@powerhousedao/shared 6.2.3-dev.34 → 6.2.3-dev.35

package/dist/{types-CmeoQg_J.d.ts → types-CFbd2nan.d.ts}

@@ -1,10 +1,11 @@
 import { f as IAnalyticsStore } from "./types-Bsp8VL2y.js";
-import { ZodRawShape, z } from "zod";
+import "./utils-BrKxCmKx.js";
+import { ZodIssue, ZodRawShape, z } from "zod";
 import { Draft } from "mutative";
+import { Kysely, QueryCreator } from "kysely";
 import { ArgParser } from "cmd-ts/dist/cjs/argparser.js";
 import { Agent } from "package-manager-detector";
 import { OperationWithContext } from "@powerhousedao/shared/document-model";
-import { Kysely, QueryCreator } from "kysely";
 import { IncomingMessage, ServerResponse } from "node:http";
 import { FC, ReactNode } from "react";
 //#region clis/args/common.d.ts
@@ -985,477 +986,987 @@ type Action = {
   context?: ActionContext;
 };
 //#endregion
-//#region processors/http.d.ts
-/** Methods a package route may bind. OPTIONS belongs to the CORS layer. */
-type RouteMethod = "DELETE" | "GET" | "HEAD" | "PATCH" | "POST" | "PUT";
-interface RouteUser {
-  address: string;
-  chainId: number;
-  networkId: string;
-  appKey: string;
+//#region document-model/action-signature.d.ts
+declare const ACTION_SIGNATURE_V2_PREFIX = "v2:";
+/** The log an operation is stored in, which a v2 tuple is bound to. */
+type ActionSigningTarget = {
+  documentId: string;
+  branch: string;
+};
+/** Who a v2 tuple attributes the action to; both halves are in the preimage. */
+type ActionSignerIdentity = {
+  user: UserActionSigner;
+  app: AppActionSigner;
+};
+/** A value that would not survive a JSON store round trip unchanged. */
+declare class CanonicalJsonError extends Error {
+  constructor(path: string, detail: string);
 }
-type RouteActor = {
-  user: RouteUser | undefined;
-  authEnabled: boolean;
+/** Sorted-key JSON, as the state hash encodes; drops `undefined` properties. */
+declare function canonicalJson(value: unknown, label?: string): string;
+/** Actions the reactor reduces itself, onto the document scope. */
+declare const DOCUMENT_SCOPE_ACTION_TYPES: ReadonlySet<string>;
+/** Where a document-scope action writes: `sourceId` or `documentId`. */
+declare function targetDocumentId(action: {
+  type: string;
+  input: unknown;
+}, fallback: string): string;
+/** The log an action submitted to a job on `documentId` is stored in. */
+declare function actionSigningTarget(action: {
+  type: string;
+  input: unknown;
+}, documentId: string, branch: string): ActionSigningTarget;
+/** The identity a signer writes into `context.signer`, and signs over. */
+declare function actionSignerIdentity(signer: {
+  user?: UserActionSigner;
+  app?: AppActionSigner;
+}): ActionSignerIdentity;
+/** The v2 preimage; throws `CanonicalJsonError` on an unsignable action. */
+declare function actionPreimageV2(action: Action, target: ActionSigningTarget, signer: ActionSignerIdentity): string;
+/** `"v2:" + base64url(sha256(preimage))`, unpadded. */
+declare function hashActionV2(action: Action, target: ActionSigningTarget, signer: ActionSignerIdentity): Promise<string>;
+/** Signs `action` as a v2 tuple; the message layout is the legacy one. */
+declare function signActionV2(params: {
+  action: Action;
+  target: ActionSigningTarget;
+  signer: ActionSignerIdentity;
+  sign: ActionSigningHandler;
+  previousStateHash?: string;
+}): Promise<Signature>;
+/** Element [2] carries the v2 prefix, whether or not it is well formed. */
+declare function isV2ActionHash(hash: string): boolean;
+/** The strict shape of a v2 tuple, apart from what its hash covers. */
+declare function v2TupleProblem(tuple: Signature): string | undefined;
+//#endregion
+//#region document-model/action-transport.d.ts
+/**
+ * An action's signer, as the wire declares it: signatures joined into strings,
+ * because GraphQL declares them as a list of strings rather than of lists.
+ */
+type TransportSigner = {
+  user?: {
+    address: string;
+    networkId: string;
+    chainId: number;
+  };
+  app?: {
+    name: string;
+    key: string;
+  };
+  signatures: string[];
 };
-type AuthorizerResult = {
-  authorized: true;
-} |
-/** Refused; the scope answers with its own JSON error envelope. */
-{
-  authorized: false;
-  status: number;
-  message: string;
+/** An action's context, as the wire declares it. */
+type TransportActionContext = {
+  prevOpIndex?: number;
+  prevOpHash?: string;
+  nonce?: string;
+  signer?: TransportSigner;
+};
+/** An action projected onto exactly the fields the wire declares. */
+type TransportAction = {
+  id: string;
+  type: string;
+  timestampUtcMs: string;
+  /**
+   * Non-nullable, because the wire declares it so. An action's own type says
+   * `unknown`, which admits the absent input an action creator called without
+   * one produces - {@link toTransportAction} refuses that rather than passing
+   * it on.
+   */
+  input: NonNullable<unknown>;
+  scope: string;
+  context?: TransportActionContext;
+};
+/**
+ * Projects an action onto the fields the GraphQL `ActionInput` declares.
+ *
+ * A projection rather than a spread, because an input object rejects a field it
+ * does not declare, and that refusal takes the whole request with it. An action
+ * read back out of storage can carry fields the type no longer has - a legacy
+ * `attachments` array, or the operation fields left behind by a signing helper
+ * that returns an operation - and any one of them would sink an otherwise valid
+ * submission.
+ *
+ * Only fields the action actually carries are emitted, so an unsigned action
+ * sends no context at all rather than a context full of nulls.
+ */
+declare function toTransportAction(action: Action): TransportAction;
+//#endregion
+//#region document-model/auth.d.ts
+type InitializeAuthActionInput = {
+  version: number;
+  grants: Grant[];
+};
+type SetGrantActionInput = {
+  grant: Grant;
+};
+type RemoveGrantActionInput = {
+  id: string;
+};
+type MoveGrantActionInput = {
+  id: string;
+  /** Target index in the grant list; clamped to the valid range. */
+  index: number;
+};
+type InitializeAuthAction = Action & {
+  type: "INITIALIZE_AUTH";
+  input: InitializeAuthActionInput;
+};
+type SetGrantAction = Action & {
+  type: "SET_GRANT";
+  input: SetGrantActionInput;
+};
+type RemoveGrantAction = Action & {
+  type: "REMOVE_GRANT";
+  input: RemoveGrantActionInput;
+};
+type MoveGrantAction = Action & {
+  type: "MOVE_GRANT";
+  input: MoveGrantActionInput;
+};
+type AuthAction = InitializeAuthAction | SetGrantAction | RemoveGrantAction | MoveGrantAction;
+declare const AUTH_ACTION_TYPES: readonly ["INITIALIZE_AUTH", "SET_GRANT", "REMOVE_GRANT", "MOVE_GRANT"];
+declare function isAuthAction(action: Action): action is AuthAction;
+/** Highest known policy version; decide() fails closed above it. */
+declare const MAX_SUPPORTED_AUTH_VERSION = 1;
+declare const InitializeAuthActionInputSchema: () => z.ZodObject<{
+  version: z.ZodNumber;
+  grants: z.ZodArray<z.ZodCustom<Grant, Grant>>;
+}, z.core.$strip>;
+declare const SetGrantActionInputSchema: () => z.ZodObject<{
+  grant: z.ZodCustom<Grant, Grant>;
+}, z.core.$strip>;
+declare const RemoveGrantActionInputSchema: () => z.ZodObject<{
+  id: z.ZodString;
+}, z.core.$strip>;
+declare const MoveGrantActionInputSchema: () => z.ZodObject<{
+  id: z.ZodString;
+  index: z.ZodNumber;
+}, z.core.$strip>;
+declare const initializeAuth: (input: InitializeAuthActionInput) => InitializeAuthAction;
+declare const setGrant: (input: SetGrantActionInput) => SetGrantAction;
+declare const removeGrant: (input: RemoveGrantActionInput) => RemoveGrantAction;
+declare const moveGrant: (input: MoveGrantActionInput) => MoveGrantAction;
+/**
+ * True when `signerKey` (an ActionSigner app key, a did:key) identifies the same
+ * key recorded as the document creator. Returns false
+ * when there is no creator (empty JWK) or no signer key.
+ */
+declare function isDocumentCreator(creatorKey: JsonWebKey | undefined, signerKey: string | undefined): boolean;
+/**
+ * Sets the initial policy. Valid only while the auth scope is uninitialized
+ * (version 0). The input version is the policy language version and must be an
+ * integer >= 1; 0 is reserved for the uninitialized state. On a signed-header
+ * document it must be signed by the document creator (`header.sig.publicKey`).
+ * A creator-less policy must include a grant permitting execute on the auth
+ * scope, or it would be born locked out.
+ */
+declare function applyInitializeAuthAction<TState extends PHBaseState>(document: PHDocument<TState>, action: InitializeAuthAction): PHDocument<TState>;
+/** Upserts a grant by id: replaces in place if present, otherwise appends. */
+declare function applySetGrantAction<TState extends PHBaseState>(document: PHDocument<TState>, action: SetGrantAction): PHDocument<TState>;
+/**
+ * Removes a grant by id; throws if the id is not present or if the removal
+ * would leave a creator-less policy with no auth-administration grant.
+ */
+declare function applyRemoveGrantAction<TState extends PHBaseState>(document: PHDocument<TState>, action: RemoveGrantAction): PHDocument<TState>;
+/**
+ * Moves a grant by id to a new index. Order is load-bearing (the last
+ * applicable grant wins), so the relative order of the other grants is kept.
+ * The target index is clamped to the valid range; an unknown id throws.
+ *
+ * Order alone decides which grant wins, so a move can take administration away
+ * without changing the list's contents. It carries the same retention rule as
+ * the two mutation paths.
+ */
+declare function applyMoveGrantAction<TState extends PHBaseState>(document: PHDocument<TState>, action: MoveGrantAction): PHDocument<TState>;
+/**
+ * Dispatches an auth-scope action to its handler. This is the auth scope's
+ * dedicated reducer: it is applied by the base reducer instead of the model
+ * reducer, mirroring the document-scope platform handlers. Unknown types are a
+ * no-op, matching the model-reducer default.
+ */
+declare function applyAuthAction<TState extends PHBaseState>(document: PHDocument<TState>, action: Action): PHDocument<TState>;
+/**
+ * Because only creators can initialize auth scopes, we must verify that either
+ * the document has no auth or the version and creator match.
+ */
+declare function assertAuthPreservedOnDuplicate(documentId: string, source: PHAuthState | undefined, duplicated: PHAuthState | undefined): void;
+/**
+ * The auth scope a state snapshot may install, given the policy already there.
+ *
+ * `applyAuthAction` is the validated door onto `state.auth`, but a whole-state
+ * snapshot (UPGRADE_DOCUMENT's `initialState`) replaces the scope wholesale and
+ * is authorized as a `document`-scope write. Without this, a subject holding
+ * `execute` on `document` and no auth grant at all can install a policy of its
+ * choosing, name itself `creator` (which exempts the policy from the retention
+ * rule for good), or wipe an existing policy by carrying the default
+ * uninitialized one.
+ *
+ * Three cases:
+ *
+ *   - the snapshot carries no policy, or an uninitialized one: the document
+ *     keeps the policy it has, so a default-state upgrade cannot reset it;
+ *   - the document is uninitialized and the snapshot carries a policy: the
+ *     policy is installed after the same validation genesis applies, so it
+ *     cannot be born locked out;
+ *   - both carry a policy: they must agree. A duplicate preserves its source's
+ *     policy (see {@link assertAuthPreservedOnDuplicate}), and anything else is
+ *     an attempt to replace one policy with another.
+ */
+declare function resolveSnapshotAuth(documentId: string, documentType: string, current: PHAuthState | undefined, incoming: PHAuthState | undefined): PHAuthState;
+/** UNDO and REDO are rejected on the auth scope. */
+declare function assertAuthScopeActionAllowed(action: Action): void;
+type AuthVerb = "read" | "execute";
+type AuthRequest = {
+  verb: AuthVerb;
+  scope: string;
+  /** For execute: the operation (action type) being attempted. Omitted for reads. */
+  operation?: string;
+};
+type AuthSubject = {
+  /** Verified signer address; undefined for an anonymous subject. */
+  address?: string;
+  /** The signer's app key (a did:key), used to match the document creator. */
+  key?: string;
+};
+/**
+ * What condition attr paths resolve against, beyond the subject. Supplied
+ * only while authConditions enforcement is on: with no context a grant
+ * carrying `where` or a { match } principal never applies.
+ */
+type ConditionContext = {
+  /** The executing scope's own state, for `doc.<scope>.*` paths. */
+  scopeState: unknown;
+  /** The action's input, for `action.input.*` paths. Absent for reads. */
+  actionInput?: unknown;
+};
+type AuthDecision = "allow" | "deny";
+/** Why the policy refused a request. */
+type AuthRefusal = "version-unsupported" | "no-applicable-grant" | "denied-by-grant";
+/**
+ * A decision together with why it refused. A refusal names which of the
+ * policy's rules produced it, so an operation records the reason it was refused
+ * rather than one reason standing for every refusal.
+ */
+type AuthEvaluation = {
+  decision: "allow";
 } | {
-  authorized: false;
-  response: Response;
+  decision: "deny";
+  refusal: AuthRefusal;
+  grantId?: string;
 };
-/** A route-specific gate, for policies the standard modes cannot express. */
-type RouteAuthorizer = (req: IncomingMessage) => Promise<AuthorizerResult> | AuthorizerResult;
-/** How a route authenticates. */
-type RouteAuth =
-/** Default. A verifiable bearer is required; a caller without one gets 401. */
-"renown" | "renown-optional" | "public" | RouteAuthorizer;
-/** How the request body reaches the handler. */
-type RouteBody =
-/** Default. Buffered, and readable through the Fetch Request. */
-"parsed" |
-/** Buffered and also handed over as `ctx.rawBody`, byte for byte. */
-"raw" |
-/** Not buffered; the Fetch Request body is the live request stream. */
-"stream" |
-/** The body is not read at all. */
-"none";
-interface RouteOptions {
-  auth?: RouteAuth;
-  body?: RouteBody;
-  /** Refuse a body larger than this with 413. Ignored when body is `stream`. */
-  maxBodyBytes?: number;
-  /** Serve sub-paths too, not just an exact match. */
-  prefix?: boolean;
+/**
+ * Evaluates the auth policy for a single request and reports why it refused.
+ * Pure and deterministic.
+ *
+ * An uninitialized policy (version 0, absent auth state, or a legacy `{}`
+ * auth scope serialized before PHAuthState had a version) leaves the document
+ * open. Once a policy exists the default is deny, and grants stack in order.
+ *
+ * Group principals match only against a supplied groups map (the groups
+ * projection, present when authGroups is on); with no map they never apply.
+ * `where` clauses and { match } principals likewise evaluate only against a
+ * supplied condition context (present when authConditions is on).
+ */
+declare function evaluate(auth: PHAuthState | undefined, subject: AuthSubject, request: AuthRequest, groups?: AuthGroups, conditions?: ConditionContext): AuthEvaluation;
+/**
+ * Evaluates the auth policy for a single request. Pure and deterministic. This
+ * is {@link evaluate} with the reason dropped.
+ */
+declare function decide(auth: PHAuthState | undefined, subject: AuthSubject, request: AuthRequest, groups?: AuthGroups, conditions?: ConditionContext): AuthDecision;
+/**
+ * The group document ids a single auth action's input names with `{ group }`
+ * principals. INITIALIZE_AUTH contributes the groups named across its grants,
+ * SET_GRANT the groups named by its one grant; REMOVE_GRANT and MOVE_GRANT
+ * contribute nothing. Total over any input shape, because references are read
+ * from the input as it arrived, including inputs later stored as errors.
+ */
+declare function mentionedGroupIds(action: Action): string[];
+//#endregion
+//#region document-model/auth-v1.d.ts
+/** Maximum number of grants in a policy. */
+declare const MAX_AUTH_GRANTS = 100;
+/** Maximum nesting depth of a condition tree. */
+declare const MAX_CONDITION_DEPTH = 10;
+/** Maximum node count (conditions plus operands) of a condition tree. */
+declare const MAX_CONDITION_NODES = 100;
+/** Maximum entries in an execute capability's operation list. */
+declare const MAX_CAPABILITY_OPERATIONS = 100;
+/**
+ * Thrown when a grant violates the v1 validation rules. The message is stored
+ * on error operations, so it must be a pure function of the input.
+ */
+declare class InvalidGrantError extends Error {
+  readonly grantId: string;
+  constructor(grantId: string, problem: string);
 }
-/** Where the request reached the host, resolved through any reverse proxy. */
-interface RouteTransport {
-  proto: string;
-  host: string;
-  prefix: string;
-  baseUrl: string;
+/** Thrown for a `{ group }` principal on a group document: references never chain. */
+declare class GroupPrincipalNotAllowedError extends Error {
+  readonly grantId: string;
+  constructor(grantId: string);
 }
-interface RouteContext {
-  /** Decoded path params. */
-  params: Record<string, string>;
-  user: RouteUser | undefined;
-  authEnabled: boolean;
-  /** The exact octets received. Present only when body is `raw`. */
-  rawBody: Buffer | undefined;
-  /** Aborts when the client disconnects. */
-  signal: AbortSignal;
-  transport: RouteTransport;
+/**
+ * Thrown when a change would leave a creator-less policy with no grant
+ * permitting execute on the auth scope. Without the creator carve-out no
+ * subject could ever administer such a policy again.
+ */
+declare class AuthAdministrationLockoutError extends Error {
+  readonly grantId: string;
+  constructor(grantId: string);
 }
-type RouteHandler = (request: Request, ctx: RouteContext) => Response | Promise<Response>;
-interface RouteSpec extends RouteOptions {
-  method: RouteMethod | RouteMethod[];
-  /** Relative to the scope: "runs/:id", never "/api/@scope/pkg/runs/:id". */
-  path: string;
-  handler: RouteHandler;
+/**
+ * Thrown when INITIALIZE_AUTH would create a creator-less policy with no grant
+ * permitting execute on the auth scope. Such a policy would be born with no
+ * subject able to administer it.
+ */
+declare class AuthAdministrationMissingError extends Error {
+  constructor();
 }
-interface NodeRouteSpec extends Omit<RouteOptions, "body" | "maxBodyBytes"> {
-  method: RouteMethod | RouteMethod[];
-  path: string;
-  handler: (req: IncomingMessage, res: ServerResponse, ctx: Omit<RouteContext, "rawBody" | "signal">) => void | Promise<void>;
+declare function isPlainValue(value: unknown): value is Record<string, unknown>;
+/** Returns the first v1-rule violation, or null. Pure, total, deterministic. */
+declare function grantProblem(value: unknown): string | null;
+declare const GrantSchema: () => z.ZodCustom<Grant, Grant>;
+/** V1 shape rules plus the group-document group-principal ban. */
+declare function assertValidGrant(grant: unknown, documentType: string): void;
+/**
+ * Validates an initial grant list: the count cap, every grant, and — on a
+ * creator-less policy — that some grant keeps the auth scope administrable.
+ */
+declare function assertValidInitialGrants(grants: Grant[], documentType: string, creator: string | undefined): void;
+/**
+ * Validates a grant upsert: the grant itself, the count cap on append, and
+ * administration retention. Retention is checked on an append as well as an
+ * in-place replace, because a grant appended after the administration grant can
+ * shadow it (evaluation is last-applicable-grant-wins) and so take
+ * administration away without removing anything.
+ */
+declare function assertValidGrantUpsert(grant: Grant, existing: Grant[], documentType: string, creator: string | undefined): void;
+/**
+ * A creator-less policy must always retain a grant permitting execute on the
+ * auth scope; on a signed document the creator carve-out keeps administration
+ * reachable instead. Rejects a change that takes the last such grant away. A
+ * policy already without one is left alone: the change is not what locks it.
+ */
+declare function assertAuthAdministrationRetained(creator: string | undefined, previous: Grant[], next: Grant[], grantId: string): void;
+/**
+ * Evaluates a version-1 condition. Deterministic, total, and pure: any input
+ * shape yields a boolean and never throws, and a malformed condition is
+ * false. These are consensus semantics, versioned by `PHAuthState.version`;
+ * changing them requires a new version.
+ */
+declare function evaluateCondition(condition: Condition, subject: AuthSubject, request: AuthRequest, conditions: ConditionContext): boolean;
+/**
+ * The group document ids named by `{ group }` principals in a grant list, in
+ * order of first appearance. These are the streams the groups projection reads.
+ */
+declare function referencedGroupIds(grants: Grant[]): string[];
+/**
+ * Evaluates a v1 grant stack: default deny, last applicable grant wins, and
+ * reports which grant decided it. Group principals match only against a
+ * supplied groups map, and `where` clauses and { match } principals evaluate
+ * only against a supplied condition context; a grant that uses an unsupplied
+ * feature never applies.
+ */
+declare function evaluateGrantStack(grants: Grant[], subject: AuthSubject, request: AuthRequest, groups?: AuthGroups, conditions?: ConditionContext): AuthEvaluation;
+/**
+ * Evaluates a v1 grant stack: default deny, last applicable grant wins. This is
+ * {@link evaluateGrantStack} with the reason dropped.
+ */
+declare function evaluateGrants(grants: Grant[], subject: AuthSubject, request: AuthRequest, groups?: AuthGroups, conditions?: ConditionContext): AuthDecision;
+//#endregion
+//#region document-model/constants.d.ts
+declare const documentModelFileExtension: "phdm";
+declare const documentModelInitialLocalState: DocumentModelLocalState;
+declare const documentModelInitialGlobalState: DocumentModelGlobalState;
+declare const documentModelGlobalState: DocumentModelGlobalState;
+declare const HASH_ALGORITHM_SHA1 = "sha1";
+declare const HASH_ALGORITHM_SHA256 = "sha256";
+declare const HASH_ALGORITHM_SHA512 = "sha512";
+declare const HASH_ENCODING_BASE64 = "base64";
+declare const HASH_ENCODING_HEX = "hex";
+//#endregion
+//#region document-model/crypto.d.ts
+declare const hashBrowser: (data: string | Uint8Array | ArrayBufferView | DataView, algorithm?: string, encoding?: string, _params?: Record<string, unknown>) => string;
+declare function getUnixTimestamp(date: Date | string): string;
+declare function buildOperationSignatureParams({ documentId, signer, action, previousStateHash }: ActionSignatureContext): [string, string, string, string];
+declare function buildOperationSignatureMessage(params: [string, string, string, string]): Uint8Array;
+declare function ab2hex(ab: ArrayBuffer | ArrayBufferView): string;
+declare function hex2ab(hex: string): Uint8Array<ArrayBuffer>;
+/**
+ * Decodes a base58btc (Bitcoin/IPFS alphabet) string to bytes. Returns null on
+ * any character outside the alphabet.
+ */
+declare function base58Decode(input: string): Uint8Array | null;
+/** Encodes bytes as unpadded base64url. */
+declare function bytesToBase64Url(bytes: Uint8Array): string;
+/** Decodes a base64url string to bytes (portable across node, browsers, workers). */
+declare function base64UrlToBytes(input: string): Uint8Array;
+//#endregion
+//#region document-model/denied.d.ts
+/**
+ * True iff authorization rejected the action.
+ */
+declare function isDenied(operation: Operation): boolean;
+/**
+ * The closed set of strings persisted as `deniedReason`. Re-evaluation compares
+ * them, so they are consensus data: exact strings that embed no grant id,
+ * subject or timestamp. Changing one is history-visible.
+ */
+declare const DOCUMENT_DELETED_REASON = "document deleted";
+declare const AUTH_VERSION_UNSUPPORTED_REASON = "auth policy version unsupported";
+declare const AUTH_NO_GRANT_REASON = "no grant permits this operation";
+declare const AUTH_DENIED_BY_GRANT_REASON = "denied by grant";
+//#endregion
+//#region document-model/document-schema.d.ts
+declare const BaseDocumentHeaderSchema: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodString;
+  createdAtUtcIso: z.ZodString;
+  lastModifiedAtUtcIso: z.ZodString;
+  documentType: z.ZodString;
+}, z.core.$strip>;
+declare const BaseDocumentStateSchema: z.ZodObject<{
+  global: z.ZodUnknown;
+}, z.core.$strip>;
+/** Schema for validating the header object of a DocumentModel document */
+declare const DocumentModelHeaderSchema: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodString;
+  createdAtUtcIso: z.ZodString;
+  lastModifiedAtUtcIso: z.ZodString;
+  documentType: z.ZodLiteral<"powerhouse/document-model">;
+}, z.core.$strip>;
+/** Schema for validating the state object of a DocumentModel document */
+declare const DocumentModelPHStateSchema: z.ZodObject<{
+  global: z.ZodObject<Required<{
+    author: z.ZodType<Author, Author, z.core.$ZodTypeInternals<Author, Author>>;
+    description: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    extension: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    id: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    name: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    specifications: z.ZodType<DocumentSpecification[], DocumentSpecification[], z.core.$ZodTypeInternals<DocumentSpecification[], DocumentSpecification[]>>;
+  }>, z.core.$strip>;
+}, z.core.$strip>;
+declare const DocumentModelSchema: z.ZodObject<{
+  header: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    createdAtUtcIso: z.ZodString;
+    lastModifiedAtUtcIso: z.ZodString;
+    documentType: z.ZodLiteral<"powerhouse/document-model">;
+  }, z.core.$strip>;
+  state: z.ZodObject<{
+    global: z.ZodObject<Required<{
+      author: z.ZodType<Author, Author, z.core.$ZodTypeInternals<Author, Author>>;
+      description: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      extension: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      id: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      name: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      specifications: z.ZodType<DocumentSpecification[], DocumentSpecification[], z.core.$ZodTypeInternals<DocumentSpecification[], DocumentSpecification[]>>;
+    }>, z.core.$strip>;
+  }, z.core.$strip>;
+  initialState: z.ZodObject<{
+    global: z.ZodObject<Required<{
+      author: z.ZodType<Author, Author, z.core.$ZodTypeInternals<Author, Author>>;
+      description: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      extension: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      id: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      name: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+      specifications: z.ZodType<DocumentSpecification[], DocumentSpecification[], z.core.$ZodTypeInternals<DocumentSpecification[], DocumentSpecification[]>>;
+    }>, z.core.$strip>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+/** Simple helper function to check if a state object is a DocumentModel document state object */
+declare function isDocumentModelState(state: unknown): state is DocumentModelPHState;
+/** Simple helper function to assert that a document state object is a DocumentModel document state object */
+declare function assertIsDocumentModelState(state: unknown): asserts state is DocumentModelPHState;
+/** Simple helper function to check if a document is a DocumentModel document */
+declare function isDocumentModelDocument(document: unknown): document is DocumentModelDocument;
+/** Simple helper function to assert that a document is a DocumentModel document */
+declare function assertIsDocumentModelDocument(document: unknown): asserts document is DocumentModelDocument;
+//#endregion
+//#region document-model/document-type.d.ts
+declare const documentModelDocumentType = "powerhouse/document-model";
+declare const groupDocumentType = "powerhouse/reactor-group";
+/**
+ * The group-model action types that change membership. The groups projection
+ * filters its reads to these, so any other group operation is invisible to a
+ * decision. Kept here so the reactor never depends on the group package; a
+ * reactor-group test guards against drift.
+ */
+declare const groupMembershipActionTypes: readonly ["ADD_MEMBER", "REMOVE_MEMBER"];
+//#endregion
+//#region document-model/errors.d.ts
+declare const FileSystemError: Error;
+declare class InvalidActionInputError extends Error {
+  data: unknown;
+  constructor(data: unknown);
 }
-interface ScopedRouteHandle {
-  /** The absolute public URL this route answers on. */
-  readonly url: string;
-  dispose(): void;
+declare class InvalidActionInputZodError extends InvalidActionInputError {
+  issues: ZodIssue[];
+  constructor(issues: ZodIssue[]);
 }
-type WebhookScheme = "none" |
-/** A shared secret presented verbatim. No digest, so no digest options. */
-"token" |
-/** The digest of the body, alone. */
-"hmac" |
-/** That digest behind a label, `sha256=<digest>`. */
-"hmac-prefixed" | "hmac-timestamped";
-/** Hashes a sender may compute the digest with. */
-type WebhookHashAlgorithm = "sha1" | "sha256" | "sha512";
-/** How the digest is written into the header. */
-type WebhookSignatureEncoding = "hex" | "base64";
-interface WebhookVerification {
-  scheme: WebhookScheme;
-  /** Resolved value, never a reference — the caller resolves refs. */
-  secret?: string;
-  /** Overrides the scheme's conventional header. */
-  header?: string;
-  /** Replay window for timestamped schemes. */
-  toleranceSeconds?: number;
-  algorithm?: WebhookHashAlgorithm;
-  /** Defaults to `hex`. Base64 comparison is case-sensitive; hex is not. */
-  encoding?: WebhookSignatureEncoding;
-  prefix?: string;
+/**
+ * Error thrown when attempting to downgrade a document version.
+ */
+declare class DowngradeNotSupportedError extends Error {
+  readonly documentType: string;
+  readonly fromVersion: number;
+  readonly toVersion: number;
+  constructor(documentType: string, fromVersion: number, toVersion: number);
 }
-type WebhookField = string | {
-  header: string;
-} |
-/** Dot-separated path into the parsed body, e.g. `data.object.id`. */
-{
-  body: string;
-};
-interface WebhookRequest {
-  /** The caller's own key for this endpoint, e.g. a document id. */
-  key: string;
-  method: string;
-  path: string;
-  queryParams: Record<string, string>;
-  /** Lowercased, with credentials redacted. */
-  headers: Record<string, string>;
-  /** The exact bytes received. */
-  raw: Buffer;
-  /** JSON and form bodies decoded; anything else as text. */
-  body: unknown;
+/**
+ * Thrown when INITIALIZE_AUTH is applied to an already-initialized auth scope.
+ * The genesis action is valid only at auth revision zero.
+ */
+declare class AuthAlreadyInitializedError extends Error {
+  readonly documentId: string;
+  constructor(documentId: string);
 }
-interface WebhookReply {
-  status: number;
-  body?: string;
-  contentType?: string;
+/**
+ * Thrown when INITIALIZE_AUTH is not signed by the document creator (its signer
+ * does not match `header.sig.publicKey`), so it cannot set the auth policy.
+ */
+declare class AuthInitializerNotCreatorError extends Error {
+  readonly documentId: string;
+  constructor(documentId: string);
 }
-interface WebhookPolicy {
-  verify?: WebhookVerification;
-  /** Uppercase. Undefined accepts every method. */
-  methods?: string[];
-  dedupe?: {
-    field: WebhookField;
-    ttlSeconds?: number;
-  };
-  challengeField?: WebhookField;
-  maxBodyBytes?: number;
+/**
+ * Thrown when INITIALIZE_AUTH carries a version below 1. Version 0 is reserved
+ * for the uninitialized auth scope.
+ */
+declare class InvalidAuthVersionError extends Error {
+  readonly documentId: string;
+  readonly version: number;
+  constructor(documentId: string, version: number);
 }
-interface WebhookSpec {
-  /** Distinguishes several endpoint families within one package. */
-  name: string;
-  defaults?: WebhookPolicy;
-  onRequest: (request: WebhookRequest) => Promise<WebhookReply> | WebhookReply;
-  policyFor?: (key: string) => Promise<WebhookPolicy | undefined> | WebhookPolicy | undefined;
+/** Thrown when a duplicate would lose the source policy's version or creator binding. */
+declare class AuthPolicyNotPreservedError extends Error {
+  readonly documentId: string;
+  constructor(documentId: string);
 }
-interface WebhookEndpointInfo {
-  key: string;
-  token: string;
-  url: string;
-  createdAt: string;
+/**
+ * Thrown when a grant referenced by REMOVE_GRANT or MOVE_GRANT does not exist.
+ */
+declare class GrantNotFoundError extends Error {
+  readonly grantId: string;
+  constructor(grantId: string);
 }
-interface IWebhookEndpoints {
-  endpointFor(key: string): Promise<Omit<WebhookEndpointInfo, "key">>;
-  revoke(key: string): Promise<void>;
-  list(): Promise<WebhookEndpointInfo[]>;
+/**
+ * Thrown when a disallowed action (UNDO, REDO) targets the auth scope.
+ */
+declare class AuthActionNotAllowedError extends Error {
+  readonly actionType: string;
+  constructor(actionType: string);
 }
-interface IWebhookScope {
-  register(spec: WebhookSpec): Promise<IWebhookEndpoints>;
-  readonly hasPublicOrigin: boolean;
+declare class HashMismatchError extends Error {
+  protected _scope: string;
+  protected _document: PHDocument;
+  protected _operation: Operation;
+  constructor(scope: string, document: PHDocument, operation: Operation);
+  get document(): PHDocument;
+  get scope(): string;
+  get operation(): Operation;
 }
-interface IHttpScope {
-  readonly owner: string;
-  readonly baseUrl: string;
-  get(path: string, handler: RouteHandler): ScopedRouteHandle;
-  get(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
-  post(path: string, handler: RouteHandler): ScopedRouteHandle;
-  post(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
-  put(path: string, handler: RouteHandler): ScopedRouteHandle;
-  put(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
-  patch(path: string, handler: RouteHandler): ScopedRouteHandle;
-  patch(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
-  delete(path: string, handler: RouteHandler): ScopedRouteHandle;
-  delete(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
-  /** Registered independently of GET: a HEAD response is not a bodyless GET. */
-  head(path: string, handler: RouteHandler): ScopedRouteHandle;
-  head(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
-  route(spec: RouteSpec): ScopedRouteHandle;
-  nodeRoute(spec: NodeRouteSpec): ScopedRouteHandle;
-  readonly webhooks: IWebhookScope;
-  /** Release every route this scope registered. Called on package teardown. */
-  dispose(): void;
+/**
+ * Thrown when replay or import requires a document model version that is not
+ * registered. Carries the data the UI needs to explain the mismatch.
+ */
+declare class UnsupportedDocumentModelVersionError extends Error {
+  readonly documentType: string;
+  readonly requiredVersion: number;
+  readonly availableVersions: number[];
+  constructor(documentType: string, requiredVersion: number, availableVersions: number[]);
+  static isError(error: unknown): error is UnsupportedDocumentModelVersionError;
 }
 //#endregion
-//#region processors/types.d.ts
-type ProcessorDispatchResult = {
-  id: string;
-  status: string;
+//#region document-model/upgrades.d.ts
+/** Upgrade reducer transforms a document from one version to another */
+type UpgradeReducer<TFrom extends PHBaseState, TTo extends PHBaseState> = (document: PHDocument<TFrom>, action: Action) => PHDocument<TTo>;
+type ModelVersion = number;
+/** Metadata about a version transition */
+type UpgradeTransition = {
+  toVersion: ModelVersion;
+  upgradeReducer: UpgradeReducer<any, any>;
+  description?: string;
+};
+type TupleMember<T extends readonly unknown[]> = T[number];
+/** Manifest declaring all supported versions and upgrade paths */
+type UpgradeManifest<TVersions extends readonly number[]> = {
+  documentType: string;
+  latestVersion: TupleMember<TVersions>;
+  supportedVersions: TVersions;
+  upgrades: { [V in Exclude<TupleMember<TVersions>, 1> as `v${V}`]: UpgradeTransition; };
 };
-interface IProcessorDispatch {
-  execute(docId: string, branch: string, actions: Action[], signal?: AbortSignal, meta?: Record<string, unknown>): Promise<ProcessorDispatchResult>;
-}
-interface IProcessorHostModuleBase {
-  analyticsStore: IAnalyticsStore;
-  relationalDb: IRelationalDb;
-  processorApp: ProcessorApp;
-  dispatch: IProcessorDispatch;
-  getReadModel<T>(name: string): T;
-  config?: Map<string, unknown>;
-  /**
-   * The package's slice of the HTTP surface, bound to its own namespace.
-   *
-   * Declared on the host-agnostic base rather than on each host's module so
-   * the two cannot drift: codegen types generated processors against
-   * reactor-browser's `IProcessorHostModule`, and the same source has to
-   * compile against reactor-api's.
-   *
-   * Absent whenever the host has no HTTP server — processors also run in the
-   * browser — and on the reactor when the package's name cannot be resolved to
-   * a routable namespace, so a caller must always check before using it.
-   */
-  http?: IHttpScope;
-}
 /**
- * Filter for matching operations to processors.
- * All fields are optional arrays - when provided, operations must match at least one value in each specified field.
- * When a field is undefined or empty, it matches all values for that field.
+ * Canonical document-model version normalization: documents stamped with 0
+ * or nothing at all predate versioning and are treated as version 1, the
+ * same version the registry assigns unversioned modules. Every consumer
+ * that resolves a module or compares versions must use this rule; resolving
+ * 0 to "latest" instead re-pins a legacy document's history to whichever
+ * module happens to be newest.
  */
-type ProcessorFilter = {
-  documentType?: string[];
-  scope?: string[];
-  branch?: string[];
-  documentId?: string[];
-};
+declare function normalizeDocumentModelVersion(version: number | undefined | null): number;
 /**
- * Describes an object that can process operations.
+ * Applies an UPGRADE_DOCUMENT action to a document.
+ * Handles all upgrade scenarios including initial upgrades, no-ops, and multi-step upgrades.
+ *
+ * Behavior based on fromVersion/toVersion:
+ * - fromVersion === toVersion (and fromVersion > 0): No-op - return unchanged document
+ * - fromVersion > toVersion: Throw DowngradeNotSupportedError
+ * - All other cases: Apply upgradePath transitions (if provided), then apply initialState, set version
  */
-interface IProcessor {
-  /**
-   * Processes a list of operations with context.
-   * Called when operations match this processor's filter.
-   *
-   * Delivery is at-least-once. Within a document's scope and branch, each
-   * call is in ordinal order, and an operation delivered late comes with
-   * every later operation of its stream this processor was already given.
-   * Across documents there is no ordering guarantee. A processor receives one
-   * `onOperations` call at a time; the next call begins after the previous
-   * resolves.
-   */
-  onOperations(operations: OperationWithContext[]): Promise<void>;
-  /**
-   * Called when the processor is disconnected.
-   * Used to clean up any resources allocated during processor creation.
-   */
-  onDisconnect(): Promise<void>;
-}
+declare function applyUpgradeDocumentAction(document: PHDocument, action: UpgradeDocumentAction, upgradePath?: UpgradeTransition[]): PHDocument;
+/** CREATE_DOCUMENT fixes `protocolVersions`; this puts them back after a reducer. */
+declare function withProtocolVersions<TDocument extends PHDocument>(document: TDocument, protocolVersions: PHDocument["header"]["protocolVersions"]): TDocument;
 /**
- * Relates a processor to its filter configuration.
+ * Applies a DELETE_DOCUMENT action, or a PURGE_DOCUMENT marker, to a document.
+ * Marks the document as deleted in the document scope state.
  */
-type ProcessorRecord = {
-  processor: IProcessor;
-  filter: ProcessorFilter;
-  startFrom?: "beginning" | "current";
-  id?: string;
-};
+declare function applyDeleteDocumentAction(document: PHDocument, action: DeleteDocumentAction | PurgeDocumentAction): PHDocument;
 /**
- * A factory function that creates processor records for a given drive.
- * Called once per drive when the drive is first detected or when the factory is registered.
+ * Computes the ordered list of upgrade transitions needed to move from
+ * fromVersion to toVersion using the provided manifest.
+ * Walks keys v(fromVersion+1)..v(toVersion) and throws a descriptive Error
+ * if the manifest is absent or any step is missing.
  */
-type ProcessorFactory = (driveHeader: PHDocumentHeader, processorApp?: ProcessorApp) => Promise<ProcessorRecord[]> | ProcessorRecord[];
-/** Takes a processor host module and builds processor factories using its context. */
-type ProcessorFactoryBuilder<TModule extends IProcessorHostModuleBase = IProcessorHostModuleBase> = {
-  bivarianceHack(module: TModule): Promise<ProcessorFactory> | ProcessorFactory;
-}["bivarianceHack"];
-type ProcessorStatus = "active" | "errored";
-type TrackedProcessor = {
-  processorId: string;
-  factoryId: string;
-  driveId: string;
-  processorIndex: number;
-  record: ProcessorRecord;
-  lastOrdinal: number;
-  status: ProcessorStatus;
-  lastError: string | undefined;
-  lastErrorTimestamp: Date | undefined;
-  /**
-   * Clears the error and resolves once the replay from the cursor completes.
-   * Safe from anywhere, but awaiting it from this processor's own
-   * `onOperations` waits on itself: the replay runs after that call returns.
-   * A no-op once the processor has been removed.
-   */
-  retry: () => Promise<void>;
+declare function computeUpgradeTransitions(manifest: UpgradeManifest<readonly number[]> | undefined, fromVersion: number, toVersion: number): UpgradeTransition[];
+//#endregion
+//#region document-model/versioned-replay.d.ts
+type VersionedReducers = Record<number, Reducer<PHBaseState>>;
+type VersionedReplayConfig = {
+  reducers: VersionedReducers;
+  upgradeManifest?: UpgradeManifest<readonly number[]>;
 };
 /**
- * Manages processor creation and destruction based on drive operations.
+ * Version-aware document replay. Replays a versioned document through per-version
+ * reducers, applying upgrade transitions at segment boundaries.
+ *
+ * Algorithm (D5):
+ *   a. Build spine from operations["document"]. Empty spine or no upgrades → legacy fallback.
+ *   b. Collect UPGRADE_DOCUMENT ops from the spine.
+ *   c. Seed state from the creation upgrade (fromVersion===0). Missing seed with validated
+ *      upgrades throws; otherwise falls back to legacy.
+ *   d. Identify validated upgrades (fromVersion > 0, version increases). Compute per-scope
+ *      boundaries using revision snapshot (preferred) or timestamp fallback.
+ *   e. Loop over version segments, replaying each scope's ops through the matching reducer,
+ *      then applying the upgrade transition before the next segment.
+ *   f. Set header.revision["document"], verify per-scope hashes against state at op-time
+ *      (not post-upgrade state) when checkHashes is false, and map timestamps from input.
+ *
+ * operations must include ALL scopes (document scope is NOT stripped).
+ * reuseOperationResultingState is ignored by this function — zip operations never carry
+ * resultingState.
  */
-interface IProcessorManager {
-  /**
-   * Registers a processor factory.
-   * Immediately creates processors for all existing drives and resolves once
-   * every factory run has completed and its processors are bound. Their
-   * backfills run afterwards, on each processor's own queue. If processors
-   * from an earlier registration under the same identifier are still
-   * draining, or a call of the previous factory is still in flight, the
-   * factory runs after they have settled, so awaiting a re-registration of
-   * a factory from inside that factory or one of its processors'
-   * `onOperations` waits on itself.
-   */
-  registerFactory(identifier: string, factory: ProcessorFactory): Promise<void>;
-  /**
-   * Unregisters a processor factory. Resolves once its processors receive no
-   * new deliveries and their cursors are deleted; each one's in-flight
-   * delivery finishes first, then `onDisconnect` runs. Safe to call from
-   * inside a processor's own `onOperations`.
-   */
-  unregisterFactory(identifier: string): Promise<void>;
-  /**
-   * Gets a tracked processor by its ID.
-   */
-  get(processorId: string): TrackedProcessor | undefined;
-  /**
-   * Gets all tracked processors.
-   */
-  getAll(): TrackedProcessor[];
-}
-type ProcessorApp = (typeof PROCESSOR_APPS)[number];
-type ProcessorApps = readonly ProcessorApp[];
+declare function replayDocumentVersioned<TState extends PHBaseState>(initialState: TState, operations: DocumentOperations, config: VersionedReplayConfig, header: PHDocumentHeader, dispatch?: SignalDispatch, options?: ReplayDocumentOptions): PHDocument<TState>;
 //#endregion
-//#region processors/relational/types.d.ts
-type IRelationalQueryMethods = "selectFrom" | "selectNoFrom" | "with" | "withRecursive";
-type IRelationalQueryBuilder<Schema = unknown> = Pick<QueryCreator<Schema>, IRelationalQueryMethods> & {
-  withSchema: (schema: string) => IRelationalQueryBuilder<Schema>;
-};
-type HashAlgorithms = "fnv1a";
-type IBaseRelationalDb<Schema = unknown> = Kysely<Schema>;
+//#region document-model/files.d.ts
+declare function createZip(document: PHDocument): Promise<Uint8Array>;
 /**
- * The standardized relational database interface for relational db processors.
- * This abstraction provides type-safe database operations while hiding the underlying
- * database framework implementation details.
- **/
-type IRelationalDb<Schema = unknown> = IBaseRelationalDb<Schema> & {
-  createNamespace<NamespaceSchema>(namespace: string): Promise<IRelationalDb<ExtractProcessorSchemaOrSelf<NamespaceSchema>>>;
-  queryNamespace<NamespaceSchema>(namespace: string): IRelationalQueryBuilder<NamespaceSchema>;
+ * Creates a minimal ZIP backup from strand data.
+ * Used when the full document is not available (e.g., in onOperations handler).
+ * Creates a ZIP with minimal header and empty operations.
+ */
+declare function createMinimalZip(data: MinimalBackupData): Promise<Uint8Array>;
+declare function baseSaveToFileHandle(document: PHDocument, input: FileSystemFileHandle): Promise<void>;
+declare function baseLoadFromInput<TState extends PHBaseState>(input: FileInput, reducer: Reducer<TState>, options?: ReplayDocumentOptions): Promise<PHDocument<TState>>;
+declare function baseLoadFromInputVersioned<TState extends PHBaseState>(input: FileInput, config: VersionedReplayConfig, options?: ReplayDocumentOptions): Promise<PHDocument<TState>>;
+type BulkArchiveEntry = {
+  /** "/"-separated zip path of a file entry (no trailing slash). */
+  path: string;
+  data: Uint8Array;
 };
-type ExtractProcessorSchemaOrSelf<TProcessor> = TProcessor extends RelationalDbProcessor<infer TSchema> ? TSchema : TProcessor;
-type RelationalDbProcessorClass<TSchema> = typeof RelationalDbProcessor<TSchema>;
-interface IRelationalDbProcessor<TDatabaseSchema = unknown> extends IProcessor {
-  namespace: string;
-  query: IRelationalQueryBuilder<TDatabaseSchema>;
-  filter: ProcessorFilter;
-  initAndUpgrade(): Promise<void>;
-}
-declare const IS_RELATIONAL_DB_PROCESSOR: unique symbol;
 /**
- * Base class for relational db processors that require a relational database storage.
- * This class abstracts database initialization, migration management, and resource cleanup,
- * allowing derived classes to focus on business logic.
+ * Whether this zip is a single Powerhouse document: the document's four JSON
+ * entries (header/state/current-state/operations) at the archive root. A
+ * bulk archive has a folder tree instead. Returns false for any input that
+ * is not a readable zip.
  */
-declare abstract class RelationalDbProcessor<TDatabaseSchema = unknown> implements IRelationalDbProcessor<TDatabaseSchema> {
-  protected _namespace: string;
-  protected _filter: ProcessorFilter;
-  protected relationalDb: IRelationalDb<TDatabaseSchema>;
-  constructor(_namespace: string, _filter: ProcessorFilter, relationalDb: IRelationalDb<TDatabaseSchema>);
-  static [IS_RELATIONAL_DB_PROCESSOR]: boolean;
-  /**
-   * Returns the namespace for a given drive id.
-   * This method can be overridden by derived classes to provide a custom namespace.
-   */
-  static getNamespace(driveId: string): string;
-  static query<Schema>(this: RelationalDbProcessorClass<Schema>, driveId: string, db: IRelationalDb<any>): IRelationalQueryBuilder<Schema>;
-  /**
-   * Processes a list of operations with context.
-   * Called when operations match this processor's filter.
-   */
-  abstract onOperations(operations: OperationWithContext[]): Promise<void>;
-  /**
-   * Returns the filter for the processor.
-   * This method can be overridden by derived classes to provide a custom filter.
-   */
-  get filter(): ProcessorFilter;
-  /**
-   * Returns the namespace used by the processor.
-   */
-  get namespace(): string;
-  get query(): IRelationalQueryBuilder<TDatabaseSchema>;
-  /**
-   * Abstract method that derived classes must implement.
-   * This method is meant to be called on subclasses to initialize and upgrade the database.
-   */
-  abstract initAndUpgrade(): Promise<void>;
-  /**
-   * Called when the processor is disconnected.
-   * This method is meant to be overridden by subclasses to clean up resources.
-   */
-  abstract onDisconnect(): Promise<void>;
-}
+declare function isDocumentZip(data: Uint8Array): Promise<boolean>;
+/**
+ * The file entries of a zip (directory entries excluded). Used for bulk
+ * archives; throws when the archive holds no files. Note this does NOT
+ * validate that the entries are document zips — pair with isDocumentZip.
+ */
+declare function parseBulkArchive(data: Uint8Array): Promise<BulkArchiveEntry[]>;
+/**
+ * Assemble a zip from raw entries. A key ending in "/" with empty data is a
+ * directory entry, so an archive's folder structure survives a round-trip.
+ */
+declare function zipEntries(entries: Record<string, Uint8Array>): Promise<Uint8Array>;
+declare const documentModelLoadFromInput: LoadFromInput<DocumentModelPHState>;
+declare const documentModelSaveToFileHandle: SaveToFileHandle;
+declare function writeFileBrowser(path: string, name: string, stream: Uint8Array): Promise<string>;
+declare function readFileBrowser(path: string): void;
+declare function fetchFileBrowser(url: string): Promise<{
+  data: Buffer;
+  mimeType?: string;
+}>;
+declare const getFileBrowser: (file: string) => Promise<void>;
 //#endregion
-//#region processors/relational/utils.d.ts
+//#region document-model/header.d.ts
 /**
- * Hashes a string to a lowercase base-26 string.
- * @param str The string to hash.
- * @param length The length of the hash. Defaults to 10.
- * @param algorithm The hashing algorithm to use. Defaults to "fnv1a".
- * @returns The hashed string.
+ * Creates a verification-only signer from a public key.
+ * This signer can only verify signatures, not sign data.
+ *
+ * @param pubKey - The public key to use for verification.
+ * @returns An ISigner that can only verify signatures.
  */
-declare function hashNamespace(str: string, length?: number): string;
+declare function createVerificationSigner(pubKey: JsonWebKey): Promise<ISigner>;
 /**
- * Creates a RelationalDb instance with namespace support.
- * @param baseDb The base RelationalDb instance to enhance.
- * @param baseOptions The default options for namespace creation. Hashes namespace by default.
- * @returns The enhanced RelationalDb instance.
+ * Signs a header. Generally, this is not called directly, but rather through
+ * {@link createSignedHeader}.
+ *
+ * @param parameters - The parameters used to sign the header.
+ * @param signer - The signer of the document.
+ *
+ * @returns The signature of the header.
  */
-declare function createRelationalDb<Schema>(baseDb: IBaseRelationalDb<Schema>, baseOptions?: NamespaceOptions): IRelationalDb<Schema>;
-type NamespaceOptions = {
-  hashNamespace?: boolean;
-};
-declare function createNamespacedDb<Schema>(db: IBaseRelationalDb<any>, namespace: string, options?: NamespaceOptions): Promise<IRelationalDb<Schema>>;
-declare function createNamespacedQueryBuilder<Schema>(db: IBaseRelationalDb<any>, namespace: string, options?: NamespaceOptions): IRelationalQueryBuilder<Schema>;
+declare const sign: (parameters: SigningParameters, signer: ISigner) => Promise<string>;
 /**
- * Returns a query builder for a RelationalDb instance.
- * @param query The RelationalDb instance to convert.
- * @returns The IRelationalQueryBuilder instance.
+ * Verifies a header signature. Generally, this is not called directly, but
+ * rather through {@link validateHeader}.
+ *
+ * @param parameters - The parameters used to sign the header.
+ * @param signature - The signature to verify.
+ * @param signer - The signer of the document.
  */
-declare function relationalDbToQueryBuilder<TSchema>(query: IBaseRelationalDb<TSchema>): IRelationalQueryBuilder<TSchema>;
+declare const verify: (parameters: SigningParameters, signature: string, signer: ISigner) => Promise<void>;
+/**
+ * Validates a header signature.
+ */
+declare const validateHeader: (header: PHDocumentHeader) => Promise<void>;
+/**
+ * Creates a header that has yet to be signed. This header is not valid, but
+ * can be input into {@link createSignedHeader} to create a signed header.
+ *
+ * With `protocolVersions` requiring v2 signatures the header takes a random
+ * nonce and the id {@link deriveDocumentId} gives, so `id` must be omitted.
+ *
+ * @returns An unsigned header for a document.
+ */
+declare const createPresignedHeader: (id?: string, documentType?: string, protocolVersions?: ProtocolVersions) => PHDocumentHeader;
+/**
+ * A header for a copy of a document headed `source`. A copy is v2-required
+ * when its source is or when `policy` asks for it, and then takes a derived id;
+ * otherwise it takes `id`. It keeps the source's other protocol versions.
+ */
+declare function createCopyHeader(source: Pick<PHDocumentHeader, "documentType" | "protocolVersions">, id?: string, policy?: SignaturePolicy$1): PHDocumentHeader;
+/** Whether a v2-required `header` carries the id its params derive. */
+declare function hasDerivedDocumentId(header: PHDocumentHeader): boolean;
+/**
+ * Creates a new, signed header for a document. This will replace the id of the
+ * document.
+ *
+ * @param unsignedHeader - The unsigned header to created the signed header from.
+ * @param signer - The signer of the document.
+ *
+ * @returns A new signed header for a document. Some fields are mutable and
+ * some are not. See the PHDocumentHeader type for more information.
+ */
+declare const createSignedHeader: (unsignedHeader: PHDocumentHeader, documentType: string, signer: ISigner) => Promise<PHDocumentHeader>;
+/**
+ * Creates a signed header for a document. The document header requires a signer
+ * as the document id is a cryptographic signature.
+ *
+ * @param documentType - The type of the document.
+ * @param signer - The signer of the document.
+ *
+ * @returns The signed header for a document. Some fields are mutable and
+ * some are not. See the PHDocumentHeader type for more information.
+ */
+declare const createSignedHeaderForSigner: (documentType: string, signer: ISigner) => Promise<PHDocumentHeader>;
 //#endregion
-//#region document-model/action-signature.d.ts
-declare const ACTION_SIGNATURE_V2_PREFIX = "v2:";
-/** The log an operation is stored in, which a v2 tuple is bound to. */
-type ActionSigningTarget = {
-  documentId: string;
-  branch: string;
+//#region document-model/peer-agreement.d.ts
+/** The reactor feature flags a capability's support is a function of. */
+type PeerCapabilityFlags = {
+  readonly [flag: string]: boolean | undefined;
+};
+/** A document protocol, named by its `protocolVersions` key. */
+type ProtocolCapability = {
+  kind: "protocol";
+  name: string;
+  /** What a peer that announces nothing is assumed to support. */
+  baseline: readonly number[];
+  supported(flags: PeerCapabilityFlags): readonly number[];
+  /** The version new documents take when peers agree. Absent: not negotiated. */
+  preferred?(flags: PeerCapabilityFlags): number;
+  /** A header may omit the key. */
+  optional: boolean;
+};
+/** A feature that changes what a peer sends or expects on the wire. */
+type FeatureCapability = {
+  kind: "feature";
+  name: string;
+  baseline: readonly number[];
+  supported(flags: PeerCapabilityFlags): readonly number[];
+};
+type PeerCapability = ProtocolCapability | FeatureCapability;
+/** A purged document's protocol; never preferred, so creation never selects it. */
+declare const DOCUMENT_PURGE_PROTOCOL = "document-purge";
+/** A peer that takes refusals of polled purge markers on the poll. */
+declare const MARKER_REFUSAL_FEATURE = "marker-refusal";
+declare const PEER_CAPABILITIES: readonly PeerCapability[];
+/** `base` plus `extra`; an extra replaces a base entry of the same name. */
+declare function mergePeerCapabilities(base: readonly PeerCapability[], extra: readonly PeerCapability[]): PeerCapability[];
+declare const PEER_MANIFEST_FORMAT = 1;
+type Supports = {
+  protocols: {
+    [protocol: string]: readonly number[];
+  };
+  features: {
+    [feature: string]: readonly number[];
+  };
 };
-/** Who a v2 tuple attributes the action to; both halves are in the preimage. */
-type ActionSignerIdentity = {
-  user: UserActionSigner;
-  app: AppActionSigner;
+type PeerManifest = Supports & {
+  format: 1;
+  /** The signer's did:key, when configured; informational. */
+  appKey?: string;
+  /** Grows with every start of the reactor; a peer ignores an older one. */
+  sequence: number;
+  /** base64url(sha256(canonicalJson(Supports & { sequence }))) */
+  revision: string;
+};
+/** What this reactor supports, for every capability it registers. */
+declare function localSupports(capabilities: readonly PeerCapability[], flags: PeerCapabilityFlags): Supports;
+/** What a peer that announces nothing supports. */
+declare function legacySupports(capabilities: readonly PeerCapability[]): Supports;
+declare function manifestRevision(supports: Supports, sequence?: number): string;
+declare function localPeerManifest(capabilities: readonly PeerCapability[], flags: PeerCapabilityFlags, appKey?: string, sequence?: number): PeerManifest;
+/** A manifest sent before the one already held; silence carries no sequence. */
+declare function isOlderManifest(next: PeerManifest | null, held: PeerManifest | null | undefined): boolean;
+/** A peer's manifest, or the baselines for a peer that announced none. */
+declare function peerSupports(manifest: PeerManifest | null, capabilities: readonly PeerCapability[]): Supports;
+/**
+ * A manifest as received from a peer, or null when it is not one. Formats only
+ * add fields, so one of an unknown format is read as its two maps.
+ */
+declare function readPeerManifest(value: unknown): PeerManifest | null;
+/** Why a document may not go to a peer. */
+type HoldReason = {
+  protocol: string;
+  version: number;
+  peerSupports: readonly number[];
+};
+/** Only keys this reactor registers are judged; an absent key agrees. */
+declare function holdReason(peer: Supports, versions: {
+  readonly [protocol: string]: number;
+}, capabilities: readonly PeerCapability[]): HoldReason | undefined;
+/** Whether a peer runs every version this reactor does, so nothing is held. */
+declare function coversLocal(peer: Supports, local: Supports, capabilities: readonly PeerCapability[]): boolean;
+/**
+ * protocolVersions for a new document: per negotiated protocol, the highest
+ * version up to the local preference that every member supports, else the
+ * lowest local one. `requested` wins over what is selected.
+ */
+declare function selectProtocolVersions(input: {
+  capabilities: readonly PeerCapability[];
+  flags: PeerCapabilityFlags;
+  members: Iterable<Supports>;
+  requested?: {
+    readonly [protocol: string]: number;
+  };
+}): {
+  [protocol: string]: number;
 };
-/** A value that would not survive a JSON store round trip unchanged. */
-declare class CanonicalJsonError extends Error {
-  constructor(path: string, detail: string);
-}
-/** Sorted-key JSON, as the state hash encodes; drops `undefined` properties. */
-declare function canonicalJson(value: unknown, label?: string): string;
-/** Actions the reactor reduces itself, onto the document scope. */
-declare const DOCUMENT_SCOPE_ACTION_TYPES: ReadonlySet<string>;
-/** Where a document-scope action writes: `sourceId` or `documentId`. */
-declare function targetDocumentId(action: {
-  type: string;
-  input: unknown;
-}, fallback: string): string;
-/** The log an action submitted to a job on `documentId` is stored in. */
-declare function actionSigningTarget(action: {
-  type: string;
-  input: unknown;
-}, documentId: string, branch: string): ActionSigningTarget;
-/** The identity a signer writes into `context.signer`, and signs over. */
-declare function actionSignerIdentity(signer: {
-  user?: UserActionSigner;
-  app?: AppActionSigner;
-}): ActionSignerIdentity;
-/** The v2 preimage; throws `CanonicalJsonError` on an unsignable action. */
-declare function actionPreimageV2(action: Action, target: ActionSigningTarget, signer: ActionSignerIdentity): string;
-/** `"v2:" + base64url(sha256(preimage))`, unpadded. */
-declare function hashActionV2(action: Action, target: ActionSigningTarget, signer: ActionSignerIdentity): Promise<string>;
-/** Signs `action` as a v2 tuple; the message layout is the legacy one. */
-declare function signActionV2(params: {
+//#endregion
+//#region document-model/purge.d.ts
+declare const PURGE_DOCUMENT = "PURGE_DOCUMENT";
+type PurgeMarkerOperation = Operation & {
+  action: PurgeDocumentAction;
+};
+type ActionLike = Pick<Action, "type">;
+declare function isPurgeMarker(value: Action): value is PurgeDocumentAction;
+declare function isPurgeMarker(value: Operation): value is PurgeMarkerOperation;
+declare function isPurgeMarker(value: OperationWithContext$1): value is OperationWithContext$1 & {
+  operation: PurgeMarkerOperation;
+};
+declare function isPurgeMarker(value: ActionLike | {
+  action?: ActionLike;
+} | {
+  operation: Operation;
+}): boolean;
+/** An unsigned marker; `purgedAtUtcIso` is the action's own timestamp. */
+declare function purgeDocumentAction(input: Omit<PurgeDocumentActionInput, "purgedAtUtcIso">, options?: {
+  id?: string;
+  timestampUtcMs?: string;
+}): PurgeDocumentAction;
+/** The sole row of a purged stream: document/main, index 0, skip 0, hash "". */
+declare function purgeMarkerOperation(action: PurgeDocumentAction): PurgeMarkerOperation;
+/** Protocol versions of a purged id; derived, never stored. */
+declare function purgedProtocolVersions(): {
+  [protocol: string]: number;
+};
+//#endregion
+//#region document-model/reducer.d.ts
+declare function replayOperations<TState extends PHBaseState = PHBaseState>(initialState: TState, clearedOperations: DocumentOperations, stateReducer: StateReducer<TState>, header: PHDocumentHeader, dispatch?: SignalDispatch, documentReducer?: typeof baseReducer, skipHeaderOperations?: SkipHeaderOperations, options?: ReplayDocumentOptions): PHDocument<TState>;
+/**
+ * Updates the document state based on the provided action.
+ *
+ * @param state The current state of the document.
+ * @param action The action being applied to the document.
+ * @param skip The number of operations to skip before applying the action.
+ * @param reuseLastOperationIndex Whether to reuse the last operation index (used when a an UNDO operation is performed after an existing one).
+ * @param context The operation context for deterministic ID generation.
+ * @returns The updated document state.
+ */
+declare function updateDocument<TDocument extends PHDocument>(document: TDocument, action: Action, reuseLastOperationIndex: boolean, skip: number, context: OperationContext, operation?: Operation, skipIndexValidation?: boolean): TDocument;
+/**
+ * Processes an UNDO or REDO action.
+ *
+ * @param document The current state of the document.
+ * @param action The action being applied to the document.
+ * @param skip The number of operations to skip before applying the action.
+ * @returns The updated document, calculated skip value and transformed action (if applied).
+ */
+declare function processUndoRedo<TState extends PHBaseState = PHBaseState>(document: PHDocument<TState>, action: Action, skip: number, protocolVersion?: number): {
+  document: PHDocument<TState>;
   action: Action;
-  target: ActionSigningTarget;
-  signer: ActionSignerIdentity;
-  sign: ActionSigningHandler;
-  previousStateHash?: string;
-}): Promise<Signature>;
-/** Element [2] carries the v2 prefix, whether or not it is well formed. */
-declare function isV2ActionHash(hash: string): boolean;
-/** The strict shape of a v2 tuple, apart from what its hash covers. */
-declare function v2TupleProblem(tuple: Signature): string | undefined;
+  skip: number;
+  reuseLastOperationIndex: boolean;
+};
+/**
+ * Base document reducer that wraps a custom document reducer and handles
+ * document-level actions such as undo, redo, and set name.
+ *
+ * @template TGlobalState - The type of the state of the custom reducer.
+ * @template TAction - The type of the actions of the custom reducer.
+ * @param state - The current state of the document.
+ * @param action - The action object to apply to the state.
+ * @param customReducer - The custom reducer that implements the application logic
+ * specific to the document's state.
+ * @returns The new state of the document.
+ */
+declare function baseReducer<TState extends PHBaseState = PHBaseState>(document: PHDocument<TState>, action: Action, customReducer: StateReducer<TState>, dispatch?: SignalDispatch, options?: ReducerOptions): PHDocument<TState>;
+/**
+ * Helper function to create a document model reducer.
+ *
+ * @remarks
+ * This function creates a new reducer that wraps the provided `reducer` with
+ * `documentReducer`, adding support for document actions:
+ *   - `SET_NAME`
+ *   - `UNDO`
+ *   - `REDO`
+ *
+ * It also updates the document-related attributes on every operation.
+ *
+ * @param reducer - The custom reducer to wrap.
+ * @param documentReducer - The document reducer to use.
+ *
+ * @returns The new reducer.
+ */
+declare function createReducer<TState extends PHBaseState = PHBaseState>(stateReducer: StateReducer<TState>, documentReducer?: typeof baseReducer): Reducer<TState>;
+//#endregion
+//#region document-model/reducers.d.ts
+declare const documentModelHeaderReducer: DocumentModelHeaderOperations;
+declare const documentModelModuleReducer: DocumentModelModuleOperations;
+declare const documentModelOperationErrorReducer: DocumentModelOperationErrorOperations;
+declare const documentModelOperationExampleReducer: DocumentModelOperationExampleOperations;
+declare const documentModelOperationReducer: DocumentModelOperationOperations;
+declare const documentModelStateSchemaReducer: DocumentModelStateOperations;
+declare const documentModelVersioningReducer: DocumentModelVersioningOperations;
+declare const documentModelStateReducer: StateReducer<DocumentModelPHState>;
+declare const documentModelReducer: Reducer<DocumentModelPHState>;
 //#endregion
 //#region document-model/schemas.d.ts
 type definedNonNullAny = {};
@@ -1792,57 +2303,554 @@ declare const ManifestSchema: z.ZodObject<{
   pwa: z.ZodOptional<z.ZodType<PHConnectPwa, unknown, z.core.$ZodTypeInternals<PHConnectPwa, unknown>>>;
 }, z.core.$strip>;
 //#endregion
-//#region document-model/upgrades.d.ts
-/** Upgrade reducer transforms a document from one version to another */
-type UpgradeReducer<TFrom extends PHBaseState, TTo extends PHBaseState> = (document: PHDocument<TFrom>, action: Action) => PHDocument<TTo>;
-type ModelVersion = number;
-/** Metadata about a version transition */
-type UpgradeTransition = {
-  toVersion: ModelVersion;
-  upgradeReducer: UpgradeReducer<any, any>;
-  description?: string;
+//#region document-model/validation.d.ts
+/**
+ * Reserved operation names from base reducer (core/actions.ts).
+ * These names cannot be used for custom operations.
+ */
+declare const RESERVED_OPERATION_NAMES: readonly ["UNDO", "REDO", "SET_NAME", "SET_PREFERRED_EDITOR", "NOOP", "PURGE_DOCUMENT"];
+type ReservedOperationName = (typeof RESERVED_OPERATION_NAMES)[number];
+/**
+ * Operation names become the literal action `type` string at runtime and the
+ * key for codegen's action union. They must be SCREAMING_SNAKE_CASE so the
+ * generated TypeScript is valid.
+ */
+declare const OPERATION_NAME_PATTERN: RegExp;
+declare function isValidOperationNameFormat(name: string): boolean;
+/**
+ * Check if name conflicts with base reducer actions (case-insensitive).
+ */
+declare function isReservedOperationName(name: string): boolean;
+/**
+ * Get all operation names from all modules in the latest specification.
+ * Returns names in uppercase for case-insensitive comparison.
+ */
+declare function getAllOperationNames(state: DocumentModelGlobalState, excludeOperationId?: string): string[];
+/**
+ * Validate operation name is not reserved or duplicate. Throws on failure.
+ *
+ * @param name - The operation name to validate
+ * @param state - The document model global state
+ * @param excludeOperationId - Optional operation ID to exclude (for rename validation)
+ * @throws Error if the name is reserved or a duplicate
+ */
+declare function validateOperationName(name: string, state: DocumentModelGlobalState, excludeOperationId?: string): void;
+declare function validateInitialState(initialState: string, allowEmptyState?: boolean): ValidationError[];
+declare function validateStateSchemaName(schema: string, documentName: string, scope?: string, allowEmptySchema?: boolean): ValidationError[];
+declare function validateModules(modules: ModuleSpecification[]): ValidationError[];
+declare function validateModule(mod: ModuleSpecification): ValidationError[];
+declare function validateModuleOperation(operation: OperationSpecification): ValidationError[];
+/**
+ * Find a module in the latest specification by id, or throw. Reducers that
+ * mutate-by-id should call this up front so an unknown id fails loudly
+ * instead of silently no-opping.
+ */
+declare function findModuleOrThrow(state: DocumentModelGlobalState, moduleId: string): ModuleSpecification;
+/**
+ * Find an operation in the latest specification by id, or throw. Same
+ * rationale as findModuleOrThrow — reducers that target an operation must
+ * fail loudly when the operation doesn't exist.
+ */
+declare function findOperationOrThrow(state: DocumentModelGlobalState, operationId: string): OperationSpecification;
+/**
+ * Find an operation error by id across all operations in the latest
+ * specification, or throw. Throws on a duplicate id too: setters act on a
+ * single error, so an ambiguous id must fail loudly rather than mutate an
+ * arbitrary match.
+ */
+declare function findOperationErrorOrThrow(state: DocumentModelGlobalState, errorId: string): OperationErrorSpecification;
+/**
+ * Find an operation example (code example) by id across all operations in the
+ * latest specification, or throw. Throws on a duplicate id for the same reason
+ * as findOperationErrorOrThrow.
+ */
+declare function findOperationExampleOrThrow(state: DocumentModelGlobalState, exampleId: string): CodeExample;
+/**
+ * Assert no module in the latest specification already uses `id`. Modules are
+ * targeted by id by the setter/delete/reorder reducers, so a duplicate id makes
+ * those operations ambiguous.
+ */
+declare function assertModuleIdUnique(state: DocumentModelGlobalState, id: string): void;
+/**
+ * Assert no operation in the latest specification already uses `id`. Operations
+ * are targeted by id across all modules, so the id must be unique document-wide.
+ */
+declare function assertOperationIdUnique(state: DocumentModelGlobalState, id: string): void;
+/**
+ * Assert no operation error in the latest specification already uses `id`.
+ * Error ids are targeted document-wide by the setter/delete reducers, so the id
+ * must be unique to keep those operations unambiguous.
+ */
+declare function assertOperationErrorIdUnique(state: DocumentModelGlobalState, id: string): void;
+/**
+ * Assert no operation example in the latest specification already uses `id`.
+ * Example ids are targeted document-wide by the update/delete reducers, so the
+ * id must be unique to keep those operations unambiguous.
+ */
+declare function assertOperationExampleIdUnique(state: DocumentModelGlobalState, id: string): void;
+declare function validateOperations(operations: DocumentOperations): ValidationError[];
+//#endregion
+//#region processors/deletion.d.ts
+/** The id a DELETE_DOCUMENT or PURGE_DOCUMENT removes; undefined otherwise. */
+declare function deletedDocumentId(op: OperationWithContext$1): string | undefined;
+//#endregion
+//#region processors/http.d.ts
+/** Methods a package route may bind. OPTIONS belongs to the CORS layer. */
+type RouteMethod = "DELETE" | "GET" | "HEAD" | "PATCH" | "POST" | "PUT";
+interface RouteUser {
+  address: string;
+  chainId: number;
+  networkId: string;
+  appKey: string;
+}
+type RouteActor = {
+  user: RouteUser | undefined;
+  authEnabled: boolean;
+};
+type AuthorizerResult = {
+  authorized: true;
+} |
+/** Refused; the scope answers with its own JSON error envelope. */
+{
+  authorized: false;
+  status: number;
+  message: string;
+} | {
+  authorized: false;
+  response: Response;
+};
+/** A route-specific gate, for policies the standard modes cannot express. */
+type RouteAuthorizer = (req: IncomingMessage) => Promise<AuthorizerResult> | AuthorizerResult;
+/** How a route authenticates. */
+type RouteAuth =
+/** Default. A verifiable bearer is required; a caller without one gets 401. */
+"renown" | "renown-optional" | "public" | RouteAuthorizer;
+/** How the request body reaches the handler. */
+type RouteBody =
+/** Default. Buffered, and readable through the Fetch Request. */
+"parsed" |
+/** Buffered and also handed over as `ctx.rawBody`, byte for byte. */
+"raw" |
+/** Not buffered; the Fetch Request body is the live request stream. */
+"stream" |
+/** The body is not read at all. */
+"none";
+interface RouteOptions {
+  auth?: RouteAuth;
+  body?: RouteBody;
+  /** Refuse a body larger than this with 413. Ignored when body is `stream`. */
+  maxBodyBytes?: number;
+  /** Serve sub-paths too, not just an exact match. */
+  prefix?: boolean;
+}
+/** Where the request reached the host, resolved through any reverse proxy. */
+interface RouteTransport {
+  proto: string;
+  host: string;
+  prefix: string;
+  baseUrl: string;
+}
+interface RouteContext {
+  /** Decoded path params. */
+  params: Record<string, string>;
+  user: RouteUser | undefined;
+  authEnabled: boolean;
+  /** The exact octets received. Present only when body is `raw`. */
+  rawBody: Buffer | undefined;
+  /** Aborts when the client disconnects. */
+  signal: AbortSignal;
+  transport: RouteTransport;
+}
+type RouteHandler = (request: Request, ctx: RouteContext) => Response | Promise<Response>;
+interface RouteSpec extends RouteOptions {
+  method: RouteMethod | RouteMethod[];
+  /** Relative to the scope: "runs/:id", never "/api/@scope/pkg/runs/:id". */
+  path: string;
+  handler: RouteHandler;
+}
+interface NodeRouteSpec extends Omit<RouteOptions, "body" | "maxBodyBytes"> {
+  method: RouteMethod | RouteMethod[];
+  path: string;
+  handler: (req: IncomingMessage, res: ServerResponse, ctx: Omit<RouteContext, "rawBody" | "signal">) => void | Promise<void>;
+}
+interface ScopedRouteHandle {
+  /** The absolute public URL this route answers on. */
+  readonly url: string;
+  dispose(): void;
+}
+type WebhookScheme = "none" |
+/** A shared secret presented verbatim. No digest, so no digest options. */
+"token" |
+/** The digest of the body, alone. */
+"hmac" |
+/** That digest behind a label, `sha256=<digest>`. */
+"hmac-prefixed" | "hmac-timestamped";
+/** Hashes a sender may compute the digest with. */
+type WebhookHashAlgorithm = "sha1" | "sha256" | "sha512";
+/** How the digest is written into the header. */
+type WebhookSignatureEncoding = "hex" | "base64";
+interface WebhookVerification {
+  scheme: WebhookScheme;
+  /** Resolved value, never a reference — the caller resolves refs. */
+  secret?: string;
+  /** Overrides the scheme's conventional header. */
+  header?: string;
+  /** Replay window for timestamped schemes. */
+  toleranceSeconds?: number;
+  algorithm?: WebhookHashAlgorithm;
+  /** Defaults to `hex`. Base64 comparison is case-sensitive; hex is not. */
+  encoding?: WebhookSignatureEncoding;
+  prefix?: string;
+}
+type WebhookField = string | {
+  header: string;
+} |
+/** Dot-separated path into the parsed body, e.g. `data.object.id`. */
+{
+  body: string;
+};
+interface WebhookRequest {
+  /** The caller's own key for this endpoint, e.g. a document id. */
+  key: string;
+  method: string;
+  path: string;
+  queryParams: Record<string, string>;
+  /** Lowercased, with credentials redacted. */
+  headers: Record<string, string>;
+  /** The exact bytes received. */
+  raw: Buffer;
+  /** JSON and form bodies decoded; anything else as text. */
+  body: unknown;
+}
+interface WebhookReply {
+  status: number;
+  body?: string;
+  contentType?: string;
+}
+interface WebhookPolicy {
+  verify?: WebhookVerification;
+  /** Uppercase. Undefined accepts every method. */
+  methods?: string[];
+  dedupe?: {
+    field: WebhookField;
+    ttlSeconds?: number;
+  };
+  challengeField?: WebhookField;
+  maxBodyBytes?: number;
+}
+interface WebhookSpec {
+  /** Distinguishes several endpoint families within one package. */
+  name: string;
+  defaults?: WebhookPolicy;
+  onRequest: (request: WebhookRequest) => Promise<WebhookReply> | WebhookReply;
+  policyFor?: (key: string) => Promise<WebhookPolicy | undefined> | WebhookPolicy | undefined;
+}
+interface WebhookEndpointInfo {
+  key: string;
+  token: string;
+  url: string;
+  createdAt: string;
+}
+interface IWebhookEndpoints {
+  endpointFor(key: string): Promise<Omit<WebhookEndpointInfo, "key">>;
+  revoke(key: string): Promise<void>;
+  list(): Promise<WebhookEndpointInfo[]>;
+}
+interface IWebhookScope {
+  register(spec: WebhookSpec): Promise<IWebhookEndpoints>;
+  readonly hasPublicOrigin: boolean;
+}
+interface IHttpScope {
+  readonly owner: string;
+  readonly baseUrl: string;
+  get(path: string, handler: RouteHandler): ScopedRouteHandle;
+  get(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
+  post(path: string, handler: RouteHandler): ScopedRouteHandle;
+  post(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
+  put(path: string, handler: RouteHandler): ScopedRouteHandle;
+  put(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
+  patch(path: string, handler: RouteHandler): ScopedRouteHandle;
+  patch(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
+  delete(path: string, handler: RouteHandler): ScopedRouteHandle;
+  delete(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
+  /** Registered independently of GET: a HEAD response is not a bodyless GET. */
+  head(path: string, handler: RouteHandler): ScopedRouteHandle;
+  head(path: string, options: RouteOptions, handler: RouteHandler): ScopedRouteHandle;
+  route(spec: RouteSpec): ScopedRouteHandle;
+  nodeRoute(spec: NodeRouteSpec): ScopedRouteHandle;
+  readonly webhooks: IWebhookScope;
+  /** Release every route this scope registered. Called on package teardown. */
+  dispose(): void;
+}
+//#endregion
+//#region processors/types.d.ts
+type ProcessorDispatchResult = {
+  id: string;
+  status: string;
+};
+interface IProcessorDispatch {
+  execute(docId: string, branch: string, actions: Action[], signal?: AbortSignal, meta?: Record<string, unknown>): Promise<ProcessorDispatchResult>;
+}
+interface IProcessorHostModuleBase {
+  analyticsStore: IAnalyticsStore;
+  relationalDb: IRelationalDb;
+  processorApp: ProcessorApp;
+  dispatch: IProcessorDispatch;
+  getReadModel<T>(name: string): T;
+  config?: Map<string, unknown>;
+  /**
+   * The package's slice of the HTTP surface, bound to its own namespace.
+   *
+   * Declared on the host-agnostic base rather than on each host's module so
+   * the two cannot drift: codegen types generated processors against
+   * reactor-browser's `IProcessorHostModule`, and the same source has to
+   * compile against reactor-api's.
+   *
+   * Absent whenever the host has no HTTP server — processors also run in the
+   * browser — and on the reactor when the package's name cannot be resolved to
+   * a routable namespace, so a caller must always check before using it.
+   */
+  http?: IHttpScope;
+}
+/**
+ * Filter for matching operations to processors.
+ * All fields are optional arrays - when provided, operations must match at least one value in each specified field.
+ * When a field is undefined or empty, it matches all values for that field.
+ */
+type ProcessorFilter = {
+  documentType?: string[];
+  scope?: string[];
+  branch?: string[];
+  documentId?: string[];
+};
+/**
+ * Describes an object that can process operations.
+ */
+interface IProcessor {
+  /**
+   * Processes a list of operations with context.
+   * Called when operations match this processor's filter.
+   *
+   * Delivery is at-least-once. Within a document's scope and branch, each
+   * call is in ordinal order, and an operation delivered late comes with
+   * every later operation of its stream this processor was already given.
+   * Across documents there is no ordering guarantee. A processor receives one
+   * `onOperations` call at a time; the next call begins after the previous
+   * resolves.
+   *
+   * A drive's processors also receive the drive's own DELETE_DOCUMENT or
+   * PURGE_DOCUMENT, whatever the filter, as the last delivery before
+   * `onDisconnect`. A purged document's operations other than its marker are
+   * not delivered. Erase a document's data on either deletion action.
+   */
+  onOperations(operations: OperationWithContext[]): Promise<void>;
+  /**
+   * Called when the processor is disconnected.
+   * Used to clean up any resources allocated during processor creation.
+   * Also runs when the factory is unregistered, so it is not a deletion signal.
+   */
+  onDisconnect(): Promise<void>;
+}
+/**
+ * Relates a processor to its filter configuration.
+ */
+type ProcessorRecord = {
+  processor: IProcessor;
+  filter: ProcessorFilter;
+  startFrom?: "beginning" | "current";
+  id?: string;
+};
+/**
+ * A factory function that creates processor records for a given drive.
+ * Called once per drive when the drive is first detected or when the factory is registered.
+ * The header is the drive's header at creation. For a purged drive it is
+ * minimal: only `id` and `documentType` are set, and `slug` and `name` are
+ * empty, so a factory that selects drives by slug or name makes no processor
+ * for it and the deletion stays owed.
+ */
+type ProcessorFactory = (driveHeader: PHDocumentHeader, processorApp?: ProcessorApp) => Promise<ProcessorRecord[]> | ProcessorRecord[];
+/** Takes a processor host module and builds processor factories using its context. */
+type ProcessorFactoryBuilder<TModule extends IProcessorHostModuleBase = IProcessorHostModuleBase> = {
+  bivarianceHack(module: TModule): Promise<ProcessorFactory> | ProcessorFactory;
+}["bivarianceHack"];
+type ProcessorStatus = "active" | "errored";
+type TrackedProcessor = {
+  processorId: string;
+  factoryId: string;
+  driveId: string;
+  processorIndex: number;
+  record: ProcessorRecord;
+  lastOrdinal: number;
+  status: ProcessorStatus;
+  lastError: string | undefined;
+  lastErrorTimestamp: Date | undefined;
+  /**
+   * Clears the error and resolves once the replay from the cursor completes.
+   * Safe from anywhere, but awaiting it from this processor's own
+   * `onOperations` waits on itself: the replay runs after that call returns.
+   * A no-op once the processor has been removed.
+   */
+  retry: () => Promise<void>;
+};
+/**
+ * Manages processor creation and destruction based on drive operations.
+ */
+interface IProcessorManager {
+  /**
+   * Registers a processor factory.
+   * Immediately creates processors for all existing drives and resolves once
+   * every factory run has completed and its processors are bound. Their
+   * backfills run afterwards, on each processor's own queue. A deleted drive
+   * whose deletion one of the factory's processors never received (it was not
+   * running, or its delivery threw) gets a processor too: it receives only the
+   * drive's `DELETE_DOCUMENT`, or its `PURGE_DOCUMENT` once purged, and is
+   * disconnected. That delivery is not awaited: it runs after this resolves,
+   * so a processor that hangs on it does not hold the registration, nor a
+   * later one: a drive whose deletion is still being delivered gets it from
+   * the new registration only if that delivery leaves it owed. If processors
+   * from an earlier registration under the same identifier are still
+   * draining, or a call of the previous factory is still in flight, the
+   * factory runs after they have settled, so awaiting a re-registration of
+   * a factory from inside that factory or one of its processors'
+   * `onOperations` waits on itself.
+   */
+  registerFactory(identifier: string, factory: ProcessorFactory): Promise<void>;
+  /**
+   * Unregisters a processor factory. Resolves once its processors receive no
+   * new deliveries and their cursors are released; each one's in-flight
+   * delivery finishes first, then `onDisconnect` runs. A released cursor no
+   * longer positions a processor: a re-registration starts each one afresh,
+   * per `startFrom`. It only records that the factory held a drive's data, so
+   * that a drive deleted before the factory registers again still gets its
+   * deletion delivered then. Safe to call from
+   * inside a processor's own `onOperations`.
+   */
+  unregisterFactory(identifier: string): Promise<void>;
+  /**
+   * Gets a tracked processor by its ID.
+   */
+  get(processorId: string): TrackedProcessor | undefined;
+  /**
+   * Gets all tracked processors, including an errored entry for each
+   * processor whose drive's deletion threw; its `retry()` delivers the
+   * deletion again.
+   */
+  getAll(): TrackedProcessor[];
+}
+type ProcessorApp = (typeof PROCESSOR_APPS)[number];
+type ProcessorApps = readonly ProcessorApp[];
+//#endregion
+//#region processors/relational/types.d.ts
+/** Columns {@link RelationalDbProcessor.deleteDocumentRows} matches. */
+declare const DOCUMENT_ID_COLUMNS: readonly ["document_id", "documentId"];
+type IRelationalQueryMethods = "selectFrom" | "selectNoFrom" | "with" | "withRecursive";
+type IRelationalQueryBuilder<Schema = unknown> = Pick<QueryCreator<Schema>, IRelationalQueryMethods> & {
+  withSchema: (schema: string) => IRelationalQueryBuilder<Schema>;
 };
-type TupleMember<T extends readonly unknown[]> = T[number];
-/** Manifest declaring all supported versions and upgrade paths */
-type UpgradeManifest<TVersions extends readonly number[]> = {
-  documentType: string;
-  latestVersion: TupleMember<TVersions>;
-  supportedVersions: TVersions;
-  upgrades: { [V in Exclude<TupleMember<TVersions>, 1> as `v${V}`]: UpgradeTransition; };
+type HashAlgorithms = "fnv1a";
+type IBaseRelationalDb<Schema = unknown> = Kysely<Schema>;
+/**
+ * The standardized relational database interface for relational db processors.
+ * This abstraction provides type-safe database operations while hiding the underlying
+ * database framework implementation details.
+ **/
+type IRelationalDb<Schema = unknown> = IBaseRelationalDb<Schema> & {
+  createNamespace<NamespaceSchema>(namespace: string): Promise<IRelationalDb<ExtractProcessorSchemaOrSelf<NamespaceSchema>>>;
+  queryNamespace<NamespaceSchema>(namespace: string): IRelationalQueryBuilder<NamespaceSchema>;
 };
+type ExtractProcessorSchemaOrSelf<TProcessor> = TProcessor extends RelationalDbProcessor<infer TSchema> ? TSchema : TProcessor;
+type RelationalDbProcessorClass<TSchema> = typeof RelationalDbProcessor<TSchema>;
+interface IRelationalDbProcessor<TDatabaseSchema = unknown> extends IProcessor {
+  namespace: string;
+  query: IRelationalQueryBuilder<TDatabaseSchema>;
+  filter: ProcessorFilter;
+  initAndUpgrade(): Promise<void>;
+}
+declare const IS_RELATIONAL_DB_PROCESSOR: unique symbol;
 /**
- * Canonical document-model version normalization: documents stamped with 0
- * or nothing at all predate versioning and are treated as version 1, the
- * same version the registry assigns unversioned modules. Every consumer
- * that resolves a module or compares versions must use this rule; resolving
- * 0 to "latest" instead re-pins a legacy document's history to whichever
- * module happens to be newest.
+ * Base class for relational db processors that require a relational database storage.
+ * This class abstracts database initialization, migration management, and resource cleanup,
+ * allowing derived classes to focus on business logic.
  */
-declare function normalizeDocumentModelVersion(version: number | undefined | null): number;
+declare abstract class RelationalDbProcessor<TDatabaseSchema = unknown> implements IRelationalDbProcessor<TDatabaseSchema> {
+  protected _namespace: string;
+  protected _filter: ProcessorFilter;
+  protected relationalDb: IRelationalDb<TDatabaseSchema>;
+  /** The drive the factory created this processor for. */
+  protected _driveId?: string | undefined;
+  constructor(_namespace: string, _filter: ProcessorFilter, relationalDb: IRelationalDb<TDatabaseSchema>,
+  /** The drive the factory created this processor for. */
+  _driveId?: string | undefined);
+  static [IS_RELATIONAL_DB_PROCESSOR]: boolean;
+  /**
+   * Returns the namespace for a given drive id.
+   * This method can be overridden by derived classes to provide a custom namespace.
+   */
+  static getNamespace(driveId: string): string;
+  static query<Schema>(this: RelationalDbProcessorClass<Schema>, driveId: string, db: IRelationalDb<any>): IRelationalQueryBuilder<Schema>;
+  /**
+   * Processes a list of operations with context.
+   * Called when operations match this processor's filter.
+   */
+  abstract onOperations(operations: OperationWithContext[]): Promise<void>;
+  /**
+   * Returns the filter for the processor.
+   * This method can be overridden by derived classes to provide a custom filter.
+   */
+  get filter(): ProcessorFilter;
+  /**
+   * Returns the namespace used by the processor.
+   */
+  get namespace(): string;
+  get query(): IRelationalQueryBuilder<TDatabaseSchema>;
+  /** True for this processor's drive when its namespace is that drive's alone. */
+  protected isNamespaceDrive(documentId: string): boolean;
+  /** Deletes a document's rows from every table with a document-id column. */
+  protected deleteDocumentRows(documentId: string): Promise<void>;
+  /** Drops this processor's namespace and every table in it. */
+  protected dropNamespace(): Promise<void>;
+  private namespaceSchema;
+  /**
+   * Abstract method that derived classes must implement.
+   * This method is meant to be called on subclasses to initialize and upgrade the database.
+   */
+  abstract initAndUpgrade(): Promise<void>;
+  /**
+   * Called when the processor is disconnected.
+   * This method is meant to be overridden by subclasses to clean up resources.
+   */
+  abstract onDisconnect(): Promise<void>;
+}
+//#endregion
+//#region processors/relational/utils.d.ts
 /**
- * Applies an UPGRADE_DOCUMENT action to a document.
- * Handles all upgrade scenarios including initial upgrades, no-ops, and multi-step upgrades.
- *
- * Behavior based on fromVersion/toVersion:
- * - fromVersion === toVersion (and fromVersion > 0): No-op - return unchanged document
- * - fromVersion > toVersion: Throw DowngradeNotSupportedError
- * - All other cases: Apply upgradePath transitions (if provided), then apply initialState, set version
+ * Hashes a string to a lowercase base-26 string.
+ * @param str The string to hash.
+ * @param length The length of the hash. Defaults to 10.
+ * @param algorithm The hashing algorithm to use. Defaults to "fnv1a".
+ * @returns The hashed string.
  */
-declare function applyUpgradeDocumentAction(document: PHDocument, action: UpgradeDocumentAction, upgradePath?: UpgradeTransition[]): PHDocument;
-/** CREATE_DOCUMENT fixes `protocolVersions`; this puts them back after a reducer. */
-declare function withProtocolVersions<TDocument extends PHDocument>(document: TDocument, protocolVersions: PHDocument["header"]["protocolVersions"]): TDocument;
+declare function hashNamespace(str: string, length?: number): string;
 /**
- * Applies a DELETE_DOCUMENT action to a document.
- * Marks the document as deleted in the document scope state.
+ * Creates a RelationalDb instance with namespace support.
+ * @param baseDb The base RelationalDb instance to enhance.
+ * @param baseOptions The default options for namespace creation. Hashes namespace by default.
+ * @returns The enhanced RelationalDb instance.
  */
-declare function applyDeleteDocumentAction(document: PHDocument, action: DeleteDocumentAction): PHDocument;
+declare function createRelationalDb<Schema>(baseDb: IBaseRelationalDb<Schema>, baseOptions?: NamespaceOptions): IRelationalDb<Schema>;
+type NamespaceOptions = {
+  hashNamespace?: boolean;
+};
+declare function createNamespacedDb<Schema>(db: IBaseRelationalDb<any>, namespace: string, options?: NamespaceOptions): Promise<IRelationalDb<Schema>>;
+/** The schema behind a handle from `createNamespace`; undefined otherwise. */
+declare function namespaceSchemaOf(db: object): string | undefined;
+declare function createNamespacedQueryBuilder<Schema>(db: IBaseRelationalDb<any>, namespace: string, options?: NamespaceOptions): IRelationalQueryBuilder<Schema>;
 /**
- * Computes the ordered list of upgrade transitions needed to move from
- * fromVersion to toVersion using the provided manifest.
- * Walks keys v(fromVersion+1)..v(toVersion) and throws a descriptive Error
- * if the manifest is absent or any step is missing.
+ * Returns a query builder for a RelationalDb instance.
+ * @param query The RelationalDb instance to convert.
+ * @returns The IRelationalQueryBuilder instance.
  */
-declare function computeUpgradeTransitions(manifest: UpgradeManifest<readonly number[]> | undefined, fromVersion: number, toVersion: number): UpgradeTransition[];
+declare function relationalDbToQueryBuilder<TSchema>(query: IBaseRelationalDb<TSchema>): IRelationalQueryBuilder<TSchema>;
 //#endregion
 //#region document-model/types.d.ts
 type State = {
@@ -2690,6 +3698,13 @@ type DeleteDocumentActionInput = {
   documentId: string;
   propagate?: "none" | "cascade";
 };
+type PurgeDocumentActionInput = {
+  documentId: string;
+  documentType: string;
+  /** The same instant as the action's timestampUtcMs. */
+  purgedAtUtcIso: string;
+  requestId: string;
+};
 type AddRelationshipActionInput = {
   sourceId: string;
   targetId: string;
@@ -2719,6 +3734,12 @@ type DeleteDocumentAction = Action & {
   type: "DELETE_DOCUMENT";
   input: DeleteDocumentActionInput;
 };
+/** Reserved document-scope marker; a purged document's only operation. */
+type PurgeDocumentAction = Action & {
+  type: "PURGE_DOCUMENT";
+  scope: "document";
+  input: PurgeDocumentActionInput;
+};
 type AddRelationshipAction = Action & {
   type: "ADD_RELATIONSHIP";
   input: AddRelationshipActionInput;
@@ -3332,6 +4353,6 @@ type PowerhouseConfig = {
   connect?: PHConnectRuntimeConfig;
 };
 //#endregion
-export { AddOperationErrorInput as $, AddOperationErrorInputSchema as $a, deleteOperationError as $c, SetOperationNameInput as $i, baseReducerVersion as $l, MutationMoveOperationArgs as $n, SetOperationErrorNameInputSchema as $o, ReorderChangeLogItemsInput as $r, ProcessorApps as $s, DocumentModelOperationExampleAction as $t, defaultDocumentState as $u, PHPackageProvider as A, UndoRedoAction as Aa, WebhookScheme as Ac, PHDocumentSignatureInfo as Ad, SetModelExtensionInput as Ai, setOperationErrorName as Al, MakeEmpty as An, RedoActionSchema as Ao, MutationUpdateStateExampleArgs as Ar, isV2ActionHash as As, DeleteOperationErrorAction as At, sortOperations as Au, ServiceActions as B, UpgradeDocumentActionInput as Ba, addChangeLogItem as Bc, SetNameActionInput as Bi, updateChangeLogItem as Bl, Mutation as Bn, SetAuthorWebsiteInputSchema as Bo, PieceModule as Br, HashAlgorithms as Bs, DocumentModelDocumentModelModule as Bt, PHBaseState as Bu, PHConnectPwaUrlPattern as C, SkipHeaderOperations as Ca, ScopedRouteHandle as Cc, setNameOperation as Cd, SetAuthorWebsiteAction as Ci, setModelName as Cl, ISigner as Cn, PieceModuleSchema as Co, MutationSetOperationReducerArgs as Cr, CanonicalJsonError as Cs, DeleteChildDocumentInput as Ct, readOnly as Cu, PHConnectRenownAdapters as D, Undo as Da, WebhookPolicy as Dc, ActionSigner as Dd, SetModelDescriptionAction as Di, setOperationDescription as Dl, IsStateOfType as Dn, PublisherSchema as Do, MutationUndoArgs as Dr, actionSigningTarget as Ds, DeleteModuleAction as Dt, reshuffleByTimestampAndIndex as Du, PHConnectRenown as E, SubgraphModule as Ea, WebhookHashAlgorithm as Ec, undoOperationV2 as Ed, SetInitialStateInput as Ei, setName as El, IsDocumentOfType as En, PowerhouseModulesSchema as Eo, MutationSetStateSchemaArgs as Er, actionSignerIdentity as Es, DeleteDocumentActionInput as Et, reshuffleByTimestamp as Eu, ParsedCmdResult as F, UpdateRelationshipAction as Fa, ActionContext as Fc, DEFAULT_ANALYTICS_PROCESSOR_DB_NAME as Fd, SetModuleDescriptionAction as Fi, setOperationScope as Fl, Maybe as Fn, ReorderOperationErrorsInputSchema as Fo, OperationsByScope as Fr, createNamespacedQueryBuilder as Fs, DeleteStateExampleAction as Ft, Capability as Fu, ActionVerificationHandler as G, UpgradeTransition as Ga, addStateExample as Gc, SetOperationErrorCodeInput as Gi, IntegrityIssueType as Gl, MutationAddOperationExampleArgs as Gn, SetModelNameInputSchema as Go, RedoAction as Gr, IRelationalQueryMethods as Gs, DocumentModelLib as Gt, createAuthState as Gu, ActionErrorCallback as H, ValidationError as Ha, addOperation as Hc, SetOperationDescriptionAction as Hi, updateStateExample as Hl, MutationAddModuleArgs as Hn, SetModelDescriptionInputSchema as Ho, Publisher as Hr, IRelationalDb as Hs, DocumentModelHeaderAction as Ht, PHGroupState as Hu, PathValidation as I, UpdateRelationshipActionInput as Ia, actionContext as Ic, DEFAULT_RELATIONAL_PROCESSOR_DB_NAME as Id, SetModuleDescriptionInput as Ii, setOperationTemplate as Il, MinimalBackupData as In, ReorderOperationExamplesInputSchema as Io, PartialRecord as Ir, createRelationalDb as Is, DeleteStateExampleInput as It, Condition as Iu, AddChangeLogItemInput as J, computeUpgradeTransitions as Ja, buildSignedAction as Jc, SetOperationErrorNameAction as Ji, PHDocumentMeta as Jl, MutationDeleteModuleArgs as Jn, SetNameActionInputSchema as Jo, ReducerOptions as Jr, IProcessor as Js, DocumentModelModuleAction as Jt, createGlobalState as Ju, Actions as K, applyDeleteDocumentAction as Ka, baseActions as Kc, SetOperationErrorDescriptionAction as Ki, PHDocument as Kl, MutationAddStateExampleArgs as Kn, SetModuleDescriptionInputSchema as Ko, RedoActionInput as Kr, RelationalDbProcessor as Ks, DocumentModelLocalState as Kt, createBaseState as Ku, PowerhouseConfig as L, UpdateStateExampleAction as La, actionFromAction as Lc, PROCESSOR_APPS as Ld, SetModuleNameAction as Li, setPreferredEditor as Ll, ModuleSpecification as Ln, ReorderStateExamplesInputSchema as Lo, PartialState as Lr, hashNamespace as Ls, DocumentAction as Lt, Grant as Lu, PHRenownPrivyAdapterConfig as M, UpdateChangeLogItemInput as Ma, WebhookSpec as Mc, UserActionSigner as Md, SetModelIdInput as Mi, setOperationName as Ml, MakeOptional as Mn, ReorderChangeLogItemsInputSchema as Mo, OperationErrorSpecification as Mr, targetDocumentId as Ms, DeleteOperationExampleAction as Mt, updateHeaderRevision as Mu, PHRenownRainbowAdapterConfig as N, UpdateOperationExampleAction as Na, WebhookVerification as Nc, deserializeSignature as Nd, SetModelNameAction as Ni, setOperationReducer as Nl, Manifest as Nn, ReorderModuleOperationsInputSchema as No, OperationIndex as Nr, v2TupleProblem as Ns, DeleteOperationExampleInput as Nt, withSignaturePolicy as Nu, PHConnectRuntimeConfig as O, UndoAction as Oa, WebhookReply as Oc, AppActionSigner as Od, SetModelDescriptionInput as Oi, setOperationErrorCode as Ol, LoadFromFile as On, PwaConfigSchema as Oo, MutationUpdateChangeLogItemInputArgs as Or, canonicalJson as Os, DeleteModuleInput as Ot, skipHeaderOperations as Ou, PackageManagerArgs as P, UpdateOperationExampleInput as Pa, Action as Pc, serializeSignature as Pd, SetModelNameInput as Pi, setOperationSchema as Pl, MappedOperation as Pn, ReorderModulesInputSchema as Po, OperationSpecification as Pr, createNamespacedDb as Ps, DeleteOperationInput as Pt, AuthGroups as Pu, AddOperationErrorAction as Q, AddModuleInputSchema as Qa, deleteOperation as Qc, SetOperationNameAction as Qi, baseCreateDocument as Ql, MutationDeleteStateExampleArgs as Qn, SetOperationErrorDescriptionInputSchema as Qo, ReorderChangeLogItemsAction as Qr, ProcessorApp as Qs, DocumentModelOperationErrorOperations as Qt, defaultBaseState as Qu, PowerhousePackage as R, UpdateStateExampleInput as Ra, actionSigner as Rc, SetModuleNameInput as Ri, setStateSchema as Rl, MoveOperationAction as Rn, ScopeStateSchema as Ro, PhAiToolAnnotations as Rr, relationalDbToQueryBuilder as Rs, DocumentModelAction as Rt, Operand as Ru, PHConnectPwaRuntimeCaching as S, SkipHeaderOperationIndex as Sa, RouteUser as Sc, redoOperation as Sd, SetAuthorNameInput as Si, setModelId as Sl, ISignalResult as Sn, OperationSpecificationSchema as So, MutationSetOperationNameArgs as Sr, ActionSigningTarget as Ss, DeleteChangeLogItemInput as St, prepareOperations as Su, PHConnectReactorFeatureFlags as T, StateReducer as Ta, WebhookField as Tc, undoOperation as Td, SetInitialStateAction as Ti, setModuleName as Tl, InputMaybe as Tn, PowerhouseModuleSchema as To, MutationSetOperationTemplateArgs as Tr, actionPreimageV2 as Ts, DeleteDocumentAction as Tt, replayDocument as Tu, ActionSignatureContext as U, UpgradeManifest as Ua, addOperationError as Uc, SetOperationDescriptionInput as Ui, verifyOperationSignature as Ul, MutationAddOperationArgs as Un, SetModelExtensionInputSchema as Uo, Query as Ur, IRelationalDbProcessor as Us, DocumentModelHeaderOperations as Ut, Principal as Uu, DEFAULT_REGISTRY_URL as V, User as Va, addModule as Vc, SetNameOperation as Vi, updateOperationExample as Vl, MutationAddChangeLogItemInputArgs as Vn, SetInitialStateInputSchema as Vo, PowerhouseModule as Vr, IBaseRelationalDb as Vs, DocumentModelGlobalState as Vt, PHDocumentState as Vu, ActionSigningHandler as W, UpgradeReducer as Wa, addOperationExample as Wc, SetOperationErrorCodeAction as Wi, IntegrityIssueSubType as Wl, MutationAddOperationErrorArgs as Wn, SetModelIdInputSchema as Wo, Redo as Wr, IRelationalQueryBuilder as Ws, DocumentModelInput as Wt, backfillAuthState as Wu, AddModuleInput as X, withProtocolVersions as Xa, deleteChangeLogItem as Xc, SetOperationErrorTemplateAction as Xi, appendWithoutApplying as Xl, MutationDeleteOperationErrorArgs as Xn, SetOperationDescriptionInputSchema as Xo, RemoveRelationshipAction as Xr, IProcessorHostModuleBase as Xs, DocumentModelOperationAction as Xt, createState as Xu, AddModuleAction as Y, normalizeDocumentModelVersion as Ya, createAction as Yc, SetOperationErrorNameInput as Yi, addUndo as Yl, MutationDeleteOperationArgs as Yn, SetNameActionSchema as Yo, ReleaseNewVersionAction as Yr, IProcessorDispatch as Ys, DocumentModelModuleOperations as Yt, createLocalState as Yu, AddOperationAction as Z, AddChangeLogItemInputSchema as Za, deleteModule as Zc, SetOperationErrorTemplateInput as Zi, attachBranch as Zl, MutationDeleteOperationExampleArgs as Zn, SetOperationErrorCodeInputSchema as Zo, RemoveRelationshipActionInput as Zr, IProcessorManager as Zs, DocumentModelOperationErrorAction as Zt, defaultAuthState as Zu, PHConnectPwa as _, SignalResult as _a, RouteHandler as _c, Operation as _d, SchemaSetNameAction as _i, setAuthorName as _l, IAction as _n, ManifestSchema as _o, MutationSetOperationDescriptionArgs as _r, UpdateStateExampleInputSchema as _s, CreateDocument as _t, merge as _u, PHConnectAi as a, SetOperationScopeInput as aa, ProcessorStatus as ac, ProtocolVersions as ad, ReorderOperationErrorsInput as ai, operationExampleCreators as al, DocumentModelUtils as an, ConfigEntrySchema as ao, MutationReorderOperationExamplesArgs as ar, SetOperationTemplateInputSchema as as, AddStateExampleAction as at, garbageCollect as au, PHConnectPwaIcon as b, SignatureVerificationHandler as ba, RouteSpec as bc, OperationWithContext$1 as bd, ScopeState as bi, setModelDescription as bl, IOperation as bn, OperationErrorSchema as bo, MutationSetOperationErrorNameArgs as br, ACTION_SIGNATURE_V2_PREFIX as bs, CreateState as bt, parseResultingState as bu, PHConnectDefaultDrive as c, SetPreferredEditorAction as ca, IHttpScope as cc, SignaturePolicy$1 as cd, ReorderStateExamplesAction as ci, operationWithContext as cl, DocumentOperationsIgnoreMap as cn, DeleteModuleInputSchema as co, MutationSetAuthorWebsiteArgs as cr, SetStateSchemaInputSchema as cs, AssertIsStateOfType as ct, getDocumentLastModified as cu, PHConnectDriveSection as d, SetStateSchemaAction as da, NodeRouteSpec as dc, isSignaturePolicy as dd, RevisionsFilter as di, reorderChangeLogItems as dl, EditorDispatch as dn, DeleteOperationInputSchema as do, MutationSetModelExtensionArgs as dr, StateSchema as ds, ConfigEntry as dt, isDocumentAction as du, SetOperationReducerAction as ea, ProcessorDispatchResult as ec, defaultGlobalState as ed, ReorderModuleOperationsAction as ei, deleteOperationExample as el, DocumentModelOperationExampleOperations as en, AddOperationExampleInputSchema as eo, MutationRedoArgs as er, SetOperationErrorTemplateInputSchema as es, AddOperationExampleAction as et, checkCleanedOperationsIntegrity as eu, PHConnectDriveSections as f, SetStateSchemaInput as fa, RouteActor as fc, protocolVersionsFor as fd, SaveToFile as fi, reorderModuleOperations as fl, EditorModule as fn, DeleteStateExampleInputSchema as fo, MutationSetModelIdArgs as fr, UndoActionInputSchema as fs, ConfigEntryType as ft, isNoopOperation as fu, PHConnectPackages as g, SignalDispatch as ga, RouteContext as gc, DocumentOperations as gd, SchemaRedoAction as gi, reorderStateExamples as gl, GetDocumentOptions as gn, DocumentSpecificationSchema as go, MutationSetNameArgs as gr, UpdateOperationExampleInputSchema as gs, CreateChildDocumentSignal as gt, mapSkippedOperationsV2 as gu, PHConnectOpenPanel as h, Signal as ha, RouteBody as hc, v2RequiredProtocolVersions as hd, SchemaNOOPAction as hi, reorderOperationExamples as hl, FileInput as hn, DocumentModelInputSchema as ho, MutationSetModuleNameArgs as hr, UpdateChangeLogItemInputSchema as hs, CreateChildDocumentInput as ht, mapSkippedOperations as hu, LogLevels as i, SetOperationScopeAction as ia, ProcessorRecord as ic, DocumentIdParams as id, ReorderOperationErrorsAction as ii, noop as il, DocumentModelStateOperations as in, CodeExampleSchema as io, MutationReorderOperationErrorsArgs as ir, SetOperationScopeInputSchema as is, AddRelationshipActionInput as it, filterDuplicatedOperations as iu, PHReactorRenown as j, UpdateChangeLogItemAction as ja, WebhookSignatureEncoding as jc, Signature as jd, SetModelIdAction as ji, setOperationErrorTemplate as jl, MakeMaybe as jn, RedoSchema as jo, NOOPAction as jr, signActionV2 as js, DeleteOperationErrorInput as jt, split as ju, PHConnectSentry as k, UndoActionInput as ka, WebhookRequest as kc, HashConfig as kd, SetModelExtensionAction as ki, setOperationErrorDescription as kl, LoadFromInput as kn, RedoActionInputSchema as ko, MutationUpdateOperationExampleArgs as kr, hashActionV2 as ks, DeleteOperationAction as kt, sortMappedOperations as ku, PHConnectDefaultDriveLocal as l, SetPreferredEditorActionInput as la, IWebhookEndpoints as lc, deriveDocumentId as ld, ReorderStateExamplesInput as li, redo as ll, DocumentSpecification as ln, DeleteOperationErrorInputSchema as lo, MutationSetInitialStateArgs as lr, Set_NameSchema as ls, Author as lt, groupOperationsByScope as lu, PHConnectInstance as m, Set_PreferredEditor as ma, RouteAuthorizer as mc, signaturePolicyOf as md, Scalars as mi, reorderOperationErrors as ml, Exact as mn, DocumentModelGlobalStateSchema as mo, MutationSetModuleDescriptionArgs as mr, UndoSchema as ms, CopyChildDocumentSignal as mt, isUndoRedo as mu, DrivePreserveStrategy as n, SetOperationSchemaAction as na, ProcessorFactoryBuilder as nc, defaultPHState as nd, ReorderModulesAction as ni, documentModelActions as nl, DocumentModelPHState as nn, AddStateExampleInputSchema as no, MutationReorderModuleOperationsArgs as nr, SetOperationReducerInputSchema as ns, AddOperationInput as nt, diffOperations as nu, PHConnectApp as o, SetOperationTemplateAction as oa, TrackedProcessor as oc, SIGNATURE_PROTOCOL as od, ReorderOperationExamplesAction as oi, operationFromAction as ol, DocumentModelVersioningAction as on, ConfigEntryTypeSchema as oo, MutationReorderStateExamplesArgs as or, SetPreferredEditorActionInputSchema as os, AddStateExampleInput as ot, garbageCollectDocumentOperations as ou, PHConnectDrives as p, Set_Name as pa, RouteAuth as pc, requestedSignaturePolicy as pd, SaveToFileHandle as pi, reorderModules as pl, EditorProps as pn, DocumentActionSchema as po, MutationSetModelNameArgs as pr, UndoActionSchema as ps, CopyChildDocumentInput as pt, isUndo as pu, AddChangeLogItemAction as q, applyUpgradeDocumentAction as qa, buildOperationSignature as qc, SetOperationErrorDescriptionInput as qi, PHDocumentHeader as ql, MutationDeleteChangeLogItemInputArgs as qn, SetModuleNameInputSchema as qo, Reducer as qr, RelationalDbProcessorClass as qs, DocumentModelModule as qt, createDocumentState as qu, LogLevel as r, SetOperationSchemaInput as ra, ProcessorFilter as rc, DEFAULT_SIGNATURE_POLICY as rd, ReorderModulesInput as ri, moveOperation as rl, DocumentModelStateAction as rn, AuthorSchema as ro, MutationReorderModulesArgs as rr, SetOperationSchemaInputSchema as rs, AddRelationshipAction as rt, filterDocumentOperationsResultingState as ru, PHConnectBranding as s, SetOperationTemplateInput as sa, AuthorizerResult as sc, SIGNATURE_PROTOCOL_V2 as sd, ReorderOperationExamplesInput as si, operationFromOperation as sl, DocumentModelVersioningOperations as sn, DeleteChangeLogItemInputSchema as so, MutationSetAuthorNameArgs as sr, SetPreferredEditorActionSchema as ss, AssertIsDocumentOfType as st, garbageCollectV2 as su, DrivePreserveStrategies as t, SetOperationReducerInput as ta, ProcessorFactory as tc, defaultLocalState as td, ReorderModuleOperationsInput as ti, deleteStateExample as tl, DocumentModelOperationOperations as tn, AddOperationInputSchema as to, MutationReorderChangeLogItemsInputArgs as tr, SetOperationNameInputSchema as ts, AddOperationExampleInput as tt, checkOperationsIntegrity as tu, PHConnectDefaultDriveRemote as u, SetPreferredEditorOperation as ua, IWebhookScope as uc, isDerivedDocumentId as ud, ReplayDocumentOptions as ui, releaseNewVersion as ul, ENSInfo as un, DeleteOperationExampleInputSchema as uo, MutationSetModelDescriptionArgs as ur, Set_PreferredEditorSchema as us, CodeExample as ut, hashDocumentStateForScope as uu, PHConnectPwaCacheStrategy as v, SignalResults as va, RouteMethod as vc, OperationContext as vd, SchemaSetPreferredEditorAction as vi, setAuthorWebsite as vl, ID as vn, ModuleSchema as vo, MutationSetOperationErrorCodeArgs as vr, definedNonNullAnySchema as vs, CreateDocumentAction as vt, nextSkipNumber as vu, PHConnectReactor as w, State as wa, WebhookEndpointInfo as wc, setPreferredEditorOperation as wd, SetAuthorWebsiteInput as wi, setModuleDescription as wl, Incremental as wn, PieceModulesSchema as wo, MutationSetOperationSchemaArgs as wr, DOCUMENT_SCOPE_ACTION_TYPES as ws, DeleteChildDocumentSignal as wt, removeExistingOperations as wu, PHConnectPwaManifest as x, SigningParameters as xa, RouteTransport as xc, operationOutcome as xd, SetAuthorNameAction as xi, setModelExtension as xl, ISignal as xn, OperationScopeSchema as xo, MutationSetOperationErrorTemplateArgs as xr, ActionSignerIdentity as xs, DeleteChangeLogItemAction as xt, precedes as xu, PHConnectPwaFileHandler as y, SignalType as ya, RouteOptions as yc, OperationOutcome as yd, SchemaUndoAction as yi, setInitialState as yl, IDocument as yn, MoveOperationInputSchema as yo, MutationSetOperationErrorDescriptionArgs as yr, isDefinedNonNullAny as ys, CreateDocumentActionInput as yt, operationsAreEqual as yu, ServiceAction as z, UpgradeDocumentAction as za, actions as zc, SetNameAction as zi, undo as zl, MoveOperationInput as zn, SetAuthorNameInputSchema as zo, PhAiToolDescriptor as zr, ExtractProcessorSchemaOrSelf as zs, DocumentModelDocument as zt, PHAuthState as zu };
+export { AddOperationErrorInput as $, HashAlgorithms as $a, PurgeMarkerOperation as $c, mentionedGroupIds as $d, reorderChangeLogItems as $f, SetOperationErrorTemplateInput as $i, UpgradeManifest as $l, isSignaturePolicy as $m, MutationMoveOperationArgs as $n, assertOperationExampleIdUnique as $o, isDocumentAction as $p, RemoveRelationshipActionInput as $r, ReorderOperationErrorsInputSchema as $s, DocumentModelOperationExampleAction as $t, documentModelInitialLocalState as $u, PHPackageProvider as A, UndoAction as Aa, UndoActionInputSchema as Ac, InitializeAuthActionInputSchema as Ad, addOperation as Af, SetModelDescriptionInput as Ai, createVerificationSigner as Al, PHGroupState as Am, MakeEmpty as An, RouteHandler as Ao, updateStateExample as Ap, MutationUpdateStateExampleArgs as Ar, DeleteStateExampleInputSchema as As, DeleteOperationErrorAction as At, isDocumentModelState as Au, ServiceActions as B, UpdateStateExampleInput as Ba, documentModelOperationErrorReducer as Bc, SetGrantActionInputSchema as Bd, deleteOperation as Bf, SetModuleNameInput as Bi, createZip as Bl, defaultBaseState as Bm, Mutation as Bn, WebhookPolicy as Bo, baseCreateDocument as Bp, PieceModule as Br, OperationSpecificationSchema as Bs, DocumentModelDocumentModelModule as Bt, buildOperationSignatureParams as Bu, PHConnectPwaUrlPattern as C, SigningParameters as Ca, SetOperationTemplateInputSchema as Cc, AuthRefusal as Cd, ActionContext as Cf, DEFAULT_ANALYTICS_PROCESSOR_DB_NAME as Ch, SetAuthorNameAction as Ci, peerSupports as Cl, Capability as Cm, ISigner as Cn, IWebhookScope as Co, setOperationScope as Cp, MutationSetOperationReducerArgs as Cr, ConfigEntrySchema as Cs, DeleteChildDocumentInput as Ct, BaseDocumentStateSchema as Cu, PHConnectRenownAdapters as D, StateReducer as Da, Set_NameSchema as Dc, ConditionContext as Dd, actions as Df, SetInitialStateAction as Di, createPresignedHeader as Dl, PHAuthState as Dm, IsStateOfType as Dn, RouteAuthorizer as Do, undo as Dp, MutationUndoArgs as Dr, DeleteOperationErrorInputSchema as Ds, DeleteModuleAction as Dt, assertIsDocumentModelDocument as Du, PHConnectRenown as E, State as Ea, SetStateSchemaInputSchema as Ec, AuthVerb as Ed, actionSigner as Ef, SetAuthorWebsiteInput as Ei, createCopyHeader as El, Operand as Em, IsDocumentOfType as En, RouteAuth as Eo, setStateSchema as Ep, MutationSetStateSchemaArgs as Er, DeleteModuleInputSchema as Es, DeleteDocumentActionInput as Et, DocumentModelSchema as Eu, ParsedCmdResult as F, UpdateOperationExampleAction as Fa, UpdateStateExampleInputSchema as Fc, RemoveGrantAction as Fd, buildOperationSignature as Ff, SetModelNameAction as Fi, BulkArchiveEntry as Fl, createDocumentState as Fm, Maybe as Fn, RouteUser as Fo, PHDocumentHeader as Fp, OperationsByScope as Fr, ManifestSchema as Fs, DeleteStateExampleAction as Ft, isDenied as Fu, ActionVerificationHandler as G, createNamespacedDb as Ga, documentModelStateSchemaReducer as Gc, applySetGrantAction as Gd, moveOperation as Gf, SetOperationDescriptionInput as Gi, isDocumentZip as Gl, DEFAULT_SIGNATURE_POLICY as Gm, MutationAddOperationExampleArgs as Gn, WebhookSpec as Go, filterDocumentOperationsResultingState as Gp, Query as Gr, PublisherSchema as Gs, DocumentModelLib as Gt, HASH_ALGORITHM_SHA1 as Gu, ActionErrorCallback as H, UpgradeDocumentActionInput as Ha, documentModelOperationReducer as Hc, applyInitializeAuthAction as Hd, deleteOperationExample as Hf, SetNameActionInput as Hi, documentModelSaveToFileHandle as Hl, defaultGlobalState as Hm, MutationAddModuleArgs as Hn, WebhookRequest as Ho, checkCleanedOperationsIntegrity as Hp, Publisher as Hr, PieceModulesSchema as Hs, DocumentModelHeaderAction as Ht, getUnixTimestamp as Hu, PathValidation as I, UpdateOperationExampleInput as Ia, definedNonNullAnySchema as Ic, RemoveGrantActionInput as Id, buildSignedAction as If, SetModelNameInput as Ii, baseLoadFromInput as Il, createGlobalState as Im, MinimalBackupData as In, ScopedRouteHandle as Io, PHDocumentMeta as Ip, PartialRecord as Ir, ModuleSchema as Is, DeleteStateExampleInput as It, ab2hex as Iu, AddChangeLogItemInput as J, hashNamespace as Ja, createReducer as Jc, decide as Jd, operationFromAction as Jf, SetOperationErrorDescriptionAction as Ji, writeFileBrowser as Jl, SIGNATURE_PROTOCOL as Jm, MutationDeleteModuleArgs as Jn, OPERATION_NAME_PATTERN as Jo, garbageCollectDocumentOperations as Jp, RedoActionInput as Jr, RedoActionSchema as Js, DocumentModelModuleAction as Jt, HASH_ENCODING_BASE64 as Ju, Actions as K, createNamespacedQueryBuilder as Ka, documentModelVersioningReducer as Kc, assertAuthPreservedOnDuplicate as Kd, noop as Kf, SetOperationErrorCodeAction as Ki, parseBulkArchive as Kl, DocumentIdParams as Km, MutationAddStateExampleArgs as Kn, WebhookVerification as Ko, filterDuplicatedOperations as Kp, Redo as Kr, PwaConfigSchema as Ks, DocumentModelLocalState as Kt, HASH_ALGORITHM_SHA256 as Ku, PowerhouseConfig as L, UpdateRelationshipAction as La, isDefinedNonNullAny as Lc, RemoveGrantActionInputSchema as Ld, createAction as Lf, SetModuleDescriptionAction as Li, baseLoadFromInputVersioned as Ll, createLocalState as Lm, ModuleSpecification as Ln, WebhookEndpointInfo as Lo, addUndo as Lp, PartialState as Lr, MoveOperationInputSchema as Ls, DocumentAction as Lt, base58Decode as Lu, PHRenownPrivyAdapterConfig as M, UndoRedoAction as Ma, UndoSchema as Mc, MoveGrantAction as Md, addOperationExample as Mf, SetModelExtensionInput as Mi, sign as Ml, backfillAuthState as Mm, MakeOptional as Mn, RouteOptions as Mo, IntegrityIssueSubType as Mp, OperationErrorSpecification as Mr, DocumentModelGlobalStateSchema as Ms, DeleteOperationExampleAction as Mt, AUTH_NO_GRANT_REASON as Mu, PHRenownRainbowAdapterConfig as N, UpdateChangeLogItemAction as Na, UpdateChangeLogItemInputSchema as Nc, MoveGrantActionInput as Nd, addStateExample as Nf, SetModelIdAction as Ni, validateHeader as Nl, createAuthState as Nm, Manifest as Nn, RouteSpec as No, IntegrityIssueType as Np, OperationIndex as Nr, DocumentModelInputSchema as Ns, DeleteOperationExampleInput as Nt, AUTH_VERSION_UNSUPPORTED_REASON as Nu, PHConnectRuntimeConfig as O, SubgraphModule as Oa, Set_PreferredEditorSchema as Oc, InitializeAuthAction as Od, addChangeLogItem as Of, SetInitialStateInput as Oi, createSignedHeader as Ol, PHBaseState as Om, LoadFromFile as On, RouteBody as Oo, updateChangeLogItem as Op, MutationUpdateChangeLogItemInputArgs as Or, DeleteOperationExampleInputSchema as Os, DeleteModuleInput as Ot, assertIsDocumentModelState as Ou, PackageManagerArgs as P, UpdateChangeLogItemInput as Pa, UpdateOperationExampleInputSchema as Pc, MoveGrantActionInputSchema as Pd, baseActions as Pf, SetModelIdInput as Pi, verify as Pl, createBaseState as Pm, MappedOperation as Pn, RouteTransport as Po, PHDocument as Pp, OperationSpecification as Pr, DocumentSpecificationSchema as Ps, DeleteOperationInput as Pt, DOCUMENT_DELETED_REASON as Pu, AddOperationErrorAction as Q, ExtractProcessorSchemaOrSelf as Qa, PURGE_DOCUMENT as Qc, isDocumentCreator as Qd, releaseNewVersion as Qf, SetOperationErrorTemplateAction as Qi, replayDocumentVersioned as Ql, isDerivedDocumentId as Qm, MutationDeleteStateExampleArgs as Qn, assertOperationErrorIdUnique as Qo, hashDocumentStateForScope as Qp, RemoveRelationshipAction as Qr, ReorderModulesInputSchema as Qs, DocumentModelOperationErrorOperations as Qt, documentModelInitialGlobalState as Qu, PowerhousePackage as R, UpdateRelationshipActionInput as Ra, documentModelHeaderReducer as Rc, SetGrantAction as Rd, deleteChangeLogItem as Rf, SetModuleDescriptionInput as Ri, baseSaveToFileHandle as Rl, createState as Rm, MoveOperationAction as Rn, WebhookField as Ro, appendWithoutApplying as Rp, PhAiToolAnnotations as Rr, OperationErrorSchema as Rs, DocumentModelAction as Rt, base64UrlToBytes as Ru, PHConnectPwaRuntimeCaching as S, SignatureVerificationHandler as Sa, SetOperationScopeInputSchema as Sc, AuthEvaluation as Sd, Action as Sf, serializeSignature as Sh, ScopeState as Si, mergePeerCapabilities as Sl, AuthGroups as Sm, ISignalResult as Sn, IWebhookEndpoints as So, setOperationSchema as Sp, MutationSetOperationNameArgs as Sr, CodeExampleSchema as Ss, DeleteChangeLogItemInput as St, BaseDocumentHeaderSchema as Su, PHConnectReactorFeatureFlags as T, SkipHeaderOperations as Ta, SetPreferredEditorActionSchema as Tc, AuthSubject as Td, actionFromAction as Tf, PROCESSOR_APPS as Th, SetAuthorWebsiteAction as Ti, selectProtocolVersions as Tl, Grant as Tm, InputMaybe as Tn, RouteActor as To, setPreferredEditor as Tp, MutationSetOperationTemplateArgs as Tr, DeleteChangeLogItemInputSchema as Ts, DeleteDocumentAction as Tt, DocumentModelPHStateSchema as Tu, ActionSignatureContext as U, User as Ua, documentModelReducer as Uc, applyMoveGrantAction as Ud, deleteStateExample as Uf, SetNameOperation as Ui, fetchFileBrowser as Ul, defaultLocalState as Um, MutationAddOperationArgs as Un, WebhookScheme as Uo, checkOperationsIntegrity as Up, PurgeDocumentAction as Ur, PowerhouseModuleSchema as Us, DocumentModelHeaderOperations as Ut, hashBrowser as Uu, DEFAULT_REGISTRY_URL as V, UpgradeDocumentAction as Va, documentModelOperationExampleReducer as Vc, applyAuthAction as Vd, deleteOperationError as Vf, SetNameAction as Vi, documentModelLoadFromInput as Vl, defaultDocumentState as Vm, MutationAddChangeLogItemInputArgs as Vn, WebhookReply as Vo, baseReducerVersion as Vp, PowerhouseModule as Vr, PieceModuleSchema as Vs, DocumentModelGlobalState as Vt, bytesToBase64Url as Vu, ActionSigningHandler as W, ValidationError as Wa, documentModelStateReducer as Wc, applyRemoveGrantAction as Wd, documentModelActions as Wf, SetOperationDescriptionAction as Wi, getFileBrowser as Wl, defaultPHState as Wm, MutationAddOperationErrorArgs as Wn, WebhookSignatureEncoding as Wo, diffOperations as Wp, PurgeDocumentActionInput as Wr, PowerhouseModulesSchema as Ws, DocumentModelInput as Wt, hex2ab as Wu, AddModuleInput as X, relationalDbToQueryBuilder as Xa, replayOperations as Xc, initializeAuth as Xd, operationWithContext as Xf, SetOperationErrorNameAction as Xi, VersionedReducers as Xl, SignaturePolicy$1 as Xm, MutationDeleteOperationErrorArgs as Xn, ReservedOperationName as Xo, getDocumentLastModified as Xp, ReducerOptions as Xr, ReorderChangeLogItemsInputSchema as Xs, DocumentModelOperationAction as Xt, documentModelFileExtension as Xu, AddModuleAction as Y, namespaceSchemaOf as Ya, processUndoRedo as Yc, evaluate as Yd, operationFromOperation as Yf, SetOperationErrorDescriptionInput as Yi, zipEntries as Yl, SIGNATURE_PROTOCOL_V2 as Ym, MutationDeleteOperationArgs as Yn, RESERVED_OPERATION_NAMES as Yo, garbageCollectV2 as Yp, Reducer as Yr, RedoSchema as Ys, DocumentModelModuleOperations as Yt, HASH_ENCODING_HEX as Yu, AddOperationAction as Z, DOCUMENT_ID_COLUMNS as Za, updateDocument as Zc, isAuthAction as Zd, redo as Zf, SetOperationErrorNameInput as Zi, VersionedReplayConfig as Zl, deriveDocumentId as Zm, MutationDeleteOperationExampleArgs as Zn, assertModuleIdUnique as Zo, groupOperationsByScope as Zp, ReleaseNewVersionAction as Zr, ReorderModuleOperationsInputSchema as Zs, DocumentModelOperationErrorAction as Zt, documentModelGlobalState as Zu, PHConnectPwa as _, Signal as _a, SetOperationErrorNameInputSchema as _c, isPlainValue as _d, hashActionV2 as _f, HashConfig as _h, SchemaNOOPAction as _i, isOlderManifest as _l, sortMappedOperations as _m, IAction as _n, ProcessorRecord as _o, setOperationErrorDescription as _p, MutationSetOperationDescriptionArgs as _r, AddOperationErrorInputSchema as _s, CreateDocument as _t, InvalidAuthVersionError as _u, PHConnectAi as a, SetOperationSchemaInput as aa, SetInitialStateInputSchema as ac, MAX_AUTH_GRANTS as ad, TransportActionContext as af, Operation as ah, ReorderModulesInput as ai, FeatureCapability as al, merge as am, DocumentModelUtils as an, RelationalDbProcessor as ao, setAuthorName as ap, MutationReorderOperationExamplesArgs as ar, getAllOperationNames as as, AddStateExampleAction as at, normalizeDocumentModelVersion as au, PHConnectPwaIcon as b, SignalResults as ba, SetOperationReducerInputSchema as bc, AuthAction as bd, targetDocumentId as bf, UserActionSigner as bh, SchemaSetPreferredEditorAction as bi, localSupports as bl, updateHeaderRevision as bm, IOperation as bn, AuthorizerResult as bo, setOperationName as bp, MutationSetOperationErrorNameArgs as br, AddStateExampleInputSchema as bs, CreateState as bt, groupDocumentType as bu, PHConnectDefaultDrive as c, SetOperationTemplateAction as ca, SetModelIdInputSchema as cc, MAX_CONDITION_NODES as cd, ACTION_SIGNATURE_V2_PREFIX as cf, OperationWithContext$1 as ch, ReorderOperationExamplesAction as ci, PEER_CAPABILITIES as cl, parseResultingState as cm, DocumentOperationsIgnoreMap as cn, IProcessorDispatch as co, setModelDescription as cp, MutationSetAuthorWebsiteArgs as cr, validateInitialState as cs, AssertIsStateOfType as ct, AuthAlreadyInitializedError as cu, PHConnectDriveSection as d, SetPreferredEditorActionInput as da, SetModuleNameInputSchema as dc, assertValidGrantUpsert as dd, CanonicalJsonError as df, setNameOperation as dh, ReorderStateExamplesInput as di, PeerCapabilityFlags as dl, readOnly as dm, EditorDispatch as dn, ProcessorApp as do, setModelName as dp, MutationSetModelExtensionArgs as dr, validateModules as ds, ConfigEntry as dt, DowngradeNotSupportedError as du, SetOperationNameAction as ea, ReorderOperationExamplesInputSchema as ec, AuthAdministrationLockoutError as ed, moveGrant as ef, protocolVersionsFor as eh, ReorderChangeLogItemsAction as ei, isPurgeMarker as el, isNoopOperation as em, DocumentModelOperationExampleOperations as en, IBaseRelationalDb as eo, reorderModuleOperations as ep, MutationRedoArgs as er, assertOperationIdUnique as es, AddOperationExampleAction as et, UpgradeReducer as eu, PHConnectDriveSections as f, SetPreferredEditorOperation as fa, SetNameActionInputSchema as fc, assertValidInitialGrants as fd, DOCUMENT_SCOPE_ACTION_TYPES as ff, setPreferredEditorOperation as fh, ReplayDocumentOptions as fi, PeerManifest as fl, removeExistingOperations as fm, EditorModule as fn, ProcessorApps as fo, setModuleDescription as fp, MutationSetModelIdArgs as fr, validateOperationName as fs, ConfigEntryType as ft, FileSystemError as fu, PHConnectPackages as g, Set_PreferredEditor as ga, SetOperationErrorDescriptionInputSchema as gc, grantProblem as gd, canonicalJson as gf, AppActionSigner as gh, Scalars as gi, holdReason as gl, skipHeaderOperations as gm, GetDocumentOptions as gn, ProcessorFilter as go, setOperationErrorCode as gp, MutationSetNameArgs as gr, AddModuleInputSchema as gs, CreateChildDocumentSignal as gt, InvalidActionInputZodError as gu, PHConnectOpenPanel as h, Set_Name as ha, SetOperationErrorCodeInputSchema as hc, evaluateGrants as hd, actionSigningTarget as hf, ActionSigner as hh, SaveToFileHandle as hi, coversLocal as hl, reshuffleByTimestampAndIndex as hm, FileInput as hn, ProcessorFactoryBuilder as ho, setOperationDescription as hp, MutationSetModuleNameArgs as hr, AddChangeLogItemInputSchema as hs, CreateChildDocumentInput as ht, InvalidActionInputError as hu, LogLevels as i, SetOperationSchemaAction as ia, SetAuthorWebsiteInputSchema as ic, InvalidGrantError as id, TransportAction as if, DocumentOperations as ih, ReorderModulesAction as ii, DOCUMENT_PURGE_PROTOCOL as il, mapSkippedOperationsV2 as im, DocumentModelStateOperations as in, IRelationalQueryMethods as io, reorderStateExamples as ip, MutationReorderOperationErrorsArgs as ir, findOperationOrThrow as is, AddRelationshipActionInput as it, computeUpgradeTransitions as iu, PHReactorRenown as j, UndoActionInput as ja, UndoActionSchema as jc, MAX_SUPPORTED_AUTH_VERSION as jd, addOperationError as jf, SetModelExtensionAction as ji, hasDerivedDocumentId as jl, Principal as jm, MakeMaybe as jn, RouteMethod as jo, verifyOperationSignature as jp, NOOPAction as jr, DocumentActionSchema as js, DeleteOperationErrorInput as jt, AUTH_DENIED_BY_GRANT_REASON as ju, PHConnectSentry as k, Undo as ka, StateSchema as kc, InitializeAuthActionInput as kd, addModule as kf, SetModelDescriptionAction as ki, createSignedHeaderForSigner as kl, PHDocumentState as km, LoadFromInput as kn, RouteContext as ko, updateOperationExample as kp, MutationUpdateOperationExampleArgs as kr, DeleteOperationInputSchema as ks, DeleteOperationAction as kt, isDocumentModelDocument as ku, PHConnectDefaultDriveLocal as l, SetOperationTemplateInput as la, SetModelNameInputSchema as lc, assertAuthAdministrationRetained as ld, ActionSignerIdentity as lf, operationOutcome as lh, ReorderOperationExamplesInput as li, PEER_MANIFEST_FORMAT as ll, precedes as lm, DocumentSpecification as ln, IProcessorHostModuleBase as lo, setModelExtension as lp, MutationSetInitialStateArgs as lr, validateModule as ls, Author as lt, AuthInitializerNotCreatorError as lu, PHConnectInstance as m, SetStateSchemaInput as ma, SetOperationDescriptionInputSchema as mc, evaluateGrantStack as md, actionSignerIdentity as mf, undoOperationV2 as mh, SaveToFile as mi, Supports as ml, reshuffleByTimestamp as mm, Exact as mn, ProcessorFactory as mo, setName as mp, MutationSetModuleDescriptionArgs as mr, validateStateSchemaName as ms, CopyChildDocumentSignal as mt, HashMismatchError as mu, DrivePreserveStrategy as n, SetOperationReducerAction as na, ScopeStateSchema as nc, GrantSchema as nd, resolveSnapshotAuth as nf, signaturePolicyOf as nh, ReorderModuleOperationsAction as ni, purgeMarkerOperation as nl, isUndoRedo as nm, DocumentModelPHState as nn, IRelationalDbProcessor as no, reorderOperationErrors as np, MutationReorderModuleOperationsArgs as nr, findOperationErrorOrThrow as ns, AddOperationInput as nt, applyDeleteDocumentAction as nu, PHConnectApp as o, SetOperationScopeAction as oa, SetModelDescriptionInputSchema as oc, MAX_CAPABILITY_OPERATIONS as od, TransportSigner as of, OperationContext as oh, ReorderOperationErrorsAction as oi, HoldReason as ol, nextSkipNumber as om, DocumentModelVersioningAction as on, RelationalDbProcessorClass as oo, setAuthorWebsite as op, MutationReorderStateExamplesArgs as or, isReservedOperationName as os, AddStateExampleInput as ot, withProtocolVersions as ou, PHConnectDrives as p, SetStateSchemaAction as pa, SetNameActionSchema as pc, evaluateCondition as pd, actionPreimageV2 as pf, undoOperation as ph, RevisionsFilter as pi, ProtocolCapability as pl, replayDocument as pm, EditorProps as pn, ProcessorDispatchResult as po, setModuleName as pp, MutationSetModelNameArgs as pr, validateOperations as ps, CopyChildDocumentInput as pt, GrantNotFoundError as pu, AddChangeLogItemAction as q, createRelationalDb as qa, baseReducer as qc, assertAuthScopeActionAllowed as qd, operationExampleCreators as qf, SetOperationErrorCodeInput as qi, readFileBrowser as ql, ProtocolVersions as qm, MutationDeleteChangeLogItemInputArgs as qn, deletedDocumentId as qo, garbageCollect as qp, RedoAction as qr, RedoActionInputSchema as qs, DocumentModelModule as qt, HASH_ALGORITHM_SHA512 as qu, LogLevel as r, SetOperationReducerInput as ra, SetAuthorNameInputSchema as rc, GroupPrincipalNotAllowedError as rd, setGrant as rf, v2RequiredProtocolVersions as rh, ReorderModuleOperationsInput as ri, purgedProtocolVersions as rl, mapSkippedOperations as rm, DocumentModelStateAction as rn, IRelationalQueryBuilder as ro, reorderOperationExamples as rp, MutationReorderModulesArgs as rr, findOperationExampleOrThrow as rs, AddRelationshipAction as rt, applyUpgradeDocumentAction as ru, PHConnectBranding as s, SetOperationScopeInput as sa, SetModelExtensionInputSchema as sc, MAX_CONDITION_DEPTH as sd, toTransportAction as sf, OperationOutcome as sh, ReorderOperationErrorsInput as si, MARKER_REFUSAL_FEATURE as sl, operationsAreEqual as sm, DocumentModelVersioningOperations as sn, IProcessor as so, setInitialState as sp, MutationSetAuthorNameArgs as sr, isValidOperationNameFormat as ss, AssertIsDocumentOfType as st, AuthActionNotAllowedError as su, DrivePreserveStrategies as t, SetOperationNameInput as ta, ReorderStateExamplesInputSchema as tc, AuthAdministrationMissingError as td, removeGrant as tf, requestedSignaturePolicy as th, ReorderChangeLogItemsInput as ti, purgeDocumentAction as tl, isUndo as tm, DocumentModelOperationOperations as tn, IRelationalDb as to, reorderModules as tp, MutationReorderChangeLogItemsInputArgs as tr, findModuleOrThrow as ts, AddOperationExampleInput as tt, UpgradeTransition as tu, PHConnectDefaultDriveRemote as u, SetPreferredEditorAction as ua, SetModuleDescriptionInputSchema as uc, assertValidGrant as ud, ActionSigningTarget as uf, redoOperation as uh, ReorderStateExamplesAction as ui, PeerCapability as ul, prepareOperations as um, ENSInfo as un, IProcessorManager as uo, setModelId as up, MutationSetModelDescriptionArgs as ur, validateModuleOperation as us, CodeExample as ut, AuthPolicyNotPreservedError as uu, PHConnectPwaCacheStrategy as v, SignalDispatch as va, SetOperationErrorTemplateInputSchema as vc, referencedGroupIds as vd, isV2ActionHash as vf, PHDocumentSignatureInfo as vh, SchemaRedoAction as vi, legacySupports as vl, sortOperations as vm, ID as vn, ProcessorStatus as vo, setOperationErrorName as vp, MutationSetOperationErrorCodeArgs as vr, AddOperationExampleInputSchema as vs, CreateDocumentAction as vt, UnsupportedDocumentModelVersionError as vu, PHConnectReactor as w, SkipHeaderOperationIndex as wa, SetPreferredEditorActionInputSchema as wc, AuthRequest as wd, actionContext as wf, DEFAULT_RELATIONAL_PROCESSOR_DB_NAME as wh, SetAuthorNameInput as wi, readPeerManifest as wl, Condition as wm, Incremental as wn, NodeRouteSpec as wo, setOperationTemplate as wp, MutationSetOperationSchemaArgs as wr, ConfigEntryTypeSchema as ws, DeleteChildDocumentSignal as wt, DocumentModelHeaderSchema as wu, PHConnectPwaManifest as x, SignalType as xa, SetOperationSchemaInputSchema as xc, AuthDecision as xd, v2TupleProblem as xf, deserializeSignature as xh, SchemaUndoAction as xi, manifestRevision as xl, withSignaturePolicy as xm, ISignal as xn, IHttpScope as xo, setOperationReducer as xp, MutationSetOperationErrorTemplateArgs as xr, AuthorSchema as xs, DeleteChangeLogItemAction as xt, groupMembershipActionTypes as xu, PHConnectPwaFileHandler as y, SignalResult as ya, SetOperationNameInputSchema as yc, AUTH_ACTION_TYPES as yd, signActionV2 as yf, Signature as yh, SchemaSetNameAction as yi, localPeerManifest as yl, split as ym, IDocument as yn, TrackedProcessor as yo, setOperationErrorTemplate as yp, MutationSetOperationErrorDescriptionArgs as yr, AddOperationInputSchema as ys, CreateDocumentActionInput as yt, documentModelDocumentType as yu, ServiceAction as z, UpdateStateExampleAction as za, documentModelModuleReducer as zc, SetGrantActionInput as zd, deleteModule as zf, SetModuleNameAction as zi, createMinimalZip as zl, defaultAuthState as zm, MoveOperationInput as zn, WebhookHashAlgorithm as zo, attachBranch as zp, PhAiToolDescriptor as zr, OperationScopeSchema as zs, DocumentModelDocument as zt, buildOperationSignatureMessage as zu };
 export {};
-//# sourceMappingURL=types-CmeoQg_J.d.ts.map
+//# sourceMappingURL=types-CFbd2nan.d.ts.map