/**
 * CLI-side helper that turns the TPM 2.0 native binding's attest output
 * into an AAuth `cnf.attestation` envelope ready to embed in an
 * `aa-agent+jwt`.
 *
 * The actual TPM 2.0 calls live in the `@neotoma/aauth-tpm2` package
 * (`packages/aauth-tpm2/`); this helper:
 *
 *   1. Probes the binding so callers can branch to the software-only
 *      tier on hosts without TPM hardware, without throwing.
 *   2. Wraps the binding's structured output into the exact JSON shape
 *      consumed by the server-side `verifyTpm2Attestation` (FU-3).
 *   3. Computes the AAuth challenge
 *      (`base64url(SHA-256(iss || sub || iat))`) so callers do not have
 *      to know the FU-3 binding contract.
 *
 * Used by:
 *   - `neotoma auth keygen --hardware` on Linux to mint the initial
 *     attestation envelope alongside the TPM-resident key.
 *   - `neotoma auth attest --refresh` to re-mint an envelope without
 *     rotating the underlying handle.
 *
 * Behaviour on non-Linux hosts (or Linux hosts without `libtss2` /
 * `/dev/tpmrm0`): {@link isTpm2BackendAvailable} returns `false` with a
 * reason, and {@link buildTpm2AttestationEnvelope} throws
 * {@link Tpm2BackendUnavailableError} so the caller can fall back to
 * the software signer cleanly.
 */
export declare const TPM2_PACKAGE_NAME = "@neotoma/aauth-tpm2";
export declare class Tpm2BackendUnavailableError extends Error {
    readonly code: "tpm2_backend_unavailable";
    readonly reason: string;
    constructor(reason: string);
}
export interface Tpm2BackendProbe {
    supported: boolean;
    reason?: string;
}
interface Tpm2BindingShape {
    isSupported(): {
        supported: boolean;
        reason?: string;
    };
    generateKey(opts: {
        hierarchy?: "owner" | "endorsement";
        alg?: "ES256" | "RS256";
    }): {
        jwk: Record<string, unknown>;
        handle: string;
        hierarchy: "owner" | "endorsement";
        alg: "ES256" | "RS256";
    };
    attest(opts: {
        handle: string;
        challenge: string;
        jkt: string;
    }): {
        format: "tpm2";
        ver: "2.0";
        alg: "ES256" | "RS256";
        x5c: string[];
        sig: string;
        certInfo: string;
        pubArea: string;
    };
}
/**
 * Test-only override hook. Vitest specs install a synthetic binding via
 * this hook so they can exercise the helper without requiring the
 * real native package or a TPM 2.0 chip.
 */
export declare function __setTpm2BindingForTesting(binding: Tpm2BindingShape | null): void;
/**
 * Probe the TPM 2.0 backend. Returns `{ supported: true }` only when
 * the optional native package is installed AND its `isSupported()`
 * probe also returns `true`. Otherwise returns
 * `{ supported: false, reason }` so the CLI can render an actionable
 * error and fall back to the software signer.
 */
export declare function isTpm2BackendAvailable(): Tpm2BackendProbe;
/**
 * Compute the AAuth attestation challenge:
 * `base64url(SHA-256(iss || sub || iat))`. This MUST match the
 * server-side `computeExpectedChallenge` (see
 * `src/services/aauth_attestation_verifier.ts`).
 */
export declare function computeAttestationChallenge(args: {
    iss: string;
    sub: string;
    iat: number;
}): string;
export interface BuildTpm2EnvelopeArgs {
    /** TPM persistent handle returned by the binding's `generateKey`. */
    handle: string;
    /** Issuer of the bound `aa-agent+jwt`. */
    iss: string;
    /** Subject of the bound `aa-agent+jwt`. */
    sub: string;
    /** `iat` (epoch seconds) of the bound `aa-agent+jwt`. */
    iat: number;
    /** RFC 7638 thumbprint of the bound JWK. */
    jkt: string;
}
export interface Tpm2AttestationEnvelope {
    format: "tpm2";
    statement: {
        ver: "2.0";
        alg: number;
        x5c: string[];
        sig: string;
        certInfo: string;
        pubArea: string;
    };
    challenge: string;
    key_binding_jkt: string;
}
/**
 * Mint a TPM 2.0 attestation envelope bound to the given JWT
 * coordinates. Throws {@link Tpm2BackendUnavailableError} on hosts
 * without a working TPM 2.0 backend so callers can fall back to the
 * software signer.
 *
 * The returned envelope has the exact shape consumed by FU-3's
 * `verifyTpm2Attestation`:
 *
 * ```json
 * {
 *   "format": "tpm2",
 *   "statement": {
 *     "ver": "2.0",
 *     "alg": -7,
 *     "x5c": ["<leaf>", "<...>", "<root>"],
 *     "sig": "<base64url AIK signature>",
 *     "certInfo": "<base64url TPMS_ATTEST>",
 *     "pubArea": "<base64url TPMT_PUBLIC>"
 *   },
 *   "challenge": "<sha256 base64url>",
 *   "key_binding_jkt": "<RFC 7638 thumbprint>"
 * }
 * ```
 */
export declare function buildTpm2AttestationEnvelope(args: BuildTpm2EnvelopeArgs): Tpm2AttestationEnvelope;
export {};
//# sourceMappingURL=aauth_tpm2_attestation.d.ts.map