@interop/wallet-core 0.70.0 → 0.72.0

package/dist/keyring/unlockSpace.d.ts

@@ -32,109 +32,86 @@ export declare function ensureUnlockSpace({ storageServerUrl, zcapClient, spaceI
  * does not exist yet. A network / unreachable error propagates, so callers can
  * distinguish "no keyring" from "could not check".
  *
+ * With a `capability`, the `zcapClient` is an enrolled client's rather than
+ * the unlock identity's, and the attached management zcap (delegated by the
+ * unlock identity at bind time; it must allow GET) authorizes the read. This
+ * is what lets the revocation cascade's re-mint read a recovery code's
+ * standing record without holding the code: the record's code-authenticated
+ * binding rides the frame in the clear, so carrying it forward verbatim needs
+ * no decryption.
+ *
  * @param options {object}
  * @param options.storageServerUrl {string}
  * @param options.zcapClient {ZcapClient}
  * @param options.spaceId {string}   the unlock Space id
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the read is a root invocation
  * @returns {Promise<unknown | null>}
  */
-export declare function getUnlockKeyring({ storageServerUrl, zcapClient, spaceId }: {
+export declare function getUnlockKeyring({ storageServerUrl, zcapClient, spaceId, capability }: {
     storageServerUrl: string;
     zcapClient: ZcapClient;
     spaceId: string;
+    capability?: IZcap;
 }): Promise<unknown | null>;
 /**
  * Writes (upserts) the keyring record into the unlock Space as a JSON document.
  *
- * @param options {object}
- * @param options.storageServerUrl {string}
- * @param options.zcapClient {ZcapClient}
- * @param options.spaceId {string}   the unlock Space id
- * @param options.record {object}   the keyring record
- * @returns {Promise<void>}
- */
-export declare function putUnlockKeyring({ storageServerUrl, zcapClient, spaceId, record }: {
-    storageServerUrl: string;
-    zcapClient: ZcapClient;
-    spaceId: string;
-    record: object;
-}): Promise<void>;
-/**
- * Reads the keyring record with an explicitly attached management capability,
- * rather than by root invocation, or returns `null` when it does not exist.
- * The `zcapClient` here is an enrolled client's (not the unlock identity's);
- * the attached `capability` -- the management zcap the unlock identity
- * delegated at bind time, provided it allows GET -- authorizes the read
- * against the unlock Space. This is what lets the revocation cascade's
- * re-mint read a recovery code's standing record without holding the code:
- * the record's code-authenticated binding rides the frame in the clear, so
- * carrying it forward verbatim needs no decryption.
- *
- * @param options {object}
- * @param options.storageServerUrl {string}
- * @param options.zcapClient {ZcapClient}   an enrolled client's zcap client
- * @param options.spaceId {string}   the unlock Space id
- * @param options.capability {IZcap}   the delegated management zcap (must
- *   allow GET)
- * @returns {Promise<unknown | null>}
- */
-export declare function getUnlockKeyringWithCapability({ storageServerUrl, zcapClient, spaceId, capability }: {
-    storageServerUrl: string;
-    zcapClient: ZcapClient;
-    spaceId: string;
-    capability: IZcap;
-}): Promise<unknown | null>;
-/**
- * Writes (upserts) the keyring record with an explicitly attached management
- * capability, rather than by root invocation. The `zcapClient` here is an
- * enrolled client's (not the unlock identity's); the attached `capability` --
- * the management zcap the unlock identity delegated at bind time, provided it
- * allows PUT -- authorizes the write against the unlock Space. This is what
- * lets the revocation cascade re-PUT a recovery code's unlock record (a fresh
- * `did.jsonl` delegation inside a re-wrapped record) without holding the
- * code: the record's JWE recipient is the code's unlock KAK, whose PUBLIC
+ * With a `capability`, the `zcapClient` is an enrolled client's rather than
+ * the unlock identity's, and the attached management zcap (delegated by the
+ * unlock identity at bind time; it must allow PUT) authorizes the write. This
+ * is what lets the revocation cascade re-PUT a recovery code's unlock record
+ * (a fresh `did.jsonl` delegation inside a re-wrapped record) without holding
+ * the code: the record's JWE recipient is the code's unlock KAK, whose PUBLIC
  * half the issuing client recorded, so re-encryption needs no secret.
  *
  * @param options {object}
  * @param options.storageServerUrl {string}
- * @param options.zcapClient {ZcapClient}   an enrolled client's zcap client
+ * @param options.zcapClient {ZcapClient}
  * @param options.spaceId {string}   the unlock Space id
  * @param options.record {object}   the keyring record
- * @param options.capability {IZcap}   the delegated management zcap (must
- *   allow PUT)
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the write is a root invocation
  * @returns {Promise<void>}
  */
-export declare function putUnlockKeyringWithCapability({ storageServerUrl, zcapClient, spaceId, record, capability }: {
+export declare function putUnlockKeyring({ storageServerUrl, zcapClient, spaceId, record, capability }: {
     storageServerUrl: string;
     zcapClient: ZcapClient;
     spaceId: string;
     record: object;
-    capability: IZcap;
+    capability?: IZcap;
 }): Promise<void>;
 /**
  * Deletes the whole unlock Space (what retires an old passphrase on a
- * passphrase change). `space.delete()` is idempotent, so an already-absent
- * Space is a success.
+ * passphrase change, or a lost unlock method). The server's answer is
+ * reported rather than decided here: an already-absent Space comes back as
+ * `not-found`, and only a non-404 error propagates, so a caller that treats
+ * the delete as idempotent ignores the outcome.
+ *
+ * With a `capability`, the `zcapClient` is an enrolled client's rather than
+ * the unlock identity's, and the attached management zcap (delegated by the
+ * unlock identity to the data identity at bind time; it must allow DELETE on
+ * the Space's own URL) authorizes the delete -- retiring a lost unlock method
+ * without re-deriving its identity from the (possibly lost) secret. The
+ * server answers 404 both for an absent Space and for a refused capability,
+ * so `not-found` is not a statement of absence on its own.
  *
  * @param options {object}
  * @param options.storageServerUrl {string}
  * @param options.zcapClient {ZcapClient}
  * @param options.spaceId {string}   the unlock Space id
- * @returns {Promise<void>}
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the delete is a root invocation
+ * @returns {Promise<{ outcome: 'deleted' | 'not-found' }>}   `not-found`
+ *   when the server answered 404 (absent, or unauthorized under a
+ *   capability); every other error propagates unchanged
  */
-export declare function deleteUnlockSpace({ storageServerUrl, zcapClient, spaceId }: {
+export declare function deleteUnlockSpace({ storageServerUrl, zcapClient, spaceId, capability }: {
     storageServerUrl: string;
     zcapClient: ZcapClient;
     spaceId: string;
-}): Promise<void>;
-/**
- * The unlock Space's name for the one capability-authorized Space DELETE
- * ({@link deleteSpaceWithCapability}). The alias stands because an unlock
- * Space's deletion is the one this module's callers reach for -- retiring a
- * lost unlock method with the management zcap the unlock identity delegated
- * to the data identity at bind time, rather than by re-deriving the unlock
- * identity from the (possibly lost) secret -- while the request itself is
- * the shared one, 404 outcome and all.
- */
-export { deleteSpaceWithCapability as deleteUnlockSpaceWithCapability } from '../space/deleteSpace.js';
+    capability?: IZcap;
+}): Promise<{
+    outcome: 'deleted' | 'not-found';
+}>;
 //# sourceMappingURL=unlockSpace.d.ts.map

package/dist/keyring/unlockSpace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAA;AAgIrD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,IAAwB,EACzB,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAQ1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACP,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,KAAK,CAAA;CAClB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAW1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,KAAK,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhB;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,yBAAyB,IAAI,+BAA+B,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"unlockSpace.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAA;AA6IrD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,IAAwB,EACzB,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAS1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAGhD"}

package/dist/keyring/unlockSpace.js

@@ -6,9 +6,15 @@
  * and separate from the wallet data Space, holding the one keyring record.
  * These are standalone functions rather than methods on a wallet's remote-store
  * class (that store is bound to the data identity): each builds its own
- * `WasClient` over the unlock agent's `zcapClient`, whose invocation signer is
- * the unlock root key (root invocation, no capability attached -- the same
- * invocation shape the data Space uses).
+ * `WasClient` over the caller's `zcapClient`. By default that is the unlock
+ * agent's, whose invocation signer is the unlock root key (root invocation,
+ * no capability attached -- the same invocation shape the data Space uses).
+ * Each read/write/delete also takes an optional `capability`: an enrolled
+ * client's `zcapClient` then invokes the management zcap the unlock identity
+ * delegated at bind time, which is how a ceremony reaches an unlock Space
+ * without holding its secret (the revocation cascade's re-mint reading and
+ * re-PUTting a recovery code's standing record, or a lost unlock method's
+ * Space being retired).
  *
  * The one resource is a plaintext JSON document (its keyring payload is
  * already ciphertext), so no encryption provider is wired in and every
@@ -16,7 +22,6 @@
  * here for the absent Space a fresh unlock secret's keyring lookup meets.
  */
 import { WasClient } from '@interop/was-client';
-import { resourcePath } from '@interop/was-client/paths';
 import { KEYRING_COLLECTION, KEYRING_RESOURCE } from '../space/collections.js';
 import { plaintextCollection } from '../space/plaintextCollection.js';
 /**
@@ -74,11 +79,18 @@ async function ensurePlaintextCollection({ storageServerUrl, zcapClient, spaceId
  * @param options.spaceId {string}
  * @param options.collectionId {string}
  * @param options.resourceId {string}
+ * @param [options.capability] {IZcap}   an invocation capability the GET
+ *   rides; absent, the request invokes the root capability
  * @returns {Promise<unknown | null>}
  */
-async function getPlaintextRecord({ storageServerUrl, zcapClient, spaceId, collectionId, resourceId }) {
+async function getPlaintextRecord({ storageServerUrl, zcapClient, spaceId, collectionId, resourceId, capability }) {
     const was = unlockSpaceClient({ storageServerUrl, zcapClient });
-    const result = await plaintextCollection({ was, spaceId, collectionId })
+    const result = await plaintextCollection({
+        was,
+        spaceId,
+        collectionId,
+        capability
+    })
         .resource(resourceId)
         .get();
     return result === null ? null : result;
@@ -94,12 +106,14 @@ async function getPlaintextRecord({ storageServerUrl, zcapClient, spaceId, colle
  * @param options.collectionId {string}
  * @param options.resourceId {string}
  * @param options.record {object}
+ * @param [options.capability] {IZcap}   an invocation capability the PUT
+ *   rides; absent, the request invokes the root capability
  * @returns {Promise<void>}
  */
-async function putPlaintextRecord({ storageServerUrl, zcapClient, spaceId, collectionId, resourceId, record }) {
+async function putPlaintextRecord({ storageServerUrl, zcapClient, spaceId, collectionId, resourceId, record, capability }) {
     const was = unlockSpaceClient({ storageServerUrl, zcapClient });
     const body = new TextEncoder().encode(JSON.stringify(record));
-    await plaintextCollection({ was, spaceId, collectionId })
+    await plaintextCollection({ was, spaceId, collectionId, capability })
         .resource(resourceId)
         .put(body, { contentType: 'application/json' });
 }
@@ -133,126 +147,90 @@ export async function ensureUnlockSpace({ storageServerUrl, zcapClient, spaceId,
  * does not exist yet. A network / unreachable error propagates, so callers can
  * distinguish "no keyring" from "could not check".
  *
+ * With a `capability`, the `zcapClient` is an enrolled client's rather than
+ * the unlock identity's, and the attached management zcap (delegated by the
+ * unlock identity at bind time; it must allow GET) authorizes the read. This
+ * is what lets the revocation cascade's re-mint read a recovery code's
+ * standing record without holding the code: the record's code-authenticated
+ * binding rides the frame in the clear, so carrying it forward verbatim needs
+ * no decryption.
+ *
  * @param options {object}
  * @param options.storageServerUrl {string}
  * @param options.zcapClient {ZcapClient}
  * @param options.spaceId {string}   the unlock Space id
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the read is a root invocation
  * @returns {Promise<unknown | null>}
  */
-export async function getUnlockKeyring({ storageServerUrl, zcapClient, spaceId }) {
+export async function getUnlockKeyring({ storageServerUrl, zcapClient, spaceId, capability }) {
     return getPlaintextRecord({
         storageServerUrl,
         zcapClient,
         spaceId,
         collectionId: KEYRING_COLLECTION.id,
-        resourceId: KEYRING_RESOURCE
+        resourceId: KEYRING_RESOURCE,
+        capability
     });
 }
 /**
  * Writes (upserts) the keyring record into the unlock Space as a JSON document.
  *
+ * With a `capability`, the `zcapClient` is an enrolled client's rather than
+ * the unlock identity's, and the attached management zcap (delegated by the
+ * unlock identity at bind time; it must allow PUT) authorizes the write. This
+ * is what lets the revocation cascade re-PUT a recovery code's unlock record
+ * (a fresh `did.jsonl` delegation inside a re-wrapped record) without holding
+ * the code: the record's JWE recipient is the code's unlock KAK, whose PUBLIC
+ * half the issuing client recorded, so re-encryption needs no secret.
+ *
  * @param options {object}
  * @param options.storageServerUrl {string}
  * @param options.zcapClient {ZcapClient}
  * @param options.spaceId {string}   the unlock Space id
  * @param options.record {object}   the keyring record
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the write is a root invocation
  * @returns {Promise<void>}
  */
-export async function putUnlockKeyring({ storageServerUrl, zcapClient, spaceId, record }) {
+export async function putUnlockKeyring({ storageServerUrl, zcapClient, spaceId, record, capability }) {
     await putPlaintextRecord({
         storageServerUrl,
         zcapClient,
         spaceId,
         collectionId: KEYRING_COLLECTION.id,
         resourceId: KEYRING_RESOURCE,
-        record
-    });
-}
-/**
- * Reads the keyring record with an explicitly attached management capability,
- * rather than by root invocation, or returns `null` when it does not exist.
- * The `zcapClient` here is an enrolled client's (not the unlock identity's);
- * the attached `capability` -- the management zcap the unlock identity
- * delegated at bind time, provided it allows GET -- authorizes the read
- * against the unlock Space. This is what lets the revocation cascade's
- * re-mint read a recovery code's standing record without holding the code:
- * the record's code-authenticated binding rides the frame in the clear, so
- * carrying it forward verbatim needs no decryption.
- *
- * @param options {object}
- * @param options.storageServerUrl {string}
- * @param options.zcapClient {ZcapClient}   an enrolled client's zcap client
- * @param options.spaceId {string}   the unlock Space id
- * @param options.capability {IZcap}   the delegated management zcap (must
- *   allow GET)
- * @returns {Promise<unknown | null>}
- */
-export async function getUnlockKeyringWithCapability({ storageServerUrl, zcapClient, spaceId, capability }) {
-    const was = unlockSpaceClient({ storageServerUrl, zcapClient });
-    const result = await plaintextCollection({
-        was,
-        spaceId,
-        collectionId: KEYRING_COLLECTION.id,
+        record,
         capability
-    })
-        .resource(KEYRING_RESOURCE)
-        .get();
-    return result === null ? null : result;
-}
-/**
- * Writes (upserts) the keyring record with an explicitly attached management
- * capability, rather than by root invocation. The `zcapClient` here is an
- * enrolled client's (not the unlock identity's); the attached `capability` --
- * the management zcap the unlock identity delegated at bind time, provided it
- * allows PUT -- authorizes the write against the unlock Space. This is what
- * lets the revocation cascade re-PUT a recovery code's unlock record (a fresh
- * `did.jsonl` delegation inside a re-wrapped record) without holding the
- * code: the record's JWE recipient is the code's unlock KAK, whose PUBLIC
- * half the issuing client recorded, so re-encryption needs no secret.
- *
- * @param options {object}
- * @param options.storageServerUrl {string}
- * @param options.zcapClient {ZcapClient}   an enrolled client's zcap client
- * @param options.spaceId {string}   the unlock Space id
- * @param options.record {object}   the keyring record
- * @param options.capability {IZcap}   the delegated management zcap (must
- *   allow PUT)
- * @returns {Promise<void>}
- */
-export async function putUnlockKeyringWithCapability({ storageServerUrl, zcapClient, spaceId, record, capability }) {
-    const was = unlockSpaceClient({ storageServerUrl, zcapClient });
-    const body = new TextEncoder().encode(JSON.stringify(record));
-    await was.request({
-        capability,
-        path: resourcePath(spaceId, KEYRING_COLLECTION.id, KEYRING_RESOURCE),
-        method: 'PUT',
-        headers: { 'content-type': 'application/json' },
-        body
     });
 }
 /**
  * Deletes the whole unlock Space (what retires an old passphrase on a
- * passphrase change). `space.delete()` is idempotent, so an already-absent
- * Space is a success.
+ * passphrase change, or a lost unlock method). The server's answer is
+ * reported rather than decided here: an already-absent Space comes back as
+ * `not-found`, and only a non-404 error propagates, so a caller that treats
+ * the delete as idempotent ignores the outcome.
+ *
+ * With a `capability`, the `zcapClient` is an enrolled client's rather than
+ * the unlock identity's, and the attached management zcap (delegated by the
+ * unlock identity to the data identity at bind time; it must allow DELETE on
+ * the Space's own URL) authorizes the delete -- retiring a lost unlock method
+ * without re-deriving its identity from the (possibly lost) secret. The
+ * server answers 404 both for an absent Space and for a refused capability,
+ * so `not-found` is not a statement of absence on its own.
  *
  * @param options {object}
  * @param options.storageServerUrl {string}
  * @param options.zcapClient {ZcapClient}
  * @param options.spaceId {string}   the unlock Space id
- * @returns {Promise<void>}
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the delete is a root invocation
+ * @returns {Promise<{ outcome: 'deleted' | 'not-found' }>}   `not-found`
+ *   when the server answered 404 (absent, or unauthorized under a
+ *   capability); every other error propagates unchanged
  */
-export async function deleteUnlockSpace({ storageServerUrl, zcapClient, spaceId }) {
+export async function deleteUnlockSpace({ storageServerUrl, zcapClient, spaceId, capability }) {
     const was = unlockSpaceClient({ storageServerUrl, zcapClient });
-    await was.space(spaceId).delete();
+    return was.space(spaceId, { capability }).deleteWithOutcome();
 }
-/**
- * The unlock Space's name for the one capability-authorized Space DELETE
- * ({@link deleteSpaceWithCapability}). The alias stands because an unlock
- * Space's deletion is the one this module's callers reach for -- retiring a
- * lost unlock method with the management zcap the unlock identity delegated
- * to the data identity at bind time, rather than by re-deriving the unlock
- * identity from the (possibly lost) secret -- while the request itself is
- * the shared one, 404 outcome and all.
- */
-export { deleteSpaceWithCapability as deleteUnlockSpaceWithCapability } from '../space/deleteSpace.js';
 //# sourceMappingURL=unlockSpace.js.map

package/dist/keyring/unlockSpace.js.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAGxD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EAIX;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,IAAI,EAOL;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;SACrE,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EAQP;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;SACtD,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAOzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACxD,MAAM,yBAAyB,CAAC;QAC9B,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EAKR;IACC,OAAO,kBAAkB,CAAC;QACxB,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EAMP;IACC,MAAM,kBAAkB,CAAC;QACvB,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EAMX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU;KACX,CAAC;SACC,QAAQ,CAAC,gBAAgB,CAAC;SAC1B,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,UAAU;QACV,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,CAAC;QACpE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI;KACL,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EAKR;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,yBAAyB,IAAI,+BAA+B,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EAIX;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,IAAI,EAOL;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EAQX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC;SACC,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EASX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SAClE,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAOzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACxD,MAAM,yBAAyB,CAAC;QAC9B,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EAMX;IACC,OAAO,kBAAkB,CAAC;QACxB,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EAOX;IACC,MAAM,kBAAkB,CAAC;QACvB,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;QACN,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EAMX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}

package/dist/keys/userKey.js

@@ -19,7 +19,7 @@
  */
 import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
 import { epochKeyIdFor, mintEpoch } from '@interop/was-client/edv';
-import { singleKeyResolver } from '../identity/keyResolver.js';
+import { singleKeyResolver } from '@interop/was-client/identity';
 /**
  * Mints a fresh user key: the X25519 key-agreement pair via the was-client
  * epoch construction (its did:key is the key id, its raw secret is what wraps),

package/dist/keys/userKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"userKey.js","sourceRoot":"","sources":["../../src/keys/userKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAiB9D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IACnC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,OAAO,EAAwB;IAIhE,MAAM,eAAe,GAAG,yBAAyB,CAAC,aAAa,CAAC;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9B,CAAqB,CAAA;IACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;AACzC,CAAC"}
+{"version":3,"file":"userKey.js","sourceRoot":"","sources":["../../src/keys/userKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAiBhE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IACnC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,OAAO,EAAwB;IAIhE,MAAM,eAAe,GAAG,yBAAyB,CAAC,aAAa,CAAC;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9B,CAAqB,CAAA;IACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;AACzC,CAAC"}

package/dist/menders/derive.d.ts

@@ -0,0 +1,85 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The derived sets a wallet's audit tests assert: the invariants a transient
+ * visit reaches, the gaps the registration index implies, and census
+ * completeness. Each is computed from the table and the sites alone, so a
+ * converger that quietly loses a trigger a transient visit fires, or an
+ * invariant no registration reports any more, moves a derived set and fails
+ * the wallet's pin.
+ */
+import { type InvariantId } from './ids.js';
+import type { MenderRegistry } from './registry.js';
+import type { InvariantGap, RegistrationSite } from './types.js';
+/**
+ * One derived gap: the declared row's key and kind, without its prose.
+ */
+type DerivedGap = Pick<InvariantGap, 'invariant' | 'kind'>;
+/**
+ * The invariants a transient visit on a standing credential reaches. The
+ * two chain triggers are read through `dueAt` over the ladder held set; a
+ * `login-routing` site counts unless the client-key-record probe guards it;
+ * a `ceremony-tail` entry counts, every such ceremony running on any
+ * session type; and a detector no site reports (a declaration carrying
+ * `holdsWhen`) counts when it is checked at a trigger a transient visit
+ * fires and, on the chain, under an authority the ladder held set carries.
+ * An unreported declaration with no detector is reached by nothing.
+ *
+ * @param options {object}
+ * @param options.registry {MenderRegistry}
+ * @returns {ReadonlyArray<InvariantId>}   in table order
+ */
+export declare function transientReachableInvariants({ registry }: {
+    registry: MenderRegistry<RegistrationSite, never>;
+}): ReadonlyArray<InvariantId>;
+/**
+ * The gaps the index implies. An invariant no site reports derives `none`,
+ * unless it is checked at ceremony tails alone (converged by the ceremony's
+ * own sequenced code, which is never registered). A detector is not a
+ * mender: a declaration carrying `holdsWhen` and no registration derives
+ * `none` like any other unreported one, so adding a detector never retires
+ * a gap. A declaration naming a chain or routing trigger no site backs
+ * derives `none` whatever else it names. An invariant reported only at sites
+ * a transient visit cannot reach, on an account shape the violation can
+ * stand on, derives `unreachable`. Nothing else derives a gap.
+ *
+ * @param options {object}
+ * @param options.registry {MenderRegistry}
+ * @returns {ReadonlyArray<DerivedGap>}
+ */
+export declare function deriveGaps({ registry }: {
+    registry: MenderRegistry<RegistrationSite, never>;
+}): ReadonlyArray<DerivedGap>;
+/**
+ * Compares the derived gaps with a wallet's declared allowlist. The
+ * derivation admits gaps and retires none: a declared row the derivation no
+ * longer produces passes, and a derived gap with no declaration fails. A
+ * derived `none` needs a declared `none` row for its invariant; a derived
+ * `unreachable` needs any declared row for it, since a declared `none` may
+ * be scoped to a different torn state of the same predicate.
+ *
+ * @param options {object}
+ * @param options.derived {ReadonlyArray<DerivedGap>}
+ * @param options.declared {ReadonlyArray<InvariantGap>}
+ * @returns {ReadonlyArray<DerivedGap>}   the
+ *   derived gaps no declaration covers; empty when the allowlist is complete
+ */
+export declare function undeclaredGaps({ derived, declared }: {
+    derived: ReadonlyArray<DerivedGap>;
+    declared: ReadonlyArray<InvariantGap>;
+}): ReadonlyArray<DerivedGap>;
+/**
+ * Census completeness: the ids in {@link INVARIANT_IDS} the table does not
+ * declare. Duplicated ids and undeclared reports are refused by
+ * `menderRegistry` at construction, so a registry in hand has neither.
+ *
+ * @param options {object}
+ * @param options.registry {MenderRegistry}
+ * @returns {ReadonlyArray<InvariantId>}   empty when the census is complete
+ */
+export declare function undeclaredInvariants({ registry }: {
+    registry: MenderRegistry<RegistrationSite, never>;
+}): ReadonlyArray<InvariantId>;
+export {};
+//# sourceMappingURL=derive.d.ts.map

package/dist/menders/derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.d.ts","sourceRoot":"","sources":["../../src/menders/derive.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAEhE;;GAEG;AACH,KAAK,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,MAAM,CAAC,CAAA;AAW1D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,cAAc,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;CAClD,GAAG,aAAa,CAAC,WAAW,CAAC,CAuC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,EACzB,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,cAAc,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;CAClD,GAAG,aAAa,CAAC,UAAU,CAAC,CAoB5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,QAAQ,EACT,EAAE;IACD,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,CAAA;IAClC,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;CACtC,GAAG,aAAa,CAAC,UAAU,CAAC,CAS5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,cAAc,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;CAClD,GAAG,aAAa,CAAC,WAAW,CAAC,CAG7B"}