@voithos-labs/aragonite 0.10.1

package/dist/invariants/marker-css-parity.js

@@ -0,0 +1,87 @@
+/**
+ * CSS↔TS parity for the hidden-run predicate: `cursor/widget-offset.ts` mirrors the
+ * stylesheet's class scoping structurally, because a getComputedStyle per keystroke is
+ * unaffordable — so the two can drift. This probe pays for the comparison once per mode
+ * change, per marker family, over three answers: the stylesheet's, the walk's, and the
+ * node-space model both are stated over. It declines wherever no stylesheet demonstrably hides
+ * anything (jsdom, source mode); the presentation e2e battery is the real assertion there.
+ */
+import { familyHidesText, markerFamilyOf } from '../core/inline/visibility';
+import { CONTENT_EMPTY_ATTR, isHiddenMarkerRoot, screenVisibilityOf } from '../cursor/widget-offset';
+/** One case per stylesheet arm the predicate mirrors, both host-focus states. */
+const CASES = ['md-marker', 'md-fence-line', 'md-ref-label'].flatMap((family) => [
+    { name: family, family, focusedHost: false },
+    { name: `${family} (focused host)`, family, focusedHost: true },
+    { name: `${family} (content-empty block)`, family, focusedHost: false, contentEmpty: true },
+    ...(family === 'md-marker'
+        ? [
+            {
+                name: 'stamped construct marker (focused host)',
+                family,
+                focusedHost: true,
+                attrs: { 'data-construct-start': '' }
+            },
+            {
+                name: 'revealed construct marker (focused host)',
+                family,
+                focusedHost: true,
+                attrs: { 'data-construct-start': '' },
+                reveal: true
+            }
+        ]
+        : [])
+]);
+export function checkMarkerCssParity(editorRoot) {
+    const probes = CASES.map((probe) => mountProbe(editorRoot, probe));
+    try {
+        const read = probes.map(({ probe, span, block }) => ({
+            name: probe.name,
+            predicate: isHiddenMarkerRoot(span, block),
+            // The model claims the families and the chrome fold; the REVEAL arms are the walk's
+            // alone, so a focused host is where the two are allowed to differ.
+            model: probe.focusedHost ? null : modelHides(span, screenVisibilityOf(block)),
+            css: getComputedStyle(span).display === 'none'
+        }));
+        // No case computes hidden: either source mode (nothing hides by design) or an engine
+        // that applies no stylesheet — no signal to compare against, so the probe stands down.
+        if (!read.some((entry) => entry.css))
+            return null;
+        const diverged = read.find((entry) => entry.predicate !== entry.css || (entry.model !== null && entry.model !== entry.css));
+        if (!diverged)
+            return null;
+        return {
+            code: 'marker-css-parity',
+            message: `the hidden-run answers disagree about "${diverged.name}" — the families in core/inline/visibility.ts, the walk in cursor/widget-offset.ts and styles/editor.css moved apart`,
+            detail: read
+        };
+    }
+    finally {
+        for (const { host } of probes)
+            host.remove();
+    }
+}
+function mountProbe(editorRoot, probe) {
+    const host = document.createElement('div');
+    host.className = 'block-host';
+    if (probe.focusedHost)
+        host.setAttribute('data-focused', '');
+    host.setAttribute('aria-hidden', 'true');
+    host.style.position = 'absolute';
+    host.style.left = '-9999px';
+    const block = document.createElement('div');
+    block.setAttribute('contenteditable', 'true');
+    if (probe.contentEmpty)
+        block.setAttribute(CONTENT_EMPTY_ATTR, '');
+    const span = document.createElement('span');
+    span.className = probe.reveal ? `${probe.family} md-construct-reveal` : probe.family;
+    for (const [name, value] of Object.entries(probe.attrs ?? {}))
+        span.setAttribute(name, value);
+    block.appendChild(span);
+    host.appendChild(block);
+    editorRoot.appendChild(host);
+    return { probe, host, block, span };
+}
+function modelHides(span, ctx) {
+    const family = markerFamilyOf(span);
+    return family !== null && familyHidesText(family, ctx);
+}

package/dist/invariants/node-shape.d.ts

@@ -0,0 +1,44 @@
+import { type CstNode } from '../core/nodes';
+import type { NodeView } from '../core/node-views';
+import type { InvariantViolation } from '../assert';
+/**
+ * G1.5 — a node's fields match its kind's category. One-directional: a container may be
+ * transiently childless mid-edit, so illegal fields are forbidden but none are required.
+ * Editor-level fields (`childIds`, `ownerEpoch`) are legal on every kind and unchecked;
+ * `mergeRole` is per-KIND, checked once at registration (G1.30).
+ */
+export declare function checkCategoryFields(node: CstNode): InvariantViolation | null;
+/**
+ * G1.1 — a strip container's `raw` agrees with its `children`:
+ * `strip(raw) === serialize(children)`. Computed by re-parsing `node.raw` and byte-comparing
+ * stripped-inner: canonicalization-proof (a `rebuildRaw` comparison false-fires on any
+ * faithful-but-non-canonical parse) and tolerant of the editor's empty-paragraph
+ * placeholder, whose bytes match the parser's `innerSuffix`. Strip containers only, recursively.
+ */
+export declare function checkStaleRaw(node: CstNode): InvariantViolation | null;
+/**
+ * G1.12 — the same staleness class as G1.1 for opaque containers, compared through the
+ * parse channel because a faithful parse may be non-canonical. When `raw` does not reparse
+ * to exactly one block of this kind, the outcome splits on recognizer existence: with one,
+ * the raw has genuinely drifted and fires; without one it cannot be validated at all, so
+ * it bails.
+ */
+export declare function checkOpaqueStaleRaw(node: CstNode): InvariantViolation | null;
+/**
+ * G1.13 — a plugin-authored `rebuildRaw` is deterministic over the committed state, which
+ * is what G1.12's single reparse trusts. The two probes are compared to each other, never
+ * to `node.raw`, which a faithful non-canonical parse legally differs from.
+ */
+export declare function checkOpaqueRebuildDeterminism(node: CstNode): InvariantViolation | null;
+/**
+ * G1.14 — a container declaring `reservedChrome` always holds a chrome leaf of the
+ * declared kind at child 0. Firing here means an op deleted or downgraded the chrome
+ * instead of clearing it.
+ */
+export declare function checkReservedChromeSlot(node: CstNode): InvariantViolation | null;
+/**
+ * G1.6 — metadata survives the one-level undo clone: every value is a primitive or an
+ * array of primitives. Anything deeper would stay shared by reference with the snapshot
+ * and corrupt undo.
+ */
+export declare function checkCloneSafeMetadata(node: NodeView): InvariantViolation | null;

package/dist/invariants/node-shape.js

@@ -0,0 +1,258 @@
+import { makeBlockNode } from '../core/nodes';
+import { parse } from '../core/parser';
+import { concatChildren } from '../core/serializer';
+import { getBlockKindDescriptor } from '../schema/block-kind-descriptor';
+import { reservedChromeKindOf } from '../schema/reserved-chrome';
+import { listRegisteredOpeners } from '../schema/block-openers';
+import { isDirectiveKind } from '../core/directive/registry';
+// ── G1.5: category ↔ field legality ──────────────────────────────────────────
+/**
+ * G1.5 — a node's fields match its kind's category. One-directional: a container may be
+ * transiently childless mid-edit, so illegal fields are forbidden but none are required.
+ * Editor-level fields (`childIds`, `ownerEpoch`) are legal on every kind and unchecked;
+ * `mergeRole` is per-KIND, checked once at registration (G1.30).
+ */
+export function checkCategoryFields(node) {
+    const d = getBlockKindDescriptor(node.kind);
+    if (!d.isContainer && node.children !== undefined) {
+        return illegalField(node.kind, 'children', 'leaf carries children');
+    }
+    if (!d.isContainer && node.innerPrefix !== undefined) {
+        return illegalField(node.kind, 'innerPrefix', 'leaf carries container structural field');
+    }
+    if (!d.isContainer && node.innerSuffix !== undefined) {
+        return illegalField(node.kind, 'innerSuffix', 'leaf carries container structural field');
+    }
+    // Only a body sitting under a chrome line of the container's own can peel a blank into
+    // `innerPrefix` (`core/parser.parseContainerBody`); elsewhere the body opens on the
+    // container's first line and a filled slot emits a line no parse can produce.
+    if (d.bodyWrap?.afterOpenerLine !== true && node.innerPrefix) {
+        return illegalField(node.kind, 'innerPrefix', 'container declares no opener-line body wrap');
+    }
+    return null;
+}
+function illegalField(kind, field, why) {
+    return {
+        code: 'illegal-fields-for-kind',
+        message: `${kind}: ${why}`,
+        detail: { kind, field }
+    };
+}
+// ── G1.1: container raw not stale ─────────────────────────────────────────────
+/**
+ * G1.1 — a strip container's `raw` agrees with its `children`:
+ * `strip(raw) === serialize(children)`. Computed by re-parsing `node.raw` and byte-comparing
+ * stripped-inner: canonicalization-proof (a `rebuildRaw` comparison false-fires on any
+ * faithful-but-non-canonical parse) and tolerant of the editor's empty-paragraph
+ * placeholder, whose bytes match the parser's `innerSuffix`. Strip containers only, recursively.
+ */
+export function checkStaleRaw(node) {
+    if (getBlockKindDescriptor(node.kind).containerContract !== 'strip')
+        return null;
+    // Document scope because the oracle gets no document position: fragment would fire on
+    // every legitimate position-scoped node at the top.
+    const correspondent = soleCorrespondent(parse(node.raw, { scope: 'document' }).children, node);
+    if (!rawFaithful(correspondent, node)) {
+        return {
+            code: 'stale-container-raw',
+            // `raw` is carried so a violation caught in CI is self-diagnosing without
+            // re-instrumenting; clamped so a large container can't flood the console.
+            message: `${node.kind} raw is stale relative to its children`,
+            detail: { kind: node.kind, raw: clampForDetail(node.raw) }
+        };
+    }
+    return null;
+}
+/**
+ * The one block `node.raw` must reparse to, or undefined. Singularity is the invariant's other
+ * half: bytes belonging to a following sibling leave the first block's inner content intact, so
+ * comparing that block alone would read a container whose raw has grown as faithful. `listItem`
+ * is never a top-level block, so its raw reparses to a wrapping `list` holding it alone.
+ */
+function soleCorrespondent(blocks, node) {
+    if (blocks.length !== 1)
+        return undefined;
+    const top = blocks[0];
+    if (top.kind === node.kind)
+        return top;
+    const wrapped = top.children ?? [];
+    return wrapped.length === 1 && wrapped[0].kind === node.kind ? wrapped[0] : undefined;
+}
+const MAX_RAW_IN_DETAIL = 200;
+function clampForDetail(raw) {
+    return raw.length > MAX_RAW_IN_DETAIL ? raw.slice(0, MAX_RAW_IN_DETAIL) + '…' : raw;
+}
+/**
+ * `strip(node.raw) === serialize(node.children)` at this level, then recurse: the
+ * parent-level byte concat can't see a child whose own raw↔children diverge while its raw
+ * still matches.
+ */
+function rawFaithful(reparsed, node) {
+    if (!reparsed)
+        return false;
+    if (strippedInner(reparsed) !== strippedInner(node))
+        return false;
+    const reparsedContainers = stripContainerChildren(reparsed);
+    const actualContainers = stripContainerChildren(node);
+    if (reparsedContainers.length !== actualContainers.length)
+        return false;
+    for (let i = 0; i < reparsedContainers.length; i++) {
+        if (!rawFaithful(reparsedContainers[i], actualContainers[i]))
+            return false;
+    }
+    return true;
+}
+/** Stripped inner content: `innerPrefix + serialize(children) + innerSuffix`. */
+function strippedInner(node) {
+    return (node.innerPrefix ?? '') + concatChildren(node.children ?? []) + (node.innerSuffix ?? '');
+}
+function stripContainerChildren(node) {
+    return (node.children ?? []).filter((c) => getBlockKindDescriptor(c.kind).containerContract === 'strip');
+}
+// ── G1.12: opaque container raw not stale ─────────────────────────────────────
+/**
+ * G1.12 — the same staleness class as G1.1 for opaque containers, compared through the
+ * parse channel because a faithful parse may be non-canonical. When `raw` does not reparse
+ * to exactly one block of this kind, the outcome splits on recognizer existence: with one,
+ * the raw has genuinely drifted and fires; without one it cannot be validated at all, so
+ * it bails.
+ */
+export function checkOpaqueStaleRaw(node) {
+    if (getBlockKindDescriptor(node.kind).containerContract !== 'opaque')
+        return null;
+    // Document scope for the same reason as G1.1's probe: the node arrives without its
+    // document position, and fragment would fire on a legitimate position-scoped node.
+    const blocks = parse(node.raw, { scope: 'document' }).children;
+    if (blocks.length !== 1 || blocks[0].kind !== node.kind) {
+        if (!hasStandaloneRecognizer(node.kind))
+            return null;
+        return {
+            code: 'opaque-stale-raw',
+            message: `${node.kind} opaque raw no longer reparses to its own kind`,
+            detail: { kind: node.kind, reason: 'reparse-diverges', raw: clampForDetail(node.raw) }
+        };
+    }
+    if (!opaqueRawFaithful(blocks[0], node)) {
+        return {
+            code: 'opaque-stale-raw',
+            message: `${node.kind} opaque raw is stale relative to its children`,
+            detail: { kind: node.kind, raw: clampForDetail(node.raw) }
+        };
+    }
+    return null;
+}
+/**
+ * Can `parse(raw)` reproduce this kind at all? Both registries answer: a kind owns a block
+ * opener, or is a directive whose shared `:::` opener recognizes it. Probing openers alone
+ * would exempt the whole directive tier as unrecognizable.
+ */
+function hasStandaloneRecognizer(kind) {
+    return listRegisteredOpeners().some((o) => o.kind === kind) || isDirectiveKind(kind);
+}
+/**
+ * Chrome-aware faithfulness: a reservedChrome child's bytes live in the container's opener
+ * line, so a reparse mints the chrome before any body trivia while the live tree may
+ * legally hold a transient blank after it. Compare the chrome raw positionally and the
+ * body bytes as a unit; a missing or displaced slot is G1.14's finding, not staleness.
+ */
+function opaqueRawFaithful(reparsed, node) {
+    const chromeKind = reservedChromeKindOf(node.kind);
+    const liveChrome = node.children?.[0];
+    const reparsedChrome = reparsed.children?.[0];
+    if (chromeKind === undefined ||
+        liveChrome?.kind !== chromeKind ||
+        reparsedChrome?.kind !== chromeKind) {
+        return rawFaithful(reparsed, node);
+    }
+    if (liveChrome.raw !== reparsedChrome.raw)
+        return false;
+    // Spreading the union widens `kind`, so re-mint through the construction funnel.
+    return rawFaithful(makeBlockNode({ ...reparsed, children: reparsed.children.slice(1) }), makeBlockNode({ ...node, children: node.children.slice(1) }));
+}
+// ── G1.13: opaque rebuild determinism ─────────────────────────────────────────
+/**
+ * G1.13 — a plugin-authored `rebuildRaw` is deterministic over the committed state, which
+ * is what G1.12's single reparse trusts. The two probes are compared to each other, never
+ * to `node.raw`, which a faithful non-canonical parse legally differs from.
+ */
+export function checkOpaqueRebuildDeterminism(node) {
+    const descriptor = getBlockKindDescriptor(node.kind);
+    if (descriptor.containerContract !== 'opaque' || !descriptor.rebuildRaw)
+        return null;
+    const first = probeRebuild(node, descriptor.rebuildRaw);
+    const second = probeRebuild(node, descriptor.rebuildRaw);
+    if (first === second)
+        return null;
+    return {
+        code: 'opaque-rebuild-nondeterministic',
+        message: `${node.kind} rebuildRaw emitted different bytes over identical committed state`,
+        detail: { kind: node.kind, first: clampForDetail(first), second: clampForDetail(second) }
+    };
+}
+/**
+ * `rebuildRaw` may write only `raw`; the probe isolates that write and copies the children
+ * array and metadata record, shielding the live node from a misbehaving rebuilder. Child
+ * NODES stay shared — defending those would cost a per-commit deep clone.
+ */
+function probeRebuild(node, rebuildRaw) {
+    const probe = { ...node };
+    if (probe.children)
+        probe.children = [...probe.children];
+    if (probe.metadata)
+        probe.metadata = { ...probe.metadata };
+    rebuildRaw(probe);
+    return probe.raw;
+}
+// ── G1.14: reserved-chrome slot ───────────────────────────────────────────────
+/**
+ * G1.14 — a container declaring `reservedChrome` always holds a chrome leaf of the
+ * declared kind at child 0. Firing here means an op deleted or downgraded the chrome
+ * instead of clearing it.
+ */
+export function checkReservedChromeSlot(node) {
+    const chromeKind = reservedChromeKindOf(node.kind);
+    if (chromeKind === undefined)
+        return null;
+    const child0 = node.children?.[0];
+    if (child0?.kind === chromeKind)
+        return null;
+    return {
+        code: 'reserved-chrome-slot',
+        message: `${node.kind}: child 0 must be reserved chrome "${chromeKind}", found "${child0?.kind ?? 'none'}"`,
+        detail: { kind: node.kind, expected: chromeKind, found: child0?.kind ?? null }
+    };
+}
+// ── G1.6: clone-safe metadata ─────────────────────────────────────────────────
+/**
+ * G1.6 — metadata survives the one-level undo clone: every value is a primitive or an
+ * array of primitives. Anything deeper would stay shared by reference with the snapshot
+ * and corrupt undo.
+ */
+export function checkCloneSafeMetadata(node) {
+    if (!node.metadata)
+        return null;
+    for (const [field, value] of Object.entries(node.metadata)) {
+        if (Array.isArray(value)) {
+            if (!value.every(isPrimitive)) {
+                return notCloneSafe(node.kind, field, 'array contains a non-primitive');
+            }
+        }
+        else if (!isPrimitive(value)) {
+            return notCloneSafe(node.kind, field, 'value is a nested object');
+        }
+    }
+    return null;
+}
+function notCloneSafe(kind, field, why) {
+    return {
+        code: 'metadata-not-clone-safe',
+        message: `${kind}.${field}: ${why}`,
+        detail: { kind, field }
+    };
+}
+function isPrimitive(value) {
+    if (value === null)
+        return true;
+    const t = typeof value;
+    return t !== 'object' && t !== 'function';
+}

package/dist/invariants/registry.d.ts

@@ -0,0 +1,126 @@
+import type { AnyBlockKind, AnyInlineKind, BlockKind } from '../core/nodes';
+import type { InvariantViolation } from '../assert';
+/**
+ * G1.2 — every BlockKind resolves to a descriptor, and to a component unless it
+ * renders inside a parent (see `NO_STANDALONE_COMPONENT`). Returns the first gap.
+ */
+export declare function checkRegistryCompleteness(kinds: readonly BlockKind[], hasDescriptor: (kind: BlockKind) => boolean, hasComponent: (kind: BlockKind) => boolean): InvariantViolation | null;
+/**
+ * G1.10 — opener-registry coherence: every registered opener belongs to a registered kind,
+ * and priorities are unique. Equal priorities are deterministic (dispatch falls back to
+ * kind name) but usually unintended, so they still warn.
+ */
+export declare function checkOpenerRegistry(entries: readonly {
+    kind: AnyBlockKind;
+    priority: number;
+}[], hasDescriptor: (kind: AnyBlockKind) => boolean): InvariantViolation | null;
+export interface KeymapCoherenceEntry {
+    kind: AnyBlockKind;
+    keymap?: readonly {
+        chord: string;
+        command: string;
+    }[];
+}
+/**
+ * G1.11 — keymap coherence: every binding uses a well-formed chord naming a known command,
+ * and a kind's chords are unique after normalization. A mistyped `Ctrl+B` collapses to a
+ * bare `B` that fires on every keypress; duplicates make dispatch order
+ * declaration-dependent. Chords are scoped per kind.
+ */
+export declare function checkKeymapCoherence(entries: readonly KeymapCoherenceEntry[], isKnownCommand: (id: string) => boolean, normalizeChord: (chord: string) => string, isChordWellFormed: (chord: string) => boolean): InvariantViolation | null;
+/**
+ * G1.17 — opener registered after the grammar was consumed. Parsed documents never
+ * re-parse, so the new kind silently misses every open document.
+ */
+export declare function checkLateOpenerRegistration(kind: AnyBlockKind, grammarConsumed: boolean): InvariantViolation | null;
+export interface ReservedChromeCoherenceEntry {
+    kind: AnyBlockKind;
+    isContainer: boolean;
+    reservedChromeKind?: AnyBlockKind;
+}
+/**
+ * G1.18 — reservedChrome bootstrap coherence: a declaring kind must be a container, and
+ * its chrome kind must resolve to both a descriptor and a component. Validates the
+ * registration shape at bootstrap, unlike the per-commit slot check (G1.14).
+ */
+export declare function checkReservedChromeCoherence(entries: readonly ReservedChromeCoherenceEntry[], hasDescriptor: (kind: AnyBlockKind) => boolean, hasComponent: (kind: AnyBlockKind) => boolean): InvariantViolation | null;
+type ClosureCellMode = 'implemented' | 'inherit-default' | 'not-supported';
+export interface ClosureCoherenceEntry {
+    kind: AnyBlockKind;
+    notMergeable: boolean;
+    hasContainerContract: boolean;
+    roundTripMode: ClosureCellMode;
+    mergeBackspaceMode: ClosureCellMode;
+    /** The descriptor declares `blockFocus: 'whole-block'`. */
+    declaresWholeBlockFocus: boolean;
+    /** `via` prose of an `implemented` cell; undefined for the other two modes. */
+    focusVia: string | undefined;
+    mergeBackspaceVia: string | undefined;
+    declaresReservedChrome: boolean;
+    clipboardMode: ClosureCellMode;
+}
+/**
+ * G1.24 — closure-block coherence: cross-checks between a kind's closure cells and the
+ * rest of its descriptor that a compiler can't reach. Each violation message below states
+ * its own rule. The fixture-parses-to-kind check runs in the unit sweep instead — a
+ * `parse` import here would close a `schema → core/parser → schema` cycle.
+ */
+export declare function checkClosureCoherence(entries: readonly ClosureCoherenceEntry[]): InvariantViolation | null;
+export interface InlineConstructPolicyEntry {
+    kind: AnyInlineKind;
+    revealable: boolean;
+    autoUnwrapOnEmpty: boolean;
+    splitBehavior: 'close-and-reopen' | 'plain';
+    /** The mark vocabulary, for a kind a format chord addresses. */
+    mark?: {
+        nestingRank: number;
+        command: string;
+    };
+}
+/**
+ * G1.31 — inline-construct policy coherence: a row names a kind the inline vocabulary holds; the
+ * marker-rewriting behaviors belong only to kinds whose markers the reveal can address; no two mark
+ * rows claim one nesting rank or one command; and no plugin row's mark claims a built-in command id.
+ * A mistyped kind is silent, a rewrite on a never-revealed kind edits markers the author cannot see,
+ * and a tied or built-in command leaves which meaning answers to each surface's own lookup order.
+ */
+export declare function checkInlineConstructPolicy(entries: readonly InlineConstructPolicyEntry[], isKnownInlineKind: (kind: AnyInlineKind) => boolean, isBuiltinInlineKind: (kind: AnyInlineKind) => boolean, isBuiltinCommandId: (id: string) => boolean): InvariantViolation | null;
+export interface DescriptorFieldEntry {
+    kind: AnyBlockKind;
+    declaresWholeBlockFocus: boolean;
+    supportsInline: boolean;
+    declaresReservedChrome: boolean;
+    contextDependentKind: boolean;
+    hasOpener: boolean;
+    unwrapLiftsFirstChild: boolean;
+    unwrapKeepsReservedChrome: boolean;
+}
+/**
+ * G1.37 — descriptor-vs-descriptor coherence: field pairs the type can represent and the kind
+ * cannot mean together. Each is silently inert rather than loud, so nothing fails until a
+ * gesture reaches the kind. G1.24 is the sibling over closure cells; this one reads the
+ * declarations alone.
+ */
+export declare function checkDescriptorFieldCoherence(entries: readonly DescriptorFieldEntry[]): InvariantViolation | null;
+export interface ContentStartBackspaceEntry {
+    kind: AnyBlockKind;
+    demotesFirst: boolean;
+    declaresContentRange: boolean;
+}
+/**
+ * G1.32 — a kind demoting on Backspace at its content start declares where that content starts.
+ * Without the hook the content range IS the whole display, so the arm never fires and the
+ * declaration reads as behavior the kind does not have — silent, and only at the keystroke.
+ */
+export declare function checkContentStartBackspace(entries: readonly ContentStartBackspaceEntry[]): InvariantViolation | null;
+export interface MergeRoleEntry {
+    kind: AnyBlockKind;
+    mergeRole: string;
+}
+/**
+ * G1.30 — every registered kind declares a `mergeRole` from the known vocabulary. A
+ * per-KIND fact, validated once at registration: an unknown role makes the merge
+ * dispatcher fall through silently on every gesture that reaches the kind.
+ */
+export declare function checkMergeRoleVocabulary(entries: readonly MergeRoleEntry[], isKnownMergeRole: (role: string) => boolean): InvariantViolation | null;
+export {};