@powerhousedao/shared 6.2.2-dev.9 → 6.2.2-staging.0

package/dist/document-model/index.js

@@ -1,10 +1,110 @@
-import { a as buildOperationSignatureParams, c as hex2ab, i as buildOperationSignatureMessage, n as generateId, o as getUnixTimestamp, r as ab2hex, s as hashBrowser, t as deriveOperationId } from "../utils-DKOFCM0Q.js";
-import { generateMock } from "./mock.js";
+import { a as base58Decode, c as buildOperationSignatureParams, d as hex2ab, i as ab2hex, l as getUnixTimestamp, n as generateId, o as base64UrlToBytes, r as generateMock, s as buildOperationSignatureMessage, t as deriveOperationId, u as hashBrowser } from "../utils-aaTmfxFW.js";
 import { ZodError, z } from "zod";
 import { stringify } from "safe-stable-stringify";
 import { strFromU8, strToU8, unzip, zip } from "fflate";
 import { castDraft, create, unsafe } from "mutative";
 import { constantCase, pascalCase } from "change-case";
+//#region document-model/signatures.ts
+/**
+* What separates a signature's params when it travels as one string.
+*
+* GraphQL declares `signatures` as a list of strings, not a list of lists, so a
+* tuple is joined for transport and split on arrival. The separator is here so
+* the two halves cannot disagree about it - they live in different packages, and
+* a mismatch would corrupt every signature that crossed the wire rather than
+* failing outright.
+*/
+const SIGNATURE_PARAM_SEPARATOR = ", ";
+/** The number of params a signature carries. */
+const SIGNATURE_PARAM_COUNT = 5;
+/** Joins a signature's params for transport. Already-joined input passes through. */
+function serializeSignature(signature) {
+	return Array.isArray(signature) ? signature.join(SIGNATURE_PARAM_SEPARATOR) : signature;
+}
+/**
+* Splits a transported signature back into its params. A tuple passes through.
+*
+* Short input is padded rather than refused: verification reads the params by
+* position and fails on a wrong one, which says more than a length complaint
+* raised here would.
+*/
+function deserializeSignature(signature) {
+	if (Array.isArray(signature)) return signature;
+	const parts = signature.split(SIGNATURE_PARAM_SEPARATOR);
+	return Array.from({ length: SIGNATURE_PARAM_COUNT }, (_unused, index) => parts[index] ?? "");
+}
+//#endregion
+//#region document-model/action-transport.ts
+/**
+* Projects an action onto the fields the GraphQL `ActionInput` declares.
+*
+* A projection rather than a spread, because an input object rejects a field it
+* does not declare, and that refusal takes the whole request with it. An action
+* read back out of storage can carry fields the type no longer has - a legacy
+* `attachments` array, or the operation fields left behind by a signing helper
+* that returns an operation - and any one of them would sink an otherwise valid
+* submission.
+*
+* Only fields the action actually carries are emitted, so an unsigned action
+* sends no context at all rather than a context full of nulls.
+*/
+function toTransportAction(action) {
+	if (action.input === void 0 || action.input === null) throw new Error(`Action ${action.id} (${action.type}) has no input, which the wire requires`);
+	const projected = {
+		id: action.id,
+		type: action.type,
+		timestampUtcMs: action.timestampUtcMs,
+		input: action.input,
+		scope: action.scope
+	};
+	const context = toTransportContext(action.context);
+	return context ? {
+		...projected,
+		context
+	} : projected;
+}
+function toTransportContext(context) {
+	if (!context) return;
+	const projected = {};
+	if (context.prevOpIndex !== void 0) projected.prevOpIndex = context.prevOpIndex;
+	if (context.prevOpHash !== void 0) projected.prevOpHash = context.prevOpHash;
+	if (context.nonce !== void 0) projected.nonce = context.nonce;
+	const signer = context.signer;
+	if (signer) projected.signer = {
+		...signer.user ? { user: toTransportSignerUser(signer.user) } : {},
+		...signer.app ? { app: toTransportSignerApp(signer.app) } : {},
+		signatures: (signer.signatures ?? []).map(serializeSignature)
+	};
+	return Object.keys(projected).length > 0 ? projected : void 0;
+}
+/**
+* The identity, projected for the same reason the context around it is.
+*
+* A signer is handed in by the app, so what reaches here is only as narrow as
+* whoever built it: an identity carrying a session's DID, credential or profile
+* alongside the address is refused by `ReactorSignerUserInput`, and that
+* refusal takes the whole submission with it.
+*
+* The compiler cannot stand in for this. `UserActionSigner` already declares
+* exactly these three fields, but excess-property checks apply to fresh object
+* literals and never to a variable of a wider type, so a wide identity assigned
+* to the narrow type passes untouched.
+*/
+function toTransportSignerUser(user) {
+	return {
+		address: user.address,
+		networkId: user.networkId,
+		chainId: user.chainId
+	};
+}
+/** The signing app, projected on the same rule as the identity above. */
+function toTransportSignerApp(app) {
+	return {
+		name: app.name,
+		key: app.key
+	};
+}
+//#endregion
 //#region document-model/errors.ts
 const FileSystemError = /* @__PURE__ */ new Error("File system not available.");
 var InvalidActionInputError = class extends Error {
@@ -39,6 +139,75 @@ var DowngradeNotSupportedError = class extends Error {
 		this.toVersion = toVersion;
 	}
 };
+/**
+* Thrown when INITIALIZE_AUTH is applied to an already-initialized auth scope.
+* The genesis action is valid only at auth revision zero.
+*/
+var AuthAlreadyInitializedError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`Auth scope already initialized for document ${documentId}: INITIALIZE_AUTH is valid only at auth revision zero`);
+		this.name = "AuthAlreadyInitializedError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH is not signed by the document creator (its signer
+* does not match `header.sig.publicKey`), so it cannot set the auth policy.
+*/
+var AuthInitializerNotCreatorError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`INITIALIZE_AUTH for document ${documentId} must be signed by the document creator`);
+		this.name = "AuthInitializerNotCreatorError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH carries a version below 1. Version 0 is reserved
+* for the uninitialized auth scope.
+*/
+var InvalidAuthVersionError = class extends Error {
+	documentId;
+	version;
+	constructor(documentId, version) {
+		super(`Invalid auth policy version ${version} for document ${documentId}: INITIALIZE_AUTH requires an integer version >= 1`);
+		this.name = "InvalidAuthVersionError";
+		this.documentId = documentId;
+		this.version = version;
+	}
+};
+/** Thrown when a duplicate would lose the source policy's version or creator binding. */
+var AuthPolicyNotPreservedError = class extends Error {
+	documentId;
+	constructor(documentId) {
+		super(`Duplicating document ${documentId} would not preserve its auth policy: the copy loses the policy version or its creator binding`);
+		this.name = "AuthPolicyNotPreservedError";
+		this.documentId = documentId;
+	}
+};
+/**
+* Thrown when a grant referenced by REMOVE_GRANT or MOVE_GRANT does not exist.
+*/
+var GrantNotFoundError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Grant not found in auth scope: ${grantId}`);
+		this.name = "GrantNotFoundError";
+		this.grantId = grantId;
+	}
+};
+/**
+* Thrown when a disallowed action (UNDO, REDO, PRUNE) targets the auth scope.
+*/
+var AuthActionNotAllowedError = class extends Error {
+	actionType;
+	constructor(actionType) {
+		super(`${actionType} is not permitted on the auth scope`);
+		this.name = "AuthActionNotAllowedError";
+		this.actionType = actionType;
+	}
+};
 var HashMismatchError = class extends Error {
 	_scope;
 	_document;
@@ -65,6 +234,25 @@ var HashMismatchError = class extends Error {
 		return this._operation;
 	}
 };
+/**
+* Thrown when replay or import requires a document model version that is not
+* registered. Carries the data the UI needs to explain the mismatch.
+*/
+var UnsupportedDocumentModelVersionError = class extends Error {
+	documentType;
+	requiredVersion;
+	availableVersions;
+	constructor(documentType, requiredVersion, availableVersions) {
+		super(`No reducer registered for document version ${requiredVersion}. Available versions: ${availableVersions.join(", ")}`);
+		this.name = "UnsupportedDocumentModelVersionError";
+		this.documentType = documentType;
+		this.requiredVersion = requiredVersion;
+		this.availableVersions = availableVersions;
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedDocumentModelVersionError";
+	}
+};
 //#endregion
 //#region document-model/schemas.ts
 const isDefinedNonNullAny = (v) => v !== void 0 && v !== null;
@@ -553,6 +741,89 @@ const ConfigEntrySchema = z.object({
 	required: z.boolean().optional(),
 	default: z.boolean().optional()
 });
+const PwaUrlPatternSchema = z.union([z.string(), z.strictObject({
+	source: z.string(),
+	flags: z.string().optional()
+}).refine((p) => {
+	try {
+		new RegExp(p.source, p.flags);
+		return true;
+	} catch {
+		return false;
+	}
+}, { message: "source/flags do not compile to a valid RegExp" })]);
+const PwaRuntimeCachingSchema = z.strictObject({
+	urlPattern: PwaUrlPatternSchema,
+	handler: z.enum([
+		"CacheFirst",
+		"CacheOnly",
+		"NetworkFirst",
+		"NetworkOnly",
+		"StaleWhileRevalidate"
+	]),
+	method: z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"HEAD",
+		"PATCH"
+	]).optional(),
+	options: z.strictObject({
+		cacheName: z.string().optional(),
+		networkTimeoutSeconds: z.number().optional(),
+		expiration: z.strictObject({
+			maxEntries: z.number().optional(),
+			maxAgeSeconds: z.number().optional()
+		}).optional(),
+		cacheableResponse: z.strictObject({
+			statuses: z.array(z.number()).optional(),
+			headers: z.record(z.string(), z.string()).optional()
+		}).optional()
+	}).optional()
+});
+const PwaIconSchema = z.strictObject({
+	src: z.string(),
+	sizes: z.string().optional(),
+	type: z.string().optional(),
+	purpose: z.string().optional()
+});
+const PwaFileHandlerSchema = z.strictObject({
+	accept: z.record(z.string(), z.array(z.string().regex(/^\./, "file extensions must start with '.'"))),
+	icons: z.array(PwaIconSchema).optional(),
+	launch_type: z.enum(["single-client", "multiple-clients"]).optional()
+});
+const PwaManifestOverrideSchema = z.strictObject({
+	name: z.string().optional(),
+	short_name: z.string().optional(),
+	description: z.string().optional(),
+	theme_color: z.string().optional(),
+	background_color: z.string().optional(),
+	display: z.enum([
+		"fullscreen",
+		"standalone",
+		"minimal-ui",
+		"browser"
+	]).optional(),
+	start_url: z.string().optional(),
+	scope: z.string().optional(),
+	icons: z.array(PwaIconSchema).optional(),
+	file_handlers: z.array(PwaFileHandlerSchema).optional(),
+	launch_handler: z.strictObject({ client_mode: z.enum([
+		"auto",
+		"focus-existing",
+		"navigate-existing",
+		"navigate-new"
+	]) }).optional()
+});
+const PwaConfigSchema = z.strictObject({
+	manifest: PwaManifestOverrideSchema.optional(),
+	globPatterns: z.array(z.string()).optional(),
+	globIgnores: z.array(z.string()).optional(),
+	maximumFileSizeToCacheInBytes: z.number().optional(),
+	runtimeCaching: z.array(PwaRuntimeCachingSchema).optional(),
+	navigateFallbackDenylist: z.array(PwaUrlPatternSchema).optional()
+});
 const ManifestSchema = z.object({
 	name: z.string(),
 	description: z.string().optional(),
@@ -564,7 +835,8 @@ const ManifestSchema = z.object({
 	editors: PowerhouseModulesSchema,
 	processors: PowerhouseModulesSchema,
 	subgraphs: PowerhouseModulesSchema,
-	config: z.array(ConfigEntrySchema).optional()
+	config: z.array(ConfigEntrySchema).optional(),
+	pwa: PwaConfigSchema.optional()
 });
 //#endregion
 //#region document-model/actions.ts
@@ -850,6 +1122,539 @@ const actions = {
 	...documentModelActions
 };
 //#endregion
+//#region document-model/document-type.ts
+const documentModelDocumentType = "powerhouse/document-model";
+const groupDocumentType = "powerhouse/reactor-group";
+/**
+* The group-model action types that change membership. The groups projection
+* filters its reads to these, so any other group operation is invisible to a
+* decision. Kept here so the reactor never depends on the group package; a
+* reactor-group test guards against drift.
+*/
+const groupMembershipActionTypes = ["ADD_MEMBER", "REMOVE_MEMBER"];
+//#endregion
+//#region document-model/auth-v1.ts
+/** Maximum number of grants in a policy. */
+const MAX_AUTH_GRANTS = 100;
+/** Maximum nesting depth of a condition tree. */
+const MAX_CONDITION_DEPTH = 10;
+/** Maximum node count (conditions plus operands) of a condition tree. */
+const MAX_CONDITION_NODES = 100;
+/** Maximum entries in an execute capability's operation list. */
+const MAX_CAPABILITY_OPERATIONS = 100;
+/**
+* Thrown when a grant violates the v1 validation rules. The message is stored
+* on error operations, so it must be a pure function of the input.
+*/
+var InvalidGrantError = class extends Error {
+	grantId;
+	constructor(grantId, problem) {
+		super(`Invalid grant "${grantId}": ${problem}`);
+		this.name = "InvalidGrantError";
+		this.grantId = grantId;
+	}
+};
+/** Thrown for a `{ group }` principal on a group document: references never chain. */
+var GroupPrincipalNotAllowedError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Grant "${grantId}" uses a group principal on a group document: a group's auth scope cannot reference other groups`);
+		this.name = "GroupPrincipalNotAllowedError";
+		this.grantId = grantId;
+	}
+};
+/**
+* Thrown when a change would leave a creator-less policy with no grant
+* permitting execute on the auth scope. Without the creator carve-out no
+* subject could ever administer such a policy again.
+*/
+var AuthAdministrationLockoutError = class extends Error {
+	grantId;
+	constructor(grantId) {
+		super(`Change to grant "${grantId}" would leave no reachable grant permitting execute on the auth scope: a policy with no creator must always retain one`);
+		this.name = "AuthAdministrationLockoutError";
+		this.grantId = grantId;
+	}
+};
+/**
+* Thrown when INITIALIZE_AUTH would create a creator-less policy with no grant
+* permitting execute on the auth scope. Such a policy would be born with no
+* subject able to administer it.
+*/
+var AuthAdministrationMissingError = class extends Error {
+	constructor() {
+		super("Initial grants include no reachable grant permitting execute on the auth scope: a policy with no creator must always include one");
+		this.name = "AuthAdministrationMissingError";
+	}
+};
+const GRANT_KEYS = new Set([
+	"id",
+	"description",
+	"effect",
+	"principal",
+	"capability",
+	"where"
+]);
+const PRINCIPAL_KINDS = new Set([
+	"anyone",
+	"address",
+	"group",
+	"match"
+]);
+const COMPARISON_CONDITION_KINDS = new Set([
+	"eq",
+	"ne",
+	"lt",
+	"lte",
+	"gt",
+	"gte"
+]);
+function isPlainValue(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function operandProblem(value, capabilityScope, budget) {
+	budget.nodes -= 1;
+	if (budget.nodes < 0) return `condition exceeds 100 nodes`;
+	if (!isPlainValue(value)) return "operand must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return "operand must have exactly one of attr or lit";
+	if (keys[0] === "attr") {
+		const attr = value.attr;
+		if (typeof attr !== "string" || attr.length === 0) return "attr must be a non-empty string";
+		if (capabilityScope !== void 0 && capabilityScope !== "*" && attr.startsWith("doc.")) {
+			const pathScope = attr.split(".")[1] ?? "";
+			if (pathScope !== capabilityScope) return `condition path "${attr}" reads scope "${pathScope}" but the capability covers only scope "${capabilityScope}"`;
+		}
+		return null;
+	}
+	if (keys[0] === "lit") {
+		const lit = value.lit;
+		if (lit !== null && typeof lit !== "string" && typeof lit !== "number" && typeof lit !== "boolean") return "lit must be a string, number, boolean, or null";
+		if (typeof lit === "number" && !Number.isFinite(lit)) return "lit must be a finite number";
+		if (typeof lit === "number" && Object.is(lit, -0)) return "lit must not be negative zero";
+		return null;
+	}
+	return `unknown operand kind "${keys[0]}"`;
+}
+function conditionProblem(value, capabilityScope, depth, budget) {
+	if (depth > 10) return `condition exceeds depth 10`;
+	budget.nodes -= 1;
+	if (budget.nodes < 0) return `condition exceeds 100 nodes`;
+	if (!isPlainValue(value)) return "condition must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return "condition must have exactly one operator";
+	const kind = keys[0];
+	const body = value[kind];
+	if (COMPARISON_CONDITION_KINDS.has(kind)) {
+		if (!Array.isArray(body) || body.length !== 2) return `${kind} requires a pair of operands`;
+		for (const operand of body) {
+			const problem = operandProblem(operand, capabilityScope, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "in" || kind === "notIn") {
+		if (!Array.isArray(body) || body.length !== 2 || !Array.isArray(body[1])) return `${kind} requires an operand and an operand list`;
+		const first = operandProblem(body[0], capabilityScope, budget);
+		if (first !== null) return first;
+		for (const operand of body[1]) {
+			const problem = operandProblem(operand, capabilityScope, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "exists") return operandProblem(body, capabilityScope, budget);
+	if (kind === "and" || kind === "or") {
+		if (!Array.isArray(body)) return `${kind} requires a condition list`;
+		for (const child of body) {
+			const problem = conditionProblem(child, capabilityScope, depth + 1, budget);
+			if (problem !== null) return problem;
+		}
+		return null;
+	}
+	if (kind === "not") return conditionProblem(body, capabilityScope, depth + 1, budget);
+	return `unknown condition operator "${kind}"`;
+}
+function principalProblem(value, capabilityScope) {
+	if (!isPlainValue(value)) return "principal must be an object";
+	const keys = Object.keys(value);
+	if (keys.length !== 1 || !PRINCIPAL_KINDS.has(keys[0])) return "principal must have exactly one of anyone, address, group, or match";
+	const kind = keys[0];
+	if (kind === "anyone" && value.anyone !== true) return "anyone must be true";
+	if (kind === "address") {
+		const address = value.address;
+		if (typeof address !== "string" || address.length === 0) return "address must be a non-empty string";
+	}
+	if (kind === "group") {
+		const group = value.group;
+		if (typeof group !== "string" || group.length === 0) return "group must be a non-empty string";
+	}
+	if (kind === "match") return conditionProblem(value.match, capabilityScope, 1, { nodes: 100 });
+	return null;
+}
+function capabilityProblem(value) {
+	if (!isPlainValue(value)) return "capability must be an object";
+	const can = value.can;
+	if (can !== "read" && can !== "execute") return "capability.can must be read or execute";
+	const allowedKeys = can === "execute" ? [
+		"can",
+		"scope",
+		"operation"
+	] : ["can", "scope"];
+	const unknownKeys = Object.keys(value).filter((key) => !allowedKeys.includes(key)).sort();
+	if (unknownKeys.length > 0) return `unknown capability key "${unknownKeys[0]}"`;
+	if (value.scope !== void 0) {
+		if (typeof value.scope !== "string" || value.scope.length === 0) return "capability.scope must be a non-empty string";
+	}
+	if (can === "execute" && value.operation !== void 0) {
+		const operation = value.operation;
+		if (!Array.isArray(operation)) return "capability.operation must be an array";
+		if (operation.length > 100) return `capability.operation exceeds 100 entries`;
+		for (const entry of operation) if (typeof entry !== "string" || entry.length === 0) return "capability.operation entries must be non-empty strings";
+	}
+	return null;
+}
+/** Returns the first v1-rule violation, or null. Pure, total, deterministic. */
+function grantProblem(value) {
+	if (!isPlainValue(value)) return "grant must be an object";
+	const unknownKeys = Object.keys(value).filter((key) => !GRANT_KEYS.has(key)).sort();
+	if (unknownKeys.length > 0) return `unknown grant key "${unknownKeys[0]}"`;
+	if (typeof value.id !== "string" || value.id.length === 0) return "id must be a non-empty string";
+	if (typeof value.description !== "string") return "description must be a string";
+	if (value.effect !== "allow" && value.effect !== "deny") return "effect must be allow or deny";
+	const capabilityValue = value.capability;
+	const capability = capabilityProblem(capabilityValue);
+	if (capability !== null) return capability;
+	const capabilityScope = capabilityValue.scope;
+	const principal = principalProblem(value.principal, capabilityScope);
+	if (principal !== null) return principal;
+	if (value.where !== void 0) return conditionProblem(value.where, capabilityScope, 1, { nodes: 100 });
+	return null;
+}
+const GrantSchema = () => z.custom((value) => grantProblem(value) === null);
+/** V1 shape rules plus the group-document group-principal ban. */
+function assertValidGrant(grant, documentType) {
+	const grantId = isPlainValue(grant) && typeof grant.id === "string" ? grant.id : "";
+	const problem = grantProblem(grant);
+	if (problem !== null) throw new InvalidGrantError(grantId, problem);
+	if (documentType === "powerhouse/reactor-group" && "group" in grant.principal) throw new GroupPrincipalNotAllowedError(grantId);
+}
+/**
+* Validates an initial grant list: the count cap, every grant, and — on a
+* creator-less policy — that some grant keeps the auth scope administrable.
+*/
+function assertValidInitialGrants(grants, documentType, creator) {
+	if (grants.length > 100) throw new InvalidGrantError("", `policy exceeds 100 grants`);
+	for (const grant of grants) assertValidGrant(grant, documentType);
+	if (creator === void 0 && !administrationReachable(grants)) throw new AuthAdministrationMissingError();
+}
+/**
+* Validates a grant upsert: the grant itself, the count cap on append, and
+* administration retention. Retention is checked on an append as well as an
+* in-place replace, because a grant appended after the administration grant can
+* shadow it (evaluation is last-applicable-grant-wins) and so take
+* administration away without removing anything.
+*/
+function assertValidGrantUpsert(grant, existing, documentType, creator) {
+	assertValidGrant(grant, documentType);
+	const exists = existing.some((g) => g.id === grant.id);
+	if (!exists && existing.length >= 100) throw new InvalidGrantError(grant.id, `policy exceeds 100 grants`);
+	assertAuthAdministrationRetained(creator, existing, exists ? existing.map((g) => g.id === grant.id ? grant : g) : [...existing, grant], grant.id);
+}
+/**
+* The request whose coverage keeps a policy administrable: a subject who may
+* SET_GRANT can upsert any grant, so every other repair stays reachable.
+*/
+const AUTH_ADMINISTRATION_REQUEST = {
+	verb: "execute",
+	scope: "auth",
+	operation: "SET_GRANT"
+};
+/**
+* Whether some subject can still administer the auth scope under this grant
+* list.
+*
+* Answers exactly what asking {@link evaluateGrantStack} per candidate grant
+* answered, in one reverse pass instead of one full stack scan per candidate.
+* Evaluation is last-applicable-grant-wins, so scanning from the end meets each
+* subject's deciding grant first: an anyone grant decides every subject not
+* already decided, and an allow reached that way is itself a grant that carries
+* administration. Only anyone and address principals are candidates, because
+* those are the ones v1 can match with no groups and no condition context; a
+* `where` condition or a group or match principal never applies.
+*/
+function administrationReachable(grants) {
+	const shadowedAddresses = /* @__PURE__ */ new Set();
+	for (let index = grants.length - 1; index >= 0; index -= 1) {
+		const grant = grants[index];
+		if (grant.where !== void 0 || !grantAnswers(grant, AUTH_ADMINISTRATION_REQUEST)) continue;
+		const allows = grant.effect === "allow";
+		if ("anyone" in grant.principal) return allows;
+		if (!("address" in grant.principal)) continue;
+		const address = grant.principal.address.toLowerCase();
+		if (shadowedAddresses.has(address)) continue;
+		if (allows) return true;
+		shadowedAddresses.add(address);
+	}
+	return false;
+}
+/**
+* A creator-less policy must always retain a grant permitting execute on the
+* auth scope; on a signed document the creator carve-out keeps administration
+* reachable instead. Rejects a change that takes the last such grant away. A
+* policy already without one is left alone: the change is not what locks it.
+*/
+function assertAuthAdministrationRetained(creator, previous, next, grantId) {
+	if (creator !== void 0) return;
+	if (administrationReachable(previous) && !administrationReachable(next)) throw new AuthAdministrationLockoutError(grantId);
+}
+/**
+* An operand whose shape validation would have rejected. Distinguished from
+* an unresolved path so a structurally malformed operand poisons its whole
+* condition to false rather than reading as "absent", which `not` would
+* otherwise widen to true.
+*/
+const INVALID_OPERAND = Symbol("invalid-operand");
+/**
+* Narrows to the values conditions compare. An object, array, or non-finite
+* number resolves to undefined, and every comparison involving undefined is
+* false.
+*/
+function asConditionValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+}
+/**
+* Resolves one operand. Attr roots: `subject.*`, `doc.<scope>.*` where the
+* scope must be the executing scope (validation already rejects any other,
+* but resolution stays total), and `action.input.*`. Path steps read own
+* properties only, so prototype members can never influence a verdict.
+*/
+function resolveOperand(operand, subject, request, conditions) {
+	if (!isPlainValue(operand)) return INVALID_OPERAND;
+	const keys = Object.keys(operand);
+	if (keys.length !== 1) return INVALID_OPERAND;
+	if (keys[0] === "lit") {
+		const value = asConditionValue(operand.lit);
+		return value === void 0 ? INVALID_OPERAND : value;
+	}
+	if (keys[0] !== "attr") return INVALID_OPERAND;
+	const attr = operand.attr;
+	if (typeof attr !== "string" || attr.length === 0) return INVALID_OPERAND;
+	const path = attr.split(".");
+	let value;
+	let rest;
+	if (path[0] === "subject") {
+		value = subject;
+		rest = path.slice(1);
+	} else if (path[0] === "doc") {
+		if (path[1] !== request.scope) return;
+		value = conditions.scopeState;
+		rest = path.slice(2);
+	} else if (path[0] === "action" && path[1] === "input") {
+		value = conditions.actionInput;
+		rest = path.slice(2);
+	} else return;
+	for (const segment of rest) {
+		if (!isPlainValue(value) || !Object.hasOwn(value, segment)) return;
+		value = value[segment];
+	}
+	return asConditionValue(value);
+}
+/**
+* Total order within one type: numbers numerically, strings by code point.
+* Everything else, including mixed types, does not order.
+*/
+function compareValues(left, right) {
+	if (typeof left === "number" && typeof right === "number") return left < right ? -1 : left > right ? 1 : 0;
+	if (typeof left === "string" && typeof right === "string") {
+		const leftPoints = Array.from(left);
+		const rightPoints = Array.from(right);
+		const shared = Math.min(leftPoints.length, rightPoints.length);
+		for (let i = 0; i < shared; i++) {
+			const a = leftPoints[i].codePointAt(0) ?? 0;
+			const b = rightPoints[i].codePointAt(0) ?? 0;
+			if (a !== b) return a < b ? -1 : 1;
+		}
+		return leftPoints.length === rightPoints.length ? 0 : leftPoints.length < rightPoints.length ? -1 : 1;
+	}
+}
+/**
+* Tri-state evaluation: undefined marks a structurally invalid node, which
+* poisons the whole tree to false at the top — and a structurally malformed
+* operand poisons its condition the same way. Both are distinct from an
+* operand whose path fails to resolve, which is a valid comparison that is
+* false. The distinction keeps `not` from widening over malformed input.
+*/
+function evaluateNode(node, subject, request, conditions) {
+	if (!isPlainValue(node)) return;
+	const keys = Object.keys(node);
+	if (keys.length !== 1) return;
+	const kind = keys[0];
+	const body = node[kind];
+	switch (kind) {
+		case "eq":
+		case "ne":
+		case "lt":
+		case "lte":
+		case "gt":
+		case "gte": {
+			if (!Array.isArray(body) || body.length !== 2) return;
+			const left = resolveOperand(body[0], subject, request, conditions);
+			const right = resolveOperand(body[1], subject, request, conditions);
+			if (left === INVALID_OPERAND || right === INVALID_OPERAND) return;
+			if (left === void 0 || right === void 0) return false;
+			if (kind === "eq") return left === right;
+			if (kind === "ne") return left !== right;
+			const order = compareValues(left, right);
+			if (order === void 0) return false;
+			switch (kind) {
+				case "lt": return order < 0;
+				case "lte": return order <= 0;
+				case "gt": return order > 0;
+				case "gte": return order >= 0;
+			}
+			return;
+		}
+		case "in":
+		case "notIn": {
+			if (!Array.isArray(body) || body.length !== 2 || !Array.isArray(body[1])) return;
+			const left = resolveOperand(body[0], subject, request, conditions);
+			if (left === INVALID_OPERAND) return;
+			const elements = body[1].map((element) => resolveOperand(element, subject, request, conditions));
+			if (elements.some((value) => value === INVALID_OPERAND)) return;
+			if (left === void 0) return false;
+			const found = elements.some((value) => value !== void 0 && value === left);
+			return kind === "in" ? found : !found;
+		}
+		case "exists": {
+			const value = resolveOperand(body, subject, request, conditions);
+			if (value === INVALID_OPERAND) return;
+			return value !== void 0;
+		}
+		case "and":
+		case "or": {
+			if (!Array.isArray(body)) return;
+			let result = kind === "and";
+			for (const child of body) {
+				const value = evaluateNode(child, subject, request, conditions);
+				if (value === void 0) return;
+				if (kind === "and") result = result && value;
+				else result = result || value;
+			}
+			return result;
+		}
+		case "not": {
+			const value = evaluateNode(body, subject, request, conditions);
+			return value === void 0 ? void 0 : !value;
+		}
+		default: return;
+	}
+}
+/**
+* Evaluates a version-1 condition. Deterministic, total, and pure: any input
+* shape yields a boolean and never throws, and a malformed condition is
+* false. These are consensus semantics, versioned by `PHAuthState.version`;
+* changing them requires a new version.
+*/
+function evaluateCondition(condition, subject, request, conditions) {
+	return evaluateNode(condition, subject, request, conditions) === true;
+}
+/** Whether a capability's scope reaches the requested one. */
+function scopeCovers(scope, requested) {
+	return scope === void 0 || scope === "*" || scope === requested;
+}
+/**
+* Whether one grant answers this request.
+*
+* A grant allowing execute on a scope also allows reading it: executing an
+* operation means reading the state it applies to, so permitting the write while
+* withholding the read would describe an access nobody could use. The converse
+* does not hold -- a read grant confers no write.
+*
+* Only an allow carries across. A deny on execute withholds the write and says
+* nothing about the read, so a policy locking writes down does not silently
+* revoke a read grant sitting before it. The operation list is not consulted
+* either: it restricts which operations may be executed, not whether the scope
+* is visible, and a read carries no operation to match against.
+*
+* Reads are not consensus -- no replica records a read, and the two read call
+* sites are both inside the read gate -- so this rule is not part of what makes
+* an operation valid, and does not need a policy version of its own.
+*/
+function grantAnswers(grant, request) {
+	if (capabilityCovers(grant.capability, request)) return true;
+	return request.verb === "read" && grant.effect === "allow" && grant.capability.can === "execute" && scopeCovers(grant.capability.scope, request.scope);
+}
+function capabilityCovers(capability, request) {
+	if (capability.can !== request.verb) return false;
+	if (!scopeCovers(capability.scope, request.scope)) return false;
+	if (capability.can === "execute") {
+		if (capability.operation === void 0) return true;
+		return request.operation !== void 0 && capability.operation.includes(request.operation);
+	}
+	return true;
+}
+function principalMatches(principal, subject, request, groups, conditions) {
+	if ("anyone" in principal) return true;
+	if ("address" in principal) return subject.address !== void 0 && subject.address.toLowerCase() === principal.address.toLowerCase();
+	if ("group" in principal) {
+		if (groups === void 0 || subject.address === void 0) return false;
+		const group = groups[principal.group];
+		if (group === void 0 || !Array.isArray(group.members)) return false;
+		const address = subject.address.toLowerCase();
+		return group.members.some((member) => member.toLowerCase() === address);
+	}
+	if ("match" in principal) {
+		if (conditions === void 0) return false;
+		return evaluateCondition(principal.match, subject, request, conditions);
+	}
+	return false;
+}
+/**
+* The group document ids named by `{ group }` principals in a grant list, in
+* order of first appearance. These are the streams the groups projection reads.
+*/
+function referencedGroupIds(grants) {
+	const ids = [];
+	for (const grant of grants) if ("group" in grant.principal && !ids.includes(grant.principal.group)) ids.push(grant.principal.group);
+	return ids;
+}
+/**
+* Evaluates a v1 grant stack: default deny, last applicable grant wins, and
+* reports which grant decided it. Group principals match only against a
+* supplied groups map, and `where` clauses and { match } principals evaluate
+* only against a supplied condition context; a grant that uses an unsupplied
+* feature never applies.
+*/
+function evaluateGrantStack(grants, subject, request, groups, conditions) {
+	let applicable;
+	for (const grant of grants) {
+		if (grant.where !== void 0) {
+			if (conditions === void 0) continue;
+			if (!evaluateCondition(grant.where, subject, request, conditions)) continue;
+		}
+		if (grantAnswers(grant, request) && principalMatches(grant.principal, subject, request, groups, conditions)) applicable = grant;
+	}
+	if (applicable === void 0) return {
+		decision: "deny",
+		refusal: "no-applicable-grant"
+	};
+	if (applicable.effect === "deny") return {
+		decision: "deny",
+		refusal: "denied-by-grant",
+		grantId: applicable.id
+	};
+	return { decision: "allow" };
+}
+/**
+* Evaluates a v1 grant stack: default deny, last applicable grant wins. This is
+* {@link evaluateGrantStack} with the reason dropped.
+*/
+function evaluateGrants(grants, subject, request, groups, conditions) {
+	return evaluateGrantStack(grants, subject, request, groups, conditions).decision;
+}
+//#endregion
 //#region document-model/constants.ts
 const documentModelFileExtension = "phdm";
 const documentModelInitialLocalState = {};
@@ -1436,8 +2241,403 @@ const HASH_ALGORITHM_SHA512 = "sha512";
 const HASH_ENCODING_BASE64 = "base64";
 const HASH_ENCODING_HEX = "hex";
 //#endregion
-//#region document-model/document-type.ts
-const documentModelDocumentType = "powerhouse/document-model";
+//#region document-model/state.ts
+/**
+* Creates a default PHAuthState
+*/
+function defaultAuthState() {
+	return {
+		version: 0,
+		grants: []
+	};
+}
+/**
+* Creates a default PHDocumentState
+*/
+function defaultDocumentState() {
+	return {
+		version: 0,
+		hash: {
+			algorithm: HASH_ALGORITHM_SHA1,
+			encoding: HASH_ENCODING_BASE64
+		}
+	};
+}
+/**
+* Creates a default PHBaseState with auth and document properties
+*/
+function defaultBaseState() {
+	return {
+		auth: defaultAuthState(),
+		document: defaultDocumentState()
+	};
+}
+/**
+* Creates a PHAuthState with the given properties
+*/
+function createAuthState(auth) {
+	return {
+		...defaultAuthState(),
+		...auth
+	};
+}
+/**
+* Creates a PHDocumentState with the given properties
+*/
+function createDocumentState(document) {
+	return {
+		...defaultDocumentState(),
+		...document
+	};
+}
+/**
+* Creates a PHBaseState with the given auth and document properties
+*/
+function createBaseState(auth, document) {
+	return {
+		auth: createAuthState(auth),
+		document: createDocumentState(document)
+	};
+}
+/**
+* Backfills the auth scope to the default for legacy documents serialized with
+* an empty `auth`. Replaces only `state.auth`. Idempotent.
+*/
+function backfillAuthState(state) {
+	return {
+		...state,
+		auth: createAuthState(state.auth)
+	};
+}
+function defaultGlobalState() {
+	return {
+		...defaultBaseState(),
+		author: {
+			name: "",
+			website: ""
+		},
+		description: "",
+		extension: "",
+		id: "",
+		name: "",
+		specifications: []
+	};
+}
+function defaultLocalState() {
+	return {};
+}
+function defaultPHState() {
+	return {
+		...defaultBaseState(),
+		global: defaultGlobalState(),
+		local: defaultLocalState()
+	};
+}
+function createGlobalState(state) {
+	return {
+		...defaultGlobalState(),
+		...state || {}
+	};
+}
+function createLocalState(state) {
+	return {
+		...defaultLocalState(),
+		...state || {}
+	};
+}
+function createState(baseState, globalState, localState) {
+	return {
+		...createBaseState(baseState?.auth, baseState?.document),
+		global: createGlobalState(globalState),
+		local: createLocalState(localState)
+	};
+}
+//#endregion
+//#region document-model/auth.ts
+const AUTH_ACTION_TYPES = [
+	"INITIALIZE_AUTH",
+	"SET_GRANT",
+	"REMOVE_GRANT",
+	"MOVE_GRANT"
+];
+function isAuthAction(action) {
+	return AUTH_ACTION_TYPES.includes(action.type);
+}
+/** Highest known policy version; decide() fails closed above it. */
+const MAX_SUPPORTED_AUTH_VERSION = 1;
+const InitializeAuthActionInputSchema = () => z.object({
+	version: z.number().int().min(1),
+	grants: z.array(GrantSchema()).max(100)
+});
+const SetGrantActionInputSchema = () => z.object({ grant: GrantSchema() });
+const RemoveGrantActionInputSchema = () => z.object({ id: z.string() });
+const MoveGrantActionInputSchema = () => z.object({
+	id: z.string(),
+	index: z.number()
+});
+const initializeAuth = (input) => createAction("INITIALIZE_AUTH", input, void 0, InitializeAuthActionInputSchema, "auth");
+const setGrant = (input) => createAction("SET_GRANT", input, void 0, SetGrantActionInputSchema, "auth");
+const removeGrant = (input) => createAction("REMOVE_GRANT", input, void 0, RemoveGrantActionInputSchema, "auth");
+const moveGrant = (input) => createAction("MOVE_GRANT", input, void 0, MoveGrantActionInputSchema, "auth");
+/**
+* Destructuring a null input (reachable via raw synced operations) would
+* store an engine-specific TypeError message on the error operation.
+*/
+function assertActionInputShape(input) {
+	if (!isPlainValue(input)) throw new InvalidActionInputError({ input: "must be an object" });
+}
+function withGrants(document, grants) {
+	return {
+		...document,
+		state: {
+			...document.state,
+			auth: {
+				...document.state.auth,
+				grants
+			}
+		}
+	};
+}
+const P256_PUBKEY_MULTICODEC = [128, 36];
+const DID_KEY_PREFIX = "did:key:z";
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+/**
+* True when `signerKey` (an ActionSigner app key, a did:key) identifies the same
+* key recorded as the document creator. Returns false
+* when there is no creator (empty JWK) or no signer key.
+*/
+function isDocumentCreator(creatorKey, signerKey) {
+	if (!creatorKey?.x || !creatorKey.y) return false;
+	if (!signerKey || !signerKey.startsWith(DID_KEY_PREFIX)) return false;
+	const decoded = base58Decode(signerKey.slice(9));
+	if (!decoded || decoded.length !== 35) return false;
+	if (decoded[0] !== P256_PUBKEY_MULTICODEC[0] || decoded[1] !== P256_PUBKEY_MULTICODEC[1]) return false;
+	const parityPrefix = decoded[2];
+	if (parityPrefix !== 2 && parityPrefix !== 3) return false;
+	const didX = decoded.subarray(3, 35);
+	const jwkX = base64UrlToBytes(creatorKey.x);
+	const jwkY = base64UrlToBytes(creatorKey.y);
+	if (jwkX.length !== 32 || jwkY.length !== 32) return false;
+	if (!bytesEqual(didX, jwkX)) return false;
+	return (jwkY[31] & 1) === 1 === (parityPrefix === 3);
+}
+/**
+* Sets the initial policy. Valid only while the auth scope is uninitialized
+* (version 0). The input version is the policy language version and must be an
+* integer >= 1; 0 is reserved for the uninitialized state. On a signed-header
+* document it must be signed by the document creator (`header.sig.publicKey`).
+* A creator-less policy must include a grant permitting execute on the auth
+* scope, or it would be born locked out.
+*/
+function applyInitializeAuthAction(document, action) {
+	assertActionInputShape(action.input);
+	const { version, grants } = action.input;
+	if (!Number.isInteger(version) || version < 1) throw new InvalidAuthVersionError(document.header.id, version);
+	if (document.state.auth.version !== 0) throw new AuthAlreadyInitializedError(document.header.id);
+	if (!Array.isArray(grants)) throw new InvalidActionInputError({ grants: "must be an array" });
+	const creatorKey = document.header.sig.publicKey;
+	const signerKey = action.context?.signer?.app.key;
+	const hasCreator = Boolean(creatorKey.kty || creatorKey.x || creatorKey.y);
+	if (hasCreator && !isDocumentCreator(creatorKey, signerKey)) throw new AuthInitializerNotCreatorError(document.header.id);
+	const creator = hasCreator ? signerKey : void 0;
+	assertValidInitialGrants(grants, document.header.documentType, creator);
+	return {
+		...document,
+		state: {
+			...document.state,
+			auth: createAuthState(creator ? {
+				version,
+				grants,
+				creator
+			} : {
+				version,
+				grants
+			})
+		}
+	};
+}
+/** Upserts a grant by id: replaces in place if present, otherwise appends. */
+function applySetGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { grant } = action.input;
+	const grants = document.state.auth.grants;
+	assertValidGrantUpsert(grant, grants, document.header.documentType, document.state.auth.creator);
+	return withGrants(document, grants.some((g) => g.id === grant.id) ? grants.map((g) => g.id === grant.id ? grant : g) : [...grants, grant]);
+}
+/**
+* Removes a grant by id; throws if the id is not present or if the removal
+* would leave a creator-less policy with no auth-administration grant.
+*/
+function applyRemoveGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { id } = action.input;
+	const { grants, creator } = document.state.auth;
+	if (!grants.some((g) => g.id === id)) throw new GrantNotFoundError(id);
+	const next = grants.filter((g) => g.id !== id);
+	assertAuthAdministrationRetained(creator, grants, next, id);
+	return withGrants(document, next);
+}
+/**
+* Moves a grant by id to a new index. Order is load-bearing (the last
+* applicable grant wins), so the relative order of the other grants is kept.
+* The target index is clamped to the valid range; an unknown id throws.
+*
+* Order alone decides which grant wins, so a move can take administration away
+* without changing the list's contents. It carries the same retention rule as
+* the two mutation paths.
+*/
+function applyMoveGrantAction(document, action) {
+	assertActionInputShape(action.input);
+	const { id, index } = action.input;
+	const { grants, creator } = document.state.auth;
+	const from = grants.findIndex((g) => g.id === id);
+	if (from === -1) throw new GrantNotFoundError(id);
+	const next = [...grants];
+	const [moved] = next.splice(from, 1);
+	const to = Math.max(0, Math.min(index, next.length));
+	next.splice(to, 0, moved);
+	assertAuthAdministrationRetained(creator, grants, next, id);
+	return withGrants(document, next);
+}
+/**
+* Dispatches an auth-scope action to its handler. This is the auth scope's
+* dedicated reducer: it is applied by the base reducer instead of the model
+* reducer, mirroring the document-scope platform handlers. Unknown types are a
+* no-op, matching the model-reducer default.
+*/
+function applyAuthAction(document, action) {
+	switch (action.type) {
+		case "INITIALIZE_AUTH": return applyInitializeAuthAction(document, action);
+		case "SET_GRANT": return applySetGrantAction(document, action);
+		case "REMOVE_GRANT": return applyRemoveGrantAction(document, action);
+		case "MOVE_GRANT": return applyMoveGrantAction(document, action);
+		default: return document;
+	}
+}
+/**
+* Because only creators can initialize auth scopes, we must verify that either
+* the document has no auth or the version and creator match.
+*/
+function assertAuthPreservedOnDuplicate(documentId, source, duplicated) {
+	if (!source || source.version === 0) return;
+	if (duplicated === void 0 || duplicated.version !== source.version || duplicated.creator !== source.creator) throw new AuthPolicyNotPreservedError(documentId);
+}
+/**
+* The auth scope a state snapshot may install, given the policy already there.
+*
+* `applyAuthAction` is the validated door onto `state.auth`, but a whole-state
+* snapshot (UPGRADE_DOCUMENT's `initialState`, LOAD_STATE's `data`) replaces the
+* scope wholesale and is authorized as a `document`-scope write. Without this,
+* a subject holding `execute` on `document` and no auth grant at all can install
+* a policy of its choosing, name itself `creator` (which exempts the policy from
+* the retention rule for good), or wipe an existing policy by carrying the
+* default uninitialized one.
+*
+* Three cases:
+*
+*   - the snapshot carries no policy, or an uninitialized one: the document
+*     keeps the policy it has, so a default-state upgrade cannot reset it;
+*   - the document is uninitialized and the snapshot carries a policy: the
+*     policy is installed after the same validation genesis applies, so it
+*     cannot be born locked out;
+*   - both carry a policy: they must agree. A duplicate preserves its source's
+*     policy (see {@link assertAuthPreservedOnDuplicate}), and anything else is
+*     an attempt to replace one policy with another.
+*/
+function resolveSnapshotAuth(documentId, documentType, current, incoming) {
+	const currentAuth = current ?? createAuthState({
+		version: 0,
+		grants: []
+	});
+	if (!incoming || !incoming.version) return currentAuth;
+	if (currentAuth.version !== 0) {
+		if (stringify(incoming) !== stringify(currentAuth)) throw new AuthPolicyNotPreservedError(documentId);
+		return incoming;
+	}
+	if (!Array.isArray(incoming.grants)) throw new InvalidActionInputError({ grants: "must be an array" });
+	assertValidInitialGrants(incoming.grants, documentType, incoming.creator);
+	return incoming;
+}
+/** UNDO, REDO and PRUNE are rejected on the auth scope. */
+function assertAuthScopeActionAllowed(action) {
+	if (action.scope === "auth" && [
+		"UNDO",
+		"REDO",
+		"PRUNE"
+	].includes(action.type)) throw new AuthActionNotAllowedError(action.type);
+}
+/**
+* Evaluates the auth policy for a single request and reports why it refused.
+* Pure and deterministic.
+*
+* An uninitialized policy (version 0, absent auth state, or a legacy `{}`
+* auth scope serialized before PHAuthState had a version) leaves the document
+* open. Once a policy exists the default is deny, and grants stack in order.
+*
+* Group principals match only against a supplied groups map (the groups
+* projection, present when authGroups is on); with no map they never apply.
+* `where` clauses and { match } principals likewise evaluate only against a
+* supplied condition context (present when authConditions is on).
+*/
+function evaluate(auth, subject, request, groups, conditions) {
+	if (!auth || !auth.version) return { decision: "allow" };
+	if (request.verb === "execute" && request.scope === "auth" && subject.key !== void 0 && subject.key === auth.creator) return { decision: "allow" };
+	if (auth.version > 1) return {
+		decision: "deny",
+		refusal: "version-unsupported"
+	};
+	return evaluateGrantStack(auth.grants, subject, request, groups, conditions);
+}
+/**
+* Evaluates the auth policy for a single request. Pure and deterministic. This
+* is {@link evaluate} with the reason dropped.
+*/
+function decide(auth, subject, request, groups, conditions) {
+	return evaluate(auth, subject, request, groups, conditions).decision;
+}
+/**
+* The group document ids a single auth action's input names with `{ group }`
+* principals. INITIALIZE_AUTH contributes the groups named across its grants,
+* SET_GRANT the groups named by its one grant; REMOVE_GRANT and MOVE_GRANT
+* contribute nothing. Total over any input shape, because references are read
+* from the input as it arrived, including inputs later stored as errors.
+*/
+function mentionedGroupIds(action) {
+	const input = action.input;
+	const candidates = [];
+	if (action.type === "INITIALIZE_AUTH" && Array.isArray(input?.grants)) candidates.push(...input.grants);
+	if (action.type === "SET_GRANT" && input?.grant !== void 0) candidates.push(input.grant);
+	const ids = [];
+	for (const candidate of candidates) {
+		if (typeof candidate !== "object" || candidate === null) continue;
+		const principal = candidate.principal;
+		if (typeof principal !== "object" || principal === null) continue;
+		const group = principal.group;
+		if (typeof group === "string" && group !== "" && !ids.includes(group)) ids.push(group);
+	}
+	return ids;
+}
+//#endregion
+//#region document-model/denied.ts
+/**
+* True iff authorization rejected the action.
+*/
+function isDenied(operation) {
+	return operation.deniedReason !== void 0;
+}
+/**
+* The closed set of strings persisted as `deniedReason`. Re-evaluation compares
+* them, so they are consensus data: exact strings that embed no grant id,
+* subject or timestamp. Changing one is history-visible.
+*/
+const DOCUMENT_DELETED_REASON = "document deleted";
+const AUTH_VERSION_UNSUPPORTED_REASON = "auth policy version unsupported";
+const AUTH_NO_GRANT_REASON = "no grant permits this operation";
+const AUTH_DENIED_BY_GRANT_REASON = "denied by grant";
 //#endregion
 //#region document-model/document-schema.ts
 const BaseDocumentHeaderSchema = z.object({
@@ -1710,6 +2910,7 @@ function createDocumentScopeOperations(header, state) {
 function baseCreateDocument(createState, initialState, documentType = "") {
 	const state = createState(initialState);
 	const header = createPresignedHeader(generateId(), documentType);
+	header.protocolVersions = { "base-reducer": 2 };
 	return {
 		header,
 		state,
@@ -1805,6 +3006,18 @@ function mapSkippedOperationsV2(operations) {
 * Uses the V2 model where consecutive NOOPs form chains.
 * Unlike V1 garbageCollect, this preserves ALL operations but marks which to apply.
 */
+/**
+* The base-reducer protocol version a document is written against. Every
+* document carries one, set from the CREATE_DOCUMENT input. A header without
+* one was built outside that path, and choosing a version on its behalf would
+* replay the document through a reducer it was not written for, so it is an
+* error rather than a default.
+*/
+function baseReducerVersion(header) {
+	const version = header.protocolVersions?.["base-reducer"];
+	if (typeof version !== "number") throw new Error(`Document ${header.id} carries no base-reducer protocol version`);
+	return version;
+}
 function garbageCollectV2(sortedOperations) {
 	const result = [];
 	let noopChainLength = 0;
@@ -1824,9 +3037,26 @@ function sortMappedOperations(operations) {
 const defaultCreateState = (state) => {
 	return state;
 };
+/**
+* Records an operation in the history without applying it, which is what a
+* denied operation needs: it occupies its index and contributes no state.
+*
+* The scope defaults to the action's own, and is passed explicitly by a rebuild
+* that is walking one stream and does not want to trust the action's copy.
+*/
+function appendWithoutApplying(document, operation, scope = operation.action.scope) {
+	return {
+		...document,
+		operations: {
+			...document.operations,
+			[scope]: [...document.operations[scope] ?? [], operation]
+		}
+	};
+}
 function replayDocument(initialState, operations, reducer, header, dispatch, skipHeaderOperations = {}, options) {
 	const { checkHashes = true, reuseOperationResultingState, operationResultingStateParser = parseResultingState, skipIndexValidation } = options || {};
-	let documentState = initialState;
+	const backfilledInitialState = backfillAuthState(initialState);
+	let documentState = backfilledInitialState;
 	const operationsToReplay = [];
 	const allScopes = new Set([
 		...Object.keys(operations),
@@ -1861,12 +3091,13 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 	const document = {
 		header,
 		state: defaultCreateState(documentState),
-		initialState,
+		initialState: backfilledInitialState,
 		operations: initialOperations,
 		clipboard: []
 	};
 	let result = document;
 	if (operationsToReplay.length) result = operationsToReplay.reduce((document, operation) => {
+		if (isDenied(operation)) return updateHeaderRevision(appendWithoutApplying(document, operation), operation.action.scope, operation.timestampUtcMs);
 		return reducer(document, operation.action, dispatch, {
 			ignoreSkipOperations: true,
 			checkHashes,
@@ -2390,14 +3621,31 @@ function redoOperation(document, action, skip) {
 	});
 }
 function loadStateOperation(document, action) {
+	const loaded = backfillAuthState(action.state.data);
+	loaded.auth = resolveSnapshotAuth(document.header.id, document.header.documentType, backfillAuthState({ ...document.state }).auth, loaded.auth);
 	return {
 		...document,
 		header: {
 			...document.header,
 			name: action.state.name
 		},
-		state: action.state.data
+		state: loaded
+	};
+}
+/**
+* Reads an operation's outcome. A denial takes precedence over a reducer
+* error, since a denied operation never reaches its reducer.
+*/
+function operationOutcome(operation) {
+	if (operation.deniedReason !== void 0) return {
+		kind: "denied",
+		reason: operation.deniedReason
+	};
+	if (operation.error !== void 0) return {
+		kind: "reducer-error",
+		message: operation.error
 	};
+	return { kind: "applied" };
 }
 //#endregion
 //#region document-model/reducer.ts
@@ -2572,12 +3820,13 @@ function processUndoOperation(document, scope, customReducer, reuseOperationResu
 function baseReducer(document, action, customReducer, dispatch, options = {}) {
 	const { skip, ignoreSkipOperations = false, reuseOperationResultingState = false, operationResultingStateParser, pruneOnSkip = true, branch = "main" } = options;
 	let _action = actionFromAction(action);
+	assertAuthScopeActionAllowed(_action);
 	let skipValue = skip ?? options.replayOptions?.operation.skip ?? 0;
 	let newDocument = { ...document };
 	let reuseLastOperationIndex = false;
 	const shouldProcessSkipOperation = !ignoreSkipOperations && skipValue > 0;
 	if (isUndoRedo(_action)) {
-		const { skip: calculatedSkip, action: transformedAction, document: processedDocument, reuseLastOperationIndex: reuseIndex } = processUndoRedo(document, _action, skipValue, options.protocolVersion ?? 1);
+		const { skip: calculatedSkip, action: transformedAction, document: processedDocument, reuseLastOperationIndex: reuseIndex } = processUndoRedo(document, _action, skipValue, options.protocolVersion ?? baseReducerVersion(document.header));
 		_action = transformedAction;
 		skipValue = calculatedSkip;
 		newDocument = processedDocument;
@@ -2593,7 +3842,7 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 		branch
 	};
 	newDocument = updateDocument(newDocument, _action, reuseLastOperationIndex, skipValue, operationContext, options.replayOptions?.operation, options.skipIndexValidation);
-	const protocolVersion = options.protocolVersion ?? 1;
+	const protocolVersion = options.protocolVersion ?? baseReducerVersion(document.header);
 	if (isUndo(action) && protocolVersion < 2) return processUndoOperation(newDocument, action.scope, customReducer);
 	const isNoopWithSkip = _action.type === "NOOP" && skipValue > 0;
 	if ((isUndo(action) || isNoopWithSkip) && protocolVersion >= 2) {
@@ -2619,6 +3868,13 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 	}
 	newDocument = create(newDocument, (draft) => {
 		try {
+			if (_action.scope === "auth") {
+				const authState = applyAuthAction(newDocument, _action).state;
+				unsafe(() => {
+					draft.state = castDraft(authState);
+				});
+				return;
+			}
 			const newState = customReducer(draft.state, _action, dispatch);
 			if (newState) unsafe(() => {
 				draft.state = castDraft(newState);
@@ -2648,8 +3904,8 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 		"PRUNE"
 	].includes(_action.type)) return newDocument;
 	const scope = _action.scope || "global";
-	let hash = hashDocumentStateForScope(newDocument, scope);
-	if (options.replayOptions?.operation.hash && options.replayOptions.operation.hash !== "") hash = options.replayOptions.operation.hash;
+	const replayHash = options.replayOptions?.operation.hash;
+	const hash = replayHash ? replayHash : hashDocumentStateForScope(newDocument, scope);
 	const lastOperation = newDocument.operations[scope]?.at(-1);
 	if (lastOperation) {
 		lastOperation.hash = hash;
@@ -3414,14 +4670,27 @@ const documentModelStateReducer = (state, action) => {
 const documentModelReducer = createReducer(documentModelStateReducer);
 //#endregion
 //#region document-model/upgrades.ts
+/**
+* Canonical document-model version normalization: documents stamped with 0
+* or nothing at all predate versioning and are treated as version 1, the
+* same version the registry assigns unversioned modules. Every consumer
+* that resolves a module or compares versions must use this rule; resolving
+* 0 to "latest" instead re-pins a legacy document's history to whichever
+* module happens to be newest.
+*/
+function normalizeDocumentModelVersion(version) {
+	return version && version > 0 ? version : 1;
+}
 function applyInitialState(document, action) {
 	const input = action.input;
 	const newState = input.initialState || input.state;
 	if (newState) {
-		document.state = {
+		const merged = backfillAuthState({
 			...document.state,
 			...newState
-		};
+		});
+		merged.auth = resolveSnapshotAuth(document.header.id, document.header.documentType, backfillAuthState({ ...document.state }).auth, merged.auth);
+		document.state = merged;
 		document.initialState = document.state;
 	}
 }
@@ -3483,7 +4752,6 @@ function computeUpgradeTransitions(manifest, fromVersion, toVersion) {
 }
 //#endregion
 //#region document-model/versioned-replay.ts
-const NON_DOMAIN_SCOPES$1 = new Set(["auth", "document"]);
 function highestReducerVersion(reducers) {
 	const keys = Object.keys(reducers).map(Number);
 	if (keys.length === 0) throw new Error("VersionedReplayConfig.reducers must not be empty");
@@ -3511,15 +4779,15 @@ function highestReducerVersion(reducers) {
 */
 function replayDocumentVersioned(initialState, operations, config, header, dispatch, options) {
 	const { checkHashes = true, skipIndexValidation } = options || {};
-	const protocolVersion = header.protocolVersions?.["base-reducer"] ?? 1;
+	const protocolVersion = baseReducerVersion(header);
 	const spine = (operations["document"] ?? []).slice().sort((a, b) => a.index - b.index);
 	const upgrades = spine.filter((op) => op.action.type === "UPGRADE_DOCUMENT");
 	const legacyFallback = () => {
-		const domainOps = Object.fromEntries(Object.entries(operations).filter(([s]) => !NON_DOMAIN_SCOPES$1.has(s)));
+		const replayOps = Object.fromEntries(Object.entries(operations).filter(([s]) => s !== "document"));
 		const latestVersion = highestReducerVersion(config.reducers);
 		const reducer = config.reducers[latestVersion];
 		return {
-			...replayDocument(initialState, domainOps, reducer, header, dispatch, {}, options),
+			...replayDocument(initialState, replayOps, reducer, header, dispatch, {}, options),
 			operations
 		};
 	};
@@ -3543,14 +4811,14 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		const a = op.action;
 		return a.input.fromVersion > 0 && a.input.fromVersion < a.input.toVersion;
 	});
-	const domainScopes = Object.keys(operations).filter((s) => !NON_DOMAIN_SCOPES$1.has(s));
+	const replayScopes = Object.keys(operations).filter((s) => s !== "document");
 	const scopeOps = {};
-	for (const s of domainScopes) scopeOps[s] = (operations[s] ?? []).slice().sort((a, b) => a.index - b.index);
+	for (const s of replayScopes) scopeOps[s] = (operations[s] ?? []).slice().sort((a, b) => a.index - b.index);
 	const boundaries = validatedUpgrades.map((upgradeOp) => {
 		const revisionSnapshot = upgradeOp.action.input.revision;
 		const upgradeTimestamp = upgradeOp.timestampUtcMs;
 		const boundary = {};
-		for (const s of domainScopes) {
+		for (const s of replayScopes) {
 			const ops = scopeOps[s] ?? [];
 			if (revisionSnapshot !== void 0) {
 				const rev = revisionSnapshot[s] ?? 0;
@@ -3568,7 +4836,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		}
 		return boundary;
 	});
-	for (let i = 1; i < boundaries.length; i++) for (const s of domainScopes) {
+	for (let i = 1; i < boundaries.length; i++) for (const s of replayScopes) {
 		const prev = boundaries[i - 1]?.[s] ?? 0;
 		const curr = boundaries[i]?.[s] ?? 0;
 		if (boundaries[i]) boundaries[i][s] = Math.max(prev, curr);
@@ -3580,10 +4848,11 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 	]);
 	const initialOperations = {};
 	for (const s of allScopes) initialOperations[s] = [];
+	const backfilledSeed = backfillAuthState(seedState);
 	let document = {
 		header,
-		state: seedState,
-		initialState: seedState,
+		state: backfilledSeed,
+		initialState: backfilledSeed,
 		operations: initialOperations,
 		clipboard: []
 	};
@@ -3591,17 +4860,15 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 	const segmentEndHashPerScope = /* @__PURE__ */ new Map();
 	for (let k = 0; k <= validatedUpgrades.length; k++) {
 		const reducer = config.reducers[currentVersion];
-		if (!reducer) {
-			const available = Object.keys(config.reducers).join(", ");
-			throw new Error(`No reducer registered for document version ${currentVersion}. Available versions: ${available}`);
-		}
-		for (const s of domainScopes) {
+		if (!reducer) throw new UnsupportedDocumentModelVersionError(header.documentType, currentVersion, Object.keys(config.reducers).map(Number).sort((a, b) => a - b));
+		for (const s of replayScopes) {
 			const ops = scopeOps[s] ?? [];
 			const segStart = k === 0 ? 0 : boundaries[k - 1]?.[s] ?? 0;
 			const segEnd = k < validatedUpgrades.length ? boundaries[k]?.[s] ?? ops.length : ops.length;
 			const segOps = ops.slice(segStart, segEnd);
 			for (const op of segOps) {
-				document = reducer(document, op.action, dispatch, {
+				if (isDenied(op)) document = updateHeaderRevision(appendWithoutApplying(document, op, s), s, op.timestampUtcMs);
+				else document = reducer(document, op.action, dispatch, {
 					ignoreSkipOperations: true,
 					checkHashes,
 					skipIndexValidation,
@@ -3618,6 +4885,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			if (!spineOp) continue;
 			const spineActionType = spineOp.action.type;
 			if (spineActionType === "CREATE_DOCUMENT" || spineActionType === "UPGRADE_DOCUMENT") continue;
+			if (isDenied(spineOp)) continue;
 			if (spineActionType === "DELETE_DOCUMENT") document = applyDeleteDocumentAction(document, spineOp.action);
 			else document = reducer(document, spineOp.action, dispatch, {
 				ignoreSkipOperations: true,
@@ -3648,7 +4916,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		}
 	};
 	if (!checkHashes) {
-		const allReplayedOps = domainScopes.flatMap((s) => scopeOps[s] ?? []);
+		const allReplayedOps = replayScopes.flatMap((s) => scopeOps[s] ?? []);
 		for (const scope of Object.keys(document.state)) {
 			const capturedHash = segmentEndHashPerScope.get(scope);
 			const scopeHash = capturedHash !== void 0 ? capturedHash : hashDocumentStateForScope(document, scope);
@@ -3692,7 +4960,6 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 }
 //#endregion
 //#region document-model/files.ts
-const NON_DOMAIN_SCOPES = new Set(["auth", "document"]);
 function zipAsync(data) {
 	return new Promise((resolve, reject) => {
 		zip(data, (err, out) => err ? reject(err) : resolve(out));
@@ -3799,7 +5066,7 @@ async function parseZipData(data) {
 async function loadFromZipData(data, reducer, options) {
 	const { initialState, header, clearedOperations } = await parseZipData(data);
 	return {
-		...replayDocument(initialState, Object.fromEntries(Object.entries(clearedOperations).filter(([scope]) => !NON_DOMAIN_SCOPES.has(scope))), reducer, header, void 0, {}, options),
+		...replayDocument(initialState, Object.fromEntries(Object.entries(clearedOperations).filter(([scope]) => scope !== "document")), reducer, header, void 0, {}, options),
 		operations: clearedOperations
 	};
 }
@@ -3816,6 +5083,42 @@ async function baseLoadFromInput(input, reducer, options) {
 async function baseLoadFromInputVersioned(input, config, options) {
 	return loadFromZipDataVersioned(await toUint8Array(input), config, options);
 }
+/**
+* Whether this zip is a single Powerhouse document: the document's four JSON
+* entries (header/state/current-state/operations) at the archive root. A
+* bulk archive has a folder tree instead. Returns false for any input that
+* is not a readable zip.
+*/
+async function isDocumentZip(data) {
+	let files;
+	try {
+		files = await unzipAsync(data);
+	} catch {
+		return false;
+	}
+	return Boolean(files["header.json"]) && Boolean(files["state.json"]) && Boolean(files["operations.json"]);
+}
+/**
+* The file entries of a zip (directory entries excluded). Used for bulk
+* archives; throws when the archive holds no files. Note this does NOT
+* validate that the entries are document zips — pair with isDocumentZip.
+*/
+async function parseBulkArchive(data) {
+	const files = await unzipAsync(data);
+	const entries = Object.entries(files).filter(([name]) => !name.endsWith("/")).map(([path, value]) => ({
+		path,
+		data: value
+	}));
+	if (entries.length === 0) throw new Error("Archive contains no files");
+	return entries;
+}
+/**
+* Assemble a zip from raw entries. A key ending in "/" with empty data is a
+* directory entry, so an archive's folder structure survives a round-trip.
+*/
+async function zipEntries(entries) {
+	return zipAsync(entries);
+}
 const documentModelLoadFromInput = (input) => {
 	return baseLoadFromInput(input, documentModelReducer);
 };
@@ -3835,105 +5138,6 @@ const getFileBrowser = (file) => {
 	return Promise.resolve().then(() => readFileBrowser(file));
 };
 //#endregion
-//#region document-model/state.ts
-/**
-* Creates a default PHAuthState
-*/
-function defaultAuthState() {
-	return {};
-}
-/**
-* Creates a default PHDocumentState
-*/
-function defaultDocumentState() {
-	return {
-		version: 0,
-		hash: {
-			algorithm: HASH_ALGORITHM_SHA1,
-			encoding: HASH_ENCODING_BASE64
-		}
-	};
-}
-/**
-* Creates a default PHBaseState with auth and document properties
-*/
-function defaultBaseState() {
-	return {
-		auth: defaultAuthState(),
-		document: defaultDocumentState()
-	};
-}
-/**
-* Creates a PHAuthState with the given properties
-*/
-function createAuthState(auth) {
-	return {
-		...defaultAuthState(),
-		...auth
-	};
-}
-/**
-* Creates a PHDocumentState with the given properties
-*/
-function createDocumentState(document) {
-	return {
-		...defaultDocumentState(),
-		...document
-	};
-}
-/**
-* Creates a PHBaseState with the given auth and document properties
-*/
-function createBaseState(auth, document) {
-	return {
-		auth: createAuthState(auth),
-		document: createDocumentState(document)
-	};
-}
-function defaultGlobalState() {
-	return {
-		...defaultBaseState(),
-		author: {
-			name: "",
-			website: ""
-		},
-		description: "",
-		extension: "",
-		id: "",
-		name: "",
-		specifications: []
-	};
-}
-function defaultLocalState() {
-	return {};
-}
-function defaultPHState() {
-	return {
-		...defaultBaseState(),
-		global: defaultGlobalState(),
-		local: defaultLocalState()
-	};
-}
-function createGlobalState(state) {
-	return {
-		...defaultGlobalState(),
-		...state || {}
-	};
-}
-function createLocalState(state) {
-	return {
-		...defaultLocalState(),
-		...state || {}
-	};
-}
-function createState(baseState, globalState, localState) {
-	return {
-		...createBaseState(baseState?.auth, baseState?.document),
-		global: createGlobalState(globalState),
-		local: createLocalState(localState)
-	};
-}
-//#endregion
-export { AddChangeLogItemInputSchema, AddModuleInputSchema, AddOperationErrorInputSchema, AddOperationExampleInputSchema, AddOperationInputSchema, AddStateExampleInputSchema, AuthorSchema, BaseDocumentHeaderSchema, BaseDocumentStateSchema, CodeExampleSchema, ConfigEntrySchema, ConfigEntryTypeSchema, DeleteChangeLogItemInputSchema, DeleteModuleInputSchema, DeleteOperationErrorInputSchema, DeleteOperationExampleInputSchema, DeleteOperationInputSchema, DeleteStateExampleInputSchema, DocumentActionSchema, DocumentModelGlobalStateSchema, DocumentModelHeaderSchema, DocumentModelInputSchema, DocumentModelPHStateSchema, DocumentModelSchema, DocumentSpecificationSchema, DowngradeNotSupportedError, FileSystemError, HASH_ALGORITHM_SHA1, HASH_ALGORITHM_SHA256, HASH_ALGORITHM_SHA512, HASH_ENCODING_BASE64, HASH_ENCODING_HEX, HashMismatchError, IntegrityIssueSubType, IntegrityIssueType, InvalidActionInputError, InvalidActionInputZodError, LoadStateActionInputSchema, LoadStateActionSchema, LoadStateActionStateInputSchema, Load_StateSchema, ManifestSchema, ModuleSchema, MoveOperationInputSchema, OPERATION_NAME_PATTERN, OperationErrorSchema, OperationScopeSchema, OperationSpecificationSchema, PowerhouseModuleSchema, PowerhouseModulesSchema, PruneActionInputSchema, PruneActionSchema, PruneSchema, PublisherSchema, RESERVED_OPERATION_NAMES, RedoActionInputSchema, RedoActionSchema, RedoSchema, ReorderChangeLogItemsInputSchema, ReorderModuleOperationsInputSchema, ReorderModulesInputSchema, ReorderOperationErrorsInputSchema, ReorderOperationExamplesInputSchema, ReorderStateExamplesInputSchema, ScopeStateSchema, SetAuthorNameInputSchema, SetAuthorWebsiteInputSchema, SetInitialStateInputSchema, SetModelDescriptionInputSchema, SetModelExtensionInputSchema, SetModelIdInputSchema, SetModelNameInputSchema, SetModuleDescriptionInputSchema, SetModuleNameInputSchema, SetNameActionInputSchema, SetNameActionSchema, SetOperationDescriptionInputSchema, SetOperationErrorCodeInputSchema, SetOperationErrorDescriptionInputSchema, SetOperationErrorNameInputSchema, SetOperationErrorTemplateInputSchema, SetOperationNameInputSchema, SetOperationReducerInputSchema, SetOperationSchemaInputSchema, SetOperationScopeInputSchema, SetOperationTemplateInputSchema, SetPreferredEditorActionInputSchema, SetPreferredEditorActionSchema, SetStateSchemaInputSchema, Set_NameSchema, Set_PreferredEditorSchema, StateSchema, UndoActionInputSchema, UndoActionSchema, UndoSchema, UpdateChangeLogItemInputSchema, UpdateOperationExampleInputSchema, UpdateStateExampleInputSchema, ab2hex, actionContext, actionFromAction, actionSigner, actions, addChangeLogItem, addModule, addOperation, addOperationError, addOperationExample, addStateExample, addUndo, applyDeleteDocumentAction, applyUpgradeDocumentAction, assertIsDocumentModelDocument, assertIsDocumentModelState, assertModuleIdUnique, assertOperationErrorIdUnique, assertOperationExampleIdUnique, assertOperationIdUnique, attachBranch, baseActions, baseCreateDocument, baseLoadFromInput, baseLoadFromInputVersioned, baseReducer, baseSaveToFileHandle, buildOperationSignature, buildOperationSignatureMessage, buildOperationSignatureParams, buildSignedAction, checkCleanedOperationsIntegrity, checkOperationsIntegrity, computeUpgradeTransitions, createAction, createAuthState, createBaseState, createDocumentState, createGlobalState, createLocalState, createMinimalZip, createPresignedHeader, createReducer, createSignedHeader, createSignedHeaderForSigner, createState, createVerificationSigner, createZip, defaultAuthState, defaultBaseState, defaultDocumentState, defaultGlobalState, defaultLocalState, defaultPHState, definedNonNullAnySchema, deleteChangeLogItem, deleteModule, deleteOperation, deleteOperationError, deleteOperationExample, deleteStateExample, deriveOperationId, diffOperations, documentModelActions, documentModelDocumentType, documentModelFileExtension, documentModelGlobalState, documentModelHeaderReducer, documentModelInitialGlobalState, documentModelInitialLocalState, documentModelLoadFromInput, documentModelModuleReducer, documentModelOperationErrorReducer, documentModelOperationExampleReducer, documentModelOperationReducer, documentModelReducer, documentModelSaveToFileHandle, documentModelStateReducer, documentModelStateSchemaReducer, documentModelVersioningReducer, fetchFileBrowser, filterDocumentOperationsResultingState, filterDuplicatedOperations, findModuleOrThrow, findOperationErrorOrThrow, findOperationExampleOrThrow, findOperationOrThrow, garbageCollect, garbageCollectDocumentOperations, garbageCollectV2, generateId, generateMock, getAllOperationNames, getDocumentLastModified, getFileBrowser, getUnixTimestamp, groupOperationsByScope, hashBrowser, hashDocumentStateForScope, hex2ab, isDefinedNonNullAny, isDocumentAction, isDocumentModelDocument, isDocumentModelState, isNoopOperation, isReservedOperationName, isUndo, isUndoRedo, isValidOperationNameFormat, loadState, loadStateOperation, mapSkippedOperations, mapSkippedOperationsV2, merge, moveOperation, nextSkipNumber, noop, operationExampleCreators, operationFromAction, operationFromOperation, operationWithContext, operationsAreEqual, parseResultingState, precedes, prepareOperations, processUndoRedo, prune, pruneOperation, readFileBrowser, readOnly, redo, redoOperation, releaseNewVersion, removeExistingOperations, reorderChangeLogItems, reorderModuleOperations, reorderModules, reorderOperationErrors, reorderOperationExamples, reorderStateExamples, replayDocument, replayDocumentVersioned, replayOperations, reshuffleByTimestamp, reshuffleByTimestampAndIndex, setAuthorName, setAuthorWebsite, setInitialState, setModelDescription, setModelExtension, setModelId, setModelName, setModuleDescription, setModuleName, setName, setNameOperation, setOperationDescription, setOperationErrorCode, setOperationErrorDescription, setOperationErrorName, setOperationErrorTemplate, setOperationName, setOperationReducer, setOperationSchema, setOperationScope, setOperationTemplate, setPreferredEditor, setPreferredEditorOperation, setStateSchema, sign, skipHeaderOperations, sortMappedOperations, sortOperations, split, undo, undoOperation, undoOperationV2, updateChangeLogItem, updateDocument, updateHeaderRevision, updateOperationExample, updateStateExample, validateHeader, validateInitialState, validateModule, validateModuleOperation, validateModules, validateOperationName, validateOperations, validateStateSchemaName, verify, verifyOperationSignature, writeFileBrowser };
+export { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, AddChangeLogItemInputSchema, AddModuleInputSchema, AddOperationErrorInputSchema, AddOperationExampleInputSchema, AddOperationInputSchema, AddStateExampleInputSchema, AuthActionNotAllowedError, AuthAdministrationLockoutError, AuthAdministrationMissingError, AuthAlreadyInitializedError, AuthInitializerNotCreatorError, AuthPolicyNotPreservedError, AuthorSchema, BaseDocumentHeaderSchema, BaseDocumentStateSchema, CodeExampleSchema, ConfigEntrySchema, ConfigEntryTypeSchema, DOCUMENT_DELETED_REASON, DeleteChangeLogItemInputSchema, DeleteModuleInputSchema, DeleteOperationErrorInputSchema, DeleteOperationExampleInputSchema, DeleteOperationInputSchema, DeleteStateExampleInputSchema, DocumentActionSchema, DocumentModelGlobalStateSchema, DocumentModelHeaderSchema, DocumentModelInputSchema, DocumentModelPHStateSchema, DocumentModelSchema, DocumentSpecificationSchema, DowngradeNotSupportedError, FileSystemError, GrantNotFoundError, GrantSchema, GroupPrincipalNotAllowedError, HASH_ALGORITHM_SHA1, HASH_ALGORITHM_SHA256, HASH_ALGORITHM_SHA512, HASH_ENCODING_BASE64, HASH_ENCODING_HEX, HashMismatchError, InitializeAuthActionInputSchema, IntegrityIssueSubType, IntegrityIssueType, InvalidActionInputError, InvalidActionInputZodError, InvalidAuthVersionError, InvalidGrantError, LoadStateActionInputSchema, LoadStateActionSchema, LoadStateActionStateInputSchema, Load_StateSchema, MAX_AUTH_GRANTS, MAX_CAPABILITY_OPERATIONS, MAX_CONDITION_DEPTH, MAX_CONDITION_NODES, MAX_SUPPORTED_AUTH_VERSION, ManifestSchema, ModuleSchema, MoveGrantActionInputSchema, MoveOperationInputSchema, OPERATION_NAME_PATTERN, OperationErrorSchema, OperationScopeSchema, OperationSpecificationSchema, PowerhouseModuleSchema, PowerhouseModulesSchema, PruneActionInputSchema, PruneActionSchema, PruneSchema, PublisherSchema, PwaConfigSchema, RESERVED_OPERATION_NAMES, RedoActionInputSchema, RedoActionSchema, RedoSchema, RemoveGrantActionInputSchema, ReorderChangeLogItemsInputSchema, ReorderModuleOperationsInputSchema, ReorderModulesInputSchema, ReorderOperationErrorsInputSchema, ReorderOperationExamplesInputSchema, ReorderStateExamplesInputSchema, ScopeStateSchema, SetAuthorNameInputSchema, SetAuthorWebsiteInputSchema, SetGrantActionInputSchema, SetInitialStateInputSchema, SetModelDescriptionInputSchema, SetModelExtensionInputSchema, SetModelIdInputSchema, SetModelNameInputSchema, SetModuleDescriptionInputSchema, SetModuleNameInputSchema, SetNameActionInputSchema, SetNameActionSchema, SetOperationDescriptionInputSchema, SetOperationErrorCodeInputSchema, SetOperationErrorDescriptionInputSchema, SetOperationErrorNameInputSchema, SetOperationErrorTemplateInputSchema, SetOperationNameInputSchema, SetOperationReducerInputSchema, SetOperationSchemaInputSchema, SetOperationScopeInputSchema, SetOperationTemplateInputSchema, SetPreferredEditorActionInputSchema, SetPreferredEditorActionSchema, SetStateSchemaInputSchema, Set_NameSchema, Set_PreferredEditorSchema, StateSchema, UndoActionInputSchema, UndoActionSchema, UndoSchema, UnsupportedDocumentModelVersionError, UpdateChangeLogItemInputSchema, UpdateOperationExampleInputSchema, UpdateStateExampleInputSchema, ab2hex, actionContext, actionFromAction, actionSigner, actions, addChangeLogItem, addModule, addOperation, addOperationError, addOperationExample, addStateExample, addUndo, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyInitializeAuthAction, applyMoveGrantAction, applyRemoveGrantAction, applySetGrantAction, applyUpgradeDocumentAction, assertAuthAdministrationRetained, assertAuthPreservedOnDuplicate, assertAuthScopeActionAllowed, assertIsDocumentModelDocument, assertIsDocumentModelState, assertModuleIdUnique, assertOperationErrorIdUnique, assertOperationExampleIdUnique, assertOperationIdUnique, assertValidGrant, assertValidGrantUpsert, assertValidInitialGrants, attachBranch, backfillAuthState, base58Decode, base64UrlToBytes, baseActions, baseCreateDocument, baseLoadFromInput, baseLoadFromInputVersioned, baseReducer, baseReducerVersion, baseSaveToFileHandle, buildOperationSignature, buildOperationSignatureMessage, buildOperationSignatureParams, buildSignedAction, checkCleanedOperationsIntegrity, checkOperationsIntegrity, computeUpgradeTransitions, createAction, createAuthState, createBaseState, createDocumentState, createGlobalState, createLocalState, createMinimalZip, createPresignedHeader, createReducer, createSignedHeader, createSignedHeaderForSigner, createState, createVerificationSigner, createZip, decide, defaultAuthState, defaultBaseState, defaultDocumentState, defaultGlobalState, defaultLocalState, defaultPHState, definedNonNullAnySchema, deleteChangeLogItem, deleteModule, deleteOperation, deleteOperationError, deleteOperationExample, deleteStateExample, deriveOperationId, deserializeSignature, diffOperations, documentModelActions, documentModelDocumentType, documentModelFileExtension, documentModelGlobalState, documentModelHeaderReducer, documentModelInitialGlobalState, documentModelInitialLocalState, documentModelLoadFromInput, documentModelModuleReducer, documentModelOperationErrorReducer, documentModelOperationExampleReducer, documentModelOperationReducer, documentModelReducer, documentModelSaveToFileHandle, documentModelStateReducer, documentModelStateSchemaReducer, documentModelVersioningReducer, evaluate, evaluateCondition, evaluateGrantStack, evaluateGrants, fetchFileBrowser, filterDocumentOperationsResultingState, filterDuplicatedOperations, findModuleOrThrow, findOperationErrorOrThrow, findOperationExampleOrThrow, findOperationOrThrow, garbageCollect, garbageCollectDocumentOperations, garbageCollectV2, generateId, generateMock, getAllOperationNames, getDocumentLastModified, getFileBrowser, getUnixTimestamp, grantProblem, groupDocumentType, groupMembershipActionTypes, groupOperationsByScope, hashBrowser, hashDocumentStateForScope, hex2ab, initializeAuth, isAuthAction, isDefinedNonNullAny, isDenied, isDocumentAction, isDocumentCreator, isDocumentModelDocument, isDocumentModelState, isDocumentZip, isNoopOperation, isPlainValue, isReservedOperationName, isUndo, isUndoRedo, isValidOperationNameFormat, loadState, loadStateOperation, mapSkippedOperations, mapSkippedOperationsV2, mentionedGroupIds, merge, moveGrant, moveOperation, nextSkipNumber, noop, normalizeDocumentModelVersion, operationExampleCreators, operationFromAction, operationFromOperation, operationOutcome, operationWithContext, operationsAreEqual, parseBulkArchive, parseResultingState, precedes, prepareOperations, processUndoRedo, prune, pruneOperation, readFileBrowser, readOnly, redo, redoOperation, referencedGroupIds, releaseNewVersion, removeExistingOperations, removeGrant, reorderChangeLogItems, reorderModuleOperations, reorderModules, reorderOperationErrors, reorderOperationExamples, reorderStateExamples, replayDocument, replayDocumentVersioned, replayOperations, reshuffleByTimestamp, reshuffleByTimestampAndIndex, resolveSnapshotAuth, serializeSignature, setAuthorName, setAuthorWebsite, setGrant, setInitialState, setModelDescription, setModelExtension, setModelId, setModelName, setModuleDescription, setModuleName, setName, setNameOperation, setOperationDescription, setOperationErrorCode, setOperationErrorDescription, setOperationErrorName, setOperationErrorTemplate, setOperationName, setOperationReducer, setOperationSchema, setOperationScope, setOperationTemplate, setPreferredEditor, setPreferredEditorOperation, setStateSchema, sign, skipHeaderOperations, sortMappedOperations, sortOperations, split, toTransportAction, undo, undoOperation, undoOperationV2, updateChangeLogItem, updateDocument, updateHeaderRevision, updateOperationExample, updateStateExample, validateHeader, validateInitialState, validateModule, validateModuleOperation, validateModules, validateOperationName, validateOperations, validateStateSchemaName, verify, verifyOperationSignature, writeFileBrowser, zipEntries };
 
 //# sourceMappingURL=index.js.map