@interop/wallet-core 0.70.0 → 0.72.0

package/dist/menders/derive.js

@@ -0,0 +1,138 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The derived sets a wallet's audit tests assert: the invariants a transient
+ * visit reaches, the gaps the registration index implies, and census
+ * completeness. Each is computed from the table and the sites alone, so a
+ * converger that quietly loses a trigger a transient visit fires, or an
+ * invariant no registration reports any more, moves a derived set and fails
+ * the wallet's pin.
+ */
+import { INVARIANT_IDS } from './ids.js';
+import { heldAuthorities } from './registry.js';
+/**
+ * The ids some site reports, whatever its trigger.
+ */
+function reportedIds(registry) {
+    return new Set(registry.sites().flatMap(site => site.reports));
+}
+/**
+ * The invariants a transient visit on a standing credential reaches. The
+ * two chain triggers are read through `dueAt` over the ladder held set; a
+ * `login-routing` site counts unless the client-key-record probe guards it;
+ * a `ceremony-tail` entry counts, every such ceremony running on any
+ * session type; and a detector no site reports (a declaration carrying
+ * `holdsWhen`) counts when it is checked at a trigger a transient visit
+ * fires and, on the chain, under an authority the ladder held set carries.
+ * An unreported declaration with no detector is reached by nothing.
+ *
+ * @param options {object}
+ * @param options.registry {MenderRegistry}
+ * @returns {ReadonlyArray<InvariantId>}   in table order
+ */
+export function transientReachableInvariants({ registry }) {
+    const reached = new Set();
+    const held = heldAuthorities({ kind: 'ladder' });
+    for (const site of registry.dueAt({
+        held,
+        trigger: 'transient-login-chain'
+    })) {
+        for (const id of site.reports) {
+            reached.add(id);
+        }
+    }
+    for (const site of registry.sites()) {
+        if (site.trigger === 'login-routing' && !site.guardedBy) {
+            for (const id of site.reports) {
+                reached.add(id);
+            }
+        }
+    }
+    const reported = reportedIds(registry);
+    for (const decl of registry.all()) {
+        if (decl.triggers.includes('ceremony-tail')) {
+            reached.add(decl.id);
+            continue;
+        }
+        if (reported.has(decl.id) || !decl.holdsWhen) {
+            continue;
+        }
+        const checkedOnVisit = decl.triggers.includes('login-routing') ||
+            (decl.triggers.includes('transient-login-chain') &&
+                held.includes(decl.authority));
+        if (checkedOnVisit) {
+            reached.add(decl.id);
+        }
+    }
+    return registry
+        .all()
+        .filter(decl => reached.has(decl.id))
+        .map(decl => decl.id);
+}
+/**
+ * The gaps the index implies. An invariant no site reports derives `none`,
+ * unless it is checked at ceremony tails alone (converged by the ceremony's
+ * own sequenced code, which is never registered). A detector is not a
+ * mender: a declaration carrying `holdsWhen` and no registration derives
+ * `none` like any other unreported one, so adding a detector never retires
+ * a gap. A declaration naming a chain or routing trigger no site backs
+ * derives `none` whatever else it names. An invariant reported only at sites
+ * a transient visit cannot reach, on an account shape the violation can
+ * stand on, derives `unreachable`. Nothing else derives a gap.
+ *
+ * @param options {object}
+ * @param options.registry {MenderRegistry}
+ * @returns {ReadonlyArray<DerivedGap>}
+ */
+export function deriveGaps({ registry }) {
+    const reported = reportedIds(registry);
+    const reachable = new Set(transientReachableInvariants({ registry }));
+    const gaps = [];
+    for (const decl of registry.all()) {
+        if (!reported.has(decl.id)) {
+            const tailOnly = decl.triggers.length > 0 &&
+                decl.triggers.every(trigger => trigger === 'ceremony-tail');
+            if (!tailOnly) {
+                gaps.push({ invariant: decl.id, kind: 'none' });
+            }
+        }
+        else if (!reachable.has(decl.id) &&
+            decl.standsOn.includes('client-less')) {
+            gaps.push({ invariant: decl.id, kind: 'unreachable' });
+        }
+    }
+    return gaps;
+}
+/**
+ * Compares the derived gaps with a wallet's declared allowlist. The
+ * derivation admits gaps and retires none: a declared row the derivation no
+ * longer produces passes, and a derived gap with no declaration fails. A
+ * derived `none` needs a declared `none` row for its invariant; a derived
+ * `unreachable` needs any declared row for it, since a declared `none` may
+ * be scoped to a different torn state of the same predicate.
+ *
+ * @param options {object}
+ * @param options.derived {ReadonlyArray<DerivedGap>}
+ * @param options.declared {ReadonlyArray<InvariantGap>}
+ * @returns {ReadonlyArray<DerivedGap>}   the
+ *   derived gaps no declaration covers; empty when the allowlist is complete
+ */
+export function undeclaredGaps({ derived, declared }) {
+    return derived.filter(({ invariant, kind }) => !declared.some(gap => gap.invariant === invariant &&
+        (kind === 'unreachable' || gap.kind === 'none')));
+}
+/**
+ * Census completeness: the ids in {@link INVARIANT_IDS} the table does not
+ * declare. Duplicated ids and undeclared reports are refused by
+ * `menderRegistry` at construction, so a registry in hand has neither.
+ *
+ * @param options {object}
+ * @param options.registry {MenderRegistry}
+ * @returns {ReadonlyArray<InvariantId>}   empty when the census is complete
+ */
+export function undeclaredInvariants({ registry }) {
+    const declared = new Set(registry.all().map(decl => decl.id));
+    return INVARIANT_IDS.filter(id => !declared.has(id));
+}
+//# sourceMappingURL=derive.js.map

package/dist/menders/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.js","sourceRoot":"","sources":["../../src/menders/derive.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EAAE,aAAa,EAAoB,MAAM,UAAU,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAQ/C;;GAEG;AACH,SAAS,WAAW,CAClB,QAAiD;IAEjD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,QAAQ,EAGT;IACC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAe,CAAA;IACtC,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC;QAChC,IAAI;QACJ,OAAO,EAAE,uBAAuB;KACjC,CAAC,EAAE,CAAC;QACH,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,OAAO,KAAK,eAAe,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACxD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACpB,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7C,SAAQ;QACV,CAAC;QACD,MAAM,cAAc,GAClB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YACvC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QAClC,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ;SACZ,GAAG,EAAE;SACL,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACpC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,EACzB,QAAQ,EAGT;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IACrE,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,eAAe,CAAC,CAAA;YAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACjD,CAAC;QACH,CAAC;aAAM,IACL,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EACrC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,QAAQ,EAIT;IACC,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CACtB,CAAC,QAAQ,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,CACJ,GAAG,CAAC,SAAS,KAAK,SAAS;QAC3B,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAClD,CACJ,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,QAAQ,EAGT;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AACtD,CAAC"}

package/dist/menders/ids.d.ts

@@ -0,0 +1,20 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The invariant ids: the closed census both wallets declare against and the
+ * mender event channel keys on. Each names the predicate an entry makes
+ * true rather than the code that converges it, so moving a converger between
+ * modules renames nothing. The ids are code-only; nothing persists them.
+ * Numbered in the order the design table assigned them, and a new one takes
+ * the next free number rather than renumbering.
+ */
+/**
+ * Every invariant id, in design-table order.
+ */
+export declare const INVARIANT_IDS: readonly ["roster-wraps-exactly-the-document-key-set", "governed-log-heads-anchor-past-the-membership-change", "collection-epochs-name-the-current-user-key", "unlock-registry-opens-under-the-current-user-key", "registry-passphrase-entry-names-the-standing-credential", "passkey-entry-carries-its-standing-configuration", "registry-lists-the-passphrase-method", "standing-delegations-verify-under-the-current-document", "registry-records-the-committed-ladder-rung", "unlock-record-points-at-the-account-did", "account-pointer-names-the-account-did", "space-controller-is-the-account-did", "roster-and-collection-epochs-exist", "registry-records-the-establishing-credential", "annex-generation-is-reachable", "generation-delegation-is-current", "acting-credential-manage-zcap-is-current", "did-web-projection-matches-the-log", "no-annex-generation-outlives-its-pointer", "app-keys-live-only-in-app-connections", "client-key-record-matches-the-pointed-account", "this-browser-is-still-an-enrolled-client", "no-client-key-record-stays-pending", "recovery-spend-is-completed", "retired-credential-leaves-no-annex-inventory", "document-lists-the-acting-credential", "keystore-controller-is-the-account-did", "account-document-publishes-an-authentication-key", "every-document-key-agreement-entry-has-a-locatable-credential", "no-unlock-space-outlives-its-credential", "no-keystore-outlives-its-account", "saved-recovery-codes-locate-their-account", "standard-collections-are-provisioned", "no-auxiliary-space-stands-unnamed"];
+/**
+ * One id from {@link INVARIANT_IDS}.
+ */
+export type InvariantId = (typeof INVARIANT_IDS)[number];
+//# sourceMappingURL=ids.d.ts.map

package/dist/menders/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/menders/ids.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa,i/CAqEhB,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/menders/ids.js

@@ -0,0 +1,85 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The invariant ids: the closed census both wallets declare against and the
+ * mender event channel keys on. Each names the predicate an entry makes
+ * true rather than the code that converges it, so moving a converger between
+ * modules renames nothing. The ids are code-only; nothing persists them.
+ * Numbered in the order the design table assigned them, and a new one takes
+ * the next free number rather than renumbering.
+ */
+/**
+ * Every invariant id, in design-table order.
+ */
+export const INVARIANT_IDS = [
+    // 1
+    'roster-wraps-exactly-the-document-key-set',
+    // 2
+    'governed-log-heads-anchor-past-the-membership-change',
+    // 3
+    'collection-epochs-name-the-current-user-key',
+    // 4
+    'unlock-registry-opens-under-the-current-user-key',
+    // 5
+    'registry-passphrase-entry-names-the-standing-credential',
+    // 6
+    'passkey-entry-carries-its-standing-configuration',
+    // 7
+    'registry-lists-the-passphrase-method',
+    // 8
+    'standing-delegations-verify-under-the-current-document',
+    // 9
+    'registry-records-the-committed-ladder-rung',
+    // 10
+    'unlock-record-points-at-the-account-did',
+    // 11
+    'account-pointer-names-the-account-did',
+    // 12
+    'space-controller-is-the-account-did',
+    // 13
+    'roster-and-collection-epochs-exist',
+    // 14
+    'registry-records-the-establishing-credential',
+    // 15
+    'annex-generation-is-reachable',
+    // 16
+    'generation-delegation-is-current',
+    // 17
+    'acting-credential-manage-zcap-is-current',
+    // 18
+    'did-web-projection-matches-the-log',
+    // 19
+    'no-annex-generation-outlives-its-pointer',
+    // 20
+    'app-keys-live-only-in-app-connections',
+    // 21
+    'client-key-record-matches-the-pointed-account',
+    // 22
+    'this-browser-is-still-an-enrolled-client',
+    // 23
+    'no-client-key-record-stays-pending',
+    // 24
+    'recovery-spend-is-completed',
+    // 25
+    'retired-credential-leaves-no-annex-inventory',
+    // 26
+    'document-lists-the-acting-credential',
+    // 27
+    'keystore-controller-is-the-account-did',
+    // 28
+    'account-document-publishes-an-authentication-key',
+    // 29
+    'every-document-key-agreement-entry-has-a-locatable-credential',
+    // 30
+    'no-unlock-space-outlives-its-credential',
+    // 31
+    'no-keystore-outlives-its-account',
+    // 32
+    'saved-recovery-codes-locate-their-account',
+    // 33
+    'standard-collections-are-provisioned',
+    // 34
+    'no-auxiliary-space-stands-unnamed'
+];
+//# sourceMappingURL=ids.js.map

package/dist/menders/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/menders/ids.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI;IACJ,2CAA2C;IAC3C,IAAI;IACJ,sDAAsD;IACtD,IAAI;IACJ,6CAA6C;IAC7C,IAAI;IACJ,kDAAkD;IAClD,IAAI;IACJ,yDAAyD;IACzD,IAAI;IACJ,kDAAkD;IAClD,IAAI;IACJ,sCAAsC;IACtC,IAAI;IACJ,wDAAwD;IACxD,IAAI;IACJ,4CAA4C;IAC5C,KAAK;IACL,yCAAyC;IACzC,KAAK;IACL,uCAAuC;IACvC,KAAK;IACL,qCAAqC;IACrC,KAAK;IACL,oCAAoC;IACpC,KAAK;IACL,8CAA8C;IAC9C,KAAK;IACL,+BAA+B;IAC/B,KAAK;IACL,kCAAkC;IAClC,KAAK;IACL,0CAA0C;IAC1C,KAAK;IACL,oCAAoC;IACpC,KAAK;IACL,0CAA0C;IAC1C,KAAK;IACL,uCAAuC;IACvC,KAAK;IACL,+CAA+C;IAC/C,KAAK;IACL,0CAA0C;IAC1C,KAAK;IACL,oCAAoC;IACpC,KAAK;IACL,6BAA6B;IAC7B,KAAK;IACL,8CAA8C;IAC9C,KAAK;IACL,sCAAsC;IACtC,KAAK;IACL,wCAAwC;IACxC,KAAK;IACL,kDAAkD;IAClD,KAAK;IACL,+DAA+D;IAC/D,KAAK;IACL,yCAAyC;IACzC,KAAK;IACL,kCAAkC;IAClC,KAAK;IACL,2CAA2C;IAC3C,KAAK;IACL,sCAAsC;IACtC,KAAK;IACL,mCAAmC;CAC3B,CAAA"}

package/dist/menders/index.d.ts

@@ -0,0 +1,42 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/menders` subpath: the mender registry keyed by
+ * invariant. A wallet declares its own table of invariants (data: what must
+ * hold between ceremonies) and its own registrations (code: what converges a
+ * violated one); this module carries the structure both wallets share.
+ *
+ * - the vocabularies: `AUTHORITIES`, `TRIGGERS`, `CHAIN_TRIGGERS`,
+ *   `ACCOUNT_SHAPES`, `EVIDENCE`, `MEND_OUTCOMES`, `GAP_KINDS`, and
+ *   `INVARIANT_IDS`, each an `as const` array with its union
+ * - the types: `InvariantDeclaration`, `RegistrationSite`, `Registration`,
+ *   `MendOutcome`, `MendReportEntry`, `MendReport`, `InvariantGap`,
+ *   `LoginRoute`
+ * - the readers: `menderRegistry` (`all`, `byId`, `sites`, `admits`,
+ *   `dueAt`), which refuses a duplicated id, an undeclared report, or a
+ *   guard on a non-routing site at construction, and `heldAuthorities`, the
+ *   held set a session's account-ceremony context derives
+ * - the runner: `runMenderBlock`, one try, warn, and skip discipline over
+ *   one chain trigger's registrations, `mendReportAccumulator`, the
+ *   pre-session report collector its `onOutcome` feeds, and `errorNameOf`,
+ *   the name a report carries for a thrown value of any shape
+ * - the derived sets a wallet's audit tests pin:
+ *   `transientReachableInvariants`, `deriveGaps`, `undeclaredGaps`, and
+ *   `undeclaredInvariants`
+ *
+ * Nothing here executes a ceremony. The runner calls the convergers a
+ * wallet registers and nothing else; the ceremonies stay explicit sequenced
+ * code, and the registry describes the menders from the outside.
+ */
+export { deriveGaps, transientReachableInvariants, undeclaredGaps, undeclaredInvariants } from './derive.js';
+export { INVARIANT_IDS } from './ids.js';
+export type { InvariantId } from './ids.js';
+export { heldAuthorities, menderRegistry } from './registry.js';
+export type { MenderRegistry, ResolvedAuthority } from './registry.js';
+export { errorNameOf, MEND_REPORT_SHAPE_ERROR, mendReportAccumulator, runMenderBlock } from './runner.js';
+export type { MendReportAccumulator } from './runner.js';
+export type { InvariantDeclaration, InvariantGap, LoginRoute, MendOutcome, MendReport, MendReportEntry, Registration, RegistrationSite } from './types.js';
+export { ACCOUNT_SHAPES, AUTHORITIES, CHAIN_TRIGGERS, EVIDENCE, GAP_KINDS, MEND_OUTCOMES, TRIGGERS } from './vocabulary.js';
+export type { AccountShape, Authority, ChainTrigger, Evidence, GapKind, MendOutcomeKind, Trigger } from './vocabulary.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/menders/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/menders/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,UAAU,EACV,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACrB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC/D,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxD,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,cAAc,EACd,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,EACT,aAAa,EACb,QAAQ,EACT,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,eAAe,EACf,OAAO,EACR,MAAM,iBAAiB,CAAA"}

package/dist/menders/index.js

@@ -0,0 +1,37 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/menders` subpath: the mender registry keyed by
+ * invariant. A wallet declares its own table of invariants (data: what must
+ * hold between ceremonies) and its own registrations (code: what converges a
+ * violated one); this module carries the structure both wallets share.
+ *
+ * - the vocabularies: `AUTHORITIES`, `TRIGGERS`, `CHAIN_TRIGGERS`,
+ *   `ACCOUNT_SHAPES`, `EVIDENCE`, `MEND_OUTCOMES`, `GAP_KINDS`, and
+ *   `INVARIANT_IDS`, each an `as const` array with its union
+ * - the types: `InvariantDeclaration`, `RegistrationSite`, `Registration`,
+ *   `MendOutcome`, `MendReportEntry`, `MendReport`, `InvariantGap`,
+ *   `LoginRoute`
+ * - the readers: `menderRegistry` (`all`, `byId`, `sites`, `admits`,
+ *   `dueAt`), which refuses a duplicated id, an undeclared report, or a
+ *   guard on a non-routing site at construction, and `heldAuthorities`, the
+ *   held set a session's account-ceremony context derives
+ * - the runner: `runMenderBlock`, one try, warn, and skip discipline over
+ *   one chain trigger's registrations, `mendReportAccumulator`, the
+ *   pre-session report collector its `onOutcome` feeds, and `errorNameOf`,
+ *   the name a report carries for a thrown value of any shape
+ * - the derived sets a wallet's audit tests pin:
+ *   `transientReachableInvariants`, `deriveGaps`, `undeclaredGaps`, and
+ *   `undeclaredInvariants`
+ *
+ * Nothing here executes a ceremony. The runner calls the convergers a
+ * wallet registers and nothing else; the ceremonies stay explicit sequenced
+ * code, and the registry describes the menders from the outside.
+ */
+export { deriveGaps, transientReachableInvariants, undeclaredGaps, undeclaredInvariants } from './derive.js';
+export { INVARIANT_IDS } from './ids.js';
+export { heldAuthorities, menderRegistry } from './registry.js';
+export { errorNameOf, MEND_REPORT_SHAPE_ERROR, mendReportAccumulator, runMenderBlock } from './runner.js';
+export { ACCOUNT_SHAPES, AUTHORITIES, CHAIN_TRIGGERS, EVIDENCE, GAP_KINDS, MEND_OUTCOMES, TRIGGERS } from './vocabulary.js';
+//# sourceMappingURL=index.js.map

package/dist/menders/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/menders/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,UAAU,EACV,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACrB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE/D,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACf,MAAM,aAAa,CAAA;AAYpB,OAAO,EACL,cAAc,EACd,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,EACT,aAAa,EACb,QAAQ,EACT,MAAM,iBAAiB,CAAA"}

package/dist/menders/registry.d.ts

@@ -0,0 +1,84 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The registry readers over a declaration table and its per-trigger
+ * registration sites: `all` and `byId` read declarations, `admits` is the
+ * one admission test (every reported invariant declares an authority the
+ * session holds and admits this login route), and `dueAt` reads the sites
+ * listed under one chain trigger that `admits` passes, in list order.
+ * Registration order is execution order; there is no dependency graph and
+ * no priority. The table and the sites are checked once, at construction: a
+ * duplicated declaration id, a site reporting an undeclared invariant, or a
+ * guard on a non-routing site is a `TypeError` there, so no reader meets the
+ * defect later, depending on what a login happens to hold.
+ */
+import type { InvariantId } from './ids.js';
+import type { InvariantDeclaration, LoginRoute, RegistrationSite } from './types.js';
+import type { Authority, ChainTrigger } from './vocabulary.js';
+/**
+ * The two authorities a session's account-ceremony context resolves to; the
+ * remaining values, `none` and `account`, are the ones every resolved kind
+ * subsumes. Derived from the vocabulary, so a new authority is a compile
+ * error in `heldAuthorities` rather than a value it can never return.
+ */
+export type ResolvedAuthority = Exclude<Authority, 'none' | 'account'>;
+/**
+ * The readers over one wallet's table. `Site` is the converge-free index
+ * shape or a wallet's registration type extending it, so the same readers
+ * serve the audit and the runner.
+ */
+export interface MenderRegistry<Site extends RegistrationSite, Deps, Ceremony extends string = string> {
+    all(): ReadonlyArray<InvariantDeclaration<Deps, Ceremony>>;
+    byId(id: InvariantId): InvariantDeclaration<Deps, Ceremony> | undefined;
+    sites(): ReadonlyArray<Site>;
+    /**
+     * Whether a site's every reported invariant declares an authority in
+     * `held` and, when a route is given, admits it. The one admission test,
+     * shared by `dueAt` and by a runner admitting a site the caller supplies.
+     *
+     * @throws {TypeError}   when the site reports an undeclared invariant,
+     *   reachable only for a site the registry does not index
+     */
+    admits(options: {
+        site: RegistrationSite;
+        held: ReadonlyArray<Authority>;
+        route?: LoginRoute;
+    }): boolean;
+    dueAt(options: {
+        held: ReadonlyArray<Authority>;
+        trigger: ChainTrigger;
+        route?: LoginRoute;
+    }): ReadonlyArray<Site>;
+}
+/**
+ * The held set a session derives from its account-ceremony context: `none`
+ * always, plus `account` and the resolved kind when a context resolves.
+ *
+ * @param options {object}
+ * @param [options.kind] {ResolvedAuthority}   the resolved context kind,
+ *   absent for a guest, a no-WAS session, or a transient session whose
+ *   record carries no standing members
+ * @returns {ReadonlyArray<Authority>}
+ */
+export declare function heldAuthorities({ kind }: {
+    kind?: ResolvedAuthority;
+}): ReadonlyArray<Authority>;
+/**
+ * Builds the readers over one wallet's declarations and sites, checking
+ * both once: every declaration id is unique, every reported id is declared,
+ * and only a `login-routing` site carries `guardedBy`.
+ *
+ * @param options {object}
+ * @param options.declarations {ReadonlyArray<InvariantDeclaration>}
+ * @param options.sites {ReadonlyArray<RegistrationSite>}   every
+ *   registration site, any trigger, in execution order within a trigger
+ * @returns {MenderRegistry}
+ * @throws {TypeError}   on a duplicated declaration id, an undeclared
+ *   report, or a guard on a non-routing site
+ */
+export declare function menderRegistry<Site extends RegistrationSite, Deps, Ceremony extends string = string>({ declarations, sites }: {
+    declarations: ReadonlyArray<InvariantDeclaration<Deps, Ceremony>>;
+    sites: ReadonlyArray<Site>;
+}): MenderRegistry<Site, Deps, Ceremony>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/menders/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/menders/registry.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EACV,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EACjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,WAAW,cAAc,CAC7B,IAAI,SAAS,gBAAgB,EAC7B,IAAI,EACJ,QAAQ,SAAS,MAAM,GAAG,MAAM;IAEhC,GAAG,IAAI,aAAa,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC1D,IAAI,CAAC,EAAE,EAAE,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAA;IACvE,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5B;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,EAAE;QACd,IAAI,EAAE,gBAAgB,CAAA;QACtB,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;QAC9B,KAAK,CAAC,EAAE,UAAU,CAAA;KACnB,GAAG,OAAO,CAAA;IACX,KAAK,CAAC,OAAO,EAAE;QACb,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;QAC9B,OAAO,EAAE,YAAY,CAAA;QACrB,KAAK,CAAC,EAAE,UAAU,CAAA;KACnB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACL,EAAE;IACD,IAAI,CAAC,EAAE,iBAAiB,CAAA;CACzB,GAAG,aAAa,CAAC,SAAS,CAAC,CAE3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,IAAI,SAAS,gBAAgB,EAC7B,IAAI,EACJ,QAAQ,SAAS,MAAM,GAAG,MAAM,EAChC,EACA,YAAY,EACZ,KAAK,EACN,EAAE;IACD,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IACjE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;CAC3B,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAsDvC"}

package/dist/menders/registry.js

@@ -0,0 +1,62 @@
+/**
+ * The held set a session derives from its account-ceremony context: `none`
+ * always, plus `account` and the resolved kind when a context resolves.
+ *
+ * @param options {object}
+ * @param [options.kind] {ResolvedAuthority}   the resolved context kind,
+ *   absent for a guest, a no-WAS session, or a transient session whose
+ *   record carries no standing members
+ * @returns {ReadonlyArray<Authority>}
+ */
+export function heldAuthorities({ kind }) {
+    return kind ? ['none', 'account', kind] : ['none'];
+}
+/**
+ * Builds the readers over one wallet's declarations and sites, checking
+ * both once: every declaration id is unique, every reported id is declared,
+ * and only a `login-routing` site carries `guardedBy`.
+ *
+ * @param options {object}
+ * @param options.declarations {ReadonlyArray<InvariantDeclaration>}
+ * @param options.sites {ReadonlyArray<RegistrationSite>}   every
+ *   registration site, any trigger, in execution order within a trigger
+ * @returns {MenderRegistry}
+ * @throws {TypeError}   on a duplicated declaration id, an undeclared
+ *   report, or a guard on a non-routing site
+ */
+export function menderRegistry({ declarations, sites }) {
+    const index = new Map();
+    for (const decl of declarations) {
+        if (index.has(decl.id)) {
+            throw new TypeError(`An invariant is declared twice: ${decl.id}`);
+        }
+        index.set(decl.id, decl);
+    }
+    const requireDeclared = (id) => {
+        const decl = index.get(id);
+        if (!decl) {
+            throw new TypeError(`A registration reports an undeclared invariant: ${id}`);
+        }
+        return decl;
+    };
+    for (const site of sites) {
+        site.reports.forEach(requireDeclared);
+        const { trigger, guardedBy } = site;
+        if (guardedBy !== undefined && trigger !== 'login-routing') {
+            throw new TypeError(`A ${trigger} site carries a guard; only a login-routing site may`);
+        }
+    }
+    const admits = ({ site, held, route }) => site.reports.every(id => {
+        const decl = requireDeclared(id);
+        return (held.includes(decl.authority) &&
+            (route === undefined || !decl.when || decl.when(route)));
+    });
+    return {
+        all: () => declarations,
+        byId: id => index.get(id),
+        sites: () => sites,
+        admits,
+        dueAt: ({ held, trigger, route }) => sites.filter(site => site.trigger === trigger && admits({ site, held, route }))
+    };
+}
+//# sourceMappingURL=registry.js.map

package/dist/menders/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/menders/registry.ts"],"names":[],"mappings":"AAgEA;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,IAAI,EAGL;IACC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAI5B,EACA,YAAY,EACZ,KAAK,EAIN;IACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqD,CAAA;IAC1E,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,mCAAmC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,MAAM,eAAe,GAAG,CACtB,EAAe,EACuB,EAAE;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,SAAS,CACjB,mDAAmD,EAAE,EAAE,CACxD,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QACrC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAA;QACnC,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAC3D,MAAM,IAAI,SAAS,CACjB,KAAK,OAAO,sDAAsD,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,EACd,IAAI,EACJ,IAAI,EACJ,KAAK,EAKN,EAAW,EAAE,CACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;QACtB,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,CAAC,CAAA;QAChC,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YAC7B,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACxD,CAAA;IACH,CAAC,CAAC,CAAA;IACJ,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY;QACvB,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;QAClB,MAAM;QACN,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAClC,KAAK,CAAC,MAAM,CACV,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAClE;KACJ,CAAA;AACH,CAAC"}

package/dist/menders/runner.d.ts

@@ -0,0 +1,143 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The mender runner: one try, warn, and skip discipline over the
+ * registrations listed under one chain trigger. `runMenderBlock` runs them
+ * in list order, since registration order is execution order and there is
+ * no dependency graph. A seed step's failure aborts the block; a
+ * registration's failure warns through the wallet's own `Logger` and the
+ * block continues. Beside it sits `mendReportAccumulator`, the report
+ * collector a wallet creates before a `Session` exists, so the entries a
+ * routing site reports and the entries this runner reports assemble into
+ * one `MendReport`.
+ */
+import type { Logger } from '../log.js';
+import type { MenderRegistry } from './registry.js';
+import type { LoginRoute, MendReport, MendReportEntry, Registration, RegistrationSite } from './types.js';
+import type { Authority, ChainTrigger } from './vocabulary.js';
+/**
+ * The `errorName` a normalized entry carries when a registration resolves
+ * with entries that do not match the invariants it reports.
+ */
+export declare const MEND_REPORT_SHAPE_ERROR = "MendReportShapeError";
+/**
+ * The report collector a wallet creates ahead of session assembly. A
+ * routing entry reports into it from its own call site before a `Session`
+ * exists, {@link runMenderBlock} reports the chain's entries into it
+ * through `onOutcome`, and the wallet hands `settled` to the session as its
+ * mend report.
+ */
+export interface MendReportAccumulator<Ceremony extends string = string> {
+    /**
+     * Records one entry. Bound to the accumulator, so it can be passed
+     * directly as {@link runMenderBlock}'s `onOutcome`.
+     */
+    report(entry: MendReportEntry<Ceremony>): void;
+    /**
+     * Every entry recorded so far, in report order.
+     */
+    entries(): MendReport<Ceremony>;
+    /**
+     * Resolves {@link MendReportAccumulator.settled} with the entries
+     * recorded so far. Idempotent: the first call fixes the resolved report,
+     * and a later `report` call still lands in `entries()`.
+     */
+    settle(): MendReport<Ceremony>;
+    /**
+     * The assembled report, resolved by `settle`. It never rejects.
+     */
+    readonly settled: Promise<MendReport<Ceremony>>;
+}
+/**
+ * Creates a report accumulator. Generic over the wallet's ceremony-id
+ * union, which defaults to `string`.
+ *
+ * @returns {MendReportAccumulator}
+ */
+export declare function mendReportAccumulator<Ceremony extends string = string>(): MendReportAccumulator<Ceremony>;
+/**
+ * Runs one registration block: the registrations listed under `trigger`
+ * whose every reported invariant declares an authority the session holds
+ * and admits this login route, in list order.
+ *
+ * The discipline, in one place. An optional `seed` registration runs first,
+ * and its failure aborts the block: nothing behind it runs, which is what a
+ * rejected chain seed does today. Past the seed, a registration that throws
+ * warns once per reported invariant with that declaration's own `warn`
+ * string, reports `failed` for each of them, and the block carries on to
+ * the next registration. Only `err.name` rides a report: a thrown error's
+ * message routinely carries a DID or a Space id, so the error itself goes
+ * to the logger alone.
+ *
+ * A registration that resolves with the wrong number of entries, or with an
+ * entry whose `invariant` is not the id it reports at that position, is a
+ * programming error. It warns and is normalized to `failed` entries
+ * carrying {@link MEND_REPORT_SHAPE_ERROR} rather than throwing, so a
+ * mismatched adapter cannot tear a login.
+ *
+ * `trigger` is one of the two chain values, so a `ceremony-tail` entry is
+ * out of reach here. Such an entry has no registration at all: its body
+ * stays inside its ceremony's sequenced code and it reports from there.
+ *
+ * `Deps` is the wallet's own type, one object per registration block,
+ * handed to the seed and to every `converge` unread. This runner never
+ * inspects it, and the raw passphrase does not cross into this package.
+ *
+ * `registrations` overrides which registrations the block runs, for a wallet
+ * that runs one trigger's list in parts (a settle point partway through, say).
+ * The same authority and route tests still admit each one, and one listed
+ * under another trigger is refused, so the override narrows the block and
+ * never widens it.
+ *
+ * A registry may index converge-free sites beside its registrations -- a
+ * wallet's routing entries, or an entry whose own call site fires it -- and
+ * such a site is never executed here, whichever list the block runs from.
+ *
+ * @param options {object}
+ * @param options.registry {MenderRegistry}   the wallet's declarations and
+ *   its registrations
+ * @param options.trigger {ChainTrigger}   which chain is running
+ * @param options.held {ReadonlyArray<Authority>}   the session's held
+ *   authorities, from `heldAuthorities`
+ * @param options.route {LoginRoute}   the login route each declaration's
+ *   `when` predicate reads
+ * @param options.deps {Deps}   passed to the seed and to every `converge`
+ * @param options.logger {Logger}   the wallet's own sink, so its warn
+ *   copy keeps the wallet's namespace
+ * @param [options.registrations] {ReadonlyArray<Registration>}   the
+ *   registrations to run, in place of the ones the registry lists under
+ *   `trigger`. Each is admitted by the same authority and route tests
+ * @param [options.seed] {Registration}   the step whose failure aborts the
+ *   block. Admitted by the same authority and route tests as any other
+ *   registration; one it does not pass is skipped rather than failed
+ * @param [options.onOutcome] {(entry: MendReportEntry) => void}   called
+ *   once per reported entry, in order. The single place a chain entry's
+ *   outcome is reported
+ * @returns {Promise<MendReport>}   the block's entries in order. It never
+ *   rejects; a seed failure resolves with the seed's `failed` entries alone
+ * @throws {TypeError}   when the seed or an override registration is listed
+ *   under a trigger other than `trigger`, a programming error
+ */
+export declare function runMenderBlock<Deps, Ceremony extends string = string, Site extends RegistrationSite = Registration<Deps, Ceremony>>({ registry, trigger, held, route, deps, logger, registrations, seed, onOutcome }: {
+    registry: MenderRegistry<Site, Deps, Ceremony>;
+    trigger: ChainTrigger;
+    held: ReadonlyArray<Authority>;
+    route: LoginRoute;
+    deps: Deps;
+    logger: Logger;
+    registrations?: ReadonlyArray<Registration<Deps, Ceremony>>;
+    seed?: Registration<Deps, Ceremony>;
+    onOutcome?: (entry: MendReportEntry<Ceremony>) => void;
+}): Promise<MendReport<Ceremony>>;
+/**
+ * The thrown value's class name alone. Its message may carry a DID or a
+ * Space id, so a report keeps the name and the logger keeps the error. A
+ * value that is not an `Error` still yields a name, so a report site never
+ * carries `undefined` where a name belongs.
+ *
+ * @param err {unknown}
+ * @returns {string}
+ */
+export declare function errorNameOf(err: unknown): string;
+//# sourceMappingURL=runner.d.ts.map