@powerhousedao/powerhouse-vetra-packages 6.2.2-dev.6 → 6.2.2-dev.61

package/dist/node/{document-drive-C8hbqQ3C.mjs → document-drive-ChLoGFvU.mjs}

@@ -1,4 +1,4 @@
-import { E as __commonJSMin, _ as string, c as any, f as lazy, h as object, j as __toESM, l as array, m as number, n as constantCase, o as _enum, p as literal, r as pascalCase, u as boolean, v as union, x as ZodError, y as unknown } from "./dist-fA4EItr0.mjs";
+import { D as __commonJSMin, M as __toESM, S as ZodError, _ as strictObject, b as unknown, c as any, f as lazy, g as record, h as object, l as array, m as number, n as constantCase, o as _enum, p as literal, r as pascalCase, u as boolean, v as string, y as union } from "./dist-DT7jI9ol.mjs";
 import { createRequire } from "module";
 //#endregion
 //#region ../../node_modules/.pnpm/safe-stable-stringify@2.5.0/node_modules/safe-stable-stringify/esm/wrapper.js
@@ -590,7 +590,7 @@ function isBE() {
 	return new Uint8Array(new Uint16Array([65279]).buffer)[0] === 254;
 }
 //#endregion
-//#region ../shared/dist/utils-DKOFCM0Q.js
+//#region ../shared/dist/utils-CTt1XRn-.js
 const hashBrowser = (data, algorithm = "sha1", encoding = "base64", _params) => {
 	if (!["sha1"].includes(algorithm)) throw new Error(`Hashing algorithm not supported: "${algorithm}". Available: sha1`);
 	if (!["base64", "hex"].includes(encoding)) throw new Error(`Hash encoding not supported: "${encoding}". Available: base64, hex`);
@@ -637,6 +637,40 @@ function ab2hex(ab) {
 	const view = ArrayBuffer.isView(ab) ? ab : new Uint8Array(ab);
 	return Array.prototype.map.call(view, (x) => ("00" + x.toString(16)).slice(-2)).join("");
 }
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+/**
+* Decodes a base58btc (Bitcoin/IPFS alphabet) string to bytes. Returns null on
+* any character outside the alphabet.
+*/
+function base58Decode(input) {
+	const bytes = [];
+	for (const ch of input) {
+		let carry = BASE58_ALPHABET.indexOf(ch);
+		if (carry === -1) return null;
+		for (let i = 0; i < bytes.length; i++) {
+			carry += bytes[i] * 58;
+			bytes[i] = carry & 255;
+			carry >>= 8;
+		}
+		while (carry > 0) {
+			bytes.push(carry & 255);
+			carry >>= 8;
+		}
+	}
+	for (let k = 0; k < input.length && input[k] === "1"; k++) bytes.push(0);
+	return Uint8Array.from(bytes.reverse());
+}
+/** Decodes a base64url string to bytes (portable across node, browsers, workers). */
+function base64UrlToBytes(input) {
+	const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+	let binary;
+	if (typeof atob === "function") binary = atob(padded);
+	else binary = Buffer.from(padded, "base64").toString("binary");
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
 function generateId(method) {
 	if (method && method.toString() !== "UUIDv4") throw new Error(`Id generation method not supported: "${method.toString()}"`);
 	return globalThis.crypto.randomUUID();
@@ -2963,6 +2997,76 @@ function castDraft(value) {
 }
 //#endregion
 //#region ../shared/dist/document-model/index.js
+/**
+* What separates a signature's params when it travels as one string.
+*
+* GraphQL declares `signatures` as a list of strings, not a list of lists, so a
+* tuple is joined for transport and split on arrival. The separator is here so
+* the two halves cannot disagree about it - they live in different packages, and
+* a mismatch would corrupt every signature that crossed the wire rather than
+* failing outright.
+*/
+const SIGNATURE_PARAM_SEPARATOR = ", ";
+/** The number of params a signature carries. */
+const SIGNATURE_PARAM_COUNT = 5;
+/** Joins a signature's params for transport. Already-joined input passes through. */
+function serializeSignature(signature) {
+	return Array.isArray(signature) ? signature.join(SIGNATURE_PARAM_SEPARATOR) : signature;
+}
+/**
+* Splits a transported signature back into its params. A tuple passes through.
+*
+* Short input is padded rather than refused: verification reads the params by
+* position and fails on a wrong one, which says more than a length complaint
+* raised here would.
+*/
+function deserializeSignature(signature) {
+	if (Array.isArray(signature)) return signature;
+	const parts = signature.split(SIGNATURE_PARAM_SEPARATOR);
+	return Array.from({ length: SIGNATURE_PARAM_COUNT }, (_unused, index) => parts[index] ?? "");
+}
+/**
+* Projects an action onto the fields the GraphQL `ActionInput` declares.
+*
+* A projection rather than a spread, because an input object rejects a field it
+* does not declare, and that refusal takes the whole request with it. An action
+* read back out of storage can carry fields the type no longer has - a legacy
+* `attachments` array, or the operation fields left behind by a signing helper
+* that returns an operation - and any one of them would sink an otherwise valid
+* submission.
+*
+* Only fields the action actually carries are emitted, so an unsigned action
+* sends no context at all rather than a context full of nulls.
+*/
+function toTransportAction(action) {
+	if (action.input === void 0 || action.input === null) throw new Error(`Action ${action.id} (${action.type}) has no input, which the wire requires`);
+	const projected = {
+		id: action.id,
+		type: action.type,
+		timestampUtcMs: action.timestampUtcMs,
+		input: action.input,
+		scope: action.scope
+	};
+	const context = toTransportContext(action.context);
+	return context ? {
+		...projected,
+		context
+	} : projected;
+}
+function toTransportContext(context) {
+	if (!context) return;
+	const projected = {};
+	if (context.prevOpIndex !== void 0) projected.prevOpIndex = context.prevOpIndex;
+	if (context.prevOpHash !== void 0) projected.prevOpHash = context.prevOpHash;
+	if (context.nonce !== void 0) projected.nonce = context.nonce;
+	const signer = context.signer;
+	if (signer) projected.signer = {
+		...signer.user ? { user: signer.user } : {},
+		...signer.app ? { app: signer.app } : {},
+		signatures: (signer.signatures ?? []).map(serializeSignature)
+	};
+	return Object.keys(projected).length > 0 ? projected : void 0;
+}
 var InvalidActionInputError = class extends Error {
 	data;
 	constructor(data) {
@@ -2995,6 +3099,75 @@ var DowngradeNotSupportedError = class extends Error {
 		this.toVersion = toVersion;
 	}
 };
+/**
+* Thrown when INITIALIZE_AUTH is applied to an already-initialized auth scope.
+* The genesis action is valid only at auth revision zero.
+*/
+var AuthAlreadyInitializedError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`Auth scope already initialized for document ${documentId}: INITIALIZE_AUTH is valid only at auth revision zero`);
+		this.name = "AuthAlreadyInitializedError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH is not signed by the document creator (its signer
+* does not match `header.sig.publicKey`), so it cannot set the auth policy.
+*/
+var AuthInitializerNotCreatorError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`INITIALIZE_AUTH for document ${documentId} must be signed by the document creator`);
+		this.name = "AuthInitializerNotCreatorError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH carries a version below 1. Version 0 is reserved
+* for the uninitialized auth scope.
+*/
+var InvalidAuthVersionError = class extends Error {
+	documentId;
+	version;
+	constructor(documentId, version) {
+		super(`Invalid auth policy version ${version} for document ${documentId}: INITIALIZE_AUTH requires an integer version >= 1`);
+		this.name = "InvalidAuthVersionError";
+		this.documentId = documentId;
+		this.version = version;
+	}
+};
+/** Thrown when a duplicate would lose the source policy's version or creator binding. */
+var AuthPolicyNotPreservedError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`Duplicating document ${documentId} would not preserve its auth policy: the copy loses the policy version or its creator binding`);
+		this.name = "AuthPolicyNotPreservedError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when a grant referenced by REMOVE_GRANT or MOVE_GRANT does not exist.
+*/
+var GrantNotFoundError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Grant not found in auth scope: ${grantId}`);
+		this.name = "GrantNotFoundError";
+		this.grantId = grantId;
+	}
+};
+/**
+* Thrown when a disallowed action (UNDO, REDO, PRUNE) targets the auth scope.
+*/
+var AuthActionNotAllowedError = class extends Error {
+	actionType;
+	constructor(actionType) {
+		super(`${actionType} is not permitted on the auth scope`);
+		this.name = "AuthActionNotAllowedError";
+		this.actionType = actionType;
+	}
+};
 var HashMismatchError = class extends Error {
 	_scope;
 	_document;
@@ -3021,6 +3194,25 @@ var HashMismatchError = class extends Error {
 		return this._operation;
 	}
 };
+/**
+* Thrown when replay or import requires a document model version that is not
+* registered. Carries the data the UI needs to explain the mismatch.
+*/
+var UnsupportedDocumentModelVersionError = class extends Error {
+	documentType;
+	requiredVersion;
+	availableVersions;
+	constructor(documentType, requiredVersion, availableVersions) {
+		super(`No reducer registered for document version ${requiredVersion}. Available versions: ${availableVersions.join(", ")}`);
+		this.name = "UnsupportedDocumentModelVersionError";
+		this.documentType = documentType;
+		this.requiredVersion = requiredVersion;
+		this.availableVersions = availableVersions;
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedDocumentModelVersionError";
+	}
+};
 const isDefinedNonNullAny$1 = (v) => v !== void 0 && v !== null;
 any().refine((v) => isDefinedNonNullAny$1(v));
 const Load_StateSchema = _enum(["LOAD_STATE"]);
@@ -3461,6 +3653,88 @@ const ConfigEntrySchema = object({
 	required: boolean().optional(),
 	default: boolean().optional()
 });
+const PwaUrlPatternSchema = union([string(), strictObject({
+	source: string(),
+	flags: string().optional()
+}).refine((p) => {
+	try {
+		new RegExp(p.source, p.flags);
+		return true;
+	} catch {
+		return false;
+	}
+}, { message: "source/flags do not compile to a valid RegExp" })]);
+const PwaRuntimeCachingSchema = strictObject({
+	urlPattern: PwaUrlPatternSchema,
+	handler: _enum([
+		"CacheFirst",
+		"CacheOnly",
+		"NetworkFirst",
+		"NetworkOnly",
+		"StaleWhileRevalidate"
+	]),
+	method: _enum([
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"HEAD",
+		"PATCH"
+	]).optional(),
+	options: strictObject({
+		cacheName: string().optional(),
+		networkTimeoutSeconds: number().optional(),
+		expiration: strictObject({
+			maxEntries: number().optional(),
+			maxAgeSeconds: number().optional()
+		}).optional(),
+		cacheableResponse: strictObject({
+			statuses: array(number()).optional(),
+			headers: record(string(), string()).optional()
+		}).optional()
+	}).optional()
+});
+const PwaIconSchema = strictObject({
+	src: string(),
+	sizes: string().optional(),
+	type: string().optional(),
+	purpose: string().optional()
+});
+const PwaFileHandlerSchema = strictObject({
+	accept: record(string(), array(string().regex(/^\./, "file extensions must start with '.'"))),
+	icons: array(PwaIconSchema).optional(),
+	launch_type: _enum(["single-client", "multiple-clients"]).optional()
+});
+const PwaConfigSchema = strictObject({
+	manifest: strictObject({
+		name: string().optional(),
+		short_name: string().optional(),
+		description: string().optional(),
+		theme_color: string().optional(),
+		background_color: string().optional(),
+		display: _enum([
+			"fullscreen",
+			"standalone",
+			"minimal-ui",
+			"browser"
+		]).optional(),
+		start_url: string().optional(),
+		scope: string().optional(),
+		icons: array(PwaIconSchema).optional(),
+		file_handlers: array(PwaFileHandlerSchema).optional(),
+		launch_handler: strictObject({ client_mode: _enum([
+			"auto",
+			"focus-existing",
+			"navigate-existing",
+			"navigate-new"
+		]) }).optional()
+	}).optional(),
+	globPatterns: array(string()).optional(),
+	globIgnores: array(string()).optional(),
+	maximumFileSizeToCacheInBytes: number().optional(),
+	runtimeCaching: array(PwaRuntimeCachingSchema).optional(),
+	navigateFallbackDenylist: array(PwaUrlPatternSchema).optional()
+});
 object({
 	name: string(),
 	description: string().optional(),
@@ -3472,7 +3746,8 @@ object({
 	editors: PowerhouseModulesSchema,
 	processors: PowerhouseModulesSchema,
 	subgraphs: PowerhouseModulesSchema,
-	config: array(ConfigEntrySchema).optional()
+	config: array(ConfigEntrySchema).optional(),
+	pwa: PwaConfigSchema.optional()
 });
 /**
 * Cancels the last `count` operations.
@@ -3743,6 +4018,505 @@ const actions = {
 	...baseActions,
 	...documentModelActions
 };
+const documentModelDocumentType = "powerhouse/document-model";
+/**
+* Thrown when a grant violates the v1 validation rules. The message is stored
+* on error operations, so it must be a pure function of the input.
+*/
+var InvalidGrantError = class extends Error {
+	grantId;
+	constructor(grantId, problem) {
+		super(`Invalid grant "${grantId}": ${problem}`);
+		this.name = "InvalidGrantError";
+		this.grantId = grantId;
+	}
+};
+/** Thrown for a `{ group }` principal on a group document: references never chain. */
+var GroupPrincipalNotAllowedError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Grant "${grantId}" uses a group principal on a group document: a group's auth scope cannot reference other groups`);
+		this.name = "GroupPrincipalNotAllowedError";
+		this.grantId = grantId;
+	}
+};
+/**
+* Thrown when a change would leave a creator-less policy with no grant
+* permitting execute on the auth scope. Without the creator carve-out no
+* subject could ever administer such a policy again.
+*/
+var AuthAdministrationLockoutError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Change to grant "${grantId}" would leave no reachable grant permitting execute on the auth scope: a policy with no creator must always retain one`);
+		this.name = "AuthAdministrationLockoutError";
+		this.grantId = grantId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH would create a creator-less policy with no grant
+* permitting execute on the auth scope. Such a policy would be born with no
+* subject able to administer it.
+*/
+var AuthAdministrationMissingError = class extends Error {
+	constructor() {
+		super("Initial grants include no reachable grant permitting execute on the auth scope: a policy with no creator must always include one");
+		this.name = "AuthAdministrationMissingError";
+	}
+};
+const GRANT_KEYS = new Set([
+	"id",
+	"description",
+	"effect",
+	"principal",
+	"capability",
+	"where"
+]);
+const PRINCIPAL_KINDS = new Set([
+	"anyone",
+	"address",
+	"group",
+	"match"
+]);
+const COMPARISON_CONDITION_KINDS = new Set([
+	"eq",
+	"ne",
+	"lt",
+	"lte",
+	"gt",
+	"gte"
+]);
+function isPlainValue(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function operandProblem(value, capabilityScope, budget) {
+	budget.nodes -= 1;
+	if (budget.nodes < 0) return `condition exceeds 100 nodes`;
+	if (!isPlainValue(value)) return "operand must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return "operand must have exactly one of attr or lit";
+	if (keys[0] === "attr") {
+		const attr = value.attr;
+		if (typeof attr !== "string" || attr.length === 0) return "attr must be a non-empty string";
+		if (capabilityScope !== void 0 && capabilityScope !== "*" && attr.startsWith("doc.")) {
+			const pathScope = attr.split(".")[1] ?? "";
+			if (pathScope !== capabilityScope) return `condition path "${attr}" reads scope "${pathScope}" but the capability covers only scope "${capabilityScope}"`;
+		}
+		return null;
+	}
+	if (keys[0] === "lit") {
+		const lit = value.lit;
+		if (lit !== null && typeof lit !== "string" && typeof lit !== "number" && typeof lit !== "boolean") return "lit must be a string, number, boolean, or null";
+		if (typeof lit === "number" && !Number.isFinite(lit)) return "lit must be a finite number";
+		if (typeof lit === "number" && Object.is(lit, -0)) return "lit must not be negative zero";
+		return null;
+	}
+	return `unknown operand kind "${keys[0]}"`;
+}
+function conditionProblem(value, capabilityScope, depth, budget) {
+	if (depth > 10) return `condition exceeds depth 10`;
+	budget.nodes -= 1;
+	if (budget.nodes < 0) return `condition exceeds 100 nodes`;
+	if (!isPlainValue(value)) return "condition must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return "condition must have exactly one operator";
+	const kind = keys[0];
+	const body = value[kind];
+	if (COMPARISON_CONDITION_KINDS.has(kind)) {
+		if (!Array.isArray(body) || body.length !== 2) return `${kind} requires a pair of operands`;
+		for (const operand of body) {
+			const problem = operandProblem(operand, capabilityScope, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "in" || kind === "notIn") {
+		if (!Array.isArray(body) || body.length !== 2 || !Array.isArray(body[1])) return `${kind} requires an operand and an operand list`;
+		const first = operandProblem(body[0], capabilityScope, budget);
+		if (first !== null) return first;
+		for (const operand of body[1]) {
+			const problem = operandProblem(operand, capabilityScope, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "exists") return operandProblem(body, capabilityScope, budget);
+	if (kind === "and" || kind === "or") {
+		if (!Array.isArray(body)) return `${kind} requires a condition list`;
+		for (const child of body) {
+			const problem = conditionProblem(child, capabilityScope, depth + 1, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "not") return conditionProblem(body, capabilityScope, depth + 1, budget);
+	return `unknown condition operator "${kind}"`;
+}
+function principalProblem(value, capabilityScope) {
+	if (!isPlainValue(value)) return "principal must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1 || !PRINCIPAL_KINDS.has(keys[0])) return "principal must have exactly one of anyone, address, group, or match";
+	const kind = keys[0];
+	if (kind === "anyone" && value.anyone !== true) return "anyone must be true";
+	if (kind === "address") {
+		const address = value.address;
+		if (typeof address !== "string" || address.length === 0) return "address must be a non-empty string";
+	}
+	if (kind === "group") {
+		const group = value.group;
+		if (typeof group !== "string" || group.length === 0) return "group must be a non-empty string";
+	}
+	if (kind === "match") return conditionProblem(value.match, capabilityScope, 1, { nodes: 100 });
+	return null;
+}
+function capabilityProblem(value) {
+	if (!isPlainValue(value)) return "capability must be an object";
+	const can = value.can;
+	if (can !== "read" && can !== "execute") return "capability.can must be read or execute";
+	const allowedKeys = can === "execute" ? [
+		"can",
+		"scope",
+		"operation"
+	] : ["can", "scope"];
+	const unknownKeys = Object.keys(value).filter((key) => !allowedKeys.includes(key)).sort();
+	if (unknownKeys.length > 0) return `unknown capability key "${unknownKeys[0]}"`;
+	if (value.scope !== void 0) {
+		if (typeof value.scope !== "string" || value.scope.length === 0) return "capability.scope must be a non-empty string";
+	}
+	if (can === "execute" && value.operation !== void 0) {
+		const operation = value.operation;
+		if (!Array.isArray(operation)) return "capability.operation must be an array";
+		if (operation.length > 100) return `capability.operation exceeds 100 entries`;
+		for (const entry of operation) if (typeof entry !== "string" || entry.length === 0) return "capability.operation entries must be non-empty strings";
+	}
+	return null;
+}
+/** Returns the first v1-rule violation, or null. Pure, total, deterministic. */
+function grantProblem(value) {
+	if (!isPlainValue(value)) return "grant must be an object";
+	const unknownKeys = Object.keys(value).filter((key) => !GRANT_KEYS.has(key)).sort();
+	if (unknownKeys.length > 0) return `unknown grant key "${unknownKeys[0]}"`;
+	if (typeof value.id !== "string" || value.id.length === 0) return "id must be a non-empty string";
+	if (typeof value.description !== "string") return "description must be a string";
+	if (value.effect !== "allow" && value.effect !== "deny") return "effect must be allow or deny";
+	const capabilityValue = value.capability;
+	const capability = capabilityProblem(capabilityValue);
+	if (capability !== null) return capability;
+	const capabilityScope = capabilityValue.scope;
+	const principal = principalProblem(value.principal, capabilityScope);
+	if (principal !== null) return principal;
+	if (value.where !== void 0) return conditionProblem(value.where, capabilityScope, 1, { nodes: 100 });
+	return null;
+}
+/** V1 shape rules plus the group-document group-principal ban. */
+function assertValidGrant(grant, documentType) {
+	const grantId = isPlainValue(grant) && typeof grant.id === "string" ? grant.id : "";
+	const problem = grantProblem(grant);
+	if (problem !== null) throw new InvalidGrantError(grantId, problem);
+	if (documentType === "powerhouse/reactor-group" && "group" in grant.principal) throw new GroupPrincipalNotAllowedError(grantId);
+}
+/**
+* Validates an initial grant list: the count cap, every grant, and — on a
+* creator-less policy — that some grant keeps the auth scope administrable.
+*/
+function assertValidInitialGrants(grants, documentType, creator) {
+	if (grants.length > 100) throw new InvalidGrantError("", `policy exceeds 100 grants`);
+	for (const grant of grants) assertValidGrant(grant, documentType);
+	if (creator === void 0 && !administrationReachable(grants)) throw new AuthAdministrationMissingError();
+}
+/**
+* Validates a grant upsert: the grant itself, the count cap on append, and
+* administration retention. Retention is checked on an append as well as an
+* in-place replace, because a grant appended after the administration grant can
+* shadow it (evaluation is last-applicable-grant-wins) and so take
+* administration away without removing anything.
+*/
+function assertValidGrantUpsert(grant, existing, documentType, creator) {
+	assertValidGrant(grant, documentType);
+	const exists = existing.some((g) => g.id === grant.id);
+	if (!exists && existing.length >= 100) throw new InvalidGrantError(grant.id, `policy exceeds 100 grants`);
+	assertAuthAdministrationRetained(creator, existing, exists ? existing.map((g) => g.id === grant.id ? grant : g) : [...existing, grant], grant.id);
+}
+/**
+* The request whose coverage keeps a policy administrable: a subject who may
+* SET_GRANT can upsert any grant, so every other repair stays reachable.
+*/
+const AUTH_ADMINISTRATION_REQUEST = {
+	verb: "execute",
+	scope: "auth",
+	operation: "SET_GRANT"
+};
+/**
+* Whether some subject can still administer the auth scope under this grant list.
+*
+* Asks the evaluator rather than pattern-matching a single grant: evaluation is
+* last-applicable-grant-wins, so an allow that some later deny shadows keeps
+* nothing reachable even though it is still present in the list. Only anyone and
+* address principals are candidates, because those are the ones v1 can match at
+* all; a `where` condition or a group or match principal never applies.
+*/
+function administrationReachable(grants) {
+	return grants.some((grant) => {
+		const subject = administrationCandidate(grant);
+		if (subject === void 0) return false;
+		return evaluateGrantStack(grants, subject, AUTH_ADMINISTRATION_REQUEST).decision === "allow";
+	});
+}
+/**
+* The subject to test this grant with, or undefined when the grant could never
+* carry administration for anyone.
+*/
+function administrationCandidate(grant) {
+	if (grant.effect !== "allow" || grant.where !== void 0 || !capabilityCovers(grant.capability, AUTH_ADMINISTRATION_REQUEST)) return;
+	if ("address" in grant.principal) return {
+		address: grant.principal.address,
+		key: void 0
+	};
+	if ("anyone" in grant.principal) return {
+		address: void 0,
+		key: void 0
+	};
+}
+/**
+* A creator-less policy must always retain a grant permitting execute on the
+* auth scope; on a signed document the creator carve-out keeps administration
+* reachable instead. Rejects a change that takes the last such grant away. A
+* policy already without one is left alone: the change is not what locks it.
+*/
+function assertAuthAdministrationRetained(creator, previous, next, grantId) {
+	if (creator !== void 0) return;
+	if (administrationReachable(previous) && !administrationReachable(next)) throw new AuthAdministrationLockoutError(grantId);
+}
+/**
+* An operand whose shape validation would have rejected. Distinguished from
+* an unresolved path so a structurally malformed operand poisons its whole
+* condition to false rather than reading as "absent", which `not` would
+* otherwise widen to true.
+*/
+const INVALID_OPERAND = Symbol("invalid-operand");
+/**
+* Narrows to the values conditions compare. An object, array, or non-finite
+* number resolves to undefined, and every comparison involving undefined is
+* false.
+*/
+function asConditionValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+}
+/**
+* Resolves one operand. Attr roots: `subject.*`, `doc.<scope>.*` where the
+* scope must be the executing scope (validation already rejects any other,
+* but resolution stays total), and `action.input.*`. Path steps read own
+* properties only, so prototype members can never influence a verdict.
+*/
+function resolveOperand(operand, subject, request, conditions) {
+	if (!isPlainValue(operand)) return INVALID_OPERAND;
+	const keys = Object.keys(operand);
+	if (keys.length !== 1) return INVALID_OPERAND;
+	if (keys[0] === "lit") {
+		const value = asConditionValue(operand.lit);
+		return value === void 0 ? INVALID_OPERAND : value;
+	}
+	if (keys[0] !== "attr") return INVALID_OPERAND;
+	const attr = operand.attr;
+	if (typeof attr !== "string" || attr.length === 0) return INVALID_OPERAND;
+	const path = attr.split(".");
+	let value;
+	let rest;
+	if (path[0] === "subject") {
+		value = subject;
+		rest = path.slice(1);
+	} else if (path[0] === "doc") {
+		if (path[1] !== request.scope) return;
+		value = conditions.scopeState;
+		rest = path.slice(2);
+	} else if (path[0] === "action" && path[1] === "input") {
+		value = conditions.actionInput;
+		rest = path.slice(2);
+	} else return;
+	for (const segment of rest) {
+		if (!isPlainValue(value) || !Object.hasOwn(value, segment)) return;
+		value = value[segment];
+	}
+	return asConditionValue(value);
+}
+/**
+* Total order within one type: numbers numerically, strings by code point.
+* Everything else, including mixed types, does not order.
+*/
+function compareValues(left, right) {
+	if (typeof left === "number" && typeof right === "number") return left < right ? -1 : left > right ? 1 : 0;
+	if (typeof left === "string" && typeof right === "string") {
+		const leftPoints = Array.from(left);
+		const rightPoints = Array.from(right);
+		const shared = Math.min(leftPoints.length, rightPoints.length);
+		for (let i = 0; i < shared; i++) {
+			const a = leftPoints[i].codePointAt(0) ?? 0;
+			const b = rightPoints[i].codePointAt(0) ?? 0;
+			if (a !== b) return a < b ? -1 : 1;
+		}
+		return leftPoints.length === rightPoints.length ? 0 : leftPoints.length < rightPoints.length ? -1 : 1;
+	}
+}
+/**
+* Tri-state evaluation: undefined marks a structurally invalid node, which
+* poisons the whole tree to false at the top — and a structurally malformed
+* operand poisons its condition the same way. Both are distinct from an
+* operand whose path fails to resolve, which is a valid comparison that is
+* false. The distinction keeps `not` from widening over malformed input.
+*/
+function evaluateNode(node, subject, request, conditions) {
+	if (!isPlainValue(node)) return;
+	const keys = Object.keys(node);
+	if (keys.length !== 1) return;
+	const kind = keys[0];
+	const body = node[kind];
+	switch (kind) {
+		case "eq":
+		case "ne":
+		case "lt":
+		case "lte":
+		case "gt":
+		case "gte": {
+			if (!Array.isArray(body) || body.length !== 2) return;
+			const left = resolveOperand(body[0], subject, request, conditions);
+			const right = resolveOperand(body[1], subject, request, conditions);
+			if (left === INVALID_OPERAND || right === INVALID_OPERAND) return;
+			if (left === void 0 || right === void 0) return false;
+			if (kind === "eq") return left === right;
+			if (kind === "ne") return left !== right;
+			const order = compareValues(left, right);
+			if (order === void 0) return false;
+			switch (kind) {
+				case "lt": return order < 0;
+				case "lte": return order <= 0;
+				case "gt": return order > 0;
+				case "gte": return order >= 0;
+			}
+			return;
+		}
+		case "in":
+		case "notIn": {
+			if (!Array.isArray(body) || body.length !== 2 || !Array.isArray(body[1])) return;
+			const left = resolveOperand(body[0], subject, request, conditions);
+			if (left === INVALID_OPERAND) return;
+			const elements = body[1].map((element) => resolveOperand(element, subject, request, conditions));
+			if (elements.some((value) => value === INVALID_OPERAND)) return;
+			if (left === void 0) return false;
+			const found = elements.some((value) => value !== void 0 && value === left);
+			return kind === "in" ? found : !found;
+		}
+		case "exists": {
+			const value = resolveOperand(body, subject, request, conditions);
+			if (value === INVALID_OPERAND) return;
+			return value !== void 0;
+		}
+		case "and":
+		case "or": {
+			if (!Array.isArray(body)) return;
+			let result = kind === "and";
+			for (const child of body) {
+				const value = evaluateNode(child, subject, request, conditions);
+				if (value === void 0) return;
+				if (kind === "and") result = result && value;
+				else result = result || value;
+			}
+			return result;
+		}
+		case "not": {
+			const value = evaluateNode(body, subject, request, conditions);
+			return value === void 0 ? void 0 : !value;
+		}
+		default: return;
+	}
+}
+/**
+* Evaluates a version-1 condition. Deterministic, total, and pure: any input
+* shape yields a boolean and never throws, and a malformed condition is
+* false. These are consensus semantics, versioned by `PHAuthState.version`;
+* changing them requires a new version.
+*/
+function evaluateCondition(condition, subject, request, conditions) {
+	return evaluateNode(condition, subject, request, conditions) === true;
+}
+/** Whether a capability's scope reaches the requested one. */
+function scopeCovers(scope, requested) {
+	return scope === void 0 || scope === "*" || scope === requested;
+}
+/**
+* Whether one grant answers this request.
+*
+* A grant allowing execute on a scope also allows reading it: executing an
+* operation means reading the state it applies to, so permitting the write while
+* withholding the read would describe an access nobody could use. The converse
+* does not hold -- a read grant confers no write.
+*
+* Only an allow carries across. A deny on execute withholds the write and says
+* nothing about the read, so a policy locking writes down does not silently
+* revoke a read grant sitting before it. The operation list is not consulted
+* either: it restricts which operations may be executed, not whether the scope
+* is visible, and a read carries no operation to match against.
+*
+* Reads are not consensus -- no replica records a read, and the two read call
+* sites are both inside the read gate -- so this rule is not part of what makes
+* an operation valid, and does not need a policy version of its own.
+*/
+function grantAnswers(grant, request) {
+	if (capabilityCovers(grant.capability, request)) return true;
+	return request.verb === "read" && grant.effect === "allow" && grant.capability.can === "execute" && scopeCovers(grant.capability.scope, request.scope);
+}
+function capabilityCovers(capability, request) {
+	if (capability.can !== request.verb) return false;
+	if (!scopeCovers(capability.scope, request.scope)) return false;
+	if (capability.can === "execute") {
+		if (capability.operation === void 0) return true;
+		return request.operation !== void 0 && capability.operation.includes(request.operation);
+	}
+	return true;
+}
+function principalMatches(principal, subject, request, groups, conditions) {
+	if ("anyone" in principal) return true;
+	if ("address" in principal) return subject.address !== void 0 && subject.address.toLowerCase() === principal.address.toLowerCase();
+	if ("group" in principal) {
+		if (groups === void 0 || subject.address === void 0) return false;
+		const group = groups[principal.group];
+		if (group === void 0 || !Array.isArray(group.members)) return false;
+		const address = subject.address.toLowerCase();
+		return group.members.some((member) => member.toLowerCase() === address);
+	}
+	if ("match" in principal) {
+		if (conditions === void 0) return false;
+		return evaluateCondition(principal.match, subject, request, conditions);
+	}
+	return false;
+}
+/**
+* Evaluates a v1 grant stack: default deny, last applicable grant wins, and
+* reports which grant decided it. Group principals match only against a
+* supplied groups map, and `where` clauses and { match } principals evaluate
+* only against a supplied condition context; a grant that uses an unsupplied
+* feature never applies.
+*/
+function evaluateGrantStack(grants, subject, request, groups, conditions) {
+	let applicable;
+	for (const grant of grants) {
+		if (grant.where !== void 0) {
+			if (conditions === void 0) continue;
+			if (!evaluateCondition(grant.where, subject, request, conditions)) continue;
+		}
+		if (grantAnswers(grant, request) && principalMatches(grant.principal, subject, request, groups, conditions)) applicable = grant;
+	}
+	if (applicable === void 0) return {
+		decision: "deny",
+		refusal: "no-applicable-grant"
+	};
+	if (applicable.effect === "deny") return {
+		decision: "deny",
+		refusal: "denied-by-grant",
+		grantId: applicable.id
+	};
+	return { decision: "allow" };
+}
 const documentModelFileExtension = "phdm";
 const documentModelInitialLocalState = {};
 const documentModelInitialGlobalState = {
@@ -4324,7 +5098,306 @@ const documentModelGlobalState = {
 };
 const HASH_ALGORITHM_SHA1 = "sha1";
 const HASH_ENCODING_BASE64 = "base64";
-const documentModelDocumentType = "powerhouse/document-model";
+/**
+* Creates a default PHAuthState
+*/
+function defaultAuthState() {
+	return {
+		version: 0,
+		grants: []
+	};
+}
+/**
+* Creates a default PHDocumentState
+*/
+function defaultDocumentState() {
+	return {
+		version: 0,
+		hash: {
+			algorithm: HASH_ALGORITHM_SHA1,
+			encoding: HASH_ENCODING_BASE64
+		}
+	};
+}
+/**
+* Creates a default PHBaseState with auth and document properties
+*/
+function defaultBaseState() {
+	return {
+		auth: defaultAuthState(),
+		document: defaultDocumentState()
+	};
+}
+/**
+* Creates a PHAuthState with the given properties
+*/
+function createAuthState(auth) {
+	return {
+		...defaultAuthState(),
+		...auth
+	};
+}
+/**
+* Creates a PHDocumentState with the given properties
+*/
+function createDocumentState(document) {
+	return {
+		...defaultDocumentState(),
+		...document
+	};
+}
+/**
+* Creates a PHBaseState with the given auth and document properties
+*/
+function createBaseState(auth, document) {
+	return {
+		auth: createAuthState(auth),
+		document: createDocumentState(document)
+	};
+}
+/**
+* Backfills the auth scope to the default for legacy documents serialized with
+* an empty `auth`. Replaces only `state.auth`. Idempotent.
+*/
+function backfillAuthState(state) {
+	return {
+		...state,
+		auth: createAuthState(state.auth)
+	};
+}
+function defaultGlobalState() {
+	return {
+		...defaultBaseState(),
+		author: {
+			name: "",
+			website: ""
+		},
+		description: "",
+		extension: "",
+		id: "",
+		name: "",
+		specifications: []
+	};
+}
+function defaultLocalState() {
+	return {};
+}
+function createGlobalState(state) {
+	return {
+		...defaultGlobalState(),
+		...state || {}
+	};
+}
+function createLocalState(state) {
+	return {
+		...defaultLocalState(),
+		...state || {}
+	};
+}
+function createState(baseState, globalState, localState) {
+	return {
+		...createBaseState(baseState?.auth, baseState?.document),
+		global: createGlobalState(globalState),
+		local: createLocalState(localState)
+	};
+}
+/**
+* Destructuring a null input (reachable via raw synced operations) would
+* store an engine-specific TypeError message on the error operation.
+*/
+function assertActionInputShape(input) {
+	if (!isPlainValue(input)) throw new InvalidActionInputError({ input: "must be an object" });
+}
+function withGrants(document, grants) {
+	return {
+		...document,
+		state: {
+			...document.state,
+			auth: {
+				...document.state.auth,
+				grants
+			}
+		}
+	};
+}
+const P256_PUBKEY_MULTICODEC = [128, 36];
+const DID_KEY_PREFIX = "did:key:z";
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+/**
+* True when `signerKey` (an ActionSigner app key, a did:key) identifies the same
+* key recorded as the document creator. Returns false
+* when there is no creator (empty JWK) or no signer key.
+*/
+function isDocumentCreator(creatorKey, signerKey) {
+	if (!creatorKey?.x || !creatorKey.y) return false;
+	if (!signerKey || !signerKey.startsWith(DID_KEY_PREFIX)) return false;
+	const decoded = base58Decode(signerKey.slice(9));
+	if (!decoded || decoded.length !== 35) return false;
+	if (decoded[0] !== P256_PUBKEY_MULTICODEC[0] || decoded[1] !== P256_PUBKEY_MULTICODEC[1]) return false;
+	const parityPrefix = decoded[2];
+	if (parityPrefix !== 2 && parityPrefix !== 3) return false;
+	const didX = decoded.subarray(3, 35);
+	const jwkX = base64UrlToBytes(creatorKey.x);
+	const jwkY = base64UrlToBytes(creatorKey.y);
+	if (jwkX.length !== 32 || jwkY.length !== 32) return false;
+	if (!bytesEqual(didX, jwkX)) return false;
+	return (jwkY[31] & 1) === 1 === (parityPrefix === 3);
+}
+/**
+* Sets the initial policy. Valid only while the auth scope is uninitialized
+* (version 0). The input version is the policy language version and must be an
+* integer >= 1; 0 is reserved for the uninitialized state. On a signed-header
+* document it must be signed by the document creator (`header.sig.publicKey`).
+* A creator-less policy must include a grant permitting execute on the auth
+* scope, or it would be born locked out.
+*/
+function applyInitializeAuthAction(document, action) {
+	assertActionInputShape(action.input);
+	const { version, grants } = action.input;
+	if (!Number.isInteger(version) || version < 1) throw new InvalidAuthVersionError(document.header.id, version);
+	if (document.state.auth.version !== 0) throw new AuthAlreadyInitializedError(document.header.id);
+	if (!Array.isArray(grants)) throw new InvalidActionInputError({ grants: "must be an array" });
+	const creatorKey = document.header.sig.publicKey;
+	const signerKey = action.context?.signer?.app.key;
+	const hasCreator = Boolean(creatorKey.kty || creatorKey.x || creatorKey.y);
+	if (hasCreator && !isDocumentCreator(creatorKey, signerKey)) throw new AuthInitializerNotCreatorError(document.header.id);
+	const creator = hasCreator ? signerKey : void 0;
+	assertValidInitialGrants(grants, document.header.documentType, creator);
+	return {
+		...document,
+		state: {
+			...document.state,
+			auth: createAuthState(creator ? {
+				version,
+				grants,
+				creator
+			} : {
+				version,
+				grants
+			})
+		}
+	};
+}
+/** Upserts a grant by id: replaces in place if present, otherwise appends. */
+function applySetGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { grant } = action.input;
+	const grants = document.state.auth.grants;
+	assertValidGrantUpsert(grant, grants, document.header.documentType, document.state.auth.creator);
+	return withGrants(document, grants.some((g) => g.id === grant.id) ? grants.map((g) => g.id === grant.id ? grant : g) : [...grants, grant]);
+}
+/**
+* Removes a grant by id; throws if the id is not present or if the removal
+* would leave a creator-less policy with no auth-administration grant.
+*/
+function applyRemoveGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { id } = action.input;
+	const { grants, creator } = document.state.auth;
+	if (!grants.some((g) => g.id === id)) throw new GrantNotFoundError(id);
+	const next = grants.filter((g) => g.id !== id);
+	assertAuthAdministrationRetained(creator, grants, next, id);
+	return withGrants(document, next);
+}
+/**
+* Moves a grant by id to a new index. Order is load-bearing (the last
+* applicable grant wins), so the relative order of the other grants is kept.
+* The target index is clamped to the valid range; an unknown id throws.
+*
+* Order alone decides which grant wins, so a move can take administration away
+* without changing the list's contents. It carries the same retention rule as
+* the two mutation paths.
+*/
+function applyMoveGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { id, index } = action.input;
+	const { grants, creator } = document.state.auth;
+	const from = grants.findIndex((g) => g.id === id);
+	if (from === -1) throw new GrantNotFoundError(id);
+	const next = [...grants];
+	const [moved] = next.splice(from, 1);
+	const to = Math.max(0, Math.min(index, next.length));
+	next.splice(to, 0, moved);
+	assertAuthAdministrationRetained(creator, grants, next, id);
+	return withGrants(document, next);
+}
+/**
+* Dispatches an auth-scope action to its handler. This is the auth scope's
+* dedicated reducer: it is applied by the base reducer instead of the model
+* reducer, mirroring the document-scope platform handlers. Unknown types are a
+* no-op, matching the model-reducer default.
+*/
+function applyAuthAction(document, action) {
+	switch (action.type) {
+		case "INITIALIZE_AUTH": return applyInitializeAuthAction(document, action);
+		case "SET_GRANT": return applySetGrantAction(document, action);
+		case "REMOVE_GRANT": return applyRemoveGrantAction(document, action);
+		case "MOVE_GRANT": return applyMoveGrantAction(document, action);
+		default: return document;
+	}
+}
+/**
+* Because only creators can initialize auth scopes, we must verify that either
+* the document has no auth or the version and creator match.
+*/
+function assertAuthPreservedOnDuplicate(documentId, source, duplicated) {
+	if (!source || source.version === 0) return;
+	if (duplicated === void 0 || duplicated.version !== source.version || duplicated.creator !== source.creator) throw new AuthPolicyNotPreservedError(documentId);
+}
+/**
+* The auth scope a state snapshot may install, given the policy already there.
+*
+* `applyAuthAction` is the validated door onto `state.auth`, but a whole-state
+* snapshot (UPGRADE_DOCUMENT's `initialState`, LOAD_STATE's `data`) replaces the
+* scope wholesale and is authorized as a `document`-scope write. Without this,
+* a subject holding `execute` on `document` and no auth grant at all can install
+* a policy of its choosing, name itself `creator` (which exempts the policy from
+* the retention rule for good), or wipe an existing policy by carrying the
+* default uninitialized one.
+*
+* Three cases:
+*
+*   - the snapshot carries no policy, or an uninitialized one: the document
+*     keeps the policy it has, so a default-state upgrade cannot reset it;
+*   - the document is uninitialized and the snapshot carries a policy: the
+*     policy is installed after the same validation genesis applies, so it
+*     cannot be born locked out;
+*   - both carry a policy: they must agree. A duplicate preserves its source's
+*     policy (see {@link assertAuthPreservedOnDuplicate}), and anything else is
+*     an attempt to replace one policy with another.
+*/
+function resolveSnapshotAuth(documentId, documentType, current, incoming) {
+	const currentAuth = current ?? createAuthState({
+		version: 0,
+		grants: []
+	});
+	if (!incoming || !incoming.version) return currentAuth;
+	if (currentAuth.version !== 0) {
+		if (stringify$1(incoming) !== stringify$1(currentAuth)) throw new AuthPolicyNotPreservedError(documentId);
+		return incoming;
+	}
+	if (!Array.isArray(incoming.grants)) throw new InvalidActionInputError({ grants: "must be an array" });
+	assertValidInitialGrants(incoming.grants, documentType, incoming.creator);
+	return incoming;
+}
+/** UNDO, REDO and PRUNE are rejected on the auth scope. */
+function assertAuthScopeActionAllowed(action) {
+	if (action.scope === "auth" && [
+		"UNDO",
+		"REDO",
+		"PRUNE"
+	].includes(action.type)) throw new AuthActionNotAllowedError(action.type);
+}
+/**
+* True iff authorization rejected the action.
+*/
+function isDenied(operation) {
+	return operation.deniedReason !== void 0;
+}
 const BaseDocumentHeaderSchema = object({
 	id: string(),
 	name: string(),
@@ -4455,6 +5528,7 @@ function createDocumentScopeOperations(header, state) {
 function baseCreateDocument(createState, initialState, documentType = "") {
 	const state = createState(initialState);
 	const header = createPresignedHeader(generateId(), documentType);
+	header.protocolVersions = { "base-reducer": 2 };
 	return {
 		header,
 		state,
@@ -4478,6 +5552,18 @@ function hashDocumentStateForScope(document, scope = "global") {
 * Uses the V2 model where consecutive NOOPs form chains.
 * Unlike V1 garbageCollect, this preserves ALL operations but marks which to apply.
 */
+/**
+* The base-reducer protocol version a document is written against. Every
+* document carries one, set from the CREATE_DOCUMENT input. A header without
+* one was built outside that path, and choosing a version on its behalf would
+* replay the document through a reducer it was not written for, so it is an
+* error rather than a default.
+*/
+function baseReducerVersion(header) {
+	const version = header.protocolVersions?.["base-reducer"];
+	if (typeof version !== "number") throw new Error(`Document ${header.id} carries no base-reducer protocol version`);
+	return version;
+}
 function garbageCollectV2(sortedOperations) {
 	const result = [];
 	let noopChainLength = 0;
@@ -4494,9 +5580,26 @@ function garbageCollectV2(sortedOperations) {
 const defaultCreateState = (state) => {
 	return state;
 };
+/**
+* Records an operation in the history without applying it, which is what a
+* denied operation needs: it occupies its index and contributes no state.
+*
+* The scope defaults to the action's own, and is passed explicitly by a rebuild
+* that is walking one stream and does not want to trust the action's copy.
+*/
+function appendWithoutApplying(document, operation, scope = operation.action.scope) {
+	return {
+		...document,
+		operations: {
+			...document.operations,
+			[scope]: [...document.operations[scope] ?? [], operation]
+		}
+	};
+}
 function replayDocument(initialState, operations, reducer, header, dispatch, skipHeaderOperations = {}, options) {
 	const { checkHashes = true, reuseOperationResultingState, operationResultingStateParser = parseResultingState, skipIndexValidation } = options || {};
-	let documentState = initialState;
+	const backfilledInitialState = backfillAuthState(initialState);
+	let documentState = backfilledInitialState;
 	const operationsToReplay = [];
 	const allScopes = new Set([
 		...Object.keys(operations),
@@ -4531,12 +5634,13 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 	const document = {
 		header,
 		state: defaultCreateState(documentState),
-		initialState,
+		initialState: backfilledInitialState,
 		operations: initialOperations,
 		clipboard: []
 	};
 	let result = document;
 	if (operationsToReplay.length) result = operationsToReplay.reduce((document, operation) => {
+		if (isDenied(operation)) return updateHeaderRevision(appendWithoutApplying(document, operation), operation.action.scope, operation.timestampUtcMs);
 		return reducer(document, operation.action, dispatch, {
 			ignoreSkipOperations: true,
 			checkHashes,
@@ -4818,13 +5922,15 @@ function redoOperation(document, action, skip) {
 	});
 }
 function loadStateOperation(document, action) {
+	const loaded = backfillAuthState(action.state.data);
+	loaded.auth = resolveSnapshotAuth(document.header.id, document.header.documentType, backfillAuthState({ ...document.state }).auth, loaded.auth);
 	return {
 		...document,
 		header: {
 			...document.header,
 			name: action.state.name
 		},
-		state: action.state.data
+		state: loaded
 	};
 }
 function replayOperations(initialState, clearedOperations, stateReducer, header, dispatch, documentReducer = baseReducer, skipHeaderOperations = {}, options) {
@@ -4998,12 +6104,13 @@ function processUndoOperation(document, scope, customReducer, reuseOperationResu
 function baseReducer(document, action, customReducer, dispatch, options = {}) {
 	const { skip, ignoreSkipOperations = false, reuseOperationResultingState = false, operationResultingStateParser, pruneOnSkip = true, branch = "main" } = options;
 	let _action = actionFromAction(action);
+	assertAuthScopeActionAllowed(_action);
 	let skipValue = skip ?? options.replayOptions?.operation.skip ?? 0;
 	let newDocument = { ...document };
 	let reuseLastOperationIndex = false;
 	const shouldProcessSkipOperation = !ignoreSkipOperations && skipValue > 0;
 	if (isUndoRedo(_action)) {
-		const { skip: calculatedSkip, action: transformedAction, document: processedDocument, reuseLastOperationIndex: reuseIndex } = processUndoRedo(document, _action, skipValue, options.protocolVersion ?? 1);
+		const { skip: calculatedSkip, action: transformedAction, document: processedDocument, reuseLastOperationIndex: reuseIndex } = processUndoRedo(document, _action, skipValue, options.protocolVersion ?? baseReducerVersion(document.header));
 		_action = transformedAction;
 		skipValue = calculatedSkip;
 		newDocument = processedDocument;
@@ -5019,7 +6126,7 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 		branch
 	};
 	newDocument = updateDocument(newDocument, _action, reuseLastOperationIndex, skipValue, operationContext, options.replayOptions?.operation, options.skipIndexValidation);
-	const protocolVersion = options.protocolVersion ?? 1;
+	const protocolVersion = options.protocolVersion ?? baseReducerVersion(document.header);
 	if (isUndo(action) && protocolVersion < 2) return processUndoOperation(newDocument, action.scope, customReducer);
 	const isNoopWithSkip = _action.type === "NOOP" && skipValue > 0;
 	if ((isUndo(action) || isNoopWithSkip) && protocolVersion >= 2) {
@@ -5045,6 +6152,13 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 	}
 	newDocument = create(newDocument, (draft) => {
 		try {
+			if (_action.scope === "auth") {
+				const authState = applyAuthAction(newDocument, _action).state;
+				unsafe(() => {
+					draft.state = castDraft(authState);
+				});
+				return;
+			}
 			const newState = customReducer(draft.state, _action, dispatch);
 			if (newState) unsafe(() => {
 				draft.state = castDraft(newState);
@@ -5834,14 +6948,27 @@ const documentModelStateReducer = (state, action) => {
 	}
 };
 const documentModelReducer = createReducer(documentModelStateReducer);
+/**
+* Canonical document-model version normalization: documents stamped with 0
+* or nothing at all predate versioning and are treated as version 1, the
+* same version the registry assigns unversioned modules. Every consumer
+* that resolves a module or compares versions must use this rule; resolving
+* 0 to "latest" instead re-pins a legacy document's history to whichever
+* module happens to be newest.
+*/
+function normalizeDocumentModelVersion(version) {
+	return version && version > 0 ? version : 1;
+}
 function applyInitialState(document, action) {
 	const input = action.input;
 	const newState = input.initialState || input.state;
 	if (newState) {
-		document.state = {
+		const merged = backfillAuthState({
 			...document.state,
 			...newState
-		};
+		});
+		merged.auth = resolveSnapshotAuth(document.header.id, document.header.documentType, backfillAuthState({ ...document.state }).auth, merged.auth);
+		document.state = merged;
 		document.initialState = document.state;
 	}
 }
@@ -5901,7 +7028,6 @@ function computeUpgradeTransitions(manifest, fromVersion, toVersion) {
 	}
 	return transitions;
 }
-const NON_DOMAIN_SCOPES$1 = new Set(["auth", "document"]);
 function highestReducerVersion(reducers) {
 	const keys = Object.keys(reducers).map(Number);
 	if (keys.length === 0) throw new Error("VersionedReplayConfig.reducers must not be empty");
@@ -5929,15 +7055,15 @@ function highestReducerVersion(reducers) {
 */
 function replayDocumentVersioned(initialState, operations, config, header, dispatch, options) {
 	const { checkHashes = true, skipIndexValidation } = options || {};
-	const protocolVersion = header.protocolVersions?.["base-reducer"] ?? 1;
+	const protocolVersion = baseReducerVersion(header);
 	const spine = (operations["document"] ?? []).slice().sort((a, b) => a.index - b.index);
 	const upgrades = spine.filter((op) => op.action.type === "UPGRADE_DOCUMENT");
 	const legacyFallback = () => {
-		const domainOps = Object.fromEntries(Object.entries(operations).filter(([s]) => !NON_DOMAIN_SCOPES$1.has(s)));
+		const replayOps = Object.fromEntries(Object.entries(operations).filter(([s]) => s !== "document"));
 		const latestVersion = highestReducerVersion(config.reducers);
 		const reducer = config.reducers[latestVersion];
 		return {
-			...replayDocument(initialState, domainOps, reducer, header, dispatch, {}, options),
+			...replayDocument(initialState, replayOps, reducer, header, dispatch, {}, options),
 			operations
 		};
 	};
@@ -5961,14 +7087,14 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		const a = op.action;
 		return a.input.fromVersion > 0 && a.input.fromVersion < a.input.toVersion;
 	});
-	const domainScopes = Object.keys(operations).filter((s) => !NON_DOMAIN_SCOPES$1.has(s));
+	const replayScopes = Object.keys(operations).filter((s) => s !== "document");
 	const scopeOps = {};
-	for (const s of domainScopes) scopeOps[s] = (operations[s] ?? []).slice().sort((a, b) => a.index - b.index);
+	for (const s of replayScopes) scopeOps[s] = (operations[s] ?? []).slice().sort((a, b) => a.index - b.index);
 	const boundaries = validatedUpgrades.map((upgradeOp) => {
 		const revisionSnapshot = upgradeOp.action.input.revision;
 		const upgradeTimestamp = upgradeOp.timestampUtcMs;
 		const boundary = {};
-		for (const s of domainScopes) {
+		for (const s of replayScopes) {
 			const ops = scopeOps[s] ?? [];
 			if (revisionSnapshot !== void 0) {
 				const rev = revisionSnapshot[s] ?? 0;
@@ -5986,7 +7112,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		}
 		return boundary;
 	});
-	for (let i = 1; i < boundaries.length; i++) for (const s of domainScopes) {
+	for (let i = 1; i < boundaries.length; i++) for (const s of replayScopes) {
 		const prev = boundaries[i - 1]?.[s] ?? 0;
 		const curr = boundaries[i]?.[s] ?? 0;
 		if (boundaries[i]) boundaries[i][s] = Math.max(prev, curr);
@@ -5998,10 +7124,11 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 	]);
 	const initialOperations = {};
 	for (const s of allScopes) initialOperations[s] = [];
+	const backfilledSeed = backfillAuthState(seedState);
 	let document = {
 		header,
-		state: seedState,
-		initialState: seedState,
+		state: backfilledSeed,
+		initialState: backfilledSeed,
 		operations: initialOperations,
 		clipboard: []
 	};
@@ -6009,17 +7136,15 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 	const segmentEndHashPerScope = /* @__PURE__ */ new Map();
 	for (let k = 0; k <= validatedUpgrades.length; k++) {
 		const reducer = config.reducers[currentVersion];
-		if (!reducer) {
-			const available = Object.keys(config.reducers).join(", ");
-			throw new Error(`No reducer registered for document version ${currentVersion}. Available versions: ${available}`);
-		}
-		for (const s of domainScopes) {
+		if (!reducer) throw new UnsupportedDocumentModelVersionError(header.documentType, currentVersion, Object.keys(config.reducers).map(Number).sort((a, b) => a - b));
+		for (const s of replayScopes) {
 			const ops = scopeOps[s] ?? [];
 			const segStart = k === 0 ? 0 : boundaries[k - 1]?.[s] ?? 0;
 			const segEnd = k < validatedUpgrades.length ? boundaries[k]?.[s] ?? ops.length : ops.length;
 			const segOps = ops.slice(segStart, segEnd);
 			for (const op of segOps) {
-				document = reducer(document, op.action, dispatch, {
+				if (isDenied(op)) document = updateHeaderRevision(appendWithoutApplying(document, op, s), s, op.timestampUtcMs);
+				else document = reducer(document, op.action, dispatch, {
 					ignoreSkipOperations: true,
 					checkHashes,
 					skipIndexValidation,
@@ -6036,6 +7161,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			if (!spineOp) continue;
 			const spineActionType = spineOp.action.type;
 			if (spineActionType === "CREATE_DOCUMENT" || spineActionType === "UPGRADE_DOCUMENT") continue;
+			if (isDenied(spineOp)) continue;
 			if (spineActionType === "DELETE_DOCUMENT") document = applyDeleteDocumentAction(document, spineOp.action);
 			else document = reducer(document, spineOp.action, dispatch, {
 				ignoreSkipOperations: true,
@@ -6066,7 +7192,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		}
 	};
 	if (!checkHashes) {
-		const allReplayedOps = domainScopes.flatMap((s) => scopeOps[s] ?? []);
+		const allReplayedOps = replayScopes.flatMap((s) => scopeOps[s] ?? []);
 		for (const scope of Object.keys(document.state)) {
 			const capturedHash = segmentEndHashPerScope.get(scope);
 			const scopeHash = capturedHash !== void 0 ? capturedHash : hashDocumentStateForScope(document, scope);
@@ -6108,7 +7234,6 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		}
 	};
 }
-const NON_DOMAIN_SCOPES = new Set(["auth", "document"]);
 function zipAsync(data) {
 	return new Promise((resolve, reject) => {
 		zip(data, (err, out) => err ? reject(err) : resolve(out));
@@ -6187,7 +7312,7 @@ async function parseZipData(data) {
 async function loadFromZipData(data, reducer, options) {
 	const { initialState, header, clearedOperations } = await parseZipData(data);
 	return {
-		...replayDocument(initialState, Object.fromEntries(Object.entries(clearedOperations).filter(([scope]) => !NON_DOMAIN_SCOPES.has(scope))), reducer, header, void 0, {}, options),
+		...replayDocument(initialState, Object.fromEntries(Object.entries(clearedOperations).filter(([scope]) => scope !== "document")), reducer, header, void 0, {}, options),
 		operations: clearedOperations
 	};
 }
@@ -6210,96 +7335,6 @@ const documentModelLoadFromInput = (input) => {
 const documentModelSaveToFileHandle = (document, input) => {
 	return baseSaveToFileHandle(document, input);
 };
-/**
-* Creates a default PHAuthState
-*/
-function defaultAuthState() {
-	return {};
-}
-/**
-* Creates a default PHDocumentState
-*/
-function defaultDocumentState() {
-	return {
-		version: 0,
-		hash: {
-			algorithm: HASH_ALGORITHM_SHA1,
-			encoding: HASH_ENCODING_BASE64
-		}
-	};
-}
-/**
-* Creates a default PHBaseState with auth and document properties
-*/
-function defaultBaseState() {
-	return {
-		auth: defaultAuthState(),
-		document: defaultDocumentState()
-	};
-}
-/**
-* Creates a PHAuthState with the given properties
-*/
-function createAuthState(auth) {
-	return {
-		...defaultAuthState(),
-		...auth
-	};
-}
-/**
-* Creates a PHDocumentState with the given properties
-*/
-function createDocumentState(document) {
-	return {
-		...defaultDocumentState(),
-		...document
-	};
-}
-/**
-* Creates a PHBaseState with the given auth and document properties
-*/
-function createBaseState(auth, document) {
-	return {
-		auth: createAuthState(auth),
-		document: createDocumentState(document)
-	};
-}
-function defaultGlobalState() {
-	return {
-		...defaultBaseState(),
-		author: {
-			name: "",
-			website: ""
-		},
-		description: "",
-		extension: "",
-		id: "",
-		name: "",
-		specifications: []
-	};
-}
-function defaultLocalState() {
-	return {};
-}
-function createGlobalState(state) {
-	return {
-		...defaultGlobalState(),
-		...state || {}
-	};
-}
-function createLocalState(state) {
-	return {
-		...defaultLocalState(),
-		...state || {}
-	};
-}
-function createState(baseState, globalState, localState) {
-	return {
-		...createBaseState(baseState?.auth, baseState?.document),
-		global: createGlobalState(globalState),
-		local: createLocalState(localState)
-	};
-}
 //#endregion
 //#region ../document-model/dist/index.js
 const isStateOfType$1 = (state) => {
@@ -7378,6 +8413,6 @@ const driveDocumentModelModule = {
 	}
 };
 //#endregion
-export { redo as A, setName as B, createZip as C, deleteOperationError as D, deleteOperation as E, setModelDescription as F, setStateSchema as G, setOperationErrorName as H, setModelExtension as I, validateModules as J, undo as K, setModelId as L, setAuthorName as M, setAuthorWebsite as N, documentModelDocumentType as O, setInitialState as P, setModelName as R, createState as S, deleteModule as T, setOperationName as U, setOperationDescription as V, setOperationSchema as W, generateId as X, validateStateSchemaName as Y, baseLoadFromInputVersioned as _, handleTargetNameCollisions as a, createPresignedHeader as b, moveNode as c, logger as d, addModule as f, baseLoadFromInput as g, baseCreateDocument as h, generateNodesCopy as i, replayDocumentVersioned as j, isDocumentAction as k, updateNode as l, addOperationError as m, copyNode as n, isFileNode as o, addOperation as p, validateInitialState as q, driveDocumentModelModule as r, isFolderNode as s, addFolder as t, documentModelDocumentModelModule as u, baseSaveToFileHandle as v, defaultBaseState as w, createReducer as x, buildSignedAction as y, setModuleName as z };
+export { setOperationErrorName as $, createZip as A, redo as B, baseSaveToFileHandle as C, createPresignedHeader as D, createBaseState as E, deserializeSignature as F, setInitialState as G, replayDocumentVersioned as H, documentModelDocumentType as I, setModelId as J, setModelDescription as K, hashDocumentStateForScope as L, deleteModule as M, deleteOperation as N, createReducer as O, deleteOperationError as P, setOperationDescription as Q, isDocumentAction as R, baseLoadFromInputVersioned as S, createAction as T, setAuthorName as U, releaseNewVersion as V, setAuthorWebsite as W, setModuleName as X, setModelName as Y, setName as Z, addOperationError as _, handleTargetNameCollisions as a, validateInitialState as at, baseCreateDocument as b, isValidName as c, generateId as ct, documentModelDocumentModelModule as d, setOperationName as et, logger as f, addOperation as g, addModule as h, generateNodesCopy as i, undo as it, defaultBaseState as j, createState as k, moveNode as l, BaseDocumentStateSchema as m, copyNode as n, setStateSchema as nt, isFileNode as o, validateModules as ot, BaseDocumentHeaderSchema as p, setModelExtension as q, driveDocumentModelModule as r, toTransportAction as rt, isFolderNode as s, validateStateSchemaName as st, addFolder as t, setOperationSchema as tt, updateNode as u, assertAuthPreservedOnDuplicate as v, buildSignedAction as w, baseLoadFromInput as x, baseActions as y, normalizeDocumentModelVersion as z };
 
-//# sourceMappingURL=document-drive-C8hbqQ3C.mjs.map
+//# sourceMappingURL=document-drive-ChLoGFvU.mjs.map