@powerhousedao/shared 6.2.2-dev.9 → 6.2.2-staging.0

package/dist/index-DPuio_se.d.ts

@@ -0,0 +1,836 @@
+import { $t as DocumentModelOperationExampleOperations, Aa as SigningParameters, Bn as ModuleSpecification, Bt as DocumentModelGlobalState, Gt as DocumentModelLocalState, H as ActionSignatureContext, Ht as DocumentModelHeaderOperations, Jr as PruneActionInput, Jt as DocumentModelModuleOperations, Lr as OperationErrorSpecification, Ma as SkipHeaderOperations, On as LoadFromInput, Pa as StateReducer, Qa as UpgradeManifest, Rt as DocumentModelDocument, Sn as ISigner, Su as Grant, Ta as SignalDispatch, Tu as PHBaseState, Za as ValidationError, Zt as DocumentModelOperationErrorOperations, _i as ReplayDocumentOptions, bi as SaveToFileHandle, bl as PHDocument, cn as DocumentSpecification, ct as Author, cu as Operation, ei as Reducer, en as DocumentModelOperationOperations, lt as CodeExample, lu as OperationContext, mn as FileInput, oc as Action, on as DocumentModelVersioningOperations, rn as DocumentModelStateOperations, su as DocumentOperations, ti as ReducerOptions, tn as DocumentModelPHState, wu as PHAuthState, xl as PHDocumentHeader, xu as Condition, yu as AuthGroups, zn as MinimalBackupData, zr as OperationSpecification } from "./types-BzWRXB7f.js";
+import { ZodIssue, z } from "zod";
+
+//#region document-model/action-transport.d.ts
+/**
+ * An action's signer, as the wire declares it: signatures joined into strings,
+ * because GraphQL declares them as a list of strings rather than of lists.
+ */
+type TransportSigner = {
+  user?: {
+    address: string;
+    networkId: string;
+    chainId: number;
+  };
+  app?: {
+    name: string;
+    key: string;
+  };
+  signatures: string[];
+};
+/** An action's context, as the wire declares it. */
+type TransportActionContext = {
+  prevOpIndex?: number;
+  prevOpHash?: string;
+  nonce?: string;
+  signer?: TransportSigner;
+};
+/** An action projected onto exactly the fields the wire declares. */
+type TransportAction = {
+  id: string;
+  type: string;
+  timestampUtcMs: string;
+  /**
+   * Non-nullable, because the wire declares it so. An action's own type says
+   * `unknown`, which admits the absent input an action creator called without
+   * one produces - {@link toTransportAction} refuses that rather than passing
+   * it on.
+   */
+  input: NonNullable<unknown>;
+  scope: string;
+  context?: TransportActionContext;
+};
+/**
+ * Projects an action onto the fields the GraphQL `ActionInput` declares.
+ *
+ * A projection rather than a spread, because an input object rejects a field it
+ * does not declare, and that refusal takes the whole request with it. An action
+ * read back out of storage can carry fields the type no longer has - a legacy
+ * `attachments` array, or the operation fields left behind by a signing helper
+ * that returns an operation - and any one of them would sink an otherwise valid
+ * submission.
+ *
+ * Only fields the action actually carries are emitted, so an unsigned action
+ * sends no context at all rather than a context full of nulls.
+ */
+declare function toTransportAction(action: Action): TransportAction;
+//#endregion
+//#region document-model/auth.d.ts
+type InitializeAuthActionInput = {
+  version: number;
+  grants: Grant[];
+};
+type SetGrantActionInput = {
+  grant: Grant;
+};
+type RemoveGrantActionInput = {
+  id: string;
+};
+type MoveGrantActionInput = {
+  id: string; /** Target index in the grant list; clamped to the valid range. */
+  index: number;
+};
+type InitializeAuthAction = Action & {
+  type: "INITIALIZE_AUTH";
+  input: InitializeAuthActionInput;
+};
+type SetGrantAction = Action & {
+  type: "SET_GRANT";
+  input: SetGrantActionInput;
+};
+type RemoveGrantAction = Action & {
+  type: "REMOVE_GRANT";
+  input: RemoveGrantActionInput;
+};
+type MoveGrantAction = Action & {
+  type: "MOVE_GRANT";
+  input: MoveGrantActionInput;
+};
+type AuthAction = InitializeAuthAction | SetGrantAction | RemoveGrantAction | MoveGrantAction;
+declare const AUTH_ACTION_TYPES: readonly ["INITIALIZE_AUTH", "SET_GRANT", "REMOVE_GRANT", "MOVE_GRANT"];
+declare function isAuthAction(action: Action): action is AuthAction;
+/** Highest known policy version; decide() fails closed above it. */
+declare const MAX_SUPPORTED_AUTH_VERSION = 1;
+declare const InitializeAuthActionInputSchema: () => z.ZodObject<{
+  version: z.ZodNumber;
+  grants: z.ZodArray<z.ZodCustom<Grant, Grant>>;
+}, z.core.$strip>;
+declare const SetGrantActionInputSchema: () => z.ZodObject<{
+  grant: z.ZodCustom<Grant, Grant>;
+}, z.core.$strip>;
+declare const RemoveGrantActionInputSchema: () => z.ZodObject<{
+  id: z.ZodString;
+}, z.core.$strip>;
+declare const MoveGrantActionInputSchema: () => z.ZodObject<{
+  id: z.ZodString;
+  index: z.ZodNumber;
+}, z.core.$strip>;
+declare const initializeAuth: (input: InitializeAuthActionInput) => InitializeAuthAction;
+declare const setGrant: (input: SetGrantActionInput) => SetGrantAction;
+declare const removeGrant: (input: RemoveGrantActionInput) => RemoveGrantAction;
+declare const moveGrant: (input: MoveGrantActionInput) => MoveGrantAction;
+/**
+ * True when `signerKey` (an ActionSigner app key, a did:key) identifies the same
+ * key recorded as the document creator. Returns false
+ * when there is no creator (empty JWK) or no signer key.
+ */
+declare function isDocumentCreator(creatorKey: JsonWebKey | undefined, signerKey: string | undefined): boolean;
+/**
+ * Sets the initial policy. Valid only while the auth scope is uninitialized
+ * (version 0). The input version is the policy language version and must be an
+ * integer >= 1; 0 is reserved for the uninitialized state. On a signed-header
+ * document it must be signed by the document creator (`header.sig.publicKey`).
+ * A creator-less policy must include a grant permitting execute on the auth
+ * scope, or it would be born locked out.
+ */
+declare function applyInitializeAuthAction<TState extends PHBaseState>(document: PHDocument<TState>, action: InitializeAuthAction): PHDocument<TState>;
+/** Upserts a grant by id: replaces in place if present, otherwise appends. */
+declare function applySetGrantAction<TState extends PHBaseState>(document: PHDocument<TState>, action: SetGrantAction): PHDocument<TState>;
+/**
+ * Removes a grant by id; throws if the id is not present or if the removal
+ * would leave a creator-less policy with no auth-administration grant.
+ */
+declare function applyRemoveGrantAction<TState extends PHBaseState>(document: PHDocument<TState>, action: RemoveGrantAction): PHDocument<TState>;
+/**
+ * Moves a grant by id to a new index. Order is load-bearing (the last
+ * applicable grant wins), so the relative order of the other grants is kept.
+ * The target index is clamped to the valid range; an unknown id throws.
+ *
+ * Order alone decides which grant wins, so a move can take administration away
+ * without changing the list's contents. It carries the same retention rule as
+ * the two mutation paths.
+ */
+declare function applyMoveGrantAction<TState extends PHBaseState>(document: PHDocument<TState>, action: MoveGrantAction): PHDocument<TState>;
+/**
+ * Dispatches an auth-scope action to its handler. This is the auth scope's
+ * dedicated reducer: it is applied by the base reducer instead of the model
+ * reducer, mirroring the document-scope platform handlers. Unknown types are a
+ * no-op, matching the model-reducer default.
+ */
+declare function applyAuthAction<TState extends PHBaseState>(document: PHDocument<TState>, action: Action): PHDocument<TState>;
+/**
+ * Because only creators can initialize auth scopes, we must verify that either
+ * the document has no auth or the version and creator match.
+ */
+declare function assertAuthPreservedOnDuplicate(documentId: string, source: PHAuthState | undefined, duplicated: PHAuthState | undefined): void;
+/**
+ * The auth scope a state snapshot may install, given the policy already there.
+ *
+ * `applyAuthAction` is the validated door onto `state.auth`, but a whole-state
+ * snapshot (UPGRADE_DOCUMENT's `initialState`, LOAD_STATE's `data`) replaces the
+ * scope wholesale and is authorized as a `document`-scope write. Without this,
+ * a subject holding `execute` on `document` and no auth grant at all can install
+ * a policy of its choosing, name itself `creator` (which exempts the policy from
+ * the retention rule for good), or wipe an existing policy by carrying the
+ * default uninitialized one.
+ *
+ * Three cases:
+ *
+ *   - the snapshot carries no policy, or an uninitialized one: the document
+ *     keeps the policy it has, so a default-state upgrade cannot reset it;
+ *   - the document is uninitialized and the snapshot carries a policy: the
+ *     policy is installed after the same validation genesis applies, so it
+ *     cannot be born locked out;
+ *   - both carry a policy: they must agree. A duplicate preserves its source's
+ *     policy (see {@link assertAuthPreservedOnDuplicate}), and anything else is
+ *     an attempt to replace one policy with another.
+ */
+declare function resolveSnapshotAuth(documentId: string, documentType: string, current: PHAuthState | undefined, incoming: PHAuthState | undefined): PHAuthState;
+/** UNDO, REDO and PRUNE are rejected on the auth scope. */
+declare function assertAuthScopeActionAllowed(action: Action): void;
+type AuthVerb = "read" | "execute";
+type AuthRequest = {
+  verb: AuthVerb;
+  scope: string; /** For execute: the operation (action type) being attempted. Omitted for reads. */
+  operation?: string;
+};
+type AuthSubject = {
+  /** Verified signer address; undefined for an anonymous subject. */address?: string; /** The signer's app key (a did:key), used to match the document creator. */
+  key?: string;
+};
+/**
+ * What condition attr paths resolve against, beyond the subject. Supplied
+ * only while authConditions enforcement is on: with no context a grant
+ * carrying `where` or a { match } principal never applies.
+ */
+type ConditionContext = {
+  /** The executing scope's own state, for `doc.<scope>.*` paths. */scopeState: unknown; /** The action's input, for `action.input.*` paths. Absent for reads. */
+  actionInput?: unknown;
+};
+type AuthDecision = "allow" | "deny";
+/** Why the policy refused a request. */
+type AuthRefusal = "version-unsupported" | "no-applicable-grant" | "denied-by-grant";
+/**
+ * A decision together with why it refused. A refusal names which of the
+ * policy's rules produced it, so an operation records the reason it was refused
+ * rather than one reason standing for every refusal.
+ */
+type AuthEvaluation = {
+  decision: "allow";
+} | {
+  decision: "deny";
+  refusal: AuthRefusal;
+  grantId?: string;
+};
+/**
+ * Evaluates the auth policy for a single request and reports why it refused.
+ * Pure and deterministic.
+ *
+ * An uninitialized policy (version 0, absent auth state, or a legacy `{}`
+ * auth scope serialized before PHAuthState had a version) leaves the document
+ * open. Once a policy exists the default is deny, and grants stack in order.
+ *
+ * Group principals match only against a supplied groups map (the groups
+ * projection, present when authGroups is on); with no map they never apply.
+ * `where` clauses and { match } principals likewise evaluate only against a
+ * supplied condition context (present when authConditions is on).
+ */
+declare function evaluate(auth: PHAuthState | undefined, subject: AuthSubject, request: AuthRequest, groups?: AuthGroups, conditions?: ConditionContext): AuthEvaluation;
+/**
+ * Evaluates the auth policy for a single request. Pure and deterministic. This
+ * is {@link evaluate} with the reason dropped.
+ */
+declare function decide(auth: PHAuthState | undefined, subject: AuthSubject, request: AuthRequest, groups?: AuthGroups, conditions?: ConditionContext): AuthDecision;
+/**
+ * The group document ids a single auth action's input names with `{ group }`
+ * principals. INITIALIZE_AUTH contributes the groups named across its grants,
+ * SET_GRANT the groups named by its one grant; REMOVE_GRANT and MOVE_GRANT
+ * contribute nothing. Total over any input shape, because references are read
+ * from the input as it arrived, including inputs later stored as errors.
+ */
+declare function mentionedGroupIds(action: Action): string[];
+//#endregion
+//#region document-model/auth-v1.d.ts
+/** Maximum number of grants in a policy. */
+declare const MAX_AUTH_GRANTS = 100;
+/** Maximum nesting depth of a condition tree. */
+declare const MAX_CONDITION_DEPTH = 10;
+/** Maximum node count (conditions plus operands) of a condition tree. */
+declare const MAX_CONDITION_NODES = 100;
+/** Maximum entries in an execute capability's operation list. */
+declare const MAX_CAPABILITY_OPERATIONS = 100;
+/**
+ * Thrown when a grant violates the v1 validation rules. The message is stored
+ * on error operations, so it must be a pure function of the input.
+ */
+declare class InvalidGrantError extends Error {
+  readonly grantId: string;
+  constructor(grantId: string, problem: string);
+}
+/** Thrown for a `{ group }` principal on a group document: references never chain. */
+declare class GroupPrincipalNotAllowedError extends Error {
+  readonly grantId: string;
+  constructor(grantId: string);
+}
+/**
+ * Thrown when a change would leave a creator-less policy with no grant
+ * permitting execute on the auth scope. Without the creator carve-out no
+ * subject could ever administer such a policy again.
+ */
+declare class AuthAdministrationLockoutError extends Error {
+  readonly grantId: string;
+  constructor(grantId: string);
+}
+/**
+ * Thrown when INITIALIZE_AUTH would create a creator-less policy with no grant
+ * permitting execute on the auth scope. Such a policy would be born with no
+ * subject able to administer it.
+ */
+declare class AuthAdministrationMissingError extends Error {
+  constructor();
+}
+declare function isPlainValue(value: unknown): value is Record<string, unknown>;
+/** Returns the first v1-rule violation, or null. Pure, total, deterministic. */
+declare function grantProblem(value: unknown): string | null;
+declare const GrantSchema: () => z.ZodCustom<Grant, Grant>;
+/** V1 shape rules plus the group-document group-principal ban. */
+declare function assertValidGrant(grant: unknown, documentType: string): void;
+/**
+ * Validates an initial grant list: the count cap, every grant, and — on a
+ * creator-less policy — that some grant keeps the auth scope administrable.
+ */
+declare function assertValidInitialGrants(grants: Grant[], documentType: string, creator: string | undefined): void;
+/**
+ * Validates a grant upsert: the grant itself, the count cap on append, and
+ * administration retention. Retention is checked on an append as well as an
+ * in-place replace, because a grant appended after the administration grant can
+ * shadow it (evaluation is last-applicable-grant-wins) and so take
+ * administration away without removing anything.
+ */
+declare function assertValidGrantUpsert(grant: Grant, existing: Grant[], documentType: string, creator: string | undefined): void;
+/**
+ * A creator-less policy must always retain a grant permitting execute on the
+ * auth scope; on a signed document the creator carve-out keeps administration
+ * reachable instead. Rejects a change that takes the last such grant away. A
+ * policy already without one is left alone: the change is not what locks it.
+ */
+declare function assertAuthAdministrationRetained(creator: string | undefined, previous: Grant[], next: Grant[], grantId: string): void;
+/**
+ * Evaluates a version-1 condition. Deterministic, total, and pure: any input
+ * shape yields a boolean and never throws, and a malformed condition is
+ * false. These are consensus semantics, versioned by `PHAuthState.version`;
+ * changing them requires a new version.
+ */
+declare function evaluateCondition(condition: Condition, subject: AuthSubject, request: AuthRequest, conditions: ConditionContext): boolean;
+/**
+ * The group document ids named by `{ group }` principals in a grant list, in
+ * order of first appearance. These are the streams the groups projection reads.
+ */
+declare function referencedGroupIds(grants: Grant[]): string[];
+/**
+ * Evaluates a v1 grant stack: default deny, last applicable grant wins, and
+ * reports which grant decided it. Group principals match only against a
+ * supplied groups map, and `where` clauses and { match } principals evaluate
+ * only against a supplied condition context; a grant that uses an unsupplied
+ * feature never applies.
+ */
+declare function evaluateGrantStack(grants: Grant[], subject: AuthSubject, request: AuthRequest, groups?: AuthGroups, conditions?: ConditionContext): AuthEvaluation;
+/**
+ * Evaluates a v1 grant stack: default deny, last applicable grant wins. This is
+ * {@link evaluateGrantStack} with the reason dropped.
+ */
+declare function evaluateGrants(grants: Grant[], subject: AuthSubject, request: AuthRequest, groups?: AuthGroups, conditions?: ConditionContext): AuthDecision;
+//#endregion
+//#region document-model/constants.d.ts
+declare const documentModelFileExtension: "phdm";
+declare const documentModelInitialLocalState: DocumentModelLocalState;
+declare const documentModelInitialGlobalState: DocumentModelGlobalState;
+declare const documentModelGlobalState: DocumentModelGlobalState;
+declare const HASH_ALGORITHM_SHA1 = "sha1";
+declare const HASH_ALGORITHM_SHA256 = "sha256";
+declare const HASH_ALGORITHM_SHA512 = "sha512";
+declare const HASH_ENCODING_BASE64 = "base64";
+declare const HASH_ENCODING_HEX = "hex";
+//#endregion
+//#region document-model/crypto.d.ts
+declare const hashBrowser: (data: string | Uint8Array | ArrayBufferView | DataView, algorithm?: string, encoding?: string, _params?: Record<string, unknown>) => string;
+declare function getUnixTimestamp(date: Date | string): string;
+declare function buildOperationSignatureParams({
+  documentId,
+  signer,
+  action,
+  previousStateHash
+}: ActionSignatureContext): [string, string, string, string];
+declare function buildOperationSignatureMessage(params: [string, string, string, string]): Uint8Array;
+declare function ab2hex(ab: ArrayBuffer | ArrayBufferView): string;
+declare function hex2ab(hex: string): Uint8Array<ArrayBuffer>;
+/**
+ * Decodes a base58btc (Bitcoin/IPFS alphabet) string to bytes. Returns null on
+ * any character outside the alphabet.
+ */
+declare function base58Decode(input: string): Uint8Array | null;
+/** Decodes a base64url string to bytes (portable across node, browsers, workers). */
+declare function base64UrlToBytes(input: string): Uint8Array;
+//#endregion
+//#region document-model/denied.d.ts
+/**
+ * True iff authorization rejected the action.
+ */
+declare function isDenied(operation: Operation): boolean;
+/**
+ * The closed set of strings persisted as `deniedReason`. Re-evaluation compares
+ * them, so they are consensus data: exact strings that embed no grant id,
+ * subject or timestamp. Changing one is history-visible.
+ */
+declare const DOCUMENT_DELETED_REASON = "document deleted";
+declare const AUTH_VERSION_UNSUPPORTED_REASON = "auth policy version unsupported";
+declare const AUTH_NO_GRANT_REASON = "no grant permits this operation";
+declare const AUTH_DENIED_BY_GRANT_REASON = "denied by grant";
+//#endregion
+//#region document-model/document-schema.d.ts
+declare const BaseDocumentHeaderSchema: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodString;
+  createdAtUtcIso: z.ZodString;
+  lastModifiedAtUtcIso: z.ZodString;
+  documentType: z.ZodString;
+}, z.core.$strip>;
+declare const BaseDocumentStateSchema: z.ZodObject<{
+  global: z.ZodUnknown;
+}, z.core.$strip>;
+/** Schema for validating the header object of a DocumentModel document */
+declare const DocumentModelHeaderSchema: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodString;
+  createdAtUtcIso: z.ZodString;
+  lastModifiedAtUtcIso: z.ZodString;
+  documentType: z.ZodLiteral<"powerhouse/document-model">;
+}, z.core.$strip>;
+/** Schema for validating the state object of a DocumentModel document */
+declare const DocumentModelPHStateSchema: z.ZodObject<{
+  global: z.ZodObject<Required<{
+    author: z.ZodType<Author, Author, z.core.$ZodTypeInternals<Author, Author>>;
+    description: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    extension: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    id: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    name: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    specifications: z.ZodType<DocumentSpecification[], DocumentSpecification[], z.core.$ZodTypeInternals<DocumentSpecification[], DocumentSpecification[]>>;
+  }>, z.core.$strip>;
+}, z.core.$strip>;
+declare const DocumentModelSchema: z.ZodObject<{
+  header: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    createdAtUtcIso: z.ZodString;
+    lastModifiedAtUtcIso: z.ZodString;
+    documentType: z.ZodLiteral<"powerhouse/document-model">;
+  }, z.core.$strip>;
+  state: z.ZodObject<{
+    global: z.ZodObject<Required<{
+      author: z.ZodType<Author, Author, z.core.$ZodTypeInternals<Author, Author>>;
+      description: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      extension: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      id: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      name: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      specifications: z.ZodType<DocumentSpecification[], DocumentSpecification[], z.core.$ZodTypeInternals<DocumentSpecification[], DocumentSpecification[]>>;
+    }>, z.core.$strip>;
+  }, z.core.$strip>;
+  initialState: z.ZodObject<{
+    global: z.ZodObject<Required<{
+      author: z.ZodType<Author, Author, z.core.$ZodTypeInternals<Author, Author>>;
+      description: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      extension: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      id: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      name: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      specifications: z.ZodType<DocumentSpecification[], DocumentSpecification[], z.core.$ZodTypeInternals<DocumentSpecification[], DocumentSpecification[]>>;
+    }>, z.core.$strip>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+/** Simple helper function to check if a state object is a DocumentModel document state object */
+declare function isDocumentModelState(state: unknown): state is DocumentModelPHState;
+/** Simple helper function to assert that a document state object is a DocumentModel document state object */
+declare function assertIsDocumentModelState(state: unknown): asserts state is DocumentModelPHState;
+/** Simple helper function to check if a document is a DocumentModel document */
+declare function isDocumentModelDocument(document: unknown): document is DocumentModelDocument;
+/** Simple helper function to assert that a document is a DocumentModel document */
+declare function assertIsDocumentModelDocument(document: unknown): asserts document is DocumentModelDocument;
+//#endregion
+//#region document-model/document-type.d.ts
+declare const documentModelDocumentType = "powerhouse/document-model";
+declare const groupDocumentType = "powerhouse/reactor-group";
+/**
+ * The group-model action types that change membership. The groups projection
+ * filters its reads to these, so any other group operation is invisible to a
+ * decision. Kept here so the reactor never depends on the group package; a
+ * reactor-group test guards against drift.
+ */
+declare const groupMembershipActionTypes: readonly ["ADD_MEMBER", "REMOVE_MEMBER"];
+//#endregion
+//#region document-model/errors.d.ts
+declare const FileSystemError: Error;
+declare class InvalidActionInputError extends Error {
+  data: unknown;
+  constructor(data: unknown);
+}
+declare class InvalidActionInputZodError extends InvalidActionInputError {
+  issues: ZodIssue[];
+  constructor(issues: ZodIssue[]);
+}
+/**
+ * Error thrown when attempting to downgrade a document version.
+ */
+declare class DowngradeNotSupportedError extends Error {
+  readonly documentType: string;
+  readonly fromVersion: number;
+  readonly toVersion: number;
+  constructor(documentType: string, fromVersion: number, toVersion: number);
+}
+/**
+ * Thrown when INITIALIZE_AUTH is applied to an already-initialized auth scope.
+ * The genesis action is valid only at auth revision zero.
+ */
+declare class AuthAlreadyInitializedError extends Error {
+  readonly documentId: string;
+  constructor(documentId: string);
+}
+/**
+ * Thrown when INITIALIZE_AUTH is not signed by the document creator (its signer
+ * does not match `header.sig.publicKey`), so it cannot set the auth policy.
+ */
+declare class AuthInitializerNotCreatorError extends Error {
+  readonly documentId: string;
+  constructor(documentId: string);
+}
+/**
+ * Thrown when INITIALIZE_AUTH carries a version below 1. Version 0 is reserved
+ * for the uninitialized auth scope.
+ */
+declare class InvalidAuthVersionError extends Error {
+  readonly documentId: string;
+  readonly version: number;
+  constructor(documentId: string, version: number);
+}
+/** Thrown when a duplicate would lose the source policy's version or creator binding. */
+declare class AuthPolicyNotPreservedError extends Error {
+  readonly documentId: string;
+  constructor(documentId: string);
+}
+/**
+ * Thrown when a grant referenced by REMOVE_GRANT or MOVE_GRANT does not exist.
+ */
+declare class GrantNotFoundError extends Error {
+  readonly grantId: string;
+  constructor(grantId: string);
+}
+/**
+ * Thrown when a disallowed action (UNDO, REDO, PRUNE) targets the auth scope.
+ */
+declare class AuthActionNotAllowedError extends Error {
+  readonly actionType: string;
+  constructor(actionType: string);
+}
+declare class HashMismatchError extends Error {
+  protected _scope: string;
+  protected _document: PHDocument;
+  protected _operation: Operation;
+  constructor(scope: string, document: PHDocument, operation: Operation);
+  get document(): PHDocument;
+  get scope(): string;
+  get operation(): Operation;
+}
+/**
+ * Thrown when replay or import requires a document model version that is not
+ * registered. Carries the data the UI needs to explain the mismatch.
+ */
+declare class UnsupportedDocumentModelVersionError extends Error {
+  readonly documentType: string;
+  readonly requiredVersion: number;
+  readonly availableVersions: number[];
+  constructor(documentType: string, requiredVersion: number, availableVersions: number[]);
+  static isError(error: unknown): error is UnsupportedDocumentModelVersionError;
+}
+//#endregion
+//#region document-model/versioned-replay.d.ts
+type VersionedReducers = Record<number, Reducer<PHBaseState>>;
+type VersionedReplayConfig = {
+  reducers: VersionedReducers;
+  upgradeManifest?: UpgradeManifest<readonly number[]>;
+};
+/**
+ * Version-aware document replay. Replays a versioned document through per-version
+ * reducers, applying upgrade transitions at segment boundaries.
+ *
+ * Algorithm (D5):
+ *   a. Build spine from operations["document"]. Empty spine or no upgrades → legacy fallback.
+ *   b. Collect UPGRADE_DOCUMENT ops from the spine.
+ *   c. Seed state from the creation upgrade (fromVersion===0). Missing seed with validated
+ *      upgrades throws; otherwise falls back to legacy.
+ *   d. Identify validated upgrades (fromVersion > 0, version increases). Compute per-scope
+ *      boundaries using revision snapshot (preferred) or timestamp fallback.
+ *   e. Loop over version segments, replaying each scope's ops through the matching reducer,
+ *      then applying the upgrade transition before the next segment.
+ *   f. Set header.revision["document"], verify per-scope hashes against state at op-time
+ *      (not post-upgrade state) when checkHashes is false, and map timestamps from input.
+ *
+ * operations must include ALL scopes (document scope is NOT stripped).
+ * reuseOperationResultingState is ignored by this function — zip operations never carry
+ * resultingState.
+ */
+declare function replayDocumentVersioned<TState extends PHBaseState>(initialState: TState, operations: DocumentOperations, config: VersionedReplayConfig, header: PHDocumentHeader, dispatch?: SignalDispatch, options?: ReplayDocumentOptions): PHDocument<TState>;
+//#endregion
+//#region document-model/files.d.ts
+declare function createZip(document: PHDocument): Promise<Uint8Array>;
+/**
+ * Creates a minimal ZIP backup from strand data.
+ * Used when the full document is not available (e.g., in onOperations handler).
+ * Creates a ZIP with minimal header and empty operations.
+ */
+declare function createMinimalZip(data: MinimalBackupData): Promise<Uint8Array>;
+declare function baseSaveToFileHandle(document: PHDocument, input: FileSystemFileHandle): Promise<void>;
+declare function baseLoadFromInput<TState extends PHBaseState>(input: FileInput, reducer: Reducer<TState>, options?: ReplayDocumentOptions): Promise<PHDocument<TState>>;
+declare function baseLoadFromInputVersioned<TState extends PHBaseState>(input: FileInput, config: VersionedReplayConfig, options?: ReplayDocumentOptions): Promise<PHDocument<TState>>;
+type BulkArchiveEntry = {
+  /** "/"-separated zip path of a file entry (no trailing slash). */path: string;
+  data: Uint8Array;
+};
+/**
+ * Whether this zip is a single Powerhouse document: the document's four JSON
+ * entries (header/state/current-state/operations) at the archive root. A
+ * bulk archive has a folder tree instead. Returns false for any input that
+ * is not a readable zip.
+ */
+declare function isDocumentZip(data: Uint8Array): Promise<boolean>;
+/**
+ * The file entries of a zip (directory entries excluded). Used for bulk
+ * archives; throws when the archive holds no files. Note this does NOT
+ * validate that the entries are document zips — pair with isDocumentZip.
+ */
+declare function parseBulkArchive(data: Uint8Array): Promise<BulkArchiveEntry[]>;
+/**
+ * Assemble a zip from raw entries. A key ending in "/" with empty data is a
+ * directory entry, so an archive's folder structure survives a round-trip.
+ */
+declare function zipEntries(entries: Record<string, Uint8Array>): Promise<Uint8Array>;
+declare const documentModelLoadFromInput: LoadFromInput<DocumentModelPHState>;
+declare const documentModelSaveToFileHandle: SaveToFileHandle;
+declare function writeFileBrowser(path: string, name: string, stream: Uint8Array): Promise<string>;
+declare function readFileBrowser(path: string): void;
+declare function fetchFileBrowser(url: string): Promise<{
+  data: Buffer;
+  mimeType?: string;
+}>;
+declare const getFileBrowser: (file: string) => Promise<void>;
+//#endregion
+//#region document-model/header.d.ts
+/**
+ * Creates a verification-only signer from a public key.
+ * This signer can only verify signatures, not sign data.
+ *
+ * @param pubKey - The public key to use for verification.
+ * @returns An ISigner that can only verify signatures.
+ */
+declare function createVerificationSigner(pubKey: JsonWebKey): Promise<ISigner>;
+/**
+ * Signs a header. Generally, this is not called directly, but rather through
+ * {@link createSignedHeader}.
+ *
+ * @param parameters - The parameters used to sign the header.
+ * @param signer - The signer of the document.
+ *
+ * @returns The signature of the header.
+ */
+declare const sign: (parameters: SigningParameters, signer: ISigner) => Promise<string>;
+/**
+ * Verifies a header signature. Generally, this is not called directly, but
+ * rather through {@link validateHeader}.
+ *
+ * @param parameters - The parameters used to sign the header.
+ * @param signature - The signature to verify.
+ * @param signer - The signer of the document.
+ */
+declare const verify: (parameters: SigningParameters, signature: string, signer: ISigner) => Promise<void>;
+/**
+ * Validates a header signature.
+ */
+declare const validateHeader: (header: PHDocumentHeader) => Promise<void>;
+/**
+ * Creates a header that has yet to be signed. This header is not valid, but
+ * can be input into {@link createSignedHeader} to create a signed header.
+ *
+ * @returns An unsigned header for a document.
+ */
+declare const createPresignedHeader: (id?: string, documentType?: string) => PHDocumentHeader;
+/**
+ * Creates a new, signed header for a document. This will replace the id of the
+ * document.
+ *
+ * @param unsignedHeader - The unsigned header to created the signed header from.
+ * @param signer - The signer of the document.
+ *
+ * @returns A new signed header for a document. Some fields are mutable and
+ * some are not. See the PHDocumentHeader type for more information.
+ */
+declare const createSignedHeader: (unsignedHeader: PHDocumentHeader, documentType: string, signer: ISigner) => Promise<PHDocumentHeader>;
+/**
+ * Creates a signed header for a document. The document header requires a signer
+ * as the document id is a cryptographic signature.
+ *
+ * @param documentType - The type of the document.
+ * @param signer - The signer of the document.
+ *
+ * @returns The signed header for a document. Some fields are mutable and
+ * some are not. See the PHDocumentHeader type for more information.
+ */
+declare const createSignedHeaderForSigner: (documentType: string, signer: ISigner) => Promise<PHDocumentHeader>;
+//#endregion
+//#region document-model/reducer.d.ts
+declare function replayOperations<TState extends PHBaseState = PHBaseState>(initialState: TState, clearedOperations: DocumentOperations, stateReducer: StateReducer<TState>, header: PHDocumentHeader, dispatch?: SignalDispatch, documentReducer?: typeof baseReducer, skipHeaderOperations?: SkipHeaderOperations, options?: ReplayDocumentOptions): PHDocument<TState>;
+/**
+ * Updates the document state based on the provided action.
+ *
+ * @param state The current state of the document.
+ * @param action The action being applied to the document.
+ * @param skip The number of operations to skip before applying the action.
+ * @param reuseLastOperationIndex Whether to reuse the last operation index (used when a an UNDO operation is performed after an existing one).
+ * @param context The operation context for deterministic ID generation.
+ * @returns The updated document state.
+ */
+declare function updateDocument<TDocument extends PHDocument>(document: TDocument, action: Action, reuseLastOperationIndex: boolean, skip: number, context: OperationContext, operation?: Operation, skipIndexValidation?: boolean): TDocument;
+/**
+ * Processes an UNDO or REDO action.
+ *
+ * @param document The current state of the document.
+ * @param action The action being applied to the document.
+ * @param skip The number of operations to skip before applying the action.
+ * @returns The updated document, calculated skip value and transformed action (if applied).
+ */
+declare function processUndoRedo<TState extends PHBaseState = PHBaseState>(document: PHDocument<TState>, action: Action, skip: number, protocolVersion?: number): {
+  document: PHDocument<TState>;
+  action: Action;
+  skip: number;
+  reuseLastOperationIndex: boolean;
+};
+/**
+ * Base document reducer that wraps a custom document reducer and handles
+ * document-level actions such as undo, redo, prune, and set name.
+ *
+ * @template TGlobalState - The type of the state of the custom reducer.
+ * @template TAction - The type of the actions of the custom reducer.
+ * @param state - The current state of the document.
+ * @param action - The action object to apply to the state.
+ * @param customReducer - The custom reducer that implements the application logic
+ * specific to the document's state.
+ * @returns The new state of the document.
+ */
+declare function baseReducer<TState extends PHBaseState = PHBaseState>(document: PHDocument<TState>, action: Action, customReducer: StateReducer<TState>, dispatch?: SignalDispatch, options?: ReducerOptions): PHDocument<TState>;
+/**
+ * Helper function to create a document model reducer.
+ *
+ * @remarks
+ * This function creates a new reducer that wraps the provided `reducer` with
+ * `documentReducer`, adding support for document actions:
+ *   - `SET_NAME`
+ *   - `UNDO`
+ *   - `REDO`
+ *   - `PRUNE`
+ *
+ * It also updates the document-related attributes on every operation.
+ *
+ * @param reducer - The custom reducer to wrap.
+ * @param documentReducer - The document reducer to use.
+ *
+ * @returns The new reducer.
+ */
+declare function createReducer<TState extends PHBaseState = PHBaseState>(stateReducer: StateReducer<TState>, documentReducer?: typeof baseReducer): Reducer<TState>;
+declare function pruneOperation<TState extends PHBaseState = PHBaseState>(document: PHDocument<TState>, input: PruneActionInput, wrappedReducer: StateReducer<TState>): PHDocument<TState>;
+//#endregion
+//#region document-model/reducers.d.ts
+declare const documentModelHeaderReducer: DocumentModelHeaderOperations;
+declare const documentModelModuleReducer: DocumentModelModuleOperations;
+declare const documentModelOperationErrorReducer: DocumentModelOperationErrorOperations;
+declare const documentModelOperationExampleReducer: DocumentModelOperationExampleOperations;
+declare const documentModelOperationReducer: DocumentModelOperationOperations;
+declare const documentModelStateSchemaReducer: DocumentModelStateOperations;
+declare const documentModelVersioningReducer: DocumentModelVersioningOperations;
+declare const documentModelStateReducer: StateReducer<DocumentModelPHState>;
+declare const documentModelReducer: Reducer<DocumentModelPHState>;
+//#endregion
+//#region document-model/validation.d.ts
+/**
+ * Reserved operation names from base reducer (core/actions.ts).
+ * These names cannot be used for custom operations.
+ */
+declare const RESERVED_OPERATION_NAMES: readonly ["UNDO", "REDO", "PRUNE", "LOAD_STATE", "SET_NAME", "SET_PREFERRED_EDITOR", "NOOP"];
+type ReservedOperationName = (typeof RESERVED_OPERATION_NAMES)[number];
+/**
+ * Operation names become the literal action `type` string at runtime and the
+ * key for codegen's action union. They must be SCREAMING_SNAKE_CASE so the
+ * generated TypeScript is valid.
+ */
+declare const OPERATION_NAME_PATTERN: RegExp;
+declare function isValidOperationNameFormat(name: string): boolean;
+/**
+ * Check if name conflicts with base reducer actions (case-insensitive).
+ */
+declare function isReservedOperationName(name: string): boolean;
+/**
+ * Get all operation names from all modules in the latest specification.
+ * Returns names in uppercase for case-insensitive comparison.
+ */
+declare function getAllOperationNames(state: DocumentModelGlobalState, excludeOperationId?: string): string[];
+/**
+ * Validate operation name is not reserved or duplicate. Throws on failure.
+ *
+ * @param name - The operation name to validate
+ * @param state - The document model global state
+ * @param excludeOperationId - Optional operation ID to exclude (for rename validation)
+ * @throws Error if the name is reserved or a duplicate
+ */
+declare function validateOperationName(name: string, state: DocumentModelGlobalState, excludeOperationId?: string): void;
+declare function validateInitialState(initialState: string, allowEmptyState?: boolean): ValidationError[];
+declare function validateStateSchemaName(schema: string, documentName: string, scope?: string, allowEmptySchema?: boolean): ValidationError[];
+declare function validateModules(modules: ModuleSpecification[]): ValidationError[];
+declare function validateModule(mod: ModuleSpecification): ValidationError[];
+declare function validateModuleOperation(operation: OperationSpecification): ValidationError[];
+/**
+ * Find a module in the latest specification by id, or throw. Reducers that
+ * mutate-by-id should call this up front so an unknown id fails loudly
+ * instead of silently no-opping.
+ */
+declare function findModuleOrThrow(state: DocumentModelGlobalState, moduleId: string): ModuleSpecification;
+/**
+ * Find an operation in the latest specification by id, or throw. Same
+ * rationale as findModuleOrThrow — reducers that target an operation must
+ * fail loudly when the operation doesn't exist.
+ */
+declare function findOperationOrThrow(state: DocumentModelGlobalState, operationId: string): OperationSpecification;
+/**
+ * Find an operation error by id across all operations in the latest
+ * specification, or throw. Throws on a duplicate id too: setters act on a
+ * single error, so an ambiguous id must fail loudly rather than mutate an
+ * arbitrary match.
+ */
+declare function findOperationErrorOrThrow(state: DocumentModelGlobalState, errorId: string): OperationErrorSpecification;
+/**
+ * Find an operation example (code example) by id across all operations in the
+ * latest specification, or throw. Throws on a duplicate id for the same reason
+ * as findOperationErrorOrThrow.
+ */
+declare function findOperationExampleOrThrow(state: DocumentModelGlobalState, exampleId: string): CodeExample;
+/**
+ * Assert no module in the latest specification already uses `id`. Modules are
+ * targeted by id by the setter/delete/reorder reducers, so a duplicate id makes
+ * those operations ambiguous.
+ */
+declare function assertModuleIdUnique(state: DocumentModelGlobalState, id: string): void;
+/**
+ * Assert no operation in the latest specification already uses `id`. Operations
+ * are targeted by id across all modules, so the id must be unique document-wide.
+ */
+declare function assertOperationIdUnique(state: DocumentModelGlobalState, id: string): void;
+/**
+ * Assert no operation error in the latest specification already uses `id`.
+ * Error ids are targeted document-wide by the setter/delete reducers, so the id
+ * must be unique to keep those operations unambiguous.
+ */
+declare function assertOperationErrorIdUnique(state: DocumentModelGlobalState, id: string): void;
+/**
+ * Assert no operation example in the latest specification already uses `id`.
+ * Example ids are targeted document-wide by the update/delete reducers, so the
+ * id must be unique to keep those operations unambiguous.
+ */
+declare function assertOperationExampleIdUnique(state: DocumentModelGlobalState, id: string): void;
+declare function validateOperations(operations: DocumentOperations): ValidationError[];
+//#endregion
+export { getFileBrowser as $, mentionedGroupIds as $n, documentModelInitialLocalState as $t, documentModelVersioningReducer as A, InitializeAuthActionInputSchema as An, isDocumentModelDocument as At, createVerificationSigner as B, SetGrantActionInputSchema as Bn, buildOperationSignatureMessage as Bt, documentModelModuleReducer as C, AuthRefusal as Cn, BaseDocumentHeaderSchema as Ct, documentModelReducer as D, ConditionContext as Dn, DocumentModelSchema as Dt, documentModelOperationReducer as E, AuthVerb as En, DocumentModelPHStateSchema as Et, replayOperations as F, RemoveGrantAction as Fn, DOCUMENT_DELETED_REASON as Ft, baseLoadFromInput as G, applySetGrantAction as Gn, HASH_ALGORITHM_SHA1 as Gt, validateHeader as H, applyInitializeAuthAction as Hn, getUnixTimestamp as Ht, updateDocument as I, RemoveGrantActionInput as In, isDenied as It, createMinimalZip as J, decide as Jn, HASH_ENCODING_BASE64 as Jt, baseLoadFromInputVersioned as K, assertAuthPreservedOnDuplicate as Kn, HASH_ALGORITHM_SHA256 as Kt, createPresignedHeader as L, RemoveGrantActionInputSchema as Ln, ab2hex as Lt, createReducer as M, MoveGrantAction as Mn, AUTH_DENIED_BY_GRANT_REASON as Mt, processUndoRedo as N, MoveGrantActionInput as Nn, AUTH_NO_GRANT_REASON as Nt, documentModelStateReducer as O, InitializeAuthAction as On, assertIsDocumentModelDocument as Ot, pruneOperation as P, MoveGrantActionInputSchema as Pn, AUTH_VERSION_UNSUPPORTED_REASON as Pt, fetchFileBrowser as Q, isDocumentCreator as Qn, documentModelInitialGlobalState as Qt, createSignedHeader as R, SetGrantAction as Rn, base58Decode as Rt, documentModelHeaderReducer as S, AuthEvaluation as Sn, groupMembershipActionTypes as St, documentModelOperationExampleReducer as T, AuthSubject as Tn, DocumentModelHeaderSchema as Tt, verify as U, applyMoveGrantAction as Un, hashBrowser as Ut, sign as V, applyAuthAction as Vn, buildOperationSignatureParams as Vt, BulkArchiveEntry as W, applyRemoveGrantAction as Wn, hex2ab as Wt, documentModelLoadFromInput as X, initializeAuth as Xn, documentModelFileExtension as Xt, createZip as Y, evaluate as Yn, HASH_ENCODING_HEX as Yt, documentModelSaveToFileHandle as Z, isAuthAction as Zn, documentModelGlobalState as Zt, validateModuleOperation as _, isPlainValue as _n, InvalidActionInputZodError as _t, assertOperationErrorIdUnique as a, MAX_AUTH_GRANTS as an, TransportActionContext as ar, VersionedReducers as at, validateOperations as b, AuthAction as bn, documentModelDocumentType as bt, findModuleOrThrow as c, MAX_CONDITION_NODES as cn, AuthActionNotAllowedError as ct, findOperationOrThrow as d, assertValidGrantUpsert as dn, AuthPolicyNotPreservedError as dt, AuthAdministrationLockoutError as en, moveGrant as er, isDocumentZip as et, getAllOperationNames as f, assertValidInitialGrants as fn, DowngradeNotSupportedError as ft, validateModule as g, grantProblem as gn, InvalidActionInputError as gt, validateInitialState as h, evaluateGrants as hn, HashMismatchError as ht, assertModuleIdUnique as i, InvalidGrantError as in, TransportAction as ir, zipEntries as it, baseReducer as j, MAX_SUPPORTED_AUTH_VERSION as jn, isDocumentModelState as jt, documentModelStateSchemaReducer as k, InitializeAuthActionInput as kn, assertIsDocumentModelState as kt, findOperationErrorOrThrow as l, assertAuthAdministrationRetained as ln, AuthAlreadyInitializedError as lt, isValidOperationNameFormat as m, evaluateGrantStack as mn, GrantNotFoundError as mt, RESERVED_OPERATION_NAMES as n, GrantSchema as nn, resolveSnapshotAuth as nr, readFileBrowser as nt, assertOperationExampleIdUnique as o, MAX_CAPABILITY_OPERATIONS as on, TransportSigner as or, VersionedReplayConfig as ot, isReservedOperationName as p, evaluateCondition as pn, FileSystemError as pt, baseSaveToFileHandle as q, assertAuthScopeActionAllowed as qn, HASH_ALGORITHM_SHA512 as qt, ReservedOperationName as r, GroupPrincipalNotAllowedError as rn, setGrant as rr, writeFileBrowser as rt, assertOperationIdUnique as s, MAX_CONDITION_DEPTH as sn, toTransportAction as sr, replayDocumentVersioned as st, OPERATION_NAME_PATTERN as t, AuthAdministrationMissingError as tn, removeGrant as tr, parseBulkArchive as tt, findOperationExampleOrThrow as u, assertValidGrant as un, AuthInitializerNotCreatorError as ut, validateModules as v, referencedGroupIds as vn, InvalidAuthVersionError as vt, documentModelOperationErrorReducer as w, AuthRequest as wn, BaseDocumentStateSchema as wt, validateStateSchemaName as x, AuthDecision as xn, groupDocumentType as xt, validateOperationName as y, AUTH_ACTION_TYPES as yn, UnsupportedDocumentModelVersionError as yt, createSignedHeaderForSigner as z, SetGrantActionInput as zn, base64UrlToBytes as zt };
+//# sourceMappingURL=index-DPuio_se.d.ts.map