@aleutian/verification 0.0.0 → 0.7.0

package/dist/browser/index.d.ts

@@ -0,0 +1,3093 @@
+/**
+ * Core types for the Aleutian verification SDK.
+ *
+ * All interfaces use readonly properties for immutability.
+ * Field names use camelCase to match TypeScript/JavaScript conventions.
+ */
+/**
+ * The entry ID range covered by an anchor.
+ *
+ * Identifies the first and last entries in the chain segment this anchor
+ * attests to.
+ */
+interface AnchorRange {
+    /** v1-v6: the entry_id of the first entry covered by this anchor ("" in v7). */
+    readonly startEntryId: string;
+    /** v1-v6: the entry_id of the last entry covered by this anchor ("" in v7). */
+    readonly endEntryId: string;
+    /**
+     * v7 only: the `global_seq` of the first entry covered (format-spec §9.1).
+     *
+     * On the wire a decimal STRING, because it may exceed 2^53: a `number` would
+     * round it and canonicalize different bytes. `parseAnchorText` returns a
+     * `bigint`; pass a `bigint` (or a safe `number`) yourself.
+     */
+    readonly startSeq?: bigint | number;
+    /** v7 only: the `global_seq` of the last entry covered, inclusive. As `startSeq`. */
+    readonly endSeq?: bigint | number;
+}
+/**
+ * A signed chain checkpoint.
+ *
+ * An anchor is a cryptographically signed attestation of a company's
+ * audit chain state at a specific point in time. Anchors are generated
+ * periodically (typically daily) and can be used to verify chain
+ * integrity without network access.
+ *
+ * The signature is an ML-DSA-65 (FIPS 204) signature over the canonical
+ * JSON form of the anchor (all fields except `signature`, alphabetical key order).
+ *
+ * WARNING (M-5): companyId contains business-identifying information.
+ * Do not log anchors in production — wrap with
+ * `redactedAnchor(anchor)` from `./redactedView` before passing to any
+ * logger or `JSON.stringify`. The interface is a plain object literal,
+ * so it does not own a `toJSON` redactor itself.
+ */
+interface Anchor {
+    /** The anchor format version: 1, 2, 3, 4, 6 or 7 (5 is withdrawn). */
+    readonly version: number;
+    /** The unique identifier for this anchor. */
+    readonly anchorId: string;
+    /** The company this anchor belongs to. WARNING: Contains business-identifying information. */
+    /**
+     * The namespace this anchor is about — whatever the chain describes.
+     *
+     * WIRE KEY VARIES BY VERSION. v3-v5 spell it `company_id`; v6 spells it
+     * `subject`. The key is INSIDE the signed bytes, which is why the rename
+     * needed a new version rather than being a refactor — and why the field also
+     * MOVES, from 3rd alphabetically to 8th.
+     *
+     * NOT ERASABLE, and MUST NOT CARRY PERSONAL DATA. Changing it invalidates the
+     * signature, and through `chainHash` and `previousAnchorId` it invalidates
+     * every anchor that follows. Use a stable pseudonym or an opaque id.
+     *
+     * Named `companyId` before 2026-09-23.
+     */
+    readonly subject: string;
+    /**
+     * Anchor-of-anchors digest binding this anchor to its covered chain.
+     *
+     * NOT byte-equal to the tip entry's `chain_hash` — it is the output
+     * of `computeAnchorChainHash`, which applies a distinct SHA-512
+     * domain separator (`"aleutian.anchor.v2:"`) and folds in the
+     * previous anchor's hash, the company id, the entry range, and the
+     * tip entry's `chain_hash`. Verifiers MUST recompute this value
+     * (not byte-compare against the tip) to validate the binding.
+     */
+    readonly chainHash: string;
+    /** The entry ID range covered by this anchor. */
+    readonly range: AnchorRange;
+    /**
+     * The number of entries covered by this anchor.
+     *
+     * Typed `bigint | number` so int64 values exceeding `Number.MAX_SAFE_INTEGER`
+     * (2^53 − 1) can be represented losslessly. Mirrors V3 SAR pattern.
+     * Ticket: dsar_js_anchor_int64_widening.
+     */
+    readonly entryCount: bigint | number;
+    /** The base64-encoded ML-DSA-65 signature over the canonical JSON form. */
+    readonly signature: string;
+    /** Identifies which signing key was used. Corresponds to a key in EMBEDDED_PUBLIC_KEYS. */
+    readonly signingKeyId: string;
+    /**
+     * The timestamp when this anchor was generated, in milliseconds since Unix epoch (UTC).
+     *
+     * Typed `bigint | number` for int64 boundary safety; realistic millisecond
+     * timestamps fit in `number` through year 2286.
+     */
+    readonly createdAtMs: bigint | number;
+    /** The anchor_id of the preceding anchor, or empty string for the first anchor. */
+    readonly previousAnchorId: string;
+    /**
+     * Version=4+: a signed claim that the chain from
+     * (previous_anchor.entry_count + 1) through this anchor's
+     * entry_count has been verified clean by the anchor-generator at
+     * signing time (ui_chainops_18).
+     *
+     * Version dispatch invariants:
+     *   - Version <= 3 anchors MUST carry verifiedThrough === 0.
+     *   - Version === 4 anchors MUST carry verifiedThrough > 0.
+     *
+     * Cross-language encoding: always present in JSON (no omission) so
+     * Go, Python, and JS produce byte-identical canonical bytes.
+     *
+     * Optional in the TypeScript interface for backwards compatibility
+     * with v3 anchor JSON that pre-dates this field; defaults to 0.
+     *
+     * Typed `bigint | number` so int64 max-boundary values (2^63 − 1)
+     * canonicalize losslessly. Ticket: dsar_js_anchor_int64_widening.
+     */
+    readonly verifiedThrough?: bigint | number;
+    /**
+     * v7 only: the previous anchor's `chainHash`, or `SEED_ANCHOR_HASH` for the
+     * first anchor (format-spec §9.1). Inside the signed bytes, so a v7 anchor
+     * is bound with no second file. Absent on v1-v6.
+     */
+    readonly previousAnchorHash?: string;
+}
+/**
+ * An entry from a data export.
+ *
+ * Contains the fields needed to verify chain integrity for an exported
+ * audit entry. This matches the schema of Aleutian's data export format.
+ */
+interface ExportedEntry {
+    /** The unique identifier for this entry. */
+    readonly entryId: string;
+    /** Indicates the type of entry (e.g., "request", "tombstone"). */
+    readonly entryType: string;
+    /** When this entry was created. Format: RFC3339 with microsecond precision. */
+    readonly timestamp: string;
+    /** The batch run identifier that linked this entry. */
+    readonly runId: string;
+    /** The 0-indexed position within the batch run. */
+    readonly sequenceNum: number;
+    /**
+     * The global sequence number across all runs.
+     *
+     * A 64-bit integer on the wire (format-spec §2.1). `parseEntriesText` returns
+     * a `number` up to `Number.MAX_SAFE_INTEGER` and a `bigint` beyond it, so the
+     * value is never rounded. Pass a `bigint` yourself for anything above 2^53.
+     */
+    readonly globalSeq: number | bigint;
+    /** The SHA-512 hash of the entry content (128 hex chars), or tombstone content hash. */
+    readonly contentHash: string;
+    /** The chain hash linking this entry to its predecessor. */
+    readonly chainHash: string;
+    /**
+     * v4 only: the entry's salt, 64 lowercase hex (format-spec §2.0). Absent on an
+     * erased entry. On a v2 or v3 entry it is `format_field_misuse` (§2.2).
+     */
+    readonly salt?: string;
+    /**
+     * v4 only: the leaf hash the chain hash covers, 128 lowercase hex
+     * (format-spec §2.0). Kept by erasure. On a v2 or v3 entry it is
+     * `format_field_misuse`.
+     */
+    readonly leafHash?: string;
+    /**
+     * v4 only: `true` on an erased entry (format-spec §5.0), which then carries
+     * no id, type, content hash or salt. A live entry carries no `erased` member:
+     * `false` is refused (`invalid_field`).
+     */
+    readonly erased?: boolean;
+    /**
+     * The snake_case names of the members the entry carried, as
+     * `parseEntriesText` read it. Set on v4 entries only.
+     *
+     * v4 tells an ABSENT member from an empty one (format-spec §2.0: run fields
+     * are "absent, not zero"; an erased entry's id is absent, not empty), which
+     * the required string fields of this interface cannot. When this is not set
+     * (an entry built in code), an empty `entryId` / `entryType` /
+     * `contentHash` / `runId`, a zero `sequenceNum`, and an undefined `salt` /
+     * `leafHash` / `erased` count as absent.
+     */
+    readonly presentMembers?: ReadonlySet<string>;
+    /**
+     * Which preimage produced `chainHash`: 2, 3 or 4.
+     *
+     * ZERO OR ABSENT MEANS V2. Entries written before this field existed carry no
+     * value for it, so treating its absence as v2 is what keeps every chain in
+     * existence verifiable. The two formats cannot be told apart by looking at a
+     * digest, so a verifier that guesses is one that reports false breaks.
+     */
+    readonly formatVersion?: number;
+}
+/**
+ * Break types that can be detected during chain verification.
+ */
+type BreakType = "hash_mismatch" | "sequence_gap" | "invalid_tombstone" | "anchor_mismatch"
+/**
+ * The entry declares a format this build cannot recompute.
+ *
+ * NOT tamper evidence. Reporting it as a hash mismatch would tell a reader
+ * their chain was altered when it was not.
+ */
+ | "unknown_format"
+/**
+ * The entry carries a field its declared format does not bind — a v3 entry
+ * with runId or sequenceNum, which invites a reader to treat them as attested
+ * when they are free to change.
+ */
+ | "format_field_misuse"
+/**
+ * A field is outside its fixed shape (format-spec §5.5): a `chainHash` or
+ * `contentHash` that is not a digest, a negative `globalSeq`, a v2 entry with
+ * a negative `sequenceNum` or an empty `runId`, or a malformed predecessor
+ * hash. Checked BEFORE recomputing: a hash recomputed over malformed fields
+ * can equal the stored one. Named `malformed_field` before format-spec §5.5.
+ */
+ | "invalid_field"
+/**
+ * The stored timestamp is not exactly `YYYY-MM-DDTHH:MM:SS.ffffffZ`
+ * (format-spec §4). Another spelling of the same instant is still a break:
+ * the hash covers one spelling.
+ */
+ | "invalid_timestamp";
+/**
+ * A break found during offline verification.
+ *
+ * Contains details about an inconsistency detected during chain
+ * verification, including the position, entry ID, and type of break.
+ *
+ * WARNING (M-4): Contains entryId and hashes that may correlate to PII.
+ * Do not log breaks directly — wrap with `redactedOfflineBreak(brk)`
+ * from `./redactedView`. Even 8-char hash prefixes can leak audit-
+ * chain structure; the opaque view is the only sanctioned logging
+ * shape.
+ */
+interface OfflineBreak {
+    /** The 0-indexed position in the entries list where the break was detected. */
+    readonly position: number;
+    /** The entryId of the entry where the break was detected. */
+    readonly entryId: string;
+    /** The expected chain hash (computed from inputs). */
+    readonly expectedHash: string;
+    /** The actual chain hash found in the entry. */
+    readonly actualHash: string;
+    /** Categorizes the break. */
+    readonly breakType: BreakType;
+    /** Additional context about the break. */
+    readonly context: Readonly<Record<string, string>>;
+}
+/**
+ * Result of offline chain verification.
+ *
+ * Summarizes the results of verifying a chain export against an anchor.
+ *
+ * WARNING (M-8): Do not log durationMs in production — it can reveal chain
+ * size and business volume. If logging is required, log only the
+ * boolean `valid` field; do not pass the result object to a logger.
+ */
+interface OfflineVerificationResult {
+    /** True if no breaks were found. */
+    readonly valid: boolean;
+    /**
+     * The number of entries walked that a tombstone does not leave exposed:
+     * `entriesProcessed - entriesNotVerified`.
+     *
+     * Entries up to and including the last tombstone are NOT counted here
+     * (format-spec §5.5): a tombstone's chain hash is taken as stored, so nothing
+     * links the entries before it to the ones after. Equal to `entriesProcessed`
+     * when the chain has no tombstone.
+     */
+    readonly entriesVerified: number;
+    /** The number of entries walked (after `maxEntries`), whatever their status. */
+    readonly entriesProcessed: number;
+    /** The number of tombstone entries encountered. */
+    readonly tombstonesFound: number;
+    /**
+     * The number of v4 entries carrying `erased: true`, malformed or not
+     * (format-spec §5.5). An erased v4 entry is still recomputed (§5.0), so it is
+     * verified like any other; this only counts them.
+     */
+    readonly erasedFound: number;
+    /**
+     * The 0-indexed position of the last tombstone (erased entry) in the entries
+     * walked, or -1 when there is none.
+     */
+    readonly lastTombstone: number;
+    /**
+     * How many entries this result leaves exposed: every entry up to and
+     * including the last tombstone (`lastTombstone + 1`; 0 when there is none).
+     *
+     * A verifier cannot detect a rewrite of these entries (format-spec §5.5).
+     * Never describe them as verified, or as bound by an anchor.
+     */
+    readonly entriesNotVerified: number;
+    /**
+     * The outcome of binding `options.anchor`, when one was supplied. Any
+     * outcome other than `"bound"` or `"chain_broken"` also appears as an
+     * `anchor_mismatch` break.
+     */
+    readonly anchorOutcome?: AnchorBindOutcome;
+    /** Details about any chain breaks found. */
+    readonly breaks: readonly OfflineBreak[];
+    /** How long verification took in milliseconds. Do not log in production. */
+    readonly durationMs: number;
+}
+/**
+ * Options for chain verification.
+ *
+ * Allows customization of chain verification, including setting
+ * resource limits to prevent OOM on large chains.
+ */
+interface ChainVerifyOptions {
+    /**
+     * Bind the verified chain to a signed Aleutian anchor.
+     *
+     * When set, after walking the entries the verifier recomputes the
+     * expected anchor chain hash via `computeAnchorChainHash` and
+     * compares against `anchor.chainHash`. Mismatch emits an
+     * `anchor_mismatch` {@link OfflineBreak}.
+     *
+     * Omit to skip anchor binding (per-entry chain integrity still checked).
+     */
+    readonly anchor?: Anchor;
+    /**
+     * Chain hash of the anchor immediately preceding `anchor` in the
+     * anchor-of-anchors chain. Required when `anchor` is set.
+     *
+     * For genesis anchors (`anchor.previousAnchorId === SEED_ANCHOR_ID`)
+     * pass `SEED_ANCHOR_HASH`, or omit — the SDK falls back to
+     * `SEED_ANCHOR_HASH` automatically. For mid-chain anchors callers
+     * MUST fetch the prior anchor and supply its `chainHash` here;
+     * otherwise no trust can be established and verification emits
+     * `anchor_mismatch`.
+     */
+    readonly previousAnchorHash?: string;
+    /**
+     * The chain hash of the entry immediately before `entries[0]`, to verify a
+     * SEGMENT of a chain. Empty or omitted for a whole chain.
+     *
+     * Must be exactly 128 lowercase hex characters; anything else is an
+     * `invalid_field` break at position 0. A segment cannot be bound to an
+     * anchor (format-spec §9.8): passing this together with `anchor` throws.
+     */
+    readonly previousHash?: string;
+    /**
+     * Deprecated and broken: byte-compares the walked tip chain_hash
+     * against a caller-supplied hash. Use `anchor` + `previousAnchorHash`
+     * instead.
+     *
+     * Kept for backwards compatibility with prior 0.x callers; will be
+     * removed in the next minor release. Cannot bind to real
+     * Aleutian-produced anchors because `anchor.chain_hash` lives in a
+     * different SHA-512 domain than the entry's `chain_hash`.
+     *
+     * @deprecated pass `anchor` + `previousAnchorHash` for real binding.
+     */
+    readonly expectedLastHash?: string;
+    /** Limits entries processed. 0 = unlimited. Use this to prevent OOM on very large exports. */
+    readonly maxEntries?: number;
+    /** Stops verification early if this many breaks are found. 0 = unlimited. */
+    readonly maxBreaks?: number;
+}
+/**
+ * The outcome of a keyless bind of an anchor to entries (format-spec §9.7,
+ * §9.8). Only `"bound"` is a bind.
+ *
+ *   - `chain_broken`: the entries do not verify, so nothing is bound
+ *   - `range_start_mismatch`: the first entry given is not `range.startEntryId`
+ *   - `range_end_mismatch`: the last entry given is not `range.endEntryId`
+ *     (which is what a chain that has grown since the anchor reports: pass the
+ *     covered prefix)
+ *   - `height_mismatch`: the number of entries given is not `entryCount`
+ *   - `predecessor_mismatch`: `previousAnchorId` is the seed id but the
+ *     predecessor hash is not the seed hash, or the reverse
+ *   - `head_mismatch`: the recomputed anchor chain hash is not the anchor's
+ */
+type AnchorBindOutcome = "bound" | "chain_broken" | "range_start_mismatch" | "range_end_mismatch" | "height_mismatch" | "head_mismatch" | "predecessor_mismatch"
+/** v7: the caller expected another subject (format-spec §9.7 step 5). */
+ | "tenant_mismatch";
+/**
+ * Result of a keyless bind of an anchor to entries.
+ *
+ * KEYLESS: the signature is not checked here. A bind says the anchor's fields
+ * describe these entries; `verifyAnchorLocally` says who signed them.
+ */
+interface AnchorBindResult {
+    /** What the bind found. */
+    readonly outcome: AnchorBindOutcome;
+    /** True only when `outcome === "bound"`. */
+    readonly bound: boolean;
+    /** Tombstones among the entries given, in every outcome. */
+    readonly tombstones: number;
+    /**
+     * Entries that the anchor does NOT bind even when it binds: every entry up
+     * to and including the last tombstone (format-spec §5.5). 0 when there is no
+     * tombstone. The walked value in every outcome. Never describe these entries
+     * as verified or as bound; when `bound` is false, no entry is bound at all.
+     */
+    readonly entriesNotBound: number;
+    /** The chain walk over the entries given. */
+    readonly chain: OfflineVerificationResult;
+    /**
+     * v7 only: whether the anchor's subject was compared with one the caller
+     * expected (format-spec §9.7). `false` means it was NOT checked: the
+     * signature proves who signed the anchor, not that it is about the chain the
+     * reader meant.
+     */
+    readonly subjectChecked?: boolean;
+}
+/**
+ * What a caller expects of a v7 anchor it binds (format-spec §9.7). Empty or
+ * omitted means "not given".
+ */
+interface AnchorBindExpectations {
+    /** The subject the anchor must be about, compared byte for byte (`tenant_mismatch`). */
+    readonly subject?: string;
+    /** The predecessor's chain hash the anchor must name (`predecessor_mismatch`). */
+    readonly previousAnchorHash?: string;
+    /**
+     * The chain hash of the entry before `entries[0]`. Any non-empty value is
+     * refused: an anchor is never bound to a segment (format-spec §9.8).
+     */
+    readonly previousHash?: string;
+}
+
+/**
+ * Error thrown when anchor signature verification fails.
+ */
+declare class AnchorVerificationError extends Error {
+    readonly name = "AnchorVerificationError";
+    constructor(message: string);
+}
+/**
+ * Error thrown when chain verification encounters an unrecoverable error.
+ */
+declare class ChainVerificationError extends Error {
+    readonly name = "ChainVerificationError";
+    constructor(message: string);
+}
+/**
+ * Thrown when the text of an entries file is not entries (format-spec §11):
+ * not JSON, an empty document, an export bundle, an anchor, or an entry with a
+ * repeated, misspelled, missing or wrongly typed member.
+ *
+ * This is an ERROR, never a broken chain: a file that is not entries says
+ * nothing about any chain. Messages name a member, never a value.
+ */
+declare class EntriesFormatError extends Error {
+    readonly name = "EntriesFormatError";
+    constructor(message: string);
+}
+/**
+ * Thrown when a ConsentChainEntry fails canonical field validation.
+ *
+ * Error messages include the field name but NEVER the field value, to prevent
+ * log injection from caller-controlled content.
+ */
+declare class InvalidConsentEntryError extends Error {
+    readonly name = "InvalidConsentEntryError";
+    constructor(message: string);
+}
+/**
+ * Thrown when consent chain entry verification fails for cryptographic reasons:
+ * unknown key ID, wrong signature length, content hash mismatch, or failed
+ * ML-DSA-65 verification.
+ *
+ * Error messages do not include signature bytes or key material.
+ */
+declare class ConsentVerificationError extends Error {
+    readonly name = "ConsentVerificationError";
+    constructor(message: string);
+}
+
+/**
+ * Domain prefix for chain hash computation.
+ * This provides domain separation for the hash function.
+ */
+declare const CHAIN_HASH_PREFIX = "aleutian.chain.v2:";
+/**
+ * Report whether a value is a SHA-512 digest as the format writes it: exactly
+ * 128 lowercase hex characters (format-spec §1). Uppercase is invalid, not
+ * equivalent.
+ *
+ * @param value - The value to check; anything but a string is not a digest
+ * @returns True for exactly 128 lowercase hex characters
+ */
+declare function isChainDigest(value: unknown): value is string;
+/**
+ * Report whether a stored timestamp is exactly the form the chain hash covers:
+ * `YYYY-MM-DDTHH:MM:SS.ffffffZ` (format-spec §4), naming a real calendar
+ * instant.
+ *
+ * Any other spelling of the same instant (an offset such as `+05:30`, no
+ * fractional digits, three, or more than six, a lowercase `z`) is refused: the
+ * hash covers one spelling, and a second one that hashed the same would be a
+ * field an editor could change without detection.
+ *
+ * @param value - The stored timestamp; anything but a string is refused
+ * @returns True only for the exact §4 form
+ */
+declare function isChainTimestamp(value: unknown): value is string;
+/**
+ * Compute the SHA-512 chain hash for an entry.
+ *
+ * Uses Aleutian's chain hash formula with domain separation:
+ * SHA512("aleutian.chain.v2:" + prev + "|" + runID + "|" + seq + "|" + ts + "|" + content)
+ *
+ * @param previousHash - Previous entry's chain_hash (empty string for first in run)
+ * @param runId - Batch run identifier
+ * @param sequenceNum - 0-indexed position within batch
+ * @param timestamp - Entry timestamp in ISO 8601 format with microsecond precision
+ * @param contentHash - SHA-512 hex of content, or tombstone content hash
+ * @returns Promise resolving to 128-character lowercase hex SHA-512 hash
+ *
+ * @example
+ * ```typescript
+ * const hash = await computeChainHash(
+ *   'abc123...',
+ *   'run_xyz',
+ *   42,
+ *   '2026-01-20T15:30:00.123456Z',
+ *   'def456...'
+ * );
+ * ```
+ */
+declare function computeChainHash(previousHash: string, runId: string, sequenceNum: number, timestamp: string, contentHash: string): Promise<string>;
+/**
+ * Format a Unix millisecond timestamp as ISO 8601 with microsecond precision.
+ *
+ * Converts Unix milliseconds to the format: "2006-01-02T15:04:05.000000Z"
+ * Since JavaScript Date only has millisecond precision, the last 3 digits
+ * of the microseconds are always "000".
+ *
+ * @param timestampMs - Unix timestamp in milliseconds
+ * @returns ISO 8601 string with 6-digit microseconds (last 3 always "000")
+ */
+declare function formatTimestampMicro(timestampMs: number): string;
+/**
+ * Compute chain hash using Unix milliseconds timestamp.
+ *
+ * This is a convenience function that converts Unix milliseconds to
+ * ISO 8601 format before computing the hash. Use this when you have
+ * a numeric timestamp instead of a string.
+ *
+ * @param previousHash - Previous entry's chain_hash (empty string for first in run)
+ * @param runId - Batch run identifier
+ * @param sequenceNum - 0-indexed position within batch
+ * @param timestampMs - Entry timestamp as Unix milliseconds. Sub-millisecond
+ *   precision is discarded. Always use `Date.now()` or `time.UnixMilli()` values
+ *   rather than dividing a nanosecond timestamp, which silently truncates and
+ *   produces a hash that won't match Go/Python.
+ * @param contentHash - SHA-512 hex of content, or tombstone content hash
+ * @returns Promise resolving to 128-character lowercase hex SHA-512 hash
+ *
+ * @example
+ * ```typescript
+ * const hash = await computeChainHashMs(
+ *   'abc123...',
+ *   'run_xyz',
+ *   42,
+ *   1706108400123,
+ *   'def456...'
+ * );
+ * ```
+ */
+declare function computeChainHashMs(previousHash: string, runId: string, sequenceNum: number, timestampMs: number, contentHash: string): Promise<string>;
+
+/**
+ * SHA-512 domain separator for the anchor-of-anchors chain.
+ * Must be byte-identical across Go/Python/JS SDKs.
+ */
+declare const ANCHOR_CHAIN_DOMAIN_V2 = "aleutian.anchor.v2:";
+/**
+ * Genesis previousAnchorHash used for the very first anchor in a
+ * company's chain. Computed as `SHA-512("aleutian.anchor.seed.v2")`.
+ *
+ * Byte-identical to the producer constant at
+ * `internal/storage/verification_types.go` and the other SDK constants.
+ */
+declare const SEED_ANCHOR_HASH: string;
+/**
+ * Sentinel `previousAnchorId` value indicating a genesis anchor.
+ */
+declare const SEED_ANCHOR_ID = "anchor_00000000-0000-0000-0000-000000000000";
+/**
+ * Bind an anchor to its tip entry and prior anchor.
+ *
+ * Returns a Promise resolving to the hex-encoded SHA-512 digest over a
+ * domain-separated, pipe-delimited concatenation of the inputs.
+ * Byte-identical to the Go SDK `ComputeAnchorChainHash` and the producer
+ * at `internal/chainlinker/anchor_generator.go`.
+ *
+ * Async because the JS SDK uses WebCrypto (`crypto.subtle.digest`), which
+ * is always async — same pattern as `computeChainHash`.
+ *
+ * @param previousAnchorHash - The prior anchor's `chain_hash`, or
+ *   {@link SEED_ANCHOR_HASH} for a genesis anchor
+ *   (`previousAnchorId === SEED_ANCHOR_ID`).
+ * @param companyId - The `company_id` field of the anchor being computed.
+ * @param startEntryId - `anchor.range.startEntryId`.
+ * @param endEntryId - `anchor.range.endEntryId`.
+ * @param tipChainHash - The chain_hash of the entry identified by
+ *   `endEntryId`, as computed by walking the per-entry chain (NOT the
+ *   stored value if verifying potentially-tampered data — the verifier
+ *   walks and recomputes).
+ * @returns Promise resolving to hex-encoded 128-char SHA-512 digest.
+ */
+declare function computeAnchorChainHash(previousAnchorHash: string, companyId: string, startEntryId: string, endEntryId: string, tipChainHash: string): Promise<string>;
+/**
+ * SHA-512 domain separator for the v7 anchor chain hash (format-spec §9.4).
+ */
+declare const ANCHOR_CHAIN_DOMAIN_V7 = "aleutian.anchor.v7:";
+/**
+ * Compute a v7 anchor's chain hash (format-spec §9.4).
+ *
+ * # Description
+ *
+ * `SHA-512("aleutian.anchor.v7:" ‖ previous_anchor_hash ‖ "|" ‖ len(subject)
+ * ‖ subject ‖ "|" ‖ start_seq ‖ "|" ‖ end_seq ‖ "|" ‖ tip_chain_hash)`, `len`
+ * a 4-byte big-endian byte count. The subject is hashed as its UTF-8 bytes,
+ * never normalised, and is length-prefixed, so it may contain `|`.
+ *
+ * Unlike v1-v6, the range is named by sequence: erasing any entry of it (v4,
+ * format-spec §5.0) changes nothing this hash covers.
+ *
+ * # Inputs
+ *
+ *   - previousAnchorHash: the anchor's own `previous_anchor_hash` (the
+ *     previous anchor's chain hash, or {@link SEED_ANCHOR_HASH}); 128 hex
+ *   - subject: the anchor's subject, non-empty
+ *   - startSeq, endSeq: the range, 0 to 2^63 - 1, as bigint, safe number or
+ *     decimal text
+ *   - tipChainHash: the chain hash of the entry at `endSeq`; 128 hex
+ *
+ * # Outputs
+ *
+ *   - Promise<string>: 128 lowercase hex
+ *   - Error: thrown (as a rejection) when an input is malformed
+ *
+ * # Example
+ *
+ *   const h = await computeAnchorChainHashV7(SEED_ANCHOR_HASH, "orders", 0n, 2n, tip);
+ *
+ * # Limitations
+ *
+ *   - Not a bind: compare the result with the anchor's `chainHash`.
+ *
+ * # Assumptions
+ *
+ *   - None.
+ */
+declare function computeAnchorChainHashV7(previousAnchorHash: string, subject: string, startSeq: bigint | number | string, endSeq: bigint | number | string, tipChainHash: string): Promise<string>;
+
+/**
+ * Tombstone detection and validation for the Aleutian verification SDK.
+ *
+ * Tombstones are GDPR deletion markers that replace original entries while
+ * preserving chain integrity. They have specific format requirements that
+ * must be validated during chain verification.
+ */
+/**
+ * Prefix for tombstone content hashes.
+ */
+declare const TOMBSTONE_CONTENT_HASH_PREFIX = "TOMBSTONE:";
+/**
+ * Prefix for tombstone entry IDs.
+ */
+declare const TOMBSTONE_ENTRY_ID_PREFIX = "tomb_";
+/**
+ * Entry type value for tombstones.
+ */
+declare const TOMBSTONE_ENTRY_TYPE = "tombstone";
+/**
+ * Check if an entry is a tombstone based on entryType and entryId.
+ *
+ * Both conditions must be true:
+ * - entryType === "tombstone"
+ * - entryId starts with "tomb_"
+ *
+ * @param entryType - The entry's type field
+ * @param entryId - The entry's ID field
+ * @returns True if entry is a tombstone
+ *
+ * @example
+ * ```typescript
+ * if (isTombstone(entry.entryType, entry.entryId)) {
+ *   // Handle tombstone entry
+ * }
+ * ```
+ */
+declare function isTombstone(entryType: string, entryId: string): boolean;
+/**
+ * Check if a contentHash uses tombstone format (prefix check only).
+ *
+ * This is a lightweight check for hot paths. Use validateTombstoneContentHash
+ * for full format validation.
+ *
+ * @param contentHash - The content hash to check
+ * @returns True if content hash starts with "TOMBSTONE:"
+ *
+ * @example
+ * ```typescript
+ * if (isTombstoneContentHash(entry.contentHash)) {
+ *   // Content was deleted, original data not available
+ * }
+ * ```
+ */
+declare function isTombstoneContentHash(contentHash: string): boolean;
+/**
+ * Fully validate tombstone content hash format.
+ *
+ * Valid format: "TOMBSTONE:" + 64 lowercase hex characters (32 random bytes)
+ * Total length: 74 characters (10 prefix + 64 hex)
+ *
+ * @param contentHash - The content hash to validate
+ * @returns True if format is valid
+ *
+ * @example
+ * ```typescript
+ * if (isTombstone(entry.entryType, entry.entryId)) {
+ *   if (!validateTombstoneContentHash(entry.contentHash)) {
+ *     // Invalid tombstone format - chain integrity issue
+ *   }
+ * }
+ * ```
+ */
+declare function validateTombstoneContentHash(contentHash: string): boolean;
+
+/** ML-DSA-65 raw public key size per FIPS 204. */
+declare const MLDSA_PUB_KEY_SIZE = 1952;
+/**
+ * URL for fetching current public keys from Aleutian's servers.
+ *
+ * This endpoint can be used to:
+ * 1. Check for key revocations
+ * 2. Fetch newly rotated keys before SDK updates
+ * 3. Verify embedded keys match server-side keys
+ *
+ * For fully offline verification, use the embedded keys instead.
+ */
+declare const PUBLIC_KEYS_ENDPOINT = "https://keys.aleutian.ai/.well-known/anchor-signing-keys.json";
+/**
+ * Embedded ML-DSA-65 public keys for offline anchor verification.
+ *
+ * Keys are raw 1952-byte Uint8Arrays, decoded from SPKI DER at load time.
+ */
+declare const EMBEDDED_PUBLIC_KEYS: ReadonlyMap<string, Uint8Array>;
+/**
+ * Get an embedded public key by ID.
+ *
+ * @param keyId - The key identifier from anchor.signature.publicKeyId
+ * @returns The raw 1952-byte ML-DSA-65 public key bytes
+ * @throws Error if key ID is not found in embedded keys
+ */
+declare function getPublicKey(keyId: string): Uint8Array;
+/**
+ * Check if a key ID is known (exists in embedded keys).
+ *
+ * @param keyId - The key identifier to check
+ * @returns True if the key ID is known
+ */
+declare function isKnownKey(keyId: string): boolean;
+/**
+ * List all known key IDs.
+ *
+ * @returns Array of key IDs sorted alphabetically
+ */
+declare function listKeyIds(): string[];
+/**
+ * SC-1: Validate that no embedded key is an all-zero development placeholder.
+ *
+ * Production deployments MUST call this function at startup and handle the
+ * thrown error (e.g., fail fast before serving traffic). The embedded keys
+ * in this SDK release are development placeholders and MUST be replaced with
+ * real keys before production use.
+ *
+ * @throws Error if any embedded key consists entirely of zero bytes
+ */
+declare function validateEmbeddedKeys(): void;
+
+/**
+ * The ML-DSA context a v7 anchor signature is made with (format-spec §9.5).
+ * v1-v6 use the empty context.
+ */
+declare const ANCHOR_SIGNATURE_CONTEXT_V7 = "aleutian.proof.anchor.v7";
+/**
+ * Refuse a malformed anchor (format-spec §9.3 and §9.8).
+ *
+ * # Description
+ *
+ * Checks what an anchor must satisfy before its canonical form is built or it
+ * is bound to a chain:
+ *
+ *   - `version` is 1, 2, 3, 4, 6 or 7. Version 5 is withdrawn and is refused
+ *     by name; any other version is refused, never treated as the closest form.
+ *   - v7 (§9.3, §9.8): a non-empty `subject`, `anchorId` and
+ *     `previousAnchorId`, each valid UTF-8 (no lone surrogate) as is
+ *     `signingKeyId`; `range.startSeq` and
+ *     `range.endSeq` integers from 0 to 2^63 - 1 with `startSeq <= endSeq`;
+ *     `entryCount = endSeq - startSeq + 1`; `previousAnchorHash` 128 lowercase
+ *     hex; `previousAnchorId` is the seed id exactly when `previousAnchorHash`
+ *     is the seed hash; `chainHash` 128 lowercase hex; `createdAtMs >= 0`; no
+ *     `verifiedThrough` and no entry-id range. v1-v6 carry no
+ *     `previousAnchorHash` and no sequence range.
+ *   - version invariants (§9.3): v1-v3 carry `verifiedThrough` 0; v4 and v6
+ *     carry it positive; v6 carries a non-empty `subject`.
+ *   - counts, v4 and v6 (§9.8): `entryCount >= 1`,
+ *     `0 < verifiedThrough <= entryCount`, `createdAtMs >= 0`.
+ *   - `signingKeyId` is not empty (§9.8).
+ *
+ * `version` is inside the signed bytes, so an anchor that breaks these carries
+ * a valid signature over malformed content. That is reported as malformed, not
+ * as tampering, and never as a bind outcome.
+ *
+ * # Inputs
+ *
+ *   - anchor: The anchor to check
+ *
+ * # Outputs
+ *
+ *   - void: Returns normally when the anchor is well formed
+ *   - AnchorVerificationError: Thrown otherwise. Messages name a field, never
+ *     its value.
+ *
+ * # Example
+ *
+ *   checkAnchorWellFormed(parseAnchorText(text));
+ *
+ * # Limitations
+ *
+ *   - Checks neither the signature nor the binding to a chain.
+ *
+ * # Assumptions
+ *
+ *   - None.
+ */
+declare function checkAnchorWellFormed(anchor: Anchor): void;
+/**
+ * Version=7 canonical form (format-spec §9.2): the bytes a v7 signature covers.
+ *
+ * Ten fields, alphabetical: `anchor_id`, `chain_hash`, `created_at_ms`,
+ * `entry_count`, `previous_anchor_hash`, `previous_anchor_id`, `range`
+ * (`end_seq`, `start_seq`), `signing_key_id`, `subject`, `version`.
+ * `previous_anchor_hash` sorts before `previous_anchor_id`. `entry_count`,
+ * `end_seq` and `start_seq` are JSON STRINGS of their decimal value, so that a
+ * value above 2^53 survives every JSON reader exactly.
+ *
+ * Builds bytes only: call `checkAnchorWellFormed` first (`verifyAnchorLocally`
+ * does).
+ */
+declare function canonicalizeAnchorV7(anchor: Anchor): string;
+
+/**
+ * Verify an anchor signature without network access.
+ *
+ * # Description
+ *
+ * Verifies the ML-DSA-65 (FIPS 204) signature of an anchor using embedded
+ * or provided public keys. This enables fully offline anchor verification.
+ *
+ * No SHA-256 pre-hash is applied — ML-DSA-65 handles message hashing
+ * internally per FIPS 204, matching the Cloud KMS signing path.
+ *
+ * # Inputs
+ *
+ *   - anchor: The anchor to verify
+ *   - publicKey: Optional raw 1952-byte ML-DSA-65 public key. If undefined,
+ *                uses embedded keys based on anchor.signingKeyId
+ *
+ * # Outputs
+ *
+ *   - void: Returns normally if verification succeeds
+ *   - AnchorVerificationError: Thrown if signature verification fails
+ *   - Error: Thrown if public key ID is not found in embedded keys
+ *
+ * # Example
+ *
+ *   const anchor = await loadAnchor('anchor-2026-01-20.json');
+ *   try {
+ *     verifyAnchorLocally(anchor);
+ *     console.log('Anchor is cryptographically valid');
+ *   } catch (e) {
+ *     console.error('Verification failed:', e.message);
+ *   }
+ *
+ * # Limitations
+ *
+ *   - Requires embedded keys to be non-placeholder for production use
+ *   - Does not verify anchor chain linkage (previousAnchorId), and takes no
+ *     predecessor hash: binding an anchor to a chain and to its predecessor is
+ *     `bindAnchorToEntries`
+ *   - Refuses a malformed anchor before any cryptography (format-spec §9.3,
+ *     §9.8): an unsupported or withdrawn version, a broken version invariant,
+ *     v4/v6 counts out of range, an empty signingKeyId
+ *
+ * # Assumptions
+ *
+ *   - anchor.signature is the canonical base64 (standard alphabet, padded, no
+ *     line breaks, zero trailing bits) of an ML-DSA-65 signature (3309 bytes)
+ *   - publicKey, if provided, is exactly MLDSA_PUB_KEY_SIZE (1952) bytes
+ */
+declare function verifyAnchorLocally(anchor: Anchor, publicKey?: Uint8Array): void;
+declare function canonicalizeAnchor(anchor: Anchor): string;
+declare function parseAnchor(data: Record<string, unknown>): Anchor;
+declare function parseExportedEntries(data: readonly Record<string, unknown>[]): ExportedEntry[];
+
+/**
+ * Bind an anchor to the entries it covers, without a key.
+ *
+ * # Description
+ *
+ * Verifies the entries as a WHOLE chain (from its first entry: a segment
+ * cannot be bound, format-spec §9.8), then checks that the anchor describes
+ * EXACTLY those entries, in this order: the chain verifies, the first entry is
+ * `range.startEntryId`, the last is `range.endEntryId`, their number is
+ * `entryCount`, the predecessor is named consistently (§9.8), and the anchor
+ * chain hash recomputes (§9.4).
+ *
+ * A v7 anchor names its range by sequence and carries its predecessor's hash:
+ * it is bound by `bindAnchorV7ToEntries`, to which this delegates, with
+ * `previousAnchorHash` as the EXPECTED predecessor (§9.7 step 4) and no
+ * expected subject (`subjectChecked` false). What follows is v1-v6.
+ *
+ * PASS THE COVERED PREFIX. An anchor is bound against the entries it covered,
+ * as the chain was when it was signed (§9.7): entries `0 … entryCount - 1`.
+ * This function does not slice. Given a chain that has grown since the anchor,
+ * it reports `range_end_mismatch`.
+ *
+ * KEYLESS: the signature is NOT checked. Use `verifyAnchorLocally` for that; a
+ * bind without a signature check says only that the anchor's fields describe
+ * these entries, not who wrote them.
+ *
+ * WHAT A TOMBSTONE LEAVES UNBOUND (§5.5). A tombstone's chain hash is taken as
+ * stored, so nothing links the entries before it to the anchored tip. Whoever
+ * can write the store can replace every entry up to a tombstone and the bind
+ * still succeeds. `entriesNotBound` counts those entries. Never describe them
+ * as verified or as bound.
+ *
+ * # Inputs
+ *
+ *   - anchor: The anchor, as `parseAnchorText` returns it
+ *   - entries: The entries the anchor covers, from the chain's first entry
+ *   - previousAnchorHash: The previous anchor's `chainHash`, or
+ *     `SEED_ANCHOR_HASH` for the first anchor. Never guessed.
+ *
+ * # Outputs
+ *
+ *   - Promise<AnchorBindResult>: the outcome; `bound` is true only for
+ *     `"bound"`. `tombstones` and `entriesNotBound` are what the walk found,
+ *     in every outcome.
+ *   - AnchorVerificationError: the anchor is malformed (§9.3, §9.8 counts and
+ *     key id), or `previousAnchorHash` is not a digest. An error, not an outcome.
+ *   - ChainVerificationError: `entries` is empty
+ *
+ * # Example
+ *
+ *   const anchor = parseAnchorText(anchorText);
+ *   const entries = parseEntriesText(entriesText);
+ *   const covered = entries.slice(0, Number(anchor.entryCount));
+ *   const r = await bindAnchorToEntries(anchor, covered, SEED_ANCHOR_HASH);
+ *   if (r.bound && r.entriesNotBound > 0) {
+ *     console.log(`bound, except the first ${r.entriesNotBound} entries`);
+ *   }
+ *
+ * # Limitations
+ *
+ *   - Does not verify the signature, and does not check a series of anchors
+ *     against each other.
+ *   - Cannot detect a rewrite of the entries before a tombstone.
+ *
+ * # Assumptions
+ *
+ *   - `entries[0]` is the chain's first entry.
+ */
+declare function bindAnchorToEntries(anchor: Anchor, entries: readonly ExportedEntry[], previousAnchorHash: string): Promise<AnchorBindResult>;
+/**
+ * Bind a v7 anchor to the entries it covers, without a key (format-spec §9.7).
+ *
+ * # Description
+ *
+ * Refuses, as errors with no outcome, an anchor that breaks format-spec §9.3
+ * or §9.8 and entries given as a segment (`expect.previousHash`). Then walks
+ * the entries from the chain's first entry and checks, in this order, the
+ * first failure being the outcome:
+ *
+ *   1. the chain verifies (§5.5): otherwise `chain_broken`;
+ *   2. the first entry's `globalSeq` is `range.startSeq`: otherwise
+ *      `range_start_mismatch`;
+ *   3. an entry has `globalSeq` `range.endSeq`: otherwise `height_mismatch`
+ *      (the anchor covers entries not given). Entries after it are not the
+ *      anchor's concern: a chain that has grown since still binds;
+ *   4. `expect.previousAnchorHash`, if given, equals the anchor's
+ *      `previousAnchorHash`: otherwise `predecessor_mismatch`;
+ *   5. `expect.subject`, if given, equals the anchor's `subject` byte for
+ *      byte: otherwise `tenant_mismatch`;
+ *   6. the v7 anchor chain hash (§9.4) recomputes to `chainHash`: otherwise
+ *      `head_mismatch`. All six: `bound`.
+ *
+ * A v7 anchor carries its predecessor's hash in its signed bytes, so no
+ * predecessor hash is needed to bind it; `expect.previousAnchorHash` only
+ * CHECKS it against the one the caller holds.
+ *
+ * KEYLESS: the signature is NOT checked. Use `verifyAnchorLocally`.
+ *
+ * WHAT IS NOT CHECKED, SAID SO. Without `expect.subject`, `subjectChecked` is
+ * false: the anchor may be about another chain. `entriesNotBound` counts the
+ * entries up to and including the last v2/v3 tombstone at or before the tip
+ * (a v3 prefix continued in v4 keeps exactly its guarantee, §2.5). Never
+ * describe those entries as bound.
+ *
+ * # Inputs
+ *
+ *   - anchor: a v7 anchor, as `parseAnchorText` returns it
+ *   - entries: the chain from its first entry (it may have grown since)
+ *   - expect: the subject and predecessor hash the caller expects; empty or
+ *     omitted means not given
+ *
+ * # Outputs
+ *
+ *   - Promise<AnchorBindResult>: `bound` only for `"bound"`; `subjectChecked`
+ *     always set
+ *   - AnchorVerificationError: the anchor is not v7 or is malformed,
+ *     `expect.previousHash` is given, or `expect.previousAnchorHash` is not a
+ *     digest
+ *   - ChainVerificationError: `entries` is empty
+ *
+ * # Example
+ *
+ *   const r = await bindAnchorV7ToEntries(parseAnchorText(text), entries, {
+ *     subject: "orders",
+ *   });
+ *
+ * # Limitations
+ *
+ *   - Does not verify the signature, and does not check a series of anchors.
+ *
+ * # Assumptions
+ *
+ *   - `entries[0]` is the chain's first entry.
+ */
+declare function bindAnchorV7ToEntries(anchor: Anchor, entries: readonly ExportedEntry[], expect?: AnchorBindExpectations): Promise<AnchorBindResult>;
+/**
+ * Verify a complete chain from exported data.
+ *
+ * Performs full chain verification using exported entries without
+ * requiring network access to Aleutian APIs. Verifies field shapes, chain hash
+ * continuity and tombstone format validity (format-spec §2, §4, §5), and
+ * optionally binds the result to an anchor.
+ *
+ * The first `globalSeq` is not constrained: a chain may start at 0, at 1, or
+ * (for a segment, with `options.previousHash`) anywhere.
+ *
+ * WHAT A TOMBSTONE LEAVES UNVERIFIED (format-spec §5.5). `valid` says the
+ * entries are consistent with each other. It does NOT say the entries before a
+ * tombstone are the ones originally written: a tombstone's chain hash is taken
+ * as stored, so whoever can write the store can replace every entry up to it.
+ * `entriesNotVerified` (and `lastTombstone`) report how many entries that is.
+ * Never describe them as verified.
+ *
+ * WARNING (M-4): OfflineBreak contains entryId and hashes that may correlate
+ * to PII. Consider truncating hashes before logging: hash.slice(0, 8) is sufficient.
+ *
+ * @param entries - Array of entries in globalSeq order
+ * @param options - Verification options (anchor, previousHash, maxEntries, maxBreaks)
+ * @returns Verification result with validity, breaks, and statistics
+ *
+ * @throws ChainVerificationError for unrecoverable errors (empty entries, or
+ *   an anchor together with `previousHash`)
+ * @throws AnchorVerificationError when `options.anchor` is malformed
+ *   (format-spec §9.3, §9.8): an error, not a break
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   loadExportedEntries,
+ *   loadAnchor,
+ *   verifyChainOffline
+ * } from '@aleutian/verification';
+ *
+ * const entries = await loadExportedEntries('export-2026-01.json');
+ * const anchor = await loadAnchor('anchor-2026-01-20.json');
+ *
+ * const result = await verifyChainOffline(entries, {
+ *   anchor,
+ *   previousAnchorHash: SEED_ANCHOR_HASH, // genesis; else prior anchor's chainHash
+ *   maxBreaks: 100, // Stop early if chain is severely corrupted
+ * });
+ *
+ * if (result.valid) {
+ *   console.log(
+ *     `Chain consistent: ${result.entriesVerified} entries verified, ` +
+ *       `${result.entriesNotVerified} not verified (up to the last tombstone)`
+ *   );
+ * } else {
+ *   console.log(`Chain invalid: ${result.breaks.length} breaks`);
+ * }
+ * ```
+ */
+declare function verifyChainOffline(entries: readonly ExportedEntry[], options?: ChainVerifyOptions): Promise<OfflineVerificationResult>;
+
+/** Chain format version 4 (format-spec §2.2). */
+declare const FORMAT_V4 = 4;
+/** The leaf hash's domain string (format-spec §2.0). */
+declare const CHAIN_LEAF_DOMAIN_V4 = "aleutian.chain.leaf.v4:";
+/** The v4 chain hash's domain string (format-spec §2.0). */
+declare const CHAIN_HASH_PREFIX_V4 = "aleutian.chain.v4:";
+/**
+ * Compute the v4 leaf hash of a live entry (format-spec §2.0).
+ *
+ * # Description
+ *
+ * Validates every field, then hashes the domain, the length-prefixed id and
+ * type (UTF-8, as given), the content hash and the salt.
+ *
+ * # Inputs
+ *
+ *   - entryId: 1 to 256 UTF-8 bytes, no control characters; not `tomb_…`
+ *   - entryType: as entryId; not `tombstone`
+ *   - contentHash: 128 lowercase hex (v4 has no tombstone value)
+ *   - salt: 64 lowercase hex
+ *
+ * # Outputs
+ *
+ *   - Promise<string>: 128 lowercase hex
+ *   - Error: thrown (as a rejection) when a field is outside its shape. The
+ *     message names the field, never its value.
+ *
+ * # Example
+ *
+ *   const leaf = await computeLeafHashV4("ent_0001", "event", contentHash, salt);
+ *
+ * # Limitations
+ *
+ *   - Does not mint salts: this SDK verifies, it never writes.
+ *
+ * # Assumptions
+ *
+ *   - None: every field is validated.
+ */
+declare function computeLeafHashV4(entryId: string, entryType: string, contentHash: string, salt: string): Promise<string>;
+/**
+ * Compute the v4 chain hash of an entry (format-spec §2.0).
+ *
+ * # Description
+ *
+ * Validates the fields, including the first-entry rule (an empty
+ * `previousHash` goes with `globalSeq` 0, a non-empty one with a `globalSeq`
+ * above 0), then hashes the `|`-delimited preimage. For an erased entry, pass
+ * its stored leaf hash: that is exactly what the verifier recomputes from.
+ *
+ * # Inputs
+ *
+ *   - previousHash: "" for the chain's first entry, else 128 lowercase hex
+ *   - globalSeq: 0 to 2^63 - 1, as a bigint, a safe number, or base-10 text
+ *   - timestamp: exactly `YYYY-MM-DDTHH:MM:SS.ffffffZ` (format-spec §4)
+ *   - leafHash: 128 lowercase hex
+ *
+ * # Outputs
+ *
+ *   - Promise<string>: 128 lowercase hex
+ *   - Error: thrown (as a rejection) when a field is malformed
+ *
+ * # Example
+ *
+ *   const h = await computeChainHashV4(prev, 1n, "2026-10-16T08:00:01.111111Z", leaf);
+ *
+ * # Limitations
+ *
+ *   - Checks one entry; linkage across entries is `verifyChainOffline`'s.
+ *
+ * # Assumptions
+ *
+ *   - None: every field is validated.
+ */
+declare function computeChainHashV4(previousHash: string, globalSeq: number | bigint | string, timestamp: string, leafHash: string): Promise<string>;
+
+/**
+ * Decode the text of an entries file, refusing anything that is not entries.
+ *
+ * # Description
+ *
+ * Accepts the three forms an export takes:
+ *
+ *   - one JSON array of entry objects;
+ *   - JSONL: one entry object per line (blank lines are skipped);
+ *   - the hosted platform's wrapper: one JSON object with an `entries` member
+ *     whose value is an array of entry objects. The wrapper's other members
+ *     are ignored. Any other top-level object is refused.
+ *
+ * Every v2 or v3 entry must carry `entry_id`, `timestamp`, `content_hash` and
+ * `chain_hash` as strings. A v4 entry (`format_version: 4`, format-spec §2.0)
+ * must carry `timestamp` and `chain_hash`: an erased one has no id, type or
+ * content hash. `salt`, `leaf_hash` (strings) and `erased` (a boolean) are
+ * read on every entry when present, and on a v4 entry the names of the
+ * members it carried are returned in `presentMembers`, so the verifier can
+ * judge its shape (absent is not empty in v4). `entry_type` and `run_id` (strings), and
+ * `sequence_num`, `global_seq` and `format_version` (integers) are read when
+ * present and are "" / 0 / absent otherwise. Each member may be spelled in
+ * snake_case or in the camelCase alias `parseExportedEntries` accepts
+ * (`entryId`, `chainHash`, ...). Members with other names are ignored.
+ *
+ * Refused, as an error and never as a broken chain: text that is not JSON, an
+ * empty document or an empty array, `{}`, `null`, an export bundle, an anchor,
+ * two objects on one line, a member name repeated in any object, an entry
+ * carrying both spellings of one member, a name that case-folds to a known
+ * snake_case name (`CHAIN_HASH`, `ſalt` with U+017F), a missing required
+ * member, and a member that is null or of the wrong type (a `global_seq`
+ * written as a string, a fraction, an exponent or `-0`). Text that is not
+ * valid UTF-8, or escapes a lone surrogate, is refused and never repaired.
+ *
+ * This checks that the text IS entries. Whether the entries verify (hash
+ * shapes, timestamps, the chain) is `verifyChainOffline`'s to report as breaks.
+ *
+ * # Inputs
+ *
+ *   - text: The file's content. Pass the raw bytes when you have them: a
+ *     string has already had invalid UTF-8 replaced by whatever decoded it.
+ *
+ * # Outputs
+ *
+ *   - ExportedEntry[]: At least one entry. `globalSeq` is a `number` up to
+ *     `Number.MAX_SAFE_INTEGER` and a `bigint` beyond it.
+ *   - EntriesFormatError: Thrown when the text is not entries. The message
+ *     names a member, never a value.
+ *
+ * # Example
+ *
+ *   const entries = parseEntriesText(await response.text());
+ *   const result = await verifyChainOffline(entries);
+ *
+ * # Limitations
+ *
+ *   - Builds every entry in memory.
+ *   - A single entry object spread over several lines is neither a wrapper nor
+ *     JSONL, and is refused.
+ *
+ * # Assumptions
+ *
+ *   - None.
+ */
+declare function parseEntriesText(text: string | Uint8Array): ExportedEntry[];
+/**
+ * Parse the text of an anchor strictly (format-spec §9.8).
+ *
+ * # Description
+ *
+ * An anchor is read strictly: only the member names of §9.1, each at most
+ * once, and `range` likewise. The subject is under the name its version uses
+ * (`subject` from v6, `company_id` before); an anchor carrying the other name,
+ * or both, is refused. A lenient parser accepts members the signature does not
+ * cover and lets two readers see two different anchors.
+ *
+ * Each member may be spelled in snake_case or in the camelCase alias
+ * `parseAnchor` accepts (`anchorId`, `chainHash`, `subjectId`, ...). An anchor
+ * carrying BOTH spellings of one member is refused, and so is a known
+ * snake_case name in another letter case (`ENTRY_COUNT`).
+ *
+ * A member of the wrong JSON type is refused; integers are JSON integers (no
+ * quotes, no fraction, no exponent, no `-0`, within 64 bits) and are never
+ * rounded. An ABSENT member is not refused here: it reads as "" or 0 (an
+ * absent `range` as two empty ids), and `checkAnchorWellFormed` judges the
+ * result. Nor is the version judged here.
+ *
+ * A v7 anchor is read more strictly (§9.8): every member of §9.1 is
+ * required, `signature` included; `verified_through` and an entry-id range
+ * are refused; `entry_count`, `range.start_seq` and `range.end_seq` must be
+ * JSON STRINGS in §2.1's decimal grammar (a JSON number is refused: it would
+ * round above 2^53) and are returned as bigints. A v1-v6 anchor carrying
+ * `previous_anchor_hash` or a sequence range is refused.
+ *
+ * This is PARSING. The version, its invariants and the counts (§9.3, §9.8)
+ * are checked by `checkAnchorWellFormed`, which `verifyAnchorLocally` and
+ * `bindAnchorToEntries` both call.
+ *
+ * # Inputs
+ *
+ *   - text: The anchor's JSON. Pass the raw bytes when you have them.
+ *
+ * # Outputs
+ *
+ *   - Anchor: The parsed anchor. int64 fields are `number` while exact and
+ *     `bigint` beyond `Number.MAX_SAFE_INTEGER`.
+ *   - AnchorVerificationError: Thrown when the anchor is refused. The message
+ *     names a member, never a value.
+ *
+ * # Example
+ *
+ *   const anchor = parseAnchorText(await response.text());
+ *   verifyAnchorLocally(anchor, publicKey);
+ *
+ * # Limitations
+ *
+ *   - Does not verify the signature or bind the anchor to a chain.
+ *   - Returns an anchor that may be malformed (a missing member, a withdrawn
+ *     version): parse, then check.
+ *
+ * # Assumptions
+ *
+ *   - None.
+ */
+declare function parseAnchorText(text: string | Uint8Array): Anchor;
+
+/**
+ * Trust-manifest freshness verdicts (chainlinker_modernization_12f_e).
+ *
+ * A verifier holding a trust manifest can only reflect revocations known
+ * AT the manifest's generation date: a key revoked afterwards is invisible
+ * ("the CRL problem" for offline verification). This module makes that
+ * limitation explicit rather than emitting a bare "valid".
+ *
+ * v1 semantics (ADR-029 §D5): advisory report + warn, never hard-fail.
+ * Byte-identical to the Go (`EvaluateManifestFreshness`) and Python
+ * (`evaluate_manifest_freshness`) SDK helpers via the shared golden
+ * vectors in `sdk/testdata/manifest_freshness_golden.json`.
+ *
+ * Browser-safe: depends only on `Date` + string ops (no Node built-ins).
+ */
+/**
+ * Soft-warn threshold (ADR-029 §D5). A manifest older than this many days
+ * is reported STALE — advisory only; never changes validity, never fails.
+ */
+declare const MANIFEST_FRESHNESS_MAX_AGE_DAYS = 30;
+/**
+ * Structured, advisory freshness verdict for a trust manifest. All fields
+ * are advisory in v1: they inform the verdict string and let a STATEFUL
+ * caller act on `rollbackDetected`, but the SDK never converts any of them
+ * into a hard verification failure.
+ */
+interface ManifestFreshness {
+    /** The manifest's monotonic version integer. */
+    readonly version: number;
+    /** The manifest's generation wall-clock time (UnixMilli, UTC). */
+    readonly generatedAtMs: number;
+    /**
+     * floor((now - generatedAtMs) / 1 day), clamped to 0 for a manifest
+     * whose generation stamp is in the future relative to `now`.
+     */
+    readonly ageDays: number;
+    /** True when `ageDays > MANIFEST_FRESHNESS_MAX_AGE_DAYS`. Advisory. */
+    readonly stale: boolean;
+    /**
+     * True only for a STATEFUL evaluation (a non-negative `lastSeenVersion`
+     * was supplied) where `version` is LOWER than the last version this
+     * verifier saw — a suppressed/rolled-back update that could hide a
+     * revocation. A stateless one-shot verifier cannot detect this and
+     * always reports false; its only defense is the reported date.
+     */
+    readonly rollbackDetected: boolean;
+}
+/**
+ * Compute the advisory freshness verdict for a trust manifest.
+ *
+ * Pure function over the manifest's signed `version` + `generatedAtMs` and
+ * a caller-supplied reference clock. Never fetches, never mutates, never
+ * throws.
+ *
+ * @param version - the manifest's monotonic version integer.
+ * @param generatedAtMs - the manifest's generation time (UnixMilli, UTC).
+ * @param nowMs - reference clock (UnixMilli, UTC).
+ * @param lastSeenVersion - the highest manifest version this verifier has
+ *   previously observed, for anti-rollback. Pass a NEGATIVE value (e.g.
+ *   `-1`) for a STATELESS verifier — rollback detection is then disabled.
+ */
+declare function evaluateManifestFreshness(version: number, generatedAtMs: number, nowMs: number, lastSeenVersion: number): ManifestFreshness;
+/**
+ * Return the manifest generation date as a UTC `YYYY-MM-DD` string. This is
+ * the exact date form embedded in the verdict line and is byte-identical
+ * across the Go/Python/JS SDKs.
+ */
+declare function manifestGeneratedDate(f: ManifestFreshness): string;
+/**
+ * Return the freshness caveat WITHOUT asserting signature validity. Use in
+ * a context that reports manifest freshness but does not itself establish
+ * that a signature verified — e.g. the offline chain CLI, which checks
+ * chain continuity + anchor binding, not signatures against the manifest.
+ */
+declare function manifestRevocationNote(f: ManifestFreshness): string;
+/**
+ * Return the exact ADR-029 §D5 verdict line for a VALID signature:
+ *
+ *   Signature valid. Revocation checked against trust manifest v{N} dated
+ *   {YYYY-MM-DD} — a key revoked after that date is not reflected.
+ *
+ * with ` [WARNING: manifest is {age} days old]` appended when stale. Never
+ * a bare "valid". Only emit this where signature validity has already been
+ * established; otherwise use {@link manifestRevocationNote}.
+ */
+declare function manifestVerdictLine(f: ManifestFreshness): string;
+
+/**
+ * Processing mode canonical encoder for Aleutian AI v=2 chain entries.
+ *
+ * Cross-language byte-equality contract
+ * ======================================
+ * The output of {@link encodeProcessingModeCanonicalFields} is guaranteed to
+ * be byte-identical to the Go function `EncodeProcessingModeCanonicalFields`
+ * in `internal/storage/processing_mode_canonical.go` for the same inputs.
+ *
+ * This invariant is enforced by the shared golden vectors in
+ * `sdk/testdata/processing_mode_golden.json`, which are generated by the
+ * Go encoder and verified by the Go, Python, and TypeScript test suites.
+ *
+ * TLV encoding format (v=2)
+ * ==========================
+ * Each field is `u32 BE byte-length || raw UTF-8 bytes`, with the two
+ * fields concatenated in alphabetical key order:
+ *
+ * 1. `processing_mode_at_write`: u32 BE length prefix + mode bytes
+ * 2. `processing_mode_set_by_event_id`: u32 BE length prefix + event id bytes
+ *
+ * All length prefixes are big-endian unsigned 32-bit integers.
+ *
+ * Ticket reference: 18_05i
+ * Finding reference: C-B4-F5 (Phase 4 review)
+ *
+ * @module
+ */
+/** Canonical wire string for the zero-knowledge processing mode. */
+declare const ZK: "zk";
+/** Canonical wire string for the PII inspection processing mode. */
+declare const PII_INSPECTION: "pii_inspection";
+/** Union of the two valid processing mode wire strings. */
+type ProcessingModeWire = typeof ZK | typeof PII_INSPECTION;
+/**
+ * Thrown when a string is not a known processing mode.
+ *
+ * The error message is a fixed string and never contains the rejected
+ * input — this enforces Privacy Invariant 4 (no caller-supplied bytes
+ * in SDK error messages) at the SDK boundary so callers cannot
+ * accidentally surface untrusted input through logs.
+ */
+declare class InvalidProcessingMode extends Error {
+    constructor(_mode: string);
+}
+/**
+ * Byte-strict parser for the processing mode field.
+ *
+ * Accepts only the exact canonical wire strings `"zk"` and
+ * `"pii_inspection"`. No trimming, no case folding, and no Unicode
+ * normalization is applied. Mirrors `ParseProcessingMode` in
+ * `internal/storage/processing_mode_types.go` (ticket 18_01, Clarification 5).
+ *
+ * @param s - The raw string to validate.
+ * @returns The input string typed as `ProcessingModeWire`.
+ * @throws {@link InvalidProcessingMode} if `s` is not a known mode.
+ *
+ * @example
+ * ```typescript
+ * parseProcessingMode("zk");           // returns "zk"
+ * parseProcessingMode("pii_inspection"); // returns "pii_inspection"
+ * parseProcessingMode("ZK");           // throws InvalidProcessingMode
+ * ```
+ */
+declare function parseProcessingMode(s: string): ProcessingModeWire;
+/**
+ * Encode the two v=2 canonical-form processing mode TLV fields.
+ *
+ * Produces the deterministic byte sequence for the
+ * `processing_mode_at_write` and `processing_mode_set_by_event_id` fields
+ * in a v=2 Aleutian consent chain entry. Output is byte-identical to
+ * `EncodeProcessingModeCanonicalFields` in
+ * `internal/storage/processing_mode_canonical.go` for the same inputs.
+ *
+ * Output format (alphabetical TLV):
+ * ```
+ * [u32 BE] len(mode bytes)
+ * [bytes]  mode bytes (UTF-8)
+ * [u32 BE] len(setByEventId bytes)
+ * [bytes]  setByEventId bytes (UTF-8)
+ * ```
+ *
+ * @param mode - The processing mode wire string; must be `"zk"` or
+ *   `"pii_inspection"` exactly.
+ * @param setByEventId - The event id that set the processing mode. Any
+ *   non-empty string accepted by the internal `ValidateProcessingModeEventID`
+ *   (UUIDv4 or a recognised system sentinel). This function does NOT replicate
+ *   Go's event id validation — use the Go encoder at write time.
+ * @returns A `Uint8Array` containing the TLV-encoded bytes.
+ * @throws {@link InvalidProcessingMode} if `mode` is not a known mode.
+ *
+ * @example
+ * ```typescript
+ * const b = encodeProcessingModeCanonicalFields("zk", "system:bootstrap");
+ * console.log(b.length); // 26 (4+2+4+16)
+ * ```
+ */
+declare function encodeProcessingModeCanonicalFields(mode: string, setByEventId: string): Uint8Array;
+
+/** Domain-separation prefix for consent entry SHA-512 hashes. */
+declare const CONSENT_ENTRY_HASH_PREFIX: "aleutian.consent.entry.v2:";
+/** Domain-separation prefix for raw template SHA-512 hashes (hashTemplate).
+ *  Mirrors the Go constant consentTextHashPrefix.
+ *
+ *  WARNING: Part of the signed consent record format. Do NOT change without
+ *  a versioned migration.
+ */
+declare const CONSENT_TEXT_HASH_PREFIX: "aleutian.consent.text.v2:";
+/**
+ * Domain-separation prefix for rendered consent text SHA-512 hashes
+ * (hashRendered). Mirrors the Go constant consentRenderedHashPrefix in
+ * internal/consent/canonical.go.
+ *
+ * 18_20 review finding B4: this prefix was split from CONSENT_TEXT_HASH_PREFIX
+ * so hashTemplate(b) != hashRendered(b) for any input b, closing a
+ * cross-protocol confusion attack. Use this prefix when re-deriving
+ * consent_rendered_hash for GDPR Art. 7 verification.
+ *
+ * WARNING: Part of the GET /v1/consent/text response and POST
+ * /v1/consent/grant verification contract. Do NOT change without a
+ * versioned migration.
+ */
+declare const CONSENT_RENDERED_HASH_PREFIX: "aleutian.consent.rendered.v2:";
+/**
+ * The 15 canonical fields of a consent chain entry.
+ *
+ * Field names use snake_case (matching JSON storage) and mirror
+ * internal/consent.ConsentChainEntry and the Python ConsentChainEntry dataclass.
+ *
+ * `entry_type` and `event_type` MUST be equal; both are included in the
+ * canonical encoding for historical schema reasons. {@link consentCanonical}
+ * throws {@link InvalidConsentEntryError} if they differ.
+ *
+ * `expires_at_ms` and `timestamp_ms` are JS `number`. Unix milliseconds for
+ * dates through 2286 fit in Number.MAX_SAFE_INTEGER (2^53 − 1 ≈ 9e15 > 10^13).
+ * Do NOT use bigint — it would prevent direct construction from JSON.parse output.
+ *
+ * WARNING (Privacy Inv 4): every field on this interface is at least
+ * correlation-grade (`actor_pseudonym`, `consent_id`, `idempotency_key_hash`,
+ * `signing_key_id`, content-policy signals) and several are outright PII
+ * carriers. Do NOT pass a `ConsentChainEntry` to `console.log`,
+ * `JSON.stringify`, structured loggers, or template strings. Wrap with
+ * `redactedConsentChainEntry(entry)` from `./redactedView` first. The
+ * interface is a plain object literal, so it cannot own a `toJSON`
+ * override the way the Python dataclass owns `__repr__` — the wrap
+ * step is the only sanctioned logging path.
+ */
+interface ConsentChainEntry {
+    readonly actor_pseudonym: string;
+    readonly actor_pseudonym_key_version: string;
+    readonly company_id: string;
+    readonly consent_id: string;
+    readonly consent_rendered_hash: string;
+    readonly consent_template_hash: string;
+    readonly consent_text_version: string;
+    readonly entry_type: string;
+    readonly event_type: string;
+    readonly expires_at_ms: number;
+    readonly idempotency_key_hash: string;
+    readonly processing_mode_at_write: string;
+    readonly processing_mode_set_by_event_id: string;
+    readonly signing_key_id: string;
+    readonly timestamp_ms: number;
+}
+/**
+ * Return hex(SHA-512(CONSENT_TEXT_HASH_PREFIX + b)).
+ *
+ * # Description
+ *
+ * Mirrors internal/consent.HashTemplate exactly. Used by external callers to
+ * independently verify a chain entry's consent_template_hash against a
+ * template fetched from docs.aleutian.ai.
+ *
+ * Async because WebCrypto's digest API is always async (same constraint as
+ * {@link deriveConsentContentHash}).
+ *
+ * # Inputs
+ *
+ *   - b: Raw template bytes. The SDK does NOT normalize; caller must pass
+ *     exactly the bytes the server hashed.
+ *
+ * # Outputs
+ *
+ *   - Promise<string>: 128 lowercase hex characters (SHA-512 output).
+ *
+ * # Assumptions
+ *
+ *   - CONSENT_TEXT_HASH_PREFIX is stable (locked by the v2 schema).
+ */
+declare function hashTemplate(b: Uint8Array): Promise<string>;
+/**
+ * Serialize a ConsentChainEntry to the deterministic 15-field TLV byte sequence.
+ *
+ * # Description
+ *
+ * Byte-identical to internal/consent.ConsentCanonical and Python consent_canonical
+ * for the same field values. Synchronous — no crypto; pure byte assembly.
+ *
+ * Fields are written in the locked alphabetical order (15 fields total).
+ * Fields 12–13 (processing_mode_at_write, processing_mode_set_by_event_id) are
+ * encoded by delegating to {@link encodeProcessingModeCanonicalFields}.
+ *
+ * # Inputs
+ *
+ *   - entry: The ConsentChainEntry to serialize. All 15 fields must be populated.
+ *
+ * # Outputs
+ *
+ *   - Uint8Array: Deterministic TLV bytes; always non-empty on success.
+ *   - InvalidConsentEntryError: Thrown on any field validation failure.
+ *
+ * # Limitations
+ *
+ *   - Does not perform cross-tenant check; caller's responsibility.
+ *   - string fields must not exceed 1024 bytes (UTF-8 encoded).
+ *
+ * # Assumptions
+ *
+ *   - All 15 fields are populated with valid values.
+ */
+declare function consentCanonical(entry: ConsentChainEntry): Uint8Array;
+/**
+ * Return hex(SHA-512(CONSENT_ENTRY_HASH_PREFIX + canonical)).
+ *
+ * # Description
+ *
+ * Async because WebCrypto's digest API is always async (mirrors chain.ts pattern).
+ *
+ * # Inputs
+ *
+ *   - canonical: TLV bytes from consentCanonical for this entry.
+ *
+ * # Outputs
+ *
+ *   - Promise<string>: 128 lowercase hex characters (SHA-512 output).
+ *
+ * # Assumptions
+ *
+ *   - canonical is the output of consentCanonical for the same entry.
+ */
+declare function deriveConsentContentHash(canonical: Uint8Array): Promise<string>;
+/**
+ * Verify the ML-DSA-65 signature over canonical bytes.
+ *
+ * # Description
+ *
+ * Uses getPublicKey(keyId) from keys.ts to look up the embedded public key,
+ * then calls ml_dsa65.verify(sigBytes, canonical, pubKey).
+ *
+ * Note the @noble/post-quantum API arg order: verify(sig, msg, pubKey).
+ * This differs from many other libraries — do not swap.
+ *
+ * # Inputs
+ *
+ *   - canonical: TLV bytes from consentCanonical for the entry.
+ *   - sigBytes: Raw ML-DSA-65 signature bytes (must be exactly 3309 bytes).
+ *   - keyId: The signing key ID from the consent_chain_entries row.
+ *
+ * # Outputs
+ *
+ *   - Promise<void>: Resolves normally if verification succeeds.
+ *   - ConsentVerificationError: Thrown on unknown keyId, wrong sig length,
+ *     or failed ML-DSA-65 verification.
+ *
+ * # Limitations
+ *
+ *   - Cross-tenant check is the caller's responsibility.
+ *
+ * # Assumptions
+ *
+ *   - canonical is the output of consentCanonical for the same entry.
+ *   - sigBytes is the raw ML-DSA-65 signature (not base64).
+ */
+declare function verifyConsentSignature(canonical: Uint8Array, sigBytes: Uint8Array, keyId: string): Promise<void>;
+/**
+ * Verify a consent chain entry: canonicalize, check content hash, verify signature.
+ *
+ * # Description
+ *
+ * This is the primary entry point for consent entry verification. Mirrors
+ * VerifyConsentEntry in the Go SDK and verify_consent_entry in the Python SDK.
+ *
+ * Steps (order is invariant — do not reorder):
+ *  1. consentCanonical(entry) — derive canonical bytes.
+ *  2. deriveConsentContentHash(canonical) — re-derive expected hash.
+ *  3. Constant-time compare expected hash against storedContentHash.
+ *     MUST precede key lookup (step 4) to prevent key-ID oracle timing attacks.
+ *  4. verifyConsentSignature(canonical, sigBytes, keyId) — ML-DSA-65 verify.
+ *
+ * # Inputs
+ *
+ *   - entry: The ConsentChainEntry to verify.
+ *   - storedContentHash: 128-char hex string from audit_entries.content_hash.
+ *   - sigBytes: Raw ML-DSA-65 signature bytes (exactly 3309 bytes).
+ *   - keyId: The signing key ID from the consent_chain_entries row.
+ *
+ * # Outputs
+ *
+ *   - Promise<void>: Resolves normally if verification succeeds.
+ *   - InvalidConsentEntryError: Thrown if entry field validation fails.
+ *   - ConsentVerificationError: Thrown if content hash mismatches or
+ *     signature verification fails.
+ *
+ * # Limitations
+ *
+ *   - Cross-tenant check is the caller's responsibility:
+ *     ```typescript
+ *     if (entry.company_id !== owningChainCompanyId) throw new CrossTenantReplayError();
+ *     await verifyConsentEntry(entry, storedContentHash, sigBytes, keyId);
+ *     ```
+ *
+ * # Assumptions
+ *
+ *   - storedContentHash is a 128-char lowercase hex string.
+ *   - sigBytes is the raw ML-DSA-65 signature (not base64).
+ */
+declare function verifyConsentEntry(entry: ConsentChainEntry, storedContentHash: string, sigBytes: Uint8Array, keyId: string): Promise<void>;
+
+/** Byte length of an ML-DSA-65 public key (FIPS 204). */
+declare const PUBLIC_KEY_SIZE = 1952;
+/** Byte length of an ML-DSA-65 signature (FIPS 204). */
+declare const SIGNATURE_SIZE = 3309;
+/** Discriminant codes for {@link MLDSAVerificationError}. */
+type MLDSAErrorCode = "invalid_public_key" | "invalid_signature_length" | "signature_verification_failed";
+/**
+ * Base error thrown by {@link verify} on any failure. Branch on `code`.
+ */
+declare class MLDSAVerificationError extends Error {
+    readonly code: MLDSAErrorCode;
+    constructor(code: MLDSAErrorCode, message: string);
+}
+/**
+ * Verify an ML-DSA-65 signature in FIPS 204 pure mode.
+ *
+ * No pre-hashing is applied — the scheme hashes the message internally per
+ * FIPS 204 §5.3. The empty context string matches Cloud KMS
+ * PQ_SIGN_ML_DSA_65 and the Go and Python SDK counterparts. Do not change
+ * without coordinated updates across every signing path.
+ *
+ * @param publicKey - Raw 1952-byte ML-DSA-65 public key.
+ * @param message - Exact bytes that were signed (e.g., RFC 8785 canonical JSON).
+ * @param signature - Raw 3309-byte ML-DSA-65 signature.
+ * @throws {MLDSAVerificationError} with `code`:
+ *   - `invalid_public_key` if `publicKey` is not a Uint8Array of length
+ *     {@link PUBLIC_KEY_SIZE}.
+ *   - `invalid_signature_length` if `signature` is not a Uint8Array of
+ *     length {@link SIGNATURE_SIZE}.
+ *   - `signature_verification_failed` if the signature does not verify
+ *     against the given public key and message.
+ *
+ * Limitations:
+ * - Does not resolve key IDs; callers provide raw public-key bytes.
+ * - Does not check revocation status; that is the trust-store loader's job.
+ * - No context string is supported; pure FIPS 204 mode only.
+ *
+ * Assumptions:
+ * - `message` bytes are already canonicalized to match what was signed.
+ * - `publicKey` is the raw 1952-byte encoding, not PEM or DER-wrapped.
+ */
+declare function verify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): void;
+
+type mldsa_MLDSAErrorCode = MLDSAErrorCode;
+type mldsa_MLDSAVerificationError = MLDSAVerificationError;
+declare const mldsa_MLDSAVerificationError: typeof MLDSAVerificationError;
+declare const mldsa_PUBLIC_KEY_SIZE: typeof PUBLIC_KEY_SIZE;
+declare const mldsa_SIGNATURE_SIZE: typeof SIGNATURE_SIZE;
+declare const mldsa_verify: typeof verify;
+declare namespace mldsa {
+  export { type mldsa_MLDSAErrorCode as MLDSAErrorCode, mldsa_MLDSAVerificationError as MLDSAVerificationError, mldsa_PUBLIC_KEY_SIZE as PUBLIC_KEY_SIZE, mldsa_SIGNATURE_SIZE as SIGNATURE_SIZE, mldsa_verify as verify };
+}
+
+/** The domain string hashed before an ML-DSA SubjectPublicKeyInfo. */
+declare const KEYID_DOMAIN = "proof.keyid.v1:";
+/**
+ * The SubjectPublicKeyInfo DER of a raw ML-DSA-65 public key.
+ *
+ * @throws Error when the key is not exactly 1952 bytes.
+ */
+declare function mldsa65Spki(publicKey: Uint8Array): Uint8Array;
+/**
+ * The key id of a raw ML-DSA-65 public key: 32 lowercase hex.
+ *
+ * @throws Error when the key is not exactly 1952 bytes.
+ */
+declare function keyIdMLDSA65(publicKey: Uint8Array): Promise<string>;
+/**
+ * The key id of a raw X-Wing public key (the legacy rule, no domain).
+ *
+ * @throws Error when the key is empty.
+ */
+declare function keyIdXWing(publicKey: Uint8Array): Promise<string>;
+
+/**
+ * SAR (Data Subject Access Request) v3 chain entry types — TS verifier port.
+ *
+ * Cross-language reference
+ * ========================
+ * Mirror of {@link "../../verification-go/sar_entries_v3.go"} and
+ * {@link "../../verification-python/src/aleutian_verification/sar_entries.py"}.
+ * Field order in each interface MUST match the alphabetical body-field order
+ * from `pqc_05c v3 §4.5–4.9`. The canonical encoder in `canonicalV3.ts`
+ * (ticket dsar_chain_f_02) relies on declaration ordering — silent reorder
+ * is a wire-format break.
+ *
+ * Sealed discriminated union
+ * ==========================
+ * TypeScript cannot enforce protocol sealing at the type-system level the
+ * way Go can (no unexported parameter types). Instead this module defines
+ * `CONCRETE_SAR_ENTRY_TYPE_TAGS` — an authoritative set of `entryType`
+ * literal values — and the public encoder / verifier dispatch chain
+ * (canonicalV3.chainCanonicalV3 in `_02`, verifyV3.verifyChainEntryV3
+ * in `_04`) checks the tag at runtime before any work. Structural-typing
+ * impostors that duck-type `ChainEntryV3` are refused at that boundary.
+ * The `ChainEntryV3` discriminated union remains the static type for
+ * annotation purposes; it is NOT the security boundary — the tag set is.
+ *
+ * Privacy posture (OQ-11, locked)
+ * ================================
+ * SAR entries are systematically actor-anonymous on chain. NONE of these
+ * interfaces carry actor pseudonyms or email-derived hashes. Verifiers
+ * cannot identify the data subject from the chain entry alone.
+ *
+ * Field naming
+ * ============
+ * camelCase per TS convention. The on-the-wire JSON form is snake_case;
+ * the canonical encoder operates on these typed objects directly, NOT
+ * on the JSON. Callers loading from chain rows should convert via the
+ * snake-case→camel-case helper in `chainRowDecode.ts` (future ticket)
+ * before passing entries into the encoder/verifier.
+ *
+ * @module
+ */
+/** Chain entry discriminating tag (pqc_05c v3 §3.2). */
+type EventTypeV3 = "sar_intent" | "sar_acknowledged" | "sar_fulfilled" | "sar_rejected" | "sar_extended";
+/** Surface that originated a SAR intent (canonical on chain, only on intent). */
+type SARSourceChannelV3 = "portal" | "api";
+/** GDPR right being exercised. */
+type SARTypeV3 = "access" | "erasure" | "both";
+/** What the controller actually did at fulfillment time. */
+type SARFulfillmentKindV3 = "access" | "erasure" | "both";
+/**
+ * Internal brand for nominal-typing on TenantHMACDigestV3.
+ *
+ * The brand is TYPE-ONLY — there is no runtime property of this name on
+ * the value. `declare const ... unique symbol` is erased at runtime, so
+ * the constructed object has only `hex` at runtime. The compile-time
+ * brand prevents external code from forging a digest via plain object
+ * literal: `{ hex: "..." } as TenantHMACDigestV3` fails type-check
+ * because the synthetic brand property is unsatisfiable outside this
+ * module.
+ */
+declare const _digestBrand: unique symbol;
+/**
+ * HMAC-SHA-512 digest under a per-tenant PII subkey (pqc_05c v3 §4.0).
+ *
+ * Stored as a hex string (or empty string for the zero / unset sentinel) —
+ * matches Go SDK's `TenantHMACDigestV3` byte-for-byte so the canonical
+ * encoder produces parity output. The encoder calls `.hex`; empty
+ * string emits a 0-length TLV (sentinel for "caller did not supply
+ * cleartext"), and 128-hex emits a 128-byte string.
+ *
+ * Construct via {@link tenantHMACDigestFromHex}, {@link tenantHMACDigestFromRaw},
+ * or {@link tenantHMACDigestZero}. The type-only brand prevents
+ * external code from forging a digest via `{} as TenantHMACDigestV3` —
+ * the brand property is unsatisfiable outside this module.
+ */
+interface TenantHMACDigestV3 {
+    readonly hex: string;
+    readonly [_digestBrand]: never;
+}
+/** Construct from a 128-char lowercase hex string. Empty string → zero digest. */
+declare function tenantHMACDigestFromHex(hex: string): TenantHMACDigestV3;
+/** Construct from 64 raw bytes. */
+declare function tenantHMACDigestFromRaw(raw: Uint8Array): TenantHMACDigestV3;
+/** Zero / unset digest — encodes as empty string on chain. */
+declare function tenantHMACDigestZero(): TenantHMACDigestV3;
+/** True iff the digest is the zero / unset sentinel. */
+declare function tenantHMACDigestIsZero(d: TenantHMACDigestV3): boolean;
+/**
+ * Common header — present on every v3 chain entry.
+ *
+ * # Number vs BigInt typing (Phase 3 review H1)
+ *
+ * Int64 fields (`timestampMs`, `tombstoneCount`, `extendedDueAtMs`)
+ * accept `bigint | number`. JS `Number` is double-precision IEEE-754,
+ * so values above `Number.MAX_SAFE_INTEGER` (2^53 - 1) silently lose
+ * precision. Realistic v3 values fit comfortably (e.g., year-3000
+ * UnixMilli is ~3.3 × 10^13, well under 2^53 ≈ 9 × 10^15), but a
+ * future caller pulling row data from BigQuery — where int64 may
+ * surface as `bigint` — should be able to pass it through without a
+ * cast or precision-loss risk.
+ *
+ * The encoder (`canonicalV3.appendU64`) accepts either form and
+ * routes through `DataView.setBigUint64` for byte-identical BE
+ * encoding regardless of the source representation.
+ */
+interface _ChainEntryHeaderV3<T extends EventTypeV3> {
+    readonly companyId: string;
+    readonly entryType: T;
+    readonly signingKeyId: string;
+    readonly timestampMs: bigint | number;
+}
+/**
+ * Filed-SAR entry. Header + 5 body fields (pqc_05c v3 §4.5).
+ *
+ * `piiDigestKeyVersion` (pii_hmac_key_rotation_R4): source-namespaced
+ * PII-HMAC key version ("sm:v1") under which `reasonHash` was computed.
+ * OPTIONAL on intent (reason_hash itself is optional). Empty string is
+ * the legacy / pre-rotation sentinel — encoded ONLY when non-empty so a
+ * legacy leaf hashes byte-identically to its original signing. Matches
+ * the Go SDK's `SARIntentEntryV3.PIIDigestKeyVersion` (json
+ * `pii_digest_key_version`).
+ */
+interface SARIntentEntryV3 extends _ChainEntryHeaderV3<"sar_intent"> {
+    readonly piiDigestKeyVersion: string;
+    readonly reasonHash: TenantHMACDigestV3;
+    readonly requestId: string;
+    readonly sarType: SARTypeV3;
+    readonly scope: string;
+    readonly sourceChannel: SARSourceChannelV3;
+}
+/** Acknowledged-SAR entry. Header + 2 body fields (pqc_05c v3 §4.6). */
+interface SARAcknowledgedEntryV3 extends _ChainEntryHeaderV3<"sar_acknowledged"> {
+    readonly intentEntryId: string;
+    readonly requestId: string;
+}
+/**
+ * Fulfilled-SAR entry. Header + 7 body fields (pqc_05c v3 §4.7).
+ *
+ * `certificateId` was added 2026-05-16 by `dsar_fulfill_b_pre_02e` as the
+ * alphabetical-first body field. Per-kind shape rules:
+ *
+ *   - fulfillmentKind=access  → certificateId MUST be empty
+ *   - fulfillmentKind=erasure → certificateId MUST match cert_<32-hex>
+ *   - fulfillmentKind=both    → certificateId MUST match cert_<32-hex>
+ */
+interface SARFulfilledEntryV3 extends _ChainEntryHeaderV3<"sar_fulfilled"> {
+    readonly certificateId: string;
+    readonly fulfillmentKind: SARFulfillmentKindV3;
+    readonly intentEntryId: string;
+    readonly legalBasis: string;
+    readonly manifestRoot: string;
+    readonly requestId: string;
+    readonly tombstoneCount: bigint | number;
+}
+/**
+ * Rejected-SAR entry. Header + 4 body fields (pqc_05c v3 §4.8).
+ *
+ * `piiDigestKeyVersion` (pii_hmac_key_rotation_R4): PII-HMAC key version
+ * ("sm:v1") under which `rationaleHash` was computed. REQUIRED in the
+ * sense that rationale_hash is required on rejection, so a non-empty
+ * version always has a digest to apply it to. Empty string is the legacy
+ * sentinel — encoded ONLY when non-empty. Matches Go
+ * `SARRejectedEntryV3.PIIDigestKeyVersion`.
+ */
+interface SARRejectedEntryV3 extends _ChainEntryHeaderV3<"sar_rejected"> {
+    readonly intentEntryId: string;
+    readonly legalBasis: string;
+    readonly piiDigestKeyVersion: string;
+    readonly rationaleHash: TenantHMACDigestV3;
+    readonly requestId: string;
+}
+/**
+ * Extended-SAR entry. Header + 4 body fields (pqc_05c v3 §4.9).
+ *
+ * Body alphabetical: extendedDueAtMs, intentEntryId, piiDigestKeyVersion
+ * (R4, iff non-empty), reasonHash, requestId.
+ * `originalDueAtMs` is NOT bound — derivable from the intent entry.
+ */
+interface SARExtendedEntryV3 extends _ChainEntryHeaderV3<"sar_extended"> {
+    readonly extendedDueAtMs: bigint | number;
+    readonly intentEntryId: string;
+    /**
+     * `piiDigestKeyVersion` (pii_hmac_key_rotation_R4): PII-HMAC key
+     * version ("sm:v1") under which `reasonHash` was computed. reason_hash
+     * is required on extension, so a non-empty version always has a digest
+     * to apply it to. Empty string is the legacy sentinel — encoded ONLY
+     * when non-empty. Matches Go `SARExtendedEntryV3.PIIDigestKeyVersion`.
+     */
+    readonly piiDigestKeyVersion: string;
+    readonly reasonHash: TenantHMACDigestV3;
+    readonly requestId: string;
+}
+/**
+ * Discriminated union of all 5 v3 SAR chain entry types.
+ *
+ * The `entryType` literal field is the discriminant — TypeScript narrows
+ * to a specific interface when you switch on it:
+ *
+ * ```ts
+ * function describe(e: ChainEntryV3): string {
+ *   switch (e.entryType) {
+ *     case "sar_intent":      return `intent ${e.requestId}`;
+ *     case "sar_fulfilled":   return `fulfilled ${e.manifestRoot.slice(0, 8)}…`;
+ *     // ... compiler errors if you forget a case
+ *   }
+ * }
+ * ```
+ */
+type ChainEntryV3 = SARIntentEntryV3 | SARAcknowledgedEntryV3 | SARFulfilledEntryV3 | SARRejectedEntryV3 | SARExtendedEntryV3;
+declare const CONCRETE_SAR_ENTRY_TYPE_TAGS: ReadonlySet<EventTypeV3>;
+/**
+ * Runtime check that an unknown value carries a valid v3 SAR chain
+ * entry TAG. Verifies the `entryType` discriminant is in the
+ * concrete-tag allowlist; does NOT shape-check body fields — that
+ * happens in `validateV3Entry` (see `_03`).
+ *
+ * Phase 3 review M4: renamed from the previous `isChainEntryV3` to
+ * accurately reflect what it does. Code paths that need full shape
+ * validation should call `validateV3Entry` from `canonicalV3.ts`.
+ */
+declare function hasValidChainEntryTag(value: unknown): value is ChainEntryV3;
+/**
+ * @deprecated Renamed to `hasValidChainEntryTag` (Phase 3 review M4)
+ * to accurately describe the tag-only check. Will be removed in a
+ * future minor version; switch call sites to the new name.
+ */
+declare const isChainEntryV3: typeof hasValidChainEntryTag;
+
+/**
+ * Locked V3 domain prefix used for content-hash and signature
+ * derivation. See Go SDK `DomainPrefixV3` for the producer-side
+ * counterpart.
+ *
+ * # WARNING — load-bearing constant
+ *
+ * Changing this byte sequence invalidates every signed v3 chain
+ * entry across all language ports.
+ */
+declare const DOMAIN_PREFIX_V3 = "aleutian.chain.entry.v3:";
+/** Pre-computed `Uint8Array` form to avoid per-hash allocation. */
+declare const DOMAIN_PREFIX_V3_BYTES: Uint8Array;
+/**
+ * v3 spec §7 byte cap on string fields post-NFC. Cross-language
+ * locked value; matches Go's `maxV3StringFieldBytesSDK` and Python's
+ * `_MAX_V3_STRING_FIELD_BYTES`.
+ */
+declare const MAX_V3_STRING_FIELD_BYTES = 256;
+/** SHA-512 hex digest length (cross-language constant). */
+declare const V3_SHA512_HEX_LEN = 128;
+/**
+ * Maximum canonical-byte sum per entry (cross-language locked
+ * value; matches Go's `MaxCanonicalBytesV3` and Python's
+ * `MAX_CANONICAL_BYTES_V3`). The widest current v3 SAR entry fits
+ * comfortably under 1 KiB; 4× headroom absorbs future field
+ * additions without forcing a SemVer-breaking bound bump.
+ *
+ * # Cross-language consistency is load-bearing
+ *
+ * A divergent value in any one SDK becomes a per-tenant DoS vector
+ * against customers using the laxer SDK — they'd do unbounded work
+ * on adversarial inputs. Pinned in
+ * `verifyV3.test.ts::MAX_CANONICAL_BYTES_V3_LockedAtCrossLanguageValue`.
+ */
+declare const MAX_CANONICAL_BYTES_V3 = 4096;
+/**
+ * 14-month sanity bound for `extendedDueAtMs` past `timestampMs`.
+ * Mirror of Go's `420 * 24 * 60 * 60 * 1000` literal.
+ */
+declare const EXTENDED_SANITY_BOUND_MS: number;
+/**
+ * Wrapped sentinel for encoder validation failures. Customer code
+ * can `err instanceof ErrInvalidEntryV3` to distinguish encoder
+ * rejections from signature/content-hash failures (which use
+ * distinct sentinels; see verifyV3.ts).
+ *
+ * Per `sdk_error_hierarchy_spec`, this is the V3 entry-shape error.
+ */
+declare class ErrInvalidEntryV3 extends Error {
+    readonly name: string;
+    constructor(message: string);
+}
+/**
+ * Validates a V3 chain entry by dispatching to the per-type
+ * validator. Throws `ErrInvalidEntryV3` on any failure. Called
+ * automatically by `chainCanonicalV3` before encoding.
+ *
+ * Exported so customers can validate without encoding.
+ */
+declare function validateV3Entry(entry: ChainEntryV3): void;
+/**
+ * `V3Encoder` bundles a growing `Uint8Array` buffer. Per-event-type
+ * body encoders append fields without explicit error plumbing — the
+ * encoder throws synchronously on invariant violations (256-byte
+ * cap, negative u64).
+ *
+ * Mirror of Go's `v3EncoderSDK`.
+ *
+ * Exported for the explicit purpose of unit-testing the encoder
+ * mechanics (NFC normalization, BE encoding, length cap) without
+ * routing through the full `chainCanonicalV3` pipeline (which
+ * validates regex/vocabulary constraints first). Customers writing
+ * normal verification code should call `chainCanonicalV3`.
+ */
+declare class V3Encoder {
+    private buf;
+    private pos;
+    private view;
+    private readonly textEncoder;
+    private readonly assumeNormalized;
+    constructor(initialCapacity?: number, options?: {
+        assumeNormalized?: boolean;
+    });
+    /** Final byte slice (a fresh allocation; safe to share with callers). */
+    bytes(): Uint8Array;
+    private grow;
+    /**
+     * Writes a length-prefixed UTF-8 string with the spec's "post-NFC,
+     * post-UTF-8 byte length" semantics (pqc_05c v3 §7).
+     *
+     * Privacy Inv 4: errors do NOT echo the offending field length.
+     *
+     * # Double-NFC posture (M6, 2026-05-29)
+     *
+     * When called via `chainCanonicalV3`, `validateV3Entry` has
+     * already NFC-normalized this field. NFC is idempotent so the
+     * re-normalization here is a no-op semantically, but it does pay
+     * one `String.normalize("NFC")` call per field. Construct the
+     * encoder with `{ assumeNormalized: true }` to skip the redundant
+     * call when the caller has already validated. Defaults to `false`
+     * so direct unit-test use of `V3Encoder` remains safe.
+     */
+    appendStr(s: string): void;
+    /**
+     * Writes a u64 BE non-negative integer. v3 has no signed-int
+     * fields; callers attempting to emit negative values indicate a
+     * validator bug — the encoder traps it as a distinct invariant
+     * violation.
+     *
+     * Accepts `bigint` or `number`. `number` inputs are checked for
+     * `Number.isSafeInteger`; if you have a value above 2^53, pass it
+     * as `bigint` (e.g. `BigInt(value)`).
+     */
+    appendU64(v: bigint | number): void;
+    /**
+     * Writes the 4-field common header in alphabetical order:
+     * company_id, entry_type, signing_key_id, timestamp_ms.
+     */
+    appendV3Header(companyId: string, entryType: string, signingKeyId: string, timestampMs: bigint | number): void;
+}
+/**
+ * Encode a typed V3 chain entry to canonical bytes per pqc_05c v3
+ * §3 + §4. The single entry-point for cross-language byte-identical
+ * encoding.
+ *
+ * Mirror of Go's `CanonicalBytesV3`.
+ *
+ * @param entry - A typed v3 chain entry (one of the 5 SAR variants).
+ * @returns Canonical TLV bytes.
+ * @throws {ErrInvalidEntryV3} On encoder invariant violation.
+ */
+declare function chainCanonicalV3(entry: ChainEntryV3): Uint8Array;
+/**
+ * Compute the V3 content hash: SHA-512(DOMAIN_PREFIX_V3_BYTES || canonical).
+ *
+ * Mirror of Go's `ContentHashV3` (which returns hex). This JS version
+ * returns the raw 64-byte digest; hex encoding is the caller's job
+ * via `bytesToHex` (caller-side utility).
+ *
+ * Uses `crypto.subtle.digest("SHA-512", ...)` from the Web Crypto API,
+ * which is available in Node ≥16 (via `globalThis.crypto`) and all
+ * modern browsers.
+ *
+ * @param canonical - Canonical bytes from `chainCanonicalV3`.
+ * @returns The 64-byte SHA-512 digest.
+ */
+declare function computeV3ContentHash(canonical: Uint8Array): Promise<Uint8Array>;
+/**
+ * Convenience: encode + hash in one call. Mirror of Go's
+ * `EncodeAndHashV3`.
+ */
+declare function encodeAndHashV3(entry: ChainEntryV3): Promise<{
+    canonical: Uint8Array;
+    contentHash: Uint8Array;
+}>;
+/**
+ * Lowercase hex encoder for digests. Mirror of Go's
+ * `hex.EncodeToString`. Useful for cross-language hash comparison
+ * tests (golden vectors carry hex strings).
+ */
+declare function bytesToHex(bytes: Uint8Array): string;
+
+/**
+ * A capture-chain AI-request leaf. camelCase fields per JS convention; the
+ * cross-language fixture `input` is snake_case (the golden test maps them).
+ * entry_type is a constant, not a field.
+ *
+ * All hash/digest fields (`contentHash`, `userId`, `piiCategories`, `dlp`) are
+ * 128 lowercase hex (SHA-512 / HMAC-SHA512), or empty for the optional digests.
+ * The verifier checks SHAPE only; per-tenant HMAC keying is producer-side.
+ */
+interface CaptureRequestEntryV3 {
+    readonly companyId: string;
+    readonly signingKeyId: string;
+    /** Server-stamped ingested_at (UnixMilli). Always < 2^53 for real anchors. */
+    readonly timestampMs: number;
+    readonly captureMethod: string;
+    readonly contentHash: string;
+    readonly dlp: string;
+    readonly encryptionMode: string;
+    readonly model: string;
+    readonly piiAction: string;
+    readonly piiCategories: string;
+    readonly piiDetected: boolean;
+    readonly piiDigestKeyVersion: string;
+    readonly processingMode: string;
+    readonly provider: string;
+    readonly region: string;
+    readonly sourceType: string;
+    readonly trustLevel: string;
+    readonly userId: string;
+}
+
+/**
+ * Constant-time byte-array equality. Returns `true` iff `a` and `b`
+ * are byte-identical.
+ *
+ * # Why constant-time matters here
+ *
+ * A short-circuiting compare leaks the position of the first
+ * differing byte via timing, which on a hash-comparison gate
+ * becomes a forgery oracle: an attacker can brute-force the hash
+ * one byte at a time.
+ *
+ * # Implementation
+ *
+ * Under Node 16+ this delegates to `crypto.timingSafeEqual` (the
+ * built-in C implementation). Under browsers it uses a pure-JS
+ * fallback that iterates the longer of the two inputs and ORs
+ * into an accumulator.
+ */
+declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;
+
+/**
+ * V3 chain entry signature verifier — TS port of
+ * `sdk/verification-go/verify_v3.go::VerifyChainEntryV3`.
+ *
+ * # Pipeline
+ *
+ *   1. `validateV3Entry(entry)` — typed validation per pqc_05c v3 §3-§4.
+ *   2. `chainCanonicalV3(entry)` — re-encode canonical bytes.
+ *   3. `len(canonical) ≤ MAX_CANONICAL_BYTES_V3` — DoS bound.
+ *   4. Bound input sizes on the CLAIM (`contentHash` 64 bytes,
+ *      `signature` 3309 bytes) BEFORE expensive ops.
+ *   5. Recompute `SHA-512(prefix || canonical)`; constant-time
+ *      compare to the claimed `contentHash`.
+ *   6. Resolve `signingKeyId` via the trust manifest.
+ *   7. Verify ML-DSA-65 signature over `prefix || canonical`
+ *      (NOT over `contentHash` — pqc_05c v3 §9.1 option A).
+ *
+ * # Error contract (chain_d H2 — strict opacity)
+ *
+ * Error messages are intentionally content-agnostic. They surface
+ * the typed error class only; never echo:
+ *   - claimed hash bytes,
+ *   - computed hash bytes,
+ *   - signingKeyId,
+ *   - raw ML-DSA library error strings.
+ *
+ * A public verifier (e.g. verify.aleutian.ai) leaking any of those
+ * gives:
+ *   - a forgery oracle (computed hash echoed back lets attacker
+ *     pass the hash gate trivially, focusing on signature alone),
+ *   - operator-metadata leakage (signingKeyId reveals KMS key
+ *     version / rotation date / tenant region to anyone who
+ *     triggers a bad signature).
+ *
+ * Callers needing structured access for ops dashboards branch on
+ * `err instanceof Err...V3` not on `.message` scraping.
+ */
+
+/** SHA-512 byte length — cross-language constant. */
+declare const CONTENT_HASH_V3_BYTES = 64;
+/**
+ * Trust manifest does not contain the entry's signingKeyId.
+ *
+ * Mirror of Go's `ErrKeyNotInTrustManifestV3` / Python's
+ * `ErrUnknownSigningKeyV3`.
+ */
+declare class ErrUnknownSigningKeyV3 extends ErrInvalidEntryV3 {
+    readonly name = "ErrUnknownSigningKeyV3";
+}
+/** Re-encoded `content_hash` does not match the supplied claim. */
+declare class ErrContentHashMismatchV3 extends ErrInvalidEntryV3 {
+    readonly name = "ErrContentHashMismatchV3";
+}
+/** Signature parses + correct length, but does not verify under the key. */
+declare class ErrSignatureInvalidV3 extends ErrInvalidEntryV3 {
+    readonly name = "ErrSignatureInvalidV3";
+}
+/** Signature bytes don't have a valid shape (wrong length, etc.). */
+declare class ErrSignatureMalformedV3 extends ErrInvalidEntryV3 {
+    readonly name = "ErrSignatureMalformedV3";
+}
+/** A trust-manifest public key has malformed bytes. */
+declare class ErrPublicKeyMalformedV3 extends ErrInvalidEntryV3 {
+    readonly name = "ErrPublicKeyMalformedV3";
+}
+/**
+ * Lookup surface a verifier uses to resolve `signingKeyId` →
+ * ML-DSA-65 public key. Mirror of Go's `TrustManifestV3` interface
+ * and Python's `TrustManifestV3` dataclass.
+ *
+ * # Required guarantees (per pqc_05c v3 §3.1.1)
+ *
+ *   - Append-only: once a `signingKeyId` is bound to a public key,
+ *     the binding MUST NOT change. Rotating a key requires minting
+ *     a NEW `signingKeyId` value.
+ *   - One-to-one: a `signingKeyId` MUST resolve to exactly one
+ *     public key over the manifest's lifetime.
+ *
+ * # Construction-time validation (chain_d H3)
+ *
+ * Each public key is validated against the ML-DSA-65 byte length
+ * (1952) at construction. Operators detect misconfiguration at
+ * manifest-load time, not lazily per-verify.
+ *
+ * # Concurrency
+ *
+ * Read-only after construction. Safe for concurrent reads.
+ */
+declare class TrustManifestV3 {
+    private readonly _keys;
+    private constructor();
+    /**
+     * Build a manifest from a `Record<signingKeyId, publicKey>`. Each
+     * public key is shape-validated at construction time. Each key
+     * is defensively copied — post-construction mutation of the
+     * caller's `Uint8Array` does not affect the manifest.
+     *
+     * Throws `ErrInvalidEntryV3` for empty signingKeyIds; throws
+     * `ErrPublicKeyMalformedV3` for keys whose byte length is not
+     * exactly `PUBLIC_KEY_SIZE`.
+     */
+    static fromMap(keys: Record<string, Uint8Array>): TrustManifestV3;
+    /**
+     * Returns the public key bytes for `signingKeyId`. Throws
+     * `ErrUnknownSigningKeyV3` if missing.
+     *
+     * The returned slice is a DEFENSIVE COPY — callers may mutate it
+     * without affecting subsequent lookups.
+     */
+    publicKeyForSigningKeyId(signingKeyId: string): Uint8Array;
+    /** Number of bound keys (for ops dashboards / sanity checks). */
+    get size(): number;
+}
+
+/**
+ * Options-object form of {@link verifyChainEntryV3} (M1, added 0.3.1).
+ *
+ * Preferred over the positional form going forward. Positional form
+ * remains accepted on the 0.3.x track and emits a one-shot
+ * `console.warn` deprecation notice on first call; removed in 0.4.0.
+ */
+interface VerifyChainEntryV3Options {
+    signature: Uint8Array;
+    contentHash: Uint8Array;
+    trustManifest: TrustManifestV3;
+}
+/**
+ * Verify a v3 chain entry's `content_hash` + ML-DSA-65 signature.
+ *
+ * # Inputs
+ *
+ * Two call shapes are accepted on the 0.3.x track:
+ *
+ * 1. **Options-object (preferred, added 0.3.1):**
+ *
+ *    ```ts
+ *    verifyChainEntryV3(entry, { signature, contentHash, trustManifest })
+ *    ```
+ *
+ * 2. **Positional (deprecated, removed in 0.4.0):**
+ *
+ *    ```ts
+ *    verifyChainEntryV3(entry, signature, contentHash, trustManifest)
+ *    ```
+ *
+ *    Emits a one-shot `console.warn` deprecation notice on first use.
+ *
+ * Field semantics (identical across both shapes):
+ *
+ *   - entry: one of the 5 concrete SAR entry variants.
+ *   - signature: raw ML-DSA-65 signature bytes (3309 bytes).
+ *   - contentHash: raw SHA-512 bytes (64 bytes). Callers with a
+ *     hex-encoded claim should decode (`hexToBytes(...)`) first.
+ *   - trustManifest: lookup surface for signingKeyId.
+ *
+ * # Outputs
+ *
+ *   - Promise resolves on successful verification.
+ *   - Throws one of:
+ *       - `ErrInvalidEntryV3` (validation, oversized canonical, missing args)
+ *       - `ErrContentHashMismatchV3` (claimed hash does not match recompute)
+ *       - `ErrSignatureMalformedV3` (signature wrong length / not Uint8Array)
+ *       - `ErrSignatureInvalidV3` (ML-DSA verify failed)
+ *       - `ErrUnknownSigningKeyV3` (signingKeyId not in manifest)
+ *       - `ErrPublicKeyMalformedV3` (manifest contains corrupt key)
+ *
+ * # Concurrency
+ *
+ * Pure function over its inputs. Safe for concurrent use.
+ */
+declare function verifyChainEntryV3(entry: ChainEntryV3 | CaptureRequestEntryV3, options: VerifyChainEntryV3Options): Promise<void>;
+declare function verifyChainEntryV3(entry: ChainEntryV3 | CaptureRequestEntryV3, signature: Uint8Array, contentHash: Uint8Array, trustManifest: TrustManifestV3): Promise<void>;
+
+/**
+ * Tier-2 bundle wire-format types.
+ *
+ * Mirrors `sdk/verification-go/tier2/bundle.go` and
+ * `aleutian_verification.tier2.bundle`. The JSON field names match the
+ * on-wire encoding produced by the proprietary Tier-2 sealer; do not
+ * rename without coordinating across all three SDKs.
+ */
+/** One recipient's bundle-CEK wrap. */
+interface CEKWrapEnvelope {
+    /** 32-char lowercase hex fingerprint of the recipient's X-Wing pubkey. */
+    pubkey_fingerprint: string;
+    /** 1120-byte X-Wing KEM ciphertext, base64. */
+    kem_ciphertext: string;
+    /** AES-256-GCM nonce (12 bytes, base64). */
+    wrap_nonce: string;
+    /** AEAD-sealed bundle CEK (48 bytes = 32-byte key + 16-byte tag), base64. */
+    wrap_ciphertext: string;
+    /** Producer-side sealing timestamp. NOT AAD-bound; operator audit only. */
+    encapsulated_at_ms?: number;
+}
+/** The `manifest.tier2` block. */
+interface Tier2Manifest {
+    /** Either `"standard"` or `"forensic"`. openBundle rejects non-standard. */
+    mode: string;
+    /** Per-recipient wraps. */
+    cek_envelopes: CEKWrapEnvelope[];
+    /**
+     * Producer-reported recipient count. Defense-in-depth cross-check
+     * against `cek_envelopes.length`; mismatch returns BundleMalformedError.
+     * Absent / zero values are tolerated.
+     */
+    pubkey_count?: number;
+}
+/** Parsed manifest.json (Tier-2 subset). */
+interface Manifest {
+    tier2: Tier2Manifest;
+}
+/** Customer-side projection of a Tier-2 audit bundle. */
+interface Bundle {
+    /** Canonical bundle identifier; MUST match seal-time value (AAD-bound). */
+    id: string;
+    manifest: Manifest;
+}
+/** Successful openBundle return. */
+interface OpenBundleResult {
+    /** Recovered 32-byte content-encryption key. */
+    cek: Uint8Array;
+    /** 0-based index of the envelope that decrypted successfully. */
+    matchedEnvelopeIndex: number;
+    /** Fingerprint of the envelope that decrypted. */
+    matchedFingerprint: string;
+}
+
+/**
+ * Exception hierarchy for Tier-2 unseal.
+ *
+ * Mirrors the Go SDK sentinels and the Python SDK exception classes.
+ * Catch `Tier2Error` to handle any unseal failure uniformly.
+ */
+/** Base class for all Tier-2 unseal failures. */
+declare class Tier2Error extends Error {
+    constructor(message: string);
+}
+/**
+ * Raised when the supplied seed is not exactly 32 bytes.
+ */
+declare class SeedInvalidError extends Tier2Error {
+    constructor(message: string);
+}
+/**
+ * Raised when the bundle is structurally invalid: missing or empty
+ * `id`, `tier2.mode` not `"standard"`, empty `cek_envelopes`, or a
+ * `pubkey_count` value that disagrees with `len(cek_envelopes)`.
+ */
+declare class BundleMalformedError extends Tier2Error {
+    constructor(message: string);
+}
+/**
+ * Raised when the seed's fingerprint matches no envelope in the bundle.
+ *
+ * SECURITY: deliberately opaque. Does NOT include the seed's fingerprint,
+ * the bundle's recipient list, or any slot label — a distinguishing
+ * error would leak which envelopes a bundle carries to an attacker who
+ * controls the seed.
+ */
+declare class NoMatchingRecipientError extends Tier2Error {
+    constructor(message: string);
+}
+/**
+ * Raised when the matched envelope's AEAD decryption fails. The single-
+ * sentinel design (wrong seed, tampered ciphertext, AAD mismatch all
+ * collapse here) mirrors the Go/Python SDKs' anti-oracle posture.
+ */
+declare class OpenFailedError extends Tier2Error {
+    constructor(message: string);
+}
+
+/**
+ * Unseal a Tier-2 Standard-mode bundle using one of the customer's
+ * X-Wing private-key seeds.
+ *
+ * Per ADR-024 Amendment (2026-05-31), bundles ship with N=2
+ * cek_envelopes (primary + backup). Either seed unseals; the function
+ * is slot-agnostic. Inspect `matchedEnvelopeIndex` to determine which
+ * slot was used.
+ *
+ * @param seed - Exactly 32 bytes of X-Wing private-key seed.
+ * @param bundle - Parsed bundle with `manifest.tier2.cek_envelopes` populated.
+ * @returns Recovered CEK and matched envelope metadata.
+ * @throws {SeedInvalidError} If seed length !== 32.
+ * @throws {BundleMalformedError} On structural rejection.
+ * @throws {NoMatchingRecipientError} If no envelope matches the seed's fingerprint.
+ * @throws {OpenFailedError} If envelope AEAD open fails.
+ */
+declare function openBundle(seed: Uint8Array, bundle: Bundle): Promise<OpenBundleResult>;
+/**
+ * Compute the 32-char lowercase hex fingerprint from a 32-byte X-Wing
+ * private-key seed.
+ *
+ * Matches `hex(SHA-512(canonical_pubkey_1216)[:16])` — the form stored
+ * in `CEKWrapEnvelope.pubkey_fingerprint`.
+ *
+ * @throws {SeedInvalidError} If seed length !== 32.
+ */
+declare function deriveFingerprint(seed: Uint8Array): Promise<string>;
+
+/**
+ * `@aleutian/verification/tier2` — customer-side unseal for Tier-2
+ * Standard-mode audit bundles. Browser- and Node-safe.
+ *
+ * Per ADR-024 Amendment (2026-05-31), bundles ship with N=2 X-Wing
+ * recipient envelopes (primary + backup). `openBundle` accepts a
+ * single seed and locates the matching envelope via constant-time
+ * fingerprint compare.
+ *
+ * @example
+ *
+ * ```ts
+ * import { openBundle, deriveFingerprint } from "@aleutian/verification/tier2";
+ *
+ * const seed = hexToBytes(myXWingPrimarySeed);
+ * const bundle = parseManifest(downloadedManifestJSON);
+ * const { cek, matchedEnvelopeIndex } = await openBundle(seed, bundle);
+ * console.log(`unsealed via envelope ${matchedEnvelopeIndex}`);
+ * ```
+ */
+
+type index_Bundle = Bundle;
+type index_BundleMalformedError = BundleMalformedError;
+declare const index_BundleMalformedError: typeof BundleMalformedError;
+type index_CEKWrapEnvelope = CEKWrapEnvelope;
+type index_Manifest = Manifest;
+type index_NoMatchingRecipientError = NoMatchingRecipientError;
+declare const index_NoMatchingRecipientError: typeof NoMatchingRecipientError;
+type index_OpenBundleResult = OpenBundleResult;
+type index_OpenFailedError = OpenFailedError;
+declare const index_OpenFailedError: typeof OpenFailedError;
+type index_SeedInvalidError = SeedInvalidError;
+declare const index_SeedInvalidError: typeof SeedInvalidError;
+type index_Tier2Error = Tier2Error;
+declare const index_Tier2Error: typeof Tier2Error;
+type index_Tier2Manifest = Tier2Manifest;
+declare const index_deriveFingerprint: typeof deriveFingerprint;
+declare const index_openBundle: typeof openBundle;
+declare namespace index {
+  export { type index_Bundle as Bundle, index_BundleMalformedError as BundleMalformedError, type index_CEKWrapEnvelope as CEKWrapEnvelope, type index_Manifest as Manifest, index_NoMatchingRecipientError as NoMatchingRecipientError, type index_OpenBundleResult as OpenBundleResult, index_OpenFailedError as OpenFailedError, index_SeedInvalidError as SeedInvalidError, index_Tier2Error as Tier2Error, type index_Tier2Manifest as Tier2Manifest, index_deriveFingerprint as deriveFingerprint, index_openBundle as openBundle };
+}
+
+/** The result id. A consumer MUST refuse any other (§9.4). */
+declare const PROOF_BUNDLE_RESULT_ID = "aleutian.proof.bundle-result.v1";
+/** The v1 bundle format string (§4.1). */
+declare const PROOF_BUNDLE_FORMAT = "aleutian.proof.bundle.v1";
+/**
+ * Why a bundle is unreadable (§9.1). Precedence: too-large (size), json,
+ * too-large (values), duplicate-key, format, structure, too-large (counts).
+ */
+type ProofBundleUnreadableReason = "too-large" | "json" | "duplicate-key" | "format" | "structure";
+/** A verdict (§1). */
+type ProofBundleVerdict = "ok" | "unauthenticated" | "failed";
+/** Whether a trust dimension was checked (§6). */
+type ProofBundleTrustState = "checked" | "not_checked";
+/** A chain's erasure state (§7.9). */
+type ProofBundleErasureState = "none" | "recorded" | "anchored" | "signed";
+/** The complete v1 list of problem codes (§12). */
+type ProofBundleProblemCode = "duplicate-chain" | "invalid-chain-id" | "field-shape" | "duplicate-entry-id" | "first-entry" | "sequence" | "link" | "chain-hash" | "entry-type" | "erasure-invalid" | "after-erasure" | "erased-event-disclosed" | "modified" | "checkpoint-malformed" | "checkpoint-subject" | "checkpoint-sequence" | "checkpoint-overreach" | "checkpoint-binding" | "checkpoint-unknown-key" | "checkpoint-bad-signature" | "unsigned" | "malformed-signature" | "unknown-key" | "bad-signature";
+/** One problem code with its count and lowest index (§9.2). */
+interface ProofBundleProblem {
+    readonly code: ProofBundleProblemCode;
+    readonly count: number;
+    /** The lowest index; null only for `invalid-chain-id`. */
+    readonly first: number | null;
+}
+/** A chain's counts (§9.2). Every count is always present. */
+interface ProofBundleChainCounts {
+    readonly entries: number;
+    readonly events: number;
+    readonly erasures: number;
+    readonly opened: number;
+    readonly committed: number;
+    readonly erased: number;
+    readonly checkpoints: number;
+    readonly unanchored: number;
+    readonly authenticated: number;
+    readonly unauthenticated: number;
+    readonly checkpoint_authenticated: number;
+    readonly record_authenticated: number;
+    readonly record_signatures_present: number;
+}
+/** One chain's result (§9.2). */
+interface ProofBundleChainResult {
+    readonly verdict: ProofBundleVerdict;
+    readonly erasure: ProofBundleErasureState;
+    readonly counts: ProofBundleChainCounts;
+    /** Sorted by `code` in byte order. */
+    readonly problems: ProofBundleProblem[];
+}
+/** An unreadable bundle (§9.1). */
+interface ProofBundleUnreadableResult {
+    readonly result: typeof PROOF_BUNDLE_RESULT_ID;
+    readonly readable: false;
+    readonly reason: ProofBundleUnreadableReason;
+}
+/** A readable bundle (§9.2). */
+interface ProofBundleReadableResult {
+    readonly result: typeof PROOF_BUNDLE_RESULT_ID;
+    readonly readable: true;
+    readonly checkpoint_trust: ProofBundleTrustState;
+    readonly record_trust: ProofBundleTrustState;
+    readonly verdict: ProofBundleVerdict;
+    /** Sorted by `code` in byte order. */
+    readonly bundle_problems: ProofBundleProblem[];
+    /** Keyed by chain id, or `#<i>` for an invalid or duplicated id (§9.3). */
+    readonly chains: Record<string, ProofBundleChainResult>;
+}
+/** The §9 result. */
+type ProofBundleResult = ProofBundleUnreadableResult | ProofBundleReadableResult;
+/** The verifier's trust (§6): raw 1952-byte ML-DSA-65 public keys. */
+interface ProofBundleTrust {
+    /** Keys trusted for checkpoints. Empty: the dimension is not checked. */
+    readonly checkpointKeys: readonly Uint8Array[];
+    /** Keys trusted for record signatures. Empty: the dimension is not checked. */
+    readonly recordKeys: readonly Uint8Array[];
+}
+/** The §5 limits. */
+interface ProofBundleLimits {
+    readonly bundleBytes: number;
+    /** JSON values in a v1 bundle, at every depth, the top-level value included. */
+    readonly values: number;
+    /**
+     * JSON values in a v2 bundle (§16 §5: 17,000,000). When absent, `values`
+     * applies to both formats.
+     */
+    readonly valuesV2?: number;
+    readonly chains: number;
+    readonly entries: number;
+    readonly checkpoints: number;
+    readonly checkpointTextBytes: number;
+}
+/** The normative limits (§5). Every implementation MUST accept a bundle within them. */
+declare const PROOF_BUNDLE_LIMITS: ProofBundleLimits;
+/** Thrown only for a caller error (bad trust keys) or a bug; never names a bundle value. */
+declare class ProofBundleVerifierError extends Error {
+    constructor(message: string);
+}
+/**
+ * Verify an `aleutian.proof.bundle.v1` or `aleutian.proof.bundle.v2` bundle.
+ *
+ * # Description
+ *
+ * Applies bundle-format §3–§9 to the bundle bytes under the caller's trust and
+ * returns the §9 result: either unreadable with its lowest-numbered reason, or
+ * readable with both trust dimensions, the bundle verdict, bundle problems and
+ * a result per chain. A dimension is checked exactly when its key set is
+ * non-empty.
+ *
+ * # Inputs
+ *
+ *   - bundle: the bundle file's exact bytes
+ *   - trust: raw 1952-byte ML-DSA-65 public keys trusted for checkpoints and
+ *     for record signatures (see `parseProofPublicKeyFile` for key files)
+ *
+ * # Outputs
+ *
+ *   - ProofBundleResult: the §9 result. An unreadable or failing bundle is a
+ *     result, never an exception.
+ *   - ProofBundleVerifierError: thrown only when `bundle` is not a Uint8Array,
+ *     `trust` is not an object with two arrays, or a trust key is not a
+ *     1952-byte Uint8Array. The message names no bundle value.
+ *
+ * # Example
+ *
+ *   const result = await verifyProofBundle(bytes, {
+ *     checkpointKeys: [checkpointKey],
+ *     recordKeys: [],
+ *   });
+ *   if (result.readable && result.verdict === "ok") { ... }
+ *
+ * # Limitations
+ *
+ *   - Holds the bundle and its parsed chains in memory (at most 256 MiB of
+ *     input and 15,000,000 JSON values for v1, 17,000,000 for v2, §5, §16);
+ *     hostile input is refused without
+ *     building more than a readable bundle would.
+ *   - A passing bundle proves only what §1 says: not that it holds every
+ *     chain, not that a chain is complete to its end, and nothing against a
+ *     writer that controls every key the verifier trusts.
+ *
+ * # Assumptions
+ *
+ *   - WebCrypto (`crypto.subtle`) is available (Node ≥ 19, modern browsers).
+ *   - The caller chose the trust keys out of band; a bundle never adds a key.
+ */
+declare function verifyProofBundle(bundle: Uint8Array, trust: ProofBundleTrust): Promise<ProofBundleResult>;
+/**
+ * The key ids present in both trust sets (§6: allowed, but one key for both
+ * roles means one compromise forges both, so a verifier SHOULD warn).
+ *
+ * # Description
+ *
+ * Computes each key's id (format-spec §9.6) and returns those in both sets,
+ * sorted.
+ *
+ * # Inputs
+ *
+ *   - trust: the two key sets
+ *
+ * # Outputs
+ *
+ *   - string[]: key ids trusted for both checkpoints and records
+ *   - ProofBundleVerifierError: thrown when `trust` is not an object with two
+ *     arrays, or a key is not a 1952-byte Uint8Array
+ *
+ * # Example
+ *
+ *   for (const id of await keysTrustedForBothRoles(trust)) warn(id);
+ *
+ * # Limitations
+ *
+ *   - Compares key ids, which name keys exactly (SHA-512 based).
+ *
+ * # Assumptions
+ *
+ *   - None.
+ */
+declare function keysTrustedForBothRoles(trust: ProofBundleTrust): Promise<string[]>;
+
+/** Thrown for any key file that is not exactly what §6 allows. */
+declare class ProofKeyFileError extends Error {
+    constructor(message: string);
+}
+/**
+ * Parse a trust key file into a raw ML-DSA-65 public key.
+ *
+ * # Description
+ *
+ * Accepts one PEM block labelled `PUBLIC KEY`, optionally surrounded by
+ * whitespace, whose body lines (ending in LF or CRLF) join to canonical base64
+ * of exactly the RFC 9881 SPKI DER of a 1952-byte ML-DSA-65 key. Returns the
+ * raw 1952-byte key.
+ *
+ * # Inputs
+ *
+ *   - bytes: the whole key file
+ *
+ * # Outputs
+ *
+ *   - Uint8Array: the raw 1952-byte public key
+ *   - ProofKeyFileError: thrown, with a fixed message that quotes nothing from
+ *     the file, for any other file
+ *
+ * # Example
+ *
+ *   const pk = parseProofPublicKeyFile(await readFile("checkpoint.pub"));
+ *
+ * # Limitations
+ *
+ *   - ML-DSA-65 only. Text before the block is refused (only whitespace may
+ *     surround it).
+ *
+ * # Assumptions
+ *
+ *   - None.
+ */
+declare function parseProofPublicKeyFile(bytes: Uint8Array): Uint8Array;
+
+/** The commitment domain string (format-spec §8). */
+declare const COMMITMENT_DOMAIN = "aleutian.commit.v1:";
+/** The only nonce length a commitment accepts, in bytes. */
+declare const COMMITMENT_NONCE_SIZE = 32;
+/**
+ * Compute a salted commitment.
+ *
+ * # Description
+ *
+ * Returns `hex(SHA-512("aleutian.commit.v1:" ‖ nonce ‖ SHA-512(content)))`.
+ *
+ * # Inputs
+ *
+ *   - nonce: exactly 32 bytes
+ *   - content: the committed bytes, any length
+ *
+ * # Outputs
+ *
+ *   - string: 128 lowercase hex characters
+ *   - Error: thrown when the nonce is not exactly 32 bytes
+ *
+ * # Example
+ *
+ *   const c = await computeCommitment(nonce, new TextEncoder().encode("consent: yes"));
+ *
+ * # Limitations
+ *
+ *   - Imposes no content size limit; a caller that has one enforces it.
+ *
+ * # Assumptions
+ *
+ *   - WebCrypto (`crypto.subtle`) is available.
+ */
+declare function computeCommitment(nonce: Uint8Array, content: Uint8Array): Promise<string>;
+/**
+ * Check whether a nonce and content open a commitment.
+ *
+ * # Description
+ *
+ * True exactly when the nonce is 32 bytes and the recomputed commitment equals
+ * `commitment` character for character. A nonce of any other length is a
+ * refusal (false), not an error.
+ *
+ * # Inputs
+ *
+ *   - nonce: the disclosed nonce
+ *   - content: the disclosed content
+ *   - commitment: the expected commitment (an entry's `content_hash`)
+ *
+ * # Outputs
+ *
+ *   - boolean: whether the commitment opens
+ *
+ * # Example
+ *
+ *   if (!(await openCommitment(nonce, content, entry.content_hash))) { ... }
+ *
+ * # Limitations
+ *
+ *   - Not constant-time; commitments and disclosures are public values.
+ *
+ * # Assumptions
+ *
+ *   - WebCrypto (`crypto.subtle`) is available.
+ */
+declare function openCommitment(nonce: Uint8Array, content: Uint8Array, commitment: string): Promise<boolean>;
+
+/** The envelope's domain string; a 0x00 byte follows it. */
+declare const RECORD_ENVELOPE_DOMAIN = "aleutian.proof.record.v1";
+/** The eight values a record signature covers, as stored strings. */
+interface RecordEnvelopeFields {
+    /** A sink chain id (sink-format §1). */
+    readonly chainId: string;
+    /** `sink-` and 32 lowercase hex. */
+    readonly entryId: string;
+    /** `sink.event` or `sink.erasure`. */
+    readonly entryType: string;
+    /** Base-10, no sign or leading zeros, 0 ≤ n ≤ 2⁶³−1. */
+    readonly globalSeq: string;
+    /** 128 lowercase hex; empty exactly when `globalSeq` is "0". */
+    readonly previousHash: string;
+    /** `YYYY-MM-DDTHH:MM:SS.ffffffZ`, a real instant, year 0001–9999. */
+    readonly timestamp: string;
+    /** 128 lowercase hex. */
+    readonly contentHash: string;
+    /** The signing key's id: 32 lowercase hex. */
+    readonly signingKeyId: string;
+}
+/**
+ * Whether every value is inside sink-format §9.1's table, so an envelope may
+ * be built from it.
+ */
+declare function isValidRecordEnvelopeFields(f: RecordEnvelopeFields): boolean;
+/**
+ * Build the exact bytes a record signature covers.
+ *
+ * # Description
+ *
+ * Writes the domain, a 0x00 byte, then the eight tagged, length-prefixed
+ * fields in order. Values are the stored strings, never re-formatted.
+ *
+ * # Inputs
+ *
+ *   - fields: the eight envelope values
+ *
+ * # Outputs
+ *
+ *   - Uint8Array: the envelope bytes
+ *   - Error: thrown, with a fixed message that quotes no value, when any value
+ *     is outside sink-format §9.1's table (no envelope may be built)
+ *
+ * # Example
+ *
+ *   const envelope = buildRecordEnvelopeV1({ chainId, entryId, ... });
+ *
+ * # Limitations
+ *
+ *   - Builds bytes only; {@link verifyRecordSignatureV1} checks a signature.
+ *
+ * # Assumptions
+ *
+ *   - None: every value is validated here.
+ */
+declare function buildRecordEnvelopeV1(fields: RecordEnvelopeFields): Uint8Array;
+/**
+ * Verify a pure ML-DSA-65 signature with an EMPTY context.
+ *
+ * # Description
+ *
+ * FIPS 204 pure mode (not HashML-DSA), context of zero bytes, as proof signs
+ * checkpoints (format-spec §9.5) and records (sink-format §9.1). A signature
+ * made with a non-empty context, or with HashML-DSA, does not verify.
+ *
+ * # Inputs
+ *
+ *   - publicKey: raw 1952-byte ML-DSA-65 public key
+ *   - message: the exact signed bytes
+ *   - signature: raw 3309-byte signature
+ *
+ * # Outputs
+ *
+ *   - boolean: true only when the signature verifies. Never throws: a wrong
+ *     size or a library error is false.
+ *
+ * # Example
+ *
+ *   if (!verifyMLDSA65Pure(pk, envelope, sig)) { ... }
+ *
+ * # Limitations
+ *
+ *   - Does not resolve key ids; the caller matches the key to its id.
+ *
+ * # Assumptions
+ *
+ *   - `@noble/post-quantum` 0.5: `verify(sig, msg, publicKey, { context })`
+ *     builds the pure-mode message `0x00 ‖ len(ctx) ‖ ctx ‖ msg`.
+ */
+declare function verifyMLDSA65Pure(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
+/**
+ * Verify a pure ML-DSA-65 signature made with a given FIPS 204 context.
+ *
+ * # Description
+ *
+ * FIPS 204 pure mode (not HashML-DSA) with context `ctx` (0 to 255 bytes):
+ * the signed message is `0x00 ‖ len(ctx) ‖ ctx ‖ message`. A signature made
+ * with any other context, or none, does not verify. proof uses
+ * `aleutian.proof.anchor.v7` for v7 anchors (format-spec §9.5) and
+ * `aleutian.proof.record.v2` for record.v2 signatures (sink-format §9.1).
+ *
+ * # Inputs
+ *
+ *   - publicKey: raw 1952-byte ML-DSA-65 public key
+ *   - message: the exact signed bytes
+ *   - signature: raw 3309-byte signature
+ *   - context: the context bytes (the caller chooses it from the declared
+ *     version, never from the signature)
+ *
+ * # Outputs
+ *
+ *   - boolean: true only when the signature verifies. Never throws.
+ *
+ * # Example
+ *
+ *   verifyMLDSA65PureWithContext(pk, envelope, sig, utf8("aleutian.proof.record.v2"));
+ *
+ * # Limitations
+ *
+ *   - Does not resolve key ids.
+ *
+ * # Assumptions
+ *
+ *   - `@noble/post-quantum` 0.5's `{ context }` option.
+ */
+declare function verifyMLDSA65PureWithContext(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array, context: Uint8Array): boolean;
+/**
+ * Verify a record signature over the `record.v1` envelope of `fields`.
+ *
+ * # Description
+ *
+ * Builds the envelope from the stored values and verifies the signature (pure
+ * ML-DSA-65, empty context). False when no envelope can be built.
+ *
+ * # Inputs
+ *
+ *   - publicKey: raw 1952-byte ML-DSA-65 public key, whose key id the caller
+ *     has checked equals `fields.signingKeyId`
+ *   - fields: the eight envelope values
+ *   - signature: raw 3309-byte signature
+ *
+ * # Outputs
+ *
+ *   - boolean: whether the signature verifies. Never throws.
+ *
+ * # Example
+ *
+ *   const ok = verifyRecordSignatureV1(pk, fields, sig);
+ *
+ * # Limitations
+ *
+ *   - Does not check that `publicKey` has id `fields.signingKeyId`.
+ *
+ * # Assumptions
+ *
+ *   - The caller decided the key is trusted for records.
+ */
+declare function verifyRecordSignatureV1(publicKey: Uint8Array, fields: RecordEnvelopeFields, signature: Uint8Array): boolean;
+/** The record.v2 envelope's domain string; a 0x00 byte follows it. */
+declare const RECORD_ENVELOPE_DOMAIN_V2 = "aleutian.proof.record.v2";
+/**
+ * The ML-DSA context a record.v2 signature is made with (sink-format §9.1).
+ * record.v1 uses the empty context.
+ */
+declare const RECORD_SIGNATURE_CONTEXT_V2 = "aleutian.proof.record.v2";
+/** The nine values a record.v2 signature covers: record.v1's eight and the leaf hash. */
+interface RecordEnvelopeFieldsV2 extends RecordEnvelopeFields {
+    /** The entry's leaf hash (format-spec §2.0): 128 lowercase hex. */
+    readonly leafHash: string;
+}
+/** Whether every value is inside sink-format §9.1's table, leaf hash included. */
+declare function isValidRecordEnvelopeFieldsV2(f: RecordEnvelopeFieldsV2): boolean;
+/**
+ * Build the exact bytes a record.v2 signature covers (sink-format §9.1).
+ *
+ * # Description
+ *
+ * `"aleutian.proof.record.v2" 0x00`, then fields 0x01-0x08 as record.v1
+ * (chain id, entry id, entry type, global seq, previous hash, timestamp,
+ * content hash, signing key id), then 0x09 the leaf hash. Signing the leaf
+ * hash binds the salt, which the content hash alone does not. Values are the
+ * stored strings, never re-formatted.
+ *
+ * # Inputs
+ *
+ *   - fields: the nine envelope values
+ *
+ * # Outputs
+ *
+ *   - Uint8Array: the envelope bytes
+ *   - Error: thrown, with a fixed message, when a value is outside the table
+ *
+ * # Example
+ *
+ *   const envelope = buildRecordEnvelopeV2({ ...fieldsV1, leafHash });
+ *
+ * # Limitations
+ *
+ *   - Builds bytes only; {@link verifyRecordSignatureV2} checks a signature.
+ *
+ * # Assumptions
+ *
+ *   - None: every value is validated here.
+ */
+declare function buildRecordEnvelopeV2(fields: RecordEnvelopeFieldsV2): Uint8Array;
+/**
+ * Verify a record signature over the record.v2 envelope of `fields`.
+ *
+ * # Description
+ *
+ * Builds the v2 envelope and verifies the signature as pure ML-DSA-65 with the
+ * context `aleutian.proof.record.v2`. A record.v1 signature, or one made with
+ * the empty or another context, does not verify. False when no envelope can
+ * be built.
+ *
+ * # Inputs
+ *
+ *   - publicKey: raw 1952-byte ML-DSA-65 public key, whose key id the caller
+ *     has checked equals `fields.signingKeyId`
+ *   - fields: the nine envelope values
+ *   - signature: raw 3309-byte signature
+ *
+ * # Outputs
+ *
+ *   - boolean: whether the signature verifies. Never throws.
+ *
+ * # Example
+ *
+ *   const ok = verifyRecordSignatureV2(pk, fields, sig);
+ *
+ * # Limitations
+ *
+ *   - Does not check that `publicKey` has id `fields.signingKeyId`.
+ *
+ * # Assumptions
+ *
+ *   - The caller decided the key is trusted for records.
+ */
+declare function verifyRecordSignatureV2(publicKey: Uint8Array, fields: RecordEnvelopeFieldsV2, signature: Uint8Array): boolean;
+
+export { ANCHOR_CHAIN_DOMAIN_V2, ANCHOR_CHAIN_DOMAIN_V7, ANCHOR_SIGNATURE_CONTEXT_V7, type Anchor, type AnchorBindExpectations, type AnchorBindOutcome, type AnchorBindResult, type AnchorRange, AnchorVerificationError, type BreakType, CHAIN_HASH_PREFIX, CHAIN_HASH_PREFIX_V4, CHAIN_LEAF_DOMAIN_V4, COMMITMENT_DOMAIN, COMMITMENT_NONCE_SIZE, CONCRETE_SAR_ENTRY_TYPE_TAGS, CONSENT_ENTRY_HASH_PREFIX, CONSENT_RENDERED_HASH_PREFIX, CONSENT_TEXT_HASH_PREFIX, CONTENT_HASH_V3_BYTES, type ChainEntryV3, ChainVerificationError, type ChainVerifyOptions, type ConsentChainEntry, ConsentVerificationError, DOMAIN_PREFIX_V3, DOMAIN_PREFIX_V3_BYTES, EMBEDDED_PUBLIC_KEYS, EXTENDED_SANITY_BOUND_MS, EntriesFormatError, ErrContentHashMismatchV3, ErrInvalidEntryV3, ErrPublicKeyMalformedV3, ErrSignatureInvalidV3, ErrSignatureMalformedV3, ErrUnknownSigningKeyV3, type EventTypeV3, type ExportedEntry, FORMAT_V4, InvalidConsentEntryError, InvalidProcessingMode, KEYID_DOMAIN, MANIFEST_FRESHNESS_MAX_AGE_DAYS, MAX_CANONICAL_BYTES_V3, MAX_V3_STRING_FIELD_BYTES, type MLDSAErrorCode, MLDSAVerificationError, PUBLIC_KEY_SIZE as MLDSA_PUBLIC_KEY_SIZE, MLDSA_PUB_KEY_SIZE, SIGNATURE_SIZE as MLDSA_SIGNATURE_SIZE, type ManifestFreshness, type OfflineBreak, type OfflineVerificationResult, PII_INSPECTION, PROOF_BUNDLE_FORMAT, PROOF_BUNDLE_LIMITS, PROOF_BUNDLE_RESULT_ID, PUBLIC_KEYS_ENDPOINT, type ProcessingModeWire, type ProofBundleChainCounts, type ProofBundleChainResult, type ProofBundleErasureState, type ProofBundleLimits, type ProofBundleProblem, type ProofBundleProblemCode, type ProofBundleReadableResult, type ProofBundleResult, type ProofBundleTrust, type ProofBundleTrustState, type ProofBundleUnreadableReason, type ProofBundleUnreadableResult, type ProofBundleVerdict, ProofBundleVerifierError, ProofKeyFileError, RECORD_ENVELOPE_DOMAIN, RECORD_ENVELOPE_DOMAIN_V2, RECORD_SIGNATURE_CONTEXT_V2, type RecordEnvelopeFields, type RecordEnvelopeFieldsV2, type SARAcknowledgedEntryV3, type SARExtendedEntryV3, type SARFulfilledEntryV3, type SARFulfillmentKindV3, type SARIntentEntryV3, type SARRejectedEntryV3, type SARSourceChannelV3, type SARTypeV3, SEED_ANCHOR_HASH, SEED_ANCHOR_ID, TOMBSTONE_CONTENT_HASH_PREFIX, TOMBSTONE_ENTRY_ID_PREFIX, TOMBSTONE_ENTRY_TYPE, type TenantHMACDigestV3, TrustManifestV3, V3Encoder, V3_SHA512_HEX_LEN, type VerifyChainEntryV3Options, ZK, bindAnchorToEntries, bindAnchorV7ToEntries, buildRecordEnvelopeV1, buildRecordEnvelopeV2, bytesToHex, canonicalizeAnchor, canonicalizeAnchorV7, chainCanonicalV3, checkAnchorWellFormed, computeAnchorChainHash, computeAnchorChainHashV7, computeChainHash, computeChainHashMs, computeChainHashV4, computeCommitment, computeLeafHashV4, computeV3ContentHash, consentCanonical, constantTimeEqual, deriveConsentContentHash, encodeAndHashV3, encodeProcessingModeCanonicalFields, evaluateManifestFreshness, formatTimestampMicro, getPublicKey, hasValidChainEntryTag, hashTemplate, isChainDigest, isChainEntryV3, isChainTimestamp, isKnownKey, isTombstone, isTombstoneContentHash, isValidRecordEnvelopeFields, isValidRecordEnvelopeFieldsV2, keyIdMLDSA65, keyIdXWing, keysTrustedForBothRoles, listKeyIds, manifestGeneratedDate, manifestRevocationNote, manifestVerdictLine, mldsa, mldsa65Spki, openCommitment, parseAnchor, parseAnchorText, parseEntriesText, parseExportedEntries, parseProcessingMode, parseProofPublicKeyFile, tenantHMACDigestFromHex, tenantHMACDigestFromRaw, tenantHMACDigestIsZero, tenantHMACDigestZero, index as tier2, validateEmbeddedKeys, validateTombstoneContentHash, validateV3Entry, verifyAnchorLocally, verifyChainEntryV3, verifyChainOffline, verifyConsentEntry, verifyConsentSignature, verifyMLDSA65Pure, verifyMLDSA65PureWithContext, verifyProofBundle, verifyRecordSignatureV1, verifyRecordSignatureV2 };