@suaveplan/tpm-struct - Zero-dep, universal TPM 2.0 attestation-structure parser/serialiser. Decodes TPMS_ATTEST (TCG Part 2 §10.12) and TPMT_PUBLIC (§12.2) byte strings, computes canonical TPM names (Part 1 §16), and underpins WebAuthn 'tpm'-format attestation verification.

Summary

Zero-runtime-dep TPM 2.0 attestation-structure parser and serialiser. Decodes TPMS_ATTEST (TCG TPM 2.0 Library Part 2 §10.12), decodes TPMT_PUBLIC (§12.2), and computes canonical TPM 2.0 name digests per TCG Part 1 §16. Underpins WebAuthn tpm-format attestation verification (W3C WebAuthn L3 §8.3) and every future TPM 2.0 attestation context (AIK enrollment, remote attestation, vTPM provisioning) without dragging in a TPM driver, Node-only runtime, or CommonJS legacy bridge.

The package is buffer-only: it neither imports a hash library nor talks to a TPM device. Callers inject HashLike for computeTpmtPublicName and ConstantTimeEqual for extraDataMatches, which keeps the package free of crypto-engine selection while making the right shape available at the WebAuthn step-5/step-8 call site.

Documentation tree

alg — (no submodules)
- alg — (no submodules)
attest — (no submodules) - serialize — serializeTpmsAttest re-emits a parsed…
- attest — (no submodules) - serialize — serializeTpmsAttest re-emits a parsed…
- serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
buffer — (no submodules)
- buffer — (no submodules)
diagnostic — (no submodules)
- diagnostic — (no submodules)
errors — (no submodules)
- error-codes — (no submodules)
extra-data — (no submodules)
- extra-data — (no submodules)
name — (no submodules)
- name — (no submodules)
observability — (no submodules)
- metrics — (no submodules)
public — (no submodules) - serialize — serializeTpmtPublic re-emits a parsed…
- object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
- public — (no submodules) - serialize — serializeTpmtPublic re-emits a parsed…
- serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
schemas — (no submodules)
- schemas — (no submodules)

- [alg](./src/alg/alg.md) — _(no submodules)_- [attest](./src/attest/attest.md) — _(no submodules)_- serialize — `serializeTpmsAttest` re-emits a parsed…

attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
buffer — (no submodules)- buffer — (no submodules)- diagnostic — (no submodules)- diagnostic — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- extra-data — (no submodules)- extra-data — (no submodules)- name — (no submodules)- name — (no submodules)- observability — (no submodules)- metrics — (no submodules)- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
- object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
- serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
schemas — (no submodules)- schemas — (no submodules)- alg — (no submodules)- attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
- attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
- serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
buffer — (no submodules)- buffer — (no submodules)- diagnostic — (no submodules)- diagnostic — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- extra-data — (no submodules)- extra-data — (no submodules)- name — (no submodules)- name — (no submodules)- observability — (no submodules)- metrics — (no submodules)- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
- object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
- serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
schemas — (no submodules)- schemas — (no submodules)- alg — (no submodules)- attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
- attest — (no submodules)- serialize — serializeTpmsAttest re-emits a parsed…
- serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
buffer — (no submodules)- buffer — (no submodules)- diagnostic — (no submodules)- diagnostic — (no submodules)- errors — (no submodules)- error-codes — (no submodules)- extra-data — (no submodules)- extra-data — (no submodules)- name — (no submodules)- name — (no submodules)- observability — (no submodules)- metrics — (no submodules)- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
- object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
- public — (no submodules)- serialize — serializeTpmtPublic re-emits a parsed…
- serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
schemas — (no submodules)- schemas — (no submodules)- alg — (no submodules)- attest — (no submodules) - attest — (no submodules) - serialize — serializeTpmsAttest re-emits a parsed TpmsAttest value as the TCG-canonical byte string per Library Part 2 §10.12.…
buffer — (no submodules) - buffer — (no submodules)- diagnostic — (no submodules) - diagnostic — (no submodules)- errors — (no submodules) - error-codes — (no submodules)- extra-data — (no submodules) - extra-data — (no submodules)- name — (no submodules) - name — (no submodules)- observability — (no submodules) - metrics — (no submodules)- public — (no submodules) - object-attributes — decodeObjectAttributes (and its inverse encodeObjectAttributes) walk the 32-bit TPMA_OBJECT bitfield documented i…
- public — (no submodules) - serialize — serializeTpmtPublic re-emits a parsed TpmtPublic value as the TCG-canonical byte string per Library Part 2 §12.2. I…
schemas — (no submodules) - schemas — (no submodules)

Install

bun add @suaveplan/tpm-struct

Quick start

import { createHash } from "node:crypto";
import {
    parseTpmsAttest,
    parseTpmtPublic,
    computeTpmtPublicName,
    extraDataMatches,
} from "@suaveplan/tpm-struct";

const att = parseTpmsAttest(attestationData);          // TPMS_ATTEST
const pub = parseTpmtPublic(pubArea);                  // TPMT_PUBLIC
const name = computeTpmtPublicName(pub, {              // 0x000b || sha256(...)
    digest: (b) => new Uint8Array(createHash("sha256").update(b).digest()),
});

if (
    att.type === "TPM_ST_ATTEST_CERTIFY" &&
    extraDataMatches(att.attested.name, name, /* injected constantTimeEqual */ null!)
) {
    // pubArea is the public area the TPM certified.
}

Modules

Module	Purpose
`buffer`	`TpmBufferReader` / `TpmBufferWriter` over §10.1 octet streams.
`alg`	`TPM_ALG` / `TPM_ECC_CURVE` frozen registries + symbolic lookup.
`public/public`	`parseTpmtPublic` per §12.2.
`public/serialize`	`serializeTpmtPublic` canonical encoder.
`public/object-attributes`	`TPMA_OBJECT` bitfield decoder (§8.3).
`attest/attest`	`parseTpmsAttest` per §10.12.
`attest/serialize`	`serializeTpmsAttest` canonical encoder.
`name/name`	`computeTpmtPublicName` per Part 1 §16.
`extra-data/extra-data`	WebAuthn step-8 `extraData` match.
`schemas/schemas`	Zod boundary schemas.
`errors/error-codes`	`TPM_STRUCT_CODES` + `TpmStructError`.
`observability/metrics`	OTel histograms + counters.
`diagnostic/diagnostic`	Debug-only human-readable dumper.

Subpath exports

., ./buffer, ./alg, ./public, ./attest, ./name, ./extra-data, ./schemas, ./errors, ./diagnostic.

Dependencies

@suaveplan/error, @suaveplan/types, @opentelemetry/api, tslib, zod. No node:* imports; no external TPM tooling.

License

MIT.