@powerhousedao/reactor 6.2.2-dev.3 → 6.2.2-dev.31

package/dist/{drive-container-types-DpJp2AmE.js → drive-container-types-BNwEHEXP.js}

@@ -1,5 +1,5 @@
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { DowngradeNotSupportedError, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, createPresignedHeader, defaultBaseState, deriveOperationId, isUndoRedo } from "@powerhousedao/shared/document-model";
+import { DowngradeNotSupportedError, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, garbageCollect, hashDocumentStateForScope, isDenied, isUndoRedo, sortOperations } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -72,6 +72,27 @@ var DocumentDeletedError = class DocumentDeletedError extends Error {
 	}
 };
 /**
+* Error thrown when the auth policy denies an action at the executor gate.
+*/
+var AuthorizationDeniedError = class AuthorizationDeniedError extends Error {
+	documentId;
+	scope;
+	operation;
+	subject;
+	constructor(documentId, scope, operation, subject) {
+		super(`Authorization denied: ${subject ?? "anonymous"} may not execute ${operation} in scope "${scope}" of document ${documentId}`);
+		this.name = "AuthorizationDeniedError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.operation = operation;
+		this.subject = subject;
+		Error.captureStackTrace(this, AuthorizationDeniedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthorizationDeniedError";
+	}
+};
+/**
 * Error thrown when an operation has an invalid signature.
 */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
@@ -181,6 +202,57 @@ var InvalidUpgradeStepError = class extends Error {
 	}
 };
 //#endregion
+//#region src/storage/interfaces.ts
+/**
+* Thrown when an operation with the same identity already exists in the store.
+*/
+var DuplicateOperationError = class extends Error {
+	constructor(description) {
+		super(`Duplicate operation: ${description}`);
+		this.name = "DuplicateOperationError";
+	}
+};
+/**
+* Thrown when a concurrent write conflict is detected during an atomic apply.
+*/
+var OptimisticLockError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OptimisticLockError";
+	}
+};
+/**
+* Thrown when the caller-provided revision does not match the current
+* stored revision, indicating a stale read.
+*/
+var RevisionMismatchError = class extends Error {
+	constructor(expected, actual) {
+		super(`Revision mismatch: expected ${expected}, got ${actual}`);
+		this.name = "RevisionMismatchError";
+	}
+};
+/** Error history keeps messages, not classes, so failures match by prefix. */
+const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
+/**
+* A read-set stream grew before the append committed. A concurrency
+* conflict, not a fault: the caller retries against the new stream heads.
+*/
+var AppendConditionFailedError = class extends Error {
+	constructor(condition) {
+		const streams = condition.streams.map((s) => `${s.documentId}:${s.scope}:${s.branch}@${s.revision}`).join(", ");
+		super(`${APPEND_CONDITION_FAILED_PREFIX}a read-set stream advanced [${streams}]`);
+		this.condition = condition;
+		this.name = "AppendConditionFailedError";
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AppendConditionFailedError";
+	}
+	/** True when a recorded error message is an append-condition failure. */
+	static isFailureMessage(message) {
+		return message.startsWith(APPEND_CONDITION_FAILED_PREFIX);
+	}
+};
+//#endregion
 //#region src/cache/collection-membership-cache.ts
 var CollectionMembershipCache = class CollectionMembershipCache {
 	cache = /* @__PURE__ */ new Map();
@@ -634,6 +706,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				skip: op.skip,
 				hash: op.hash,
 				action: op.action,
+				deniedReason: op.deniedReason ?? null,
 				sourceRemote: op.sourceRemote
 			}));
 			operationOrdinals = (await trx.insertInto("operation_index_operations").values(operationRows).returning("ordinal").execute()).map((row) => row.ordinal);
@@ -765,6 +838,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				hash: row.hash,
 				skip: row.skip,
 				action: row.action,
+				deniedReason: row.deniedReason ?? void 0,
 				id: row.opId
 			},
 			context: {
@@ -788,6 +862,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			hash: row.hash,
 			skip: row.skip,
 			action: row.action,
+			deniedReason: row.deniedReason ?? void 0,
 			id: row.opId,
 			sourceRemote: row.sourceRemote
 		};
@@ -873,11 +948,69 @@ var RingBuffer = class {
 	}
 };
 //#endregion
+//#region src/cache/write-cache-types.ts
+/**
+* Where a snapshot sits in its stream.
+*
+* - `Head`: the newest revision of the stream when it was stored. Only these
+*   can answer a read that asks for the head.
+* - `Historical`: state at an earlier revision. Usable as a starting point to
+*   replay forward from, and as an answer to a read for that same revision.
+*/
+let SnapshotPosition = /* @__PURE__ */ function(SnapshotPosition) {
+	SnapshotPosition["Head"] = "head";
+	SnapshotPosition["Historical"] = "historical";
+	return SnapshotPosition;
+}({});
+//#endregion
 //#region src/cache/kysely-write-cache.ts
+/**
+* The last operation index a keyframe's document reflects for the scope. A
+* keyframe only exists for a scope that has operations, so a missing entry
+* means the stored row is corrupt.
+*/
+function keyframeRevision(keyframe, documentId, scope) {
+	const nextIndex = keyframe.document.header.revision[scope];
+	if (typeof nextIndex !== "number") throw new Error(`Corrupt keyframe for document ${documentId} at revision ${keyframe.revision}: header carries no ${scope} revision`);
+	return nextIndex - 1;
+}
+/**
+* Records a denied operation in the history without applying it. This is used
+* for auth-rejected operations, as these need to be recorded without being
+* applied.
+*/
+function appendWithoutApplying(document, scope, operation) {
+	return {
+		...document,
+		operations: {
+			...document.operations,
+			[scope]: [...document.operations[scope] ?? [], operation]
+		}
+	};
+}
 function extractModuleVersion(doc) {
 	const v = doc.state.document.version;
 	return v === 0 ? void 0 : v;
 }
+/** The highest revision held, latest push winning a tie. */
+function highestRevision(snapshots) {
+	let newest = void 0;
+	for (const snapshot of snapshots) if (!newest || snapshot.revision >= newest.revision) newest = snapshot;
+	return newest;
+}
+/**
+* Copies a document far enough that the caller cannot write through it. Inside
+* this class, callers only ever replace whole fields on these four, so one
+* level each is enough.
+*/
+function copyDocument(document) {
+	return {
+		...document,
+		header: { ...document.header },
+		state: { ...document.state },
+		operations: { ...document.operations }
+	};
+}
 /**
 * In-memory write cache with keyframe persistence for PHDocuments.
 *
@@ -956,6 +1089,8 @@ var KyselyWriteCache = class KyselyWriteCache {
 	/**
 	* Retrieves document state at a specific revision from cache or rebuilds it.
 	*
+	* Note: this returns a _shallow_ copy of the document.
+	*
 	* Cache hit path: Returns cached snapshot if available (O(1))
 	* Warm miss path: Rebuilds from cached base revision + incremental ops
 	* Cold miss path: Rebuilds from keyframe or from scratch using all operations
@@ -979,30 +1114,35 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if (stream) {
 			const snapshots = stream.ringBuffer.getAll();
 			if (targetRevision === void 0) {
-				if (snapshots.length > 0) {
-					const newest = snapshots[snapshots.length - 1];
+				const newest = highestRevision(snapshots);
+				if (newest?.position === SnapshotPosition.Head) {
 					this.lruTracker.touch(streamKey);
-					return newest.document;
+					return copyDocument(newest.document);
+				}
+				if (newest) {
+					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
+					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, SnapshotPosition.Head);
+					this.lruTracker.touch(streamKey);
+					return document;
 				}
 			} else {
-				const exactMatch = snapshots.find((s) => s.revision === targetRevision);
+				const exactMatch = snapshots.findLast((s) => s.revision === targetRevision);
 				if (exactMatch) {
 					this.lruTracker.touch(streamKey);
-					return exactMatch.document;
+					return copyDocument(exactMatch.document);
 				}
 				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
 				if (newestOlder) {
 					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
-					this.putState(documentId, scope, branch, targetRevision, document);
+					this.store(documentId, scope, branch, targetRevision, document, SnapshotPosition.Historical);
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
 			}
 		}
 		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
-		let revision = targetRevision;
-		if (revision === void 0) revision = document.header.revision[scope] || 0;
-		this.putState(documentId, scope, branch, revision, document);
+		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
+		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? SnapshotPosition.Head : SnapshotPosition.Historical);
 		return document;
 	}
 	/**
@@ -1025,16 +1165,20 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* @param document - The document to cache
 	* @throws {Error} If document serialization fails
 	*/
-	putState(documentId, scope, branch, revision, document) {
+	putState(documentId, scope, branch, revision, document, position) {
+		this.store(documentId, scope, branch, revision, document, position);
+	}
+	store(documentId, scope, branch, revision, document, position) {
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
 		const stream = this.getOrCreateStream(streamKey);
 		const snapshot = {
 			revision,
 			document: {
-				...document,
+				...copyDocument(document),
 				operations: Object.fromEntries(Object.entries(document.operations).map(([k, ops]) => [k, ops.length ? [ops.at(-1)] : []])),
 				clipboard: []
-			}
+			},
+			position
 		};
 		stream.ringBuffer.push(snapshot);
 		if (this.isKeyframeRevision(revision)) this.keyframeStore.putKeyframe(documentId, scope, branch, revision, {
@@ -1102,58 +1246,75 @@ var KyselyWriteCache = class KyselyWriteCache {
 	}
 	async findNearestKeyframe(documentId, scope, branch, targetRevision, signal) {
 		if (targetRevision === Number.MAX_SAFE_INTEGER || targetRevision <= 0) return;
-		return this.keyframeStore.findNearestKeyframe(documentId, scope, branch, targetRevision, signal);
+		const keyframe = await this.keyframeStore.findNearestKeyframe(documentId, scope, branch, targetRevision, signal);
+		if (!keyframe) return;
+		return {
+			revision: Math.min(keyframeRevision(keyframe, documentId, scope), keyframe.revision),
+			document: keyframe.document
+		};
 	}
 	async coldMissRebuild(documentId, scope, branch, targetRevision, signal) {
 		const effectiveTargetRevision = targetRevision || Number.MAX_SAFE_INTEGER;
 		const keyframe = await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal);
+		const documentScopeBound = scope === "document" ? targetRevision : void 0;
 		let document;
 		let startRevision;
 		let documentType;
 		const validatedUpgrades = [];
+		let lastDocumentScopeOperation;
 		if (keyframe) {
 			document = keyframe.document;
 			startRevision = keyframe.revision;
 			documentType = keyframe.document.header.documentType;
-			const docScopeOpsAfterKeyframe = await this.operationStore.getSince(documentId, "document", branch, keyframe.revision, void 0, void 0, signal);
-			for (const operation of docScopeOpsAfterKeyframe.results) if (operation.action.type === "UPGRADE_DOCUMENT") {
-				const upgradeAction = operation.action;
-				const fromVersion = upgradeAction.input.fromVersion;
-				const toVersion = upgradeAction.input.toVersion;
-				if (fromVersion > 0 && fromVersion < toVersion) {
-					let upgradePath;
-					try {
-						upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
-					} catch (err) {
-						if (upgradeAction.input.initialState !== void 0) upgradePath = void 0;
-						else throw new Error(`Failed to rebuild document ${documentId}: no upgrade manifest for ${documentType} v${fromVersion}→v${toVersion} and no initialState snapshot. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			const documentScopeResume = scope === "document" ? keyframe.revision : keyframeRevision(keyframe, documentId, "document");
+			const docScopeOpsAfterKeyframe = await this.operationStore.getSince(documentId, "document", branch, documentScopeResume, void 0, void 0, signal);
+			for (const operation of docScopeOpsAfterKeyframe.results) {
+				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
+				lastDocumentScopeOperation = operation;
+				if (operation.error || isDenied(operation)) continue;
+				if (operation.action.type === "UPGRADE_DOCUMENT") {
+					const upgradeAction = operation.action;
+					const fromVersion = upgradeAction.input.fromVersion;
+					const toVersion = upgradeAction.input.toVersion;
+					if (fromVersion > 0 && fromVersion < toVersion) {
+						let upgradePath;
+						try {
+							upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
+						} catch (err) {
+							if (upgradeAction.input.initialState !== void 0) upgradePath = void 0;
+							else throw new Error(`Failed to rebuild document ${documentId}: no upgrade manifest for ${documentType} v${fromVersion}→v${toVersion} and no initialState snapshot. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+						}
+						validatedUpgrades.push({
+							fromVersion,
+							toVersion,
+							revision: upgradeAction.input.revision,
+							timestampUtcMs: operation.timestampUtcMs
+						});
+						document = applyUpgradeDocumentAction(document, upgradeAction, upgradePath);
 					}
-					validatedUpgrades.push({
-						fromVersion,
-						toVersion,
-						revision: upgradeAction.input.revision,
-						timestampUtcMs: operation.timestampUtcMs
-					});
-					document = applyUpgradeDocumentAction(document, upgradeAction, upgradePath);
-				}
-			} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
+				} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
+			}
 		} else {
 			startRevision = -1;
 			const createOpResult = await this.operationStore.getSince(documentId, "document", branch, -1, void 0, {
 				cursor: "0",
 				limit: 1
 			}, signal);
-			if (createOpResult.results.length === 0) throw new Error(`Failed to rebuild document ${documentId}: no CREATE_DOCUMENT operation found in document scope`);
+			if (createOpResult.results.length === 0) throw new DocumentNotFoundError(documentId);
 			const createOp = createOpResult.results[0];
 			if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Failed to rebuild document ${documentId}: first operation in document scope must be CREATE_DOCUMENT, found ${createOp.action.type}`);
 			const documentCreateAction = createOp.action;
 			documentType = documentCreateAction.input.model;
 			if (!documentType) throw new Error(`Failed to rebuild document ${documentId}: CREATE_DOCUMENT action missing model in input`);
 			document = createDocumentFromAction(documentCreateAction);
+			lastDocumentScopeOperation = createOp;
 			let docModule = this.registry.getModule(documentType, extractModuleVersion(document));
 			const docScopeOps = await this.operationStore.getSince(documentId, "document", branch, 0, void 0, void 0, signal);
 			for (const operation of docScopeOps.results) {
+				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
+				lastDocumentScopeOperation = operation;
 				if (operation.index === 0) continue;
+				if (operation.error || isDenied(operation)) continue;
 				if (operation.action.type === "UPGRADE_DOCUMENT") {
 					const upgradeAction = operation.action;
 					const fromVersion = upgradeAction.input.fromVersion;
@@ -1177,7 +1338,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 					docModule = this.registry.getModule(documentType, extractModuleVersion(document));
 				} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
 				else {
-					const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
+					const protocolVersion = baseReducerVersion(document.header);
 					document = docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
@@ -1185,6 +1346,21 @@ var KyselyWriteCache = class KyselyWriteCache {
 				}
 			}
 		}
+		if (scope === "document") {
+			const last = lastDocumentScopeOperation ?? await this.operationAt(documentId, "document", branch, startRevision, signal);
+			document.operations = {
+				...document.operations,
+				document: last ? [last] : []
+			};
+			return this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+		}
+		if (keyframe) {
+			const resumeOperation = await this.operationAt(documentId, scope, branch, startRevision, signal);
+			if (resumeOperation) document.operations = {
+				...document.operations,
+				[scope]: [resumeOperation]
+			};
+		}
 		const moduleCache = /* @__PURE__ */ new Map();
 		const getModuleCached = (version) => {
 			const key = version ?? 0;
@@ -1209,11 +1385,14 @@ var KyselyWriteCache = class KyselyWriteCache {
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
 					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, extractModuleVersion(document));
-					const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
-					document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
-						skip: operation.skip,
-						protocolVersion
-					});
+					if (isDenied(operation)) document = appendWithoutApplying(document, scope, operation);
+					else {
+						const protocolVersion = baseReducerVersion(document.header);
+						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+							skip: operation.skip,
+							protocolVersion
+						});
+					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
 				hasMorePages = Boolean(result.nextCursor) && !reachedTarget;
@@ -1222,11 +1401,31 @@ var KyselyWriteCache = class KyselyWriteCache {
 				throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 			}
 		} while (hasMorePages);
+		return this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+	}
+	/**
+	* Copies the current document revisions onto the document. Overwrites the
+	* requested scope revision with the target revision, if provided.
+	*/
+	async stampRevisions(document, documentId, scope, branch, targetRevision, signal) {
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
+		if (targetRevision !== void 0) document.header.revision = {
+			...document.header.revision,
+			[scope]: targetRevision + 1
+		};
 		document.header.lastModifiedAtUtcIso = revisions.latestTimestamp;
 		return document;
 	}
+	/** The stored operation at `index`, or undefined if it is no longer there. */
+	async operationAt(documentId, scope, branch, index, signal) {
+		if (index < 0) return;
+		const operation = (await this.operationStore.getSince(documentId, scope, branch, index - 1, void 0, {
+			cursor: "0",
+			limit: 1
+		}, signal)).results[0];
+		return operation && operation.index === index ? operation : void 0;
+	}
 	/**
 	* Resolves which module version to use for a given operation in phase 2.
 	*
@@ -1250,19 +1449,22 @@ var KyselyWriteCache = class KyselyWriteCache {
 	async warmMissRebuild(baseDocument, baseRevision, documentId, scope, branch, targetRevision, signal) {
 		const documentType = baseDocument.header.documentType;
 		const docScopeNextIndex = baseDocument.header.revision["document"] ?? 0;
-		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.some((op) => op.action.type === "UPGRADE_DOCUMENT")) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
+		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.length > 0) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const module = this.registry.getModule(documentType, extractModuleVersion(baseDocument));
-		let document = baseDocument;
+		let document = copyDocument(baseDocument);
 		try {
 			const pagedResults = await this.operationStore.getSince(documentId, scope, branch, baseRevision, void 0, void 0, signal);
 			for (const operation of pagedResults.results) {
 				if (signal?.aborted) throw new Error("Operation aborted");
 				if (targetRevision !== void 0 && operation.index > targetRevision) break;
-				const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
-				document = module.reducer(document, operation.action, void 0, {
-					skip: operation.skip,
-					protocolVersion
-				});
+				if (isDenied(operation)) document = appendWithoutApplying(document, scope, operation);
+				else {
+					const protocolVersion = baseReducerVersion(document.header);
+					document = module.reducer(document, operation.action, void 0, {
+						skip: operation.skip,
+						protocolVersion
+					});
+				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
 		} catch (err) {
@@ -1270,6 +1472,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 		}
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
+		if (targetRevision !== void 0) document.header.revision = {
+			...document.header.revision,
+			[scope]: targetRevision + 1
+		};
 		document.header.lastModifiedAtUtcIso = revisions.latestTimestamp;
 		return document;
 	}
@@ -1436,6 +1642,260 @@ function reshuffleByTimestamp(startIndex, opsA, opsB) {
 	}));
 }
 //#endregion
+//#region src/decision/build-decision-model.ts
+/**
+* Reads each projection's stream through the write cache, recording the
+* revision observed. Static projections resolve first; derived projections
+* see only those and contribute a map from document id to state. Each
+* distinct stream is read once and yields one append condition entry.
+*/
+async function buildDecisionModel(cache, definition, target, signal) {
+	const decisionModel = definition(target);
+	const projections = Object.entries(decisionModel.projections);
+	const reads = /* @__PURE__ */ new Map();
+	const model = {};
+	for (const [key, projection] of projections) {
+		if (typeof projection.query === "function") continue;
+		model[key] = (await readStream(cache, projection.query, reads, signal)).state;
+	}
+	const staticModel = { ...model };
+	for (const [key, projection] of projections) {
+		if (typeof projection.query !== "function") continue;
+		const queries = projection.query(staticModel);
+		const value = {};
+		for (const query of queries) {
+			const read = await readStream(cache, query, reads, signal);
+			value[query.documentId] = read.state;
+		}
+		model[key] = value;
+	}
+	return {
+		model,
+		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
+	};
+}
+async function readStream(cache, query, reads, signal) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	const existing = reads.get(key);
+	if (existing) return existing;
+	const document = await cache.getState(query.documentId, query.scope, query.branch, void 0, signal);
+	const read = {
+		state: document.state[query.scope],
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: observedRevision(document, query.scope)
+		}
+	};
+	reads.set(key, read);
+	return read;
+}
+/**
+* The highest operation index the document reflects for the scope, or -1 if
+* empty. `header.revision` is authoritative, not the rebuilt operation list.
+*/
+function observedRevision(document, scope) {
+	if (scope in document.header.revision) return document.header.revision[scope] - 1;
+	if (scope in document.operations) {
+		const operations = document.operations[scope];
+		if (operations.length > 0) return operations[operations.length - 1].index;
+	}
+	if (!(scope in document.header.revision)) return -1;
+	return document.header.revision[scope] - 1;
+}
+/**
+* The streams a model reads whose queries are known before it is built. A
+* derived query needs the statically-queried projections first, so it is not
+* included here.
+*/
+function staticReadSet(definition) {
+	const streams = [];
+	for (const projection of Object.values(definition.projections)) {
+		if (typeof projection.query === "function") continue;
+		streams.push({
+			query: projection.query,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply
+		});
+	}
+	return streams;
+}
+//#endregion
+//#region src/decision/document-decision-model.ts
+/** Why the model refused an operation. */
+const DOCUMENT_DELETED_REASON = "document deleted";
+/**
+* The simplest decision model: one projection over the document scope, which
+* rejects on a deleted document.
+*/
+function documentDecisionModel(target) {
+	return {
+		projections: { document: {
+			decidingActions: ["DELETE_DOCUMENT"],
+			apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+				...document,
+				state: { ...document.state }
+			}, operation.action) : document,
+			query: {
+				documentId: target.documentId,
+				branch: target.branch,
+				scope: "document"
+			}
+		} },
+		judgesScope() {
+			return true;
+		},
+		decide(model) {
+			return model.document.isDeleted ? "deny" : "allow";
+		}
+	};
+}
+//#endregion
+//#region src/decision/merged-order.ts
+/** Identifies a stream within a walk. */
+function streamKey(query) {
+	return `${query.documentId}:${query.scope}:${query.branch}`;
+}
+/**
+* Orders two operations from different streams by position. Timestamp decides;
+* an equal timestamp falls to the action id and then the operation id, so that
+* two replicas holding the same operations agree on the order whatever order
+* they happen to store them in.
+*/
+function comparePositions(a, b) {
+	const aTime = Date.parse(a.operation.timestampUtcMs);
+	const bTime = Date.parse(b.operation.timestampUtcMs);
+	if (aTime !== bTime) return aTime - bTime;
+	const actionIds = (a.operation.action.id ?? "").localeCompare(b.operation.action.id ?? "");
+	if (actionIds !== 0) return actionIds;
+	return (a.operation.id ?? "").localeCompare(b.operation.id ?? "");
+}
+/**
+* Merges the read-set streams into one sequence by position. Each stream keeps
+* its stored order; only how far to go is decided by the timestamp, so a stream
+* whose stored order disagrees with its timestamp order still applies in the
+* order it is stored.
+*
+* An operation's position in the result is the bound a decision at that
+* operation reads to: every operation before it has been applied, and it has
+* not.
+*/
+function mergeByPosition(streams) {
+	const merged = [];
+	for (const stream of streams) for (const operation of stream.operations) merged.push({
+		streamKey: stream.streamKey,
+		operation
+	});
+	return merged.sort(comparePositions);
+}
+/**
+* For auth-related reshuffles, we may need to retract previous operations.
+* This function calculates the needed skip value.
+*/
+function retractionSkip(nextIndex, firstRetractedIndex) {
+	return nextIndex - firstRetractedIndex;
+}
+//#endregion
+//#region src/decision/walk.ts
+/**
+* Visits every operation in the read-set once, in the order their positions
+* fall, and hands back the state each stream held just before it. That state is
+* what a decision at that operation reads: everything ahead of it has been
+* applied and it has not.
+*
+* Skips are resolved first (i.e. this is performed on a garbage collected
+* stream), which means we can do a single forward pass.
+*
+* A denied operation is visited but not applied.
+*/
+function* walkByPosition(streams) {
+	const merged = mergeByPosition(streams.map((stream) => ({
+		streamKey: stream.streamKey,
+		operations: garbageCollect(sortOperations([...stream.operations]))
+	})));
+	const states = new Map(streams.map((stream) => [stream.streamKey, stream.document]));
+	for (const { streamKey, operation } of merged) {
+		yield {
+			streamKey,
+			operation,
+			states: new Map(states)
+		};
+		if (isDenied(operation)) continue;
+		const stream = streams.find((candidate) => candidate.streamKey === streamKey);
+		const before = states.get(streamKey);
+		if (before === void 0 || stream === void 0) throw new Error(`No state for stream ${streamKey}`);
+		states.set(streamKey, stream.apply(before, operation));
+	}
+}
+//#endregion
+//#region src/decision/deletion-verdicts.ts
+const WRITTEN = "written";
+/** Whether a read stream counts this action as one that changes a verdict. */
+function canRefuseOthers(operation, readSet) {
+	return readSet.some((stream) => stream.decidingActions.includes(operation.action.type));
+}
+/** The deleted one of these, or the first if none of them is deleted. */
+function firstDeleted(candidates) {
+	for (const candidate of candidates) if (candidate?.state.document.isDeleted) return candidate.state.document;
+	return candidates[0].state.document;
+}
+/**
+* This function determines which operations will be refused because of
+* deletes, returning reasons in a parallel array (undefined means the
+* operation is not refused).
+*
+* A deletion already in the stream refuses the operations timestamped after it
+* and leaves the earlier ones alone. A deletion among the ones passed in does
+* the same to those after it.
+*/
+async function deletionVerdictsByPosition(documentId, scope, branch, operations, writeCache, operationStore, signal) {
+	const definition = documentDecisionModel({
+		documentId,
+		branch
+	});
+	const readSet = staticReadSet(definition);
+	if (!definition.judgesScope(scope)) return operations.map(() => void 0);
+	const readStreams = await Promise.all(readSet.map(async (stream) => ({
+		stream,
+		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, 0, { actionTypes: stream.decidingActions }, void 0, signal)).results
+	})));
+	const decidingWritten = operations.filter((operation) => canRefuseOthers(operation, readSet));
+	if (readStreams.every((read) => read.operations.length === 0) && decidingWritten.length === 0) return operations.map(() => void 0);
+	const walked = [];
+	for (const read of readStreams) {
+		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, 0, signal);
+		walked.push({
+			streamKey: streamKey(read.stream.query),
+			document: before,
+			operations: read.operations,
+			apply: read.stream.apply
+		});
+	}
+	const writtenStreamIsRead = readSet.find((stream) => stream.query.scope === scope);
+	walked.push({
+		streamKey: WRITTEN,
+		document: walked[0].document,
+		operations,
+		apply: writtenStreamIsRead?.apply ?? ((document) => document)
+	});
+	const reasons = /* @__PURE__ */ new Map();
+	for (const step of walkByPosition(walked)) {
+		if (step.streamKey !== WRITTEN) continue;
+		const document = firstDeleted([...step.states.values()]);
+		const decision = definition.decide({ document }, {
+			address: void 0,
+			key: void 0
+		}, {
+			verb: "execute",
+			scope,
+			operation: step.operation.action.type
+		}, { scopeState: void 0 });
+		reasons.set(step.operation.id, decision === "deny" ? DOCUMENT_DELETED_REASON : void 0);
+	}
+	return operations.map((operation) => reasons.get(operation.id));
+}
+//#endregion
 //#region src/cache/operation-index-types.ts
 const DRIVE_COLLECTION_PREFIX = "drive.";
 /**
@@ -1487,11 +1947,11 @@ var DocumentActionHandler = class {
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
 	}
-	async execute(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	async execute(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal, verdictAlreadyDecided = false) {
 		switch (action.type) {
 			case "CREATE_DOCUMENT": return this.executeCreate(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
-			case "DELETE_DOCUMENT": return this.executeDelete(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "UPGRADE_DOCUMENT": return this.executeUpgrade(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
+			case "DELETE_DOCUMENT": return this.executeDelete(job, action, startTime, indexTxn, stores, sourceRemote, signal, verdictAlreadyDecided);
+			case "UPGRADE_DOCUMENT": return this.executeUpgrade(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal, verdictAlreadyDecided);
 			case "ADD_RELATIONSHIP": return this.executeAddRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
 			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
 			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
@@ -1524,7 +1984,7 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId: document.header.id,
@@ -1545,7 +2005,7 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
 	}
-	async executeDelete(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
+	async executeDelete(job, action, startTime, indexTxn, stores, sourceRemote = "", signal, verdictAlreadyDecided = false) {
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("DELETE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -1556,7 +2016,7 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document before deletion: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		if (documentState.isDeleted && !verdictAlreadyDecided) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
 		let operation = createOperation(action, getNextIndexForScope(document, job.scope), 0, {
 			documentId,
 			scope: job.scope,
@@ -1576,7 +2036,7 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -1592,7 +2052,7 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	async executeUpgrade(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	async executeUpgrade(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal, verdictAlreadyDecided = false) {
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("UPGRADE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -1605,7 +2065,7 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		if (documentState.isDeleted && !verdictAlreadyDecided) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
 		const nextIndex = getNextIndexForScope(document, job.scope);
 		let upgradePath;
 		if (fromVersion > 0 && fromVersion < toVersion) try {
@@ -1643,7 +2103,7 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -1714,7 +2174,7 @@ var DocumentActionHandler = class {
 			[job.scope]: scopeState === void 0 ? {} : structuredClone(scopeState)
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc);
+		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId: input.sourceId,
@@ -1746,10 +2206,11 @@ var DocumentActionHandler = class {
 		} catch (error) {
 			this.logger.error("Error writing @Operation to IOperationStore: @Error", operation, error);
 			stores.writeCache.invalidate(documentId, scope, branch);
+			if (AppendConditionFailedError.isError(error)) for (const stream of error.condition.streams) stores.writeCache.invalidate(stream.documentId, stream.scope, stream.branch);
 			return {
 				job,
 				success: false,
-				error: /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
+				error: AppendConditionFailedError.isError(error) ? error : /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
 				duration: Date.now() - startTime
 			};
 		}
@@ -1827,6 +2288,7 @@ const documentScopeActions = [
 */
 var SimpleJobExecutor = class {
 	config;
+	featureFlags;
 	signatureVerifierModule;
 	documentActionHandler;
 	executionScope;
@@ -1841,6 +2303,7 @@ var SimpleJobExecutor = class {
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
 		this.config = {
+			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
 			maxConcurrency: config.maxConcurrency ?? 1,
 			jobTimeoutMs: config.jobTimeoutMs ?? 3e4,
@@ -1848,6 +2311,7 @@ var SimpleJobExecutor = class {
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50
 		};
+		this.featureFlags = { documentDecisions: config.featureFlags?.documentDecisions ?? false };
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
 		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
@@ -1931,7 +2395,7 @@ var SimpleJobExecutor = class {
 		const documentIds = [...new Set(operations.map((op) => op.context.documentId))];
 		return stores.collectionMembershipCache.getCollectionsForDocuments(documentIds);
 	}
-	async processActions(job, actions, startTime, indexTxn, stores, skipValues, sourceOperations, sourceRemote = "", signal) {
+	async processActions(job, actions, startTime, indexTxn, stores, skipValues, sourceOperations, sourceRemote = "", signal, deniedReasons) {
 		const generatedOperations = [];
 		const operationsWithContext = [];
 		try {
@@ -1955,7 +2419,8 @@ var SimpleJobExecutor = class {
 			const action = actions[actionIndex];
 			const skip = skipValues?.[actionIndex] ?? 0;
 			const sourceOperation = sourceOperations?.[actionIndex];
-			const result = documentScopeActions.includes(action.type) ? await this.documentActionHandler.execute(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal) : await this.executeRegularAction(job, action, startTime, indexTxn, stores, skip, sourceOperation, sourceRemote, signal);
+			const deniedReason = deniedReasons?.[actionIndex];
+			const result = documentScopeActions.includes(action.type) ? await this.documentActionHandler.execute(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal, this.featureFlags.documentDecisions && job.kind === "load") : await this.executeRegularAction(job, action, startTime, indexTxn, stores, skip, sourceOperation, sourceRemote, signal, deniedReason);
 			const error = this.accumulateResultOrReturnError(result, generatedOperations, operationsWithContext);
 			if (error !== null) return {
 				success: false,
@@ -1980,14 +2445,43 @@ var SimpleJobExecutor = class {
 			operationsWithContext
 		};
 	}
-	async executeRegularAction(job, action, startTime, indexTxn, stores, skip = 0, sourceOperation, sourceRemote = "", signal) {
-		let docMeta;
-		try {
-			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
-		} catch (error) {
-			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+	async executeRegularAction(job, action, startTime, indexTxn, stores, skip = 0, sourceOperation, sourceRemote = "", signal, deniedReason) {
+		let appendCondition;
+		let documentVersion;
+		const verdictAlreadyDecided = this.featureFlags.documentDecisions && job.kind === "load";
+		if (this.featureFlags.documentDecisions && !verdictAlreadyDecided) {
+			const target = {
+				documentId: job.documentId,
+				branch: job.branch
+			};
+			const definition = documentDecisionModel(target);
+			let built;
+			try {
+				built = await buildDecisionModel(stores.writeCache, () => definition, target, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (definition.decide(built.model, {
+				address: action.context?.signer?.user.address,
+				key: action.context?.signer?.app.key
+			}, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}, { scopeState: void 0 }) === "deny") return buildErrorResult(job, new DocumentDeletedError(job.documentId, built.model.document.deletedAtUtcIso), startTime);
+			appendCondition = built.appendCondition;
+			documentVersion = built.model.document.version;
+		} else if (verdictAlreadyDecided) documentVersion = (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).state.document.version;
+		else {
+			let docMeta;
+			try {
+				docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+			documentVersion = docMeta.state.version;
 		}
-		if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		if (isUndoRedo(action) || action.type === "PRUNE" || action.type === "NOOP" && skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		try {
@@ -1995,16 +2489,42 @@ var SimpleJobExecutor = class {
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
+		if (job.kind !== "load") {
+			const subject = {
+				address: action.context?.signer?.user.address,
+				key: action.context?.signer?.app.key
+			};
+			if (decide(document.state.auth, subject, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}) === "deny") return buildErrorResult(job, new AuthorizationDeniedError(job.documentId, action.scope, action.type, subject.address), startTime);
+		}
 		let module;
 		try {
-			const moduleVersion = docMeta.state.version === 0 ? void 0 : docMeta.state.version;
+			const moduleVersion = documentVersion === 0 ? void 0 : documentVersion;
 			module = this.registry.getModule(document.header.documentType, moduleVersion);
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
 		let updatedDocument;
-		try {
-			const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
+		if (deniedReason !== void 0) {
+			const denied = createOperation(action, getNextIndexForScope(document, job.scope), skip, {
+				documentId: job.documentId,
+				scope: job.scope,
+				branch: job.branch
+			});
+			denied.deniedReason = deniedReason;
+			denied.hash = hashDocumentStateForScope(document, job.scope);
+			updatedDocument = {
+				...document,
+				operations: {
+					...document.operations,
+					[job.scope]: [...document.operations[job.scope] ?? [], denied]
+				}
+			};
+		} else try {
+			const protocolVersion = baseReducerVersion(document.header);
 			const reducerOptions = sourceOperation ? {
 				skip,
 				branch: job.branch,
@@ -2035,14 +2555,15 @@ var SimpleJobExecutor = class {
 		try {
 			storedOperations = await stores.operationStore.apply(job.documentId, document.header.documentType, scope, job.branch, newOperation.index, (txn) => {
 				txn.addOperations(newOperation);
-			}, signal);
+			}, signal, appendCondition);
 		} catch (error) {
 			this.logger.error("Error writing @Operation to IOperationStore: @Error", newOperation, error);
 			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			if (AppendConditionFailedError.isError(error)) for (const stream of error.condition.streams) stores.writeCache.invalidate(stream.documentId, stream.scope, stream.branch);
 			return {
 				job,
 				success: false,
-				error: /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
+				error: AppendConditionFailedError.isError(error) ? error : /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
 				duration: Date.now() - startTime
 			};
 		}
@@ -2051,7 +2572,7 @@ var SimpleJobExecutor = class {
 			...updatedDocument.header.revision,
 			[scope]: storedOperation.index + 1
 		};
-		stores.writeCache.putState(job.documentId, scope, job.branch, storedOperation.index, updatedDocument);
+		stores.writeCache.putState(job.documentId, scope, job.branch, storedOperation.index, updatedDocument, SnapshotPosition.Head);
 		indexTxn.write([{
 			...storedOperation,
 			documentId: job.documentId,
@@ -2078,13 +2599,43 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
+	/**
+	* If an operation happened that could change a decision model verdict, we
+	* need to re-evaluate across the streams that could be affected. Previously
+	* approved operations may need to be denied, which will apply new denied
+	* operations with appropriate skip.
+	*/
+	async reevaluateReadingScopes(job, startTime, indexTxn, stores, signal) {
+		const definition = documentDecisionModel({
+			documentId: job.documentId,
+			branch: job.branch
+		});
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		for (const scope of Object.keys(revisions.revision)) {
+			if (!definition.judgesScope(scope)) continue;
+			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
+			const effective = garbageCollect(sortOperations([...stored]));
+			if (effective.length === 0) continue;
+			const recomputed = await deletionVerdictsByPosition(job.documentId, scope, job.branch, effective, stores.writeCache, stores.operationStore, signal);
+			const firstChange = effective.findIndex((operation, i) => operation.deniedReason !== recomputed[i]);
+			if (firstChange === -1) continue;
+			const tail = effective.slice(firstChange);
+			const nextIndex = revisions.revision[scope];
+			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			const result = await this.processActions({
+				...job,
+				scope
+			}, tail.map((operation) => operation.action), startTime, indexTxn, stores, tail.map((_, i) => i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0), void 0, "", signal, recomputed.slice(firstChange));
+			if (!result.success) return result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`);
+		}
+	}
 	async executeLoadJob(job, startTime, indexTxn, stores, signal) {
 		if (job.operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("Load job must include at least one operation"), startTime);
 		let docMeta;
 		try {
 			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
 		} catch {}
-		if (docMeta?.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+		if (docMeta?.state.isDeleted && !this.featureFlags.documentDecisions) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		const scope = job.scope;
 		let latestRevision;
 		try {
@@ -2173,8 +2724,19 @@ var SimpleJobExecutor = class {
 		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP") operation.skip = 1;
 		const actions = reshuffledOperations.map((operation) => operation.action);
 		const skipValues = reshuffledOperations.map((operation) => operation.skip);
+		let deniedReasons;
+		if (this.featureFlags.documentDecisions) try {
+			deniedReasons = await deletionVerdictsByPosition(job.documentId, scope, job.branch, reshuffledOperations, stores.writeCache, stores.operationStore, signal);
+		} catch (error) {
+			return {
+				job,
+				success: false,
+				error: error instanceof Error ? error : new Error(String(error)),
+				duration: Date.now() - startTime
+			};
+		}
 		const effectiveSourceRemote = skipCount > 0 ? "" : job.meta.sourceRemote || "";
-		const result = await this.processActions(job, actions, startTime, indexTxn, stores, skipValues, reshuffledOperations, effectiveSourceRemote, signal);
+		const result = await this.processActions(job, actions, startTime, indexTxn, stores, skipValues, reshuffledOperations, effectiveSourceRemote, signal, deniedReasons);
 		if (!result.success) return {
 			job,
 			success: false,
@@ -2183,6 +2745,23 @@ var SimpleJobExecutor = class {
 		};
 		stores.writeCache.invalidate(job.documentId, scope, job.branch);
 		if (scope === "document") stores.documentMetaCache.invalidate(job.documentId, job.branch);
+		const readsThisStream = staticReadSet(documentDecisionModel({
+			documentId: job.documentId,
+			branch: job.branch
+		})).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === scope && stream.query.branch === job.branch);
+		if (this.featureFlags.documentDecisions && readsThisStream) {
+			const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+			const latest = Date.parse(revisions.latestTimestamp);
+			if (result.generatedOperations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) {
+				const error = await this.reevaluateReadingScopes(job, startTime, indexTxn, stores, signal);
+				if (error) return {
+					job,
+					success: false,
+					error,
+					duration: Date.now() - startTime
+				};
+			}
+		}
 		return {
 			job,
 			success: true,
@@ -2419,36 +2998,6 @@ function paginateRows(rows, paging, cursorOf, toItem, refetch) {
 	};
 }
 //#endregion
-//#region src/storage/interfaces.ts
-/**
-* Thrown when an operation with the same identity already exists in the store.
-*/
-var DuplicateOperationError = class extends Error {
-	constructor(description) {
-		super(`Duplicate operation: ${description}`);
-		this.name = "DuplicateOperationError";
-	}
-};
-/**
-* Thrown when a concurrent write conflict is detected during an atomic apply.
-*/
-var OptimisticLockError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "OptimisticLockError";
-	}
-};
-/**
-* Thrown when the caller-provided revision does not match the current
-* stored revision, indicating a stale read.
-*/
-var RevisionMismatchError = class extends Error {
-	constructor(expected, actual) {
-		super(`Revision mismatch: expected ${expected}, got ${actual}`);
-		this.name = "RevisionMismatchError";
-	}
-};
-//#endregion
 //#region src/storage/txn.ts
 var AtomicTransaction = class {
 	operations = [];
@@ -2473,6 +3022,7 @@ var AtomicTransaction = class {
 			action: JSON.stringify(op.action),
 			skip: op.skip,
 			error: op.error || null,
+			deniedReason: op.deniedReason || null,
 			hash: op.hash
 		});
 	}
@@ -2506,12 +3056,12 @@ var KyselyOperationStore = class KyselyOperationStore {
 		instance.trx = trx;
 		return instance;
 	}
-	async apply(documentId, documentType, scope, branch, revision, fn, signal) {
+	async apply(documentId, documentType, scope, branch, revision, fn, signal, condition) {
 		if (this.trx) {
 			let executeResult = null;
 			let uniqueCtx = null;
 			try {
-				executeResult = await this.executeApply(this.trx, documentId, documentType, scope, branch, revision, fn, signal);
+				executeResult = await this.executeApply(this.trx, documentId, documentType, scope, branch, revision, fn, signal, condition);
 			} catch (error) {
 				if (error instanceof _UniqueConstraintContext) uniqueCtx = error;
 				else throw error;
@@ -2523,7 +3073,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			let uniqueCtx = null;
 			try {
 				transactionResult = await this.db.transaction().execute(async (trx) => {
-					return this.executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal);
+					return this.executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal, condition);
 				});
 			} catch (error) {
 				if (error instanceof _UniqueConstraintContext) uniqueCtx = error;
@@ -2542,12 +3092,13 @@ var KyselyOperationStore = class KyselyOperationStore {
 		const op = ctx.stagedOps[0];
 		throw new DuplicateOperationError(`${op.opId} at index ${op.index} with skip ${op.skip}`);
 	}
-	async executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal) {
+	async executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal, condition) {
 		throwIfAborted(signal);
 		const atomicTxn = new AtomicTransaction(documentId, documentType, scope, branch, revision);
 		await fn(atomicTxn);
 		const operations = atomicTxn.getOperations();
 		if (operations.length === 0) return [];
+		if (condition) await this.acquireStreamLocks(trx, documentId, scope, branch, condition);
 		const latestOp = await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "desc").limit(1).executeTakeFirst();
 		const currentRevision = latestOp ? latestOp.index : -1;
 		if (currentRevision !== revision - 1) {
@@ -2563,22 +3114,91 @@ var KyselyOperationStore = class KyselyOperationStore {
 			op.prevOpId = prevOpId;
 			prevOpId = op.opId;
 		}
+		let insertedCount = operations.length;
 		try {
-			await trx.insertInto("Operation").values(operations).execute();
+			if (condition && condition.streams.length > 0) insertedCount = await this.insertGuarded(trx, operations, condition);
+			else await trx.insertInto("Operation").values(operations).execute();
 		} catch (error) {
 			if (error instanceof Error && error.message.includes("unique constraint")) throw new _UniqueConstraintContext(documentId, scope, branch, revision, operations);
 			throw error;
 		}
+		if (insertedCount !== operations.length) throw new AppendConditionFailedError(condition);
 		return operations.map((op) => ({
 			index: op.index,
 			timestampUtcMs: op.timestampUtcMs.toISOString(),
 			hash: op.hash,
 			skip: op.skip,
 			error: op.error || void 0,
+			deniedReason: op.deniedReason || void 0,
 			id: op.opId,
 			action: JSON.parse(op.action)
 		}));
 	}
+	/**
+	* Locks the written stream and every read-set stream, in sorted key order
+	* so that overlapping concurrent appends serialize rather than deadlock.
+	* The locks are still taken one row at a time, so the query preserves that
+	* order. It must stay separate from the guarded insert, which would
+	* otherwise read a snapshot taken before the locks were held.
+	*/
+	async acquireStreamLocks(trx, documentId, scope, branch, condition) {
+		const keys = new Set([`${documentId}:${scope}:${branch}`]);
+		for (const stream of condition.streams) keys.add(`${stream.documentId}:${stream.scope}:${stream.branch}`);
+		await sql`
+      with ordered as materialized (
+        select key
+        from unnest(array[${sql.join([...keys].sort())}]::text[]) with ordinality as t(key, ord)
+        order by ord
+      )
+      select pg_advisory_xact_lock(hashtext(key)) from ordered
+    `.execute(trx);
+	}
+	/**
+	* Inserts the staged operations with the condition compiled in as a WHERE
+	* NOT EXISTS guard, making the check and the append one statement. Returns
+	* the rows inserted; zero means the guard failed and nothing was written.
+	*/
+	async insertGuarded(trx, operations, condition) {
+		const branches = operations.map((op) => trx.selectNoFrom([
+			sql`${op.jobId}::text`.as("jobId"),
+			sql`${op.opId}::text`.as("opId"),
+			sql`${op.prevOpId}::text`.as("prevOpId"),
+			sql`${op.documentId}::text`.as("documentId"),
+			sql`${op.documentType}::text`.as("documentType"),
+			sql`${op.scope}::text`.as("scope"),
+			sql`${op.branch}::text`.as("branch"),
+			sql`${op.timestampUtcMs}::timestamptz`.as("timestampUtcMs"),
+			sql`${op.index}::integer`.as("index"),
+			sql`${op.action}::jsonb`.as("action"),
+			sql`${op.skip}::integer`.as("skip"),
+			sql`${op.error ?? null}::text`.as("error"),
+			sql`${op.deniedReason ?? null}::text`.as("deniedReason"),
+			sql`${op.hash}::text`.as("hash")
+		]).where((eb) => eb.not(eb.exists(eb.selectFrom("Operation").select("Operation.id").where((web) => web.or(condition.streams.map((s) => web.and([
+			web("Operation.documentId", "=", s.documentId),
+			web("Operation.scope", "=", s.scope),
+			web("Operation.branch", "=", s.branch),
+			web("Operation.index", ">", s.revision)
+		]))))))));
+		let expression = branches[0];
+		for (let i = 1; i < branches.length; i++) expression = expression.unionAll(branches[i]);
+		return (await trx.insertInto("Operation").columns([
+			"jobId",
+			"opId",
+			"prevOpId",
+			"documentId",
+			"documentType",
+			"scope",
+			"branch",
+			"timestampUtcMs",
+			"index",
+			"action",
+			"skip",
+			"error",
+			"deniedReason",
+			"hash"
+		]).expression(expression).returning("id").execute()).length;
+	}
 	async findIdempotentReplay(executor, documentId, scope, branch, revision, stagedOps) {
 		const minIndex = revision;
 		const maxIndex = revision + stagedOps.length - 1;
@@ -2665,6 +3285,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			hash: row.hash,
 			skip: row.skip,
 			error: row.error || void 0,
+			deniedReason: row.deniedReason || void 0,
 			id: row.opId,
 			action: row.action
 		};
@@ -2750,8 +3371,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -2776,8 +3397,8 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -2793,14 +3414,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -2812,14 +3433,14 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -2840,8 +3461,8 @@ async function up$8(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
+async function up$8(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -2851,14 +3472,14 @@ async function up$7(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
+async function up$7(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
+async function up$6(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -2872,8 +3493,8 @@ async function up$5(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
-async function up$4(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
+async function up$5(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -2881,8 +3502,8 @@ async function up$4(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
-async function up$3(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
+async function up$4(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -2891,24 +3512,43 @@ async function up$3(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
-async function up$2(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
+async function up$3(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$1 });
-async function up$1(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
+async function up$2(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up });
-async function up(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$1 });
+async function up$1(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
+//#region src/storage/migrations/015_add_operation_denied_reason.ts
+var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Records why authorization refused an operation. Separate from `error` so a
+* denial is distinguishable from a reducer failure without matching on a
+* message. Null for every operation written before decisions were enforced.
+*/
+async function up(db) {
+	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
+	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
+}
+async function down(db) {
+	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
+	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -2925,7 +3565,8 @@ const migrations = {
 	"011_add_cursor_type_column": _011_add_cursor_type_column_exports,
 	"012_add_source_remote_column": _012_add_source_remote_column_exports,
 	"013_create_sync_dead_letters_table": _013_create_sync_dead_letters_table_exports,
-	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports
+	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports,
+	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -2979,6 +3620,6 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { parsePagingOptions as A, DuplicateManifestError as C, DocumentDeletedError as D, ModuleNotFoundError as E, __exportAll as M, DocumentNotFoundError as O, CollectionMembershipCache as S, InvalidModuleError as T, KyselyWriteCache as _, createForwardingPoolInstrumentation as a, createConsistencyToken as b, DuplicateOperationError as c, KyselyKeyframeStore as d, DocumentModelRegistry as f, EventBus as g, KyselyExecutionScope as h, runMigrations as i, throwIfAborted as j, matchesScope as k, OptimisticLockError as l, DriveCollectionId as m, REACTOR_SCHEMA as n, instrumentPgPool as o, SimpleJobExecutor as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, RevisionMismatchError as u, KyselyOperationIndex as v, DuplicateModuleError as w, createEmptyConsistencyToken as x, DocumentMetaCache as y };
+export { AuthorizationDeniedError as A, DuplicateOperationError as C, DuplicateModuleError as D, DuplicateManifestError as E, throwIfAborted as F, __exportAll as I, DocumentNotFoundError as M, matchesScope as N, InvalidModuleError as O, parsePagingOptions as P, AppendConditionFailedError as S, RevisionMismatchError as T, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, CollectionMembershipCache as b, KyselyKeyframeStore as c, DriveCollectionId as d, buildDecisionModel as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, DocumentDeletedError as j, ModuleNotFoundError as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, KyselyExecutionScope as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, createConsistencyToken as v, OptimisticLockError as w, APPEND_CONDITION_FAILED_PREFIX as x, createEmptyConsistencyToken as y };
 
-//# sourceMappingURL=drive-container-types-DpJp2AmE.js.map
+//# sourceMappingURL=drive-container-types-BNwEHEXP.js.map