@powerhousedao/reactor 6.2.2-dev.4 → 6.2.2-dev.40

package/dist/{drive-container-types-DpJp2AmE.js → drive-container-types-BJCKXJwH.js}

@@ -1,5 +1,5 @@
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { DowngradeNotSupportedError, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, createPresignedHeader, defaultBaseState, deriveOperationId, isUndoRedo } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, hashDocumentStateForScope, isDenied, isUndoRedo, sortOperations } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -72,6 +72,102 @@ var DocumentDeletedError = class DocumentDeletedError extends Error {
 	}
 };
 /**
+* Error thrown when the auth policy denies an action at the executor gate.
+*/
+var AuthorizationDeniedError = class AuthorizationDeniedError extends Error {
+	documentId;
+	scope;
+	operation;
+	subject;
+	constructor(documentId, scope, operation, subject) {
+		super(`Authorization denied: ${subject ?? "anonymous"} may not execute ${operation} in scope "${scope}" of document ${documentId}`);
+		this.name = "AuthorizationDeniedError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.operation = operation;
+		this.subject = subject;
+		Error.captureStackTrace(this, AuthorizationDeniedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthorizationDeniedError";
+	}
+};
+/**
+* An auth operation did not strictly exceed the newest timestamp in its stream.
+*
+* Terminal and asymmetric by design: no ordering rule can reconcile two replicas
+* that each accepted an auth operation offline, because either order hands one
+* authority the other never granted, so the replica ahead holds the arrival.
+*/
+var AuthTimestampNotMonotonicError = class AuthTimestampNotMonotonicError extends Error {
+	documentId;
+	branch;
+	timestampUtcMs;
+	newestTimestampUtcMs;
+	constructor(documentId, branch, timestampUtcMs, newestTimestampUtcMs) {
+		super(`Auth timestamp not monotonic: ${timestampUtcMs} does not exceed ${newestTimestampUtcMs} in the auth stream of document ${documentId} on branch ${branch}`);
+		this.name = "AuthTimestampNotMonotonicError";
+		this.documentId = documentId;
+		this.branch = branch;
+		this.timestampUtcMs = timestampUtcMs;
+		this.newestTimestampUtcMs = newestTimestampUtcMs;
+		Error.captureStackTrace(this, AuthTimestampNotMonotonicError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthTimestampNotMonotonicError";
+	}
+};
+/**
+* An operation or action carried a timestamp that is not an ISO-8601 UTC
+* instant.
+*
+* Terminal rather than retryable: the value does not change between attempts,
+* so a retry re-runs the whole job to fail identically. Quarantining, unlike a
+* held auth operation — this is malformed data rather than two replicas
+* disagreeing, and nothing further from that source should be trusted until it
+* is looked at.
+*/
+var InvalidOperationTimestampError = class InvalidOperationTimestampError extends Error {
+	documentId;
+	scope;
+	timestampUtcMs;
+	constructor(documentId, scope, timestampUtcMs, context) {
+		super(`Invalid timestamp "${timestampUtcMs}" on ${context} in scope "${scope}" of document ${documentId}`);
+		this.name = "InvalidOperationTimestampError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.timestampUtcMs = timestampUtcMs;
+		Error.captureStackTrace(this, InvalidOperationTimestampError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidOperationTimestampError";
+	}
+};
+/**
+* A load would move more operations than the bound allows, indicating a real
+* divergence between local and incoming history. Counts only first-time moves,
+* so a re-evaluation pass's re-appends do not make busy documents
+* revocation-proof. Terminal: the condition is deterministic.
+*/
+var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
+	documentId;
+	scope;
+	count;
+	threshold;
+	constructor(documentId, scope, count, threshold) {
+		super(`Excessive reshuffle detected: ${count} operations in scope "${scope}" of document ${documentId} exceeds the threshold of ${threshold}. This indicates a significant divergence between local and incoming operations.`);
+		this.name = "ExcessiveReshuffleError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.count = count;
+		this.threshold = threshold;
+		Error.captureStackTrace(this, ExcessiveReshuffleError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
+	}
+};
+/**
 * Error thrown when an operation has an invalid signature.
 */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
@@ -181,6 +277,57 @@ var InvalidUpgradeStepError = class extends Error {
 	}
 };
 //#endregion
+//#region src/storage/interfaces.ts
+/**
+* Thrown when an operation with the same identity already exists in the store.
+*/
+var DuplicateOperationError = class extends Error {
+	constructor(description) {
+		super(`Duplicate operation: ${description}`);
+		this.name = "DuplicateOperationError";
+	}
+};
+/**
+* Thrown when a concurrent write conflict is detected during an atomic apply.
+*/
+var OptimisticLockError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OptimisticLockError";
+	}
+};
+/**
+* Thrown when the caller-provided revision does not match the current
+* stored revision, indicating a stale read.
+*/
+var RevisionMismatchError = class extends Error {
+	constructor(expected, actual) {
+		super(`Revision mismatch: expected ${expected}, got ${actual}`);
+		this.name = "RevisionMismatchError";
+	}
+};
+/** Error history keeps messages, not classes, so failures match by prefix. */
+const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
+/**
+* A read-set stream grew before the append committed. A concurrency
+* conflict, not a fault: the caller retries against the new stream heads.
+*/
+var AppendConditionFailedError = class extends Error {
+	constructor(condition) {
+		const streams = condition.streams.map((s) => `${s.documentId}:${s.scope}:${s.branch}@${s.revision}`).join(", ");
+		super(`${APPEND_CONDITION_FAILED_PREFIX}a read-set stream advanced [${streams}]`);
+		this.condition = condition;
+		this.name = "AppendConditionFailedError";
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AppendConditionFailedError";
+	}
+	/** True when a recorded error message is an append-condition failure. */
+	static isFailureMessage(message) {
+		return message.startsWith(APPEND_CONDITION_FAILED_PREFIX);
+	}
+};
+//#endregion
 //#region src/cache/collection-membership-cache.ts
 var CollectionMembershipCache = class CollectionMembershipCache {
 	cache = /* @__PURE__ */ new Map();
@@ -216,6 +363,34 @@ var CollectionMembershipCache = class CollectionMembershipCache {
 };
 //#endregion
 //#region src/executor/util.ts
+/** Actions the reactor reduces itself, onto the document scope. */
+const DOCUMENT_SCOPE_ACTIONS = new Set([
+	"CREATE_DOCUMENT",
+	"DELETE_DOCUMENT",
+	"UPGRADE_DOCUMENT",
+	"ADD_RELATIONSHIP",
+	"REMOVE_RELATIONSHIP",
+	"UPDATE_RELATIONSHIP"
+]);
+/**
+* `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
+* so building a decision model would throw and defer the job forever.
+*/
+const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
+/**
+* The document a document-scope action writes to, which is not always the job's
+* own document: delete and upgrade name it in `input.documentId`, and the
+* relationship actions in `input.sourceId`. `execute` only checks that a batch
+* shares one scope, so a caller can submit an action whose target is a document
+* other than the one the job is keyed by. The policy gate has to follow the
+* action rather than the job, or it decides against a policy the caller may
+* control instead of the one guarding the write.
+*/
+function targetDocumentId(action, fallback) {
+	const input = action.input;
+	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
+	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
+}
 /**
 * Creates a PHDocument from a CREATE_DOCUMENT action input.
 * Reconstructs the document header and initializes the base state.
@@ -353,6 +528,24 @@ function buildErrorResult(job, error, startTime) {
 		duration: Date.now() - startTime
 	};
 }
+/**
+* The error a refusal surfaces as. Both classes are already terminal in the job
+* result handler, so a refusal never burns a retry.
+*/
+function refusalError(reason, documentId, deletedAtUtcIso, action) {
+	if (reason === DOCUMENT_DELETED_REASON) return new DocumentDeletedError(documentId, deletedAtUtcIso);
+	return new AuthorizationDeniedError(documentId, action.scope, action.type, action.context?.signer?.user.address);
+}
+/**
+* Whether this operation is part of the document's creation. The create and the
+* upgrade from version zero hold the first two indexes for the life of the
+* document, so a reshuffle has to leave them where they are.
+*/
+function isGenesisOperation(operation) {
+	if (operation.action.type === "CREATE_DOCUMENT") return true;
+	if (operation.action.type !== "UPGRADE_DOCUMENT") return false;
+	return operation.action.input.fromVersion === 0;
+}
 //#endregion
 //#region src/cache/lru/lru-tracker.ts
 var LRUNode = class {
@@ -634,6 +827,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				skip: op.skip,
 				hash: op.hash,
 				action: op.action,
+				deniedReason: op.deniedReason ?? null,
 				sourceRemote: op.sourceRemote
 			}));
 			operationOrdinals = (await trx.insertInto("operation_index_operations").values(operationRows).returning("ordinal").execute()).map((row) => row.ordinal);
@@ -765,6 +959,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				hash: row.hash,
 				skip: row.skip,
 				action: row.action,
+				deniedReason: row.deniedReason ?? void 0,
 				id: row.opId
 			},
 			context: {
@@ -788,6 +983,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			hash: row.hash,
 			skip: row.skip,
 			action: row.action,
+			deniedReason: row.deniedReason ?? void 0,
 			id: row.opId,
 			sourceRemote: row.sourceRemote
 		};
@@ -873,11 +1069,55 @@ var RingBuffer = class {
 	}
 };
 //#endregion
+//#region src/cache/write-cache-types.ts
+/**
+* Where a snapshot sits in its stream.
+*
+* - `Head`: the newest revision of the stream when it was stored. Only these
+*   can answer a read that asks for the head.
+* - `Historical`: state at an earlier revision. Usable as a starting point to
+*   replay forward from, and as an answer to a read for that same revision.
+*/
+let SnapshotPosition = /* @__PURE__ */ function(SnapshotPosition) {
+	SnapshotPosition["Head"] = "head";
+	SnapshotPosition["Historical"] = "historical";
+	return SnapshotPosition;
+}({});
+//#endregion
 //#region src/cache/kysely-write-cache.ts
+/**
+* The last operation index a keyframe's document reflects for the scope. A
+* keyframe only exists for a scope that has operations, so a missing entry
+* means the stored row is corrupt.
+*/
+function keyframeRevision(keyframe, documentId, scope) {
+	const nextIndex = keyframe.document.header.revision[scope];
+	if (typeof nextIndex !== "number") throw new Error(`Corrupt keyframe for document ${documentId} at revision ${keyframe.revision}: header carries no ${scope} revision`);
+	return nextIndex - 1;
+}
 function extractModuleVersion(doc) {
 	const v = doc.state.document.version;
 	return v === 0 ? void 0 : v;
 }
+/** The highest revision held, latest push winning a tie. */
+function highestRevision(snapshots) {
+	let newest = void 0;
+	for (const snapshot of snapshots) if (!newest || snapshot.revision >= newest.revision) newest = snapshot;
+	return newest;
+}
+/**
+* Copies a document far enough that the caller cannot write through it. Inside
+* this class, callers only ever replace whole fields on these four, so one
+* level each is enough.
+*/
+function copyDocument(document) {
+	return {
+		...document,
+		header: { ...document.header },
+		state: { ...document.state },
+		operations: { ...document.operations }
+	};
+}
 /**
 * In-memory write cache with keyframe persistence for PHDocuments.
 *
@@ -956,6 +1196,8 @@ var KyselyWriteCache = class KyselyWriteCache {
 	/**
 	* Retrieves document state at a specific revision from cache or rebuilds it.
 	*
+	* Note: this returns a _shallow_ copy of the document.
+	*
 	* Cache hit path: Returns cached snapshot if available (O(1))
 	* Warm miss path: Rebuilds from cached base revision + incremental ops
 	* Cold miss path: Rebuilds from keyframe or from scratch using all operations
@@ -979,30 +1221,35 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if (stream) {
 			const snapshots = stream.ringBuffer.getAll();
 			if (targetRevision === void 0) {
-				if (snapshots.length > 0) {
-					const newest = snapshots[snapshots.length - 1];
+				const newest = highestRevision(snapshots);
+				if (newest?.position === SnapshotPosition.Head) {
 					this.lruTracker.touch(streamKey);
-					return newest.document;
+					return copyDocument(newest.document);
+				}
+				if (newest) {
+					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
+					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, SnapshotPosition.Head);
+					this.lruTracker.touch(streamKey);
+					return document;
 				}
 			} else {
-				const exactMatch = snapshots.find((s) => s.revision === targetRevision);
+				const exactMatch = snapshots.findLast((s) => s.revision === targetRevision);
 				if (exactMatch) {
 					this.lruTracker.touch(streamKey);
-					return exactMatch.document;
+					return copyDocument(exactMatch.document);
 				}
 				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
 				if (newestOlder) {
 					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
-					this.putState(documentId, scope, branch, targetRevision, document);
+					this.store(documentId, scope, branch, targetRevision, document, SnapshotPosition.Historical);
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
 			}
 		}
 		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
-		let revision = targetRevision;
-		if (revision === void 0) revision = document.header.revision[scope] || 0;
-		this.putState(documentId, scope, branch, revision, document);
+		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
+		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? SnapshotPosition.Head : SnapshotPosition.Historical);
 		return document;
 	}
 	/**
@@ -1025,16 +1272,20 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* @param document - The document to cache
 	* @throws {Error} If document serialization fails
 	*/
-	putState(documentId, scope, branch, revision, document) {
+	putState(documentId, scope, branch, revision, document, position) {
+		this.store(documentId, scope, branch, revision, document, position);
+	}
+	store(documentId, scope, branch, revision, document, position) {
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
 		const stream = this.getOrCreateStream(streamKey);
 		const snapshot = {
 			revision,
 			document: {
-				...document,
+				...copyDocument(document),
 				operations: Object.fromEntries(Object.entries(document.operations).map(([k, ops]) => [k, ops.length ? [ops.at(-1)] : []])),
 				clipboard: []
-			}
+			},
+			position
 		};
 		stream.ringBuffer.push(snapshot);
 		if (this.isKeyframeRevision(revision)) this.keyframeStore.putKeyframe(documentId, scope, branch, revision, {
@@ -1102,58 +1353,75 @@ var KyselyWriteCache = class KyselyWriteCache {
 	}
 	async findNearestKeyframe(documentId, scope, branch, targetRevision, signal) {
 		if (targetRevision === Number.MAX_SAFE_INTEGER || targetRevision <= 0) return;
-		return this.keyframeStore.findNearestKeyframe(documentId, scope, branch, targetRevision, signal);
+		const keyframe = await this.keyframeStore.findNearestKeyframe(documentId, scope, branch, targetRevision, signal);
+		if (!keyframe) return;
+		return {
+			revision: Math.min(keyframeRevision(keyframe, documentId, scope), keyframe.revision),
+			document: keyframe.document
+		};
 	}
 	async coldMissRebuild(documentId, scope, branch, targetRevision, signal) {
 		const effectiveTargetRevision = targetRevision || Number.MAX_SAFE_INTEGER;
 		const keyframe = await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal);
+		const documentScopeBound = scope === "document" ? targetRevision : void 0;
 		let document;
 		let startRevision;
 		let documentType;
 		const validatedUpgrades = [];
+		let lastDocumentScopeOperation;
 		if (keyframe) {
 			document = keyframe.document;
 			startRevision = keyframe.revision;
 			documentType = keyframe.document.header.documentType;
-			const docScopeOpsAfterKeyframe = await this.operationStore.getSince(documentId, "document", branch, keyframe.revision, void 0, void 0, signal);
-			for (const operation of docScopeOpsAfterKeyframe.results) if (operation.action.type === "UPGRADE_DOCUMENT") {
-				const upgradeAction = operation.action;
-				const fromVersion = upgradeAction.input.fromVersion;
-				const toVersion = upgradeAction.input.toVersion;
-				if (fromVersion > 0 && fromVersion < toVersion) {
-					let upgradePath;
-					try {
-						upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
-					} catch (err) {
-						if (upgradeAction.input.initialState !== void 0) upgradePath = void 0;
-						else throw new Error(`Failed to rebuild document ${documentId}: no upgrade manifest for ${documentType} v${fromVersion}→v${toVersion} and no initialState snapshot. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			const documentScopeResume = scope === "document" ? keyframe.revision : keyframeRevision(keyframe, documentId, "document");
+			const docScopeOpsAfterKeyframe = await this.operationStore.getSince(documentId, "document", branch, documentScopeResume, void 0, void 0, signal);
+			for (const operation of docScopeOpsAfterKeyframe.results) {
+				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
+				lastDocumentScopeOperation = operation;
+				if (operation.error || isDenied(operation)) continue;
+				if (operation.action.type === "UPGRADE_DOCUMENT") {
+					const upgradeAction = operation.action;
+					const fromVersion = upgradeAction.input.fromVersion;
+					const toVersion = upgradeAction.input.toVersion;
+					if (fromVersion > 0 && fromVersion < toVersion) {
+						let upgradePath;
+						try {
+							upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
+						} catch (err) {
+							if (upgradeAction.input.initialState !== void 0) upgradePath = void 0;
+							else throw new Error(`Failed to rebuild document ${documentId}: no upgrade manifest for ${documentType} v${fromVersion}→v${toVersion} and no initialState snapshot. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+						}
+						validatedUpgrades.push({
+							fromVersion,
+							toVersion,
+							revision: upgradeAction.input.revision,
+							timestampUtcMs: operation.timestampUtcMs
+						});
+						document = applyUpgradeDocumentAction(document, upgradeAction, upgradePath);
 					}
-					validatedUpgrades.push({
-						fromVersion,
-						toVersion,
-						revision: upgradeAction.input.revision,
-						timestampUtcMs: operation.timestampUtcMs
-					});
-					document = applyUpgradeDocumentAction(document, upgradeAction, upgradePath);
-				}
-			} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
+				} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
+			}
 		} else {
 			startRevision = -1;
 			const createOpResult = await this.operationStore.getSince(documentId, "document", branch, -1, void 0, {
 				cursor: "0",
 				limit: 1
 			}, signal);
-			if (createOpResult.results.length === 0) throw new Error(`Failed to rebuild document ${documentId}: no CREATE_DOCUMENT operation found in document scope`);
+			if (createOpResult.results.length === 0) throw new DocumentNotFoundError(documentId);
 			const createOp = createOpResult.results[0];
 			if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Failed to rebuild document ${documentId}: first operation in document scope must be CREATE_DOCUMENT, found ${createOp.action.type}`);
 			const documentCreateAction = createOp.action;
 			documentType = documentCreateAction.input.model;
 			if (!documentType) throw new Error(`Failed to rebuild document ${documentId}: CREATE_DOCUMENT action missing model in input`);
 			document = createDocumentFromAction(documentCreateAction);
+			lastDocumentScopeOperation = createOp;
 			let docModule = this.registry.getModule(documentType, extractModuleVersion(document));
 			const docScopeOps = await this.operationStore.getSince(documentId, "document", branch, 0, void 0, void 0, signal);
 			for (const operation of docScopeOps.results) {
+				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
+				lastDocumentScopeOperation = operation;
 				if (operation.index === 0) continue;
+				if (operation.error || isDenied(operation)) continue;
 				if (operation.action.type === "UPGRADE_DOCUMENT") {
 					const upgradeAction = operation.action;
 					const fromVersion = upgradeAction.input.fromVersion;
@@ -1177,7 +1445,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 					docModule = this.registry.getModule(documentType, extractModuleVersion(document));
 				} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
 				else {
-					const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
+					const protocolVersion = baseReducerVersion(document.header);
 					document = docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
@@ -1185,6 +1453,21 @@ var KyselyWriteCache = class KyselyWriteCache {
 				}
 			}
 		}
+		if (scope === "document") {
+			const last = lastDocumentScopeOperation ?? await this.operationAt(documentId, "document", branch, startRevision, signal);
+			document.operations = {
+				...document.operations,
+				document: last ? [last] : []
+			};
+			return this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+		}
+		if (keyframe) {
+			const resumeOperation = await this.operationAt(documentId, scope, branch, startRevision, signal);
+			if (resumeOperation) document.operations = {
+				...document.operations,
+				[scope]: [resumeOperation]
+			};
+		}
 		const moduleCache = /* @__PURE__ */ new Map();
 		const getModuleCached = (version) => {
 			const key = version ?? 0;
@@ -1209,11 +1492,14 @@ var KyselyWriteCache = class KyselyWriteCache {
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
 					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, extractModuleVersion(document));
-					const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
-					document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
-						skip: operation.skip,
-						protocolVersion
-					});
+					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
+					else {
+						const protocolVersion = baseReducerVersion(document.header);
+						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+							skip: operation.skip,
+							protocolVersion
+						});
+					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
 				hasMorePages = Boolean(result.nextCursor) && !reachedTarget;
@@ -1222,11 +1508,31 @@ var KyselyWriteCache = class KyselyWriteCache {
 				throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 			}
 		} while (hasMorePages);
+		return this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+	}
+	/**
+	* Copies the current document revisions onto the document. Overwrites the
+	* requested scope revision with the target revision, if provided.
+	*/
+	async stampRevisions(document, documentId, scope, branch, targetRevision, signal) {
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
+		if (targetRevision !== void 0) document.header.revision = {
+			...document.header.revision,
+			[scope]: targetRevision + 1
+		};
 		document.header.lastModifiedAtUtcIso = revisions.latestTimestamp;
 		return document;
 	}
+	/** The stored operation at `index`, or undefined if it is no longer there. */
+	async operationAt(documentId, scope, branch, index, signal) {
+		if (index < 0) return;
+		const operation = (await this.operationStore.getSince(documentId, scope, branch, index - 1, void 0, {
+			cursor: "0",
+			limit: 1
+		}, signal)).results[0];
+		return operation && operation.index === index ? operation : void 0;
+	}
 	/**
 	* Resolves which module version to use for a given operation in phase 2.
 	*
@@ -1250,19 +1556,22 @@ var KyselyWriteCache = class KyselyWriteCache {
 	async warmMissRebuild(baseDocument, baseRevision, documentId, scope, branch, targetRevision, signal) {
 		const documentType = baseDocument.header.documentType;
 		const docScopeNextIndex = baseDocument.header.revision["document"] ?? 0;
-		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.some((op) => op.action.type === "UPGRADE_DOCUMENT")) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
+		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.length > 0) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const module = this.registry.getModule(documentType, extractModuleVersion(baseDocument));
-		let document = baseDocument;
+		let document = copyDocument(baseDocument);
 		try {
 			const pagedResults = await this.operationStore.getSince(documentId, scope, branch, baseRevision, void 0, void 0, signal);
 			for (const operation of pagedResults.results) {
 				if (signal?.aborted) throw new Error("Operation aborted");
 				if (targetRevision !== void 0 && operation.index > targetRevision) break;
-				const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
-				document = module.reducer(document, operation.action, void 0, {
-					skip: operation.skip,
-					protocolVersion
-				});
+				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
+				else {
+					const protocolVersion = baseReducerVersion(document.header);
+					document = module.reducer(document, operation.action, void 0, {
+						skip: operation.skip,
+						protocolVersion
+					});
+				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
 		} catch (err) {
@@ -1270,6 +1579,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 		}
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		document.header.revision = revisions.revision;
+		if (targetRevision !== void 0) document.header.revision = {
+			...document.header.revision,
+			[scope]: targetRevision + 1
+		};
 		document.header.lastModifiedAtUtcIso = revisions.latestTimestamp;
 		return document;
 	}
@@ -1339,6 +1652,32 @@ var EventBus = class {
 	}
 };
 //#endregion
+//#region src/core/feature-flags.ts
+/**
+* Every flag this reactor knows, with the flags it requires. A stage adds its
+* flag here when it ships, so asking an older reactor for a later stage's flag
+* is an unrecognized name rather than a flag that quietly does nothing.
+*/
+const FLAG_PREREQUISITES = {
+	documentDecisions: [],
+	authEnforcement: ["documentDecisions"]
+};
+/**
+* Throws when the flags ask for enforcement the reactor cannot deliver. Either
+* failure would otherwise read as enforcement being on while the reactor
+* applies less than the caller asked for.
+*/
+function validateFeatureFlags(flags, prerequisites) {
+	const known = Object.keys(prerequisites);
+	const unrecognized = Object.keys(flags).filter((name) => !known.includes(name));
+	if (unrecognized.length > 0) throw new Error(`Unrecognized reactor feature flag: ${unrecognized.join(", ")}. This reactor knows: ${known.join(", ")}.`);
+	for (const name of known) {
+		if (flags[name] !== true) continue;
+		const missing = prerequisites[name].filter((required) => flags[required] !== true);
+		if (missing.length > 0) throw new Error(`Reactor feature flag ${name} requires ${missing.join(", ")}.`);
+	}
+}
+//#endregion
 //#region src/executor/execution-scope.ts
 var DefaultExecutionScope = class {
 	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
@@ -1425,15 +1764,402 @@ function reshuffleByTimestamp(startIndex, opsA, opsB) {
 		if (shouldPrioritizeLogicalIndex) {
 			if (logicalIndexDiff !== 0) return logicalIndexDiff;
 		}
-		const actionIdDiff = (a.action?.id ?? "").localeCompare(b.action?.id ?? "");
-		if (actionIdDiff !== 0) return actionIdDiff;
-		if (!shouldPrioritizeLogicalIndex && logicalIndexDiff !== 0) return logicalIndexDiff;
-		return a.id.localeCompare(b.id);
-	}).map((op, i) => ({
-		...op,
-		index: startIndex.index + i,
-		skip: i === 0 ? startIndex.skip : 0
-	}));
+		const actionIdDiff = (a.action?.id ?? "").localeCompare(b.action?.id ?? "");
+		if (actionIdDiff !== 0) return actionIdDiff;
+		if (!shouldPrioritizeLogicalIndex && logicalIndexDiff !== 0) return logicalIndexDiff;
+		return a.id.localeCompare(b.id);
+	}).map((op, i) => ({
+		...op,
+		index: startIndex.index + i,
+		skip: i === 0 ? startIndex.skip : 0
+	}));
+}
+//#endregion
+//#region src/decision/auth-decision-model.ts
+function refusalReason(refusal) {
+	switch (refusal) {
+		case "version-unsupported": return AUTH_VERSION_UNSUPPORTED_REASON;
+		case "denied-by-grant": return AUTH_DENIED_BY_GRANT_REASON;
+		case "no-applicable-grant": return AUTH_NO_GRANT_REASON;
+	}
+}
+/** This decision model uses both the document and the auth streams. */
+function authDecisionModel(target) {
+	return {
+		projections: {
+			document: {
+				decidingActions: ["DELETE_DOCUMENT"],
+				apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+					...document,
+					state: { ...document.state }
+				}, operation.action) : document,
+				query: {
+					documentId: target.documentId,
+					branch: target.branch,
+					scope: "document"
+				}
+			},
+			auth: {
+				decidingActions: [...AUTH_ACTION_TYPES],
+				apply: (document, operation) => applyAuthAction(document, operation.action),
+				query: {
+					documentId: target.documentId,
+					branch: target.branch,
+					scope: "auth"
+				}
+			}
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			if (request.verb === "execute" && model.document.isDeleted) return {
+				decision: "deny",
+				reason: DOCUMENT_DELETED_REASON
+			};
+			const evaluation = evaluate(model.auth, subject, request);
+			if (evaluation.decision === "allow") return { decision: "allow" };
+			return {
+				decision: "deny",
+				reason: refusalReason(evaluation.refusal)
+			};
+		}
+	};
+}
+//#endregion
+//#region src/decision/build-decision-model.ts
+/**
+* Reads each projection's stream through the write cache, recording the
+* revision observed. Static projections resolve first; derived projections
+* see only those and contribute a map from document id to state. Each
+* distinct stream is read once and yields one append condition entry.
+*/
+async function buildDecisionModel(cache, definition, target, signal) {
+	const decisionModel = definition(target);
+	const projections = Object.entries(decisionModel.projections);
+	const reads = /* @__PURE__ */ new Map();
+	const model = {};
+	for (const [key, projection] of projections) {
+		if (typeof projection.query === "function") continue;
+		model[key] = (await readStream(cache, projection.query, reads, signal)).state;
+	}
+	const staticModel = { ...model };
+	for (const [key, projection] of projections) {
+		if (typeof projection.query !== "function") continue;
+		const queries = projection.query(staticModel);
+		const value = {};
+		for (const query of queries) {
+			const read = await readStream(cache, query, reads, signal);
+			value[query.documentId] = read.state;
+		}
+		model[key] = value;
+	}
+	return {
+		model,
+		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
+	};
+}
+async function readStream(cache, query, reads, signal) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	const existing = reads.get(key);
+	if (existing) return existing;
+	const document = await cache.getState(query.documentId, query.scope, query.branch, void 0, signal);
+	const read = {
+		state: document.state[query.scope],
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: observedRevision(document, query.scope)
+		}
+	};
+	reads.set(key, read);
+	return read;
+}
+/**
+* The highest operation index the document reflects for the scope, or -1 if
+* empty. `header.revision` is authoritative, not the rebuilt operation list.
+*/
+function observedRevision(document, scope) {
+	if (scope in document.header.revision) return document.header.revision[scope] - 1;
+	if (scope in document.operations) {
+		const operations = document.operations[scope];
+		if (operations.length > 0) return operations[operations.length - 1].index;
+	}
+	if (!(scope in document.header.revision)) return -1;
+	return document.header.revision[scope] - 1;
+}
+/**
+* The streams a model reads whose queries are known before it is built. A
+* derived query needs the statically-queried projections first, so it is not
+* included here.
+*/
+function staticReadSet(definition) {
+	const streams = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query === "function") continue;
+		streams.push({
+			name,
+			query: projection.query,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply
+		});
+	}
+	return streams;
+}
+//#endregion
+//#region src/decision/document-decision-model.ts
+/**
+* The simplest decision model: one projection over the document scope, which
+* rejects on a deleted document.
+*/
+function documentDecisionModel(target) {
+	return {
+		projections: { document: {
+			decidingActions: ["DELETE_DOCUMENT"],
+			apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+				...document,
+				state: { ...document.state }
+			}, operation.action) : document,
+			query: {
+				documentId: target.documentId,
+				branch: target.branch,
+				scope: "document"
+			}
+		} },
+		evaluatesScope() {
+			return true;
+		},
+		decide(model) {
+			return model.document.isDeleted ? {
+				decision: "deny",
+				reason: DOCUMENT_DELETED_REASON
+			} : { decision: "allow" };
+		}
+	};
+}
+//#endregion
+//#region src/decision/registered-model.ts
+/**
+* Builds the model at the stream heads and decides one request against it. The
+* append condition it returns is the read-set the store enforces at write time.
+*/
+async function decideAtHead(model, cache, target, subject, request, signal) {
+	const built = await buildDecisionModel(cache, model, target, signal);
+	return {
+		evaluation: model(target).decide(built.model, subject, request, { scopeState: void 0 }),
+		appendCondition: built.appendCondition,
+		documentVersion: built.model.document.version,
+		deletedAtUtcIso: built.model.document.deletedAtUtcIso ?? null
+	};
+}
+/**
+* The model this reactor enforces. With `authEnforcement` off the auth scope is
+* absent from every append condition and no load walks it.
+*/
+function selectDecisionModel(flags) {
+	return flags.authEnforcement ? authDecisionModel : documentDecisionModel;
+}
+//#endregion
+//#region src/decision/merged-order.ts
+/** Identifies a stream within a walk. */
+function streamKey(query) {
+	return `${query.documentId}:${query.scope}:${query.branch}`;
+}
+/**
+* Orders two operations from different streams by position. Timestamp decides;
+* an equal timestamp puts an auth operation first, and otherwise falls to the
+* action id and then the operation id, so that two replicas holding the same
+* operations agree on the order whatever order they happen to store them in.
+*/
+function comparePositions(a, b) {
+	const aTime = Date.parse(a.operation.timestampUtcMs);
+	const bTime = Date.parse(b.operation.timestampUtcMs);
+	if (aTime !== bTime) return aTime - bTime;
+	if (a.streamKey === b.streamKey) return a.operation.index - b.operation.index;
+	const aAuth = a.scope === "auth";
+	if (aAuth !== (b.scope === "auth")) return aAuth ? -1 : 1;
+	const actionIds = (a.operation.action.id ?? "").localeCompare(b.operation.action.id ?? "");
+	if (actionIds !== 0) return actionIds;
+	return (a.operation.id ?? "").localeCompare(b.operation.id ?? "");
+}
+/**
+* Merges the read-set streams into one sequence by position. An operation's
+* place in the result is the bound a decision at that operation reads to: every
+* operation before it has been applied, and it has not.
+*/
+function mergeByPosition(streams) {
+	const merged = [];
+	for (const stream of streams) for (const operation of stream.operations) merged.push({
+		streamKey: stream.streamKey,
+		scope: stream.scope,
+		operation
+	});
+	return merged.sort(comparePositions);
+}
+/**
+* The skip that retracts everything from `firstRetractedIndex` up to where the
+* re-appended operation lands. It spans the indexes rather than counting the
+* operations, because a stream with a gap in it makes those differ.
+*/
+function retractionSkip(nextIndex, firstRetractedIndex) {
+	return nextIndex - firstRetractedIndex;
+}
+//#endregion
+//#region src/decision/walk.ts
+/**
+* A single forward pass is only correct while a stream's effective operations
+* are ordered.
+*/
+function assertPositionOrder(streamKey, scope, operations) {
+	for (let i = 1; i < operations.length; i++) {
+		const previous = operations[i - 1];
+		const current = operations[i];
+		if (comparePositions({
+			streamKey,
+			scope,
+			operation: previous
+		}, {
+			streamKey,
+			scope,
+			operation: current
+		}) > 0) throw new Error(`Stream ${streamKey} is out of position order: index ${previous.index} at ${previous.timestampUtcMs} precedes index ${current.index} at ${current.timestampUtcMs}`);
+	}
+}
+/**
+* Visits every operation in the read-set once, in the order their positions
+* fall, and hands back the state each stream held just before it. That state is
+* what a decision at that operation reads.
+*
+* Skips are resolved first (i.e. this is performed on a garbage collected
+* stream), which means we can do a single forward pass.
+*
+* An operation that contributes no state, whether denied or holding a reducer
+* error, is visited but not applied (this matches the write cache's rebuild).
+*
+* The consumer sends back whether it refused the operation it was handed: a
+* refusal this pass produced must suppress it the same way a stored one does.
+*/
+function* walkByPosition(streams) {
+	const merged = mergeByPosition(streams.map((stream) => {
+		const operations = garbageCollect(sortOperations([...stream.operations]));
+		assertPositionOrder(stream.streamKey, stream.scope, operations);
+		return {
+			streamKey: stream.streamKey,
+			scope: stream.scope,
+			operations
+		};
+	}));
+	const byKey = new Map(streams.map((stream) => [stream.streamKey, stream]));
+	const states = new Map(streams.map((stream) => [stream.streamKey, stream.document]));
+	for (const { streamKey, operation } of merged) {
+		if ((yield {
+			streamKey,
+			operation,
+			states: new Map(states)
+		}) || operation.error !== void 0 || isDenied(operation)) continue;
+		const stream = byKey.get(streamKey);
+		const before = states.get(streamKey);
+		if (before === void 0 || stream === void 0) throw new Error(`No state for stream ${streamKey}`);
+		states.set(streamKey, stream.apply(before, operation));
+	}
+}
+//#endregion
+//#region src/decision/evaluation.ts
+/** The stream key for evaluated operations whose scope no projection reads. */
+const EVALUATED_ONLY = "evaluated";
+/**
+* Whether any stream the model reads declares this operation's action type as
+* one that can change an evaluation.
+*/
+function isDecidingAction(operation, readSet) {
+	return readSet.some((stream) => stream.decidingActions.includes(operation.action.type));
+}
+/**
+* Who an operation acts as. A replayed operation is evaluated as its own signer,
+* so an address-scoped policy does not deny its own author's history.
+*/
+function subjectOf(operation) {
+	const signer = operation.action.context?.signer;
+	return {
+		address: signer?.user.address,
+		key: signer?.app.key
+	};
+}
+/**
+* The model as the walk reached this operation: each projection's value is its
+* own scope's state, taken from the stream that projection reads.
+*/
+function modelAt(readSet, states) {
+	const model = {};
+	for (const stream of readSet) {
+		const document = states.get(streamKey(stream.query));
+		if (document === void 0) throw new Error(`No state walked for projection ${stream.name}`);
+		model[stream.name] = document.state[stream.query.scope];
+	}
+	return model;
+}
+/**
+* Evaluates each operation at its own position and returns the refusals in an
+* array parallel to the operations, where undefined means allowed.
+*
+* A position is a timestamp, so an operation refused by a delete is one that
+* sorts after it, and the operations before it are left alone. That holds
+* whether the delete is already stored or is among the operations passed in.
+*/
+async function evaluateByPosition(model, target, subject, stores, signal) {
+	const { scope, operations } = subject;
+	const { writeCache, operationStore } = stores;
+	const definition = model(target);
+	const readSet = staticReadSet(definition);
+	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
+	const evaluating = new Set(operations.map((operation) => operation.id));
+	const readStreams = await Promise.all(readSet.map(async (stream) => ({
+		stream,
+		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, -1, { actionTypes: stream.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id))
+	})));
+	const decidingOperations = operations.filter((operation) => isDecidingAction(operation, readSet));
+	if (readStreams.every((read) => read.operations.length === 0) && decidingOperations.length === 0) return operations.map(() => void 0);
+	if (readStreams.length === 0) throw new Error(`Decision model for ${target.documentId} reads no stream whose query is known before it is built`);
+	const writtenProjection = readSet.find((stream) => stream.query.scope === scope);
+	const walked = [];
+	for (const read of readStreams) {
+		const isWritten = read.stream === writtenProjection;
+		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, -1, signal);
+		walked.push({
+			streamKey: streamKey(read.stream.query),
+			scope: read.stream.query.scope,
+			document: before,
+			operations: isWritten ? [...read.operations, ...operations] : read.operations,
+			apply: read.stream.apply
+		});
+	}
+	if (writtenProjection === void 0) walked.push({
+		streamKey: EVALUATED_ONLY,
+		scope,
+		document: walked[0].document,
+		operations,
+		apply: (document) => document
+	});
+	const reasons = /* @__PURE__ */ new Map();
+	const walk = walkByPosition(walked);
+	let step = walk.next(false);
+	while (!step.done) {
+		const position = step.value;
+		if (!evaluating.has(position.operation.id)) {
+			step = walk.next(false);
+			continue;
+		}
+		const evaluation = definition.decide(modelAt(readSet, position.states), subjectOf(position.operation), {
+			verb: "execute",
+			scope: position.operation.action.scope,
+			operation: position.operation.action.type
+		}, { scopeState: void 0 });
+		const denied = evaluation.decision === "deny";
+		reasons.set(position.operation.id, denied ? evaluation.reason : void 0);
+		step = walk.next(denied);
+	}
+	return operations.map((operation) => reasons.get(operation.id));
 }
 //#endregion
 //#region src/cache/operation-index-types.ts
@@ -1482,23 +2208,119 @@ var DriveCollectionId = class DriveCollectionId {
 //#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
-	constructor(registry, logger, driveContainerTypes) {
+	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel) {
 		this.registry = registry;
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
-	}
-	async execute(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+		this.featureFlags = featureFlags;
+		this.decisionModel = decisionModel;
+	}
+	/** Whether the write arrives with its evaluation already decided. */
+	alreadyEvaluated(executing) {
+		return this.featureFlags.documentDecisions && (executing.replayingAcceptedHistory || executing.evaluatedByPosition);
+	}
+	async execute(write, executing) {
+		const { action } = write;
+		if (write.deniedReason !== void 0) return this.writeDenied(write, executing);
+		const refusal = await this.refuseIfPolicyDenies(write, executing);
+		if (refusal) return refusal;
 		switch (action.type) {
-			case "CREATE_DOCUMENT": return this.executeCreate(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
-			case "DELETE_DOCUMENT": return this.executeDelete(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "UPGRADE_DOCUMENT": return this.executeUpgrade(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal);
-			case "ADD_RELATIONSHIP": return this.executeAddRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(job, action, startTime, indexTxn, stores, sourceRemote, signal);
-			default: return buildErrorResult(job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), startTime);
+			case "CREATE_DOCUMENT": return this.executeCreate(write, executing);
+			case "DELETE_DOCUMENT": return this.executeDelete(write, executing);
+			case "UPGRADE_DOCUMENT": return this.executeUpgrade(write, executing);
+			case "ADD_RELATIONSHIP": return this.executeAddRelationship(write, executing);
+			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(write, executing);
+			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(write, executing);
+			default: return buildErrorResult(executing.job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), executing.startTime);
+		}
+	}
+	/**
+	* Refuses a document-scope write the policy denies, or undefined to proceed.
+	* Without this an `execute`-on-`document` grant is unenforceable.
+	*/
+	async refuseIfPolicyDenies(write, executing) {
+		const { action } = write;
+		const { job, startTime, stores, signal } = executing;
+		if (!this.featureFlags.documentDecisions || !this.featureFlags.authEnforcement || this.alreadyEvaluated(executing) || !GATED_DOCUMENT_ACTIONS.has(action.type)) return;
+		const documentId = targetDocumentId(action, job.documentId);
+		let admission;
+		try {
+			admission = await decideAtHead(this.decisionModel, stores.writeCache, {
+				documentId,
+				branch: job.branch
+			}, {
+				address: action.context?.signer?.user.address,
+				key: action.context?.signer?.app.key
+			}, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
+		if (admission.evaluation.decision === "allow") return;
+		return buildErrorResult(job, refusalError(admission.evaluation.reason, documentId, admission.deletedAtUtcIso, action), startTime);
 	}
-	async executeCreate(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	/** A refused operation holds a position in the stream but changes nothing. */
+	async writeDenied(write, executing) {
+		const { action, skip, sourceRemote, deniedReason } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		let document;
+		try {
+			document = await stores.writeCache.getState(job.documentId, job.scope, job.branch, void 0, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		const index = getNextIndexForScope(document, job.scope);
+		let standing = document;
+		if (skip > 0) try {
+			standing = await stores.writeCache.getState(job.documentId, job.scope, job.branch, index - skip - 1, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		let operation = createOperation(action, index, skip, {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		});
+		operation.deniedReason = deniedReason;
+		operation.hash = hashDocumentStateForScope(standing, job.scope);
+		const writeResult = await this.writeOperationToStore({
+			documentId: job.documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
+		if (!Array.isArray(writeResult)) return writeResult;
+		operation = writeResult[0];
+		updateDocumentRevision(standing, job.scope, operation.index);
+		standing.operations = {
+			...standing.operations,
+			[job.scope]: [...standing.operations[job.scope] ?? [], operation]
+		};
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, SnapshotPosition.Head);
+		indexTxn.write([{
+			...operation,
+			documentId: job.documentId,
+			documentType: document.header.documentType,
+			branch: job.branch,
+			scope: job.scope,
+			sourceRemote
+		}]);
+		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
+			state: standing.state.document,
+			documentType: standing.header.documentType,
+			documentScopeRevision: operation.index + 1
+		});
+		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
+			header: standing.header,
+			document: standing.state.document
+		}), startTime);
+	}
+	async executeCreate(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.scope !== "document") return {
 			job,
 			success: false,
@@ -1516,7 +2338,12 @@ var DocumentActionHandler = class {
 			...document.state
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(document.header.id, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId: document.header.id,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -1524,7 +2351,7 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId: document.header.id,
@@ -1545,7 +2372,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
 	}
-	async executeDelete(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
+	async executeDelete(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("DELETE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -1556,8 +2385,8 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document before deletion: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
-		let operation = createOperation(action, getNextIndexForScope(document, job.scope), 0, {
+		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		let operation = createOperation(action, getNextIndexForScope(document, job.scope), skip, {
 			documentId,
 			scope: job.scope,
 			branch: job.branch
@@ -1568,7 +2397,12 @@ var DocumentActionHandler = class {
 			document: document.state.document
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(documentId, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -1576,7 +2410,7 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -1592,7 +2426,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	async executeUpgrade(job, action, startTime, indexTxn, stores, skip = 0, sourceRemote = "", signal) {
+	async executeUpgrade(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		const input = action.input;
 		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("UPGRADE_DOCUMENT action requires a documentId in input"), startTime);
 		const documentId = input.documentId;
@@ -1605,7 +2441,7 @@ var DocumentActionHandler = class {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
 		const documentState = document.state.document;
-		if (documentState.isDeleted) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
 		const nextIndex = getNextIndexForScope(document, job.scope);
 		let upgradePath;
 		if (fromVersion > 0 && fromVersion < toVersion) try {
@@ -1635,7 +2471,12 @@ var DocumentActionHandler = class {
 			...document.state
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		const writeResult = await this.writeOperationToStore(documentId, document.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		updateDocumentRevision(document, job.scope, operation.index);
@@ -1643,7 +2484,7 @@ var DocumentActionHandler = class {
 			...document.operations,
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -1659,8 +2500,8 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	executeAddRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("ADD_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
+	executeAddRelationship(write, executing) {
+		return this.withRelationshipAction("ADD_RELATIONSHIP", write, executing, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
 			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.addToCollection(collectionId, input.targetId);
@@ -1668,8 +2509,8 @@ var DocumentActionHandler = class {
 			}
 		});
 	}
-	executeRemoveRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("REMOVE_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
+	executeRemoveRelationship(write, executing) {
+		return this.withRelationshipAction("REMOVE_RELATIONSHIP", write, executing, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
 			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.removeFromCollection(collectionId, input.targetId);
@@ -1677,10 +2518,12 @@ var DocumentActionHandler = class {
 			}
 		});
 	}
-	executeUpdateRelationship(job, action, startTime, indexTxn, stores, sourceRemote = "", signal) {
-		return this.withRelationshipAction("UPDATE_RELATIONSHIP", job, action, startTime, indexTxn, stores, sourceRemote, signal, null, null);
+	executeUpdateRelationship(write, executing) {
+		return this.withRelationshipAction("UPDATE_RELATIONSHIP", write, executing, null, null);
 	}
-	async withRelationshipAction(actionTypeName, job, action, startTime, indexTxn, stores, sourceRemote, signal, preValidate, postWrite) {
+	async withRelationshipAction(actionTypeName, write, executing, preValidate, postWrite) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.scope !== "document") return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName} must be in "document" scope, got "${job.scope}"`), startTime);
 		const input = action.input;
 		if (!input.sourceId || !input.targetId || !input.relationshipType) return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName} action requires sourceId, targetId, and relationshipType in input`), startTime);
@@ -1694,12 +2537,17 @@ var DocumentActionHandler = class {
 		} catch (error) {
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName}: source document ${input.sourceId} not found: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
-		let operation = createOperation(action, getNextIndexForScope(sourceDoc, job.scope), 0, {
+		let operation = createOperation(action, getNextIndexForScope(sourceDoc, job.scope), skip, {
 			documentId: input.sourceId,
 			scope: job.scope,
 			branch: job.branch
 		});
-		const writeResult = await this.writeOperationToStore(input.sourceId, sourceDoc.header.documentType, job.scope, job.branch, operation, job, startTime, stores, signal);
+		const writeResult = await this.writeOperationToStore({
+			documentId: input.sourceId,
+			documentType: sourceDoc.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
 		if (!Array.isArray(writeResult)) return writeResult;
 		operation = writeResult[0];
 		sourceDoc.header.lastModifiedAtUtcIso = operation.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString();
@@ -1714,7 +2562,7 @@ var DocumentActionHandler = class {
 			[job.scope]: scopeState === void 0 ? {} : structuredClone(scopeState)
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
-		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc);
+		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, SnapshotPosition.Head);
 		indexTxn.write([{
 			...operation,
 			documentId: input.sourceId,
@@ -1737,7 +2585,9 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
 	}
-	async writeOperationToStore(documentId, documentType, scope, branch, operation, job, startTime, stores, signal) {
+	async writeOperationToStore(target, operation, executing) {
+		const { documentId, documentType, scope, branch } = target;
+		const { job, startTime, stores, signal } = executing;
 		let storedOperations;
 		try {
 			storedOperations = await stores.operationStore.apply(documentId, documentType, scope, branch, operation.index, (txn) => {
@@ -1746,10 +2596,11 @@ var DocumentActionHandler = class {
 		} catch (error) {
 			this.logger.error("Error writing @Operation to IOperationStore: @Error", operation, error);
 			stores.writeCache.invalidate(documentId, scope, branch);
+			if (AppendConditionFailedError.isError(error)) for (const stream of error.condition.streams) stores.writeCache.invalidate(stream.documentId, stream.scope, stream.branch);
 			return {
 				job,
 				success: false,
-				error: /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
+				error: AppendConditionFailedError.isError(error) ? error : /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
 				duration: Date.now() - startTime
 			};
 		}
@@ -1814,19 +2665,13 @@ function isValidISOTimestamp(value) {
 	if (!ISO_TIMESTAMP_REGEX.test(value)) return false;
 	return !isNaN(new Date(value).getTime());
 }
-const documentScopeActions = [
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP"
-];
 /**
 * Simple job executor that processes a job by applying actions through document model reducers.
 */
 var SimpleJobExecutor = class {
 	config;
+	featureFlags;
+	decisionModel;
 	signatureVerifierModule;
 	documentActionHandler;
 	executionScope;
@@ -1841,6 +2686,7 @@ var SimpleJobExecutor = class {
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
 		this.config = {
+			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
 			maxConcurrency: config.maxConcurrency ?? 1,
 			jobTimeoutMs: config.jobTimeoutMs ?? 3e4,
@@ -1848,8 +2694,14 @@ var SimpleJobExecutor = class {
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50
 		};
+		this.featureFlags = {
+			documentDecisions: config.featureFlags?.documentDecisions ?? false,
+			authEnforcement: config.featureFlags?.authEnforcement ?? false
+		};
+		validateFeatureFlags(this.featureFlags, FLAG_PREREQUISITES);
+		this.decisionModel = selectDecisionModel(this.featureFlags);
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
-		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes);
+		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
 	/**
@@ -1865,7 +2717,15 @@ var SimpleJobExecutor = class {
 			result = await this.executionScope.run(async (stores) => {
 				const indexTxn = stores.operationIndex.start();
 				if (job.kind === "load") {
-					const loadResult = await this.executeLoadJob(job, startTime, indexTxn, stores, signal);
+					const loadResult = await this.executeLoadJob({
+						job,
+						startTime,
+						indexTxn,
+						stores,
+						signal,
+						replayingAcceptedHistory: true,
+						evaluatedByPosition: false
+					});
 					if (loadResult.success && loadResult.operationsWithContext) {
 						for (const owc of loadResult.operationsWithContext) touchedCacheEntries.push({
 							documentId: owc.context.documentId,
@@ -1884,7 +2744,18 @@ var SimpleJobExecutor = class {
 					}
 					return loadResult;
 				}
-				const actionResult = await this.processActions(job, job.actions, startTime, indexTxn, stores, void 0, void 0, "", signal);
+				const positioned = await this.positionByTimestamp(job, stores, signal);
+				if (positioned.error) return buildErrorResult(job, positioned.error, startTime);
+				const executing = {
+					job,
+					startTime,
+					indexTxn,
+					stores,
+					signal,
+					replayingAcceptedHistory: false,
+					evaluatedByPosition: positioned.evaluatedByPosition
+				};
+				const actionResult = await this.processActions(positioned.writes, executing);
 				if (!actionResult.success) return {
 					job,
 					success: false,
@@ -1896,6 +2767,16 @@ var SimpleJobExecutor = class {
 					scope: owc.context.scope,
 					branch: owc.context.branch
 				});
+				const reevaluationError = await this.reevaluateIfCriteriaMet({
+					scope: job.scope,
+					operations: actionResult.generatedOperations
+				}, executing);
+				if (reevaluationError) return {
+					job,
+					success: false,
+					error: reevaluationError,
+					duration: Date.now() - startTime
+				};
 				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
 				if (actionResult.operationsWithContext.length > 0) {
 					for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
@@ -1931,7 +2812,9 @@ var SimpleJobExecutor = class {
 		const documentIds = [...new Set(operations.map((op) => op.context.documentId))];
 		return stores.collectionMembershipCache.getCollectionsForDocuments(documentIds);
 	}
-	async processActions(job, actions, startTime, indexTxn, stores, skipValues, sourceOperations, sourceRemote = "", signal) {
+	async processActions(writes, executing) {
+		const { job, signal } = executing;
+		const actions = writes.map((write) => write.action);
 		const generatedOperations = [];
 		const operationsWithContext = [];
 		try {
@@ -1948,14 +2831,11 @@ var SimpleJobExecutor = class {
 			success: false,
 			generatedOperations,
 			operationsWithContext,
-			error: /* @__PURE__ */ new Error(`Invalid timestamp "${action.timestampUtcMs}" on action ${action.type} (id: ${action.id})`)
+			error: new InvalidOperationTimestampError(job.documentId, action.scope, action.timestampUtcMs, `action ${action.type} (id: ${action.id})`)
 		};
 		let lastYield = performance.now();
-		for (let actionIndex = 0; actionIndex < actions.length; actionIndex++) {
-			const action = actions[actionIndex];
-			const skip = skipValues?.[actionIndex] ?? 0;
-			const sourceOperation = sourceOperations?.[actionIndex];
-			const result = documentScopeActions.includes(action.type) ? await this.documentActionHandler.execute(job, action, startTime, indexTxn, stores, skip, sourceRemote, signal) : await this.executeRegularAction(job, action, startTime, indexTxn, stores, skip, sourceOperation, sourceRemote, signal);
+		for (const write of writes) {
+			const result = DOCUMENT_SCOPE_ACTIONS.has(write.action.type) ? await this.documentActionHandler.execute(write, executing) : await this.executeRegularAction(write, executing);
 			const error = this.accumulateResultOrReturnError(result, generatedOperations, operationsWithContext);
 			if (error !== null) return {
 				success: false,
@@ -1980,14 +2860,44 @@ var SimpleJobExecutor = class {
 			operationsWithContext
 		};
 	}
-	async executeRegularAction(job, action, startTime, indexTxn, stores, skip = 0, sourceOperation, sourceRemote = "", signal) {
-		let docMeta;
-		try {
-			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
-		} catch (error) {
-			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+	async executeRegularAction(write, executing) {
+		const { action, skip, sourceOperation, sourceRemote, deniedReason } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		let appendCondition;
+		let documentVersion;
+		const alreadyEvaluated = this.featureFlags.documentDecisions && (executing.replayingAcceptedHistory || executing.evaluatedByPosition);
+		if (this.featureFlags.documentDecisions && !alreadyEvaluated) {
+			const target = {
+				documentId: job.documentId,
+				branch: job.branch
+			};
+			let admission;
+			try {
+				admission = await decideAtHead(this.decisionModel, stores.writeCache, target, {
+					address: action.context?.signer?.user.address,
+					key: action.context?.signer?.app.key
+				}, {
+					verb: "execute",
+					scope: action.scope,
+					operation: action.type
+				}, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (admission.evaluation.decision === "deny") return buildErrorResult(job, refusalError(admission.evaluation.reason, job.documentId, admission.deletedAtUtcIso, action), startTime);
+			appendCondition = admission.appendCondition;
+			documentVersion = admission.documentVersion;
+		} else if (alreadyEvaluated) documentVersion = (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).state.document.version;
+		else {
+			let docMeta;
+			try {
+				docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+			documentVersion = docMeta.state.version;
 		}
-		if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		if (isUndoRedo(action) || action.type === "PRUNE" || action.type === "NOOP" && skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		try {
@@ -1995,16 +2905,49 @@ var SimpleJobExecutor = class {
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
+		if (!this.featureFlags.authEnforcement && !executing.replayingAcceptedHistory) {
+			const subject = {
+				address: write.action.context?.signer?.user.address,
+				key: write.action.context?.signer?.app.key
+			};
+			if (decide(document.state.auth, subject, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}) === "deny") return buildErrorResult(job, new AuthorizationDeniedError(job.documentId, action.scope, action.type, subject.address), startTime);
+		}
 		let module;
 		try {
-			const moduleVersion = docMeta.state.version === 0 ? void 0 : docMeta.state.version;
+			const moduleVersion = documentVersion === 0 ? void 0 : documentVersion;
 			module = this.registry.getModule(document.header.documentType, moduleVersion);
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
 		let updatedDocument;
-		try {
-			const protocolVersion = document.header.protocolVersions?.["base-reducer"] ?? 1;
+		if (deniedReason !== void 0) {
+			const index = getNextIndexForScope(document, job.scope);
+			const denied = createOperation(action, index, skip, {
+				documentId: job.documentId,
+				scope: job.scope,
+				branch: job.branch
+			});
+			denied.deniedReason = deniedReason;
+			let standing = document;
+			if (skip > 0) try {
+				standing = await stores.writeCache.getState(job.documentId, job.scope, job.branch, index - skip - 1, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			denied.hash = hashDocumentStateForScope(standing, job.scope);
+			updatedDocument = {
+				...standing,
+				operations: {
+					...standing.operations,
+					[job.scope]: [...standing.operations[job.scope] ?? [], denied]
+				}
+			};
+		} else try {
+			const protocolVersion = baseReducerVersion(document.header);
 			const reducerOptions = sourceOperation ? {
 				skip,
 				branch: job.branch,
@@ -2035,14 +2978,15 @@ var SimpleJobExecutor = class {
 		try {
 			storedOperations = await stores.operationStore.apply(job.documentId, document.header.documentType, scope, job.branch, newOperation.index, (txn) => {
 				txn.addOperations(newOperation);
-			}, signal);
+			}, signal, appendCondition);
 		} catch (error) {
 			this.logger.error("Error writing @Operation to IOperationStore: @Error", newOperation, error);
 			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			if (AppendConditionFailedError.isError(error)) for (const stream of error.condition.streams) stores.writeCache.invalidate(stream.documentId, stream.scope, stream.branch);
 			return {
 				job,
 				success: false,
-				error: /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
+				error: AppendConditionFailedError.isError(error) ? error : /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${error instanceof Error ? error.message : String(error)}`),
 				duration: Date.now() - startTime
 			};
 		}
@@ -2051,7 +2995,7 @@ var SimpleJobExecutor = class {
 			...updatedDocument.header.revision,
 			[scope]: storedOperation.index + 1
 		};
-		stores.writeCache.putState(job.documentId, scope, job.branch, storedOperation.index, updatedDocument);
+		stores.writeCache.putState(job.documentId, scope, job.branch, storedOperation.index, updatedDocument, SnapshotPosition.Head);
 		indexTxn.write([{
 			...storedOperation,
 			documentId: job.documentId,
@@ -2078,14 +3022,238 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
-	async executeLoadJob(job, startTime, indexTxn, stores, signal) {
+	/**
+	* Orders a write by timestamp and decides it where it lands. The caller
+	* supplies the timestamp, so a write can belong before operations already
+	* stored; those are re-appended alongside it, the way a load reshuffles.
+	*
+	* Deciding a backdated write at the stream heads instead of at its position
+	* would overwrite the verdict every other replica computes for it.
+	*/
+	async positionByTimestamp(job, stores, signal) {
+		const plain = () => ({
+			writes: job.actions.map((action) => ({
+				action,
+				skip: 0,
+				sourceRemote: ""
+			})),
+			evaluatedByPosition: false
+		});
+		if (!this.featureFlags.documentDecisions || job.actions.length === 0) return plain();
+		let earliest = job.actions[0].timestampUtcMs;
+		let earliestAt = Date.parse(earliest);
+		for (const action of job.actions) {
+			const at = Date.parse(action.timestampUtcMs);
+			if (at < earliestAt) {
+				earliest = action.timestampUtcMs;
+				earliestAt = at;
+			}
+		}
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		const backdated = earliestAt < Date.parse(revisions.latestTimestamp);
+		if (this.featureFlags.authEnforcement && job.scope === "auth") {
+			const newest = await stores.operationStore.getStreamLatestTimestamp(job.documentId, "auth", job.branch, signal);
+			const violation = this.firstNonMonotonicTimestamp(job.actions, newest, job.documentId, job.branch);
+			if (violation) return {
+				writes: [],
+				evaluatedByPosition: false,
+				error: violation
+			};
+			if (!backdated) return plain();
+			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
+		}
+		if (!backdated) return plain();
+		const conflicting = (await stores.operationStore.getConflicting(job.documentId, job.scope, job.branch, earliest, void 0, signal)).results.filter((operation) => !isGenesisOperation(operation));
+		if (conflicting.length === 0) {
+			if (!this.featureFlags.authEnforcement) return plain();
+			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
+		}
+		const nextIndex = revisions.revision[job.scope] ?? 0;
+		let firstConflicting = conflicting[0].index;
+		for (const operation of conflicting) if (operation.index < firstConflicting) firstConflicting = operation.index;
+		const incoming = job.actions.map((action, i) => ({
+			id: action.id,
+			index: nextIndex + i,
+			skip: 0,
+			hash: "",
+			timestampUtcMs: action.timestampUtcMs,
+			action
+		}));
+		const merged = reshuffleByTimestamp({
+			index: nextIndex,
+			skip: retractionSkip(nextIndex, firstConflicting)
+		}, conflicting, incoming);
+		stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (!this.featureFlags.authEnforcement) return {
+			writes: merged.map((operation) => ({
+				action: operation.action,
+				skip: operation.skip,
+				sourceRemote: ""
+			})),
+			evaluatedByPosition: false
+		};
+		return this.evaluatePositioned(job, stores, merged, signal);
+	}
+	/**
+	* Decides each operation where it lands and carries the verdict on it. A
+	* refused submitted action is reported to the caller and nothing is stored; a
+	* refused operation the reshuffle merely moved keeps its verdict, because it
+	* already holds a position.
+	*
+	* The operations carry the indexes and skips they will be stored at, because
+	* the walk resolves skips before it orders them.
+	*/
+	async evaluatePositioned(job, stores, operations, signal) {
+		const reasons = await evaluateByPosition(this.decisionModel, {
+			documentId: job.documentId,
+			branch: job.branch
+		}, {
+			scope: job.scope,
+			operations
+		}, stores, signal);
+		const submitted = new Set(job.actions.map((action) => action.id));
+		for (let i = 0; i < operations.length; i++) {
+			const reason = reasons[i];
+			if (reason !== void 0 && submitted.has(operations[i].action.id)) return {
+				writes: [],
+				evaluatedByPosition: false,
+				error: refusalError(reason, job.documentId, null, operations[i].action)
+			};
+		}
+		return {
+			writes: operations.map((operation, i) => ({
+				action: operation.action,
+				skip: operation.skip,
+				sourceRemote: "",
+				deniedReason: reasons[i]
+			})),
+			evaluatedByPosition: true
+		};
+	}
+	/**
+	* The scopes a re-evaluation pass visits, in a fixed order.
+	*
+	* The revisions map comes from a query with no ORDER BY, and the order is
+	* load-bearing: each scope's pass re-reads the auth stream, and the walk skips
+	* an operation by its stored denial, so a denial this pass just wrote is
+	* visible to a later-visited scope and invisible to an earlier one. The model's
+	* own projection order leads, then the rest sorted, so the pass is reproducible
+	* across replicas and across runs.
+	*/
+	evaluationOrder(target, revision) {
+		const definition = this.decisionModel(target);
+		const evaluated = Object.keys(revision).filter((scope) => definition.evaluatesScope(scope));
+		const leading = [];
+		for (const stream of staticReadSet(definition)) {
+			const scope = stream.query.scope;
+			if (evaluated.includes(scope) && !leading.includes(scope)) leading.push(scope);
+		}
+		const rest = evaluated.filter((scope) => !leading.includes(scope)).sort((a, b) => a.localeCompare(b));
+		return [...leading, ...rest];
+	}
+	/**
+	* The first timestamp in the batch that does not strictly exceed everything
+	* ahead of it, or undefined when the whole batch is monotonic.
+	*
+	* The bound is carried forward rather than compared against one stored maximum,
+	* because a single execute can carry several auth actions stamped in the same
+	* millisecond. Letting a tie through would store a stream the position walk
+	* then refuses to read, with no repair path.
+	*/
+	firstNonMonotonicTimestamp(entries, newest, documentId, branch) {
+		let boundIso = newest;
+		let bound = newest === void 0 ? Number.NEGATIVE_INFINITY : Date.parse(newest);
+		for (const entry of entries) {
+			if (!isValidISOTimestamp(entry.timestampUtcMs)) return new InvalidOperationTimestampError(documentId, "auth", entry.timestampUtcMs, "auth operation");
+			const at = Date.parse(entry.timestampUtcMs);
+			if (boundIso !== void 0 && at <= bound) return new AuthTimestampNotMonotonicError(documentId, branch, entry.timestampUtcMs, boundIso);
+			bound = at;
+			boundIso = entry.timestampUtcMs;
+		}
+	}
+	/** The operations a batch of submitted actions appends at the scope's tail. */
+	appendedOperations(job, nextIndex) {
+		return job.actions.map((action, i) => ({
+			id: action.id,
+			index: nextIndex + i,
+			skip: 0,
+			hash: "",
+			timestampUtcMs: action.timestampUtcMs,
+			action
+		}));
+	}
+	/**
+	* Re-evaluates the document when a write meets both criteria: it was written
+	* to a stream the model reads, and it is timestamped before an operation
+	* already stored. The caller supplies the timestamp and the reactor does not replace
+	* it, so a mutation job can write such an operation just as a load job can,
+	* which is why both executeJob and executeLoadJob call this.
+	*/
+	async reevaluateIfCriteriaMet(criteria, executing) {
+		if (!this.featureFlags.documentDecisions) return;
+		const { job, stores, signal } = executing;
+		const target = {
+			documentId: job.documentId,
+			branch: job.branch
+		};
+		if (!staticReadSet(this.decisionModel(target)).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === criteria.scope && stream.query.branch === job.branch)) return;
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		const latest = Date.parse(revisions.latestTimestamp);
+		if (!criteria.operations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) return;
+		return this.reevaluateDocument(executing);
+	}
+	/**
+	* Re-evaluates every scope the model evaluates. Where an operation's
+	* evaluation differs from what is stored, the tail from that operation is
+	* re-appended, carrying a skip that spans the indices it supersedes.
+	*/
+	async reevaluateDocument(executing) {
+		const { job, stores, signal } = executing;
+		const target = {
+			documentId: job.documentId,
+			branch: job.branch
+		};
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		for (const scope of this.evaluationOrder(target, revisions.revision)) {
+			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
+			const effective = garbageCollect(sortOperations([...stored]));
+			if (effective.length === 0) continue;
+			const reevaluated = await evaluateByPosition(this.decisionModel, target, {
+				scope,
+				operations: effective
+			}, stores, signal);
+			const firstChange = effective.findIndex((operation, i) => operation.deniedReason !== reevaluated[i]);
+			if (firstChange === -1) continue;
+			const tail = effective.slice(firstChange);
+			const nextIndex = revisions.revision[scope];
+			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			const result = await this.processActions(tail.map((operation, i) => ({
+				action: operation.action,
+				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index) : 0,
+				sourceRemote: "",
+				deniedReason: reevaluated[firstChange + i]
+			})), {
+				...executing,
+				job: {
+					...job,
+					scope
+				},
+				replayingAcceptedHistory: true,
+				evaluatedByPosition: true
+			});
+			if (!result.success) return result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`);
+		}
+	}
+	async executeLoadJob(executing) {
+		const { job, startTime, indexTxn, stores, signal } = executing;
 		if (job.operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("Load job must include at least one operation"), startTime);
 		let docMeta;
 		try {
 			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
 		} catch {}
-		if (docMeta?.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+		if (docMeta?.state.isDeleted && !this.featureFlags.documentDecisions) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 		const scope = job.scope;
+		const monotonicAuthStream = this.featureFlags.authEnforcement && scope === "auth";
 		let latestRevision;
 		try {
 			latestRevision = (await stores.operationStore.getRevisions(job.documentId, job.branch, signal)).revision[scope] ?? 0;
@@ -2095,7 +3263,7 @@ var SimpleJobExecutor = class {
 		for (const operation of job.operations) if (operation.timestampUtcMs && !isValidISOTimestamp(operation.timestampUtcMs)) return {
 			job,
 			success: false,
-			error: /* @__PURE__ */ new Error(`Invalid timestamp "${operation.timestampUtcMs}" on operation (index: ${operation.index})`),
+			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
 			duration: Date.now() - startTime
 		};
 		let minIncomingIndex = Number.POSITIVE_INFINITY;
@@ -2103,7 +3271,7 @@ var SimpleJobExecutor = class {
 		for (const operation of job.operations) {
 			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
 			const ts = operation.timestampUtcMs || "";
-			if (ts < minIncomingTimestamp) minIncomingTimestamp = ts;
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
 		}
 		let conflictingOps;
 		try {
@@ -2128,11 +3296,14 @@ var SimpleJobExecutor = class {
 			}
 			return true;
 		});
-		const existingOpsToReshuffle = nonSupersededOps;
-		if (existingOpsToReshuffle.length > this.config.maxSkipThreshold) return {
+		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
+		const actionIdCounts = /* @__PURE__ */ new Map();
+		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
+		const reshuffleCost = existingOpsToReshuffle.filter((operation) => (actionIdCounts.get(operation.action.id) ?? 0) < 2).length;
+		if (reshuffleCost > this.config.maxSkipThreshold) return {
 			job,
 			success: false,
-			error: /* @__PURE__ */ new Error(`Excessive reshuffle detected: existing op count of ${existingOpsToReshuffle.length} exceeds threshold of ${this.config.maxSkipThreshold}. This indicates a significant divergence between local and incoming operations.`),
+			error: new ExcessiveReshuffleError(job.documentId, scope, reshuffleCost, this.config.maxSkipThreshold),
 			duration: Date.now() - startTime
 		};
 		let skipCount = existingOpsToReshuffle.length;
@@ -2160,6 +3331,16 @@ var SimpleJobExecutor = class {
 			operationsWithContext: [],
 			duration: Date.now() - startTime
 		};
+		if (monotonicAuthStream) {
+			const newest = await stores.operationStore.getStreamLatestTimestamp(job.documentId, "auth", job.branch, signal);
+			const violation = this.firstNonMonotonicTimestamp([...incomingOpsToApply].sort((a, b) => a.index - b.index), newest, job.documentId, job.branch);
+			if (violation) return {
+				job,
+				success: false,
+				error: violation,
+				duration: Date.now() - startTime
+			};
+		}
 		const reshuffledOperations = existingOpsToReshuffle.length === 0 && skipCount === 0 ? incomingOpsToApply.slice().sort((a, b) => a.index - b.index).map((operation, i) => ({
 			...operation,
 			index: latestRevision + i
@@ -2171,10 +3352,31 @@ var SimpleJobExecutor = class {
 			id: operation.id
 		})));
 		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP") operation.skip = 1;
-		const actions = reshuffledOperations.map((operation) => operation.action);
-		const skipValues = reshuffledOperations.map((operation) => operation.skip);
+		let deniedReasons;
+		if (this.featureFlags.documentDecisions) try {
+			deniedReasons = await evaluateByPosition(this.decisionModel, {
+				documentId: job.documentId,
+				branch: job.branch
+			}, {
+				scope,
+				operations: reshuffledOperations
+			}, stores, signal);
+		} catch (error) {
+			return {
+				job,
+				success: false,
+				error: error instanceof Error ? error : new Error(String(error)),
+				duration: Date.now() - startTime
+			};
+		}
 		const effectiveSourceRemote = skipCount > 0 ? "" : job.meta.sourceRemote || "";
-		const result = await this.processActions(job, actions, startTime, indexTxn, stores, skipValues, reshuffledOperations, effectiveSourceRemote, signal);
+		const result = await this.processActions(reshuffledOperations.map((operation, i) => ({
+			action: operation.action,
+			skip: operation.skip,
+			sourceOperation: operation,
+			sourceRemote: effectiveSourceRemote,
+			deniedReason: deniedReasons?.[i]
+		})), executing);
 		if (!result.success) return {
 			job,
 			success: false,
@@ -2183,6 +3385,16 @@ var SimpleJobExecutor = class {
 		};
 		stores.writeCache.invalidate(job.documentId, scope, job.branch);
 		if (scope === "document") stores.documentMetaCache.invalidate(job.documentId, job.branch);
+		const reevaluationError = await this.reevaluateIfCriteriaMet({
+			scope,
+			operations: result.generatedOperations
+		}, executing);
+		if (reevaluationError) return {
+			job,
+			success: false,
+			error: reevaluationError,
+			duration: Date.now() - startTime
+		};
 		return {
 			job,
 			success: true,
@@ -2419,36 +3631,6 @@ function paginateRows(rows, paging, cursorOf, toItem, refetch) {
 	};
 }
 //#endregion
-//#region src/storage/interfaces.ts
-/**
-* Thrown when an operation with the same identity already exists in the store.
-*/
-var DuplicateOperationError = class extends Error {
-	constructor(description) {
-		super(`Duplicate operation: ${description}`);
-		this.name = "DuplicateOperationError";
-	}
-};
-/**
-* Thrown when a concurrent write conflict is detected during an atomic apply.
-*/
-var OptimisticLockError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "OptimisticLockError";
-	}
-};
-/**
-* Thrown when the caller-provided revision does not match the current
-* stored revision, indicating a stale read.
-*/
-var RevisionMismatchError = class extends Error {
-	constructor(expected, actual) {
-		super(`Revision mismatch: expected ${expected}, got ${actual}`);
-		this.name = "RevisionMismatchError";
-	}
-};
-//#endregion
 //#region src/storage/txn.ts
 var AtomicTransaction = class {
 	operations = [];
@@ -2473,6 +3655,7 @@ var AtomicTransaction = class {
 			action: JSON.stringify(op.action),
 			skip: op.skip,
 			error: op.error || null,
+			deniedReason: op.deniedReason || null,
 			hash: op.hash
 		});
 	}
@@ -2506,12 +3689,12 @@ var KyselyOperationStore = class KyselyOperationStore {
 		instance.trx = trx;
 		return instance;
 	}
-	async apply(documentId, documentType, scope, branch, revision, fn, signal) {
+	async apply(documentId, documentType, scope, branch, revision, fn, signal, condition) {
 		if (this.trx) {
 			let executeResult = null;
 			let uniqueCtx = null;
 			try {
-				executeResult = await this.executeApply(this.trx, documentId, documentType, scope, branch, revision, fn, signal);
+				executeResult = await this.executeApply(this.trx, documentId, documentType, scope, branch, revision, fn, signal, condition);
 			} catch (error) {
 				if (error instanceof _UniqueConstraintContext) uniqueCtx = error;
 				else throw error;
@@ -2523,7 +3706,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			let uniqueCtx = null;
 			try {
 				transactionResult = await this.db.transaction().execute(async (trx) => {
-					return this.executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal);
+					return this.executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal, condition);
 				});
 			} catch (error) {
 				if (error instanceof _UniqueConstraintContext) uniqueCtx = error;
@@ -2542,12 +3725,13 @@ var KyselyOperationStore = class KyselyOperationStore {
 		const op = ctx.stagedOps[0];
 		throw new DuplicateOperationError(`${op.opId} at index ${op.index} with skip ${op.skip}`);
 	}
-	async executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal) {
+	async executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal, condition) {
 		throwIfAborted(signal);
 		const atomicTxn = new AtomicTransaction(documentId, documentType, scope, branch, revision);
 		await fn(atomicTxn);
 		const operations = atomicTxn.getOperations();
 		if (operations.length === 0) return [];
+		if (condition) await this.acquireStreamLocks(trx, documentId, scope, branch, condition);
 		const latestOp = await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "desc").limit(1).executeTakeFirst();
 		const currentRevision = latestOp ? latestOp.index : -1;
 		if (currentRevision !== revision - 1) {
@@ -2563,22 +3747,91 @@ var KyselyOperationStore = class KyselyOperationStore {
 			op.prevOpId = prevOpId;
 			prevOpId = op.opId;
 		}
+		let insertedCount = operations.length;
 		try {
-			await trx.insertInto("Operation").values(operations).execute();
+			if (condition && condition.streams.length > 0) insertedCount = await this.insertGuarded(trx, operations, condition);
+			else await trx.insertInto("Operation").values(operations).execute();
 		} catch (error) {
 			if (error instanceof Error && error.message.includes("unique constraint")) throw new _UniqueConstraintContext(documentId, scope, branch, revision, operations);
 			throw error;
 		}
+		if (insertedCount !== operations.length) throw new AppendConditionFailedError(condition);
 		return operations.map((op) => ({
 			index: op.index,
 			timestampUtcMs: op.timestampUtcMs.toISOString(),
 			hash: op.hash,
 			skip: op.skip,
 			error: op.error || void 0,
+			deniedReason: op.deniedReason || void 0,
 			id: op.opId,
 			action: JSON.parse(op.action)
 		}));
 	}
+	/**
+	* Locks the written stream and every read-set stream, in sorted key order
+	* so that overlapping concurrent appends serialize rather than deadlock.
+	* The locks are still taken one row at a time, so the query preserves that
+	* order. It must stay separate from the guarded insert, which would
+	* otherwise read a snapshot taken before the locks were held.
+	*/
+	async acquireStreamLocks(trx, documentId, scope, branch, condition) {
+		const keys = new Set([`${documentId}:${scope}:${branch}`]);
+		for (const stream of condition.streams) keys.add(`${stream.documentId}:${stream.scope}:${stream.branch}`);
+		await sql`
+      with ordered as materialized (
+        select key
+        from unnest(array[${sql.join([...keys].sort())}]::text[]) with ordinality as t(key, ord)
+        order by ord
+      )
+      select pg_advisory_xact_lock(hashtext(key)) from ordered
+    `.execute(trx);
+	}
+	/**
+	* Inserts the staged operations with the condition compiled in as a WHERE
+	* NOT EXISTS guard, making the check and the append one statement. Returns
+	* the rows inserted; zero means the guard failed and nothing was written.
+	*/
+	async insertGuarded(trx, operations, condition) {
+		const branches = operations.map((op) => trx.selectNoFrom([
+			sql`${op.jobId}::text`.as("jobId"),
+			sql`${op.opId}::text`.as("opId"),
+			sql`${op.prevOpId}::text`.as("prevOpId"),
+			sql`${op.documentId}::text`.as("documentId"),
+			sql`${op.documentType}::text`.as("documentType"),
+			sql`${op.scope}::text`.as("scope"),
+			sql`${op.branch}::text`.as("branch"),
+			sql`${op.timestampUtcMs}::timestamptz`.as("timestampUtcMs"),
+			sql`${op.index}::integer`.as("index"),
+			sql`${op.action}::jsonb`.as("action"),
+			sql`${op.skip}::integer`.as("skip"),
+			sql`${op.error ?? null}::text`.as("error"),
+			sql`${op.deniedReason ?? null}::text`.as("deniedReason"),
+			sql`${op.hash}::text`.as("hash")
+		]).where((eb) => eb.not(eb.exists(eb.selectFrom("Operation").select("Operation.id").where((web) => web.or(condition.streams.map((s) => web.and([
+			web("Operation.documentId", "=", s.documentId),
+			web("Operation.scope", "=", s.scope),
+			web("Operation.branch", "=", s.branch),
+			web("Operation.index", ">", s.revision)
+		]))))))));
+		let expression = branches[0];
+		for (let i = 1; i < branches.length; i++) expression = expression.unionAll(branches[i]);
+		return (await trx.insertInto("Operation").columns([
+			"jobId",
+			"opId",
+			"prevOpId",
+			"documentId",
+			"documentType",
+			"scope",
+			"branch",
+			"timestampUtcMs",
+			"index",
+			"action",
+			"skip",
+			"error",
+			"deniedReason",
+			"hash"
+		]).expression(expression).returning("id").execute()).length;
+	}
 	async findIdempotentReplay(executor, documentId, scope, branch, revision, stagedOps) {
 		const minIndex = revision;
 		const maxIndex = revision + stagedOps.length - 1;
@@ -2646,18 +3899,18 @@ var KyselyOperationStore = class KyselyOperationStore {
 			"o1.index",
 			"o1.timestampUtcMs"
 		]).where("o1.documentId", "=", documentId).where("o1.branch", "=", branch).where((eb) => eb("o1.index", "=", eb.selectFrom("Operation as o2").select((eb2) => eb2.fn.max("o2.index").as("maxIndex")).where("o2.documentId", "=", eb.ref("o1.documentId")).where("o2.branch", "=", eb.ref("o1.branch")).where("o2.scope", "=", eb.ref("o1.scope")))).execute();
+		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("branch", "=", branch).executeTakeFirst();
 		const revision = {};
-		let latestTimestamp = (/* @__PURE__ */ new Date(0)).toISOString();
-		for (const row of scopeRevisions) {
-			revision[row.scope] = row.index + 1;
-			const timestamp = row.timestampUtcMs.toISOString();
-			if (timestamp > latestTimestamp) latestTimestamp = timestamp;
-		}
+		for (const row of scopeRevisions) revision[row.scope] = row.index + 1;
 		return {
 			revision,
-			latestTimestamp
+			latestTimestamp: latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : (/* @__PURE__ */ new Date(0)).toISOString()
 		};
 	}
+	async getStreamLatestTimestamp(documentId, scope, branch, signal) {
+		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
+		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
+	}
 	rowToOperation(row) {
 		return {
 			index: row.index,
@@ -2665,6 +3918,7 @@ var KyselyOperationStore = class KyselyOperationStore {
 			hash: row.hash,
 			skip: row.skip,
 			error: row.error || void 0,
+			deniedReason: row.deniedReason || void 0,
 			id: row.opId,
 			action: row.action
 		};
@@ -2750,8 +4004,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -2776,8 +4030,8 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -2793,14 +4047,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -2812,14 +4066,14 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -2840,8 +4094,8 @@ async function up$8(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -2851,14 +4105,14 @@ async function up$7(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
+async function up$8(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
+async function up$7(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -2872,8 +4126,8 @@ async function up$5(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
-async function up$4(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
+async function up$6(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -2881,8 +4135,8 @@ async function up$4(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
-async function up$3(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
+async function up$5(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -2891,24 +4145,60 @@ async function up$3(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
-async function up$2(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
+async function up$4(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$1 });
-async function up$1(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
+async function up$3(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up });
-async function up(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
+async function up$2(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
+//#region src/storage/migrations/015_add_operation_denied_reason.ts
+var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Records why authorization refused an operation. Separate from `error` so a
+* denial is distinguishable from a reducer failure without matching on a
+* message. Null for every operation written before decisions were enforced.
+*/
+async function up$1(db) {
+	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
+	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
+}
+async function down$1(db) {
+	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
+	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
+}
+//#endregion
+//#region src/storage/migrations/016_add_dead_letter_error_type.ts
+var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* The classification a dead letter falls into, stored because it decides whether
+* the document stays quarantined and the in-memory error is gone after a restart.
+* Defaulted rather than nullable, so a pre-existing row rehydrates.
+*/
+async function up(db) {
+	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
+}
+async function down(db) {
+	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -2925,7 +4215,9 @@ const migrations = {
 	"011_add_cursor_type_column": _011_add_cursor_type_column_exports,
 	"012_add_source_remote_column": _012_add_source_remote_column_exports,
 	"013_create_sync_dead_letters_table": _013_create_sync_dead_letters_table_exports,
-	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports
+	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports,
+	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports,
+	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -2979,6 +4271,6 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { parsePagingOptions as A, DuplicateManifestError as C, DocumentDeletedError as D, ModuleNotFoundError as E, __exportAll as M, DocumentNotFoundError as O, CollectionMembershipCache as S, InvalidModuleError as T, KyselyWriteCache as _, createForwardingPoolInstrumentation as a, createConsistencyToken as b, DuplicateOperationError as c, KyselyKeyframeStore as d, DocumentModelRegistry as f, EventBus as g, KyselyExecutionScope as h, runMigrations as i, throwIfAborted as j, matchesScope as k, OptimisticLockError as l, DriveCollectionId as m, REACTOR_SCHEMA as n, instrumentPgPool as o, SimpleJobExecutor as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, RevisionMismatchError as u, KyselyOperationIndex as v, DuplicateModuleError as w, createEmptyConsistencyToken as x, DocumentMetaCache as y };
+export { OptimisticLockError as A, ExcessiveReshuffleError as B, DocumentMetaCache as C, APPEND_CONDITION_FAILED_PREFIX as D, CollectionMembershipCache as E, ModuleNotFoundError as F, __exportAll as G, matchesScope as H, AuthTimestampNotMonotonicError as I, AuthorizationDeniedError as L, DuplicateManifestError as M, DuplicateModuleError as N, AppendConditionFailedError as O, InvalidModuleError as P, DocumentDeletedError as R, KyselyOperationIndex as S, createEmptyConsistencyToken as T, parsePagingOptions as U, InvalidOperationTimestampError as V, throwIfAborted as W, KyselyExecutionScope as _, createForwardingPoolInstrumentation as a, EventBus as b, KyselyKeyframeStore as c, DriveCollectionId as d, decideAtHead as f, authDecisionModel as g, buildDecisionModel as h, runMigrations as i, RevisionMismatchError as j, DuplicateOperationError as k, DocumentModelRegistry as l, documentDecisionModel as m, REACTOR_SCHEMA as n, instrumentPgPool as o, selectDecisionModel as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, FLAG_PREREQUISITES as v, createConsistencyToken as w, KyselyWriteCache as x, validateFeatureFlags as y, DocumentNotFoundError as z };
 
-//# sourceMappingURL=drive-container-types-DpJp2AmE.js.map
+//# sourceMappingURL=drive-container-types-BJCKXJwH.js.map