@fuaran-ui/ops 0.9.0 → 0.21.0

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { Result, NodeId, NodeKind, JsonValue, Binding, SemanticStyle, StateBehaviour, Node, Cell, ColExpr, DataSource, Transform, EvalError, Table, TextSource, CellFormat, ColumnWidth, Orientation, ToneVariant, StyleWeight, Emphasis, HeadingVariant, BadgeVariant, IconSource, IconSize } from '@fuaran-ui/schema';
+import { Result, NodeId, NodeKind, JsonValue, Binding, SemanticStyle, StateBehaviour, Node, Cell, ColExpr, DataSource, Transform, EvalError, Table, TextSource, CellFormat, ColumnWidth, Orientation, ToneVariant, StyleWeight, Emphasis, TrendPolarity, HeadingVariant, BadgeVariant, IconSource, IconSize, DecodePolicy } from '@fuaran-ui/schema';
 
 /** Local JSON AST. Shape-for-shape port of the F# decoder's private `Json` DU. */
 type JsonAst = {
@@ -23,6 +23,15 @@ type JsonAst = {
 interface ParseError {
     readonly message: string;
     readonly offset: number;
+    /**
+     * True when this failure is a WIRE_FORMAT.md §21 resource-limit breach rather
+     * than a syntax error. It exists because the two must not be reported the
+     * same way: §21.2 rule 2 forbids reporting a limit breach as `INVALID_JSON`,
+     * since the input is well-formed and merely too large to walk, and calling it
+     * malformed sends the author to repair the wrong thing. `decodeNode` reads
+     * this flag to choose between `INVALID_JSON` and `LIMIT_EXCEEDED`.
+     */
+    readonly limit?: boolean;
 }
 /**
  * Parse a JSON document into the local AST. Mirrors the F# `tryParse`: empty /
@@ -131,9 +140,37 @@ declare const evalErrorString: (e: EvalError) => string;
 declare const stepParams: (t: Transform) => readonly string[];
 /** Every distinct param name a pipeline references — the TS mirror of Core `Transform.paramsOf`. */
 declare const pipelineParams: (pipeline: readonly Transform[]) => readonly string[];
+/**
+ * Substitute every `inParam` bound in `listEnv` with the literal `in` form, through the
+ * whole pipeline — the TS mirror of Core `Transform.substituteListParams`. Unbound list
+ * params are left intact for the caller's prune to catch. Only `filter` / `derive` carry
+ * a `ColExpr`; every other step is returned unchanged.
+ */
+declare const substituteListParams: (listEnv: Readonly<Record<string, readonly Cell[]>>, pipeline: readonly Transform[]) => readonly Transform[];
 
 /** Stable AI-friendly discriminator for decode-time failures (WIRE_FORMAT.md §6). */
-type DecodeErrorCode = 'INVALID_JSON' | 'MISSING_FIELD' | 'WRONG_TYPE' | 'UNKNOWN_DU_CASE' | 'WRONG_NODE_KIND' | 'EMPTY_NODE_ID';
+type DecodeErrorCode = 'INVALID_JSON' | 'MISSING_FIELD' | 'WRONG_TYPE' | 'UNKNOWN_DU_CASE' | 'WRONG_NODE_KIND' | 'EMPTY_NODE_ID'
+/**
+ * A WIRE_FORMAT.md §21 resource limit was exceeded — the document is
+ * well-formed and merely too large to walk. Deliberately distinct from
+ * `INVALID_JSON`, which §21.2 rule 2 forbids using for this: calling a
+ * well-formed document malformed sends the author to repair the wrong thing.
+ */
+ | 'LIMIT_EXCEEDED'
+/**
+ * The document names a kind the HOST'S DECLARED decode policy does not admit
+ * (WIRE_FORMAT.md §23).
+ *
+ * Deliberately distinct from `WRONG_NODE_KIND`, which says the vocabulary has
+ * no such kind. This one says the kind exists and THIS DEPLOYMENT does not
+ * take it — a different fact with a different remedy, and conflating them
+ * would send a repairing author to invent a spelling that is already correct.
+ *
+ * Raised ONLY when a caller supplied a narrowing policy. With no policy the
+ * code is unreachable, which is what keeps §22's "a decoder owes nothing"
+ * true of the default decoder.
+ */
+ | 'KIND_NOT_ADMITTED';
 /** AI-recoverable decode-time failure. Mirrors the F# `DecodeError` record. */
 interface DecodeError {
     readonly code: DecodeErrorCode;
@@ -175,6 +212,8 @@ declare const coerce: {
     tone: (v: JsonValue) => Result<ToneVariant, string>;
     weight: (v: JsonValue) => Result<StyleWeight, string>;
     emphasis: (v: JsonValue) => Result<Emphasis, string>;
+    /** `Metric.TrendPolarity` (Phase 867) - the UpdateProp twin of `decodeTrendPolarity`. */
+    trendPolarity: (v: JsonValue) => Result<TrendPolarity, string>;
     /**
      * The behavioural `emphasis` BOOL on Fact / LabelValueRow — the UpdateProp
      * twin of `decodeEmphasisFlag`, so a TreeOp edit gets the same
@@ -189,10 +228,34 @@ declare const coerce: {
     iconSize: (v: JsonValue) => Result<IconSize, string>;
     stringOption: (v: JsonValue) => Result<string | undefined, string>;
 };
-/** Decode a canonical-JSON `Node` payload into the storage-shape `Node<unknown>`. */
-declare const decodeNode: (json: string) => R<Node<unknown>>;
-/** Decode a canonical-JSON `TreeOp` payload into the storage-shape `TreeOp<unknown>`. */
-declare const decodeOp: (json: string) => R<TreeOp<unknown>>;
+/**
+ * Decode a canonical-JSON `Node` payload into the storage-shape `Node<unknown>`.
+ *
+ * `policy` is the OPTIONAL WIRE_FORMAT §23 host-declared admission policy: a
+ * tree naming a kind outside it is refused with `KIND_NOT_ADMITTED` at the
+ * offending `kind.$type`, naming the kind and the policy. **Omitted, the decoder
+ * has exactly the obligations it had before** — every valid document decodes and
+ * the code is unreachable, which is what keeps §22 unqualified. Build a policy
+ * with `@fuaran-ui/schema`'s `CLOSED_PROFILE`, `excluding` or `admitting`.
+ *
+ * The reference host spells this as a sibling entry point rather than an
+ * optional argument, because F# optional parameters exist only on type members
+ * and defaulting in place would reshape its whole decoder surface. What the two
+ * hosts owe each other is the same behaviour on the same bytes, not the same
+ * arity — the `decode-policy/` corpus family is where that is asserted.
+ */
+declare const decodeNode: (json: string, policy?: DecodePolicy) => R<Node<unknown>>;
+/**
+ * Decode a canonical-JSON `TreeOp` payload into the storage-shape
+ * `TreeOp<unknown>`.
+ *
+ * `policy` is the optional §23 admission policy. A node kind reaches an op two
+ * ways — inside a node-bearing operation, and as `EditNode`'s replacement kind —
+ * and both are gated, because an op stream that could introduce a refused kind
+ * into an admitted tree would make the policy a property of the first decode
+ * only rather than a closure.
+ */
+declare const decodeOp: (json: string, policy?: DecodePolicy) => R<TreeOp<unknown>>;
 
 type ApplyErrorCode = 'NodeNotFound' | 'ParentNotFound' | 'ChildlessKind' | 'PositionOutOfRange' | 'DuplicateNodeId' | 'FieldNotFound' | 'SlotNotFound' | 'KindMismatch' | 'PathInvalid' | 'PathNotSupportedYet' | 'OrderingMismatch' | 'BatchAborted';
 interface ApplyError {
@@ -379,6 +442,22 @@ declare const pasteOpWith: <TMsg>(freshIds: FreshIds, targetRoot: Node<TMsg>, in
 /** `pasteOpWith` under the default derived-suffix id strategy. */
 declare const pasteOp: <TMsg>(targetRoot: Node<TMsg>, incoming: Node<TMsg>, target: PlaceTarget) => Result<TreeOp<TMsg>, PlaceError>;
 
+/**
+ * Who authored a DAG op. Structurally identical to `Actor` in
+ * `@fuaran-ui/op-stream`, and DELIBERATELY declared here rather than imported:
+ * op-stream depends on this package, so importing it would invert the package
+ * dependency. TypeScript is structurally typed, so an op-stream `Actor` is
+ * assignable here and vice versa with no import and no new dependency edge.
+ */
+type DagActor = {
+    readonly kind: 'human';
+    readonly id: string;
+} | {
+    readonly kind: 'agent';
+    readonly model: string;
+    readonly version: string;
+    readonly id: string;
+};
 /** The result envelope captured on a DAG record (closed shape). */
 type DagResultEnvelope = {
     readonly $type: 'Success';
@@ -401,7 +480,7 @@ interface DagOpRecord<TMsg = unknown> {
     readonly op: TreeOp<TMsg>;
     readonly outcomeHash?: string;
     readonly promptId?: string;
-    readonly userId: string;
+    readonly actor: DagActor;
     /** Unix seconds. */
     readonly timestamp: number;
     readonly resultEnvelope: DagResultEnvelope;
@@ -409,10 +488,10 @@ interface DagOpRecord<TMsg = unknown> {
 }
 /**
  * Encode a `DagOpRecord` to its canonical JSON wire form. Keys in Ordinal order
- * (hash < op < outcomeHash < parents < promptId < resultEnvelope < streamId <
- * timestamp < tombstoned < userId); `outcomeHash` / `promptId` omitted when
- * absent; `op` nests `encodeOp` verbatim. Byte-identical to the F#
- * `DagWire.encodeRecord`.
+ * (actor < hash < op < outcomeHash < parents < promptId < resultEnvelope <
+ * streamId < timestamp < tombstoned); `outcomeHash` / `promptId` omitted when
+ * absent; `op` nests `encodeOp` and `actor` nests the canonical actor form
+ * verbatim. Byte-identical to the F# `DagWire.encodeRecord`.
  */
 declare const encodeDagRecord: <TMsg>(record: DagOpRecord<TMsg>) => string;
 type DecodeResult<T> = {
@@ -729,4 +808,36 @@ declare const decodeElicitationOutcome: (json: string) => Result<ElicitationOutc
  */
 declare const validateAnswerDocument: (json: string) => Result<undefined, ElicitationError>;
 
-export { type Answer, type AnswerContract, type AnswerField, type AnswerSpace, type AnswerValue, type ApplyError, type ApplyErrorCode, type ApplyResult, type Compatibility, type DagOpRecord, type DagResultEnvelope, type DecodeError, type DecodeErrorCode, type Decoded, ELICITATION_KEY, ELICITATION_VERSION, type ElicitationEnvelope, type ElicitationError, type ElicitationErrorCode, type ElicitationOutcome, type ElicitationOutcomeEnvelope, type Envelope, type EnvelopeError, type EnvelopeErrorCode, type EvalEnv, type FreshIds, type JsonAst, type MergeConflict, type MergeResult, type OpApplyTelemetryRecord, PAYLOAD_KEY, PROFILE_KEY, type ParseError, type PlaceError, type PlaceTarget, type Placement, type Profile, REQUIRED_PROFILE_KEY, type SourceResolver, type TreeOp, type UnknownKind, apply, canPlace, cellString, coerce, coreV1, decodeDagRecord, decodeElicitation, decodeElicitationOutcome, decodeEnvelope, decodeEnvelopeAst, decodeNode, decodeNodeTolerant, decodeOp, decodeTolerant, derivedFreshIds, duplicateOp, duplicateOpWith, encodeCell, encodeColExpr, encodeDagRecord, encodeDataSource, encodeElicitation, encodeElicitationOutcome, encodeEnvelope, encodeNode, encodeOp, encodePipeline, evalErrorString, evalPipeline, evalPipelineInEnv, evalPipelineWith, evalPipelineWithInEnv, evalSource, field as jsonField, liveValueToTable, merge3Way, moveOp, negotiate, negotiateEnvelope, noResolve, nudgeOp, parse, pasteOp, pasteOpWith, pipelineParams, placeOp, reencodeNode, renderAstCanonical, renderProfile, sequentialFreshIds, stepParams, tryParseProfile, validateAnswer, validateAnswerAt, validateAnswerDocument };
+/**
+ * Keys under this prefix are HOST-OWNED: a tree-originated write naming one is
+ * refused, so a tree-originated SEED naming one must be too.
+ *
+ * Declared here rather than imported because the TypeScript tier carries no
+ * shared state-key policy module (the F# tier's `Fuaran.UI.StateKeyPolicy`).
+ * It must stay in step with that definition — there is one prefix, and a host
+ * that names a slot `host.<whatever>` is entitled to have every tier honour it.
+ */
+declare const HOST_RESERVED_PREFIX = "host.";
+/**
+ * Collect the seed map for a tree: the value each `$state.<key>` slot carries
+ * before anything else has said anything.
+ *
+ * Order-independent by construction (charter §5) — the whole tree is walked
+ * before any binding resolves, so a badge declared before the grid that carries
+ * its rows is not a special case.
+ */
+declare const collectStateSeeds: <TMsg>(tree: Node<TMsg>) => Readonly<Record<string, unknown>>;
+/**
+ * Lay a tree's seeds UNDER a host's own binding sources. The host's map wins on
+ * every key it names — a seed is the value before anything else has said
+ * anything, never an override, which is the only reading consistent with the
+ * wire's standing posture that the host owns named data.
+ *
+ * Returns the caller's own object unchanged when the tree declares nothing, so
+ * an unseeded tree costs one walk and no allocation.
+ */
+declare const withStateSeeds: <TMsg, S extends {
+    readonly state?: Readonly<Record<string, unknown>>;
+}>(tree: Node<TMsg>, sources: S) => S;
+
+export { type Answer, type AnswerContract, type AnswerField, type AnswerSpace, type AnswerValue, type ApplyError, type ApplyErrorCode, type ApplyResult, type Compatibility, type DagActor, type DagOpRecord, type DagResultEnvelope, type DecodeError, type DecodeErrorCode, type Decoded, ELICITATION_KEY, ELICITATION_VERSION, type ElicitationEnvelope, type ElicitationError, type ElicitationErrorCode, type ElicitationOutcome, type ElicitationOutcomeEnvelope, type Envelope, type EnvelopeError, type EnvelopeErrorCode, type EvalEnv, type FreshIds, HOST_RESERVED_PREFIX, type JsonAst, type MergeConflict, type MergeResult, type OpApplyTelemetryRecord, PAYLOAD_KEY, PROFILE_KEY, type ParseError, type PlaceError, type PlaceTarget, type Placement, type Profile, REQUIRED_PROFILE_KEY, type SourceResolver, type TreeOp, type UnknownKind, apply, canPlace, cellString, coerce, collectStateSeeds, coreV1, decodeDagRecord, decodeElicitation, decodeElicitationOutcome, decodeEnvelope, decodeEnvelopeAst, decodeNode, decodeNodeTolerant, decodeOp, decodeTolerant, derivedFreshIds, duplicateOp, duplicateOpWith, encodeCell, encodeColExpr, encodeDagRecord, encodeDataSource, encodeElicitation, encodeElicitationOutcome, encodeEnvelope, encodeNode, encodeOp, encodePipeline, evalErrorString, evalPipeline, evalPipelineInEnv, evalPipelineWith, evalPipelineWithInEnv, evalSource, field as jsonField, liveValueToTable, merge3Way, moveOp, negotiate, negotiateEnvelope, noResolve, nudgeOp, parse, pasteOp, pasteOpWith, pipelineParams, placeOp, reencodeNode, renderAstCanonical, renderProfile, sequentialFreshIds, stepParams, substituteListParams, tryParseProfile, validateAnswer, validateAnswerAt, validateAnswerDocument, withStateSeeds };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { Result, NodeId, NodeKind, JsonValue, Binding, SemanticStyle, StateBehaviour, Node, Cell, ColExpr, DataSource, Transform, EvalError, Table, TextSource, CellFormat, ColumnWidth, Orientation, ToneVariant, StyleWeight, Emphasis, HeadingVariant, BadgeVariant, IconSource, IconSize } from '@fuaran-ui/schema';
+import { Result, NodeId, NodeKind, JsonValue, Binding, SemanticStyle, StateBehaviour, Node, Cell, ColExpr, DataSource, Transform, EvalError, Table, TextSource, CellFormat, ColumnWidth, Orientation, ToneVariant, StyleWeight, Emphasis, TrendPolarity, HeadingVariant, BadgeVariant, IconSource, IconSize, DecodePolicy } from '@fuaran-ui/schema';
 
 /** Local JSON AST. Shape-for-shape port of the F# decoder's private `Json` DU. */
 type JsonAst = {
@@ -23,6 +23,15 @@ type JsonAst = {
 interface ParseError {
     readonly message: string;
     readonly offset: number;
+    /**
+     * True when this failure is a WIRE_FORMAT.md §21 resource-limit breach rather
+     * than a syntax error. It exists because the two must not be reported the
+     * same way: §21.2 rule 2 forbids reporting a limit breach as `INVALID_JSON`,
+     * since the input is well-formed and merely too large to walk, and calling it
+     * malformed sends the author to repair the wrong thing. `decodeNode` reads
+     * this flag to choose between `INVALID_JSON` and `LIMIT_EXCEEDED`.
+     */
+    readonly limit?: boolean;
 }
 /**
  * Parse a JSON document into the local AST. Mirrors the F# `tryParse`: empty /
@@ -131,9 +140,37 @@ declare const evalErrorString: (e: EvalError) => string;
 declare const stepParams: (t: Transform) => readonly string[];
 /** Every distinct param name a pipeline references — the TS mirror of Core `Transform.paramsOf`. */
 declare const pipelineParams: (pipeline: readonly Transform[]) => readonly string[];
+/**
+ * Substitute every `inParam` bound in `listEnv` with the literal `in` form, through the
+ * whole pipeline — the TS mirror of Core `Transform.substituteListParams`. Unbound list
+ * params are left intact for the caller's prune to catch. Only `filter` / `derive` carry
+ * a `ColExpr`; every other step is returned unchanged.
+ */
+declare const substituteListParams: (listEnv: Readonly<Record<string, readonly Cell[]>>, pipeline: readonly Transform[]) => readonly Transform[];
 
 /** Stable AI-friendly discriminator for decode-time failures (WIRE_FORMAT.md §6). */
-type DecodeErrorCode = 'INVALID_JSON' | 'MISSING_FIELD' | 'WRONG_TYPE' | 'UNKNOWN_DU_CASE' | 'WRONG_NODE_KIND' | 'EMPTY_NODE_ID';
+type DecodeErrorCode = 'INVALID_JSON' | 'MISSING_FIELD' | 'WRONG_TYPE' | 'UNKNOWN_DU_CASE' | 'WRONG_NODE_KIND' | 'EMPTY_NODE_ID'
+/**
+ * A WIRE_FORMAT.md §21 resource limit was exceeded — the document is
+ * well-formed and merely too large to walk. Deliberately distinct from
+ * `INVALID_JSON`, which §21.2 rule 2 forbids using for this: calling a
+ * well-formed document malformed sends the author to repair the wrong thing.
+ */
+ | 'LIMIT_EXCEEDED'
+/**
+ * The document names a kind the HOST'S DECLARED decode policy does not admit
+ * (WIRE_FORMAT.md §23).
+ *
+ * Deliberately distinct from `WRONG_NODE_KIND`, which says the vocabulary has
+ * no such kind. This one says the kind exists and THIS DEPLOYMENT does not
+ * take it — a different fact with a different remedy, and conflating them
+ * would send a repairing author to invent a spelling that is already correct.
+ *
+ * Raised ONLY when a caller supplied a narrowing policy. With no policy the
+ * code is unreachable, which is what keeps §22's "a decoder owes nothing"
+ * true of the default decoder.
+ */
+ | 'KIND_NOT_ADMITTED';
 /** AI-recoverable decode-time failure. Mirrors the F# `DecodeError` record. */
 interface DecodeError {
     readonly code: DecodeErrorCode;
@@ -175,6 +212,8 @@ declare const coerce: {
     tone: (v: JsonValue) => Result<ToneVariant, string>;
     weight: (v: JsonValue) => Result<StyleWeight, string>;
     emphasis: (v: JsonValue) => Result<Emphasis, string>;
+    /** `Metric.TrendPolarity` (Phase 867) - the UpdateProp twin of `decodeTrendPolarity`. */
+    trendPolarity: (v: JsonValue) => Result<TrendPolarity, string>;
     /**
      * The behavioural `emphasis` BOOL on Fact / LabelValueRow — the UpdateProp
      * twin of `decodeEmphasisFlag`, so a TreeOp edit gets the same
@@ -189,10 +228,34 @@ declare const coerce: {
     iconSize: (v: JsonValue) => Result<IconSize, string>;
     stringOption: (v: JsonValue) => Result<string | undefined, string>;
 };
-/** Decode a canonical-JSON `Node` payload into the storage-shape `Node<unknown>`. */
-declare const decodeNode: (json: string) => R<Node<unknown>>;
-/** Decode a canonical-JSON `TreeOp` payload into the storage-shape `TreeOp<unknown>`. */
-declare const decodeOp: (json: string) => R<TreeOp<unknown>>;
+/**
+ * Decode a canonical-JSON `Node` payload into the storage-shape `Node<unknown>`.
+ *
+ * `policy` is the OPTIONAL WIRE_FORMAT §23 host-declared admission policy: a
+ * tree naming a kind outside it is refused with `KIND_NOT_ADMITTED` at the
+ * offending `kind.$type`, naming the kind and the policy. **Omitted, the decoder
+ * has exactly the obligations it had before** — every valid document decodes and
+ * the code is unreachable, which is what keeps §22 unqualified. Build a policy
+ * with `@fuaran-ui/schema`'s `CLOSED_PROFILE`, `excluding` or `admitting`.
+ *
+ * The reference host spells this as a sibling entry point rather than an
+ * optional argument, because F# optional parameters exist only on type members
+ * and defaulting in place would reshape its whole decoder surface. What the two
+ * hosts owe each other is the same behaviour on the same bytes, not the same
+ * arity — the `decode-policy/` corpus family is where that is asserted.
+ */
+declare const decodeNode: (json: string, policy?: DecodePolicy) => R<Node<unknown>>;
+/**
+ * Decode a canonical-JSON `TreeOp` payload into the storage-shape
+ * `TreeOp<unknown>`.
+ *
+ * `policy` is the optional §23 admission policy. A node kind reaches an op two
+ * ways — inside a node-bearing operation, and as `EditNode`'s replacement kind —
+ * and both are gated, because an op stream that could introduce a refused kind
+ * into an admitted tree would make the policy a property of the first decode
+ * only rather than a closure.
+ */
+declare const decodeOp: (json: string, policy?: DecodePolicy) => R<TreeOp<unknown>>;
 
 type ApplyErrorCode = 'NodeNotFound' | 'ParentNotFound' | 'ChildlessKind' | 'PositionOutOfRange' | 'DuplicateNodeId' | 'FieldNotFound' | 'SlotNotFound' | 'KindMismatch' | 'PathInvalid' | 'PathNotSupportedYet' | 'OrderingMismatch' | 'BatchAborted';
 interface ApplyError {
@@ -379,6 +442,22 @@ declare const pasteOpWith: <TMsg>(freshIds: FreshIds, targetRoot: Node<TMsg>, in
 /** `pasteOpWith` under the default derived-suffix id strategy. */
 declare const pasteOp: <TMsg>(targetRoot: Node<TMsg>, incoming: Node<TMsg>, target: PlaceTarget) => Result<TreeOp<TMsg>, PlaceError>;
 
+/**
+ * Who authored a DAG op. Structurally identical to `Actor` in
+ * `@fuaran-ui/op-stream`, and DELIBERATELY declared here rather than imported:
+ * op-stream depends on this package, so importing it would invert the package
+ * dependency. TypeScript is structurally typed, so an op-stream `Actor` is
+ * assignable here and vice versa with no import and no new dependency edge.
+ */
+type DagActor = {
+    readonly kind: 'human';
+    readonly id: string;
+} | {
+    readonly kind: 'agent';
+    readonly model: string;
+    readonly version: string;
+    readonly id: string;
+};
 /** The result envelope captured on a DAG record (closed shape). */
 type DagResultEnvelope = {
     readonly $type: 'Success';
@@ -401,7 +480,7 @@ interface DagOpRecord<TMsg = unknown> {
     readonly op: TreeOp<TMsg>;
     readonly outcomeHash?: string;
     readonly promptId?: string;
-    readonly userId: string;
+    readonly actor: DagActor;
     /** Unix seconds. */
     readonly timestamp: number;
     readonly resultEnvelope: DagResultEnvelope;
@@ -409,10 +488,10 @@ interface DagOpRecord<TMsg = unknown> {
 }
 /**
  * Encode a `DagOpRecord` to its canonical JSON wire form. Keys in Ordinal order
- * (hash < op < outcomeHash < parents < promptId < resultEnvelope < streamId <
- * timestamp < tombstoned < userId); `outcomeHash` / `promptId` omitted when
- * absent; `op` nests `encodeOp` verbatim. Byte-identical to the F#
- * `DagWire.encodeRecord`.
+ * (actor < hash < op < outcomeHash < parents < promptId < resultEnvelope <
+ * streamId < timestamp < tombstoned); `outcomeHash` / `promptId` omitted when
+ * absent; `op` nests `encodeOp` and `actor` nests the canonical actor form
+ * verbatim. Byte-identical to the F# `DagWire.encodeRecord`.
  */
 declare const encodeDagRecord: <TMsg>(record: DagOpRecord<TMsg>) => string;
 type DecodeResult<T> = {
@@ -729,4 +808,36 @@ declare const decodeElicitationOutcome: (json: string) => Result<ElicitationOutc
  */
 declare const validateAnswerDocument: (json: string) => Result<undefined, ElicitationError>;
 
-export { type Answer, type AnswerContract, type AnswerField, type AnswerSpace, type AnswerValue, type ApplyError, type ApplyErrorCode, type ApplyResult, type Compatibility, type DagOpRecord, type DagResultEnvelope, type DecodeError, type DecodeErrorCode, type Decoded, ELICITATION_KEY, ELICITATION_VERSION, type ElicitationEnvelope, type ElicitationError, type ElicitationErrorCode, type ElicitationOutcome, type ElicitationOutcomeEnvelope, type Envelope, type EnvelopeError, type EnvelopeErrorCode, type EvalEnv, type FreshIds, type JsonAst, type MergeConflict, type MergeResult, type OpApplyTelemetryRecord, PAYLOAD_KEY, PROFILE_KEY, type ParseError, type PlaceError, type PlaceTarget, type Placement, type Profile, REQUIRED_PROFILE_KEY, type SourceResolver, type TreeOp, type UnknownKind, apply, canPlace, cellString, coerce, coreV1, decodeDagRecord, decodeElicitation, decodeElicitationOutcome, decodeEnvelope, decodeEnvelopeAst, decodeNode, decodeNodeTolerant, decodeOp, decodeTolerant, derivedFreshIds, duplicateOp, duplicateOpWith, encodeCell, encodeColExpr, encodeDagRecord, encodeDataSource, encodeElicitation, encodeElicitationOutcome, encodeEnvelope, encodeNode, encodeOp, encodePipeline, evalErrorString, evalPipeline, evalPipelineInEnv, evalPipelineWith, evalPipelineWithInEnv, evalSource, field as jsonField, liveValueToTable, merge3Way, moveOp, negotiate, negotiateEnvelope, noResolve, nudgeOp, parse, pasteOp, pasteOpWith, pipelineParams, placeOp, reencodeNode, renderAstCanonical, renderProfile, sequentialFreshIds, stepParams, tryParseProfile, validateAnswer, validateAnswerAt, validateAnswerDocument };
+/**
+ * Keys under this prefix are HOST-OWNED: a tree-originated write naming one is
+ * refused, so a tree-originated SEED naming one must be too.
+ *
+ * Declared here rather than imported because the TypeScript tier carries no
+ * shared state-key policy module (the F# tier's `Fuaran.UI.StateKeyPolicy`).
+ * It must stay in step with that definition — there is one prefix, and a host
+ * that names a slot `host.<whatever>` is entitled to have every tier honour it.
+ */
+declare const HOST_RESERVED_PREFIX = "host.";
+/**
+ * Collect the seed map for a tree: the value each `$state.<key>` slot carries
+ * before anything else has said anything.
+ *
+ * Order-independent by construction (charter §5) — the whole tree is walked
+ * before any binding resolves, so a badge declared before the grid that carries
+ * its rows is not a special case.
+ */
+declare const collectStateSeeds: <TMsg>(tree: Node<TMsg>) => Readonly<Record<string, unknown>>;
+/**
+ * Lay a tree's seeds UNDER a host's own binding sources. The host's map wins on
+ * every key it names — a seed is the value before anything else has said
+ * anything, never an override, which is the only reading consistent with the
+ * wire's standing posture that the host owns named data.
+ *
+ * Returns the caller's own object unchanged when the tree declares nothing, so
+ * an unseeded tree costs one walk and no allocation.
+ */
+declare const withStateSeeds: <TMsg, S extends {
+    readonly state?: Readonly<Record<string, unknown>>;
+}>(tree: Node<TMsg>, sources: S) => S;
+
+export { type Answer, type AnswerContract, type AnswerField, type AnswerSpace, type AnswerValue, type ApplyError, type ApplyErrorCode, type ApplyResult, type Compatibility, type DagActor, type DagOpRecord, type DagResultEnvelope, type DecodeError, type DecodeErrorCode, type Decoded, ELICITATION_KEY, ELICITATION_VERSION, type ElicitationEnvelope, type ElicitationError, type ElicitationErrorCode, type ElicitationOutcome, type ElicitationOutcomeEnvelope, type Envelope, type EnvelopeError, type EnvelopeErrorCode, type EvalEnv, type FreshIds, HOST_RESERVED_PREFIX, type JsonAst, type MergeConflict, type MergeResult, type OpApplyTelemetryRecord, PAYLOAD_KEY, PROFILE_KEY, type ParseError, type PlaceError, type PlaceTarget, type Placement, type Profile, REQUIRED_PROFILE_KEY, type SourceResolver, type TreeOp, type UnknownKind, apply, canPlace, cellString, coerce, collectStateSeeds, coreV1, decodeDagRecord, decodeElicitation, decodeElicitationOutcome, decodeEnvelope, decodeEnvelopeAst, decodeNode, decodeNodeTolerant, decodeOp, decodeTolerant, derivedFreshIds, duplicateOp, duplicateOpWith, encodeCell, encodeColExpr, encodeDagRecord, encodeDataSource, encodeElicitation, encodeElicitationOutcome, encodeEnvelope, encodeNode, encodeOp, encodePipeline, evalErrorString, evalPipeline, evalPipelineInEnv, evalPipelineWith, evalPipelineWithInEnv, evalSource, field as jsonField, liveValueToTable, merge3Way, moveOp, negotiate, negotiateEnvelope, noResolve, nudgeOp, parse, pasteOp, pasteOpWith, pipelineParams, placeOp, reencodeNode, renderAstCanonical, renderProfile, sequentialFreshIds, stepParams, substituteListParams, tryParseProfile, validateAnswer, validateAnswerAt, validateAnswerDocument, withStateSeeds };