/**
 * SEV-SNP combined attestation verifier (replaces the dead Nitro path).
 *
 * Faithful TS port of reclaim-tee shared/snp_combined_{aws,verify}.go:
 * a 1-byte cloud tag (0x01 GCP / 0x02 AWS) then a CBOR envelope carrying the
 * cross-cloud app hash, the cloud-specific hardware evidence, and the
 * presentable nonce list (the SEV-SNP analogue of a CS JWT eat_nonce).
 */
export declare const SEV_TAG_GCP = 1;
export declare const SEV_TAG_AWS = 2;
export declare const SNP_APP_PREFIX = "snp-app:";
export declare const SNP_BASE_PREFIX = "snp-base:";
export declare const APP_PCR = 8;
export declare const BASE_PCR = 11;
export interface SevSnpEnvelope {
    app: Uint8Array;
    tpm?: Uint8Array;
    nitrotpm?: Uint8Array;
    sev?: Uint8Array;
    nonces?: string[];
}
export interface SevSnpResult {
    teeType: 'tee_k' | 'tee_t';
    ethAddress: string;
    app: string;
    base: string;
    nonces: string[];
}
/** Splits the 1-byte cloud tag from the CBOR envelope. */
export declare function parseSevSnpEnvelope(att: Uint8Array): Promise<{
    tag: number;
    env: SevSnpEnvelope;
}>;
/**
 * snpNonceCommitment: sha256 over, for each nonce, the 8-byte big-endian byte
 * length followed by the utf-8 bytes. Binding this in report_data/user_data is
 * what makes the carried nonces unforgeable.
 */
export declare function snpNonceCommitment(nonces: string[]): Buffer;
/**
 * expectedPCR8: the value the loader produces by extending a pristine (all-zero)
 * PCR 8 once with alg(appHash), i.e. alg(0^algSize || alg(appHash)). GCP uses the
 * SHA-256 bank, AWS the SHA-384 bank.
 */
export declare function expectedPCR8(appHash: Uint8Array, alg: 'sha256' | 'sha384'): Buffer;
export declare function appBaseIdentity(appHash: Uint8Array, pcr11: Uint8Array): {
    app: string;
    base: string;
};
export declare function extractTeeKeyFromNonces(nonces: string[]): {
    teeType: 'tee_k' | 'tee_t';
    ethAddress: string;
};
/**
 * Verifies a claim-path combined SEV-SNP attestation end to end and returns the
 * tee type, eth signing key, app/base identities, and the presentable nonces.
 * `now` defaults to the real clock; tests may pass a time in the leaf window.
 */
export declare function verifyCombinedSevSnp(att: Uint8Array, now?: Date): Promise<SevSnpResult>;