/**
 * AWS NitroTPM attestation document verifier (the AWS code-identity proof).
 *
 * Port of reclaim-tee shared/snp_combined_aws.go verifyNitroTPMDocument: the doc
 * is a COSE_Sign1 (ES384) whose leaf cert chains to the pinned AWS Nitro root;
 * its nitrotpm_pcrs carry PCR 8 (app) + PCR 11 (base) and user_data carries the
 * hardware binding.
 */
export interface NitroTpmResult {
    pcr8: Buffer;
    pcr11: Buffer;
    userData: Buffer;
}
/**
 * Verifies the NitroTPM COSE_Sign1 document and returns PCR 8 / PCR 11 and
 * user_data. Throws on any signature/chain failure. `now` defaults to the real
 * clock (production freshness); tests may pass a time inside the leaf's window.
 */
export declare function verifyNitroTpmDocument(docBytes: Uint8Array, now?: Date): Promise<NitroTpmResult>;