@powerhousedao/powerhouse-vetra-packages 6.2.2-dev.3 → 6.2.2-dev.30

package/dist/browser/{document-drive-sTKoi6L4.js → document-drive-QCAIGn3V.js}

@@ -1,4 +1,4 @@
-import { E as __commonJSMin, _ as string, c as any, f as lazy, h as object, k as __toESM, l as array, m as number, n as constantCase, o as _enum, p as literal, r as pascalCase, u as boolean, v as union, x as ZodError, y as unknown } from "./dist-CXoKspdx.js";
+import { A as __toESM, D as __commonJSMin, S as ZodError, _ as strictObject, b as unknown, c as any, f as lazy, g as record, h as object, l as array, m as number, n as constantCase, o as _enum, p as literal, r as pascalCase, u as boolean, v as string, y as union } from "./dist-B4FWbuEM.js";
 //#endregion
 //#region ../../node_modules/.pnpm/safe-stable-stringify@2.5.0/node_modules/safe-stable-stringify/esm/wrapper.js
 var import_safe_stable_stringify = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -589,7 +589,7 @@ function isBE() {
 	return new Uint8Array(new Uint16Array([65279]).buffer)[0] === 254;
 }
 //#endregion
-//#region ../shared/dist/utils-DKOFCM0Q.js
+//#region ../shared/dist/utils-CTt1XRn-.js
 const hashBrowser = (data, algorithm = "sha1", encoding = "base64", _params) => {
 	if (!["sha1"].includes(algorithm)) throw new Error(`Hashing algorithm not supported: "${algorithm}". Available: sha1`);
 	if (!["base64", "hex"].includes(encoding)) throw new Error(`Hash encoding not supported: "${encoding}". Available: base64, hex`);
@@ -636,6 +636,40 @@ function ab2hex(ab) {
 	const view = ArrayBuffer.isView(ab) ? ab : new Uint8Array(ab);
 	return Array.prototype.map.call(view, (x) => ("00" + x.toString(16)).slice(-2)).join("");
 }
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+/**
+* Decodes a base58btc (Bitcoin/IPFS alphabet) string to bytes. Returns null on
+* any character outside the alphabet.
+*/
+function base58Decode(input) {
+	const bytes = [];
+	for (const ch of input) {
+		let carry = BASE58_ALPHABET.indexOf(ch);
+		if (carry === -1) return null;
+		for (let i = 0; i < bytes.length; i++) {
+			carry += bytes[i] * 58;
+			bytes[i] = carry & 255;
+			carry >>= 8;
+		}
+		while (carry > 0) {
+			bytes.push(carry & 255);
+			carry >>= 8;
+		}
+	}
+	for (let k = 0; k < input.length && input[k] === "1"; k++) bytes.push(0);
+	return Uint8Array.from(bytes.reverse());
+}
+/** Decodes a base64url string to bytes (portable across node, browsers, workers). */
+function base64UrlToBytes(input) {
+	const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+	let binary;
+	if (typeof atob === "function") binary = atob(padded);
+	else binary = Buffer.from(padded, "base64").toString("binary");
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
 function generateId(method) {
 	if (method && method.toString() !== "UUIDv4") throw new Error(`Id generation method not supported: "${method.toString()}"`);
 	return globalThis.crypto.randomUUID();
@@ -2978,6 +3012,75 @@ var DowngradeNotSupportedError = class extends Error {
 		this.toVersion = toVersion;
 	}
 };
+/**
+* Thrown when INITIALIZE_AUTH is applied to an already-initialized auth scope.
+* The genesis action is valid only at auth revision zero.
+*/
+var AuthAlreadyInitializedError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`Auth scope already initialized for document ${documentId}: INITIALIZE_AUTH is valid only at auth revision zero`);
+		this.name = "AuthAlreadyInitializedError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH is not signed by the document creator (its signer
+* does not match `header.sig.publicKey`), so it cannot set the auth policy.
+*/
+var AuthInitializerNotCreatorError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`INITIALIZE_AUTH for document ${documentId} must be signed by the document creator`);
+		this.name = "AuthInitializerNotCreatorError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH carries a version below 1. Version 0 is reserved
+* for the uninitialized auth scope.
+*/
+var InvalidAuthVersionError = class extends Error {
+	documentId;
+	version;
+	constructor(documentId, version) {
+		super(`Invalid auth policy version ${version} for document ${documentId}: INITIALIZE_AUTH requires an integer version >= 1`);
+		this.name = "InvalidAuthVersionError";
+		this.documentId = documentId;
+		this.version = version;
+	}
+};
+/** Thrown when a duplicate would lose the source policy's version or creator binding. */
+var AuthPolicyNotPreservedError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`Duplicating document ${documentId} would not preserve its auth policy: the copy loses the policy version or its creator binding`);
+		this.name = "AuthPolicyNotPreservedError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when a grant referenced by REMOVE_GRANT or MOVE_GRANT does not exist.
+*/
+var GrantNotFoundError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Grant not found in auth scope: ${grantId}`);
+		this.name = "GrantNotFoundError";
+		this.grantId = grantId;
+	}
+};
+/**
+* Thrown when a disallowed action (UNDO, REDO, PRUNE) targets the auth scope.
+*/
+var AuthActionNotAllowedError = class extends Error {
+	actionType;
+	constructor(actionType) {
+		super(`${actionType} is not permitted on the auth scope`);
+		this.name = "AuthActionNotAllowedError";
+		this.actionType = actionType;
+	}
+};
 var HashMismatchError = class extends Error {
 	_scope;
 	_document;
@@ -3444,17 +3547,101 @@ const ConfigEntrySchema = object({
 	required: boolean().optional(),
 	default: boolean().optional()
 });
+const PwaUrlPatternSchema = union([string(), strictObject({
+	source: string(),
+	flags: string().optional()
+}).refine((p) => {
+	try {
+		new RegExp(p.source, p.flags);
+		return true;
+	} catch {
+		return false;
+	}
+}, { message: "source/flags do not compile to a valid RegExp" })]);
+const PwaRuntimeCachingSchema = strictObject({
+	urlPattern: PwaUrlPatternSchema,
+	handler: _enum([
+		"CacheFirst",
+		"CacheOnly",
+		"NetworkFirst",
+		"NetworkOnly",
+		"StaleWhileRevalidate"
+	]),
+	method: _enum([
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"HEAD",
+		"PATCH"
+	]).optional(),
+	options: strictObject({
+		cacheName: string().optional(),
+		networkTimeoutSeconds: number().optional(),
+		expiration: strictObject({
+			maxEntries: number().optional(),
+			maxAgeSeconds: number().optional()
+		}).optional(),
+		cacheableResponse: strictObject({
+			statuses: array(number()).optional(),
+			headers: record(string(), string()).optional()
+		}).optional()
+	}).optional()
+});
+const PwaIconSchema = strictObject({
+	src: string(),
+	sizes: string().optional(),
+	type: string().optional(),
+	purpose: string().optional()
+});
+const PwaFileHandlerSchema = strictObject({
+	accept: record(string(), array(string().regex(/^\./, "file extensions must start with '.'"))),
+	icons: array(PwaIconSchema).optional(),
+	launch_type: _enum(["single-client", "multiple-clients"]).optional()
+});
+const PwaConfigSchema = strictObject({
+	manifest: strictObject({
+		name: string().optional(),
+		short_name: string().optional(),
+		description: string().optional(),
+		theme_color: string().optional(),
+		background_color: string().optional(),
+		display: _enum([
+			"fullscreen",
+			"standalone",
+			"minimal-ui",
+			"browser"
+		]).optional(),
+		start_url: string().optional(),
+		scope: string().optional(),
+		icons: array(PwaIconSchema).optional(),
+		file_handlers: array(PwaFileHandlerSchema).optional(),
+		launch_handler: strictObject({ client_mode: _enum([
+			"auto",
+			"focus-existing",
+			"navigate-existing",
+			"navigate-new"
+		]) }).optional()
+	}).optional(),
+	globPatterns: array(string()).optional(),
+	globIgnores: array(string()).optional(),
+	maximumFileSizeToCacheInBytes: number().optional(),
+	runtimeCaching: array(PwaRuntimeCachingSchema).optional(),
+	navigateFallbackDenylist: array(PwaUrlPatternSchema).optional()
+});
 object({
 	name: string(),
 	description: string().optional(),
 	category: string().optional(),
+	image: string().optional(),
 	publisher: PublisherSchema.optional(),
 	documentModels: PowerhouseModulesSchema,
 	apps: PowerhouseModulesSchema,
 	editors: PowerhouseModulesSchema,
 	processors: PowerhouseModulesSchema,
 	subgraphs: PowerhouseModulesSchema,
-	config: array(ConfigEntrySchema).optional()
+	config: array(ConfigEntrySchema).optional(),
+	pwa: PwaConfigSchema.optional()
 });
 /**
 * Cancels the last `count` operations.
@@ -3725,6 +3912,189 @@ const actions = {
 	...baseActions,
 	...documentModelActions
 };
+const documentModelDocumentType = "powerhouse/document-model";
+/**
+* Thrown when a grant violates the v1 validation rules. The message is stored
+* on error operations, so it must be a pure function of the input.
+*/
+var InvalidGrantError = class extends Error {
+	grantId;
+	constructor(grantId, problem) {
+		super(`Invalid grant "${grantId}": ${problem}`);
+		this.name = "InvalidGrantError";
+		this.grantId = grantId;
+	}
+};
+/** Thrown for a `{ group }` principal on a group document: references never chain. */
+var GroupPrincipalNotAllowedError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Grant "${grantId}" uses a group principal on a group document: a group's auth scope cannot reference other groups`);
+		this.name = "GroupPrincipalNotAllowedError";
+		this.grantId = grantId;
+	}
+};
+const GRANT_KEYS = new Set([
+	"id",
+	"description",
+	"effect",
+	"principal",
+	"capability",
+	"where"
+]);
+const PRINCIPAL_KINDS = new Set([
+	"anyone",
+	"address",
+	"group",
+	"match"
+]);
+const COMPARISON_CONDITION_KINDS = new Set([
+	"eq",
+	"ne",
+	"lt",
+	"lte",
+	"gt",
+	"gte"
+]);
+function isPlainValue(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function operandProblem(value, capabilityScope, budget) {
+	budget.nodes -= 1;
+	if (budget.nodes < 0) return `condition exceeds 100 nodes`;
+	if (!isPlainValue(value)) return "operand must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return "operand must have exactly one of attr or lit";
+	if (keys[0] === "attr") {
+		const attr = value.attr;
+		if (typeof attr !== "string" || attr.length === 0) return "attr must be a non-empty string";
+		if (capabilityScope !== void 0 && capabilityScope !== "*" && attr.startsWith("doc.")) {
+			const pathScope = attr.split(".")[1] ?? "";
+			if (pathScope !== capabilityScope) return `condition path "${attr}" reads scope "${pathScope}" but the capability covers only scope "${capabilityScope}"`;
+		}
+		return null;
+	}
+	if (keys[0] === "lit") {
+		const lit = value.lit;
+		if (lit !== null && typeof lit !== "string" && typeof lit !== "number" && typeof lit !== "boolean") return "lit must be a string, number, boolean, or null";
+		if (typeof lit === "number" && !Number.isFinite(lit)) return "lit must be a finite number";
+		if (typeof lit === "number" && Object.is(lit, -0)) return "lit must not be negative zero";
+		return null;
+	}
+	return `unknown operand kind "${keys[0]}"`;
+}
+function conditionProblem(value, capabilityScope, depth, budget) {
+	if (depth > 10) return `condition exceeds depth 10`;
+	budget.nodes -= 1;
+	if (budget.nodes < 0) return `condition exceeds 100 nodes`;
+	if (!isPlainValue(value)) return "condition must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return "condition must have exactly one operator";
+	const kind = keys[0];
+	const body = value[kind];
+	if (COMPARISON_CONDITION_KINDS.has(kind)) {
+		if (!Array.isArray(body) || body.length !== 2) return `${kind} requires a pair of operands`;
+		for (const operand of body) {
+			const problem = operandProblem(operand, capabilityScope, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "in" || kind === "notIn") {
+		if (!Array.isArray(body) || body.length !== 2 || !Array.isArray(body[1])) return `${kind} requires an operand and an operand list`;
+		const first = operandProblem(body[0], capabilityScope, budget);
+		if (first !== null) return first;
+		for (const operand of body[1]) {
+			const problem = operandProblem(operand, capabilityScope, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "exists") return operandProblem(body, capabilityScope, budget);
+	if (kind === "and" || kind === "or") {
+		if (!Array.isArray(body)) return `${kind} requires a condition list`;
+		for (const child of body) {
+			const problem = conditionProblem(child, capabilityScope, depth + 1, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "not") return conditionProblem(body, capabilityScope, depth + 1, budget);
+	return `unknown condition operator "${kind}"`;
+}
+function principalProblem(value, capabilityScope) {
+	if (!isPlainValue(value)) return "principal must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1 || !PRINCIPAL_KINDS.has(keys[0])) return "principal must have exactly one of anyone, address, group, or match";
+	const kind = keys[0];
+	if (kind === "anyone" && value.anyone !== true) return "anyone must be true";
+	if (kind === "address") {
+		const address = value.address;
+		if (typeof address !== "string" || address.length === 0) return "address must be a non-empty string";
+	}
+	if (kind === "group") {
+		const group = value.group;
+		if (typeof group !== "string" || group.length === 0) return "group must be a non-empty string";
+	}
+	if (kind === "match") return conditionProblem(value.match, capabilityScope, 1, { nodes: 100 });
+	return null;
+}
+function capabilityProblem(value) {
+	if (!isPlainValue(value)) return "capability must be an object";
+	const can = value.can;
+	if (can !== "read" && can !== "execute") return "capability.can must be read or execute";
+	const allowedKeys = can === "execute" ? [
+		"can",
+		"scope",
+		"operation"
+	] : ["can", "scope"];
+	const unknownKeys = Object.keys(value).filter((key) => !allowedKeys.includes(key)).sort();
+	if (unknownKeys.length > 0) return `unknown capability key "${unknownKeys[0]}"`;
+	if (value.scope !== void 0) {
+		if (typeof value.scope !== "string" || value.scope.length === 0) return "capability.scope must be a non-empty string";
+	}
+	if (can === "execute" && value.operation !== void 0) {
+		const operation = value.operation;
+		if (!Array.isArray(operation)) return "capability.operation must be an array";
+		if (operation.length > 100) return `capability.operation exceeds 100 entries`;
+		for (const entry of operation) if (typeof entry !== "string" || entry.length === 0) return "capability.operation entries must be non-empty strings";
+	}
+	return null;
+}
+/** Returns the first v1-rule violation, or null. Pure, total, deterministic. */
+function grantProblem(value) {
+	if (!isPlainValue(value)) return "grant must be an object";
+	const unknownKeys = Object.keys(value).filter((key) => !GRANT_KEYS.has(key)).sort();
+	if (unknownKeys.length > 0) return `unknown grant key "${unknownKeys[0]}"`;
+	if (typeof value.id !== "string" || value.id.length === 0) return "id must be a non-empty string";
+	if (typeof value.description !== "string") return "description must be a string";
+	if (value.effect !== "allow" && value.effect !== "deny") return "effect must be allow or deny";
+	const capabilityValue = value.capability;
+	const capability = capabilityProblem(capabilityValue);
+	if (capability !== null) return capability;
+	const capabilityScope = capabilityValue.scope;
+	const principal = principalProblem(value.principal, capabilityScope);
+	if (principal !== null) return principal;
+	if (value.where !== void 0) return conditionProblem(value.where, capabilityScope, 1, { nodes: 100 });
+	return null;
+}
+/** V1 shape rules plus the group-document group-principal ban. */
+function assertValidGrant(grant, documentType) {
+	const grantId = isPlainValue(grant) && typeof grant.id === "string" ? grant.id : "";
+	const problem = grantProblem(grant);
+	if (problem !== null) throw new InvalidGrantError(grantId, problem);
+	if (documentType === "@powerhousedao/document-group" && "group" in grant.principal) throw new GroupPrincipalNotAllowedError(grantId);
+}
+/** Validates an initial grant list: the count cap plus every grant. */
+function assertValidInitialGrants(grants, documentType) {
+	if (grants.length > 100) throw new InvalidGrantError("", `policy exceeds 100 grants`);
+	for (const grant of grants) assertValidGrant(grant, documentType);
+}
+/** Validates a grant upsert: the grant itself plus the count cap on append. */
+function assertValidGrantUpsert(grant, existing, documentType) {
+	assertValidGrant(grant, documentType);
+	if (!existing.some((g) => g.id === grant.id) && existing.length >= 100) throw new InvalidGrantError(grant.id, `policy exceeds 100 grants`);
+}
 const documentModelFileExtension = "phdm";
 const documentModelInitialLocalState = {};
 const documentModelInitialGlobalState = {
@@ -4306,7 +4676,252 @@ const documentModelGlobalState = {
 };
 const HASH_ALGORITHM_SHA1 = "sha1";
 const HASH_ENCODING_BASE64 = "base64";
-const documentModelDocumentType = "powerhouse/document-model";
+/**
+* Creates a default PHAuthState
+*/
+function defaultAuthState() {
+	return {
+		version: 0,
+		grants: []
+	};
+}
+/**
+* Creates a default PHDocumentState
+*/
+function defaultDocumentState() {
+	return {
+		version: 0,
+		hash: {
+			algorithm: HASH_ALGORITHM_SHA1,
+			encoding: HASH_ENCODING_BASE64
+		}
+	};
+}
+/**
+* Creates a default PHBaseState with auth and document properties
+*/
+function defaultBaseState() {
+	return {
+		auth: defaultAuthState(),
+		document: defaultDocumentState()
+	};
+}
+/**
+* Creates a PHAuthState with the given properties
+*/
+function createAuthState(auth) {
+	return {
+		...defaultAuthState(),
+		...auth
+	};
+}
+/**
+* Creates a PHDocumentState with the given properties
+*/
+function createDocumentState(document) {
+	return {
+		...defaultDocumentState(),
+		...document
+	};
+}
+/**
+* Creates a PHBaseState with the given auth and document properties
+*/
+function createBaseState(auth, document) {
+	return {
+		auth: createAuthState(auth),
+		document: createDocumentState(document)
+	};
+}
+/**
+* Backfills the auth scope to the default for legacy documents serialized with
+* an empty `auth`. Replaces only `state.auth`. Idempotent.
+*/
+function backfillAuthState(state) {
+	return {
+		...state,
+		auth: createAuthState(state.auth)
+	};
+}
+function defaultGlobalState() {
+	return {
+		...defaultBaseState(),
+		author: {
+			name: "",
+			website: ""
+		},
+		description: "",
+		extension: "",
+		id: "",
+		name: "",
+		specifications: []
+	};
+}
+function defaultLocalState() {
+	return {};
+}
+function createGlobalState(state) {
+	return {
+		...defaultGlobalState(),
+		...state || {}
+	};
+}
+function createLocalState(state) {
+	return {
+		...defaultLocalState(),
+		...state || {}
+	};
+}
+function createState(baseState, globalState, localState) {
+	return {
+		...createBaseState(baseState?.auth, baseState?.document),
+		global: createGlobalState(globalState),
+		local: createLocalState(localState)
+	};
+}
+/**
+* Destructuring a null input (reachable via raw synced operations) would
+* store an engine-specific TypeError message on the error operation.
+*/
+function assertActionInputShape(input) {
+	if (!isPlainValue(input)) throw new InvalidActionInputError({ input: "must be an object" });
+}
+function withGrants(document, grants) {
+	return {
+		...document,
+		state: {
+			...document.state,
+			auth: {
+				...document.state.auth,
+				grants
+			}
+		}
+	};
+}
+const P256_PUBKEY_MULTICODEC = [128, 36];
+const DID_KEY_PREFIX = "did:key:z";
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+/**
+* True when `signerKey` (an ActionSigner app key, a did:key) identifies the same
+* key recorded as the document creator. Returns false
+* when there is no creator (empty JWK) or no signer key.
+*/
+function isDocumentCreator(creatorKey, signerKey) {
+	if (!creatorKey?.x || !creatorKey.y) return false;
+	if (!signerKey || !signerKey.startsWith(DID_KEY_PREFIX)) return false;
+	const decoded = base58Decode(signerKey.slice(9));
+	if (!decoded || decoded.length !== 35) return false;
+	if (decoded[0] !== P256_PUBKEY_MULTICODEC[0] || decoded[1] !== P256_PUBKEY_MULTICODEC[1]) return false;
+	const parityPrefix = decoded[2];
+	if (parityPrefix !== 2 && parityPrefix !== 3) return false;
+	const didX = decoded.subarray(3, 35);
+	const jwkX = base64UrlToBytes(creatorKey.x);
+	const jwkY = base64UrlToBytes(creatorKey.y);
+	if (jwkX.length !== 32 || jwkY.length !== 32) return false;
+	if (!bytesEqual(didX, jwkX)) return false;
+	return (jwkY[31] & 1) === 1 === (parityPrefix === 3);
+}
+/**
+* Sets the initial policy. Valid only while the auth scope is uninitialized
+* (version 0). The input version is the policy language version and must be an
+* integer >= 1; 0 is reserved for the uninitialized state. On a signed-header
+* document it must be signed by the document creator (`header.sig.publicKey`).
+*/
+function applyInitializeAuthAction(document, action) {
+	assertActionInputShape(action.input);
+	const { version, grants } = action.input;
+	if (!Number.isInteger(version) || version < 1) throw new InvalidAuthVersionError(document.header.id, version);
+	if (document.state.auth.version !== 0) throw new AuthAlreadyInitializedError(document.header.id);
+	if (!Array.isArray(grants)) throw new InvalidActionInputError({ grants: "must be an array" });
+	assertValidInitialGrants(grants, document.header.documentType);
+	const creatorKey = document.header.sig.publicKey;
+	const signerKey = action.context?.signer?.app.key;
+	const hasCreator = Boolean(creatorKey.kty || creatorKey.x || creatorKey.y);
+	if (hasCreator && !isDocumentCreator(creatorKey, signerKey)) throw new AuthInitializerNotCreatorError(document.header.id);
+	const creator = hasCreator ? signerKey : void 0;
+	return {
+		...document,
+		state: {
+			...document.state,
+			auth: createAuthState(creator ? {
+				version,
+				grants,
+				creator
+			} : {
+				version,
+				grants
+			})
+		}
+	};
+}
+/** Upserts a grant by id: replaces in place if present, otherwise appends. */
+function applySetGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { grant } = action.input;
+	const grants = document.state.auth.grants;
+	assertValidGrantUpsert(grant, grants, document.header.documentType);
+	return withGrants(document, grants.some((g) => g.id === grant.id) ? grants.map((g) => g.id === grant.id ? grant : g) : [...grants, grant]);
+}
+/** Removes a grant by id; throws if the id is not present. */
+function applyRemoveGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { id } = action.input;
+	const grants = document.state.auth.grants;
+	if (!grants.some((g) => g.id === id)) throw new GrantNotFoundError(id);
+	return withGrants(document, grants.filter((g) => g.id !== id));
+}
+/**
+* Moves a grant by id to a new index. Order is load-bearing (the last
+* applicable grant wins), so the relative order of the other grants is kept.
+* The target index is clamped to the valid range; an unknown id throws.
+*/
+function applyMoveGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { id, index } = action.input;
+	const grants = document.state.auth.grants;
+	const from = grants.findIndex((g) => g.id === id);
+	if (from === -1) throw new GrantNotFoundError(id);
+	const next = [...grants];
+	const [moved] = next.splice(from, 1);
+	const to = Math.max(0, Math.min(index, next.length));
+	next.splice(to, 0, moved);
+	return withGrants(document, next);
+}
+/**
+* Dispatches an auth-scope action to its handler. This is the auth scope's
+* dedicated reducer: it is applied by the base reducer instead of the model
+* reducer, mirroring the document-scope platform handlers. Unknown types are a
+* no-op, matching the model-reducer default.
+*/
+function applyAuthAction(document, action) {
+	switch (action.type) {
+		case "INITIALIZE_AUTH": return applyInitializeAuthAction(document, action);
+		case "SET_GRANT": return applySetGrantAction(document, action);
+		case "REMOVE_GRANT": return applyRemoveGrantAction(document, action);
+		case "MOVE_GRANT": return applyMoveGrantAction(document, action);
+		default: return document;
+	}
+}
+/**
+* Because only creators can initialize auth scopes, we must verify that either
+* the document has no auth or the version and creator match.
+*/
+function assertAuthPreservedOnDuplicate(documentId, source, duplicated) {
+	if (!source || source.version === 0) return;
+	if (duplicated === void 0 || duplicated.version !== source.version || duplicated.creator !== source.creator) throw new AuthPolicyNotPreservedError(documentId);
+}
+/** UNDO, REDO and PRUNE are rejected on the auth scope. */
+function assertAuthScopeActionAllowed(action) {
+	if (action.scope === "auth" && [
+		"UNDO",
+		"REDO",
+		"PRUNE"
+	].includes(action.type)) throw new AuthActionNotAllowedError(action.type);
+}
 const BaseDocumentHeaderSchema = object({
 	id: string(),
 	name: string(),
@@ -4437,6 +5052,7 @@ function createDocumentScopeOperations(header, state) {
 function baseCreateDocument(createState, initialState, documentType = "") {
 	const state = createState(initialState);
 	const header = createPresignedHeader(generateId(), documentType);
+	header.protocolVersions = { "base-reducer": 2 };
 	return {
 		header,
 		state,
@@ -4460,6 +5076,18 @@ function hashDocumentStateForScope(document, scope = "global") {
 * Uses the V2 model where consecutive NOOPs form chains.
 * Unlike V1 garbageCollect, this preserves ALL operations but marks which to apply.
 */
+/**
+* The base-reducer protocol version a document is written against. Every
+* document carries one, set from the CREATE_DOCUMENT input. A header without
+* one was built outside that path, and choosing a version on its behalf would
+* replay the document through a reducer it was not written for, so it is an
+* error rather than a default.
+*/
+function baseReducerVersion(header) {
+	const version = header.protocolVersions?.["base-reducer"];
+	if (typeof version !== "number") throw new Error(`Document ${header.id} carries no base-reducer protocol version`);
+	return version;
+}
 function garbageCollectV2(sortedOperations) {
 	const result = [];
 	let noopChainLength = 0;
@@ -4478,7 +5106,8 @@ const defaultCreateState = (state) => {
 };
 function replayDocument(initialState, operations, reducer, header, dispatch, skipHeaderOperations = {}, options) {
 	const { checkHashes = true, reuseOperationResultingState, operationResultingStateParser = parseResultingState, skipIndexValidation } = options || {};
-	let documentState = initialState;
+	const backfilledInitialState = backfillAuthState(initialState);
+	let documentState = backfilledInitialState;
 	const operationsToReplay = [];
 	const allScopes = new Set([
 		...Object.keys(operations),
@@ -4513,7 +5142,7 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 	const document = {
 		header,
 		state: defaultCreateState(documentState),
-		initialState,
+		initialState: backfilledInitialState,
 		operations: initialOperations,
 		clipboard: []
 	};
@@ -4806,7 +5435,7 @@ function loadStateOperation(document, action) {
 			...document.header,
 			name: action.state.name
 		},
-		state: action.state.data
+		state: backfillAuthState(action.state.data)
 	};
 }
 function replayOperations(initialState, clearedOperations, stateReducer, header, dispatch, documentReducer = baseReducer, skipHeaderOperations = {}, options) {
@@ -4980,6 +5609,7 @@ function processUndoOperation(document, scope, customReducer, reuseOperationResu
 function baseReducer(document, action, customReducer, dispatch, options = {}) {
 	const { skip, ignoreSkipOperations = false, reuseOperationResultingState = false, operationResultingStateParser, pruneOnSkip = true, branch = "main" } = options;
 	let _action = actionFromAction(action);
+	assertAuthScopeActionAllowed(_action);
 	let skipValue = skip ?? options.replayOptions?.operation.skip ?? 0;
 	let newDocument = { ...document };
 	let reuseLastOperationIndex = false;
@@ -5027,6 +5657,13 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 	}
 	newDocument = create(newDocument, (draft) => {
 		try {
+			if (_action.scope === "auth") {
+				const authState = applyAuthAction(newDocument, _action).state;
+				unsafe(() => {
+					draft.state = castDraft(authState);
+				});
+				return;
+			}
 			const newState = customReducer(draft.state, _action, dispatch);
 			if (newState) unsafe(() => {
 				draft.state = castDraft(newState);
@@ -5820,10 +6457,10 @@ function applyInitialState(document, action) {
 	const input = action.input;
 	const newState = input.initialState || input.state;
 	if (newState) {
-		document.state = {
+		document.state = backfillAuthState({
 			...document.state,
 			...newState
-		};
+		});
 		document.initialState = document.state;
 	}
 }
@@ -5883,7 +6520,6 @@ function computeUpgradeTransitions(manifest, fromVersion, toVersion) {
 	}
 	return transitions;
 }
-const NON_DOMAIN_SCOPES$1 = new Set(["auth", "document"]);
 function highestReducerVersion(reducers) {
 	const keys = Object.keys(reducers).map(Number);
 	if (keys.length === 0) throw new Error("VersionedReplayConfig.reducers must not be empty");
@@ -5911,15 +6547,15 @@ function highestReducerVersion(reducers) {
 */
 function replayDocumentVersioned(initialState, operations, config, header, dispatch, options) {
 	const { checkHashes = true, skipIndexValidation } = options || {};
-	const protocolVersion = header.protocolVersions?.["base-reducer"] ?? 1;
+	const protocolVersion = baseReducerVersion(header);
 	const spine = (operations["document"] ?? []).slice().sort((a, b) => a.index - b.index);
 	const upgrades = spine.filter((op) => op.action.type === "UPGRADE_DOCUMENT");
 	const legacyFallback = () => {
-		const domainOps = Object.fromEntries(Object.entries(operations).filter(([s]) => !NON_DOMAIN_SCOPES$1.has(s)));
+		const replayOps = Object.fromEntries(Object.entries(operations).filter(([s]) => s !== "document"));
 		const latestVersion = highestReducerVersion(config.reducers);
 		const reducer = config.reducers[latestVersion];
 		return {
-			...replayDocument(initialState, domainOps, reducer, header, dispatch, {}, options),
+			...replayDocument(initialState, replayOps, reducer, header, dispatch, {}, options),
 			operations
 		};
 	};
@@ -5943,14 +6579,14 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		const a = op.action;
 		return a.input.fromVersion > 0 && a.input.fromVersion < a.input.toVersion;
 	});
-	const domainScopes = Object.keys(operations).filter((s) => !NON_DOMAIN_SCOPES$1.has(s));
+	const replayScopes = Object.keys(operations).filter((s) => s !== "document");
 	const scopeOps = {};
-	for (const s of domainScopes) scopeOps[s] = (operations[s] ?? []).slice().sort((a, b) => a.index - b.index);
+	for (const s of replayScopes) scopeOps[s] = (operations[s] ?? []).slice().sort((a, b) => a.index - b.index);
 	const boundaries = validatedUpgrades.map((upgradeOp) => {
 		const revisionSnapshot = upgradeOp.action.input.revision;
 		const upgradeTimestamp = upgradeOp.timestampUtcMs;
 		const boundary = {};
-		for (const s of domainScopes) {
+		for (const s of replayScopes) {
 			const ops = scopeOps[s] ?? [];
 			if (revisionSnapshot !== void 0) {
 				const rev = revisionSnapshot[s] ?? 0;
@@ -5968,7 +6604,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		}
 		return boundary;
 	});
-	for (let i = 1; i < boundaries.length; i++) for (const s of domainScopes) {
+	for (let i = 1; i < boundaries.length; i++) for (const s of replayScopes) {
 		const prev = boundaries[i - 1]?.[s] ?? 0;
 		const curr = boundaries[i]?.[s] ?? 0;
 		if (boundaries[i]) boundaries[i][s] = Math.max(prev, curr);
@@ -5980,10 +6616,11 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 	]);
 	const initialOperations = {};
 	for (const s of allScopes) initialOperations[s] = [];
+	const backfilledSeed = backfillAuthState(seedState);
 	let document = {
 		header,
-		state: seedState,
-		initialState: seedState,
+		state: backfilledSeed,
+		initialState: backfilledSeed,
 		operations: initialOperations,
 		clipboard: []
 	};
@@ -5995,7 +6632,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			const available = Object.keys(config.reducers).join(", ");
 			throw new Error(`No reducer registered for document version ${currentVersion}. Available versions: ${available}`);
 		}
-		for (const s of domainScopes) {
+		for (const s of replayScopes) {
 			const ops = scopeOps[s] ?? [];
 			const segStart = k === 0 ? 0 : boundaries[k - 1]?.[s] ?? 0;
 			const segEnd = k < validatedUpgrades.length ? boundaries[k]?.[s] ?? ops.length : ops.length;
@@ -6048,7 +6685,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		}
 	};
 	if (!checkHashes) {
-		const allReplayedOps = domainScopes.flatMap((s) => scopeOps[s] ?? []);
+		const allReplayedOps = replayScopes.flatMap((s) => scopeOps[s] ?? []);
 		for (const scope of Object.keys(document.state)) {
 			const capturedHash = segmentEndHashPerScope.get(scope);
 			const scopeHash = capturedHash !== void 0 ? capturedHash : hashDocumentStateForScope(document, scope);
@@ -6090,7 +6727,6 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		}
 	};
 }
-const NON_DOMAIN_SCOPES = new Set(["auth", "document"]);
 function zipAsync(data) {
 	return new Promise((resolve, reject) => {
 		zip(data, (err, out) => err ? reject(err) : resolve(out));
@@ -6169,7 +6805,7 @@ async function parseZipData(data) {
 async function loadFromZipData(data, reducer, options) {
 	const { initialState, header, clearedOperations } = await parseZipData(data);
 	return {
-		...replayDocument(initialState, Object.fromEntries(Object.entries(clearedOperations).filter(([scope]) => !NON_DOMAIN_SCOPES.has(scope))), reducer, header, void 0, {}, options),
+		...replayDocument(initialState, Object.fromEntries(Object.entries(clearedOperations).filter(([scope]) => scope !== "document")), reducer, header, void 0, {}, options),
 		operations: clearedOperations
 	};
 }
@@ -6192,96 +6828,6 @@ const documentModelLoadFromInput = (input) => {
 const documentModelSaveToFileHandle = (document, input) => {
 	return baseSaveToFileHandle(document, input);
 };
-/**
-* Creates a default PHAuthState
-*/
-function defaultAuthState() {
-	return {};
-}
-/**
-* Creates a default PHDocumentState
-*/
-function defaultDocumentState() {
-	return {
-		version: 0,
-		hash: {
-			algorithm: HASH_ALGORITHM_SHA1,
-			encoding: HASH_ENCODING_BASE64
-		}
-	};
-}
-/**
-* Creates a default PHBaseState with auth and document properties
-*/
-function defaultBaseState() {
-	return {
-		auth: defaultAuthState(),
-		document: defaultDocumentState()
-	};
-}
-/**
-* Creates a PHAuthState with the given properties
-*/
-function createAuthState(auth) {
-	return {
-		...defaultAuthState(),
-		...auth
-	};
-}
-/**
-* Creates a PHDocumentState with the given properties
-*/
-function createDocumentState(document) {
-	return {
-		...defaultDocumentState(),
-		...document
-	};
-}
-/**
-* Creates a PHBaseState with the given auth and document properties
-*/
-function createBaseState(auth, document) {
-	return {
-		auth: createAuthState(auth),
-		document: createDocumentState(document)
-	};
-}
-function defaultGlobalState() {
-	return {
-		...defaultBaseState(),
-		author: {
-			name: "",
-			website: ""
-		},
-		description: "",
-		extension: "",
-		id: "",
-		name: "",
-		specifications: []
-	};
-}
-function defaultLocalState() {
-	return {};
-}
-function createGlobalState(state) {
-	return {
-		...defaultGlobalState(),
-		...state || {}
-	};
-}
-function createLocalState(state) {
-	return {
-		...defaultLocalState(),
-		...state || {}
-	};
-}
-function createState(baseState, globalState, localState) {
-	return {
-		...createBaseState(baseState?.auth, baseState?.document),
-		global: createGlobalState(globalState),
-		local: createLocalState(localState)
-	};
-}
 //#endregion
 //#region ../document-model/dist/index.js
 const isStateOfType$1 = (state) => {
@@ -7360,6 +7906,6 @@ const driveDocumentModelModule = {
 	}
 };
 //#endregion
-export { redo as A, setName as B, createZip as C, deleteOperationError as D, deleteOperation as E, setModelDescription as F, setStateSchema as G, setOperationErrorName as H, setModelExtension as I, validateModules as J, undo as K, setModelId as L, setAuthorName as M, setAuthorWebsite as N, documentModelDocumentType as O, setInitialState as P, setModelName as R, createState as S, deleteModule as T, setOperationName as U, setOperationDescription as V, setOperationSchema as W, generateId as X, validateStateSchemaName as Y, baseLoadFromInputVersioned as _, handleTargetNameCollisions as a, createPresignedHeader as b, moveNode as c, logger as d, addModule as f, baseLoadFromInput as g, baseCreateDocument as h, generateNodesCopy as i, replayDocumentVersioned as j, isDocumentAction as k, updateNode as l, addOperationError as m, copyNode as n, isFileNode as o, addOperation as p, validateInitialState as q, driveDocumentModelModule as r, isFolderNode as s, addFolder as t, documentModelDocumentModelModule as u, baseSaveToFileHandle as v, defaultBaseState as w, createReducer as x, buildSignedAction as y, setModuleName as z };
+export { hashDocumentStateForScope as A, setModelName as B, createState as C, deleteOperation as D, deleteModule as E, setAuthorWebsite as F, setOperationName as G, setName as H, setInitialState as I, undo as J, setOperationSchema as K, setModelDescription as L, redo as M, replayDocumentVersioned as N, deleteOperationError as O, setAuthorName as P, generateId as Q, setModelExtension as R, createReducer as S, defaultBaseState as T, setOperationDescription as U, setModuleName as V, setOperationErrorName as W, validateModules as X, validateInitialState as Y, validateStateSchemaName as Z, baseLoadFromInput as _, handleTargetNameCollisions as a, buildSignedAction as b, moveNode as c, logger as d, addModule as f, baseCreateDocument as g, assertAuthPreservedOnDuplicate as h, generateNodesCopy as i, isDocumentAction as j, documentModelDocumentType as k, updateNode as l, addOperationError as m, copyNode as n, isFileNode as o, addOperation as p, setStateSchema as q, driveDocumentModelModule as r, isFolderNode as s, addFolder as t, documentModelDocumentModelModule as u, baseLoadFromInputVersioned as v, createZip as w, createPresignedHeader as x, baseSaveToFileHandle as y, setModelId as z };
 
-//# sourceMappingURL=document-drive-sTKoi6L4.js.map
+//# sourceMappingURL=document-drive-QCAIGn3V.js.map