@yahoo/uds-create-config 2.45.0 → 3.0.0

package/dist/framework/Config.d.ts

@@ -0,0 +1,2472 @@
+import { CopyPlan } from "../entities/system/copy-plan.js";
+import { ConfigEdit, ConfigOp } from "./config-op.js";
+import { RebaseResult, StampedPatch } from "./overlay.js";
+import { DeletePlan, Plan, PlanOp, RenamePlan } from "./plan.js";
+import { Entity } from "./Entity.js";
+import { Ref } from "./utils/refs.js";
+import { RefGraph, TraverseOptions } from "./ref-graph.js";
+import { FieldsSchema } from "./utils/field-schema.js";
+import { SubEntityClass } from "./defineSubEntity.js";
+import { LocalOverlay, SourceAnswer, SourceOverlay, SourceResolver, SourceState } from "./sources.js";
+import { AuthoredEntry } from "./utils/group.js";
+import { EntityClass } from "./defineEntity.js";
+import { BreakPlan, LinkPlan, SourceRowState, UnlinkPlan } from "../entities/system/link-plan.js";
+import { InlineOptions } from "./inline-sources.js";
+import { Snapshot } from "./snapshot.js";
+import { EntityKind } from "./registry.js";
+
+//#region src/framework/Config.d.ts
+/**
+ * One source this config recorded — the closure it reaches through a link, as an ordinary artifact.
+ *
+ * Recorded because only a build ever has a source attached, and every reader afterwards wanted the
+ * twelve entities a system uses rather than the four hundred it can see. Stored as a config rather
+ * than as a bag of values so nothing about reading it is special: entity bodies validate against their
+ * own kinds' schemas, group nodes and settings ride along, and `sourceFor` hands back something the
+ * ordinary chase already knows how to walk.
+ */
+interface RecordedSource {
+  /**
+   * What the source resolved to when this was recorded — concrete, and an immutable snapshot. Absent
+   * when nothing resolved it: a config assembled by `registerSources` rather than loaded has attached
+   * sources and no answer about where they came from, which is the same third state
+   * {@link Config.sources} reports.
+   *
+   * `unknown`, because the shape is the source kind's. It is written straight from the `attached`
+   * state's `resolved`, already validated against that kind's own `sourceResolution.resolved` schema at
+   * the resolver seam — so a reader that knows the kind reads it as that kind's type
+   * (`ResolvedSource` for a linked system) and nothing here restates it. Naming
+   * `{ systemId, version }` was the framework naming a kind, and a repo-local source could not fill it
+   * anyway: identity on one is its `configPath`.
+   */
+  readonly resolved?: unknown;
+  /** The reached closure. Recursive by nature: a source is a config. */
+  readonly config: SerializedConfig;
+}
+/**
+ * A config's wire form.
+ *
+ * Declared rather than inferred off `toJSON`. Inference is the nicer shape — a field added to the
+ * writer is in the type for free — and it is not available here: the wire form contains itself
+ * ({@link RecordedSource} holds a `SerializedConfig`), so reading the type off a writer that
+ * references the type is circular and TypeScript answers `any`.
+ *
+ * Most of the guarantee the inference bought is kept by annotating `toJSON` with this type: a required
+ * field declared here and not emitted is a compile error, and a field added to the literal outside a
+ * spread is an excess-property error.
+ *
+ * What is genuinely weaker: an optional field added as a conditional spread
+ * (`...(cond ? { k } : {})`) is not excess-checked, so it can be emitted without being declared here
+ * and nothing complains. Every optional field below arrives that way. There is no type-level fix that
+ * keeps the recursion, so this is the cost of the wire form containing itself — when adding an
+ * optional field to `toJSON`, add it here too.
+ */
+/**
+ * The version of {@link SerializedConfig} this build writes and reads — an alias for
+ * `CURRENT_SCHEMA_VERSION` (`schema-version.ts`), kept under the name the wire-form constructors
+ * across the repo already spell. The version is a mint timestamp and moves with every schema change;
+ * an artifact written under an older one comes up through the registered migration chain on
+ * hydrate, and one written under a newer one is refused with the remedy named.
+ *
+ * An artifact with no version at all is the corpus written before versioning existed — version 1.
+ * The dense-counter `2` a short-lived scheme stamped before the chain existed reads as the mint
+ * that replaced it (see `detectedWireVersion`).
+ */
+declare const SERIALIZED_CONFIG_VERSION = 20260910212453;
+interface SerializedConfig {
+  /** See {@link SERIALIZED_CONFIG_VERSION}. Always written; a stored artifact may lack it. */
+  readonly version: number;
+  /** The config's namespace name — preserved so a round-tripped config keeps its tool prefix. */
+  readonly name?: string;
+  /** The kinds this config owns — preserved so a kind registered without items (an AI sandbox that
+   *  may create the first one) survives the round-trip and still exposes its ops. */
+  readonly ownedKinds: string[];
+  readonly items: Record<string, Record<string, unknown>>;
+  readonly groups: Record<string, Record<string, unknown>>;
+  /** Every source this config reaches into, by slug — see {@link RecordedSource}. Absent when
+   *  nothing is borrowed. */
+  readonly sources?: Record<string, RecordedSource>;
+  /** Self-sourced derived kinds, re-attached (source = the loaded config) on `fromJSON`. An
+   *  externally-sourced one re-attaches via `rederiveFrom`, not through the wire. */
+  readonly derivedKinds?: string[];
+  /** Sparse per-member overrides of a derived kind's fields. The base always re-derives. */
+  readonly overrides?: Record<string, Record<string, Record<string, unknown>>>;
+}
+/**
+ * A stored artifact as read, before this build has checked its version: written under some version or
+ * none, and possibly carrying the `options` slot a pre-version artifact kept its config type's settings
+ * in. What `hydrateFrom` takes in and what a migration's `up` reads and answers.
+ */
+type StoredConfig = Omit<SerializedConfig, 'version' | 'sources'> & {
+  readonly version?: number;
+  readonly options?: unknown; /** The recorded closures, each an artifact of the same age as the one holding it. */
+  readonly sources?: Record<string, {
+    readonly resolved?: unknown;
+    readonly config: StoredConfig;
+  }>;
+};
+/** A CRUD mutation — the patch shape the pipeline speaks. `data` is validated against the
+ *  kind's schema-derived create/update shape. */
+/** An op a tolerant batch left out: where it sat in the batch, and the refusal it got. */
+interface SkippedOp {
+  readonly opIndex: number;
+  readonly message: string;
+}
+type Patch = {
+  kind: string;
+  operation: 'create';
+  path: string;
+  data: unknown;
+}
+/**
+ * A partial over the item body, addressed by field path — `{ 'layers.root.bg': 'hover' }`. The value
+ * replaces whatever the key names and `null` removes it, so one verb writes at every depth
+ * ({@link applyPathDelta}).
+ *
+ * Depth is the caller's to state, which is what makes this one op rather than two. It also composes:
+ * two entries against one target apply in order rather than clobbering, so a batch needs no grouping
+ * by target and no caller does read-merge-write to set a nested value.
+ */
+| {
+  kind: string;
+  operation: 'update';
+  path: string;
+  data: unknown;
+}
+/**
+ * Replace an occupied path's whole stored body — the write a partial can't express.
+ *
+ * `update` is a merge, and on a borrowed item it merges into the envelope by design: `{ value: … }`
+ * over `Token.ref('x@ds').extend({ … })` records a local override, which is what makes an extension
+ * useful and why `update` can never remove one. `create` refuses an occupied path, and
+ * `delete`-then-`create` is refused by any referrer and drops the item to the end of its collection,
+ * because order is key order.
+ *
+ * So dissolving a borrow into a body of this config's own has no other spelling. Writing the snapshot
+ * directly produces no patch, which is invisible to replay: an undo or a rebase re-applies the
+ * flattening `update` onto the envelope it was meant to remove, puts the value back inside `extend`,
+ * then refuses to drop the pin because the extension still references it. Both directions of the
+ * borrow boundary — a `copy` landing on a pointer row, and a pointer written over a local body — are
+ * ordinary recorded edits through this verb.
+ *
+ * It writes in place, so the item keeps its position. `data` is a complete body, the same shape
+ * `create` takes, including the two shorthands: a bare ref lands in the kind's primary field, and an
+ * `{ __ref, extend }` body is stored as an extension.
+ */
+| {
+  kind: string;
+  operation: 'replace';
+  path: string;
+  data: unknown;
+} | {
+  kind: string;
+  operation: 'delete';
+  path: string;
+} | {
+  kind: string;
+  operation: 'rename';
+  path: string;
+  to: string;
+}
+/** A group node's own body (`path` = the group prefix) — its kind's `groupFields` plus the
+ *  universal label/description. Separate from item CRUD because a group isn't an item: it lives in
+ *  its own store, and a folder can be rendered with no node behind it. */
+| {
+  kind: string;
+  operation: 'group-update';
+  path: string;
+  data: unknown;
+}
+/**
+ * Move a whole group — its stored body and every member whose path extends it.
+ *
+ * Its own operation rather than a fan-out of member renames, because a group is two things at once:
+ * membership is emergent from paths, but the body (label, icon) is stored under the group path. A
+ * caller renaming the members would move half of it, orphaning the body under the old name and
+ * leaving the new name unlabelled. It is also one patch — one draft row, one undo step, one line in
+ * the changes panel — where the fan-out was one per member.
+ */
+| {
+  kind: string;
+  operation: 'group-rename';
+  path: string;
+  to: string;
+} /** Delete a group: its body and its members. Nothing is left for a group to be derived from. */ | {
+  kind: string;
+  operation: 'group-delete';
+  path: string;
+}
+/**
+ * Rearrange a kind's items — and, separately below, its group nodes.
+ *
+ * Order is key order — the order of the authored object literal, of the serialized artifact, and of
+ * the emitted stylesheet — so this rewrites that rather than writing a rank or an index anywhere. An
+ * authored config therefore says nothing about ordering; it just has its keys in an order.
+ *
+ * `order` is the full intended sequence rather than a relative move, so replay never depends on a
+ * neighbour still existing.
+ *
+ * Two operations rather than one carrying `target: 'item' | 'group'`, for the same reason a sub-op
+ * spells its collection (`sub-create/layers`): what is being ordered is part of which operation this
+ * is, not an argument to a shared one. Every other group operation is already its own verb
+ * (`group-update`, `group-rename`, `group-delete`), ordering was the one that wasn't, and the cost
+ * showed up downstream — one op can't be both `scope: 'collection'` and `scope: 'group'`, so its
+ * derived tool advertised a single overloaded call where every other group edit has its own.
+ */
+| {
+  kind: string;
+  operation: 'reorder';
+  order: readonly string[];
+} /** Rearrange a kind's group nodes — the folders, not the items inside them. */ | {
+  kind: string;
+  operation: 'group-reorder';
+  order: readonly string[];
+} | SubPatch;
+/**
+ * A mutation on a member inside an item's keyed collection field (a component's `layers`/`props`) —
+ * `field` names the collection, `key` the member.
+ *
+ * A nested collection is addressed by the same two plus `owner`: `field` is the declared path
+ * (`props/value`, a variant prop's values) and `owner` is the member of the outer collection it
+ * sits in (`variant`). The field stays the declaration rather than absorbing the owner key, so the
+ * verb it produces (`sub-create/props/value`) is the same string the op catalog declares.
+ */
+type SubPatch = {
+  kind: string;
+  operation: 'sub-create';
+  path: string;
+  field: string;
+  owner?: string; /** Left out on a collection that derives its members' keys. */
+  key?: string;
+  data: unknown;
+}
+/**
+ * Write one member's whole value, whether or not it is already there.
+ *
+ * Deliberately not `sub-create` relaxed into an upsert. A create's `ALREADY_EXISTS` refusal is
+ * load-bearing: the draft is a replayed list, so a create landing on a base that already holds the
+ * member is a collision someone has to be told about, and an "add" tool that silently clobbered a
+ * member a collaborator just added would make that invisible. Those are two different intents, so
+ * they are two operations — `sub-create` still means "this is new", and a surface that only knows
+ * what the member should be says so instead of reading the collection first to find out which
+ * verb it is allowed to use.
+ */
+| {
+  kind: string;
+  operation: 'sub-upsert';
+  path: string;
+  field: string;
+  owner?: string; /** Left out on a collection that derives its members' keys — an override's, a style rule's. */
+  key?: string;
+  data: unknown;
+}
+/**
+ * A partial over one member, addressed by field path — `{ 'layers.root.bg': 'hover' }` changes one
+ * leaf of a style rule's bag and leaves every sibling alone, where `sub-upsert` would replace the
+ * member whole. `null` at an address removes what is there.
+ *
+ * **Upserting on purpose**: a missing member is written from `{}` rather than refused. Two reasons,
+ * and they point the same way. A derived key (`defineSubEntity({ key })`) is a function of the
+ * content, so "the rule at this condition" names the same thing whether or not it is stored yet —
+ * refusing would mean a component could only be styled where it already was. And a member whose key
+ * is the caller's may still be a part the config only projects until someone edits it: a node inside
+ * an inserted instance has no stored anatomy entry until its first prop is written, and that write is
+ * what stores it. `sub-create` stays the strict form for a caller that means "this must be new".
+ *
+ * The result is validated against the field's create schema, never the delta against a derived
+ * partial — so `null` never reaches a stored value type, per-owner strictness still applies, and
+ * every declared coercion and `.default()` still runs.
+ */
+| {
+  kind: string;
+  operation: 'sub-update';
+  path: string;
+  field: string;
+  owner?: string;
+  key: string;
+  data: unknown;
+} | {
+  kind: string;
+  operation: 'sub-delete';
+  path: string;
+  field: string;
+  owner?: string;
+  key: string;
+} | {
+  kind: string;
+  operation: 'sub-rename';
+  path: string;
+  field: string;
+  owner?: string;
+  key: string;
+  to: string;
+} | {
+  kind: string;
+  operation: 'sub-reorder';
+  path: string;
+  field: string;
+  owner?: string;
+  order: string[];
+};
+/** A node in a kind's folder/file tree — a `folder` (an emergent group prefix, with its
+ *  optional metadata) or an `item` (a leaf entity). */
+interface TreeNode {
+  name: string;
+  path: string;
+  type: 'folder' | 'item';
+  meta?: Record<string, unknown>;
+  item?: Entity;
+  children: TreeNode[];
+}
+/**
+ * Somewhere a current config can be read from — what a link points at.
+ *
+ * Two immutable values can't be "live" with respect to each other: once a link captures a `Config`,
+ * that config never changes again, and `sys = sys.apply(…)` produces a value the link has never
+ * heard of. So a link stores this instead, and reads resolve through it every time.
+ *
+ * `ConfigSession` is the real implementation — a mutable handle whose `config` advances as edits
+ * land. A plain config supplies {@link Config.liveSource}, which resolves to itself: correct for the
+ * build-time case, where the source is authored once and never edited.
+ */
+interface LiveConfig {
+  readonly config: Config;
+}
+/**
+ * One source kind's loaded sources, by the slug every ref through them spells — a live `Config`, or
+ * the serialized form straight off the wire.
+ *
+ * Accepting the serialized form is what keeps `fromJSON` the only hydration API. A caller holding a
+ * payload would otherwise need somewhere to turn each source into a `Config` first, and "somewhere"
+ * becomes a helper, a name for the argument, and a second vocabulary sitting next to `fromJSON` — with
+ * every call site remembering to use it. There is nothing to remember if the option takes what the
+ * caller has.
+ */
+type SourcesBySlug = Record<string, Config | LiveConfig | SerializedConfig>;
+/**
+ * Loaded sources ready to attach, keyed by the source kind's accessor name and then by the item's
+ * slug — `{ linkedSystems: { yos: yahooOs } }`.
+ *
+ * The same two levels the declaration uses (`register({ linkedSystems: { yos: LinkedSystem.item(…) } })`),
+ * so declaring a source and handing over what it resolved to are spelled the same way. See
+ * {@link Config.registerSources}.
+ */
+type AttachedSources = Readonly<Record<string, SourcesBySlug>>;
+/**
+ * What a serialized config needs from outside itself in order to hydrate whole.
+ *
+ * `sources` attaches each source under the slug every ref through it spells, and is not required: an
+ * artifact whose sources are absent is a legitimate, readable config whose borrowed values simply do not
+ * resolve, which is what Create shows as "linked, unresolved".
+ *
+ * Attaching at hydration rather than after it is the point. `fromJSON(json)` followed by
+ * `.registerSources(…)` leaves a window in which every sourced ref dangles, and anything that reads in that
+ * window — an emitter, an integrity check, a memo that caches — gets a wrong answer that looks like data.
+ */
+interface HydrationOptions {
+  /**
+   * The loaded sources to attach — {@link AttachedSources}, so `{ linkedSystems: { yos: … } }`.
+   *
+   * Nested under its own key rather than spread across this interface, because the accessor names are
+   * the config type's to choose. A `linkedSystems?:` field here would be the framework naming a kind
+   * (see `.claude/rules/config-framework-kind-agnostic.md`), and a config declaring `linkedPackages`
+   * would have no way to hydrate at all. `patches` shares this level, which is why the sources cannot
+   * simply be this interface.
+   */
+  readonly sources?: AttachedSources;
+  /**
+   * What those sources resolved to, by slug — the receipt beside the attachment.
+   *
+   * `sources` and this are two halves of one answer, and {@link Config.load} sets both: attaching says
+   * a source is readable, and the state says how that turned out and, for one that couldn't be met,
+   * why. A surface reads the second through {@link Config.sourceStatus}, so hydrating with sources but
+   * no states leaves the linked-system rail unable to tell "nobody looked" from "looked and could not".
+   *
+   * Here rather than only inside `load`, because resolving is what makes `load` async and attaching is
+   * not. A client handed pre-resolved answers — the editor, whose server resolved them at page load —
+   * has nothing to await, and going through `load` would mean an async hydrate for a synchronous fact.
+   *
+   * Keyed by slug alone, like every other source lookup: a ref spells `@ds` with no room for a
+   * collection. The payloads inside are the kind's own, so this names no kind.
+   */
+  readonly sourceStates?: ReadonlyMap<string, SourceState>;
+  /**
+   * The draft this snapshot already includes, recorded rather than replayed — see
+   * {@link Config.withResolvedDraft}.
+   *
+   * Here because a client's hydration is one step conceptually and was two in practice: the server sends
+   * base-plus-draft applied, so the browser must record the log without performing it, and a `fromJSON`
+   * that couldn't do that left every caller to remember a second call. `config.patches` empty on mount is
+   * not a smaller version of the truth — it is a config that cannot answer "is this new in this draft".
+   *
+   * **Pass the ID with a patch that has one.** A stored patch is already known by an id, and that id is
+   * what the changes panel deletes by, what `drop` takes, and what an optimistic caller staged under; a
+   * fresh one would name nothing on either side. So an entry may be a bare `Patch` — stamped with a new id,
+   * which is right for a draft assembled locally — or `{ id, patch }` when the id already exists.
+   *
+   * Its twin, {@link Config.withDraft}, stays a method: it replays, and reports which patches would not
+   * apply, so it answers with more than a config.
+   */
+  readonly patches?: readonly (Patch | StampedPatch)[];
+}
+/** How a derived kind gets its members. `source: undefined` means self, resolved at read time
+ *  rather than captured in a closure — so a derived config rebinds for free instead of having to
+ *  rebuild every forward. */
+interface DerivedBinding {
+  readonly deriveMembers: (source: Config) => Record<string, Record<string, unknown>>;
+  /** `undefined` = self. An external source is a {@link LiveConfig} for the same reason a link is:
+   *  a derived kind computed from another config has to track it, not a frozen copy of it. */
+  readonly source: LiveConfig | undefined;
+}
+/**
+ * A config's whole state, in one object — so deriving a config is a single property write and the
+ * clone stays O(1) however many kinds are registered.
+ *
+ * The metadata half (`entities` / `ownedKinds` / `links` / `derived`) is shared by
+ * reference across every config `apply` produces, and copied only by the authoring methods, which
+ * run once at build time.
+ */
+/**
+ * What a config has written: its base and its pending list.
+ *
+ * One `Edition` value is shared by every config derived from the same edits, so two configs with the
+ * same `edition` differ only in what was read into them — an attached source, derived rows, an owner.
+ * A holder deciding whether someone else wrote compares editions; comparing configs would count every
+ * late read as a write.
+ */
+interface Edition {
+  readonly base: Snapshot;
+  readonly pending: readonly StampedPatch[];
+}
+/**
+ * A judgement about CSS text the config can't make on its own: whether `value` is one the CSS
+ * `property` takes, against the property's real grammar. `true` and `false` are verdicts; `undefined`
+ * is no verdict, for a property or a value the grammar can't judge (a custom property, a `var()`).
+ *
+ * The generated CSS table answers keywords and single-class literals itself and puts to this only what
+ * it can't judge (a shorthand, a function). A write lane supplies one through
+ * {@link Config.withCssGrammar}; the package never loads a grammar itself, since it is bundled into
+ * the Studio client.
+ */
+type CssGrammar = (input: {
+  readonly property: string;
+  readonly value: string;
+}) => boolean | undefined;
+interface ConfigState {
+  readonly name: string;
+  /** What this config type holds and how one is authored — prose the config type declares. */
+  readonly description?: string;
+  /** The grammar a write lane armed this config with — see {@link CssGrammar}. */
+  readonly cssGrammar?: CssGrammar;
+  /** What reads see: the base with every pending patch applied. */
+  readonly snapshot: Snapshot;
+  /** The last state seen from the source — what `rebase` replays the pending patches onto. */
+  readonly base: Snapshot;
+  /** Local edits the source hasn't confirmed yet. */
+  readonly pending: readonly StampedPatch[];
+  /** Shared by every config holding the same `base` and `pending` — see {@link Edition}. */
+  readonly edition: Edition;
+  /** Bumps on every derivation — the coarse cache key kept for compatibility. New code keys on
+   *  Snapshot slice identity instead (see `memo.ts`), which doesn't over-invalidate. */
+  readonly generation: number;
+  readonly entities: ReadonlyMap<string, EntityKind>;
+  readonly ownedKinds: ReadonlySet<string>;
+  /**
+   * The loaded linked systems, keyed by the link's local slug — what a `@source` ref resolves
+   * through.
+   *
+   * Distinct from `links`, which is keyed by kind and borrows one kind wholesale (a design file's
+   * view of its system's components). This borrows nothing: a source sits here so refs into it can
+   * be followed, and using none of it is the normal case. A {@link LiveConfig} for the same reason a
+   * link is — a source that advances has to be seen advancing.
+   */
+  readonly sources: ReadonlyMap<string, LiveConfig>;
+  /**
+   * The resolved values of the borrowed entities this config actually reaches, keyed by the qualified ref
+   * that reaches them — computed as the config serializes, which is the only moment they matter.
+   *
+   * Why record what the sources could compute: a source is a whole config, and only the build ever has one
+   * attached. Every reader afterwards — Create painting a swatch, the server regenerating a stylesheet —
+   * wanted the twelve values a system uses, not the four hundred it can see, and was being handed the
+   * problem of fetching and materializing entire artifacts to get them. Recording them where they are
+   * already computed (the CSS emitter walks exactly this set) makes every later read a lookup.
+   *
+   * Sound because a pin is exact: a published `{systemId, version}` is immutable, so its values cannot
+   * drift, and a repo-local pin is recomputed on every local build. Stale values would need a source to
+   * change under a fixed pin, which is the one thing a pin prevents.
+   */
+  /**
+   * Sources this config recorded, by slug — the closure it reaches, each as an ordinary artifact.
+   *
+   * Distinct from {@link sources} above, which holds what is attached right now. A reader asking "can
+   * I read this value" wants either ({@link Config.sourceFor}); a reader asking "is a real source
+   * attached" wants only the first ({@link Config.liveSourceFor}), and four of them do.
+   *
+   * Carried by reference through `derive`, which is load-bearing: the reconstructed configs are
+   * memoized on this map's identity, and rebuilding it per `apply` would rebuild them too — throwing
+   * away every memo keyed on a source (`memo.ts`) on every keystroke, with nothing failing.
+   */
+  readonly recorded: ReadonlyMap<string, RecordedSource>;
+  /**
+   * What each declared source resolved to, recorded per slug by {@link Config.load} — the same
+   * tagged value the resolver answered with, so nothing translates between them.
+   *
+   * Absent is a third state, and a meaningful one: a config hydrated by plain `fromJSON` asked nobody,
+   * which is different from a resolver that looked and could not. Those two plus `attached` are the
+   * three cases that are all the same `undefined` without this.
+   *
+   * Carried by reference through `derive` like {@link recorded} — an edit does not change what a
+   * source resolved to.
+   */
+  readonly sourceStates: ReadonlyMap<string, SourceState>;
+  readonly derived: ReadonlyMap<string, DerivedBinding>;
+  /** The mutable handle that owns this config's lineage, when one does (a `ConfigSession`). A link
+   *  taken off this config reads through it, so the window stays live as the session advances.
+   *  `undefined` for a standalone value, which links as itself. */
+  readonly owner: LiveConfig | undefined;
+}
+/**
+ * Everything a config derives from its snapshot and its live linked sources, in one bucket.
+ *
+ * Reference stability for a resolved extension, a kind's list and a group's members all want the
+ * same key, and none of them can be keyed on the snapshot alone: an extended linked item takes its
+ * base from the current source, so a config that swapped one — hydrating with `{ sources }`,
+ * re-attaching after a republish — has the same slices and different data. `list` inlines those
+ * resolved entities into an array, so a slug-only key would keep handing back the pre-republish ones
+ * even though `resolveExtension` would now build new ones.
+ *
+ * Keyed by the current source Config identities, a live source edit invalidates naturally without
+ * serializing or hashing either config.
+ */
+/** What a collection read may leave out. `retired: false` drops every entity {@link Config.retired}
+ *  answers true for; anything else is the total list. */
+type ListOptions = {
+  readonly retired?: boolean;
+};
+declare class Config {
+  #private;
+  /** All of this config's state. `protected`, not a `#private` field, so a derived config can be
+   *  built with `Object.create` — JS private fields are installed by a constructor, and an O(1)
+   *  clone is precisely the thing that skips the constructor. */
+  protected state: ConfigState;
+  /** A config's name is its namespace (`'system-config'`, `'design-file'`) — the segment tool names
+   *  carry (`uds_<name>_<verb>_<kind>`) so two configs' tools are distinct. Defaults to
+   *  `'system-config'` for a bare `new Config()`; a config type (`defineConfig({ name })`) passes its
+   *  own. */
+  constructor(name?: string, description?: string);
+  get name(): string;
+  /** What this config type holds and how one is authored, when the type says. */
+  get description(): string | undefined;
+  /** The stored state this config reads through — the value the view caches key on (`memo.ts`). */
+  get snapshot(): Snapshot;
+  /** The last state seen from the source, without the local pending patches. */
+  get base(): Snapshot;
+  /** Local edits the source hasn't confirmed yet, oldest first. */
+  get patches(): readonly Patch[];
+  /** This config as A link source — what another config's `registerLinked` should point at.
+   *  Resolves through the owning session when there is one, so the link tracks it; otherwise it
+   *  resolves to this exact value, which is what a build-time link wants. */
+  get liveSource(): LiveConfig;
+  /** Bind this config's lineage to the handle that owns it — called by `ConfigSession`, so links
+   *  taken off any config it produces resolve through the session rather than freezing. */
+  withOwner(owner: LiveConfig): this;
+  /** The pending edits with their ids — what a sink persists and `merge` names. */
+  get pending(): readonly StampedPatch[];
+  /**
+   * What this config has written, as one value shared with every config derived from the same edits.
+   *
+   * A write — `apply`, `rebase`, `withDraft`, `merge`, `drop` — produces a new edition. A read that
+   * arrives late — a source attaching, rows deriving, an owner binding — produces a new config over
+   * the same one. A holder asking "did someone else write while my edit was out" compares this.
+   */
+  get edition(): Edition;
+  /**
+   * The members of one collection that the unmerged draft created — "which of these elements are new
+   * in this draft?"
+   *
+   * The one class of question a snapshot cannot answer. A component's anatomy says an element is
+   * there, not who put it there, and an editor that routes a dropped instance to a different panel
+   * than a baked one has to know which it is. It is asked of the config because the config is what
+   * holds the draft; the alternative every surface reached for was scanning stored rows, which sees
+   * only what has been persisted — an edit still in flight is invisible to it, and one that has
+   * settled is invisible in the other direction, because the row a client stages and the rows a
+   * commit writes are not the same shape.
+   *
+   * Looks for the create, not for the op that produced it. A custom op decomposes into several
+   * patches and replay never records that one ran, so `element-insert` leaves a `sub-create` on the
+   * collection its element landed in and nothing that names the insert. That also means a subtree
+   * insert answers with every node it grafted, not just the root: each one is equally new, and a
+   * caller that wants only the root has a containment question to ask of the anatomy, not of the
+   * draft.
+   */
+  draftCreatedKeys(kind: string, path: string, field: string): ReadonlySet<string>;
+  /**
+   * This config's bucket in {@link cachesFor}, resolved once.
+   *
+   * `cachesFor` allocates a sorted `[slug, Config]` list and scans the snapshot's buckets for a match,
+   * and its callers include `withComputed`, which the value-domain expansion behind one CSS emit reaches
+   * hundreds of thousands of times. The pair it keys on — this config's snapshot and its attached
+   * sources — is fixed for the instance's lifetime, because every change goes through {@link derive} and
+   * produces a new one, so holding the answer here is a memo that can't go stale.
+   *
+   * Safe on a derived config for the same reason: `derive` builds the clone with `Object.create` and
+   * assigns only `state`, so an instance field is never carried across.
+   */
+  private get caches();
+  private buckets?;
+  /**
+   * The next config: same identity and metadata, new state. One `Object.create` plus one property
+   * write — no re-registration, no rehydration, and the receiver is untouched.
+   */
+  private derive;
+  /**
+   * This config over another snapshot — what a guard inside {@link computeApply} reads.
+   *
+   * `computeApply` is pure in its `snapshot` and reads metadata off `this`, and during a replay those
+   * are two different states: `this` is the stale local config, while the patch has to be judged against
+   * the base it is landing on. So a guard whose question is about stored rows — a pin's `link` field,
+   * a folder's pointer — must not ask `this`. The reads that answer it are `Config` methods rather than
+   * `Snapshot` ones, because they cross kinds and consult the entity registry, and this is the view they
+   * take instead.
+   *
+   * One `Object.create` (see {@link derive}), and every snapshot-keyed cache is shared with the
+   * receiver, so a guard pays nothing for asking the right config.
+   */
+  private at;
+  /** A mutable copy of the metadata half — taken by the authoring methods, which are pure but rare.
+   *  `apply` shares the metadata by reference and never pays for this. */
+  private metaDraft;
+  /** The state a completed registration produces. Build content is confirmed by definition, so the
+   *  base advances with it — nothing authored is ever "pending". */
+  private registered;
+  /** This config's metadata for a kind — the `EntityKind` copied off the entity class when the kind
+   *  was registered into this instance. `undefined` for a kind this config doesn't know. The single
+   *  accessor every internal read routes through. */
+  entityOf(kind: string): EntityKind | undefined;
+  /**
+   * Run one of a kind's operations — the input parsed through the op's own schema, then handed to
+   * its handler.
+   *
+   * The parse is the point. An op declares what it takes, and that declaration is what the AI tools
+   * advertise, what the docs print, and what an example is filled from — but a caller reaching
+   * `schemas[verb].handler` directly skipped every word of it, so a missing field arrived as
+   * `undefined` and a declared `.default()` never applied at all. Callers were left supplying the
+   * defaults themselves, which put a fact about the op (an unstated parent means `root`) in whichever
+   * consumer happened to need it, spelled slightly differently each time.
+   *
+   * Throws the same rejection any other refused write throws, so a bad tool call and a bad patch
+   * report identically.
+   *
+   * The single-op half of {@link run}, which is the door a caller uses.
+   */
+  private dispatch;
+  /**
+   * A whole-body op's input with a bare ref put in the kind's primary field, so an op takes the same
+   * shorthand `apply` does (`wholeBodyChange`): `Token.ref('x@ds')` is a token body at either door.
+   * Anything else is handed back as it came.
+   */
+  private wholeBodyShorthand;
+  /**
+   * Run an operation: one op, or a list as one changeset.
+   *
+   * One op is looked up and run, read or write alike, and typed by its verb where the framework
+   * declares the verb: a standard write (`create`, `update`, `rename`, `sub-update`, …) produces a
+   * config, and a standard read (`list`, `get`, `delete-plan`, …) produces its answer. A custom op is
+   * declared by a kind, which the type system cannot enumerate, so it comes back as `unknown`; a caller
+   * that wants the config from a custom op runs it as a one-item list.
+   *
+   * `id` on the single form names the first patch the op produces, for the same reason `apply` takes
+   * one — see {@link named}. A custom op applies several patches internally, and the caller cannot hand
+   * any of them over, so this is the only place its own id can reach them.
+   */
+  run(op: ConfigOp & {
+    readonly operation: Patch['operation'];
+  }, id?: string): this;
+  run(op: ConfigOp & {
+    readonly operation: 'list';
+  }): Entity[];
+  run(op: ConfigOp & {
+    readonly operation: 'get';
+  }): Entity | undefined;
+  run(op: ConfigOp & {
+    readonly operation: 'dependents';
+  }): string[];
+  run(op: ConfigOp & {
+    readonly operation: 'rename-plan';
+  }): RenamePlan;
+  run(op: ConfigOp & {
+    readonly operation: 'delete-plan';
+  }): DeletePlan;
+  run(op: ConfigOp & {
+    readonly operation: 'copy-plan';
+  }): Omit<CopyPlan, 'patches'>;
+  run(op: ConfigOp & {
+    readonly operation: 'link-plan';
+  }): Omit<LinkPlan, 'patches'>;
+  run(op: ConfigOp & {
+    readonly operation: 'unlink-plan';
+  }): Omit<UnlinkPlan, 'patches'>;
+  run(op: ConfigOp & {
+    readonly operation: 'break-plan';
+  }): Omit<BreakPlan, 'patches'>;
+  run(op: ConfigOp & {
+    readonly operation: 'rows';
+  }): SourceRowState[];
+  run(op: ConfigOp & {
+    readonly operation: 'group-list';
+  }): ReturnType<Config['groups']>;
+  run(op: ConfigOp & {
+    readonly operation: 'group-get';
+  }): {
+    path: string;
+    meta: Record<string, unknown> | undefined;
+    members: string[];
+  };
+  run(op: ConfigOp, id?: string): unknown;
+  run(ops: readonly ConfigEdit[], changeset?: {
+    id?: string;
+  }): this;
+  /**
+   * Several ops as one changeset.
+   *
+   * Each runs against the config the previous one produced, so a refused op refuses the call and
+   * nothing lands, and every patch they wrote is stamped with the call's changeset — one undo step and one
+   * line in a changes list for what a caller did once. An op that stamped a changeset of its own is
+   * folded into the call's: a changeset is flat, and the call is the gesture.
+   *
+   * An item may name the id its first patch lands under ({@link IdentifiedOp}); the rest are minted.
+   *
+   * A refusal is the op's own `ConfigRejection` with `opIndex` set to the position of the op that
+   * was refused, so a caller reporting on a batch can name the item without running them one by one.
+   */
+  private runBatch;
+  /**
+   * The batch {@link run} would apply, keeping every op this config takes and naming the ones it
+   * refuses, by position and reason. An op that depended on a refused one is refused in turn and
+   * named the same way. What landed shares one changeset, as a run does; nothing lands when
+   * everything was refused.
+   */
+  runSkippingRefused(ops: readonly ConfigEdit[], changeset?: {
+    id?: string;
+  }): {
+    config: Config;
+    skipped: readonly SkippedOp[];
+  };
+  /**
+   * What running `ops` would do, without doing it.
+   *
+   * Every op is config in, config out, so the ops run against this config as {@link run} would run a list of
+   * them, and the patches they appended are read off the result and returned with it dropped. Nothing
+   * is stored and nothing reaches a sink; the receiver is untouched. Refuses exactly what the ops
+   * refuse, since it runs them, and refuses a read, since a read writes nothing to plan.
+   *
+   * A patch list cannot show everything an op does. A rename is one patch whose cascade rewrites every
+   * referrer; a delete is refused by dependents; a link break resolves every borrowed ref. A kind says
+   * so by declaring a `<verb>-plan` read beside the op, and the plan runs that read for each op, against
+   * the config as it stands when the op would run, so one plan is the whole account.
+   */
+  plan(ops: PlanOp | readonly PlanOp[]): Plan;
+  /** This config carrying a CSS grammar for what the generated table leaves unjudged, and every config
+   *  derived from it carries it too. `undefined` disarms. */
+  withCssGrammar(grammar: CssGrammar | undefined): this;
+  /** The grammar a write lane armed this config with, if any — see {@link CssGrammar}. */
+  get cssGrammar(): CssGrammar | undefined;
+  /**
+   * The pending patches from `since` onward, as one changeset — the call's, over whatever the ops that
+   * produced them stamped, since a changeset is flat and the call is the gesture.
+   *
+   * What {@link run} on a list ends with, and what a caller that applied a batch entry by entry (to report
+   * which entry failed) calls afterwards. The first patch takes `id` when given, and that id is the
+   * changeset's; a tail of one patch carries no changeset.
+   */
+  withChangeset({
+    since,
+    id
+  }: {
+    since: number;
+    id?: string;
+  }): this;
+  /**
+   * The patches an op produced, as one changeset.
+   *
+   * A custom op is one changeset that decomposes into several patches, and the handler mints an id for
+   * each — so an optimistic caller, which staged a row under an id of its own before the op ran, gets
+   * back a pending log naming patches it has never heard of and can never settle its row. The first
+   * patch takes the caller's id, exactly as passing an id to `apply` does for the single-patch case,
+   * and that id is also the changeset's, so what the caller staged, what undo drops and what a list groups
+   * under are one identifier.
+   *
+   * A single patch carries no changeset. Several carry one, and a caller whose call is the gesture
+   * stamps over what the ops stamped with {@link withChangeset}.
+   *
+   * Anything that isn't a config passes straight through — a read op (`info`, `api`) returns a value,
+   * and there is no patch to name.
+   */
+  private named;
+  /** The sub-entity a kind's collection field is declared with (`component`/`layers` → `Layer`), or
+   *  `undefined` when the field isn't a collection. Takes a field path, so a nested collection
+   *  (`props/value`) resolves too. The accessor a consumer asks for a member's labels or its own
+   *  `list`/`get`, so nothing has to reach into `subEntities` or fall back to title-casing the key. */
+  subEntityOf(kind: string, field: string): SubEntityClass | undefined;
+  /** The human label for one item of a kind — the registered `label`, or a title-cased fallback for
+   *  a kind this config doesn't know (e.g. a synthetic UI group). */
+  entityLabel(kind: string): string;
+  /** The human label for a collection of a kind — the registered `labelPlural`, or a naive `<Label>s`
+   *  fallback. */
+  entityLabelPlural(kind: string): string;
+  /** Spin up a read-view facade for this config — `config.views.components()`,
+   *  `config.views.token(path)`, `config.views.render(spec)`. */
+  get views(): {
+    token: (path: string) => string | number | undefined;
+    componentProps: (path: string) => Record<string, unknown>;
+    stylePropValues: (path: string) => string[];
+    styleValue: (value: unknown) => string;
+    styleDeclarations: (bag: Record<string, unknown>) => Record<string, string>;
+    cssVar: (kind: string, path: string) => string;
+    cssVarRef: (kind: string, path: string) => string;
+    className: (kind: string, path: string) => string;
+  };
+  /** Every ref in this config, indexed both ways — `config.refs.dependents(ref)`,
+   *  `.dependencies(ref)` (each with `{ transitive }`), and `.path(from, to)` for the chain
+   *  between two entities. Carried on the snapshot and updated per mutation for the entities that
+   *  actually changed, so a delete-safety check or an impact panel is a lookup, not a re-scan. */
+  get refs(): RefGraph;
+  /** Bumps on every derivation — the coarse cache key a display layer memoizes against. Includes
+   *  linked sources' versions, so a change in a linked config bumps this too. Prefer keying on
+   *  Snapshot slice identity (`memo.ts`), which doesn't invalidate unrelated kinds. */
+  get version(): number;
+  /** The low-level registration primitive — seed a kind's metadata into a new config (from the
+   *  Entity class's `kindDef`) and wire its membership: Derive (members computed from a source —
+   *  self by default), link (a read-only window onto a source's items), or own (load the items in
+   *  `record`). `protected`: authoring goes through a config type (`defineConfig`), whose typed
+   *  `register`/`registerLinked` call this per entry — there is no public single-entity register.
+   *
+   *  A value in `record` is a group node (`Token.group(...)`), a raw item (`Token.item(...)` / bare
+   *  shorthand), or a typed authoring handle (`defineComponent` → any `Authored`, which adopts its
+   *  path and normalizes via `toStored()`). Entries register in order, so one may reference another. */
+  protected registerEntity<F extends FieldsSchema, G extends FieldsSchema>(entityClass: EntityClass<F, G> | {
+    readonly kind: string;
+    readonly isDerived: true;
+    readonly kindDef: EntityKind;
+  }, record?: Record<string, AuthoredEntry<F, G>>): this;
+  /**
+   * Every item of `kind`, with its factory sub-entity members coerced — what makes an authored
+   * collection store what the same write through a sub-op would have stored.
+   *
+   * Without it a component authored with its `styles` inline holds a condition exactly as typed
+   * while one edited through `sub-create` holds the ref its schema transforms it into, and every
+   * reader has to accept both forever. A no-op for a kind with no factory members, which is most.
+   */
+  /**
+   * Re-coerce every owned kind — run after a `register` call has loaded all of its records.
+   *
+   * A member's schema is built from the config, so a value that names another kind's item can only
+   * bind once that item exists. `registerEntity` coerces the kind it just wrote, which makes forward
+   * depend on the order the keys happen to appear in one `register({ … })` literal: a component listed
+   * before the motion presets it defaults to saw no presets yet and stored a bare name, silently, with
+   * the reference missing from the graph. A second pass over everything removes the ordering from the
+   * answer.
+   *
+   * Idempotent, which is what makes a second pass safe: forward turns a leaf into a ref, and a ref is
+   * not a leaf, so re-coercing already-bound data is a no-op that allocates nothing.
+   */
+  protected coerceOwned(): this;
+  /**
+   * Refuse two source kinds claiming one slug.
+   *
+   * A ref spells `@ds` and nothing more, so a slug resolves against the config rather than against a
+   * collection: {@link sourceFor}, the attached sources, the recorded closures and the resolved states
+   * are every one of them keyed by slug alone. Two kinds declaring `ds` therefore cannot both be
+   * reachable — one silently wins every read, and which one depends on the order they were registered
+   * in.
+   *
+   * Checked rather than assumed. "The slug namespace is flat" is a property of the ref grammar, and
+   * nothing was making the data honour it: a config declaring `linkedSystems: { ds }` and
+   * `linkedPackages: { ds }` registered clean, `sourceSlugs()` answered `['ds', 'ds']`, and every read
+   * through `@ds` picked a winner. Unreachable while a config declares one source kind, and the first
+   * thing to go wrong the day it declares two — which is exactly what `sources` exists to allow.
+   *
+   * A slug equal to this config's own {@link name} is refused for the same reason: {@link configFor}
+   * answers a ref qualified with the name locally, so a source declared under it would shadow this
+   * config's own entities for every reader holding such a ref.
+   *
+   * The cross-kind check is free for a config with fewer than two source kinds, which is every config
+   * today.
+   */
+  private assertDistinctSourceSlugs;
+  private coerceKind;
+  /**
+   * Seed a kind in place — legal only from a constructor, where the object being built isn't
+   * observable to anyone yet, so this isn't mutation in the sense the rest of the class avoids.
+   * `defineConfig` uses it to install a config type's manifest without a clone per kind.
+   */
+  protected seedEntityInPlace(entityClass: {
+    readonly kind: string;
+    readonly kindDef: EntityKind;
+  }): void;
+  /** Apply one patch — the recorded unit of change, in the shape a draft stores and replays.
+   *
+   *  `apply` and {@link run} are two doors on one wall. A {@link Patch} is one of the framework's own
+   *  verbs (`create`, `update`, `rename`, `sub-update`, …) with its body already in stored shape, and
+   *  `apply` performs exactly that one and records it. A {@link ConfigOp} is anything the catalog
+   *  addresses — those same verbs, and custom ops such as `linked-system/copy` that decompose into
+   *  several patches — and `run` parses its input against the op's own schema and hands it to the op's
+   *  handler, which for a standard verb is a call to `apply`. So `apply` is what a handler and a
+   *  replay call, and `run` is what a caller calls: a tool, an editor gesture, a commit. A caller
+   *  reaching for `apply` directly skips the op's input parse (its defaults, its refinements) and
+   *  cannot spell a custom op at all.
+   *
+   *  `create`/`update` bodies are validated against the schema-derived shapes; `update`/`delete`
+   *  require an existing target. Throws on an invalid body or missing target.
+   *
+   *  Returns a new config; the receiver is unchanged. A caller that drops the return has applied
+   *  nothing.
+   *
+   *  `id` lets a caller name the patch it just made. A client that paints optimistically stages a row
+   *  under an id of its own and has to settle that row when the write lands, so it needs the pending
+   *  entry and its own staging to agree — and an id minted here would be a second source that
+   *  silently disagrees with it. Omitted, one is minted, which is what every non-optimistic caller
+   *  wants. */
+  apply(patch: Patch, id?: string): this;
+  /**
+   * Several patches as one step: each validates against the state the previous one produced, as
+   * {@link apply} would, and the config is derived once at the end rather than once per patch.
+   *
+   * What a handler that writes a row per entity uses. Deriving is the larger share of an apply, so
+   * a copy of 2,600 entities takes a third of the time it would one patch at a time, and every
+   * patch still lands in `pending` with its own stamp, so the sink and a replay see the same list.
+   *
+   * A patch on a source kind goes through {@link apply} on its own, since that is where a pin that
+   * moves retires what was held under its slug, and where the rows its declaration mints re-derive.
+   *
+   * Several patches are one gesture, so they share one changeset; a single patch carries none.
+   */
+  applyAll(patches: readonly Patch[]): this;
+  /**
+   * Replay the pending patches onto a new base — what a remote change calls.
+   *
+   * Each patch re-validates against the state the previous one produced, so a patch whose target
+   * the remote change removed (or whose derived member key it re-keyed) fails exactly as a fresh
+   * apply would. Those are dropped and reported rather than silently skipped: the local edit really
+   * is gone, and the surface that made it needs to be able to say so.
+   *
+   * A replayed pin patch does not re-derive rows the way {@link apply} does. A draft stored before
+   * pin patches re-derived carries a `delete` per minted row after its `link: null`, and those have
+   * to replay whole; the session derives once after the replay instead.
+   */
+  rebase(base: Snapshot): RebaseResult<this>;
+  /**
+   * One patch of a changeset onto a scratch snapshot, with the same second try a lone patch gets: a
+   * patch may fail because the rows it needs had not been derived yet (the pin it depends on is in
+   * this draft), so the replay derives against what it has built so far and goes once more.
+   */
+  private replayOne;
+  /**
+   * Attach the draft log to a snapshot that already includes it.
+   *
+   * The client's counterpart to {@link withDraft}, and deliberately not the same thing. A browser
+   * receives the config the server already resolved — base plus draft, applied — so replaying the
+   * draft over it would apply every edit twice. But `fromJSON` seeds `pending: []`, so what arrives
+   * is a config that cannot say which patches compose it: `config.patches` is empty on mount and
+   * after every true-up, and every question of the form "is this element new in this draft" has to
+   * be re-derived by scanning stored rows instead.
+   *
+   * So the patches are recorded, not performed. The snapshot is untouched.
+   *
+   * The consequence to know: `base` stays where it is, which for a client is the resolved state —
+   * so this config knows its draft but cannot rewind it. {@link rebase} and {@link merge} are
+   * therefore not meaningful on one built this way, and a client doesn't call them: it re-hydrates
+   * wholesale from the server instead.
+   */
+  withResolvedDraft(patches: readonly StampedPatch[]): this;
+  /**
+   * Drop patches the base now contains — what a merge produces.
+   *
+   * Merging a branch's draft publishes a new artifact that already includes these edits, so keeping
+   * them pending would apply them twice. Note this is not about persistence: a patch written to
+   * `draft_patches` is durable but still part of the draft, and still belongs here.
+   *
+   * Unknown ids are ignored, since a merge may be observed more than once.
+   */
+  merge(patchIds: readonly string[]): this;
+  /**
+   * Adopt a shared draft — take `patches` as the pending list and replay them onto the current base.
+   *
+   * The collaborative case. A branch's draft is one list every client can see, so a client takes it
+   * whole rather than reconciling it entry by entry. Replacing rather than appending is what makes
+   * a client's own echo harmless: its patch comes back inside a list it is already part of, so it
+   * is replayed exactly once.
+   *
+   * The base does not move here — only the draft over it does. A patch the current base can no
+   * longer take is dropped and reported, exactly as in `rebase`.
+   */
+  withDraft(patches: readonly StampedPatch[]): RebaseResult<this>;
+  /**
+   * One complete item body as a change — the shared half of `create` and `replace`, which differ only
+   * in whether the path has to be free or has to be taken.
+   *
+   * Three body shapes, all of which a config file already authors, which is why they're accepted here
+   * rather than only by `register`:
+   *
+   *   • a field bag — the ordinary case, validated against the kind's create schema.
+   *   • a bare ref — `{ __ref: 'token:color/brand@ds' }` borrows through a source, and `primaryField`
+   *     is the field the kind puts it in. That is why `Token.ref(…)` reads as a token in a config file.
+   *     `itemChange` does the wrap, but it runs after the parse, so without this a patch would be the
+   *     one door refusing a shorthand every other door takes.
+   *   • an extension — `{ __ref, extend }`, stored as framework data rather than parsed as a body,
+   *     because its delta is sparse and a complete-body schema would refuse it.
+   */
+  private wholeBodyChange;
+  /** The next snapshot for one patch, validated. Pure in `snapshot`; reads metadata off `this`. */
+  private computeApply;
+  /**
+   * This config's reads over another snapshot, for a check that wants nothing else: a plain clone
+   * with the snapshot swapped in. Unlike {@link at}, it records no parent link for the snapshot, so a
+   * batch or a replay that checks every intermediate step keeps none of them alive.
+   */
+  private viewOf;
+  /**
+   * Refuse a state the kind's {@link EntityKind.invariants} reject, or one where a kind declaring
+   * {@link EntityKind.uniqueLeaves} holds a leaf twice. One kind when a patch names it, every kind
+   * after a registration. Never called on hydration.
+   */
+  private assertInvariants;
+  /** One sentence per leaf that two items of `kind` hold, since a leaf has to name one item. */
+  private duplicateLeaves;
+  /** `patch` with a bare leaf resolved to the path it names — see {@link leafPath}. */
+  private leafAddressed;
+  private computeApplyPatch;
+  /** Apply a mutation to a derived kind — only `update`, which merges a sparse override of the
+   *  `overridable` fields (the base always re-derives). Create/delete/rename don't exist. */
+  private applyDerived;
+  /** Sub-entity CRUD — mutate one member inside an item's keyed collection field
+   *  (`layers`/`props`): create/update/delete/rename a member, or reorder the collection.
+   *  The item re-hydrates so refs inside the member flow into the dependency graph. */
+  private applySub;
+  /** Which names a member's delta may address as fields — read off the collection's own member
+   *  schema, resolved for this owner, so a per-owner shape (a style rule's `layers`, keyed by the
+   *  Component's own layers) answers for the member actually being written. */
+  private memberFields;
+  /**
+   * The key a member of `field` on `kind` is stored under when the collection derives it from the
+   * member itself — an override's from its `on`. `undefined` where the caller's key stands, and for a
+   * member the derivation cannot read.
+   */
+  memberKeyOf({
+    kind,
+    field,
+    member
+  }: {
+    kind: string;
+    field: string;
+    member: unknown;
+  }): string | undefined;
+  /** A member's derived key, when its collection declares that members are identified by their
+   *  value (`defineSubEntity({ key })`). `undefined` = the caller's key stands. */
+  private memberKey;
+  /** Validate a sub-entity member body against the field's sub-op data schema (`sub-create/<field>`
+   *  or `sub-update/<field>` in `schemas`), returning the parsed (coerced) output. A field with no
+   *  derived member schema stores as-is. */
+  private validateMember;
+  /**
+   * One member through its per-owner schema, for its coercions only — whatever doesn't fit is
+   * returned exactly as authored, field by field ({@link coerceFieldwise}).
+   *
+   * Lenient on purpose. This runs on paths that never validated factory members at all (an authored
+   * Config's inline collections, an item create), so rejecting here would turn a coercion into a new
+   * gate and fail configs that load today. Validation stays where it already is: the sub-ops, which
+   * refuse through {@link validateMember}.
+   */
+  private coerceMember;
+  /**
+   * Run every member of every sub-entity collection through its own member schema.
+   *
+   * An authored config never meets that schema otherwise: `register` stores the body as written, so
+   * a component authored with its `styles` inline stored a condition exactly as typed while the same
+   * rule written through `sub-create` stored the ref its schema transforms it into. Two storage
+   * forms for one statement, decided by which door the write came through — and every reader
+   * downstream then has to accept both forever.
+   *
+   * Running it here is what makes the authored path and the op path agree, which is why it covers
+   * static members too and not only the per-owner factories: a variant prop's values are a keyed
+   * collection whichever way they were authored, and the list an author writes is coerced by the
+   * member's own schema. Members are re-keyed afterwards for the same reason `cascadeRename` does
+   * it: a coercion can change a derived key.
+   *
+   * `written` scopes it to the fields a write actually carried. Coercion belongs to the write that
+   * stores a value, and a collection the patch didn't touch was coerced by the write that did store
+   * it — so an update setting one field has no reason to re-derive the per-owner schema of every
+   * other collection on the item. Omitted (create, registration) means the whole body was written.
+   *
+   * `strict` is a whole new body — a create or a replace — which refuses a member its per-owner
+   * schema refuses, exactly as the member's own sub-op would; otherwise a component created whole
+   * could carry a style rule no `sub-create/styles` takes, and the first later edit of that rule,
+   * which re-validates it merged, would be refused for a key the create let in. An update stays
+   * lenient, as registration and hydration do ({@link coerceMember}): the build records the anatomy
+   * a render actually has through `update`, and a stored body has to load so it can be fixed.
+   */
+  private normalizeMembers;
+  /**
+   * A body's refs to a kind with unique leaves, spelled by path. An author writes
+   * `Modifier.ref('dark')`; the graph holds `modifier:colorMode/dark`, so one spelling is what the
+   * index sees and what a rename cascade finds. A ref that already spells a path, or that reaches
+   * through a source, is left alone.
+   */
+  private canonicalLeafRefs;
+  /**
+   * Every reference to `from` rewritten to name `to` — the entities at either address untouched.
+   *
+   * The third answer to a link collision, and the one that makes a design spec portable: a spec stores
+   * paths, so a system that repoints its refs at the source's qualified address starts speaking the
+   * source's vocabulary and its specs travel. Re-aliasing is the other answer — keep your path, point
+   * its body at theirs — and the two are not reversible into one another for free, which is why the
+   * `link` op asks rather than defaulting.
+   *
+   * Only the dependents the ref index names are visited, the same as a rename.
+   *
+   * **A name held as a key is not moved, and this refuses rather than half-moving it.** A style
+   * property and a modifier appear in a styles bag as keys rather than refs, and `to` here is a
+   * qualified address (`style-property:bg@ds`), which is not a thing a bag key can be. So after the
+   * refs are rewritten anything still depending on `from` is depending by name, and the caller is told
+   * which — a repoint that silently left those keys naming a row it had just deleted would break the
+   * styles that use them with nothing to read.
+   */
+  repointRefs({
+    from,
+    to
+  }: {
+    from: string;
+    to: string;
+  }): this;
+  /**
+   * Rewrite every ref `from` → `to`, across items and group nodes alike.
+   *
+   * Only the entities the ref index says actually point at `from` are visited. The previous version
+   * re-serialized every item of every kind to find the few that matched, which made a rename cost
+   * the whole config; the index already knows the answer.
+   */
+  private cascadeRename;
+  /**
+   * Rename one key inside every record that is keyed by the renamed collection — a style rule's
+   * `when`, which names the props it conditions on.
+   *
+   * The counterpart to a ref rewrite, for the one place a rename can't be expressed as one. Refs
+   * carry identity in a value, where {@link rewriteRefs} can find them; a record carries it in a
+   * key, where nothing generic can — so the sub-entity declares which of its fields work that way
+   * (`namesMembersOf`) and this walks exactly those.
+   *
+   * Key order is preserved: `when`'s order feeds `canonicalWhen`, and a rebuilt record that reorders
+   * would change the derived key of a rule nothing asked to move.
+   */
+  private rekeyRecords;
+  /** Re-derive every derived member key in `def`. The key function is the single source of a
+   *  member's identity (`memberKey` already runs it on sub-create/sub-update), so re-running it
+   *  after any change to the member's data keeps key and value from drifting. Collections with
+   *  caller-chosen keys (layers, props) have no key function and pass through untouched. */
+  private rekeyMembers;
+  /** Merge a partial over a group node's body, creating the node when the folder is emergent — a
+   *  group exists as soon as an item path implies it, so requiring a node first would make a folder
+   *  the UI already renders uneditable. `null` clears an optional field, as on an item update. */
+  private applyGroupUpdate;
+  /**
+   * A group's members — every item whose path extends the prefix.
+   *
+   * The separator is part of the match, so `color/` never catches `colorScheme/fg`, and a member in a
+   * subgroup (`color/brand/primary`) belongs to `color` too. Getting either wrong is silent: one drags
+   * an unrelated group along, the other skips half of what the user sees under the heading.
+   */
+  private groupMembers;
+  /**
+   * The declared group nodes nested under `group`, at any depth. Sub-groups are stored apart from a
+   * group's items, so a group op has to move or remove them explicitly. Emergent sub-groups exist
+   * because an item is named into them and follow the items by construction.
+   */
+  private descendantGroups;
+  private applyGroupRename;
+  private applyGroupDelete;
+  /** A derived kind's members, memoized against the source's snapshot (recompute only on change). */
+  private derivedMembers;
+  /** Resolve one derived member — base ⊕ sparse override, with `computed` fields evaluated on read
+   *  (never stored). Returns `undefined` for a path that doesn't derive. */
+  private resolveDerived;
+  resolve(kind: string, path: string): Entity | undefined;
+  /**
+   * Whether this config holds `target`'s entity, at the path the source spells it, through `slug`.
+   *
+   * The narrow question, and the narrowness is the point. A row merely occupying that path is not
+   * enough — a borrower with its own `primitives/Box` has a different entity that happens to share a
+   * name, and reading the source's render against it would swap what the render was written for
+   * without anything looking broken. This asks whether the row is a pointer at the same entity, so
+   * that answering yes means the two spellings cannot disagree.
+   *
+   * Entity-level pointers only. A value borrow leaves the entity the borrower's own, holding what
+   * theirs is worth, so it is the first case rather than this one.
+   */
+  private borrowsExactly;
+  /**
+   * The body a linked extension resolves to before this config's kind parses it — the pinned source's
+   * own fields, qualified into this namespace, with the locally authored delta laid over them.
+   *
+   * Split out of {@link resolveExtension} so {@link canBorrow} can ask whether a borrow would parse
+   * here against the same merge a resolve performs. Two merges would disagree about the one case either
+   * exists for, the record-valued fields that merge a level deep, and the disagreement would surface
+   * only as a borrow the picker offered and the read then refused.
+   */
+  private extensionBody;
+  /**
+   * Resolve one locally extended linked item: the pinned source body, shallowly overlaid by the fields
+   * authored here, then parsed through this config's kind. Parsing on this side is what lets a React
+   * Native kind transform or reject a web value rather than trusting the source kind's rules.
+   *
+   * `strict` says what to do when the kind refuses it, and the two callers want different things:
+   *
+   * `true`  a write is going through this body — a sub-op editing the inherited bag, or `materialize`
+   *         sealing it into a local item. A body the kind refuses can't be written, so it throws and
+   *         names the field.
+   * `false` a read. A borrow whose body this kind refuses is one this config can't show, which is the
+   *         same answer as a source that never resolved: nothing. It must not throw, because the row is
+   *         stored, so `list`, `sourceClosure` and `toJSON` all reach it on their way past, and a throw
+   *         from inside serialization has no caller in a position to catch it.
+   *
+   * {@link canBorrow} is the door that keeps such a row from being written; this is what a config
+   */
+  private resolveExtension;
+  /**
+   * Whether an entity in the catalogue of the source `slug` names can be borrowed into this config —
+   * asked before the ref is written, which is the only moment anything can be done about the answer.
+   *
+   * Two ways it can be no, and they're different failures:
+   *
+   *  - **This config has no such kind.** Two config types need not declare the same ones — a native
+   *    System declares no `motion` or `global-style` — so a source offering them is offering something
+   *    with nowhere to land.
+   *  - **The kind exists and the body doesn't fit it.** Same kind string, different value domain: a
+   *    Native modifier's `{ state: 'pressed' }` selector has no arm in the web `Modifier`'s union.
+   *    Writing that borrow leaves a row nothing here can read.
+   *
+   * Judged by the merge a resolve would perform ({@link extensionBody}), so what a surface offers and
+   * what the read produces can't drift. A slug with nothing resolved is `ok` rather than refused: the
+   * catalogue is what this judges against, and "not loaded here" isn't a verdict about the entity.
+   */
+  canBorrow({
+    kind,
+    path,
+    slug,
+    extend
+  }: {
+    kind: string;
+    path: string;
+    slug: string;
+    /** The delta the borrow would carry, if any — a local answer is exactly how a body that would not
+     *  otherwise fit is brought into range, so judging without it would refuse a legal borrow. */
+    extend?: Record<string, unknown>;
+  }): {
+    ok: true;
+  } | {
+    ok: false;
+    error: string;
+  };
+  /**
+   * The kinds this config could take from `slug` at all — what the source declares, narrowed to what
+   * this config also declares.
+   *
+   * The intersection is the whole content, and it's a real question because the two sides need not
+   * share a platform: a native system declares no `motion` or `global-style`, and a web source offering
+   * both is offering kinds with nowhere to land. A surface enumerating the source's kinds instead would
+   * send an op per kind for things this config can't hold.
+   *
+   * Capability only. Whether a kind is one a person should take wholesale — their pins, their editor
+   * configuration, their sealed files — is a judgement about what the kind means, and belongs to the
+   * surface offering the gesture.
+   */
+  borrowableKinds(slug: string): string[];
+  /**
+   * Which config answers for `kind`/`path` — this one, or the source of a linked kind.
+   *
+   * Provenance, resolved per item rather than per kind, and that is the whole point. A borrowed
+   * Entity's own fields were written in its source's namespace: its unqualified `token:color/brand`
+   * means the source's `color/brand`, and its var name carries the source's `cssPrefix`. Interpreting
+   * it against the borrowing config names a custom property nothing sets, and the borrowed component
+   * paints its default with nothing thrown.
+   *
+   * Asking per item is also what makes two links bringing the same kind unambiguous: the answer is the
+   * Config that has the item, so there is no precedence to define and no first-match to depend on.
+   *
+   * Routing only — no entity is built. Every ref rendered into a stylesheet goes through here
+   * ({@link configFor} → `renderStyleValue`), so it walks the snapshot and the declared links and
+   * stops; {@link resolvedIn} is the pair for a caller that wants the item too.
+   *
+   * Recursive, because a source may itself link.
+   */
+  ownerOf(kind: string, path: string): Config | undefined;
+  /**
+   * The item at `kind`/`path` and the config that answered for it.
+   *
+   * Every read that cares where an item came from goes through here, because the two halves must not be
+   * chosen separately: a caller that resolved the item here and then interpreted it against a config of
+   * its own choosing gets a plausible wrong answer whenever those differ — a borrowed token carries the
+   * source's `cssPrefix`, and a borrowed entity's unqualified refs name the source's vocabulary.
+   *
+   * {@link ownerOf} picks the config; this builds the item there. Split so the routing can be asked for
+   * on its own, and so the two can never disagree about who answers.
+   */
+  private resolvedIn;
+  /**
+   * The path a bare leaf names, for a kind that declares {@link EntityKind.uniqueLeaves}. `undefined`
+   * for any other kind, for a leaf nothing holds, or for a name that already carries a slash.
+   */
+  leafPath(kind: string, leaf: string): string | undefined;
+  /**
+   * Every spelling an edge to `kind:path` may carry: the path itself, and for a kind with unique
+   * leaves the bare leaf, since a name-borne edge (`modifier:dark`) is minted from a bag key that
+   * cannot spell the path. Read wherever the index is asked who points at an entity.
+   */
+  private refAliases;
+  /** Who points at `kind:path`, under every spelling {@link refAliases} admits. */
+  private referrersOf;
+  /** The path an item read addresses. A singleton has one item, at the kind's own name, so any path
+   *  a ref spells is a path INTO it and the item is what resolves; {@link valueAt} reads the rest. */
+  private itemPath;
+  /**
+   * The value a ref addresses, member path included: an item's whole body, one member of a keyed
+   * collection (`component:Button#props/gap`), or a field of a singleton's one item spelled as the path
+   * (`settings:css/prefix`, `settings:css`). A qualified ref reads through its source. `undefined` when
+   * nothing is there.
+   */
+  valueAt(target: string | Ref): unknown;
+  /** The item this config stores or derives at `kind`/`path`, with no routing — {@link ownerOf} has
+   *  already chosen who answers, so this must not delegate or the two would recurse into each other. */
+  private storedEntity;
+  /**
+   * A stored entity, with its kind's {@link ComputedFields} evaluated against this config.
+   *
+   * A stored `Entity` is built when the snapshot changes, so it holds no config and can't compute
+   * anything itself. The config it lives in is only known at read time, which is here.
+   *
+   * **Memoized, because entity reads are reference-stable and code depends on it.** `Component.get`
+   * returning a fresh instance per call would put a new value in every dep array that holds one, which
+   * is the same failure a derivation inside a zustand selector causes, arriving from the other
+   * direction. Keyed on the snapshot rather than the config instance: a config is a value, so a cache
+   * living on one would be discarded by the next `apply`, where a snapshot survives every derivation
+   * that didn't change the data.
+   *
+   * The snapshot alone isn't the whole key, because two configs can share one and still disagree on a
+   * computed — attaching a linked source derives a new config over the same data, which is what flips a
+   * Token's `link` from unresolved to resolved. So it shares {@link cachesFor}'s bucket, which adds the
+   * attached sources by identity. Keyed on slug names, re-pointing a slug at a newer source under the
+   * same name would look like nothing changed, and a computed reading through that source would serve
+   * the pre-swap answer for the rest of the session.
+   *
+   * A kind that declares no computeds is handed straight back, so the common path allocates nothing.
+   */
+  private withComputed;
+  /**
+   * Attach loaded sources, in the shape everything else names them in — keyed by the source kind's
+   * accessor name, then by the item's slug:
+   *
+   * ```ts
+   * Config.registerSources({ linkedSystems: { yos: yahooOs } })
+   * ```
+   *
+   * The same two levels `register` takes (`{ linkedSystems: { yos: LinkedSystem.item(…) } }`) and the
+   * same two `fromJSON(json, { sources })` takes, so one gesture — declare a source, then hand
+   * over what it resolved to — reads identically at all three. A flat `{ yos }` said nothing about
+   * which collection `yos` came from, which is fine while `linked-system` is the only source kind and
+   * wrong the day there is a second.
+   *
+   * Immutable like every other authoring step: the sources ride on the derived config, and every later
+   * `apply` carries them along.
+   *
+   * Prefer `fromJSON(json, { sources })` when hydrating: attaching after hydration leaves a window
+   * in which every sourced ref dangles, and the emitters and integrity checks read exactly there.
+   */
+  registerSources(sources: AttachedSources): this;
+  private assertSlugIsNotOwnName;
+  /**
+   * Every attached source, ordered by slug — the memo key for any derivation that can reach a borrowed
+   * value (`memo.ts`). A source's entities are in the source's snapshot, so nothing about swapping one
+   * shows up in this config's slices.
+   */
+  attachedSources(): readonly Config[];
+  /**
+   * The source behind a link slug — attached if one is, otherwise the closure this config recorded.
+   *
+   * What a reader asking "can I read this value" wants, and it should not have to care which it got:
+   * a recorded closure is a config, so the ordinary chase walks it and a borrowed alias resolves
+   * inside it exactly as it would inside the live source.
+   *
+   * A reader asking "is a real source attached right now" wants {@link liveSourceFor} instead, and
+   * four do — the incremental CSS delta (which compares by reference), the emitted path unions (which
+   * must not narrow to paths already used), the dangling-ref check (whose whole subject is the seam
+   * where the other side can change without us), and the Create badges.
+   */
+  sourceFor(slug: string): Config | undefined;
+  /** This config's own answer for a slug — attached, else the closure it recorded. No hop, which is
+   *  what makes it the base case {@link sourceThrough} recurses over. */
+  private ownSourceFor;
+  /**
+   * A slug this config doesn't declare, answered by a source that does.
+   *
+   * It exists for a published chain two deep. Materializing keeps a ref whose target has no value to
+   * collapse into — a `style-property`, a component's `file` — so a component borrowed from `mid`
+   * arrives in `top` still spelling `style-property:bg@base`, where `base` is a pin only `mid` declared.
+   * `top` has no way to name it, because the slug belongs to the system that wrote the ref. Answering
+   * `undefined` makes the ref unresolvable, which surfaces as `Cannot inline "style-property:bg@base"`
+   * and takes the whole publish down. Depth one works only because there the slug is the consumer's own.
+   *
+   * Read the way {@link configFor} already describes resolution: it hops configs, each answering for
+   * the links it declares. This is the same hop for the source address rather than the entity.
+   *
+   * Local first, always. {@link sourceFor} tries {@link ownSourceFor} before reaching here, so a config
+   * that declares `base` itself keeps meaning its own, and a diamond resolves through the pin its owner
+   * wrote.
+   *
+   * Memoized per instance including the misses: a dangling sourced ref is read repeatedly, since
+   * `list`, `sourceClosure` and `toJSON` all pass over it, and each miss would otherwise re-walk every
+   * source.
+   */
+  private sourceThrough;
+  private throughCache?;
+  /**
+   * One level of {@link sourceThrough}'s search, then the same again through whatever answered.
+   *
+   * `seen` guards against a walk that never terminates: a derived kind can be sourced from the config
+   * that owns it, so a Config is reachable from itself. It carries configs rather than slugs, because
+   * one slug legitimately names different sources at different depths.
+   *
+   * Keyed off the attachment maps rather than `sourceSlugs()` — a recorded closure holds the entities
+   * its refs reached and no pin items at all, so asking it what it declares answers nothing while its
+   * own recorded closures are right there.
+   */
+  private hopFor;
+  /**
+   * Record what each source resolved to. Immutable like every other authoring step, and carried by
+   * reference through `derive` — an edit does not change what a source resolved to.
+   *
+   * Internal to {@link Config.load}: a state is an answer a resolver gave, so there is no legitimate
+   * reason for a caller to assert one without having resolved it.
+   */
+  protected withSourceStates(states: ReadonlyMap<string, SourceState>): this;
+  /**
+   * What every resolved source resolved to, by slug.
+   *
+   * Empty for a config hydrated by plain `fromJSON`, which asked nobody — and that is a real third
+   * answer rather than a gap. "Nothing resolved this" is not "a resolver looked and could not", and the
+   * two being the same `undefined` is why one rail says a value "isn't loaded here" when it is loaded
+   * and the ref is simply broken.
+   *
+   * Distinct from the config type's `sources` declaration, which says what it draws on; this says how
+   * that turned out. Distinct again from {@link attachedSources}, which hands back the configs
+   * themselves and answers nothing about the ones that failed to resolve.
+   */
+  sourceStates(): readonly SourceState[];
+  /**
+   * One source's state — the same tagged value its resolver answered with, so nothing maps between
+   * what a resolver said and what a surface reads.
+   *
+   * By slug alone, like {@link sourceFor} and {@link liveSourceFor}, even though the state itself
+   * carries which declared source it came from. A ref spells `@ds` with no room for a collection, so a
+   * second address level here would be a key nothing that resolves a ref could supply — and
+   * {@link assertDistinctSourceSlugs} is what makes one level sufficient rather than merely usual.
+   *
+   * `undefined` means nothing has resolved this slug. See {@link sources} for why that is a third
+   * state and not a missing one.
+   */
+  sourceStatus(slug: string): SourceState | undefined;
+  /**
+   * The one source slug every member of a group draws through — `undefined` when they disagree, and
+   * `undefined` for an empty group.
+   *
+   * The same rule {@link Entity.source} applies across an item's fields, applied across a group's
+   * members: a group is a display convenience over member paths, not a thing that can itself be
+   * borrowed, so "this group is borrowed" can only mean "all of it is". One local member makes it
+   * mixed, and a mixed group answers `undefined` — its editor stays editable, because one of its rows
+   * is. Members split across two sources answer `undefined` too, because naming either would label the
+   * other's rows wrongly.
+   *
+   * Answers the slug, which is the kind-agnostic half and therefore the half that belongs here. Turning
+   * a slug into the typed pin behind it is the source kind's own business (`sourceOfGroup` beside
+   * `LinkedSystem`) — a `Config` method could only hand back a bare `Entity`, and the rule above would
+   * then be stated once per source kind instead of once.
+   */
+  groupSource({
+    kind,
+    groupPath
+  }: {
+    kind: string;
+    groupPath: string;
+  }): string | undefined;
+  /**
+   * The one source every member of a group is borrowed from — `undefined` when they disagree, when any
+   * member is this config's own, and for an empty group.
+   *
+   * {@link groupSource} applied to the other provenance question, so the agreement rule is stated once
+   * for both. The pair splits the way `Entity.source` and `Entity.borrowedFrom` do: a folder whose
+   * members all point at another system is worth adorning, while a folder whose members all are another
+   * System's is the one where adding, renaming and reordering belong to somebody else.
+   */
+  groupBorrowedFrom({
+    kind,
+    groupPath
+  }: {
+    kind: string;
+    groupPath: string;
+  }): string | undefined;
+  /** The slug a linked folder records on its own body (`ref`), or `undefined` for a folder of this
+   *  config's own. */
+  private recordedGroupSource;
+  /** The rule both group-level provenance reads follow — one dissenting or local member and there is
+   *  no answer. Private because the two public readers above are the questions worth asking. */
+  private agreedAcrossMembers;
+  /**
+   * Every item this config stores for a kind, as authored — the body before resolution.
+   *
+   * The counterpart to {@link list}, and the right subject for anything asking what this config claims
+   * rather than what it currently reads as. Resolution is lossy in both directions for that question:
+   * an extension whose base cannot be found resolves to nothing and drops out of `list` entirely, while
+   * one that can be found resolves to its source's fields merged in — so a resolved body carries refs
+   * this config never wrote, through slugs it never declared.
+   *
+   * Groups are not included. A group node holds metadata, not values, and every caller here is asking
+   * about the things that point somewhere.
+   */
+  authoredItems(kind: string): {
+    path: string;
+    body: Record<string, unknown>;
+  }[];
+  /**
+   * The slug whose bulk-take declaration still covers this path — `undefined` when none does.
+   *
+   * Two questions, and both have to answer yes. The entity has to be a borrow, stored as a pointer into
+   * a source ({@link borrowedFrom}): a declaration says what was taken from someone else and reaches
+   * nothing this config authored, so gating on the kind alone would refuse you your own tokens the
+   * moment you took that kind wholesale. And the source's pin has to still cover the path the pointer
+   * names, which only the pin's kind can say — where it records a take, how it keys it, and which kinds
+   * a whole-source take doesn't extend to are all facts about that kind
+   * ({@link EntityKind.bulkAdopts}).
+   *
+   * Matched on the path the source spells rather than the local one, because that's what a declaration
+   * names: `to` lets a borrow sit under a name of your own, and a list matched against the local name
+   * would cover nothing for exactly those.
+   *
+   * A pointer is the only borrow shape this can see. A `scope: 'value'` borrow stores the source's ref
+   * in the primary field, which is byte-for-byte what a local entity pointing at a borrowed value
+   * stores, so refusing on that shape would lock a pointer we declared. See `borrowedSlug`.
+   */
+  /**
+   * The pin whose `link` declaration covers `kind:path` and whose source has a row there, so the build
+   * mints the source's row at the path on its next pass. `undefined` when no declaration covers the
+   * path, or the declaring source is attached and lacks it. A source that isn't attached is taken at
+   * its declaration's word.
+   */
+  private declaringSource;
+  /** Whether the pin at `slug` declares the source's `kind:path`, read off the stored pin alone. */
+  private declarationAdopts;
+  private adoptingSource;
+  /**
+   * What the declared source at `slug` lays over one of its entities, or `undefined` where it says
+   * nothing about that path. The narrow half of {@link Config.sourceDirective}, for the readers whose
+   * subject is the overlay rather than whether a row is minted at all.
+   */
+  sourceOverlay(slug: string, kind: string, path: string): SourceOverlay | undefined;
+  /**
+   * The field-path delta that records `overlay` as the pin's directive for one path, or `null` when
+   * there is nothing to write.
+   *
+   * An overlay with nothing in it is cleared rather than written: the pin refuses an empty entry, and
+   * a path it says nothing about is the plain adopted row this edit has just made it again. Clearing
+   * the last entry the pin holds removes `options` altogether, so the pin reads as it was authored,
+   * and clearing an entry that was never there is a no-op rather than a recorded patch.
+   */
+  private directiveWrite;
+  /**
+   * Every path a declared source's declaration says something about, with the accessor resolved to the
+   * kind it addresses — `kind: undefined` where this config has no kind under that accessor.
+   *
+   * The inverse of every other read here. Those answer for a path you already hold, so they are asked
+   * while walking something that exists; this enumerates what was written, which is the only direction
+   * that can see an entry aimed at a path or an accessor that is not there. Asked of the kind
+   * ({@link EntityKind.bulkDirectives}), for the reason the rest are: the field is the kind's.
+   */
+  sourceDirectives(slug: string): {
+    kind: string | undefined;
+    accessor: string;
+    path: string;
+  }[];
+  /**
+   * Whether one of a declared source's paths is adopted here — covered by the pin's `link`.
+   *
+   * The question a spelling turns on: an adopted path is addressed bare, because the build mints a
+   * row for it at the path the source spells, and everything else is addressed qualified. The two are
+   * exclusive, which is what keeps one entity from having two names.
+   */
+  sourceStance(slug: string, kind: string, path: string): {
+    adopted: boolean;
+  };
+  /**
+   * Whether the entity at `path` — an item or a group node — is kept but no longer offered.
+   *
+   * An authoring question, not a resolution one. The entity is still here and still resolves, because
+   * references already going through it have to keep working — so nothing that emits a *value* reads
+   * this. What does: a surface that lists paths for someone to pick from, and the emitted type union,
+   * which is exactly such a list.
+   *
+   * True when the entity's own body says `hidden`, when any folder above it does, or when the pin a
+   * borrowed row came through hides its path. A folder's flag reaches every member without the members
+   * being rewritten, so un-hiding the folder is one write. Asked by local path, which for an inherited
+   * row is the path the source spells.
+   */
+  hidden(kind: string, path: string): boolean;
+  /**
+   * Whether the entity at `path` — an item or a group node — is withdrawn from new work.
+   *
+   * Everything {@link hidden} is, and then every existing use is something to flag: a value bound to a
+   * deprecated token, an instance of a deprecated component, a build warning per reference. Same shape
+   * as `hidden` — the body, or any folder above it — minus the pin case, since deprecation is a fact
+   * about the entity rather than about a borrow. A borrowed row reads its source's flag through its
+   * resolved body.
+   */
+  deprecated(kind: string, path: string): boolean;
+  /**
+   * Whether the entity at `path` is retired short of deletion — {@link hidden} or {@link deprecated}.
+   * The one read a surface choosing a NEW value filters on: a picker, an autocomplete, a prompt
+   * catalogue. A surface showing an EXISTING value does not ask, since a value already bound keeps
+   * rendering whatever its entity's state.
+   */
+  retired(kind: string, path: string): boolean;
+  /** {@link hidden} and {@link deprecated} share one walk: the node at the path, then each folder
+   *  above it, nearest first. */
+  private flagged;
+  /**
+   * One node's own answer, with no walk: its resolved body, and for `hidden` the directive the pin lays
+   * over a borrowed row or a borrowed group. A path that is both an item and a folder (a component
+   * holding its parts) answers as the item; its group node has no body of its own.
+   */
+  private flagAt;
+  /** {@link groups} keyed by path, cached beside it. */
+  private groupIndex;
+  /**
+   * What the declared source at `slug` says about one of the source's paths: whether its `link` claims
+   * it, and what it lays over the entity.
+   *
+   * Asked of the kind ({@link EntityKind.bulkAdopts} / {@link EntityKind.bulkOverlay}) rather than read
+   * off a field here: the framework does not know the pin's vocabulary, and a second reader of the
+   * same field is a second thing to keep in step.
+   */
+  private sourceDirective;
+  /**
+   * One of a source's entity bodies as it reads from here — their fields with their refs qualified
+   * into this namespace, and `undefined` for a path they have nothing at.
+   *
+   * Qualified for the reason {@link extensionBody} qualifies: their body spells its refs the way they
+   * do, locally, and a value spliced into a row of ours without that would name whatever this config
+   * happens to have at the same path. The overlay merge splices exactly one thing — the entries an
+   * `extend` unions onto their array.
+   */
+  private theirBody;
+  /**
+   * The source's entity at `kind:path`, as a body this config could author — what a copy stores.
+   *
+   * Refs into the source are qualified `@slug`, except a target this config names bare: one it
+   * already borrows at the source's own path, or one `alongside` says will be here once the edit
+   * lands — arriving with it, or held already. So a copied token that points at a sibling copied
+   * with it points at the local copy, and one that points at something not taken keeps drawing
+   * through the pin.
+   *
+   * `extend` is the delta a pointer at the path carried, laid over the source's body by the same rule
+   * a derived row's `options` are — so copying a linked row keeps what was written over it here.
+   *
+   * `undefined` when nothing has resolved the slug, or the source has no such entity.
+   */
+  copyOf({
+    slug,
+    kind,
+    path,
+    alongside,
+    extend
+  }: {
+    slug: string;
+    kind: string;
+    path: string; /** `kind:path` targets landing as this config's own in the same edit. */
+    alongside?: ReadonlySet<string>;
+    extend?: Record<string, unknown>;
+  }): Record<string, unknown> | undefined;
+  /**
+   * Whether a copied row no longer matches what its source offers at the path it was copied from.
+   *
+   * `undefined` when the row is not a copy, or its source is not attached — there is nothing to compare
+   * against, which is not the same as matching. `true` when the source has moved on since the copy, or
+   * no longer has the path; also `true` when the copy was edited here, since the row itself cannot say
+   * which side moved. A surface phrases it as "differs from the source" for that reason.
+   */
+  copyDiffers({
+    kind,
+    path
+  }: {
+    kind: string;
+    path: string;
+  }): boolean | undefined;
+  /**
+   * Whether what this config shows at `path` reads the same as what `slug` offers there — what a
+   * source page asks about a row that is yours, or another pin's, before it calls the two a conflict.
+   *
+   * The whole of what shows, not the one body: a component reads through its style properties and
+   * tokens, so every entity the source's row reaches by ref is compared on both sides too, a ref at a
+   * folder by that folder's members. Taking theirs would bring those along, and a match here means
+   * nothing that renders would change.
+   *
+   * `undefined` when nothing is held at the path, the source has no such path, or the source is not
+   * attached. Compares resolved bodies, so a row minted through another pin is read as the values it
+   * shows rather than as the pointer it stores. Refs are compared bare: `token:color/brand@f` and
+   * `token:color/brand@ds` name one path through two pins. A copy's `copiedFrom` mark is provenance,
+   * not a value, and is left out. A dependency this config doesn't hold is a difference: what shows
+   * here can't read the same without it.
+   */
+  matchesSource({
+    slug,
+    kind,
+    path
+  }: {
+    slug: string;
+    kind: string;
+    path: string;
+  }): boolean | undefined;
+  /** The source attached for a slug — `undefined` for one that was only recorded. The narrow question,
+   *  for the readers whose subject is the live link rather than the value behind it. */
+  liveSourceFor(slug: string): Config | undefined;
+  /**
+   * The source an item is borrowed from — set only when this config stores it as a pointer into one,
+   * and `undefined` for an item it authored, however far that item's own fields point.
+   *
+   * Backs the `borrowedFrom` computed the framework installs on every kind, which is how callers read
+   * it (`config.resolve(kind, path)?.borrowedFrom`). A method here because the answer is in the
+   * snapshot rather than in the resolved entity — resolving an extension merges its source's fields in
+   * over the pointer, so by the time a computed sees `member` there is nothing left to read.
+   */
+  borrowedFrom(kind: string, path: string): string | undefined;
+  /**
+   * What this config lays over a borrowed item, beside the source's own body it lays it on —
+   * `undefined` for an item this config authored.
+   *
+   * One answer for both ways an item is borrowed. A row the build minted from a `link` carries the
+   * pin's directive folded into its `extend`, and a row extended by hand carries the delta the author
+   * wrote there; either way the stored body is the pointer plus our fields. The source body is theirs
+   * as it reads from here, refs qualified into this namespace, and `undefined` while the source is
+   * unavailable — every field is then an extension, since nothing says otherwise.
+   */
+  localOverlay(kind: string, path: string): LocalOverlay | undefined;
+  /**
+   * One item's body as stored — the pointer still visible, nothing merged in, and `undefined` for a path
+   * this config doesn't hold.
+   *
+   * The pair to {@link resolve}, and the difference is why both exist. `resolve` answers what the item
+   * is, so an extension comes back as the source's fields under ours, which is what a renderer wants
+   * and is the merge that erases the pointer. This answers what this config wrote, which is what a
+   * caller deciding whether an item is a borrow, and of which shape, has to read. {@link borrowedFrom}
+   * is the narrow question over the same body; this is for a caller that needs the rest of it.
+   *
+   * `groupMeta` is the group half. Named for the stored form rather than "raw", because the distinction
+   * is about the merge and not about parsing: the body has been through the kind's schema.
+   */
+  storedBody(kind: string, path: string): Record<string, unknown> | undefined;
+  /**
+   * This config with every cross-source ref replaced by the value it points at — self-contained, so it
+   * loads with no sources attached.
+   *
+   * What the materialize route runs before handing a published version to a consumer: their artifact may
+   * draw on systems the consumer never pinned and cannot see, and resolving here (with the publisher's
+   * sources) is what makes one entry answer for itself. A chained link resolves all the way to a literal,
+   * and a ref that cannot resolve throws rather than leaving a hole — a partial artifact breaks builds
+   * confusingly later.
+   *
+   * The pins stay. They are not values that inline, and a consumer's tooling still wants them for
+   * attribution and upgrade detection. Breaking a link is deleting the pin, once nothing refers
+   * through it.
+   *
+   * Local refs are untouched — the point is to remove dependence on other systems, not to flatten this
+   * one into literals.
+   */
+  withInlinedSources(options?: InlineOptions): this;
+  /** @internal Turn extensions through the selected source into ordinary complete local items.
+   *
+   * Used by source materialization before it walks nested refs. A component cannot
+   * collapse to one scalar value the way a token ref can, so its extension is flattened as the
+   * complete resolved entity instead. That makes a published B→A component extension self-contained
+   * when C installs B: C receives B's component and render source, and never needs permission to A.
+   *
+   * `only` narrows to one item. It has to come through here rather than being done by the caller,
+   * because the enumeration is over stored bodies — an extension is only visible before it resolves,
+   * and `list` hands back the merge.
+   *
+   * Each one goes through `apply` as a `replace`. Writing the snapshot directly would produce no
+   * patch, so the dissolve would be invisible to replay: an undo or a rebase would re-apply a
+   * flattening `update` onto the envelope it was supposed to have removed, put the value back inside
+   * `extend`, and then refuse to drop the pin because the extension still referenced it. `replace`
+   * makes a dissolve an ordinary recorded edit, so it survives being replayed. */
+  withMaterializedExtensions({
+    slug,
+    only
+  }?: {
+    slug?: string;
+    only?: {
+      kind: string;
+      path: string;
+    };
+  }): this;
+  /**
+   * The config a ref resolves in — this one for a local ref or a ref qualified with this config's own
+   * {@link name}, the linked source for any other qualified one.
+   *
+   * `undefined` means the ref names a source this config can't reach: either the link isn't declared
+   * or it was declared and never loaded. That is deliberately not the same as falling back to
+   * ourselves. Resolving `token:color/brand@yahoo-os` against our own `color/brand` would hand back
+   * a plausible wrong value with nothing to signal it — the exact confusion between your key and
+   * their key that qualified refs exist to prevent.
+   *
+   * The own-name case is the one exception, because it is not a fallback: a canvas attaches the one
+   * system it draws from under that system's `name`, so the refs it mints
+   * (`component:actions/Button@system-config`) are addressed to whichever system is attached. The
+   * name is the config type's, shared by every `System`, which is why "the attached one" is all it
+   * can mean. Handed to the system itself, such a ref resolves there. A source that was hydrated
+   * under that slug still answers first, so an artifact written before the name was reserved keeps
+   * its meaning; {@link assertDistinctSourceSlugs} refuses authoring a new one.
+   */
+  configFor(target: string | Ref): Config | undefined;
+  /** One ref, resolved wherever it points — the source hop plus an ordinary `resolve`, so a caller
+   *  following a ref never splits one apart or decides which config to ask. */
+  resolveRef(target: string | Ref): Entity | undefined;
+  /**
+   * What a person calls whatever `target` names: the resolved entity's
+   * {@link Entity.displayLabel} (its authored `label`, else its leaf). A
+   * `#member` reads as the member's own leaf (`gap` for `props/gap`), and a
+   * name that resolves to nothing — a bare intrinsic tag, a glyph the config
+   * never registered, a deleted component — as the leaf of its path. Never a
+   * `kind:` marker, which no person should read.
+   */
+  displayLabelOf(target: string | Ref): string;
+  /**
+   * The `data` schema for a mutation `verb`, narrowed to one target entity — the same per-owner
+   * schema `apply` validates against (a factory input like a style rule's `when`/`layers` builds
+   * itself from the resolved parent), emitted as JSON Schema for a form to render. A tool's
+   * advertised input stays owner-agnostic (no `path` chosen yet); this is for a form that already
+   * knows its target. `undefined` when the verb carries no `data`, or the target doesn't resolve.
+   */
+  contextualDataSchema(kind: string, path: string, verb: string): Record<string, unknown> | undefined;
+  /**
+   * Validate a `data` payload against that same per-owner schema — the write-time check `apply`
+   * runs, minus the mutation. `[]` = valid; otherwise `path: message` lines. Lets a preview form
+   * flag exactly what `apply` would reject, before anything is sent.
+   */
+  validateData(kind: string, path: string, verb: string, data: unknown): string[];
+  /** What a body's collection members would be refused for, as `field.key.path: message` lines —
+   *  the per-owner check a strict {@link normalizeMembers} throws, collected instead. */
+  private memberIssues;
+  /** Emergent membership: the items whose path sits under a group prefix. Never stored. Reads
+   *  through `list`, so a linked kind's members come from its source. */
+  members(kind: string, groupPath: string): Entity[];
+  /**
+   * A kind's groups — the union of the two ways one can exist.
+   *
+   * A group's membership is emergent: `spacing/sm` puts `spacing` on this list whether or not anything
+   * wrote a body for it. A group's body is stored, so a group someone just made and hasn't filled is on
+   * this list too. Listing only the stored bodies hides every group nobody has labelled, including —
+   * after a rename moved its members — the group they moved to.
+   *
+   * Every prefix level with members counts, so `spectrum/brand` is a group in its own right next to
+   * `spectrum`, **unless there is an item at that path**. That exception keeps a component's parts from
+   * turning their owner into a folder: `Select/Trigger` is a part of `Select` because it is named that
+   * way, and `Select` is a component rather than a group containing one. A prefix is a group only when
+   * nothing occupies it.
+   *
+   * **The stored record is the authority for order.** Bodied groups come first, in its key order, which
+   * is what `reorder` rewrites, and body-less ones follow, positioned by where their first member sits
+   * in the item record. So a body-less group can't be reordered until something gives it a body, which
+   * is a gap rather than an intended rule.
+   */
+  /**
+   * A group's metadata, with what the source says about the group inherited from it and any
+   * directive the pin lays over this path folded in.
+   *
+   * The source's group node arrives whole, minus the fields the kind declares as its own
+   * ({@link EntityKind.localGroupFields}). The split is what a field is ABOUT: `variants` and `sizes`
+   * describe the icon library, so a consumer that borrows it needs them — `primitives/Icon` declares
+   * its `variant` prop's domain as `icon:<slug>#variants`, which is read off this node, and without
+   * it the ref resolves to nothing and the build refuses. `cssPrefix` describes how a config emits,
+   * and a borrowed component's classes carry the consumer's prefix, so inheriting the source's would
+   * name classes this stylesheet doesn't contain.
+   *
+   * Asked of the kind rather than named here, so a kind whose group node carries facts about the
+   * group is described by this rather than flattened to the two fields every kind happens to share.
+   *
+   * A directive at this path — from `options`, or from `applyGroupUpdate`'s redirect off a minted
+   * body — lays over what inherits, the same order an item's `extend` lays over its source fields.
+   * Anything the stored body itself still sets wins over both: a hand-linked group (no `link`
+   * declaration behind it) keeps writing its own body, and this is where that read wins.
+   */
+  private withInheritedGroupMeta;
+  /** Every group node of a kind, total by default; `{ retired: false }` leaves out retired folders,
+   *  the same way {@link list} leaves out retired items. */
+  groups(kind: string, opts?: ListOptions): {
+    path: string;
+    meta: Record<string, unknown>;
+  }[];
+  /** The total list behind {@link groups}. */
+  private allGroupsOf;
+  /**
+   * The walk behind {@link groups}. Per call it reads every stored group's inherited meta through its
+   * source and splits every item's path for emergent folders, so a consumer with borrowed groups pays
+   * the source's own walk once per group — which is why the answer is cached per snapshot above.
+   */
+  private computeGroups;
+  groupMeta(kind: string, groupPath: string): Record<string, unknown> | undefined;
+  /** The kinds this config surfaces for reading — its own kinds with items, plus its derived ones.
+   *  The top level of a UI tree. A source's kinds are not here: they are read through a qualified
+   *  ref, so they belong to the config that answers for them. */
+  kinds(): string[];
+  /** The kinds this config derives (computed, read-only) via `defineDerivedEntity`. */
+  derivedKinds(): string[];
+  /** Re-attach `other`'s derived kinds onto this config — the derived twin of `relinkFrom`. A
+   *  self-sourced kind rebinds to this config (so a clone's members reflect the clone); an
+   *  externally-sourced one keeps pointing at its original source. Used after `fromJSON` on a clone. */
+  rederiveFrom(other: Config): this;
+  /**
+   * The accessor each kind is registered under (`tokens` → the Token kind) — the one mapping a write
+   * back into authored source needs, because a patch names the kind while the source names the
+   * accessor.
+   *
+   * Read off the config type's own `entities` manifest, which `defineConfig` installs as a static.
+   * Here rather than at each call site: every writer needs it, and reaching for the constructor is a
+   * cast each of them would otherwise repeat.
+   */
+  accessors(): Record<string, {
+    kind: string;
+  }>;
+  /** The kinds registered into this config — what it owns, whether or not they hold items yet.
+   *  Tool derivation (reads + mutations) scopes to these so a config only exposes its own kinds
+   *  (a source's kinds are read through their own config, so they derive none). */
+  ownedKinds(): string[];
+  /**
+   * What this config reaches inside `slug`'s source, transitively — as qualified `kind:path` targets.
+   *
+   * Seeded two ways, and both are floors rather than filters. From the sourced refs this config
+   * spells, then closed over each target's own refs inside the source, because their entity may alias
+   * another of theirs. And from what the pin declares it took ({@link adoptedFrom}) — a surface
+   * saying "every token" is describing entities no ref has landed on yet, and a closure that carried
+   * only the reached ones would leave those rows absent from the artifact. Reachability stays the
+   * floor either way, so a ref always brings its target whether or not a declaration claims it.
+   *
+   * Shared rather than computed per caller: the CSS emitter needs it to know what to declare, and the
+   * build's validation needs the same set to know what to check — two answers to that question would
+   * drift, and the drift would look like a token that emits but isn't validated.
+   *
+   * `kind` narrows it for a caller that emits or validates one kind, which is the caller's business
+   * to name; the walk itself follows refs wherever they go, so borrowing something other than a token
+   * is reached rather than silently dropped.
+   *
+   * Sorted, so anything built from it is deterministic.
+   */
+  sourceClosure(slug: string, kind?: string): string[];
+  /**
+   * The walk behind {@link sourceClosure}, run once per snapshot and source set.
+   *
+   * Memoized because it is asked repeatedly of one config and is O(every entity): the CSS emit asks
+   * per kind, the artifact walk asks per slug, and the row derivation asks again — three full passes
+   * over a config that is routinely megabytes, for one answer that cannot change while the snapshot
+   * and its sources are fixed.
+   */
+  private computeSourceClosure;
+  /**
+   * A refusal for a pin patch whose derive pass would retire a minted row that something authored
+   * here still points at. A minted row has no body of its own, so once it goes the referrer dangles;
+   * copying what is used, or breaking the link with `keep`, is how the value stays.
+   */
+  private assertDerivedDropsUnreferenced;
+  /**
+   * This config with a row for every entity it inherits — the build's output. A pin patch runs this
+   * inside {@link apply}; a source attaching runs it through the session.
+   *
+   * A link declares a source and what it took from it; everything that arrives is derived here, one
+   * pointer per entity at the path the source spells it, marked ({@link minted}). So authored source
+   * carries a declaration rather than a copy — linking one system into another would otherwise write
+   * 2,674 rows by hand — while everything downstream still reads a stored row: `list`, the pickers, the
+   * rename gate, `inlineAllSources` and the emitters are untouched, because a derived row is a stored
+   * row by the time any of them run.
+   *
+   * The set is {@link adoptedFrom} — what the pin adopts. Not
+   * {@link sourceClosure}, which is that plus whatever this config's refs happen to reach: a ref
+   * already resolves qualified, so minting a bare row for it gives one entity two spellings, and which
+   * one you get depends on what some unrelated file happened to reference. Adoption is a declaration,
+   * and the rows follow it.
+   *
+   * The folders standing above a derived item come with it — a var name carries its group's
+   * `cssPrefix`, so a leaf without its folder emits a custom property nothing declares.
+   *
+   * **A path this config already holds is left alone, silently.** Local shadows a source, whether the
+   * local row is authored, borrowed by hand, or derived by an earlier pass — which is what makes this
+   * idempotent and makes re-running it after a source grows additive.
+   *
+   * Only slugs this config pins derive rows. A slug reached through a borrowed entity names a third
+   * system's namespace, which this config has no `@slug` for and no claim on.
+   */
+  withDerivedRows(): this;
+  /**
+   * Whether the snapshot already stores exactly the row a derive pass would write at this path.
+   *
+   * A minted row is recomputed on every pass, so the plan names every inherited entity whether or not
+   * anything about it moved. Writing an unchanged row would still mint a new config, and a session
+   * derives on every publish — so on a linked branch every edit, and every holder keyed on the
+   * config's identity, would see a fresh value for a snapshot that says the same thing.
+   */
+  private holdsDerivedRow;
+  /**
+   * The paths two or more sources both offer and this config has not settled — `kind:path` with the
+   * slugs that wanted it.
+   *
+   * Local shadows a source silently, and that is what makes re-deriving additive: a row you authored
+   * wins and nothing is lost, because you said what you meant. Two *sources* offering one path is a
+   * different question with no such answer — deciding it by pin order would make which vendor's
+   * `actions/Button` you got depend on the order links happen to sit in, and nothing would look wrong.
+   *
+   * So neither derives, and this names them. The way out is an authored row at that path extending the
+   * one you meant, which settles it as an ordinary local shadow and is reviewable in a diff.
+   */
+  collidingSources(): {
+    kind: string;
+    path: string;
+    slugs: string[];
+  }[];
+  /**
+   * The derivation made for the snapshot this one came from, when this edit could not have changed
+   * it: the same sources, no change to a pin or to which paths exist, and every row that did change
+   * is authored on both sides with the same source-qualified refs and the same style-bag keys —
+   * which is all {@link groupRefMembers} reads off an authored body. A value edit on an authored row
+   * is the common case and passes.
+   *
+   * A session derives on every publish, so on a linked branch every keystroke redoes the walk
+   * otherwise.
+   */
+  private inheritedDerivation;
+  /**
+   * Same paths in the same order, and every row that changed is authored on both sides and reaches
+   * the same sources the same way — see {@link inheritedDerivation}. Order counts because the walk
+   * visits rows in stored order and mints in the order it reaches them, and key order is meaning
+   * downstream.
+   */
+  private sameRowsForDerivation;
+  /**
+   * What the row derivation reads off an authored body, as one comparable string: the refs that
+   * name a source, and the style-bag keys (a bag's keys name style properties a source may declare).
+   */
+  private derivationFacts;
+  /**
+   * The derivation, run once per snapshot and source set — {@link withDerivedRows} takes the changes
+   * and {@link collidingSources} takes what it refused to decide.
+   *
+   * One walk rather than two, because the two answers come from the same pass and a second walk is a
+   * second chance to disagree about which source claimed a path.
+   */
+  private rowDerivation;
+  /**
+   * The targets inside `slug` this config already RE-aliases — `kind:path` in the source's namespace,
+   * under a local name of its own rather than the source's.
+   *
+   * Entity-level pointers only, which is the borrow that moves an entity here. A value borrow leaves
+   * the entity theirs and points a row of ours at what it is worth, so their path is still free and a
+   * derived row there is the ordinary inheritance rather than a duplicate.
+   *
+   * A row this same declaration derived is never a re-alias — {@link derivedItemChange} always points
+   * a target at its own path, so excluding it here is what lets {@link rowDerivation} re-derive one
+   * rather than reading its presence as somebody's chosen alias.
+   *
+   * Also what the emitted types qualify: `Token.ref('x@ds')` is spelled in authored source to extend
+   * an entity you hold, so the qualified name is worth typing for exactly these and not for the rest
+   * of a source's catalogue.
+   */
+  borrowedTargets(slug: string): Set<string>;
+  /**
+   * Everything `slug`'s pin declares this system took, as `kind:path` targets in the source's own
+   * namespace — the second seed {@link sourceClosure} closes over.
+   *
+   * The declaration lives on the pin and only that kind knows how to read it, so this asks per
+   * candidate ({@link EntityKind.bulkAdopts}) rather than interpreting the field here. Candidates are
+   * what the source offers and this config could hold ({@link borrowableKinds}), which is what keeps a
+   * whole-source take to design entities instead of reaching the source's own pins and sealed files.
+   *
+   * Empty for a pin that declares nothing, which is the ordinary case — so a config that borrowed by
+   * hand enumerates no catalogue.
+   *
+   * Public because it is the half of {@link sourceClosure} that stands on its own: a row the pin
+   * declares is there whatever this config's refs do, where a row seeded by reachability exists
+   * because of the very ref asking about it. {@link redundantQualifiers} needs that distinction.
+   */
+  /**
+   * What the rows drawn through `slug` depend on: the members of a source GROUP something here names,
+   * and every entity a LINKED row points at, walked to a fixpoint.
+   *
+   * A linked row's dependencies land as rows of their own, so everything a link needs has a path in
+   * this system, the way a copy writes every one of them. A ref this config wrote by hand at the
+   * source (`Token.ref('x@ds')`) brings a folder's members but not an item: the ref already reaches
+   * the value, and a row minted for it would be that value under a second spelling.
+   *
+   * A ref may name a folder rather than an entity: `primitives/Text` binds its `variant` prop to
+   * `composite:textVariant`, and a style property's `values: [Token.ref(ramp)]` does the same. A
+   * folder has no stored row to borrow, so reachability — which brings what a ref NAMES — brings
+   * nothing, and a config that borrowed one component ended up with a component whose prop domain is
+   * empty and whose emitted module imports a lookup table that was never emitted.
+   *
+   * Taking every member is what makes the two spellings one set: the members land as ordinary rows at
+   * their own paths, so this config emits their rules under ITS prefix and the borrowed module's
+   * import resolves against its own table. A wholesale link already has them, so this adds nothing
+   * there — it is the narrow borrow, which adopts no kinds at all, that has the hole.
+   *
+   * Walked to a fixpoint, because a member may name a folder of its own. That is also what keeps
+   * {@link withDerivedRows} idempotent: a second pass finds every member already held and plans no
+   * change.
+   *
+   * Every guard the adopted targets pass through applies to these too — a name this config already
+   * holds wins, an entry it cannot express is left behind — because
+   * they join the same loop rather than being written directly.
+   */
+  private groupRefMembers;
+  adoptedFrom(slug: string): string[];
+  /**
+   * One source item's identity, from the fields its own kind declares as `sourceIdentity` — what a walk
+   * that must stay kind-blind keys a cache and a cycle check on.
+   *
+   * `undefined` when the kind declares none, or nothing is stored at that path. A declared field the
+   * item does not set contributes an empty segment rather than being skipped: two items differing only
+   * in which fields they set are different sources, and collapsing them would share one cache entry.
+   *
+   * Derived rather than spelled, which is what makes it right for kinds nobody has written — it covers
+   * whatever fields a kind actually declares instead of the three `linked-system` happens to have. The
+   * key it replaces was `${systemId}@${version}`, which a repo-local source cannot state at all;
+   * that is the case the walk using it had to pre-skip.
+   */
+  sourceIdentityKey(kind: string, path: string): string | undefined;
+  private sourceKey;
+  /**
+   * Where what this config shows at `path` originates: the system it was first authored in, followed
+   * through however many pins it took to get here. `undefined` for a row this config authored itself.
+   *
+   * A row borrowed or copied through a pin is asked of that pin's source in turn, so a system linked
+   * to a system linked to a foundation answers with the foundation. A row a materialized artifact
+   * flattened to a literal has no pointer left, so the pin whose `link` declaration covers the path
+   * stands in, provided the row still reads as the source's ({@link matchesSource}); one the
+   * publisher changed is its own. Two answers with one `key` are one entity reached by two routes,
+   * whatever versions the pins name: the key is the pin kind's `sourceOrigin`, not its identity.
+   *
+   * `pin` is the pin entity at the hop where the answer was found, for a surface that names the
+   * origin the way it names any source.
+   */
+  originOf({
+    kind,
+    path
+  }: {
+    kind: string;
+    path: string;
+  }): {
+    key: string;
+    pin: Entity;
+  } | undefined;
+  /**
+   * The pin whose `link` declaration covers `kind:path` while the row there still reads as that
+   * source's: how a row a materialized artifact flattened to a literal is traced back to the pin it
+   * came through. `undefined` when no declaration covers it, or the row differs from the source's.
+   */
+  private declaredThrough;
+  /**
+   * The identity of the source behind a slug — {@link sourceIdentityKey} for a caller holding the
+   * address every source lookup uses.
+   *
+   * A slug is unique across source kinds ({@link assertDistinctSourceSlugs}), so the first kind holding
+   * it is the only one that can, and nothing here has to say which kind that was.
+   *
+   * A client that fetched a catalogue needs to know whether the pin it fetched under is still the same
+   * pin. Comparing slugs alone can't tell a retarget from a no-op, and comparing `systemId`/`version`
+   * names fields one kind happens to declare. `undefined` for a slug this config doesn't pin.
+   */
+  sourceIdentityOf(slug: string): string | undefined;
+  /**
+   * Every slug this config draws a source under — the item paths of every kind declaring
+   * {@link EntityKind.sourceIdentity}, whatever those kinds are called.
+   *
+   * One declaration site is the point: a source's value says both which source and where from, so
+   * nothing has to reconcile two lists.
+   *
+   * Across all source kinds, and that is the right answer rather than a convenience: a ref spells `@ds`
+   * with no room for a collection, so a slug is taken if any source kind has it. Two kinds claiming one
+   * is refused outright ({@link assertDistinctSourceSlugs}), so this never reports a duplicate.
+   */
+  sourceSlugs(): string[];
+  /**
+   * The kinds whose items name an external source — the ones declaring
+   * {@link EntityKind.sourceIdentity}.
+   *
+   * The framework knows borrowing as a mechanism and asks which kind implements it rather than testing
+   * for one by name. A config registering no such kind borrows nothing, and every reader below returns
+   * empty without a special case.
+   */
+  sourceKinds(): string[];
+  /**
+   * The source kind whose declared item is `slug` — asked rather than named, the same reason
+   * {@link sourceKinds} is a list rather than a single kind the framework assumes.
+   *
+   * At most one: a config's slugs are flat and unique across every source kind
+   * ({@link assertDistinctSourceSlugs}), because a ref spells `@ds` with no room for which
+   * collection `ds` came from.
+   */
+  private sourceKindFor;
+  /**
+   * Every source kind by the accessor name its config type declares it under — `linkedSystems` →
+   * `linked-system`.
+   *
+   * The accessor name is what every source-shaped argument is keyed by ({@link AttachedSources},
+   * `register`, `Config.load`'s resolvers), because it's the name an author writes, where the kind is
+   * what the framework indexes items under. Something has to hold the pair, and this is the only place
+   * it needs holding.
+   *
+   * Read structurally off the config type's own manifest, so it names no kind and needs nothing added
+   * per kind. A `Config` built outside `defineConfig` has no manifest, so its source kinds answer under
+   * their kind name, which is the only key such a config has.
+   */
+  /**
+   * The accessor a kind is registered under — `token` → `tokens` — or `undefined` for a config with no
+   * manifest, and for a kind it does not declare.
+   *
+   * Config files are keyed by accessor (`register({ tokens, components })`) while ops and refs are
+   * keyed by kind (`token:color/brand`). Anything stored that a person will read in a config file
+   * therefore wants the accessor, and something has to be able to say which — this is that, read
+   * structurally off the config type's own manifest exactly as {@link sourceAccessors} does, so it
+   * names no kind and needs nothing added per kind.
+   */
+  accessorOf(kind: string): string | undefined;
+  sourceAccessors(): ReadonlyMap<string, string>;
+  /**
+   * Every source this config reaches into, captured as an ordinary artifact — what `toJSON` stores.
+   *
+   * Membership is reachability and nothing else: follow the refs and keep what they land on, whatever
+   * kind it is. No kind opts in and no field is required, which is why a modifier reached through a
+   * Token's condition and a font reached through a typography token both survive. A value-map shape
+   * drops both, and the font is native borrowing's blocker.
+   *
+   * Stored as a config rather than a bag of values, so nothing about reading it is special. Bodies are
+   * verbatim, so each validates against its own kind's schema on the way back in, and groups and
+   * settings ride along so `cssVar` recomputes from the source's own `cssPrefix` instead of being
+   * frozen per entity.
+   *
+   * Away from a build there is nothing attached, so this carries through what was hydrated rather than
+   * blanking it.
+   *
+   * That is sound because a pin is exact: a published version is immutable, and a repo-local pin is
+   * recomputed on every local build. A stale closure would need a source to change under a fixed pin,
+   * which is what a pin prevents.
+   */
+  /**
+   * The closures this config would embed if it were serialized, without serializing it.
+   *
+   * {@link toJSON} already carries them, which is how an artifact keeps its borrowed values readable
+   * when nothing is attached. A caller that wants only the closures — Create's load path, adding a
+   * draft-aware closure to the base artifact a client hydrates — would otherwise pay a full walk over
+   * every entity in a config that is routinely megabytes, to read a few kilobytes off the end.
+   *
+   * The same map `toJSON` embeds, from the same private walk, so the two can't describe a borrow
+   * differently.
+   */
+  recordedSources(): Record<string, RecordedSource>;
+  private recordSources;
+  /**
+   * Every slug this config's refs name, declared here or not — what {@link recordSources} owes a
+   * closure for.
+   *
+   * Declared slugs are only half of it. Materializing a published chain keeps a ref whose target has no
+   * value to collapse into, so a component borrowed from `mid` arrives holding `style-property:bg@base`,
+   * a slug only `mid` declares. Recording only what this config pins leaves that ref with nothing behind
+   * it, and a consumer holding the artifact alone reads a borrowed component whose style property
+   * resolves to nothing.
+   *
+   * Reachability is already what a closure means; this applies the same rule to the source address
+   * rather than the target. {@link sourceThrough} is what answers for such a slug, and the pair is why
+   * the recorded artifact is self-contained.
+   *
+   * Skipped entirely for a config that borrows nothing, so the common serialize walks nothing extra.
+   */
+  private reachedSlugs;
+  /**
+   * Every item of a kind, in authored order — the flat list to map over in a UI. This config's own
+   * kinds only: a source's items are read through a qualified ref, in the config that answers.
+   *
+   * **Memoized on the snapshot, like {@link Config.withComputed}, and for a sharper reason than
+   * convenience.** A value domain is expanded per read (`stylePropEntries` → `members` → here), so
+   * one CSS emit over this system's own artifact asked for the token list 23,895 times and paid 673
+   * `withComputed` lookups each — 16M of them, 1.7s, on the browser's main thread. The list a
+   * Snapshot has of a kind cannot change without the snapshot changing, so there is nothing to
+   * expire.
+   *
+   * The array is shared with every other caller at this snapshot: consume it, don't mutate it. Sort
+   * or splice a projection of it (`list(k).map(…).sort()`), never the list itself.
+   */
+  /**
+   * Every item of a kind. Total by default: the stylesheet, the type union, ref resolution and the rail
+   * all read it, and each has to keep seeing a hidden or deprecated entity. `{ retired: false }` is the
+   * offer surface's read — a picker, an autocomplete, a prompt catalogue — and leaves out every entity
+   * {@link retired} answers true for. Both answers are cached per snapshot, so either is safe in a dep
+   * array.
+   */
+  list(kind: string, opts?: ListOptions): Entity[];
+  /** The total list behind {@link list}. */
+  private allOf;
+  /** A kind's items as a nested folder/file tree, built from the qualified paths at any
+   *  depth (`color/spectrum/purple-60` → folder `color` → folder `color/spectrum` → item). A
+   *  folder carries its group metadata when a node exists at that prefix, else `undefined`
+   *  — folders come from the paths, so they render whether or not they were augmented. */
+  tree(kind: string): TreeNode[];
+  /** Every `kind:path` whose definition references the given entity — the reverse
+   *  dependency graph, harvested generically from refs in each item's data. */
+  dependentsOf(kind: string, path: string, opts?: TraverseOptions): string[];
+  /** The inverse: what `kind:path` needs in order to resolve. `{ transitive: true }` returns the
+   *  whole closure — what a sealed/exported copy would have to carry along with it. */
+  dependenciesOf(kind: string, path: string, opts?: TraverseOptions): string[];
+  /** Validate a create body against the kind's schema — derived from its fields. */
+  validateCreate(kind: string, data: unknown): {
+    ok: true;
+  } | {
+    ok: false;
+    error: string;
+  };
+  /**
+   * The wire form. Annotated with {@link SerializedConfig} rather than defining it by inference —
+   * see that type for why the direction flipped, and why both drift directions still fail to compile.
+   *
+   * Every optional field stays a conditional spread rather than a later assignment: a
+   * `{...(cond ? { k } : {})}` is checked against the annotation as one literal, where assigning to a
+   * mutable object would defeat the excess-property check that replaces the old inference.
+   */
+  toJSON(): SerializedConfig;
+  /** `defineConfig` registers its class here so `Config.fromJSON(json)` can construct the right type
+   *  from `json.name`. */
+  static registerConfigType(name: string, ctor: new () => Config): void;
+  /** Rehydrate a config from its wire form. Untyped escape hatch for generic code that only holds a
+   *  plain `Config` (the ~100 studio patch appliers — all link-less system configs, so they call it
+   *  one-arg). Dispatches on `json.name` to the registered config type, then hydrates. Typed callers
+   *  use the config type's own `fromJSON` static (strict `LinkedSources`). `sources` values
+   *  self-describe their linked kind, so keys are irrelevant here. */
+  static fromJSON(json: StoredConfig, options?: HydrationOptions): Config;
+  /**
+   * Hydrate an artifact with its sources resolved — the async counterpart to {@link fromJSON}.
+   *
+   * `fromJSON` is sync and every environment's fetch is not, which is the whole reason this exists.
+   * Attaching at hydration rather than after is load-bearing: `registerSources` leaves a window in which
+   * every sourced ref dangles, and emitters, integrity checks and memos all read exactly there.
+   *
+   * `sources` is keyed the way every other source-shaped argument is — by the source kind's accessor
+   * name, `{ linkedSystems: resolver }` — so the resolver set, the declaration, and
+   * {@link registerSources} all spell the same key. Each resolver is the kind's own
+   * (`LinkedSystemResolver`), and its answer is validated against the schemas that kind declares.
+   *
+   * Reads the source entities off a throwaway bare parse, resolves them all, then hydrates once with
+   * whatever came back attached. The bare parse is cheap and is what lets a resolver be handed the
+   * Entity — `entity.path` is the slug and every other field is its kind's own, so a config declaring
+   * some other source kind needs nothing added here.
+   *
+   * **Two levels of totality, failing differently.** The resolver map must cover every declared source
+   * kind — a missing key is a programming error, and answering nothing for a kind reads identically to
+   * "this config borrows nothing". Each resolver must then answer for every item of its kind;
+   * `unavailable` is a legal answer, no answer is not.
+   *
+   * Refusing on `unavailable` is the caller's policy, not this method's: a build refuses, an editor
+   * records it and paints it. So this attaches what it got, records every state, and returns.
+   */
+  static load(json: SerializedConfig, options: {
+    readonly sources: Record<string, SourceResolver<never>>;
+  }): Promise<Config>;
+  /**
+   * This config with its declared sources resolved — the authoring-side counterpart to {@link load}.
+   *
+   * `load` is for an artifact, where attaching at hydration is load-bearing: between a bare `fromJSON`
+   * and a later attach every sourced ref dangles, and the emitters and integrity checks read exactly
+   * there. A config that was authored has no such window — it already exists, its sourced refs already
+   * dangle, and the only question is what its pins resolve to. That is the build's shape, and forcing it
+   * through `load` would mean serializing a config the caller is holding just to hydrate it again.
+   *
+   * Same resolvers, same validation, same recorded states, so the two paths cannot disagree about what a
+   * source resolved to.
+   */
+  resolveSources(options: {
+    readonly sources: Record<string, SourceResolver<never>>;
+  }): Promise<this>;
+  /**
+   * Attach one source and record what it resolved to — the incremental counterpart to
+   * {@link resolveSources}.
+   *
+   * A walk answers for every declared pin at once, which is what a build and a page load want. A
+   * surface that fetched a source because someone opened a panel holds one answer about one slug, and
+   * putting that through the walk would mean inventing answers for the others: "as before" for the ones
+   * already attached, and something for the ones nobody has looked at, which turns the third state
+   * ({@link sources}: nobody resolved this) into a verdict. So the incremental case gets its own door.
+   */
+  attachResolved({
+    source,
+    slug,
+    answer
+  }: {
+    readonly source: string;
+    readonly slug: string; /** What a resolver — or the server action standing in for one — answered about this slug. */
+    readonly answer: SourceAnswer;
+  }): this;
+  /**
+   * This config with another's live attachments and receipts carried across — minus any whose pin moved.
+   *
+   * **A rebuild from bytes loses every attachment.** A payload is bytes and an attached source isn't in
+   * them, so `fromJSON` hands back a config with nothing attached, and every holder that rehydrates — a
+   * realtime echo, a draft sync, a tab-switch true-up, a rebase — wipes a catalogue someone just
+   * fetched. It looks like this: link a system, watch its catalogue fill in, then watch the panel revert
+   * to "their values aren't loaded here yet" with no interaction. Nothing errors and the pin is still
+   * there; only the attachment is gone, and with it every borrowed read.
+   *
+   * The receipts ride along for the same reason. They are what a rail reads to say why a pin is unmet,
+   * and rebuilding without them turns "we looked and it failed" back into "nobody looked".
+   *
+   * Carried per slug, and only where the pin still names the same source, judged by the fields the kind
+   * declares as its identity ({@link sourceIdentityOf}). A pin retargeted to another version is a
+   * different source, and carrying its catalogue would have the picker offering the old version's
+   * Entities under the new pin's name.
+   *
+   * It never overwrites — a caller that hydrated with sources of its own keeps them — and returns the
+   * receiver unchanged when there is nothing to carry, so the ordinary path allocates nothing and
+   * callers can compare by reference.
+   */
+  withAttachmentsFrom(previous: Config): this;
+  /**
+   * Retire the attachment for every slug a walk answered `unavailable` for.
+   *
+   * A resolve walk is total over the declared items of a source kind — `unavailable` is a legal answer
+   * and silence is not — so what it reports is the whole truth about those slugs rather than an
+   * amendment to what was attached before. {@link registerSources} only ever sets, which is right for
+   * the incremental case, attaching one source someone just fetched, and wrong for an answer that
+   */
+  private detachUnresolved;
+  /**
+   * The resolve walk {@link load} and {@link resolveSources} share — declared sources in, the states
+   * they answered with and the configs to attach out.
+   *
+   * Static and taking its config, because `load` runs it against a throwaway bare parse while
+   * `resolveSources` runs it against the config the caller already holds.
+   */
+  private static resolveDeclared;
+  /**
+   * One source kind's resolution schema, from what the kind declared — the framework's `status` tag over
+   * its own `{ resolved, unavailable }`.
+   *
+   * A separate step so the refusal reads as a declaration problem rather than as a validation failure on
+   * whatever the first resolver happened to answer. `defineConfig` already refuses a `sources` entry whose
+   * kind declares none, so reaching this throw means a kind was resolved through some other route.
+   */
+  private static resolutionSchemaOf;
+  /** The shared hydration path both the untyped dispatcher and a config type's typed `fromJSON` funnel
+   *  through. The instance is freshly constructed by a config type, so its entity metadata is already
+   *  seeded (owned + derived); this loads the data (items, groups, sparse overrides) and wires
+   *  links from the provided sources. A declared `linkedKind` with no provided source throws. */
+  protected hydrateFrom(stored: StoredConfig, options?: HydrationOptions): this;
+}
+//#endregion
+export { AttachedSources, Config, CssGrammar, Edition, HydrationOptions, ListOptions, LiveConfig, Patch, RecordedSource, SERIALIZED_CONFIG_VERSION, SerializedConfig, SkippedOp, SourcesBySlug, StoredConfig, SubPatch, TreeNode };