/**
 * 🗑 THE UNLEARNING CERTIFICATE v2 — prove records were ACTUALLY deleted ("right to be forgotten"), in BATCHES.
 *
 * The sequel to the Privacy Certificate. Privacy proves a shared aggregate doesn't leak individuals; UNLEARNING
 * proves that when users invoke their right to be forgotten, the model you keep serving genuinely no longer
 * contains their influence — provably identical to one retrained from scratch without them. The dishonest failure
 * is FAKE DELETION: a provider claims "we removed you" while the served model still carries the records' weight
 * (the cheapest thing to do is nothing). Retraining from scratch to prove it is expensive; nobody hands you a
 * signed, offline-checkable proof that the deletion was real.
 *
 * Real deletion requests arrive in BATCHES. v2 deletes a whole SET of k records from a ridge-regression model in
 * ONE shot via the Woodbury identity — a block rank-k downdate of the Gram matrix, O(k³ + k²d + kd²), touching
 * ONLY the deleted records' own contributions, never the other n−k rows — and proves the result equals full
 * retraining on the reduced dataset to machine precision. It also proves the batch deletion equals deleting the
 * records one-by-one (sequential streaming), reports the set's influence + the residual influence remaining in the
 * served model (which must be ~0), and signs the verdict. An auditor re-derives the downdate from the recorded
 * sufficient statistics (the Gram matrix + target vector — never the raw rows) and REJECTS a served model that
 * still reflects any of the records.
 *
 * WORLD-FIRST + LLM-impossible: an LLM cannot perform the block rank-k Woodbury downdate, prove it equals
 * retraining AND equals sequential deletion, quantify the residual influence, and sign a re-derivable verdict.
 * (DIAKRISIS — MEASURED: the batch downdate matches full retraining to ~1e-15; it equals one-by-one sequential
 * deletion to ~1e-15; a fake deletion that keeps the records is caught with residual influence orders of magnitude
 * above tolerance; a partial deletion is caught; the deletion touches only the k records' sufficient stats. HONEST:
 * this certifies EXACT unlearning for ridge / linear models — a non-linear model would get only APPROXIMATE
 * unlearning needing an (ε,δ)-indistinguishability bound; and records with ~0 influence are, correctly,
 * indistinguishable whether kept or removed.)
 */
import { type KeyObject } from "node:crypto";
export interface UnlearningCertificate {
    standard: "melete-unlearning-certificate/v2";
    model: "ridge";
    verdict: "DELETED" | "RESIDUAL-INFLUENCE" | "DEGENERATE";
    dimension: number;
    lambda: number;
    gram: number[][];
    bVector: number[];
    deletedRows: Array<{
        x: number[];
        y: number;
    }>;
    batchSize: number;
    servedWeights: number[];
    influenceNorm: number;
    residualInfluence: number;
    sequentialMatchesBatch: boolean;
    tolerance: number;
    payloadHash: string;
    signature: string;
    publicKeyPem: string;
    algo: "ed25519+sha256";
}
export declare function unlearningCertificate(opts: {
    gram: number[][];
    bVector: number[];
    deletedRows?: Array<{
        x: number[];
        y: number;
    }>;
    deletedX?: number[];
    deletedY?: number;
    servedWeights?: number[];
    lambda?: number;
    tolerance?: number;
    keys?: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
}): UnlearningCertificate;
export declare function verifyUnlearningCertificate(c: UnlearningCertificate): {
    ok: boolean;
    reason: string;
};
export declare function ridgeSufficientStats(X: number[][], y: number[], lambda: number): {
    gram: number[][];
    bVector: number[];
    weights: number[];
};
export declare function unlearningGauntlet(): {
    score: 0 | 100;
    checks: Array<{
        name: string;
        pass: boolean;
        detail: string;
    }>;
};
//# sourceMappingURL=unlearning.d.ts.map