_AAGUID_TRUST_LIST_PATH` so the file format is stable
 *   even though the WebAuthn verifier is currently a stub.
 *
 * Fail-open semantics: missing or malformed operator inputs log a single
 * warning and continue with whatever was already loaded. Operators must
 * never lock themselves out of plain-signed writes by misconfiguring
 * trust — verifier failure simply falls through to the lower tier.
 */
import { X509Certificate } from "node:crypto";
export interface AttestationTrustConfig {
    /** Trusted attestation roots, leaf-equivalence checked by SHA-256. */
    attestationRoots: X509Certificate[];
    /** Optional WebAuthn AAGUID allowlist. Empty array means no restriction. */
    webauthnAaguidAllowlist: string[];
    /** Diagnostic notes accumulated during load (used for log lines). */
    diagnostics: string[];
}
/**
 * Public entry point. Computes the trust config once per process and
 * caches the result; pass `{ refresh: true }` from tests to rebuild.
 */
export declare function loadAttestationTrustConfig(options?: {
    refresh?: boolean;
}): AttestationTrustConfig;
/**
 * Test helper: clear the cached config so the next call re-reads env
 * and disk inputs. Production code never calls this.
 */
export declare function resetAttestationTrustConfigCacheForTests(): void;
//# sourceMappingURL=aauth_attestation_trust_config.d.ts.map