proofseal 0.0.1 → 0.1.0

package/dist/manifest/schema.d.ts

@@ -0,0 +1,1068 @@
+/**
+ * proofseal/v1 manifest schema — types + zod validation (ADR-0001 §5.3).
+ */
+import { z } from 'zod';
+export declare const SCHEMA_ID = "proofseal/v1";
+export declare const ToleranceSchema: z.ZodObject<{
+    rtol: z.ZodNumber;
+    atol: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    rtol: number;
+    atol: number;
+}, {
+    rtol: number;
+    atol: number;
+}>;
+export type Tolerance = z.infer<typeof ToleranceSchema>;
+export declare const FileHashClaimSchema: z.ZodObject<{
+    type: z.ZodLiteral<"file-hash">;
+    file: z.ZodString;
+    /** Computed at seal time; optional in config. */
+    sha256: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+    desc: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "file-hash";
+    file: string;
+    id: string;
+    sha256?: string | undefined;
+    desc?: string | undefined;
+}, {
+    type: "file-hash";
+    file: string;
+    id: string;
+    sha256?: string | undefined;
+    desc?: string | undefined;
+}>;
+export type FileHashClaim = z.infer<typeof FileHashClaimSchema>;
+export declare const MarkerClaimSchema: z.ZodObject<{
+    type: z.ZodLiteral<"marker">;
+    file: z.ZodString;
+    marker: z.ZodString;
+    /** Computed at seal time; optional in config. */
+    sha256: z.ZodOptional<z.ZodString>;
+    markerVerified: z.ZodOptional<z.ZodBoolean>;
+    id: z.ZodString;
+    desc: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "marker";
+    file: string;
+    id: string;
+    marker: string;
+    sha256?: string | undefined;
+    desc?: string | undefined;
+    markerVerified?: boolean | undefined;
+}, {
+    type: "marker";
+    file: string;
+    id: string;
+    marker: string;
+    sha256?: string | undefined;
+    desc?: string | undefined;
+    markerVerified?: boolean | undefined;
+}>;
+export type MarkerClaim = z.infer<typeof MarkerClaimSchema>;
+export declare const HarnessClaimSchema: z.ZodObject<{
+    type: z.ZodLiteral<"harness">;
+    /** Harness name (defaults to claim id when omitted in config). */
+    harness: z.ZodString;
+    /** Command spawned with PROOFSEAL_SEED in env. */
+    cmd: z.ZodString;
+    seed: z.ZodOptional<z.ZodNumber>;
+    quantizeDecimals: z.ZodOptional<z.ZodNumber>;
+    /** Named output blocks to exclude from hashing (pitfall 6: un-hashable features). */
+    exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Committed expectation — set by `proofseal harness run --update`. */
+    expectedSha256: z.ZodOptional<z.ZodString>;
+    /** Path (relative to root) to a committed JSON array of reference numbers. */
+    referenceVector: z.ZodOptional<z.ZodString>;
+    tolerance: z.ZodOptional<z.ZodObject<{
+        rtol: z.ZodNumber;
+        atol: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        rtol: number;
+        atol: number;
+    }, {
+        rtol: number;
+        atol: number;
+    }>>;
+    id: z.ZodString;
+    desc: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "harness";
+    id: string;
+    harness: string;
+    cmd: string;
+    desc?: string | undefined;
+    seed?: number | undefined;
+    quantizeDecimals?: number | undefined;
+    exclude?: string[] | undefined;
+    expectedSha256?: string | undefined;
+    referenceVector?: string | undefined;
+    tolerance?: {
+        rtol: number;
+        atol: number;
+    } | undefined;
+}, {
+    type: "harness";
+    id: string;
+    harness: string;
+    cmd: string;
+    desc?: string | undefined;
+    seed?: number | undefined;
+    quantizeDecimals?: number | undefined;
+    exclude?: string[] | undefined;
+    expectedSha256?: string | undefined;
+    referenceVector?: string | undefined;
+    tolerance?: {
+        rtol: number;
+        atol: number;
+    } | undefined;
+}>;
+export type HarnessClaim = z.infer<typeof HarnessClaimSchema>;
+export declare const ClaimSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"file-hash">;
+    file: z.ZodString;
+    /** Computed at seal time; optional in config. */
+    sha256: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+    desc: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "file-hash";
+    file: string;
+    id: string;
+    sha256?: string | undefined;
+    desc?: string | undefined;
+}, {
+    type: "file-hash";
+    file: string;
+    id: string;
+    sha256?: string | undefined;
+    desc?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"marker">;
+    file: z.ZodString;
+    marker: z.ZodString;
+    /** Computed at seal time; optional in config. */
+    sha256: z.ZodOptional<z.ZodString>;
+    markerVerified: z.ZodOptional<z.ZodBoolean>;
+    id: z.ZodString;
+    desc: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "marker";
+    file: string;
+    id: string;
+    marker: string;
+    sha256?: string | undefined;
+    desc?: string | undefined;
+    markerVerified?: boolean | undefined;
+}, {
+    type: "marker";
+    file: string;
+    id: string;
+    marker: string;
+    sha256?: string | undefined;
+    desc?: string | undefined;
+    markerVerified?: boolean | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"harness">;
+    /** Harness name (defaults to claim id when omitted in config). */
+    harness: z.ZodString;
+    /** Command spawned with PROOFSEAL_SEED in env. */
+    cmd: z.ZodString;
+    seed: z.ZodOptional<z.ZodNumber>;
+    quantizeDecimals: z.ZodOptional<z.ZodNumber>;
+    /** Named output blocks to exclude from hashing (pitfall 6: un-hashable features). */
+    exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Committed expectation — set by `proofseal harness run --update`. */
+    expectedSha256: z.ZodOptional<z.ZodString>;
+    /** Path (relative to root) to a committed JSON array of reference numbers. */
+    referenceVector: z.ZodOptional<z.ZodString>;
+    tolerance: z.ZodOptional<z.ZodObject<{
+        rtol: z.ZodNumber;
+        atol: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        rtol: number;
+        atol: number;
+    }, {
+        rtol: number;
+        atol: number;
+    }>>;
+    id: z.ZodString;
+    desc: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "harness";
+    id: string;
+    harness: string;
+    cmd: string;
+    desc?: string | undefined;
+    seed?: number | undefined;
+    quantizeDecimals?: number | undefined;
+    exclude?: string[] | undefined;
+    expectedSha256?: string | undefined;
+    referenceVector?: string | undefined;
+    tolerance?: {
+        rtol: number;
+        atol: number;
+    } | undefined;
+}, {
+    type: "harness";
+    id: string;
+    harness: string;
+    cmd: string;
+    desc?: string | undefined;
+    seed?: number | undefined;
+    quantizeDecimals?: number | undefined;
+    exclude?: string[] | undefined;
+    expectedSha256?: string | undefined;
+    referenceVector?: string | undefined;
+    tolerance?: {
+        rtol: number;
+        atol: number;
+    } | undefined;
+}>]>;
+export type Claim = z.infer<typeof ClaimSchema>;
+export declare const SummarySchema: z.ZodObject<{
+    totalClaims: z.ZodNumber;
+    verified: z.ZodNumber;
+    missing: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    totalClaims: number;
+    verified: number;
+    missing: number;
+}, {
+    totalClaims: number;
+    verified: number;
+    missing: number;
+}>;
+export type ManifestSummary = z.infer<typeof SummarySchema>;
+/**
+ * Sealing environment (premortem #3: platform honesty). Recorded — and
+ * therefore signed — at seal time so verify can warn when the verifying OS
+ * differs (built/binary artifact hashes legitimately diverge across OSes).
+ */
+export declare const PlatformSchema: z.ZodObject<{
+    os: z.ZodString;
+    arch: z.ZodString;
+    node: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    os: string;
+    arch: string;
+    node: string;
+}, {
+    os: string;
+    arch: string;
+    node: string;
+}>;
+export type ManifestPlatform = z.infer<typeof PlatformSchema>;
+export declare const ManifestSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"proofseal/v1">;
+    issuedAt: z.ZodString;
+    gitCommit: z.ZodString;
+    branch: z.ZodString;
+    salt: z.ZodString;
+    releases: z.ZodRecord<z.ZodString, z.ZodString>;
+    summary: z.ZodObject<{
+        totalClaims: z.ZodNumber;
+        verified: z.ZodNumber;
+        missing: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        totalClaims: number;
+        verified: number;
+        missing: number;
+    }, {
+        totalClaims: number;
+        verified: number;
+        missing: number;
+    }>;
+    claims: z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"file-hash">;
+        file: z.ZodString;
+        /** Computed at seal time; optional in config. */
+        sha256: z.ZodOptional<z.ZodString>;
+        id: z.ZodString;
+        desc: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "file-hash";
+        file: string;
+        id: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+    }, {
+        type: "file-hash";
+        file: string;
+        id: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"marker">;
+        file: z.ZodString;
+        marker: z.ZodString;
+        /** Computed at seal time; optional in config. */
+        sha256: z.ZodOptional<z.ZodString>;
+        markerVerified: z.ZodOptional<z.ZodBoolean>;
+        id: z.ZodString;
+        desc: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "marker";
+        file: string;
+        id: string;
+        marker: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+        markerVerified?: boolean | undefined;
+    }, {
+        type: "marker";
+        file: string;
+        id: string;
+        marker: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+        markerVerified?: boolean | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"harness">;
+        /** Harness name (defaults to claim id when omitted in config). */
+        harness: z.ZodString;
+        /** Command spawned with PROOFSEAL_SEED in env. */
+        cmd: z.ZodString;
+        seed: z.ZodOptional<z.ZodNumber>;
+        quantizeDecimals: z.ZodOptional<z.ZodNumber>;
+        /** Named output blocks to exclude from hashing (pitfall 6: un-hashable features). */
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Committed expectation — set by `proofseal harness run --update`. */
+        expectedSha256: z.ZodOptional<z.ZodString>;
+        /** Path (relative to root) to a committed JSON array of reference numbers. */
+        referenceVector: z.ZodOptional<z.ZodString>;
+        tolerance: z.ZodOptional<z.ZodObject<{
+            rtol: z.ZodNumber;
+            atol: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            rtol: number;
+            atol: number;
+        }, {
+            rtol: number;
+            atol: number;
+        }>>;
+        id: z.ZodString;
+        desc: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "harness";
+        id: string;
+        harness: string;
+        cmd: string;
+        desc?: string | undefined;
+        seed?: number | undefined;
+        quantizeDecimals?: number | undefined;
+        exclude?: string[] | undefined;
+        expectedSha256?: string | undefined;
+        referenceVector?: string | undefined;
+        tolerance?: {
+            rtol: number;
+            atol: number;
+        } | undefined;
+    }, {
+        type: "harness";
+        id: string;
+        harness: string;
+        cmd: string;
+        desc?: string | undefined;
+        seed?: number | undefined;
+        quantizeDecimals?: number | undefined;
+        exclude?: string[] | undefined;
+        expectedSha256?: string | undefined;
+        referenceVector?: string | undefined;
+        tolerance?: {
+            rtol: number;
+            atol: number;
+        } | undefined;
+    }>]>, "many">;
+    /** Optional for backward compat: pre-platform manifests still validate. */
+    platform: z.ZodOptional<z.ZodObject<{
+        os: z.ZodString;
+        arch: z.ZodString;
+        node: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        os: string;
+        arch: string;
+        node: string;
+    }, {
+        os: string;
+        arch: string;
+        node: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    schema: "proofseal/v1";
+    issuedAt: string;
+    gitCommit: string;
+    branch: string;
+    salt: string;
+    releases: Record<string, string>;
+    summary: {
+        totalClaims: number;
+        verified: number;
+        missing: number;
+    };
+    claims: ({
+        type: "file-hash";
+        file: string;
+        id: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+    } | {
+        type: "marker";
+        file: string;
+        id: string;
+        marker: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+        markerVerified?: boolean | undefined;
+    } | {
+        type: "harness";
+        id: string;
+        harness: string;
+        cmd: string;
+        desc?: string | undefined;
+        seed?: number | undefined;
+        quantizeDecimals?: number | undefined;
+        exclude?: string[] | undefined;
+        expectedSha256?: string | undefined;
+        referenceVector?: string | undefined;
+        tolerance?: {
+            rtol: number;
+            atol: number;
+        } | undefined;
+    })[];
+    platform?: {
+        os: string;
+        arch: string;
+        node: string;
+    } | undefined;
+}, {
+    schema: "proofseal/v1";
+    issuedAt: string;
+    gitCommit: string;
+    branch: string;
+    salt: string;
+    releases: Record<string, string>;
+    summary: {
+        totalClaims: number;
+        verified: number;
+        missing: number;
+    };
+    claims: ({
+        type: "file-hash";
+        file: string;
+        id: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+    } | {
+        type: "marker";
+        file: string;
+        id: string;
+        marker: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+        markerVerified?: boolean | undefined;
+    } | {
+        type: "harness";
+        id: string;
+        harness: string;
+        cmd: string;
+        desc?: string | undefined;
+        seed?: number | undefined;
+        quantizeDecimals?: number | undefined;
+        exclude?: string[] | undefined;
+        expectedSha256?: string | undefined;
+        referenceVector?: string | undefined;
+        tolerance?: {
+            rtol: number;
+            atol: number;
+        } | undefined;
+    })[];
+    platform?: {
+        os: string;
+        arch: string;
+        node: string;
+    } | undefined;
+}>;
+export type Manifest = z.infer<typeof ManifestSchema>;
+export declare const IntegritySchema: z.ZodObject<{
+    manifestHashAlgo: z.ZodLiteral<"sha256">;
+    manifestHash: z.ZodString;
+    signatureAlgo: z.ZodLiteral<"ed25519">;
+    publicKey: z.ZodString;
+    signature: z.ZodString;
+    seedDerivation: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    manifestHashAlgo: "sha256";
+    manifestHash: string;
+    signatureAlgo: "ed25519";
+    publicKey: string;
+    signature: string;
+    seedDerivation: string;
+}, {
+    manifestHashAlgo: "sha256";
+    manifestHash: string;
+    signatureAlgo: "ed25519";
+    publicKey: string;
+    signature: string;
+    seedDerivation: string;
+}>;
+export type Integrity = z.infer<typeof IntegritySchema>;
+export declare const WitnessSchema: z.ZodObject<{
+    manifest: z.ZodObject<{
+        schema: z.ZodLiteral<"proofseal/v1">;
+        issuedAt: z.ZodString;
+        gitCommit: z.ZodString;
+        branch: z.ZodString;
+        salt: z.ZodString;
+        releases: z.ZodRecord<z.ZodString, z.ZodString>;
+        summary: z.ZodObject<{
+            totalClaims: z.ZodNumber;
+            verified: z.ZodNumber;
+            missing: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            totalClaims: number;
+            verified: number;
+            missing: number;
+        }, {
+            totalClaims: number;
+            verified: number;
+            missing: number;
+        }>;
+        claims: z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+            type: z.ZodLiteral<"file-hash">;
+            file: z.ZodString;
+            /** Computed at seal time; optional in config. */
+            sha256: z.ZodOptional<z.ZodString>;
+            id: z.ZodString;
+            desc: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "file-hash";
+            file: string;
+            id: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+        }, {
+            type: "file-hash";
+            file: string;
+            id: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"marker">;
+            file: z.ZodString;
+            marker: z.ZodString;
+            /** Computed at seal time; optional in config. */
+            sha256: z.ZodOptional<z.ZodString>;
+            markerVerified: z.ZodOptional<z.ZodBoolean>;
+            id: z.ZodString;
+            desc: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "marker";
+            file: string;
+            id: string;
+            marker: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+            markerVerified?: boolean | undefined;
+        }, {
+            type: "marker";
+            file: string;
+            id: string;
+            marker: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+            markerVerified?: boolean | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"harness">;
+            /** Harness name (defaults to claim id when omitted in config). */
+            harness: z.ZodString;
+            /** Command spawned with PROOFSEAL_SEED in env. */
+            cmd: z.ZodString;
+            seed: z.ZodOptional<z.ZodNumber>;
+            quantizeDecimals: z.ZodOptional<z.ZodNumber>;
+            /** Named output blocks to exclude from hashing (pitfall 6: un-hashable features). */
+            exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Committed expectation — set by `proofseal harness run --update`. */
+            expectedSha256: z.ZodOptional<z.ZodString>;
+            /** Path (relative to root) to a committed JSON array of reference numbers. */
+            referenceVector: z.ZodOptional<z.ZodString>;
+            tolerance: z.ZodOptional<z.ZodObject<{
+                rtol: z.ZodNumber;
+                atol: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                rtol: number;
+                atol: number;
+            }, {
+                rtol: number;
+                atol: number;
+            }>>;
+            id: z.ZodString;
+            desc: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "harness";
+            id: string;
+            harness: string;
+            cmd: string;
+            desc?: string | undefined;
+            seed?: number | undefined;
+            quantizeDecimals?: number | undefined;
+            exclude?: string[] | undefined;
+            expectedSha256?: string | undefined;
+            referenceVector?: string | undefined;
+            tolerance?: {
+                rtol: number;
+                atol: number;
+            } | undefined;
+        }, {
+            type: "harness";
+            id: string;
+            harness: string;
+            cmd: string;
+            desc?: string | undefined;
+            seed?: number | undefined;
+            quantizeDecimals?: number | undefined;
+            exclude?: string[] | undefined;
+            expectedSha256?: string | undefined;
+            referenceVector?: string | undefined;
+            tolerance?: {
+                rtol: number;
+                atol: number;
+            } | undefined;
+        }>]>, "many">;
+        /** Optional for backward compat: pre-platform manifests still validate. */
+        platform: z.ZodOptional<z.ZodObject<{
+            os: z.ZodString;
+            arch: z.ZodString;
+            node: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            os: string;
+            arch: string;
+            node: string;
+        }, {
+            os: string;
+            arch: string;
+            node: string;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        schema: "proofseal/v1";
+        issuedAt: string;
+        gitCommit: string;
+        branch: string;
+        salt: string;
+        releases: Record<string, string>;
+        summary: {
+            totalClaims: number;
+            verified: number;
+            missing: number;
+        };
+        claims: ({
+            type: "file-hash";
+            file: string;
+            id: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+        } | {
+            type: "marker";
+            file: string;
+            id: string;
+            marker: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+            markerVerified?: boolean | undefined;
+        } | {
+            type: "harness";
+            id: string;
+            harness: string;
+            cmd: string;
+            desc?: string | undefined;
+            seed?: number | undefined;
+            quantizeDecimals?: number | undefined;
+            exclude?: string[] | undefined;
+            expectedSha256?: string | undefined;
+            referenceVector?: string | undefined;
+            tolerance?: {
+                rtol: number;
+                atol: number;
+            } | undefined;
+        })[];
+        platform?: {
+            os: string;
+            arch: string;
+            node: string;
+        } | undefined;
+    }, {
+        schema: "proofseal/v1";
+        issuedAt: string;
+        gitCommit: string;
+        branch: string;
+        salt: string;
+        releases: Record<string, string>;
+        summary: {
+            totalClaims: number;
+            verified: number;
+            missing: number;
+        };
+        claims: ({
+            type: "file-hash";
+            file: string;
+            id: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+        } | {
+            type: "marker";
+            file: string;
+            id: string;
+            marker: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+            markerVerified?: boolean | undefined;
+        } | {
+            type: "harness";
+            id: string;
+            harness: string;
+            cmd: string;
+            desc?: string | undefined;
+            seed?: number | undefined;
+            quantizeDecimals?: number | undefined;
+            exclude?: string[] | undefined;
+            expectedSha256?: string | undefined;
+            referenceVector?: string | undefined;
+            tolerance?: {
+                rtol: number;
+                atol: number;
+            } | undefined;
+        })[];
+        platform?: {
+            os: string;
+            arch: string;
+            node: string;
+        } | undefined;
+    }>;
+    integrity: z.ZodObject<{
+        manifestHashAlgo: z.ZodLiteral<"sha256">;
+        manifestHash: z.ZodString;
+        signatureAlgo: z.ZodLiteral<"ed25519">;
+        publicKey: z.ZodString;
+        signature: z.ZodString;
+        seedDerivation: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        manifestHashAlgo: "sha256";
+        manifestHash: string;
+        signatureAlgo: "ed25519";
+        publicKey: string;
+        signature: string;
+        seedDerivation: string;
+    }, {
+        manifestHashAlgo: "sha256";
+        manifestHash: string;
+        signatureAlgo: "ed25519";
+        publicKey: string;
+        signature: string;
+        seedDerivation: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    manifest: {
+        schema: "proofseal/v1";
+        issuedAt: string;
+        gitCommit: string;
+        branch: string;
+        salt: string;
+        releases: Record<string, string>;
+        summary: {
+            totalClaims: number;
+            verified: number;
+            missing: number;
+        };
+        claims: ({
+            type: "file-hash";
+            file: string;
+            id: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+        } | {
+            type: "marker";
+            file: string;
+            id: string;
+            marker: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+            markerVerified?: boolean | undefined;
+        } | {
+            type: "harness";
+            id: string;
+            harness: string;
+            cmd: string;
+            desc?: string | undefined;
+            seed?: number | undefined;
+            quantizeDecimals?: number | undefined;
+            exclude?: string[] | undefined;
+            expectedSha256?: string | undefined;
+            referenceVector?: string | undefined;
+            tolerance?: {
+                rtol: number;
+                atol: number;
+            } | undefined;
+        })[];
+        platform?: {
+            os: string;
+            arch: string;
+            node: string;
+        } | undefined;
+    };
+    integrity: {
+        manifestHashAlgo: "sha256";
+        manifestHash: string;
+        signatureAlgo: "ed25519";
+        publicKey: string;
+        signature: string;
+        seedDerivation: string;
+    };
+}, {
+    manifest: {
+        schema: "proofseal/v1";
+        issuedAt: string;
+        gitCommit: string;
+        branch: string;
+        salt: string;
+        releases: Record<string, string>;
+        summary: {
+            totalClaims: number;
+            verified: number;
+            missing: number;
+        };
+        claims: ({
+            type: "file-hash";
+            file: string;
+            id: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+        } | {
+            type: "marker";
+            file: string;
+            id: string;
+            marker: string;
+            sha256?: string | undefined;
+            desc?: string | undefined;
+            markerVerified?: boolean | undefined;
+        } | {
+            type: "harness";
+            id: string;
+            harness: string;
+            cmd: string;
+            desc?: string | undefined;
+            seed?: number | undefined;
+            quantizeDecimals?: number | undefined;
+            exclude?: string[] | undefined;
+            expectedSha256?: string | undefined;
+            referenceVector?: string | undefined;
+            tolerance?: {
+                rtol: number;
+                atol: number;
+            } | undefined;
+        })[];
+        platform?: {
+            os: string;
+            arch: string;
+            node: string;
+        } | undefined;
+    };
+    integrity: {
+        manifestHashAlgo: "sha256";
+        manifestHash: string;
+        signatureAlgo: "ed25519";
+        publicKey: string;
+        signature: string;
+        seedDerivation: string;
+    };
+}>;
+export type Witness = z.infer<typeof WitnessSchema>;
+/** proofseal.json config file shape. */
+export declare const ConfigSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"proofseal/v1">;
+    salt: z.ZodOptional<z.ZodString>;
+    manifest: z.ZodOptional<z.ZodString>;
+    history: z.ZodOptional<z.ZodString>;
+    releases: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    claims: z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"file-hash">;
+        file: z.ZodString;
+        /** Computed at seal time; optional in config. */
+        sha256: z.ZodOptional<z.ZodString>;
+        id: z.ZodString;
+        desc: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "file-hash";
+        file: string;
+        id: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+    }, {
+        type: "file-hash";
+        file: string;
+        id: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"marker">;
+        file: z.ZodString;
+        marker: z.ZodString;
+        /** Computed at seal time; optional in config. */
+        sha256: z.ZodOptional<z.ZodString>;
+        markerVerified: z.ZodOptional<z.ZodBoolean>;
+        id: z.ZodString;
+        desc: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "marker";
+        file: string;
+        id: string;
+        marker: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+        markerVerified?: boolean | undefined;
+    }, {
+        type: "marker";
+        file: string;
+        id: string;
+        marker: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+        markerVerified?: boolean | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"harness">;
+        /** Harness name (defaults to claim id when omitted in config). */
+        harness: z.ZodString;
+        /** Command spawned with PROOFSEAL_SEED in env. */
+        cmd: z.ZodString;
+        seed: z.ZodOptional<z.ZodNumber>;
+        quantizeDecimals: z.ZodOptional<z.ZodNumber>;
+        /** Named output blocks to exclude from hashing (pitfall 6: un-hashable features). */
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Committed expectation — set by `proofseal harness run --update`. */
+        expectedSha256: z.ZodOptional<z.ZodString>;
+        /** Path (relative to root) to a committed JSON array of reference numbers. */
+        referenceVector: z.ZodOptional<z.ZodString>;
+        tolerance: z.ZodOptional<z.ZodObject<{
+            rtol: z.ZodNumber;
+            atol: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            rtol: number;
+            atol: number;
+        }, {
+            rtol: number;
+            atol: number;
+        }>>;
+        id: z.ZodString;
+        desc: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "harness";
+        id: string;
+        harness: string;
+        cmd: string;
+        desc?: string | undefined;
+        seed?: number | undefined;
+        quantizeDecimals?: number | undefined;
+        exclude?: string[] | undefined;
+        expectedSha256?: string | undefined;
+        referenceVector?: string | undefined;
+        tolerance?: {
+            rtol: number;
+            atol: number;
+        } | undefined;
+    }, {
+        type: "harness";
+        id: string;
+        harness: string;
+        cmd: string;
+        desc?: string | undefined;
+        seed?: number | undefined;
+        quantizeDecimals?: number | undefined;
+        exclude?: string[] | undefined;
+        expectedSha256?: string | undefined;
+        referenceVector?: string | undefined;
+        tolerance?: {
+            rtol: number;
+            atol: number;
+        } | undefined;
+    }>]>, "many">;
+}, "strip", z.ZodTypeAny, {
+    schema: "proofseal/v1";
+    claims: ({
+        type: "file-hash";
+        file: string;
+        id: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+    } | {
+        type: "marker";
+        file: string;
+        id: string;
+        marker: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+        markerVerified?: boolean | undefined;
+    } | {
+        type: "harness";
+        id: string;
+        harness: string;
+        cmd: string;
+        desc?: string | undefined;
+        seed?: number | undefined;
+        quantizeDecimals?: number | undefined;
+        exclude?: string[] | undefined;
+        expectedSha256?: string | undefined;
+        referenceVector?: string | undefined;
+        tolerance?: {
+            rtol: number;
+            atol: number;
+        } | undefined;
+    })[];
+    salt?: string | undefined;
+    releases?: Record<string, string> | undefined;
+    manifest?: string | undefined;
+    history?: string | undefined;
+}, {
+    schema: "proofseal/v1";
+    claims: ({
+        type: "file-hash";
+        file: string;
+        id: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+    } | {
+        type: "marker";
+        file: string;
+        id: string;
+        marker: string;
+        sha256?: string | undefined;
+        desc?: string | undefined;
+        markerVerified?: boolean | undefined;
+    } | {
+        type: "harness";
+        id: string;
+        harness: string;
+        cmd: string;
+        desc?: string | undefined;
+        seed?: number | undefined;
+        quantizeDecimals?: number | undefined;
+        exclude?: string[] | undefined;
+        expectedSha256?: string | undefined;
+        referenceVector?: string | undefined;
+        tolerance?: {
+            rtol: number;
+            atol: number;
+        } | undefined;
+    })[];
+    salt?: string | undefined;
+    releases?: Record<string, string> | undefined;
+    manifest?: string | undefined;
+    history?: string | undefined;
+}>;
+export type ProofSealConfig = z.infer<typeof ConfigSchema>;
+/** Per-claim verification status (ADR §5.6, ported from ruflo verify.mjs). */
+export type ClaimStatus = 'pass' | 'drift' | 'regressed' | 'missing';
+/** Result of refreshing a claim against the live tree at seal time. */
+export type ClaimState = Claim & {
+    missing: boolean;
+};