/**
 * Minimal CBOR decoder — the read-side counterpart to {@link ./cbor}.
 *
 * Decodes only the subset needed to verify a vault-provider CWT bearer
 * token (RFC 8392) wrapped in a COSE Sign1 envelope (RFC 8152): tagged
 * values, definite-length arrays and maps, byte/text strings, and
 * unsigned/negative integers. Indefinite-length items, floats, and
 * big-number tags are intentionally rejected — the issuer
 * (btc-vault's `coset`/`ciborium` stack) never emits them for this
 * shape, so accepting them would only widen the parser's attack
 * surface.
 *
 * The decoder is a cursor over a single buffer. {@link CborReader.pos}
 * is public so callers can slice the exact encoded byte range of an
 * item (head + content) — required to reconstruct the COSE
 * `Sig_structure` byte-for-byte from the token's own protected-header
 * and payload byte strings.
 *
 * @module tbv/core/clients/vault-provider/auth/cborDecode
 */
/** A decoded CBOR data item. Maps preserve key insertion order. */
export type CborValue = number | bigint | string | Uint8Array | boolean | null | CborValue[] | Map<CborValue, CborValue> | CborTagged;
/** A CBOR tagged value (major type 6). */
export interface CborTagged {
    tag: number;
    value: CborValue;
}
/** Parsed initial-byte header: major type plus its decoded argument. */
export interface CborHead {
    major: number;
    /** The header argument (length, value, tag number, …) as a number. */
    arg: number;
}
export declare class CborDecodeError extends Error {
    constructor(message: string);
}
/**
 * Cursor-based reader over a CBOR buffer. Not reusable across buffers —
 * construct one per decode.
 */
export declare class CborReader {
    readonly buf: Uint8Array;
    /** Current read offset. Public so callers can slice encoded sub-ranges. */
    pos: number;
    constructor(buf: Uint8Array);
    private nextByte;
    /**
     * Read an initial byte and its argument. Rejects indefinite-length
     * and reserved additional-info encodings. Arguments wider than
     * {@link Number.MAX_SAFE_INTEGER} are rejected — none of the token's
     * lengths, tags, or timestamps approach that bound.
     */
    readHead(): CborHead;
    /** Read `length` raw bytes as a sub-array view into the backing buffer. */
    private readBytes;
    /**
     * Read a byte string (major type 2), returning its content bytes.
     * Throws if the next item is not a byte string.
     */
    readByteString(): Uint8Array;
    /**
     * Read the next complete data item as a decoded {@link CborValue}.
     *
     * `depth` tracks the current nesting level so a deeply-nested blob is
     * rejected with a {@link CborDecodeError} rather than overflowing the
     * native call stack (see {@link MAX_NESTING_DEPTH}).
     */
    readValue(depth?: number): CborValue;
}
/**
 * Decode a single CBOR item from `bytes`, rejecting any trailing bytes.
 *
 * Used to parse the COSE protected header and CWT claims set — both are
 * exactly one top-level item, so a valid prefix followed by extra bytes
 * is a malformed structure, not a benign tail. Strict consumption keeps
 * the parser from silently accepting a token a stricter CWT/COSE
 * consumer would interpret differently.
 */
export declare function decodeCbor(bytes: Uint8Array): CborValue;
//# sourceMappingURL=cborDecode.d.ts.map