@powerhousedao/reactor 6.2.2-dev.49 → 6.2.2-dev.50

package/dist/index.d.ts

@@ -2065,157 +2065,6 @@ interface IReactorClient {
   subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
 }
 //#endregion
-//#region src/client/reactor-client.d.ts
-/**
- * ReactorClient implementation that wraps lower-level APIs to provide
- * a simpler interface for document operations.
- *
- * Features:
- * - Wraps Jobs with Promises for easier async handling
- * - Manages signing of submitted Action objects
- * - Provides quality-of-life functions for common tasks
- * - Wraps subscription interface with ViewFilters
- */
-declare class ReactorClient implements IReactorClient {
-  private logger;
-  private reactor;
-  private signer;
-  private subscriptionManager;
-  private jobAwaiter;
-  private documentIndexer;
-  private documentView;
-  readonly drives: IDriveClient;
-  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView);
-  private readSubject;
-  /**
-   * Retrieves a list of document model modules.
-   */
-  getDocumentModelModules(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
-  /**
-   * Retrieves a specific document model module by document type.
-   *
-   * @param documentType - The document type identifier
-   * @returns The document model module
-   */
-  getDocumentModelModule(documentType: string): Promise<DocumentModelModule<any>>;
-  /**
-   * Retrieves the document model module matching the version the document is
-   * stamped with, so not-yet-upgraded documents get the reducer their
-   * history was written with rather than the latest.
-   */
-  getDocumentModelModuleForDocument(document: PHDocument): Promise<DocumentModelModule<any>>;
-  /**
-   * Retrieves a specific PHDocument
-   */
-  get<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Resolves an identifier (id or slug) to the canonical document id, using the
-   * same lookup as the data path. Resolves against the "main" branch. Throws if
-   * the identifier cannot be resolved or is ambiguous.
-   */
-  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
-  /**
-   * Retrieves operations for a document
-   */
-  getOperations(documentIdentifier: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  private getOperationsWithCompositeCursor;
-  /**
-   * Retrieves outgoing relationships of a given type from a source document.
-   */
-  getOutgoingRelationships(sourceIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
-  /**
-   * Retrieves incoming relationships of a given type to a target document.
-   */
-  getIncomingRelationships(targetIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
-  /**
-   * Filters documents by criteria and returns a list of them
-   */
-  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
-  /**
-   * Creates a document and waits for completion
-   */
-  create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Creates an empty document and waits for completion
-   */
-  createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Upgrades a document to a newer document model version by dispatching an
-   * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
-   * latest registered module version for the document's type. Returns the
-   * document unchanged when it is already at the target version.
-   *
-   * The executor validates the action's version and revision snapshot against
-   * the state the migration actually runs on. When a concurrent edit
-   * invalidates the snapshot, the upgrade is rebuilt from a fresh read and
-   * retried up to maxConflictRetries times before the conflict is surfaced.
-   */
-  upgradeDocument<TDocument extends PHDocument = PHDocument>(documentIdentifier: string, toVersion?: number, options?: UpgradeDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Creates an empty document in a drive as a single batched operation.
-   * Delegates to {@link IDriveClient.addFile}.
-   *
-   * @deprecated Use `client.drives.addFile` instead. This method will be
-   * removed in a future release.
-   */
-  createDocumentInDrive<TDocument extends PHDocument>(driveId: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Applies a list of actions to a document and waits for completion
-   */
-  execute<TDocument extends PHDocument>(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<TDocument>;
-  /**
-   * Submits a list of actions to a document
-   */
-  executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
-  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
-  /**
-   * Renames a document and waits for completion
-   */
-  rename(documentIdentifier: string, name: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Updates the preferred editor recorded in the document header meta.
-   * Pass `null` to clear it.
-   */
-  setPreferredEditor(documentIdentifier: string, preferredEditor: string | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Adds multiple documents as children to another and waits for completion
-   */
-  addRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Removes a relationship between two documents and waits for completion.
-   */
-  removeRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Moves a relationship from one source document to another and waits for completion.
-   */
-  moveRelationship(sourceParentIdentifier: string, targetParentIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<{
-    source: PHDocument;
-    target: PHDocument;
-  }>;
-  loadBatch(request: BatchLoadRequest, signal?: AbortSignal): Promise<BatchLoadResult>;
-  /**
-   * Deletes a document and waits for completion
-   */
-  deleteDocument(identifier: string, propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
-  /**
-   * Deletes documents and waits for completion
-   */
-  deleteDocuments(identifiers: string[], propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
-  /**
-   * Retrieves the status of a job
-   */
-  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
-  /**
-   * Waits for a job to complete
-   */
-  waitForJob(jobId: string | JobInfo, signal?: AbortSignal): Promise<JobInfo>;
-  /**
-   * Subscribes to changes for documents matching specified filters
-   */
-  subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
-  private removeAllIncomingRelationships;
-}
-//#endregion
 //#region src/cache/collection-membership-cache.d.ts
 interface ICollectionMembershipCache {
   getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
@@ -3264,112 +3113,557 @@ type JobResult = {
   error?: Error; /** The operations generated from the actions (if successful) */
   operations?: Operation[];
   /**
-   * Operations with context (includes ephemeral resultingState).
-   * Used for emitting to IDocumentView via event bus.
+   * Operations with context (includes ephemeral resultingState).
+   * Used for emitting to IDocumentView via event bus.
+   */
+  operationsWithContext?: OperationWithContext$1[]; /** Timestamp when the job execution completed */
+  completedAt?: string; /** Duration of job execution in milliseconds */
+  duration?: number; /** Any additional metadata from the execution */
+  metadata?: Record<string, any>;
+};
+/**
+ * Enforcement the reactor performs, each off by default.
+ *
+ * An evaluation made while replaying is part of the document's history, so two
+ * reactors that share documents and disagree on these diverge. A flag is turned
+ * on for a set of reactors that sync with each other, not for one node.
+ */
+type ReactorFeatureFlags = {
+  /**
+   * Decide whether an operation may be admitted by building a decision model
+   * over the document stream, rather than reading the deleted flag from the
+   * document meta cache. Deletion then takes effect from the deleting
+   * operation's position rather than for the whole document.
+   */
+  documentDecisions: boolean;
+  /**
+   * Evaluate the auth policy by reading the auth scope as a second projection.
+   * Requires documentDecisions.
+   */
+  authEnforcement: boolean;
+  /**
+   * Match { group } principals by folding the referenced PHGroup documents as
+   * derived projections. Requires authEnforcement.
+   */
+  authGroups: boolean;
+  /**
+   * Evaluate `where` clauses and { match } principals against the executing
+   * scope's state, the subject, and the action input. Requires authGroups.
+   */
+  authConditions: boolean;
+};
+/**
+ * Configuration options for the job executor
+ */
+type JobExecutorConfig = {
+  /** Feature flags; anything unset is off. */featureFlags?: Partial<ReactorFeatureFlags>; /** Maximum number of conflicting operations to skip when reshuffling. */
+  maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
+  maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
+  jobTimeoutMs?: number; /** Base delay in milliseconds for exponential backoff retries */
+  retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
+  retryMaxDelayMs?: number;
+  /** Maximum elapsed milliseconds before yielding to the main thread between actions.
+   *  Keeps the UI responsive when processing large batches. */
+  yieldDeadlineMs?: number;
+};
+/**
+ * Event types for the job executor
+ */
+declare const JobExecutorEventTypes: {
+  readonly JOB_STARTED: 20000;
+  readonly JOB_COMPLETED: 20001;
+  readonly JOB_FAILED: 20002;
+  readonly EXECUTOR_STARTED: 20003;
+  readonly EXECUTOR_STOPPED: 20004;
+};
+/**
+ * Event data for job execution events
+ */
+type JobStartedEvent = {
+  job: Job;
+  startedAt: string;
+  /**
+   * Identifier of the executor that took the job. For the worker pool this is
+   * the thread-worker id (e.g. "reactor-worker-3"); for the in-process simple
+   * manager it is "in-process-<index>". Optional for backwards compatibility
+   * with consumers built before the field was added.
+   */
+  workerId?: string;
+};
+type JobCompletedEvent = {
+  job: Job;
+  result: JobResult; /** See {@link JobStartedEvent.workerId}. */
+  workerId?: string;
+};
+type JobFailedEvent = {
+  job: Job;
+  error: string;
+  willRetry: boolean;
+  retryCount: number; /** See {@link JobStartedEvent.workerId}. */
+  workerId?: string;
+};
+type ExecutorStartedEvent = {
+  config: JobExecutorConfig;
+  startedAt: string;
+};
+type ExecutorStoppedEvent = {
+  stoppedAt: string;
+  graceful: boolean;
+};
+/**
+ * Status information for the job executor manager
+ */
+type ExecutorManagerStatus = {
+  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
+  numExecutors: number; /** Number of jobs currently being processed */
+  activeJobs: number; /** Total number of jobs processed since start */
+  totalJobsProcessed: number;
+};
+//#endregion
+//#region src/decision/types.d.ts
+/** One operation stream. */
+type StreamQuery = {
+  documentId: string;
+  branch: string;
+  scope: string;
+};
+/**
+ * What building a decision model reads a stream's state through.
+ *
+ * `IWriteCache` satisfies this and is what the write paths pass. The read path
+ * cannot: the write cache is a write-side projection invalidated by the process
+ * that runs the executor, so a reactor whose executors live in worker processes
+ * holds state in its parent that no commit ever invalidates. A read there would
+ * decide against a policy arbitrarily far behind the one the write paths
+ * enforce. Reads therefore pass a reader backed by the read side.
+ */
+interface IStreamStateReader {
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+}
+/** The document and branch a decision model is built for. */
+type DecisionTarget = {
+  documentId: string;
+  branch: string;
+};
+/**
+ * What a decision's conditions may read beyond the projections: the executing
+ * scope's own state and the attempted action's input. Populated only while
+ * authConditions is on; otherwise both stay undefined and conditional grants
+ * never apply.
+ */
+type DecisionContext = {
+  scopeState: unknown;
+  actionInput?: unknown;
+};
+/** A statically-queried stream's operations, named after its projection. */
+type StreamHistory = {
+  name: string;
+  operations: Operation[];
+};
+/**
+ * A named stream whose value in the model is that scope's state from the
+ * document rebuild the reactor already performs. A derived query may read
+ * only statically-queried projections, so composition is one layer deep.
+ */
+type Projection<M> = {
+  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
+  /**
+   * For a derived projection, the streams it may read anywhere in an
+   * evaluated range, derived from the statically-queried streams' operations
+   * (including the operations under evaluation). A positional walk cannot use
+   * `query`, because the folded state it depends on changes over the range;
+   * this over-approximates by design, since a stream referenced at any
+   * position stays readable when the earlier range is re-evaluated even if a
+   * later operation removes the reference. Ignored on static projections.
+   */
+  queryOverHistory?: (reads: StreamHistory[]) => StreamQuery[];
+  /**
+   * Action types in this stream that can change an evaluation. Reads of the stream
+   * are filtered to these, so anything left out is invisible to a decision.
+   */
+  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
+  apply: (document: PHDocument, operation: Operation) => PHDocument;
+};
+/**
+ * The outcome of evaluating one operation. A refusal carries the reason it is
+ * recorded with, because a model has more than one way to refuse.
+ */
+type Evaluation = {
+  decision: "allow";
+} | {
+  decision: "deny";
+  reason: string;
+};
+/** Projections plus a decision function over the built model. */
+type DecisionModel<M> = {
+  projections: { [K in keyof M]: Projection<M> };
+  /**
+   * Present when decide reads the executing scope's state through the
+   * decision context. A positional walk then folds the evaluated stream with
+   * this, from its base state through every effective operation, so
+   * conditions read the state as it stood at each operation's position
+   * rather than at the head.
+   */
+  foldEvaluatedScope?: (document: PHDocument, operation: Operation) => PHDocument;
+  /**
+   * Whether or not this model decides about operations in a given scope. That
+   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
+   */
+  evaluatesScope(scope: string): boolean;
+  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
+};
+/** A built model plus the read-set condition recording what the build read. */
+type BuiltDecisionModel<M> = {
+  model: M;
+  appendCondition: AppendCondition;
+};
+//#endregion
+//#region src/decision/document-decision-model.d.ts
+/** What the document decision model reads: the target's document scope. */
+type DocumentDecisionModel = {
+  document: PHDocumentState;
+};
+/**
+ * The simplest decision model: one projection over the document scope, which
+ * rejects on a deleted document.
+ */
+declare function documentDecisionModel(target: DecisionTarget): DecisionModel<DocumentDecisionModel>;
+//#endregion
+//#region src/decision/registered-model.d.ts
+/**
+ * A model this reactor can register. Every one carries the document projection,
+ * because admission reads the version and the deletion timestamp off it; a model
+ * with more projections than that is still assignable here.
+ */
+type RegisteredDecisionModel = (target: DecisionTarget) => DecisionModel<DocumentDecisionModel>;
+/** What admission needs out of a model built at the stream heads. */
+type AdmissionDecision = {
+  evaluation: Evaluation;
+  appendCondition: AppendCondition;
+  documentVersion: number;
+  deletedAtUtcIso: string | null;
+};
+/**
+ * What decideAtHead resolves a condition context from: the action's input,
+ * with the executing scope's state read at the head. Supplied only while
+ * authConditions is on.
+ */
+type AdmissionConditions = {
+  actionInput?: unknown;
+};
+/**
+ * Builds the model at the stream heads and decides one request against it. The
+ * append condition it returns is the read-set the store enforces at write time.
+ *
+ * With `conditions` supplied, the executing scope's state is read at the head
+ * for `doc.<scope>.*` paths. That read carries no append-condition entry of
+ * its own: the written stream's expected-revision check already refuses a
+ * write whose scope grew between the read and the append.
+ */
+declare function decideAtHead(model: RegisteredDecisionModel, cache: IWriteCache, target: DecisionTarget, subject: AuthSubject, request: AuthRequest, signal?: AbortSignal, conditions?: AdmissionConditions): Promise<AdmissionDecision>;
+/**
+ * The model this reactor enforces. With `authEnforcement` off the auth scope is
+ * absent from every append condition and no load walks it; with `authGroups`
+ * on, the group documents the grant list names join the read-set and the
+ * registry supplies the reducer that folds them.
+ */
+declare function selectDecisionModel(flags: ReactorFeatureFlags, registry: IDocumentModelRegistry): RegisteredDecisionModel;
+//#endregion
+//#region src/decision/read-gate.d.ts
+/**
+ * Scopes every holder of a document may read, whatever the grants say. Denying
+ * the policy itself would let a replica sync a document without it, read the
+ * auth scope as uninitialized, and allow every operation it holds, so replicas
+ * would diverge permanently. The document scope carries the metadata the same
+ * argument covers. Grants gate domain-scope reads only.
+ */
+declare const ALWAYS_READABLE_SCOPES: ReadonlySet<string>;
+/** Whether a subject may read each scope of one document. */
+interface IReadGate {
+  /**
+   * Resolves, for one document, which of its scopes the subject may read.
+   *
+   * The predicate is resolved up front rather than asked per scope so that the
+   * filtering itself stays synchronous, and so that a model backing the answer
+   * is built once per document instead of once per scope.
+   */
+  scopePredicate(document: PHDocument, subject: AuthSubject, branch: string, signal?: AbortSignal): Promise<(scope: string) => boolean>;
+}
+/**
+ * The model reads enforce. Below `authEnforcement` there is no model to
+ * enforce: the document-only model ignores the auth scope entirely, so reading
+ * through it would serve every domain scope of a policied document to anyone.
+ * Undefined therefore means "evaluate the policy alone", which is what the read
+ * surface did before the model existed.
+ */
+declare function readDecisionModel(flags: ReactorFeatureFlags, registry: IDocumentModelRegistry): RegisteredDecisionModel | undefined;
+/**
+ * Evaluates the policy on its own, with no groups map and no condition context.
+ * A `{ group }` or conditional grant therefore never applies: an allow that
+ * does not apply withholds access, so this cannot widen a policy, but a policy
+ * relying on a conditional deny is weaker here than it is written.
+ */
+declare class BareReadGate implements IReadGate {
+  scopePredicate(document: PHDocument, subject: AuthSubject): Promise<(scope: string) => boolean>;
+}
+/**
+ * Evaluates a read against the registered decision model, built at the stream
+ * heads. This is what makes `{ group }` principals and conditional grants apply
+ * to a read: the model supplies the groups map and the scope's own state, the
+ * same two things admission supplies.
+ *
+ * A read has no action, so a condition on `action.input.*` never holds for one.
+ *
+ * State is read through the read side rather than the write cache. The write
+ * cache is invalidated by whichever process runs the executor, so a reactor
+ * running its executors in worker processes would answer reads in the parent
+ * from state no commit ever invalidates.
+ */
+declare class ModelReadGate implements IReadGate {
+  private readonly model;
+  private readonly documentView;
+  /**
+   * Whether a group a policy names is served to that policy's audience. Only
+   * meaningful with `authGroups`, which is what makes a `{ group }` grant
+   * match at all; below it the grant fails closed, so serving the roster
+   * would publish a member list no read grant can use.
+   */
+  private readonly servesGroups;
+  private readonly operationIndex?;
+  private readonly logger?;
+  constructor(model: RegisteredDecisionModel, documentView: IDocumentView,
+  /**
+   * Whether a group a policy names is served to that policy's audience. Only
+   * meaningful with `authGroups`, which is what makes a `{ group }` grant
+   * match at all; below it the grant fails closed, so serving the roster
+   * would publish a member list no read grant can use.
+   */
+
+  servesGroups: boolean, operationIndex?: IOperationIndex | undefined, logger?: ILogger | undefined);
+  /**
+   * A served group yields its member list and nothing else. What the audience
+   * is owed is the state it must fold to evaluate auth with the group; a
+   * group's other scopes are its own business and stay behind its own grants.
+   */
+  scopePredicate(document: PHDocument, subject: AuthSubject, branch: string, signal?: AbortSignal): Promise<(scope: string) => boolean>;
+  /**
+   * Whether the subject is served this group because a policy names it.
+   *
+   * A replica must fold a group's membership to evaluate auth with it, so a
+   * group a grant names is served to the audience of the document that names
+   * it, whatever the group's own read grants say. Naming a group in a policy
+   * publishes its roster to that policy's audience; a group whose membership
+   * must stay confidential does not belong in a grant.
+   *
+   * The referencing document's own domain scopes are the test. Its `auth` and
+   * `document` scopes are readable by every holder, so testing those would
+   * serve every referenced group to everybody.
+   *
+   * One level only. A referencer that is itself a group is skipped, and a
+   * referencer's own readability is decided from its policy alone, so a
+   * reference cycle terminates. Cycles are reachable: the reference relation
+   * is recorded from an operation's input, including one later stored denied,
+   * so a refused grant naming a group from inside another group leaves a row
+   * behind that validation never saw.
+   *
+   * The referencers are probed a few at a time and the walk stops at the first
+   * that serves, because a subject outside the audience is the case that runs to
+   * the bound, and it is the common one. A probe that failed decides only when
+   * nothing served: serving rests on a real allow, so this cannot widen, and it
+   * stops one unreachable referencer from turning an allow already in hand into
+   * a denial. A read records no operation, so replicas differing over a
+   * transient failure has no consensus consequence.
+   *
+   * The probes are awaited together rather than raced, so none is ever left
+   * running with nobody awaiting it, which is where unhandled rejections come
+   * from.
+   */
+  private servesGroupTo;
+  /**
+   * Whether one referencing document serves the subject any domain scope. A
+   * referencer this replica does not hold serves nothing, which fails closed
+   * the same way a group it does not hold does.
+   */
+  private servesThrough;
+  private servesGroup;
+  /**
+   * What this document's own policy says, with no group serving applied.
+   *
+   * An unpoliced document is readable in full, which is the common case and the
+   * one worth answering without building anything. The test is the one
+   * `evaluate` makes: a legacy `{}` auth scope and version 0 both mean
+   * uninitialized, and "no grants" does not, because a policy with a version and
+   * an empty grant list denies everything.
+   */
+  private ownPolicyPredicate;
+}
+//#endregion
+//#region src/client/reactor-client.d.ts
+/**
+ * ReactorClient implementation that wraps lower-level APIs to provide
+ * a simpler interface for document operations.
+ *
+ * Features:
+ * - Wraps Jobs with Promises for easier async handling
+ * - Manages signing of submitted Action objects
+ * - Provides quality-of-life functions for common tasks
+ * - Wraps subscription interface with ViewFilters
+ */
+declare class ReactorClient implements IReactorClient {
+  private logger;
+  private reactor;
+  private signer;
+  private subscriptionManager;
+  private jobAwaiter;
+  private documentIndexer;
+  private documentView;
+  private readGate;
+  readonly drives: IDriveClient;
+  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView, readGate?: IReadGate);
+  private readSubject;
+  /**
+   * Which scopes of one document the subject may read. Resolved once per
+   * document, so the gate builds its model once however many scopes are then
+   * tested, and the filtering itself stays synchronous.
+   */
+  private readableScopes;
+  /**
+   * One document, filtered to the scopes the subject may read. Every method
+   * that hands a document back goes through here, including the ones that
+   * follow a write: a document returned from a mutation is a read like any
+   * other, and returning it whole served scopes the same subject would be
+   * refused by `get`. Its author still sees what it wrote, because an allow on
+   * execute confers read of that scope.
+   */
+  private gateDocument;
+  /**
+   * Retrieves a list of document model modules.
+   */
+  getDocumentModelModules(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
+  /**
+   * Retrieves a specific document model module by document type.
+   *
+   * @param documentType - The document type identifier
+   * @returns The document model module
+   */
+  getDocumentModelModule(documentType: string): Promise<DocumentModelModule<any>>;
+  /**
+   * Retrieves the document model module matching the version the document is
+   * stamped with, so not-yet-upgraded documents get the reducer their
+   * history was written with rather than the latest.
+   */
+  getDocumentModelModuleForDocument(document: PHDocument): Promise<DocumentModelModule<any>>;
+  /**
+   * Retrieves a specific PHDocument
+   */
+  get<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Resolves an identifier (id or slug) to the canonical document id, using the
+   * same lookup as the data path. Resolves against the "main" branch. Throws if
+   * the identifier cannot be resolved or is ambiguous.
+   */
+  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
+  /**
+   * Retrieves operations for a document
+   */
+  getOperations(documentIdentifier: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  private getOperationsWithCompositeCursor;
+  /**
+   * Retrieves outgoing relationships of a given type from a source document.
+   */
+  getOutgoingRelationships(sourceIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Retrieves incoming relationships of a given type to a target document.
+   */
+  getIncomingRelationships(targetIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Filters documents by criteria and returns a list of them
+   */
+  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Creates a document and waits for completion
+   */
+  create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Creates an empty document and waits for completion
+   */
+  createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Upgrades a document to a newer document model version by dispatching an
+   * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
+   * latest registered module version for the document's type. Returns the
+   * document unchanged when it is already at the target version.
+   *
+   * The executor validates the action's version and revision snapshot against
+   * the state the migration actually runs on. When a concurrent edit
+   * invalidates the snapshot, the upgrade is rebuilt from a fresh read and
+   * retried up to maxConflictRetries times before the conflict is surfaced.
+   */
+  upgradeDocument<TDocument extends PHDocument = PHDocument>(documentIdentifier: string, toVersion?: number, options?: UpgradeDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Creates an empty document in a drive as a single batched operation.
+   * Delegates to {@link IDriveClient.addFile}.
+   *
+   * @deprecated Use `client.drives.addFile` instead. This method will be
+   * removed in a future release.
+   */
+  createDocumentInDrive<TDocument extends PHDocument>(driveId: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Applies a list of actions to a document and waits for completion
+   */
+  execute<TDocument extends PHDocument>(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Submits a list of actions to a document
+   */
+  executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
+  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
+  /**
+   * Renames a document and waits for completion
+   */
+  rename(documentIdentifier: string, name: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Updates the preferred editor recorded in the document header meta.
+   * Pass `null` to clear it.
+   */
+  setPreferredEditor(documentIdentifier: string, preferredEditor: string | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Adds multiple documents as children to another and waits for completion
+   */
+  addRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Removes a relationship between two documents and waits for completion.
+   */
+  removeRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Moves a relationship from one source document to another and waits for completion.
    */
-  operationsWithContext?: OperationWithContext$1[]; /** Timestamp when the job execution completed */
-  completedAt?: string; /** Duration of job execution in milliseconds */
-  duration?: number; /** Any additional metadata from the execution */
-  metadata?: Record<string, any>;
-};
-/**
- * Enforcement the reactor performs, each off by default.
- *
- * An evaluation made while replaying is part of the document's history, so two
- * reactors that share documents and disagree on these diverge. A flag is turned
- * on for a set of reactors that sync with each other, not for one node.
- */
-type ReactorFeatureFlags = {
+  moveRelationship(sourceParentIdentifier: string, targetParentIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<{
+    source: PHDocument;
+    target: PHDocument;
+  }>;
+  loadBatch(request: BatchLoadRequest, signal?: AbortSignal): Promise<BatchLoadResult>;
   /**
-   * Decide whether an operation may be admitted by building a decision model
-   * over the document stream, rather than reading the deleted flag from the
-   * document meta cache. Deletion then takes effect from the deleting
-   * operation's position rather than for the whole document.
+   * Deletes a document and waits for completion
    */
-  documentDecisions: boolean;
+  deleteDocument(identifier: string, propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
   /**
-   * Evaluate the auth policy by reading the auth scope as a second projection.
-   * Requires documentDecisions.
+   * Deletes documents and waits for completion
    */
-  authEnforcement: boolean;
+  deleteDocuments(identifiers: string[], propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
   /**
-   * Match { group } principals by folding the referenced PHGroup documents as
-   * derived projections. Requires authEnforcement.
+   * Retrieves the status of a job
    */
-  authGroups: boolean;
+  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
   /**
-   * Evaluate `where` clauses and { match } principals against the executing
-   * scope's state, the subject, and the action input. Requires authGroups.
+   * Waits for a job to complete
    */
-  authConditions: boolean;
-};
-/**
- * Configuration options for the job executor
- */
-type JobExecutorConfig = {
-  /** Feature flags; anything unset is off. */featureFlags?: Partial<ReactorFeatureFlags>; /** Maximum number of conflicting operations to skip when reshuffling. */
-  maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
-  maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
-  jobTimeoutMs?: number; /** Base delay in milliseconds for exponential backoff retries */
-  retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
-  retryMaxDelayMs?: number;
-  /** Maximum elapsed milliseconds before yielding to the main thread between actions.
-   *  Keeps the UI responsive when processing large batches. */
-  yieldDeadlineMs?: number;
-};
-/**
- * Event types for the job executor
- */
-declare const JobExecutorEventTypes: {
-  readonly JOB_STARTED: 20000;
-  readonly JOB_COMPLETED: 20001;
-  readonly JOB_FAILED: 20002;
-  readonly EXECUTOR_STARTED: 20003;
-  readonly EXECUTOR_STOPPED: 20004;
-};
-/**
- * Event data for job execution events
- */
-type JobStartedEvent = {
-  job: Job;
-  startedAt: string;
+  waitForJob(jobId: string | JobInfo, signal?: AbortSignal): Promise<JobInfo>;
   /**
-   * Identifier of the executor that took the job. For the worker pool this is
-   * the thread-worker id (e.g. "reactor-worker-3"); for the in-process simple
-   * manager it is "in-process-<index>". Optional for backwards compatibility
-   * with consumers built before the field was added.
+   * Subscribes to changes for documents matching specified filters
    */
-  workerId?: string;
-};
-type JobCompletedEvent = {
-  job: Job;
-  result: JobResult; /** See {@link JobStartedEvent.workerId}. */
-  workerId?: string;
-};
-type JobFailedEvent = {
-  job: Job;
-  error: string;
-  willRetry: boolean;
-  retryCount: number; /** See {@link JobStartedEvent.workerId}. */
-  workerId?: string;
-};
-type ExecutorStartedEvent = {
-  config: JobExecutorConfig;
-  startedAt: string;
-};
-type ExecutorStoppedEvent = {
-  stoppedAt: string;
-  graceful: boolean;
-};
-/**
- * Status information for the job executor manager
- */
-type ExecutorManagerStatus = {
-  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
-  numExecutors: number; /** Number of jobs currently being processed */
-  activeJobs: number; /** Total number of jobs processed since start */
-  totalJobsProcessed: number;
-};
+  subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
+  private removeAllIncomingRelationships;
+}
 //#endregion
 //#region src/executor/interfaces.d.ts
 /**
@@ -4437,6 +4731,12 @@ interface ReactorModule {
  * integration scenarios.
  */
 interface InProcessReactorModule extends ReactorModule {
+  /**
+   * The enforcement flags this reactor resolved, as plain booleans. Held on the
+   * module because they select what a read enforces as well as what a write
+   * does, and the read surface is composed outside the reactor.
+   */
+  featureFlags: ReactorFeatureFlags;
   queue: IQueue;
   jobTracker: IJobTracker;
   executorManager: IJobExecutorManager;
@@ -5053,6 +5353,7 @@ declare class ReactorClientBuilder {
   private subscriptionManager?;
   private jobAwaiter?;
   private documentModelLoader?;
+  private readGate?;
   /**
    * Sets the logger for the ReactorClient.
    * @param logger - The logger to use.
@@ -5076,6 +5377,22 @@ declare class ReactorClientBuilder {
   withSubscriptionManager(subscriptionManager: IReactorSubscriptionManager): this;
   withJobAwaiter(jobAwaiter: IJobAwaiter): this;
   withDocumentModelLoader(loader: IDocumentModelLoader): this;
+  /**
+   * Overrides how reads are gated. A client built from a ReactorBuilder derives
+   * this from that reactor's flags; one built from `withReactor` cannot, because
+   * it is handed no flags and no registry, so it gates on the policy alone
+   * unless a gate is supplied here.
+   */
+  withReadGate(readGate: IReadGate): this;
+  /**
+   * The gate this reactor's flags call for. Below authEnforcement there is no
+   * model to enforce -- the registered one ignores the auth scope -- so the
+   * policy is evaluated on its own, which is what reads did before the model
+   * existed. Group serving turns on with authGroups, because below it a
+   * `{ group }` grant does not match, so a served roster is one no grant can
+   * use.
+   */
+  private resolveReadGate;
   build(): Promise<ReactorClient>;
   buildModule(): Promise<InProcessReactorClientModule>;
 }
@@ -5555,99 +5872,14 @@ declare class DocumentModelRegistry implements IDocumentModelRegistry {
   getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
 }
 //#endregion
-//#region src/decision/types.d.ts
-/** One operation stream. */
-type StreamQuery = {
-  documentId: string;
-  branch: string;
-  scope: string;
-};
-/** The document and branch a decision model is built for. */
-type DecisionTarget = {
-  documentId: string;
-  branch: string;
-};
-/**
- * What a decision's conditions may read beyond the projections: the executing
- * scope's own state and the attempted action's input. Populated only while
- * authConditions is on; otherwise both stay undefined and conditional grants
- * never apply.
- */
-type DecisionContext = {
-  scopeState: unknown;
-  actionInput?: unknown;
-};
-/** A statically-queried stream's operations, named after its projection. */
-type StreamHistory = {
-  name: string;
-  operations: Operation[];
-};
-/**
- * A named stream whose value in the model is that scope's state from the
- * document rebuild the reactor already performs. A derived query may read
- * only statically-queried projections, so composition is one layer deep.
- */
-type Projection<M> = {
-  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
-  /**
-   * For a derived projection, the streams it may read anywhere in an
-   * evaluated range, derived from the statically-queried streams' operations
-   * (including the operations under evaluation). A positional walk cannot use
-   * `query`, because the folded state it depends on changes over the range;
-   * this over-approximates by design, since a stream referenced at any
-   * position stays readable when the earlier range is re-evaluated even if a
-   * later operation removes the reference. Ignored on static projections.
-   */
-  queryOverHistory?: (reads: StreamHistory[]) => StreamQuery[];
-  /**
-   * Action types in this stream that can change an evaluation. Reads of the stream
-   * are filtered to these, so anything left out is invisible to a decision.
-   */
-  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
-  apply: (document: PHDocument, operation: Operation) => PHDocument;
-};
-/**
- * The outcome of evaluating one operation. A refusal carries the reason it is
- * recorded with, because a model has more than one way to refuse.
- */
-type Evaluation = {
-  decision: "allow";
-} | {
-  decision: "deny";
-  reason: string;
-};
-/** Projections plus a decision function over the built model. */
-type DecisionModel<M> = {
-  projections: { [K in keyof M]: Projection<M> };
-  /**
-   * Present when decide reads the executing scope's state through the
-   * decision context. A positional walk then folds the evaluated stream with
-   * this, from its base state through every effective operation, so
-   * conditions read the state as it stood at each operation's position
-   * rather than at the head.
-   */
-  foldEvaluatedScope?: (document: PHDocument, operation: Operation) => PHDocument;
-  /**
-   * Whether or not this model decides about operations in a given scope. That
-   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
-   */
-  evaluatesScope(scope: string): boolean;
-  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
-};
-/** A built model plus the read-set condition recording what the build read. */
-type BuiltDecisionModel<M> = {
-  model: M;
-  appendCondition: AppendCondition;
-};
-//#endregion
 //#region src/decision/build-decision-model.d.ts
 /**
- * Reads each projection's stream through the write cache, recording the
+ * Reads each projection's stream through the supplied reader, recording the
  * revision observed. Static projections resolve first; derived projections
  * see only those and contribute a map from document id to state. Each
  * distinct stream is read once and yields one append condition entry.
  */
-declare function buildDecisionModel<M>(cache: IWriteCache, definition: (target: DecisionTarget) => DecisionModel<M>, target: DecisionTarget, signal?: AbortSignal): Promise<BuiltDecisionModel<M>>;
+declare function buildDecisionModel<M>(reader: IStreamStateReader, definition: (target: DecisionTarget) => DecisionModel<M>, target: DecisionTarget, signal?: AbortSignal): Promise<BuiltDecisionModel<M>>;
 //#endregion
 //#region src/decision/auth-decision-model.d.ts
 type AuthDecisionModel = {
@@ -5657,57 +5889,6 @@ type AuthDecisionModel = {
 /** This decision model uses both the document and the auth streams. */
 declare function authDecisionModel(target: DecisionTarget): DecisionModel<AuthDecisionModel>;
 //#endregion
-//#region src/decision/document-decision-model.d.ts
-/** What the document decision model reads: the target's document scope. */
-type DocumentDecisionModel = {
-  document: PHDocumentState;
-};
-/**
- * The simplest decision model: one projection over the document scope, which
- * rejects on a deleted document.
- */
-declare function documentDecisionModel(target: DecisionTarget): DecisionModel<DocumentDecisionModel>;
-//#endregion
-//#region src/decision/registered-model.d.ts
-/**
- * A model this reactor can register. Every one carries the document projection,
- * because admission reads the version and the deletion timestamp off it; a model
- * with more projections than that is still assignable here.
- */
-type RegisteredDecisionModel = (target: DecisionTarget) => DecisionModel<DocumentDecisionModel>;
-/** What admission needs out of a model built at the stream heads. */
-type AdmissionDecision = {
-  evaluation: Evaluation;
-  appendCondition: AppendCondition;
-  documentVersion: number;
-  deletedAtUtcIso: string | null;
-};
-/**
- * What decideAtHead resolves a condition context from: the action's input,
- * with the executing scope's state read at the head. Supplied only while
- * authConditions is on.
- */
-type AdmissionConditions = {
-  actionInput?: unknown;
-};
-/**
- * Builds the model at the stream heads and decides one request against it. The
- * append condition it returns is the read-set the store enforces at write time.
- *
- * With `conditions` supplied, the executing scope's state is read at the head
- * for `doc.<scope>.*` paths. That read carries no append-condition entry of
- * its own: the written stream's expected-revision check already refuses a
- * write whose scope grew between the read and the append.
- */
-declare function decideAtHead(model: RegisteredDecisionModel, cache: IWriteCache, target: DecisionTarget, subject: AuthSubject, request: AuthRequest, signal?: AbortSignal, conditions?: AdmissionConditions): Promise<AdmissionDecision>;
-/**
- * The model this reactor enforces. With `authEnforcement` off the auth scope is
- * absent from every append condition and no load walks it; with `authGroups`
- * on, the group documents the grant list names join the read-set and the
- * registry supplies the reducer that folds them.
- */
-declare function selectDecisionModel(flags: ReactorFeatureFlags, registry: IDocumentModelRegistry): RegisteredDecisionModel;
-//#endregion
 //#region src/decision/stream-order.d.ts
 /** Where a stream's stored order contradicts its timestamps. */
 type OutOfOrderPair = {
@@ -6342,5 +6523,5 @@ declare class ProcessorManager extends BaseReadModel implements IProcessorManage
   private deleteProcessorCursors;
 }
 //#endregion
-export { APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type AdmissionDecision, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type AdmissionDecision, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, BareReadGate, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModelReadGate, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 //# sourceMappingURL=index.d.ts.map