/**
 * CLI-side helper that turns the Windows TBS / NCrypt native binding's
 * attest output into an AAuth `cnf.attestation` envelope ready to embed
 * in an `aa-agent+jwt`.
 *
 * The actual TBS + CNG calls live in the `@neotoma/aauth-win-tbs`
 * package (`packages/aauth-win-tbs/`); this helper:
 *
 *   1. Probes the binding so callers can branch to the software-only
 *      tier on hosts without TPM hardware (or non-Windows hosts),
 *      without throwing.
 *   2. Wraps the binding's structured output into the exact JSON shape
 *      consumed by the server-side `verifyTpm2Attestation` (FU-3).
 *      Even though the backend is TBS + NCrypt, the wire format is
 *      WebAuthn-`tpm` and reuses the FU-3 verifier.
 *   3. Computes the AAuth challenge
 *      (`base64url(SHA-256(iss || sub || iat))`) so callers do not have
 *      to know the FU-3 binding contract.
 *
 * Used by:
 *   - `neotoma auth keygen --hardware` on Windows to mint the initial
 *     attestation envelope alongside the TPM-resident NCrypt key.
 *   - `neotoma auth attest --refresh` to re-mint an envelope without
 *     rotating the underlying NCrypt key.
 *
 * Behaviour on non-Windows hosts (or Windows hosts without the
 * Microsoft Platform Crypto Provider / a usable TPM 2.0 chip):
 * {@link isTbsBackendAvailable} returns `false` with a reason, and
 * {@link buildTbsAttestationEnvelope} throws
 * {@link TbsBackendUnavailableError} so the caller can fall back to
 * the software signer cleanly.
 */
export declare const TBS_PACKAGE_NAME = "@neotoma/aauth-win-tbs";
export declare class TbsBackendUnavailableError extends Error {
    readonly code: "tbs_backend_unavailable";
    readonly reason: string;
    constructor(reason: string);
}
export interface TbsBackendProbe {
    supported: boolean;
    reason?: string;
}
interface TbsBindingShape {
    isSupported(): {
        supported: boolean;
        reason?: string;
    };
    generateKey(opts: {
        provider?: string;
        scope?: "user" | "machine";
        alg?: "ES256" | "RS256";
        keyName?: string;
    }): {
        jwk: Record<string, unknown>;
        keyName: string;
        provider: string;
        scope: "user" | "machine";
        alg: "ES256" | "RS256";
    };
    attest(opts: {
        keyName: string;
        provider?: string;
        challenge: string;
        jkt: string;
    }): {
        format: "tpm2";
        ver: "2.0";
        alg: "ES256" | "RS256";
        x5c: string[];
        sig: string;
        certInfo: string;
        pubArea: string;
    };
}
/**
 * Test-only override hook. Vitest specs install a synthetic binding via
 * this hook so they can exercise the helper without requiring the
 * real native package or a TPM 2.0 chip.
 */
export declare function __setTbsBindingForTesting(binding: TbsBindingShape | null): void;
/**
 * Probe the Windows TBS backend. Returns `{ supported: true }` only
 * when the optional native package is installed AND its
 * `isSupported()` probe also returns `true`. Otherwise returns
 * `{ supported: false, reason }` so the CLI can render an actionable
 * error and fall back to the software signer.
 */
export declare function isTbsBackendAvailable(): TbsBackendProbe;
/**
 * Compute the AAuth attestation challenge:
 * `base64url(SHA-256(iss || sub || iat))`. This MUST match the
 * server-side `computeExpectedChallenge` (see
 * `src/services/aauth_attestation_verifier.ts`).
 */
export declare function computeAttestationChallenge(args: {
    iss: string;
    sub: string;
    iat: number;
}): string;
export interface BuildTbsEnvelopeArgs {
    /** NCrypt key name returned by the binding's `generateKey`. */
    keyName: string;
    /** Optional NCrypt provider override (defaults to MS_PLATFORM_KEY_STORAGE_PROVIDER). */
    provider?: string;
    /** Issuer of the bound `aa-agent+jwt`. */
    iss: string;
    /** Subject of the bound `aa-agent+jwt`. */
    sub: string;
    /** `iat` (epoch seconds) of the bound `aa-agent+jwt`. */
    iat: number;
    /** RFC 7638 thumbprint of the bound JWK. */
    jkt: string;
}
export interface TbsAttestationEnvelope {
    format: "tpm2";
    statement: {
        ver: "2.0";
        alg: number;
        x5c: string[];
        sig: string;
        certInfo: string;
        pubArea: string;
    };
    challenge: string;
    key_binding_jkt: string;
}
/**
 * Mint a Windows TBS attestation envelope bound to the given JWT
 * coordinates. Throws {@link TbsBackendUnavailableError} on hosts
 * without a working Windows TBS backend so callers can fall back to
 * the software signer.
 *
 * The returned envelope has the exact shape consumed by FU-3's
 * `verifyTpm2Attestation` (the wire format is WebAuthn-`tpm` even on
 * Windows; the TBS + NCrypt backend is purely an implementation
 * detail of the CLI):
 *
 * ```json
 * {
 *   "format": "tpm2",
 *   "statement": {
 *     "ver": "2.0",
 *     "alg": -7,
 *     "x5c": ["<leaf>", "<...>", "<root>"],
 *     "sig": "<base64url AIK signature>",
 *     "certInfo": "<base64url TPMS_ATTEST>",
 *     "pubArea": "<base64url TPMT_PUBLIC>"
 *   },
 *   "challenge": "<sha256 base64url>",
 *   "key_binding_jkt": "<RFC 7638 thumbprint>"
 * }
 * ```
 */
export declare function buildTbsAttestationEnvelope(args: BuildTbsEnvelopeArgs): TbsAttestationEnvelope;
export {};
//# sourceMappingURL=aauth_tbs_attestation.d.ts.map