/**
 * Pinned TPM 2.0 Endorsement-Key vendor root certificates.
 *
 * Every `platform: "tpm"` hardware-attestation claim must chain to one of
 * the root CAs listed here. Pinning is the self-attesting contract — a
 * verifier that dynamically fetched vendor CAs could not be reproduced
 * by a third-party audit. By committing the exact bytes of the CAs we
 * accept, anyone can audit this file, pin the same bytes in their own
 * verifier, and reach the same yes/no answer.
 *
 * The TPM ecosystem is multi-vendor by design: every Windows 11 device
 * ships with TPM 2.0 (Microsoft's mandatory requirement), every modern
 * Linux-on-x86 laptop has one, every Mac with a T2 chip has one. Each
 * vendor maintains a public CA bundle rooted at their Endorsement-Key
 * issuer. The motebit policy pins the four most common:
 *
 *   - Infineon          (`OptigaTrustM`, `SLB966x` families)
 *   - Nuvoton            (`NPCT7xx` family)
 *   - STMicroelectronics (`ST33TPHF2ESPI`, `ST33HTPH2E32AHB3`,
 *                         `ST33KTPM2X` families) — RSA + ECC parallel
 *                         roots; both pinned
 *   - Intel PTT          (firmware TPM bundled with Intel CSME)
 *
 * AMD fTPM (firmware TPM bundled with AMD PSP) uses a vendor-signed
 * chain that roots to AMD's EK CA; that root is additive and lands in
 * a subsequent pass once the first AMD-shaped test vector is captured.
 *
 * ## Real-fixture coverage is a separate concern
 *
 * Pinning the production vendor root bytes (this file) is one half of
 * the moat-provability claim. The other half — proving the verifier
 * agrees with what real hardware emits in the wild — requires a
 * captured TPM2_Quote from an actual device with its full AK→vendor-
 * root chain. Real-device captures expose serial-number-grade chip
 * identity (each device's EK cert is unique by design), so projects
 * systemically don't publish them. Real-fixture coverage stays deferred
 * to an owned-hardware capture session; see
 * `docs/doctrine/hardware-attestation.md` §"Real TPM fixture status".
 * The `rootPems` test override path remains for synthetic chain-
 * verification tests that don't require a real-device fixture.
 *
 * Each constant below ships its real vendor-published bytes. Each
 * comment names: source URL, subject DN, SHA-256 fingerprint, and
 * validity window. The fingerprint is the audit anchor — a third-party
 * verifier that fetches the same vendor URL and computes its own
 * SHA-256 should reach the byte-identical value below.
 */
/**
 * Infineon OPTIGA(TM) ECC Root CA.
 *
 *   Source:     https://pki.infineon.com/OptigaEccRootCA/OptigaEccRootCA.crt
 *   Subject:    C=DE, O=Infineon Technologies AG, OU=OPTIGA(TM) Devices,
 *               CN=Infineon OPTIGA(TM) ECC Root CA
 *   SHA-256:    cfeb02fecd55ad7a73c6e1d11985d4c47dee248ab63dcb66091a2489660443c3
 *   Public key: ECDSA P-384
 *   Validity:   2013-07-26 → 2043-07-25
 */
export declare const INFINEON_TPM_EK_ROOT_PEM = "-----BEGIN CERTIFICATE-----\nMIICWzCCAeKgAwIBAgIBBDAKBggqhkjOPQQDAzB3MQswCQYDVQQGEwJERTEhMB8G\nA1UECgwYSW5maW5lb24gVGVjaG5vbG9naWVzIEFHMRswGQYDVQQLDBJPUFRJR0Eo\nVE0pIERldmljZXMxKDAmBgNVBAMMH0luZmluZW9uIE9QVElHQShUTSkgRUNDIFJv\nb3QgQ0EwHhcNMTMwNzI2MDAwMDAwWhcNNDMwNzI1MjM1OTU5WjB3MQswCQYDVQQG\nEwJERTEhMB8GA1UECgwYSW5maW5lb24gVGVjaG5vbG9naWVzIEFHMRswGQYDVQQL\nDBJPUFRJR0EoVE0pIERldmljZXMxKDAmBgNVBAMMH0luZmluZW9uIE9QVElHQShU\nTSkgRUNDIFJvb3QgQ0EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQm1HxLVgvAu1q2\nGM+ymTz12zdTEu0JBVG9CdsVEJv/pE7pSWOlsG3YwU792YAvjSy7zL+WtDK40KGe\nOm8bSWt46QJ00MQUkYxz6YqXbb14BBr06hWD6u6IMBupNkPd9pKjQjBAMB0GA1Ud\nDgQWBBS0GIXISkrFEnryQDnexPWLHn5K0TAOBgNVHQ8BAf8EBAMCAAYwDwYDVR0T\nAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNnADBkAjA6QZcV8DjjbPuKjKDZQmTRywZk\nMAn8wE6kuW3EouVvBt+/2O+szxMe4vxj8R6TDCYCMG7c9ov86ll/jDlJb/q0L4G+\n+O3Bdel9P5+cOgzIGANkOPEzBQM3VfJegfnriT/kaA==\n-----END CERTIFICATE-----\n";
/**
 * Nuvoton TPM Root CA 2110.
 *
 *   Source:     https://www.nuvoton.com/security/NTC-TPM-EK-Cert/Nuvoton TPM Root CA 2110.cer
 *   Subject:    CN=Nuvoton TPM Root CA 2110, O=Nuvoton Technology Corporation, C=TW
 *   SHA-256:    4aebe77a51ed29959a7f9f5e07a24a558dee8167f3985d724995a541c258dfda
 *   Public key: ECDSA P-256
 *   Validity:   2015-10-19 → 2035-10-15
 */
export declare const NUVOTON_TPM_EK_ROOT_PEM = "-----BEGIN CERTIFICATE-----\nMIICBjCCAaygAwIBAgIIP5MvnZk8FrswCgYIKoZIzj0EAwIwVTFTMB8GA1UEAxMY\nTnV2b3RvbiBUUE0gUm9vdCBDQSAyMTEwMCUGA1UEChMeTnV2b3RvbiBUZWNobm9s\nb2d5IENvcnBvcmF0aW9uMAkGA1UEBhMCVFcwHhcNMTUxMDE5MDQzMjAwWhcNMzUx\nMDE1MDQzMjAwWjBVMVMwHwYDVQQDExhOdXZvdG9uIFRQTSBSb290IENBIDIxMTAw\nJQYDVQQKEx5OdXZvdG9uIFRlY2hub2xvZ3kgQ29ycG9yYXRpb24wCQYDVQQGEwJU\nVzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPv9uK2BNm8/nmIyNsc2/aKHV0WR\nptzge3jKAIgUMosQIokl4LE3iopXWD3Hruxjf9vkLMDJrTeK3hWh2ySS4ySjZjBk\nMA4GA1UdDwEB/wQEAwICBDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSf\nu3mqD1JieL7RUJKacXHpajW+9zAfBgNVHSMEGDAWgBSfu3mqD1JieL7RUJKacXHp\najW+9zAKBggqhkjOPQQDAgNIADBFAiEA/jiywhOKpiMOUnTfDmXsXfDFokhKVNTX\nB6Xtqm7J8L4CICjT3/Y+rrSnf8zrBXqWeHDh8Wi41+w2ppq6Ev9orZFI\n-----END CERTIFICATE-----\n";
/**
 * STSAFE RSA Root CA 02 — STMicroelectronics's RSA-PKI anchor for the
 * ST33 / STSAFE-TPM family. Modern ST33xxx devices provision EK certs
 * under either this RSA root or the parallel ECC root below; pin both.
 *
 *   Source:     https://sw-center.st.com/STSAFE/STSAFERsaRootCA02.crt
 *   Reference:  ST Technical Note TN1330
 *   Subject:    C=CH, O=STMicroelectronics NV, CN=STSAFE RSA Root CA 02
 *   SHA-256:    c8f179943356e13d9d84b100201cefabbf408880241e5329e60d950ce1dea623
 *   Public key: RSA-4096
 *   Validity:   2022-01-20 → 9999-12-31
 */
export declare const STMICRO_TPM_EK_RSA_ROOT_PEM = "-----BEGIN CERTIFICATE-----\nMIIFXjCCA0agAwIBAgIGVR0gAAACMA0GCSqGSIb3DQEBDAUAME0xCzAJBgNVBAYT\nAkNIMR4wHAYDVQQKExVTVE1pY3JvZWxlY3Ryb25pY3MgTlYxHjAcBgNVBAMTFVNU\nU0FGRSBSU0EgUm9vdCBDQSAwMjAgFw0yMjAxMjAwMDAwMDBaGA85OTk5MTIzMTAw\nMDAwMFowTTELMAkGA1UEBhMCQ0gxHjAcBgNVBAoTFVNUTWljcm9lbGVjdHJvbmlj\ncyBOVjEeMBwGA1UEAxMVU1RTQUZFIFJTQSBSb290IENBIDAyMIICIjANBgkqhkiG\n9w0BAQEFAAOCAg8AMIICCgKCAgEAyDtHbW51K/pnDbnPdLQTls2U/bu/aDATTi1W\nCZDAtFC9sWtCRK6jQ0SG9DCCys7ur170V3Q+HVov88FzH6bYg4TWY7+wEQKLR/4W\nIgdCjcW3uXMimsh9tOb+UlfRMW0yEozi7F+F/v07lULTJg+itCOMASi/caV1ySYI\ncX5z/5Woj3hDgJGa4scOoxdOfPg1GCkEjQPy7fG/IBt883palE/T4UNg1megfLcg\nhjOrbaPTFB3qXmm6E07QDYMkPiqryz3v9MCnOw62EXGcQLFIK4DwPxySU7NxO0ta\nDHXv+8B5ljv4Jtx5OLkDf9YAfjEg6ZOpsyIGKI+bgIoVYtGbXTDZAtoMKw3ystQX\nva9ceQ4cIQQUjpH6nFm8dbm/TOrkZd6m9pmLftR6kTuzRd8hhKCwpfcKbxQlMI2u\nTDVbw03IFUhk23uDSTOzsyOjB2f93SLEw1yTBuiYXhO2YHUHFJckbiuz7RdE4sjN\n1J0LwxKKbm9kleYEP+Kah6IJ0Zs7vbP3WNZUpmt6/XTmszb+paTSpanUYbBr2/IE\naQCRiAlv0H26i5u4CjSHRjjRIqLAuGnpn0gZ2Zgs1espJwmey7MPKvTJtK1H+TQN\n0HZW8DYtcdzPkpxqKndWIUR7JTnozVPCVOcirSPGdkSvhbAGPyoyv7ju86RnTiT0\nNLz7SbECAwEAAaNCMEAwHQYDVR0OBBYEFHzCjb5uWdhKVANGmxMIANL48G0nMA4G\nA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4IC\nAQCykiyYyHAXHzRBdqJ3QLr8qTDDNO3RdLToZmiFRdslaRr2RtlDDjcAEFKf1u/E\n1qprZe926Ob5KxWIQREvDAgqAbRS9fd3+w6hZ+ZrmHNh5aH2UEgsfAi9vZ3K8BH/\nrReqTm0oxCMz4socJ9tIpvGSZhJg6PDTidsIscr8iNcSsVYJO60wSMxn7tv+Buh+\nZgJFddzEYZqTuezsdiXswkAkwqTJY9KM1w0bFLHrmifkc0y6I+jeBgjGxMknz8G5\np7YX4GoeJp5LjM8z36qBFKcjkKpYEb2H+u6CxgXFsxu6nkB0pn3u2uNwmXTYIQKO\ntrcshrmoKUv7mDvtaNIa0blMTRTEZzkwrR1BsHm/Gz7NLhgkDIv9p1u5oiCwlebh\neJ1cDJ9I7puSBPiDDpkdvVPg0wNFPai/SAhjW0OaULcybVR7kXzST9/xerCoquYp\nI+qLjTs+RqahgL5a9ZRPVABX3DwvnDCarwVqMSfRjGP4e8b2BspDM+wPTvQH1K4O\nxk+qc9HT7YubzqhtJ/yfcYd/eKTsk60aNmknatNZDSFzq03lxN048n3D9mcjGDkR\n15Kv5NX8DhZuCNcBddkGC96uYpgSvl089RgnSL/qPlM+QlVjPbqDpISd/z3X4RNb\nvdT+agOdZZJRB1MROQXDnACVdQB1ba/DTO4UNEou27D03Q==\n-----END CERTIFICATE-----\n";
/**
 * STSAFE ECC Root CA 02 — STMicroelectronics's ECC-PKI anchor for the
 * ST33 / STSAFE-TPM family. Sibling of the RSA root above; modern ST33
 * devices use one or the other depending on EK template firmware.
 *
 *   Source:     https://sw-center.st.com/STSAFE/STSAFEEccRootCA02.crt
 *   Reference:  ST Technical Note TN1330
 *   Subject:    C=CH, O=STMicroelectronics NV, CN=STSAFE ECC Root CA 02
 *   SHA-256:    fd1e7b68accd825636b27b3177c67402d463a7f04c97b6c47ab705fcdc1a04f6
 *   Public key: ECDSA P-521
 *   Validity:   2022-01-20 → 9999-12-31
 */
export declare const STMICRO_TPM_EK_ECC_ROOT_PEM = "-----BEGIN CERTIFICATE-----\nMIICWjCCAbugAwIBAgIGVR0gAAECMAoGCCqGSM49BAMEME0xCzAJBgNVBAYTAkNI\nMR4wHAYDVQQKExVTVE1pY3JvZWxlY3Ryb25pY3MgTlYxHjAcBgNVBAMTFVNUU0FG\nRSBFQ0MgUm9vdCBDQSAwMjAgFw0yMjAxMjAwMDAwMDBaGA85OTk5MTIzMTAwMDAw\nMFowTTELMAkGA1UEBhMCQ0gxHjAcBgNVBAoTFVNUTWljcm9lbGVjdHJvbmljcyBO\nVjEeMBwGA1UEAxMVU1RTQUZFIEVDQyBSb290IENBIDAyMIGbMBAGByqGSM49AgEG\nBSuBBAAjA4GGAAQAJFgkbtp5mZpvISjL8zAUSSJXxXpPhxhSVGQfqU0GEjPBIMMD\nKNvc23xCcyIsiFTMD4MZQ1wov0SaBE3M31bWx78BrbiPCJ4lXUvJWiwm9+v3EL1z\nlznBtyJDYUkrUe2n7r8NH7kAQ1X/csItvyomECdRtm4wwD8VX1n+l3npVlMNOxWj\nQjBAMB0GA1UdDgQWBBT1XLcHvEsXQiYkgEBLu3yAulo8vjAOBgNVHQ8BAf8EBAMC\nAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDBAOBjAAwgYgCQgC85uufYwd5\nyelX2EKkjx7s8LP6qgcXHxkO1zZYrTU7umomS5beVyPf2hA12yPVG9VnYUqs9+RA\nL0mbODJNfHR5yAJCAUf2a5qPe3a/BpZBoY7YI68nUt1UD8ScX+IbkLJQ6mPe8pNR\nxRJfSy8RvtTJcPEqH7kpj5sZjlRC5GUG/3Sco8uX\n-----END CERTIFICATE-----\n";
/**
 * Intel TPM EK Root Certificate (used by Intel PTT, the firmware TPM
 * bundled with Intel CSME).
 *
 *   Source:     https://upgrades.intel.com/content/CRL/ekcert/EKRootPublicKey.cer
 *   Subject:    C=US, ST=CA, L=Santa Clara, O=Intel Corporation,
 *               OU=TPM EK root cert signing, CN=www.intel.com
 *   SHA-256:    2e1b3ba79af56d758be51697621bc4b9e8cee0983db3e749c55eb9b37c6d2ae0
 *   Public key: ECDSA P-256
 *   Validity:   2014-01-15 → 2049-12-31
 */
export declare const INTEL_PTT_EK_ROOT_PEM = "-----BEGIN CERTIFICATE-----\nMIICdzCCAh6gAwIBAgIUB+dPf7a3IyJGO923z34oQLRP7pwwCgYIKoZIzj0EAwIw\ngYcxCzAJBgNVBAYMAlVTMQswCQYDVQQIDAJDQTEUMBIGA1UEBwwLU2FudGEgQ2xh\ncmExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMSEwHwYDVQQLDBhUUE0gRUsg\ncm9vdCBjZXJ0IHNpZ25pbmcxFjAUBgNVBAMMDXd3dy5pbnRlbC5jb20wHhcNMTQw\nMTE1MDAwMDAwWhcNNDkxMjMxMjM1OTU5WjCBhzELMAkGA1UEBgwCVVMxCzAJBgNV\nBAgMAkNBMRQwEgYDVQQHDAtTYW50YSBDbGFyYTEaMBgGA1UECgwRSW50ZWwgQ29y\ncG9yYXRpb24xITAfBgNVBAsMGFRQTSBFSyByb290IGNlcnQgc2lnbmluZzEWMBQG\nA1UEAwwNd3d3LmludGVsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJR9\ngVEsjUrMb+E/dl19ywJsKZDnghmwVyG16dAfQ0Pftp1bjhtPEGEguvbLGRRopKWH\nVscAOlTFnvCHq+6/9/SjZjBkMB8GA1UdIwQYMBaAFOhSBcJP2NLVpSFHFrbODHtb\nuncPMB0GA1UdDgQWBBToUgXCT9jS1aUhRxa2zgx7W7p3DzASBgNVHRMBAf8ECDAG\nAQH/AgEBMA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNHADBEAiAldFScWQ6L\nPQgW/YT+2GILcATEA2TgzASaCrG+AzL6FgIgLH8ABRzm028hRYR/JZVGkHiomzYX\nVILmTjHwSL7uZBU=\n-----END CERTIFICATE-----\n";
/**
 * @deprecated since 1.1.0, removed in 2.0.0. Use {@link STMICRO_TPM_EK_RSA_ROOT_PEM} (RSA-PKI) or {@link STMICRO_TPM_EK_ECC_ROOT_PEM} (ECC-PKI) directly.
 *
 *   Reason: ST runs parallel RSA + ECC trust anchors for the
 *   ST33 / STSAFE-TPM family; the single-PEM constant could only
 *   ever name one of them, and modern ST33 devices may chain to
 *   either depending on EK template firmware. Kept as an alias for
 *   the ECC root (the modern default for most ST33 EK templates) for
 *   one minor release cycle so existing consumers don't break the
 *   moment they pull `1.1.0`.
 */
export declare const STMICRO_TPM_EK_ROOT_PEM = "-----BEGIN CERTIFICATE-----\nMIICWjCCAbugAwIBAgIGVR0gAAECMAoGCCqGSM49BAMEME0xCzAJBgNVBAYTAkNI\nMR4wHAYDVQQKExVTVE1pY3JvZWxlY3Ryb25pY3MgTlYxHjAcBgNVBAMTFVNUU0FG\nRSBFQ0MgUm9vdCBDQSAwMjAgFw0yMjAxMjAwMDAwMDBaGA85OTk5MTIzMTAwMDAw\nMFowTTELMAkGA1UEBhMCQ0gxHjAcBgNVBAoTFVNUTWljcm9lbGVjdHJvbmljcyBO\nVjEeMBwGA1UEAxMVU1RTQUZFIEVDQyBSb290IENBIDAyMIGbMBAGByqGSM49AgEG\nBSuBBAAjA4GGAAQAJFgkbtp5mZpvISjL8zAUSSJXxXpPhxhSVGQfqU0GEjPBIMMD\nKNvc23xCcyIsiFTMD4MZQ1wov0SaBE3M31bWx78BrbiPCJ4lXUvJWiwm9+v3EL1z\nlznBtyJDYUkrUe2n7r8NH7kAQ1X/csItvyomECdRtm4wwD8VX1n+l3npVlMNOxWj\nQjBAMB0GA1UdDgQWBBT1XLcHvEsXQiYkgEBLu3yAulo8vjAOBgNVHQ8BAf8EBAMC\nAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDBAOBjAAwgYgCQgC85uufYwd5\nyelX2EKkjx7s8LP6qgcXHxkO1zZYrTU7umomS5beVyPf2hA12yPVG9VnYUqs9+RA\nL0mbODJNfHR5yAJCAUf2a5qPe3a/BpZBoY7YI68nUt1UD8ScX+IbkLJQ6mPe8pNR\nxRJfSy8RvtTJcPEqH7kpj5sZjlRC5GUG/3Sco8uX\n-----END CERTIFICATE-----\n";
/**
 * Default pinned-root set returned when a caller passes no `rootPems`
 * override. Five real vendor bytes covering the four major TPM 2.0
 * silicon vendors (STMicroelectronics ships parallel RSA + ECC roots,
 * both pinned). Ordered by deployment prevalence — Infineon and Intel
 * PTT together cover the vast majority of Windows 11 hosts; Nuvoton
 * and STMicro cover most non-Intel Linux laptops and ST33-based
 * embedded systems.
 */
export declare const DEFAULT_PINNED_TPM_ROOTS: readonly string[];
/**
 * Sentinel value the consumer-facing verifier emits on a mint path
 * where the Rust bridge returns a `not_supported` failure envelope.
 * Exposed as a constant so call sites match on a named token rather
 * than a raw string literal.
 */
export declare const TPM_PLATFORM: "tpm";
//# sourceMappingURL=tpm-roots.d.ts.map