/**
 * Hand-written decoders for the TPM 2.0 structures that the WebAuthn
 * `tpm` attestation statement carries:
 *
 *   - `TPMT_PUBLIC` — the public area of the bound key
 *     (Trusted Computing Group, "TPM 2.0 Library, Part 2 — Structures",
 *     §12.2.4).
 *   - `TPMS_ATTEST` — the quote / certify payload signed by the AIK
 *     (TCG TPM 2.0 Library, Part 2, §10.12.8).
 *
 * Implemented from scratch against the spec; no external TPM dependency.
 * The decoders only support the subset of `TPMT_PUBLIC` (RSA / ECC) and
 * `TPMS_ATTEST` (ATTEST_QUOTE / ATTEST_CERTIFY) needed by the
 * server-side WebAuthn `tpm` verifier. Anything outside that subset
 * throws `TpmStructuresError` so the verifier can convert the failure
 * into a structured outcome rather than propagating an unchecked
 * exception.
 *
 * All multi-byte fields are big-endian per the TCG canonical encoding.
 */
/** Constant identifying TPM2 quote/certify payloads ("TCG\0" big-endian). */
export declare const TPM_GENERATED_VALUE = 4283712327;
export declare const TPM_ST_ATTEST_QUOTE = 32788;
export declare const TPM_ST_ATTEST_CERTIFY = 32791;
export declare const TPM_ALG_RSA = 1;
export declare const TPM_ALG_ECC = 35;
export declare const TPM_ALG_SHA1 = 4;
export declare const TPM_ALG_SHA256 = 11;
export declare const TPM_ALG_SHA384 = 12;
export declare const TPM_ALG_SHA512 = 13;
export declare const TPM_ECC_NIST_P256 = 3;
export declare const TPM_ECC_NIST_P384 = 4;
export declare const TPM_ECC_NIST_P521 = 5;
export declare class TpmStructuresError extends Error {
    constructor(message: string);
}
export type TpmtPublicKey = {
    type: "rsa";
    nameAlg: number;
    objectAttributes: number;
    n: Buffer;
    e: Buffer;
} | {
    type: "ecc";
    nameAlg: number;
    objectAttributes: number;
    curve: "P-256" | "P-384" | "P-521";
    x: Buffer;
    y: Buffer;
};
export interface TpmsAttest {
    magic: number;
    type: number;
    qualifiedSigner: Buffer;
    extraData: Buffer;
    clockInfo: Buffer;
    firmwareVersion: bigint;
    attested: TpmsAttestQuote | TpmsAttestCertify;
}
export interface TpmsAttestQuote {
    kind: "quote";
    pcrSelect: Buffer;
    pcrDigest: Buffer;
}
export interface TpmsAttestCertify {
    kind: "certify";
    /** Concatenation of nameAlg (2 bytes BE) || digest. */
    name: Buffer;
    qualifiedName: Buffer;
}
/**
 * Map a hash algorithm identifier to the digest size in bytes used by
 * `TPM2B_DIGEST` payloads in `TPMU_ATTEST` and `TPMS_ATTEST.attested.name`.
 */
export declare function digestLengthForAlg(alg: number): number;
/**
 * Decode a `TPMT_PUBLIC` structure from a TPM2 statement's `pubArea`.
 *
 * Layout (from TCG TPM 2.0 Library, Part 2, §12.2.4):
 *   TPMI_ALG_PUBLIC      type            (UINT16)
 *   TPMI_ALG_HASH        nameAlg         (UINT16)
 *   TPMA_OBJECT          objectAttributes (UINT32)
 *   TPM2B_DIGEST         authPolicy      (UINT16 length || digest)
 *   TPMU_PUBLIC_PARMS    parameters      (variable per `type`)
 *   TPMU_PUBLIC_ID       unique          (variable per `type`)
 *
 * For the WebAuthn `tpm` format we only handle RSA and ECC keys.
 */
export declare function parseTpmtPublic(buf: Buffer): TpmtPublicKey;
/**
 * Decode a `TPMS_ATTEST` structure from a TPM2 statement's `certInfo`.
 *
 * Layout (TCG TPM 2.0 Library, Part 2, §10.12.8):
 *   TPM_GENERATED        magic                (UINT32)
 *   TPMI_ST_ATTEST       type                 (UINT16)
 *   TPM2B_NAME           qualifiedSigner      (UINT16 length || data)
 *   TPM2B_DATA           extraData            (UINT16 length || data)
 *   TPMS_CLOCK_INFO      clockInfo            (17 bytes: u64 clock + u32 resetCount + u32 restartCount + u8 safe)
 *   UINT64               firmwareVersion
 *   TPMU_ATTEST          attested             (variable per `type`)
 */
export declare function parseTpmsAttest(buf: Buffer): TpmsAttest;
//# sourceMappingURL=aauth_tpm_structures.d.ts.map