@kubun/mutation 0.17.0 → 0.18.0

package/lib/create.d.ts

@@ -1,7 +1,6 @@
-import type { PatchOperation } from '@kubun/graphql';
 import { HLC } from '@kubun/hlc';
 import { DocumentID, type DocumentModelID } from '@kubun/id';
-import type { ChangeDocumentMutation, DocumentData, SetDocumentMutation } from '@kubun/protocol';
+import type { ChangeDocumentMutation, DocumentData, PatchOperation, SetDocumentMutation, TombstoneDocumentMutation } from '@kubun/protocol';
 export type CreateSetMutationParams<Data extends DocumentData = DocumentData> = {
     data: Data;
     hlc: HLC;
@@ -10,6 +9,7 @@ export type CreateSetMutationParams<Data extends DocumentData = DocumentData> =
     owner?: string;
     unique: Uint8Array;
     cap?: string | Array<string>;
+    sourceFetchHLC?: string;
 };
 export declare function createSetMutation<Data extends DocumentData = DocumentData>(params: CreateSetMutationParams<Data>): Promise<SetDocumentMutation>;
 export type CreateChangeMutationParams = {
@@ -27,3 +27,13 @@ export type CreateRemoveMutationParams = {
     cap?: string | Array<string>;
 };
 export declare function createRemoveMutation(params: CreateRemoveMutationParams): ChangeDocumentMutation;
+export type CreateTombstoneMutationParams = {
+    hlc: HLC;
+    issuer: string;
+    modelID: DocumentModelID | string;
+    owner?: string;
+    unique: Uint8Array;
+    sourceFetchHLC: string;
+    cap?: string | Array<string>;
+};
+export declare function createTombstoneMutation(params: CreateTombstoneMutationParams): Promise<TombstoneDocumentMutation>;

package/lib/create.js

@@ -2,7 +2,7 @@ import { HLC } from '@kubun/hlc';
 import { DocumentID } from '@kubun/id';
 import { isValidAccessPermissions } from '@kubun/protocol';
 import { toB64 } from '@sozai/codec';
-import { InvalidAccessPermissionsError } from './errors.js';
+import { FetchTokenOrderError, InvalidAccessPermissionsError } from './errors.js';
 const ACCESS_PERMISSIONS_FIELD = 'accessPermissions';
 const ACCESS_PERMISSIONS_PATH = `/${ACCESS_PERMISSIONS_FIELD}`;
 /**
@@ -30,16 +30,23 @@ export async function createSetMutation(params) {
     const issuer = params.issuer;
     const owner = params.owner ?? issuer;
     const docID = await DocumentID.create(params.modelID, owner, params.unique);
+    const hlc = HLC.serialize(params.hlc.now());
+    if (params.sourceFetchHLC != null && hlc < params.sourceFetchHLC) {
+        throw new FetchTokenOrderError();
+    }
     return {
         typ: 'set',
         iss: issuer,
         aud: owner,
         sub: docID.toString(),
         data: params.data,
-        hlc: HLC.serialize(params.hlc.now()),
+        hlc,
         unq: toB64(params.unique),
         ...params.cap != null ? {
             cap: params.cap
+        } : {},
+        ...params.sourceFetchHLC != null ? {
+            sourceFetchHLC: params.sourceFetchHLC
         } : {}
     };
 }
@@ -74,3 +81,23 @@ export function createRemoveMutation(params) {
         } : {}
     };
 }
+export async function createTombstoneMutation(params) {
+    const owner = params.owner ?? params.issuer;
+    const docID = await DocumentID.create(params.modelID, owner, params.unique);
+    const hlc = HLC.serialize(params.hlc.now());
+    if (hlc < params.sourceFetchHLC) {
+        throw new FetchTokenOrderError();
+    }
+    return {
+        typ: 'tombstone',
+        iss: params.issuer,
+        aud: owner,
+        sub: docID.toString(),
+        unq: toB64(params.unique),
+        hlc,
+        sourceFetchHLC: params.sourceFetchHLC,
+        ...params.cap != null ? {
+            cap: params.cap
+        } : {}
+    };
+}

package/lib/errors.d.ts

@@ -1,11 +1,23 @@
+export type KubunMutationErrorCode = 'KB07' | 'KB09' | 'KB10' | 'KB11' | 'KB12' | 'KB13' | 'KB16' | 'KB17' | 'KB18' | 'KB19' | 'KB20' | 'KB21' | 'KB22';
+export type KubunMutationErrorParams = {
+    message: string;
+    code: KubunMutationErrorCode;
+    docID?: string;
+    cause?: unknown;
+};
+export declare class KubunMutationError extends Error {
+    #private;
+    constructor(params: KubunMutationErrorParams);
+    get code(): KubunMutationErrorCode;
+    get docID(): string | undefined;
+}
 /**
  * Thrown by the mutation apply path when a non-owner writer's capability
  * check fails. Tagged with the protocol-level error code `KB07` so callers
  * — particularly the RPC handler — can translate the throw into a
  * structured wire response without losing the reason.
  */
-export declare class WriteAccessDeniedError extends Error {
-    #private;
+export declare class WriteAccessDeniedError extends KubunMutationError {
     constructor(docID: string);
     get code(): 'KB07';
     get docID(): string;
@@ -19,8 +31,7 @@ export declare class WriteAccessDeniedError extends Error {
  * error code `KB09` so callers — particularly the RPC handler — can translate
  * the throw into a structured wire response without losing the reason.
  */
-export declare class DocumentIDMismatchError extends Error {
-    #private;
+export declare class DocumentIDMismatchError extends KubunMutationError {
     constructor(docID: string);
     get code(): 'KB09';
     get docID(): string;
@@ -32,13 +43,113 @@ export declare class DocumentIDMismatchError extends Error {
  * the bound — the reject is permanent. Tagged `KB10` so the RPC handler can
  * translate the throw into a structured wire response.
  */
-export declare class HLCDriftError extends Error {
+export declare class HLCDriftError extends KubunMutationError {
     #private;
     constructor(driftMS: number, maxDriftMS: number);
     get code(): 'KB10';
     get driftMS(): number;
     get maxDriftMS(): number;
 }
+/**
+ * Thrown when a fetch token cannot be parsed as a valid HLC timestamp. Detects
+ * malformed tokens or NaN values that would slip past `HLC.parse` but fail
+ * `HLC.tryParse` validation. Tagged `KB16` so the RPC handler can translate the
+ * throw into a structured wire response.
+ */
+export declare class InvalidFetchTokenError extends KubunMutationError {
+    #private;
+    constructor(token: string);
+    get code(): 'KB16';
+    get token(): string;
+}
+/**
+ * Thrown when a mutation's minted HLC timestamp predates the supplied fetch
+ * token (sourceFetchHLC). Since HLC is a fixed property of a signed mutation,
+ * this reject is permanent — resending cannot move the HLC forward. Tagged
+ * `KB17` so the RPC handler can translate the throw into a structured wire
+ * response.
+ */
+export declare class FetchTokenOrderError extends KubunMutationError {
+    constructor();
+    get code(): 'KB17';
+}
+/**
+ * Thrown by the set apply path when a merge-policy SET omits a schema-required
+ * field of its model's provider group. A merge-policy SET must carry the
+ * complete group so a winning higher-key SET can atomically replace it (an
+ * omitted OPTIONAL group field is legitimate — it clears that field's stored
+ * value instead of throwing). Tagged `KB18` so the RPC handler can translate
+ * the throw into a structured wire response.
+ */
+export declare class IncompleteProviderGroupError extends KubunMutationError {
+    #private;
+    constructor(docID: string, field: string);
+    get code(): 'KB18';
+    get docID(): string;
+    get field(): string;
+}
+/**
+ * Thrown by the tombstone apply path when the target document's model
+ * declares no `providerMergePolicy`. A tombstone advances the fetch-order
+ * `/fetch` liveness register, which only a merge-policy document's `assemble`
+ * consults — an ordinary model's liveness is governed by the plain `$set`/`/`
+ * HLC registers and deletes via the `/`→null CHANGE path instead. Tagged
+ * `KB19` so the RPC handler can translate the throw into a structured wire
+ * response.
+ */
+export declare class TombstoneRequiresMergePolicyError extends KubunMutationError {
+    constructor(docID: string);
+    get code(): 'KB19';
+    get docID(): string;
+}
+/**
+ * Thrown by the change apply path when a CHANGE mutation targets a
+ * merge-policy model's provider-authoritative group. The group is single
+ * authority — every write to it is a fetch-token-ordered provider projection
+ * (a complete-group SET or a tombstone) — so a local HLC-ordered CHANGE
+ * against it would mix two incompatible orderings on the same fields. A
+ * CHANGE to a field outside the group is unaffected. Tagged `KB20` so the RPC
+ * handler can translate the throw into a structured wire response.
+ */
+export declare class ProviderGroupChangeRejectedError extends KubunMutationError {
+    #private;
+    constructor(docID: string, field: string);
+    get code(): 'KB20';
+    get docID(): string;
+    get field(): string;
+}
+/**
+ * Thrown by the set and tombstone apply paths when a merge-policy model's
+ * single-authority write carries no `sourceFetchHLC`. No conforming producer
+ * emits a tokenless merge-policy write — `createSetMutation`/
+ * `createTombstoneMutation` mint one, and the tombstone wire schema requires
+ * it — so this is a defensive gate: it keeps the incoming token always
+ * present by the time a merge-policy candidate reaches classification. Tagged
+ * `KB21` so the RPC handler can translate the throw into a structured wire
+ * response.
+ */
+export declare class MissingFetchTokenError extends KubunMutationError {
+    constructor(docID: string);
+    get code(): 'KB21';
+    get docID(): string;
+}
+/**
+ * Thrown by the change apply path when a generic `/`→null delete CHANGE targets
+ * a merge-policy model. A merge-policy document's liveness lives in the
+ * fetch-order registers (`$setFetch`/`/fetch`), which a delete CHANGE never
+ * advances — it would null the visible data while leaving the live register
+ * standing, so a later provider SET or any outside-group CHANGE would resurrect
+ * the document with stale group data. Such a deletion must flow through the
+ * fetch-token tombstone path instead, which carries the token that advances
+ * `/fetch`. The rejection is deterministic and permanent — the same mutation
+ * always fails. Tagged `KB22` so the RPC handler can translate the throw into a
+ * structured wire response.
+ */
+export declare class MergePolicyRemoveRequiresTombstoneError extends KubunMutationError {
+    constructor(docID: string);
+    get code(): 'KB22';
+    get docID(): string;
+}
 /**
  * Thrown by the set apply path when a mutation would reassign an existing
  * document's owner. Ownership is immutable once a document exists, so this is a
@@ -46,8 +157,7 @@ export declare class HLCDriftError extends Error {
  * Tagged `KB11` so the RPC handler can translate the throw into a structured
  * wire response.
  */
-export declare class OwnerChangeError extends Error {
-    #private;
+export declare class OwnerChangeError extends KubunMutationError {
     constructor(docID: string, fromOwner: string, toOwner: string);
     get code(): 'KB11';
     get docID(): string;
@@ -58,7 +168,7 @@ export declare class OwnerChangeError extends Error {
  * deterministic, permanent reject. Tagged `KB12` so the RPC handler can
  * translate the throw into a structured wire response.
  */
-export declare class UnsupportedMutationTypeError extends Error {
+export declare class UnsupportedMutationTypeError extends KubunMutationError {
     #private;
     constructor(mutationType: string);
     get code(): 'KB12';
@@ -71,8 +181,7 @@ export declare class UnsupportedMutationTypeError extends Error {
  * preserved as `cause`. Tagged `KB13` so the RPC handler can translate the
  * throw into a structured wire response.
  */
-export declare class MutationSchemaValidationError extends Error {
-    #private;
+export declare class MutationSchemaValidationError extends KubunMutationError {
     constructor(docID: string, options?: {
         cause?: unknown;
     });
@@ -90,6 +199,15 @@ export declare class MutationSchemaValidationError extends Error {
 export declare class InvalidAccessPermissionsError extends Error {
     constructor(detail?: string);
 }
+export declare class InvalidDefaultAccessPermissionsError extends KubunMutationError {
+    constructor(docID: string);
+}
+type InvalidAccessRulePatchErrorParams = {
+    docID: string;
+};
+export declare class InvalidAccessRulePatchError extends KubunMutationError {
+    constructor(params: InvalidAccessRulePatchErrorParams);
+}
 /**
  * True when `err` carries a protocol error code identifying a deterministically
  * permanent mutation reject. A permanent reject is one the sender cannot fix by
@@ -98,3 +216,4 @@ export declare class InvalidAccessPermissionsError extends Error {
  * else — a transient store/db failure — is excluded so it stays retryable.
  */
 export declare function isPermanentApplyError(err: unknown): boolean;
+export {};

package/lib/errors.js

@@ -1,20 +1,40 @@
+export class KubunMutationError extends Error {
+    #code;
+    #docID;
+    constructor(params){
+        super(params.message, Object.hasOwn(params, 'cause') ? {
+            cause: params.cause
+        } : undefined);
+        this.name = 'KubunMutationError';
+        this.#code = params.code;
+        this.#docID = params.docID;
+    }
+    get code() {
+        return this.#code;
+    }
+    get docID() {
+        return this.#docID;
+    }
+}
 /**
  * Thrown by the mutation apply path when a non-owner writer's capability
  * check fails. Tagged with the protocol-level error code `KB07` so callers
  * — particularly the RPC handler — can translate the throw into a
  * structured wire response without losing the reason.
- */ export class WriteAccessDeniedError extends Error {
-    #docID;
+ */ export class WriteAccessDeniedError extends KubunMutationError {
     constructor(docID){
-        super(`Access denied: cannot write document ${docID}`);
+        super({
+            message: `Access denied: cannot write document ${docID}`,
+            code: 'KB07',
+            docID
+        });
         this.name = 'WriteAccessDeniedError';
-        this.#docID = docID;
     }
     get code() {
         return 'KB07';
     }
     get docID() {
-        return this.#docID;
+        return super.docID;
     }
 }
 /**
@@ -25,18 +45,20 @@
  * a victim's deterministic-unique document ID. Tagged with the protocol-level
  * error code `KB09` so callers — particularly the RPC handler — can translate
  * the throw into a structured wire response without losing the reason.
- */ export class DocumentIDMismatchError extends Error {
-    #docID;
+ */ export class DocumentIDMismatchError extends KubunMutationError {
     constructor(docID){
-        super(`Document ID mismatch: ${docID} is not bound to its owner and unique value`);
+        super({
+            message: `Document ID mismatch: ${docID} is not bound to its owner and unique value`,
+            code: 'KB09',
+            docID
+        });
         this.name = 'DocumentIDMismatchError';
-        this.#docID = docID;
     }
     get code() {
         return 'KB09';
     }
     get docID() {
-        return this.#docID;
+        return super.docID;
     }
 }
 /**
@@ -45,11 +67,14 @@
  * is a fixed property of the mutation, so resending cannot move it back under
  * the bound — the reject is permanent. Tagged `KB10` so the RPC handler can
  * translate the throw into a structured wire response.
- */ export class HLCDriftError extends Error {
+ */ export class HLCDriftError extends KubunMutationError {
     #driftMS;
     #maxDriftMS;
     constructor(driftMS, maxDriftMS){
-        super(`HLC timestamp too far in the future: ${driftMS}ms drift exceeds ${maxDriftMS}ms limit`);
+        super({
+            message: `HLC timestamp too far in the future: ${driftMS}ms drift exceeds ${maxDriftMS}ms limit`,
+            code: 'KB10'
+        });
         this.name = 'HLCDriftError';
         this.#driftMS = driftMS;
         this.#maxDriftMS = maxDriftMS;
@@ -64,24 +89,199 @@
         return this.#maxDriftMS;
     }
 }
+/**
+ * Thrown when a fetch token cannot be parsed as a valid HLC timestamp. Detects
+ * malformed tokens or NaN values that would slip past `HLC.parse` but fail
+ * `HLC.tryParse` validation. Tagged `KB16` so the RPC handler can translate the
+ * throw into a structured wire response.
+ */ export class InvalidFetchTokenError extends KubunMutationError {
+    #token;
+    constructor(token){
+        super({
+            message: `Invalid fetch token: malformed HLC timestamp '${token}'`,
+            code: 'KB16'
+        });
+        this.name = 'InvalidFetchTokenError';
+        this.#token = token;
+    }
+    get code() {
+        return 'KB16';
+    }
+    get token() {
+        return this.#token;
+    }
+}
+/**
+ * Thrown when a mutation's minted HLC timestamp predates the supplied fetch
+ * token (sourceFetchHLC). Since HLC is a fixed property of a signed mutation,
+ * this reject is permanent — resending cannot move the HLC forward. Tagged
+ * `KB17` so the RPC handler can translate the throw into a structured wire
+ * response.
+ */ export class FetchTokenOrderError extends KubunMutationError {
+    constructor(){
+        super({
+            message: 'Fetch token ordering violated: mutation HLC must be >= sourceFetchHLC',
+            code: 'KB17'
+        });
+        this.name = 'FetchTokenOrderError';
+    }
+    get code() {
+        return 'KB17';
+    }
+}
+/**
+ * Thrown by the set apply path when a merge-policy SET omits a schema-required
+ * field of its model's provider group. A merge-policy SET must carry the
+ * complete group so a winning higher-key SET can atomically replace it (an
+ * omitted OPTIONAL group field is legitimate — it clears that field's stored
+ * value instead of throwing). Tagged `KB18` so the RPC handler can translate
+ * the throw into a structured wire response.
+ */ export class IncompleteProviderGroupError extends KubunMutationError {
+    #field;
+    constructor(docID, field){
+        super({
+            message: `Incomplete provider group: document ${docID} SET omits required field '${field}'`,
+            code: 'KB18',
+            docID
+        });
+        this.name = 'IncompleteProviderGroupError';
+        this.#field = field;
+    }
+    get code() {
+        return 'KB18';
+    }
+    get docID() {
+        return super.docID;
+    }
+    get field() {
+        return this.#field;
+    }
+}
+/**
+ * Thrown by the tombstone apply path when the target document's model
+ * declares no `providerMergePolicy`. A tombstone advances the fetch-order
+ * `/fetch` liveness register, which only a merge-policy document's `assemble`
+ * consults — an ordinary model's liveness is governed by the plain `$set`/`/`
+ * HLC registers and deletes via the `/`→null CHANGE path instead. Tagged
+ * `KB19` so the RPC handler can translate the throw into a structured wire
+ * response.
+ */ export class TombstoneRequiresMergePolicyError extends KubunMutationError {
+    constructor(docID){
+        super({
+            message: `Tombstone requires a provider-merge-policy model: document ${docID}`,
+            code: 'KB19',
+            docID
+        });
+        this.name = 'TombstoneRequiresMergePolicyError';
+    }
+    get code() {
+        return 'KB19';
+    }
+    get docID() {
+        return super.docID;
+    }
+}
+/**
+ * Thrown by the change apply path when a CHANGE mutation targets a
+ * merge-policy model's provider-authoritative group. The group is single
+ * authority — every write to it is a fetch-token-ordered provider projection
+ * (a complete-group SET or a tombstone) — so a local HLC-ordered CHANGE
+ * against it would mix two incompatible orderings on the same fields. A
+ * CHANGE to a field outside the group is unaffected. Tagged `KB20` so the RPC
+ * handler can translate the throw into a structured wire response.
+ */ export class ProviderGroupChangeRejectedError extends KubunMutationError {
+    #field;
+    constructor(docID, field){
+        super({
+            message: `Provider group CHANGE rejected: document ${docID} CHANGE targets provider group field '${field}'`,
+            code: 'KB20',
+            docID
+        });
+        this.name = 'ProviderGroupChangeRejectedError';
+        this.#field = field;
+    }
+    get code() {
+        return 'KB20';
+    }
+    get docID() {
+        return super.docID;
+    }
+    get field() {
+        return this.#field;
+    }
+}
+/**
+ * Thrown by the set and tombstone apply paths when a merge-policy model's
+ * single-authority write carries no `sourceFetchHLC`. No conforming producer
+ * emits a tokenless merge-policy write — `createSetMutation`/
+ * `createTombstoneMutation` mint one, and the tombstone wire schema requires
+ * it — so this is a defensive gate: it keeps the incoming token always
+ * present by the time a merge-policy candidate reaches classification. Tagged
+ * `KB21` so the RPC handler can translate the throw into a structured wire
+ * response.
+ */ export class MissingFetchTokenError extends KubunMutationError {
+    constructor(docID){
+        super({
+            message: `Missing fetch token: document ${docID} merge-policy write carries no sourceFetchHLC`,
+            code: 'KB21',
+            docID
+        });
+        this.name = 'MissingFetchTokenError';
+    }
+    get code() {
+        return 'KB21';
+    }
+    get docID() {
+        return super.docID;
+    }
+}
+/**
+ * Thrown by the change apply path when a generic `/`→null delete CHANGE targets
+ * a merge-policy model. A merge-policy document's liveness lives in the
+ * fetch-order registers (`$setFetch`/`/fetch`), which a delete CHANGE never
+ * advances — it would null the visible data while leaving the live register
+ * standing, so a later provider SET or any outside-group CHANGE would resurrect
+ * the document with stale group data. Such a deletion must flow through the
+ * fetch-token tombstone path instead, which carries the token that advances
+ * `/fetch`. The rejection is deterministic and permanent — the same mutation
+ * always fails. Tagged `KB22` so the RPC handler can translate the throw into a
+ * structured wire response.
+ */ export class MergePolicyRemoveRequiresTombstoneError extends KubunMutationError {
+    constructor(docID){
+        super({
+            message: `Merge-policy remove requires a tombstone: document ${docID} must be deleted via the fetch-token tombstone path`,
+            code: 'KB22',
+            docID
+        });
+        this.name = 'MergePolicyRemoveRequiresTombstoneError';
+    }
+    get code() {
+        return 'KB22';
+    }
+    get docID() {
+        return super.docID;
+    }
+}
 /**
  * Thrown by the set apply path when a mutation would reassign an existing
  * document's owner. Ownership is immutable once a document exists, so this is a
  * deterministic, permanent reject — the same mutation will always fail.
  * Tagged `KB11` so the RPC handler can translate the throw into a structured
  * wire response.
- */ export class OwnerChangeError extends Error {
-    #docID;
+ */ export class OwnerChangeError extends KubunMutationError {
     constructor(docID, fromOwner, toOwner){
-        super(`Cannot change owner from ${fromOwner} to ${toOwner} in document: ${docID}`);
+        super({
+            message: `Cannot change owner from ${fromOwner} to ${toOwner} in document: ${docID}`,
+            code: 'KB11',
+            docID
+        });
         this.name = 'OwnerChangeError';
-        this.#docID = docID;
     }
     get code() {
         return 'KB11';
     }
     get docID() {
-        return this.#docID;
+        return super.docID;
     }
 }
 /**
@@ -89,10 +289,13 @@
  * not support. The type is fixed in the signed mutation, so this is a
  * deterministic, permanent reject. Tagged `KB12` so the RPC handler can
  * translate the throw into a structured wire response.
- */ export class UnsupportedMutationTypeError extends Error {
+ */ export class UnsupportedMutationTypeError extends KubunMutationError {
     #mutationType;
     constructor(mutationType){
-        super(`Unsupported mutation type: ${mutationType}`);
+        super({
+            message: `Unsupported mutation type: ${mutationType}`,
+            code: 'KB12'
+        });
         this.name = 'UnsupportedMutationTypeError';
         this.#mutationType = mutationType;
     }
@@ -109,18 +312,21 @@
  * is a deterministic, permanent reject. The original validation error is
  * preserved as `cause`. Tagged `KB13` so the RPC handler can translate the
  * throw into a structured wire response.
- */ export class MutationSchemaValidationError extends Error {
-    #docID;
+ */ export class MutationSchemaValidationError extends KubunMutationError {
     constructor(docID, options){
-        super(`Mutation payload failed model schema validation for document ${docID}`, options);
+        super({
+            message: `Mutation payload failed model schema validation for document ${docID}`,
+            code: 'KB13',
+            docID,
+            ...options
+        });
         this.name = 'MutationSchemaValidationError';
-        this.#docID = docID;
     }
     get code() {
         return 'KB13';
     }
     get docID() {
-        return this.#docID;
+        return super.docID;
     }
 }
 /**
@@ -136,13 +342,40 @@
         this.name = 'InvalidAccessPermissionsError';
     }
 }
+export class InvalidDefaultAccessPermissionsError extends KubunMutationError {
+    constructor(docID){
+        super({
+            message: 'Invalid default access rule or HLC: expected a rule and HLC no later than the mutation',
+            code: 'KB13',
+            docID
+        });
+        this.name = 'InvalidDefaultAccessPermissionsError';
+    }
+}
+export class InvalidAccessRulePatchError extends KubunMutationError {
+    constructor(params){
+        super({
+            message: 'Invalid access rule patch: replace or remove a whole slot or read/write rule',
+            code: 'KB13',
+            docID: params.docID
+        });
+        this.name = 'InvalidAccessRulePatchError';
+    }
+}
 const PERMANENT_APPLY_ERROR_CODES = new Set([
     'KB07',
     'KB09',
     'KB10',
     'KB11',
     'KB12',
-    'KB13'
+    'KB13',
+    'KB16',
+    'KB17',
+    'KB18',
+    'KB19',
+    'KB20',
+    'KB21',
+    'KB22'
 ]);
 /**
  * True when `err` carries a protocol error code identifying a deterministically

package/lib/index.d.ts

@@ -1,8 +1,12 @@
 export { HLC, type HLCTimestamp } from '@kubun/hlc';
-export type { DocumentValidator, MutationContext, MutationDB, PostStateGate, ValidatorsRecord, } from './apply.js';
-export { applyChangeMutation, applyMutation, applySetMutation, DEFAULT_MAX_DRIFT_MS, getTopLevelField, } from './apply.js';
-export type { CreateChangeMutationParams, CreateRemoveMutationParams, CreateSetMutationParams, } from './create.js';
-export { createChangeMutation, createRemoveMutation, createSetMutation } from './create.js';
-export { DocumentIDMismatchError, HLCDriftError, InvalidAccessPermissionsError, isPermanentApplyError, MutationSchemaValidationError, OwnerChangeError, UnsupportedMutationTypeError, WriteAccessDeniedError, } from './errors.js';
+export { isAccessSlotOnlyMutation } from './access-slot-only.js';
+export type { DocumentValidator, FetchFrontier, MergeOutcome, MutationApplyResult, MutationContext, MutationDB, PostStateGate, PostStateGateContext, ValidatorsRecord, } from './apply.js';
+export { applyChangeMutation, applyMutation, applySetMutation, applyTombstoneMutation, assembleDocumentData, classifySetOutcome, classifyTombstoneOutcome, DEFAULT_MAX_DRIFT_MS, DELETE_FETCH_KEY, getTopLevelField, providerGroupDigest, resolveModelPolicy, SET_FETCH_KEY, validateFetchTokenDrift, validateSetData, winnerStateDigestOf, } from './apply.js';
+export type { CreateChangeMutationParams, CreateRemoveMutationParams, CreateSetMutationParams, CreateTombstoneMutationParams, } from './create.js';
+export { createChangeMutation, createRemoveMutation, createSetMutation, createTombstoneMutation, } from './create.js';
+export type { KubunMutationErrorCode, KubunMutationErrorParams } from './errors.js';
+export { DocumentIDMismatchError, FetchTokenOrderError, HLCDriftError, IncompleteProviderGroupError, InvalidAccessPermissionsError, InvalidAccessRulePatchError, InvalidDefaultAccessPermissionsError, InvalidFetchTokenError, isPermanentApplyError, KubunMutationError, MergePolicyRemoveRequiresTombstoneError, MissingFetchTokenError, MutationSchemaValidationError, OwnerChangeError, ProviderGroupChangeRejectedError, TombstoneRequiresMergePolicyError, UnsupportedMutationTypeError, WriteAccessDeniedError, } from './errors.js';
+export { type HeldProviderMutation, type HeldProviderWinner, type SelectHeldProviderWinnerParams, selectHeldProviderWinner, } from './observation-winner.js';
 export type { CreateDocumentParams, CreateMutationOperationsParams, MutationOperations, RemoveDocumentParams, SetDocumentParams, UpdateDocumentParams, } from './operations.js';
 export { convertPatchInput, createMutationOperations } from './operations.js';
+export { DELETED_STATE_DIGEST, type StateDigestInput, stateDigest } from './state-digest.js';