/**
 * Verify the x5c certificate chain against the Apple App Attestation Root CA.
 *
 * @param x5c - Array of DER-encoded certificates (index 0 = leaf, last = closest to root)
 * @param checkDate - Date to use for validity checking (defaults to now; override for testing expired certs)
 */
export declare function verifyCertificateChain(x5c: Uint8Array[], checkDate?: Date): Promise<void>;
/**
 * Extract the nonce from the Apple App Attest credential certificate.
 *
 * The nonce is stored in an extension with OID 1.2.840.113635.100.8.2.
 * The extension value is ASN.1: SEQUENCE { [1] EXPLICIT { OCTET STRING <nonce> } }
 *
 * @param certDer - DER-encoded leaf certificate
 * @returns The 32-byte nonce
 */
export declare function extractNonceFromCert(certDer: Uint8Array): Uint8Array;
/**
 * Extract the raw (uncompressed) public key from a DER-encoded certificate.
 *
 * @param certDer - DER-encoded certificate
 * @returns 65-byte uncompressed EC point (0x04 || x || y)
 */
export declare function extractPublicKeyFromCert(certDer: Uint8Array): Promise<Uint8Array>;