@powerhousedao/reactor 6.2.2-dev.36 → 6.2.2-dev.38

package/dist/index.js

@@ -1,10 +1,10 @@
-import { A as AuthorizationDeniedError, C as DuplicateOperationError, D as DuplicateModuleError, E as DuplicateManifestError, F as throwIfAborted, M as DocumentNotFoundError, N as matchesScope, O as InvalidModuleError, P as parsePagingOptions, S as AppendConditionFailedError, T as RevisionMismatchError, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as CollectionMembershipCache, c as KyselyKeyframeStore, d as DriveCollectionId, f as buildDecisionModel, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as DocumentDeletedError, k as ModuleNotFoundError, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as KyselyExecutionScope, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as createConsistencyToken, w as OptimisticLockError, x as APPEND_CONDITION_FAILED_PREFIX, y as createEmptyConsistencyToken } from "./drive-container-types-ZSLCC3lC.js";
+import { A as OptimisticLockError, B as ExcessiveReshuffleError, C as DocumentMetaCache, D as APPEND_CONDITION_FAILED_PREFIX, E as CollectionMembershipCache, F as ModuleNotFoundError, H as matchesScope, I as AuthTimestampNotMonotonicError, L as AuthorizationDeniedError, M as DuplicateManifestError, N as DuplicateModuleError, O as AppendConditionFailedError, P as InvalidModuleError, R as DocumentDeletedError, S as KyselyOperationIndex, T as createEmptyConsistencyToken, U as parsePagingOptions, V as InvalidOperationTimestampError, W as throwIfAborted, _ as KyselyExecutionScope, a as createForwardingPoolInstrumentation, b as EventBus, c as KyselyKeyframeStore, d as DriveCollectionId, f as decideAtHead, g as authDecisionModel, h as buildDecisionModel, i as runMigrations, j as RevisionMismatchError, k as DuplicateOperationError, l as DocumentModelRegistry, m as documentDecisionModel, n as REACTOR_SCHEMA, o as instrumentPgPool, p as selectDecisionModel, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as FLAG_PREREQUISITES, w as createConsistencyToken, x as KyselyWriteCache, y as validateFeatureFlags, z as DocumentNotFoundError } from "./drive-container-types-BJCKXJwH.js";
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
-import { a as ReadModelCoordinator, i as KyselyDocumentView, n as ConsistencyTracker, o as BaseReadModel, r as makeConsistencyKey, t as KyselyDocumentIndexer } from "./document-indexer-BY-mPXJF.js";
+import { a as ReadModelCoordinator, i as KyselyDocumentView, n as ConsistencyTracker, o as BaseReadModel, r as makeConsistencyKey, t as KyselyDocumentIndexer } from "./document-indexer-C0GB0b8Q.js";
 import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-BMn-2vsH.js";
-import { actions, actions as documentActions, createPresignedHeader, decide, generateId, hashDocumentStateForScope, replayDocument } from "@powerhousedao/shared/document-model";
+import { t as workerEntryPath } from "./worker-jEJW6_j7.js";
+import { actions, actions as documentActions, createPresignedHeader, decide, garbageCollect, generateId, hashDocumentStateForScope, replayDocument, sortOperations } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -190,10 +190,12 @@ function topologicalSort(jobs) {
 */
 function toErrorInfo$1(error) {
 	if (error instanceof Error) return {
+		name: error.name,
 		message: error.message,
 		stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 	};
 	return {
+		name: "Error",
 		message: error,
 		stack: (/* @__PURE__ */ new Error()).stack || ""
 	};
@@ -705,13 +707,19 @@ function filterReadableScopes(document, subject) {
 	const state = document.state;
 	if (!state) return document;
 	const auth = document.state.auth;
-	const filtered = {};
-	for (const scope of Object.keys(state)) if (canReadScope(auth, subject, scope)) filtered[scope] = state[scope];
+	const readable = (scope) => canReadScope(auth, subject, scope);
 	return {
 		...document,
-		state: filtered
+		state: keepReadableScopes(state, readable),
+		initialState: keepReadableScopes(document.initialState, readable)
 	};
 }
+function keepReadableScopes(scopes, readable) {
+	if (!scopes) return scopes;
+	const kept = {};
+	for (const scope of Object.keys(scopes)) if (readable(scope)) kept[scope] = scopes[scope];
+	return kept;
+}
 //#endregion
 //#region src/client/reactor-client.ts
 /**
@@ -777,8 +785,8 @@ var ReactorClient = class {
 	* same lookup as the data path. Resolves against the "main" branch. Throws if
 	* the identifier cannot be resolved or is ambiguous.
 	*/
-	async resolveIdOrSlug(identifier, signal) {
-		return this.documentView.resolveIdOrSlug(identifier, void 0, void 0, signal);
+	async resolveIdOrSlug(identifier, view, signal) {
+		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
 	}
 	/**
 	* Retrieves operations for a document
@@ -1127,13 +1135,15 @@ var ReactorClient = class {
 	*/
 	subscribe(search, callback, view) {
 		this.logger.verbose("subscribe(@search, @view)", search, view);
+		const subject = this.readSubject(view?.subject);
+		const readable = (document) => filterReadableScopes(document, subject);
 		const unsubscribeCreated = this.subscriptionManager.onDocumentCreated((result) => {
 			(async () => {
 				try {
-					const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, view, void 0, void 0)));
+					const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, withAuthScope(view), void 0, void 0)));
 					callback({
 						type: DocumentChangeType.Created,
-						documents
+						documents: documents.map(readable)
 					});
 				} catch {}
 			})();
@@ -1148,7 +1158,7 @@ var ReactorClient = class {
 		const unsubscribeUpdated = this.subscriptionManager.onDocumentStateUpdated((result) => {
 			callback({
 				type: DocumentChangeType.Updated,
-				documents: result.results
+				documents: result.results.map(readable)
 			});
 		}, search, view);
 		const unsubscribeRelationship = this.subscriptionManager.onRelationshipChanged((parentId, childId, changeType) => {
@@ -1214,10 +1224,12 @@ const QueueEventTypes = { JOB_AVAILABLE: 1e4 };
 const MAX_EXEMPT_CONFLICT_RETRIES = 20;
 function toErrorInfo(error) {
 	if (error instanceof Error) return {
+		name: error.name,
 		message: error.message,
 		stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 	};
 	return {
+		name: "Error",
 		message: error,
 		stack: (/* @__PURE__ */ new Error()).stack || ""
 	};
@@ -1262,7 +1274,7 @@ var JobResultHandler = class {
 			callbacks.deferJob(handle.job.documentId, handle.job);
 			return;
 		}
-		if (result.error && (DocumentDeletedError.isError(result.error) || AuthorizationDeniedError.isError(result.error))) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -1321,6 +1333,7 @@ var JobResultHandler = class {
 			stackLines.push(`[Attempt ${index + 1}] Stack trace:\n${error.stack}`);
 		});
 		return {
+			name: currentError.name,
 			message: messageLines.join("\n"),
 			stack: stackLines.join("\n\n")
 		};
@@ -1685,29 +1698,6 @@ function extractMembershipTarget(op) {
 	if (actionType === "DELETE_DOCUMENT") return input?.documentId ?? op.context.documentId;
 }
 //#endregion
-//#region src/core/feature-flags.ts
-/**
-* Every flag this reactor knows, with the flags it requires. A stage adds its
-* flag here when it ships, so asking an older reactor for a later stage's flag
-* is an unrecognized name rather than a flag that quietly does nothing.
-*/
-const FLAG_PREREQUISITES = { documentDecisions: [] };
-/**
-* Throws when the flags ask for enforcement the reactor cannot deliver. Either
-* failure would otherwise read as enforcement being on while the reactor
-* applies less than the caller asked for.
-*/
-function validateFeatureFlags(flags, prerequisites) {
-	const known = Object.keys(prerequisites);
-	const unrecognized = Object.keys(flags).filter((name) => !known.includes(name));
-	if (unrecognized.length > 0) throw new Error(`Unrecognized reactor feature flag: ${unrecognized.join(", ")}. This reactor knows: ${known.join(", ")}.`);
-	for (const name of known) {
-		if (flags[name] !== true) continue;
-		const missing = prerequisites[name].filter((required) => flags[required] !== true);
-		if (missing.length > 0) throw new Error(`Reactor feature flag ${name} requires ${missing.join(", ")}.`);
-	}
-}
-//#endregion
 //#region src/executor/simple-job-executor-manager.ts
 /**
 * Manages multiple job executors and coordinates job distribution.
@@ -1949,6 +1939,7 @@ var InMemoryJobTracker = class {
 	}
 	handleJobFailed(event) {
 		this.markFailed(event.jobId, {
+			name: event.error.name,
 			message: event.error.message,
 			stack: event.error.stack || ""
 		}, event.job);
@@ -2410,10 +2401,12 @@ var InMemoryQueue = class {
 	}
 	toErrorInfo(error) {
 		if (error instanceof Error) return {
+			name: error.name,
 			message: error.message,
 			stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 		};
 		return {
+			name: "Error",
 			message: error,
 			stack: (/* @__PURE__ */ new Error()).stack || ""
 		};
@@ -2501,6 +2494,7 @@ var InMemoryQueue = class {
 			await this.resolver.ensureModelLoaded(documentType);
 		} catch {
 			await this.failJob(job.id, {
+				name: "Error",
 				message: `Failed to load document model for type: ${documentType}`,
 				stack: (/* @__PURE__ */ new Error()).stack || ""
 			});
@@ -3537,11 +3531,18 @@ var PollingChannelError = class extends Error {
 var ChannelError = class extends Error {
 	source;
 	error;
-	constructor(source, error) {
+	/**
+	* The classification when something other than the error carries it. Absent
+	* means derive it from `error.name`; a dead letter mirrored from a peer sets it,
+	* because only the message crosses the wire.
+	*/
+	errorType;
+	constructor(source, error, errorType) {
 		super(`ChannelError[${source}]: ${error.message}`);
 		this.name = "ChannelError";
 		this.source = source;
 		this.error = error;
+		this.errorType = errorType;
 	}
 };
 //#endregion
@@ -3912,6 +3913,33 @@ function splitComponent(items, maxSize) {
 	for (let i = 0; i < sorted.length; i += maxSize) chunks.push(sorted.slice(i, i + maxSize));
 	return chunks;
 }
+/**
+* Classifies a failure by error name rather than `instanceof`, because a failure
+* that crossed the pooled-worker boundary arrives as plain data.
+*/
+function classifyJobFailure(errorName) {
+	switch (errorName) {
+		case "AuthTimestampNotMonotonicError": return "AUTH_TIMESTAMP_NOT_MONOTONIC";
+		case "InvalidOperationTimestampError": return "INVALID_TIMESTAMP";
+		case "ExcessiveReshuffleError": return "EXCESSIVE_SHUFFLE";
+		case "InvalidSignatureError": return "SIGNATURE_INVALID";
+		case "HashMismatchError": return "HASH_MISMATCH";
+		default: return "UNCLASSIFIED";
+	}
+}
+/** The explicit type when something else carried it, else derived by name. */
+function syncOperationErrorType(error) {
+	return error?.errorType ?? classifyJobFailure(error?.error?.name ?? "Error");
+}
+/** Dead-letter types that must not stop the document syncing. */
+const NON_QUARANTINING_ERROR_TYPES = new Set(["AUTH_TIMESTAMP_NOT_MONOTONIC"]);
+/**
+* A held auth operation must not quarantine: reconciling the two policies needs
+* the traffic a quarantine would stop.
+*/
+function quarantinesDocument(errorType) {
+	return !NON_QUARANTINING_ERROR_TYPES.has(errorType);
+}
 //#endregion
 //#region src/sync/channels/interval-poll-timer.ts
 const DEFAULT_CONFIG = {
@@ -4074,7 +4102,7 @@ function serializeEnvelope(envelope) {
 				hash: opWithContext.operation.hash,
 				skip: opWithContext.operation.skip,
 				error: opWithContext.operation.error,
-				deniedReason: opWithContext.operation.deniedReason,
+				...opWithContext.operation.deniedReason !== void 0 ? { deniedReason: opWithContext.operation.deniedReason } : {},
 				id: opWithContext.operation.id,
 				action: serializeAction(opWithContext.operation.action)
 			},
@@ -4102,21 +4130,33 @@ function deserializeSignature(sig) {
 	return sig.split(", ");
 }
 /**
-* Deserializes signatures in an operation's signer context from strings back to tuples.
-*
-* When operations are transported via GraphQL, signatures are serialized as comma-separated
-* strings. This function restores them to the Signature tuple format required for verification.
+* `isDenied` tests strictly against undefined, so a null left in place would mark
+* every synced operation denied. The key is removed rather than set to undefined,
+* so an operation that arrived without it stays identical to the one sent.
 */
-function deserializeOperationSignatures(opWithContext) {
-	const signer = opWithContext.operation.action.context?.signer;
-	if (!signer?.signatures || signer.signatures.length === 0) return opWithContext;
+function normalizeAbsentFields(operation) {
+	const wire = operation;
+	if (wire.error !== null && wire.deniedReason !== null) return operation;
+	const normalized = { ...operation };
+	if (wire.error === null) delete normalized.error;
+	if (wire.deniedReason === null) delete normalized.deniedReason;
+	return normalized;
+}
+/** Restores signature tuples and null-valued optional fields to undefined. */
+function deserializeOperation(opWithContext) {
+	const operation = normalizeAbsentFields(opWithContext.operation);
+	const signer = operation.action.context?.signer;
+	if (!signer?.signatures || signer.signatures.length === 0) return {
+		...opWithContext,
+		operation
+	};
 	const deserializedSignatures = signer.signatures.map(deserializeSignature);
 	const deserializedOperation = {
-		...opWithContext.operation,
+		...operation,
 		action: {
-			...opWithContext.operation.action,
+			...operation.action,
 			context: {
-				...opWithContext.operation.action.context,
+				...operation.action.context,
 				signer: {
 					...signer,
 					signatures: deserializedSignatures
@@ -4143,7 +4183,7 @@ function deserializeOperationSignatures(opWithContext) {
 */
 function envelopesToSyncOperations(envelope, remoteName) {
 	if (!envelope.operations || envelope.operations.length === 0) return [];
-	return batchOperationsByDocument(envelope.operations.map(deserializeOperationSignatures)).map((batch) => {
+	return batchOperationsByDocument(envelope.operations.map(deserializeOperation)).map((batch) => {
 		return new SyncOperation(`syncop-${envelope.channelMeta.id}-${Date.now()}-${syncOpCounter++}`, envelope.key ?? "", (envelope.dependsOn ?? []).filter(Boolean), remoteName, batch.documentId, [batch.scope], batch.branch, batch.operations);
 	});
 }
@@ -4155,6 +4195,12 @@ const getLatestAppliedOrdinal = (syncOps) => {
 //#endregion
 //#region src/sync/channels/gql-req-channel.ts
 /**
+* Fields the auth projection added to the sync schema. A remote that predates
+* them rejects the whole query for naming one, so they are selected only while
+* the remote is known to serve them.
+*/
+const DECISION_FIELDS = ["deniedReason", "errorType"];
+/**
 * GraphQL-based synchronization channel for network communication between reactors.
 */
 var GqlRequestChannel = class {
@@ -4181,6 +4227,8 @@ var GqlRequestChannel = class {
 	isPushing = false;
 	pendingDrain = false;
 	receivingPages = false;
+	/** Cleared for good the first time the remote rejects {@link DECISION_FIELDS}. */
+	peerServesDecisionFields = true;
 	isRecovering = false;
 	connectionState = "connecting";
 	/** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -4359,7 +4407,7 @@ var GqlRequestChannel = class {
 		const syncOps = [];
 		for (const dl of deadLetters) {
 			const syncOp = new SyncOperation(crypto.randomUUID(), dl.jobId, [], this.remoteName, dl.documentId, dl.scopes, dl.branch, []);
-			syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, new Error(dl.error)));
+			syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, new Error(dl.error), dl.errorType ?? void 0));
 			syncOps.push(syncOp);
 		}
 		this.deadLetter.add(...syncOps);
@@ -4451,7 +4499,44 @@ var GqlRequestChannel = class {
 	* Queries the remote GraphQL endpoint for sync envelopes.
 	*/
 	async pollSyncEnvelopes(ackOrdinal, latestOrdinal) {
-		const query = `
+		const variables = {
+			channelId: this.channelId,
+			outboxAck: ackOrdinal,
+			outboxLatest: latestOrdinal
+		};
+		let response;
+		try {
+			response = await this.executeGraphQL(this.pollQuery(this.peerServesDecisionFields), variables);
+		} catch (error) {
+			if (!this.rejectsDecisionFields(error)) throw error;
+			this.logger.warn("Remote @channelId does not serve deniedReason/errorType; polling without them. The remote is on an older schema, so it has neither to report.", this.channelId);
+			this.peerServesDecisionFields = false;
+			response = await this.executeGraphQL(this.pollQuery(false), variables);
+		}
+		return {
+			envelopes: response.pollSyncEnvelopes.envelopes,
+			ackOrdinal: response.pollSyncEnvelopes.ackOrdinal,
+			deadLetters: response.pollSyncEnvelopes.deadLetters ?? [],
+			hasMore: response.pollSyncEnvelopes.hasMore
+		};
+	}
+	/**
+	* True when the remote rejected the query for naming a field it does not
+	* have. Selecting an unknown field fails validation for the whole query, so
+	* an unhandled one takes the channel's polling down until the process
+	* restarts rather than degrading.
+	*/
+	rejectsDecisionFields(error) {
+		if (!this.peerServesDecisionFields) return false;
+		if (!(error instanceof GraphQLRequestError) || error.category !== "graphql") return false;
+		return DECISION_FIELDS.some((field) => error.message.includes(field));
+	}
+	/**
+	* The poll query. `withDecisionFields` selects the two fields added with the
+	* auth projection; a remote on the previous schema is polled without them.
+	*/
+	pollQuery(withDecisionFields) {
+		return `
       query PollSyncEnvelopes($channelId: String!, $outboxAck: Int!, $outboxLatest: Int!) {
         pollSyncEnvelopes(channelId: $channelId, outboxAck: $outboxAck, outboxLatest: $outboxLatest) {
           envelopes {
@@ -4466,6 +4551,7 @@ var GqlRequestChannel = class {
                 hash
                 skip
                 error
+                ${withDecisionFields ? "deniedReason" : ""}
                 id
                 action {
                   id
@@ -4509,6 +4595,7 @@ var GqlRequestChannel = class {
           deadLetters {
             documentId
             error
+            ${withDecisionFields ? "errorType" : ""}
             jobId
             branch
             scopes
@@ -4518,18 +4605,6 @@ var GqlRequestChannel = class {
         }
       }
     `;
-		const variables = {
-			channelId: this.channelId,
-			outboxAck: ackOrdinal,
-			outboxLatest: latestOrdinal
-		};
-		const response = await this.executeGraphQL(query, variables);
-		return {
-			envelopes: response.pollSyncEnvelopes.envelopes,
-			ackOrdinal: response.pollSyncEnvelopes.ackOrdinal,
-			deadLetters: response.pollSyncEnvelopes.deadLetters ?? [],
-			hasMore: response.pollSyncEnvelopes.hasMore
-		};
 	}
 	/**
 	* Registers or updates this channel on the remote server via GraphQL mutation.
@@ -5011,7 +5086,8 @@ function rowToDeadLetterRecord(row) {
 		branch: row.branch,
 		operations: row.operations,
 		errorSource: row.error_source,
-		errorMessage: row.error_message
+		errorMessage: row.error_message,
+		errorType: row.error_type ?? "UNCLASSIFIED"
 	};
 }
 function deadLetterRecordToRow(record) {
@@ -5025,7 +5101,8 @@ function deadLetterRecordToRow(record) {
 		branch: record.branch,
 		operations: JSON.stringify(record.operations),
 		error_source: record.errorSource,
-		error_message: record.errorMessage
+		error_message: record.errorMessage,
+		error_type: record.errorType
 	};
 }
 /**
@@ -5082,9 +5159,11 @@ var KyselySyncDeadLetterStorage = class {
 	}
 	async listQuarantinedDocumentIds(signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
-		const rows = await this.db.selectFrom("sync_dead_letters").select("document_id").distinct().execute();
+		const rows = await this.db.selectFrom("sync_dead_letters").select(["document_id", "error_type"]).distinct().execute();
 		if (signal?.aborted) throw new Error("Operation aborted");
-		return rows.map((row) => row.document_id);
+		const quarantined = /* @__PURE__ */ new Set();
+		for (const row of rows) if (quarantinesDocument(row.error_type ?? "UNCLASSIFIED")) quarantined.add(row.document_id);
+		return [...quarantined];
 	}
 };
 //#endregion
@@ -5757,7 +5836,8 @@ var SyncManager = class {
 		remote.channel.deadLetter.onAdded((syncOps) => {
 			for (const syncOp of syncOps) {
 				this.logger.error("Dead letter (@remote, @documentId, @jobId, @error, @dependencies)", remote.meta.name, syncOp.documentId, syncOp.jobId, syncOp.error?.message ?? "unknown", syncOp.jobDependencies);
-				this.quarantinedDocumentIds.add(syncOp.documentId);
+				const errorType = syncOperationErrorType(syncOp.error);
+				if (quarantinesDocument(errorType)) this.quarantinedDocumentIds.add(syncOp.documentId);
 				const record = {
 					id: syncOp.id,
 					jobId: syncOp.jobId,
@@ -5768,7 +5848,8 @@ var SyncManager = class {
 					branch: syncOp.branch,
 					operations: syncOp.operations,
 					errorSource: syncOp.error?.source ?? ChannelErrorSource.None,
-					errorMessage: syncOp.error?.error.message ?? "unknown"
+					errorMessage: syncOp.error?.error.message ?? "unknown",
+					errorType
 				};
 				this.deadLetterStorage.add(record).catch((err) => {
 					this.logger.error("Failed to persist dead letter (@id, @error)", record.id, err instanceof Error ? err.message : String(err));
@@ -5778,7 +5859,8 @@ var SyncManager = class {
 					jobId: record.jobId,
 					remoteName: record.remoteName,
 					documentId: record.documentId,
-					errorSource: record.errorSource
+					errorSource: record.errorSource,
+					errorType: record.errorType
 				}).catch(() => {});
 			}
 			const items = remote.channel.deadLetter.items;
@@ -5805,7 +5887,7 @@ var SyncManager = class {
 		const syncOps = [];
 		for (const record of records) {
 			const syncOp = new SyncOperation(record.id, record.jobId, record.jobDependencies, record.remoteName, record.documentId, record.scopes, record.branch, record.operations);
-			syncOp.failed(new ChannelError(record.errorSource, new Error(record.errorMessage)));
+			syncOp.failed(new ChannelError(record.errorSource, new Error(record.errorMessage), record.errorType));
 			syncOps.push(syncOp);
 		}
 		remote.channel.deadLetter.add(...syncOps);
@@ -5886,8 +5968,7 @@ var SyncManager = class {
 		if (completedJobInfo.status === JobStatus.FAILED) {
 			const errorMessage = completedJobInfo.error?.message || "Unknown error";
 			this.logger.error("Failed to apply operations from inbox (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, completedJobInfo.id, errorMessage);
-			const error = new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${errorMessage}`));
-			syncOp.failed(error);
+			syncOp.failed(this.inboxFailure(completedJobInfo.error));
 			remote.channel.deadLetter.add(syncOp);
 		} else syncOp.executed();
 		remote.channel.inbox.remove(syncOp);
@@ -5964,14 +6045,26 @@ var SyncManager = class {
 			}
 			if (this.isShutdown) return;
 			if (completedJobInfo.status === JobStatus.FAILED) {
-				const errorMessage = completedJobInfo.error?.message || "Unknown error";
-				const channelError = new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${errorMessage}`));
-				syncOp.failed(channelError);
+				syncOp.failed(this.inboxFailure(completedJobInfo.error));
 				remote.channel.deadLetter.add(syncOp);
 			} else syncOp.executed();
 			remote.channel.inbox.remove(syncOp);
 		}
 	}
+	/**
+	* The dead letter for a load job the executor failed.
+	*
+	* The classification is passed explicitly because it cannot be recovered
+	* downstream: the wrapper carries the failure's message, not the failure, so
+	* deriving it from the wrapper's own name would classify every one of these
+	* as unclassified and quarantine the document. A held auth operation must
+	* keep syncing, because reconciling the two policies needs the traffic a
+	* quarantine would stop.
+	*/
+	inboxFailure(error) {
+		const message = error?.message || "Unknown error";
+		return new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
+	}
 	async updateOutbox(remote, ackOrdinal, mode = OutboxMode.Backfill, signal) {
 		const composedSignal = signal ? AbortSignal.any([signal, this.abortController.signal]) : this.abortController.signal;
 		let maxOrdinal = ackOrdinal;
@@ -6930,7 +7023,7 @@ var ReactorBuilder = class {
 		await executorManager.start(executorStartCount);
 		const readModelInstances = Array.from(new Set([...this.readModels]));
 		const documentViewConsistencyTracker = new ConsistencyTracker();
-		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker);
+		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, this.executorConfig.featureFlags?.documentDecisions ?? false);
 		try {
 			await documentView.init();
 		} catch (error) {
@@ -7069,7 +7162,7 @@ var ReactorBuilder = class {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
 			import("./worker-handle-CrERzl8s.js"),
 			import("./transport-ByGviWdZ.js"),
-			import("./worker-BMn-2vsH.js").then((n) => n.n)
+			import("./worker-jEJW6_j7.js").then((n) => n.n)
 		]);
 		const poolConfig = {
 			enabled: true,
@@ -7331,6 +7424,38 @@ function driveIdFromUrl(url) {
 	return url.split("/").pop() ?? "";
 }
 //#endregion
+//#region src/decision/stream-order.ts
+/**
+* The first pair of effective operations whose stored order contradicts their
+* timestamps, or undefined when the stream is in position order.
+*
+* Such a stream cannot be walked, and the auth stream is never reshuffled once
+* the monotonic rule is on, so run this before enabling enforcement on a fleet.
+*
+* `requireStrict` additionally rejects a tie, which is what the auth stream's
+* monotonic rule requires and what the walk alone does not care about.
+*/
+function firstOutOfOrderPair(operations, options) {
+	const requireStrict = options?.requireStrict ?? false;
+	const effective = garbageCollect(sortOperations([...operations]));
+	for (let i = 1; i < effective.length; i++) {
+		const previous = effective[i - 1];
+		const current = effective[i];
+		const previousAt = Date.parse(previous.timestampUtcMs);
+		const currentAt = Date.parse(current.timestampUtcMs);
+		if (currentAt < previousAt) return {
+			previous,
+			current,
+			kind: "descending"
+		};
+		if (requireStrict && currentAt === previousAt) return {
+			previous,
+			current,
+			kind: "tied"
+		};
+	}
+}
+//#endregion
 //#region src/read-models/interfaces.ts
 function supportsLiveReadModelRegistration(coordinator) {
 	return "addReadModel" in coordinator && typeof coordinator.addReadModel === "function";
@@ -7361,6 +7486,7 @@ var DocumentIntegrityService = class {
 	async validateDocument(documentId, branch = "main", signal) {
 		const keyframeIssues = [];
 		const snapshotIssues = [];
+		const streamOrderIssues = await this.findStreamOrderIssues(documentId, branch, signal);
 		const replayCache = new KyselyWriteCache(passthroughKeyframeStore, this.operationStore, this.documentModelRegistry, {
 			maxDocuments: 1,
 			ringBufferSize: 1,
@@ -7387,9 +7513,10 @@ var DocumentIntegrityService = class {
 		} catch {
 			return {
 				documentId,
-				isConsistent: keyframeIssues.length === 0,
+				isConsistent: keyframeIssues.length === 0 && streamOrderIssues.length === 0,
 				keyframeIssues,
-				snapshotIssues
+				snapshotIssues,
+				streamOrderIssues
 			};
 		}
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
@@ -7415,9 +7542,10 @@ var DocumentIntegrityService = class {
 		}
 		return {
 			documentId,
-			isConsistent: keyframeIssues.length === 0 && snapshotIssues.length === 0,
+			isConsistent: keyframeIssues.length === 0 && snapshotIssues.length === 0 && streamOrderIssues.length === 0,
 			keyframeIssues,
-			snapshotIssues
+			snapshotIssues,
+			streamOrderIssues
 		};
 	}
 	async rebuildKeyframes(documentId, branch = "main", signal) {
@@ -7439,12 +7567,26 @@ var DocumentIntegrityService = class {
 			scopesInvalidated: scopes.length
 		};
 	}
+	async findStreamOrderIssues(documentId, branch, signal) {
+		const scopes = await this.discoverScopes(documentId, branch, signal);
+		const issues = [];
+		for (const scope of scopes) {
+			throwIfAborted(signal);
+			const pair = firstOutOfOrderPair((await this.operationStore.getSince(documentId, scope, branch, -1, void 0, void 0, signal)).results, { requireStrict: scope === "auth" });
+			if (pair !== void 0) issues.push({
+				scope,
+				branch,
+				...pair
+			});
+		}
+		return issues;
+	}
 	async discoverScopes(documentId, branch, signal) {
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		return Object.keys(revisions.revision);
 	}
 };
 //#endregion
-export { APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncStatus, SyncStatusTracker, addRelationshipAction, batchOperationsByDocument, buildDecisionModel, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, deleteDocumentAction, documentActions, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, removeRelationshipAction, runMigrations, sanitizeArg, supportsLiveReadModelRegistration, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 
 //# sourceMappingURL=index.js.map