@powerhousedao/shared 6.2.3-dev.9 → 6.2.3

package/dist/document-model/index.js

@@ -1,9 +1,176 @@
-import { a as base58Decode, c as buildOperationSignatureParams, d as hex2ab, i as ab2hex, l as getUnixTimestamp, n as generateId, o as base64UrlToBytes, r as generateMock, s as buildOperationSignatureMessage, t as deriveOperationId, u as hashBrowser } from "../utils-aaTmfxFW.js";
+import { a as base58Decode, c as buildOperationSignatureParams, d as hashBrowser, f as hex2ab, i as ab2hex, l as bytesToBase64Url, n as generateId, o as base64UrlToBytes, r as generateMock, s as buildOperationSignatureMessage, t as deriveOperationId, u as getUnixTimestamp } from "../utils-CSF716ux.js";
 import { ZodError, z } from "zod";
 import { stringify } from "safe-stable-stringify";
+import { sha256 } from "@noble/hashes/sha2.js";
 import { strFromU8, strToU8, unzip, zip } from "fflate";
-import { castDraft, create, unsafe } from "mutative";
+import { castDraft, create, isDraft, original, unsafe } from "mutative";
 import { constantCase, pascalCase } from "change-case";
+//#region document-model/action-signature.ts
+const ACTION_SIGNATURE_V2_PREFIX = "v2:";
+const V2_HASH = /^v2:[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+const V2_TIMESTAMP = /^[0-9]+$/;
+const V2_SIGNATURE = /^0x[0-9a-f]{128}$/;
+const LONE_SURROGATE = /\p{Cs}/u;
+const PREIMAGE_FIELDS = [
+	"version",
+	"documentId",
+	"branch",
+	"scope",
+	"type",
+	"id",
+	"timestampUtcMs",
+	"input",
+	"signer.user.address",
+	"signer.user.networkId",
+	"signer.user.chainId",
+	"signer.app.key"
+];
+/** A value that would not survive a JSON store round trip unchanged. */
+var CanonicalJsonError = class extends Error {
+	constructor(path, detail) {
+		super(`Cannot canonicalize ${path}: ${detail}`);
+		this.name = "CanonicalJsonError";
+	}
+};
+/** Sorted-key JSON, as the state hash encodes; drops `undefined` properties. */
+function canonicalJson(value, label = "value") {
+	assertCanonical(value, label, /* @__PURE__ */ new Set());
+	return stringify(value);
+}
+/** Actions the reactor reduces itself, onto the document scope. */
+const DOCUMENT_SCOPE_ACTION_TYPES = /* @__PURE__ */ new Set([
+	"CREATE_DOCUMENT",
+	"DELETE_DOCUMENT",
+	"UPGRADE_DOCUMENT",
+	"ADD_RELATIONSHIP",
+	"REMOVE_RELATIONSHIP",
+	"UPDATE_RELATIONSHIP"
+]);
+/** Where a document-scope action writes: `sourceId` or `documentId`. */
+function targetDocumentId(action, fallback) {
+	const input = action.input;
+	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
+	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
+}
+/** The log an action submitted to a job on `documentId` is stored in. */
+function actionSigningTarget(action, documentId, branch) {
+	return {
+		documentId: DOCUMENT_SCOPE_ACTION_TYPES.has(action.type) ? targetDocumentId(action, documentId) : documentId,
+		branch
+	};
+}
+/** The identity a signer writes into `context.signer`, and signs over. */
+function actionSignerIdentity(signer) {
+	return {
+		user: {
+			address: signer.user?.address ?? "",
+			networkId: signer.user?.networkId ?? "",
+			chainId: signer.user?.chainId ?? 0
+		},
+		app: {
+			name: signer.app?.name ?? "",
+			key: signer.app?.key ?? ""
+		}
+	};
+}
+/** The v2 preimage; throws `CanonicalJsonError` on an unsignable action. */
+function actionPreimageV2(action, target, signer) {
+	if (!target.documentId) throw new CanonicalJsonError("documentId", "must not be empty");
+	if (!target.branch) throw new CanonicalJsonError("branch", "must not be empty");
+	if (action.input === void 0) throw new CanonicalJsonError("input", `action ${action.id} (${action.type}) has no input`);
+	const fields = [
+		"v2",
+		target.documentId,
+		target.branch,
+		action.scope,
+		action.type,
+		action.id,
+		action.timestampUtcMs,
+		action.input,
+		signer.user.address,
+		signer.user.networkId,
+		signer.user.chainId,
+		signer.app.key
+	];
+	fields.forEach((field, i) => {
+		assertCanonical(field, PREIMAGE_FIELDS[i], /* @__PURE__ */ new Set());
+	});
+	return stringify(fields);
+}
+/** `"v2:" + base64url(sha256(preimage))`, unpadded. */
+async function hashActionV2(action, target, signer) {
+	const preimage = actionPreimageV2(action, target, signer);
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(preimage));
+	return "v2:" + bytesToBase64Url$1(new Uint8Array(digest));
+}
+/** Signs `action` as a v2 tuple; the message layout is the legacy one. */
+async function signActionV2(params) {
+	const { action, target, signer, sign } = params;
+	const previousStateHash = params.previousStateHash ?? "";
+	if (previousStateHash.includes(", ")) throw new Error(`Cannot sign action ${action.id}: the previous state hash contains ", "`);
+	const tuple = [
+		(Date.now() / 1e3).toFixed(0),
+		signer.app.key,
+		await hashActionV2(action, target, signer),
+		previousStateHash
+	];
+	const signature = await sign(buildOperationSignatureMessage(tuple));
+	if (signature.length !== 64) throw new Error(`Cannot sign action ${action.id}: expected a 64-byte P-256 signature, got ${signature.length} bytes`);
+	return [...tuple, `0x${bytesToHex(signature)}`];
+}
+/** Element [2] carries the v2 prefix, whether or not it is well formed. */
+function isV2ActionHash(hash) {
+	return hash.startsWith("v2:");
+}
+/** The strict shape of a v2 tuple, apart from what its hash covers. */
+function v2TupleProblem(tuple) {
+	if (!V2_TIMESTAMP.test(tuple[0])) return "signing time is not decimal seconds";
+	if (!V2_HASH.test(tuple[2])) return "hash is not v2: and 43 base64url characters";
+	if (!V2_SIGNATURE.test(tuple[4])) return "signature is not 0x and 128 lowercase hex digits";
+}
+function assertCanonical(value, path, ancestors) {
+	switch (typeof value) {
+		case "string":
+			if (LONE_SURROGATE.test(value)) throw new CanonicalJsonError(path, "string holds a lone surrogate");
+			return;
+		case "boolean": return;
+		case "number":
+			if (!Number.isFinite(value)) throw new CanonicalJsonError(path, `${value} is not a JSON number`);
+			return;
+		case "undefined": throw new CanonicalJsonError(path, "undefined is not a JSON value");
+		case "bigint": throw new CanonicalJsonError(path, "BigInt is not a JSON value");
+		case "function":
+		case "symbol": throw new CanonicalJsonError(path, `${typeof value} is not a JSON value`);
+	}
+	if (value === null) return;
+	const object = value;
+	if (ancestors.has(object)) throw new CanonicalJsonError(path, "value is circular");
+	const toJSON = object.toJSON;
+	if (typeof toJSON === "function") {
+		assertCanonical(toJSON.call(object), path, new Set(ancestors).add(object));
+		return;
+	}
+	ancestors.add(object);
+	if (Array.isArray(object)) for (let i = 0; i < object.length; i++) {
+		if (!(i in object)) throw new CanonicalJsonError(`${path}[${i}]`, "array is sparse");
+		assertCanonical(object[i], `${path}[${i}]`, ancestors);
+	}
+	else for (const [key, child] of Object.entries(object)) {
+		if (LONE_SURROGATE.test(key)) throw new CanonicalJsonError(path, "key holds a lone surrogate");
+		if (child === void 0) continue;
+		assertCanonical(child, `${path}.${key}`, ancestors);
+	}
+	ancestors.delete(object);
+}
+function bytesToBase64Url$1(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function bytesToHex(bytes) {
+	return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
 //#region document-model/signatures.ts
 /**
 * What separates a signature's params when it travels as one string.
@@ -198,7 +365,7 @@ var GrantNotFoundError = class extends Error {
 	}
 };
 /**
-* Thrown when a disallowed action (UNDO, REDO, PRUNE) targets the auth scope.
+* Thrown when a disallowed action (UNDO, REDO) targets the auth scope.
 */
 var AuthActionNotAllowedError = class extends Error {
 	actionType;
@@ -257,8 +424,6 @@ var UnsupportedDocumentModelVersionError = class extends Error {
 //#region document-model/schemas.ts
 const isDefinedNonNullAny = (v) => v !== void 0 && v !== null;
 const definedNonNullAnySchema = z.any().refine((v) => isDefinedNonNullAny(v));
-const Load_StateSchema = z.enum(["LOAD_STATE"]);
-const PruneSchema = z.enum(["PRUNE"]);
 const RedoSchema = z.enum(["REDO"]);
 const Set_NameSchema = z.enum(["SET_NAME"]);
 const Set_PreferredEditorSchema = z.enum(["SET_PREFERRED_EDITOR"]);
@@ -268,50 +433,12 @@ function OperationScopeSchema() {
 }
 function DocumentActionSchema() {
 	return z.union([
-		LoadStateActionSchema(),
-		PruneActionSchema(),
 		RedoActionSchema(),
 		SetNameActionSchema(),
 		SetPreferredEditorActionSchema(),
 		UndoActionSchema()
 	]);
 }
-function LoadStateActionSchema() {
-	return z.object({
-		id: z.string(),
-		timestampUtcMs: z.string(),
-		input: z.lazy(() => LoadStateActionInputSchema()),
-		type: Load_StateSchema,
-		scope: OperationScopeSchema()
-	});
-}
-function LoadStateActionInputSchema() {
-	return z.object({
-		operations: z.number(),
-		state: z.lazy(() => LoadStateActionStateInputSchema())
-	});
-}
-function LoadStateActionStateInputSchema() {
-	return z.object({
-		data: z.unknown().nullish(),
-		name: z.string()
-	});
-}
-function PruneActionSchema() {
-	return z.object({
-		id: z.string(),
-		timestampUtcMs: z.string(),
-		input: z.lazy(() => PruneActionInputSchema()),
-		type: PruneSchema,
-		scope: OperationScopeSchema()
-	});
-}
-function PruneActionInputSchema() {
-	return z.object({
-		end: z.number().nullish(),
-		start: z.number().nullish()
-	});
-}
 function RedoActionInputSchema() {
 	return z.object({ count: z.number() });
 }
@@ -729,6 +856,13 @@ const PowerhouseModuleSchema = z.object({
 	documentTypes: z.array(z.string()).optional()
 });
 const PowerhouseModulesSchema = z.array(PowerhouseModuleSchema).optional();
+const PieceModuleSchema = PowerhouseModuleSchema.extend({
+	version: z.string().optional(),
+	description: z.string().optional(),
+	bundle: z.string().optional(),
+	descriptor: z.string().optional()
+});
+const PieceModulesSchema = z.array(PieceModuleSchema).optional();
 const PublisherSchema = z.object({
 	name: z.string().optional(),
 	url: z.string().optional()
@@ -739,7 +873,7 @@ const ConfigEntrySchema = z.object({
 	type: ConfigEntryTypeSchema,
 	description: z.string().optional(),
 	required: z.boolean().optional(),
-	default: z.boolean().optional()
+	default: z.string().optional()
 });
 const PwaUrlPatternSchema = z.union([z.string(), z.strictObject({
 	source: z.string(),
@@ -835,7 +969,7 @@ const ManifestSchema = z.object({
 	editors: PowerhouseModulesSchema,
 	processors: PowerhouseModulesSchema,
 	subgraphs: PowerhouseModulesSchema,
-	pieces: PowerhouseModulesSchema,
+	pieces: PieceModulesSchema,
 	config: z.array(ConfigEntrySchema).optional(),
 	pwa: PwaConfigSchema.optional()
 });
@@ -855,35 +989,6 @@ const undo = (count = 1, scope = "global") => createAction("UNDO", { count }, vo
 * @category Actions
 */
 const redo = (count = 1, scope = "global") => createAction("REDO", { count }, void 0, RedoActionInputSchema, scope);
-/**
-* Joins multiple operations into a single {@link loadState | LOAD_STATE} operation.
-*
-* @remarks
-* Useful to keep operations history smaller. Operations to prune are selected by index,
-* similar to the {@link https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/slice | slice} method in Arrays.
-*
-* @param start - Index of the first operation to prune
-* @param end - Index of the last operation to prune
-* @category Actions
-*/
-const prune = (start, end, scope = "global") => createAction("PRUNE", {
-	start,
-	end
-}, void 0, PruneActionInputSchema, scope);
-/**
-* Replaces the state of the document.
-*
-* @remarks
-* This action shouldn't be used directly. It is dispatched by the {@link prune} action.
-*
-* @param state - State to be set in the document.
-* @param operations - Number of operations that were removed from the previous state.
-* @category Actions
-*/
-const loadState = (state, operations) => createAction("LOAD_STATE", {
-	state,
-	operations
-}, void 0, LoadStateActionInputSchema);
 const noop = (scope = "global") => createAction("NOOP", {}, void 0, void 0, scope);
 /**
 * Helper function to be used by action creators.
@@ -981,6 +1086,7 @@ async function buildOperationSignature(context, signMethod) {
 	const signature = await signMethod(buildOperationSignatureMessage(params));
 	return [...params, `0x${ab2hex(signature)}`];
 }
+/** @deprecated Emits a legacy SHA-1 tuple; sign through `ISigner.signAction`. */
 async function buildSignedAction(action, reducer, document, signer, signHandler) {
 	const scopeOperations = reducer(document, action, void 0, { reuseOperationResultingState: true }).operations[action.scope];
 	if (!scopeOperations) throw new Error(`No operations found for scope: ${action.scope}`);
@@ -993,8 +1099,10 @@ async function buildSignedAction(action, reducer, document, signer, signHandler)
 		action,
 		previousStateHash
 	}, signHandler);
-	return operationWithContext(operation, { signer: actionSigner(signer.user, signer.app, [...signer.signatures, signature]) });
+	const actionContext = { signer: actionSigner(signer.user, signer.app, [...signer.signatures, signature]) };
+	return operationWithContext(operation, actionContext);
 }
+/** @deprecated Use `verifyActionSignature` from `@powerhousedao/reactor`. */
 async function verifyOperationSignature(signature, signer, verifyHandler) {
 	const publicKey = signer.app.key;
 	const params = signature.slice(0, 4);
@@ -1069,8 +1177,6 @@ const baseActions = {
 	setPreferredEditor,
 	undo,
 	redo,
-	prune,
-	loadState,
 	noop
 };
 const documentModelActions = {
@@ -1188,7 +1294,7 @@ var AuthAdministrationMissingError = class extends Error {
 		this.name = "AuthAdministrationMissingError";
 	}
 };
-const GRANT_KEYS = new Set([
+const GRANT_KEYS = /* @__PURE__ */ new Set([
 	"id",
 	"description",
 	"effect",
@@ -1196,13 +1302,13 @@ const GRANT_KEYS = new Set([
 	"capability",
 	"where"
 ]);
-const PRINCIPAL_KINDS = new Set([
+const PRINCIPAL_KINDS = /* @__PURE__ */ new Set([
 	"anyone",
 	"address",
 	"group",
 	"match"
 ]);
-const COMPARISON_CONDITION_KINDS = new Set([
+const COMPARISON_CONDITION_KINDS = /* @__PURE__ */ new Set([
 	"eq",
 	"ne",
 	"lt",
@@ -2531,12 +2637,12 @@ function assertAuthPreservedOnDuplicate(documentId, source, duplicated) {
 * The auth scope a state snapshot may install, given the policy already there.
 *
 * `applyAuthAction` is the validated door onto `state.auth`, but a whole-state
-* snapshot (UPGRADE_DOCUMENT's `initialState`, LOAD_STATE's `data`) replaces the
-* scope wholesale and is authorized as a `document`-scope write. Without this,
-* a subject holding `execute` on `document` and no auth grant at all can install
-* a policy of its choosing, name itself `creator` (which exempts the policy from
-* the retention rule for good), or wipe an existing policy by carrying the
-* default uninitialized one.
+* snapshot (UPGRADE_DOCUMENT's `initialState`) replaces the scope wholesale and
+* is authorized as a `document`-scope write. Without this, a subject holding
+* `execute` on `document` and no auth grant at all can install a policy of its
+* choosing, name itself `creator` (which exempts the policy from the retention
+* rule for good), or wipe an existing policy by carrying the default
+* uninitialized one.
 *
 * Three cases:
 *
@@ -2563,13 +2669,9 @@ function resolveSnapshotAuth(documentId, documentType, current, incoming) {
 	assertValidInitialGrants(incoming.grants, documentType, incoming.creator);
 	return incoming;
 }
-/** UNDO, REDO and PRUNE are rejected on the auth scope. */
+/** UNDO and REDO are rejected on the auth scope. */
 function assertAuthScopeActionAllowed(action) {
-	if (action.scope === "auth" && [
-		"UNDO",
-		"REDO",
-		"PRUNE"
-	].includes(action.type)) throw new AuthActionNotAllowedError(action.type);
+	if (action.scope === "auth" && ["UNDO", "REDO"].includes(action.type)) throw new AuthActionNotAllowedError(action.type);
 }
 /**
 * Evaluates the auth policy for a single request and reports why it refused.
@@ -2675,6 +2777,63 @@ function assertIsDocumentModelDocument(document) {
 	DocumentModelSchema.parse(document);
 }
 //#endregion
+//#region document-model/signature-policy.ts
+/** The `protocolVersions` key that fixes a document's signature requirement. */
+const SIGNATURE_PROTOCOL = "signature";
+/** `protocolVersions.signature` of a document that requires v2 tuples. */
+const SIGNATURE_PROTOCOL_V2 = 2;
+/** What a new document is created as unless the caller or host says otherwise. */
+const DEFAULT_SIGNATURE_POLICY = "v2-required";
+function isSignaturePolicy(value) {
+	return value === "legacy" || value === "v2-required";
+}
+const DERIVED_ID = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+/** Read from a header, a CREATE_DOCUMENT input or a bare map. */
+function signaturePolicyOf(source) {
+	const version = (source && "protocolVersions" in source ? source.protocolVersions : source)?.[SIGNATURE_PROTOCOL];
+	return typeof version === "number" && version >= 2 ? "v2-required" : "legacy";
+}
+/** `protocolVersions` for a new v2-required document. */
+function v2RequiredProtocolVersions(base = {}) {
+	return {
+		"base-reducer": 2,
+		...base,
+		[SIGNATURE_PROTOCOL]: 2
+	};
+}
+/**
+* The policy a create call asks for: `signaturePolicy`, else the `signature`
+* key of its `protocolVersions`, else `fallback`, the host's default.
+*/
+function requestedSignaturePolicy(request, fallback) {
+	if (request?.signaturePolicy) return request.signaturePolicy;
+	if (request?.protocolVersions?.["signature"] !== void 0) return signaturePolicyOf(request.protocolVersions);
+	return fallback;
+}
+/** `protocolVersions` for a new document under `policy`, over `base`. */
+function protocolVersionsFor(policy, base = {}) {
+	if (policy === "v2-required") return v2RequiredProtocolVersions(base);
+	const { [SIGNATURE_PROTOCOL]: _signature, ...rest } = base;
+	return {
+		"base-reducer": 2,
+		...rest
+	};
+}
+/** `base64url(sha256(canonicalJson(params)))`, unpadded. */
+function deriveDocumentId(params) {
+	const preimage = canonicalJson({
+		documentType: params.documentType,
+		createdAtUtcIso: params.createdAtUtcIso,
+		nonce: params.nonce,
+		protocolVersions: params.protocolVersions
+	}, "document id");
+	return bytesToBase64Url(sha256(new TextEncoder().encode(preimage)));
+}
+/** Whether `id` has the shape `deriveDocumentId` produces. */
+function isDerivedDocumentId(id) {
+	return DERIVED_ID.test(id);
+}
+//#endregion
 //#region document-model/header.ts
 /**
 * Generates a deterministic payload from signing parameters
@@ -2694,11 +2853,11 @@ async function createVerificationSigner(pubKey) {
 	}, true, ["verify"]);
 	return {
 		publicKey: cryptoKey,
-		async sign(_data) {
-			throw new Error("verification-only signer cannot sign data");
+		sign(_data) {
+			return Promise.reject(/* @__PURE__ */ new Error("verification-only signer cannot sign data"));
 		},
-		async signAction(_action, _abortSignal) {
-			throw new Error("verification-only signer cannot sign actions");
+		signAction(_action, _target, _abortSignal) {
+			return Promise.reject(/* @__PURE__ */ new Error("verification-only signer cannot sign actions"));
 		},
 		async verify(data, signature) {
 			let isValid;
@@ -2768,26 +2927,68 @@ const validateHeader = async (header) => {
 * Creates a header that has yet to be signed. This header is not valid, but
 * can be input into {@link createSignedHeader} to create a signed header.
 *
+* With `protocolVersions` requiring v2 signatures the header takes a random
+* nonce and the id {@link deriveDocumentId} gives, so `id` must be omitted.
+*
 * @returns An unsigned header for a document.
 */
-const createPresignedHeader = (id = generateId(), documentType = "") => {
-	return {
-		id,
+const createPresignedHeader = (id, documentType = "", protocolVersions) => {
+	const createdAtUtcIso = (/* @__PURE__ */ new Date()).toISOString();
+	const header = {
+		id: id ?? generateId(),
 		sig: {
 			publicKey: {},
 			nonce: ""
 		},
 		documentType,
-		createdAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
+		createdAtUtcIso,
 		slug: "",
 		name: "",
 		branch: "main",
 		revision: { document: 0 },
-		lastModifiedAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
+		lastModifiedAtUtcIso: createdAtUtcIso,
 		meta: {}
 	};
+	if (protocolVersions === void 0) return header;
+	header.protocolVersions = { ...protocolVersions };
+	if (signaturePolicyOf(header) === "legacy") return header;
+	if (id !== void 0) throw new Error(`A v2-required document's id is derived from its header; cannot use ${id}`);
+	header.sig.nonce = generateId();
+	header.id = deriveDocumentId({
+		documentType,
+		createdAtUtcIso,
+		nonce: header.sig.nonce,
+		protocolVersions: header.protocolVersions
+	});
+	return header;
 };
 /**
+* A header for a copy of a document headed `source`. A copy is v2-required
+* when its source is or when `policy` asks for it, and then takes a derived id;
+* otherwise it takes `id`. It keeps the source's other protocol versions.
+*/
+function createCopyHeader(source, id, policy = DEFAULT_SIGNATURE_POLICY) {
+	const base = source.protocolVersions ?? {};
+	if (signaturePolicyOf(source) === "v2-required" || policy === "v2-required") return createPresignedHeader(void 0, source.documentType, protocolVersionsFor("v2-required", base));
+	const header = createPresignedHeader(id, source.documentType);
+	if (source.protocolVersions) header.protocolVersions = { ...source.protocolVersions };
+	return header;
+}
+/** Whether a v2-required `header` carries the id its params derive. */
+function hasDerivedDocumentId(header) {
+	if (signaturePolicyOf(header) === "legacy" || !header.protocolVersions) return false;
+	try {
+		return deriveDocumentId({
+			documentType: header.documentType,
+			createdAtUtcIso: header.createdAtUtcIso,
+			nonce: header.sig.nonce,
+			protocolVersions: header.protocolVersions
+		}) === header.id;
+	} catch {
+		return false;
+	}
+}
+/**
 * Creates a new, signed header for a document. This will replace the id of the
 * document.
 *
@@ -2830,7 +3031,8 @@ const createSignedHeader = async (unsignedHeader, documentType, signer) => {
 * some are not. See the PHDocumentHeader type for more information.
 */
 const createSignedHeaderForSigner = async (documentType, signer) => {
-	return await createSignedHeader(createPresignedHeader(), documentType, signer);
+	const unsignedHeader = createPresignedHeader();
+	return await createSignedHeader(unsignedHeader, documentType, signer);
 };
 //#endregion
 //#region document-model/documents.ts
@@ -2848,9 +3050,7 @@ function isDocumentAction(action) {
 		"SET_NAME",
 		"SET_PREFERRED_EDITOR",
 		"UNDO",
-		"REDO",
-		"PRUNE",
-		"LOAD_STATE"
+		"REDO"
 	].includes(action.type);
 }
 /**
@@ -2906,12 +3106,16 @@ function createDocumentScopeOperations(header, state) {
 }
 /**
 * Creates a new document. When `documentType` is given the header is stamped
-* with it and the document-scope operations are seeded.
+* with it and the document-scope operations are seeded. Without
+* `protocolVersions` the document is v2-required and takes a derived id; with
+* them it is v2-required only if they say so (see {@link protocolVersionsFor}).
 */
-function baseCreateDocument(createState, initialState, documentType = "") {
+function baseCreateDocument(createState, initialState, documentType = "", protocolVersions) {
 	const state = createState(initialState);
-	const header = createPresignedHeader(generateId(), documentType);
-	header.protocolVersions = { "base-reducer": 2 };
+	const header = createPresignedHeader(void 0, documentType, protocolVersions === void 0 ? protocolVersionsFor("v2-required") : {
+		"base-reducer": 2,
+		...protocolVersions
+	});
 	return {
 		header,
 		state,
@@ -2927,8 +3131,39 @@ function baseCreateDocument(createState, initialState, documentType = "") {
 		clipboard: []
 	};
 }
+/**
+* `document`, not yet created, under a fresh header for `policy`. A legacy
+* header takes `id` when given; a v2-required one ignores `id` and derives its
+* own, so a caller that needs a fixed id must ask for legacy.
+* `protocolVersions` are merged over the document's. Name, slug, branch and
+* meta carry over. A document already under `policy` is returned as is unless
+* a legacy `id` or `protocolVersions` are given.
+*/
+function withSignaturePolicy(document, policy, options = {}) {
+	const id = policy === "legacy" ? options.id : void 0;
+	if (id === void 0 && options.protocolVersions === void 0 && signaturePolicyOf(document.header) === policy) return document;
+	const source = document.header;
+	const header = createPresignedHeader(id, source.documentType, protocolVersionsFor(policy, {
+		...source.protocolVersions,
+		...options.protocolVersions
+	}));
+	header.name = source.name;
+	header.slug = source.slug;
+	header.branch = source.branch;
+	header.meta = source.meta;
+	const operations = document.operations.document ? {
+		...document.operations,
+		document: createDocumentScopeOperations(header, document.state)
+	} : document.operations;
+	return {
+		...document,
+		header,
+		operations
+	};
+}
 function hashDocumentStateForScope(document, scope = "global") {
-	return hashBrowser(stringify(document.state[scope] || ""));
+	const stateString = stringify(document.state[scope] || "");
+	return hashBrowser(stateString);
 }
 function readOnly(value) {
 	return Object.freeze(value);
@@ -3059,7 +3294,7 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 	const backfilledInitialState = backfillAuthState(initialState);
 	let documentState = backfilledInitialState;
 	const operationsToReplay = [];
-	const allScopes = new Set([
+	const allScopes = /* @__PURE__ */ new Set([
 		...Object.keys(operations),
 		"global",
 		"local"
@@ -3117,7 +3352,7 @@ function replayDocument(initialState, operations, reducer, header, dispatch, ski
 		if (operation.hash !== hashDocumentStateForScope(result, scope)) throw new HashMismatchError(scope, result, operation);
 		else break;
 	}
-	const allResultScopes = new Set([
+	const allResultScopes = /* @__PURE__ */ new Set([
 		...Object.keys(result.operations),
 		...Object.keys(operations),
 		"global",
@@ -3180,8 +3415,8 @@ function checkCleanedOperationsIntegrity(sortedOperations) {
 				index: nextOperation.index,
 				skip: nextOperation.skip
 			},
-			issue: IntegrityIssueType.UNEXPECTED_INDEX,
-			category: nextIndex > currentIndex + 1 ? IntegrityIssueSubType.MISSING_INDEX : IntegrityIssueSubType.DUPLICATED_INDEX,
+			issue: "UNEXPECTED_INDEX",
+			category: nextIndex > currentIndex + 1 ? "MISSING_INDEX" : "DUPLICATED_INDEX",
 			message: `Expected index ${currentIndex + 1} with skip 0 or equivalent, got index ${nextOperation.index} with skip ${nextOperation.skip}`
 		});
 		currentIndex = nextOperation.index;
@@ -3291,12 +3526,14 @@ function attachBranch(trunk, newBranch) {
 			nextTrunkOperation = trunkCopy.shift();
 		}
 		if (!nextTrunkOperation) enteredBranch = true;
-		else if (!enteredBranch) if (operationsAreEqual(nextTrunkOperation, newOperationCandidate)) {
-			newOperations.shift();
-			result.push(nextTrunkOperation);
-		} else {
-			trunkCopy.unshift(nextTrunkOperation);
-			enteredBranch = true;
+		else if (!enteredBranch) {
+			if (operationsAreEqual(nextTrunkOperation, newOperationCandidate)) {
+				newOperations.shift();
+				result.push(nextTrunkOperation);
+			} else {
+				trunkCopy.unshift(nextTrunkOperation);
+				enteredBranch = true;
+			}
 		}
 		if (enteredBranch) {
 			let nextAppend = newOperations.shift();
@@ -3327,13 +3564,14 @@ function split(sortedTargetOperations, sortedMergeOperations) {
 	for (let i = 0; i < maxLength; i++) {
 		const targetOperation = sortedTargetOperations[i];
 		const mergeOperation = sortedMergeOperations[i];
-		if (targetOperation && mergeOperation) if (!splitHappened && operationsAreEqual(targetOperation, mergeOperation)) commonOperations.push(targetOperation);
-		else {
-			splitHappened = true;
-			targetDiffOperations.push(targetOperation);
-			mergeDiffOperations.push(mergeOperation);
-		}
-		else if (targetOperation) targetDiffOperations.push(targetOperation);
+		if (targetOperation && mergeOperation) {
+			if (!splitHappened && operationsAreEqual(targetOperation, mergeOperation)) commonOperations.push(targetOperation);
+			else {
+				splitHappened = true;
+				targetDiffOperations.push(targetOperation);
+				mergeDiffOperations.push(mergeOperation);
+			}
+		} else if (targetOperation) targetDiffOperations.push(targetOperation);
 		else if (mergeOperation) mergeDiffOperations.push(mergeOperation);
 	}
 	return [
@@ -3385,14 +3623,14 @@ function prepareOperations(operationsHistory, newOperations) {
 	const sortedOperationsHistory = sortOperations(operationsHistory);
 	const sortedOperations = sortOperations(newOperations);
 	const integrityErrors = checkCleanedOperationsIntegrity([...sortedOperationsHistory, ...sortedOperations]);
-	const firstMissingIndexOperation = [...integrityErrors.filter((integrityIssue) => integrityIssue.category === IntegrityIssueSubType.MISSING_INDEX)].sort((a, b) => b.operation.index - a.operation.index).pop()?.operation;
+	const firstMissingIndexOperation = [...integrityErrors.filter((integrityIssue) => integrityIssue.category === "MISSING_INDEX")].sort((a, b) => b.operation.index - a.operation.index).pop()?.operation;
 	for (const newOperation of sortedOperations) {
 		if (firstMissingIndexOperation && newOperation.index >= firstMissingIndexOperation.index) {
 			result.invalidOperations.push(newOperation);
 			continue;
 		}
 		if (integrityErrors.some((integrityError) => {
-			return integrityError.operation.index === newOperation.index && integrityError.operation.skip === newOperation.skip && integrityError.category === IntegrityIssueSubType.DUPLICATED_INDEX;
+			return integrityError.operation.index === newOperation.index && integrityError.operation.skip === newOperation.skip && integrityError.category === "DUPLICATED_INDEX";
 		})) {
 			result.duplicatedOperations.push(newOperation);
 			continue;
@@ -3621,18 +3859,6 @@ function redoOperation(document, action, skip) {
 		});
 	});
 }
-function loadStateOperation(document, action) {
-	const loaded = backfillAuthState(action.state.data);
-	loaded.auth = resolveSnapshotAuth(document.header.id, document.header.documentType, backfillAuthState({ ...document.state }).auth, loaded.auth);
-	return {
-		...document,
-		header: {
-			...document.header,
-			name: action.state.name
-		},
-		state: loaded
-	};
-}
 /**
 * Reads an operation's outcome. A denial takes precedence over a reducer
 * error, since a denied operation never reaches its reducer.
@@ -3665,15 +3891,12 @@ function replayOperations(initialState, clearedOperations, stateReducer, header,
 * @returns The updated document state.
 */
 function updateOperationsForAction(document, action, reuseLastOperationIndex, skip, context) {
-	if ([
-		"UNDO",
-		"REDO",
-		"PRUNE"
-	].includes(action.type)) return document;
+	if (["UNDO", "REDO"].includes(action.type)) return document;
 	const scope = action.scope;
 	const existing = document.operations[scope];
 	const lastOperationIndex = existing?.at(-1)?.index ?? -1;
-	const newOperation = operationFromAction(action, reuseLastOperationIndex ? lastOperationIndex : lastOperationIndex + 1, skip, context);
+	const index = reuseLastOperationIndex ? lastOperationIndex : lastOperationIndex + 1;
+	const newOperation = operationFromAction(action, index, skip, context);
 	const operations = [...existing ?? [], newOperation];
 	return {
 		...document,
@@ -3717,20 +3940,17 @@ function updateDocument(document, action, reuseLastOperationIndex, skip, context
 	return newDocument;
 }
 /**
-* The base document reducer function that wraps a custom reducer function.
+* The base document reducer function.
 *
 * @param state The current state of the document.
 * @param action The action being applied to the document.
-* @param wrappedReducer The custom reducer function being wrapped by the base reducer.
 * @returns The updated document state.
 */
-function _baseReducer(document, action, wrappedReducer) {
+function _baseReducer(document, action) {
 	const parsedAction = DocumentActionSchema().parse(action);
 	switch (parsedAction.type) {
 		case "SET_NAME": return setNameOperation(document, parsedAction.input);
 		case "SET_PREFERRED_EDITOR": return setPreferredEditorOperation(document, parsedAction.input);
-		case "PRUNE": return pruneOperation(document, parsedAction.input, wrappedReducer);
-		case "LOAD_STATE": return loadStateOperation(document, parsedAction.input);
 		default: return document;
 	}
 }
@@ -3808,7 +4028,7 @@ function processUndoOperation(document, scope, customReducer, reuseOperationResu
 }
 /**
 * Base document reducer that wraps a custom document reducer and handles
-* document-level actions such as undo, redo, prune, and set name.
+* document-level actions such as undo, redo, and set name.
 *
 * @template TGlobalState - The type of the state of the custom reducer.
 * @template TAction - The type of the actions of the custom reducer.
@@ -3836,7 +4056,7 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 		...newDocument,
 		clipboard: []
 	};
-	if (isDocumentAction(_action)) newDocument = _baseReducer(newDocument, _action, customReducer);
+	if (isDocumentAction(_action)) newDocument = _baseReducer(newDocument, _action);
 	const operationContext = {
 		documentId: document.header.id,
 		scope: _action.scope,
@@ -3899,11 +4119,7 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 			}
 		}
 	});
-	if ([
-		"UNDO",
-		"REDO",
-		"PRUNE"
-	].includes(_action.type)) return newDocument;
+	if (["UNDO", "REDO"].includes(_action.type)) return newDocument;
 	const scope = _action.scope || "global";
 	const replayHash = options.replayOptions?.operation.hash;
 	const hash = replayHash ? replayHash : hashDocumentStateForScope(newDocument, scope);
@@ -3923,7 +4139,6 @@ function baseReducer(document, action, customReducer, dispatch, options = {}) {
 *   - `SET_NAME`
 *   - `UNDO`
 *   - `REDO`
-*   - `PRUNE`
 *
 * It also updates the document-related attributes on every operation.
 *
@@ -3938,46 +4153,6 @@ function createReducer(stateReducer, documentReducer = baseReducer) {
 	};
 	return reducer;
 }
-function pruneOperation(document, input, wrappedReducer) {
-	const operations = document.operations.global;
-	if (!operations) throw new Error("No global operations found");
-	let { start, end } = input;
-	start = start || 0;
-	end = end || operations.length;
-	const actionsToPrune = operations.slice(start, end);
-	const actionsToKeepStart = operations.slice(0, start);
-	const actionsToKeepEnd = operations.slice(end);
-	const newDocument = replayOperations(document.initialState, {
-		...document.operations,
-		global: actionsToKeepStart.concat(actionsToPrune)
-	}, wrappedReducer, document.header);
-	const newState = newDocument.state;
-	const name = newDocument.header.name;
-	const loadStateIndex = actionsToKeepStart.length;
-	const loadStateTimestamp = actionsToKeepStart.length ? actionsToKeepStart[actionsToKeepStart.length - 1].timestampUtcMs : actionsToKeepEnd.length ? actionsToKeepEnd[0].timestampUtcMs : (/* @__PURE__ */ new Date()).toISOString();
-	const action = loadState({
-		name,
-		...newState
-	}, actionsToPrune.length);
-	return replayOperations(document.initialState, {
-		...document.operations,
-		global: [
-			...actionsToKeepStart,
-			{
-				skip: 0,
-				...action,
-				action,
-				timestampUtcMs: loadStateTimestamp,
-				index: loadStateIndex,
-				hash: hashDocumentStateForScope({ state: newState }, "global")
-			},
-			...actionsToKeepEnd.map((action, index) => ({
-				...action,
-				index: loadStateIndex + index + 1
-			}))
-		]
-	}, wrappedReducer, document.header);
-}
 //#endregion
 //#region document-model/validation.ts
 /**
@@ -3987,8 +4162,6 @@ function pruneOperation(document, input, wrappedReducer) {
 const RESERVED_OPERATION_NAMES = [
 	"UNDO",
 	"REDO",
-	"PRUNE",
-	"LOAD_STATE",
 	"SET_NAME",
 	"SET_PREFERRED_EDITOR",
 	"NOOP"
@@ -4227,6 +4400,15 @@ function orderBy(items, order) {
 		return (rank.get(a.item.id) ?? Number.MAX_SAFE_INTEGER) - (rank.get(b.item.id) ?? Number.MAX_SAFE_INTEGER) || a.index - b.index;
 	}).map(({ item }) => item);
 }
+/**
+* The untouched base of a mutative draft, or the value itself when it is not a
+* draft. Build replacement lists from it and freeze them before assigning, as
+* the drive node reducer does, so finalize skips the walk over the assigned
+* list. Read before writing: the base does not see this action's mutations.
+*/
+function readBase(value) {
+	return isDraft(value) ? original(value) : value;
+}
 const documentModelHeaderReducer = {
 	setModelNameOperation(state, action) {
 		state.name = action.input.name;
@@ -4276,7 +4458,8 @@ const documentModelModuleReducer = {
 	deleteModuleOperation(state, action) {
 		findModuleOrThrow(state, action.input.id);
 		const latestSpec = state.specifications[state.specifications.length - 1];
-		latestSpec.modules = latestSpec.modules.filter((m) => m.id != action.input.id);
+		const modules = readBase(latestSpec).modules.filter((m) => m.id != action.input.id);
+		latestSpec.modules = Object.freeze(modules);
 	},
 	reorderModulesOperation(state, action) {
 		const latestSpec = state.specifications[state.specifications.length - 1];
@@ -4394,14 +4577,20 @@ const documentModelOperationReducer = {
 		const matches = latestSpec.modules.flatMap((mod) => mod.operations.filter((op) => op.id === action.input.operationId));
 		if (matches.length === 0) throw new Error(`Operation "${action.input.operationId}" not found in the latest specification`);
 		if (matches.length > 1) throw new Error(`Operation "${action.input.operationId}" is duplicated in the latest specification`);
-		const moved = matches[0];
-		for (const mod of latestSpec.modules) mod.operations = mod.operations.filter((op) => op.id !== action.input.operationId);
-		targetModule.operations.push(moved);
+		const moved = readBase(matches[0]);
+		for (const mod of latestSpec.modules) {
+			const operations = readBase(mod).operations.filter((op) => op.id !== action.input.operationId);
+			if (mod === targetModule) operations.push(moved);
+			mod.operations = Object.freeze(operations);
+		}
 	},
 	deleteOperationOperation(state, action) {
 		findOperationOrThrow(state, action.input.id);
 		const latestSpec = state.specifications[state.specifications.length - 1];
-		for (const mod of latestSpec.modules) mod.operations = mod.operations.filter((operation) => operation.id != action.input.id);
+		for (const mod of latestSpec.modules) {
+			const operations = readBase(mod).operations.filter((operation) => operation.id != action.input.id);
+			mod.operations = Object.freeze(operations);
+		}
 	},
 	reorderModuleOperationsOperation(state, action) {
 		const targetModule = findModuleOrThrow(state, action.input.moduleId);
@@ -4439,7 +4628,8 @@ const documentModelStateSchemaReducer = {
 		if (!Object.keys(latestSpec.state).includes(action.input.scope)) throw new Error(`Invalid scope: ${action.input.scope}`);
 		const scopeState = latestSpec.state[action.input.scope];
 		if (!scopeState.examples.some((e) => e.id == action.input.id)) throw new Error(`State example "${action.input.id}" not found in scope "${action.input.scope}"`);
-		scopeState.examples = scopeState.examples.filter((e) => e.id != action.input.id);
+		const examples = readBase(scopeState).examples.filter((e) => e.id != action.input.id);
+		scopeState.examples = Object.freeze(examples);
 	},
 	reorderStateExamplesOperation(state, action) {
 		const latestSpec = state.specifications[state.specifications.length - 1];
@@ -4709,7 +4899,11 @@ function applyUpgradeDocumentAction(document, action, upgradePath) {
 	const toVersion = action.input.toVersion;
 	if (fromVersion === toVersion && fromVersion > 0) return document;
 	if (fromVersion > toVersion) throw new DowngradeNotSupportedError(document.header.documentType, fromVersion, toVersion);
-	if (upgradePath) for (const transition of upgradePath) document = transition.upgradeReducer(document, action);
+	if (upgradePath) {
+		const protocolVersions = document.header.protocolVersions;
+		for (const transition of upgradePath) document = transition.upgradeReducer(document, action);
+		document = withProtocolVersions(document, protocolVersions);
+	}
 	applyInitialState(document, action);
 	document.state.document = {
 		...document.state.document,
@@ -4717,6 +4911,16 @@ function applyUpgradeDocumentAction(document, action, upgradePath) {
 	};
 	return document;
 }
+/** CREATE_DOCUMENT fixes `protocolVersions`; this puts them back after a reducer. */
+function withProtocolVersions(document, protocolVersions) {
+	const header = { ...document.header };
+	if (protocolVersions === void 0) delete header.protocolVersions;
+	else header.protocolVersions = { ...protocolVersions };
+	return {
+		...document,
+		header
+	};
+}
 /**
 * Applies a DELETE_DOCUMENT action to a document.
 * Marks the document as deleted in the document scope state.
@@ -4842,7 +5046,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 		const curr = boundaries[i]?.[s] ?? 0;
 		if (boundaries[i]) boundaries[i][s] = Math.max(prev, curr);
 	}
-	const allScopes = new Set([
+	const allScopes = /* @__PURE__ */ new Set([
 		...Object.keys(operations),
 		"global",
 		"local"
@@ -4929,7 +5133,7 @@ function replayDocumentVersioned(initialState, operations, config, header, dispa
 			}
 		}
 	}
-	const allResultScopes = new Set([
+	const allResultScopes = /* @__PURE__ */ new Set([
 		...Object.keys(document.operations),
 		...Object.keys(operations),
 		"global",
@@ -5013,22 +5217,22 @@ async function createZip(document) {
 */
 async function createMinimalZip(data) {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const header = {
-		id: data.documentId,
-		sig: {
-			publicKey: {},
-			nonce: ""
-		},
-		documentType: data.documentType,
-		createdAtUtcIso: now,
-		slug: data.name,
-		name: data.name,
-		branch: data.branch,
-		revision: {},
-		lastModifiedAtUtcIso: now
-	};
 	return zipAsync({
-		"header.json": jsonEntry(header),
+		"header.json": jsonEntry({
+			id: data.documentId,
+			sig: {
+				publicKey: {},
+				nonce: ""
+			},
+			documentType: data.documentType,
+			createdAtUtcIso: now,
+			slug: data.name,
+			name: data.name,
+			branch: data.branch,
+			revision: {},
+			lastModifiedAtUtcIso: now,
+			...data.protocolVersions && { protocolVersions: data.protocolVersions }
+		}),
 		"state.json": jsonEntry(data.state),
 		"current-state.json": jsonEntry(data.state),
 		"operations.json": jsonEntry({})
@@ -5052,7 +5256,10 @@ async function parseZipData(data) {
 	if (!files["header.json"]) throw new Error("Document header not found - file format may be outdated");
 	const header = JSON.parse(readEntry(files, "header.json"));
 	if (!files["operations.json"]) throw new Error("Operations history not found");
-	const clearedOperations = garbageCollectDocumentOperations(JSON.parse(readEntry(files, "operations.json")));
+	const operations = JSON.parse(readEntry(files, "operations.json"));
+	const clearedOperations = garbageCollectDocumentOperations(operations);
+	pinProtocolVersionsToCreate(header, operations);
+	backfillBaseReducerVersion(header);
 	const operationsError = validateOperations(clearedOperations);
 	if (operationsError.length) {
 		const errorMessages = operationsError.map((err) => err.message);
@@ -5064,6 +5271,25 @@ async function parseZipData(data) {
 		clearedOperations
 	};
 }
+/** header.json is a snapshot; the stored CREATE_DOCUMENT input wins. */
+function pinProtocolVersionsToCreate(header, operations) {
+	const create = operations.document?.find((operation) => operation.action.type === "CREATE_DOCUMENT");
+	if (!create) return;
+	const input = create.action.input;
+	if (input?.protocolVersions) header.protocolVersions = { ...input.protocolVersions };
+	else if (header.protocolVersions) {
+		const { [SIGNATURE_PROTOCOL]: _dropped, ...rest } = header.protocolVersions;
+		header.protocolVersions = rest;
+	}
+}
+/** A zip with no recorded base-reducer version predates it: replay as v1. */
+function backfillBaseReducerVersion(header) {
+	if (typeof header.protocolVersions?.["base-reducer"] === "number") return;
+	header.protocolVersions = {
+		...header.protocolVersions,
+		"base-reducer": 1
+	};
+}
 async function loadFromZipData(data, reducer, options) {
 	const { initialState, header, clearedOperations } = await parseZipData(data);
 	return {
@@ -5139,6 +5365,157 @@ const getFileBrowser = (file) => {
 	return Promise.resolve().then(() => readFileBrowser(file));
 };
 //#endregion
-export { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, AddChangeLogItemInputSchema, AddModuleInputSchema, AddOperationErrorInputSchema, AddOperationExampleInputSchema, AddOperationInputSchema, AddStateExampleInputSchema, AuthActionNotAllowedError, AuthAdministrationLockoutError, AuthAdministrationMissingError, AuthAlreadyInitializedError, AuthInitializerNotCreatorError, AuthPolicyNotPreservedError, AuthorSchema, BaseDocumentHeaderSchema, BaseDocumentStateSchema, CodeExampleSchema, ConfigEntrySchema, ConfigEntryTypeSchema, DOCUMENT_DELETED_REASON, DeleteChangeLogItemInputSchema, DeleteModuleInputSchema, DeleteOperationErrorInputSchema, DeleteOperationExampleInputSchema, DeleteOperationInputSchema, DeleteStateExampleInputSchema, DocumentActionSchema, DocumentModelGlobalStateSchema, DocumentModelHeaderSchema, DocumentModelInputSchema, DocumentModelPHStateSchema, DocumentModelSchema, DocumentSpecificationSchema, DowngradeNotSupportedError, FileSystemError, GrantNotFoundError, GrantSchema, GroupPrincipalNotAllowedError, HASH_ALGORITHM_SHA1, HASH_ALGORITHM_SHA256, HASH_ALGORITHM_SHA512, HASH_ENCODING_BASE64, HASH_ENCODING_HEX, HashMismatchError, InitializeAuthActionInputSchema, IntegrityIssueSubType, IntegrityIssueType, InvalidActionInputError, InvalidActionInputZodError, InvalidAuthVersionError, InvalidGrantError, LoadStateActionInputSchema, LoadStateActionSchema, LoadStateActionStateInputSchema, Load_StateSchema, MAX_AUTH_GRANTS, MAX_CAPABILITY_OPERATIONS, MAX_CONDITION_DEPTH, MAX_CONDITION_NODES, MAX_SUPPORTED_AUTH_VERSION, ManifestSchema, ModuleSchema, MoveGrantActionInputSchema, MoveOperationInputSchema, OPERATION_NAME_PATTERN, OperationErrorSchema, OperationScopeSchema, OperationSpecificationSchema, PowerhouseModuleSchema, PowerhouseModulesSchema, PruneActionInputSchema, PruneActionSchema, PruneSchema, PublisherSchema, PwaConfigSchema, RESERVED_OPERATION_NAMES, RedoActionInputSchema, RedoActionSchema, RedoSchema, RemoveGrantActionInputSchema, ReorderChangeLogItemsInputSchema, ReorderModuleOperationsInputSchema, ReorderModulesInputSchema, ReorderOperationErrorsInputSchema, ReorderOperationExamplesInputSchema, ReorderStateExamplesInputSchema, ScopeStateSchema, SetAuthorNameInputSchema, SetAuthorWebsiteInputSchema, SetGrantActionInputSchema, SetInitialStateInputSchema, SetModelDescriptionInputSchema, SetModelExtensionInputSchema, SetModelIdInputSchema, SetModelNameInputSchema, SetModuleDescriptionInputSchema, SetModuleNameInputSchema, SetNameActionInputSchema, SetNameActionSchema, SetOperationDescriptionInputSchema, SetOperationErrorCodeInputSchema, SetOperationErrorDescriptionInputSchema, SetOperationErrorNameInputSchema, SetOperationErrorTemplateInputSchema, SetOperationNameInputSchema, SetOperationReducerInputSchema, SetOperationSchemaInputSchema, SetOperationScopeInputSchema, SetOperationTemplateInputSchema, SetPreferredEditorActionInputSchema, SetPreferredEditorActionSchema, SetStateSchemaInputSchema, Set_NameSchema, Set_PreferredEditorSchema, StateSchema, UndoActionInputSchema, UndoActionSchema, UndoSchema, UnsupportedDocumentModelVersionError, UpdateChangeLogItemInputSchema, UpdateOperationExampleInputSchema, UpdateStateExampleInputSchema, ab2hex, actionContext, actionFromAction, actionSigner, actions, addChangeLogItem, addModule, addOperation, addOperationError, addOperationExample, addStateExample, addUndo, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyInitializeAuthAction, applyMoveGrantAction, applyRemoveGrantAction, applySetGrantAction, applyUpgradeDocumentAction, assertAuthAdministrationRetained, assertAuthPreservedOnDuplicate, assertAuthScopeActionAllowed, assertIsDocumentModelDocument, assertIsDocumentModelState, assertModuleIdUnique, assertOperationErrorIdUnique, assertOperationExampleIdUnique, assertOperationIdUnique, assertValidGrant, assertValidGrantUpsert, assertValidInitialGrants, attachBranch, backfillAuthState, base58Decode, base64UrlToBytes, baseActions, baseCreateDocument, baseLoadFromInput, baseLoadFromInputVersioned, baseReducer, baseReducerVersion, baseSaveToFileHandle, buildOperationSignature, buildOperationSignatureMessage, buildOperationSignatureParams, buildSignedAction, checkCleanedOperationsIntegrity, checkOperationsIntegrity, computeUpgradeTransitions, createAction, createAuthState, createBaseState, createDocumentState, createGlobalState, createLocalState, createMinimalZip, createPresignedHeader, createReducer, createSignedHeader, createSignedHeaderForSigner, createState, createVerificationSigner, createZip, decide, defaultAuthState, defaultBaseState, defaultDocumentState, defaultGlobalState, defaultLocalState, defaultPHState, definedNonNullAnySchema, deleteChangeLogItem, deleteModule, deleteOperation, deleteOperationError, deleteOperationExample, deleteStateExample, deriveOperationId, deserializeSignature, diffOperations, documentModelActions, documentModelDocumentType, documentModelFileExtension, documentModelGlobalState, documentModelHeaderReducer, documentModelInitialGlobalState, documentModelInitialLocalState, documentModelLoadFromInput, documentModelModuleReducer, documentModelOperationErrorReducer, documentModelOperationExampleReducer, documentModelOperationReducer, documentModelReducer, documentModelSaveToFileHandle, documentModelStateReducer, documentModelStateSchemaReducer, documentModelVersioningReducer, evaluate, evaluateCondition, evaluateGrantStack, evaluateGrants, fetchFileBrowser, filterDocumentOperationsResultingState, filterDuplicatedOperations, findModuleOrThrow, findOperationErrorOrThrow, findOperationExampleOrThrow, findOperationOrThrow, garbageCollect, garbageCollectDocumentOperations, garbageCollectV2, generateId, generateMock, getAllOperationNames, getDocumentLastModified, getFileBrowser, getUnixTimestamp, grantProblem, groupDocumentType, groupMembershipActionTypes, groupOperationsByScope, hashBrowser, hashDocumentStateForScope, hex2ab, initializeAuth, isAuthAction, isDefinedNonNullAny, isDenied, isDocumentAction, isDocumentCreator, isDocumentModelDocument, isDocumentModelState, isDocumentZip, isNoopOperation, isPlainValue, isReservedOperationName, isUndo, isUndoRedo, isValidOperationNameFormat, loadState, loadStateOperation, mapSkippedOperations, mapSkippedOperationsV2, mentionedGroupIds, merge, moveGrant, moveOperation, nextSkipNumber, noop, normalizeDocumentModelVersion, operationExampleCreators, operationFromAction, operationFromOperation, operationOutcome, operationWithContext, operationsAreEqual, parseBulkArchive, parseResultingState, precedes, prepareOperations, processUndoRedo, prune, pruneOperation, readFileBrowser, readOnly, redo, redoOperation, referencedGroupIds, releaseNewVersion, removeExistingOperations, removeGrant, reorderChangeLogItems, reorderModuleOperations, reorderModules, reorderOperationErrors, reorderOperationExamples, reorderStateExamples, replayDocument, replayDocumentVersioned, replayOperations, reshuffleByTimestamp, reshuffleByTimestampAndIndex, resolveSnapshotAuth, serializeSignature, setAuthorName, setAuthorWebsite, setGrant, setInitialState, setModelDescription, setModelExtension, setModelId, setModelName, setModuleDescription, setModuleName, setName, setNameOperation, setOperationDescription, setOperationErrorCode, setOperationErrorDescription, setOperationErrorName, setOperationErrorTemplate, setOperationName, setOperationReducer, setOperationSchema, setOperationScope, setOperationTemplate, setPreferredEditor, setPreferredEditorOperation, setStateSchema, sign, skipHeaderOperations, sortMappedOperations, sortOperations, split, toTransportAction, undo, undoOperation, undoOperationV2, updateChangeLogItem, updateDocument, updateHeaderRevision, updateOperationExample, updateStateExample, validateHeader, validateInitialState, validateModule, validateModuleOperation, validateModules, validateOperationName, validateOperations, validateStateSchemaName, verify, verifyOperationSignature, writeFileBrowser, zipEntries };
+//#region document-model/peer-agreement.ts
+const PEER_CAPABILITIES = [{
+	kind: "protocol",
+	name: "base-reducer",
+	baseline: [1, 2],
+	supported: () => [1, 2],
+	preferred: () => 2,
+	optional: false
+}, {
+	kind: "protocol",
+	name: "signature",
+	baseline: [2],
+	supported: () => [2],
+	optional: true
+}];
+/** `base` plus `extra`; an extra replaces a base entry of the same name. */
+function mergePeerCapabilities(base, extra) {
+	const key = (capability) => `${capability.kind}:${capability.name}`;
+	const replaced = new Set(extra.map(key));
+	return [...base.filter((capability) => !replaced.has(key(capability))), ...extra];
+}
+const PEER_MANIFEST_FORMAT = 1;
+function versionSet(values) {
+	return [...new Set(values)].sort((a, b) => a - b);
+}
+function supportsFrom(capabilities, values) {
+	const supports = {
+		protocols: {},
+		features: {}
+	};
+	for (const capability of capabilities) {
+		const target = capability.kind === "protocol" ? supports.protocols : supports.features;
+		target[capability.name] = versionSet(values(capability));
+	}
+	return supports;
+}
+/** What this reactor supports, for every capability it registers. */
+function localSupports(capabilities, flags) {
+	return supportsFrom(capabilities, (capability) => capability.supported(flags));
+}
+/** What a peer that announces nothing supports. */
+function legacySupports(capabilities) {
+	return supportsFrom(capabilities, (capability) => capability.baseline);
+}
+function manifestRevision(supports, sequence = 0) {
+	const preimage = canonicalJson({
+		protocols: supports.protocols,
+		features: supports.features,
+		sequence
+	}, "peer manifest");
+	return bytesToBase64Url(sha256(new TextEncoder().encode(preimage)));
+}
+function localPeerManifest(capabilities, flags, appKey, sequence = 0) {
+	const supports = localSupports(capabilities, flags);
+	return {
+		format: 1,
+		...appKey !== void 0 ? { appKey } : {},
+		sequence,
+		revision: manifestRevision(supports, sequence),
+		protocols: supports.protocols,
+		features: supports.features
+	};
+}
+/** A manifest sent before the one already held; silence carries no sequence. */
+function isOlderManifest(next, held) {
+	return next !== null && held != null && next.sequence < held.sequence;
+}
+/** A peer's manifest, or the baselines for a peer that announced none. */
+function peerSupports(manifest, capabilities) {
+	return manifest ?? legacySupports(capabilities);
+}
+function readVersionMap(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+	const map = {};
+	for (const [name, versions] of Object.entries(value)) {
+		if (!Array.isArray(versions) || !versions.every((v) => Number.isInteger(v))) return;
+		map[name] = versionSet(versions);
+	}
+	return map;
+}
+/**
+* A manifest as received from a peer, or null when it is not one. Formats only
+* add fields, so one of an unknown format is read as its two maps.
+*/
+function readPeerManifest(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const raw = value;
+	const protocols = readVersionMap(raw.protocols);
+	const features = readVersionMap(raw.features ?? {});
+	if (!protocols || !features) return null;
+	const sequence = Number.isSafeInteger(raw.sequence) ? raw.sequence : 0;
+	return {
+		format: 1,
+		...typeof raw.appKey === "string" ? { appKey: raw.appKey } : {},
+		sequence,
+		revision: typeof raw.revision === "string" ? raw.revision : manifestRevision({
+			protocols,
+			features
+		}, sequence),
+		protocols,
+		features
+	};
+}
+/** Only keys this reactor registers are judged; an absent key agrees. */
+function holdReason(peer, versions, capabilities) {
+	for (const capability of capabilities) {
+		if (capability.kind !== "protocol") continue;
+		const version = versions[capability.name];
+		if (version === void 0) continue;
+		const supported = peer.protocols[capability.name] ?? [];
+		if (!supported.includes(version)) return {
+			protocol: capability.name,
+			version,
+			peerSupports: supported
+		};
+	}
+}
+/** Whether a peer runs every version this reactor does, so nothing is held. */
+function coversLocal(peer, local, capabilities) {
+	for (const capability of capabilities) {
+		if (capability.kind !== "protocol") continue;
+		const theirs = peer.protocols[capability.name] ?? [];
+		if (!(local.protocols[capability.name] ?? []).every((version) => theirs.includes(version))) return false;
+	}
+	return true;
+}
+/**
+* protocolVersions for a new document: per negotiated protocol, the highest
+* version up to the local preference that every member supports, else the
+* lowest local one. `requested` wins over what is selected.
+*/
+function selectProtocolVersions(input) {
+	const members = [...input.members];
+	const selected = {};
+	for (const capability of input.capabilities) {
+		if (capability.kind !== "protocol" || !capability.preferred) continue;
+		const preferred = capability.preferred(input.flags);
+		const supported = capability.supported(input.flags);
+		let agreed = supported.filter((version) => version <= preferred);
+		for (const member of members) {
+			const theirs = member.protocols[capability.name] ?? [];
+			agreed = agreed.filter((version) => theirs.includes(version));
+		}
+		selected[capability.name] = agreed.length > 0 ? Math.max(...agreed) : Math.min(...supported);
+	}
+	return {
+		...selected,
+		...input.requested
+	};
+}
+//#endregion
+export { ACTION_SIGNATURE_V2_PREFIX, AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, AddChangeLogItemInputSchema, AddModuleInputSchema, AddOperationErrorInputSchema, AddOperationExampleInputSchema, AddOperationInputSchema, AddStateExampleInputSchema, AuthActionNotAllowedError, AuthAdministrationLockoutError, AuthAdministrationMissingError, AuthAlreadyInitializedError, AuthInitializerNotCreatorError, AuthPolicyNotPreservedError, AuthorSchema, BaseDocumentHeaderSchema, BaseDocumentStateSchema, CanonicalJsonError, CodeExampleSchema, ConfigEntrySchema, ConfigEntryTypeSchema, DEFAULT_SIGNATURE_POLICY, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DeleteChangeLogItemInputSchema, DeleteModuleInputSchema, DeleteOperationErrorInputSchema, DeleteOperationExampleInputSchema, DeleteOperationInputSchema, DeleteStateExampleInputSchema, DocumentActionSchema, DocumentModelGlobalStateSchema, DocumentModelHeaderSchema, DocumentModelInputSchema, DocumentModelPHStateSchema, DocumentModelSchema, DocumentSpecificationSchema, DowngradeNotSupportedError, FileSystemError, GrantNotFoundError, GrantSchema, GroupPrincipalNotAllowedError, HASH_ALGORITHM_SHA1, HASH_ALGORITHM_SHA256, HASH_ALGORITHM_SHA512, HASH_ENCODING_BASE64, HASH_ENCODING_HEX, HashMismatchError, InitializeAuthActionInputSchema, IntegrityIssueSubType, IntegrityIssueType, InvalidActionInputError, InvalidActionInputZodError, InvalidAuthVersionError, InvalidGrantError, MAX_AUTH_GRANTS, MAX_CAPABILITY_OPERATIONS, MAX_CONDITION_DEPTH, MAX_CONDITION_NODES, MAX_SUPPORTED_AUTH_VERSION, ManifestSchema, ModuleSchema, MoveGrantActionInputSchema, MoveOperationInputSchema, OPERATION_NAME_PATTERN, OperationErrorSchema, OperationScopeSchema, OperationSpecificationSchema, PEER_CAPABILITIES, PEER_MANIFEST_FORMAT, PieceModuleSchema, PieceModulesSchema, PowerhouseModuleSchema, PowerhouseModulesSchema, PublisherSchema, PwaConfigSchema, RESERVED_OPERATION_NAMES, RedoActionInputSchema, RedoActionSchema, RedoSchema, RemoveGrantActionInputSchema, ReorderChangeLogItemsInputSchema, ReorderModuleOperationsInputSchema, ReorderModulesInputSchema, ReorderOperationErrorsInputSchema, ReorderOperationExamplesInputSchema, ReorderStateExamplesInputSchema, SIGNATURE_PROTOCOL, SIGNATURE_PROTOCOL_V2, ScopeStateSchema, SetAuthorNameInputSchema, SetAuthorWebsiteInputSchema, SetGrantActionInputSchema, SetInitialStateInputSchema, SetModelDescriptionInputSchema, SetModelExtensionInputSchema, SetModelIdInputSchema, SetModelNameInputSchema, SetModuleDescriptionInputSchema, SetModuleNameInputSchema, SetNameActionInputSchema, SetNameActionSchema, SetOperationDescriptionInputSchema, SetOperationErrorCodeInputSchema, SetOperationErrorDescriptionInputSchema, SetOperationErrorNameInputSchema, SetOperationErrorTemplateInputSchema, SetOperationNameInputSchema, SetOperationReducerInputSchema, SetOperationSchemaInputSchema, SetOperationScopeInputSchema, SetOperationTemplateInputSchema, SetPreferredEditorActionInputSchema, SetPreferredEditorActionSchema, SetStateSchemaInputSchema, Set_NameSchema, Set_PreferredEditorSchema, StateSchema, UndoActionInputSchema, UndoActionSchema, UndoSchema, UnsupportedDocumentModelVersionError, UpdateChangeLogItemInputSchema, UpdateOperationExampleInputSchema, UpdateStateExampleInputSchema, ab2hex, actionContext, actionFromAction, actionPreimageV2, actionSigner, actionSignerIdentity, actionSigningTarget, actions, addChangeLogItem, addModule, addOperation, addOperationError, addOperationExample, addStateExample, addUndo, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyInitializeAuthAction, applyMoveGrantAction, applyRemoveGrantAction, applySetGrantAction, applyUpgradeDocumentAction, assertAuthAdministrationRetained, assertAuthPreservedOnDuplicate, assertAuthScopeActionAllowed, assertIsDocumentModelDocument, assertIsDocumentModelState, assertModuleIdUnique, assertOperationErrorIdUnique, assertOperationExampleIdUnique, assertOperationIdUnique, assertValidGrant, assertValidGrantUpsert, assertValidInitialGrants, attachBranch, backfillAuthState, base58Decode, base64UrlToBytes, baseActions, baseCreateDocument, baseLoadFromInput, baseLoadFromInputVersioned, baseReducer, baseReducerVersion, baseSaveToFileHandle, buildOperationSignature, buildOperationSignatureMessage, buildOperationSignatureParams, buildSignedAction, bytesToBase64Url, canonicalJson, checkCleanedOperationsIntegrity, checkOperationsIntegrity, computeUpgradeTransitions, coversLocal, createAction, createAuthState, createBaseState, createCopyHeader, createDocumentState, createGlobalState, createLocalState, createMinimalZip, createPresignedHeader, createReducer, createSignedHeader, createSignedHeaderForSigner, createState, createVerificationSigner, createZip, decide, defaultAuthState, defaultBaseState, defaultDocumentState, defaultGlobalState, defaultLocalState, defaultPHState, definedNonNullAnySchema, deleteChangeLogItem, deleteModule, deleteOperation, deleteOperationError, deleteOperationExample, deleteStateExample, deriveDocumentId, deriveOperationId, deserializeSignature, diffOperations, documentModelActions, documentModelDocumentType, documentModelFileExtension, documentModelGlobalState, documentModelHeaderReducer, documentModelInitialGlobalState, documentModelInitialLocalState, documentModelLoadFromInput, documentModelModuleReducer, documentModelOperationErrorReducer, documentModelOperationExampleReducer, documentModelOperationReducer, documentModelReducer, documentModelSaveToFileHandle, documentModelStateReducer, documentModelStateSchemaReducer, documentModelVersioningReducer, evaluate, evaluateCondition, evaluateGrantStack, evaluateGrants, fetchFileBrowser, filterDocumentOperationsResultingState, filterDuplicatedOperations, findModuleOrThrow, findOperationErrorOrThrow, findOperationExampleOrThrow, findOperationOrThrow, garbageCollect, garbageCollectDocumentOperations, garbageCollectV2, generateId, generateMock, getAllOperationNames, getDocumentLastModified, getFileBrowser, getUnixTimestamp, grantProblem, groupDocumentType, groupMembershipActionTypes, groupOperationsByScope, hasDerivedDocumentId, hashActionV2, hashBrowser, hashDocumentStateForScope, hex2ab, holdReason, initializeAuth, isAuthAction, isDefinedNonNullAny, isDenied, isDerivedDocumentId, isDocumentAction, isDocumentCreator, isDocumentModelDocument, isDocumentModelState, isDocumentZip, isNoopOperation, isOlderManifest, isPlainValue, isReservedOperationName, isSignaturePolicy, isUndo, isUndoRedo, isV2ActionHash, isValidOperationNameFormat, legacySupports, localPeerManifest, localSupports, manifestRevision, mapSkippedOperations, mapSkippedOperationsV2, mentionedGroupIds, merge, mergePeerCapabilities, moveGrant, moveOperation, nextSkipNumber, noop, normalizeDocumentModelVersion, operationExampleCreators, operationFromAction, operationFromOperation, operationOutcome, operationWithContext, operationsAreEqual, parseBulkArchive, parseResultingState, peerSupports, precedes, prepareOperations, processUndoRedo, protocolVersionsFor, readFileBrowser, readOnly, readPeerManifest, redo, redoOperation, referencedGroupIds, releaseNewVersion, removeExistingOperations, removeGrant, reorderChangeLogItems, reorderModuleOperations, reorderModules, reorderOperationErrors, reorderOperationExamples, reorderStateExamples, replayDocument, replayDocumentVersioned, replayOperations, requestedSignaturePolicy, reshuffleByTimestamp, reshuffleByTimestampAndIndex, resolveSnapshotAuth, selectProtocolVersions, serializeSignature, setAuthorName, setAuthorWebsite, setGrant, setInitialState, setModelDescription, setModelExtension, setModelId, setModelName, setModuleDescription, setModuleName, setName, setNameOperation, setOperationDescription, setOperationErrorCode, setOperationErrorDescription, setOperationErrorName, setOperationErrorTemplate, setOperationName, setOperationReducer, setOperationSchema, setOperationScope, setOperationTemplate, setPreferredEditor, setPreferredEditorOperation, setStateSchema, sign, signActionV2, signaturePolicyOf, skipHeaderOperations, sortMappedOperations, sortOperations, split, targetDocumentId, toTransportAction, undo, undoOperation, undoOperationV2, updateChangeLogItem, updateDocument, updateHeaderRevision, updateOperationExample, updateStateExample, v2RequiredProtocolVersions, v2TupleProblem, validateHeader, validateInitialState, validateModule, validateModuleOperation, validateModules, validateOperationName, validateOperations, validateStateSchemaName, verify, verifyOperationSignature, withProtocolVersions, withSignaturePolicy, writeFileBrowser, zipEntries };
 
 //# sourceMappingURL=index.js.map