@powerhousedao/reactor 6.2.2-dev.42 → 6.2.2-dev.44

package/dist/{drive-container-types-BJCKXJwH.js → drive-container-types-h3M1AK3K.js}

@@ -1,5 +1,5 @@
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, hashDocumentStateForScope, isDenied, isUndoRedo, sortOperations } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, isDenied, isUndoRedo, mentionedGroupIds, normalizeDocumentModelVersion, referencedGroupIds, sortOperations } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -182,6 +182,28 @@ var InvalidSignatureError = class InvalidSignatureError extends Error {
 	}
 };
 /**
+* An UPGRADE_DOCUMENT action's preconditions (fromVersion and the per-scope
+* revision snapshot) did not match the document state the executor loaded.
+*
+* Terminal rather than retryable: the action carries the client's snapshot,
+* which stays stale no matter how often the job re-runs. The client is
+* expected to re-read the document and submit a fresh action instead.
+*/
+var UpgradePreconditionFailedError = class UpgradePreconditionFailedError extends Error {
+	documentId;
+	detail;
+	constructor(documentId, detail) {
+		super(`Upgrade precondition failed for document ${documentId}: ${detail}`);
+		this.name = "UpgradePreconditionFailedError";
+		this.documentId = documentId;
+		this.detail = detail;
+		Error.captureStackTrace(this, UpgradePreconditionFailedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UpgradePreconditionFailedError";
+	}
+};
+/**
 * Error thrown when a document is not found (no operations exist for the document ID).
 */
 var DocumentNotFoundError = class DocumentNotFoundError extends Error {
@@ -736,6 +758,7 @@ var KyselyOperationIndexTxn = class {
 	collections = [];
 	collectionMemberships = [];
 	collectionRemovals = [];
+	groupReferences = [];
 	operations = [];
 	createCollection(collectionId) {
 		this.collections.push(collectionId);
@@ -758,12 +781,25 @@ var KyselyOperationIndexTxn = class {
 			operationIndex: lastOpIndex
 		});
 	}
+	recordGroupReferences(documentId, groupIds) {
+		const lastOpIndex = this.operations.length - 1;
+		if (lastOpIndex < 0) throw new Error("recordGroupReferences must be called after write() - no operations in transaction");
+		if (groupIds.length === 0) return;
+		this.groupReferences.push({
+			documentId,
+			groupIds,
+			operationIndex: lastOpIndex
+		});
+	}
 	write(operations) {
 		this.operations.push(...operations);
 	}
 	getCollections() {
 		return this.collections;
 	}
+	getGroupReferenceRecords() {
+		return this.groupReferences;
+	}
 	getCollectionMembershipRecords() {
 		return this.collectionMemberships;
 	}
@@ -800,10 +836,27 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		});
 		return resultOrdinals;
 	}
+	/**
+	* A policy-driven join: keeps the earliest join so a rediscovered reference
+	* never shrinks a backfill window remotes already rely on, and reopens a
+	* closed membership because a policy reference is not a removable one.
+	*/
+	async joinKeepingEarliest(trx, documentId, collectionId, ordinal) {
+		await trx.insertInto("document_collections").values({
+			documentId,
+			collectionId,
+			joinedOrdinal: ordinal,
+			leftOrdinal: null
+		}).onConflict((oc) => oc.columns(["documentId", "collectionId"]).doUpdateSet({
+			joinedOrdinal: sql`LEAST("document_collections"."joinedOrdinal", EXCLUDED."joinedOrdinal")`,
+			leftOrdinal: null
+		})).execute();
+	}
 	async executeCommit(trx, kyselyTxn) {
 		const collections = kyselyTxn.getCollections();
 		const memberships = kyselyTxn.getCollectionMembershipRecords();
 		const removals = kyselyTxn.getCollectionRemovals();
+		const groupReferences = kyselyTxn.getGroupReferenceRecords();
 		const operations = kyselyTxn.getOperations();
 		if (collections.length > 0) {
 			const collectionRows = collections.map((collectionId) => ({
@@ -843,13 +896,28 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				joinedOrdinal: BigInt(ordinal),
 				leftOrdinal: null
 			})).execute();
+			const references = await trx.selectFrom("group_references").select("groupId").where("documentId", "=", m.documentId).execute();
+			for (const { groupId } of references) await this.joinKeepingEarliest(trx, groupId, m.collectionId, BigInt(ordinal));
 		}
 		if (removals.length > 0) for (const r of removals) {
 			const ordinal = operationOrdinals[r.operationIndex];
 			await trx.updateTable("document_collections").set({ leftOrdinal: BigInt(ordinal) }).where("collectionId", "=", r.collectionId).where("documentId", "=", r.documentId).where("leftOrdinal", "is", null).execute();
 		}
+		if (groupReferences.length > 0) for (const record of groupReferences) {
+			const ordinal = operationOrdinals[record.operationIndex];
+			await trx.insertInto("group_references").values(record.groupIds.map((groupId) => ({
+				documentId: record.documentId,
+				groupId
+			}))).onConflict((oc) => oc.doNothing()).execute();
+			const rows = await trx.selectFrom("document_collections").select("collectionId").where("documentId", "=", record.documentId).execute();
+			for (const groupId of record.groupIds) for (const { collectionId } of rows) await this.joinKeepingEarliest(trx, groupId, collectionId, BigInt(ordinal));
+		}
 		return operationOrdinals;
 	}
+	async getGroupReferencers(groupId, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
+	}
 	async find(collectionId, cursor, view, paging, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const outerCursor = cursor ?? -1;
@@ -1097,7 +1165,7 @@ function keyframeRevision(keyframe, documentId, scope) {
 }
 function extractModuleVersion(doc) {
 	const v = doc.state.document.version;
-	return v === 0 ? void 0 : v;
+	return normalizeDocumentModelVersion(v);
 }
 /** The highest revision held, latest push winning a tie. */
 function highestRevision(snapshots) {
@@ -1360,6 +1428,18 @@ var KyselyWriteCache = class KyselyWriteCache {
 			document: keyframe.document
 		};
 	}
+	/**
+	* Rebuilds a scope from a keyframe or from the whole operation history.
+	*
+	* The document scope is always rebuilt first, because it carries the type,
+	* the upgrades and the deletion marker. Its version-changing upgrades are not
+	* applied there though: an upgrade reducer must see the state the requested
+	* scope has reached at that upgrade's boundary, so each one is held back and
+	* applied when the replay below crosses the boundary that
+	* resolveModuleVersionForOp derives from it. Upgrades whose boundary lies past
+	* the last replayed operation are applied at the end. Creation-time 0->N seed
+	* upgrades carry the initial state, so they still apply immediately.
+	*/
 	async coldMissRebuild(documentId, scope, branch, targetRevision, signal) {
 		const effectiveTargetRevision = targetRevision || Number.MAX_SAFE_INTEGER;
 		const keyframe = await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal);
@@ -1368,6 +1448,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		let startRevision;
 		let documentType;
 		const validatedUpgrades = [];
+		const pendingUpgrades = [];
 		let lastDocumentScopeOperation;
 		if (keyframe) {
 			document = keyframe.document;
@@ -1397,9 +1478,17 @@ var KyselyWriteCache = class KyselyWriteCache {
 							revision: upgradeAction.input.revision,
 							timestampUtcMs: operation.timestampUtcMs
 						});
-						document = applyUpgradeDocumentAction(document, upgradeAction, upgradePath);
+						pendingUpgrades.push({
+							action: upgradeAction,
+							upgradePath,
+							index: operation.index,
+							subsequentDeletes: []
+						});
 					}
-				} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
+				} else if (operation.action.type === "DELETE_DOCUMENT") {
+					applyDeleteDocumentAction(document, operation.action);
+					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
+				}
 			}
 		} else {
 			startRevision = -1;
@@ -1426,8 +1515,8 @@ var KyselyWriteCache = class KyselyWriteCache {
 					const upgradeAction = operation.action;
 					const fromVersion = upgradeAction.input.fromVersion;
 					const toVersion = upgradeAction.input.toVersion;
-					let upgradePath;
 					if (fromVersion > 0 && fromVersion < toVersion) {
+						let upgradePath;
 						try {
 							upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
 						} catch (err) {
@@ -1440,11 +1529,18 @@ var KyselyWriteCache = class KyselyWriteCache {
 							revision: upgradeAction.input.revision,
 							timestampUtcMs: operation.timestampUtcMs
 						});
-					}
-					document = applyUpgradeDocumentAction(document, upgradeAction, upgradePath);
-					docModule = this.registry.getModule(documentType, extractModuleVersion(document));
-				} else if (operation.action.type === "DELETE_DOCUMENT") applyDeleteDocumentAction(document, operation.action);
-				else {
+						pendingUpgrades.push({
+							action: upgradeAction,
+							upgradePath,
+							index: operation.index,
+							subsequentDeletes: []
+						});
+					} else document = applyUpgradeDocumentAction(document, upgradeAction, void 0);
+					docModule = this.registry.getModule(documentType, normalizeDocumentModelVersion(toVersion));
+				} else if (operation.action.type === "DELETE_DOCUMENT") {
+					applyDeleteDocumentAction(document, operation.action);
+					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
+				} else {
 					const protocolVersion = baseReducerVersion(document.header);
 					document = docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
@@ -1454,6 +1550,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 			}
 		}
 		if (scope === "document") {
+			document = this.applyPendingUpgrades(document, pendingUpgrades, Number.MAX_SAFE_INTEGER);
 			const last = lastDocumentScopeOperation ?? await this.operationAt(documentId, "document", branch, startRevision, signal);
 			document.operations = {
 				...document.operations,
@@ -1478,6 +1575,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 			}
 			return mod;
 		};
+		const finalVersion = validatedUpgrades.at(-1)?.toVersion ?? extractModuleVersion(document);
 		let cursor = void 0;
 		const pageSize = 100;
 		let hasMorePages;
@@ -1491,7 +1589,8 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const result = await this.operationStore.getSince(documentId, scope, branch, startRevision, void 0, paging, signal);
 				for (const operation of result.results) {
 					if (targetRevision !== void 0 && operation.index > targetRevision) break;
-					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, extractModuleVersion(document));
+					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, finalVersion);
+					document = this.applyPendingUpgrades(document, pendingUpgrades, moduleVersion ?? Number.MAX_SAFE_INTEGER);
 					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 					else {
 						const protocolVersion = baseReducerVersion(document.header);
@@ -1508,7 +1607,62 @@ var KyselyWriteCache = class KyselyWriteCache {
 				throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
 			}
 		} while (hasMorePages);
-		return this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+		document = this.applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision);
+		document = await this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+		if (pendingUpgrades.length > 0) {
+			const firstHeldBack = pendingUpgrades[0];
+			const stamped = document.header.revision["document"] ?? 0;
+			document.header.revision = {
+				...document.header.revision,
+				document: Math.min(stamped, firstHeldBack.index)
+			};
+		}
+		return document;
+	}
+	/**
+	* Applies and removes every held-back upgrade whose target version is at or
+	* below `throughVersion`, in the order the document scope recorded them.
+	*/
+	applyPendingUpgrades(document, pendingUpgrades, throughVersion) {
+		while (pendingUpgrades.length > 0) {
+			const pending = pendingUpgrades[0];
+			if (throughVersion < pending.action.input.toVersion) break;
+			pendingUpgrades.shift();
+			document = this.applyPendingUpgrade(document, pending);
+		}
+		return document;
+	}
+	/**
+	* Applies the remaining held-back upgrades after the requested scope's
+	* replay has finished. A head read applies them all. A positional read
+	* applies only those whose boundary for this scope lies at or before the
+	* target position: applying a later one would label migrated state with a
+	* pre-upgrade revision, and a keyframe stored from that poisons every
+	* rebuild that resumes from it. Boundaries come from the upgrade's revision
+	* snapshot; an upgrade without one records no position for this scope, and
+	* the replay loop not having crossed it already places it past the target.
+	*/
+	applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision) {
+		while (pendingUpgrades.length > 0) {
+			const pending = pendingUpgrades[0];
+			if (targetRevision !== void 0) {
+				const snapshot = pending.action.input.revision;
+				if (snapshot === void 0) break;
+				if ((snapshot[scope] ?? 0) > targetRevision) break;
+			}
+			pendingUpgrades.shift();
+			document = this.applyPendingUpgrade(document, pending);
+		}
+		return document;
+	}
+	/**
+	* Applies one held-back upgrade, then re-applies the deletes the document
+	* scope recorded after it so the hold-back cannot invert their order.
+	*/
+	applyPendingUpgrade(document, pending) {
+		document = applyUpgradeDocumentAction(document, pending.action, pending.upgradePath);
+		for (const deleteAction of pending.subsequentDeletes) document = applyDeleteDocumentAction(document, deleteAction);
+		return document;
 	}
 	/**
 	* Copies the current document revisions onto the document. Overwrites the
@@ -1660,7 +1814,9 @@ var EventBus = class {
 */
 const FLAG_PREREQUISITES = {
 	documentDecisions: [],
-	authEnforcement: ["documentDecisions"]
+	authEnforcement: ["documentDecisions"],
+	authGroups: ["authEnforcement"],
+	authConditions: ["authGroups"]
 };
 /**
 * Throws when the flags ask for enforcement the reactor cannot deliver. Either
@@ -1783,49 +1939,159 @@ function refusalReason(refusal) {
 		case "no-applicable-grant": return AUTH_NO_GRANT_REASON;
 	}
 }
+function decideAuthModel(model, subject, request, groups, conditions) {
+	if (request.verb === "execute" && model.document.isDeleted) return {
+		decision: "deny",
+		reason: DOCUMENT_DELETED_REASON
+	};
+	const evaluation = evaluate(model.auth, subject, request, groups, conditions);
+	if (evaluation.decision === "allow") return { decision: "allow" };
+	return {
+		decision: "deny",
+		reason: refusalReason(evaluation.refusal)
+	};
+}
+function documentProjection(target) {
+	return {
+		decidingActions: ["DELETE_DOCUMENT"],
+		apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+			...document,
+			state: { ...document.state }
+		}, operation.action) : document,
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "document"
+		}
+	};
+}
+function authProjection(target) {
+	return {
+		decidingActions: [...AUTH_ACTION_TYPES],
+		apply: (document, operation) => applyAuthAction(document, operation.action),
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "auth"
+		}
+	};
+}
 /** This decision model uses both the document and the auth streams. */
 function authDecisionModel(target) {
 	return {
 		projections: {
-			document: {
-				decidingActions: ["DELETE_DOCUMENT"],
-				apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
-					...document,
-					state: { ...document.state }
-				}, operation.action) : document,
-				query: {
-					documentId: target.documentId,
-					branch: target.branch,
-					scope: "document"
-				}
-			},
-			auth: {
-				decidingActions: [...AUTH_ACTION_TYPES],
-				apply: (document, operation) => applyAuthAction(document, operation.action),
-				query: {
-					documentId: target.documentId,
-					branch: target.branch,
-					scope: "auth"
-				}
-			}
+			document: documentProjection(target),
+			auth: authProjection(target)
 		},
 		evaluatesScope() {
 			return true;
 		},
 		decide(model, subject, request) {
-			if (request.verb === "execute" && model.document.isDeleted) return {
-				decision: "deny",
-				reason: DOCUMENT_DELETED_REASON
-			};
-			const evaluation = evaluate(model.auth, subject, request);
-			if (evaluation.decision === "allow") return { decision: "allow" };
-			return {
-				decision: "deny",
-				reason: refusalReason(evaluation.refusal)
-			};
+			return decideAuthModel(model, subject, request);
 		}
 	};
 }
+/**
+* Folds one group-stream operation with the registered group model's reducer.
+* A reactor without the module registered folds nothing, so the member list
+* stays as read and a missing reducer never widens access.
+*/
+function applyGroupOperation(registry, document, operation) {
+	let reducer;
+	try {
+		reducer = registry.getModule(groupDocumentType).reducer;
+	} catch {
+		return document;
+	}
+	return reducer(document, operation.action);
+}
+/**
+* Folds one evaluated-scope operation with the reducer registered for the
+* document's own type, at the document's stamped version. A reactor without
+* that module folds nothing, so conditions read the base state and an
+* unresolvable reducer never widens access.
+*/
+function applyModelOperation(registry, document, operation) {
+	let reducer;
+	try {
+		const version = normalizeDocumentModelVersion(document.state.document?.version);
+		reducer = registry.getModule(document.header.documentType, version).reducer;
+	} catch {
+		return document;
+	}
+	return reducer(document, operation.action);
+}
+/**
+* The auth model extended with a derived groups projection: the streams it
+* reads are the group documents the folded grant list names, so adding a
+* grant that names a new group pulls that group's stream into the read-set.
+* Group queries pin the main branch, because a group's member list lives on
+* its main branch no matter which branch the referencing document is on.
+*/
+function groupsProjection(registry) {
+	return {
+		decidingActions: [...groupMembershipActionTypes],
+		apply: (document, operation) => applyGroupOperation(registry, document, operation),
+		query: (model) => referencedGroupIds(model.auth?.grants ?? []).map((id) => ({
+			documentId: id,
+			branch: "main",
+			scope: "global"
+		})),
+		queryOverHistory: (reads) => {
+			const ids = [];
+			for (const read of reads) {
+				if (read.name !== "auth") continue;
+				for (const operation of read.operations) for (const id of mentionedGroupIds(operation.action)) if (!ids.includes(id)) ids.push(id);
+			}
+			return ids.map((id) => ({
+				documentId: id,
+				branch: "main",
+				scope: "global"
+			}));
+		}
+	};
+}
+function authGroupsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return decideAuthModel(model, subject, request, model.groups);
+		}
+	});
+}
+/**
+* The groups model with conditions live: decide hands the executing scope's
+* state and the action input through to the evaluator, so `where` clauses
+* and { match } principals apply. The model folds the evaluated scope during
+* a positional walk, so a condition reads the state as it stood at each
+* operation's position.
+*/
+function authConditionsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		foldEvaluatedScope: (document, operation) => applyModelOperation(registry, document, operation),
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request, ctx) {
+			return decideAuthModel(model, subject, request, model.groups, {
+				scopeState: ctx.scopeState,
+				actionInput: ctx.actionInput
+			});
+		}
+	});
+}
 //#endregion
 //#region src/decision/build-decision-model.ts
 /**
@@ -1849,7 +2115,16 @@ async function buildDecisionModel(cache, definition, target, signal) {
 		const queries = projection.query(staticModel);
 		const value = {};
 		for (const query of queries) {
-			const read = await readStream(cache, query, reads, signal);
+			let read;
+			try {
+				read = await readStream(cache, query, reads, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) {
+					recordEmptyStream(query, reads);
+					continue;
+				}
+				throw error;
+			}
 			value[query.documentId] = read.state;
 		}
 		model[key] = value;
@@ -1859,6 +2134,20 @@ async function buildDecisionModel(cache, definition, target, signal) {
 		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
 	};
 }
+/** Guards a stream that holds nothing yet: any operation appearing is growth. */
+function recordEmptyStream(query, reads) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	if (reads.has(key)) return;
+	reads.set(key, {
+		state: void 0,
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: -1
+		}
+	});
+}
 async function readStream(cache, query, reads, signal) {
 	const key = `${query.documentId}:${query.scope}:${query.branch}`;
 	const existing = reads.get(key);
@@ -1890,6 +2179,24 @@ function observedRevision(document, scope) {
 	return document.header.revision[scope] - 1;
 }
 /**
+* The projections whose queries depend on folded state. A positional walk
+* resolves their streams through `queryOverHistory`; a projection without one
+* contributes no streams to a walk.
+*/
+function derivedReadSet(definition) {
+	const projections = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query !== "function") continue;
+		projections.push({
+			name,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply,
+			queryOverHistory: projection.queryOverHistory
+		});
+	}
+	return projections;
+}
+/**
 * The streams a model reads whose queries are known before it is built. A
 * derived query needs the statically-queried projections first, so it is not
 * included here.
@@ -1943,11 +2250,21 @@ function documentDecisionModel(target) {
 /**
 * Builds the model at the stream heads and decides one request against it. The
 * append condition it returns is the read-set the store enforces at write time.
+*
+* With `conditions` supplied, the executing scope's state is read at the head
+* for `doc.<scope>.*` paths. That read carries no append-condition entry of
+* its own: the written stream's expected-revision check already refuses a
+* write whose scope grew between the read and the append.
 */
-async function decideAtHead(model, cache, target, subject, request, signal) {
+async function decideAtHead(model, cache, target, subject, request, signal, conditions) {
 	const built = await buildDecisionModel(cache, model, target, signal);
+	let scopeState;
+	if (conditions !== void 0) scopeState = (await cache.getState(target.documentId, request.scope, target.branch, void 0, signal)).state[request.scope];
 	return {
-		evaluation: model(target).decide(built.model, subject, request, { scopeState: void 0 }),
+		evaluation: model(target).decide(built.model, subject, request, {
+			scopeState,
+			actionInput: conditions?.actionInput
+		}),
 		appendCondition: built.appendCondition,
 		documentVersion: built.model.document.version,
 		deletedAtUtcIso: built.model.document.deletedAtUtcIso ?? null
@@ -1955,9 +2272,13 @@ async function decideAtHead(model, cache, target, subject, request, signal) {
 }
 /**
 * The model this reactor enforces. With `authEnforcement` off the auth scope is
-* absent from every append condition and no load walks it.
+* absent from every append condition and no load walks it; with `authGroups`
+* on, the group documents the grant list names join the read-set and the
+* registry supplies the reducer that folds them.
 */
-function selectDecisionModel(flags) {
+function selectDecisionModel(flags, registry) {
+	if (flags.authConditions) return authConditionsDecisionModel(registry);
+	if (flags.authGroups) return authGroupsDecisionModel(registry);
 	return flags.authEnforcement ? authDecisionModel : documentDecisionModel;
 }
 //#endregion
@@ -2087,16 +2408,24 @@ function subjectOf(operation) {
 	};
 }
 /**
-* The model as the walk reached this operation: each projection's value is its
-* own scope's state, taken from the stream that projection reads.
+* The model as the walk reached this operation: each static projection's value
+* is its own scope's state, and each derived projection's value maps document
+* id to that document's state, holding only the streams this replica walked. A
+* derived stream it does not hold stays out of the map, which fails closed.
 */
-function modelAt(readSet, states) {
+function modelAt(readSet, derivedNames, derived, states) {
 	const model = {};
 	for (const stream of readSet) {
 		const document = states.get(streamKey(stream.query));
 		if (document === void 0) throw new Error(`No state walked for projection ${stream.name}`);
 		model[stream.name] = document.state[stream.query.scope];
 	}
+	for (const name of derivedNames) model[name] = {};
+	for (const entry of derived) {
+		const map = model[entry.name];
+		const document = states.get(streamKey(entry.query));
+		if (document !== void 0) map[entry.query.documentId] = document.state[entry.query.scope];
+	}
 	return model;
 }
 /**
@@ -2112,6 +2441,7 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	const { writeCache, operationStore } = stores;
 	const definition = model(target);
 	const readSet = staticReadSet(definition);
+	const derivedSet = derivedReadSet(definition);
 	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
 	const evaluating = new Set(operations.map((operation) => operation.id));
 	const readStreams = await Promise.all(readSet.map(async (stream) => ({
@@ -2123,24 +2453,76 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	if (readStreams.length === 0) throw new Error(`Decision model for ${target.documentId} reads no stream whose query is known before it is built`);
 	const writtenProjection = readSet.find((stream) => stream.query.scope === scope);
 	const walked = [];
+	const histories = [];
 	for (const read of readStreams) {
-		const isWritten = read.stream === writtenProjection;
+		const streamOperations = read.stream === writtenProjection ? [...read.operations, ...operations] : read.operations;
 		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, -1, signal);
 		walked.push({
 			streamKey: streamKey(read.stream.query),
 			scope: read.stream.query.scope,
 			document: before,
-			operations: isWritten ? [...read.operations, ...operations] : read.operations,
+			operations: streamOperations,
 			apply: read.stream.apply
 		});
+		histories.push({
+			name: read.stream.name,
+			operations: streamOperations
+		});
 	}
-	if (writtenProjection === void 0) walked.push({
+	let evaluatedStateKey;
+	if (writtenProjection !== void 0) evaluatedStateKey = streamKey(writtenProjection.query);
+	else if (definition.foldEvaluatedScope !== void 0) {
+		const query = {
+			documentId: target.documentId,
+			scope,
+			branch: target.branch
+		};
+		const storedOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, void 0, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
+		const before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+		evaluatedStateKey = streamKey(query);
+		walked.push({
+			streamKey: evaluatedStateKey,
+			scope,
+			document: before,
+			operations: [...storedOperations, ...operations],
+			apply: definition.foldEvaluatedScope
+		});
+	} else walked.push({
 		streamKey: EVALUATED_ONLY,
 		scope,
 		document: walked[0].document,
 		operations,
 		apply: (document) => document
 	});
+	const derivedEntries = [];
+	const walkedKeys = new Set(walked.map((stream) => stream.streamKey));
+	for (const projection of derivedSet) {
+		const queries = projection.queryOverHistory?.(histories) ?? [];
+		for (const query of queries) {
+			const key = streamKey(query);
+			if (walkedKeys.has(key)) continue;
+			let before;
+			try {
+				before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) continue;
+				throw error;
+			}
+			const streamOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, { actionTypes: projection.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
+			walkedKeys.add(key);
+			walked.push({
+				streamKey: key,
+				scope: query.scope,
+				document: before,
+				operations: streamOperations,
+				apply: projection.apply
+			});
+			derivedEntries.push({
+				name: projection.name,
+				query
+			});
+		}
+	}
 	const reasons = /* @__PURE__ */ new Map();
 	const walk = walkByPosition(walked);
 	let step = walk.next(false);
@@ -2150,11 +2532,16 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 			step = walk.next(false);
 			continue;
 		}
-		const evaluation = definition.decide(modelAt(readSet, position.states), subjectOf(position.operation), {
+		const evaluatedDocument = evaluatedStateKey === void 0 ? void 0 : position.states.get(evaluatedStateKey);
+		const scopeState = evaluatedDocument === void 0 ? void 0 : evaluatedDocument.state[scope];
+		const evaluation = definition.decide(modelAt(readSet, derivedSet.map((projection) => projection.name), derivedEntries, position.states), subjectOf(position.operation), {
 			verb: "execute",
 			scope: position.operation.action.scope,
 			operation: position.operation.action.type
-		}, { scopeState: void 0 });
+		}, {
+			scopeState,
+			actionInput: position.operation.action.input
+		});
 		const denied = evaluation.decision === "deny";
 		reasons.set(position.operation.id, denied ? evaluation.reason : void 0);
 		step = walk.next(denied);
@@ -2255,7 +2642,7 @@ var DocumentActionHandler = class {
 				verb: "execute",
 				scope: action.scope,
 				operation: action.type
-			}, signal);
+			}, signal, this.featureFlags.authConditions ? { actionInput: action.input } : void 0);
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
@@ -2442,13 +2829,6 @@ var DocumentActionHandler = class {
 		}
 		const documentState = document.state.document;
 		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
-		const nextIndex = getNextIndexForScope(document, job.scope);
-		let upgradePath;
-		if (fromVersion > 0 && fromVersion < toVersion) try {
-			upgradePath = this.registry.computeUpgradePath(document.header.documentType, fromVersion, toVersion);
-		} catch (error) {
-			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
-		}
 		if (fromVersion === toVersion && fromVersion > 0) return {
 			job,
 			success: true,
@@ -2456,6 +2836,48 @@ var DocumentActionHandler = class {
 			operationsWithContext: [],
 			duration: Date.now() - startTime
 		};
+		const arrivesDecided = executing.replayingAcceptedHistory || executing.evaluatedByPosition;
+		if (fromVersion > 0 && !arrivesDecided) {
+			const stampedVersion = normalizeDocumentModelVersion(documentState.version);
+			if (fromVersion !== stampedVersion) return buildErrorResult(job, new UpgradePreconditionFailedError(documentId, `fromVersion ${fromVersion} does not match the document's version ${stampedVersion}`), startTime);
+			if (input.revision !== void 0) {
+				let actualRevisions;
+				try {
+					actualRevisions = (await stores.operationStore.getRevisions(documentId, job.branch, signal)).revision;
+				} catch (error) {
+					return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch revisions for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
+				}
+				const revisionScopes = new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
+				for (const revisionScope of revisionScopes) {
+					const snapshot = input.revision[revisionScope] ?? 0;
+					const actual = actualRevisions[revisionScope] ?? 0;
+					if (snapshot !== actual) return buildErrorResult(job, new UpgradePreconditionFailedError(documentId, `revision snapshot for scope "${revisionScope}" is ${snapshot} but the document is at ${actual}`), startTime);
+				}
+			}
+		}
+		let upgradePath;
+		if (fromVersion > 0 && fromVersion < toVersion) try {
+			upgradePath = this.registry.computeUpgradePath(document.header.documentType, fromVersion, toVersion);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		const otherScopes = Object.keys(document.state).filter((scope) => scope !== job.scope);
+		if (fromVersion > 0) for (const scope of otherScopes) {
+			let scopedDocument;
+			try {
+				scopedDocument = await stores.writeCache.getState(documentId, scope, job.branch, void 0, signal);
+			} catch (error) {
+				return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch ${scope} scope for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
+			}
+			document = {
+				...document,
+				state: {
+					...document.state,
+					[scope]: scopedDocument.state[scope]
+				}
+			};
+		}
+		const nextIndex = getNextIndexForScope(document, job.scope);
 		try {
 			document = applyUpgradeDocumentAction$1(document, action, upgradePath);
 		} catch (error) {
@@ -2470,6 +2892,7 @@ var DocumentActionHandler = class {
 			header: document.header,
 			...document.state
 		};
+		if (fromVersion > 0) resultingStateObj.__migrated = true;
 		const resultingState = JSON.stringify(resultingStateObj);
 		const writeResult = await this.writeOperationToStore({
 			documentId,
@@ -2485,6 +2908,11 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		for (const scope of otherScopes) executing.postCommitInvalidations.push({
+			documentId,
+			scope,
+			branch: job.branch
+		});
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -2696,10 +3124,12 @@ var SimpleJobExecutor = class {
 		};
 		this.featureFlags = {
 			documentDecisions: config.featureFlags?.documentDecisions ?? false,
-			authEnforcement: config.featureFlags?.authEnforcement ?? false
+			authEnforcement: config.featureFlags?.authEnforcement ?? false,
+			authGroups: config.featureFlags?.authGroups ?? false,
+			authConditions: config.featureFlags?.authConditions ?? false
 		};
 		validateFeatureFlags(this.featureFlags, FLAG_PREREQUISITES);
-		this.decisionModel = selectDecisionModel(this.featureFlags);
+		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
 		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
@@ -2711,6 +3141,7 @@ var SimpleJobExecutor = class {
 	async executeJob(job, signal) {
 		const startTime = Date.now();
 		const touchedCacheEntries = [];
+		const postCommitInvalidations = [];
 		let pendingEvent;
 		let result;
 		try {
@@ -2724,7 +3155,8 @@ var SimpleJobExecutor = class {
 						stores,
 						signal,
 						replayingAcceptedHistory: true,
-						evaluatedByPosition: false
+						evaluatedByPosition: false,
+						postCommitInvalidations
 					});
 					if (loadResult.success && loadResult.operationsWithContext) {
 						for (const owc of loadResult.operationsWithContext) touchedCacheEntries.push({
@@ -2744,6 +3176,37 @@ var SimpleJobExecutor = class {
 					}
 					return loadResult;
 				}
+				if (job.kind === "reevaluation") {
+					const reevalResult = await this.executeReevaluationJob({
+						job,
+						startTime,
+						indexTxn,
+						stores,
+						signal,
+						replayingAcceptedHistory: false,
+						evaluatedByPosition: false,
+						postCommitInvalidations
+					});
+					if (reevalResult.success && reevalResult.operationsWithContext) {
+						for (const owc of reevalResult.operationsWithContext) touchedCacheEntries.push({
+							documentId: owc.context.documentId,
+							scope: owc.context.scope,
+							branch: owc.context.branch
+						});
+						const ordinals = await stores.operationIndex.commit(indexTxn, signal);
+						for (let i = 0; i < reevalResult.operationsWithContext.length; i++) reevalResult.operationsWithContext[i].context.ordinal = ordinals[i];
+						if (reevalResult.operationsWithContext.length > 0) {
+							const collectionMemberships = await this.getCollectionMembershipsForOperations(reevalResult.operationsWithContext, stores);
+							pendingEvent = {
+								jobId: job.id,
+								operations: reevalResult.operationsWithContext,
+								jobMeta: job.meta,
+								collectionMemberships
+							};
+						}
+					}
+					return reevalResult;
+				}
 				const positioned = await this.positionByTimestamp(job, stores, signal);
 				if (positioned.error) return buildErrorResult(job, positioned.error, startTime);
 				const executing = {
@@ -2753,7 +3216,8 @@ var SimpleJobExecutor = class {
 					stores,
 					signal,
 					replayingAcceptedHistory: false,
-					evaluatedByPosition: positioned.evaluatedByPosition
+					evaluatedByPosition: positioned.evaluatedByPosition,
+					postCommitInvalidations
 				};
 				const actionResult = await this.processActions(positioned.writes, executing);
 				if (!actionResult.success) return {
@@ -2803,6 +3267,7 @@ var SimpleJobExecutor = class {
 			}
 			throw error;
 		}
+		if (result.success) for (const entry of postCommitInvalidations) this.writeCache.invalidate(entry.documentId, entry.scope, entry.branch);
 		if (pendingEvent) this.eventBus.emit(ReactorEventTypes.JOB_WRITE_READY, pendingEvent).catch((error) => {
 			this.logger.error("Failed to emit JOB_WRITE_READY event: @Event : @Error", pendingEvent, error);
 		});
@@ -2880,7 +3345,7 @@ var SimpleJobExecutor = class {
 					verb: "execute",
 					scope: action.scope,
 					operation: action.type
-				}, signal);
+				}, signal, this.featureFlags.authConditions ? { actionInput: action.input } : void 0);
 			} catch (error) {
 				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 			}
@@ -2918,8 +3383,7 @@ var SimpleJobExecutor = class {
 		}
 		let module;
 		try {
-			const moduleVersion = documentVersion === 0 ? void 0 : documentVersion;
-			module = this.registry.getModule(document.header.documentType, moduleVersion);
+			module = this.registry.getModule(document.header.documentType, normalizeDocumentModelVersion(documentVersion));
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
@@ -3004,6 +3468,7 @@ var SimpleJobExecutor = class {
 			scope,
 			sourceRemote
 		}]);
+		if (scope === "auth") indexTxn.recordGroupReferences(job.documentId, mentionedGroupIds(action));
 		return {
 			job,
 			success: true,
@@ -3200,7 +3665,7 @@ var SimpleJobExecutor = class {
 		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
 		const latest = Date.parse(revisions.latestTimestamp);
 		if (!criteria.operations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) return;
-		return this.reevaluateDocument(executing);
+		return (await this.reevaluateDocument(executing)).error;
 	}
 	/**
 	* Re-evaluates every scope the model evaluates. Where an operation's
@@ -3213,6 +3678,7 @@ var SimpleJobExecutor = class {
 			documentId: job.documentId,
 			branch: job.branch
 		};
+		const reappended = [];
 		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
 		for (const scope of this.evaluationOrder(target, revisions.revision)) {
 			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
@@ -3241,8 +3707,60 @@ var SimpleJobExecutor = class {
 				replayingAcceptedHistory: true,
 				evaluatedByPosition: true
 			});
-			if (!result.success) return result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`);
+			if (!result.success) return {
+				error: result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`),
+				operationsWithContext: reappended
+			};
+			reappended.push(...result.operationsWithContext);
+		}
+		return { operationsWithContext: reappended };
+	}
+	/**
+	* Re-judges a document's stored operations because a read-set stream in
+	* another document (a group) gained an operation. The trigger timestamp
+	* bounds the work: an operation later than everything this document holds
+	* cannot change any evaluation, so the pass is skipped.
+	*/
+	async executeReevaluationJob(executing) {
+		const { job, startTime, stores, signal } = executing;
+		if (!this.featureFlags.documentDecisions) return {
+			job,
+			success: true,
+			operations: [],
+			operationsWithContext: [],
+			duration: Date.now() - startTime
+		};
+		const trigger = job.meta.triggerTimestampUtcMs;
+		if (typeof trigger === "string") {
+			let latestTimestamp;
+			try {
+				latestTimestamp = (await stores.operationStore.getRevisions(job.documentId, job.branch, signal)).latestTimestamp;
+			} catch {
+				return {
+					job,
+					success: true,
+					operations: [],
+					operationsWithContext: [],
+					duration: Date.now() - startTime
+				};
+			}
+			if (Date.parse(trigger) > Date.parse(latestTimestamp)) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
 		}
+		const outcome = await this.reevaluateDocument(executing);
+		if (outcome.error) return buildErrorResult(job, outcome.error, startTime);
+		return {
+			job,
+			success: true,
+			operations: outcome.operationsWithContext.map((owc) => owc.operation),
+			operationsWithContext: outcome.operationsWithContext,
+			duration: Date.now() - startTime
+		};
 	}
 	async executeLoadJob(executing) {
 		const { job, startTime, indexTxn, stores, signal } = executing;
@@ -3527,7 +4045,7 @@ var DocumentModelRegistry = class {
 	}
 	computeUpgradePath(documentType, fromVersion, toVersion) {
 		if (fromVersion === toVersion) return [];
-		if (toVersion < fromVersion) throw new DowngradeNotSupportedError(documentType, fromVersion, toVersion);
+		if (toVersion < fromVersion) throw new DowngradeNotSupportedError$1(documentType, fromVersion, toVersion);
 		const manifest = this.getUpgradeManifest(documentType);
 		const path = [];
 		for (let v = fromVersion + 1; v <= toVersion; v++) {
@@ -4004,8 +4522,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
-async function up$15(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -4030,8 +4548,8 @@ async function up$15(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
-async function up$14(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -4047,14 +4565,14 @@ async function up$14(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -4066,14 +4584,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -4094,8 +4612,8 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -4105,14 +4623,14 @@ async function up$9(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
+async function up$8(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -4126,8 +4644,8 @@ async function up$7(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
+async function up$7(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -4135,8 +4653,8 @@ async function up$6(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
+async function up$6(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -4145,60 +4663,82 @@ async function up$5(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
-async function up$4(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
+async function up$5(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
-async function up$3(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
+async function up$4(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
-async function up$2(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
+async function up$3(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/015_add_operation_denied_reason.ts
 var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * Records why authorization refused an operation. Separate from `error` so a
 * denial is distinguishable from a reducer failure without matching on a
 * message. Null for every operation written before decisions were enforced.
 */
-async function up$1(db) {
+async function up$2(db) {
 	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
 	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
 }
-async function down$1(db) {
+async function down$2(db) {
 	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
 	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
 }
 //#endregion
 //#region src/storage/migrations/016_add_dead_letter_error_type.ts
 var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * The classification a dead letter falls into, stored because it decides whether
 * the document stays quarantined and the in-memory error is gone after a restart.
 * Defaulted rather than nullable, so a pre-existing row rehydrates.
 */
-async function up(db) {
+async function up$1(db) {
 	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
 }
-async function down(db) {
+async function down$1(db) {
 	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
 }
 //#endregion
+//#region src/storage/migrations/017_create_group_references.ts
+var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* One row per (document, group) reference ever discovered from an auth
+* operation's input. Rows are never updated or deleted: auth evaluation is
+* positional, so a grant that named a group at any position keeps that
+* group's stream in the document's read-set even after a later operation
+* removes the reference. Read by documentId for the groups a document
+* requires (sync), and by groupId for the documents a group change affects
+* (re-evaluation).
+*/
+async function up(db) {
+	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
+	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
+}
+async function down(db) {
+	await db.schema.dropTable("group_references").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -4217,7 +4757,8 @@ const migrations = {
 	"013_create_sync_dead_letters_table": _013_create_sync_dead_letters_table_exports,
 	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports,
 	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports,
-	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports
+	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports,
+	"017_create_group_references": _017_create_group_references_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -4271,6 +4812,6 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { OptimisticLockError as A, ExcessiveReshuffleError as B, DocumentMetaCache as C, APPEND_CONDITION_FAILED_PREFIX as D, CollectionMembershipCache as E, ModuleNotFoundError as F, __exportAll as G, matchesScope as H, AuthTimestampNotMonotonicError as I, AuthorizationDeniedError as L, DuplicateManifestError as M, DuplicateModuleError as N, AppendConditionFailedError as O, InvalidModuleError as P, DocumentDeletedError as R, KyselyOperationIndex as S, createEmptyConsistencyToken as T, parsePagingOptions as U, InvalidOperationTimestampError as V, throwIfAborted as W, KyselyExecutionScope as _, createForwardingPoolInstrumentation as a, EventBus as b, KyselyKeyframeStore as c, DriveCollectionId as d, decideAtHead as f, authDecisionModel as g, buildDecisionModel as h, runMigrations as i, RevisionMismatchError as j, DuplicateOperationError as k, DocumentModelRegistry as l, documentDecisionModel as m, REACTOR_SCHEMA as n, instrumentPgPool as o, selectDecisionModel as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, FLAG_PREREQUISITES as v, createConsistencyToken as w, KyselyWriteCache as x, validateFeatureFlags as y, DocumentNotFoundError as z };
+export { OptimisticLockError as A, ExcessiveReshuffleError as B, DocumentMetaCache as C, APPEND_CONDITION_FAILED_PREFIX as D, CollectionMembershipCache as E, ModuleNotFoundError as F, throwIfAborted as G, UpgradePreconditionFailedError as H, AuthTimestampNotMonotonicError as I, __exportAll as K, AuthorizationDeniedError as L, DuplicateManifestError as M, DuplicateModuleError as N, AppendConditionFailedError as O, InvalidModuleError as P, DocumentDeletedError as R, KyselyOperationIndex as S, createEmptyConsistencyToken as T, matchesScope as U, InvalidOperationTimestampError as V, parsePagingOptions as W, KyselyExecutionScope as _, createForwardingPoolInstrumentation as a, EventBus as b, KyselyKeyframeStore as c, DriveCollectionId as d, decideAtHead as f, authDecisionModel as g, buildDecisionModel as h, runMigrations as i, RevisionMismatchError as j, DuplicateOperationError as k, DocumentModelRegistry as l, documentDecisionModel as m, REACTOR_SCHEMA as n, instrumentPgPool as o, selectDecisionModel as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, FLAG_PREREQUISITES as v, createConsistencyToken as w, KyselyWriteCache as x, validateFeatureFlags as y, DocumentNotFoundError as z };
 
-//# sourceMappingURL=drive-container-types-BJCKXJwH.js.map
+//# sourceMappingURL=drive-container-types-h3M1AK3K.js.map