@powerhousedao/shared 6.2.2-dev.37 → 6.2.2-dev.38

package/dist/document-model/index.js

@@ -1037,6 +1037,30 @@ var GroupPrincipalNotAllowedError = class extends Error {
 		this.grantId = grantId;
 	}
 };
+/**
+* Thrown when a change would leave a creator-less policy with no grant
+* permitting execute on the auth scope. Without the creator carve-out no
+* subject could ever administer such a policy again.
+*/
+var AuthAdministrationLockoutError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Change to grant "${grantId}" would leave no reachable grant permitting execute on the auth scope: a policy with no creator must always retain one`);
+		this.name = "AuthAdministrationLockoutError";
+		this.grantId = grantId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH would create a creator-less policy with no grant
+* permitting execute on the auth scope. Such a policy would be born with no
+* subject able to administer it.
+*/
+var AuthAdministrationMissingError = class extends Error {
+	constructor() {
+		super("Initial grants include no reachable grant permitting execute on the auth scope: a policy with no creator must always include one");
+		this.name = "AuthAdministrationMissingError";
+	}
+};
 const GRANT_KEYS = new Set([
 	"id",
 	"description",
@@ -1189,15 +1213,77 @@ function assertValidGrant(grant, documentType) {
 	if (problem !== null) throw new InvalidGrantError(grantId, problem);
 	if (documentType === "@powerhousedao/document-group" && "group" in grant.principal) throw new GroupPrincipalNotAllowedError(grantId);
 }
-/** Validates an initial grant list: the count cap plus every grant. */
-function assertValidInitialGrants(grants, documentType) {
+/**
+* Validates an initial grant list: the count cap, every grant, and — on a
+* creator-less policy — that some grant keeps the auth scope administrable.
+*/
+function assertValidInitialGrants(grants, documentType, creator) {
 	if (grants.length > 100) throw new InvalidGrantError("", `policy exceeds 100 grants`);
 	for (const grant of grants) assertValidGrant(grant, documentType);
+	if (creator === void 0 && !administrationReachable(grants)) throw new AuthAdministrationMissingError();
 }
-/** Validates a grant upsert: the grant itself plus the count cap on append. */
-function assertValidGrantUpsert(grant, existing, documentType) {
+/**
+* Validates a grant upsert: the grant itself, the count cap on append, and
+* administration retention. Retention is checked on an append as well as an
+* in-place replace, because a grant appended after the administration grant can
+* shadow it (evaluation is last-applicable-grant-wins) and so take
+* administration away without removing anything.
+*/
+function assertValidGrantUpsert(grant, existing, documentType, creator) {
 	assertValidGrant(grant, documentType);
-	if (!existing.some((g) => g.id === grant.id) && existing.length >= 100) throw new InvalidGrantError(grant.id, `policy exceeds 100 grants`);
+	const exists = existing.some((g) => g.id === grant.id);
+	if (!exists && existing.length >= 100) throw new InvalidGrantError(grant.id, `policy exceeds 100 grants`);
+	assertAuthAdministrationRetained(creator, existing, exists ? existing.map((g) => g.id === grant.id ? grant : g) : [...existing, grant], grant.id);
+}
+/**
+* The request whose coverage keeps a policy administrable: a subject who may
+* SET_GRANT can upsert any grant, so every other repair stays reachable.
+*/
+const AUTH_ADMINISTRATION_REQUEST = {
+	verb: "execute",
+	scope: "auth",
+	operation: "SET_GRANT"
+};
+/**
+* Whether some subject can still administer the auth scope under this grant list.
+*
+* Asks the evaluator rather than pattern-matching a single grant: evaluation is
+* last-applicable-grant-wins, so an allow that some later deny shadows keeps
+* nothing reachable even though it is still present in the list. Only anyone and
+* address principals are candidates, because those are the ones v1 can match at
+* all; a `where` condition or a group or match principal never applies.
+*/
+function administrationReachable(grants) {
+	return grants.some((grant) => {
+		const subject = administrationCandidate(grant);
+		if (subject === void 0) return false;
+		return evaluateGrantStack(grants, subject, AUTH_ADMINISTRATION_REQUEST).decision === "allow";
+	});
+}
+/**
+* The subject to test this grant with, or undefined when the grant could never
+* carry administration for anyone.
+*/
+function administrationCandidate(grant) {
+	if (grant.effect !== "allow" || grant.where !== void 0 || !capabilityCovers(grant.capability, AUTH_ADMINISTRATION_REQUEST)) return;
+	if ("address" in grant.principal) return {
+		address: grant.principal.address,
+		key: void 0
+	};
+	if ("anyone" in grant.principal) return {
+		address: void 0,
+		key: void 0
+	};
+}
+/**
+* A creator-less policy must always retain a grant permitting execute on the
+* auth scope; on a signed document the creator carve-out keeps administration
+* reachable instead. Rejects a change that takes the last such grant away. A
+* policy already without one is left alone: the change is not what locks it.
+*/
+function assertAuthAdministrationRetained(creator, previous, next, grantId) {
+	if (creator !== void 0) return;
+	if (administrationReachable(previous) && !administrationReachable(next)) throw new AuthAdministrationLockoutError(grantId);
 }
 function capabilityCovers(capability, request) {
 	if (capability.can !== request.verb) return false;
@@ -1215,17 +1301,33 @@ function principalMatches(principal, subject) {
 	return false;
 }
 /**
-* Evaluates a v1 grant stack: default deny, last applicable grant wins.
-* Group and match principals and `where` conditions are not evaluated yet; a
-* grant that uses any of them never applies.
+* Evaluates a v1 grant stack: default deny, last applicable grant wins, and
+* reports which grant decided it. Group and match principals and `where`
+* conditions are not evaluated yet; a grant that uses any of them never applies.
 */
-function evaluateGrants(grants, subject, request) {
-	let decision = "deny";
+function evaluateGrantStack(grants, subject, request) {
+	let applicable;
 	for (const grant of grants) {
 		if (grant.where !== void 0) continue;
-		if (capabilityCovers(grant.capability, request) && principalMatches(grant.principal, subject)) decision = grant.effect;
+		if (capabilityCovers(grant.capability, request) && principalMatches(grant.principal, subject)) applicable = grant;
 	}
-	return decision;
+	if (applicable === void 0) return {
+		decision: "deny",
+		refusal: "no-applicable-grant"
+	};
+	if (applicable.effect === "deny") return {
+		decision: "deny",
+		refusal: "denied-by-grant",
+		grantId: applicable.id
+	};
+	return { decision: "allow" };
+}
+/**
+* Evaluates a v1 grant stack: default deny, last applicable grant wins. This is
+* {@link evaluateGrantStack} with the reason dropped.
+*/
+function evaluateGrants(grants, subject, request) {
+	return evaluateGrantStack(grants, subject, request).decision;
 }
 //#endregion
 //#region document-model/constants.ts
@@ -2003,6 +2105,8 @@ function isDocumentCreator(creatorKey, signerKey) {
 * (version 0). The input version is the policy language version and must be an
 * integer >= 1; 0 is reserved for the uninitialized state. On a signed-header
 * document it must be signed by the document creator (`header.sig.publicKey`).
+* A creator-less policy must include a grant permitting execute on the auth
+* scope, or it would be born locked out.
 */
 function applyInitializeAuthAction(document, action) {
 	assertActionInputShape(action.input);
@@ -2010,12 +2114,12 @@ function applyInitializeAuthAction(document, action) {
 	if (!Number.isInteger(version) || version < 1) throw new InvalidAuthVersionError(document.header.id, version);
 	if (document.state.auth.version !== 0) throw new AuthAlreadyInitializedError(document.header.id);
 	if (!Array.isArray(grants)) throw new InvalidActionInputError({ grants: "must be an array" });
-	assertValidInitialGrants(grants, document.header.documentType);
 	const creatorKey = document.header.sig.publicKey;
 	const signerKey = action.context?.signer?.app.key;
 	const hasCreator = Boolean(creatorKey.kty || creatorKey.x || creatorKey.y);
 	if (hasCreator && !isDocumentCreator(creatorKey, signerKey)) throw new AuthInitializerNotCreatorError(document.header.id);
 	const creator = hasCreator ? signerKey : void 0;
+	assertValidInitialGrants(grants, document.header.documentType, creator);
 	return {
 		...document,
 		state: {
@@ -2036,32 +2140,42 @@ function applySetGrantAction(document, action) {
 	assertActionInputShape(action.input);
 	const { grant } = action.input;
 	const grants = document.state.auth.grants;
-	assertValidGrantUpsert(grant, grants, document.header.documentType);
+	assertValidGrantUpsert(grant, grants, document.header.documentType, document.state.auth.creator);
 	return withGrants(document, grants.some((g) => g.id === grant.id) ? grants.map((g) => g.id === grant.id ? grant : g) : [...grants, grant]);
 }
-/** Removes a grant by id; throws if the id is not present. */
+/**
+* Removes a grant by id; throws if the id is not present or if the removal
+* would leave a creator-less policy with no auth-administration grant.
+*/
 function applyRemoveGrantAction(document, action) {
 	assertActionInputShape(action.input);
 	const { id } = action.input;
-	const grants = document.state.auth.grants;
+	const { grants, creator } = document.state.auth;
 	if (!grants.some((g) => g.id === id)) throw new GrantNotFoundError(id);
-	return withGrants(document, grants.filter((g) => g.id !== id));
+	const next = grants.filter((g) => g.id !== id);
+	assertAuthAdministrationRetained(creator, grants, next, id);
+	return withGrants(document, next);
 }
 /**
 * Moves a grant by id to a new index. Order is load-bearing (the last
 * applicable grant wins), so the relative order of the other grants is kept.
 * The target index is clamped to the valid range; an unknown id throws.
+*
+* Order alone decides which grant wins, so a move can take administration away
+* without changing the list's contents. It carries the same retention rule as
+* the two mutation paths.
 */
 function applyMoveGrantAction(document, action) {
 	assertActionInputShape(action.input);
 	const { id, index } = action.input;
-	const grants = document.state.auth.grants;
+	const { grants, creator } = document.state.auth;
 	const from = grants.findIndex((g) => g.id === id);
 	if (from === -1) throw new GrantNotFoundError(id);
 	const next = [...grants];
 	const [moved] = next.splice(from, 1);
 	const to = Math.max(0, Math.min(index, next.length));
 	next.splice(to, 0, moved);
+	assertAuthAdministrationRetained(creator, grants, next, id);
 	return withGrants(document, next);
 }
 /**
@@ -2087,6 +2201,42 @@ function assertAuthPreservedOnDuplicate(documentId, source, duplicated) {
 	if (!source || source.version === 0) return;
 	if (duplicated === void 0 || duplicated.version !== source.version || duplicated.creator !== source.creator) throw new AuthPolicyNotPreservedError(documentId);
 }
+/**
+* The auth scope a state snapshot may install, given the policy already there.
+*
+* `applyAuthAction` is the validated door onto `state.auth`, but a whole-state
+* snapshot (UPGRADE_DOCUMENT's `initialState`, LOAD_STATE's `data`) replaces the
+* scope wholesale and is authorized as a `document`-scope write. Without this,
+* a subject holding `execute` on `document` and no auth grant at all can install
+* a policy of its choosing, name itself `creator` (which exempts the policy from
+* the retention rule for good), or wipe an existing policy by carrying the
+* default uninitialized one.
+*
+* Three cases:
+*
+*   - the snapshot carries no policy, or an uninitialized one: the document
+*     keeps the policy it has, so a default-state upgrade cannot reset it;
+*   - the document is uninitialized and the snapshot carries a policy: the
+*     policy is installed after the same validation genesis applies, so it
+*     cannot be born locked out;
+*   - both carry a policy: they must agree. A duplicate preserves its source's
+*     policy (see {@link assertAuthPreservedOnDuplicate}), and anything else is
+*     an attempt to replace one policy with another.
+*/
+function resolveSnapshotAuth(documentId, documentType, current, incoming) {
+	const currentAuth = current ?? createAuthState({
+		version: 0,
+		grants: []
+	});
+	if (!incoming || !incoming.version) return currentAuth;
+	if (currentAuth.version !== 0) {
+		if (stringify(incoming) !== stringify(currentAuth)) throw new AuthPolicyNotPreservedError(documentId);
+		return incoming;
+	}
+	if (!Array.isArray(incoming.grants)) throw new InvalidActionInputError({ grants: "must be an array" });
+	assertValidInitialGrants(incoming.grants, documentType, incoming.creator);
+	return incoming;
+}
 /** UNDO, REDO and PRUNE are rejected on the auth scope. */
 function assertAuthScopeActionAllowed(action) {
 	if (action.scope === "auth" && [
@@ -2096,19 +2246,47 @@ function assertAuthScopeActionAllowed(action) {
 	].includes(action.type)) throw new AuthActionNotAllowedError(action.type);
 }
 /**
-* Evaluates the auth policy for a single request. Pure and deterministic.
+* Evaluates the auth policy for a single request and reports why it refused.
+* Pure and deterministic.
 *
 * An uninitialized policy (version 0, absent auth state, or a legacy `{}`
 * auth scope serialized before PHAuthState had a version) leaves the document
 * open. Once a policy exists the default is deny, and grants stack in order.
 */
+function evaluate(auth, subject, request) {
+	if (!auth || !auth.version) return { decision: "allow" };
+	if (request.verb === "execute" && request.scope === "auth" && subject.key !== void 0 && subject.key === auth.creator) return { decision: "allow" };
+	if (auth.version > 1) return {
+		decision: "deny",
+		refusal: "version-unsupported"
+	};
+	return evaluateGrantStack(auth.grants, subject, request);
+}
+/**
+* Evaluates the auth policy for a single request. Pure and deterministic. This
+* is {@link evaluate} with the reason dropped.
+*/
 function decide(auth, subject, request) {
-	if (!auth || !auth.version) return "allow";
-	if (request.verb === "execute" && request.scope === "auth" && subject.key !== void 0 && subject.key === auth.creator) return "allow";
-	if (auth.version > 1) return "deny";
-	return evaluateGrants(auth.grants, subject, request);
+	return evaluate(auth, subject, request).decision;
 }
 //#endregion
+//#region document-model/denied.ts
+/**
+* True iff authorization rejected the action.
+*/
+function isDenied(operation) {
+	return operation.deniedReason !== void 0;
+}
+/**
+* The closed set of strings persisted as `deniedReason`. Re-evaluation compares
+* them, so they are consensus data: exact strings that embed no grant id,
+* subject or timestamp. Changing one is history-visible.
+*/
+const DOCUMENT_DELETED_REASON = "document deleted";
+const AUTH_VERSION_UNSUPPORTED_REASON = "auth policy version unsupported";
+const AUTH_NO_GRANT_REASON = "no grant permits this operation";
+const AUTH_DENIED_BY_GRANT_REASON = "denied by grant";
+//#endregion
 //#region document-model/document-schema.ts
 const BaseDocumentHeaderSchema = z.object({
 	id: z.string(),
@@ -2507,6 +2685,22 @@ function sortMappedOperations(operations) {
 const defaultCreateState = (state) => {
 	return state;
 };
+/**
+* Records an operation in the history without applying it, which is what a
+* denied operation needs: it occupies its index and contributes no state.
+*
+* The scope defaults to the action's own, and is passed explicitly by a rebuild
+* that is walking one stream and does not want to trust the action's copy.
+*/
+function appendWithoutApplying(document, operation, scope = operation.action.scope) {
+	return {
+		...document,
+		operations: {
+			...document.operations,
+			[scope]: [...document.operations[scope] ?? [], operation]
+		}
+	};
+}
 function replayDocument(initialState, operations, reducer, header, dispatch, skipHeaderOperations = {}, options) {
 	const { checkHashes = true, reuseOperationResultingState, operationResultingStateParser = parseResultingState, skipIndexValidation } = options || {};
 	const backfilledInitialState = backfillAuthState(initialState);
@@ -2551,6 +2745,7 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 	};
 	let result = document;
 	if (operationsToReplay.length) result = operationsToReplay.reduce((document, operation) => {
+		if (isDenied(operation)) return appendWithoutApplying(document, operation);
 		return reducer(document, operation.action, dispatch, {
 			ignoreSkipOperations: true,
 			checkHashes,
@@ -3074,13 +3269,15 @@ function redoOperation(document, action, skip) {
 	});
 }
 function loadStateOperation(document, action) {
+	const loaded = backfillAuthState(action.state.data);
+	loaded.auth = resolveSnapshotAuth(document.header.id, document.header.documentType, backfillAuthState({ ...document.state }).auth, loaded.auth);
 	return {
 		...document,
 		header: {
 			...document.header,
 			name: action.state.name
 		},
-		state: backfillAuthState(action.state.data)
+		state: loaded
 	};
 }
 /**
@@ -3098,12 +3295,6 @@ function operationOutcome(operation) {
 	};
 	return { kind: "applied" };
 }
-/**
-* True iff authorization rejected the action.
-*/
-function isDenied(operation) {
-	return operation.deniedReason !== void 0;
-}
 //#endregion
 //#region document-model/reducer.ts
 function replayOperations(initialState, clearedOperations, stateReducer, header, dispatch, documentReducer = baseReducer, skipHeaderOperations = {}, options) {
@@ -4131,10 +4322,12 @@ function applyInitialState(document, action) {
 	const input = action.input;
 	const newState = input.initialState || input.state;
 	if (newState) {
-		document.state = backfillAuthState({
+		const merged = backfillAuthState({
 			...document.state,
 			...newState
 		});
+		merged.auth = resolveSnapshotAuth(document.header.id, document.header.documentType, backfillAuthState({ ...document.state }).auth, merged.auth);
+		document.state = merged;
 		document.initialState = document.state;
 	}
 }
@@ -4314,7 +4507,8 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			const segEnd = k < validatedUpgrades.length ? boundaries[k]?.[s] ?? ops.length : ops.length;
 			const segOps = ops.slice(segStart, segEnd);
 			for (const op of segOps) {
-				document = reducer(document, op.action, dispatch, {
+				if (isDenied(op)) document = appendWithoutApplying(document, op, s);
+				else document = reducer(document, op.action, dispatch, {
 					ignoreSkipOperations: true,
 					checkHashes,
 					skipIndexValidation,
@@ -4331,6 +4525,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			if (!spineOp) continue;
 			const spineActionType = spineOp.action.type;
 			if (spineActionType === "CREATE_DOCUMENT" || spineActionType === "UPGRADE_DOCUMENT") continue;
+			if (isDenied(spineOp)) continue;
 			if (spineActionType === "DELETE_DOCUMENT") document = applyDeleteDocumentAction(document, spineOp.action);
 			else document = reducer(document, spineOp.action, dispatch, {
 				ignoreSkipOperations: true,
@@ -4547,6 +4742,6 @@ const getFileBrowser = (file) => {
 	return Promise.resolve().then(() => readFileBrowser(file));
 };
 //#endregion
-export { AUTH_ACTION_TYPES, AddChangeLogItemInputSchema, AddModuleInputSchema, AddOperationErrorInputSchema, AddOperationExampleInputSchema, AddOperationInputSchema, AddStateExampleInputSchema, AuthActionNotAllowedError, AuthAlreadyInitializedError, AuthInitializerNotCreatorError, AuthPolicyNotPreservedError, AuthorSchema, BaseDocumentHeaderSchema, BaseDocumentStateSchema, CodeExampleSchema, ConfigEntrySchema, ConfigEntryTypeSchema, DeleteChangeLogItemInputSchema, DeleteModuleInputSchema, DeleteOperationErrorInputSchema, DeleteOperationExampleInputSchema, DeleteOperationInputSchema, DeleteStateExampleInputSchema, DocumentActionSchema, DocumentModelGlobalStateSchema, DocumentModelHeaderSchema, DocumentModelInputSchema, DocumentModelPHStateSchema, DocumentModelSchema, DocumentSpecificationSchema, DowngradeNotSupportedError, FileSystemError, GrantNotFoundError, GrantSchema, GroupPrincipalNotAllowedError, HASH_ALGORITHM_SHA1, HASH_ALGORITHM_SHA256, HASH_ALGORITHM_SHA512, HASH_ENCODING_BASE64, HASH_ENCODING_HEX, HashMismatchError, InitializeAuthActionInputSchema, IntegrityIssueSubType, IntegrityIssueType, InvalidActionInputError, InvalidActionInputZodError, InvalidAuthVersionError, InvalidGrantError, LoadStateActionInputSchema, LoadStateActionSchema, LoadStateActionStateInputSchema, Load_StateSchema, MAX_AUTH_GRANTS, MAX_CAPABILITY_OPERATIONS, MAX_CONDITION_DEPTH, MAX_CONDITION_NODES, MAX_SUPPORTED_AUTH_VERSION, ManifestSchema, ModuleSchema, MoveGrantActionInputSchema, MoveOperationInputSchema, OPERATION_NAME_PATTERN, OperationErrorSchema, OperationScopeSchema, OperationSpecificationSchema, PowerhouseModuleSchema, PowerhouseModulesSchema, PruneActionInputSchema, PruneActionSchema, PruneSchema, PublisherSchema, PwaConfigSchema, RESERVED_OPERATION_NAMES, RedoActionInputSchema, RedoActionSchema, RedoSchema, RemoveGrantActionInputSchema, ReorderChangeLogItemsInputSchema, ReorderModuleOperationsInputSchema, ReorderModulesInputSchema, ReorderOperationErrorsInputSchema, ReorderOperationExamplesInputSchema, ReorderStateExamplesInputSchema, ScopeStateSchema, SetAuthorNameInputSchema, SetAuthorWebsiteInputSchema, SetGrantActionInputSchema, SetInitialStateInputSchema, SetModelDescriptionInputSchema, SetModelExtensionInputSchema, SetModelIdInputSchema, SetModelNameInputSchema, SetModuleDescriptionInputSchema, SetModuleNameInputSchema, SetNameActionInputSchema, SetNameActionSchema, SetOperationDescriptionInputSchema, SetOperationErrorCodeInputSchema, SetOperationErrorDescriptionInputSchema, SetOperationErrorNameInputSchema, SetOperationErrorTemplateInputSchema, SetOperationNameInputSchema, SetOperationReducerInputSchema, SetOperationSchemaInputSchema, SetOperationScopeInputSchema, SetOperationTemplateInputSchema, SetPreferredEditorActionInputSchema, SetPreferredEditorActionSchema, SetStateSchemaInputSchema, Set_NameSchema, Set_PreferredEditorSchema, StateSchema, UndoActionInputSchema, UndoActionSchema, UndoSchema, UpdateChangeLogItemInputSchema, UpdateOperationExampleInputSchema, UpdateStateExampleInputSchema, ab2hex, actionContext, actionFromAction, actionSigner, actions, addChangeLogItem, addModule, addOperation, addOperationError, addOperationExample, addStateExample, addUndo, applyAuthAction, applyDeleteDocumentAction, applyInitializeAuthAction, applyMoveGrantAction, applyRemoveGrantAction, applySetGrantAction, applyUpgradeDocumentAction, assertAuthPreservedOnDuplicate, assertAuthScopeActionAllowed, assertIsDocumentModelDocument, assertIsDocumentModelState, assertModuleIdUnique, assertOperationErrorIdUnique, assertOperationExampleIdUnique, assertOperationIdUnique, assertValidGrant, assertValidGrantUpsert, assertValidInitialGrants, attachBranch, backfillAuthState, base58Decode, base64UrlToBytes, baseActions, baseCreateDocument, baseLoadFromInput, baseLoadFromInputVersioned, baseReducer, baseReducerVersion, baseSaveToFileHandle, buildOperationSignature, buildOperationSignatureMessage, buildOperationSignatureParams, buildSignedAction, checkCleanedOperationsIntegrity, checkOperationsIntegrity, computeUpgradeTransitions, createAction, createAuthState, createBaseState, createDocumentState, createGlobalState, createLocalState, createMinimalZip, createPresignedHeader, createReducer, createSignedHeader, createSignedHeaderForSigner, createState, createVerificationSigner, createZip, decide, defaultAuthState, defaultBaseState, defaultDocumentState, defaultGlobalState, defaultLocalState, defaultPHState, definedNonNullAnySchema, deleteChangeLogItem, deleteModule, deleteOperation, deleteOperationError, deleteOperationExample, deleteStateExample, deriveOperationId, diffOperations, documentModelActions, documentModelDocumentType, documentModelFileExtension, documentModelGlobalState, documentModelHeaderReducer, documentModelInitialGlobalState, documentModelInitialLocalState, documentModelLoadFromInput, documentModelModuleReducer, documentModelOperationErrorReducer, documentModelOperationExampleReducer, documentModelOperationReducer, documentModelReducer, documentModelSaveToFileHandle, documentModelStateReducer, documentModelStateSchemaReducer, documentModelVersioningReducer, evaluateGrants, fetchFileBrowser, filterDocumentOperationsResultingState, filterDuplicatedOperations, findModuleOrThrow, findOperationErrorOrThrow, findOperationExampleOrThrow, findOperationOrThrow, garbageCollect, garbageCollectDocumentOperations, garbageCollectV2, generateId, generateMock, getAllOperationNames, getDocumentLastModified, getFileBrowser, getUnixTimestamp, grantProblem, groupDocumentType, groupOperationsByScope, hashBrowser, hashDocumentStateForScope, hex2ab, initializeAuth, isAuthAction, isDefinedNonNullAny, isDenied, isDocumentAction, isDocumentCreator, isDocumentModelDocument, isDocumentModelState, isNoopOperation, isPlainValue, isReservedOperationName, isUndo, isUndoRedo, isValidOperationNameFormat, loadState, loadStateOperation, mapSkippedOperations, mapSkippedOperationsV2, merge, moveGrant, moveOperation, nextSkipNumber, noop, operationExampleCreators, operationFromAction, operationFromOperation, operationOutcome, operationWithContext, operationsAreEqual, parseResultingState, precedes, prepareOperations, processUndoRedo, prune, pruneOperation, readFileBrowser, readOnly, redo, redoOperation, releaseNewVersion, removeExistingOperations, removeGrant, reorderChangeLogItems, reorderModuleOperations, reorderModules, reorderOperationErrors, reorderOperationExamples, reorderStateExamples, replayDocument, replayDocumentVersioned, replayOperations, reshuffleByTimestamp, reshuffleByTimestampAndIndex, setAuthorName, setAuthorWebsite, setGrant, setInitialState, setModelDescription, setModelExtension, setModelId, setModelName, setModuleDescription, setModuleName, setName, setNameOperation, setOperationDescription, setOperationErrorCode, setOperationErrorDescription, setOperationErrorName, setOperationErrorTemplate, setOperationName, setOperationReducer, setOperationSchema, setOperationScope, setOperationTemplate, setPreferredEditor, setPreferredEditorOperation, setStateSchema, sign, skipHeaderOperations, sortMappedOperations, sortOperations, split, undo, undoOperation, undoOperationV2, updateChangeLogItem, updateDocument, updateHeaderRevision, updateOperationExample, updateStateExample, validateHeader, validateInitialState, validateModule, validateModuleOperation, validateModules, validateOperationName, validateOperations, validateStateSchemaName, verify, verifyOperationSignature, writeFileBrowser };
+export { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, AddChangeLogItemInputSchema, AddModuleInputSchema, AddOperationErrorInputSchema, AddOperationExampleInputSchema, AddOperationInputSchema, AddStateExampleInputSchema, AuthActionNotAllowedError, AuthAdministrationLockoutError, AuthAdministrationMissingError, AuthAlreadyInitializedError, AuthInitializerNotCreatorError, AuthPolicyNotPreservedError, AuthorSchema, BaseDocumentHeaderSchema, BaseDocumentStateSchema, CodeExampleSchema, ConfigEntrySchema, ConfigEntryTypeSchema, DOCUMENT_DELETED_REASON, DeleteChangeLogItemInputSchema, DeleteModuleInputSchema, DeleteOperationErrorInputSchema, DeleteOperationExampleInputSchema, DeleteOperationInputSchema, DeleteStateExampleInputSchema, DocumentActionSchema, DocumentModelGlobalStateSchema, DocumentModelHeaderSchema, DocumentModelInputSchema, DocumentModelPHStateSchema, DocumentModelSchema, DocumentSpecificationSchema, DowngradeNotSupportedError, FileSystemError, GrantNotFoundError, GrantSchema, GroupPrincipalNotAllowedError, HASH_ALGORITHM_SHA1, HASH_ALGORITHM_SHA256, HASH_ALGORITHM_SHA512, HASH_ENCODING_BASE64, HASH_ENCODING_HEX, HashMismatchError, InitializeAuthActionInputSchema, IntegrityIssueSubType, IntegrityIssueType, InvalidActionInputError, InvalidActionInputZodError, InvalidAuthVersionError, InvalidGrantError, LoadStateActionInputSchema, LoadStateActionSchema, LoadStateActionStateInputSchema, Load_StateSchema, MAX_AUTH_GRANTS, MAX_CAPABILITY_OPERATIONS, MAX_CONDITION_DEPTH, MAX_CONDITION_NODES, MAX_SUPPORTED_AUTH_VERSION, ManifestSchema, ModuleSchema, MoveGrantActionInputSchema, MoveOperationInputSchema, OPERATION_NAME_PATTERN, OperationErrorSchema, OperationScopeSchema, OperationSpecificationSchema, PowerhouseModuleSchema, PowerhouseModulesSchema, PruneActionInputSchema, PruneActionSchema, PruneSchema, PublisherSchema, PwaConfigSchema, RESERVED_OPERATION_NAMES, RedoActionInputSchema, RedoActionSchema, RedoSchema, RemoveGrantActionInputSchema, ReorderChangeLogItemsInputSchema, ReorderModuleOperationsInputSchema, ReorderModulesInputSchema, ReorderOperationErrorsInputSchema, ReorderOperationExamplesInputSchema, ReorderStateExamplesInputSchema, ScopeStateSchema, SetAuthorNameInputSchema, SetAuthorWebsiteInputSchema, SetGrantActionInputSchema, SetInitialStateInputSchema, SetModelDescriptionInputSchema, SetModelExtensionInputSchema, SetModelIdInputSchema, SetModelNameInputSchema, SetModuleDescriptionInputSchema, SetModuleNameInputSchema, SetNameActionInputSchema, SetNameActionSchema, SetOperationDescriptionInputSchema, SetOperationErrorCodeInputSchema, SetOperationErrorDescriptionInputSchema, SetOperationErrorNameInputSchema, SetOperationErrorTemplateInputSchema, SetOperationNameInputSchema, SetOperationReducerInputSchema, SetOperationSchemaInputSchema, SetOperationScopeInputSchema, SetOperationTemplateInputSchema, SetPreferredEditorActionInputSchema, SetPreferredEditorActionSchema, SetStateSchemaInputSchema, Set_NameSchema, Set_PreferredEditorSchema, StateSchema, UndoActionInputSchema, UndoActionSchema, UndoSchema, UpdateChangeLogItemInputSchema, UpdateOperationExampleInputSchema, UpdateStateExampleInputSchema, ab2hex, actionContext, actionFromAction, actionSigner, actions, addChangeLogItem, addModule, addOperation, addOperationError, addOperationExample, addStateExample, addUndo, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyInitializeAuthAction, applyMoveGrantAction, applyRemoveGrantAction, applySetGrantAction, applyUpgradeDocumentAction, assertAuthAdministrationRetained, assertAuthPreservedOnDuplicate, assertAuthScopeActionAllowed, assertIsDocumentModelDocument, assertIsDocumentModelState, assertModuleIdUnique, assertOperationErrorIdUnique, assertOperationExampleIdUnique, assertOperationIdUnique, assertValidGrant, assertValidGrantUpsert, assertValidInitialGrants, attachBranch, backfillAuthState, base58Decode, base64UrlToBytes, baseActions, baseCreateDocument, baseLoadFromInput, baseLoadFromInputVersioned, baseReducer, baseReducerVersion, baseSaveToFileHandle, buildOperationSignature, buildOperationSignatureMessage, buildOperationSignatureParams, buildSignedAction, checkCleanedOperationsIntegrity, checkOperationsIntegrity, computeUpgradeTransitions, createAction, createAuthState, createBaseState, createDocumentState, createGlobalState, createLocalState, createMinimalZip, createPresignedHeader, createReducer, createSignedHeader, createSignedHeaderForSigner, createState, createVerificationSigner, createZip, decide, defaultAuthState, defaultBaseState, defaultDocumentState, defaultGlobalState, defaultLocalState, defaultPHState, definedNonNullAnySchema, deleteChangeLogItem, deleteModule, deleteOperation, deleteOperationError, deleteOperationExample, deleteStateExample, deriveOperationId, diffOperations, documentModelActions, documentModelDocumentType, documentModelFileExtension, documentModelGlobalState, documentModelHeaderReducer, documentModelInitialGlobalState, documentModelInitialLocalState, documentModelLoadFromInput, documentModelModuleReducer, documentModelOperationErrorReducer, documentModelOperationExampleReducer, documentModelOperationReducer, documentModelReducer, documentModelSaveToFileHandle, documentModelStateReducer, documentModelStateSchemaReducer, documentModelVersioningReducer, evaluate, evaluateGrantStack, evaluateGrants, fetchFileBrowser, filterDocumentOperationsResultingState, filterDuplicatedOperations, findModuleOrThrow, findOperationErrorOrThrow, findOperationExampleOrThrow, findOperationOrThrow, garbageCollect, garbageCollectDocumentOperations, garbageCollectV2, generateId, generateMock, getAllOperationNames, getDocumentLastModified, getFileBrowser, getUnixTimestamp, grantProblem, groupDocumentType, groupOperationsByScope, hashBrowser, hashDocumentStateForScope, hex2ab, initializeAuth, isAuthAction, isDefinedNonNullAny, isDenied, isDocumentAction, isDocumentCreator, isDocumentModelDocument, isDocumentModelState, isNoopOperation, isPlainValue, isReservedOperationName, isUndo, isUndoRedo, isValidOperationNameFormat, loadState, loadStateOperation, mapSkippedOperations, mapSkippedOperationsV2, merge, moveGrant, moveOperation, nextSkipNumber, noop, operationExampleCreators, operationFromAction, operationFromOperation, operationOutcome, operationWithContext, operationsAreEqual, parseResultingState, precedes, prepareOperations, processUndoRedo, prune, pruneOperation, readFileBrowser, readOnly, redo, redoOperation, releaseNewVersion, removeExistingOperations, removeGrant, reorderChangeLogItems, reorderModuleOperations, reorderModules, reorderOperationErrors, reorderOperationExamples, reorderStateExamples, replayDocument, replayDocumentVersioned, replayOperations, reshuffleByTimestamp, reshuffleByTimestampAndIndex, resolveSnapshotAuth, setAuthorName, setAuthorWebsite, setGrant, setInitialState, setModelDescription, setModelExtension, setModelId, setModelName, setModuleDescription, setModuleName, setName, setNameOperation, setOperationDescription, setOperationErrorCode, setOperationErrorDescription, setOperationErrorName, setOperationErrorTemplate, setOperationName, setOperationReducer, setOperationSchema, setOperationScope, setOperationTemplate, setPreferredEditor, setPreferredEditorOperation, setStateSchema, sign, skipHeaderOperations, sortMappedOperations, sortOperations, split, undo, undoOperation, undoOperationV2, updateChangeLogItem, updateDocument, updateHeaderRevision, updateOperationExample, updateStateExample, validateHeader, validateInitialState, validateModule, validateModuleOperation, validateModules, validateOperationName, validateOperations, validateStateSchemaName, verify, verifyOperationSignature, writeFileBrowser };
 
 //# sourceMappingURL=index.js.map