@vorionsys/security 1.0.0

package/dist/security/types.d.ts

@@ -0,0 +1,1796 @@
+/**
+ * Security Hardening Types
+ *
+ * Type definitions for CAR ID security hardening controls including:
+ * - DPoP (Demonstrating Proof-of-Possession)
+ * - TEE (Trusted Execution Environment) binding
+ * - Pairwise DID configuration
+ * - Revocation SLA configuration
+ * - Token lifetime configuration
+ *
+ * Based on CAR ID Security Hardening Specification v1.0.0
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+/**
+ * Trust tiers as defined in CAR ID specification
+ * Maps to security conformance levels:
+ * - T0-T1: No minimum security (not recommended)
+ * - T2: SH-1 (Basic) - DPoP, short-lived tokens
+ * - T3: SH-2 (Standard) - SH-1 + pairwise DIDs, recursive revocation
+ * - T4-T5: SH-3 (Hardened) - SH-2 + TEE binding, sync revocation checks
+ */
+export declare const TrustTier: {
+    readonly T0: 0;
+    readonly T1: 1;
+    readonly T2: 2;
+    readonly T3: 3;
+    readonly T4: 4;
+    readonly T5: 5;
+    readonly T6: 6;
+    readonly T7: 7;
+};
+export type TrustTier = (typeof TrustTier)[keyof typeof TrustTier];
+export declare const trustTierSchema: z.ZodNativeEnum<{
+    readonly T0: 0;
+    readonly T1: 1;
+    readonly T2: 2;
+    readonly T3: 3;
+    readonly T4: 4;
+    readonly T5: 5;
+    readonly T6: 6;
+    readonly T7: 7;
+}>;
+/**
+ * Security conformance levels
+ */
+export declare const SecurityConformanceLevel: {
+    readonly NONE: "none";
+    readonly SH1_BASIC: "sh-1";
+    readonly SH2_STANDARD: "sh-2";
+    readonly SH3_HARDENED: "sh-3";
+};
+export type SecurityConformanceLevel = (typeof SecurityConformanceLevel)[keyof typeof SecurityConformanceLevel];
+export declare const securityConformanceLevelSchema: z.ZodNativeEnum<{
+    readonly NONE: "none";
+    readonly SH1_BASIC: "sh-1";
+    readonly SH2_STANDARD: "sh-2";
+    readonly SH3_HARDENED: "sh-3";
+}>;
+/**
+ * DPoP proof JWT payload structure per RFC 9449
+ */
+export interface DPoPProof {
+    /** Unique token ID (MUST be unique, servers MUST reject replays) */
+    jti: string;
+    /** HTTP method (e.g., 'GET', 'POST') */
+    htm: string;
+    /** HTTP URI (the target endpoint) */
+    htu: string;
+    /** Issued at timestamp (Unix seconds) */
+    iat: number;
+    /** Access token hash (for bound tokens, sha256 of access token) */
+    ath?: string;
+}
+export declare const dpopProofSchema: z.ZodObject<{
+    jti: z.ZodString;
+    htm: z.ZodString;
+    htu: z.ZodString;
+    iat: z.ZodNumber;
+    ath: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    iat?: number;
+    jti?: string;
+    htm?: string;
+    htu?: string;
+    ath?: string;
+}, {
+    iat?: number;
+    jti?: string;
+    htm?: string;
+    htu?: string;
+    ath?: string;
+}>;
+/**
+ * DPoP proof header structure
+ */
+export interface DPoPHeader {
+    /** Type is always 'dpop+jwt' */
+    typ: 'dpop+jwt';
+    /** Algorithm (ES256 required, ES384/ES512 recommended) */
+    alg: 'ES256' | 'ES384' | 'ES512';
+    /** JWK public key */
+    jwk: JsonWebKey;
+}
+export declare const dpopHeaderSchema: z.ZodObject<{
+    typ: z.ZodLiteral<"dpop+jwt">;
+    alg: z.ZodEnum<["ES256", "ES384", "ES512"]>;
+    jwk: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    jwk?: Record<string, unknown>;
+    typ?: "dpop+jwt";
+    alg?: "ES256" | "ES384" | "ES512";
+}, {
+    jwk?: Record<string, unknown>;
+    typ?: "dpop+jwt";
+    alg?: "ES256" | "ES384" | "ES512";
+}>;
+/**
+ * DPoP configuration
+ */
+export interface DPoPConfig {
+    /** Which trust tiers require DPoP (default: T2+) */
+    requiredForTiers: TrustTier[];
+    /** Maximum proof age in seconds (default: 60) */
+    maxProofAge: number;
+    /** Whether nonce is required from server */
+    nonceRequired: boolean;
+    /** Maximum clock skew tolerance in seconds (default: 5) */
+    clockSkewTolerance: number;
+    /** Supported algorithms */
+    allowedAlgorithms: ('ES256' | 'ES384' | 'ES512')[];
+}
+export declare const dpopConfigSchema: z.ZodObject<{
+    requiredForTiers: z.ZodArray<z.ZodNativeEnum<{
+        readonly T0: 0;
+        readonly T1: 1;
+        readonly T2: 2;
+        readonly T3: 3;
+        readonly T4: 4;
+        readonly T5: 5;
+        readonly T6: 6;
+        readonly T7: 7;
+    }>, "many">;
+    maxProofAge: z.ZodDefault<z.ZodNumber>;
+    nonceRequired: z.ZodDefault<z.ZodBoolean>;
+    clockSkewTolerance: z.ZodDefault<z.ZodNumber>;
+    allowedAlgorithms: z.ZodDefault<z.ZodArray<z.ZodEnum<["ES256", "ES384", "ES512"]>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
+    clockSkewTolerance?: number;
+    maxProofAge?: number;
+    requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+    nonceRequired?: boolean;
+}, {
+    allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
+    clockSkewTolerance?: number;
+    maxProofAge?: number;
+    requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+    nonceRequired?: boolean;
+}>;
+/**
+ * DPoP verification result
+ */
+export interface DPoPVerificationResult {
+    /** Whether verification succeeded */
+    valid: boolean;
+    /** JWK thumbprint of the proof key */
+    keyThumbprint?: string;
+    /** Error reason if verification failed */
+    error?: string;
+    /** Error code for programmatic handling */
+    errorCode?: 'INVALID_SIGNATURE' | 'EXPIRED' | 'REPLAY' | 'METHOD_MISMATCH' | 'URI_MISMATCH' | 'INVALID_FORMAT';
+    /** Verified at timestamp */
+    verifiedAt: string;
+}
+export declare const dpopVerificationResultSchema: z.ZodObject<{
+    valid: z.ZodBoolean;
+    keyThumbprint: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+    errorCode: z.ZodOptional<z.ZodEnum<["INVALID_SIGNATURE", "EXPIRED", "REPLAY", "METHOD_MISMATCH", "URI_MISMATCH", "INVALID_FORMAT"]>>;
+    verifiedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    valid?: boolean;
+    error?: string;
+    errorCode?: "EXPIRED" | "INVALID_SIGNATURE" | "INVALID_FORMAT" | "REPLAY" | "METHOD_MISMATCH" | "URI_MISMATCH";
+    keyThumbprint?: string;
+    verifiedAt?: string;
+}, {
+    valid?: boolean;
+    error?: string;
+    errorCode?: "EXPIRED" | "INVALID_SIGNATURE" | "INVALID_FORMAT" | "REPLAY" | "METHOD_MISMATCH" | "URI_MISMATCH";
+    keyThumbprint?: string;
+    verifiedAt?: string;
+}>;
+/**
+ * Supported TEE platforms
+ */
+export declare const TEEPlatform: {
+    readonly SGX: "sgx";
+    readonly NITRO: "nitro";
+    readonly SEV: "sev";
+    readonly TRUSTZONE: "trustzone";
+    readonly SECURE_ENCLAVE: "secure-enclave";
+};
+export type TEEPlatform = (typeof TEEPlatform)[keyof typeof TEEPlatform];
+export declare const teePlatformSchema: z.ZodNativeEnum<{
+    readonly SGX: "sgx";
+    readonly NITRO: "nitro";
+    readonly SEV: "sev";
+    readonly TRUSTZONE: "trustzone";
+    readonly SECURE_ENCLAVE: "secure-enclave";
+}>;
+/**
+ * TEE attestation document
+ */
+export interface TEEAttestation {
+    /** TEE platform type */
+    platform: TEEPlatform;
+    /** Hash of running code (measurement) */
+    measurementHash: string;
+    /** Attestation timestamp */
+    timestamp: Date;
+    /** Enclave identifier */
+    enclaveId: string;
+    /** Platform Configuration Registers (for SGX/Nitro) */
+    pcrs?: Record<string, string>;
+    /** Attestation document signature */
+    signature?: string;
+    /** Certificate chain for verification */
+    certificateChain?: string[];
+    /** Attestation service endpoint */
+    attestationEndpoint?: string;
+    /** Validity period end */
+    validUntil?: Date;
+}
+export declare const teeAttestationSchema: z.ZodObject<{
+    platform: z.ZodNativeEnum<{
+        readonly SGX: "sgx";
+        readonly NITRO: "nitro";
+        readonly SEV: "sev";
+        readonly TRUSTZONE: "trustzone";
+        readonly SECURE_ENCLAVE: "secure-enclave";
+    }>;
+    measurementHash: z.ZodString;
+    timestamp: z.ZodDate;
+    enclaveId: z.ZodString;
+    pcrs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    signature: z.ZodOptional<z.ZodString>;
+    certificateChain: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    attestationEndpoint: z.ZodOptional<z.ZodString>;
+    validUntil: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
+    timestamp?: Date;
+    signature?: string;
+    validUntil?: Date;
+    measurementHash?: string;
+    enclaveId?: string;
+    pcrs?: Record<string, string>;
+    certificateChain?: string[];
+    attestationEndpoint?: string;
+}, {
+    platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
+    timestamp?: Date;
+    signature?: string;
+    validUntil?: Date;
+    measurementHash?: string;
+    enclaveId?: string;
+    pcrs?: Record<string, string>;
+    certificateChain?: string[];
+    attestationEndpoint?: string;
+}>;
+/**
+ * TEE key binding - binds a DID key to an enclave
+ */
+export interface TEEKeyBinding {
+    /** DID verification method ID */
+    didKeyId: string;
+    /** Enclave key identifier */
+    enclaveKeyId: string;
+    /** Cryptographic binding proof */
+    bindingProof: string;
+    /** When the binding was created */
+    boundAt: Date;
+    /** Binding validity period */
+    validUntil?: Date;
+}
+export declare const teeKeyBindingSchema: z.ZodObject<{
+    didKeyId: z.ZodString;
+    enclaveKeyId: z.ZodString;
+    bindingProof: z.ZodString;
+    boundAt: z.ZodDate;
+    validUntil: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    validUntil?: Date;
+    didKeyId?: string;
+    enclaveKeyId?: string;
+    bindingProof?: string;
+    boundAt?: Date;
+}, {
+    validUntil?: Date;
+    didKeyId?: string;
+    enclaveKeyId?: string;
+    bindingProof?: string;
+    boundAt?: Date;
+}>;
+/**
+ * TEE configuration
+ */
+export interface TEEConfig {
+    /** Which trust tiers require TEE (default: T4+) */
+    requiredForTiers: TrustTier[];
+    /** Allowed TEE platforms */
+    allowedPlatforms: TEEPlatform[];
+    /** Maximum attestation age before re-attestation required (seconds) */
+    maxAttestationAge: number;
+    /** Expected code measurements for verification */
+    expectedMeasurements?: Record<string, string>;
+    /** Attestation verification endpoint */
+    attestationVerificationEndpoint?: string;
+}
+export declare const teeConfigSchema: z.ZodObject<{
+    requiredForTiers: z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
+        readonly T0: 0;
+        readonly T1: 1;
+        readonly T2: 2;
+        readonly T3: 3;
+        readonly T4: 4;
+        readonly T5: 5;
+        readonly T6: 6;
+        readonly T7: 7;
+    }>, "many">>;
+    allowedPlatforms: z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
+        readonly SGX: "sgx";
+        readonly NITRO: "nitro";
+        readonly SEV: "sev";
+        readonly TRUSTZONE: "trustzone";
+        readonly SECURE_ENCLAVE: "secure-enclave";
+    }>, "many">>;
+    maxAttestationAge: z.ZodDefault<z.ZodNumber>;
+    expectedMeasurements: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    attestationVerificationEndpoint: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+    allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
+    maxAttestationAge?: number;
+    expectedMeasurements?: Record<string, string>;
+    attestationVerificationEndpoint?: string;
+}, {
+    requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+    allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
+    maxAttestationAge?: number;
+    expectedMeasurements?: Record<string, string>;
+    attestationVerificationEndpoint?: string;
+}>;
+/**
+ * TEE verification result
+ */
+export interface TEEVerificationResult {
+    /** Whether verification succeeded */
+    valid: boolean;
+    /** Verification error reason */
+    reason?: string;
+    /** Platform that was verified */
+    platform?: TEEPlatform;
+    /** Verified measurement hash */
+    measurementHash?: string;
+    /** Verification timestamp */
+    verifiedAt: string;
+}
+export declare const teeVerificationResultSchema: z.ZodObject<{
+    valid: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+    platform: z.ZodOptional<z.ZodNativeEnum<{
+        readonly SGX: "sgx";
+        readonly NITRO: "nitro";
+        readonly SEV: "sev";
+        readonly TRUSTZONE: "trustzone";
+        readonly SECURE_ENCLAVE: "secure-enclave";
+    }>>;
+    measurementHash: z.ZodOptional<z.ZodString>;
+    verifiedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    valid?: boolean;
+    platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
+    reason?: string;
+    verifiedAt?: string;
+    measurementHash?: string;
+}, {
+    valid?: boolean;
+    platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
+    reason?: string;
+    verifiedAt?: string;
+    measurementHash?: string;
+}>;
+/**
+ * Data types that may require pairwise DIDs
+ */
+export declare const DataClassification: {
+    readonly PUBLIC: "public";
+    readonly BUSINESS: "business";
+    readonly PERSONAL: "personal";
+    readonly SENSITIVE: "sensitive";
+    readonly REGULATED: "regulated";
+};
+export type DataClassification = (typeof DataClassification)[keyof typeof DataClassification];
+export declare const dataClassificationSchema: z.ZodNativeEnum<{
+    readonly PUBLIC: "public";
+    readonly BUSINESS: "business";
+    readonly PERSONAL: "personal";
+    readonly SENSITIVE: "sensitive";
+    readonly REGULATED: "regulated";
+}>;
+/**
+ * Pairwise DID derivation algorithm
+ */
+export declare const PairwiseDerivationAlgorithm: {
+    readonly SHA256: "sha256";
+    readonly HKDF: "hkdf";
+};
+export type PairwiseDerivationAlgorithm = (typeof PairwiseDerivationAlgorithm)[keyof typeof PairwiseDerivationAlgorithm];
+export declare const pairwiseDerivationAlgorithmSchema: z.ZodNativeEnum<{
+    readonly SHA256: "sha256";
+    readonly HKDF: "hkdf";
+}>;
+/**
+ * Pairwise DID configuration
+ */
+export interface PairwiseDIDConfig {
+    /** Data types that require pairwise DIDs */
+    requiredForDataTypes: DataClassification[];
+    /** Derivation algorithm */
+    derivationAlgorithm: PairwiseDerivationAlgorithm;
+    /** Salt length in bytes */
+    saltLength: number;
+    /** Info string for HKDF derivation */
+    hkdfInfo?: string;
+}
+export declare const pairwiseDIDConfigSchema: z.ZodObject<{
+    requiredForDataTypes: z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
+        readonly PUBLIC: "public";
+        readonly BUSINESS: "business";
+        readonly PERSONAL: "personal";
+        readonly SENSITIVE: "sensitive";
+        readonly REGULATED: "regulated";
+    }>, "many">>;
+    derivationAlgorithm: z.ZodDefault<z.ZodNativeEnum<{
+        readonly SHA256: "sha256";
+        readonly HKDF: "hkdf";
+    }>>;
+    saltLength: z.ZodDefault<z.ZodNumber>;
+    hkdfInfo: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    requiredForDataTypes?: ("public" | "sensitive" | "regulated" | "personal" | "business")[];
+    derivationAlgorithm?: "sha256" | "hkdf";
+    saltLength?: number;
+    hkdfInfo?: string;
+}, {
+    requiredForDataTypes?: ("public" | "sensitive" | "regulated" | "personal" | "business")[];
+    derivationAlgorithm?: "sha256" | "hkdf";
+    saltLength?: number;
+    hkdfInfo?: string;
+}>;
+/**
+ * Pairwise DID derivation record
+ */
+export interface PairwiseDerivation {
+    /** Agent's root/master DID */
+    masterDid: string;
+    /** Relying party's DID */
+    relyingPartyDid: string;
+    /** Random salt for this relationship */
+    contextSalt: string;
+    /** Derived pairwise DID */
+    derivedDid: string;
+    /** When the derivation was created */
+    createdAt: Date;
+}
+export declare const pairwiseDerivationSchema: z.ZodObject<{
+    masterDid: z.ZodString;
+    relyingPartyDid: z.ZodString;
+    contextSalt: z.ZodString;
+    derivedDid: z.ZodString;
+    createdAt: z.ZodDate;
+}, "strip", z.ZodTypeAny, {
+    createdAt?: Date;
+    masterDid?: string;
+    relyingPartyDid?: string;
+    contextSalt?: string;
+    derivedDid?: string;
+}, {
+    createdAt?: Date;
+    masterDid?: string;
+    relyingPartyDid?: string;
+    contextSalt?: string;
+    derivedDid?: string;
+}>;
+/**
+ * Revocation SLA configuration per trust tier
+ */
+export interface RevocationSLA {
+    /** Trust tier this SLA applies to */
+    tier: TrustTier;
+    /** Maximum propagation latency in milliseconds */
+    maxPropagationLatencyMs: number;
+    /** Whether synchronous check is required */
+    syncCheckRequired: boolean;
+    /** Whether token introspection is required */
+    introspectionRequired: boolean;
+}
+export declare const revocationSLASchema: z.ZodObject<{
+    tier: z.ZodNativeEnum<{
+        readonly T0: 0;
+        readonly T1: 1;
+        readonly T2: 2;
+        readonly T3: 3;
+        readonly T4: 4;
+        readonly T5: 5;
+        readonly T6: 6;
+        readonly T7: 7;
+    }>;
+    maxPropagationLatencyMs: z.ZodNumber;
+    syncCheckRequired: z.ZodBoolean;
+    introspectionRequired: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+    maxPropagationLatencyMs?: number;
+    syncCheckRequired?: boolean;
+    introspectionRequired?: boolean;
+}, {
+    tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+    maxPropagationLatencyMs?: number;
+    syncCheckRequired?: boolean;
+    introspectionRequired?: boolean;
+}>;
+/**
+ * Default revocation SLAs per CAR ID spec
+ */
+export declare const DEFAULT_REVOCATION_SLAS: RevocationSLA[];
+/**
+ * Revocation propagation policy
+ */
+export interface RevocationPropagationPolicy {
+    /** Whether to terminate descendant delegations */
+    terminateDescendants: boolean;
+    /** Grace period before termination (milliseconds) */
+    gracePeriodMs: number;
+    /** Whether to notify webhooks */
+    notifyWebhooks: boolean;
+}
+export declare const revocationPropagationPolicySchema: z.ZodObject<{
+    terminateDescendants: z.ZodDefault<z.ZodBoolean>;
+    gracePeriodMs: z.ZodDefault<z.ZodNumber>;
+    notifyWebhooks: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    gracePeriodMs?: number;
+    terminateDescendants?: boolean;
+    notifyWebhooks?: boolean;
+}, {
+    gracePeriodMs?: number;
+    terminateDescendants?: boolean;
+    notifyWebhooks?: boolean;
+}>;
+/**
+ * Revocation request
+ */
+export interface RevocationPropagation {
+    /** DID of agent to revoke */
+    revokedDid: string;
+    /** Reason for revocation */
+    reason: string;
+    /** Propagation policy */
+    propagationPolicy: RevocationPropagationPolicy;
+}
+export declare const revocationPropagationSchema: z.ZodObject<{
+    revokedDid: z.ZodString;
+    reason: z.ZodString;
+    propagationPolicy: z.ZodObject<{
+        terminateDescendants: z.ZodDefault<z.ZodBoolean>;
+        gracePeriodMs: z.ZodDefault<z.ZodNumber>;
+        notifyWebhooks: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        gracePeriodMs?: number;
+        terminateDescendants?: boolean;
+        notifyWebhooks?: boolean;
+    }, {
+        gracePeriodMs?: number;
+        terminateDescendants?: boolean;
+        notifyWebhooks?: boolean;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    reason?: string;
+    revokedDid?: string;
+    propagationPolicy?: {
+        gracePeriodMs?: number;
+        terminateDescendants?: boolean;
+        notifyWebhooks?: boolean;
+    };
+}, {
+    reason?: string;
+    revokedDid?: string;
+    propagationPolicy?: {
+        gracePeriodMs?: number;
+        terminateDescendants?: boolean;
+        notifyWebhooks?: boolean;
+    };
+}>;
+/**
+ * Revocation result
+ */
+export interface RevocationResult {
+    /** Unique revocation ID */
+    revocationId: string;
+    /** DID that was revoked */
+    revokedDid: string;
+    /** DIDs of descendants that were also revoked */
+    descendantsRevoked: string[];
+    /** Number of tokens invalidated */
+    tokensInvalidated: number;
+    /** Whether propagation completed successfully */
+    propagationComplete: boolean;
+    /** Revocation timestamp */
+    timestamp: Date;
+}
+export declare const revocationResultSchema: z.ZodObject<{
+    revocationId: z.ZodString;
+    revokedDid: z.ZodString;
+    descendantsRevoked: z.ZodArray<z.ZodString, "many">;
+    tokensInvalidated: z.ZodNumber;
+    propagationComplete: z.ZodBoolean;
+    timestamp: z.ZodDate;
+}, "strip", z.ZodTypeAny, {
+    timestamp?: Date;
+    revocationId?: string;
+    revokedDid?: string;
+    descendantsRevoked?: string[];
+    tokensInvalidated?: number;
+    propagationComplete?: boolean;
+}, {
+    timestamp?: Date;
+    revocationId?: string;
+    revokedDid?: string;
+    descendantsRevoked?: string[];
+    tokensInvalidated?: number;
+    propagationComplete?: boolean;
+}>;
+/**
+ * Revocation status
+ */
+export declare const RevocationStatusEnum: {
+    readonly ACTIVE: "active";
+    readonly REVOKED: "revoked";
+    readonly PENDING: "pending";
+};
+export type RevocationStatusEnum = (typeof RevocationStatusEnum)[keyof typeof RevocationStatusEnum];
+export declare const revocationStatusEnumSchema: z.ZodNativeEnum<{
+    readonly ACTIVE: "active";
+    readonly REVOKED: "revoked";
+    readonly PENDING: "pending";
+}>;
+/**
+ * Revocation status response
+ */
+export interface RevocationStatus {
+    /** DID being checked */
+    did: string;
+    /** Current status */
+    status: RevocationStatusEnum;
+    /** Revocation timestamp if revoked */
+    revokedAt?: Date;
+    /** Revocation reason if revoked */
+    reason?: string;
+    /** Whether this is from cache or sync check */
+    fromCache: boolean;
+    /** Cache age in milliseconds */
+    cacheAgeMs?: number;
+}
+export declare const revocationStatusSchema: z.ZodObject<{
+    did: z.ZodString;
+    status: z.ZodNativeEnum<{
+        readonly ACTIVE: "active";
+        readonly REVOKED: "revoked";
+        readonly PENDING: "pending";
+    }>;
+    revokedAt: z.ZodOptional<z.ZodDate>;
+    reason: z.ZodOptional<z.ZodString>;
+    fromCache: z.ZodBoolean;
+    cacheAgeMs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    status?: "pending" | "active" | "revoked";
+    reason?: string;
+    revokedAt?: Date;
+    fromCache?: boolean;
+    did?: string;
+    cacheAgeMs?: number;
+}, {
+    status?: "pending" | "active" | "revoked";
+    reason?: string;
+    revokedAt?: Date;
+    fromCache?: boolean;
+    did?: string;
+    cacheAgeMs?: number;
+}>;
+/**
+ * Revocation event for webhooks/subscriptions
+ */
+export interface RevocationEvent {
+    /** Event type */
+    type: 'agent.revoked' | 'delegation.terminated' | 'token.invalidated';
+    /** Revocation ID */
+    revocationId: string;
+    /** Affected DID */
+    did: string;
+    /** Revocation reason */
+    reason: string;
+    /** Event timestamp */
+    timestamp: Date;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+export declare const revocationEventSchema: z.ZodObject<{
+    type: z.ZodEnum<["agent.revoked", "delegation.terminated", "token.invalidated"]>;
+    revocationId: z.ZodString;
+    did: z.ZodString;
+    reason: z.ZodString;
+    timestamp: z.ZodDate;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    type?: "agent.revoked" | "delegation.terminated" | "token.invalidated";
+    timestamp?: Date;
+    metadata?: Record<string, unknown>;
+    reason?: string;
+    did?: string;
+    revocationId?: string;
+}, {
+    type?: "agent.revoked" | "delegation.terminated" | "token.invalidated";
+    timestamp?: Date;
+    metadata?: Record<string, unknown>;
+    reason?: string;
+    did?: string;
+    revocationId?: string;
+}>;
+/**
+ * Token lifetime configuration per CAR ID spec
+ */
+export interface TokenLifetimeConfig {
+    /** Access token maximum TTL in seconds (default: 300 = 5 min) */
+    accessTokenMaxTTL: number;
+    /** Refresh token maximum TTL in seconds (default: 86400 = 24 hr) */
+    refreshTokenMaxTTL: number;
+    /** ID token maximum TTL in seconds (default: 300 = 5 min) */
+    idTokenMaxTTL: number;
+    /** TTL for high-value operations L3+ (default: 60 = 1 min) */
+    highValueOperationTTL: number;
+    /** Threshold for proactive refresh (percentage of TTL remaining) */
+    refreshThreshold: number;
+}
+export declare const tokenLifetimeConfigSchema: z.ZodObject<{
+    accessTokenMaxTTL: z.ZodDefault<z.ZodNumber>;
+    refreshTokenMaxTTL: z.ZodDefault<z.ZodNumber>;
+    idTokenMaxTTL: z.ZodDefault<z.ZodNumber>;
+    highValueOperationTTL: z.ZodDefault<z.ZodNumber>;
+    refreshThreshold: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    refreshThreshold?: number;
+    accessTokenMaxTTL?: number;
+    refreshTokenMaxTTL?: number;
+    idTokenMaxTTL?: number;
+    highValueOperationTTL?: number;
+}, {
+    refreshThreshold?: number;
+    accessTokenMaxTTL?: number;
+    refreshTokenMaxTTL?: number;
+    idTokenMaxTTL?: number;
+    highValueOperationTTL?: number;
+}>;
+/**
+ * Default token lifetime configuration
+ */
+export declare const DEFAULT_TOKEN_LIFETIME_CONFIG: TokenLifetimeConfig;
+/**
+ * Token introspection result per RFC 7662
+ */
+export interface IntrospectionResult {
+    /** Whether the token is active */
+    active: boolean;
+    /** Token scope */
+    scope?: string;
+    /** Client ID */
+    clientId?: string;
+    /** Username (subject) */
+    username?: string;
+    /** Token type */
+    tokenType?: string;
+    /** Expiration timestamp */
+    exp?: number;
+    /** Issued at timestamp */
+    iat?: number;
+    /** Not before timestamp */
+    nbf?: number;
+    /** Subject identifier */
+    sub?: string;
+    /** Audience */
+    aud?: string | string[];
+    /** Issuer */
+    iss?: string;
+    /** JWT ID */
+    jti?: string;
+    /** DPoP key confirmation */
+    cnf?: {
+        jkt?: string;
+    };
+    /** Introspection timestamp */
+    introspectedAt: string;
+    /** Whether result is from cache */
+    fromCache: boolean;
+}
+export declare const introspectionResultSchema: z.ZodObject<{
+    active: z.ZodBoolean;
+    scope: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    tokenType: z.ZodOptional<z.ZodString>;
+    exp: z.ZodOptional<z.ZodNumber>;
+    iat: z.ZodOptional<z.ZodNumber>;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    sub: z.ZodOptional<z.ZodString>;
+    aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+    iss: z.ZodOptional<z.ZodString>;
+    jti: z.ZodOptional<z.ZodString>;
+    cnf: z.ZodOptional<z.ZodObject<{
+        jkt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        jkt?: string;
+    }, {
+        jkt?: string;
+    }>>;
+    introspectedAt: z.ZodString;
+    fromCache: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    sub?: string;
+    iss?: string;
+    aud?: string | string[];
+    exp?: number;
+    iat?: number;
+    clientId?: string;
+    scope?: string;
+    active?: boolean;
+    username?: string;
+    jti?: string;
+    fromCache?: boolean;
+    tokenType?: string;
+    nbf?: number;
+    cnf?: {
+        jkt?: string;
+    };
+    introspectedAt?: string;
+}, {
+    sub?: string;
+    iss?: string;
+    aud?: string | string[];
+    exp?: number;
+    iat?: number;
+    clientId?: string;
+    scope?: string;
+    active?: boolean;
+    username?: string;
+    jti?: string;
+    fromCache?: boolean;
+    tokenType?: string;
+    nbf?: number;
+    cnf?: {
+        jkt?: string;
+    };
+    introspectedAt?: string;
+}>;
+/**
+ * Agent identity for security context
+ */
+export interface AgentIdentity {
+    /** Agent DID */
+    did: string;
+    /** Trust tier */
+    trustTier: TrustTier;
+    /** Capability level (L0-L5) */
+    capabilityLevel: number;
+    /** DID document */
+    didDocument?: unknown;
+    /** TEE binding if present */
+    teeBinding?: TEEKeyBinding;
+    /** Attestation chain */
+    attestationChain?: unknown[];
+}
+export declare const agentIdentitySchema: z.ZodObject<{
+    did: z.ZodString;
+    trustTier: z.ZodNativeEnum<{
+        readonly T0: 0;
+        readonly T1: 1;
+        readonly T2: 2;
+        readonly T3: 3;
+        readonly T4: 4;
+        readonly T5: 5;
+        readonly T6: 6;
+        readonly T7: 7;
+    }>;
+    capabilityLevel: z.ZodNumber;
+    didDocument: z.ZodOptional<z.ZodUnknown>;
+    teeBinding: z.ZodOptional<z.ZodObject<{
+        didKeyId: z.ZodString;
+        enclaveKeyId: z.ZodString;
+        bindingProof: z.ZodString;
+        boundAt: z.ZodDate;
+        validUntil: z.ZodOptional<z.ZodDate>;
+    }, "strip", z.ZodTypeAny, {
+        validUntil?: Date;
+        didKeyId?: string;
+        enclaveKeyId?: string;
+        bindingProof?: string;
+        boundAt?: Date;
+    }, {
+        validUntil?: Date;
+        didKeyId?: string;
+        enclaveKeyId?: string;
+        bindingProof?: string;
+        boundAt?: Date;
+    }>>;
+    attestationChain: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
+}, "strip", z.ZodTypeAny, {
+    did?: string;
+    trustTier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+    capabilityLevel?: number;
+    didDocument?: unknown;
+    teeBinding?: {
+        validUntil?: Date;
+        didKeyId?: string;
+        enclaveKeyId?: string;
+        bindingProof?: string;
+        boundAt?: Date;
+    };
+    attestationChain?: unknown[];
+}, {
+    did?: string;
+    trustTier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+    capabilityLevel?: number;
+    didDocument?: unknown;
+    teeBinding?: {
+        validUntil?: Date;
+        didKeyId?: string;
+        enclaveKeyId?: string;
+        bindingProof?: string;
+        boundAt?: Date;
+    };
+    attestationChain?: unknown[];
+}>;
+/**
+ * Action request for security evaluation
+ */
+export interface ActionRequest {
+    /** Request ID */
+    requestId: string;
+    /** HTTP method */
+    method: string;
+    /** Request URI */
+    uri: string;
+    /** Action type/name */
+    actionType: string;
+    /** Action level (L0-L5) */
+    actionLevel: number;
+    /** Domain codes */
+    domains?: string[];
+    /** Whether this is a high-value operation */
+    isHighValue?: boolean;
+    /** Data classification */
+    dataClassification?: DataClassification;
+}
+export declare const actionRequestSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    method: z.ZodString;
+    uri: z.ZodString;
+    actionType: z.ZodString;
+    actionLevel: z.ZodNumber;
+    domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    isHighValue: z.ZodOptional<z.ZodBoolean>;
+    dataClassification: z.ZodOptional<z.ZodNativeEnum<{
+        readonly PUBLIC: "public";
+        readonly BUSINESS: "business";
+        readonly PERSONAL: "personal";
+        readonly SENSITIVE: "sensitive";
+        readonly REGULATED: "regulated";
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    method?: string;
+    requestId?: string;
+    dataClassification?: "public" | "sensitive" | "regulated" | "personal" | "business";
+    actionType?: string;
+    domains?: string[];
+    uri?: string;
+    actionLevel?: number;
+    isHighValue?: boolean;
+}, {
+    method?: string;
+    requestId?: string;
+    dataClassification?: "public" | "sensitive" | "regulated" | "personal" | "business";
+    actionType?: string;
+    domains?: string[];
+    uri?: string;
+    actionLevel?: number;
+    isHighValue?: boolean;
+}>;
+/**
+ * Security context for validation
+ */
+export interface SecurityContext {
+    /** Agent identity */
+    agent: AgentIdentity;
+    /** Current action request */
+    request: ActionRequest;
+    /** Access token */
+    accessToken: string;
+    /** DPoP proof if present */
+    dpopProof?: string;
+    /** DPoP public key */
+    dpopKey?: JsonWebKey;
+    /** TEE attestation if present */
+    teeAttestation?: TEEAttestation;
+    /** Pairwise DID if used */
+    pairwiseDid?: string;
+}
+export declare const securityContextSchema: z.ZodObject<{
+    agent: z.ZodObject<{
+        did: z.ZodString;
+        trustTier: z.ZodNativeEnum<{
+            readonly T0: 0;
+            readonly T1: 1;
+            readonly T2: 2;
+            readonly T3: 3;
+            readonly T4: 4;
+            readonly T5: 5;
+            readonly T6: 6;
+            readonly T7: 7;
+        }>;
+        capabilityLevel: z.ZodNumber;
+        didDocument: z.ZodOptional<z.ZodUnknown>;
+        teeBinding: z.ZodOptional<z.ZodObject<{
+            didKeyId: z.ZodString;
+            enclaveKeyId: z.ZodString;
+            bindingProof: z.ZodString;
+            boundAt: z.ZodDate;
+            validUntil: z.ZodOptional<z.ZodDate>;
+        }, "strip", z.ZodTypeAny, {
+            validUntil?: Date;
+            didKeyId?: string;
+            enclaveKeyId?: string;
+            bindingProof?: string;
+            boundAt?: Date;
+        }, {
+            validUntil?: Date;
+            didKeyId?: string;
+            enclaveKeyId?: string;
+            bindingProof?: string;
+            boundAt?: Date;
+        }>>;
+        attestationChain: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        did?: string;
+        trustTier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        capabilityLevel?: number;
+        didDocument?: unknown;
+        teeBinding?: {
+            validUntil?: Date;
+            didKeyId?: string;
+            enclaveKeyId?: string;
+            bindingProof?: string;
+            boundAt?: Date;
+        };
+        attestationChain?: unknown[];
+    }, {
+        did?: string;
+        trustTier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        capabilityLevel?: number;
+        didDocument?: unknown;
+        teeBinding?: {
+            validUntil?: Date;
+            didKeyId?: string;
+            enclaveKeyId?: string;
+            bindingProof?: string;
+            boundAt?: Date;
+        };
+        attestationChain?: unknown[];
+    }>;
+    request: z.ZodObject<{
+        requestId: z.ZodString;
+        method: z.ZodString;
+        uri: z.ZodString;
+        actionType: z.ZodString;
+        actionLevel: z.ZodNumber;
+        domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        isHighValue: z.ZodOptional<z.ZodBoolean>;
+        dataClassification: z.ZodOptional<z.ZodNativeEnum<{
+            readonly PUBLIC: "public";
+            readonly BUSINESS: "business";
+            readonly PERSONAL: "personal";
+            readonly SENSITIVE: "sensitive";
+            readonly REGULATED: "regulated";
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        method?: string;
+        requestId?: string;
+        dataClassification?: "public" | "sensitive" | "regulated" | "personal" | "business";
+        actionType?: string;
+        domains?: string[];
+        uri?: string;
+        actionLevel?: number;
+        isHighValue?: boolean;
+    }, {
+        method?: string;
+        requestId?: string;
+        dataClassification?: "public" | "sensitive" | "regulated" | "personal" | "business";
+        actionType?: string;
+        domains?: string[];
+        uri?: string;
+        actionLevel?: number;
+        isHighValue?: boolean;
+    }>;
+    accessToken: z.ZodString;
+    dpopProof: z.ZodOptional<z.ZodString>;
+    dpopKey: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    teeAttestation: z.ZodOptional<z.ZodObject<{
+        platform: z.ZodNativeEnum<{
+            readonly SGX: "sgx";
+            readonly NITRO: "nitro";
+            readonly SEV: "sev";
+            readonly TRUSTZONE: "trustzone";
+            readonly SECURE_ENCLAVE: "secure-enclave";
+        }>;
+        measurementHash: z.ZodString;
+        timestamp: z.ZodDate;
+        enclaveId: z.ZodString;
+        pcrs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        signature: z.ZodOptional<z.ZodString>;
+        certificateChain: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        attestationEndpoint: z.ZodOptional<z.ZodString>;
+        validUntil: z.ZodOptional<z.ZodDate>;
+    }, "strip", z.ZodTypeAny, {
+        platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
+        timestamp?: Date;
+        signature?: string;
+        validUntil?: Date;
+        measurementHash?: string;
+        enclaveId?: string;
+        pcrs?: Record<string, string>;
+        certificateChain?: string[];
+        attestationEndpoint?: string;
+    }, {
+        platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
+        timestamp?: Date;
+        signature?: string;
+        validUntil?: Date;
+        measurementHash?: string;
+        enclaveId?: string;
+        pcrs?: Record<string, string>;
+        certificateChain?: string[];
+        attestationEndpoint?: string;
+    }>>;
+    pairwiseDid: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    agent?: {
+        did?: string;
+        trustTier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        capabilityLevel?: number;
+        didDocument?: unknown;
+        teeBinding?: {
+            validUntil?: Date;
+            didKeyId?: string;
+            enclaveKeyId?: string;
+            bindingProof?: string;
+            boundAt?: Date;
+        };
+        attestationChain?: unknown[];
+    };
+    request?: {
+        method?: string;
+        requestId?: string;
+        dataClassification?: "public" | "sensitive" | "regulated" | "personal" | "business";
+        actionType?: string;
+        domains?: string[];
+        uri?: string;
+        actionLevel?: number;
+        isHighValue?: boolean;
+    };
+    accessToken?: string;
+    dpopProof?: string;
+    dpopKey?: Record<string, unknown>;
+    teeAttestation?: {
+        platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
+        timestamp?: Date;
+        signature?: string;
+        validUntil?: Date;
+        measurementHash?: string;
+        enclaveId?: string;
+        pcrs?: Record<string, string>;
+        certificateChain?: string[];
+        attestationEndpoint?: string;
+    };
+    pairwiseDid?: string;
+}, {
+    agent?: {
+        did?: string;
+        trustTier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        capabilityLevel?: number;
+        didDocument?: unknown;
+        teeBinding?: {
+            validUntil?: Date;
+            didKeyId?: string;
+            enclaveKeyId?: string;
+            bindingProof?: string;
+            boundAt?: Date;
+        };
+        attestationChain?: unknown[];
+    };
+    request?: {
+        method?: string;
+        requestId?: string;
+        dataClassification?: "public" | "sensitive" | "regulated" | "personal" | "business";
+        actionType?: string;
+        domains?: string[];
+        uri?: string;
+        actionLevel?: number;
+        isHighValue?: boolean;
+    };
+    accessToken?: string;
+    dpopProof?: string;
+    dpopKey?: Record<string, unknown>;
+    teeAttestation?: {
+        platform?: "sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave";
+        timestamp?: Date;
+        signature?: string;
+        validUntil?: Date;
+        measurementHash?: string;
+        enclaveId?: string;
+        pcrs?: Record<string, string>;
+        certificateChain?: string[];
+        attestationEndpoint?: string;
+    };
+    pairwiseDid?: string;
+}>;
+/**
+ * Security validation result
+ */
+export interface SecurityValidationResult {
+    /** Whether validation passed */
+    valid: boolean;
+    /** Validation errors */
+    errors: SecurityValidationError[];
+    /** Applied security level */
+    securityLevel: SecurityConformanceLevel;
+    /** Warnings (non-fatal) */
+    warnings: string[];
+    /** Validation timestamp */
+    validatedAt: string;
+}
+export interface SecurityValidationError {
+    /** Error code */
+    code: string;
+    /** Error message */
+    message: string;
+    /** Component that failed */
+    component: 'dpop' | 'tee' | 'pairwise' | 'revocation' | 'token' | 'introspection';
+}
+export declare const securityValidationErrorSchema: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+    component: z.ZodEnum<["dpop", "tee", "pairwise", "revocation", "token", "introspection"]>;
+}, "strip", z.ZodTypeAny, {
+    code?: string;
+    message?: string;
+    component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
+}, {
+    code?: string;
+    message?: string;
+    component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
+}>;
+export declare const securityValidationResultSchema: z.ZodObject<{
+    valid: z.ZodBoolean;
+    errors: z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+        component: z.ZodEnum<["dpop", "tee", "pairwise", "revocation", "token", "introspection"]>;
+    }, "strip", z.ZodTypeAny, {
+        code?: string;
+        message?: string;
+        component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
+    }, {
+        code?: string;
+        message?: string;
+        component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
+    }>, "many">;
+    securityLevel: z.ZodNativeEnum<{
+        readonly NONE: "none";
+        readonly SH1_BASIC: "sh-1";
+        readonly SH2_STANDARD: "sh-2";
+        readonly SH3_HARDENED: "sh-3";
+    }>;
+    warnings: z.ZodArray<z.ZodString, "many">;
+    validatedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    valid?: boolean;
+    errors?: {
+        code?: string;
+        message?: string;
+        component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
+    }[];
+    securityLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
+    warnings?: string[];
+    validatedAt?: string;
+}, {
+    valid?: boolean;
+    errors?: {
+        code?: string;
+        message?: string;
+        component?: "token" | "dpop" | "tee" | "pairwise" | "revocation" | "introspection";
+    }[];
+    securityLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
+    warnings?: string[];
+    validatedAt?: string;
+}>;
+/**
+ * Pre-request security check result
+ */
+export interface PreRequestResult {
+    /** Whether request can proceed */
+    allow: boolean;
+    /** Required actions before proceeding */
+    requiredActions?: ('dpop' | 'tee_attestation' | 'pairwise_did' | 'introspection')[];
+    /** Security requirements for this request */
+    requirements: SecurityRequirements;
+    /** Denial reason if not allowed */
+    denyReason?: string;
+}
+export declare const preRequestResultSchema: z.ZodObject<{
+    allow: z.ZodBoolean;
+    requiredActions: z.ZodOptional<z.ZodArray<z.ZodEnum<["dpop", "tee_attestation", "pairwise_did", "introspection"]>, "many">>;
+    requirements: z.ZodLazy<z.ZodObject<{
+        tier: z.ZodNativeEnum<{
+            readonly T0: 0;
+            readonly T1: 1;
+            readonly T2: 2;
+            readonly T3: 3;
+            readonly T4: 4;
+            readonly T5: 5;
+            readonly T6: 6;
+            readonly T7: 7;
+        }>;
+        conformanceLevel: z.ZodNativeEnum<{
+            readonly NONE: "none";
+            readonly SH1_BASIC: "sh-1";
+            readonly SH2_STANDARD: "sh-2";
+            readonly SH3_HARDENED: "sh-3";
+        }>;
+        dpopRequired: z.ZodBoolean;
+        teeRequired: z.ZodBoolean;
+        pairwiseRequired: z.ZodBoolean;
+        syncRevocationRequired: z.ZodBoolean;
+        maxTokenTTL: z.ZodNumber;
+        maxChainDepth: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
+        dpopRequired?: boolean;
+        teeRequired?: boolean;
+        pairwiseRequired?: boolean;
+        syncRevocationRequired?: boolean;
+        maxTokenTTL?: number;
+        maxChainDepth?: number;
+    }, {
+        tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
+        dpopRequired?: boolean;
+        teeRequired?: boolean;
+        pairwiseRequired?: boolean;
+        syncRevocationRequired?: boolean;
+        maxTokenTTL?: number;
+        maxChainDepth?: number;
+    }>>;
+    denyReason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    allow?: boolean;
+    requirements?: {
+        tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
+        dpopRequired?: boolean;
+        teeRequired?: boolean;
+        pairwiseRequired?: boolean;
+        syncRevocationRequired?: boolean;
+        maxTokenTTL?: number;
+        maxChainDepth?: number;
+    };
+    requiredActions?: ("dpop" | "introspection" | "tee_attestation" | "pairwise_did")[];
+    denyReason?: string;
+}, {
+    allow?: boolean;
+    requirements?: {
+        tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
+        dpopRequired?: boolean;
+        teeRequired?: boolean;
+        pairwiseRequired?: boolean;
+        syncRevocationRequired?: boolean;
+        maxTokenTTL?: number;
+        maxChainDepth?: number;
+    };
+    requiredActions?: ("dpop" | "introspection" | "tee_attestation" | "pairwise_did")[];
+    denyReason?: string;
+}>;
+/**
+ * High-value operation check result
+ */
+export interface HighValueCheckResult {
+    /** Whether operation can proceed */
+    allow: boolean;
+    /** Whether introspection was performed */
+    introspectionPerformed: boolean;
+    /** Whether revocation was checked synchronously */
+    syncRevocationCheck: boolean;
+    /** Token remaining TTL in seconds */
+    tokenTTLRemaining?: number;
+    /** Denial reason if not allowed */
+    denyReason?: string;
+}
+export declare const highValueCheckResultSchema: z.ZodObject<{
+    allow: z.ZodBoolean;
+    introspectionPerformed: z.ZodBoolean;
+    syncRevocationCheck: z.ZodBoolean;
+    tokenTTLRemaining: z.ZodOptional<z.ZodNumber>;
+    denyReason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    allow?: boolean;
+    denyReason?: string;
+    introspectionPerformed?: boolean;
+    syncRevocationCheck?: boolean;
+    tokenTTLRemaining?: number;
+}, {
+    allow?: boolean;
+    denyReason?: string;
+    introspectionPerformed?: boolean;
+    syncRevocationCheck?: boolean;
+    tokenTTLRemaining?: number;
+}>;
+/**
+ * Security requirements for a trust tier
+ */
+export interface SecurityRequirements {
+    /** Trust tier */
+    tier: TrustTier;
+    /** Required conformance level */
+    conformanceLevel: SecurityConformanceLevel;
+    /** Whether DPoP is required */
+    dpopRequired: boolean;
+    /** Whether TEE binding is required */
+    teeRequired: boolean;
+    /** Whether pairwise DIDs are required */
+    pairwiseRequired: boolean;
+    /** Whether sync revocation check is required */
+    syncRevocationRequired: boolean;
+    /** Maximum token TTL */
+    maxTokenTTL: number;
+    /** Maximum delegation chain depth */
+    maxChainDepth: number;
+}
+export declare const securityRequirementsSchema: z.ZodObject<{
+    tier: z.ZodNativeEnum<{
+        readonly T0: 0;
+        readonly T1: 1;
+        readonly T2: 2;
+        readonly T3: 3;
+        readonly T4: 4;
+        readonly T5: 5;
+        readonly T6: 6;
+        readonly T7: 7;
+    }>;
+    conformanceLevel: z.ZodNativeEnum<{
+        readonly NONE: "none";
+        readonly SH1_BASIC: "sh-1";
+        readonly SH2_STANDARD: "sh-2";
+        readonly SH3_HARDENED: "sh-3";
+    }>;
+    dpopRequired: z.ZodBoolean;
+    teeRequired: z.ZodBoolean;
+    pairwiseRequired: z.ZodBoolean;
+    syncRevocationRequired: z.ZodBoolean;
+    maxTokenTTL: z.ZodNumber;
+    maxChainDepth: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+    conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
+    dpopRequired?: boolean;
+    teeRequired?: boolean;
+    pairwiseRequired?: boolean;
+    syncRevocationRequired?: boolean;
+    maxTokenTTL?: number;
+    maxChainDepth?: number;
+}, {
+    tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+    conformanceLevel?: "none" | "sh-1" | "sh-2" | "sh-3";
+    dpopRequired?: boolean;
+    teeRequired?: boolean;
+    pairwiseRequired?: boolean;
+    syncRevocationRequired?: boolean;
+    maxTokenTTL?: number;
+    maxChainDepth?: number;
+}>;
+/**
+ * Get security requirements for a trust tier
+ */
+export declare function getSecurityRequirementsForTier(tier: TrustTier): SecurityRequirements;
+/**
+ * Incoming request structure for middleware
+ */
+export interface IncomingRequest {
+    /** Request ID */
+    requestId: string;
+    /** HTTP method */
+    method: string;
+    /** Request URI */
+    uri: string;
+    /** Authorization header */
+    authorization?: string;
+    /** DPoP header */
+    dpop?: string;
+    /** Additional headers */
+    headers: Record<string, string | string[] | undefined>;
+}
+export declare const incomingRequestSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    method: z.ZodString;
+    uri: z.ZodString;
+    authorization: z.ZodOptional<z.ZodString>;
+    dpop: z.ZodOptional<z.ZodString>;
+    headers: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">, z.ZodUndefined]>>;
+}, "strip", z.ZodTypeAny, {
+    authorization?: string;
+    headers?: Record<string, string | string[]>;
+    method?: string;
+    requestId?: string;
+    uri?: string;
+    dpop?: string;
+}, {
+    authorization?: string;
+    headers?: Record<string, string | string[]>;
+    method?: string;
+    requestId?: string;
+    uri?: string;
+    dpop?: string;
+}>;
+/**
+ * JTI cache interface for DPoP replay prevention
+ */
+export interface JTICache {
+    /** Store JTI with expiration */
+    store(jti: string, expiresAt: Date): Promise<void>;
+    /** Check if JTI has been seen */
+    exists(jti: string): Promise<boolean>;
+}
+/**
+ * Security plugin options for Fastify
+ */
+export interface SecurityPluginOptions {
+    /** DPoP configuration */
+    dpop?: Partial<DPoPConfig>;
+    /** TEE configuration */
+    tee?: Partial<TEEConfig>;
+    /** Pairwise DID configuration */
+    pairwiseDid?: Partial<PairwiseDIDConfig>;
+    /** Revocation SLA overrides */
+    revocationSLAs?: RevocationSLA[];
+    /** Token lifetime configuration */
+    tokenLifetime?: Partial<TokenLifetimeConfig>;
+    /** Token introspection endpoint */
+    introspectionEndpoint?: string;
+    /** Skip security checks for certain paths */
+    skipPaths?: string[];
+    /** Enable metrics collection */
+    enableMetrics?: boolean;
+}
+export declare const securityPluginOptionsSchema: z.ZodObject<{
+    dpop: z.ZodOptional<z.ZodObject<{
+        requiredForTiers: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<{
+            readonly T0: 0;
+            readonly T1: 1;
+            readonly T2: 2;
+            readonly T3: 3;
+            readonly T4: 4;
+            readonly T5: 5;
+            readonly T6: 6;
+            readonly T7: 7;
+        }>, "many">>;
+        maxProofAge: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        nonceRequired: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        clockSkewTolerance: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        allowedAlgorithms: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<["ES256", "ES384", "ES512"]>, "many">>>;
+    }, "strip", z.ZodTypeAny, {
+        allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
+        clockSkewTolerance?: number;
+        maxProofAge?: number;
+        requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+        nonceRequired?: boolean;
+    }, {
+        allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
+        clockSkewTolerance?: number;
+        maxProofAge?: number;
+        requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+        nonceRequired?: boolean;
+    }>>;
+    tee: z.ZodOptional<z.ZodObject<{
+        requiredForTiers: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
+            readonly T0: 0;
+            readonly T1: 1;
+            readonly T2: 2;
+            readonly T3: 3;
+            readonly T4: 4;
+            readonly T5: 5;
+            readonly T6: 6;
+            readonly T7: 7;
+        }>, "many">>>;
+        allowedPlatforms: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
+            readonly SGX: "sgx";
+            readonly NITRO: "nitro";
+            readonly SEV: "sev";
+            readonly TRUSTZONE: "trustzone";
+            readonly SECURE_ENCLAVE: "secure-enclave";
+        }>, "many">>>;
+        maxAttestationAge: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        expectedMeasurements: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        attestationVerificationEndpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+        allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
+        maxAttestationAge?: number;
+        expectedMeasurements?: Record<string, string>;
+        attestationVerificationEndpoint?: string;
+    }, {
+        requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+        allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
+        maxAttestationAge?: number;
+        expectedMeasurements?: Record<string, string>;
+        attestationVerificationEndpoint?: string;
+    }>>;
+    pairwiseDid: z.ZodOptional<z.ZodObject<{
+        requiredForDataTypes: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodNativeEnum<{
+            readonly PUBLIC: "public";
+            readonly BUSINESS: "business";
+            readonly PERSONAL: "personal";
+            readonly SENSITIVE: "sensitive";
+            readonly REGULATED: "regulated";
+        }>, "many">>>;
+        derivationAlgorithm: z.ZodOptional<z.ZodDefault<z.ZodNativeEnum<{
+            readonly SHA256: "sha256";
+            readonly HKDF: "hkdf";
+        }>>>;
+        saltLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        hkdfInfo: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        requiredForDataTypes?: ("public" | "sensitive" | "regulated" | "personal" | "business")[];
+        derivationAlgorithm?: "sha256" | "hkdf";
+        saltLength?: number;
+        hkdfInfo?: string;
+    }, {
+        requiredForDataTypes?: ("public" | "sensitive" | "regulated" | "personal" | "business")[];
+        derivationAlgorithm?: "sha256" | "hkdf";
+        saltLength?: number;
+        hkdfInfo?: string;
+    }>>;
+    revocationSLAs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        tier: z.ZodNativeEnum<{
+            readonly T0: 0;
+            readonly T1: 1;
+            readonly T2: 2;
+            readonly T3: 3;
+            readonly T4: 4;
+            readonly T5: 5;
+            readonly T6: 6;
+            readonly T7: 7;
+        }>;
+        maxPropagationLatencyMs: z.ZodNumber;
+        syncCheckRequired: z.ZodBoolean;
+        introspectionRequired: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        maxPropagationLatencyMs?: number;
+        syncCheckRequired?: boolean;
+        introspectionRequired?: boolean;
+    }, {
+        tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        maxPropagationLatencyMs?: number;
+        syncCheckRequired?: boolean;
+        introspectionRequired?: boolean;
+    }>, "many">>;
+    tokenLifetime: z.ZodOptional<z.ZodObject<{
+        accessTokenMaxTTL: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        refreshTokenMaxTTL: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        idTokenMaxTTL: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        highValueOperationTTL: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        refreshThreshold: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        refreshThreshold?: number;
+        accessTokenMaxTTL?: number;
+        refreshTokenMaxTTL?: number;
+        idTokenMaxTTL?: number;
+        highValueOperationTTL?: number;
+    }, {
+        refreshThreshold?: number;
+        accessTokenMaxTTL?: number;
+        refreshTokenMaxTTL?: number;
+        idTokenMaxTTL?: number;
+        highValueOperationTTL?: number;
+    }>>;
+    introspectionEndpoint: z.ZodOptional<z.ZodString>;
+    skipPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    enableMetrics: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    skipPaths?: string[];
+    pairwiseDid?: {
+        requiredForDataTypes?: ("public" | "sensitive" | "regulated" | "personal" | "business")[];
+        derivationAlgorithm?: "sha256" | "hkdf";
+        saltLength?: number;
+        hkdfInfo?: string;
+    };
+    dpop?: {
+        allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
+        clockSkewTolerance?: number;
+        maxProofAge?: number;
+        requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+        nonceRequired?: boolean;
+    };
+    tee?: {
+        requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+        allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
+        maxAttestationAge?: number;
+        expectedMeasurements?: Record<string, string>;
+        attestationVerificationEndpoint?: string;
+    };
+    revocationSLAs?: {
+        tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        maxPropagationLatencyMs?: number;
+        syncCheckRequired?: boolean;
+        introspectionRequired?: boolean;
+    }[];
+    tokenLifetime?: {
+        refreshThreshold?: number;
+        accessTokenMaxTTL?: number;
+        refreshTokenMaxTTL?: number;
+        idTokenMaxTTL?: number;
+        highValueOperationTTL?: number;
+    };
+    introspectionEndpoint?: string;
+    enableMetrics?: boolean;
+}, {
+    skipPaths?: string[];
+    pairwiseDid?: {
+        requiredForDataTypes?: ("public" | "sensitive" | "regulated" | "personal" | "business")[];
+        derivationAlgorithm?: "sha256" | "hkdf";
+        saltLength?: number;
+        hkdfInfo?: string;
+    };
+    dpop?: {
+        allowedAlgorithms?: ("ES256" | "ES384" | "ES512")[];
+        clockSkewTolerance?: number;
+        maxProofAge?: number;
+        requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+        nonceRequired?: boolean;
+    };
+    tee?: {
+        requiredForTiers?: (0 | 7 | 1 | 2 | 3 | 4 | 5 | 6)[];
+        allowedPlatforms?: ("sgx" | "nitro" | "sev" | "trustzone" | "secure-enclave")[];
+        maxAttestationAge?: number;
+        expectedMeasurements?: Record<string, string>;
+        attestationVerificationEndpoint?: string;
+    };
+    revocationSLAs?: {
+        tier?: 0 | 7 | 1 | 2 | 3 | 4 | 5 | 6;
+        maxPropagationLatencyMs?: number;
+        syncCheckRequired?: boolean;
+        introspectionRequired?: boolean;
+    }[];
+    tokenLifetime?: {
+        refreshThreshold?: number;
+        accessTokenMaxTTL?: number;
+        refreshTokenMaxTTL?: number;
+        idTokenMaxTTL?: number;
+        highValueOperationTTL?: number;
+    };
+    introspectionEndpoint?: string;
+    enableMetrics?: boolean;
+}>;
+//# sourceMappingURL=types.d.ts.map