@thurinlabs/identity-kit 1.4.0 → 2.1.0

package/dist/core.d.ts

@@ -2,7 +2,7 @@ import * as viem from 'viem';
 import { Hex, TypedDataDomain } from 'viem';
 
 interface Attestation {
-    /** Position in the owner's attestation history. */
+    /** Position in the owner's claim history. */
     index: number;
     /** Lowercase hex fingerprint, no 0x (40 chars for v4 keys, 64 for v6). */
     fingerprint: string;
@@ -11,21 +11,28 @@ interface Attestation {
     revoked: boolean;
     /** Unix seconds, or null while active. */
     revokedAt: number | null;
-    /** Format of the clearsigned message (1 = "I control the Ethereum address: <address>"). */
+    /** 'active', 'revoked', or 'replaced' (revoked by a reattest). */
+    state: 'active' | 'revoked' | 'replaced';
+    /** The claim that replaced this one, when `state` is 'replaced'. */
+    replacedBy: number | null;
+    /** The owner's revoke reason: '', 'compromised', 'retired', 'superseded', or 'other'. */
+    revokeReason: string;
+    /** 1 = detached signature over the statement; 0 = a clearsigned message stored as submitted. */
     messageVersion: number;
-    /** The clearsigned message stored on-chain (null only if the payload read failed). */
+    /** The signature as armored text, or the clearsigned message (null only if the read failed). */
     pgpSignature: string | null;
-    /** The armored public key stored on-chain (null only if the payload read failed). */
+    /** The armored public key (null only if the read failed). */
     pgpPublicKey: string | null;
+    /** null when the claim wasn't read: older than `readClaims`' limit. */
     verification: PGPVerification | null;
 }
-/** Why a claim does or doesn't count, in a form a UI can word (see CLAIM_CHECK_LABEL). Since 1.4.0. */
+/** Why a claim does or doesn't count, in a form a UI can word (see CLAIM_CHECK_LABEL). */
 type ClaimCheckKind = 'verified' | 'expired' | 'signing-key-expired' | 'revoked' | 'compromised' | 'signing-key-revoked' | 'unsupported' | 'bad-signature';
 interface PGPVerification {
     verified: boolean;
     /** The underlying library message, for logs; show `kind` to people instead. */
     reason?: string;
-    /** Since 1.4.0. */
+    /** Why a claim doesn't count, or `verified`. */
     kind?: ClaimCheckKind;
     /** ISO date that goes with `kind`: when the key or subkey expired or was revoked. */
     at?: string | null;
@@ -46,11 +53,19 @@ interface PGPKeyInfo {
     expires: string | null;
     notations: Notation[];
     subkeys: SubkeyInfo[];
+    /** A key or subkey that can take encrypted messages is valid now. */
+    canEncrypt: boolean;
 }
 interface SubkeyInfo {
     algorithm: string;
     created: string | null;
     fingerprint: string;
+    /** What its newest binding signature allows. */
+    usage: ('sign' | 'encrypt' | 'auth')[];
+    /** ISO, or null if it doesn't expire. */
+    expires: string | null;
+    /** Usable now: bound, not expired, not revoked. */
+    valid: boolean;
 }
 interface Notation {
     name: string;
@@ -67,139 +82,532 @@ interface Proof {
     castHash?: string;
     domain?: string;
 }
-interface ProofResult {
-    provider: string;
-    label: string;
-    url: string;
-    displayUrl: string;
-    href: string | null;
-    secondaryHref: string | null;
-    status: 'verified' | 'unverified' | 'pending' | 'skipped';
-    reason?: string;
+
+declare function identifyProof(notation: Notation): Proof | null;
+declare function displayUrl(proof: Proof): string;
+declare function proofHref(proof: Proof): string | null;
+declare function proofSecondaryHref(proof: Proof): string | null;
+/**
+ * Farcaster proofs are read from a Farcaster node's HTTP API (`/v1/userNameProofByName`,
+ * `/v1/castsByFid`). The default is Quilibrium's public Hypersnap node, which needs no key and
+ * allows browser requests; it sees the visitor's IP and which account was checked. Point
+ * `farcasterHub` at your own node to avoid that, or pass a Neynar key to use Neynar's hub.
+ */
+declare const FARCASTER_HUB = "https://haatz.quilibrium.com";
+interface ProofOptions {
+    /** A Farcaster node's HTTP API base URL. Default: FARCASTER_HUB (keyless). */
+    farcasterHub?: string;
+    /** Optional: read Farcaster through Neynar's hub with this key instead. */
+    neynarApiKey?: string;
 }
-interface EFPGraph {
-    followers: number;
-    following: number;
-    top8: string[];
-    hasEfp: boolean;
+/** Check one proof against its platform. `options` may also be a Neynar API key. */
+declare function verifyProof(proof: Proof, fingerprint: string, opts?: ProofOptions | string): Promise<PGPVerification>;
+
+/** A key or signature as armored text, raw bytes, or the `0x…` hex a contract call returns. */
+type PgpInput = string | Uint8Array;
+/** The line every claim signs (message version 1). The address is lowercased. */
+declare function statementText(address: string): string;
+declare function parsePgpKey(armoredKey: PgpInput): Promise<PGPKeyInfo | null>;
+/** A clearsigned message against a key, judged as gpg would: claims, and records such as `thurin.canary`. */
+declare function verifyClearsigned({ armoredKey, clearsigned }: {
+    armoredKey: PgpInput;
+    clearsigned: string;
+}): Promise<{
+    verified: boolean;
+    reason?: string;
+    text: string;
+}>;
+/**
+ * A detached signature over the claim statement for `address`, exactly as `printf '%s'` gives it
+ * (no trailing line break): the only form the registry's `clearsigned()` view can show to gpg.
+ */
+declare function verifyStatementSignature({ key, signature, address }: {
+    key: PgpInput;
+    signature: PgpInput;
+    address: string;
+}): Promise<{
+    verified: boolean;
+    reason?: string;
+    text: string;
+}>;
+declare function verifyAttestation({ pgpPublicKey, pgpSignature, fingerprint, ethAddress, }: {
+    pgpPublicKey: PgpInput | null;
+    pgpSignature: PgpInput | null;
+    fingerprint: string;
+    ethAddress: string;
+}): Promise<PGPVerification>;
+interface StrippedKey {
+    /** Armored public key containing only the non-email user IDs. */
+    armored: string;
+    /** The same key as raw bytes. */
+    binary: Uint8Array;
+    /** User IDs kept (no `@`). */
+    kept: string[];
+    /** User IDs removed (contained an `@`). */
+    removed: string[];
 }
-interface ThurinIdentity {
-    address: string | null;
-    ensName: string | null;
-    ensAvatar: string | null;
-    claims: Attestation[];
-    totalClaims: number;
-    activeClaims: number;
-    currentFingerprint: string | null;
-    pgpKeyInfo: PGPKeyInfo | null;
-    proofs: ProofResult[];
-    efp: EFPGraph | null;
-    isLoading: boolean;
-    /** Set when the identity couldn't be shown; the message is plain and safe to display. */
-    error: Error | null;
-    /** Why: the RPC didn't answer, the ENS name has no address, or a registry read failed. */
-    errorKind: 'rpc' | 'not-found' | 'read' | null;
-    /** Re-run the lookups (for a "Try again" button). */
-    retry: () => void;
+/**
+ * The key without its email user IDs; the rest keep their self-certifications and notations.
+ * Null when no user ID would remain: openpgp needs one to verify signatures.
+ */
+declare function stripEmailUserIDs(armoredKey: PgpInput): Promise<StrippedKey | null>;
+/** True when any user ID on the key contains an email address. */
+declare function hasEmailUserID(armoredKey: PgpInput): Promise<boolean>;
+interface LeanKey {
+    /** The key to store, as raw bytes. */
+    binary: Uint8Array;
+    kept: string[];
+    /** Names left out: they contain an email, or a notation on them does. */
+    removed: string[];
+    /** Emails in notations on the key itself (not on a name), which can't be left out: refuse to publish these. */
+    keyNotationEmails: string[];
 }
-type Theme = 'thurin' | 'dark' | 'light';
-interface IdentityKitConfig {
-    rpcUrl?: string;
-    /** Optional: read Farcaster proofs through Neynar's hub with this key. Not needed since 1.3.7. */
-    neynarApiKey?: string;
-    /** A Farcaster node's HTTP API for Farcaster proofs. Default: Quilibrium's public Hypersnap node (keyless). */
-    farcasterHub?: string;
-    baseUrl?: string;
-    /** Which PGPRegistry deployment to read: 'mainnet' (default) or 'sepolia'. */
-    network?: 'mainnet' | 'sepolia' | 'local';
-    /** Override the registry address (e.g. a local deploy that landed elsewhere). */
-    registryAddress?: string;
+/**
+ * The key as a claim stores it, like gpg's export-minimal: raw bytes, the newest self-signature per
+ * user ID and subkey, revocations kept. Email user IDs are left out unless `includeEmail`. Every subkey
+ * stays, authentication (SSH) ones included. Null when no user ID would remain.
+ */
+declare function leanKey(input: PgpInput, { includeEmail }?: {
+    includeEmail?: boolean;
+}): Promise<LeanKey | null>;
+/**
+ * What to store as a claim's signature. A detached signature is stored as its own raw bytes
+ * (message version 1). A clearsigned message is reduced to its signature when that covers the
+ * statement exactly; otherwise (e.g. made with `echo`, which signs a trailing line break) the
+ * whole message is kept as text (version 0), so gpg can still verify what the registry returns.
+ */
+declare function claimSignature({ signature, key, address }: {
+    signature: PgpInput;
+    key: PgpInput;
+    address: string;
+}): Promise<{
+    signature: Uint8Array | string;
+    messageVersion: 0 | 1;
+} | null>;
+/**
+ * The email gpg signed in as the signer's user ID (from `-u me@example.com` or gpg.conf `sender`),
+ * or null. It can't be removed without re-signing; `gpg --disable-signer-uid` leaves it out.
+ */
+declare function signatureEmail(signature: PgpInput): Promise<string | null>;
+/**
+ * A stored key or signature as armored text, for display, copy buttons, and `gpg --import`.
+ * A clearsigned message comes back as stored. Accepts the `0x…` hex a contract call returns.
+ * Null if it isn't OpenPGP data.
+ */
+declare function payloadText(input: PgpInput, kind: 'key' | 'signature'): Promise<string | null>;
+interface SshKey {
+    /** An `authorized_keys` line without a comment: `ssh-ed25519 AAAA…`. */
+    line: string;
+    /** As `ssh-keygen -l` shows it: `SHA256:…`. */
+    sha256: string;
+    /** The PGP key or subkey it came from. */
+    fingerprint: string;
 }
+/**
+ * The key's SSH keys: every authentication key or subkey that is valid now (not expired, not
+ * revoked), in a type OpenSSH accepts. What `gpg --export-ssh-key` prints, but every one, not only
+ * the newest. Empty when there are none.
+ */
+declare function sshKeys(input: PgpInput): Promise<SshKey[]>;
 
-declare const REGISTRY_ABI: readonly [{
-    readonly type: "function";
-    readonly name: "ATTEST_TYPEHASH";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [{
-        readonly name: "";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
+/** Normalize a fingerprint to lowercase hex with no prefix or spaces. Returns null if malformed. */
+declare function normalizeFingerprint(input: string): string | null;
+/** Same key, whatever the case, spacing, or 0x of either side. Malformed input never matches. */
+declare function sameFingerprint(a: string | null | undefined, b: string | null | undefined): boolean;
+/** Fingerprint → the raw `bytes` argument the registry takes (0x-prefixed, 20 or 32 bytes). */
+declare function fingerprintToBytes(fingerprint: string): Hex;
+/** Raw `bytes` from the registry → lowercase hex fingerprint without 0x. */
+declare function bytesToFingerprint(bytes: Hex | string): string;
+/** keccak256 of the raw fingerprint bytes: the `fingerprintHash` the registry indexes by. */
+declare function fingerprintHash(fingerprint: string): Hex;
+/**
+ * The long key ID as the registry's `bytes8`: the last 8 bytes of a v4 fingerprint, the first 8 of
+ * a v6 (RFC 9580 §5.5.4), as `gpg --keyid-format long` prints.
+ */
+declare function keyIdOf(fingerprint: string): Hex;
+/** A 16-hex long key ID (spaces/0x tolerated) → `bytes8`. */
+declare function keyIdToBytes(keyId: string): Hex | null;
+
+/**
+ * EIP-712 permissions for the registry's relayed writes (`attestFor`, `reattestFor`,
+ * `updateKeyFor`, `revokeFor`, `setRecordFor`, `markCompromisedFor`). The owner signs one; anyone can submit the
+ * matching call and pay the gas. Every field is bound, plus the owner's `nonces(owner)` and a
+ * `deadline`. The domain includes the chain id, so a permission can't be replayed on another network.
+ */
+declare const EIP712_NAME = "Thurin PGPRegistry";
+declare const EIP712_VERSION = "3";
+declare function registryDomain(chainId: number, verifyingContract: Hex): TypedDataDomain;
+declare const AUTHORIZATION_TYPES: {
+    readonly Attest: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+    }, {
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+    }, {
+        readonly name: "signature";
+        readonly type: "bytes";
+    }, {
+        readonly name: "key";
+        readonly type: "bytes";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "deadline";
+        readonly type: "uint256";
     }];
-    readonly stateMutability: "view";
-}, {
-    readonly type: "function";
-    readonly name: "DOMAIN_SEPARATOR";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [{
-        readonly name: "";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
+    readonly Reattest: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+    }, {
+        readonly name: "revokeIndex";
+        readonly type: "uint256";
+    }, {
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+    }, {
+        readonly name: "signature";
+        readonly type: "bytes";
+    }, {
+        readonly name: "key";
+        readonly type: "bytes";
+    }, {
+        readonly name: "keepRecords";
+        readonly type: "bool";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "deadline";
+        readonly type: "uint256";
     }];
-    readonly stateMutability: "view";
-}, {
-    readonly type: "function";
-    readonly name: "EIP712_NAME";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [{
-        readonly name: "";
-        readonly type: "string";
-        readonly internalType: "string";
+    readonly UpdateKey: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+    }, {
+        readonly name: "index";
+        readonly type: "uint256";
+    }, {
+        readonly name: "key";
+        readonly type: "bytes";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "deadline";
+        readonly type: "uint256";
     }];
-    readonly stateMutability: "view";
-}, {
-    readonly type: "function";
-    readonly name: "EIP712_VERSION";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [{
-        readonly name: "";
+    readonly Revoke: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+    }, {
+        readonly name: "index";
+        readonly type: "uint256";
+    }, {
+        readonly name: "reason";
         readonly type: "string";
-        readonly internalType: "string";
-    }];
-    readonly stateMutability: "view";
-}, {
-    readonly type: "function";
-    readonly name: "MAX_KEY_BYTES";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [{
-        readonly name: "";
+    }, {
+        readonly name: "nonce";
         readonly type: "uint256";
-        readonly internalType: "uint256";
-    }];
-    readonly stateMutability: "view";
-}, {
-    readonly type: "function";
-    readonly name: "MAX_RECORD_BYTES";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [{
-        readonly name: "";
+    }, {
+        readonly name: "deadline";
         readonly type: "uint256";
-        readonly internalType: "uint256";
     }];
-    readonly stateMutability: "view";
-}, {
-    readonly type: "function";
-    readonly name: "MAX_SIG_BYTES";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [{
-        readonly name: "";
+    readonly SetRecord: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+    }, {
+        readonly name: "index";
+        readonly type: "uint256";
+    }, {
+        readonly name: "kind";
+        readonly type: "string";
+    }, {
+        readonly name: "value";
+        readonly type: "string";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "deadline";
         readonly type: "uint256";
-        readonly internalType: "uint256";
     }];
-    readonly stateMutability: "view";
-}, {
-    readonly type: "function";
-    readonly name: "MESSAGE_VERSION";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [{
-        readonly name: "";
-        readonly type: "uint8";
-        readonly internalType: "uint8";
+    readonly MarkCompromised: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+    }, {
+        readonly name: "index";
+        readonly type: "uint256";
+    }, {
+        readonly name: "nonce";
+        readonly type: "uint256";
+    }, {
+        readonly name: "deadline";
+        readonly type: "uint256";
     }];
-    readonly stateMutability: "view";
-}, {
-    readonly type: "function";
-    readonly name: "REATTEST_TYPEHASH";
-    readonly inputs: readonly [];
+};
+type AuthorizationAction = keyof typeof AUTHORIZATION_TYPES;
+/** Every revoke reason a claim can show ('' = none given). "superseded" is set only by reattest. */
+declare const REVOKE_REASONS: readonly ["", "compromised", "retired", "superseded", "other"];
+type RevokeReason = (typeof REVOKE_REASONS)[number];
+/** The reasons an owner can give to `revoke`. "compromised" is final: that address can never claim the key again. */
+declare const OWNER_REVOKE_REASONS: readonly ["", "compromised", "retired", "other"];
+interface Common {
+    owner: Hex;
+    nonce: bigint;
+    deadline: bigint;
+}
+/** `signature` and `key` are the raw bytes as `0x…` hex (or a clearsigned message as text). */
+type AttestAuthorization = Common & {
+    fingerprint: string;
+    signature: string;
+    key: string;
+};
+type ReattestAuthorization = AttestAuthorization & {
+    revokeIndex: bigint;
+    keepRecords: boolean;
+};
+type UpdateKeyAuthorization = Common & {
+    index: bigint;
+    key: string;
+};
+type RevokeAuthorization = Common & {
+    index: bigint;
+    reason?: RevokeReason;
+};
+/** `kind` exactly as it will be submitted (the registry adds `thurin.` to undotted names itself). */
+type SetRecordAuthorization = Common & {
+    index: bigint;
+    kind: string;
+    value: string;
+};
+/** Mark an already revoked or replaced claim compromised (`markCompromisedFor`). A Revoke permission never can. */
+type MarkCompromisedAuthorization = Common & {
+    index: bigint;
+};
+/** The object to pass to viem/wagmi `signTypedData`. */
+declare function attestTypedData(chainId: number, registry: Hex, a: AttestAuthorization): {
+    domain: TypedDataDomain;
+    types: {
+        Attest: readonly [{
+            readonly name: "owner";
+            readonly type: "address";
+        }, {
+            readonly name: "fingerprint";
+            readonly type: "bytes";
+        }, {
+            readonly name: "signature";
+            readonly type: "bytes";
+        }, {
+            readonly name: "key";
+            readonly type: "bytes";
+        }, {
+            readonly name: "nonce";
+            readonly type: "uint256";
+        }, {
+            readonly name: "deadline";
+            readonly type: "uint256";
+        }];
+    };
+    primaryType: "Attest";
+    message: {
+        owner: `0x${string}`;
+        fingerprint: `0x${string}`;
+        signature: `0x${string}`;
+        key: `0x${string}`;
+        nonce: bigint;
+        deadline: bigint;
+    };
+};
+declare function reattestTypedData(chainId: number, registry: Hex, a: ReattestAuthorization): {
+    domain: TypedDataDomain;
+    types: {
+        Reattest: readonly [{
+            readonly name: "owner";
+            readonly type: "address";
+        }, {
+            readonly name: "revokeIndex";
+            readonly type: "uint256";
+        }, {
+            readonly name: "fingerprint";
+            readonly type: "bytes";
+        }, {
+            readonly name: "signature";
+            readonly type: "bytes";
+        }, {
+            readonly name: "key";
+            readonly type: "bytes";
+        }, {
+            readonly name: "keepRecords";
+            readonly type: "bool";
+        }, {
+            readonly name: "nonce";
+            readonly type: "uint256";
+        }, {
+            readonly name: "deadline";
+            readonly type: "uint256";
+        }];
+    };
+    primaryType: "Reattest";
+    message: {
+        owner: `0x${string}`;
+        revokeIndex: bigint;
+        fingerprint: `0x${string}`;
+        signature: `0x${string}`;
+        key: `0x${string}`;
+        keepRecords: boolean;
+        nonce: bigint;
+        deadline: bigint;
+    };
+};
+declare function updateKeyTypedData(chainId: number, registry: Hex, a: UpdateKeyAuthorization): {
+    domain: TypedDataDomain;
+    types: {
+        UpdateKey: readonly [{
+            readonly name: "owner";
+            readonly type: "address";
+        }, {
+            readonly name: "index";
+            readonly type: "uint256";
+        }, {
+            readonly name: "key";
+            readonly type: "bytes";
+        }, {
+            readonly name: "nonce";
+            readonly type: "uint256";
+        }, {
+            readonly name: "deadline";
+            readonly type: "uint256";
+        }];
+    };
+    primaryType: "UpdateKey";
+    message: {
+        owner: `0x${string}`;
+        index: bigint;
+        key: `0x${string}`;
+        nonce: bigint;
+        deadline: bigint;
+    };
+};
+declare function revokeTypedData(chainId: number, registry: Hex, a: RevokeAuthorization): {
+    domain: TypedDataDomain;
+    types: {
+        Revoke: readonly [{
+            readonly name: "owner";
+            readonly type: "address";
+        }, {
+            readonly name: "index";
+            readonly type: "uint256";
+        }, {
+            readonly name: "reason";
+            readonly type: "string";
+        }, {
+            readonly name: "nonce";
+            readonly type: "uint256";
+        }, {
+            readonly name: "deadline";
+            readonly type: "uint256";
+        }];
+    };
+    primaryType: "Revoke";
+    message: {
+        owner: `0x${string}`;
+        index: bigint;
+        reason: "" | "compromised" | "retired" | "superseded" | "other";
+        nonce: bigint;
+        deadline: bigint;
+    };
+};
+declare function setRecordTypedData(chainId: number, registry: Hex, a: SetRecordAuthorization): {
+    domain: TypedDataDomain;
+    types: {
+        SetRecord: readonly [{
+            readonly name: "owner";
+            readonly type: "address";
+        }, {
+            readonly name: "index";
+            readonly type: "uint256";
+        }, {
+            readonly name: "kind";
+            readonly type: "string";
+        }, {
+            readonly name: "value";
+            readonly type: "string";
+        }, {
+            readonly name: "nonce";
+            readonly type: "uint256";
+        }, {
+            readonly name: "deadline";
+            readonly type: "uint256";
+        }];
+    };
+    primaryType: "SetRecord";
+    message: {
+        owner: `0x${string}`;
+        index: bigint;
+        kind: string;
+        value: string;
+        nonce: bigint;
+        deadline: bigint;
+    };
+};
+declare function markCompromisedTypedData(chainId: number, registry: Hex, a: MarkCompromisedAuthorization): {
+    domain: TypedDataDomain;
+    types: {
+        MarkCompromised: readonly [{
+            readonly name: "owner";
+            readonly type: "address";
+        }, {
+            readonly name: "index";
+            readonly type: "uint256";
+        }, {
+            readonly name: "nonce";
+            readonly type: "uint256";
+        }, {
+            readonly name: "deadline";
+            readonly type: "uint256";
+        }];
+    };
+    primaryType: "MarkCompromised";
+    message: {
+        owner: `0x${string}`;
+        index: bigint;
+        nonce: bigint;
+        deadline: bigint;
+    };
+};
+/** The digest the registry recovers the signer from. */
+declare function authorizationDigest(typedData: ReturnType<typeof attestTypedData | typeof reattestTypedData | typeof updateKeyTypedData | typeof revokeTypedData | typeof setRecordTypedData | typeof markCompromisedTypedData>): Hex;
+/** Any client with viem's `getCode` and `readContract` (a viem PublicClient, or a stub in tests). */
+interface PermissionReader {
+    getCode(args: {
+        address: Hex;
+    }): Promise<Hex | undefined>;
+    readContract(args: any): Promise<unknown>;
+}
+type PermissionCheck = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+    signer?: Hex;
+};
+/**
+ * Is `signature` a permission from `owner`? Judged the way the registry judges it: a plain signature
+ * from the owner's key (any address, EIP-7702 accounts included), else, for an account with code (a
+ * Safe, a smart-account wallet), the account's own answer (EIP-1271). An ERC-6492 signature (from an
+ * account not on-chain yet) is refused with the reason: the registry asks the deployed account.
+ * `signer` is set when a plain signature came from someone else.
+ */
+declare function permissionSigned(client: PermissionReader, typedData: Parameters<typeof authorizationDigest>[0], signature: Hex, owner: Hex): Promise<PermissionCheck>;
+/** The hash the registry indexes a record name by (the `kindHash` in `RecordSet` events). */
+declare function recordKind(name: string): Hex;
+
+declare const REGISTRY_ABI: readonly [{
+    readonly type: "function";
+    readonly name: "ATTEST_TYPEHASH";
+    readonly inputs: readonly [];
     readonly outputs: readonly [{
         readonly name: "";
         readonly type: "bytes32";
@@ -208,7 +616,7 @@ declare const REGISTRY_ABI: readonly [{
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "REVOKE_TYPEHASH";
+    readonly name: "DOMAIN_SEPARATOR";
     readonly inputs: readonly [];
     readonly outputs: readonly [{
         readonly name: "";
@@ -218,56 +626,68 @@ declare const REGISTRY_ABI: readonly [{
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "SET_RECORD_TYPEHASH";
+    readonly name: "EIP712_NAME";
     readonly inputs: readonly [];
     readonly outputs: readonly [{
         readonly name: "";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
+        readonly type: "string";
+        readonly internalType: "string";
     }];
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "UPDATE_KEY_TYPEHASH";
+    readonly name: "EIP712_VERSION";
     readonly inputs: readonly [];
     readonly outputs: readonly [{
         readonly name: "";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
+        readonly type: "string";
+        readonly internalType: "string";
     }];
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "VERSION";
+    readonly name: "EPOCH";
     readonly inputs: readonly [];
     readonly outputs: readonly [{
         readonly name: "";
-        readonly type: "uint8";
-        readonly internalType: "uint8";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
     }];
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "addressesFor";
-    readonly inputs: readonly [{
-        readonly name: "fingerprintHash";
+    readonly name: "MARK_COMPROMISED_TYPEHASH";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
         readonly type: "bytes32";
         readonly internalType: "bytes32";
     }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "MAX_CLAIMS_PER_OWNER";
+    readonly inputs: readonly [];
     readonly outputs: readonly [{
         readonly name: "";
-        readonly type: "address[]";
-        readonly internalType: "address[]";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
     }];
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "addressesForCount";
-    readonly inputs: readonly [{
-        readonly name: "fingerprintHash";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
+    readonly name: "MAX_KEY_BYTES";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
     }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "MAX_KIND_BYTES";
+    readonly inputs: readonly [];
     readonly outputs: readonly [{
         readonly name: "";
         readonly type: "uint256";
@@ -276,24 +696,134 @@ declare const REGISTRY_ABI: readonly [{
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "addressesForRange";
-    readonly inputs: readonly [{
-        readonly name: "fingerprintHash";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
-    }, {
-        readonly name: "start";
+    readonly name: "MAX_PAYLOAD_BYTES";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "MAX_RECORD_BYTES";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "MAX_SIGNATURE_BYTES";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
         readonly type: "uint256";
         readonly internalType: "uint256";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "MESSAGE_CLEARSIGNED";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint8";
+        readonly internalType: "uint8";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "MESSAGE_DETACHED";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint8";
+        readonly internalType: "uint8";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "REATTEST_TYPEHASH";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bytes32";
+        readonly internalType: "bytes32";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "REVOKE_TYPEHASH";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bytes32";
+        readonly internalType: "bytes32";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "SET_RECORD_TYPEHASH";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bytes32";
+        readonly internalType: "bytes32";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "UPDATE_KEY_TYPEHASH";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bytes32";
+        readonly internalType: "bytes32";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "VERSION";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint8";
+        readonly internalType: "uint8";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "armorToBytes";
+    readonly inputs: readonly [{
+        readonly name: "armored";
+        readonly type: "string";
+        readonly internalType: "string";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
+    readonly stateMutability: "pure";
+}, {
+    readonly type: "function";
+    readonly name: "armoredKey";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly internalType: "address";
     }, {
-        readonly name: "count";
+        readonly name: "index";
         readonly type: "uint256";
         readonly internalType: "uint256";
     }];
     readonly outputs: readonly [{
-        readonly name: "out";
-        readonly type: "address[]";
-        readonly internalType: "address[]";
+        readonly name: "";
+        readonly type: "string";
+        readonly internalType: "string";
     }];
     readonly stateMutability: "view";
 }, {
@@ -304,11 +834,11 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
-        readonly name: "pgpSignature";
+        readonly name: "signature";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
-        readonly name: "pgpPublicKey";
+        readonly name: "key";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }];
@@ -330,11 +860,11 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
-        readonly name: "pgpSignature";
+        readonly name: "signature";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
-        readonly name: "pgpPublicKey";
+        readonly name: "key";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
@@ -342,7 +872,7 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "uint256";
         readonly internalType: "uint256";
     }, {
-        readonly name: "signature";
+        readonly name: "permission";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }];
@@ -354,7 +884,76 @@ declare const REGISTRY_ABI: readonly [{
     readonly stateMutability: "nonpayable";
 }, {
     readonly type: "function";
-    readonly name: "attestationCount";
+    readonly name: "cancelAuthorization";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+}, {
+    readonly type: "function";
+    readonly name: "claim";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly internalType: "address";
+    }, {
+        readonly name: "index";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "details";
+        readonly type: "tuple";
+        readonly internalType: "struct PGPRegistry.ClaimView";
+        readonly components: readonly [{
+            readonly name: "index";
+            readonly type: "uint256";
+            readonly internalType: "uint256";
+        }, {
+            readonly name: "fingerprint";
+            readonly type: "bytes";
+            readonly internalType: "bytes";
+        }, {
+            readonly name: "createdAt";
+            readonly type: "uint64";
+            readonly internalType: "uint64";
+        }, {
+            readonly name: "revokedAt";
+            readonly type: "uint64";
+            readonly internalType: "uint64";
+        }, {
+            readonly name: "state";
+            readonly type: "string";
+            readonly internalType: "string";
+        }, {
+            readonly name: "replacedBy";
+            readonly type: "uint256";
+            readonly internalType: "uint256";
+        }, {
+            readonly name: "revokeReason";
+            readonly type: "string";
+            readonly internalType: "string";
+        }, {
+            readonly name: "messageVersion";
+            readonly type: "uint8";
+            readonly internalType: "uint8";
+        }];
+    }, {
+        readonly name: "key";
+        readonly type: "string";
+        readonly internalType: "string";
+    }, {
+        readonly name: "statement";
+        readonly type: "string";
+        readonly internalType: "string";
+    }, {
+        readonly name: "recordKinds";
+        readonly type: "string[]";
+        readonly internalType: "string[]";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "claimCount";
     readonly inputs: readonly [{
         readonly name: "owner";
         readonly type: "address";
@@ -368,17 +967,21 @@ declare const REGISTRY_ABI: readonly [{
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "attestationsOf";
+    readonly name: "claimsOf";
     readonly inputs: readonly [{
         readonly name: "owner";
         readonly type: "address";
         readonly internalType: "address";
     }];
     readonly outputs: readonly [{
-        readonly name: "";
+        readonly name: "out";
         readonly type: "tuple[]";
-        readonly internalType: "struct PGPRegistry.Attestation[]";
+        readonly internalType: "struct PGPRegistry.ClaimView[]";
         readonly components: readonly [{
+            readonly name: "index";
+            readonly type: "uint256";
+            readonly internalType: "uint256";
+        }, {
             readonly name: "fingerprint";
             readonly type: "bytes";
             readonly internalType: "bytes";
@@ -390,24 +993,28 @@ declare const REGISTRY_ABI: readonly [{
             readonly name: "revokedAt";
             readonly type: "uint64";
             readonly internalType: "uint64";
+        }, {
+            readonly name: "state";
+            readonly type: "string";
+            readonly internalType: "string";
+        }, {
+            readonly name: "replacedBy";
+            readonly type: "uint256";
+            readonly internalType: "uint256";
+        }, {
+            readonly name: "revokeReason";
+            readonly type: "string";
+            readonly internalType: "string";
         }, {
             readonly name: "messageVersion";
             readonly type: "uint8";
             readonly internalType: "uint8";
-        }, {
-            readonly name: "keyPtr";
-            readonly type: "address";
-            readonly internalType: "address";
-        }, {
-            readonly name: "sigPtr";
-            readonly type: "address";
-            readonly internalType: "address";
         }];
     }];
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "attestationsOfRange";
+    readonly name: "claimsOfRange";
     readonly inputs: readonly [{
         readonly name: "owner";
         readonly type: "address";
@@ -424,8 +1031,12 @@ declare const REGISTRY_ABI: readonly [{
     readonly outputs: readonly [{
         readonly name: "out";
         readonly type: "tuple[]";
-        readonly internalType: "struct PGPRegistry.Attestation[]";
+        readonly internalType: "struct PGPRegistry.ClaimView[]";
         readonly components: readonly [{
+            readonly name: "index";
+            readonly type: "uint256";
+            readonly internalType: "uint256";
+        }, {
             readonly name: "fingerprint";
             readonly type: "bytes";
             readonly internalType: "bytes";
@@ -437,27 +1048,43 @@ declare const REGISTRY_ABI: readonly [{
             readonly name: "revokedAt";
             readonly type: "uint64";
             readonly internalType: "uint64";
+        }, {
+            readonly name: "state";
+            readonly type: "string";
+            readonly internalType: "string";
+        }, {
+            readonly name: "replacedBy";
+            readonly type: "uint256";
+            readonly internalType: "uint256";
+        }, {
+            readonly name: "revokeReason";
+            readonly type: "string";
+            readonly internalType: "string";
         }, {
             readonly name: "messageVersion";
             readonly type: "uint8";
             readonly internalType: "uint8";
-        }, {
-            readonly name: "keyPtr";
-            readonly type: "address";
-            readonly internalType: "address";
-        }, {
-            readonly name: "sigPtr";
-            readonly type: "address";
-            readonly internalType: "address";
         }];
     }];
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "cancelAuthorization";
-    readonly inputs: readonly [];
-    readonly outputs: readonly [];
-    readonly stateMutability: "nonpayable";
+    readonly name: "clearsigned";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly internalType: "address";
+    }, {
+        readonly name: "index";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "string";
+        readonly internalType: "string";
+    }];
+    readonly stateMutability: "view";
 }, {
     readonly type: "function";
     readonly name: "current";
@@ -475,10 +1102,14 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "uint256";
         readonly internalType: "uint256";
     }, {
-        readonly name: "attestation";
+        readonly name: "details";
         readonly type: "tuple";
-        readonly internalType: "struct PGPRegistry.Attestation";
+        readonly internalType: "struct PGPRegistry.ClaimView";
         readonly components: readonly [{
+            readonly name: "index";
+            readonly type: "uint256";
+            readonly internalType: "uint256";
+        }, {
             readonly name: "fingerprint";
             readonly type: "bytes";
             readonly internalType: "bytes";
@@ -490,36 +1121,74 @@ declare const REGISTRY_ABI: readonly [{
             readonly name: "revokedAt";
             readonly type: "uint64";
             readonly internalType: "uint64";
+        }, {
+            readonly name: "state";
+            readonly type: "string";
+            readonly internalType: "string";
+        }, {
+            readonly name: "replacedBy";
+            readonly type: "uint256";
+            readonly internalType: "uint256";
+        }, {
+            readonly name: "revokeReason";
+            readonly type: "string";
+            readonly internalType: "string";
         }, {
             readonly name: "messageVersion";
             readonly type: "uint8";
             readonly internalType: "uint8";
-        }, {
-            readonly name: "keyPtr";
-            readonly type: "address";
-            readonly internalType: "address";
-        }, {
-            readonly name: "sigPtr";
-            readonly type: "address";
-            readonly internalType: "address";
         }];
     }];
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "fingerprintsForKeyId";
-    readonly inputs: readonly [{
-        readonly name: "keyId";
-        readonly type: "bytes8";
-        readonly internalType: "bytes8";
-    }];
+    readonly name: "eip712Domain";
+    readonly inputs: readonly [];
     readonly outputs: readonly [{
-        readonly name: "";
-        readonly type: "bytes[]";
-        readonly internalType: "bytes[]";
-    }];
-    readonly stateMutability: "view";
-}, {
+        readonly name: "fields";
+        readonly type: "bytes1";
+        readonly internalType: "bytes1";
+    }, {
+        readonly name: "name";
+        readonly type: "string";
+        readonly internalType: "string";
+    }, {
+        readonly name: "version";
+        readonly type: "string";
+        readonly internalType: "string";
+    }, {
+        readonly name: "chainId";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "verifyingContract";
+        readonly type: "address";
+        readonly internalType: "address";
+    }, {
+        readonly name: "salt";
+        readonly type: "bytes32";
+        readonly internalType: "bytes32";
+    }, {
+        readonly name: "extensions";
+        readonly type: "uint256[]";
+        readonly internalType: "uint256[]";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "fingerprintsForKeyId";
+    readonly inputs: readonly [{
+        readonly name: "keyId";
+        readonly type: "bytes8";
+        readonly internalType: "bytes8";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "bytes[]";
+        readonly internalType: "bytes[]";
+    }];
+    readonly stateMutability: "view";
+}, {
     readonly type: "function";
     readonly name: "fingerprintsForKeyIdCount";
     readonly inputs: readonly [{
@@ -557,7 +1226,7 @@ declare const REGISTRY_ABI: readonly [{
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "getAttestation";
+    readonly name: "keyBytes";
     readonly inputs: readonly [{
         readonly name: "owner";
         readonly type: "address";
@@ -567,40 +1236,33 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "uint256";
         readonly internalType: "uint256";
     }];
+    readonly outputs: readonly [{
+        readonly name: "key";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "keyStatus";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly internalType: "address";
+    }, {
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
     readonly outputs: readonly [{
         readonly name: "";
-        readonly type: "tuple";
-        readonly internalType: "struct PGPRegistry.Attestation";
-        readonly components: readonly [{
-            readonly name: "fingerprint";
-            readonly type: "bytes";
-            readonly internalType: "bytes";
-        }, {
-            readonly name: "createdAt";
-            readonly type: "uint64";
-            readonly internalType: "uint64";
-        }, {
-            readonly name: "revokedAt";
-            readonly type: "uint64";
-            readonly internalType: "uint64";
-        }, {
-            readonly name: "messageVersion";
-            readonly type: "uint8";
-            readonly internalType: "uint8";
-        }, {
-            readonly name: "keyPtr";
-            readonly type: "address";
-            readonly internalType: "address";
-        }, {
-            readonly name: "sigPtr";
-            readonly type: "address";
-            readonly internalType: "address";
-        }];
+        readonly type: "string";
+        readonly internalType: "string";
     }];
     readonly stateMutability: "view";
 }, {
     readonly type: "function";
-    readonly name: "getPayload";
+    readonly name: "markCompromisedFor";
     readonly inputs: readonly [{
         readonly name: "owner";
         readonly type: "address";
@@ -609,22 +1271,36 @@ declare const REGISTRY_ABI: readonly [{
         readonly name: "index";
         readonly type: "uint256";
         readonly internalType: "uint256";
-    }];
-    readonly outputs: readonly [{
-        readonly name: "pgpSignature";
-        readonly type: "bytes";
-        readonly internalType: "bytes";
     }, {
-        readonly name: "pgpPublicKey";
+        readonly name: "deadline";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "permission";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }];
-    readonly stateMutability: "view";
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+}, {
+    readonly type: "function";
+    readonly name: "multicall";
+    readonly inputs: readonly [{
+        readonly name: "calls";
+        readonly type: "bytes[]";
+        readonly internalType: "bytes[]";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "results";
+        readonly type: "bytes[]";
+        readonly internalType: "bytes[]";
+    }];
+    readonly stateMutability: "nonpayable";
 }, {
     readonly type: "function";
     readonly name: "nonces";
     readonly inputs: readonly [{
-        readonly name: "";
+        readonly name: "owner";
         readonly type: "address";
         readonly internalType: "address";
     }];
@@ -634,6 +1310,56 @@ declare const REGISTRY_ABI: readonly [{
         readonly internalType: "uint256";
     }];
     readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "ownersOf";
+    readonly inputs: readonly [{
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "address[]";
+        readonly internalType: "address[]";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "ownersOfCount";
+    readonly inputs: readonly [{
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "ownersOfRange";
+    readonly inputs: readonly [{
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }, {
+        readonly name: "start";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "count";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "out";
+        readonly type: "address[]";
+        readonly internalType: "address[]";
+    }];
+    readonly stateMutability: "view";
 }, {
     readonly type: "function";
     readonly name: "reattest";
@@ -646,13 +1372,17 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
-        readonly name: "pgpSignature";
+        readonly name: "signature";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
-        readonly name: "pgpPublicKey";
+        readonly name: "key";
         readonly type: "bytes";
         readonly internalType: "bytes";
+    }, {
+        readonly name: "keepRecords";
+        readonly type: "bool";
+        readonly internalType: "bool";
     }];
     readonly outputs: readonly [{
         readonly name: "index";
@@ -676,19 +1406,23 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
-        readonly name: "pgpSignature";
+        readonly name: "signature";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
-        readonly name: "pgpPublicKey";
+        readonly name: "key";
         readonly type: "bytes";
         readonly internalType: "bytes";
+    }, {
+        readonly name: "keepRecords";
+        readonly type: "bool";
+        readonly internalType: "bool";
     }, {
         readonly name: "deadline";
         readonly type: "uint256";
         readonly internalType: "uint256";
     }, {
-        readonly name: "signature";
+        readonly name: "permission";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }];
@@ -700,7 +1434,7 @@ declare const REGISTRY_ABI: readonly [{
     readonly stateMutability: "nonpayable";
 }, {
     readonly type: "function";
-    readonly name: "record";
+    readonly name: "recordText";
     readonly inputs: readonly [{
         readonly name: "owner";
         readonly type: "address";
@@ -711,13 +1445,35 @@ declare const REGISTRY_ABI: readonly [{
         readonly internalType: "uint256";
     }, {
         readonly name: "kind";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
+        readonly type: "string";
+        readonly internalType: "string";
     }];
     readonly outputs: readonly [{
         readonly name: "";
-        readonly type: "bytes";
-        readonly internalType: "bytes";
+        readonly type: "string";
+        readonly internalType: "string";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "recordsOf";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly internalType: "address";
+    }, {
+        readonly name: "index";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "kinds";
+        readonly type: "string[]";
+        readonly internalType: "string[]";
+    }, {
+        readonly name: "values";
+        readonly type: "string[]";
+        readonly internalType: "string[]";
     }];
     readonly stateMutability: "view";
 }, {
@@ -727,6 +1483,10 @@ declare const REGISTRY_ABI: readonly [{
         readonly name: "index";
         readonly type: "uint256";
         readonly internalType: "uint256";
+    }, {
+        readonly name: "reason";
+        readonly type: "string";
+        readonly internalType: "string";
     }];
     readonly outputs: readonly [];
     readonly stateMutability: "nonpayable";
@@ -741,12 +1501,16 @@ declare const REGISTRY_ABI: readonly [{
         readonly name: "index";
         readonly type: "uint256";
         readonly internalType: "uint256";
+    }, {
+        readonly name: "reason";
+        readonly type: "string";
+        readonly internalType: "string";
     }, {
         readonly name: "deadline";
         readonly type: "uint256";
         readonly internalType: "uint256";
     }, {
-        readonly name: "signature";
+        readonly name: "permission";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }];
@@ -761,12 +1525,12 @@ declare const REGISTRY_ABI: readonly [{
         readonly internalType: "uint256";
     }, {
         readonly name: "kind";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
+        readonly type: "string";
+        readonly internalType: "string";
     }, {
         readonly name: "value";
-        readonly type: "bytes";
-        readonly internalType: "bytes";
+        readonly type: "string";
+        readonly internalType: "string";
     }];
     readonly outputs: readonly [];
     readonly stateMutability: "nonpayable";
@@ -783,23 +1547,81 @@ declare const REGISTRY_ABI: readonly [{
         readonly internalType: "uint256";
     }, {
         readonly name: "kind";
-        readonly type: "bytes32";
-        readonly internalType: "bytes32";
+        readonly type: "string";
+        readonly internalType: "string";
     }, {
         readonly name: "value";
-        readonly type: "bytes";
-        readonly internalType: "bytes";
+        readonly type: "string";
+        readonly internalType: "string";
     }, {
         readonly name: "deadline";
         readonly type: "uint256";
         readonly internalType: "uint256";
     }, {
-        readonly name: "signature";
+        readonly name: "permission";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }];
     readonly outputs: readonly [];
     readonly stateMutability: "nonpayable";
+}, {
+    readonly type: "function";
+    readonly name: "signatureBytes";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly internalType: "address";
+    }, {
+        readonly name: "index";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "signature";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
+    readonly stateMutability: "view";
+}, {
+    readonly type: "function";
+    readonly name: "statementFor";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly internalType: "address";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "string";
+        readonly internalType: "string";
+    }];
+    readonly stateMutability: "pure";
+}, {
+    readonly type: "function";
+    readonly name: "summary";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly internalType: "address";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "total";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "active";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "hasCurrent";
+        readonly type: "bool";
+        readonly internalType: "bool";
+    }, {
+        readonly name: "currentIndex";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+    readonly stateMutability: "view";
 }, {
     readonly type: "function";
     readonly name: "updateKey";
@@ -808,7 +1630,7 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "uint256";
         readonly internalType: "uint256";
     }, {
-        readonly name: "pgpPublicKey";
+        readonly name: "key";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }];
@@ -826,7 +1648,7 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "uint256";
         readonly internalType: "uint256";
     }, {
-        readonly name: "pgpPublicKey";
+        readonly name: "key";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }, {
@@ -834,7 +1656,7 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "uint256";
         readonly internalType: "uint256";
     }, {
-        readonly name: "signature";
+        readonly name: "permission";
         readonly type: "bytes";
         readonly internalType: "bytes";
     }];
@@ -864,20 +1686,15 @@ declare const REGISTRY_ABI: readonly [{
         readonly indexed: false;
         readonly internalType: "bytes";
     }, {
-        readonly name: "messageVersion";
-        readonly type: "uint8";
-        readonly indexed: false;
-        readonly internalType: "uint8";
-    }, {
-        readonly name: "keyPtr";
+        readonly name: "payload";
         readonly type: "address";
         readonly indexed: false;
         readonly internalType: "address";
     }, {
-        readonly name: "sigPtr";
-        readonly type: "address";
+        readonly name: "messageVersion";
+        readonly type: "uint8";
         readonly indexed: false;
-        readonly internalType: "address";
+        readonly internalType: "uint8";
     }, {
         readonly name: "submitter";
         readonly type: "address";
@@ -904,12 +1721,12 @@ declare const REGISTRY_ABI: readonly [{
         readonly indexed: true;
         readonly internalType: "uint256";
     }, {
-        readonly name: "oldKeyPtr";
+        readonly name: "oldPayload";
         readonly type: "address";
         readonly indexed: false;
         readonly internalType: "address";
     }, {
-        readonly name: "newKeyPtr";
+        readonly name: "newPayload";
         readonly type: "address";
         readonly indexed: false;
         readonly internalType: "address";
@@ -949,10 +1766,20 @@ declare const REGISTRY_ABI: readonly [{
         readonly indexed: true;
         readonly internalType: "uint256";
     }, {
-        readonly name: "kind";
+        readonly name: "kindHash";
         readonly type: "bytes32";
         readonly indexed: true;
         readonly internalType: "bytes32";
+    }, {
+        readonly name: "kind";
+        readonly type: "string";
+        readonly indexed: false;
+        readonly internalType: "string";
+    }, {
+        readonly name: "value";
+        readonly type: "string";
+        readonly indexed: false;
+        readonly internalType: "string";
     }, {
         readonly name: "submitter";
         readonly type: "address";
@@ -960,6 +1787,26 @@ declare const REGISTRY_ABI: readonly [{
         readonly internalType: "address";
     }];
     readonly anonymous: false;
+}, {
+    readonly type: "event";
+    readonly name: "RecordsMoved";
+    readonly inputs: readonly [{
+        readonly name: "owner";
+        readonly type: "address";
+        readonly indexed: true;
+        readonly internalType: "address";
+    }, {
+        readonly name: "fromIndex";
+        readonly type: "uint256";
+        readonly indexed: true;
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "toIndex";
+        readonly type: "uint256";
+        readonly indexed: true;
+        readonly internalType: "uint256";
+    }];
+    readonly anonymous: false;
 }, {
     readonly type: "event";
     readonly name: "Revoked";
@@ -978,6 +1825,16 @@ declare const REGISTRY_ABI: readonly [{
         readonly type: "uint256";
         readonly indexed: true;
         readonly internalType: "uint256";
+    }, {
+        readonly name: "reason";
+        readonly type: "string";
+        readonly indexed: false;
+        readonly internalType: "string";
+    }, {
+        readonly name: "replacedBy";
+        readonly type: "uint256";
+        readonly indexed: false;
+        readonly internalType: "uint256";
     }, {
         readonly name: "submitter";
         readonly type: "address";
@@ -988,11 +1845,27 @@ declare const REGISTRY_ABI: readonly [{
 }, {
     readonly type: "error";
     readonly name: "AlreadyRevoked";
+    readonly inputs: readonly [{
+        readonly name: "index";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "BadArmorChecksum";
     readonly inputs: readonly [];
 }, {
     readonly type: "error";
-    readonly name: "AuthorizationExpired";
+    readonly name: "BadBase64";
     readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "ClaimActive";
+    readonly inputs: readonly [{
+        readonly name: "index";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
 }, {
     readonly type: "error";
     readonly name: "DeploymentFailed";
@@ -1000,10 +1873,14 @@ declare const REGISTRY_ABI: readonly [{
 }, {
     readonly type: "error";
     readonly name: "DuplicateActiveFingerprint";
-    readonly inputs: readonly [];
+    readonly inputs: readonly [{
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
 }, {
     readonly type: "error";
-    readonly name: "EmptyPublicKey";
+    readonly name: "EmptyKey";
     readonly inputs: readonly [];
 }, {
     readonly type: "error";
@@ -1012,14 +1889,42 @@ declare const REGISTRY_ABI: readonly [{
 }, {
     readonly type: "error";
     readonly name: "IndexOutOfBounds";
-    readonly inputs: readonly [];
+    readonly inputs: readonly [{
+        readonly name: "index";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "count";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
 }, {
     readonly type: "error";
-    readonly name: "InvalidAuthorization";
-    readonly inputs: readonly [];
+    readonly name: "InvalidFingerprint";
+    readonly inputs: readonly [{
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
 }, {
     readonly type: "error";
     readonly name: "InvalidFingerprintLength";
+    readonly inputs: readonly [{
+        readonly name: "length";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "InvalidKindName";
+    readonly inputs: readonly [{
+        readonly name: "kind";
+        readonly type: "string";
+        readonly internalType: "string";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "InvalidPermission";
     readonly inputs: readonly [];
 }, {
     readonly type: "error";
@@ -1027,31 +1932,125 @@ declare const REGISTRY_ABI: readonly [{
     readonly inputs: readonly [];
 }, {
     readonly type: "error";
-    readonly name: "PublicKeyTooLarge";
+    readonly name: "KeyCompromised";
+    readonly inputs: readonly [{
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "KeyStillActive";
+    readonly inputs: readonly [{
+        readonly name: "fingerprint";
+        readonly type: "bytes";
+        readonly internalType: "bytes";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "KeyTooLarge";
+    readonly inputs: readonly [{
+        readonly name: "size";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "max";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "NotAKey";
+    readonly inputs: readonly [{
+        readonly name: "firstByte";
+        readonly type: "bytes1";
+        readonly internalType: "bytes1";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "NotASignature";
+    readonly inputs: readonly [{
+        readonly name: "firstByte";
+        readonly type: "bytes1";
+        readonly internalType: "bytes1";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "NotArmored";
     readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "PayloadTooLarge";
+    readonly inputs: readonly [{
+        readonly name: "size";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "max";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "PermissionExpired";
+    readonly inputs: readonly [{
+        readonly name: "deadline";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
 }, {
     readonly type: "error";
     readonly name: "RecordTooLarge";
-    readonly inputs: readonly [];
+    readonly inputs: readonly [{
+        readonly name: "size";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "max";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
 }, {
     readonly type: "error";
     readonly name: "SignatureTooLarge";
+    readonly inputs: readonly [{
+        readonly name: "size";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }, {
+        readonly name: "max";
+        readonly type: "uint256";
+        readonly internalType: "uint256";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "SupersededIsSetByReattest";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "TooManyClaims";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "UnknownRevokeReason";
+    readonly inputs: readonly [{
+        readonly name: "reason";
+        readonly type: "string";
+        readonly internalType: "string";
+    }];
+}, {
+    readonly type: "error";
+    readonly name: "UnsupportedHeader";
     readonly inputs: readonly [];
 }];
 
-/**
- * PGPRegistry v2 is deployed with CREATE2, so it has the same address on every
- * network. (v1 lived at 0xf7a45BC662A78a6fb417ED5f52b3766cbf13EbBb on mainnet and
- * is no longer read by Thurin.)
- */
-declare const REGISTRY_ADDRESS: "0x9302E02e2869e129aC8516fE5eFFd51EA3082c09";
+/** PGPRegistry v3. Deployed with CREATE2, so the address is the same on mainnet, Sepolia, and a local anvil. */
+declare const REGISTRY_ADDRESS: "0xFa6956c11163517249f8A67F5560a4406B519451";
 /** Networks the PGPRegistry is deployed on. `mainnet` is the default everywhere. */
 type NetworkName = 'mainnet' | 'sepolia' | 'local';
 interface RegistryDeployment {
     chainId: number;
     address: `0x${string}`;
-    /** Block the registry was deployed in (informational; v2 needs no log scans). */
-    deployBlock: bigint;
     /** Block explorer base URL for address/tx links. Empty when there is none. */
     explorerUrl: string;
     /** Keyless public RPC used when no rpcUrl is configured. */
@@ -1099,14 +2098,17 @@ declare function chainFor(network?: NetworkName): {
         };
     };
     sourceId?: number | undefined | undefined;
+    supportsTransactionReplacementDetection?: boolean | undefined | undefined;
     testnet: true;
     custom?: Record<string, unknown> | undefined;
     extendSchema?: Record<string, unknown> | undefined;
     fees?: viem.ChainFees<undefined> | undefined;
     formatters?: undefined;
     prepareTransactionRequest?: ((args: viem.PrepareTransactionRequestParameters, options: {
+        client: viem.Client;
         phase: "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
     }) => Promise<viem.PrepareTransactionRequestParameters>) | [fn: ((args: viem.PrepareTransactionRequestParameters, options: {
+        client: viem.Client;
         phase: "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
     }) => Promise<viem.PrepareTransactionRequestParameters>) | undefined, options: {
         runAt: readonly ("beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters")[];
@@ -1152,14 +2154,17 @@ declare function chainFor(network?: NetworkName): {
         };
     };
     sourceId?: number | undefined | undefined;
+    supportsTransactionReplacementDetection?: boolean | undefined | undefined;
     testnet?: boolean | undefined | undefined;
     custom?: Record<string, unknown> | undefined;
     extendSchema?: Record<string, unknown> | undefined;
     fees?: viem.ChainFees<undefined> | undefined;
     formatters?: undefined;
     prepareTransactionRequest?: ((args: viem.PrepareTransactionRequestParameters, options: {
+        client: viem.Client;
         phase: "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
     }) => Promise<viem.PrepareTransactionRequestParameters>) | [fn: ((args: viem.PrepareTransactionRequestParameters, options: {
+        client: viem.Client;
         phase: "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
     }) => Promise<viem.PrepareTransactionRequestParameters>) | undefined, options: {
         runAt: readonly ("beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters")[];
@@ -1187,479 +2192,178 @@ declare function chainFor(network?: NetworkName): {
     };
     ensTlds?: readonly string[] | undefined;
     id: 1;
-    name: "Ethereum";
-    nativeCurrency: {
-        readonly name: "Ether";
-        readonly symbol: "ETH";
-        readonly decimals: 18;
-    };
-    experimental_preconfirmationTime?: number | undefined | undefined;
-    rpcUrls: {
-        readonly default: {
-            readonly http: readonly ["https://eth.merkle.io"];
-        };
-    };
-    sourceId?: number | undefined | undefined;
-    testnet?: boolean | undefined | undefined;
-    custom?: Record<string, unknown> | undefined;
-    extendSchema?: Record<string, unknown> | undefined;
-    fees?: viem.ChainFees<undefined> | undefined;
-    formatters?: undefined;
-    prepareTransactionRequest?: ((args: viem.PrepareTransactionRequestParameters, options: {
-        phase: "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
-    }) => Promise<viem.PrepareTransactionRequestParameters>) | [fn: ((args: viem.PrepareTransactionRequestParameters, options: {
-        phase: "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
-    }) => Promise<viem.PrepareTransactionRequestParameters>) | undefined, options: {
-        runAt: readonly ("beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters")[];
-    }] | undefined;
-    serializers?: viem.ChainSerializers<undefined, viem.TransactionSerializable> | undefined;
-    verifyHash?: ((client: viem.Client, parameters: viem.VerifyHashActionParameters) => Promise<viem.VerifyHashActionReturnType>) | undefined;
-};
-
-/**
- * The `id.thurin` ENS text record: a name points at the PGP key claimed on the Thurin
- * registry by the address the name resolves to. It is a discovery hint, not part of the
- * trust chain — the name owner set the address, the address signed the claim, so a reader
- * verifies by resolving the name and reading the registry. The record only says where to
- * look. `id.thurin` is a service key under ENSIP-5 (reverse-dot of thurin.id); ENSIP-18
- * says service-key values are bare, so the value is the 40-hex fingerprint, uppercase.
- */
-declare const ENS_HINT_KEY: "id.thurin";
-type EnsHintState = 'match' | 'unset' | 'mismatch';
-interface EnsHint {
-    key: typeof ENS_HINT_KEY;
-    state: EnsHintState;
-    /** The raw record value, or null when the name carries no record. */
-    record: string | null;
-    /** The record as a lowercase fingerprint, or null when it does not parse as one. */
-    fingerprint: string | null;
-    /** The verified claim's fingerprint (lowercase) the record is compared against, if any. */
-    expected: string | null;
-    /** Why a record does not match; absent for `match` and `unset`. */
-    reason?: string;
-}
-/**
- * Compare a name's `id.thurin` record with the fingerprint the registry verifies for the
- * name's address. Parsing is lenient (case, spaces, 0x); what Thurin writes is strict.
- */
-declare function ensHintFor(record: string | null | undefined, verifiedFingerprint: string | null | undefined): EnsHint;
-/** The value Thurin writes: the fingerprint, uppercase, bare. */
-declare function ensHintValue(fingerprint: string): string;
-/** The `text` / `setText` pair every ENS resolver speaks (ENSIP-5); the same on ENSv2. */
-declare const ENS_TEXT_RESOLVER_ABI: readonly [{
-    readonly type: "function";
-    readonly name: "text";
-    readonly stateMutability: "view";
-    readonly inputs: readonly [{
-        readonly name: "node";
-        readonly type: "bytes32";
-    }, {
-        readonly name: "key";
-        readonly type: "string";
-    }];
-    readonly outputs: readonly [{
-        readonly name: "";
-        readonly type: "string";
-    }];
-}, {
-    readonly type: "function";
-    readonly name: "setText";
-    readonly stateMutability: "nonpayable";
-    readonly inputs: readonly [{
-        readonly name: "node";
-        readonly type: "bytes32";
-    }, {
-        readonly name: "key";
-        readonly type: "string";
-    }, {
-        readonly name: "value";
-        readonly type: "string";
-    }];
-    readonly outputs: readonly [];
-}];
-/**
- * The `setText` call that links a name to a claim. The resolver address is not part of it
- * on purpose: look it up at write time (`client.getEnsResolver({ name })`) — on ENSv2 every
- * account has its own resolver, so a cached or hardcoded one is the wrong contract.
- */
-declare function ensHintWrite(name: string, fingerprint: string): {
-    abi: readonly [{
-        readonly type: "function";
-        readonly name: "text";
-        readonly stateMutability: "view";
-        readonly inputs: readonly [{
-            readonly name: "node";
-            readonly type: "bytes32";
-        }, {
-            readonly name: "key";
-            readonly type: "string";
-        }];
-        readonly outputs: readonly [{
-            readonly name: "";
-            readonly type: "string";
-        }];
-    }, {
-        readonly type: "function";
-        readonly name: "setText";
-        readonly stateMutability: "nonpayable";
-        readonly inputs: readonly [{
-            readonly name: "node";
-            readonly type: "bytes32";
-        }, {
-            readonly name: "key";
-            readonly type: "string";
-        }, {
-            readonly name: "value";
-            readonly type: "string";
-        }];
-        readonly outputs: readonly [];
-    }];
-    functionName: "setText";
-    args: readonly [`0x${string}`, "id.thurin", string];
-    name: string;
-};
-/** Minimal client shape: viem's PublicClient has both. */
-interface EnsTextReader {
-    getEnsText(args: {
-        name: string;
-        key: string;
-    }): Promise<string | null>;
-}
-/** Read a name's `id.thurin` record and compare it with the verified fingerprint. */
-declare function fetchEnsHint(client: EnsTextReader, name: string, verifiedFingerprint: string | null | undefined): Promise<EnsHint>;
-
-/**
- * EIP-712 authorizations for the registry's relayed writes (`attestFor`, `reattestFor`,
- * `updateKeyFor`, `revokeFor`, `setRecordFor`). The owner signs one of these typed
- * structs; anyone can then submit the matching call and pay the gas. Every field is
- * bound, plus the owner's current `nonce` (read with `nonces(owner)`) and a `deadline`.
- *
- * The domain includes the chain id, so an authorization for one network cannot be
- * replayed on another even though the registry has the same address everywhere.
- */
-declare const EIP712_NAME = "Thurin PGPRegistry";
-declare const EIP712_VERSION = "2";
-declare function registryDomain(chainId: number, verifyingContract: Hex): TypedDataDomain;
-declare const AUTHORIZATION_TYPES: {
-    readonly Attest: readonly [{
-        readonly name: "owner";
-        readonly type: "address";
-    }, {
-        readonly name: "fingerprint";
-        readonly type: "bytes";
-    }, {
-        readonly name: "pgpSignature";
-        readonly type: "bytes";
-    }, {
-        readonly name: "pgpPublicKey";
-        readonly type: "bytes";
-    }, {
-        readonly name: "nonce";
-        readonly type: "uint256";
-    }, {
-        readonly name: "deadline";
-        readonly type: "uint256";
-    }];
-    readonly Reattest: readonly [{
-        readonly name: "owner";
-        readonly type: "address";
-    }, {
-        readonly name: "revokeIndex";
-        readonly type: "uint256";
-    }, {
-        readonly name: "fingerprint";
-        readonly type: "bytes";
-    }, {
-        readonly name: "pgpSignature";
-        readonly type: "bytes";
-    }, {
-        readonly name: "pgpPublicKey";
-        readonly type: "bytes";
-    }, {
-        readonly name: "nonce";
-        readonly type: "uint256";
-    }, {
-        readonly name: "deadline";
-        readonly type: "uint256";
-    }];
-    readonly UpdateKey: readonly [{
-        readonly name: "owner";
-        readonly type: "address";
-    }, {
-        readonly name: "index";
-        readonly type: "uint256";
-    }, {
-        readonly name: "pgpPublicKey";
-        readonly type: "bytes";
-    }, {
-        readonly name: "nonce";
-        readonly type: "uint256";
-    }, {
-        readonly name: "deadline";
-        readonly type: "uint256";
-    }];
-    readonly Revoke: readonly [{
-        readonly name: "owner";
-        readonly type: "address";
-    }, {
-        readonly name: "index";
-        readonly type: "uint256";
-    }, {
-        readonly name: "nonce";
-        readonly type: "uint256";
-    }, {
-        readonly name: "deadline";
-        readonly type: "uint256";
-    }];
-    readonly SetRecord: readonly [{
-        readonly name: "owner";
-        readonly type: "address";
-    }, {
-        readonly name: "index";
-        readonly type: "uint256";
-    }, {
-        readonly name: "kind";
-        readonly type: "bytes32";
-    }, {
-        readonly name: "value";
-        readonly type: "bytes";
-    }, {
-        readonly name: "nonce";
-        readonly type: "uint256";
-    }, {
-        readonly name: "deadline";
-        readonly type: "uint256";
-    }];
-};
-type AuthorizationAction = keyof typeof AUTHORIZATION_TYPES;
-interface Common {
-    owner: Hex;
-    nonce: bigint;
-    deadline: bigint;
-}
-type AttestAuthorization = Common & {
-    fingerprint: string;
-    pgpSignature: string;
-    pgpPublicKey: string;
-};
-type ReattestAuthorization = AttestAuthorization & {
-    revokeIndex: bigint;
-};
-type UpdateKeyAuthorization = Common & {
-    index: bigint;
-    pgpPublicKey: string;
-};
-type RevokeAuthorization = Common & {
-    index: bigint;
-};
-type SetRecordAuthorization = Common & {
-    index: bigint;
-    kind: Hex;
-    value: Hex;
-};
-/**
- * Build the object to pass to viem/wagmi `signTypedData`. `fingerprint` is the hex
- * fingerprint; `pgpSignature` / `pgpPublicKey` are the armored text exactly as they
- * will be submitted (they are hashed as UTF-8 bytes).
- */
-declare function attestTypedData(chainId: number, registry: Hex, a: AttestAuthorization): {
-    domain: TypedDataDomain;
-    types: {
-        Attest: readonly [{
-            readonly name: "owner";
-            readonly type: "address";
-        }, {
-            readonly name: "fingerprint";
-            readonly type: "bytes";
-        }, {
-            readonly name: "pgpSignature";
-            readonly type: "bytes";
-        }, {
-            readonly name: "pgpPublicKey";
-            readonly type: "bytes";
-        }, {
-            readonly name: "nonce";
-            readonly type: "uint256";
-        }, {
-            readonly name: "deadline";
-            readonly type: "uint256";
-        }];
-    };
-    primaryType: "Attest";
-    message: {
-        owner: `0x${string}`;
-        fingerprint: `0x${string}`;
-        pgpSignature: `0x${string}`;
-        pgpPublicKey: `0x${string}`;
-        nonce: bigint;
-        deadline: bigint;
-    };
-};
-declare function reattestTypedData(chainId: number, registry: Hex, a: ReattestAuthorization): {
-    domain: TypedDataDomain;
-    types: {
-        Reattest: readonly [{
-            readonly name: "owner";
-            readonly type: "address";
-        }, {
-            readonly name: "revokeIndex";
-            readonly type: "uint256";
-        }, {
-            readonly name: "fingerprint";
-            readonly type: "bytes";
-        }, {
-            readonly name: "pgpSignature";
-            readonly type: "bytes";
-        }, {
-            readonly name: "pgpPublicKey";
-            readonly type: "bytes";
-        }, {
-            readonly name: "nonce";
-            readonly type: "uint256";
-        }, {
-            readonly name: "deadline";
-            readonly type: "uint256";
-        }];
-    };
-    primaryType: "Reattest";
-    message: {
-        revokeIndex: bigint;
-        owner: `0x${string}`;
-        fingerprint: `0x${string}`;
-        pgpSignature: `0x${string}`;
-        pgpPublicKey: `0x${string}`;
-        nonce: bigint;
-        deadline: bigint;
-    };
-};
-declare function updateKeyTypedData(chainId: number, registry: Hex, a: UpdateKeyAuthorization): {
-    domain: TypedDataDomain;
-    types: {
-        UpdateKey: readonly [{
-            readonly name: "owner";
-            readonly type: "address";
-        }, {
-            readonly name: "index";
-            readonly type: "uint256";
-        }, {
-            readonly name: "pgpPublicKey";
-            readonly type: "bytes";
-        }, {
-            readonly name: "nonce";
-            readonly type: "uint256";
-        }, {
-            readonly name: "deadline";
-            readonly type: "uint256";
-        }];
-    };
-    primaryType: "UpdateKey";
-    message: {
-        owner: `0x${string}`;
-        index: bigint;
-        pgpPublicKey: `0x${string}`;
-        nonce: bigint;
-        deadline: bigint;
-    };
-};
-declare function revokeTypedData(chainId: number, registry: Hex, a: RevokeAuthorization): {
-    domain: TypedDataDomain;
-    types: {
-        Revoke: readonly [{
-            readonly name: "owner";
-            readonly type: "address";
-        }, {
-            readonly name: "index";
-            readonly type: "uint256";
-        }, {
-            readonly name: "nonce";
-            readonly type: "uint256";
-        }, {
-            readonly name: "deadline";
-            readonly type: "uint256";
-        }];
+    name: "Ethereum";
+    nativeCurrency: {
+        readonly name: "Ether";
+        readonly symbol: "ETH";
+        readonly decimals: 18;
     };
-    primaryType: "Revoke";
-    message: {
-        owner: `0x${string}`;
-        index: bigint;
-        nonce: bigint;
-        deadline: bigint;
+    experimental_preconfirmationTime?: number | undefined | undefined;
+    rpcUrls: {
+        readonly default: {
+            readonly http: readonly ["https://ethereum.reth.rs/rpc"];
+        };
     };
+    sourceId?: number | undefined | undefined;
+    supportsTransactionReplacementDetection?: boolean | undefined | undefined;
+    testnet?: boolean | undefined | undefined;
+    custom?: Record<string, unknown> | undefined;
+    extendSchema?: Record<string, unknown> | undefined;
+    fees?: viem.ChainFees<undefined> | undefined;
+    formatters?: undefined;
+    prepareTransactionRequest?: ((args: viem.PrepareTransactionRequestParameters, options: {
+        client: viem.Client;
+        phase: "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
+    }) => Promise<viem.PrepareTransactionRequestParameters>) | [fn: ((args: viem.PrepareTransactionRequestParameters, options: {
+        client: viem.Client;
+        phase: "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
+    }) => Promise<viem.PrepareTransactionRequestParameters>) | undefined, options: {
+        runAt: readonly ("beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters")[];
+    }] | undefined;
+    serializers?: viem.ChainSerializers<undefined, viem.TransactionSerializable> | undefined;
+    verifyHash?: ((client: viem.Client, parameters: viem.VerifyHashActionParameters) => Promise<viem.VerifyHashActionReturnType>) | undefined;
 };
-declare function setRecordTypedData(chainId: number, registry: Hex, a: SetRecordAuthorization): {
-    domain: TypedDataDomain;
-    types: {
-        SetRecord: readonly [{
-            readonly name: "owner";
-            readonly type: "address";
-        }, {
-            readonly name: "index";
-            readonly type: "uint256";
-        }, {
-            readonly name: "kind";
-            readonly type: "bytes32";
-        }, {
-            readonly name: "value";
-            readonly type: "bytes";
-        }, {
-            readonly name: "nonce";
-            readonly type: "uint256";
-        }, {
-            readonly name: "deadline";
-            readonly type: "uint256";
-        }];
-    };
-    primaryType: "SetRecord";
-    message: {
-        owner: `0x${string}`;
-        index: bigint;
-        kind: `0x${string}`;
-        value: `0x${string}`;
-        nonce: bigint;
-        deadline: bigint;
+
+/** Any client with viem's `readContract` (a viem PublicClient, or a stub in tests). */
+interface ClaimReader {
+    readContract(args: any): Promise<unknown>;
+}
+type Address = `0x${string}`;
+/** How many of the newest claims `readClaims` reads and verifies by default. */
+declare const CLAIM_LIMIT = 50;
+/**
+ * An address's claims, oldest first: every row from `claimsOf`, and for the newest `limit` the
+ * stored key and signature, verified. Older claims come back with `verification: null` (not read):
+ * an address can hold 65,535 claims, and each one checked costs two reads and a signature check.
+ * A failed `claimsOf` read throws; a failed key or signature read leaves that claim unverified.
+ */
+declare function readClaims(client: ClaimReader, owner: Address, { registry, limit }?: {
+    registry?: Address;
+    limit?: number;
+}): Promise<Attestation[]>;
+/** Where an address's key stands. verified: the newest active claim that verifies · not-counted: the
+ *  newest active claim, none verify (its `verification` says why) · inactive: only ended claims, the
+ *  newest · none: never claimed. */
+type KeyStanding = {
+    kind: 'verified' | 'not-counted' | 'inactive';
+    claim: Attestation;
+} | {
+    kind: 'none';
+    claim: null;
+};
+declare function keyStanding(claims: readonly Attestation[]): KeyStanding;
+/**
+ * Every address that ever claimed a key, found by fingerprint (`ownersOf`) or long key ID
+ * (`fingerprintsForKeyId`, then `ownersOf`). A key ID can match more than one key, so each owner
+ * comes with the fingerprint it claimed. Malformed input finds nothing.
+ */
+declare function findOwners(client: ClaimReader, key: {
+    fingerprint: string;
+} | {
+    keyId: string;
+}, { registry }?: {
+    registry?: Address;
+}): Promise<{
+    owner: Address;
+    fingerprint: string;
+}[]>;
+
+/** Why an identity can't take an encrypted message. */
+type EncryptRefusal = 'no-claim' | 'unverified' | 'no-encryption-subkey' | 'encryption-subkey-expired';
+interface EncryptionKey {
+    ok: true;
+    /** The claim that counts; its key is the one to encrypt to. */
+    claim: Attestation;
+    /** The claim's armored public key. */
+    key: string;
+    /** The key or subkey openpgp will encrypt to. */
+    subkey: {
+        fingerprint: string;
+        algorithm: string;
+        expires: string | null;
     };
+    /** Unix seconds: when this key arrived on the identity (the claim's creation). */
+    addedAt: number;
+    /** Added within `recentDays`: a stolen wallet can only bring in a new key through a new claim. */
+    changedRecently: boolean;
+}
+type EncryptionKeyResult = EncryptionKey | {
+    ok: false;
+    reason: EncryptRefusal;
+    claim: Attestation | null;
+    expired?: string | null;
 };
-/** The digest the registry recovers the signer from — handy for tests and CLIs. */
-declare function authorizationDigest(typedData: ReturnType<typeof attestTypedData | typeof reattestTypedData | typeof updateKeyTypedData | typeof revokeTypedData | typeof setRecordTypedData>): Hex;
-/** `bytes32 kind` for a record from a human-readable name, e.g. recordKind('thurin.vouch'). */
-declare function recordKind(name: string): Hex;
+/**
+ * The key to encrypt to for an address, from its claims: only the claim that counts (`keyStanding`),
+ * and only while an encryption key or subkey is valid. An unverified claim could be someone else's
+ * fake claim for the address, so it is never used.
+ */
+declare function encryptionKeyFor(claims: readonly Attestation[], { now, recentDays }?: {
+    now?: number;
+    recentDays?: number;
+}): Promise<EncryptionKeyResult>;
+/** One plain sentence for a refusal, for the page and the CLI alike. */
+declare function encryptRefusalText(r: Extract<EncryptionKeyResult, {
+    ok: false;
+}>, formatDate?: (iso: string | null | undefined) => string): string;
+/** The warning to show above Encrypt when the key arrived recently; null otherwise. */
+declare function keyChangedText(k: EncryptionKey, now?: number): string | null;
+/**
+ * Encrypt text or a file to a public key, with the kit's openpgp config. The recipient is hidden by
+ * default (key ID zero, like gpg's --throw-keyids), so an intercepted message doesn't name its
+ * recipient; their software tries each of their keys. Text comes back armored; a file as bytes.
+ */
+declare function encryptTo(key: PgpInput, data: string | Uint8Array, { filename, armor, hideRecipient, date }?: {
+    filename?: string;
+    armor?: boolean;
+    hideRecipient?: boolean;
+    date?: Date;
+}): Promise<string | Uint8Array>;
+
+/** Each custom error the registry can revert with, as a sentence to show people. From the contract's NatSpec. */
+declare const CONTRACT_ERROR_TEXT: Record<string, string>;
+/** The registry's custom error name inside a viem error, following `cause` down; null when it isn't a contract revert. */
+declare function contractErrorName(err: unknown): string | null;
+/** The sentence for a registry revert inside a viem error, or null when it isn't one. */
+declare function contractErrorText(err: unknown): string | null;
 
 /**
- * Records: one small value per claim per kind, set only by the owner (or by anyone holding
- * the owner's `setRecordFor` authorization), readable by anyone, clearable. The contract looks
- * a record up by kind and cannot list them, so readers ask for the kinds they know.
+ * Records: named text values on a claim, set only by the owner (or with the owner's
+ * `setRecordFor` permission), readable by anyone, clearable. `recordsOf(owner, index)` lists them.
  *
- * Conventions: kind = keccak256("thurin.<name>"); simple kinds are UTF-8 text, structured
- * kinds small JSON with a `v`, encrypted kinds an armored PGP message; readers ignore unknown
- * fields. Third parties use reverse-dot names (`com.example.thing`) without asking. 1 KB max.
+ * Conventions: simple kinds are text, structured kinds small JSON with a `v`, encrypted kinds an
+ * armored PGP message; readers ignore unknown fields. Third parties use reverse-dot names
+ * (`com.example.thing`) without asking. 1 KB max.
  */
 declare const MAX_RECORD_BYTES = 1024;
+/** Longest record name, `thurin.` included. */
+declare const MAX_KIND_BYTES = 31;
 /** `thurin.` is the default namespace: kindName('canary') === 'thurin.canary'. Dotted names pass through. */
 declare function kindName(input: string): string;
-/** Every kind Thurin defines. `thurin.pointer` is the Thurin Labs release list (CLI only; not shown on identity pages). */
-declare const KNOWN_KINDS: readonly ["thurin.railgun", "thurin.security", "thurin.successor", "thurin.affiliation", "thurin.canary", "thurin.private", "thurin.disclosure", "thurin.pointer"];
+/** The full record name for `input`, or throws with the registry's rule (a-z 0-9 - . only, 31 bytes). */
+declare function checkKindName(input: string): string;
+/** `value` unchanged, or throws if it is over the registry's 1 KB. An empty value clears the record. */
+declare function checkRecordValue(value: string): string;
+/** Every kind Thurin defines, in the order an identity page shows them. */
+declare const KNOWN_KINDS: readonly ["thurin.railgun", "thurin.security", "thurin.successor", "thurin.affiliation", "thurin.canary", "thurin.releases", "thurin.private", "thurin.disclosure"];
 type KnownKind = (typeof KNOWN_KINDS)[number];
-/** The kinds an identity page shows, in display order. */
-declare const IDENTITY_KINDS: readonly KnownKind[];
-declare function encodeRecord(value: string): Hex;
-declare function decodeRecord(hex: Hex): string;
-interface PointerEntry {
+interface ReleaseEntry {
     name: string;
     sha256: string;
     date: string;
     url?: string;
 }
-interface PointerRecord {
+interface ReleasesRecord {
     v: 1;
-    releases: PointerEntry[];
+    releases: ReleaseEntry[];
 }
-declare function parsePointer(text: string): PointerRecord;
+declare function parseReleases(text: string): ReleasesRecord;
 /** Add a release, newest first; drop the oldest until it fits the 1 KB slot. */
-declare function addPointer(existing: PointerRecord | null, entry: PointerEntry): {
-    record: PointerRecord;
-    dropped: PointerEntry[];
+declare function addRelease(existing: ReleasesRecord | null, entry: ReleaseEntry): {
+    record: ReleasesRecord;
+    dropped: ReleaseEntry[];
 };
-declare function renderPointer(p: PointerRecord): string;
+declare function renderReleases(p: ReleasesRecord): string;
 /** A record as the identity page shows it: what was stored, and what it means if it parses. */
 interface ParsedRecord {
     kind: string;
@@ -1698,8 +2402,8 @@ type RecordData = {
     type: 'encrypted';
     recipients: number | null;
 } | {
-    type: 'pointer';
-    releases: PointerEntry[];
+    type: 'releases';
+    releases: ReleaseEntry[];
 } | {
     type: 'text';
 };
@@ -1712,133 +2416,33 @@ type RecordData = {
 declare function parseRecord(kind: string, text: string, opts?: {
     armoredKey?: string;
 }): Promise<ParsedRecord>;
-/** Minimal client shape: viem's PublicClient has it. */
+/** Anything with viem's `readContract`, such as a viem `PublicClient`. */
 interface RecordReader {
-    readContract(args: {
-        address: `0x${string}`;
-        abi: unknown;
-        functionName: 'record';
-        args: readonly [`0x${string}`, bigint, Hex];
-    }): Promise<unknown>;
-}
-/**
- * Read and parse the given kinds on one claim. Kinds with no record are left out.
- * `registry` is the contract address; pass the kit's REGISTRY_ABI.
- */
-declare function fetchRecords(client: RecordReader, registry: `0x${string}`, abi: unknown, owner: `0x${string}`, index: number | bigint, kinds?: readonly string[], opts?: {
-    armoredKey?: string;
-}): Promise<ParsedRecord[]>;
-
-declare function identifyProof(notation: Notation): Proof | null;
-declare function displayUrl(proof: Proof): string;
-declare function proofHref(proof: Proof): string | null;
-declare function proofSecondaryHref(proof: Proof): string | null;
-/**
- * Farcaster proofs are read from a Farcaster node's HTTP API (`/v1/userNameProofByName`,
- * `/v1/castsByFid`). The default is Quilibrium's public Hypersnap node, which needs no key and
- * allows browser requests; it sees the visitor's IP and which account was checked. Point
- * `farcasterHub` at your own node to avoid that, or pass a Neynar key to use Neynar's hub.
- */
-declare const FARCASTER_HUB = "https://haatz.quilibrium.com";
-interface ProofOptions {
-    /** A Farcaster node's HTTP API base URL. Default: FARCASTER_HUB (keyless). */
-    farcasterHub?: string;
-    /** Optional: read Farcaster through Neynar's hub with this key instead. */
-    neynarApiKey?: string;
+    readContract(args: any): Promise<unknown>;
 }
 /**
- * Check one proof. The third argument is options; a plain string is still accepted as a
- * Neynar API key (the pre-1.3.7 signature).
- */
-declare function verifyProof(proof: Proof, fingerprint: string, opts?: ProofOptions | string): Promise<PGPVerification>;
-
-declare function parsePgpKey(armoredKey: string): Promise<PGPKeyInfo | null>;
-/**
- * Verify a clearsigned message against an armored public key, the way gpg does: the signing
- * key (or subkey) must be valid *now* — bound to this primary, unrevoked, unexpired — and the
- * signature must be sound. We deliberately do not ask openpgp.verify(), which also demands
- * the key was valid at the instant the signature was made. Thurin's update flow tells people
- * to `export-minimal` after editing notations, which keeps only the newest self-certification;
- * when that postdates the signature (Ben's own key, 2026-09-14: notations edited 16 minutes
- * after signing), openpgp.verify() reports "Could not find valid self-signature" for a
- * signature gpg verifies fine. A key that has since been revoked or expired still fails here.
- * These are internals the .d.ts does not expose (the signature packet list, the
- * CRLF-normalised text, LiteralDataPacket.setText); they are stable across openpgp.js 6 and
- * exercised by the real-data tests in attestation.test.ts.
- *
- * Used for attestation statements and for clearsigned records such as `thurin.canary`.
+ * The records on one claim, from `recordsOf`, as `{ kind, text }` pairs. `kinds` picks and orders
+ * them (full names); `null` keeps every record in the order it was first set.
  */
-declare function verifyClearsigned({ armoredKey, clearsigned }: {
-    armoredKey: string;
-    clearsigned: string;
-}): Promise<{
-    verified: boolean;
-    reason?: string;
+declare function pickRecords(names: readonly string[], values: readonly string[], kinds?: readonly string[] | null): {
+    kind: string;
     text: string;
-}>;
-declare function verifyAttestation({ pgpPublicKey, pgpSignature, fingerprint, ethAddress, }: {
-    pgpPublicKey: string | null;
-    pgpSignature: string | null;
-    fingerprint: string;
-    ethAddress: string;
-}): Promise<PGPVerification>;
-interface StrippedKey {
-    /** Armored public key containing only the non-email user IDs. */
-    armored: string;
-    /** User IDs kept (no `@`). */
-    kept: string[];
-    /** User IDs removed (contained an `@`). */
-    removed: string[];
-}
-/**
- * Remove every user ID that contains an email address, keeping the rest (and
- * their self-certifications, so proof notations on a non-email user ID survive).
- * Returns null when nothing would remain — openpgp needs at least one
- * self-certified user ID to verify signatures, so such a key must not be
- * published. The key material and subkeys are untouched; the fingerprint is
- * unchanged.
- */
-declare function stripEmailUserIDs(armoredKey: string): Promise<StrippedKey | null>;
-/** True when any user ID on the key contains an email address. */
-declare function hasEmailUserID(armoredKey: string): Promise<boolean>;
-
-/**
- * EFP social graph for an address. Followers are counted by EFP for any address,
- * whether or not it has published a list of its own; following and top-8 exist
- * only when it has (its "primary list"). An address with followers but no list
- * — a project account that has never followed anyone — is still on EFP.
- */
-declare function fetchEFPGraph(address: string): Promise<EFPGraph | null>;
-
+}[];
 /**
- * Why an identity couldn't be shown. A dead RPC must never read as a fact about the identity:
- * viem's ENS lookup turns an unreachable RPC into "no address", and a failed registry read
- * leaves every count at zero. So when a lookup comes back empty or fails, the hook asks the
- * RPC for the block number and this decides which it was.
- *
- * - `rpc`: the RPC didn't answer; nothing about the identity is known
- * - `not-found`: the RPC answered and the ENS name has no address
- * - `read`: the RPC answers, but a registry read failed anyway
+ * The records an identity page shows, in page order: Thurin's kinds in their display order, then
+ * everyone else's in the order they were first set on the claim. Empty values are left out.
  */
-type IdentityErrorKind = 'rpc' | 'not-found' | 'read';
-interface IdentityLookupState {
-    /** An ENS name was looked up and came back with no address. */
-    ensEmpty: boolean;
-    /** The ENS lookup itself errored. */
-    ensFailed: boolean;
-    /** Reading the owner's claims from the registry errored. */
-    claimsFailed: boolean;
-    /** The block-number probe: undefined while not run or running. */
-    rpcAnswered: boolean | undefined;
-}
-/** Whether the lookup needs the RPC probe to be understood. */
-declare function needsRpcProbe(s: Omit<IdentityLookupState, 'rpcAnswered'>): boolean;
-/** null when nothing went wrong or the probe hasn't answered yet. */
-declare function identityErrorKind(s: IdentityLookupState): IdentityErrorKind | null;
-declare const IDENTITY_ERROR_TEXT: Record<IdentityErrorKind, string>;
+declare function pageRecords(names: readonly string[], values: readonly string[]): {
+    kind: string;
+    text: string;
+}[];
+/** Read and parse the records on one claim. Pass the kit's REGISTRY_ABI. */
+declare function fetchRecords(client: RecordReader, registry: `0x${string}`, abi: unknown, owner: `0x${string}`, index: number | bigint, kinds?: readonly string[] | null, opts?: {
+    armoredKey?: string;
+}): Promise<ParsedRecord[]>;
 
 /**
- * Plain words for a claim's state, shared by thurin.id, the CLI, and anyone embedding the kit,
+ * Plain words for a claim's state, shared by thurin.id, the CLI, and anyone using the kit,
  * so every surface says the same thing. `sentence` is for visitors; `fix` is for the owner only
  * (thurin.id shows it when the connected wallet owns the claim).
  */
@@ -1855,6 +2459,11 @@ interface ClaimCheckText {
 }
 /** Label, visitor sentence, and owner fix for a verification result. */
 declare function claimCheckText(v: PGPVerification, formatDate?: (iso: string | null | undefined) => string): ClaimCheckText;
+/**
+ * What's wrong with a key before it's published, when the problem is the key and not the signature;
+ * null otherwise. For the attest screen and CLI, where claimCheckText's claim wording doesn't fit.
+ */
+declare function keyProblemText(v: PGPVerification, formatDate?: (iso: string | null | undefined) => string): ClaimCheckText | null;
 /** Days until a verified claim's key (or signing subkey) expires, when that is within `withinDays`. */
 declare function expiresSoon(v: PGPVerification | null | undefined, now?: number, withinDays?: number): {
     days: number;
@@ -1870,36 +2479,27 @@ type ClaimFate = {
 } | {
     state: 'revoked';
     at: number;
+    reason?: string;
 } | {
     state: 'replaced';
     at: number;
     by: number;
+    compromised?: boolean;
 };
-/**
- * Active, revoked, or replaced, for each of one owner's claims (keyed by index). `reattest`
- * revokes and attests in one transaction, so a claim revoked at the very second a newer claim
- * of the same owner was created counts as replaced by it. The contract has no "superseded"
- * event; this reads the same fact from the stored timestamps.
- */
-declare function claimFates(claims: Pick<Attestation, 'index' | 'createdAt' | 'revokedAt'>[]): Map<number, ClaimFate>;
-/** "Revoked by its owner on Oct 3, 2026." / "Replaced by claim #2 on Oct 3, 2026." */
+/** Active, revoked (with the owner's reason), or replaced, for each of one owner's claims (keyed by index). */
+declare function claimFates(claims: Pick<Attestation, 'index' | 'revokedAt' | 'state' | 'replacedBy' | 'revokeReason'>[]): Map<number, ClaimFate>;
+/** "Revoked by its owner on Oct 3, 2026 (compromised)." / "Replaced by claim #2 on Oct 3, 2026." */
 declare function claimFateText(fate: ClaimFate, formatDate?: (seconds: number) => string): string | null;
 
 /**
- * ENS avatars without the tracking pixel. The `avatar` record is a link the name's owner
- * chooses; loading an ordinary https:// link would tell that owner's server the IP and time of
- * everyone who views the card. So only images the owner can't watch load: content-addressed
- * ones (IPFS, Arweave, inline data, or an NFT whose metadata and image are content-addressed)
- * through public gateways, and euc.li, ENS Labs' host behind the ENS app's avatar upload
- * (most avatars; ENS Labs sees the view, the name's owner doesn't). Anything else: no avatar.
- */
-/**
- * Public IPFS gateways, tried in order: when an image fails to load, the next one is used.
- * Any single public gateway can stop serving (ipfs.io and dweb.link went "service worker only"
- * in 2026), so there is always a fallback. The gateway sees the viewer's IP and the avatar.
+ * ENS avatars without the tracking pixel: an ordinary https:// avatar tells the name's owner who
+ * viewed the page. Only images the owner can't watch load: content-addressed ones (IPFS, Arweave,
+ * inline data, an NFT whose metadata and image are content-addressed) through public gateways, and
+ * euc.li, where the ENS app stores uploads (ENS Labs sees the view; the owner doesn't).
  */
+/** Public IPFS gateways, tried in order when an image fails: any one can stop serving. Each sees the viewer's IP. */
 declare const IPFS_GATEWAYS: readonly ["https://ipfs.filebase.io/ipfs/", "https://gateway.pinata.cloud/ipfs/"];
-/** The first gateway in IPFS_GATEWAYS (kept for code that imported it before 1.3.6). */
+/** The first gateway in IPFS_GATEWAYS. */
 declare const IPFS_GATEWAY: string;
 declare const ARWEAVE_GATEWAY = "https://arweave.net/";
 /** An image URL safe to load for `uri`, or null if loading it would reach a host the owner picked. */
@@ -1941,21 +2541,112 @@ declare const NFT_AVATAR_ABI: readonly [{
  */
 declare function nftAvatarImage(tokenUri: string, tokenId: bigint, fetchFn?: typeof fetch): Promise<string | null>;
 
-/** Normalize a fingerprint to lowercase hex with no prefix or spaces. Returns null if malformed. */
-declare function normalizeFingerprint(input: string): string | null;
-/** Fingerprint → the raw `bytes` argument the v2 registry takes (0x-prefixed, 20 or 32 bytes). */
-declare function fingerprintToBytes(fingerprint: string): Hex;
-/** Raw `bytes` from the registry → lowercase hex fingerprint without 0x. */
-declare function bytesToFingerprint(bytes: Hex | string): string;
-/** keccak256 of the raw fingerprint bytes — the `fingerprintHash` the registry indexes by. */
-declare function fingerprintHash(fingerprint: string): Hex;
 /**
- * The long key ID as the `bytes8` the registry indexes by. Per RFC 9580 §5.5.4 it is the
- * low-order 8 bytes of a v4 (20-byte) fingerprint and the high-order 8 bytes of a v6
- * (32-byte) fingerprint — the same value `gpg --keyid-format long` prints.
+ * The `id.thurin` ENS text record points a name at the key its address claimed. A hint, not trust:
+ * readers still resolve the name and verify the claim. It's an ENSIP-5 service key (reverse-dot of
+ * thurin.id), so per ENSIP-18 the value is bare: the fingerprint, uppercase.
  */
-declare function keyIdOf(fingerprint: string): Hex;
-/** A 16-hex long key ID (spaces/0x tolerated) → `bytes8`. */
-declare function keyIdToBytes(keyId: string): Hex | null;
+declare const ENS_HINT_KEY: "id.thurin";
+type EnsHintState = 'match' | 'unset' | 'mismatch';
+interface EnsHint {
+    key: typeof ENS_HINT_KEY;
+    state: EnsHintState;
+    /** The raw record value, or null when the name carries no record. */
+    record: string | null;
+    /** The record as a lowercase fingerprint, or null when it does not parse as one. */
+    fingerprint: string | null;
+    /** The verified claim's fingerprint (lowercase) the record is compared against, if any. */
+    expected: string | null;
+    /** Why a record does not match; absent for `match` and `unset`. */
+    reason?: string;
+}
+/**
+ * Compare a name's `id.thurin` record with the fingerprint the registry verifies for the
+ * name's address. Parsing is lenient (case, spaces, 0x); what Thurin writes is strict.
+ */
+declare function ensHintFor(record: string | null | undefined, verifiedFingerprint: string | null | undefined): EnsHint;
+/** The value Thurin writes: the fingerprint, uppercase, bare. */
+declare function ensHintValue(fingerprint: string): string;
+/** The `text` / `setText` pair every ENS resolver speaks (ENSIP-5); the same on ENSv2. */
+declare const ENS_TEXT_RESOLVER_ABI: readonly [{
+    readonly type: "function";
+    readonly name: "text";
+    readonly stateMutability: "view";
+    readonly inputs: readonly [{
+        readonly name: "node";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "key";
+        readonly type: "string";
+    }];
+    readonly outputs: readonly [{
+        readonly name: "";
+        readonly type: "string";
+    }];
+}, {
+    readonly type: "function";
+    readonly name: "setText";
+    readonly stateMutability: "nonpayable";
+    readonly inputs: readonly [{
+        readonly name: "node";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "key";
+        readonly type: "string";
+    }, {
+        readonly name: "value";
+        readonly type: "string";
+    }];
+    readonly outputs: readonly [];
+}];
+/**
+ * The `setText` call that links a name to a claim. Look up the resolver at write time
+ * (`client.getEnsResolver({ name })`): on ENSv2 every account has its own.
+ */
+declare function ensHintWrite(name: string, fingerprint: string): {
+    abi: readonly [{
+        readonly type: "function";
+        readonly name: "text";
+        readonly stateMutability: "view";
+        readonly inputs: readonly [{
+            readonly name: "node";
+            readonly type: "bytes32";
+        }, {
+            readonly name: "key";
+            readonly type: "string";
+        }];
+        readonly outputs: readonly [{
+            readonly name: "";
+            readonly type: "string";
+        }];
+    }, {
+        readonly type: "function";
+        readonly name: "setText";
+        readonly stateMutability: "nonpayable";
+        readonly inputs: readonly [{
+            readonly name: "node";
+            readonly type: "bytes32";
+        }, {
+            readonly name: "key";
+            readonly type: "string";
+        }, {
+            readonly name: "value";
+            readonly type: "string";
+        }];
+        readonly outputs: readonly [];
+    }];
+    functionName: "setText";
+    args: readonly [`0x${string}`, "id.thurin", string];
+    name: string;
+};
+/** Minimal client shape: viem's PublicClient has both. */
+interface EnsTextReader {
+    getEnsText(args: {
+        name: string;
+        key: string;
+    }): Promise<string | null>;
+}
+/** Read a name's `id.thurin` record and compare it with the verified fingerprint. */
+declare function fetchEnsHint(client: EnsTextReader, name: string, verifiedFingerprint: string | null | undefined): Promise<EnsHint>;
 
-export { ARWEAVE_GATEWAY, AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, CLAIM_CHECK_LABEL, type ClaimCheckKind, type ClaimCheckText, type ClaimFate, type EFPGraph, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EnsHint, type EnsHintState, type EnsTextReader, FARCASTER_HUB, IDENTITY_ERROR_TEXT, IDENTITY_KINDS, IPFS_GATEWAY, IPFS_GATEWAYS, type IdentityErrorKind, type IdentityKitConfig, type IdentityLookupState, KNOWN_KINDS, type KnownKind, MAX_RECORD_BYTES, NETWORKS, NFT_AVATAR_ABI, type NetworkName, type NftAvatar, type Notation, type PGPKeyInfo, type PGPVerification, type ParsedRecord, type PointerEntry, type PointerRecord, type Proof, type ProofOptions, type ProofResult, REGISTRY_ABI, REGISTRY_ADDRESS, type ReattestAuthorization, type RecordData, type RecordReader, type RegistryDeployment, type RevokeAuthorization, type SetRecordAuthorization, type StrippedKey, type SubkeyInfo, type Theme, type ThurinIdentity, type UpdateKeyAuthorization, addPointer, attestTypedData, authorizationDigest, avatarFallbacks, avatarUrl, bytesToFingerprint, chainFor, claimCheckText, claimFateText, claimFates, decodeRecord, displayUrl, encodeRecord, ensHintFor, ensHintValue, ensHintWrite, expiresSoon, expiresSoonText, fetchEFPGraph, fetchEnsHint, fetchRecords, fingerprintHash, fingerprintToBytes, formatClaimDate, getRegistry, hasEmailUserID, identifyProof, identityErrorKind, isNetworkName, keyIdOf, keyIdToBytes, kindName, needsRpcProbe, nftAvatarImage, normalizeFingerprint, parseNftAvatar, parsePgpKey, parsePointer, parseRecord, proofHref, proofSecondaryHref, reattestTypedData, recordKind, registryDomain, renderPointer, revokeTypedData, setRecordTypedData, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyClearsigned, verifyProof };
+export { ARWEAVE_GATEWAY, AUTHORIZATION_TYPES, type AttestAuthorization, type Attestation, type AuthorizationAction, CLAIM_CHECK_LABEL, CLAIM_LIMIT, CONTRACT_ERROR_TEXT, type ClaimCheckKind, type ClaimCheckText, type ClaimFate, type ClaimReader, EIP712_NAME, EIP712_VERSION, ENS_HINT_KEY, ENS_TEXT_RESOLVER_ABI, type EncryptRefusal, type EncryptionKey, type EncryptionKeyResult, type EnsHint, type EnsHintState, type EnsTextReader, FARCASTER_HUB, IPFS_GATEWAY, IPFS_GATEWAYS, KNOWN_KINDS, type KeyStanding, type KnownKind, type LeanKey, MAX_KIND_BYTES, MAX_RECORD_BYTES, type MarkCompromisedAuthorization, NETWORKS, NFT_AVATAR_ABI, type NetworkName, type NftAvatar, type Notation, OWNER_REVOKE_REASONS, type PGPKeyInfo, type PGPVerification, type ParsedRecord, type PermissionCheck, type PermissionReader, type PgpInput, type Proof, type ProofOptions, REGISTRY_ABI, REGISTRY_ADDRESS, REVOKE_REASONS, type ReattestAuthorization, type RecordData, type RecordReader, type RegistryDeployment, type ReleaseEntry, type ReleasesRecord, type RevokeAuthorization, type RevokeReason, type SetRecordAuthorization, type SshKey, type StrippedKey, type SubkeyInfo, type UpdateKeyAuthorization, addRelease, attestTypedData, authorizationDigest, avatarFallbacks, avatarUrl, bytesToFingerprint, chainFor, checkKindName, checkRecordValue, claimCheckText, claimFateText, claimFates, claimSignature, contractErrorName, contractErrorText, displayUrl, encryptRefusalText, encryptTo, encryptionKeyFor, ensHintFor, ensHintValue, ensHintWrite, expiresSoon, expiresSoonText, fetchEnsHint, fetchRecords, findOwners, fingerprintHash, fingerprintToBytes, formatClaimDate, getRegistry, hasEmailUserID, identifyProof, isNetworkName, keyChangedText, keyIdOf, keyIdToBytes, keyProblemText, keyStanding, kindName, leanKey, markCompromisedTypedData, nftAvatarImage, normalizeFingerprint, pageRecords, parseNftAvatar, parsePgpKey, parseRecord, parseReleases, payloadText, permissionSigned, pickRecords, proofHref, proofSecondaryHref, readClaims, reattestTypedData, recordKind, registryDomain, renderReleases, revokeTypedData, sameFingerprint, setRecordTypedData, signatureEmail, sshKeys, statementText, stripEmailUserIDs, updateKeyTypedData, verifyAttestation, verifyClearsigned, verifyProof, verifyStatementSignature };