@fuaran-ui/ops 0.19.0 → 0.22.0

package/dist/index.d.cts

@@ -1,4 +1,5 @@
-import { Result, NodeId, NodeKind, JsonValue, Binding, SemanticStyle, StateBehaviour, Node, Cell, ColExpr, DataSource, Transform, EvalError, Table, TextSource, CellFormat, ColumnWidth, Orientation, ToneVariant, StyleWeight, Emphasis, TrendPolarity, HeadingVariant, BadgeVariant, IconSource, IconSize, DecodePolicy } from '@fuaran-ui/schema';
+import { Result, NodeId, NodeKind, JsonValue, Binding, SemanticStyle, StateBehaviour, Node, Cell, ColExpr, DataSource, Transform, EvalError, Table, TextSource, CellFormat, ColumnWidth, Orientation, ToneVariant, StyleWeight, Emphasis, TrendPolarity, HeadingVariant, BadgeVariant, IconSource, IconSize, DecodePolicy, Capability } from '@fuaran-ui/schema';
+export { Capability, Placement as CapabilityPlacement, CapabilitySigEntry, CapabilitySignature, IslandKind } from '@fuaran-ui/schema';
 
 /** Local JSON AST. Shape-for-shape port of the F# decoder's private `Json` DU. */
 type JsonAst = {
@@ -35,9 +36,11 @@ interface ParseError {
 }
 /**
  * Parse a JSON document into the local AST. Mirrors the F# `tryParse`: empty /
- * whitespace-only input is a structural error; otherwise a single top-level
- * value is parsed (trailing content after the first value is not inspected,
- * matching the F# parser).
+ * whitespace-only input is a structural error; a document past the §21.7
+ * ceiling is refused BEFORE the parse; and per §20.2 row 2 the root value must
+ * be followed by nothing but whitespace — §1 makes a wire artefact a single
+ * JSON document, and this parser used to stop at the first value and ignore the
+ * remainder, which is a framing ambiguity rather than a tolerance.
  */
 declare const parse: (input: string) => Result<JsonAst, ParseError>;
 /** Look up an object field by key (key-order tolerant per WIRE_FORMAT.md §2). */
@@ -140,6 +143,13 @@ declare const evalErrorString: (e: EvalError) => string;
 declare const stepParams: (t: Transform) => readonly string[];
 /** Every distinct param name a pipeline references — the TS mirror of Core `Transform.paramsOf`. */
 declare const pipelineParams: (pipeline: readonly Transform[]) => readonly string[];
+/**
+ * Substitute every `inParam` bound in `listEnv` with the literal `in` form, through the
+ * whole pipeline — the TS mirror of Core `Transform.substituteListParams`. Unbound list
+ * params are left intact for the caller's prune to catch. Only `filter` / `derive` carry
+ * a `ColExpr`; every other step is returned unchanged.
+ */
+declare const substituteListParams: (listEnv: Readonly<Record<string, readonly Cell[]>>, pipeline: readonly Transform[]) => readonly Transform[];
 
 /** Stable AI-friendly discriminator for decode-time failures (WIRE_FORMAT.md §6). */
 type DecodeErrorCode = 'INVALID_JSON' | 'MISSING_FIELD' | 'WRONG_TYPE' | 'UNKNOWN_DU_CASE' | 'WRONG_NODE_KIND' | 'EMPTY_NODE_ID'
@@ -172,6 +182,17 @@ interface DecodeError {
     readonly expectedShape?: string;
 }
 type R<T> = Result<T, DecodeError>;
+type CR<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/** A `DataSource` — port of F# `ColumnCodec.decodeJson` (Phase 88: `schema`
+ *  may be omitted on an embedded source; inferred in Ordinal column order). */
+declare const decodeDataSource: (j: JsonAst) => CR<DataSource>;
+declare const decodePipelineCore: (j: JsonAst) => CR<Transform[]>;
 /**
  * Phase 818 — materialise a LIVE Transform source's resolved store value as the
  * evaluation input table: row-major rows transpose through the same 815
@@ -249,6 +270,54 @@ declare const decodeNode: (json: string, policy?: DecodePolicy) => R<Node<unknow
  * only rather than a closure.
  */
 declare const decodeOp: (json: string, policy?: DecodePolicy) => R<TreeOp<unknown>>;
+/**
+ * Decode a canonical-JSON payload holding EITHER one `TreeOp` or an array of
+ * them — the shape a host sends down an op channel.
+ *
+ * It exists because the obvious composition is unsound. A consumer holding
+ * "one op or an array" reaches for `JSON.parse`, walks the array, and calls
+ * `decodeOp(JSON.stringify(entry))` per element; the embedded standalone bundle
+ * did exactly that. Three things go wrong, and none of them is visible from the
+ * call site:
+ *
+ *  - The whole payload passes through `JSON.parse` BEFORE any bound applies, so
+ *    the §21 depth gate never sees it. `JSON.parse` is native and will not
+ *    overflow, but the document it hands back is unbounded, and the per-op
+ *    decode that follows measures each op against a limit the batch already
+ *    escaped.
+ *  - `JSON.parse` is a different parser with different §20 answers: it keeps the
+ *    LAST duplicate member, reads `1e999` as `Infinity`, and accepts nothing
+ *    this parser refuses. Re-stringifying its output launders every one of those
+ *    differences into bytes this decoder then accepts without complaint — the
+ *    §20.1 undeclared-entry-point defect, arrived at by composition.
+ *  - `MAX_NODES` is reset per `decodeOp` call, so it bounded ONE op rather than
+ *    the batch: 1 000 ops of 100 000 nodes each passed every check.
+ *
+ * So the batch is parsed ONCE through this package's own parser, the array is
+ * split at the AST, and the node budget is carried ACROSS the ops rather than
+ * reset per op.
+ */
+declare const decodeOps: (json: string, policy?: DecodePolicy) => R<readonly TreeOp<unknown>[]>;
+
+/** A total codec result — a value, or a named refusal. Never a throw. */
+type CapabilityDeclResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Encode a capability declaration to its canonical-JSON string. Total: every
+ * field of every case is representable, so there is nothing to refuse.
+ */
+declare const encodeCapabilityDeclaration: (cap: Capability) => string;
+/**
+ * Decode a canonical capability-declaration string. Total — a malformed or
+ * un-carryable declaration yields `{ ok: false, error }` naming what was wrong,
+ * never an exception and never a partially-built capability.
+ */
+declare const decodeCapabilityDeclaration: (json: string) => CapabilityDeclResult<Capability>;
 
 type ApplyErrorCode = 'NodeNotFound' | 'ParentNotFound' | 'ChildlessKind' | 'PositionOutOfRange' | 'DuplicateNodeId' | 'FieldNotFound' | 'SlotNotFound' | 'KindMismatch' | 'PathInvalid' | 'PathNotSupportedYet' | 'OrderingMismatch' | 'BatchAborted';
 interface ApplyError {
@@ -435,6 +504,22 @@ declare const pasteOpWith: <TMsg>(freshIds: FreshIds, targetRoot: Node<TMsg>, in
 /** `pasteOpWith` under the default derived-suffix id strategy. */
 declare const pasteOp: <TMsg>(targetRoot: Node<TMsg>, incoming: Node<TMsg>, target: PlaceTarget) => Result<TreeOp<TMsg>, PlaceError>;
 
+/**
+ * Who authored a DAG op. Structurally identical to `Actor` in
+ * `@fuaran-ui/op-stream`, and DELIBERATELY declared here rather than imported:
+ * op-stream depends on this package, so importing it would invert the package
+ * dependency. TypeScript is structurally typed, so an op-stream `Actor` is
+ * assignable here and vice versa with no import and no new dependency edge.
+ */
+type DagActor = {
+    readonly kind: 'human';
+    readonly id: string;
+} | {
+    readonly kind: 'agent';
+    readonly model: string;
+    readonly version: string;
+    readonly id: string;
+};
 /** The result envelope captured on a DAG record (closed shape). */
 type DagResultEnvelope = {
     readonly $type: 'Success';
@@ -457,7 +542,7 @@ interface DagOpRecord<TMsg = unknown> {
     readonly op: TreeOp<TMsg>;
     readonly outcomeHash?: string;
     readonly promptId?: string;
-    readonly userId: string;
+    readonly actor: DagActor;
     /** Unix seconds. */
     readonly timestamp: number;
     readonly resultEnvelope: DagResultEnvelope;
@@ -465,10 +550,10 @@ interface DagOpRecord<TMsg = unknown> {
 }
 /**
  * Encode a `DagOpRecord` to its canonical JSON wire form. Keys in Ordinal order
- * (hash < op < outcomeHash < parents < promptId < resultEnvelope < streamId <
- * timestamp < tombstoned < userId); `outcomeHash` / `promptId` omitted when
- * absent; `op` nests `encodeOp` verbatim. Byte-identical to the F#
- * `DagWire.encodeRecord`.
+ * (actor < hash < op < outcomeHash < parents < promptId < resultEnvelope <
+ * streamId < timestamp < tombstoned); `outcomeHash` / `promptId` omitted when
+ * absent; `op` nests `encodeOp` and `actor` nests the canonical actor form
+ * verbatim. Byte-identical to the F# `DagWire.encodeRecord`.
  */
 declare const encodeDagRecord: <TMsg>(record: DagOpRecord<TMsg>) => string;
 type DecodeResult<T> = {
@@ -486,10 +571,62 @@ type DecodeResult<T> = {
 declare const decodeDagRecord: (json: string) => DecodeResult<DagOpRecord<unknown>>;
 
 type N = Node<unknown>;
-/** A `(nodeId, facet)` cell that could not be auto-merged. */
+/**
+ * The class of a merge refusal. Mirrors the reference host's
+ * `MergeConflictClass` spelling-for-spelling — these strings are the `class`
+ * member of the committed refusal envelope, so they are wire, not prose.
+ */
+type MergeConflictClass = 'ConcurrentEdit' | 'ConcurrentMove' | 'DeleteModify' | 'KindSwapOrphansPin' | 'ReorderVsStructural' | 'CombinedCycle';
+/**
+ * One SIDE of a two-sided refusal: that branch's value for the contended cell,
+ * plus the branch's own opaque provenance tag.
+ *
+ * The `value` is the contended cell's canonical encoding, EXCEPT for the
+ * `style.*` sub-facets, whose value is the sub-field's case name — which
+ * coincides with its wire spelling only because every style sub-field is
+ * enum-shaped. Do not generalise it to a compound cell.
+ */
+interface MergeSide {
+    readonly value: string;
+    readonly tag?: string;
+}
+/**
+ * A `(nodeId, facet)` cell that could not be auto-merged, as a two-sided
+ * recovery envelope.
+ *
+ * `a` and `b` are the SIDES view: the first- and second-argument branches'
+ * values for the contended cell, populated on EVERY refusal. Swapping the
+ * branches TRANSPOSES them and changes nothing else — which is what lets two
+ * replicas that merged the same pair in opposite orders agree about what the
+ * other side wanted. `base` is the LCA value (the empty string for a cell that
+ * exists on neither side of the LCA, such as an `insert`).
+ *
+ * `primacyHeld` is the precedence view, and on this tier it is always `false`:
+ * `merge3Way` is the author-agnostic entry point, so neither side is pinned.
+ * The reference host's precedence slots (`primary` / `secondary` /
+ * `secondaryTag`) are deliberately NOT mirrored here — they are populated
+ * exactly when a pin is held, and this tier has no author classifier to hold one
+ * with, so they could only ever be absent. They arrive with the entry point that
+ * supplies an author, not before.
+ *
+ * The reference host's `choices` menu is not mirrored either, but for a
+ * different reason, and the difference matters to whoever ports it. It is NOT
+ * empty on this tier: every choice the reference offers names a slot the
+ * envelope populated, so an unpinned refusal offers `KeepBase` / `KeepA` /
+ * `KeepB` — all three well-defined here — rather than the `KeepSecondary` that
+ * would name the empty precedence slot. The menu is left out because it is
+ * derivable from the sides plus the pin, which is also why the shared refusal
+ * corpus does not encode it; a port that wants it computes it, and must not
+ * infer from the absence that this tier has no menu to offer.
+ */
 interface MergeConflict {
     readonly nodeId: string;
     readonly facet: string;
+    readonly class: MergeConflictClass;
+    readonly base: string;
+    readonly a: MergeSide;
+    readonly b: MergeSide;
+    readonly primacyHeld: boolean;
 }
 /** Outcome of a 3-way merge: the merged tree, or the conflicting cells. */
 type MergeResult = {
@@ -506,6 +643,25 @@ type MergeResult = {
  * tie-break, no wall-clock) — byte-identical to the F# `TreeMerge.merge3Way`.
  */
 declare const merge3Way: (base: N, a: N, b: N) => MergeResult;
+/**
+ * Order a refusal set deterministically. `(nodeId, facet)` is unique within one
+ * merge — a facet of a node is merged once — so this totally orders an envelope
+ * regardless of the fold's internal emission order.
+ */
+declare const sortConflictsCanonical: (conflicts: readonly MergeConflict[]) => readonly MergeConflict[];
+/**
+ * Canonical JSON of a REFUSAL envelope: the conflict set as a sorted array of
+ * `{a,b,base,class,facet,nodeId,primacyHeld}` objects (object keys alphabetical,
+ * array entries in `(nodeId, facet)` order). Byte-stable across hosts, so a
+ * sha256 over it is the cross-host refusal hash — the determinism artefact for a
+ * REFUSED structural merge, the analogue of the outcome hash for an auto-merge.
+ *
+ * The precedence view is deliberately projected as `primacyHeld` alone: the
+ * pinned winner and loser are derivable from the sides plus the pin, and a
+ * corpus that committed both would pin the same value twice and go red on a host
+ * that agreed about the merge.
+ */
+declare const encodeMergeEnvelope: (conflicts: readonly MergeConflict[]) => string;
 
 /**
  * A wire profile id — `<name>@<major>.<minor>` (e.g. `core@1.0`). `name` is the
@@ -817,4 +973,74 @@ declare const withStateSeeds: <TMsg, S extends {
     readonly state?: Readonly<Record<string, unknown>>;
 }>(tree: Node<TMsg>, sources: S) => S;
 
-export { type Answer, type AnswerContract, type AnswerField, type AnswerSpace, type AnswerValue, type ApplyError, type ApplyErrorCode, type ApplyResult, type Compatibility, type DagOpRecord, type DagResultEnvelope, type DecodeError, type DecodeErrorCode, type Decoded, ELICITATION_KEY, ELICITATION_VERSION, type ElicitationEnvelope, type ElicitationError, type ElicitationErrorCode, type ElicitationOutcome, type ElicitationOutcomeEnvelope, type Envelope, type EnvelopeError, type EnvelopeErrorCode, type EvalEnv, type FreshIds, HOST_RESERVED_PREFIX, type JsonAst, type MergeConflict, type MergeResult, type OpApplyTelemetryRecord, PAYLOAD_KEY, PROFILE_KEY, type ParseError, type PlaceError, type PlaceTarget, type Placement, type Profile, REQUIRED_PROFILE_KEY, type SourceResolver, type TreeOp, type UnknownKind, apply, canPlace, cellString, coerce, collectStateSeeds, coreV1, decodeDagRecord, decodeElicitation, decodeElicitationOutcome, decodeEnvelope, decodeEnvelopeAst, decodeNode, decodeNodeTolerant, decodeOp, decodeTolerant, derivedFreshIds, duplicateOp, duplicateOpWith, encodeCell, encodeColExpr, encodeDagRecord, encodeDataSource, encodeElicitation, encodeElicitationOutcome, encodeEnvelope, encodeNode, encodeOp, encodePipeline, evalErrorString, evalPipeline, evalPipelineInEnv, evalPipelineWith, evalPipelineWithInEnv, evalSource, field as jsonField, liveValueToTable, merge3Way, moveOp, negotiate, negotiateEnvelope, noResolve, nudgeOp, parse, pasteOp, pasteOpWith, pipelineParams, placeOp, reencodeNode, renderAstCanonical, renderProfile, sequentialFreshIds, stepParams, tryParseProfile, validateAnswer, validateAnswerAt, validateAnswerDocument, withStateSeeds };
+/**
+ * The identity text rendition of a buffered value.
+ *
+ * `String(v)` is deliberately not used for numbers: it spells `1e21` as `1e+21`
+ * here and `1E+21` on .NET, and the hosts have to agree. `formatFiniteDouble` is
+ * the layout the corpus bytes already go through, so a number reads here exactly
+ * as it reads on the wire.
+ */
+declare const identityFormat: (v: unknown) => string;
+/**
+ * The JSON number grammar, and nothing wider. Surrounding ASCII whitespace is
+ * trimmed first — a reader's trailing space is not a type error — but a leading
+ * `+`, a bare `.5`, a hex literal and a thousands separator are all refused,
+ * because a grammar each host guesses at is a grammar each host guesses at
+ * differently.
+ *
+ * `Number(text)` is emphatically NOT the implementation: it accepts `0x10`,
+ * `Infinity`, `1_0` and the empty string, all of which this must refuse.
+ */
+declare const tryNumberText: (text: string) => number | undefined;
+/**
+ * The scalar a piece of buffer text denotes, when it denotes one. `true` /
+ * `false` and the JSON number grammar only — an empty string is NOT null here,
+ * because a cleared text field is an empty string and reading it as "no value"
+ * would make the buffer lie about what the reader did.
+ */
+declare const scalarOfText: (text: string) => string | number | boolean | undefined;
+/**
+ * Fixed-point text: sign, integer part, and EXACTLY `decimals` fraction digits,
+ * `.` as the point, no grouping. Rounding is half-away-from-zero, spelled as
+ * `floor(x + 0.5)` on the absolute value rather than as `toFixed` — `toFixed`
+ * rounds half-to-even on some values through the double's binary expansion, and
+ * a rounding mode each host picks a default for is a divergence waiting to be
+ * found by a fixture.
+ */
+declare const fixedText: (decimals: number, v: number) => string;
+/**
+ * The `Format.Number` codec's rendition: fixed-point at the declared decimals,
+ * or the identity when the codec declares none.
+ *
+ * A NON-numeric buffered value falls back to the identity text rather than
+ * failing. The codec is a declaration about presentation, and a value of the
+ * wrong shape underneath it is the slot's problem, reported by the slot — a
+ * format function that threw here would take out the render of a tree whose only
+ * defect is a mistyped binding.
+ */
+declare const numberText: (decimals: number | undefined, v: unknown) => string;
+/**
+ * The wire-survivability failure a DECODED host-only projection throws when a
+ * reader tries to run it.
+ *
+ * It exists because the alternative — returning a default — is
+ * indistinguishable from a real answer at the slot: a decoded `Binding.Computed`
+ * used to hand back `undefined` and render it as though the computation had run.
+ *
+ * The `name` is set explicitly and consumers match on IT rather than on
+ * `instanceof`: the renderer lives in another package with its own bundle, so an
+ * identity check across the boundary is a check on which copy of the class was
+ * loaded, which is not the question being asked.
+ */
+declare class WireSurvivabilityError extends Error {
+    constructor(message: string);
+}
+/**
+ * The one message a decoded `Binding.Computed` carries. A constant rather than a
+ * template at each site so the resolver can recognise it, the corpus can pin it,
+ * and every host can render the same sentence.
+ */
+declare const DECODED_COMPUTED_MESSAGE = "Binding.Computed has no wire projection (decoded from a '<closure>' sentinel) \u2014 use Binding.Expr / Transform / State";
+
+export { type Answer, type AnswerContract, type AnswerField, type AnswerSpace, type AnswerValue, type ApplyError, type ApplyErrorCode, type ApplyResult, type CapabilityDeclResult, type Compatibility, DECODED_COMPUTED_MESSAGE, type DagActor, type DagOpRecord, type DagResultEnvelope, type DecodeError, type DecodeErrorCode, type Decoded, ELICITATION_KEY, ELICITATION_VERSION, type ElicitationEnvelope, type ElicitationError, type ElicitationErrorCode, type ElicitationOutcome, type ElicitationOutcomeEnvelope, type Envelope, type EnvelopeError, type EnvelopeErrorCode, type EvalEnv, type FreshIds, HOST_RESERVED_PREFIX, type JsonAst, type MergeConflict, type MergeConflictClass, type MergeResult, type MergeSide, type OpApplyTelemetryRecord, PAYLOAD_KEY, PROFILE_KEY, type ParseError, type PlaceError, type PlaceTarget, type Placement, type Profile, REQUIRED_PROFILE_KEY, type SourceResolver, type TreeOp, type UnknownKind, WireSurvivabilityError, apply, canPlace, cellString, coerce, collectStateSeeds, coreV1, decodeCapabilityDeclaration, decodeDagRecord, decodeDataSource, decodeElicitation, decodeElicitationOutcome, decodeEnvelope, decodeEnvelopeAst, decodeNode, decodeNodeTolerant, decodeOp, decodeOps, decodePipelineCore as decodePipeline, decodeTolerant, derivedFreshIds, duplicateOp, duplicateOpWith, encodeCapabilityDeclaration, encodeCell, encodeColExpr, encodeDagRecord, encodeDataSource, encodeElicitation, encodeElicitationOutcome, encodeEnvelope, encodeMergeEnvelope, encodeNode, encodeOp, encodePipeline, evalErrorString, evalPipeline, evalPipelineInEnv, evalPipelineWith, evalPipelineWithInEnv, evalSource, fixedText, identityFormat, field as jsonField, liveValueToTable, merge3Way, moveOp, negotiate, negotiateEnvelope, noResolve, nudgeOp, numberText, parse, pasteOp, pasteOpWith, pipelineParams, placeOp, reencodeNode, renderAstCanonical, renderProfile, scalarOfText, sequentialFreshIds, sortConflictsCanonical, stepParams, substituteListParams, tryNumberText, tryParseProfile, validateAnswer, validateAnswerAt, validateAnswerDocument, withStateSeeds };

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-import { Result, NodeId, NodeKind, JsonValue, Binding, SemanticStyle, StateBehaviour, Node, Cell, ColExpr, DataSource, Transform, EvalError, Table, TextSource, CellFormat, ColumnWidth, Orientation, ToneVariant, StyleWeight, Emphasis, TrendPolarity, HeadingVariant, BadgeVariant, IconSource, IconSize, DecodePolicy } from '@fuaran-ui/schema';
+import { Result, NodeId, NodeKind, JsonValue, Binding, SemanticStyle, StateBehaviour, Node, Cell, ColExpr, DataSource, Transform, EvalError, Table, TextSource, CellFormat, ColumnWidth, Orientation, ToneVariant, StyleWeight, Emphasis, TrendPolarity, HeadingVariant, BadgeVariant, IconSource, IconSize, DecodePolicy, Capability } from '@fuaran-ui/schema';
+export { Capability, Placement as CapabilityPlacement, CapabilitySigEntry, CapabilitySignature, IslandKind } from '@fuaran-ui/schema';
 
 /** Local JSON AST. Shape-for-shape port of the F# decoder's private `Json` DU. */
 type JsonAst = {
@@ -35,9 +36,11 @@ interface ParseError {
 }
 /**
  * Parse a JSON document into the local AST. Mirrors the F# `tryParse`: empty /
- * whitespace-only input is a structural error; otherwise a single top-level
- * value is parsed (trailing content after the first value is not inspected,
- * matching the F# parser).
+ * whitespace-only input is a structural error; a document past the §21.7
+ * ceiling is refused BEFORE the parse; and per §20.2 row 2 the root value must
+ * be followed by nothing but whitespace — §1 makes a wire artefact a single
+ * JSON document, and this parser used to stop at the first value and ignore the
+ * remainder, which is a framing ambiguity rather than a tolerance.
  */
 declare const parse: (input: string) => Result<JsonAst, ParseError>;
 /** Look up an object field by key (key-order tolerant per WIRE_FORMAT.md §2). */
@@ -140,6 +143,13 @@ declare const evalErrorString: (e: EvalError) => string;
 declare const stepParams: (t: Transform) => readonly string[];
 /** Every distinct param name a pipeline references — the TS mirror of Core `Transform.paramsOf`. */
 declare const pipelineParams: (pipeline: readonly Transform[]) => readonly string[];
+/**
+ * Substitute every `inParam` bound in `listEnv` with the literal `in` form, through the
+ * whole pipeline — the TS mirror of Core `Transform.substituteListParams`. Unbound list
+ * params are left intact for the caller's prune to catch. Only `filter` / `derive` carry
+ * a `ColExpr`; every other step is returned unchanged.
+ */
+declare const substituteListParams: (listEnv: Readonly<Record<string, readonly Cell[]>>, pipeline: readonly Transform[]) => readonly Transform[];
 
 /** Stable AI-friendly discriminator for decode-time failures (WIRE_FORMAT.md §6). */
 type DecodeErrorCode = 'INVALID_JSON' | 'MISSING_FIELD' | 'WRONG_TYPE' | 'UNKNOWN_DU_CASE' | 'WRONG_NODE_KIND' | 'EMPTY_NODE_ID'
@@ -172,6 +182,17 @@ interface DecodeError {
     readonly expectedShape?: string;
 }
 type R<T> = Result<T, DecodeError>;
+type CR<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/** A `DataSource` — port of F# `ColumnCodec.decodeJson` (Phase 88: `schema`
+ *  may be omitted on an embedded source; inferred in Ordinal column order). */
+declare const decodeDataSource: (j: JsonAst) => CR<DataSource>;
+declare const decodePipelineCore: (j: JsonAst) => CR<Transform[]>;
 /**
  * Phase 818 — materialise a LIVE Transform source's resolved store value as the
  * evaluation input table: row-major rows transpose through the same 815
@@ -249,6 +270,54 @@ declare const decodeNode: (json: string, policy?: DecodePolicy) => R<Node<unknow
  * only rather than a closure.
  */
 declare const decodeOp: (json: string, policy?: DecodePolicy) => R<TreeOp<unknown>>;
+/**
+ * Decode a canonical-JSON payload holding EITHER one `TreeOp` or an array of
+ * them — the shape a host sends down an op channel.
+ *
+ * It exists because the obvious composition is unsound. A consumer holding
+ * "one op or an array" reaches for `JSON.parse`, walks the array, and calls
+ * `decodeOp(JSON.stringify(entry))` per element; the embedded standalone bundle
+ * did exactly that. Three things go wrong, and none of them is visible from the
+ * call site:
+ *
+ *  - The whole payload passes through `JSON.parse` BEFORE any bound applies, so
+ *    the §21 depth gate never sees it. `JSON.parse` is native and will not
+ *    overflow, but the document it hands back is unbounded, and the per-op
+ *    decode that follows measures each op against a limit the batch already
+ *    escaped.
+ *  - `JSON.parse` is a different parser with different §20 answers: it keeps the
+ *    LAST duplicate member, reads `1e999` as `Infinity`, and accepts nothing
+ *    this parser refuses. Re-stringifying its output launders every one of those
+ *    differences into bytes this decoder then accepts without complaint — the
+ *    §20.1 undeclared-entry-point defect, arrived at by composition.
+ *  - `MAX_NODES` is reset per `decodeOp` call, so it bounded ONE op rather than
+ *    the batch: 1 000 ops of 100 000 nodes each passed every check.
+ *
+ * So the batch is parsed ONCE through this package's own parser, the array is
+ * split at the AST, and the node budget is carried ACROSS the ops rather than
+ * reset per op.
+ */
+declare const decodeOps: (json: string, policy?: DecodePolicy) => R<readonly TreeOp<unknown>[]>;
+
+/** A total codec result — a value, or a named refusal. Never a throw. */
+type CapabilityDeclResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Encode a capability declaration to its canonical-JSON string. Total: every
+ * field of every case is representable, so there is nothing to refuse.
+ */
+declare const encodeCapabilityDeclaration: (cap: Capability) => string;
+/**
+ * Decode a canonical capability-declaration string. Total — a malformed or
+ * un-carryable declaration yields `{ ok: false, error }` naming what was wrong,
+ * never an exception and never a partially-built capability.
+ */
+declare const decodeCapabilityDeclaration: (json: string) => CapabilityDeclResult<Capability>;
 
 type ApplyErrorCode = 'NodeNotFound' | 'ParentNotFound' | 'ChildlessKind' | 'PositionOutOfRange' | 'DuplicateNodeId' | 'FieldNotFound' | 'SlotNotFound' | 'KindMismatch' | 'PathInvalid' | 'PathNotSupportedYet' | 'OrderingMismatch' | 'BatchAborted';
 interface ApplyError {
@@ -435,6 +504,22 @@ declare const pasteOpWith: <TMsg>(freshIds: FreshIds, targetRoot: Node<TMsg>, in
 /** `pasteOpWith` under the default derived-suffix id strategy. */
 declare const pasteOp: <TMsg>(targetRoot: Node<TMsg>, incoming: Node<TMsg>, target: PlaceTarget) => Result<TreeOp<TMsg>, PlaceError>;
 
+/**
+ * Who authored a DAG op. Structurally identical to `Actor` in
+ * `@fuaran-ui/op-stream`, and DELIBERATELY declared here rather than imported:
+ * op-stream depends on this package, so importing it would invert the package
+ * dependency. TypeScript is structurally typed, so an op-stream `Actor` is
+ * assignable here and vice versa with no import and no new dependency edge.
+ */
+type DagActor = {
+    readonly kind: 'human';
+    readonly id: string;
+} | {
+    readonly kind: 'agent';
+    readonly model: string;
+    readonly version: string;
+    readonly id: string;
+};
 /** The result envelope captured on a DAG record (closed shape). */
 type DagResultEnvelope = {
     readonly $type: 'Success';
@@ -457,7 +542,7 @@ interface DagOpRecord<TMsg = unknown> {
     readonly op: TreeOp<TMsg>;
     readonly outcomeHash?: string;
     readonly promptId?: string;
-    readonly userId: string;
+    readonly actor: DagActor;
     /** Unix seconds. */
     readonly timestamp: number;
     readonly resultEnvelope: DagResultEnvelope;
@@ -465,10 +550,10 @@ interface DagOpRecord<TMsg = unknown> {
 }
 /**
  * Encode a `DagOpRecord` to its canonical JSON wire form. Keys in Ordinal order
- * (hash < op < outcomeHash < parents < promptId < resultEnvelope < streamId <
- * timestamp < tombstoned < userId); `outcomeHash` / `promptId` omitted when
- * absent; `op` nests `encodeOp` verbatim. Byte-identical to the F#
- * `DagWire.encodeRecord`.
+ * (actor < hash < op < outcomeHash < parents < promptId < resultEnvelope <
+ * streamId < timestamp < tombstoned); `outcomeHash` / `promptId` omitted when
+ * absent; `op` nests `encodeOp` and `actor` nests the canonical actor form
+ * verbatim. Byte-identical to the F# `DagWire.encodeRecord`.
  */
 declare const encodeDagRecord: <TMsg>(record: DagOpRecord<TMsg>) => string;
 type DecodeResult<T> = {
@@ -486,10 +571,62 @@ type DecodeResult<T> = {
 declare const decodeDagRecord: (json: string) => DecodeResult<DagOpRecord<unknown>>;
 
 type N = Node<unknown>;
-/** A `(nodeId, facet)` cell that could not be auto-merged. */
+/**
+ * The class of a merge refusal. Mirrors the reference host's
+ * `MergeConflictClass` spelling-for-spelling — these strings are the `class`
+ * member of the committed refusal envelope, so they are wire, not prose.
+ */
+type MergeConflictClass = 'ConcurrentEdit' | 'ConcurrentMove' | 'DeleteModify' | 'KindSwapOrphansPin' | 'ReorderVsStructural' | 'CombinedCycle';
+/**
+ * One SIDE of a two-sided refusal: that branch's value for the contended cell,
+ * plus the branch's own opaque provenance tag.
+ *
+ * The `value` is the contended cell's canonical encoding, EXCEPT for the
+ * `style.*` sub-facets, whose value is the sub-field's case name — which
+ * coincides with its wire spelling only because every style sub-field is
+ * enum-shaped. Do not generalise it to a compound cell.
+ */
+interface MergeSide {
+    readonly value: string;
+    readonly tag?: string;
+}
+/**
+ * A `(nodeId, facet)` cell that could not be auto-merged, as a two-sided
+ * recovery envelope.
+ *
+ * `a` and `b` are the SIDES view: the first- and second-argument branches'
+ * values for the contended cell, populated on EVERY refusal. Swapping the
+ * branches TRANSPOSES them and changes nothing else — which is what lets two
+ * replicas that merged the same pair in opposite orders agree about what the
+ * other side wanted. `base` is the LCA value (the empty string for a cell that
+ * exists on neither side of the LCA, such as an `insert`).
+ *
+ * `primacyHeld` is the precedence view, and on this tier it is always `false`:
+ * `merge3Way` is the author-agnostic entry point, so neither side is pinned.
+ * The reference host's precedence slots (`primary` / `secondary` /
+ * `secondaryTag`) are deliberately NOT mirrored here — they are populated
+ * exactly when a pin is held, and this tier has no author classifier to hold one
+ * with, so they could only ever be absent. They arrive with the entry point that
+ * supplies an author, not before.
+ *
+ * The reference host's `choices` menu is not mirrored either, but for a
+ * different reason, and the difference matters to whoever ports it. It is NOT
+ * empty on this tier: every choice the reference offers names a slot the
+ * envelope populated, so an unpinned refusal offers `KeepBase` / `KeepA` /
+ * `KeepB` — all three well-defined here — rather than the `KeepSecondary` that
+ * would name the empty precedence slot. The menu is left out because it is
+ * derivable from the sides plus the pin, which is also why the shared refusal
+ * corpus does not encode it; a port that wants it computes it, and must not
+ * infer from the absence that this tier has no menu to offer.
+ */
 interface MergeConflict {
     readonly nodeId: string;
     readonly facet: string;
+    readonly class: MergeConflictClass;
+    readonly base: string;
+    readonly a: MergeSide;
+    readonly b: MergeSide;
+    readonly primacyHeld: boolean;
 }
 /** Outcome of a 3-way merge: the merged tree, or the conflicting cells. */
 type MergeResult = {
@@ -506,6 +643,25 @@ type MergeResult = {
  * tie-break, no wall-clock) — byte-identical to the F# `TreeMerge.merge3Way`.
  */
 declare const merge3Way: (base: N, a: N, b: N) => MergeResult;
+/**
+ * Order a refusal set deterministically. `(nodeId, facet)` is unique within one
+ * merge — a facet of a node is merged once — so this totally orders an envelope
+ * regardless of the fold's internal emission order.
+ */
+declare const sortConflictsCanonical: (conflicts: readonly MergeConflict[]) => readonly MergeConflict[];
+/**
+ * Canonical JSON of a REFUSAL envelope: the conflict set as a sorted array of
+ * `{a,b,base,class,facet,nodeId,primacyHeld}` objects (object keys alphabetical,
+ * array entries in `(nodeId, facet)` order). Byte-stable across hosts, so a
+ * sha256 over it is the cross-host refusal hash — the determinism artefact for a
+ * REFUSED structural merge, the analogue of the outcome hash for an auto-merge.
+ *
+ * The precedence view is deliberately projected as `primacyHeld` alone: the
+ * pinned winner and loser are derivable from the sides plus the pin, and a
+ * corpus that committed both would pin the same value twice and go red on a host
+ * that agreed about the merge.
+ */
+declare const encodeMergeEnvelope: (conflicts: readonly MergeConflict[]) => string;
 
 /**
  * A wire profile id — `<name>@<major>.<minor>` (e.g. `core@1.0`). `name` is the
@@ -817,4 +973,74 @@ declare const withStateSeeds: <TMsg, S extends {
     readonly state?: Readonly<Record<string, unknown>>;
 }>(tree: Node<TMsg>, sources: S) => S;
 
-export { type Answer, type AnswerContract, type AnswerField, type AnswerSpace, type AnswerValue, type ApplyError, type ApplyErrorCode, type ApplyResult, type Compatibility, type DagOpRecord, type DagResultEnvelope, type DecodeError, type DecodeErrorCode, type Decoded, ELICITATION_KEY, ELICITATION_VERSION, type ElicitationEnvelope, type ElicitationError, type ElicitationErrorCode, type ElicitationOutcome, type ElicitationOutcomeEnvelope, type Envelope, type EnvelopeError, type EnvelopeErrorCode, type EvalEnv, type FreshIds, HOST_RESERVED_PREFIX, type JsonAst, type MergeConflict, type MergeResult, type OpApplyTelemetryRecord, PAYLOAD_KEY, PROFILE_KEY, type ParseError, type PlaceError, type PlaceTarget, type Placement, type Profile, REQUIRED_PROFILE_KEY, type SourceResolver, type TreeOp, type UnknownKind, apply, canPlace, cellString, coerce, collectStateSeeds, coreV1, decodeDagRecord, decodeElicitation, decodeElicitationOutcome, decodeEnvelope, decodeEnvelopeAst, decodeNode, decodeNodeTolerant, decodeOp, decodeTolerant, derivedFreshIds, duplicateOp, duplicateOpWith, encodeCell, encodeColExpr, encodeDagRecord, encodeDataSource, encodeElicitation, encodeElicitationOutcome, encodeEnvelope, encodeNode, encodeOp, encodePipeline, evalErrorString, evalPipeline, evalPipelineInEnv, evalPipelineWith, evalPipelineWithInEnv, evalSource, field as jsonField, liveValueToTable, merge3Way, moveOp, negotiate, negotiateEnvelope, noResolve, nudgeOp, parse, pasteOp, pasteOpWith, pipelineParams, placeOp, reencodeNode, renderAstCanonical, renderProfile, sequentialFreshIds, stepParams, tryParseProfile, validateAnswer, validateAnswerAt, validateAnswerDocument, withStateSeeds };
+/**
+ * The identity text rendition of a buffered value.
+ *
+ * `String(v)` is deliberately not used for numbers: it spells `1e21` as `1e+21`
+ * here and `1E+21` on .NET, and the hosts have to agree. `formatFiniteDouble` is
+ * the layout the corpus bytes already go through, so a number reads here exactly
+ * as it reads on the wire.
+ */
+declare const identityFormat: (v: unknown) => string;
+/**
+ * The JSON number grammar, and nothing wider. Surrounding ASCII whitespace is
+ * trimmed first — a reader's trailing space is not a type error — but a leading
+ * `+`, a bare `.5`, a hex literal and a thousands separator are all refused,
+ * because a grammar each host guesses at is a grammar each host guesses at
+ * differently.
+ *
+ * `Number(text)` is emphatically NOT the implementation: it accepts `0x10`,
+ * `Infinity`, `1_0` and the empty string, all of which this must refuse.
+ */
+declare const tryNumberText: (text: string) => number | undefined;
+/**
+ * The scalar a piece of buffer text denotes, when it denotes one. `true` /
+ * `false` and the JSON number grammar only — an empty string is NOT null here,
+ * because a cleared text field is an empty string and reading it as "no value"
+ * would make the buffer lie about what the reader did.
+ */
+declare const scalarOfText: (text: string) => string | number | boolean | undefined;
+/**
+ * Fixed-point text: sign, integer part, and EXACTLY `decimals` fraction digits,
+ * `.` as the point, no grouping. Rounding is half-away-from-zero, spelled as
+ * `floor(x + 0.5)` on the absolute value rather than as `toFixed` — `toFixed`
+ * rounds half-to-even on some values through the double's binary expansion, and
+ * a rounding mode each host picks a default for is a divergence waiting to be
+ * found by a fixture.
+ */
+declare const fixedText: (decimals: number, v: number) => string;
+/**
+ * The `Format.Number` codec's rendition: fixed-point at the declared decimals,
+ * or the identity when the codec declares none.
+ *
+ * A NON-numeric buffered value falls back to the identity text rather than
+ * failing. The codec is a declaration about presentation, and a value of the
+ * wrong shape underneath it is the slot's problem, reported by the slot — a
+ * format function that threw here would take out the render of a tree whose only
+ * defect is a mistyped binding.
+ */
+declare const numberText: (decimals: number | undefined, v: unknown) => string;
+/**
+ * The wire-survivability failure a DECODED host-only projection throws when a
+ * reader tries to run it.
+ *
+ * It exists because the alternative — returning a default — is
+ * indistinguishable from a real answer at the slot: a decoded `Binding.Computed`
+ * used to hand back `undefined` and render it as though the computation had run.
+ *
+ * The `name` is set explicitly and consumers match on IT rather than on
+ * `instanceof`: the renderer lives in another package with its own bundle, so an
+ * identity check across the boundary is a check on which copy of the class was
+ * loaded, which is not the question being asked.
+ */
+declare class WireSurvivabilityError extends Error {
+    constructor(message: string);
+}
+/**
+ * The one message a decoded `Binding.Computed` carries. A constant rather than a
+ * template at each site so the resolver can recognise it, the corpus can pin it,
+ * and every host can render the same sentence.
+ */
+declare const DECODED_COMPUTED_MESSAGE = "Binding.Computed has no wire projection (decoded from a '<closure>' sentinel) \u2014 use Binding.Expr / Transform / State";
+
+export { type Answer, type AnswerContract, type AnswerField, type AnswerSpace, type AnswerValue, type ApplyError, type ApplyErrorCode, type ApplyResult, type CapabilityDeclResult, type Compatibility, DECODED_COMPUTED_MESSAGE, type DagActor, type DagOpRecord, type DagResultEnvelope, type DecodeError, type DecodeErrorCode, type Decoded, ELICITATION_KEY, ELICITATION_VERSION, type ElicitationEnvelope, type ElicitationError, type ElicitationErrorCode, type ElicitationOutcome, type ElicitationOutcomeEnvelope, type Envelope, type EnvelopeError, type EnvelopeErrorCode, type EvalEnv, type FreshIds, HOST_RESERVED_PREFIX, type JsonAst, type MergeConflict, type MergeConflictClass, type MergeResult, type MergeSide, type OpApplyTelemetryRecord, PAYLOAD_KEY, PROFILE_KEY, type ParseError, type PlaceError, type PlaceTarget, type Placement, type Profile, REQUIRED_PROFILE_KEY, type SourceResolver, type TreeOp, type UnknownKind, WireSurvivabilityError, apply, canPlace, cellString, coerce, collectStateSeeds, coreV1, decodeCapabilityDeclaration, decodeDagRecord, decodeDataSource, decodeElicitation, decodeElicitationOutcome, decodeEnvelope, decodeEnvelopeAst, decodeNode, decodeNodeTolerant, decodeOp, decodeOps, decodePipelineCore as decodePipeline, decodeTolerant, derivedFreshIds, duplicateOp, duplicateOpWith, encodeCapabilityDeclaration, encodeCell, encodeColExpr, encodeDagRecord, encodeDataSource, encodeElicitation, encodeElicitationOutcome, encodeEnvelope, encodeMergeEnvelope, encodeNode, encodeOp, encodePipeline, evalErrorString, evalPipeline, evalPipelineInEnv, evalPipelineWith, evalPipelineWithInEnv, evalSource, fixedText, identityFormat, field as jsonField, liveValueToTable, merge3Way, moveOp, negotiate, negotiateEnvelope, noResolve, nudgeOp, numberText, parse, pasteOp, pasteOpWith, pipelineParams, placeOp, reencodeNode, renderAstCanonical, renderProfile, scalarOfText, sequentialFreshIds, sortConflictsCanonical, stepParams, substituteListParams, tryNumberText, tryParseProfile, validateAnswer, validateAnswerAt, validateAnswerDocument, withStateSeeds };