@owf/eudi-tl 0.4.0-alpha-20260901082001

package/dist/index.d.cts

@@ -0,0 +1,515 @@
+import { z } from "zod";
+//#region src/constants.d.ts
+/**
+ * Well-known ETSI TS 119 612 URIs.
+ *
+ * These are the standard values used by eIDAS national trusted lists. Profiled
+ * lists may use their own profile-specific URIs (validated via a caller-supplied
+ * {@link ProfileRule}); this library's parser is agnostic to both.
+ */
+/** Standard `TSLType` values (TS 119 612 clause 5.3.3). */
+declare const TSLType: {
+  readonly EUgeneric: "http://uri.etsi.org/TrstSvc/TrustedList/TSLType/EUgeneric";
+  readonly EUlistofthelists: "http://uri.etsi.org/TrstSvc/TrustedList/TSLType/EUlistofthelists";
+};
+/** Standard `ServiceStatus` values (TS 119 612 clause 5.5.4). */
+declare const ServiceStatus: {
+  readonly Granted: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted";
+  readonly Withdrawn: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/withdrawn";
+  readonly UnderSupervision: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/undersupervision";
+  readonly SupervisionCeased: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/supervisionceased";
+  readonly SupervisionInCessation: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/supervisionincessation";
+  readonly Accredited: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/accredited";
+  readonly AccreditationCeased: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/accreditationceased";
+  readonly AccreditationRevoked: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/accreditationrevoked";
+  readonly SetByNationalLaw: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/setbynationallaw";
+  readonly RecognisedAtNationalLevel: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/recognisedatnationallevel";
+  readonly DeprecatedAtNationalLevel: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/deprecatedatnationallevel";
+};
+/**
+ * Service statuses that denote a currently active / trustworthy service under
+ * TS 119 612. Use as the `serviceStatus` filter when extracting trust anchors
+ * from a standard eIDAS list; withdrawn/ceased services are excluded.
+ */
+declare const ACTIVE_SERVICE_STATUSES: string[];
+/** Common standard `ServiceTypeIdentifier` values (TS 119 612 Annex D). */
+declare const ServiceType: {
+  /** Qualified certificate CA. */
+  readonly CA_QC: "http://uri.etsi.org/TrstSvc/Svctype/CA/QC";
+  /** Public key certificate CA. */
+  readonly CA_PKC: "http://uri.etsi.org/TrstSvc/Svctype/CA/PKC";
+  /** Qualified timestamping authority. */
+  readonly TSA_QTST: "http://uri.etsi.org/TrstSvc/Svctype/TSA/QTST";
+  /** Qualified electronic delivery service. */
+  readonly EDS_Q: "http://uri.etsi.org/TrstSvc/Svctype/EDS/Q";
+  /** Qualified registered electronic mail delivery service. */
+  readonly EDS_REM_Q: "http://uri.etsi.org/TrstSvc/Svctype/EDS/REM/Q";
+  /** Qualified preservation service for electronic signatures/seals. */
+  readonly PSES_Q: "http://uri.etsi.org/TrstSvc/Svctype/PSES/Q";
+  /** Qualified validation service for qualified electronic signatures. */
+  readonly QESValidation_Q: "http://uri.etsi.org/TrstSvc/Svctype/QESValidation/Q";
+  /** OCSP responder for qualified certificates. */
+  readonly OCSP_QC: "http://uri.etsi.org/TrstSvc/Svctype/Certstatus/OCSP/QC";
+};
+//#endregion
+//#region src/types.d.ts
+/**
+ * A service's digital identity (TS 119 612 `ServiceDigitalIdentity`): the
+ * `DigitalId` children (X509Certificate, X509SubjectName, X509SKI) that describe
+ * one entity are merged here. A standard list may identify a service by subject
+ * name and/or key identifier without embedding the full certificate.
+ */
+declare const DigitalIdentitySchema: z.ZodObject<{
+  certificate: z.ZodOptional<z.ZodString>;
+  subjectName: z.ZodOptional<z.ZodString>;
+  subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type DigitalIdentity = z.infer<typeof DigitalIdentitySchema>;
+/** A past status entry for a service (`ServiceHistoryInstance`). */
+declare const ServiceHistoryInstanceSchema: z.ZodObject<{
+  serviceTypeIdentifier: z.ZodOptional<z.ZodString>;
+  serviceStatus: z.ZodString;
+  statusStartingTime: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ServiceHistoryInstance = z.infer<typeof ServiceHistoryInstanceSchema>;
+/**
+ * A trust service (TSPService) entry: its type, status, digital identities,
+ * qualifiers, and status history.
+ */
+declare const TrustedListServiceSchema: z.ZodObject<{
+  serviceTypeIdentifier: z.ZodString;
+  serviceStatus: z.ZodString;
+  serviceName: z.ZodOptional<z.ZodString>;
+  digitalIdentities: z.ZodArray<z.ZodObject<{
+    certificate: z.ZodOptional<z.ZodString>;
+    subjectName: z.ZodOptional<z.ZodString>;
+    subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  qualifiers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  history: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    serviceTypeIdentifier: z.ZodOptional<z.ZodString>;
+    serviceStatus: z.ZodString;
+    statusStartingTime: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>>;
+}, z.core.$strip>;
+type TrustedListService = z.infer<typeof TrustedListServiceSchema>;
+/** A Trust Service Provider (TSP) and the services it operates. */
+declare const TrustServiceProviderSchema: z.ZodObject<{
+  name: z.ZodOptional<z.ZodString>;
+  services: z.ZodArray<z.ZodObject<{
+    serviceTypeIdentifier: z.ZodString;
+    serviceStatus: z.ZodString;
+    serviceName: z.ZodOptional<z.ZodString>;
+    digitalIdentities: z.ZodArray<z.ZodObject<{
+      certificate: z.ZodOptional<z.ZodString>;
+      subjectName: z.ZodOptional<z.ZodString>;
+      subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    qualifiers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    history: z.ZodOptional<z.ZodArray<z.ZodObject<{
+      serviceTypeIdentifier: z.ZodOptional<z.ZodString>;
+      serviceStatus: z.ZodString;
+      statusStartingTime: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+type TrustServiceProvider = z.infer<typeof TrustServiceProviderSchema>;
+/** A pointer to another trusted list (`OtherTSLPointer`), e.g. the EU LOTL. */
+declare const TrustedListPointerSchema: z.ZodObject<{
+  location: z.ZodString;
+  tslType: z.ZodOptional<z.ZodString>;
+  schemeTerritory: z.ZodOptional<z.ZodString>;
+  digitalIdentities: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    certificate: z.ZodOptional<z.ZodString>;
+    subjectName: z.ZodOptional<z.ZodString>;
+    subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>>;
+}, z.core.$strip>;
+type TrustedListPointer = z.infer<typeof TrustedListPointerSchema>;
+/** A parsed ETSI TS 119 612 Trusted List (`TrustServiceStatusList`). */
+declare const TrustedListSchema: z.ZodObject<{
+  tslType: z.ZodOptional<z.ZodString>;
+  schemeOperatorName: z.ZodOptional<z.ZodString>;
+  sequenceNumber: z.ZodOptional<z.ZodNumber>;
+  listIssueDateTime: z.ZodOptional<z.ZodString>;
+  nextUpdate: z.ZodOptional<z.ZodString>;
+  providers: z.ZodArray<z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    services: z.ZodArray<z.ZodObject<{
+      serviceTypeIdentifier: z.ZodString;
+      serviceStatus: z.ZodString;
+      serviceName: z.ZodOptional<z.ZodString>;
+      digitalIdentities: z.ZodArray<z.ZodObject<{
+        certificate: z.ZodOptional<z.ZodString>;
+        subjectName: z.ZodOptional<z.ZodString>;
+        subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+      qualifiers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      history: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        serviceTypeIdentifier: z.ZodOptional<z.ZodString>;
+        serviceStatus: z.ZodString;
+        statusStartingTime: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>>;
+  pointersToOtherLists: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    location: z.ZodString;
+    tslType: z.ZodOptional<z.ZodString>;
+    schemeTerritory: z.ZodOptional<z.ZodString>;
+    digitalIdentities: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      certificate: z.ZodOptional<z.ZodString>;
+      subjectName: z.ZodOptional<z.ZodString>;
+      subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+  }, z.core.$strip>>>;
+}, z.core.$strip>;
+type TrustedList = z.infer<typeof TrustedListSchema>;
+/**
+ * A flattened trust anchor: one digital identity with the service context it was
+ * published under. The normalized unit both certificate-chain validation and AKI
+ * emission consume — the ETSI TS 119 612 counterpart of a `@owf/eudi-lote`
+ * TrustedEntity service certificate.
+ */
+declare const TrustAnchorSchema: z.ZodObject<{
+  certificate: z.ZodOptional<z.ZodString>;
+  subjectName: z.ZodOptional<z.ZodString>;
+  subjectKeyIdentifier: z.ZodOptional<z.ZodString>;
+  serviceTypeIdentifier: z.ZodString;
+  serviceStatus: z.ZodString;
+  providerName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type TrustAnchor = z.infer<typeof TrustAnchorSchema>;
+//#endregion
+//#region src/verify.d.ts
+/**
+ * Install the WebCrypto implementation used to verify trusted list signatures
+ * ("bring your own crypto"), for callers that must route verification through a
+ * reviewed or policy-constrained engine. Call it once during start-up, before
+ * verifying; without it, the global Web Crypto API (`globalThis.crypto`,
+ * available in Node >= 20 and browsers) is used.
+ *
+ * Process-wide by necessity, not by design: xadesjs exposes a single global
+ * crypto engine rather than a per-call context
+ * (see {@link https://github.com/PeculiarVentures/xmldsigjs/issues/119}).
+ * A per-invocation option would look isolated while still swapping that global,
+ * so concurrent verifications with different engines would race; it is
+ * deliberately not offered. Should upstream gain per-call crypto, accepting it
+ * as a verification option is an additive, non-breaking change.
+ */
+declare function setTrustedListCrypto(crypto: Crypto): void;
+interface VerifyTrustedListOptions {
+  /**
+   * DER-encoded certificates the trusted list's signer certificate must match.
+   * When provided, verification fails closed unless the embedded signer
+   * certificate equals one of these anchors — establishing that the list was
+   * signed by the expected scheme operator, not merely by *some* key.
+   *
+   * When omitted, only the cryptographic validity of the enveloped signature
+   * is checked; that proves integrity, NOT trust. Production callers should
+   * always pin the scheme operator certificate(s).
+   */
+  trustAnchors?: Uint8Array[];
+}
+interface VerifyTrustedListResult {
+  /** base64-encoded DER of the signer certificate from the signature KeyInfo. */
+  signerCertificateBase64: string;
+}
+/**
+ * Verify the enveloped XAdES/XMLDSig signature of an ETSI TS 119 612 Trusted
+ * List. Throws {@link TrustedListSignatureException} when the signature is
+ * missing, invalid, or (with `trustAnchors`) not signed by a pinned scheme
+ * operator.
+ *
+ * Verified against a standard eIDAS national trusted list (RSA-SHA512,
+ * exclusive C14N, XAdES SignedProperties).
+ *
+ * Verification runs on the global Web Crypto API unless another implementation
+ * was installed with {@link setTrustedListCrypto}.
+ */
+declare function verifyTrustedListSignature(xml: string, options?: VerifyTrustedListOptions): Promise<VerifyTrustedListResult>;
+//#endregion
+//#region src/eu-lotl.d.ts
+/**
+ * The LOTL signing certificates shipped with this package, as DER bytes ready
+ * to pass as `trustAnchors`.
+ *
+ * This pinned set is the root of the eIDAS trusted-list hierarchy and cannot be
+ * bootstrapped from the LOTL itself — a forged list would carry a forged
+ * self-pointer. It is published by the European Commission in the Official
+ * Journal; see {@link EU_LOTL_ANCHORS_PROVENANCE} for the exact act, list issue
+ * and expiry of the shipped set.
+ *
+ * Certificates rotate (historically every 6–24 months), so a deployment has
+ * three ways to stay current without waiting for a release of this package:
+ *
+ * 1. pass its own `trustAnchors`, e.g. from configuration;
+ * 2. after verifying a LOTL, read the currently published set from its own
+ *    self-pointer with `getPointerSigningCertificates(lotl, { tslType:
+ *    TSLType.EUlistofthelists })` and persist it — rotation is announced in a
+ *    list still signed by the previous generation of keys;
+ * 3. follow the pivot LOTLs advertised in the list's `SchemeInformationURI`
+ *    when the pinned set has fallen behind entirely.
+ */
+declare function getEuLotlTrustAnchors(): Uint8Array[];
+/**
+ * Verify the signature of the EU List of Trusted Lists against the shipped
+ * signing certificates. Identical to {@link verifyTrustedListSignature} except
+ * that `trustAnchors` defaults to {@link getEuLotlTrustAnchors} instead of to
+ * "integrity only" — pass your own to override.
+ */
+declare function verifyEuLotlSignature(xml: string, options?: VerifyTrustedListOptions): Promise<VerifyTrustedListResult>;
+/**
+ * Verify, parse and profile-check the EU List of Trusted Lists in one step: the
+ * safe entry point for the top of the hierarchy. The returned list carries the
+ * `PointersToOtherTSL` entries from which national list anchors are derived
+ * with `getPointerSigningCertificates`.
+ */
+declare function loadEuLotl(xml: string, options?: VerifyTrustedListOptions): Promise<TrustedList>;
+//#endregion
+//#region src/eu-lotl-anchors.d.ts
+/**
+ * EU List of Trusted Lists (LOTL) signing certificates — GENERATED by
+ * `scripts/refresh-lotl-anchors.mts`, do not edit by hand.
+ *
+ * These are the certificates the European Commission publishes as the signers
+ * of the LOTL. They are the out-of-band trust anchor of the whole eIDAS trusted
+ * list hierarchy: the set cannot be derived from the LOTL alone (a forged list
+ * would carry a forged self-pointer), so it is pinned here and cross-checked
+ * against the Official Journal publication referenced below.
+ *
+ * Source list: https://ec.europa.eu/tools/lotl/eu-lotl.xml
+ * Official Journal: https://eur-lex.europa.eu/eli/C/2026/1944/oj
+ */
+/** One certificate the European Commission publishes as a LOTL signer. */
+interface EuLotlSigningCertificate {
+  /** base64-encoded DER. */
+  certificate: string;
+  /** Subject distinguished name, for human review of the pinned set. */
+  subject: string;
+  /** Lowercase-hex SHA-256 of the DER, for out-of-band cross-checking. */
+  fingerprintSha256: string;
+  /** Certificate expiry (ISO 8601). */
+  notAfter: string;
+}
+/**
+ * The signing certificates published by the LOTL identified in
+ * {@link EU_LOTL_ANCHORS_PROVENANCE}. Any of them may sign a future issue of the
+ * list, so the whole published set is pinned, not just the current signer.
+ */
+declare const EU_LOTL_SIGNING_CERTIFICATES: readonly EuLotlSigningCertificate[];
+/** Where this set came from, so the pin can be audited without re-running the script. */
+declare const EU_LOTL_ANCHORS_PROVENANCE: {
+  /** The list the certificates were read from. */
+  readonly source: "https://ec.europa.eu/tools/lotl/eu-lotl.xml";
+  /** The Official Journal act the LOTL itself references for its signers. */
+  readonly officialJournal: "https://eur-lex.europa.eu/eli/C/2026/1944/oj";
+  /** `TSLSequenceNumber` of that list. */
+  readonly tslSequenceNumber: 390;
+  /** `ListIssueDateTime` of that list. */
+  readonly listIssueDateTime: "2026-08-03T13:16:38Z";
+  /** Earliest expiry in the set: refresh before this date. */
+  readonly earliestNotAfter: "2027-04-26T12:49:22.000Z";
+};
+//#endregion
+//#region src/parse.d.ts
+/**
+ * Parse an ETSI TS 119 612 `TrustServiceStatusList` XML into a normalized
+ * {@link TrustedList}. This does NOT verify the list signature — call
+ * {@link verifyTrustedListSignature} first (or use {@link loadTrustedList}).
+ */
+declare function parseTrustedList(xml: string): TrustedList;
+/** Selects `PointersToOtherTSL` entries in {@link getPointerSigningCertificates}. */
+interface TrustedListPointerFilter {
+  /** `SchemeTerritory` of the pointed-to list (e.g. `ES`), case-insensitive. */
+  schemeTerritory?: string;
+  /** `TSLType` of the pointed-to list, compared scheme-insensitively. */
+  tslType?: string;
+  /** Exact `TSLLocation` URL of the pointed-to list. */
+  location?: string;
+}
+/**
+ * The DER-encoded certificates a list publishes for the lists it points to —
+ * i.e. the trust anchors with which those lists are signed, ready to be passed
+ * as `trustAnchors` to `verifyTrustedListSignature`.
+ *
+ * This is the mechanism by which a trusted list distributes trust downwards: a
+ * verifier that has established trust in one list (for the EU LOTL, by pinning
+ * its signing certificates out of band) obtains the anchors of every list it
+ * points to without pinning them individually.
+ *
+ * ```ts
+ * const lotl = await loadTrustedList(lotlXml, { trustAnchors: getEuLotlTrustAnchors() })
+ * const esAnchors = getPointerSigningCertificates(lotl, { schemeTerritory: 'ES' })
+ * const esList = await loadTrustedList(esXml, { trustAnchors: esAnchors })
+ * ```
+ *
+ * Passing `{ tslType: TSLType.EUlistofthelists }` returns the LOTL's own
+ * currently published signing certificates (from its self-pointer), which is
+ * how a deployment refreshes its pinned set as the scheme operator rotates keys.
+ */
+declare function getPointerSigningCertificates(trustedList: TrustedList, filter?: TrustedListPointerFilter): Uint8Array[];
+interface TrustAnchorFilter {
+  /**
+   * When set, only include services whose `serviceStatus` is in this list
+   * (e.g. `ACTIVE_SERVICE_STATUSES`). Withdrawn/deprecated services are
+   * excluded.
+   */
+  serviceStatus?: string[];
+  /** When set, only include services whose `serviceTypeIdentifier` matches. */
+  serviceTypeIdentifier?: string[];
+  /**
+   * When true, only include anchors that embed an X.509 certificate (i.e. the
+   * ones usable for certificate-chain validation). Defaults to false, which
+   * also returns SubjectName/SKI-only identities (useful for AKI queries).
+   */
+  requireCertificate?: boolean;
+}
+/**
+ * Flatten a {@link TrustedList} into individual {@link TrustAnchor} entries —
+ * the normalized unit consumed by certificate-chain validation and AKI
+ * emission.
+ */
+declare function getTrustAnchors(trustedList: TrustedList, filter?: TrustAnchorFilter): TrustAnchor[];
+//#endregion
+//#region src/profiles.d.ts
+/**
+ * Ready-made {@link ProfileRule}s for common ETSI ecosystems, so callers don't
+ * have to hand-write the URIs. The engine ({@link validateTrustedListProfile})
+ * stays profile-agnostic; these are just convenience constants you pass into it.
+ *
+ * A profile is an allowlist: the structural schema is checked first, then the
+ * list's `TSLType` must match and every service's type/status must be permitted.
+ * That fits homogeneous, curated lists well (e.g. Age Verification). For a full
+ * eIDAS national list — which legitimately carries withdrawn/ceased services and
+ * a broad mix of qualified service types — {@link euGeneric} therefore permits
+ * all standard ETSI statuses and qualified service types: it asserts "this is a
+ * well-formed EU generic list using standard ETSI URIs", not "only currently
+ * active CAs". Narrow further with your own {@link ProfileRule} when you need to.
+ */
+declare const TrustedListProfiles: {
+  /**
+   * EU List of Trusted Lists (LOTL). Its `TSLType` is `EUlistofthelists` and it
+   * carries pointers to national lists rather than trust-service providers, so
+   * no service type/status is permitted (a conforming LOTL has no TSP services).
+   */
+  euLotl: {
+    name: string;
+    tslType: "http://uri.etsi.org/TrstSvc/TrustedList/TSLType/EUlistofthelists";
+    serviceTypes: never[];
+    serviceStatuses: never[];
+  };
+  /**
+   * A generic EU (eIDAS national) trusted list: `TSLType` `EUgeneric`, any
+   * standard qualified service type, any standard service status (including
+   * withdrawn/ceased entries that national lists retain for history).
+   */
+  euGeneric: {
+    name: string;
+    tslType: "http://uri.etsi.org/TrstSvc/TrustedList/TSLType/EUgeneric";
+    serviceTypes: string[];
+    serviceStatuses: string[];
+  };
+  /**
+   * EU Age Verification trusted list, per the European Commission's "AV Trusted
+   * List Specifications" (DIGIT.B.3). The `TSLType` (clause 5.3.3), the single
+   * Proof of Age Attestation service type (`paa`, clause 5.5.1) and the two
+   * permitted service statuses (clause 5.5.4) are fixed by that specification —
+   * which states the statuses "may be used to the exclusion of any other", so
+   * the allowlist model captures the AV profile exactly. Deployed lists have
+   * used `https` for the `TSLType`; the profile compares scheme-insensitively.
+   */
+  ageVerification: {
+    name: string;
+    tslType: string;
+    serviceTypes: string[];
+    serviceStatuses: string[];
+  };
+};
+//#endregion
+//#region src/trusted-list-exception.d.ts
+/**
+ * Base exception for all trusted-list processing failures.
+ */
+declare class TrustedListException extends Error {
+  readonly cause?: unknown;
+  constructor(message: string, options?: {
+    cause?: unknown;
+  });
+}
+/**
+ * The XML could not be parsed as an ETSI TS 119 612 `TrustServiceStatusList`.
+ */
+declare class TrustedListParseException extends TrustedListException {
+  constructor(message: string, options?: {
+    cause?: unknown;
+  });
+}
+/**
+ * The trusted list's own XAdES/XMLDSig signature is missing, invalid, or does
+ * not match a configured trust anchor. Callers MUST treat this as fail-closed:
+ * a trusted list whose authenticity cannot be established must not be used to
+ * trust credentials.
+ */
+declare class TrustedListSignatureException extends TrustedListException {
+  constructor(message: string, options?: {
+    cause?: unknown;
+  });
+}
+//#endregion
+//#region src/validate.d.ts
+/** A single validation problem, mirroring `@owf/eudi-lote`'s ValidationError. */
+interface ValidationError {
+  path: string;
+  message: string;
+}
+/** Result of a validation, mirroring `@owf/eudi-lote`'s ValidationResult. */
+interface ValidationResult {
+  valid: boolean;
+  errors: ValidationError[];
+}
+/**
+ * Structurally validate an object against the ETSI TS 119 612 trusted-list
+ * schema (the same zod-based approach `@owf/eudi-lote` uses for TS 119 602).
+ * For XML input, parse it first with `parseTrustedList` (XML → object), then
+ * validate the object here.
+ */
+declare function validateTrustedList(value: unknown): ValidationResult;
+/**
+ * Structurally validate and return the typed trusted list, throwing
+ * {@link TrustedListParseException} when it does not conform to the schema.
+ */
+declare function assertValidTrustedList(value: unknown): TrustedList;
+/**
+ * A profile constraint set for a trusted list: the expected `TSLType` and the
+ * service type / status URIs the profile permits. The zod-based structural
+ * schema ({@link validateTrustedList}) is checked first; a profile then narrows
+ * a conforming list to a specific ecosystem. Rules are supplied by the caller,
+ * so the library stays profile-agnostic (mirrors `@owf/eudi-lote`'s approach).
+ */
+interface ProfileRule {
+  /** Optional label used in error messages. */
+  name?: string;
+  /** Expected `TSLType` (compared scheme-insensitively). */
+  tslType: string;
+  /** Service type URIs the profile permits (scheme-insensitive). */
+  serviceTypes: string[];
+  /** Service status URIs the profile permits (scheme-insensitive). */
+  serviceStatuses: string[];
+}
+/**
+ * Validate that a trusted list conforms to one (or any, given several) of the
+ * supplied profile rules — structural schema first, then profile-specific
+ * constraints. Mirrors `@owf/eudi-lote`'s profile validation.
+ */
+declare function validateTrustedListProfile(value: unknown, rule: ProfileRule | ProfileRule[]): ValidationResult;
+//#endregion
+//#region src/index.d.ts
+/**
+ * Verify the trusted list signature and, only if it is valid, parse it. This is
+ * the safe entry point: it never returns a {@link TrustedList} whose
+ * authenticity has not been established.
+ */
+declare function loadTrustedList(xml: string, options?: VerifyTrustedListOptions): Promise<TrustedList>;
+//#endregion
+export { ACTIVE_SERVICE_STATUSES, type DigitalIdentity, DigitalIdentitySchema, EU_LOTL_ANCHORS_PROVENANCE, EU_LOTL_SIGNING_CERTIFICATES, type EuLotlSigningCertificate, type ProfileRule, type ServiceHistoryInstance, ServiceHistoryInstanceSchema, ServiceStatus, ServiceType, TSLType, type TrustAnchor, type TrustAnchorFilter, TrustAnchorSchema, type TrustServiceProvider, TrustServiceProviderSchema, type TrustedList, TrustedListException, TrustedListParseException, type TrustedListPointer, type TrustedListPointerFilter, TrustedListPointerSchema, TrustedListProfiles, TrustedListSchema, type TrustedListService, TrustedListServiceSchema, TrustedListSignatureException, type ValidationError, type ValidationResult, type VerifyTrustedListOptions, type VerifyTrustedListResult, assertValidTrustedList, getEuLotlTrustAnchors, getPointerSigningCertificates, getTrustAnchors, loadEuLotl, loadTrustedList, parseTrustedList, setTrustedListCrypto, validateTrustedList, validateTrustedListProfile, verifyEuLotlSignature, verifyTrustedListSignature };
+//# sourceMappingURL=index.d.cts.map