@powerhousedao/reactor 6.2.2-dev.2 → 6.2.2-dev.20

package/dist/index.js

@@ -1,10 +1,10 @@
-import { A as parsePagingOptions, C as DuplicateManifestError, D as DocumentDeletedError, E as ModuleNotFoundError, O as DocumentNotFoundError, S as CollectionMembershipCache, T as InvalidModuleError, _ as KyselyWriteCache, a as createForwardingPoolInstrumentation, b as createConsistencyToken, c as DuplicateOperationError, d as KyselyKeyframeStore, f as DocumentModelRegistry, g as EventBus, h as KyselyExecutionScope, i as runMigrations, j as throwIfAborted, k as matchesScope, l as OptimisticLockError, m as DriveCollectionId, n as REACTOR_SCHEMA, o as instrumentPgPool, p as SimpleJobExecutor, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as RevisionMismatchError, v as KyselyOperationIndex, w as DuplicateModuleError, x as createEmptyConsistencyToken, y as DocumentMetaCache } from "./drive-container-types-DpJp2AmE.js";
+import { A as DocumentNotFoundError, C as RevisionMismatchError, D as ModuleNotFoundError, E as InvalidModuleError, M as parsePagingOptions, N as throwIfAborted, O as AuthorizationDeniedError, S as OptimisticLockError, T as DuplicateModuleError, _ as createConsistencyToken, a as createForwardingPoolInstrumentation, b as AppendConditionFailedError, c as KyselyKeyframeStore, d as DriveCollectionId, f as KyselyExecutionScope, g as DocumentMetaCache, h as KyselyOperationIndex, i as runMigrations, j as matchesScope, k as DocumentDeletedError, l as DocumentModelRegistry, m as KyselyWriteCache, n as REACTOR_SCHEMA, o as instrumentPgPool, p as EventBus, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as createEmptyConsistencyToken, w as DuplicateManifestError, x as DuplicateOperationError, y as CollectionMembershipCache } from "./drive-container-types-DrQMmpCa.js";
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
-import { a as ReadModelCoordinator, i as KyselyDocumentView, n as ConsistencyTracker, o as BaseReadModel, r as makeConsistencyKey, t as KyselyDocumentIndexer } from "./document-indexer-FGJmRAdX.js";
+import { a as ReadModelCoordinator, i as KyselyDocumentView, n as ConsistencyTracker, o as BaseReadModel, r as makeConsistencyKey, t as KyselyDocumentIndexer } from "./document-indexer-BY-mPXJF.js";
 import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-DBJOv8Gp.js";
-import { actions, actions as documentActions, createPresignedHeader, generateId, hashDocumentStateForScope, replayDocument } from "@powerhousedao/shared/document-model";
+import { t as workerEntryPath } from "./worker-BEzk4Q1I.js";
+import { actions, actions as documentActions, createPresignedHeader, decide, generateId, hashDocumentStateForScope, replayDocument } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -680,6 +680,39 @@ let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 	return DocumentChangeType;
 }({});
 //#endregion
+//#region src/client/util.ts
+const ALWAYS_READABLE_SCOPES = new Set(["auth", "document"]);
+function authSubjectFromSigner(signer) {
+	return {
+		address: signer.user?.address,
+		key: signer.app?.key
+	};
+}
+function canReadScope(auth, subject, scope) {
+	return ALWAYS_READABLE_SCOPES.has(scope) || decide(auth, subject, {
+		verb: "read",
+		scope
+	}) === "allow";
+}
+function withAuthScope(view) {
+	if (view?.scopes && view.scopes.length > 0) return {
+		...view,
+		scopes: [...new Set([...view.scopes, "auth"])]
+	};
+	return view;
+}
+function filterReadableScopes(document, subject) {
+	const state = document.state;
+	if (!state) return document;
+	const auth = document.state.auth;
+	const filtered = {};
+	for (const scope of Object.keys(state)) if (canReadScope(auth, subject, scope)) filtered[scope] = state[scope];
+	return {
+		...document,
+		state: filtered
+	};
+}
+//#endregion
 //#region src/client/reactor-client.ts
 /**
 * ReactorClient implementation that wraps lower-level APIs to provide
@@ -711,6 +744,9 @@ var ReactorClient = class {
 		this.drives = new DriveClient(this, logger, reactor, signer);
 		this.logger.verbose("ReactorClient initialized");
 	}
+	readSubject(subject) {
+		return subject ?? authSubjectFromSigner(this.signer);
+	}
 	/**
 	* Retrieves a list of document model modules.
 	*/
@@ -734,7 +770,7 @@ var ReactorClient = class {
 	*/
 	async get(identifier, view, signal) {
 		this.logger.verbose("get(@identifier, @view)", identifier, view);
-		return await this.reactor.getByIdOrSlug(identifier, view, void 0, signal);
+		return filterReadableScopes(await this.reactor.getByIdOrSlug(identifier, withAuthScope(view), void 0, signal), this.readSubject(view?.subject));
 	}
 	/**
 	* Resolves an identifier (id or slug) to the canonical document id, using the
@@ -750,8 +786,15 @@ var ReactorClient = class {
 	async getOperations(documentIdentifier, view, filter, paging, signal) {
 		this.logger.verbose("getOperations(@documentIdentifier, @view, @filter, @paging)", documentIdentifier, view, filter, paging);
 		const documentId = await this.documentView.resolveIdOrSlug(documentIdentifier, view, void 0, signal);
-		if (paging?.cursor && isCompositeCursor(paging.cursor)) return this.getOperationsWithCompositeCursor(documentId, view, filter, paging, signal);
+		const authDoc = await this.reactor.getByIdOrSlug(documentId, {
+			scopes: ["auth"],
+			branch: view?.branch
+		}, void 0, signal);
+		const subject = this.readSubject(view?.subject);
+		const canRead = (scope) => canReadScope(authDoc?.state.auth, subject, scope);
+		if (paging?.cursor && isCompositeCursor(paging.cursor)) return this.getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead);
 		const operationsByScope = await this.reactor.getOperations(documentId, view, filter, paging, void 0, signal);
+		for (const scope of Object.keys(operationsByScope)) if (!canRead(scope)) delete operationsByScope[scope];
 		const scopeEntries = Object.entries(operationsByScope);
 		const effectivePaging = paging || {
 			cursor: "0",
@@ -779,11 +822,12 @@ var ReactorClient = class {
 			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
 		};
 	}
-	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal) {
+	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
 		const scopeCursors = decodeCompositeCursor(paging.cursor);
 		const allOperations = [];
 		const activeCursors = {};
 		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
+			if (!canRead(scopeName)) continue;
 			const scopeView = {
 				...view,
 				scopes: [scopeName]
@@ -817,7 +861,7 @@ var ReactorClient = class {
 				limit: 0
 			}
 		};
-		return this.reactor.find({ ids: targetIds }, view, paging, void 0, signal);
+		return this.find({ ids: targetIds }, view, paging, signal);
 	}
 	/**
 	* Retrieves incoming relationships of a given type to a target document.
@@ -833,14 +877,19 @@ var ReactorClient = class {
 				limit: 0
 			}
 		};
-		return this.reactor.find({ ids: sourceIds }, view, paging, void 0, signal);
+		return this.find({ ids: sourceIds }, view, paging, signal);
 	}
 	/**
 	* Filters documents by criteria and returns a list of them
 	*/
 	async find(search, view, paging, signal) {
 		this.logger.verbose("find(@search, @view, @paging)", search, view, paging);
-		return this.reactor.find(search, view, paging, void 0, signal);
+		const results = await this.reactor.find(search, withAuthScope(view), paging, void 0, signal);
+		const readSubject = this.readSubject(view?.subject);
+		return {
+			...results,
+			results: results.results.map((doc) => filterReadableScopes(doc, readSubject))
+		};
 	}
 	/**
 	* Creates a document and waits for completion
@@ -1144,6 +1193,18 @@ let JobQueueState = /* @__PURE__ */ function(JobQueueState) {
 	return JobQueueState;
 }({});
 /**
+* How a retry is accounted against the job's retry limit.
+* - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
+*   retries and fails terminally.
+* - `ExemptFromLimit`: not a fault, so the attempt is not charged to the job.
+*   Used for concurrency conflicts, where the retry does new work.
+*/
+let RetryAccounting = /* @__PURE__ */ function(RetryAccounting) {
+	RetryAccounting["CountAgainstLimit"] = "count-against-limit";
+	RetryAccounting["ExemptFromLimit"] = "exempt-from-limit";
+	return RetryAccounting;
+}({});
+/**
 * Event types for the queue system
 */
 const QueueEventTypes = { JOB_AVAILABLE: 1e4 };
@@ -1187,12 +1248,19 @@ var JobResultHandler = class {
 				} catch {}
 			}
 		}
+		if (result.error && AppendConditionFailedError.isError(result.error)) {
+			const errorInfo = toErrorInfo(result.error);
+			try {
+				await this.queue.retryJob(handle.job.id, errorInfo, RetryAccounting.ExemptFromLimit);
+				return;
+			} catch {}
+		}
 		if (result.error && DocumentNotFoundError.isError(result.error)) {
 			handle.defer();
 			callbacks.deferJob(handle.job.documentId, handle.job);
 			return;
 		}
-		if (result.error && DocumentDeletedError.isError(result.error)) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || AuthorizationDeniedError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -2587,7 +2655,7 @@ var InMemoryQueue = class {
 		if (documentId) this.markJobComplete(jobId, documentId);
 		this.jobIndex.delete(jobId);
 	}
-	async retryJob(jobId, error) {
+	async retryJob(jobId, error, accounting = RetryAccounting.CountAgainstLimit) {
 		const job = this.jobIndex.get(jobId);
 		if (!job) return;
 		job.lastError = error;
@@ -2596,9 +2664,10 @@ var InMemoryQueue = class {
 		this.jobIndex.delete(jobId);
 		this.jobIdToQueueKey.delete(jobId);
 		if (error) job.errorHistory.push(error);
+		const retryCount = job.retryCount || 0;
 		const updatedJob = {
 			...job,
-			retryCount: (job.retryCount || 0) + 1,
+			retryCount: accounting === RetryAccounting.CountAgainstLimit ? retryCount + 1 : retryCount,
 			lastError: error
 		};
 		await this.enqueue(updatedJob);
@@ -2686,6 +2755,98 @@ var InMemoryQueue = class {
 	}
 };
 //#endregion
+//#region src/core/model-sources.ts
+function modelSourceKey(module) {
+	return `${module.documentModel.global.id}@${module.version ?? 1}`;
+}
+function isDocumentModelModule(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.reducer === "function" && typeof candidate.documentModel?.global?.id === "string";
+}
+/**
+* Resolves every source to live modules by importing file/package sources
+* host-side and scanning their exports, so the host registry and the worker
+* manifest are derived from one list and cannot diverge.
+*/
+async function resolveModelSources(sources) {
+	const resolved = /* @__PURE__ */ new Map();
+	for (const source of sources) {
+		if (isDocumentModelModule(source)) {
+			addEntry(resolved, {
+				module: source,
+				spec: null
+			});
+			continue;
+		}
+		for (const entry of await resolveImportableSource(source)) addEntry(resolved, entry);
+	}
+	const modules = [];
+	const manifest = [];
+	const moduleOnlyKeys = [];
+	for (const [key, entry] of resolved) {
+		modules.push(entry.module);
+		if (entry.spec) manifest.push({
+			documentType: entry.module.documentModel.global.id,
+			version: String(entry.module.version ?? 1),
+			spec: entry.spec
+		});
+		else moduleOnlyKeys.push(key);
+	}
+	return {
+		modules,
+		manifest,
+		moduleOnlyKeys
+	};
+}
+function addEntry(map, entry) {
+	const key = modelSourceKey(entry.module);
+	const existing = map.get(key);
+	if (!existing) {
+		map.set(key, entry);
+		return;
+	}
+	if (!existing.spec && entry.spec) existing.spec = entry.spec;
+}
+async function resolveImportableSource(source) {
+	const isFile = "filePath" in source;
+	const specifier = isFile ? new URL(`file://${source.filePath}`).href : source.subpath ? `${source.packageName}/${source.subpath}` : source.packageName;
+	const moduleRef = isFile ? { filePath: source.filePath } : { packageName: specifier };
+	let moduleNs;
+	try {
+		moduleNs = await import(
+			/* @vite-ignore */
+			specifier
+);
+	} catch (error) {
+		throw new Error(`Failed to import document-model source "${describeSource(source)}"`, { cause: error });
+	}
+	if (source.exportName !== void 0) {
+		const value = moduleNs[source.exportName];
+		if (!isDocumentModelModule(value)) throw new Error(`Export "${source.exportName}" of document-model source "${describeSource(source)}" is not a DocumentModelModule`);
+		return [{
+			module: value,
+			spec: { module: {
+				...moduleRef,
+				exportName: source.exportName
+			} }
+		}];
+	}
+	const entries = [];
+	for (const [exportName, value] of Object.entries(moduleNs)) if (isDocumentModelModule(value)) entries.push({
+		module: value,
+		spec: { module: {
+			...moduleRef,
+			exportName
+		} }
+	});
+	if (entries.length === 0) throw new Error(`Document-model source "${describeSource(source)}" has no DocumentModelModule exports`);
+	return entries;
+}
+function describeSource(source) {
+	return "filePath" in source ? source.filePath : source.subpath ? `${source.packageName}/${source.subpath}` : source.packageName;
+}
+//#endregion
 //#region src/registry/document-model-resolver.ts
 /**
 * Encapsulates the logic for resolving document model modules on demand.
@@ -2743,10 +2904,11 @@ var DocumentModelResolver = class {
 		return loadPromise;
 	}
 	async loadRegisterAndBroadcast(documentType) {
-		const module = await this.loader.load(documentType);
-		const [result] = this.registry.registerModules(module);
-		if (result.status === "error" && !DuplicateModuleError.isError(result.error)) throw result.error;
-		await this.broadcastIfPossible(documentType);
+		const resolved = await resolveModelSources([await this.loader.load(documentType)]);
+		if (!resolved.modules.some((module) => module.documentModel.global.id === documentType)) throw new Error(`Loader source resolved no module for document type: ${documentType}`);
+		const results = this.registry.registerModules(...resolved.modules);
+		for (const result of results) if (result.status === "error" && !DuplicateModuleError.isError(result.error)) throw result.error;
+		if (this.broadcastHook) for (const entry of resolved.manifest) await this.broadcastHook(entry);
 	}
 	async notifyPeersModelLoaded(documentType) {
 		if (!this.modelLoadedHook) return;
@@ -2756,12 +2918,6 @@ var DocumentModelResolver = class {
 			this.logger.warn(`MODEL_LOADED hook failed: ${documentType}`, error);
 		}
 	}
-	async broadcastIfPossible(documentType) {
-		if (!this.broadcastHook || !this.loader.resolveSpec) return;
-		const entry = await this.loader.resolveSpec(documentType);
-		if (!entry) return;
-		await this.broadcastHook(entry);
-	}
 };
 /**
 * No-op resolver used when no document model loader is configured.
@@ -6478,9 +6634,12 @@ var Reactor = class {
 };
 //#endregion
 //#region src/core/reactor-builder.ts
+function sameDatabaseTarget(a, b) {
+	return a.host === b.host && a.port === b.port && a.database === b.database;
+}
 var ReactorBuilder = class {
 	logger;
-	documentModels = [];
+	documentModelSources = [];
 	upgradeManifests = [];
 	features = { legacyStorageEnabled: false };
 	readModels = [];
@@ -6501,12 +6660,8 @@ var ReactorBuilder = class {
 	documentModelLoader;
 	shutdownHooks = [];
 	driveContainerTypes = DEFAULT_DRIVE_CONTAINER_TYPES;
-	documentModelSpecs = [];
-	workerPoolConfig;
+	workerPool;
 	resolvedModelManifest;
-	workerDbConfig;
-	workerSignatureVerifierSpec;
-	workerFactory;
 	projectionShardConfig;
 	projectionWorkerFactory;
 	instrumentedPools = [];
@@ -6514,8 +6669,15 @@ var ReactorBuilder = class {
 		this.logger = logger;
 		return this;
 	}
-	withDocumentModels(models) {
-		this.documentModels = models;
+	/**
+	* Register document-model sources: live modules, importable files, or
+	* importable packages. Appends across calls. At `buildModule()` every
+	* source is resolved host-side and registered on the registry; file and
+	* package sources additionally form the worker manifest when the worker
+	* pool is enabled (live modules cannot cross a thread boundary).
+	*/
+	withDocumentModelSources(sources) {
+		this.documentModelSources.push(...sources);
 		return this;
 	}
 	withUpgradeManifests(manifests) {
@@ -6630,58 +6792,30 @@ var ReactorBuilder = class {
 		this.shutdownHooks.push(hook);
 		return this;
 	}
-	withDocumentModelSpecs(specs) {
-		this.documentModelSpecs = specs;
-		return this;
-	}
-	/**
-	* Stores the worker-pool configuration. When `config.enabled === true` the
-	* builder constructs a {@link WorkerPoolJobExecutorManager} in place of the
-	* in-process {@link SimpleJobExecutorManager}.
-	*/
-	withWorkerPool(config) {
-		this.workerPoolConfig = config;
-		return this;
-	}
-	/**
-	* Postgres connection info forwarded to each worker so it can open its own
-	* pool. Required when `workerPool.enabled === true` unless a custom
-	* `withWorkerFactory` or `withExecutor` is provided.
-	*/
-	withWorkerDbConfig(db) {
-		this.workerDbConfig = db;
-		return this;
-	}
-	/**
-	* Factory spec the worker imports to instantiate its signature verifier.
-	* Required when `workerPool.enabled === true` unless a custom
-	* `withWorkerFactory` or `withExecutor` is provided.
-	*/
-	withWorkerSignatureVerifierSpec(spec) {
-		this.workerSignatureVerifierSpec = spec;
-		return this;
-	}
 	/**
-	* Inject a custom {@link WorkerFactory}. When set, the builder skips
-	* default thread-transport wiring and hands the factory directly to the
-	* pool manager. Use this in tests or to plug in a different transport
-	* (e.g. a child-process adapter).
+	* Enable the executor worker pool: N `node:worker_threads` workers with
+	* sticky per-document routing, replacing the in-process executor. Calling
+	* this enables the pool — there is no `enabled` flag. Provide `db`
+	* (each worker opens its own Postgres pool; the parent database is built
+	* from it too unless {@link withKysely} is set) or a custom `factory`
+	* transport. `verifier` is imported by the default transport's workers;
+	* omitted = no executor-side signature verification.
 	*/
-	withWorkerFactory(factory) {
-		this.workerFactory = factory;
+	withWorkerPool(options) {
+		this.workerPool = options;
 		return this;
 	}
 	/**
 	* Configure N sharded projection workers. When set, the builder replaces
 	* the default in-process {@link ReadModelCoordinator} with a
-	* {@link ProjectionShardManager}. The same `DbConfig` registered via
-	* {@link withWorkerDbConfig} is reused for the projection workers'
-	* connection info; only the `poolSize` is overridden by
-	* {@link ProjectionShardBuilderConfig.poolSize}.
+	* {@link ProjectionShardManager}.
 	*
-	* Requires {@link withWorkerDbConfig} (the projection workers need
-	* connection info to open their own pools). The same model manifest
-	* resolved from {@link withDocumentModelSpecs} is forwarded.
+	* Projection workers open their own Postgres pools from `config.db`,
+	* falling back to the executor worker pool's `db` when
+	* {@link withWorkerPool} is configured with one; only the `poolSize` is
+	* overridden by {@link ProjectionShardBuilderConfig.poolSize}. The same
+	* model manifest resolved from {@link withDocumentModelSources} is
+	* forwarded.
 	*/
 	withProjectionShards(config) {
 		this.projectionShardConfig = config;
@@ -6704,41 +6838,24 @@ var ReactorBuilder = class {
 	}
 	async buildModule() {
 		if (!this.logger) this.logger = new ConsoleLogger(["reactor"]);
-		if (this.workerPoolConfig?.enabled) {
-			if (this.documentModels.length > 0) throw new Error("workerPool.enabled requires withDocumentModelSpecs; remove withDocumentModels() in worker-pool mode.");
-			if (this.documentModelSpecs.length === 0) throw new Error("workerPool.enabled requires at least one spec registered via withDocumentModelSpecs.");
-			const needsDefaultFactory = !this.executorManager && !this.workerFactory;
-			if (needsDefaultFactory && !this.workerDbConfig) throw new Error("workerPool.enabled requires withWorkerDbConfig (or a custom withWorkerFactory / withExecutor).");
-			if (needsDefaultFactory && !this.workerSignatureVerifierSpec) throw new Error("workerPool.enabled requires withWorkerSignatureVerifierSpec (or a custom withWorkerFactory / withExecutor).");
-		}
-		if (this.documentModelSpecs.length > 0) this.resolvedModelManifest = this.documentModelSpecs.map((input) => {
-			if ("filePath" in input) return {
-				documentType: "<unresolved>",
-				version: "<unresolved>",
-				spec: { module: {
-					filePath: input.filePath,
-					exportName: "documentModel"
-				} }
-			};
-			return {
-				documentType: "<unresolved>",
-				version: input.version,
-				spec: { module: {
-					packageName: input.packageName,
-					exportName: "documentModel"
-				} }
-			};
-		});
+		if (this.projectionShardConfig !== void 0 && this.readModelFactories.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModelFactory; projection workers cannot receive host-only factory dependencies");
+		const resolvedSources = await resolveModelSources(this.documentModelSources);
+		if (this.workerPool) {
+			if (resolvedSources.manifest.length === 0) throw new Error("withWorkerPool requires at least one worker-importable document-model source ({ filePath } or { packageName }).");
+			if (resolvedSources.moduleOnlyKeys.length > 0) throw new Error(`withWorkerPool requires worker-importable sources, but these models were registered only as live modules: ${resolvedSources.moduleOnlyKeys.join(", ")}. Provide a { filePath } or { packageName } source for each.`);
+		}
+		this.resolvedModelManifest = resolvedSources.manifest.length > 0 ? resolvedSources.manifest : void 0;
 		const documentModelRegistry = new DocumentModelRegistry();
 		if (this.upgradeManifests.length > 0) {
 			const results = documentModelRegistry.registerUpgradeManifests(...this.upgradeManifests);
 			for (const result of results) if (result.status === "error") this.logger.error("Failed to register upgrade manifest: @error", result.error.message);
 		}
-		if (this.documentModels.length > 0) {
-			const results = documentModelRegistry.registerModules(...this.documentModels);
+		if (resolvedSources.modules.length > 0) {
+			const results = documentModelRegistry.registerModules(...resolvedSources.modules);
 			for (const result of results) if (result.status === "error") this.logger.error("Failed to register document model: @error", result.error.message);
 		}
-		const baseDatabase = this.kyselyInstance ?? (this.workerPoolConfig?.enabled && this.workerDbConfig ? await this.createPostgresDatabase(this.workerDbConfig) : await createDefaultDatabase());
+		const reactorDbConfig = this.resolveReactorDbConfig();
+		const baseDatabase = this.kyselyInstance ?? (reactorDbConfig ? await this.createPostgresDatabase(reactorDbConfig) : await createDefaultDatabase());
 		if (this.migrationStrategy === "auto") {
 			const result = await runMigrations(baseDatabase, REACTOR_SCHEMA);
 			if (!result.success && result.error) throw new Error(`Database migration failed: ${result.error.message}`);
@@ -6764,10 +6881,16 @@ var ReactorBuilder = class {
 		const executionScope = new KyselyExecutionScope(database, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache);
 		let executorManager = this.executorManager;
 		let executorStartCount = this.executorConfig.maxConcurrency ?? 1;
-		if (!executorManager) if (this.workerPoolConfig?.enabled) {
-			const poolManager = new WorkerPoolJobExecutorManager(this.workerFactory ?? await this.createDefaultWorkerFactory(this.workerPoolConfig), eventBus, queue, jobTracker, this.logger, resolver, collectionMembershipCache, this.executorConfig.jobTimeoutMs);
+		if (!executorManager) if (this.workerPool) {
+			const pool = this.workerPool;
+			let factory = pool.factory;
+			if (!factory) {
+				if (pool.db === void 0) throw new Error("unreachable: worker pool configured without db or factory");
+				factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db, pool.verifier);
+			}
+			const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, collectionMembershipCache, this.executorConfig.jobTimeoutMs);
 			executorManager = poolManager;
-			executorStartCount = this.workerPoolConfig.numWorkers;
+			executorStartCount = pool.numWorkers;
 			if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
 		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, this.signatureVerifier, executionScope), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs);
 		await executorManager.start(executorStartCount);
@@ -6799,6 +6922,7 @@ var ReactorBuilder = class {
 		}
 		for (const factory of this.readModelFactories) {
 			const readModel = await factory({
+				documentModelRegistry,
 				operationIndex,
 				writeCache,
 				processorManagerConsistencyTracker
@@ -6843,6 +6967,19 @@ var ReactorBuilder = class {
 		return module;
 	}
 	/**
+	* The single Postgres config for the parent, executor workers, and
+	* projection shards. They must share one physical database (the parent
+	* writes operations; workers and shards read them), so divergent
+	* worker/shard targets throw. `withKysely` overrides the parent and is not
+	* validated against a worker/shard `db`.
+	*/
+	resolveReactorDbConfig() {
+		const workerDb = this.workerPool?.db;
+		const projectionDb = this.projectionShardConfig?.db;
+		if (workerDb && projectionDb && !sameDatabaseTarget(workerDb, projectionDb)) throw new Error("withWorkerPool({ db }) and withProjectionShards({ db }) must address the same Postgres database (same host, port, and database); the parent writes operations there and the projection shards read them.");
+		return workerDb ?? projectionDb;
+	}
+	/**
 	* Constructs a {@link ProjectionShardManager} bound to the host event
 	* bus. Builds the default thread-transport factory unless one was
 	* injected via {@link withProjectionWorkerFactory}. Calls
@@ -6850,11 +6987,12 @@ var ReactorBuilder = class {
 	* is returned to the caller.
 	*/
 	async createProjectionShardManager(config, eventBus) {
-		if (!this.workerDbConfig) throw new Error("withProjectionShards requires withWorkerDbConfig; projection workers need connection info to open their own pools.");
+		const baseDb = this.resolveReactorDbConfig();
+		if (!baseDb) throw new Error("withProjectionShards requires a db (or an executor worker pool configured with one); projection workers need connection info to open their own pools.");
 		const models = this.resolvedModelManifest ?? [];
 		const db = {
-			...this.workerDbConfig,
-			poolSize: config.poolSize ?? this.workerDbConfig.poolSize,
+			...baseDb,
+			poolSize: config.poolSize ?? baseDb.poolSize,
 			applicationName: "reactor-projection-shard"
 		};
 		const factory = this.projectionWorkerFactory ?? await this.createDefaultProjectionWorkerFactory();
@@ -6889,18 +7027,21 @@ var ReactorBuilder = class {
 		return () => createProjectionThreadTransport(projectionWorkerEntryPath);
 	}
 	/**
-	* Default {@link WorkerFactory} used when `workerPool.enabled` is set and
-	* the caller did not inject `withWorkerFactory`. Each worker spawns a real
-	* `node:worker_threads` Worker pointing at the compiled `worker/entry.js`.
+	* Default {@link WorkerFactory} used when the pool options carry no
+	* custom `factory`. Each worker spawns a real `node:worker_threads`
+	* Worker pointing at the compiled `worker/entry.js`.
 	*/
-	async createDefaultWorkerFactory(poolConfig) {
+	async createDefaultWorkerFactory(numWorkers, db, signatureVerifier) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
 			import("./worker-handle-B1w03nRA.js"),
 			import("./transport-ByGviWdZ.js"),
-			import("./worker-DBJOv8Gp.js").then((n) => n.n)
+			import("./worker-BEzk4Q1I.js").then((n) => n.n)
 		]);
-		const db = this.workerDbConfig;
-		const signatureVerifier = this.workerSignatureVerifierSpec;
+		const poolConfig = {
+			enabled: true,
+			numWorkers,
+			workerType: "thread"
+		};
 		const models = this.resolvedModelManifest ?? [];
 		const logger = this.logger;
 		return (index) => {
@@ -7155,6 +7296,74 @@ function driveIdFromUrl(url) {
 	return url.split("/").pop() ?? "";
 }
 //#endregion
+//#region src/decision/build-decision-model.ts
+/**
+* Reads each projection's stream through the write cache, recording the
+* revision observed. Static projections resolve first; derived projections
+* see only those and contribute a map from document id to state. Each
+* distinct stream is read once and yields one append condition entry.
+*/
+async function buildDecisionModel(cache, definition, target, signal) {
+	const decisionModel = definition(target);
+	const projections = Object.entries(decisionModel.projections);
+	const reads = /* @__PURE__ */ new Map();
+	const model = {};
+	for (const [key, projection] of projections) {
+		if (typeof projection.query === "function") continue;
+		model[key] = (await readStream(cache, projection.query, reads, signal)).state;
+	}
+	const staticModel = { ...model };
+	for (const [key, projection] of projections) {
+		if (typeof projection.query !== "function") continue;
+		const queries = projection.query(staticModel);
+		const value = {};
+		for (const query of queries) {
+			const read = await readStream(cache, query, reads, signal);
+			value[query.documentId] = read.state;
+		}
+		model[key] = value;
+	}
+	return {
+		model,
+		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
+	};
+}
+async function readStream(cache, query, reads, signal) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	const existing = reads.get(key);
+	if (existing) return existing;
+	const document = await cache.getState(query.documentId, query.scope, query.branch, void 0, signal);
+	const read = {
+		state: document.state[query.scope],
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: observedRevision(document, query.scope)
+		}
+	};
+	reads.set(key, read);
+	return read;
+}
+/**
+* The highest operation index the document reflects for the scope, or -1 if
+* empty. The last operation's index is the one invariant the write cache
+* guarantees; header.revision (next-index semantics) is the fallback.
+*/
+function observedRevision(document, scope) {
+	if (scope in document.operations) {
+		const operations = document.operations[scope];
+		if (operations.length > 0) return operations[operations.length - 1].index;
+	}
+	if (!(scope in document.header.revision)) return -1;
+	return document.header.revision[scope] - 1;
+}
+//#endregion
+//#region src/read-models/interfaces.ts
+function supportsLiveReadModelRegistration(coordinator) {
+	return "addReadModel" in coordinator && typeof coordinator.addReadModel === "function";
+}
+//#endregion
 //#region src/admin/passthrough-keyframe-store.ts
 const passthroughKeyframeStore = {
 	putKeyframe: () => Promise.resolve(),
@@ -7264,6 +7473,6 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RevisionMismatchError, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncStatus, SyncStatusTracker, addRelationshipAction, batchOperationsByDocument, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, deleteDocumentAction, documentActions, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, removeRelationshipAction, runMigrations, sanitizeArg, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { AppendConditionFailedError, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncStatus, SyncStatusTracker, addRelationshipAction, batchOperationsByDocument, buildDecisionModel, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, deleteDocumentAction, documentActions, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, removeRelationshipAction, runMigrations, sanitizeArg, supportsLiveReadModelRegistration, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 
 //# sourceMappingURL=index.js.map