@powerhousedao/reactor 6.2.2-dev.43 → 6.2.2-dev.44

package/dist/{drive-container-types-CU1ZUfD1.js → drive-container-types-h3M1AK3K.js}

@@ -1,5 +1,5 @@
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, hashDocumentStateForScope, isDenied, isUndoRedo, normalizeDocumentModelVersion, sortOperations } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, isDenied, isUndoRedo, mentionedGroupIds, normalizeDocumentModelVersion, referencedGroupIds, sortOperations } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -758,6 +758,7 @@ var KyselyOperationIndexTxn = class {
 	collections = [];
 	collectionMemberships = [];
 	collectionRemovals = [];
+	groupReferences = [];
 	operations = [];
 	createCollection(collectionId) {
 		this.collections.push(collectionId);
@@ -780,12 +781,25 @@ var KyselyOperationIndexTxn = class {
 			operationIndex: lastOpIndex
 		});
 	}
+	recordGroupReferences(documentId, groupIds) {
+		const lastOpIndex = this.operations.length - 1;
+		if (lastOpIndex < 0) throw new Error("recordGroupReferences must be called after write() - no operations in transaction");
+		if (groupIds.length === 0) return;
+		this.groupReferences.push({
+			documentId,
+			groupIds,
+			operationIndex: lastOpIndex
+		});
+	}
 	write(operations) {
 		this.operations.push(...operations);
 	}
 	getCollections() {
 		return this.collections;
 	}
+	getGroupReferenceRecords() {
+		return this.groupReferences;
+	}
 	getCollectionMembershipRecords() {
 		return this.collectionMemberships;
 	}
@@ -822,10 +836,27 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		});
 		return resultOrdinals;
 	}
+	/**
+	* A policy-driven join: keeps the earliest join so a rediscovered reference
+	* never shrinks a backfill window remotes already rely on, and reopens a
+	* closed membership because a policy reference is not a removable one.
+	*/
+	async joinKeepingEarliest(trx, documentId, collectionId, ordinal) {
+		await trx.insertInto("document_collections").values({
+			documentId,
+			collectionId,
+			joinedOrdinal: ordinal,
+			leftOrdinal: null
+		}).onConflict((oc) => oc.columns(["documentId", "collectionId"]).doUpdateSet({
+			joinedOrdinal: sql`LEAST("document_collections"."joinedOrdinal", EXCLUDED."joinedOrdinal")`,
+			leftOrdinal: null
+		})).execute();
+	}
 	async executeCommit(trx, kyselyTxn) {
 		const collections = kyselyTxn.getCollections();
 		const memberships = kyselyTxn.getCollectionMembershipRecords();
 		const removals = kyselyTxn.getCollectionRemovals();
+		const groupReferences = kyselyTxn.getGroupReferenceRecords();
 		const operations = kyselyTxn.getOperations();
 		if (collections.length > 0) {
 			const collectionRows = collections.map((collectionId) => ({
@@ -865,13 +896,28 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 				joinedOrdinal: BigInt(ordinal),
 				leftOrdinal: null
 			})).execute();
+			const references = await trx.selectFrom("group_references").select("groupId").where("documentId", "=", m.documentId).execute();
+			for (const { groupId } of references) await this.joinKeepingEarliest(trx, groupId, m.collectionId, BigInt(ordinal));
 		}
 		if (removals.length > 0) for (const r of removals) {
 			const ordinal = operationOrdinals[r.operationIndex];
 			await trx.updateTable("document_collections").set({ leftOrdinal: BigInt(ordinal) }).where("collectionId", "=", r.collectionId).where("documentId", "=", r.documentId).where("leftOrdinal", "is", null).execute();
 		}
+		if (groupReferences.length > 0) for (const record of groupReferences) {
+			const ordinal = operationOrdinals[record.operationIndex];
+			await trx.insertInto("group_references").values(record.groupIds.map((groupId) => ({
+				documentId: record.documentId,
+				groupId
+			}))).onConflict((oc) => oc.doNothing()).execute();
+			const rows = await trx.selectFrom("document_collections").select("collectionId").where("documentId", "=", record.documentId).execute();
+			for (const groupId of record.groupIds) for (const { collectionId } of rows) await this.joinKeepingEarliest(trx, groupId, collectionId, BigInt(ordinal));
+		}
 		return operationOrdinals;
 	}
+	async getGroupReferencers(groupId, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
+	}
 	async find(collectionId, cursor, view, paging, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const outerCursor = cursor ?? -1;
@@ -1768,7 +1814,9 @@ var EventBus = class {
 */
 const FLAG_PREREQUISITES = {
 	documentDecisions: [],
-	authEnforcement: ["documentDecisions"]
+	authEnforcement: ["documentDecisions"],
+	authGroups: ["authEnforcement"],
+	authConditions: ["authGroups"]
 };
 /**
 * Throws when the flags ask for enforcement the reactor cannot deliver. Either
@@ -1891,49 +1939,159 @@ function refusalReason(refusal) {
 		case "no-applicable-grant": return AUTH_NO_GRANT_REASON;
 	}
 }
+function decideAuthModel(model, subject, request, groups, conditions) {
+	if (request.verb === "execute" && model.document.isDeleted) return {
+		decision: "deny",
+		reason: DOCUMENT_DELETED_REASON
+	};
+	const evaluation = evaluate(model.auth, subject, request, groups, conditions);
+	if (evaluation.decision === "allow") return { decision: "allow" };
+	return {
+		decision: "deny",
+		reason: refusalReason(evaluation.refusal)
+	};
+}
+function documentProjection(target) {
+	return {
+		decidingActions: ["DELETE_DOCUMENT"],
+		apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+			...document,
+			state: { ...document.state }
+		}, operation.action) : document,
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "document"
+		}
+	};
+}
+function authProjection(target) {
+	return {
+		decidingActions: [...AUTH_ACTION_TYPES],
+		apply: (document, operation) => applyAuthAction(document, operation.action),
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "auth"
+		}
+	};
+}
 /** This decision model uses both the document and the auth streams. */
 function authDecisionModel(target) {
 	return {
 		projections: {
-			document: {
-				decidingActions: ["DELETE_DOCUMENT"],
-				apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
-					...document,
-					state: { ...document.state }
-				}, operation.action) : document,
-				query: {
-					documentId: target.documentId,
-					branch: target.branch,
-					scope: "document"
-				}
-			},
-			auth: {
-				decidingActions: [...AUTH_ACTION_TYPES],
-				apply: (document, operation) => applyAuthAction(document, operation.action),
-				query: {
-					documentId: target.documentId,
-					branch: target.branch,
-					scope: "auth"
-				}
-			}
+			document: documentProjection(target),
+			auth: authProjection(target)
 		},
 		evaluatesScope() {
 			return true;
 		},
 		decide(model, subject, request) {
-			if (request.verb === "execute" && model.document.isDeleted) return {
-				decision: "deny",
-				reason: DOCUMENT_DELETED_REASON
-			};
-			const evaluation = evaluate(model.auth, subject, request);
-			if (evaluation.decision === "allow") return { decision: "allow" };
-			return {
-				decision: "deny",
-				reason: refusalReason(evaluation.refusal)
-			};
+			return decideAuthModel(model, subject, request);
 		}
 	};
 }
+/**
+* Folds one group-stream operation with the registered group model's reducer.
+* A reactor without the module registered folds nothing, so the member list
+* stays as read and a missing reducer never widens access.
+*/
+function applyGroupOperation(registry, document, operation) {
+	let reducer;
+	try {
+		reducer = registry.getModule(groupDocumentType).reducer;
+	} catch {
+		return document;
+	}
+	return reducer(document, operation.action);
+}
+/**
+* Folds one evaluated-scope operation with the reducer registered for the
+* document's own type, at the document's stamped version. A reactor without
+* that module folds nothing, so conditions read the base state and an
+* unresolvable reducer never widens access.
+*/
+function applyModelOperation(registry, document, operation) {
+	let reducer;
+	try {
+		const version = normalizeDocumentModelVersion(document.state.document?.version);
+		reducer = registry.getModule(document.header.documentType, version).reducer;
+	} catch {
+		return document;
+	}
+	return reducer(document, operation.action);
+}
+/**
+* The auth model extended with a derived groups projection: the streams it
+* reads are the group documents the folded grant list names, so adding a
+* grant that names a new group pulls that group's stream into the read-set.
+* Group queries pin the main branch, because a group's member list lives on
+* its main branch no matter which branch the referencing document is on.
+*/
+function groupsProjection(registry) {
+	return {
+		decidingActions: [...groupMembershipActionTypes],
+		apply: (document, operation) => applyGroupOperation(registry, document, operation),
+		query: (model) => referencedGroupIds(model.auth?.grants ?? []).map((id) => ({
+			documentId: id,
+			branch: "main",
+			scope: "global"
+		})),
+		queryOverHistory: (reads) => {
+			const ids = [];
+			for (const read of reads) {
+				if (read.name !== "auth") continue;
+				for (const operation of read.operations) for (const id of mentionedGroupIds(operation.action)) if (!ids.includes(id)) ids.push(id);
+			}
+			return ids.map((id) => ({
+				documentId: id,
+				branch: "main",
+				scope: "global"
+			}));
+		}
+	};
+}
+function authGroupsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return decideAuthModel(model, subject, request, model.groups);
+		}
+	});
+}
+/**
+* The groups model with conditions live: decide hands the executing scope's
+* state and the action input through to the evaluator, so `where` clauses
+* and { match } principals apply. The model folds the evaluated scope during
+* a positional walk, so a condition reads the state as it stood at each
+* operation's position.
+*/
+function authConditionsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		foldEvaluatedScope: (document, operation) => applyModelOperation(registry, document, operation),
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request, ctx) {
+			return decideAuthModel(model, subject, request, model.groups, {
+				scopeState: ctx.scopeState,
+				actionInput: ctx.actionInput
+			});
+		}
+	});
+}
 //#endregion
 //#region src/decision/build-decision-model.ts
 /**
@@ -1957,7 +2115,16 @@ async function buildDecisionModel(cache, definition, target, signal) {
 		const queries = projection.query(staticModel);
 		const value = {};
 		for (const query of queries) {
-			const read = await readStream(cache, query, reads, signal);
+			let read;
+			try {
+				read = await readStream(cache, query, reads, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) {
+					recordEmptyStream(query, reads);
+					continue;
+				}
+				throw error;
+			}
 			value[query.documentId] = read.state;
 		}
 		model[key] = value;
@@ -1967,6 +2134,20 @@ async function buildDecisionModel(cache, definition, target, signal) {
 		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
 	};
 }
+/** Guards a stream that holds nothing yet: any operation appearing is growth. */
+function recordEmptyStream(query, reads) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	if (reads.has(key)) return;
+	reads.set(key, {
+		state: void 0,
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: -1
+		}
+	});
+}
 async function readStream(cache, query, reads, signal) {
 	const key = `${query.documentId}:${query.scope}:${query.branch}`;
 	const existing = reads.get(key);
@@ -1998,6 +2179,24 @@ function observedRevision(document, scope) {
 	return document.header.revision[scope] - 1;
 }
 /**
+* The projections whose queries depend on folded state. A positional walk
+* resolves their streams through `queryOverHistory`; a projection without one
+* contributes no streams to a walk.
+*/
+function derivedReadSet(definition) {
+	const projections = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query !== "function") continue;
+		projections.push({
+			name,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply,
+			queryOverHistory: projection.queryOverHistory
+		});
+	}
+	return projections;
+}
+/**
 * The streams a model reads whose queries are known before it is built. A
 * derived query needs the statically-queried projections first, so it is not
 * included here.
@@ -2051,11 +2250,21 @@ function documentDecisionModel(target) {
 /**
 * Builds the model at the stream heads and decides one request against it. The
 * append condition it returns is the read-set the store enforces at write time.
+*
+* With `conditions` supplied, the executing scope's state is read at the head
+* for `doc.<scope>.*` paths. That read carries no append-condition entry of
+* its own: the written stream's expected-revision check already refuses a
+* write whose scope grew between the read and the append.
 */
-async function decideAtHead(model, cache, target, subject, request, signal) {
+async function decideAtHead(model, cache, target, subject, request, signal, conditions) {
 	const built = await buildDecisionModel(cache, model, target, signal);
+	let scopeState;
+	if (conditions !== void 0) scopeState = (await cache.getState(target.documentId, request.scope, target.branch, void 0, signal)).state[request.scope];
 	return {
-		evaluation: model(target).decide(built.model, subject, request, { scopeState: void 0 }),
+		evaluation: model(target).decide(built.model, subject, request, {
+			scopeState,
+			actionInput: conditions?.actionInput
+		}),
 		appendCondition: built.appendCondition,
 		documentVersion: built.model.document.version,
 		deletedAtUtcIso: built.model.document.deletedAtUtcIso ?? null
@@ -2063,9 +2272,13 @@ async function decideAtHead(model, cache, target, subject, request, signal) {
 }
 /**
 * The model this reactor enforces. With `authEnforcement` off the auth scope is
-* absent from every append condition and no load walks it.
+* absent from every append condition and no load walks it; with `authGroups`
+* on, the group documents the grant list names join the read-set and the
+* registry supplies the reducer that folds them.
 */
-function selectDecisionModel(flags) {
+function selectDecisionModel(flags, registry) {
+	if (flags.authConditions) return authConditionsDecisionModel(registry);
+	if (flags.authGroups) return authGroupsDecisionModel(registry);
 	return flags.authEnforcement ? authDecisionModel : documentDecisionModel;
 }
 //#endregion
@@ -2195,16 +2408,24 @@ function subjectOf(operation) {
 	};
 }
 /**
-* The model as the walk reached this operation: each projection's value is its
-* own scope's state, taken from the stream that projection reads.
+* The model as the walk reached this operation: each static projection's value
+* is its own scope's state, and each derived projection's value maps document
+* id to that document's state, holding only the streams this replica walked. A
+* derived stream it does not hold stays out of the map, which fails closed.
 */
-function modelAt(readSet, states) {
+function modelAt(readSet, derivedNames, derived, states) {
 	const model = {};
 	for (const stream of readSet) {
 		const document = states.get(streamKey(stream.query));
 		if (document === void 0) throw new Error(`No state walked for projection ${stream.name}`);
 		model[stream.name] = document.state[stream.query.scope];
 	}
+	for (const name of derivedNames) model[name] = {};
+	for (const entry of derived) {
+		const map = model[entry.name];
+		const document = states.get(streamKey(entry.query));
+		if (document !== void 0) map[entry.query.documentId] = document.state[entry.query.scope];
+	}
 	return model;
 }
 /**
@@ -2220,6 +2441,7 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	const { writeCache, operationStore } = stores;
 	const definition = model(target);
 	const readSet = staticReadSet(definition);
+	const derivedSet = derivedReadSet(definition);
 	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
 	const evaluating = new Set(operations.map((operation) => operation.id));
 	const readStreams = await Promise.all(readSet.map(async (stream) => ({
@@ -2231,24 +2453,76 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	if (readStreams.length === 0) throw new Error(`Decision model for ${target.documentId} reads no stream whose query is known before it is built`);
 	const writtenProjection = readSet.find((stream) => stream.query.scope === scope);
 	const walked = [];
+	const histories = [];
 	for (const read of readStreams) {
-		const isWritten = read.stream === writtenProjection;
+		const streamOperations = read.stream === writtenProjection ? [...read.operations, ...operations] : read.operations;
 		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, -1, signal);
 		walked.push({
 			streamKey: streamKey(read.stream.query),
 			scope: read.stream.query.scope,
 			document: before,
-			operations: isWritten ? [...read.operations, ...operations] : read.operations,
+			operations: streamOperations,
 			apply: read.stream.apply
 		});
+		histories.push({
+			name: read.stream.name,
+			operations: streamOperations
+		});
 	}
-	if (writtenProjection === void 0) walked.push({
+	let evaluatedStateKey;
+	if (writtenProjection !== void 0) evaluatedStateKey = streamKey(writtenProjection.query);
+	else if (definition.foldEvaluatedScope !== void 0) {
+		const query = {
+			documentId: target.documentId,
+			scope,
+			branch: target.branch
+		};
+		const storedOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, void 0, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
+		const before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+		evaluatedStateKey = streamKey(query);
+		walked.push({
+			streamKey: evaluatedStateKey,
+			scope,
+			document: before,
+			operations: [...storedOperations, ...operations],
+			apply: definition.foldEvaluatedScope
+		});
+	} else walked.push({
 		streamKey: EVALUATED_ONLY,
 		scope,
 		document: walked[0].document,
 		operations,
 		apply: (document) => document
 	});
+	const derivedEntries = [];
+	const walkedKeys = new Set(walked.map((stream) => stream.streamKey));
+	for (const projection of derivedSet) {
+		const queries = projection.queryOverHistory?.(histories) ?? [];
+		for (const query of queries) {
+			const key = streamKey(query);
+			if (walkedKeys.has(key)) continue;
+			let before;
+			try {
+				before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) continue;
+				throw error;
+			}
+			const streamOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, { actionTypes: projection.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
+			walkedKeys.add(key);
+			walked.push({
+				streamKey: key,
+				scope: query.scope,
+				document: before,
+				operations: streamOperations,
+				apply: projection.apply
+			});
+			derivedEntries.push({
+				name: projection.name,
+				query
+			});
+		}
+	}
 	const reasons = /* @__PURE__ */ new Map();
 	const walk = walkByPosition(walked);
 	let step = walk.next(false);
@@ -2258,11 +2532,16 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 			step = walk.next(false);
 			continue;
 		}
-		const evaluation = definition.decide(modelAt(readSet, position.states), subjectOf(position.operation), {
+		const evaluatedDocument = evaluatedStateKey === void 0 ? void 0 : position.states.get(evaluatedStateKey);
+		const scopeState = evaluatedDocument === void 0 ? void 0 : evaluatedDocument.state[scope];
+		const evaluation = definition.decide(modelAt(readSet, derivedSet.map((projection) => projection.name), derivedEntries, position.states), subjectOf(position.operation), {
 			verb: "execute",
 			scope: position.operation.action.scope,
 			operation: position.operation.action.type
-		}, { scopeState: void 0 });
+		}, {
+			scopeState,
+			actionInput: position.operation.action.input
+		});
 		const denied = evaluation.decision === "deny";
 		reasons.set(position.operation.id, denied ? evaluation.reason : void 0);
 		step = walk.next(denied);
@@ -2363,7 +2642,7 @@ var DocumentActionHandler = class {
 				verb: "execute",
 				scope: action.scope,
 				operation: action.type
-			}, signal);
+			}, signal, this.featureFlags.authConditions ? { actionInput: action.input } : void 0);
 		} catch (error) {
 			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 		}
@@ -2845,10 +3124,12 @@ var SimpleJobExecutor = class {
 		};
 		this.featureFlags = {
 			documentDecisions: config.featureFlags?.documentDecisions ?? false,
-			authEnforcement: config.featureFlags?.authEnforcement ?? false
+			authEnforcement: config.featureFlags?.authEnforcement ?? false,
+			authGroups: config.featureFlags?.authGroups ?? false,
+			authConditions: config.featureFlags?.authConditions ?? false
 		};
 		validateFeatureFlags(this.featureFlags, FLAG_PREREQUISITES);
-		this.decisionModel = selectDecisionModel(this.featureFlags);
+		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
 		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
@@ -2895,6 +3176,37 @@ var SimpleJobExecutor = class {
 					}
 					return loadResult;
 				}
+				if (job.kind === "reevaluation") {
+					const reevalResult = await this.executeReevaluationJob({
+						job,
+						startTime,
+						indexTxn,
+						stores,
+						signal,
+						replayingAcceptedHistory: false,
+						evaluatedByPosition: false,
+						postCommitInvalidations
+					});
+					if (reevalResult.success && reevalResult.operationsWithContext) {
+						for (const owc of reevalResult.operationsWithContext) touchedCacheEntries.push({
+							documentId: owc.context.documentId,
+							scope: owc.context.scope,
+							branch: owc.context.branch
+						});
+						const ordinals = await stores.operationIndex.commit(indexTxn, signal);
+						for (let i = 0; i < reevalResult.operationsWithContext.length; i++) reevalResult.operationsWithContext[i].context.ordinal = ordinals[i];
+						if (reevalResult.operationsWithContext.length > 0) {
+							const collectionMemberships = await this.getCollectionMembershipsForOperations(reevalResult.operationsWithContext, stores);
+							pendingEvent = {
+								jobId: job.id,
+								operations: reevalResult.operationsWithContext,
+								jobMeta: job.meta,
+								collectionMemberships
+							};
+						}
+					}
+					return reevalResult;
+				}
 				const positioned = await this.positionByTimestamp(job, stores, signal);
 				if (positioned.error) return buildErrorResult(job, positioned.error, startTime);
 				const executing = {
@@ -3033,7 +3345,7 @@ var SimpleJobExecutor = class {
 					verb: "execute",
 					scope: action.scope,
 					operation: action.type
-				}, signal);
+				}, signal, this.featureFlags.authConditions ? { actionInput: action.input } : void 0);
 			} catch (error) {
 				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 			}
@@ -3156,6 +3468,7 @@ var SimpleJobExecutor = class {
 			scope,
 			sourceRemote
 		}]);
+		if (scope === "auth") indexTxn.recordGroupReferences(job.documentId, mentionedGroupIds(action));
 		return {
 			job,
 			success: true,
@@ -3352,7 +3665,7 @@ var SimpleJobExecutor = class {
 		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
 		const latest = Date.parse(revisions.latestTimestamp);
 		if (!criteria.operations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) return;
-		return this.reevaluateDocument(executing);
+		return (await this.reevaluateDocument(executing)).error;
 	}
 	/**
 	* Re-evaluates every scope the model evaluates. Where an operation's
@@ -3365,6 +3678,7 @@ var SimpleJobExecutor = class {
 			documentId: job.documentId,
 			branch: job.branch
 		};
+		const reappended = [];
 		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
 		for (const scope of this.evaluationOrder(target, revisions.revision)) {
 			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
@@ -3393,8 +3707,60 @@ var SimpleJobExecutor = class {
 				replayingAcceptedHistory: true,
 				evaluatedByPosition: true
 			});
-			if (!result.success) return result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`);
+			if (!result.success) return {
+				error: result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`),
+				operationsWithContext: reappended
+			};
+			reappended.push(...result.operationsWithContext);
+		}
+		return { operationsWithContext: reappended };
+	}
+	/**
+	* Re-judges a document's stored operations because a read-set stream in
+	* another document (a group) gained an operation. The trigger timestamp
+	* bounds the work: an operation later than everything this document holds
+	* cannot change any evaluation, so the pass is skipped.
+	*/
+	async executeReevaluationJob(executing) {
+		const { job, startTime, stores, signal } = executing;
+		if (!this.featureFlags.documentDecisions) return {
+			job,
+			success: true,
+			operations: [],
+			operationsWithContext: [],
+			duration: Date.now() - startTime
+		};
+		const trigger = job.meta.triggerTimestampUtcMs;
+		if (typeof trigger === "string") {
+			let latestTimestamp;
+			try {
+				latestTimestamp = (await stores.operationStore.getRevisions(job.documentId, job.branch, signal)).latestTimestamp;
+			} catch {
+				return {
+					job,
+					success: true,
+					operations: [],
+					operationsWithContext: [],
+					duration: Date.now() - startTime
+				};
+			}
+			if (Date.parse(trigger) > Date.parse(latestTimestamp)) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
 		}
+		const outcome = await this.reevaluateDocument(executing);
+		if (outcome.error) return buildErrorResult(job, outcome.error, startTime);
+		return {
+			job,
+			success: true,
+			operations: outcome.operationsWithContext.map((owc) => owc.operation),
+			operationsWithContext: outcome.operationsWithContext,
+			duration: Date.now() - startTime
+		};
 	}
 	async executeLoadJob(executing) {
 		const { job, startTime, indexTxn, stores, signal } = executing;
@@ -4156,8 +4522,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
-async function up$15(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -4182,8 +4548,8 @@ async function up$15(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
-async function up$14(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -4199,14 +4565,14 @@ async function up$14(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -4218,14 +4584,14 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
+async function up$11(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -4246,8 +4612,8 @@ async function up$10(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
+async function up$10(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -4257,14 +4623,14 @@ async function up$9(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
-async function up$8(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
+async function up$9(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
-async function up$7(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$8 });
+async function up$8(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -4278,8 +4644,8 @@ async function up$7(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
-async function up$6(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$7 });
+async function up$7(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -4287,8 +4653,8 @@ async function up$6(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
-async function up$5(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$6 });
+async function up$6(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -4297,60 +4663,82 @@ async function up$5(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
-async function up$4(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$5 });
+async function up$5(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
-async function up$3(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$4 });
+async function up$4(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$2 });
-async function up$2(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$3 });
+async function up$3(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/015_add_operation_denied_reason.ts
 var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$2,
+	up: () => up$2
 });
 /**
 * Records why authorization refused an operation. Separate from `error` so a
 * denial is distinguishable from a reducer failure without matching on a
 * message. Null for every operation written before decisions were enforced.
 */
-async function up$1(db) {
+async function up$2(db) {
 	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
 	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
 }
-async function down$1(db) {
+async function down$2(db) {
 	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
 	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
 }
 //#endregion
 //#region src/storage/migrations/016_add_dead_letter_error_type.ts
 var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$1,
+	up: () => up$1
 });
 /**
 * The classification a dead letter falls into, stored because it decides whether
 * the document stays quarantined and the in-memory error is gone after a restart.
 * Defaulted rather than nullable, so a pre-existing row rehydrates.
 */
-async function up(db) {
+async function up$1(db) {
 	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
 }
-async function down(db) {
+async function down$1(db) {
 	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
 }
 //#endregion
+//#region src/storage/migrations/017_create_group_references.ts
+var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* One row per (document, group) reference ever discovered from an auth
+* operation's input. Rows are never updated or deleted: auth evaluation is
+* positional, so a grant that named a group at any position keeps that
+* group's stream in the document's read-set even after a later operation
+* removes the reference. Read by documentId for the groups a document
+* requires (sync), and by groupId for the documents a group change affects
+* (re-evaluation).
+*/
+async function up(db) {
+	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
+	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
+}
+async function down(db) {
+	await db.schema.dropTable("group_references").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -4369,7 +4757,8 @@ const migrations = {
 	"013_create_sync_dead_letters_table": _013_create_sync_dead_letters_table_exports,
 	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports,
 	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports,
-	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports
+	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports,
+	"017_create_group_references": _017_create_group_references_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -4425,4 +4814,4 @@ const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "pow
 //#endregion
 export { OptimisticLockError as A, ExcessiveReshuffleError as B, DocumentMetaCache as C, APPEND_CONDITION_FAILED_PREFIX as D, CollectionMembershipCache as E, ModuleNotFoundError as F, throwIfAborted as G, UpgradePreconditionFailedError as H, AuthTimestampNotMonotonicError as I, __exportAll as K, AuthorizationDeniedError as L, DuplicateManifestError as M, DuplicateModuleError as N, AppendConditionFailedError as O, InvalidModuleError as P, DocumentDeletedError as R, KyselyOperationIndex as S, createEmptyConsistencyToken as T, matchesScope as U, InvalidOperationTimestampError as V, parsePagingOptions as W, KyselyExecutionScope as _, createForwardingPoolInstrumentation as a, EventBus as b, KyselyKeyframeStore as c, DriveCollectionId as d, decideAtHead as f, authDecisionModel as g, buildDecisionModel as h, runMigrations as i, RevisionMismatchError as j, DuplicateOperationError as k, DocumentModelRegistry as l, documentDecisionModel as m, REACTOR_SCHEMA as n, instrumentPgPool as o, selectDecisionModel as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, FLAG_PREREQUISITES as v, createConsistencyToken as w, KyselyWriteCache as x, validateFeatureFlags as y, DocumentNotFoundError as z };
 
-//# sourceMappingURL=drive-container-types-CU1ZUfD1.js.map
+//# sourceMappingURL=drive-container-types-h3M1AK3K.js.map