@powerhousedao/shared 6.2.3-dev.6 → 6.2.3-dev.61

package/dist/document-model/index.js

@@ -1,8 +1,12 @@
-import { a as base58Decode, c as buildOperationSignatureParams, d as hex2ab, i as ab2hex, l as getUnixTimestamp, n as generateId, o as base64UrlToBytes, r as generateMock, s as buildOperationSignatureMessage, t as deriveOperationId, u as hashBrowser } from "../utils-aaTmfxFW.js";
+import { a as base58Decode, c as buildOperationSignatureParams, d as hashBrowser, f as hex2ab, i as ab2hex, l as bytesToBase64Url, n as generateId, o as base64UrlToBytes, r as generateMock, s as buildOperationSignatureMessage, t as deriveOperationId, u as getUnixTimestamp } from "../utils-CSF716ux.js";
+import { A as signActionV2, C as DOCUMENT_SCOPE_ACTION_TYPES, D as canonicalJson, E as actionSigningTarget, M as v2TupleProblem, O as hashActionV2, S as CanonicalJsonError, T as actionSignerIdentity, _ as mergePeerCapabilities, a as purgedProtocolVersions, b as selectProtocolVersions, c as PEER_CAPABILITIES, d as holdReason, f as isOlderManifest, g as manifestRevision, h as localSupports, i as purgeMarkerOperation, j as targetDocumentId, k as isV2ActionHash, l as PEER_MANIFEST_FORMAT, m as localPeerManifest, n as isPurgeMarker, o as DOCUMENT_PURGE_PROTOCOL, p as legacySupports, r as purgeDocumentAction, s as MARKER_REFUSAL_FEATURE, t as PURGE_DOCUMENT, u as coversLocal, v as peerSupports, w as actionPreimageV2, x as ACTION_SIGNATURE_V2_PREFIX, y as readPeerManifest } from "../purge-v06m_oGz.js";
+import { AuthActionNotAllowedError, AuthAlreadyInitializedError, AuthInitializerNotCreatorError, AuthPolicyNotPreservedError, DowngradeNotSupportedError, FileSystemError, GrantNotFoundError, HashMismatchError, InvalidActionInputError, InvalidActionInputZodError, InvalidAuthVersionError, UnsupportedDocumentModelVersionError } from "./errors.js";
+import { normalizeDocumentModelVersion } from "./version.js";
 import { ZodError, z } from "zod";
 import { stringify } from "safe-stable-stringify";
+import { sha256 } from "@noble/hashes/sha2.js";
 import { strFromU8, strToU8, unzip, zip } from "fflate";
-import { castDraft, create, unsafe } from "mutative";
+import { castDraft, create, isDraft, original, unsafe } from "mutative";
 import { constantCase, pascalCase } from "change-case";
 //#region document-model/signatures.ts
 /**
@@ -105,160 +109,9 @@ function toTransportSignerApp(app) {
 	};
 }
 //#endregion
-//#region document-model/errors.ts
-const FileSystemError = /* @__PURE__ */ new Error("File system not available.");
-var InvalidActionInputError = class extends Error {
-	data;
-	constructor(data) {
-		super();
-		this.name = "InvalidActionInputError";
-		this.data = data;
-		this.message = this.message || `Invalid action input: ${JSON.stringify(data, null, 2)}`;
-	}
-};
-var InvalidActionInputZodError = class extends InvalidActionInputError {
-	issues;
-	constructor(issues) {
-		super(issues);
-		this.issues = issues;
-		this.name = "InvalidActionInputZodError";
-	}
-};
-/**
-* Error thrown when attempting to downgrade a document version.
-*/
-var DowngradeNotSupportedError = class extends Error {
-	documentType;
-	fromVersion;
-	toVersion;
-	constructor(documentType, fromVersion, toVersion) {
-		super(`Downgrade not supported for ${documentType}: cannot upgrade from version ${fromVersion} to ${toVersion}`);
-		this.name = "DowngradeNotSupportedError";
-		this.documentType = documentType;
-		this.fromVersion = fromVersion;
-		this.toVersion = toVersion;
-	}
-};
-/**
-* Thrown when INITIALIZE_AUTH is applied to an already-initialized auth scope.
-* The genesis action is valid only at auth revision zero.
-*/
-var AuthAlreadyInitializedError = class extends Error {
-	documentId;
-	constructor(documentId) {
-		super(`Auth scope already initialized for document ${documentId}: INITIALIZE_AUTH is valid only at auth revision zero`);
-		this.name = "AuthAlreadyInitializedError";
-		this.documentId = documentId;
-	}
-};
-/**
-* Thrown when INITIALIZE_AUTH is not signed by the document creator (its signer
-* does not match `header.sig.publicKey`), so it cannot set the auth policy.
-*/
-var AuthInitializerNotCreatorError = class extends Error {
-	documentId;
-	constructor(documentId) {
-		super(`INITIALIZE_AUTH for document ${documentId} must be signed by the document creator`);
-		this.name = "AuthInitializerNotCreatorError";
-		this.documentId = documentId;
-	}
-};
-/**
-* Thrown when INITIALIZE_AUTH carries a version below 1. Version 0 is reserved
-* for the uninitialized auth scope.
-*/
-var InvalidAuthVersionError = class extends Error {
-	documentId;
-	version;
-	constructor(documentId, version) {
-		super(`Invalid auth policy version ${version} for document ${documentId}: INITIALIZE_AUTH requires an integer version >= 1`);
-		this.name = "InvalidAuthVersionError";
-		this.documentId = documentId;
-		this.version = version;
-	}
-};
-/** Thrown when a duplicate would lose the source policy's version or creator binding. */
-var AuthPolicyNotPreservedError = class extends Error {
-	documentId;
-	constructor(documentId) {
-		super(`Duplicating document ${documentId} would not preserve its auth policy: the copy loses the policy version or its creator binding`);
-		this.name = "AuthPolicyNotPreservedError";
-		this.documentId = documentId;
-	}
-};
-/**
-* Thrown when a grant referenced by REMOVE_GRANT or MOVE_GRANT does not exist.
-*/
-var GrantNotFoundError = class extends Error {
-	grantId;
-	constructor(grantId) {
-		super(`Grant not found in auth scope: ${grantId}`);
-		this.name = "GrantNotFoundError";
-		this.grantId = grantId;
-	}
-};
-/**
-* Thrown when a disallowed action (UNDO, REDO, PRUNE) targets the auth scope.
-*/
-var AuthActionNotAllowedError = class extends Error {
-	actionType;
-	constructor(actionType) {
-		super(`${actionType} is not permitted on the auth scope`);
-		this.name = "AuthActionNotAllowedError";
-		this.actionType = actionType;
-	}
-};
-var HashMismatchError = class extends Error {
-	_scope;
-	_document;
-	_operation;
-	constructor(scope, document, operation) {
-		super();
-		this.name = "HashMismatchError";
-		this._document = document;
-		this._scope = scope;
-		this._operation = operation;
-		this.message = JSON.stringify({
-			error: `Hash mismatch on document ${document.header.id}, scope ${scope}, index ${operation.index}`,
-			document,
-			operation
-		}, null, 1);
-	}
-	get document() {
-		return this._document;
-	}
-	get scope() {
-		return this._scope;
-	}
-	get operation() {
-		return this._operation;
-	}
-};
-/**
-* Thrown when replay or import requires a document model version that is not
-* registered. Carries the data the UI needs to explain the mismatch.
-*/
-var UnsupportedDocumentModelVersionError = class extends Error {
-	documentType;
-	requiredVersion;
-	availableVersions;
-	constructor(documentType, requiredVersion, availableVersions) {
-		super(`No reducer registered for document version ${requiredVersion}. Available versions: ${availableVersions.join(", ")}`);
-		this.name = "UnsupportedDocumentModelVersionError";
-		this.documentType = documentType;
-		this.requiredVersion = requiredVersion;
-		this.availableVersions = availableVersions;
-	}
-	static isError(error) {
-		return Error.isError(error) && error.name === "UnsupportedDocumentModelVersionError";
-	}
-};
-//#endregion
 //#region document-model/schemas.ts
 const isDefinedNonNullAny = (v) => v !== void 0 && v !== null;
 const definedNonNullAnySchema = z.any().refine((v) => isDefinedNonNullAny(v));
-const Load_StateSchema = z.enum(["LOAD_STATE"]);
-const PruneSchema = z.enum(["PRUNE"]);
 const RedoSchema = z.enum(["REDO"]);
 const Set_NameSchema = z.enum(["SET_NAME"]);
 const Set_PreferredEditorSchema = z.enum(["SET_PREFERRED_EDITOR"]);
@@ -268,50 +121,12 @@ function OperationScopeSchema() {
 }
 function DocumentActionSchema() {
 	return z.union([
-		LoadStateActionSchema(),
-		PruneActionSchema(),
 		RedoActionSchema(),
 		SetNameActionSchema(),
 		SetPreferredEditorActionSchema(),
 		UndoActionSchema()
 	]);
 }
-function LoadStateActionSchema() {
-	return z.object({
-		id: z.string(),
-		timestampUtcMs: z.string(),
-		input: z.lazy(() => LoadStateActionInputSchema()),
-		type: Load_StateSchema,
-		scope: OperationScopeSchema()
-	});
-}
-function LoadStateActionInputSchema() {
-	return z.object({
-		operations: z.number(),
-		state: z.lazy(() => LoadStateActionStateInputSchema())
-	});
-}
-function LoadStateActionStateInputSchema() {
-	return z.object({
-		data: z.unknown().nullish(),
-		name: z.string()
-	});
-}
-function PruneActionSchema() {
-	return z.object({
-		id: z.string(),
-		timestampUtcMs: z.string(),
-		input: z.lazy(() => PruneActionInputSchema()),
-		type: PruneSchema,
-		scope: OperationScopeSchema()
-	});
-}
-function PruneActionInputSchema() {
-	return z.object({
-		end: z.number().nullish(),
-		start: z.number().nullish()
-	});
-}
 function RedoActionInputSchema() {
 	return z.object({ count: z.number() });
 }
@@ -729,6 +544,13 @@ const PowerhouseModuleSchema = z.object({
 	documentTypes: z.array(z.string()).optional()
 });
 const PowerhouseModulesSchema = z.array(PowerhouseModuleSchema).optional();
+const PieceModuleSchema = PowerhouseModuleSchema.extend({
+	version: z.string().optional(),
+	description: z.string().optional(),
+	bundle: z.string().optional(),
+	descriptor: z.string().optional()
+});
+const PieceModulesSchema = z.array(PieceModuleSchema).optional();
 const PublisherSchema = z.object({
 	name: z.string().optional(),
 	url: z.string().optional()
@@ -739,7 +561,7 @@ const ConfigEntrySchema = z.object({
 	type: ConfigEntryTypeSchema,
 	description: z.string().optional(),
 	required: z.boolean().optional(),
-	default: z.boolean().optional()
+	default: z.string().optional()
 });
 const PwaUrlPatternSchema = z.union([z.string(), z.strictObject({
 	source: z.string(),
@@ -835,6 +657,8 @@ const ManifestSchema = z.object({
 	editors: PowerhouseModulesSchema,
 	processors: PowerhouseModulesSchema,
 	subgraphs: PowerhouseModulesSchema,
+	pieces: PieceModulesSchema,
+	externalDependencies: z.record(z.string(), z.string()).optional(),
 	config: z.array(ConfigEntrySchema).optional(),
 	pwa: PwaConfigSchema.optional()
 });
@@ -854,35 +678,6 @@ const undo = (count = 1, scope = "global") => createAction("UNDO", { count }, vo
 * @category Actions
 */
 const redo = (count = 1, scope = "global") => createAction("REDO", { count }, void 0, RedoActionInputSchema, scope);
-/**
-* Joins multiple operations into a single {@link loadState | LOAD_STATE} operation.
-*
-* @remarks
-* Useful to keep operations history smaller. Operations to prune are selected by index,
-* similar to the {@link https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/slice | slice} method in Arrays.
-*
-* @param start - Index of the first operation to prune
-* @param end - Index of the last operation to prune
-* @category Actions
-*/
-const prune = (start, end, scope = "global") => createAction("PRUNE", {
-	start,
-	end
-}, void 0, PruneActionInputSchema, scope);
-/**
-* Replaces the state of the document.
-*
-* @remarks
-* This action shouldn't be used directly. It is dispatched by the {@link prune} action.
-*
-* @param state - State to be set in the document.
-* @param operations - Number of operations that were removed from the previous state.
-* @category Actions
-*/
-const loadState = (state, operations) => createAction("LOAD_STATE", {
-	state,
-	operations
-}, void 0, LoadStateActionInputSchema);
 const noop = (scope = "global") => createAction("NOOP", {}, void 0, void 0, scope);
 /**
 * Helper function to be used by action creators.
@@ -980,6 +775,7 @@ async function buildOperationSignature(context, signMethod) {
 	const signature = await signMethod(buildOperationSignatureMessage(params));
 	return [...params, `0x${ab2hex(signature)}`];
 }
+/** @deprecated Emits a legacy SHA-1 tuple; sign through `ISigner.signAction`. */
 async function buildSignedAction(action, reducer, document, signer, signHandler) {
 	const scopeOperations = reducer(document, action, void 0, { reuseOperationResultingState: true }).operations[action.scope];
 	if (!scopeOperations) throw new Error(`No operations found for scope: ${action.scope}`);
@@ -992,8 +788,10 @@ async function buildSignedAction(action, reducer, document, signer, signHandler)
 		action,
 		previousStateHash
 	}, signHandler);
-	return operationWithContext(operation, { signer: actionSigner(signer.user, signer.app, [...signer.signatures, signature]) });
+	const actionContext = { signer: actionSigner(signer.user, signer.app, [...signer.signatures, signature]) };
+	return operationWithContext(operation, actionContext);
 }
+/** @deprecated Use `verifyActionSignature` from `@powerhousedao/reactor`. */
 async function verifyOperationSignature(signature, signer, verifyHandler) {
 	const publicKey = signer.app.key;
 	const params = signature.slice(0, 4);
@@ -1068,8 +866,6 @@ const baseActions = {
 	setPreferredEditor,
 	undo,
 	redo,
-	prune,
-	loadState,
 	noop
 };
 const documentModelActions = {
@@ -1187,7 +983,7 @@ var AuthAdministrationMissingError = class extends Error {
 		this.name = "AuthAdministrationMissingError";
 	}
 };
-const GRANT_KEYS = new Set([
+const GRANT_KEYS = /* @__PURE__ */ new Set([
 	"id",
 	"description",
 	"effect",
@@ -1195,13 +991,13 @@ const GRANT_KEYS = new Set([
 	"capability",
 	"where"
 ]);
-const PRINCIPAL_KINDS = new Set([
+const PRINCIPAL_KINDS = /* @__PURE__ */ new Set([
 	"anyone",
 	"address",
 	"group",
 	"match"
 ]);
-const COMPARISON_CONDITION_KINDS = new Set([
+const COMPARISON_CONDITION_KINDS = /* @__PURE__ */ new Set([
 	"eq",
 	"ne",
 	"lt",
@@ -2530,12 +2326,12 @@ function assertAuthPreservedOnDuplicate(documentId, source, duplicated) {
 * The auth scope a state snapshot may install, given the policy already there.
 *
 * `applyAuthAction` is the validated door onto `state.auth`, but a whole-state
-* snapshot (UPGRADE_DOCUMENT's `initialState`, LOAD_STATE's `data`) replaces the
-* scope wholesale and is authorized as a `document`-scope write. Without this,
-* a subject holding `execute` on `document` and no auth grant at all can install
-* a policy of its choosing, name itself `creator` (which exempts the policy from
-* the retention rule for good), or wipe an existing policy by carrying the
-* default uninitialized one.
+* snapshot (UPGRADE_DOCUMENT's `initialState`) replaces the scope wholesale and
+* is authorized as a `document`-scope write. Without this, a subject holding
+* `execute` on `document` and no auth grant at all can install a policy of its
+* choosing, name itself `creator` (which exempts the policy from the retention
+* rule for good), or wipe an existing policy by carrying the default
+* uninitialized one.
 *
 * Three cases:
 *
@@ -2562,13 +2358,9 @@ function resolveSnapshotAuth(documentId, documentType, current, incoming) {
 	assertValidInitialGrants(incoming.grants, documentType, incoming.creator);
 	return incoming;
 }
-/** UNDO, REDO and PRUNE are rejected on the auth scope. */
+/** UNDO and REDO are rejected on the auth scope. */
 function assertAuthScopeActionAllowed(action) {
-	if (action.scope === "auth" && [
-		"UNDO",
-		"REDO",
-		"PRUNE"
-	].includes(action.type)) throw new AuthActionNotAllowedError(action.type);
+	if (action.scope === "auth" && ["UNDO", "REDO"].includes(action.type)) throw new AuthActionNotAllowedError(action.type);
 }
 /**
 * Evaluates the auth policy for a single request and reports why it refused.
@@ -2674,6 +2466,63 @@ function assertIsDocumentModelDocument(document) {
 	DocumentModelSchema.parse(document);
 }
 //#endregion
+//#region document-model/signature-policy.ts
+/** The `protocolVersions` key that fixes a document's signature requirement. */
+const SIGNATURE_PROTOCOL = "signature";
+/** `protocolVersions.signature` of a document that requires v2 tuples. */
+const SIGNATURE_PROTOCOL_V2 = 2;
+/** What a new document is created as unless the caller or host says otherwise. */
+const DEFAULT_SIGNATURE_POLICY = "v2-required";
+function isSignaturePolicy(value) {
+	return value === "legacy" || value === "v2-required";
+}
+const DERIVED_ID = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+/** Read from a header, a CREATE_DOCUMENT input or a bare map. */
+function signaturePolicyOf(source) {
+	const version = (source && "protocolVersions" in source ? source.protocolVersions : source)?.[SIGNATURE_PROTOCOL];
+	return typeof version === "number" && version >= 2 ? "v2-required" : "legacy";
+}
+/** `protocolVersions` for a new v2-required document. */
+function v2RequiredProtocolVersions(base = {}) {
+	return {
+		"base-reducer": 2,
+		...base,
+		[SIGNATURE_PROTOCOL]: 2
+	};
+}
+/**
+* The policy a create call asks for: `signaturePolicy`, else the `signature`
+* key of its `protocolVersions`, else `fallback`, the host's default.
+*/
+function requestedSignaturePolicy(request, fallback) {
+	if (request?.signaturePolicy) return request.signaturePolicy;
+	if (request?.protocolVersions?.["signature"] !== void 0) return signaturePolicyOf(request.protocolVersions);
+	return fallback;
+}
+/** `protocolVersions` for a new document under `policy`, over `base`. */
+function protocolVersionsFor(policy, base = {}) {
+	if (policy === "v2-required") return v2RequiredProtocolVersions(base);
+	const { [SIGNATURE_PROTOCOL]: _signature, ...rest } = base;
+	return {
+		"base-reducer": 2,
+		...rest
+	};
+}
+/** `base64url(sha256(canonicalJson(params)))`, unpadded. */
+function deriveDocumentId(params) {
+	const preimage = canonicalJson({
+		documentType: params.documentType,
+		createdAtUtcIso: params.createdAtUtcIso,
+		nonce: params.nonce,
+		protocolVersions: params.protocolVersions
+	}, "document id");
+	return bytesToBase64Url(sha256(new TextEncoder().encode(preimage)));
+}
+/** Whether `id` has the shape `deriveDocumentId` produces. */
+function isDerivedDocumentId(id) {
+	return DERIVED_ID.test(id);
+}
+//#endregion
 //#region document-model/header.ts
 /**
 * Generates a deterministic payload from signing parameters
@@ -2693,11 +2542,11 @@ async function createVerificationSigner(pubKey) {
 	}, true, ["verify"]);
 	return {
 		publicKey: cryptoKey,
-		async sign(_data) {
-			throw new Error("verification-only signer cannot sign data");
+		sign(_data) {
+			return Promise.reject(/* @__PURE__ */ new Error("verification-only signer cannot sign data"));
 		},
-		async signAction(_action, _abortSignal) {
-			throw new Error("verification-only signer cannot sign actions");
+		signAction(_action, _target, _abortSignal) {
+			return Promise.reject(/* @__PURE__ */ new Error("verification-only signer cannot sign actions"));
 		},
 		async verify(data, signature) {
 			let isValid;
@@ -2767,26 +2616,68 @@ const validateHeader = async (header) => {
 * Creates a header that has yet to be signed. This header is not valid, but
 * can be input into {@link createSignedHeader} to create a signed header.
 *
+* With `protocolVersions` requiring v2 signatures the header takes a random
+* nonce and the id {@link deriveDocumentId} gives, so `id` must be omitted.
+*
 * @returns An unsigned header for a document.
 */
-const createPresignedHeader = (id = generateId(), documentType = "") => {
-	return {
-		id,
+const createPresignedHeader = (id, documentType = "", protocolVersions) => {
+	const createdAtUtcIso = (/* @__PURE__ */ new Date()).toISOString();
+	const header = {
+		id: id ?? generateId(),
 		sig: {
 			publicKey: {},
 			nonce: ""
 		},
 		documentType,
-		createdAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
+		createdAtUtcIso,
 		slug: "",
 		name: "",
 		branch: "main",
 		revision: { document: 0 },
-		lastModifiedAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
+		lastModifiedAtUtcIso: createdAtUtcIso,
 		meta: {}
 	};
+	if (protocolVersions === void 0) return header;
+	header.protocolVersions = { ...protocolVersions };
+	if (signaturePolicyOf(header) === "legacy") return header;
+	if (id !== void 0) throw new Error(`A v2-required document's id is derived from its header; cannot use ${id}`);
+	header.sig.nonce = generateId();
+	header.id = deriveDocumentId({
+		documentType,
+		createdAtUtcIso,
+		nonce: header.sig.nonce,
+		protocolVersions: header.protocolVersions
+	});
+	return header;
 };
 /**
+* A header for a copy of a document headed `source`. A copy is v2-required
+* when its source is or when `policy` asks for it, and then takes a derived id;
+* otherwise it takes `id`. It keeps the source's other protocol versions.
+*/
+function createCopyHeader(source, id, policy = DEFAULT_SIGNATURE_POLICY) {
+	const base = source.protocolVersions ?? {};
+	if (signaturePolicyOf(source) === "v2-required" || policy === "v2-required") return createPresignedHeader(void 0, source.documentType, protocolVersionsFor("v2-required", base));
+	const header = createPresignedHeader(id, source.documentType);
+	if (source.protocolVersions) header.protocolVersions = { ...source.protocolVersions };
+	return header;
+}
+/** Whether a v2-required `header` carries the id its params derive. */
+function hasDerivedDocumentId(header) {
+	if (signaturePolicyOf(header) === "legacy" || !header.protocolVersions) return false;
+	try {
+		return deriveDocumentId({
+			documentType: header.documentType,
+			createdAtUtcIso: header.createdAtUtcIso,
+			nonce: header.sig.nonce,
+			protocolVersions: header.protocolVersions
+		}) === header.id;
+	} catch {
+		return false;
+	}
+}
+/**
 * Creates a new, signed header for a document. This will replace the id of the
 * document.
 *
@@ -2829,7 +2720,8 @@ const createSignedHeader = async (unsignedHeader, documentType, signer) => {
 * some are not. See the PHDocumentHeader type for more information.
 */
 const createSignedHeaderForSigner = async (documentType, signer) => {
-	return await createSignedHeader(createPresignedHeader(), documentType, signer);
+	const unsignedHeader = createPresignedHeader();
+	return await createSignedHeader(unsignedHeader, documentType, signer);
 };
 //#endregion
 //#region document-model/documents.ts
@@ -2847,9 +2739,7 @@ function isDocumentAction(action) {
 		"SET_NAME",
 		"SET_PREFERRED_EDITOR",
 		"UNDO",
-		"REDO",
-		"PRUNE",
-		"LOAD_STATE"
+		"REDO"
 	].includes(action.type);
 }
 /**
@@ -2905,12 +2795,16 @@ function createDocumentScopeOperations(header, state) {
 }
 /**
 * Creates a new document. When `documentType` is given the header is stamped
-* with it and the document-scope operations are seeded.
+* with it and the document-scope operations are seeded. Without
+* `protocolVersions` the document is v2-required and takes a derived id; with
+* them it is v2-required only if they say so (see {@link protocolVersionsFor}).
 */
-function baseCreateDocument(createState, initialState, documentType = "") {
+function baseCreateDocument(createState, initialState, documentType = "", protocolVersions) {
 	const state = createState(initialState);
-	const header = createPresignedHeader(generateId(), documentType);
-	header.protocolVersions = { "base-reducer": 2 };
+	const header = createPresignedHeader(void 0, documentType, protocolVersions === void 0 ? protocolVersionsFor("v2-required") : {
+		"base-reducer": 2,
+		...protocolVersions
+	});
 	return {
 		header,
 		state,
@@ -2926,8 +2820,39 @@ function baseCreateDocument(createState, initialState, documentType = "") {
 		clipboard: []
 	};
 }
+/**
+* `document`, not yet created, under a fresh header for `policy`. A legacy
+* header takes `id` when given; a v2-required one ignores `id` and derives its
+* own, so a caller that needs a fixed id must ask for legacy.
+* `protocolVersions` are merged over the document's. Name, slug, branch and
+* meta carry over. A document already under `policy` is returned as is unless
+* a legacy `id` or `protocolVersions` are given.
+*/
+function withSignaturePolicy(document, policy, options = {}) {
+	const id = policy === "legacy" ? options.id : void 0;
+	if (id === void 0 && options.protocolVersions === void 0 && signaturePolicyOf(document.header) === policy) return document;
+	const source = document.header;
+	const header = createPresignedHeader(id, source.documentType, protocolVersionsFor(policy, {
+		...source.protocolVersions,
+		...options.protocolVersions
+	}));
+	header.name = source.name;
+	header.slug = source.slug;
+	header.branch = source.branch;
+	header.meta = source.meta;
+	const operations = document.operations.document ? {
+		...document.operations,
+		document: createDocumentScopeOperations(header, document.state)
+	} : document.operations;
+	return {
+		...document,
+		header,
+		operations
+	};
+}
 function hashDocumentStateForScope(document, scope = "global") {
-	return hashBrowser(stringify(document.state[scope] || ""));
+	const stateString = stringify(document.state[scope] || "");
+	return hashBrowser(stateString);
 }
 function readOnly(value) {
 	return Object.freeze(value);
@@ -3058,7 +2983,7 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 	const backfilledInitialState = backfillAuthState(initialState);
 	let documentState = backfilledInitialState;
 	const operationsToReplay = [];
-	const allScopes = new Set([
+	const allScopes = /* @__PURE__ */ new Set([
 		...Object.keys(operations),
 		"global",
 		"local"
@@ -3116,7 +3041,7 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 		if (operation.hash !== hashDocumentStateForScope(result, scope)) throw new HashMismatchError(scope, result, operation);
 		else break;
 	}
-	const allResultScopes = new Set([
+	const allResultScopes = /* @__PURE__ */ new Set([
 		...Object.keys(result.operations),
 		...Object.keys(operations),
 		"global",
@@ -3179,8 +3104,8 @@ function checkCleanedOperationsIntegrity(sortedOperations) {
 				index: nextOperation.index,
 				skip: nextOperation.skip
 			},
-			issue: IntegrityIssueType.UNEXPECTED_INDEX,
-			category: nextIndex > currentIndex + 1 ? IntegrityIssueSubType.MISSING_INDEX : IntegrityIssueSubType.DUPLICATED_INDEX,
+			issue: "UNEXPECTED_INDEX",
+			category: nextIndex > currentIndex + 1 ? "MISSING_INDEX" : "DUPLICATED_INDEX",
 			message: `Expected index ${currentIndex + 1} with skip 0 or equivalent, got index ${nextOperation.index} with skip ${nextOperation.skip}`
 		});
 		currentIndex = nextOperation.index;
@@ -3290,12 +3215,14 @@ function attachBranch(trunk, newBranch) {
 			nextTrunkOperation = trunkCopy.shift();
 		}
 		if (!nextTrunkOperation) enteredBranch = true;
-		else if (!enteredBranch) if (operationsAreEqual(nextTrunkOperation, newOperationCandidate)) {
-			newOperations.shift();
-			result.push(nextTrunkOperation);
-		} else {
-			trunkCopy.unshift(nextTrunkOperation);
-			enteredBranch = true;
+		else if (!enteredBranch) {
+			if (operationsAreEqual(nextTrunkOperation, newOperationCandidate)) {
+				newOperations.shift();
+				result.push(nextTrunkOperation);
+			} else {
+				trunkCopy.unshift(nextTrunkOperation);
+				enteredBranch = true;
+			}
 		}
 		if (enteredBranch) {
 			let nextAppend = newOperations.shift();
@@ -3326,13 +3253,14 @@ function split(sortedTargetOperations, sortedMergeOperations) {
 	for (let i = 0; i < maxLength; i++) {
 		const targetOperation = sortedTargetOperations[i];
 		const mergeOperation = sortedMergeOperations[i];
-		if (targetOperation && mergeOperation) if (!splitHappened && operationsAreEqual(targetOperation, mergeOperation)) commonOperations.push(targetOperation);
-		else {
-			splitHappened = true;
-			targetDiffOperations.push(targetOperation);
-			mergeDiffOperations.push(mergeOperation);
-		}
-		else if (targetOperation) targetDiffOperations.push(targetOperation);
+		if (targetOperation && mergeOperation) {
+			if (!splitHappened && operationsAreEqual(targetOperation, mergeOperation)) commonOperations.push(targetOperation);
+			else {
+				splitHappened = true;
+				targetDiffOperations.push(targetOperation);
+				mergeDiffOperations.push(mergeOperation);
+			}
+		} else if (targetOperation) targetDiffOperations.push(targetOperation);
 		else if (mergeOperation) mergeDiffOperations.push(mergeOperation);
 	}
 	return [
@@ -3384,14 +3312,14 @@ function prepareOperations(operationsHistory, newOperations) {
 	const sortedOperationsHistory = sortOperations(operationsHistory);
 	const sortedOperations = sortOperations(newOperations);
 	const integrityErrors = checkCleanedOperationsIntegrity([...sortedOperationsHistory, ...sortedOperations]);
-	const firstMissingIndexOperation = [...integrityErrors.filter((integrityIssue) => integrityIssue.category === IntegrityIssueSubType.MISSING_INDEX)].sort((a, b) => b.operation.index - a.operation.index).pop()?.operation;
+	const firstMissingIndexOperation = [...integrityErrors.filter((integrityIssue) => integrityIssue.category === "MISSING_INDEX")].sort((a, b) => b.operation.index - a.operation.index).pop()?.operation;
 	for (const newOperation of sortedOperations) {
 		if (firstMissingIndexOperation && newOperation.index >= firstMissingIndexOperation.index) {
 			result.invalidOperations.push(newOperation);
 			continue;
 		}
 		if (integrityErrors.some((integrityError) => {
-			return integrityError.operation.index === newOperation.index && integrityError.operation.skip === newOperation.skip && integrityError.category === IntegrityIssueSubType.DUPLICATED_INDEX;
+			return integrityError.operation.index === newOperation.index && integrityError.operation.skip === newOperation.skip && integrityError.category === "DUPLICATED_INDEX";
 		})) {
 			result.duplicatedOperations.push(newOperation);
 			continue;
@@ -3620,18 +3548,6 @@ function redoOperation(document, action, skip) {
 		});
 	});
 }
-function loadStateOperation(document, action) {
-	const loaded = backfillAuthState(action.state.data);
-	loaded.auth = resolveSnapshotAuth(document.header.id, document.header.documentType, backfillAuthState({ ...document.state }).auth, loaded.auth);
-	return {
-		...document,
-		header: {
-			...document.header,
-			name: action.state.name
-		},
-		state: loaded
-	};
-}
 /**
 * Reads an operation's outcome. A denial takes precedence over a reducer
 * error, since a denied operation never reaches its reducer.
@@ -3664,15 +3580,12 @@ function replayOperations(initialState, clearedOperations, stateReducer, header,
 * @returns The updated document state.
 */
 function updateOperationsForAction(document, action, reuseLastOperationIndex, skip, context) {
-	if ([
-		"UNDO",
-		"REDO",
-		"PRUNE"
-	].includes(action.type)) return document;
+	if (["UNDO", "REDO"].includes(action.type)) return document;
 	const scope = action.scope;
 	const existing = document.operations[scope];
 	const lastOperationIndex = existing?.at(-1)?.index ?? -1;
-	const newOperation = operationFromAction(action, reuseLastOperationIndex ? lastOperationIndex : lastOperationIndex + 1, skip, context);
+	const index = reuseLastOperationIndex ? lastOperationIndex : lastOperationIndex + 1;
+	const newOperation = operationFromAction(action, index, skip, context);
 	const operations = [...existing ?? [], newOperation];
 	return {
 		...document,
@@ -3716,20 +3629,17 @@ function updateDocument(document, action, reuseLastOperationIndex, skip, context
 	return newDocument;
 }
 /**
-* The base document reducer function that wraps a custom reducer function.
+* The base document reducer function.
 *
 * @param state The current state of the document.
 * @param action The action being applied to the document.
-* @param wrappedReducer The custom reducer function being wrapped by the base reducer.
 * @returns The updated document state.
 */
-function _baseReducer(document, action, wrappedReducer) {
+function _baseReducer(document, action) {
 	const parsedAction = DocumentActionSchema().parse(action);
 	switch (parsedAction.type) {
 		case "SET_NAME": return setNameOperation(document, parsedAction.input);
 		case "SET_PREFERRED_EDITOR": return setPreferredEditorOperation(document, parsedAction.input);
-		case "PRUNE": return pruneOperation(document, parsedAction.input, wrappedReducer);
-		case "LOAD_STATE": return loadStateOperation(document, parsedAction.input);
 		default: return document;
 	}
 }
@@ -3807,7 +3717,7 @@ function processUndoOperation(document, scope, customReducer, reuseOperationResu
 }
 /**
 * Base document reducer that wraps a custom document reducer and handles
-* document-level actions such as undo, redo, prune, and set name.
+* document-level actions such as undo, redo, and set name.
 *
 * @template TGlobalState - The type of the state of the custom reducer.
 * @template TAction - The type of the actions of the custom reducer.
@@ -3835,7 +3745,7 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 		...newDocument,
 		clipboard: []
 	};
-	if (isDocumentAction(_action)) newDocument = _baseReducer(newDocument, _action, customReducer);
+	if (isDocumentAction(_action)) newDocument = _baseReducer(newDocument, _action);
 	const operationContext = {
 		documentId: document.header.id,
 		scope: _action.scope,
@@ -3898,11 +3808,7 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 			}
 		}
 	});
-	if ([
-		"UNDO",
-		"REDO",
-		"PRUNE"
-	].includes(_action.type)) return newDocument;
+	if (["UNDO", "REDO"].includes(_action.type)) return newDocument;
 	const scope = _action.scope || "global";
 	const replayHash = options.replayOptions?.operation.hash;
 	const hash = replayHash ? replayHash : hashDocumentStateForScope(newDocument, scope);
@@ -3922,7 +3828,6 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 *   - `SET_NAME`
 *   - `UNDO`
 *   - `REDO`
-*   - `PRUNE`
 *
 * It also updates the document-related attributes on every operation.
 *
@@ -3937,46 +3842,6 @@ function createReducer(stateReducer, documentReducer = baseReducer) {
 	};
 	return reducer;
 }
-function pruneOperation(document, input, wrappedReducer) {
-	const operations = document.operations.global;
-	if (!operations) throw new Error("No global operations found");
-	let { start, end } = input;
-	start = start || 0;
-	end = end || operations.length;
-	const actionsToPrune = operations.slice(start, end);
-	const actionsToKeepStart = operations.slice(0, start);
-	const actionsToKeepEnd = operations.slice(end);
-	const newDocument = replayOperations(document.initialState, {
-		...document.operations,
-		global: actionsToKeepStart.concat(actionsToPrune)
-	}, wrappedReducer, document.header);
-	const newState = newDocument.state;
-	const name = newDocument.header.name;
-	const loadStateIndex = actionsToKeepStart.length;
-	const loadStateTimestamp = actionsToKeepStart.length ? actionsToKeepStart[actionsToKeepStart.length - 1].timestampUtcMs : actionsToKeepEnd.length ? actionsToKeepEnd[0].timestampUtcMs : (/* @__PURE__ */ new Date()).toISOString();
-	const action = loadState({
-		name,
-		...newState
-	}, actionsToPrune.length);
-	return replayOperations(document.initialState, {
-		...document.operations,
-		global: [
-			...actionsToKeepStart,
-			{
-				skip: 0,
-				...action,
-				action,
-				timestampUtcMs: loadStateTimestamp,
-				index: loadStateIndex,
-				hash: hashDocumentStateForScope({ state: newState }, "global")
-			},
-			...actionsToKeepEnd.map((action, index) => ({
-				...action,
-				index: loadStateIndex + index + 1
-			}))
-		]
-	}, wrappedReducer, document.header);
-}
 //#endregion
 //#region document-model/validation.ts
 /**
@@ -3986,11 +3851,10 @@ function pruneOperation(document, input, wrappedReducer) {
 const RESERVED_OPERATION_NAMES = [
 	"UNDO",
 	"REDO",
-	"PRUNE",
-	"LOAD_STATE",
 	"SET_NAME",
 	"SET_PREFERRED_EDITOR",
-	"NOOP"
+	"NOOP",
+	"PURGE_DOCUMENT"
 ];
 /**
 * Operation names become the literal action `type` string at runtime and the
@@ -4226,6 +4090,15 @@ function orderBy(items, order) {
 		return (rank.get(a.item.id) ?? Number.MAX_SAFE_INTEGER) - (rank.get(b.item.id) ?? Number.MAX_SAFE_INTEGER) || a.index - b.index;
 	}).map(({ item }) => item);
 }
+/**
+* The untouched base of a mutative draft, or the value itself when it is not a
+* draft. Build replacement lists from it and freeze them before assigning, as
+* the drive node reducer does, so finalize skips the walk over the assigned
+* list. Read before writing: the base does not see this action's mutations.
+*/
+function readBase(value) {
+	return isDraft(value) ? original(value) : value;
+}
 const documentModelHeaderReducer = {
 	setModelNameOperation(state, action) {
 		state.name = action.input.name;
@@ -4275,7 +4148,8 @@ const documentModelModuleReducer = {
 	deleteModuleOperation(state, action) {
 		findModuleOrThrow(state, action.input.id);
 		const latestSpec = state.specifications[state.specifications.length - 1];
-		latestSpec.modules = latestSpec.modules.filter((m) => m.id != action.input.id);
+		const modules = readBase(latestSpec).modules.filter((m) => m.id != action.input.id);
+		latestSpec.modules = Object.freeze(modules);
 	},
 	reorderModulesOperation(state, action) {
 		const latestSpec = state.specifications[state.specifications.length - 1];
@@ -4393,14 +4267,20 @@ const documentModelOperationReducer = {
 		const matches = latestSpec.modules.flatMap((mod) => mod.operations.filter((op) => op.id === action.input.operationId));
 		if (matches.length === 0) throw new Error(`Operation "${action.input.operationId}" not found in the latest specification`);
 		if (matches.length > 1) throw new Error(`Operation "${action.input.operationId}" is duplicated in the latest specification`);
-		const moved = matches[0];
-		for (const mod of latestSpec.modules) mod.operations = mod.operations.filter((op) => op.id !== action.input.operationId);
-		targetModule.operations.push(moved);
+		const moved = readBase(matches[0]);
+		for (const mod of latestSpec.modules) {
+			const operations = readBase(mod).operations.filter((op) => op.id !== action.input.operationId);
+			if (mod === targetModule) operations.push(moved);
+			mod.operations = Object.freeze(operations);
+		}
 	},
 	deleteOperationOperation(state, action) {
 		findOperationOrThrow(state, action.input.id);
 		const latestSpec = state.specifications[state.specifications.length - 1];
-		for (const mod of latestSpec.modules) mod.operations = mod.operations.filter((operation) => operation.id != action.input.id);
+		for (const mod of latestSpec.modules) {
+			const operations = readBase(mod).operations.filter((operation) => operation.id != action.input.id);
+			mod.operations = Object.freeze(operations);
+		}
 	},
 	reorderModuleOperationsOperation(state, action) {
 		const targetModule = findModuleOrThrow(state, action.input.moduleId);
@@ -4438,7 +4318,8 @@ const documentModelStateSchemaReducer = {
 		if (!Object.keys(latestSpec.state).includes(action.input.scope)) throw new Error(`Invalid scope: ${action.input.scope}`);
 		const scopeState = latestSpec.state[action.input.scope];
 		if (!scopeState.examples.some((e) => e.id == action.input.id)) throw new Error(`State example "${action.input.id}" not found in scope "${action.input.scope}"`);
-		scopeState.examples = scopeState.examples.filter((e) => e.id != action.input.id);
+		const examples = readBase(scopeState).examples.filter((e) => e.id != action.input.id);
+		scopeState.examples = Object.freeze(examples);
 	},
 	reorderStateExamplesOperation(state, action) {
 		const latestSpec = state.specifications[state.specifications.length - 1];
@@ -4670,17 +4551,6 @@ const documentModelStateReducer = (state, action) => {
 const documentModelReducer = createReducer(documentModelStateReducer);
 //#endregion
 //#region document-model/upgrades.ts
-/**
-* Canonical document-model version normalization: documents stamped with 0
-* or nothing at all predate versioning and are treated as version 1, the
-* same version the registry assigns unversioned modules. Every consumer
-* that resolves a module or compares versions must use this rule; resolving
-* 0 to "latest" instead re-pins a legacy document's history to whichever
-* module happens to be newest.
-*/
-function normalizeDocumentModelVersion(version) {
-	return version && version > 0 ? version : 1;
-}
 function applyInitialState(document, action) {
 	const input = action.input;
 	const newState = input.initialState || input.state;
@@ -4708,7 +4578,11 @@ function applyUpgradeDocumentAction(document, action, upgradePath) {
 	const toVersion = action.input.toVersion;
 	if (fromVersion === toVersion && fromVersion > 0) return document;
 	if (fromVersion > toVersion) throw new DowngradeNotSupportedError(document.header.documentType, fromVersion, toVersion);
-	if (upgradePath) for (const transition of upgradePath) document = transition.upgradeReducer(document, action);
+	if (upgradePath) {
+		const protocolVersions = document.header.protocolVersions;
+		for (const transition of upgradePath) document = transition.upgradeReducer(document, action);
+		document = withProtocolVersions(document, protocolVersions);
+	}
 	applyInitialState(document, action);
 	document.state.document = {
 		...document.state.document,
@@ -4716,12 +4590,22 @@ function applyUpgradeDocumentAction(document, action, upgradePath) {
 	};
 	return document;
 }
+/** CREATE_DOCUMENT fixes `protocolVersions`; this puts them back after a reducer. */
+function withProtocolVersions(document, protocolVersions) {
+	const header = { ...document.header };
+	if (protocolVersions === void 0) delete header.protocolVersions;
+	else header.protocolVersions = { ...protocolVersions };
+	return {
+		...document,
+		header
+	};
+}
 /**
-* Applies a DELETE_DOCUMENT action to a document.
+* Applies a DELETE_DOCUMENT action, or a PURGE_DOCUMENT marker, to a document.
 * Marks the document as deleted in the document scope state.
 */
 function applyDeleteDocumentAction(document, action) {
-	const deletedAt = action.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString();
+	const deletedAt = isPurgeMarker(action) ? action.input.purgedAtUtcIso : action.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString();
 	document.state = {
 		...document.state,
 		document: {
@@ -4841,7 +4725,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		const curr = boundaries[i]?.[s] ?? 0;
 		if (boundaries[i]) boundaries[i][s] = Math.max(prev, curr);
 	}
-	const allScopes = new Set([
+	const allScopes = /* @__PURE__ */ new Set([
 		...Object.keys(operations),
 		"global",
 		"local"
@@ -4886,7 +4770,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			const spineActionType = spineOp.action.type;
 			if (spineActionType === "CREATE_DOCUMENT" || spineActionType === "UPGRADE_DOCUMENT") continue;
 			if (isDenied(spineOp)) continue;
-			if (spineActionType === "DELETE_DOCUMENT") document = applyDeleteDocumentAction(document, spineOp.action);
+			if (spineActionType === "DELETE_DOCUMENT" || spineActionType === "PURGE_DOCUMENT") document = applyDeleteDocumentAction(document, spineOp.action);
 			else document = reducer(document, spineOp.action, dispatch, {
 				ignoreSkipOperations: true,
 				checkHashes,
@@ -4928,7 +4812,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			}
 		}
 	}
-	const allResultScopes = new Set([
+	const allResultScopes = /* @__PURE__ */ new Set([
 		...Object.keys(document.operations),
 		...Object.keys(operations),
 		"global",
@@ -5012,22 +4896,22 @@ async function createZip(document) {
 */
 async function createMinimalZip(data) {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const header = {
-		id: data.documentId,
-		sig: {
-			publicKey: {},
-			nonce: ""
-		},
-		documentType: data.documentType,
-		createdAtUtcIso: now,
-		slug: data.name,
-		name: data.name,
-		branch: data.branch,
-		revision: {},
-		lastModifiedAtUtcIso: now
-	};
 	return zipAsync({
-		"header.json": jsonEntry(header),
+		"header.json": jsonEntry({
+			id: data.documentId,
+			sig: {
+				publicKey: {},
+				nonce: ""
+			},
+			documentType: data.documentType,
+			createdAtUtcIso: now,
+			slug: data.name,
+			name: data.name,
+			branch: data.branch,
+			revision: {},
+			lastModifiedAtUtcIso: now,
+			...data.protocolVersions && { protocolVersions: data.protocolVersions }
+		}),
 		"state.json": jsonEntry(data.state),
 		"current-state.json": jsonEntry(data.state),
 		"operations.json": jsonEntry({})
@@ -5051,7 +4935,10 @@ async function parseZipData(data) {
 	if (!files["header.json"]) throw new Error("Document header not found - file format may be outdated");
 	const header = JSON.parse(readEntry(files, "header.json"));
 	if (!files["operations.json"]) throw new Error("Operations history not found");
-	const clearedOperations = garbageCollectDocumentOperations(JSON.parse(readEntry(files, "operations.json")));
+	const operations = JSON.parse(readEntry(files, "operations.json"));
+	const clearedOperations = garbageCollectDocumentOperations(operations);
+	pinProtocolVersionsToCreate(header, operations);
+	backfillBaseReducerVersion(header);
 	const operationsError = validateOperations(clearedOperations);
 	if (operationsError.length) {
 		const errorMessages = operationsError.map((err) => err.message);
@@ -5063,6 +4950,25 @@ async function parseZipData(data) {
 		clearedOperations
 	};
 }
+/** header.json is a snapshot; the stored CREATE_DOCUMENT input wins. */
+function pinProtocolVersionsToCreate(header, operations) {
+	const create = operations.document?.find((operation) => operation.action.type === "CREATE_DOCUMENT");
+	if (!create) return;
+	const input = create.action.input;
+	if (input?.protocolVersions) header.protocolVersions = { ...input.protocolVersions };
+	else if (header.protocolVersions) {
+		const { [SIGNATURE_PROTOCOL]: _dropped, ...rest } = header.protocolVersions;
+		header.protocolVersions = rest;
+	}
+}
+/** A zip with no recorded base-reducer version predates it: replay as v1. */
+function backfillBaseReducerVersion(header) {
+	if (typeof header.protocolVersions?.["base-reducer"] === "number") return;
+	header.protocolVersions = {
+		...header.protocolVersions,
+		"base-reducer": 1
+	};
+}
 async function loadFromZipData(data, reducer, options) {
 	const { initialState, header, clearedOperations } = await parseZipData(data);
 	return {
@@ -5138,6 +5044,6 @@ const getFileBrowser = (file) => {
 	return Promise.resolve().then(() => readFileBrowser(file));
 };
 //#endregion
-export { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, AddChangeLogItemInputSchema, AddModuleInputSchema, AddOperationErrorInputSchema, AddOperationExampleInputSchema, AddOperationInputSchema, AddStateExampleInputSchema, AuthActionNotAllowedError, AuthAdministrationLockoutError, AuthAdministrationMissingError, AuthAlreadyInitializedError, AuthInitializerNotCreatorError, AuthPolicyNotPreservedError, AuthorSchema, BaseDocumentHeaderSchema, BaseDocumentStateSchema, CodeExampleSchema, ConfigEntrySchema, ConfigEntryTypeSchema, DOCUMENT_DELETED_REASON, DeleteChangeLogItemInputSchema, DeleteModuleInputSchema, DeleteOperationErrorInputSchema, DeleteOperationExampleInputSchema, DeleteOperationInputSchema, DeleteStateExampleInputSchema, DocumentActionSchema, DocumentModelGlobalStateSchema, DocumentModelHeaderSchema, DocumentModelInputSchema, DocumentModelPHStateSchema, DocumentModelSchema, DocumentSpecificationSchema, DowngradeNotSupportedError, FileSystemError, GrantNotFoundError, GrantSchema, GroupPrincipalNotAllowedError, HASH_ALGORITHM_SHA1, HASH_ALGORITHM_SHA256, HASH_ALGORITHM_SHA512, HASH_ENCODING_BASE64, HASH_ENCODING_HEX, HashMismatchError, InitializeAuthActionInputSchema, IntegrityIssueSubType, IntegrityIssueType, InvalidActionInputError, InvalidActionInputZodError, InvalidAuthVersionError, InvalidGrantError, LoadStateActionInputSchema, LoadStateActionSchema, LoadStateActionStateInputSchema, Load_StateSchema, MAX_AUTH_GRANTS, MAX_CAPABILITY_OPERATIONS, MAX_CONDITION_DEPTH, MAX_CONDITION_NODES, MAX_SUPPORTED_AUTH_VERSION, ManifestSchema, ModuleSchema, MoveGrantActionInputSchema, MoveOperationInputSchema, OPERATION_NAME_PATTERN, OperationErrorSchema, OperationScopeSchema, OperationSpecificationSchema, PowerhouseModuleSchema, PowerhouseModulesSchema, PruneActionInputSchema, PruneActionSchema, PruneSchema, PublisherSchema, PwaConfigSchema, RESERVED_OPERATION_NAMES, RedoActionInputSchema, RedoActionSchema, RedoSchema, RemoveGrantActionInputSchema, ReorderChangeLogItemsInputSchema, ReorderModuleOperationsInputSchema, ReorderModulesInputSchema, ReorderOperationErrorsInputSchema, ReorderOperationExamplesInputSchema, ReorderStateExamplesInputSchema, ScopeStateSchema, SetAuthorNameInputSchema, SetAuthorWebsiteInputSchema, SetGrantActionInputSchema, SetInitialStateInputSchema, SetModelDescriptionInputSchema, SetModelExtensionInputSchema, SetModelIdInputSchema, SetModelNameInputSchema, SetModuleDescriptionInputSchema, SetModuleNameInputSchema, SetNameActionInputSchema, SetNameActionSchema, SetOperationDescriptionInputSchema, SetOperationErrorCodeInputSchema, SetOperationErrorDescriptionInputSchema, SetOperationErrorNameInputSchema, SetOperationErrorTemplateInputSchema, SetOperationNameInputSchema, SetOperationReducerInputSchema, SetOperationSchemaInputSchema, SetOperationScopeInputSchema, SetOperationTemplateInputSchema, SetPreferredEditorActionInputSchema, SetPreferredEditorActionSchema, SetStateSchemaInputSchema, Set_NameSchema, Set_PreferredEditorSchema, StateSchema, UndoActionInputSchema, UndoActionSchema, UndoSchema, UnsupportedDocumentModelVersionError, UpdateChangeLogItemInputSchema, UpdateOperationExampleInputSchema, UpdateStateExampleInputSchema, ab2hex, actionContext, actionFromAction, actionSigner, actions, addChangeLogItem, addModule, addOperation, addOperationError, addOperationExample, addStateExample, addUndo, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyInitializeAuthAction, applyMoveGrantAction, applyRemoveGrantAction, applySetGrantAction, applyUpgradeDocumentAction, assertAuthAdministrationRetained, assertAuthPreservedOnDuplicate, assertAuthScopeActionAllowed, assertIsDocumentModelDocument, assertIsDocumentModelState, assertModuleIdUnique, assertOperationErrorIdUnique, assertOperationExampleIdUnique, assertOperationIdUnique, assertValidGrant, assertValidGrantUpsert, assertValidInitialGrants, attachBranch, backfillAuthState, base58Decode, base64UrlToBytes, baseActions, baseCreateDocument, baseLoadFromInput, baseLoadFromInputVersioned, baseReducer, baseReducerVersion, baseSaveToFileHandle, buildOperationSignature, buildOperationSignatureMessage, buildOperationSignatureParams, buildSignedAction, checkCleanedOperationsIntegrity, checkOperationsIntegrity, computeUpgradeTransitions, createAction, createAuthState, createBaseState, createDocumentState, createGlobalState, createLocalState, createMinimalZip, createPresignedHeader, createReducer, createSignedHeader, createSignedHeaderForSigner, createState, createVerificationSigner, createZip, decide, defaultAuthState, defaultBaseState, defaultDocumentState, defaultGlobalState, defaultLocalState, defaultPHState, definedNonNullAnySchema, deleteChangeLogItem, deleteModule, deleteOperation, deleteOperationError, deleteOperationExample, deleteStateExample, deriveOperationId, deserializeSignature, diffOperations, documentModelActions, documentModelDocumentType, documentModelFileExtension, documentModelGlobalState, documentModelHeaderReducer, documentModelInitialGlobalState, documentModelInitialLocalState, documentModelLoadFromInput, documentModelModuleReducer, documentModelOperationErrorReducer, documentModelOperationExampleReducer, documentModelOperationReducer, documentModelReducer, documentModelSaveToFileHandle, documentModelStateReducer, documentModelStateSchemaReducer, documentModelVersioningReducer, evaluate, evaluateCondition, evaluateGrantStack, evaluateGrants, fetchFileBrowser, filterDocumentOperationsResultingState, filterDuplicatedOperations, findModuleOrThrow, findOperationErrorOrThrow, findOperationExampleOrThrow, findOperationOrThrow, garbageCollect, garbageCollectDocumentOperations, garbageCollectV2, generateId, generateMock, getAllOperationNames, getDocumentLastModified, getFileBrowser, getUnixTimestamp, grantProblem, groupDocumentType, groupMembershipActionTypes, groupOperationsByScope, hashBrowser, hashDocumentStateForScope, hex2ab, initializeAuth, isAuthAction, isDefinedNonNullAny, isDenied, isDocumentAction, isDocumentCreator, isDocumentModelDocument, isDocumentModelState, isDocumentZip, isNoopOperation, isPlainValue, isReservedOperationName, isUndo, isUndoRedo, isValidOperationNameFormat, loadState, loadStateOperation, mapSkippedOperations, mapSkippedOperationsV2, mentionedGroupIds, merge, moveGrant, moveOperation, nextSkipNumber, noop, normalizeDocumentModelVersion, operationExampleCreators, operationFromAction, operationFromOperation, operationOutcome, operationWithContext, operationsAreEqual, parseBulkArchive, parseResultingState, precedes, prepareOperations, processUndoRedo, prune, pruneOperation, readFileBrowser, readOnly, redo, redoOperation, referencedGroupIds, releaseNewVersion, removeExistingOperations, removeGrant, reorderChangeLogItems, reorderModuleOperations, reorderModules, reorderOperationErrors, reorderOperationExamples, reorderStateExamples, replayDocument, replayDocumentVersioned, replayOperations, reshuffleByTimestamp, reshuffleByTimestampAndIndex, resolveSnapshotAuth, serializeSignature, setAuthorName, setAuthorWebsite, setGrant, setInitialState, setModelDescription, setModelExtension, setModelId, setModelName, setModuleDescription, setModuleName, setName, setNameOperation, setOperationDescription, setOperationErrorCode, setOperationErrorDescription, setOperationErrorName, setOperationErrorTemplate, setOperationName, setOperationReducer, setOperationSchema, setOperationScope, setOperationTemplate, setPreferredEditor, setPreferredEditorOperation, setStateSchema, sign, skipHeaderOperations, sortMappedOperations, sortOperations, split, toTransportAction, undo, undoOperation, undoOperationV2, updateChangeLogItem, updateDocument, updateHeaderRevision, updateOperationExample, updateStateExample, validateHeader, validateInitialState, validateModule, validateModuleOperation, validateModules, validateOperationName, validateOperations, validateStateSchemaName, verify, verifyOperationSignature, writeFileBrowser, zipEntries };
+export { ACTION_SIGNATURE_V2_PREFIX, AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, AddChangeLogItemInputSchema, AddModuleInputSchema, AddOperationErrorInputSchema, AddOperationExampleInputSchema, AddOperationInputSchema, AddStateExampleInputSchema, AuthActionNotAllowedError, AuthAdministrationLockoutError, AuthAdministrationMissingError, AuthAlreadyInitializedError, AuthInitializerNotCreatorError, AuthPolicyNotPreservedError, AuthorSchema, BaseDocumentHeaderSchema, BaseDocumentStateSchema, CanonicalJsonError, CodeExampleSchema, ConfigEntrySchema, ConfigEntryTypeSchema, DEFAULT_SIGNATURE_POLICY, DOCUMENT_DELETED_REASON, DOCUMENT_PURGE_PROTOCOL, DOCUMENT_SCOPE_ACTION_TYPES, DeleteChangeLogItemInputSchema, DeleteModuleInputSchema, DeleteOperationErrorInputSchema, DeleteOperationExampleInputSchema, DeleteOperationInputSchema, DeleteStateExampleInputSchema, DocumentActionSchema, DocumentModelGlobalStateSchema, DocumentModelHeaderSchema, DocumentModelInputSchema, DocumentModelPHStateSchema, DocumentModelSchema, DocumentSpecificationSchema, DowngradeNotSupportedError, FileSystemError, GrantNotFoundError, GrantSchema, GroupPrincipalNotAllowedError, HASH_ALGORITHM_SHA1, HASH_ALGORITHM_SHA256, HASH_ALGORITHM_SHA512, HASH_ENCODING_BASE64, HASH_ENCODING_HEX, HashMismatchError, InitializeAuthActionInputSchema, IntegrityIssueSubType, IntegrityIssueType, InvalidActionInputError, InvalidActionInputZodError, InvalidAuthVersionError, InvalidGrantError, MARKER_REFUSAL_FEATURE, MAX_AUTH_GRANTS, MAX_CAPABILITY_OPERATIONS, MAX_CONDITION_DEPTH, MAX_CONDITION_NODES, MAX_SUPPORTED_AUTH_VERSION, ManifestSchema, ModuleSchema, MoveGrantActionInputSchema, MoveOperationInputSchema, OPERATION_NAME_PATTERN, OperationErrorSchema, OperationScopeSchema, OperationSpecificationSchema, PEER_CAPABILITIES, PEER_MANIFEST_FORMAT, PURGE_DOCUMENT, PieceModuleSchema, PieceModulesSchema, PowerhouseModuleSchema, PowerhouseModulesSchema, PublisherSchema, PwaConfigSchema, RESERVED_OPERATION_NAMES, RedoActionInputSchema, RedoActionSchema, RedoSchema, RemoveGrantActionInputSchema, ReorderChangeLogItemsInputSchema, ReorderModuleOperationsInputSchema, ReorderModulesInputSchema, ReorderOperationErrorsInputSchema, ReorderOperationExamplesInputSchema, ReorderStateExamplesInputSchema, SIGNATURE_PROTOCOL, SIGNATURE_PROTOCOL_V2, ScopeStateSchema, SetAuthorNameInputSchema, SetAuthorWebsiteInputSchema, SetGrantActionInputSchema, SetInitialStateInputSchema, SetModelDescriptionInputSchema, SetModelExtensionInputSchema, SetModelIdInputSchema, SetModelNameInputSchema, SetModuleDescriptionInputSchema, SetModuleNameInputSchema, SetNameActionInputSchema, SetNameActionSchema, SetOperationDescriptionInputSchema, SetOperationErrorCodeInputSchema, SetOperationErrorDescriptionInputSchema, SetOperationErrorNameInputSchema, SetOperationErrorTemplateInputSchema, SetOperationNameInputSchema, SetOperationReducerInputSchema, SetOperationSchemaInputSchema, SetOperationScopeInputSchema, SetOperationTemplateInputSchema, SetPreferredEditorActionInputSchema, SetPreferredEditorActionSchema, SetStateSchemaInputSchema, Set_NameSchema, Set_PreferredEditorSchema, StateSchema, UndoActionInputSchema, UndoActionSchema, UndoSchema, UnsupportedDocumentModelVersionError, UpdateChangeLogItemInputSchema, UpdateOperationExampleInputSchema, UpdateStateExampleInputSchema, ab2hex, actionContext, actionFromAction, actionPreimageV2, actionSigner, actionSignerIdentity, actionSigningTarget, actions, addChangeLogItem, addModule, addOperation, addOperationError, addOperationExample, addStateExample, addUndo, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyInitializeAuthAction, applyMoveGrantAction, applyRemoveGrantAction, applySetGrantAction, applyUpgradeDocumentAction, assertAuthAdministrationRetained, assertAuthPreservedOnDuplicate, assertAuthScopeActionAllowed, assertIsDocumentModelDocument, assertIsDocumentModelState, assertModuleIdUnique, assertOperationErrorIdUnique, assertOperationExampleIdUnique, assertOperationIdUnique, assertValidGrant, assertValidGrantUpsert, assertValidInitialGrants, attachBranch, backfillAuthState, base58Decode, base64UrlToBytes, baseActions, baseCreateDocument, baseLoadFromInput, baseLoadFromInputVersioned, baseReducer, baseReducerVersion, baseSaveToFileHandle, buildOperationSignature, buildOperationSignatureMessage, buildOperationSignatureParams, buildSignedAction, bytesToBase64Url, canonicalJson, checkCleanedOperationsIntegrity, checkOperationsIntegrity, computeUpgradeTransitions, coversLocal, createAction, createAuthState, createBaseState, createCopyHeader, createDocumentState, createGlobalState, createLocalState, createMinimalZip, createPresignedHeader, createReducer, createSignedHeader, createSignedHeaderForSigner, createState, createVerificationSigner, createZip, decide, defaultAuthState, defaultBaseState, defaultDocumentState, defaultGlobalState, defaultLocalState, defaultPHState, definedNonNullAnySchema, deleteChangeLogItem, deleteModule, deleteOperation, deleteOperationError, deleteOperationExample, deleteStateExample, deriveDocumentId, deriveOperationId, deserializeSignature, diffOperations, documentModelActions, documentModelDocumentType, documentModelFileExtension, documentModelGlobalState, documentModelHeaderReducer, documentModelInitialGlobalState, documentModelInitialLocalState, documentModelLoadFromInput, documentModelModuleReducer, documentModelOperationErrorReducer, documentModelOperationExampleReducer, documentModelOperationReducer, documentModelReducer, documentModelSaveToFileHandle, documentModelStateReducer, documentModelStateSchemaReducer, documentModelVersioningReducer, evaluate, evaluateCondition, evaluateGrantStack, evaluateGrants, fetchFileBrowser, filterDocumentOperationsResultingState, filterDuplicatedOperations, findModuleOrThrow, findOperationErrorOrThrow, findOperationExampleOrThrow, findOperationOrThrow, garbageCollect, garbageCollectDocumentOperations, garbageCollectV2, generateId, generateMock, getAllOperationNames, getDocumentLastModified, getFileBrowser, getUnixTimestamp, grantProblem, groupDocumentType, groupMembershipActionTypes, groupOperationsByScope, hasDerivedDocumentId, hashActionV2, hashBrowser, hashDocumentStateForScope, hex2ab, holdReason, initializeAuth, isAuthAction, isDefinedNonNullAny, isDenied, isDerivedDocumentId, isDocumentAction, isDocumentCreator, isDocumentModelDocument, isDocumentModelState, isDocumentZip, isNoopOperation, isOlderManifest, isPlainValue, isPurgeMarker, isReservedOperationName, isSignaturePolicy, isUndo, isUndoRedo, isV2ActionHash, isValidOperationNameFormat, legacySupports, localPeerManifest, localSupports, manifestRevision, mapSkippedOperations, mapSkippedOperationsV2, mentionedGroupIds, merge, mergePeerCapabilities, moveGrant, moveOperation, nextSkipNumber, noop, normalizeDocumentModelVersion, operationExampleCreators, operationFromAction, operationFromOperation, operationOutcome, operationWithContext, operationsAreEqual, parseBulkArchive, parseResultingState, peerSupports, precedes, prepareOperations, processUndoRedo, protocolVersionsFor, purgeDocumentAction, purgeMarkerOperation, purgedProtocolVersions, readFileBrowser, readOnly, readPeerManifest, redo, redoOperation, referencedGroupIds, releaseNewVersion, removeExistingOperations, removeGrant, reorderChangeLogItems, reorderModuleOperations, reorderModules, reorderOperationErrors, reorderOperationExamples, reorderStateExamples, replayDocument, replayDocumentVersioned, replayOperations, requestedSignaturePolicy, reshuffleByTimestamp, reshuffleByTimestampAndIndex, resolveSnapshotAuth, selectProtocolVersions, serializeSignature, setAuthorName, setAuthorWebsite, setGrant, setInitialState, setModelDescription, setModelExtension, setModelId, setModelName, setModuleDescription, setModuleName, setName, setNameOperation, setOperationDescription, setOperationErrorCode, setOperationErrorDescription, setOperationErrorName, setOperationErrorTemplate, setOperationName, setOperationReducer, setOperationSchema, setOperationScope, setOperationTemplate, setPreferredEditor, setPreferredEditorOperation, setStateSchema, sign, signActionV2, signaturePolicyOf, skipHeaderOperations, sortMappedOperations, sortOperations, split, targetDocumentId, toTransportAction, undo, undoOperation, undoOperationV2, updateChangeLogItem, updateDocument, updateHeaderRevision, updateOperationExample, updateStateExample, v2RequiredProtocolVersions, v2TupleProblem, validateHeader, validateInitialState, validateModule, validateModuleOperation, validateModules, validateOperationName, validateOperations, validateStateSchemaName, verify, verifyOperationSignature, withProtocolVersions, withSignaturePolicy, writeFileBrowser, zipEntries };
 
 //# sourceMappingURL=index.js.map