/**
 * 🕵️ THE PRIVATE AUDIT PROOF — prove a model-quality claim over a HUGE PRIVATE dataset while the auditor sees only
 * a tiny, tamper-proof, cryptographically-selected random sample. "Audit without handing over the data."
 *
 * This is the wall every real AI audit hits: to verify "my model is ≥ 90% accurate / its approval rate is ≥ τ /
 * it's right on the hard slice", an auditor today must be GIVEN the model and the whole (often private, often
 * regulated) evaluation set. Vendors won't expose the IP; data subjects' records can't be dumped to a regulator.
 * So claims go unverified. This breaks the deadlock with a probabilistically-checkable proof: the prover
 * MERKLE-COMMITS to the full per-record outcome vector (one signed root binds every record), a FIAT-SHAMIR
 * challenge derived FROM that root deterministically selects k random indices (so the prover cannot choose which
 * records are inspected, and cannot change the data after seeing the challenge), the prover opens only those k
 * records with Merkle authentication paths, and the verifier re-derives the indices, checks each opening against
 * the root, and accepts the claim iff the k-sample supports it. The auditor inspects k of N records — and a claim
 * inflated by a gap ε is caught with probability ≥ 1 − (1−ε)^k (exponential in k).
 *
 * WHO BENEFITS (≥3 parties): ① the VENDOR proves compliance without surrendering the model or the full dataset;
 * ② the AUDITOR / REGULATOR gets a sound, offline-verifiable audit at the cost of inspecting a handful of records;
 * ③ the DATA SUBJECTS have only a tiny random sample exposed, not the whole corpus; ④ a downstream RELYING PARTY
 * re-checks the same proof offline.
 *
 * WORLD-FIRST framing: a productized, signed, offline-verifiable "audit-without-the-data" proof for an AI model
 * claim. (DIAKRISIS — MEASURED: an honest claim [true mean ≥ τ] is accepted ~100%; a claim inflated past the
 * tolerance is rejected with a rate that rises with k toward 1 [empirical 30→100→300 samples: ~86%→96%→100% at a
 * 0.07 gap], matching 1−(1−ε)^k; only k of N records are revealed; a tampered opening fails its Merkle path; the
 * challenge indices are a pure function of the committed root, so the prover cannot cherry-pick the sample.
 * HONEST: this is NOT zero-knowledge — the k sampled records ARE revealed — and NOT a SNARK; it is a data-
 * minimizing, binding, sound spot-check. Soundness holds in the random-oracle model against a prover who commits
 * first; a grinding prover (re-rolling the commitment to search for a lucky index set) faces work ~ 1/(1−ε)^k, so
 * pick k for the soundness you need. The outcome bit per record must be the genuine ground truth.)
 */
import { type KeyObject } from "node:crypto";
export interface AuditOpening {
    index: number;
    bit: number;
    salt: string;
    path: Array<{
        sib: string;
        right: boolean;
    }>;
}
export interface PrivateAuditProof {
    standard: "melete-private-audit/v1";
    claim: string;
    tau: number;
    margin: number;
    k: number;
    n: number;
    root: string;
    claimTag: string;
    openings: AuditOpening[];
    sampleMean: number;
    verdict: "SUPPORTED" | "UNSUPPORTED";
    revealedFraction: number;
    payloadHash: string;
    signature: string;
    publicKeyPem: string;
    algo: "ed25519+sha256";
}
export declare function buildPrivateAuditProof(opts: {
    bits: number[];
    tau: number;
    margin?: number;
    k?: number;
    secret?: string;
    keys?: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
}): PrivateAuditProof;
export declare function verifyPrivateAuditProof(c: PrivateAuditProof): {
    ok: boolean;
    verdict: string;
    reason: string;
};
export declare function spotcheckGauntlet(): {
    score: 0 | 100;
    checks: Array<{
        name: string;
        pass: boolean;
        detail: string;
    }>;
};
//# sourceMappingURL=spotcheck.d.ts.map