@powerhousedao/reactor 6.2.2-dev.49 → 6.2.2-dev.50

package/dist/{drive-container-types-h3M1AK3K.js → drive-container-types-BoY5t12r.js}

@@ -219,93 +219,444 @@ var DocumentNotFoundError = class DocumentNotFoundError extends Error {
 	}
 };
 //#endregion
-//#region src/registry/errors.ts
+//#region src/decision/build-decision-model.ts
 /**
-* Error thrown when a document model module is not found in the registry.
+* Reads each projection's stream through the supplied reader, recording the
+* revision observed. Static projections resolve first; derived projections
+* see only those and contribute a map from document id to state. Each
+* distinct stream is read once and yields one append condition entry.
 */
-var ModuleNotFoundError = class extends Error {
-	documentType;
-	requestedVersion;
-	constructor(documentType, version) {
-		const versionSuffix = version !== void 0 ? ` version ${version}` : "";
-		super(`Document model module not found for type: ${documentType}${versionSuffix}`);
-		this.name = "ModuleNotFoundError";
-		this.documentType = documentType;
-		this.requestedVersion = version;
+async function buildDecisionModel(reader, definition, target, signal) {
+	const decisionModel = definition(target);
+	const projections = Object.entries(decisionModel.projections);
+	const reads = /* @__PURE__ */ new Map();
+	const model = {};
+	for (const [key, projection] of projections) {
+		if (typeof projection.query === "function") continue;
+		model[key] = (await readStream(reader, projection.query, reads, signal)).state;
 	}
-	static isError(error) {
-		return Error.isError(error) && error.name === "ModuleNotFoundError";
+	const staticModel = { ...model };
+	for (const [key, projection] of projections) {
+		if (typeof projection.query !== "function") continue;
+		const queries = projection.query(staticModel);
+		const value = {};
+		for (const query of queries) {
+			let read;
+			try {
+				read = await readStream(reader, query, reads, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) {
+					recordEmptyStream(query, reads);
+					continue;
+				}
+				throw error;
+			}
+			value[query.documentId] = read.state;
+		}
+		model[key] = value;
 	}
-};
+	return {
+		model,
+		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
+	};
+}
+/** Guards a stream that holds nothing yet: any operation appearing is growth. */
+function recordEmptyStream(query, reads) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	if (reads.has(key)) return;
+	reads.set(key, {
+		state: void 0,
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: -1
+		}
+	});
+}
+async function readStream(reader, query, reads, signal) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	const existing = reads.get(key);
+	if (existing) return existing;
+	const document = await reader.getState(query.documentId, query.scope, query.branch, void 0, signal);
+	const read = {
+		state: document.state[query.scope],
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: observedRevision(document, query.scope)
+		}
+	};
+	reads.set(key, read);
+	return read;
+}
 /**
-* Error thrown when attempting to register a module that already exists.
+* The highest operation index the document reflects for the scope, or -1 if
+* empty. `header.revision` is authoritative, not the rebuilt operation list.
 */
-var DuplicateModuleError = class extends Error {
-	constructor(documentType, version) {
-		const versionSuffix = version !== void 0 ? ` (version ${version})` : "";
-		super(`Document model module already registered for type: ${documentType}${versionSuffix}`);
-		this.name = "DuplicateModuleError";
-	}
-	static isError(error) {
-		return Error.isError(error) && error.name === "DuplicateModuleError";
+function observedRevision(document, scope) {
+	if (scope in document.header.revision) return document.header.revision[scope] - 1;
+	if (scope in document.operations) {
+		const operations = document.operations[scope];
+		if (operations.length > 0) return operations[operations.length - 1].index;
 	}
-};
+	if (!(scope in document.header.revision)) return -1;
+	return document.header.revision[scope] - 1;
+}
 /**
-* Error thrown when a module is invalid or malformed.
+* The projections whose queries depend on folded state. A positional walk
+* resolves their streams through `queryOverHistory`; a projection without one
+* contributes no streams to a walk.
 */
-var InvalidModuleError = class extends Error {
-	constructor(message) {
-		super(`Invalid document model module: ${message}`);
-		this.name = "InvalidModuleError";
+function derivedReadSet(definition) {
+	const projections = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query !== "function") continue;
+		projections.push({
+			name,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply,
+			queryOverHistory: projection.queryOverHistory
+		});
 	}
-};
+	return projections;
+}
 /**
-* Error thrown when attempting to register an upgrade manifest that already exists.
+* The streams a model reads whose queries are known before it is built. A
+* derived query needs the statically-queried projections first, so it is not
+* included here.
 */
-var DuplicateManifestError = class extends Error {
-	constructor(documentType) {
-		super(`Upgrade manifest already registered for type: ${documentType}`);
-		this.name = "DuplicateManifestError";
-	}
-	static isError(error) {
-		return Error.isError(error) && error.name === "DuplicateManifestError";
+function staticReadSet(definition) {
+	const streams = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query === "function") continue;
+		streams.push({
+			name,
+			query: projection.query,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply
+		});
 	}
-};
-/**
-* Error thrown when an upgrade manifest is not found.
-*/
-var ManifestNotFoundError = class extends Error {
-	constructor(documentType) {
-		super(`Upgrade manifest not found for type: ${documentType}`);
-		this.name = "ManifestNotFoundError";
+	return streams;
+}
+//#endregion
+//#region src/decision/auth-decision-model.ts
+function refusalReason(refusal) {
+	switch (refusal) {
+		case "version-unsupported": return AUTH_VERSION_UNSUPPORTED_REASON;
+		case "denied-by-grant": return AUTH_DENIED_BY_GRANT_REASON;
+		case "no-applicable-grant": return AUTH_NO_GRANT_REASON;
 	}
-};
+}
+function decideAuthModel(model, subject, request, groups, conditions) {
+	if (request.verb === "execute" && model.document.isDeleted) return {
+		decision: "deny",
+		reason: DOCUMENT_DELETED_REASON
+	};
+	const evaluation = evaluate(model.auth, subject, request, groups, conditions);
+	if (evaluation.decision === "allow") return { decision: "allow" };
+	return {
+		decision: "deny",
+		reason: refusalReason(evaluation.refusal)
+	};
+}
+function documentProjection(target) {
+	return {
+		decidingActions: ["DELETE_DOCUMENT"],
+		apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+			...document,
+			state: { ...document.state }
+		}, operation.action) : document,
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "document"
+		}
+	};
+}
+function authProjection(target) {
+	return {
+		decidingActions: [...AUTH_ACTION_TYPES],
+		apply: (document, operation) => applyAuthAction(document, operation.action),
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "auth"
+		}
+	};
+}
+/** This decision model uses both the document and the auth streams. */
+function authDecisionModel(target) {
+	return {
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target)
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return decideAuthModel(model, subject, request);
+		}
+	};
+}
 /**
-* Error thrown when a required upgrade transition is missing from the manifest.
+* Folds one group-stream operation with the registered group model's reducer.
+* A reactor without the module registered folds nothing, so the member list
+* stays as read and a missing reducer never widens access.
 */
-var MissingUpgradeTransitionError = class extends Error {
-	constructor(documentType, fromVersion, toVersion) {
-		super(`Missing upgrade transition for ${documentType}: v${fromVersion} to v${toVersion}`);
-		this.name = "MissingUpgradeTransitionError";
+function applyGroupOperation(registry, document, operation) {
+	let reducer;
+	try {
+		reducer = registry.getModule(groupDocumentType).reducer;
+	} catch {
+		return document;
 	}
-};
+	return reducer(document, operation.action);
+}
 /**
-* Error thrown when getUpgradeReducer is called with a non-single-step version increment.
+* Folds one evaluated-scope operation with the reducer registered for the
+* document's own type, at the document's stamped version. A reactor without
+* that module folds nothing, so conditions read the base state and an
+* unresolvable reducer never widens access.
 */
-var InvalidUpgradeStepError = class extends Error {
-	constructor(documentType, fromVersion, toVersion) {
-		super(`Invalid upgrade step for ${documentType}: must be single version increment, got v${fromVersion} to v${toVersion}`);
-		this.name = "InvalidUpgradeStepError";
+function applyModelOperation(registry, document, operation) {
+	let reducer;
+	try {
+		const version = normalizeDocumentModelVersion(document.state.document?.version);
+		reducer = registry.getModule(document.header.documentType, version).reducer;
+	} catch {
+		return document;
 	}
-};
-//#endregion
-//#region src/storage/interfaces.ts
+	return reducer(document, operation.action);
+}
 /**
-* Thrown when an operation with the same identity already exists in the store.
+* The auth model extended with a derived groups projection: the streams it
+* reads are the group documents the folded grant list names, so adding a
+* grant that names a new group pulls that group's stream into the read-set.
+* Group queries pin the main branch, because a group's member list lives on
+* its main branch no matter which branch the referencing document is on.
 */
-var DuplicateOperationError = class extends Error {
-	constructor(description) {
-		super(`Duplicate operation: ${description}`);
+function groupsProjection(registry) {
+	return {
+		decidingActions: [...groupMembershipActionTypes],
+		apply: (document, operation) => applyGroupOperation(registry, document, operation),
+		query: (model) => referencedGroupIds(model.auth?.grants ?? []).map((id) => ({
+			documentId: id,
+			branch: "main",
+			scope: "global"
+		})),
+		queryOverHistory: (reads) => {
+			const ids = [];
+			for (const read of reads) {
+				if (read.name !== "auth") continue;
+				for (const operation of read.operations) for (const id of mentionedGroupIds(operation.action)) if (!ids.includes(id)) ids.push(id);
+			}
+			return ids.map((id) => ({
+				documentId: id,
+				branch: "main",
+				scope: "global"
+			}));
+		}
+	};
+}
+function authGroupsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return decideAuthModel(model, subject, request, model.groups);
+		}
+	});
+}
+/**
+* The groups model with conditions live: decide hands the executing scope's
+* state and the action input through to the evaluator, so `where` clauses
+* and { match } principals apply. The model folds the evaluated scope during
+* a positional walk, so a condition reads the state as it stood at each
+* operation's position.
+*/
+function authConditionsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		foldEvaluatedScope: (document, operation) => applyModelOperation(registry, document, operation),
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request, ctx) {
+			return decideAuthModel(model, subject, request, model.groups, {
+				scopeState: ctx.scopeState,
+				actionInput: ctx.actionInput
+			});
+		}
+	});
+}
+//#endregion
+//#region src/decision/document-decision-model.ts
+/**
+* The simplest decision model: one projection over the document scope, which
+* rejects on a deleted document.
+*/
+function documentDecisionModel(target) {
+	return {
+		projections: { document: {
+			decidingActions: ["DELETE_DOCUMENT"],
+			apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+				...document,
+				state: { ...document.state }
+			}, operation.action) : document,
+			query: {
+				documentId: target.documentId,
+				branch: target.branch,
+				scope: "document"
+			}
+		} },
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return request.verb === "execute" && model.document.isDeleted ? {
+				decision: "deny",
+				reason: DOCUMENT_DELETED_REASON
+			} : { decision: "allow" };
+		}
+	};
+}
+//#endregion
+//#region src/decision/registered-model.ts
+/**
+* Builds the model at the stream heads and decides one request against it. The
+* append condition it returns is the read-set the store enforces at write time.
+*
+* With `conditions` supplied, the executing scope's state is read at the head
+* for `doc.<scope>.*` paths. That read carries no append-condition entry of
+* its own: the written stream's expected-revision check already refuses a
+* write whose scope grew between the read and the append.
+*/
+async function decideAtHead(model, cache, target, subject, request, signal, conditions) {
+	const built = await buildDecisionModel(cache, model, target, signal);
+	let scopeState;
+	if (conditions !== void 0) scopeState = (await cache.getState(target.documentId, request.scope, target.branch, void 0, signal)).state[request.scope];
+	return {
+		evaluation: model(target).decide(built.model, subject, request, {
+			scopeState,
+			actionInput: conditions?.actionInput
+		}),
+		appendCondition: built.appendCondition,
+		documentVersion: built.model.document.version,
+		deletedAtUtcIso: built.model.document.deletedAtUtcIso ?? null
+	};
+}
+/**
+* The model this reactor enforces. With `authEnforcement` off the auth scope is
+* absent from every append condition and no load walks it; with `authGroups`
+* on, the group documents the grant list names join the read-set and the
+* registry supplies the reducer that folds them.
+*/
+function selectDecisionModel(flags, registry) {
+	if (flags.authConditions) return authConditionsDecisionModel(registry);
+	if (flags.authGroups) return authGroupsDecisionModel(registry);
+	return flags.authEnforcement ? authDecisionModel : documentDecisionModel;
+}
+//#endregion
+//#region src/registry/errors.ts
+/**
+* Error thrown when a document model module is not found in the registry.
+*/
+var ModuleNotFoundError = class extends Error {
+	documentType;
+	requestedVersion;
+	constructor(documentType, version) {
+		const versionSuffix = version !== void 0 ? ` version ${version}` : "";
+		super(`Document model module not found for type: ${documentType}${versionSuffix}`);
+		this.name = "ModuleNotFoundError";
+		this.documentType = documentType;
+		this.requestedVersion = version;
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ModuleNotFoundError";
+	}
+};
+/**
+* Error thrown when attempting to register a module that already exists.
+*/
+var DuplicateModuleError = class extends Error {
+	constructor(documentType, version) {
+		const versionSuffix = version !== void 0 ? ` (version ${version})` : "";
+		super(`Document model module already registered for type: ${documentType}${versionSuffix}`);
+		this.name = "DuplicateModuleError";
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DuplicateModuleError";
+	}
+};
+/**
+* Error thrown when a module is invalid or malformed.
+*/
+var InvalidModuleError = class extends Error {
+	constructor(message) {
+		super(`Invalid document model module: ${message}`);
+		this.name = "InvalidModuleError";
+	}
+};
+/**
+* Error thrown when attempting to register an upgrade manifest that already exists.
+*/
+var DuplicateManifestError = class extends Error {
+	constructor(documentType) {
+		super(`Upgrade manifest already registered for type: ${documentType}`);
+		this.name = "DuplicateManifestError";
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DuplicateManifestError";
+	}
+};
+/**
+* Error thrown when an upgrade manifest is not found.
+*/
+var ManifestNotFoundError = class extends Error {
+	constructor(documentType) {
+		super(`Upgrade manifest not found for type: ${documentType}`);
+		this.name = "ManifestNotFoundError";
+	}
+};
+/**
+* Error thrown when a required upgrade transition is missing from the manifest.
+*/
+var MissingUpgradeTransitionError = class extends Error {
+	constructor(documentType, fromVersion, toVersion) {
+		super(`Missing upgrade transition for ${documentType}: v${fromVersion} to v${toVersion}`);
+		this.name = "MissingUpgradeTransitionError";
+	}
+};
+/**
+* Error thrown when getUpgradeReducer is called with a non-single-step version increment.
+*/
+var InvalidUpgradeStepError = class extends Error {
+	constructor(documentType, fromVersion, toVersion) {
+		super(`Invalid upgrade step for ${documentType}: must be single version increment, got v${fromVersion} to v${toVersion}`);
+		this.name = "InvalidUpgradeStepError";
+	}
+};
+//#endregion
+//#region src/storage/interfaces.ts
+/**
+* Thrown when an operation with the same identity already exists in the store.
+*/
+var DuplicateOperationError = class extends Error {
+	constructor(description) {
+		super(`Duplicate operation: ${description}`);
 		this.name = "DuplicateOperationError";
 	}
 };
@@ -1777,509 +2128,173 @@ var EventBus = class {
 	subscribe(type, subscriber) {
 		let list = this.eventTypeToSubscribers.get(type);
 		if (!list) {
-			list = [];
-			this.eventTypeToSubscribers.set(type, list);
-		}
-		list.push(subscriber);
-		let done = false;
-		return () => {
-			if (done) return;
-			done = true;
-			const arr = this.eventTypeToSubscribers.get(type);
-			if (!arr) return;
-			const idx = arr.indexOf(subscriber);
-			if (idx !== -1) arr.splice(idx, 1);
-			if (arr.length === 0) this.eventTypeToSubscribers.delete(type);
-		};
-	}
-	async emit(type, data) {
-		const list = this.eventTypeToSubscribers.get(type);
-		if (!list || list.length === 0) return;
-		const snapshot = list.slice();
-		const errors = [];
-		for (const fn of snapshot) try {
-			await Promise.resolve(fn(type, data));
-		} catch (err) {
-			errors.push(err);
-		}
-		if (errors.length > 0) throw new EventBusAggregateError(errors);
-	}
-};
-//#endregion
-//#region src/core/feature-flags.ts
-/**
-* Every flag this reactor knows, with the flags it requires. A stage adds its
-* flag here when it ships, so asking an older reactor for a later stage's flag
-* is an unrecognized name rather than a flag that quietly does nothing.
-*/
-const FLAG_PREREQUISITES = {
-	documentDecisions: [],
-	authEnforcement: ["documentDecisions"],
-	authGroups: ["authEnforcement"],
-	authConditions: ["authGroups"]
-};
-/**
-* Throws when the flags ask for enforcement the reactor cannot deliver. Either
-* failure would otherwise read as enforcement being on while the reactor
-* applies less than the caller asked for.
-*/
-function validateFeatureFlags(flags, prerequisites) {
-	const known = Object.keys(prerequisites);
-	const unrecognized = Object.keys(flags).filter((name) => !known.includes(name));
-	if (unrecognized.length > 0) throw new Error(`Unrecognized reactor feature flag: ${unrecognized.join(", ")}. This reactor knows: ${known.join(", ")}.`);
-	for (const name of known) {
-		if (flags[name] !== true) continue;
-		const missing = prerequisites[name].filter((required) => flags[required] !== true);
-		if (missing.length > 0) throw new Error(`Reactor feature flag ${name} requires ${missing.join(", ")}.`);
-	}
-}
-//#endregion
-//#region src/executor/execution-scope.ts
-var DefaultExecutionScope = class {
-	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
-		this.operationStore = operationStore;
-		this.operationIndex = operationIndex;
-		this.writeCache = writeCache;
-		this.documentMetaCache = documentMetaCache;
-		this.collectionMembershipCache = collectionMembershipCache;
-	}
-	async run(fn, signal) {
-		signal?.throwIfAborted();
-		return fn({
-			operationStore: this.operationStore,
-			operationIndex: this.operationIndex,
-			writeCache: this.writeCache,
-			documentMetaCache: this.documentMetaCache,
-			collectionMembershipCache: this.collectionMembershipCache
-		});
-	}
-};
-var KyselyExecutionScope = class {
-	constructor(db, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache) {
-		this.db = db;
-		this.operationStore = operationStore;
-		this.operationIndex = operationIndex;
-		this.keyframeStore = keyframeStore;
-		this.writeCache = writeCache;
-		this.documentMetaCache = documentMetaCache;
-		this.collectionMembershipCache = collectionMembershipCache;
-	}
-	async run(fn, signal) {
-		signal?.throwIfAborted();
-		return this.db.transaction().execute(async (trx) => {
-			const scopedOperationStore = this.operationStore.withTransaction(trx);
-			const scopedOperationIndex = this.operationIndex.withTransaction(trx);
-			const scopedKeyframeStore = this.keyframeStore.withTransaction(trx);
-			return fn({
-				operationStore: scopedOperationStore,
-				operationIndex: scopedOperationIndex,
-				writeCache: this.writeCache.withScopedStores(scopedOperationStore, scopedKeyframeStore),
-				documentMetaCache: this.documentMetaCache.withScopedStore(scopedOperationStore),
-				collectionMembershipCache: this.collectionMembershipCache.withScopedIndex(scopedOperationIndex)
-			});
-		});
-	}
-};
-//#endregion
-//#region src/utils/reshuffle.ts
-const STRICT_ORDER_ACTION_TYPES = new Set([
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP",
-	"ADD_FOLDER",
-	"UPDATE_FOLDER",
-	"REMOVE_FOLDER"
-]);
-/**
-* Reshuffles operations by timestamp, then applies deterministic tie-breaking.
-* Used for merging concurrent operations from different branches.
-*
-* For strict document-structure actions (e.g., CREATE_DOCUMENT/UPGRADE_DOCUMENT),
-* logical index (index - skip) is prioritized to preserve causal replay order.
-*
-* For other actions, action ID is prioritized to ensure a canonical cross-reactor order
-* for concurrent operations that may have diverged local indices due to prior reshuffles.
-* Logical index and operation ID are then used as deterministic tie-breakers.
-*
-* Example:
-* [0:0, 1:0, 2:0, A3:0, A4:0, A5:0] + [0:0, 1:0, 2:0, B3:0, B4:2, B5:0]
-* GC               => [0:0, 1:0, 2:0, A3:0, A4:0, A5:0] + [0:0, 1:0, B4:2, B5:0]
-* Split            => [0:0, 1:0] + [2:0, A3:0, A4:0, A5:0] + [B4:2, B5:0]
-* Reshuffle(6:4)   => [6:4, 7:0, 8:0, 9:0, 10:0, 11:0]
-* merge            => [0:0, 1:0, 6:4, 7:0, 8:0, 9:0, 10:0, 11:0]
-*/
-function reshuffleByTimestamp(startIndex, opsA, opsB) {
-	return [...opsA, ...opsB].sort((a, b) => {
-		const timestampDiff = new Date(a.timestampUtcMs).getTime() - new Date(b.timestampUtcMs).getTime();
-		if (timestampDiff !== 0) return timestampDiff;
-		const shouldPrioritizeLogicalIndex = STRICT_ORDER_ACTION_TYPES.has(a.action?.type ?? "") || STRICT_ORDER_ACTION_TYPES.has(b.action?.type ?? "");
-		const logicalIndexDiff = a.index - a.skip - (b.index - b.skip);
-		if (shouldPrioritizeLogicalIndex) {
-			if (logicalIndexDiff !== 0) return logicalIndexDiff;
-		}
-		const actionIdDiff = (a.action?.id ?? "").localeCompare(b.action?.id ?? "");
-		if (actionIdDiff !== 0) return actionIdDiff;
-		if (!shouldPrioritizeLogicalIndex && logicalIndexDiff !== 0) return logicalIndexDiff;
-		return a.id.localeCompare(b.id);
-	}).map((op, i) => ({
-		...op,
-		index: startIndex.index + i,
-		skip: i === 0 ? startIndex.skip : 0
-	}));
-}
-//#endregion
-//#region src/decision/auth-decision-model.ts
-function refusalReason(refusal) {
-	switch (refusal) {
-		case "version-unsupported": return AUTH_VERSION_UNSUPPORTED_REASON;
-		case "denied-by-grant": return AUTH_DENIED_BY_GRANT_REASON;
-		case "no-applicable-grant": return AUTH_NO_GRANT_REASON;
-	}
-}
-function decideAuthModel(model, subject, request, groups, conditions) {
-	if (request.verb === "execute" && model.document.isDeleted) return {
-		decision: "deny",
-		reason: DOCUMENT_DELETED_REASON
-	};
-	const evaluation = evaluate(model.auth, subject, request, groups, conditions);
-	if (evaluation.decision === "allow") return { decision: "allow" };
-	return {
-		decision: "deny",
-		reason: refusalReason(evaluation.refusal)
-	};
-}
-function documentProjection(target) {
-	return {
-		decidingActions: ["DELETE_DOCUMENT"],
-		apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
-			...document,
-			state: { ...document.state }
-		}, operation.action) : document,
-		query: {
-			documentId: target.documentId,
-			branch: target.branch,
-			scope: "document"
-		}
-	};
-}
-function authProjection(target) {
-	return {
-		decidingActions: [...AUTH_ACTION_TYPES],
-		apply: (document, operation) => applyAuthAction(document, operation.action),
-		query: {
-			documentId: target.documentId,
-			branch: target.branch,
-			scope: "auth"
-		}
-	};
-}
-/** This decision model uses both the document and the auth streams. */
-function authDecisionModel(target) {
-	return {
-		projections: {
-			document: documentProjection(target),
-			auth: authProjection(target)
-		},
-		evaluatesScope() {
-			return true;
-		},
-		decide(model, subject, request) {
-			return decideAuthModel(model, subject, request);
-		}
-	};
-}
-/**
-* Folds one group-stream operation with the registered group model's reducer.
-* A reactor without the module registered folds nothing, so the member list
-* stays as read and a missing reducer never widens access.
-*/
-function applyGroupOperation(registry, document, operation) {
-	let reducer;
-	try {
-		reducer = registry.getModule(groupDocumentType).reducer;
-	} catch {
-		return document;
-	}
-	return reducer(document, operation.action);
-}
-/**
-* Folds one evaluated-scope operation with the reducer registered for the
-* document's own type, at the document's stamped version. A reactor without
-* that module folds nothing, so conditions read the base state and an
-* unresolvable reducer never widens access.
-*/
-function applyModelOperation(registry, document, operation) {
-	let reducer;
-	try {
-		const version = normalizeDocumentModelVersion(document.state.document?.version);
-		reducer = registry.getModule(document.header.documentType, version).reducer;
-	} catch {
-		return document;
-	}
-	return reducer(document, operation.action);
-}
-/**
-* The auth model extended with a derived groups projection: the streams it
-* reads are the group documents the folded grant list names, so adding a
-* grant that names a new group pulls that group's stream into the read-set.
-* Group queries pin the main branch, because a group's member list lives on
-* its main branch no matter which branch the referencing document is on.
-*/
-function groupsProjection(registry) {
-	return {
-		decidingActions: [...groupMembershipActionTypes],
-		apply: (document, operation) => applyGroupOperation(registry, document, operation),
-		query: (model) => referencedGroupIds(model.auth?.grants ?? []).map((id) => ({
-			documentId: id,
-			branch: "main",
-			scope: "global"
-		})),
-		queryOverHistory: (reads) => {
-			const ids = [];
-			for (const read of reads) {
-				if (read.name !== "auth") continue;
-				for (const operation of read.operations) for (const id of mentionedGroupIds(operation.action)) if (!ids.includes(id)) ids.push(id);
-			}
-			return ids.map((id) => ({
-				documentId: id,
-				branch: "main",
-				scope: "global"
-			}));
-		}
-	};
-}
-function authGroupsDecisionModel(registry) {
-	return (target) => ({
-		projections: {
-			document: documentProjection(target),
-			auth: authProjection(target),
-			groups: groupsProjection(registry)
-		},
-		evaluatesScope() {
-			return true;
-		},
-		decide(model, subject, request) {
-			return decideAuthModel(model, subject, request, model.groups);
-		}
-	});
-}
-/**
-* The groups model with conditions live: decide hands the executing scope's
-* state and the action input through to the evaluator, so `where` clauses
-* and { match } principals apply. The model folds the evaluated scope during
-* a positional walk, so a condition reads the state as it stood at each
-* operation's position.
-*/
-function authConditionsDecisionModel(registry) {
-	return (target) => ({
-		projections: {
-			document: documentProjection(target),
-			auth: authProjection(target),
-			groups: groupsProjection(registry)
-		},
-		foldEvaluatedScope: (document, operation) => applyModelOperation(registry, document, operation),
-		evaluatesScope() {
-			return true;
-		},
-		decide(model, subject, request, ctx) {
-			return decideAuthModel(model, subject, request, model.groups, {
-				scopeState: ctx.scopeState,
-				actionInput: ctx.actionInput
-			});
-		}
-	});
-}
-//#endregion
-//#region src/decision/build-decision-model.ts
-/**
-* Reads each projection's stream through the write cache, recording the
-* revision observed. Static projections resolve first; derived projections
-* see only those and contribute a map from document id to state. Each
-* distinct stream is read once and yields one append condition entry.
-*/
-async function buildDecisionModel(cache, definition, target, signal) {
-	const decisionModel = definition(target);
-	const projections = Object.entries(decisionModel.projections);
-	const reads = /* @__PURE__ */ new Map();
-	const model = {};
-	for (const [key, projection] of projections) {
-		if (typeof projection.query === "function") continue;
-		model[key] = (await readStream(cache, projection.query, reads, signal)).state;
-	}
-	const staticModel = { ...model };
-	for (const [key, projection] of projections) {
-		if (typeof projection.query !== "function") continue;
-		const queries = projection.query(staticModel);
-		const value = {};
-		for (const query of queries) {
-			let read;
-			try {
-				read = await readStream(cache, query, reads, signal);
-			} catch (error) {
-				if (error instanceof DocumentNotFoundError) {
-					recordEmptyStream(query, reads);
-					continue;
-				}
-				throw error;
-			}
-			value[query.documentId] = read.state;
-		}
-		model[key] = value;
-	}
-	return {
-		model,
-		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
-	};
-}
-/** Guards a stream that holds nothing yet: any operation appearing is growth. */
-function recordEmptyStream(query, reads) {
-	const key = `${query.documentId}:${query.scope}:${query.branch}`;
-	if (reads.has(key)) return;
-	reads.set(key, {
-		state: void 0,
-		stream: {
-			documentId: query.documentId,
-			scope: query.scope,
-			branch: query.branch,
-			revision: -1
+			list = [];
+			this.eventTypeToSubscribers.set(type, list);
 		}
-	});
-}
-async function readStream(cache, query, reads, signal) {
-	const key = `${query.documentId}:${query.scope}:${query.branch}`;
-	const existing = reads.get(key);
-	if (existing) return existing;
-	const document = await cache.getState(query.documentId, query.scope, query.branch, void 0, signal);
-	const read = {
-		state: document.state[query.scope],
-		stream: {
-			documentId: query.documentId,
-			scope: query.scope,
-			branch: query.branch,
-			revision: observedRevision(document, query.scope)
+		list.push(subscriber);
+		let done = false;
+		return () => {
+			if (done) return;
+			done = true;
+			const arr = this.eventTypeToSubscribers.get(type);
+			if (!arr) return;
+			const idx = arr.indexOf(subscriber);
+			if (idx !== -1) arr.splice(idx, 1);
+			if (arr.length === 0) this.eventTypeToSubscribers.delete(type);
+		};
+	}
+	async emit(type, data) {
+		const list = this.eventTypeToSubscribers.get(type);
+		if (!list || list.length === 0) return;
+		const snapshot = list.slice();
+		const errors = [];
+		for (const fn of snapshot) try {
+			await Promise.resolve(fn(type, data));
+		} catch (err) {
+			errors.push(err);
 		}
-	};
-	reads.set(key, read);
-	return read;
-}
+		if (errors.length > 0) throw new EventBusAggregateError(errors);
+	}
+};
+//#endregion
+//#region src/core/feature-flags.ts
 /**
-* The highest operation index the document reflects for the scope, or -1 if
-* empty. `header.revision` is authoritative, not the rebuilt operation list.
+* Every flag this reactor knows, with the flags it requires. A stage adds its
+* flag here when it ships, so asking an older reactor for a later stage's flag
+* is an unrecognized name rather than a flag that quietly does nothing.
 */
-function observedRevision(document, scope) {
-	if (scope in document.header.revision) return document.header.revision[scope] - 1;
-	if (scope in document.operations) {
-		const operations = document.operations[scope];
-		if (operations.length > 0) return operations[operations.length - 1].index;
-	}
-	if (!(scope in document.header.revision)) return -1;
-	return document.header.revision[scope] - 1;
-}
+const FLAG_PREREQUISITES = {
+	documentDecisions: [],
+	authEnforcement: ["documentDecisions"],
+	authGroups: ["authEnforcement"],
+	authConditions: ["authGroups"]
+};
 /**
-* The projections whose queries depend on folded state. A positional walk
-* resolves their streams through `queryOverHistory`; a projection without one
-* contributes no streams to a walk.
+* The flags as plain booleans, with anything unset off, validated. Callers hold
+* a partial set, because that is what crosses to a pooled worker, and every
+* consumer needs the same resolution of it.
 */
-function derivedReadSet(definition) {
-	const projections = [];
-	for (const [name, projection] of Object.entries(definition.projections)) {
-		if (typeof projection.query !== "function") continue;
-		projections.push({
-			name,
-			decidingActions: projection.decidingActions,
-			apply: projection.apply,
-			queryOverHistory: projection.queryOverHistory
-		});
-	}
-	return projections;
+function resolveFeatureFlags(flags = {}) {
+	const resolved = {
+		documentDecisions: flags.documentDecisions ?? false,
+		authEnforcement: flags.authEnforcement ?? false,
+		authGroups: flags.authGroups ?? false,
+		authConditions: flags.authConditions ?? false
+	};
+	validateFeatureFlags(flags, FLAG_PREREQUISITES);
+	return resolved;
 }
 /**
-* The streams a model reads whose queries are known before it is built. A
-* derived query needs the statically-queried projections first, so it is not
-* included here.
+* Throws when the flags ask for enforcement the reactor cannot deliver. Either
+* failure would otherwise read as enforcement being on while the reactor
+* applies less than the caller asked for.
 */
-function staticReadSet(definition) {
-	const streams = [];
-	for (const [name, projection] of Object.entries(definition.projections)) {
-		if (typeof projection.query === "function") continue;
-		streams.push({
-			name,
-			query: projection.query,
-			decidingActions: projection.decidingActions,
-			apply: projection.apply
-		});
+function validateFeatureFlags(flags, prerequisites) {
+	const known = Object.keys(prerequisites);
+	const unrecognized = Object.keys(flags).filter((name) => !known.includes(name));
+	if (unrecognized.length > 0) throw new Error(`Unrecognized reactor feature flag: ${unrecognized.join(", ")}. This reactor knows: ${known.join(", ")}.`);
+	for (const name of known) {
+		if (flags[name] !== true) continue;
+		const missing = prerequisites[name].filter((required) => flags[required] !== true);
+		if (missing.length > 0) throw new Error(`Reactor feature flag ${name} requires ${missing.join(", ")}.`);
 	}
-	return streams;
 }
 //#endregion
-//#region src/decision/document-decision-model.ts
-/**
-* The simplest decision model: one projection over the document scope, which
-* rejects on a deleted document.
-*/
-function documentDecisionModel(target) {
-	return {
-		projections: { document: {
-			decidingActions: ["DELETE_DOCUMENT"],
-			apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
-				...document,
-				state: { ...document.state }
-			}, operation.action) : document,
-			query: {
-				documentId: target.documentId,
-				branch: target.branch,
-				scope: "document"
-			}
-		} },
-		evaluatesScope() {
-			return true;
-		},
-		decide(model) {
-			return model.document.isDeleted ? {
-				decision: "deny",
-				reason: DOCUMENT_DELETED_REASON
-			} : { decision: "allow" };
-		}
-	};
-}
+//#region src/executor/execution-scope.ts
+var DefaultExecutionScope = class {
+	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
+		this.operationStore = operationStore;
+		this.operationIndex = operationIndex;
+		this.writeCache = writeCache;
+		this.documentMetaCache = documentMetaCache;
+		this.collectionMembershipCache = collectionMembershipCache;
+	}
+	async run(fn, signal) {
+		signal?.throwIfAborted();
+		return fn({
+			operationStore: this.operationStore,
+			operationIndex: this.operationIndex,
+			writeCache: this.writeCache,
+			documentMetaCache: this.documentMetaCache,
+			collectionMembershipCache: this.collectionMembershipCache
+		});
+	}
+};
+var KyselyExecutionScope = class {
+	constructor(db, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache) {
+		this.db = db;
+		this.operationStore = operationStore;
+		this.operationIndex = operationIndex;
+		this.keyframeStore = keyframeStore;
+		this.writeCache = writeCache;
+		this.documentMetaCache = documentMetaCache;
+		this.collectionMembershipCache = collectionMembershipCache;
+	}
+	async run(fn, signal) {
+		signal?.throwIfAborted();
+		return this.db.transaction().execute(async (trx) => {
+			const scopedOperationStore = this.operationStore.withTransaction(trx);
+			const scopedOperationIndex = this.operationIndex.withTransaction(trx);
+			const scopedKeyframeStore = this.keyframeStore.withTransaction(trx);
+			return fn({
+				operationStore: scopedOperationStore,
+				operationIndex: scopedOperationIndex,
+				writeCache: this.writeCache.withScopedStores(scopedOperationStore, scopedKeyframeStore),
+				documentMetaCache: this.documentMetaCache.withScopedStore(scopedOperationStore),
+				collectionMembershipCache: this.collectionMembershipCache.withScopedIndex(scopedOperationIndex)
+			});
+		});
+	}
+};
 //#endregion
-//#region src/decision/registered-model.ts
+//#region src/utils/reshuffle.ts
+const STRICT_ORDER_ACTION_TYPES = new Set([
+	"CREATE_DOCUMENT",
+	"DELETE_DOCUMENT",
+	"UPGRADE_DOCUMENT",
+	"ADD_RELATIONSHIP",
+	"REMOVE_RELATIONSHIP",
+	"UPDATE_RELATIONSHIP",
+	"ADD_FOLDER",
+	"UPDATE_FOLDER",
+	"REMOVE_FOLDER"
+]);
 /**
-* Builds the model at the stream heads and decides one request against it. The
-* append condition it returns is the read-set the store enforces at write time.
+* Reshuffles operations by timestamp, then applies deterministic tie-breaking.
+* Used for merging concurrent operations from different branches.
 *
-* With `conditions` supplied, the executing scope's state is read at the head
-* for `doc.<scope>.*` paths. That read carries no append-condition entry of
-* its own: the written stream's expected-revision check already refuses a
-* write whose scope grew between the read and the append.
-*/
-async function decideAtHead(model, cache, target, subject, request, signal, conditions) {
-	const built = await buildDecisionModel(cache, model, target, signal);
-	let scopeState;
-	if (conditions !== void 0) scopeState = (await cache.getState(target.documentId, request.scope, target.branch, void 0, signal)).state[request.scope];
-	return {
-		evaluation: model(target).decide(built.model, subject, request, {
-			scopeState,
-			actionInput: conditions?.actionInput
-		}),
-		appendCondition: built.appendCondition,
-		documentVersion: built.model.document.version,
-		deletedAtUtcIso: built.model.document.deletedAtUtcIso ?? null
-	};
-}
-/**
-* The model this reactor enforces. With `authEnforcement` off the auth scope is
-* absent from every append condition and no load walks it; with `authGroups`
-* on, the group documents the grant list names join the read-set and the
-* registry supplies the reducer that folds them.
+* For strict document-structure actions (e.g., CREATE_DOCUMENT/UPGRADE_DOCUMENT),
+* logical index (index - skip) is prioritized to preserve causal replay order.
+*
+* For other actions, action ID is prioritized to ensure a canonical cross-reactor order
+* for concurrent operations that may have diverged local indices due to prior reshuffles.
+* Logical index and operation ID are then used as deterministic tie-breakers.
+*
+* Example:
+* [0:0, 1:0, 2:0, A3:0, A4:0, A5:0] + [0:0, 1:0, 2:0, B3:0, B4:2, B5:0]
+* GC               => [0:0, 1:0, 2:0, A3:0, A4:0, A5:0] + [0:0, 1:0, B4:2, B5:0]
+* Split            => [0:0, 1:0] + [2:0, A3:0, A4:0, A5:0] + [B4:2, B5:0]
+* Reshuffle(6:4)   => [6:4, 7:0, 8:0, 9:0, 10:0, 11:0]
+* merge            => [0:0, 1:0, 6:4, 7:0, 8:0, 9:0, 10:0, 11:0]
 */
-function selectDecisionModel(flags, registry) {
-	if (flags.authConditions) return authConditionsDecisionModel(registry);
-	if (flags.authGroups) return authGroupsDecisionModel(registry);
-	return flags.authEnforcement ? authDecisionModel : documentDecisionModel;
+function reshuffleByTimestamp(startIndex, opsA, opsB) {
+	return [...opsA, ...opsB].sort((a, b) => {
+		const timestampDiff = new Date(a.timestampUtcMs).getTime() - new Date(b.timestampUtcMs).getTime();
+		if (timestampDiff !== 0) return timestampDiff;
+		const shouldPrioritizeLogicalIndex = STRICT_ORDER_ACTION_TYPES.has(a.action?.type ?? "") || STRICT_ORDER_ACTION_TYPES.has(b.action?.type ?? "");
+		const logicalIndexDiff = a.index - a.skip - (b.index - b.skip);
+		if (shouldPrioritizeLogicalIndex) {
+			if (logicalIndexDiff !== 0) return logicalIndexDiff;
+		}
+		const actionIdDiff = (a.action?.id ?? "").localeCompare(b.action?.id ?? "");
+		if (actionIdDiff !== 0) return actionIdDiff;
+		if (!shouldPrioritizeLogicalIndex && logicalIndexDiff !== 0) return logicalIndexDiff;
+		return a.id.localeCompare(b.id);
+	}).map((op, i) => ({
+		...op,
+		index: startIndex.index + i,
+		skip: i === 0 ? startIndex.skip : 0
+	}));
 }
 //#endregion
 //#region src/decision/merged-order.ts
@@ -3122,13 +3137,7 @@ var SimpleJobExecutor = class {
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50
 		};
-		this.featureFlags = {
-			documentDecisions: config.featureFlags?.documentDecisions ?? false,
-			authEnforcement: config.featureFlags?.authEnforcement ?? false,
-			authGroups: config.featureFlags?.authGroups ?? false,
-			authConditions: config.featureFlags?.authConditions ?? false
-		};
-		validateFeatureFlags(this.featureFlags, FLAG_PREREQUISITES);
+		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
 		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
 		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
@@ -4812,6 +4821,6 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { OptimisticLockError as A, ExcessiveReshuffleError as B, DocumentMetaCache as C, APPEND_CONDITION_FAILED_PREFIX as D, CollectionMembershipCache as E, ModuleNotFoundError as F, throwIfAborted as G, UpgradePreconditionFailedError as H, AuthTimestampNotMonotonicError as I, __exportAll as K, AuthorizationDeniedError as L, DuplicateManifestError as M, DuplicateModuleError as N, AppendConditionFailedError as O, InvalidModuleError as P, DocumentDeletedError as R, KyselyOperationIndex as S, createEmptyConsistencyToken as T, matchesScope as U, InvalidOperationTimestampError as V, parsePagingOptions as W, KyselyExecutionScope as _, createForwardingPoolInstrumentation as a, EventBus as b, KyselyKeyframeStore as c, DriveCollectionId as d, decideAtHead as f, authDecisionModel as g, buildDecisionModel as h, runMigrations as i, RevisionMismatchError as j, DuplicateOperationError as k, DocumentModelRegistry as l, documentDecisionModel as m, REACTOR_SCHEMA as n, instrumentPgPool as o, selectDecisionModel as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, FLAG_PREREQUISITES as v, createConsistencyToken as w, KyselyWriteCache as x, validateFeatureFlags as y, DocumentNotFoundError as z };
+export { decideAtHead as A, InvalidOperationTimestampError as B, DuplicateOperationError as C, DuplicateModuleError as D, DuplicateManifestError as E, AuthTimestampNotMonotonicError as F, __exportAll as G, matchesScope as H, AuthorizationDeniedError as I, DocumentDeletedError as L, documentDecisionModel as M, authDecisionModel as N, InvalidModuleError as O, buildDecisionModel as P, DocumentNotFoundError as R, AppendConditionFailedError as S, RevisionMismatchError as T, parsePagingOptions as U, UpgradePreconditionFailedError as V, throwIfAborted as W, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, CollectionMembershipCache as b, KyselyKeyframeStore as c, DriveCollectionId as d, KyselyExecutionScope as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, selectDecisionModel as j, ModuleNotFoundError as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, instrumentPgPool as o, resolveFeatureFlags as p, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, SimpleJobExecutor as u, createConsistencyToken as v, OptimisticLockError as w, APPEND_CONDITION_FAILED_PREFIX as x, createEmptyConsistencyToken as y, ExcessiveReshuffleError as z };
 
-//# sourceMappingURL=drive-container-types-h3M1AK3K.js.map
+//# sourceMappingURL=drive-container-types-BoY5t12r.js.map