@powerhousedao/reactor 6.2.2-dev.27 → 6.2.2-dev.28

package/dist/{drive-container-types-uigTGO3i.js → drive-container-types-BNwEHEXP.js}

@@ -1,5 +1,5 @@
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { DowngradeNotSupportedError, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, createPresignedHeader, decide, defaultBaseState, deriveOperationId, isUndoRedo } from "@powerhousedao/shared/document-model";
+import { DowngradeNotSupportedError, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, garbageCollect, hashDocumentStateForScope, isDenied, isUndoRedo, sortOperations } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -706,6 +706,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				skip: op.skip,
 				hash: op.hash,
 				action: op.action,
+				deniedReason: op.deniedReason ?? null,
 				sourceRemote: op.sourceRemote
 			}));
 			operationOrdinals = (await trx.insertInto("operation_index_operations").values(operationRows).returning("ordinal").execute()).map((row) => row.ordinal);
@@ -837,6 +838,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				hash: row.hash,
 				skip: row.skip,
 				action: row.action,
+				deniedReason: row.deniedReason ?? void 0,
 				id: row.opId
 			},
 			context: {
@@ -860,6 +862,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			hash: row.hash,
 			skip: row.skip,
 			action: row.action,
+			deniedReason: row.deniedReason ?? void 0,
 			id: row.opId,
 			sourceRemote: row.sourceRemote
 		};
@@ -971,6 +974,20 @@ function keyframeRevision(keyframe, documentId, scope) {
 	if (typeof nextIndex !== "number") throw new Error(`Corrupt keyframe for document ${documentId} at revision ${keyframe.revision}: header carries no ${scope} revision`);
 	return nextIndex - 1;
 }
+/**
+* Records a denied operation in the history without applying it. This is used
+* for auth-rejected operations, as these need to be recorded without being
+* applied.
+*/
+function appendWithoutApplying(document, scope, operation) {
+	return {
+		...document,
+		operations: {
+			...document.operations,
+			[scope]: [...document.operations[scope] ?? [], operation]
+		}
+	};
+}
 function extractModuleVersion(doc) {
 	const v = doc.state.document.version;
 	return v === 0 ? void 0 : v;
@@ -1254,7 +1271,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 			for (const operation of docScopeOpsAfterKeyframe.results) {
 				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
 				lastDocumentScopeOperation = operation;
-				if (operation.error) continue;
+				if (operation.error || isDenied(operation)) continue;
 				if (operation.action.type === "UPGRADE_DOCUMENT") {
 					const upgradeAction = operation.action;
 					const fromVersion = upgradeAction.input.fromVersion;
@@ -1297,7 +1314,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
 				lastDocumentScopeOperation = operation;
 				if (operation.index === 0) continue;
-				if (operation.error) continue;
+				if (operation.error || isDenied(operation)) continue;
 				if (operation.action.type === "UPGRADE_DOCUMENT") {
 					const upgradeAction = operation.action;
 					const fromVersion = upgradeAction.input.fromVersion;
@@ -1321,7 +1338,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 					docModule = this.registry.getModule(documentType, extractModuleVersion(document));
 				} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
 				else {
-					const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
+					const protocolVersion = baseReducerVersion(document.header);
 					document = docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
@@ -1368,11 +1385,14 @@ var KyselyWriteCache = class KyselyWriteCache {
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
 					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, extractModuleVersion(document));
-					const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
-					document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
-						skip: operation.skip,
-						protocolVersion
-					});
+					if (isDenied(operation)) document = appendWithoutApplying(document, scope, operation);
+					else {
+						const protocolVersion = baseReducerVersion(document.header);
+						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+							skip: operation.skip,
+							protocolVersion
+						});
+					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
 				hasMorePages = Boolean(result.nextCursor) && !reachedTarget;
@@ -1437,11 +1457,14 @@ var KyselyWriteCache = class KyselyWriteCache {
 			for (const operation of pagedResults.results) {
 				if (signal?.aborted) throw new Error("Operation aborted");
 				if (targetRevision !== void 0 && operation.index > targetRevision) break;
-				const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
-				document = module.reducer(document, operation.action, void 0, {
-					skip: operation.skip,
-					protocolVersion
-				});
+				if (isDenied(operation)) document = appendWithoutApplying(document, scope, operation);
+				else {
+					const protocolVersion = baseReducerVersion(document.header);
+					document = module.reducer(document, operation.action, void 0, {
+						skip: operation.skip,
+						protocolVersion
+					});
+				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
 		} catch (err) {
@@ -1619,6 +1642,260 @@ function reshuffleByTimestamp(startIndex, opsA, opsB) {
 	}));
 }
 //#endregion
+//#region src/decision/build-decision-model.ts
+/**
+* Reads each projection's stream through the write cache, recording the
+* revision observed. Static projections resolve first; derived projections
+* see only those and contribute a map from document id to state. Each
+* distinct stream is read once and yields one append condition entry.
+*/
+async function buildDecisionModel(cache, definition, target, signal) {
+	const decisionModel = definition(target);
+	const projections = Object.entries(decisionModel.projections);
+	const reads = /* @__PURE__ */ new Map();
+	const model = {};
+	for (const [key, projection] of projections) {
+		if (typeof projection.query === "function") continue;
+		model[key] = (await readStream(cache, projection.query, reads, signal)).state;
+	}
+	const staticModel = { ...model };
+	for (const [key, projection] of projections) {
+		if (typeof projection.query !== "function") continue;
+		const queries = projection.query(staticModel);
+		const value = {};
+		for (const query of queries) {
+			const read = await readStream(cache, query, reads, signal);
+			value[query.documentId] = read.state;
+		}
+		model[key] = value;
+	}
+	return {
+		model,
+		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
+	};
+}
+async function readStream(cache, query, reads, signal) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	const existing = reads.get(key);
+	if (existing) return existing;
+	const document = await cache.getState(query.documentId, query.scope, query.branch, void 0, signal);
+	const read = {
+		state: document.state[query.scope],
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: observedRevision(document, query.scope)
+		}
+	};
+	reads.set(key, read);
+	return read;
+}
+/**
+* The highest operation index the document reflects for the scope, or -1 if
+* empty. `header.revision` is authoritative, not the rebuilt operation list.
+*/
+function observedRevision(document, scope) {
+	if (scope in document.header.revision) return document.header.revision[scope] - 1;
+	if (scope in document.operations) {
+		const operations = document.operations[scope];
+		if (operations.length > 0) return operations[operations.length - 1].index;
+	}
+	if (!(scope in document.header.revision)) return -1;
+	return document.header.revision[scope] - 1;
+}
+/**
+* The streams a model reads whose queries are known before it is built. A
+* derived query needs the statically-queried projections first, so it is not
+* included here.
+*/
+function staticReadSet(definition) {
+	const streams = [];
+	for (const projection of Object.values(definition.projections)) {
+		if (typeof projection.query === "function") continue;
+		streams.push({
+			query: projection.query,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply
+		});
+	}
+	return streams;
+}
+//#endregion
+//#region src/decision/document-decision-model.ts
+/** Why the model refused an operation. */
+const DOCUMENT_DELETED_REASON = "document deleted";
+/**
+* The simplest decision model: one projection over the document scope, which
+* rejects on a deleted document.
+*/
+function documentDecisionModel(target) {
+	return {
+		projections: { document: {
+			decidingActions: ["DELETE_DOCUMENT"],
+			apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+				...document,
+				state: { ...document.state }
+			}, operation.action) : document,
+			query: {
+				documentId: target.documentId,
+				branch: target.branch,
+				scope: "document"
+			}
+		} },
+		judgesScope() {
+			return true;
+		},
+		decide(model) {
+			return model.document.isDeleted ? "deny" : "allow";
+		}
+	};
+}
+//#endregion
+//#region src/decision/merged-order.ts
+/** Identifies a stream within a walk. */
+function streamKey(query) {
+	return `${query.documentId}:${query.scope}:${query.branch}`;
+}
+/**
+* Orders two operations from different streams by position. Timestamp decides;
+* an equal timestamp falls to the action id and then the operation id, so that
+* two replicas holding the same operations agree on the order whatever order
+* they happen to store them in.
+*/
+function comparePositions(a, b) {
+	const aTime = Date.parse(a.operation.timestampUtcMs);
+	const bTime = Date.parse(b.operation.timestampUtcMs);
+	if (aTime !== bTime) return aTime - bTime;
+	const actionIds = (a.operation.action.id ?? "").localeCompare(b.operation.action.id ?? "");
+	if (actionIds !== 0) return actionIds;
+	return (a.operation.id ?? "").localeCompare(b.operation.id ?? "");
+}
+/**
+* Merges the read-set streams into one sequence by position. Each stream keeps
+* its stored order; only how far to go is decided by the timestamp, so a stream
+* whose stored order disagrees with its timestamp order still applies in the
+* order it is stored.
+*
+* An operation's position in the result is the bound a decision at that
+* operation reads to: every operation before it has been applied, and it has
+* not.
+*/
+function mergeByPosition(streams) {
+	const merged = [];
+	for (const stream of streams) for (const operation of stream.operations) merged.push({
+		streamKey: stream.streamKey,
+		operation
+	});
+	return merged.sort(comparePositions);
+}
+/**
+* For auth-related reshuffles, we may need to retract previous operations.
+* This function calculates the needed skip value.
+*/
+function retractionSkip(nextIndex, firstRetractedIndex) {
+	return nextIndex - firstRetractedIndex;
+}
+//#endregion
+//#region src/decision/walk.ts
+/**
+* Visits every operation in the read-set once, in the order their positions
+* fall, and hands back the state each stream held just before it. That state is
+* what a decision at that operation reads: everything ahead of it has been
+* applied and it has not.
+*
+* Skips are resolved first (i.e. this is performed on a garbage collected
+* stream), which means we can do a single forward pass.
+*
+* A denied operation is visited but not applied.
+*/
+function* walkByPosition(streams) {
+	const merged = mergeByPosition(streams.map((stream) => ({
+		streamKey: stream.streamKey,
+		operations: garbageCollect(sortOperations([...stream.operations]))
+	})));
+	const states = new Map(streams.map((stream) => [stream.streamKey, stream.document]));
+	for (const { streamKey, operation } of merged) {
+		yield {
+			streamKey,
+			operation,
+			states: new Map(states)
+		};
+		if (isDenied(operation)) continue;
+		const stream = streams.find((candidate) => candidate.streamKey === streamKey);
+		const before = states.get(streamKey);
+		if (before === void 0 || stream === void 0) throw new Error(`No state for stream ${streamKey}`);
+		states.set(streamKey, stream.apply(before, operation));
+	}
+}
+//#endregion
+//#region src/decision/deletion-verdicts.ts
+const WRITTEN = "written";
+/** Whether a read stream counts this action as one that changes a verdict. */
+function canRefuseOthers(operation, readSet) {
+	return readSet.some((stream) => stream.decidingActions.includes(operation.action.type));
+}
+/** The deleted one of these, or the first if none of them is deleted. */
+function firstDeleted(candidates) {
+	for (const candidate of candidates) if (candidate?.state.document.isDeleted) return candidate.state.document;
+	return candidates[0].state.document;
+}
+/**
+* This function determines which operations will be refused because of
+* deletes, returning reasons in a parallel array (undefined means the
+* operation is not refused).
+*
+* A deletion already in the stream refuses the operations timestamped after it
+* and leaves the earlier ones alone. A deletion among the ones passed in does
+* the same to those after it.
+*/
+async function deletionVerdictsByPosition(documentId, scope, branch, operations, writeCache, operationStore, signal) {
+	const definition = documentDecisionModel({
+		documentId,
+		branch
+	});
+	const readSet = staticReadSet(definition);
+	if (!definition.judgesScope(scope)) return operations.map(() => void 0);
+	const readStreams = await Promise.all(readSet.map(async (stream) => ({
+		stream,
+		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, 0, { actionTypes: stream.decidingActions }, void 0, signal)).results
+	})));
+	const decidingWritten = operations.filter((operation) => canRefuseOthers(operation, readSet));
+	if (readStreams.every((read) => read.operations.length === 0) && decidingWritten.length === 0) return operations.map(() => void 0);
+	const walked = [];
+	for (const read of readStreams) {
+		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, 0, signal);
+		walked.push({
+			streamKey: streamKey(read.stream.query),
+			document: before,
+			operations: read.operations,
+			apply: read.stream.apply
+		});
+	}
+	const writtenStreamIsRead = readSet.find((stream) => stream.query.scope === scope);
+	walked.push({
+		streamKey: WRITTEN,
+		document: walked[0].document,
+		operations,
+		apply: writtenStreamIsRead?.apply ?? ((document) => document)
+	});
+	const reasons = /* @__PURE__ */ new Map();
+	for (const step of walkByPosition(walked)) {
+		if (step.streamKey !== WRITTEN) continue;
+		const document = firstDeleted([...step.states.values()]);
+		const decision = definition.decide({ document }, {
+			address: void 0,
+			key: void 0
+		}, {
+			verb: "execute",
+			scope,
+			operation: step.operation.action.type
+		}, { scopeState: void 0 });
+		reasons.set(step.operation.id, decision === "deny" ? DOCUMENT_DELETED_REASON : void 0);
+	}
+	return operations.map((operation) => reasons.get(operation.id));
+}
+//#endregion
 //#region src/cache/operation-index-types.ts
 const DRIVE_COLLECTION_PREFIX = "drive.";
 /**
@@ -1670,11 +1947,11 @@ var DocumentActionHandler = class {
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
 	}
-	async execute(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	async execute(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal, verdictAlreadyDecided = false) {
 		switch (action.type) {
 			case "CREATE_DOCUMENT": return this.executeCreate(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
-			case "DELETE_DOCUMENT": return this.executeDelete(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "UPGRADE_DOCUMENT": return this.executeUpgrade(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
+			case "DELETE_DOCUMENT": return this.executeDelete(job, action, startTime, indexTxn, stores, sourceRemote, signal, verdictAlreadyDecided);
+			case "UPGRADE_DOCUMENT": return this.executeUpgrade(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal, verdictAlreadyDecided);
 			case "ADD_RELATIONSHIP": return this.executeAddRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
 			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
 			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
@@ -1728,7 +2005,7 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
 	}
-	async executeDelete(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
+	async executeDelete(job, action, startTime, indexTxn, stores, sourceRemote = "", signal, verdictAlreadyDecided = false) {
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("DELETE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -1739,7 +2016,7 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document before deletion: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		if (documentState.isDeleted && !verdictAlreadyDecided) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
 		let operation = createOperation(action, getNextIndexForScope(document, job.scope), 0, {
 			documentId,
 			scope: job.scope,
@@ -1775,7 +2052,7 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	async executeUpgrade(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	async executeUpgrade(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal, verdictAlreadyDecided = false) {
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("UPGRADE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -1788,7 +2065,7 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		if (documentState.isDeleted && !verdictAlreadyDecided) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
 		const nextIndex = getNextIndexForScope(document, job.scope);
 		let upgradePath;
 		if (fromVersion > 0 && fromVersion < toVersion) try {
@@ -2011,6 +2288,7 @@ const documentScopeActions = [
 */
 var SimpleJobExecutor = class {
 	config;
+	featureFlags;
 	signatureVerifierModule;
 	documentActionHandler;
 	executionScope;
@@ -2025,6 +2303,7 @@ var SimpleJobExecutor = class {
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
 		this.config = {
+			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
 			maxConcurrency: config.maxConcurrency ?? 1,
 			jobTimeoutMs: config.jobTimeoutMs ?? 3e4,
@@ -2032,6 +2311,7 @@ var SimpleJobExecutor = class {
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50
 		};
+		this.featureFlags = { documentDecisions: config.featureFlags?.documentDecisions ?? false };
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
 		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
@@ -2115,7 +2395,7 @@ var SimpleJobExecutor = class {
 		const documentIds = [...new Set(operations.map((op) => op.context.documentId))];
 		return stores.collectionMembershipCache.getCollectionsForDocuments(documentIds);
 	}
-	async processActions(job, actions, startTime, indexTxn, stores, skipValues, sourceOperations, sourceRemote = "", signal) {
+	async processActions(job, actions, startTime, indexTxn, stores, skipValues, sourceOperations, sourceRemote = "", signal, deniedReasons) {
 		const generatedOperations = [];
 		const operationsWithContext = [];
 		try {
@@ -2139,7 +2419,8 @@ var SimpleJobExecutor = class {
 			const action = actions[actionIndex];
 			const skip = skipValues?.[actionIndex] ?? 0;
 			const sourceOperation = sourceOperations?.[actionIndex];
-			const result = documentScopeActions.includes(action.type) ? await this.documentActionHandler.execute(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal) : await this.executeRegularAction(job, action, startTime, indexTxn, stores, skip, sourceOperation, sourceRemote, signal);
+			const deniedReason = deniedReasons?.[actionIndex];
+			const result = documentScopeActions.includes(action.type) ? await this.documentActionHandler.execute(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal, this.featureFlags.documentDecisions && job.kind === "load") : await this.executeRegularAction(job, action, startTime, indexTxn, stores, skip, sourceOperation, sourceRemote, signal, deniedReason);
 			const error = this.accumulateResultOrReturnError(result, generatedOperations, operationsWithContext);
 			if (error !== null) return {
 				success: false,
@@ -2164,14 +2445,43 @@ var SimpleJobExecutor = class {
 			operationsWithContext
 		};
 	}
-	async executeRegularAction(job, action, startTime, indexTxn, stores, skip = 0, sourceOperation, sourceRemote = "", signal) {
-		let docMeta;
-		try {
-			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
-		} catch (error) {
-			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+	async executeRegularAction(job, action, startTime, indexTxn, stores, skip = 0, sourceOperation, sourceRemote = "", signal, deniedReason) {
+		let appendCondition;
+		let documentVersion;
+		const verdictAlreadyDecided = this.featureFlags.documentDecisions && job.kind === "load";
+		if (this.featureFlags.documentDecisions && !verdictAlreadyDecided) {
+			const target = {
+				documentId: job.documentId,
+				branch: job.branch
+			};
+			const definition = documentDecisionModel(target);
+			let built;
+			try {
+				built = await buildDecisionModel(stores.writeCache, () => definition, target, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (definition.decide(built.model, {
+				address: action.context?.signer?.user.address,
+				key: action.context?.signer?.app.key
+			}, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}, { scopeState: void 0 }) === "deny") return buildErrorResult(job, new DocumentDeletedError(job.documentId, built.model.document.deletedAtUtcIso), startTime);
+			appendCondition = built.appendCondition;
+			documentVersion = built.model.document.version;
+		} else if (verdictAlreadyDecided) documentVersion = (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).state.document.version;
+		else {
+			let docMeta;
+			try {
+				docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+			documentVersion = docMeta.state.version;
 		}
-		if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		if (isUndoRedo(action) || action.type === "PRUNE" || action.type === "NOOP" && skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		try {
@@ -2192,14 +2502,29 @@ var SimpleJobExecutor = class {
 		}
 		let module;
 		try {
-			const moduleVersion = docMeta.state.version === 0 ? void 0 : docMeta.state.version;
+			const moduleVersion = documentVersion === 0 ? void 0 : documentVersion;
 			module = this.registry.getModule(document.header.documentType, moduleVersion);
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
 		let updatedDocument;
-		try {
-			const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
+		if (deniedReason !== void 0) {
+			const denied = createOperation(action, getNextIndexForScope(document, job.scope), skip, {
+				documentId: job.documentId,
+				scope: job.scope,
+				branch: job.branch
+			});
+			denied.deniedReason = deniedReason;
+			denied.hash = hashDocumentStateForScope(document, job.scope);
+			updatedDocument = {
+				...document,
+				operations: {
+					...document.operations,
+					[job.scope]: [...document.operations[job.scope] ?? [], denied]
+				}
+			};
+		} else try {
+			const protocolVersion = baseReducerVersion(document.header);
 			const reducerOptions = sourceOperation ? {
 				skip,
 				branch: job.branch,
@@ -2230,7 +2555,7 @@ var SimpleJobExecutor = class {
 		try {
 			storedOperations = await stores.operationStore.apply(job.documentId, document.header.documentType, scope, job.branch, newOperation.index, (txn) => {
 				txn.addOperations(newOperation);
-			}, signal);
+			}, signal, appendCondition);
 		} catch (error) {
 			this.logger.error("Error writing @Operation to IOperationStore: @Error", newOperation, error);
 			stores.writeCache.invalidate(job.documentId, scope, job.branch);
@@ -2274,13 +2599,43 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
+	/**
+	* If an operation happened that could change a decision model verdict, we
+	* need to re-evaluate across the streams that could be affected. Previously
+	* approved operations may need to be denied, which will apply new denied
+	* operations with appropriate skip.
+	*/
+	async reevaluateReadingScopes(job, startTime, indexTxn, stores, signal) {
+		const definition = documentDecisionModel({
+			documentId: job.documentId,
+			branch: job.branch
+		});
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		for (const scope of Object.keys(revisions.revision)) {
+			if (!definition.judgesScope(scope)) continue;
+			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
+			const effective = garbageCollect(sortOperations([...stored]));
+			if (effective.length === 0) continue;
+			const recomputed = await deletionVerdictsByPosition(job.documentId, scope, job.branch, effective, stores.writeCache, stores.operationStore, signal);
+			const firstChange = effective.findIndex((operation, i) => operation.deniedReason !== recomputed[i]);
+			if (firstChange === -1) continue;
+			const tail = effective.slice(firstChange);
+			const nextIndex = revisions.revision[scope];
+			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			const result = await this.processActions({
+				...job,
+				scope
+			}, tail.map((operation) => operation.action), startTime, indexTxn, stores, tail.map((_, i) => i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0), void 0, "", signal, recomputed.slice(firstChange));
+			if (!result.success) return result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`);
+		}
+	}
 	async executeLoadJob(job, startTime, indexTxn, stores, signal) {
 		if (job.operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("Load job must include at least one operation"), startTime);
 		let docMeta;
 		try {
 			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
 		} catch {}
-		if (docMeta?.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+		if (docMeta?.state.isDeleted && !this.featureFlags.documentDecisions) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		const scope = job.scope;
 		let latestRevision;
 		try {
@@ -2369,8 +2724,19 @@ var SimpleJobExecutor = class {
 		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP") operation.skip = 1;
 		const actions = reshuffledOperations.map((operation) => operation.action);
 		const skipValues = reshuffledOperations.map((operation) => operation.skip);
+		let deniedReasons;
+		if (this.featureFlags.documentDecisions) try {
+			deniedReasons = await deletionVerdictsByPosition(job.documentId, scope, job.branch, reshuffledOperations, stores.writeCache, stores.operationStore, signal);
+		} catch (error) {
+			return {
+				job,
+				success: false,
+				error: error instanceof Error ? error : new Error(String(error)),
+				duration: Date.now() - startTime
+			};
+		}
 		const effectiveSourceRemote = skipCount > 0 ? "" : job.meta.sourceRemote || "";
-		const result = await this.processActions(job, actions, startTime, indexTxn, stores, skipValues, reshuffledOperations, effectiveSourceRemote, signal);
+		const result = await this.processActions(job, actions, startTime, indexTxn, stores, skipValues, reshuffledOperations, effectiveSourceRemote, signal, deniedReasons);
 		if (!result.success) return {
 			job,
 			success: false,
@@ -2379,6 +2745,23 @@ var SimpleJobExecutor = class {
 		};
 		stores.writeCache.invalidate(job.documentId, scope, job.branch);
 		if (scope === "document") stores.documentMetaCache.invalidate(job.documentId, job.branch);
+		const readsThisStream = staticReadSet(documentDecisionModel({
+			documentId: job.documentId,
+			branch: job.branch
+		})).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === scope && stream.query.branch === job.branch);
+		if (this.featureFlags.documentDecisions && readsThisStream) {
+			const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+			const latest = Date.parse(revisions.latestTimestamp);
+			if (result.generatedOperations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) {
+				const error = await this.reevaluateReadingScopes(job, startTime, indexTxn, stores, signal);
+				if (error) return {
+					job,
+					success: false,
+					error,
+					duration: Date.now() - startTime
+				};
+			}
+		}
 		return {
 			job,
 			success: true,
@@ -2639,6 +3022,7 @@ var AtomicTransaction = class {
 			action: JSON.stringify(op.action),
 			skip: op.skip,
 			error: op.error || null,
+			deniedReason: op.deniedReason || null,
 			hash: op.hash
 		});
 	}
@@ -2745,6 +3129,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			hash: op.hash,
 			skip: op.skip,
 			error: op.error || void 0,
+			deniedReason: op.deniedReason || void 0,
 			id: op.opId,
 			action: JSON.parse(op.action)
 		}));
@@ -2787,6 +3172,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			sql`${op.action}::jsonb`.as("action"),
 			sql`${op.skip}::integer`.as("skip"),
 			sql`${op.error ?? null}::text`.as("error"),
+			sql`${op.deniedReason ?? null}::text`.as("deniedReason"),
 			sql`${op.hash}::text`.as("hash")
 		]).where((eb) => eb.not(eb.exists(eb.selectFrom("Operation").select("Operation.id").where((web) => web.or(condition.streams.map((s) => web.and([
 			web("Operation.documentId", "=", s.documentId),
@@ -2809,6 +3195,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			"action",
 			"skip",
 			"error",
+			"deniedReason",
 			"hash"
 		]).expression(expression).returning("id").execute()).length;
 	}
@@ -2898,6 +3285,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			hash: row.hash,
 			skip: row.skip,
 			error: row.error || void 0,
+			deniedReason: row.deniedReason || void 0,
 			id: row.opId,
 			action: row.action
 		};
@@ -2983,8 +3371,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -3009,8 +3397,8 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -3026,14 +3414,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -3045,14 +3433,14 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -3073,8 +3461,8 @@ async function up$8(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
+async function up$8(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -3084,14 +3472,14 @@ async function up$7(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
+async function up$7(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
+async function up$6(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -3105,8 +3493,8 @@ async function up$5(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
-async function up$4(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
+async function up$5(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -3114,8 +3502,8 @@ async function up$4(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
-async function up$3(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
+async function up$4(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -3124,24 +3512,43 @@ async function up$3(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
-async function up$2(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
+async function up$3(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$1 });
-async function up$1(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
+async function up$2(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up });
-async function up(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$1 });
+async function up$1(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
+//#region src/storage/migrations/015_add_operation_denied_reason.ts
+var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Records why authorization refused an operation. Separate from `error` so a
+* denial is distinguishable from a reducer failure without matching on a
+* message. Null for every operation written before decisions were enforced.
+*/
+async function up(db) {
+	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
+	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
+}
+async function down(db) {
+	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
+	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -3158,7 +3565,8 @@ const migrations = {
 	"011_add_cursor_type_column": _011_add_cursor_type_column_exports,
 	"012_add_source_remote_column": _012_add_source_remote_column_exports,
 	"013_create_sync_dead_letters_table": _013_create_sync_dead_letters_table_exports,
-	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports
+	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports,
+	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -3212,6 +3620,6 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { DocumentDeletedError as A, OptimisticLockError as C, InvalidModuleError as D, DuplicateModuleError as E, __exportAll as F, matchesScope as M, parsePagingOptions as N, ModuleNotFoundError as O, throwIfAborted as P, DuplicateOperationError as S, DuplicateManifestError as T, createConsistencyToken as _, createForwardingPoolInstrumentation as a, APPEND_CONDITION_FAILED_PREFIX as b, KyselyKeyframeStore as c, DriveCollectionId as d, KyselyExecutionScope as f, DocumentMetaCache as g, KyselyOperationIndex as h, runMigrations as i, DocumentNotFoundError as j, AuthorizationDeniedError as k, DocumentModelRegistry as l, KyselyWriteCache as m, REACTOR_SCHEMA as n, instrumentPgPool as o, EventBus as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, createEmptyConsistencyToken as v, RevisionMismatchError as w, AppendConditionFailedError as x, CollectionMembershipCache as y };
+export { AuthorizationDeniedError as A, DuplicateOperationError as C, DuplicateModuleError as D, DuplicateManifestError as E, throwIfAborted as F, __exportAll as I, DocumentNotFoundError as M, matchesScope as N, InvalidModuleError as O, parsePagingOptions as P, AppendConditionFailedError as S, RevisionMismatchError as T, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, CollectionMembershipCache as b, KyselyKeyframeStore as c, DriveCollectionId as d, buildDecisionModel as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, DocumentDeletedError as j, ModuleNotFoundError as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, KyselyExecutionScope as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, createConsistencyToken as v, OptimisticLockError as w, APPEND_CONDITION_FAILED_PREFIX as x, createEmptyConsistencyToken as y };
 
-//# sourceMappingURL=drive-container-types-uigTGO3i.js.map
+//# sourceMappingURL=drive-container-types-BNwEHEXP.js.map