@powerhousedao/reactor 6.2.2-dev.5 → 6.2.2-dev.51

package/dist/index.js

@@ -1,10 +1,10 @@
-import { A as parsePagingOptions, C as DuplicateManifestError, D as DocumentDeletedError, E as ModuleNotFoundError, O as DocumentNotFoundError, S as CollectionMembershipCache, T as InvalidModuleError, _ as KyselyWriteCache, a as createForwardingPoolInstrumentation, b as createConsistencyToken, c as DuplicateOperationError, d as KyselyKeyframeStore, f as DocumentModelRegistry, g as EventBus, h as KyselyExecutionScope, i as runMigrations, j as throwIfAborted, k as matchesScope, l as OptimisticLockError, m as DriveCollectionId, n as REACTOR_SCHEMA, o as instrumentPgPool, p as SimpleJobExecutor, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as RevisionMismatchError, v as KyselyOperationIndex, w as DuplicateModuleError, x as createEmptyConsistencyToken, y as DocumentMetaCache } from "./drive-container-types-DpJp2AmE.js";
+import { A as createEmptyConsistencyToken, B as DocumentDeletedError, C as RevisionMismatchError, D as ModuleNotFoundError, E as InvalidModuleError, F as authDecisionModel, G as matchesScope, H as ExcessiveReshuffleError, I as buildDecisionModel, K as parsePagingOptions, L as AuthEnforcementDisabledError, M as decideAtHead, N as selectDecisionModel, O as GATED_DOCUMENT_ACTIONS, P as documentDecisionModel, R as AuthTimestampNotMonotonicError, S as OptimisticLockError, T as DuplicateModuleError, U as InvalidOperationTimestampError, V as DocumentNotFoundError, W as UpgradePreconditionFailedError, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as AppendConditionFailedError, c as KyselyKeyframeStore, d as DriveCollectionId, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as targetDocumentId, k as createConsistencyToken, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as resolveFeatureFlags, q as throwIfAborted, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache, w as DuplicateManifestError, x as DuplicateOperationError, y as APPEND_CONDITION_FAILED_PREFIX, z as AuthorizationDeniedError } from "./drive-container-types-RZa1wukO.js";
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
-import { a as ReadModelCoordinator, i as KyselyDocumentView, n as ConsistencyTracker, o as BaseReadModel, r as makeConsistencyKey, t as KyselyDocumentIndexer } from "./document-indexer-FGJmRAdX.js";
+import { a as ReadModelCoordinator, i as KyselyDocumentView, n as ConsistencyTracker, o as BaseReadModel, r as makeConsistencyKey, t as KyselyDocumentIndexer } from "./document-indexer-DlpJB8AK.js";
 import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-DBJOv8Gp.js";
-import { actions, actions as documentActions, createPresignedHeader, generateId, hashDocumentStateForScope, replayDocument } from "@powerhousedao/shared/document-model";
+import { t as workerEntryPath } from "./worker-sw2vjrd3.js";
+import { DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actions, actions as documentActions, createPresignedHeader, decide, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, sortOperations } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -190,10 +190,12 @@ function topologicalSort(jobs) {
 */
 function toErrorInfo$1(error) {
 	if (error instanceof Error) return {
+		name: error.name,
 		message: error.message,
 		stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 	};
 	return {
+		name: "Error",
 		message: error,
 		stack: (/* @__PURE__ */ new Error()).stack || ""
 	};
@@ -363,7 +365,7 @@ var DriveClient = class {
 				documentId: document.header.id,
 				model: document.header.documentType,
 				fromVersion: 0,
-				toVersion: 1,
+				toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 				initialState: document.state
 			}),
 			addRelationshipAction(driveIdentifier, documentId, "child")
@@ -391,7 +393,7 @@ var DriveClient = class {
 		}] }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
 		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
-		return this.reactor.get(documentId);
+		return this.client.get(documentId, void 0, signal);
 	}
 	async addFolder(driveIdentifier, name, parentFolder, signal) {
 		this.logger.verbose("drives.addFolder(@driveIdentifier, @name, @parentFolder)", driveIdentifier, name, parentFolder);
@@ -400,7 +402,7 @@ var DriveClient = class {
 			id: folderId,
 			name,
 			parentFolder
-		})], signal)).state.global.nodes.find((n) => n.id === folderId);
+		})], signal)).state.global?.nodes.find((n) => n.id === folderId);
 		if (!node || !isFolderNode(node)) throw new Error("Folder creation failed");
 		return node;
 	}
@@ -427,7 +429,7 @@ var DriveClient = class {
 		const node = (await this.client.execute(driveIdentifier, "main", [updateNode({
 			id: nodeId,
 			name
-		})], signal)).state.global.nodes.find((n) => n.id === nodeId);
+		})], signal)).state.global?.nodes.find((n) => n.id === nodeId);
 		if (!node) throw new Error("Node missing from drive after rename");
 		return node;
 	}
@@ -468,8 +470,12 @@ var DriveClient = class {
 			const node = drive.state.global.nodes.find((n) => n.id === entry.srcId);
 			if (!node || !isFileNode(node)) continue;
 			const srcDoc = await this.client.get(entry.srcId, void 0, signal);
-			const module = await this.client.getDocumentModelModule(srcDoc.header.documentType);
-			const duplicated = replayDocument(srcDoc.initialState, srcDoc.operations, module.reducer, createPresignedHeader(entry.targetId, srcDoc.header.documentType));
+			const duplicated = {
+				...srcDoc,
+				header: createPresignedHeader(entry.targetId, srcDoc.header.documentType),
+				initialState: srcDoc.state,
+				operations: {}
+			};
 			const resolvedName = resolvedNamesByTargetId.get(entry.targetId);
 			if (resolvedName) duplicated.header.name = resolvedName;
 			await this.addFile(driveIdentifier, duplicated, entry.targetParentFolder ?? void 0, signal);
@@ -680,8 +686,328 @@ let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 	return DocumentChangeType;
 }({});
 //#endregion
+//#region src/decision/read-gate.ts
+/**
+* Scopes every holder of a document may read, whatever the grants say. Denying
+* the policy itself would let a replica sync a document without it, read the
+* auth scope as uninitialized, and allow every operation it holds, so replicas
+* would diverge permanently. The document scope carries the metadata the same
+* argument covers. Grants gate domain-scope reads only.
+*/
+const ALWAYS_READABLE_SCOPES = new Set(["auth", "document"]);
+/**
+* The branch a group is read on. A group's member list lives on its main
+* branch whatever branch the document naming it is on, and the reference
+* relation records no branch of its own.
+*/
+const GROUP_BRANCH = "main";
+/**
+* The scope of a group document that holds its member list. It is the only
+* scope group serving reaches, because it is the only one the audience must
+* fold in order to evaluate auth with the group.
+*/
+const GROUP_MEMBERSHIP_SCOPE = "global";
+/**
+* How many of a group's referencing documents are examined before a read of
+* that group gives up and withholds. Each one costs a model build, and the
+* relation is append-only, so an old and briefly-held reference still counts.
+* Truncating denies, which is the direction that withholds. It is the cap a
+* version-1 policy carries on its own grant list, taken from there rather than
+* restated: raising that cap raises the read fan-out here.
+*/
+const MAX_EXAMINED_REFERENCERS = MAX_AUTH_GRANTS;
+/**
+* How many referencers are probed at once. The reactor's Postgres pool size is
+* optional and defaults to ten, and a listing resolves one gate per result, so
+* per-gate fan-out multiplies: a handful keeps one group read from claiming the
+* whole pool while still cutting the walk several times over. On PGlite the
+* queries serialize regardless, so a larger number buys nothing in a browser.
+*/
+const REFERENCER_PROBE_CONCURRENCY = 4;
+/**
+* The policy carried on a document, if it carries one. A document handed to the
+* gate with no state at all is not policied, so it is not gated.
+*/
+function authOf(document) {
+	return document.state?.auth;
+}
+/**
+* The model reads enforce. Below `authEnforcement` there is no model to
+* enforce: the document-only model ignores the auth scope entirely, so reading
+* through it would serve every domain scope of a policied document to anyone.
+* Undefined therefore means "evaluate the policy alone", which is what the read
+* surface did before the model existed.
+*/
+function readDecisionModel(flags, registry) {
+	return flags.authEnforcement ? selectDecisionModel(flags, registry) : void 0;
+}
+/**
+* Evaluates the policy on its own, with no groups map and no condition context.
+* A `{ group }` or conditional grant therefore never applies: an allow that
+* does not apply withholds access, so this cannot widen a policy, but a policy
+* relying on a conditional deny is weaker here than it is written.
+*/
+var BareReadGate = class {
+	scopePredicate(document, subject) {
+		const auth = authOf(document);
+		return Promise.resolve((scope) => ALWAYS_READABLE_SCOPES.has(scope) || decide(auth, subject, {
+			verb: "read",
+			scope
+		}) === "allow");
+	}
+};
+/**
+* Answers a stream read from the document already fetched, and anything else
+* through the read side.
+*
+* The seed is why routing reads through a decision model costs no extra I/O for
+* the document being read: its `document` and `auth` scopes are the two static
+* projections, and the caller has both in hand. Only a group stream the grant
+* list names is fetched.
+*/
+var SeededStateReader = class {
+	constructor(documentView, seed, branch) {
+		this.documentView = documentView;
+		this.seed = seed;
+		this.branch = branch;
+	}
+	/**
+	* A stream this replica does not hold has to reach buildDecisionModel as the
+	* absence it recognises, or the whole read fails instead of leaving the group
+	* out of the model, where its principal does not match and the policy fails
+	* closed. The read side reports absence as a plain Error, so the absence is
+	* confirmed rather than inferred from the message: a transient failure must
+	* surface, not silently deny.
+	*/
+	async getState(documentId, scope, branch, targetRevision, signal) {
+		if (targetRevision === void 0 && documentId === this.seed.header.id && branch === this.branch && scope in this.seed.state) return this.seed;
+		try {
+			return await this.documentView.get(documentId, {
+				branch,
+				scopes: [scope]
+			}, void 0, signal);
+		} catch (error) {
+			await this.assertAbsent(documentId, error, signal);
+			throw new DocumentNotFoundError(documentId);
+		}
+	}
+	async assertAbsent(documentId, error, signal) {
+		if (DocumentNotFoundError.isError(error)) return;
+		let exists;
+		try {
+			exists = await this.documentView.exists([documentId], void 0, signal);
+		} catch {
+			throw error;
+		}
+		if (exists[0]) throw error;
+	}
+};
+/**
+* Evaluates a read against the registered decision model, built at the stream
+* heads. This is what makes `{ group }` principals and conditional grants apply
+* to a read: the model supplies the groups map and the scope's own state, the
+* same two things admission supplies.
+*
+* A read has no action, so a condition on `action.input.*` never holds for one.
+*
+* State is read through the read side rather than the write cache. The write
+* cache is invalidated by whichever process runs the executor, so a reactor
+* running its executors in worker processes would answer reads in the parent
+* from state no commit ever invalidates.
+*/
+var ModelReadGate = class {
+	constructor(model, documentView, servesGroups, operationIndex, logger) {
+		this.model = model;
+		this.documentView = documentView;
+		this.servesGroups = servesGroups;
+		this.operationIndex = operationIndex;
+		this.logger = logger;
+	}
+	/**
+	* A served group yields its member list and nothing else. What the audience
+	* is owed is the state it must fold to evaluate auth with the group; a
+	* group's other scopes are its own business and stay behind its own grants.
+	*/
+	async scopePredicate(document, subject, branch, signal) {
+		const own = await this.ownPolicyPredicate(document, subject, branch, signal);
+		if (!this.servesGroup(document) || own(GROUP_MEMBERSHIP_SCOPE)) return own;
+		const audience = await this.servesGroupTo(document.header.id, subject, signal);
+		return (scope) => own(scope) || audience && scope === GROUP_MEMBERSHIP_SCOPE;
+	}
+	/**
+	* Whether the subject is served this group because a policy names it.
+	*
+	* A replica must fold a group's membership to evaluate auth with it, so a
+	* group a grant names is served to the audience of the document that names
+	* it, whatever the group's own read grants say. Naming a group in a policy
+	* publishes its roster to that policy's audience; a group whose membership
+	* must stay confidential does not belong in a grant.
+	*
+	* The referencing document's own domain scopes are the test. Its `auth` and
+	* `document` scopes are readable by every holder, so testing those would
+	* serve every referenced group to everybody.
+	*
+	* One level only. A referencer that is itself a group is skipped, and a
+	* referencer's own readability is decided from its policy alone, so a
+	* reference cycle terminates. Cycles are reachable: the reference relation
+	* is recorded from an operation's input, including one later stored denied,
+	* so a refused grant naming a group from inside another group leaves a row
+	* behind that validation never saw.
+	*
+	* The referencers are probed a few at a time and the walk stops at the first
+	* that serves, because a subject outside the audience is the case that runs to
+	* the bound, and it is the common one. A probe that failed decides only when
+	* nothing served: serving rests on a real allow, so this cannot widen, and it
+	* stops one unreachable referencer from turning an allow already in hand into
+	* a denial. A read records no operation, so replicas differing over a
+	* transient failure has no consensus consequence.
+	*
+	* The probes are awaited together rather than raced, so none is ever left
+	* running with nobody awaiting it, which is where unhandled rejections come
+	* from.
+	*/
+	async servesGroupTo(groupId, subject, signal) {
+		if (!this.operationIndex) return false;
+		const referencers = await this.operationIndex.getGroupReferencers(groupId, signal);
+		const examined = referencers.slice(0, MAX_EXAMINED_REFERENCERS);
+		if (examined.length < referencers.length) this.logger?.warn(`Group ${groupId} is referenced by ${referencers.length} documents; only the first ${MAX_EXAMINED_REFERENCERS} decide whether it is served`);
+		const walk = {
+			next: 0,
+			served: false,
+			failure: void 0
+		};
+		const probe = async () => {
+			while (!walk.served && walk.next < examined.length) {
+				const referencerId = examined[walk.next++];
+				let serves = false;
+				try {
+					serves = await this.servesThrough(referencerId, subject, signal);
+				} catch (error) {
+					walk.failure ??= Error.isError(error) ? error : /* @__PURE__ */ new Error(`Probing referencer ${referencerId} failed`);
+				}
+				if (serves) walk.served = true;
+			}
+		};
+		await Promise.all(Array.from({ length: Math.min(REFERENCER_PROBE_CONCURRENCY, examined.length) }, probe));
+		if (!walk.served && walk.failure) throw walk.failure;
+		return walk.served;
+	}
+	/**
+	* Whether one referencing document serves the subject any domain scope. A
+	* referencer this replica does not hold serves nothing, which fails closed
+	* the same way a group it does not hold does.
+	*/
+	async servesThrough(referencerId, subject, signal) {
+		let referencer;
+		try {
+			referencer = await this.documentView.get(referencerId, { branch: GROUP_BRANCH }, void 0, signal);
+		} catch {
+			return false;
+		}
+		if (this.servesGroup(referencer)) return false;
+		const readable = await this.ownPolicyPredicate(referencer, subject, GROUP_BRANCH, signal);
+		return Object.keys(referencer.state ?? {}).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope)).some((scope) => readable(scope));
+	}
+	servesGroup(document) {
+		return this.servesGroups && this.operationIndex !== void 0 && document.header.documentType === groupDocumentType;
+	}
+	/**
+	* What this document's own policy says, with no group serving applied.
+	*
+	* An unpoliced document is readable in full, which is the common case and the
+	* one worth answering without building anything. The test is the one
+	* `evaluate` makes: a legacy `{}` auth scope and version 0 both mean
+	* uninitialized, and "no grants" does not, because a policy with a version and
+	* an empty grant list denies everything.
+	*/
+	async ownPolicyPredicate(document, subject, branch, signal) {
+		const auth = authOf(document);
+		if (!auth || !auth.version) return () => true;
+		const target = {
+			documentId: document.header.id,
+			branch
+		};
+		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), this.model, target, signal);
+		const definition = this.model(target);
+		const scopeStates = document.state ?? {};
+		return (scope) => ALWAYS_READABLE_SCOPES.has(scope) || definition.decide(built.model, subject, {
+			verb: "read",
+			scope
+		}, {
+			scopeState: scopeStates[scope],
+			actionInput: void 0
+		}).decision === "allow";
+	}
+};
+//#endregion
+//#region src/client/util.ts
+function authSubjectFromSigner(signer) {
+	return {
+		address: signer.user?.address,
+		key: signer.app?.key
+	};
+}
+function withAuthScope(view) {
+	if (view?.scopes && view.scopes.length > 0) return {
+		...view,
+		scopes: [...new Set([...view.scopes, "auth"])]
+	};
+	return view;
+}
+/**
+* Drops the scopes the predicate refuses. The predicate is resolved by the read
+* gate, which decides against the whole policy once per document; this only
+* applies the answer, so it stays synchronous.
+*/
+function filterReadableScopes(document, readable) {
+	const state = document.state;
+	if (!state) return document;
+	return {
+		...document,
+		state: keepReadableScopes(state, readable),
+		initialState: keepReadableScopes(document.initialState, readable)
+	};
+}
+function keepReadableScopes(scopes, readable) {
+	if (!scopes) return scopes;
+	const kept = {};
+	for (const scope of Object.keys(scopes)) if (readable(scope)) kept[scope] = scopes[scope];
+	return kept;
+}
+//#endregion
 //#region src/client/reactor-client.ts
 /**
+* The document a candidate is decided against. Routed on the action type alone,
+* which is what the executor routes on: every action the reactor reduces onto
+* the document scope carries that scope already, and the gate follows the
+* action's own target rather than the document the request named.
+*/
+function evaluationTargetId(candidate, fallback) {
+	return GATED_DOCUMENT_ACTIONS.has(candidate.type) ? targetDocumentId({
+		type: candidate.type,
+		input: candidate.input
+	}, fallback) : fallback;
+}
+/**
+* One candidate's verdict, decided exactly as admission decides it: the same
+* request, and a condition context populated only while authConditions is on,
+* so a conditional grant applies here precisely when it would apply there.
+* Groups need nothing added, because the selected model carries them.
+*/
+function decideCandidate(config, target, subject, candidate) {
+	return target.definition.decide(target.model, subject, {
+		verb: "execute",
+		scope: candidate.scope,
+		operation: candidate.type
+	}, config.flags.authConditions ? {
+		scopeState: target.scopeStates[candidate.scope],
+		actionInput: candidate.input
+	} : {
+		scopeState: void 0,
+		actionInput: void 0
+	});
+}
+/**
 * ReactorClient implementation that wraps lower-level APIs to provide
 * a simpler interface for document operations.
 *
@@ -699,8 +1025,10 @@ var ReactorClient = class {
 	jobAwaiter;
 	documentIndexer;
 	documentView;
+	readGate;
+	actionEvaluation;
 	drives;
-	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView) {
+	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, readGate = new BareReadGate(), actionEvaluation) {
 		this.logger = logger;
 		this.reactor = reactor;
 		this.signer = signer;
@@ -708,9 +1036,33 @@ var ReactorClient = class {
 		this.jobAwaiter = jobAwaiter;
 		this.documentIndexer = documentIndexer;
 		this.documentView = documentView;
+		this.readGate = readGate;
+		this.actionEvaluation = actionEvaluation;
 		this.drives = new DriveClient(this, logger, reactor, signer);
 		this.logger.verbose("ReactorClient initialized");
 	}
+	readSubject(subject) {
+		return subject ?? authSubjectFromSigner(this.signer);
+	}
+	/**
+	* Which scopes of one document the subject may read. Resolved once per
+	* document, so the gate builds its model once however many scopes are then
+	* tested, and the filtering itself stays synchronous.
+	*/
+	readableScopes(document, view, signal) {
+		return this.readGate.scopePredicate(document, this.readSubject(view?.subject), view?.branch ?? "main", signal);
+	}
+	/**
+	* One document, filtered to the scopes the subject may read. Every method
+	* that hands a document back goes through here, including the ones that
+	* follow a write: a document returned from a mutation is a read like any
+	* other, and returning it whole served scopes the same subject would be
+	* refused by `get`. Its author still sees what it wrote, because an allow on
+	* execute confers read of that scope.
+	*/
+	async gateDocument(document, view, signal) {
+		return filterReadableScopes(document, await this.readableScopes(document, view, signal));
+	}
 	/**
 	* Retrieves a list of document model modules.
 	*/
@@ -725,24 +1077,53 @@ var ReactorClient = class {
 	* @returns The document model module
 	*/
 	async getDocumentModelModule(documentType) {
-		const module = (await this.reactor.getDocumentModels()).results.find((m) => m.documentModel.global.id === documentType);
-		if (!module) throw new Error(`Document model module not found for type: ${documentType}`);
-		return module;
+		const modules = await this.reactor.getDocumentModels();
+		let latestModule;
+		let latestVersion = -1;
+		for (const module of modules.results) {
+			if (module.documentModel.global.id !== documentType) continue;
+			const version = module.version ?? 1;
+			if (version > latestVersion) {
+				latestVersion = version;
+				latestModule = module;
+			}
+		}
+		if (!latestModule) throw new Error(`Document model module not found for type: ${documentType}`);
+		return latestModule;
+	}
+	/**
+	* Retrieves the document model module matching the version the document is
+	* stamped with, so not-yet-upgraded documents get the reducer their
+	* history was written with rather than the latest.
+	*/
+	async getDocumentModelModuleForDocument(document) {
+		const documentType = document.header.documentType;
+		const version = normalizeDocumentModelVersion(document.state.document?.version);
+		const modules = await this.reactor.getDocumentModels();
+		const availableVersions = [];
+		for (const module of modules.results) {
+			if (module.documentModel.global.id !== documentType) continue;
+			const moduleVersion = normalizeDocumentModelVersion(module.version);
+			if (moduleVersion === version) return module;
+			availableVersions.push(moduleVersion);
+		}
+		throw new UnsupportedDocumentModelVersionError(documentType, version, availableVersions.sort((a, b) => a - b));
 	}
 	/**
 	* Retrieves a specific PHDocument
 	*/
 	async get(identifier, view, signal) {
 		this.logger.verbose("get(@identifier, @view)", identifier, view);
-		return await this.reactor.getByIdOrSlug(identifier, view, void 0, signal);
+		const document = await this.reactor.getByIdOrSlug(identifier, withAuthScope(view), void 0, signal);
+		return this.gateDocument(document, view, signal);
 	}
 	/**
 	* Resolves an identifier (id or slug) to the canonical document id, using the
 	* same lookup as the data path. Resolves against the "main" branch. Throws if
 	* the identifier cannot be resolved or is ambiguous.
 	*/
-	async resolveIdOrSlug(identifier, signal) {
-		return this.documentView.resolveIdOrSlug(identifier, void 0, void 0, signal);
+	async resolveIdOrSlug(identifier, view, signal) {
+		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
 	}
 	/**
 	* Retrieves operations for a document
@@ -750,8 +1131,11 @@ var ReactorClient = class {
 	async getOperations(documentIdentifier, view, filter, paging, signal) {
 		this.logger.verbose("getOperations(@documentIdentifier, @view, @filter, @paging)", documentIdentifier, view, filter, paging);
 		const documentId = await this.documentView.resolveIdOrSlug(documentIdentifier, view, void 0, signal);
-		if (paging?.cursor && isCompositeCursor(paging.cursor)) return this.getOperationsWithCompositeCursor(documentId, view, filter, paging, signal);
+		const gated = await this.reactor.getByIdOrSlug(documentId, withAuthScope(view), void 0, signal);
+		const canRead = await this.readableScopes(gated, view, signal);
+		if (paging?.cursor && isCompositeCursor(paging.cursor)) return this.getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead);
 		const operationsByScope = await this.reactor.getOperations(documentId, view, filter, paging, void 0, signal);
+		for (const scope of Object.keys(operationsByScope)) if (!canRead(scope)) delete operationsByScope[scope];
 		const scopeEntries = Object.entries(operationsByScope);
 		const effectivePaging = paging || {
 			cursor: "0",
@@ -779,11 +1163,12 @@ var ReactorClient = class {
 			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
 		};
 	}
-	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal) {
+	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
 		const scopeCursors = decodeCompositeCursor(paging.cursor);
 		const allOperations = [];
 		const activeCursors = {};
 		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
+			if (!canRead(scopeName)) continue;
 			const scopeView = {
 				...view,
 				scopes: [scopeName]
@@ -817,7 +1202,7 @@ var ReactorClient = class {
 				limit: 0
 			}
 		};
-		return this.reactor.find({ ids: targetIds }, view, paging, void 0, signal);
+		return this.find({ ids: targetIds }, view, paging, signal);
 	}
 	/**
 	* Retrieves incoming relationships of a given type to a target document.
@@ -833,14 +1218,90 @@ var ReactorClient = class {
 				limit: 0
 			}
 		};
-		return this.reactor.find({ ids: sourceIds }, view, paging, void 0, signal);
+		return this.find({ ids: sourceIds }, view, paging, signal);
 	}
 	/**
 	* Filters documents by criteria and returns a list of them
 	*/
 	async find(search, view, paging, signal) {
 		this.logger.verbose("find(@search, @view, @paging)", search, view, paging);
-		return this.reactor.find(search, view, paging, void 0, signal);
+		const results = await this.reactor.find(search, withAuthScope(view), paging, void 0, signal);
+		return {
+			...results,
+			results: await Promise.all(results.results.map(async (doc) => filterReadableScopes(doc, await this.readableScopes(doc, view, signal))))
+		};
+	}
+	/**
+	* Predicts the admission verdict for each candidate. See
+	* {@link IReactorClient.evaluateActions} for the contract and its caveats.
+	*
+	* Read-only throughout, and never through the write cache: that cache is
+	* invalidated by whichever process runs the executor, so a reactor running
+	* its executors in worker processes would answer here from state no commit
+	* ever invalidates.
+	*/
+	async evaluateActions(documentIdentifier, branch, candidates, subject, signal) {
+		this.logger.verbose("evaluateActions(@documentIdentifier, @branch, @count candidates)", documentIdentifier, branch, candidates.length);
+		const config = this.actionEvaluation;
+		if (config === void 0) throw new AuthEnforcementDisabledError();
+		const decidedSubject = this.readSubject(subject);
+		const resolvedId = await this.documentView.resolveIdOrSlug(documentIdentifier, { branch }, void 0, signal);
+		const targets = /* @__PURE__ */ new Map();
+		const evaluations = [];
+		for (const candidate of candidates) {
+			if (candidate.type === "CREATE_DOCUMENT") {
+				evaluations.push({ decision: "allow" });
+				continue;
+			}
+			const targetId = evaluationTargetId(candidate, resolvedId);
+			let target = targets.get(targetId);
+			if (target === void 0) {
+				target = await this.buildEvaluationTarget(config, targetId, branch, signal);
+				targets.set(targetId, target);
+			}
+			evaluations.push(decideCandidate(config, target, decidedSubject, candidate));
+		}
+		const allowed = evaluations.filter((evaluation) => evaluation.decision === "allow").length;
+		return {
+			evaluations,
+			allAllowed: candidates.length > 0 && allowed === candidates.length,
+			anyAllowed: allowed > 0,
+			allDenied: candidates.length > 0 && allowed === 0,
+			anyDenied: allowed < candidates.length
+		};
+	}
+	/**
+	* The decision model for one target document, built at its stream heads.
+	*
+	* The document is fetched unfiltered, because the policy is what decides:
+	* reading it through the read gate would withhold the very scopes the
+	* decision is about. A deleted document is served at its deletion boundary,
+	* which is what lets the model refuse an execute against it -- authEnforcement
+	* requires documentDecisions, so that read is available whenever this runs.
+	*
+	* Reading past the gate discloses nothing a submit does not. The `auth` and
+	* `document` scopes are readable by every holder, so a verdict resting on the
+	* policy alone is one the caller could compute unaided; and a verdict resting
+	* on a conditional grant reads the executing scope's state exactly as
+	* admission reads it, so the answer here is what submitting and being refused
+	* would have revealed anyway.
+	*
+	* The append condition the build records is dropped. It guards a write, and
+	* this makes none; reproducing it is also what the preflight cannot do, which
+	* is why the answer is a prediction.
+	*/
+	async buildEvaluationTarget(config, documentId, branch, signal) {
+		const document = await this.documentView.get(documentId, { branch }, void 0, signal);
+		const target = {
+			documentId,
+			branch
+		};
+		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), config.model, target, signal);
+		return {
+			definition: config.model(target),
+			model: built.model,
+			scopeStates: document.state ?? {}
+		};
 	}
 	/**
 	* Creates a document and waits for completion
@@ -868,7 +1329,7 @@ var ReactorClient = class {
 			documentId,
 			model: document.header.documentType,
 			fromVersion: 0,
-			toVersion: document.state.document.version,
+			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 			initialState: document.state
 		})], this.signer, signal);
 		const jobs = [{
@@ -893,7 +1354,8 @@ var ReactorClient = class {
 		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
 		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
-		return await this.reactor.get(documentId);
+		const created = await this.reactor.get(documentId);
+		return this.gateDocument(created, void 0, signal);
 	}
 	/**
 	* Creates an empty document and waits for completion
@@ -903,20 +1365,64 @@ var ReactorClient = class {
 		const matchingModules = (await this.reactor.getDocumentModels(void 0, void 0, signal)).results.filter((m) => m.documentModel.global.id === documentModelType);
 		let module;
 		if (options?.documentModelVersion !== void 0) {
-			module = matchingModules.find((m) => m.version === options.documentModelVersion);
+			const requestedVersion = normalizeDocumentModelVersion(options.documentModelVersion);
+			module = matchingModules.find((m) => normalizeDocumentModelVersion(m.version) === requestedVersion);
 			if (!module) throw new Error(`Document model not found for type: ${documentModelType} with version: ${options.documentModelVersion}`);
 		} else {
 			module = matchingModules.reduce((latest, current) => {
 				if (latest === void 0) return current;
-				return (current.version ?? 0) > (latest.version ?? 0) ? current : latest;
+				return normalizeDocumentModelVersion(current.version) > normalizeDocumentModelVersion(latest.version) ? current : latest;
 			}, void 0);
 			if (!module) throw new Error(`Document model not found for type: ${documentModelType}`);
 		}
 		const document = module.utils.createDocument();
-		document.state.document.version = module.version ?? 1;
+		document.state.document.version = normalizeDocumentModelVersion(module.version);
 		return this.create(document, options?.parentIdentifier, signal);
 	}
 	/**
+	* Upgrades a document to a newer document model version by dispatching an
+	* UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
+	* latest registered module version for the document's type. Returns the
+	* document unchanged when it is already at the target version.
+	*
+	* The executor validates the action's version and revision snapshot against
+	* the state the migration actually runs on. When a concurrent edit
+	* invalidates the snapshot, the upgrade is rebuilt from a fresh read and
+	* retried up to maxConflictRetries times before the conflict is surfaced.
+	*/
+	async upgradeDocument(documentIdentifier, toVersion, options, signal) {
+		this.logger.verbose("upgradeDocument(@documentIdentifier, @toVersion)", documentIdentifier, toVersion);
+		const maxConflictRetries = options?.maxConflictRetries ?? 3;
+		let lastConflictMessage = "";
+		for (let attempt = 0; attempt <= maxConflictRetries; attempt++) {
+			const document = await this.reactor.getByIdOrSlug(documentIdentifier, void 0, void 0, signal);
+			const documentId = document.header.id;
+			const documentType = document.header.documentType;
+			const branch = document.header.branch || "main";
+			const fromVersion = normalizeDocumentModelVersion(document.state.document?.version);
+			let targetVersion = toVersion;
+			if (targetVersion === void 0) targetVersion = normalizeDocumentModelVersion((await this.getDocumentModelModule(documentType)).version);
+			if (targetVersion === fromVersion) return this.gateDocument(document, { branch }, signal);
+			if (targetVersion < fromVersion) throw new DowngradeNotSupportedError(documentType, fromVersion, targetVersion);
+			const signedActions = await signActions([upgradeDocumentAction({
+				documentId,
+				model: documentType,
+				fromVersion,
+				toVersion: targetVersion,
+				revision: { ...document.header.revision }
+			})], this.signer, signal);
+			const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
+			const completedJob = await this.waitForJob(jobInfo, signal);
+			if (completedJob.status !== JobStatus.FAILED) {
+				const upgraded = await this.reactor.getByIdOrSlug(documentId, { branch }, completedJob.consistencyToken, signal);
+				return this.gateDocument(upgraded, { branch }, signal);
+			}
+			if (completedJob.error?.name !== "UpgradePreconditionFailedError") throw new Error(completedJob.error?.message);
+			lastConflictMessage = completedJob.error.message;
+		}
+		throw new Error(`Upgrade of document ${documentIdentifier} conflicted with concurrent edits after ${maxConflictRetries + 1} attempts: ${lastConflictMessage}`);
+	}
+	/**
 	* Creates an empty document in a drive as a single batched operation.
 	* Delegates to {@link IDriveClient.addFile}.
 	*
@@ -936,7 +1442,8 @@ var ReactorClient = class {
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
 		const view = { branch };
-		return await this.reactor.getByIdOrSlug(documentIdentifier, view, completedJob.consistencyToken, signal);
+		const result = await this.reactor.getByIdOrSlug(documentIdentifier, view, completedJob.consistencyToken, signal);
+		return this.gateDocument(result, view, signal);
 	}
 	/**
 	* Submits a list of actions to a document
@@ -980,7 +1487,8 @@ var ReactorClient = class {
 		const jobInfo = await this.reactor.addRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
-		return await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		return this.gateDocument(result, { branch }, signal);
 	}
 	/**
 	* Removes a relationship between two documents and waits for completion.
@@ -990,7 +1498,8 @@ var ReactorClient = class {
 		const jobInfo = await this.reactor.removeRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
-		return await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		return this.gateDocument(result, { branch }, signal);
 	}
 	/**
 	* Moves a relationship from one source document to another and waits for completion.
@@ -1003,9 +1512,11 @@ var ReactorClient = class {
 		const addJobInfo = await this.reactor.addRelationship(targetParentIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const addCompletedJob = await this.waitForJob(addJobInfo, signal);
 		if (addCompletedJob.status === JobStatus.FAILED) throw new Error(addCompletedJob.error?.message);
+		const sourceResult = await this.reactor.getByIdOrSlug(sourceParentIdentifier, { branch }, removeCompletedJob.consistencyToken, signal);
+		const targetResult = await this.reactor.getByIdOrSlug(targetParentIdentifier, { branch }, addCompletedJob.consistencyToken, signal);
 		return {
-			source: await this.reactor.getByIdOrSlug(sourceParentIdentifier, { branch }, removeCompletedJob.consistencyToken, signal),
-			target: await this.reactor.getByIdOrSlug(targetParentIdentifier, { branch }, addCompletedJob.consistencyToken, signal)
+			source: await this.gateDocument(sourceResult, { branch }, signal),
+			target: await this.gateDocument(targetResult, { branch }, signal)
 		};
 	}
 	async loadBatch(request, signal) {
@@ -1078,32 +1589,56 @@ var ReactorClient = class {
 	*/
 	subscribe(search, callback, view) {
 		this.logger.verbose("subscribe(@search, @view)", search, view);
+		const readable = async (document) => filterReadableScopes(document, await this.readableScopes(document, view));
+		let disposed = false;
+		let delivering = Promise.resolve();
+		/**
+		* Queues one event behind those already queued. Gating an event resolves
+		* asynchronously, so an event needing a group fetch would otherwise be
+		* overtaken by the one behind it, and one still in flight would reach a
+		* subscriber that has already unsubscribed. Only delivery is ordered, not
+		* the gating: a single subscription can cover every document in the
+		* reactor, so serializing that work would make its delivery rate the sum
+		* of every gate build rather than the slowest. An event that cannot be
+		* gated is withheld, because serving it unfiltered would leak the scopes
+		* the gate did not clear -- but it is logged rather than swallowed, since
+		* the gate rethrows a transient failure precisely so it is not read as a
+		* denial.
+		*/
+		const deliver = (event) => {
+			Promise.resolve(event).catch(() => void 0);
+			delivering = delivering.then(async () => {
+				const built = await event;
+				if (disposed) return;
+				callback(built);
+			}).catch((error) => {
+				this.logger.error("Subscription delivery failed for @search: @Error", { search }, error);
+			});
+		};
 		const unsubscribeCreated = this.subscriptionManager.onDocumentCreated((result) => {
-			(async () => {
-				try {
-					const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, view, void 0, void 0)));
-					callback({
-						type: DocumentChangeType.Created,
-						documents
-					});
-				} catch {}
-			})();
+			deliver((async () => {
+				const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, withAuthScope(view), void 0, void 0)));
+				return {
+					type: DocumentChangeType.Created,
+					documents: await Promise.all(documents.map(readable))
+				};
+			})());
 		}, search);
 		const unsubscribeDeleted = this.subscriptionManager.onDocumentDeleted((documentIds) => {
-			callback({
+			deliver({
 				type: DocumentChangeType.Deleted,
 				documents: [],
 				context: { childId: documentIds[0] }
 			});
 		}, search);
 		const unsubscribeUpdated = this.subscriptionManager.onDocumentStateUpdated((result) => {
-			callback({
+			deliver((async () => ({
 				type: DocumentChangeType.Updated,
-				documents: result.results
-			});
+				documents: await Promise.all(result.results.map(readable))
+			}))());
 		}, search, view);
 		const unsubscribeRelationship = this.subscriptionManager.onRelationshipChanged((parentId, childId, changeType) => {
-			callback({
+			deliver({
 				type: changeType === RelationshipChangeType.Added ? DocumentChangeType.ChildAdded : DocumentChangeType.ChildRemoved,
 				documents: [],
 				context: {
@@ -1113,6 +1648,7 @@ var ReactorClient = class {
 			});
 		}, search);
 		return () => {
+			disposed = true;
 			unsubscribeCreated();
 			unsubscribeDeleted();
 			unsubscribeUpdated();
@@ -1144,17 +1680,33 @@ let JobQueueState = /* @__PURE__ */ function(JobQueueState) {
 	return JobQueueState;
 }({});
 /**
+* How a retry is accounted against the job's retry limit.
+* - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
+*   retries and fails terminally.
+* - `ExemptFromLimit`: not a fault, so the attempt is not charged to the job.
+*   Used for concurrency conflicts, where the retry does new work.
+*/
+let RetryAccounting = /* @__PURE__ */ function(RetryAccounting) {
+	RetryAccounting["CountAgainstLimit"] = "count-against-limit";
+	RetryAccounting["ExemptFromLimit"] = "exempt-from-limit";
+	return RetryAccounting;
+}({});
+/**
 * Event types for the queue system
 */
 const QueueEventTypes = { JOB_AVAILABLE: 1e4 };
 //#endregion
 //#region src/executor/job-result-handler.ts
+/** Conflict retries a job may take without charging its retry limit. */
+const MAX_EXEMPT_CONFLICT_RETRIES = 20;
 function toErrorInfo(error) {
 	if (error instanceof Error) return {
+		name: error.name,
 		message: error.message,
 		stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 	};
 	return {
+		name: "Error",
 		message: error,
 		stack: (/* @__PURE__ */ new Error()).stack || ""
 	};
@@ -1187,12 +1739,19 @@ var JobResultHandler = class {
 				} catch {}
 			}
 		}
+		if (result.error && AppendConditionFailedError.isError(result.error) && this.countConflicts(handle.job) < MAX_EXEMPT_CONFLICT_RETRIES) {
+			const errorInfo = toErrorInfo(result.error);
+			try {
+				await this.queue.retryJob(handle.job.id, errorInfo, RetryAccounting.ExemptFromLimit);
+				return;
+			} catch {}
+		}
 		if (result.error && DocumentNotFoundError.isError(result.error)) {
 			handle.defer();
 			callbacks.deferJob(handle.job.documentId, handle.job);
 			return;
 		}
-		if (result.error && DocumentDeletedError.isError(result.error)) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -1230,6 +1789,12 @@ var JobResultHandler = class {
 			handle.fail(fullErrorInfo);
 		}
 	}
+	/** How many times this job has already lost an append-condition race. */
+	countConflicts(job) {
+		let conflicts = 0;
+		for (const error of job.errorHistory) if (AppendConditionFailedError.isFailureMessage(error.message)) conflicts++;
+		return conflicts;
+	}
 	hasCreateDocumentAction(job) {
 		for (const action of job.actions) if (action.type === "CREATE_DOCUMENT") return true;
 		for (const operation of job.operations) if (operation.action.type === "CREATE_DOCUMENT") return true;
@@ -1245,6 +1810,7 @@ var JobResultHandler = class {
 			stackLines.push(`[Attempt ${index + 1}] Stack trace:\n${error.stack}`);
 		});
 		return {
+			name: currentError.name,
 			message: messageLines.join("\n"),
 			stack: stackLines.join("\n\n")
 		};
@@ -1850,6 +2416,7 @@ var InMemoryJobTracker = class {
 	}
 	handleJobFailed(event) {
 		this.markFailed(event.jobId, {
+			name: event.error.name,
 			message: event.error.message,
 			stack: event.error.stack || ""
 		}, event.job);
@@ -2311,10 +2878,12 @@ var InMemoryQueue = class {
 	}
 	toErrorInfo(error) {
 		if (error instanceof Error) return {
+			name: error.name,
 			message: error.message,
 			stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
 		};
 		return {
+			name: "Error",
 			message: error,
 			stack: (/* @__PURE__ */ new Error()).stack || ""
 		};
@@ -2402,6 +2971,7 @@ var InMemoryQueue = class {
 			await this.resolver.ensureModelLoaded(documentType);
 		} catch {
 			await this.failJob(job.id, {
+				name: "Error",
 				message: `Failed to load document model for type: ${documentType}`,
 				stack: (/* @__PURE__ */ new Error()).stack || ""
 			});
@@ -2575,9 +3145,11 @@ var InMemoryQueue = class {
 		this.jobIndex.delete(jobId);
 		this.completedJobs.add(jobId);
 		await this.remove(jobId);
+		const emittedError = new Error(error?.message ?? "Job failed");
+		if (error?.name) emittedError.name = error.name;
 		this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
 			jobId,
-			error: new Error(error?.message ?? "Job failed"),
+			error: emittedError,
 			job
 		}).catch(() => {});
 		this.checkDrained();
@@ -2587,7 +3159,7 @@ var InMemoryQueue = class {
 		if (documentId) this.markJobComplete(jobId, documentId);
 		this.jobIndex.delete(jobId);
 	}
-	async retryJob(jobId, error) {
+	async retryJob(jobId, error, accounting = RetryAccounting.CountAgainstLimit) {
 		const job = this.jobIndex.get(jobId);
 		if (!job) return;
 		job.lastError = error;
@@ -2596,9 +3168,10 @@ var InMemoryQueue = class {
 		this.jobIndex.delete(jobId);
 		this.jobIdToQueueKey.delete(jobId);
 		if (error) job.errorHistory.push(error);
+		const retryCount = job.retryCount || 0;
 		const updatedJob = {
 			...job,
-			retryCount: (job.retryCount || 0) + 1,
+			retryCount: accounting === RetryAccounting.CountAgainstLimit ? retryCount + 1 : retryCount,
 			lastError: error
 		};
 		await this.enqueue(updatedJob);
@@ -3116,6 +3689,83 @@ var SubscriptionNotificationReadModel = class {
 	}
 };
 //#endregion
+//#region src/core/group-reevaluation-trigger.ts
+/**
+* Watches committed writes for group membership changes and enqueues a
+* re-evaluation job for every document whose auth history references the
+* changed group, found through the reverse direction of the group-reference
+* relation. Each affected document is re-judged in its own job, so the work
+* runs under that document's execution slot rather than the group's.
+*
+* The job carries the earliest changed membership timestamp; the executor
+* skips the pass when everything the document holds sorts before it, which
+* keeps the common case (a membership write later than all history) free.
+*/
+var GroupReevaluationTrigger = class {
+	unsubscribe;
+	constructor(logger, eventBus, queue, operationIndex) {
+		this.logger = logger;
+		this.eventBus = eventBus;
+		this.queue = queue;
+		this.operationIndex = operationIndex;
+	}
+	startup() {
+		this.unsubscribe = this.eventBus.subscribe(ReactorEventTypes.JOB_WRITE_READY, async (_type, event) => this.onWriteReady(event));
+	}
+	shutdown() {
+		this.unsubscribe?.();
+		this.unsubscribe = void 0;
+	}
+	async onWriteReady(event) {
+		const changed = /* @__PURE__ */ new Map();
+		for (const { operation, context } of event.operations) {
+			if (context.documentType !== groupDocumentType || context.scope !== "global" || !groupMembershipActionTypes.includes(operation.action.type)) continue;
+			const existing = changed.get(context.documentId);
+			if (existing === void 0 || Date.parse(operation.timestampUtcMs) < Date.parse(existing)) changed.set(context.documentId, operation.timestampUtcMs);
+		}
+		if (changed.size === 0) return;
+		const affected = /* @__PURE__ */ new Map();
+		for (const [groupId, timestamp] of changed) {
+			let referencers;
+			try {
+				referencers = await this.operationIndex.getGroupReferencers(groupId);
+			} catch (error) {
+				this.logger.error("Failed to resolve referencers of group @groupId: @error", groupId, error);
+				continue;
+			}
+			for (const documentId of referencers) {
+				const existing = affected.get(documentId);
+				if (existing === void 0 || Date.parse(timestamp) < Date.parse(existing)) affected.set(documentId, timestamp);
+			}
+		}
+		for (const [documentId, timestamp] of affected) {
+			const jobId = v4();
+			const job = {
+				id: jobId,
+				kind: "reevaluation",
+				documentId,
+				scope: "global",
+				branch: "main",
+				actions: [],
+				operations: [],
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				queueHint: [],
+				maxRetries: 3,
+				errorHistory: [],
+				meta: {
+					...buildSingleJobMeta(jobId),
+					triggerTimestampUtcMs: timestamp
+				}
+			};
+			try {
+				await this.queue.enqueue(job);
+			} catch (error) {
+				this.logger.error("Failed to enqueue re-evaluation of @documentId: @error", documentId, error);
+			}
+		}
+	}
+};
+//#endregion
 //#region src/sync/types.ts
 let ChannelScheme = /* @__PURE__ */ function(ChannelScheme) {
 	ChannelScheme["CONNECT"] = "connect";
@@ -3437,11 +4087,18 @@ var PollingChannelError = class extends Error {
 var ChannelError = class extends Error {
 	source;
 	error;
-	constructor(source, error) {
+	/**
+	* The classification when something other than the error carries it. Absent
+	* means derive it from `error.name`; a dead letter mirrored from a peer sets it,
+	* because only the message crosses the wire.
+	*/
+	errorType;
+	constructor(source, error, errorType) {
 		super(`ChannelError[${source}]: ${error.message}`);
 		this.name = "ChannelError";
 		this.source = source;
 		this.error = error;
+		this.errorType = errorType;
 	}
 };
 //#endregion
@@ -3646,6 +4303,7 @@ function toOperationWithContext(entry) {
 			skip: entry.skip,
 			hash: entry.hash,
 			timestampUtcMs: entry.timestampUtcMs,
+			deniedReason: entry.deniedReason,
 			action: entry.action
 		},
 		context: {
@@ -3811,6 +4469,33 @@ function splitComponent(items, maxSize) {
 	for (let i = 0; i < sorted.length; i += maxSize) chunks.push(sorted.slice(i, i + maxSize));
 	return chunks;
 }
+/**
+* Classifies a failure by error name rather than `instanceof`, because a failure
+* that crossed the pooled-worker boundary arrives as plain data.
+*/
+function classifyJobFailure(errorName) {
+	switch (errorName) {
+		case "AuthTimestampNotMonotonicError": return "AUTH_TIMESTAMP_NOT_MONOTONIC";
+		case "InvalidOperationTimestampError": return "INVALID_TIMESTAMP";
+		case "ExcessiveReshuffleError": return "EXCESSIVE_SHUFFLE";
+		case "InvalidSignatureError": return "SIGNATURE_INVALID";
+		case "HashMismatchError": return "HASH_MISMATCH";
+		default: return "UNCLASSIFIED";
+	}
+}
+/** The explicit type when something else carried it, else derived by name. */
+function syncOperationErrorType(error) {
+	return error?.errorType ?? classifyJobFailure(error?.error?.name ?? "Error");
+}
+/** Dead-letter types that must not stop the document syncing. */
+const NON_QUARANTINING_ERROR_TYPES = new Set(["AUTH_TIMESTAMP_NOT_MONOTONIC"]);
+/**
+* A held auth operation must not quarantine: reconciling the two policies needs
+* the traffic a quarantine would stop.
+*/
+function quarantinesDocument(errorType) {
+	return !NON_QUARANTINING_ERROR_TYPES.has(errorType);
+}
 //#endregion
 //#region src/sync/channels/interval-poll-timer.ts
 const DEFAULT_CONFIG = {
@@ -3973,6 +4658,7 @@ function serializeEnvelope(envelope) {
 				hash: opWithContext.operation.hash,
 				skip: opWithContext.operation.skip,
 				error: opWithContext.operation.error,
+				...opWithContext.operation.deniedReason !== void 0 ? { deniedReason: opWithContext.operation.deniedReason } : {},
 				id: opWithContext.operation.id,
 				action: serializeAction(opWithContext.operation.action)
 			},
@@ -4000,21 +4686,33 @@ function deserializeSignature(sig) {
 	return sig.split(", ");
 }
 /**
-* Deserializes signatures in an operation's signer context from strings back to tuples.
-*
-* When operations are transported via GraphQL, signatures are serialized as comma-separated
-* strings. This function restores them to the Signature tuple format required for verification.
+* `isDenied` tests strictly against undefined, so a null left in place would mark
+* every synced operation denied. The key is removed rather than set to undefined,
+* so an operation that arrived without it stays identical to the one sent.
 */
-function deserializeOperationSignatures(opWithContext) {
-	const signer = opWithContext.operation.action.context?.signer;
-	if (!signer?.signatures || signer.signatures.length === 0) return opWithContext;
+function normalizeAbsentFields(operation) {
+	const wire = operation;
+	if (wire.error !== null && wire.deniedReason !== null) return operation;
+	const normalized = { ...operation };
+	if (wire.error === null) delete normalized.error;
+	if (wire.deniedReason === null) delete normalized.deniedReason;
+	return normalized;
+}
+/** Restores signature tuples and null-valued optional fields to undefined. */
+function deserializeOperation(opWithContext) {
+	const operation = normalizeAbsentFields(opWithContext.operation);
+	const signer = operation.action.context?.signer;
+	if (!signer?.signatures || signer.signatures.length === 0) return {
+		...opWithContext,
+		operation
+	};
 	const deserializedSignatures = signer.signatures.map(deserializeSignature);
 	const deserializedOperation = {
-		...opWithContext.operation,
+		...operation,
 		action: {
-			...opWithContext.operation.action,
+			...operation.action,
 			context: {
-				...opWithContext.operation.action.context,
+				...operation.action.context,
 				signer: {
 					...signer,
 					signatures: deserializedSignatures
@@ -4041,7 +4739,7 @@ function deserializeOperationSignatures(opWithContext) {
 */
 function envelopesToSyncOperations(envelope, remoteName) {
 	if (!envelope.operations || envelope.operations.length === 0) return [];
-	return batchOperationsByDocument(envelope.operations.map(deserializeOperationSignatures)).map((batch) => {
+	return batchOperationsByDocument(envelope.operations.map(deserializeOperation)).map((batch) => {
 		return new SyncOperation(`syncop-${envelope.channelMeta.id}-${Date.now()}-${syncOpCounter++}`, envelope.key ?? "", (envelope.dependsOn ?? []).filter(Boolean), remoteName, batch.documentId, [batch.scope], batch.branch, batch.operations);
 	});
 }
@@ -4053,6 +4751,12 @@ const getLatestAppliedOrdinal = (syncOps) => {
 //#endregion
 //#region src/sync/channels/gql-req-channel.ts
 /**
+* Fields the auth projection added to the sync schema. A remote that predates
+* them rejects the whole query for naming one, so they are selected only while
+* the remote is known to serve them.
+*/
+const DECISION_FIELDS = ["deniedReason", "errorType"];
+/**
 * GraphQL-based synchronization channel for network communication between reactors.
 */
 var GqlRequestChannel = class {
@@ -4079,6 +4783,8 @@ var GqlRequestChannel = class {
 	isPushing = false;
 	pendingDrain = false;
 	receivingPages = false;
+	/** Cleared for good the first time the remote rejects {@link DECISION_FIELDS}. */
+	peerServesDecisionFields = true;
 	isRecovering = false;
 	connectionState = "connecting";
 	/** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -4257,7 +4963,7 @@ var GqlRequestChannel = class {
 		const syncOps = [];
 		for (const dl of deadLetters) {
 			const syncOp = new SyncOperation(crypto.randomUUID(), dl.jobId, [], this.remoteName, dl.documentId, dl.scopes, dl.branch, []);
-			syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, new Error(dl.error)));
+			syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, new Error(dl.error), dl.errorType ?? void 0));
 			syncOps.push(syncOp);
 		}
 		this.deadLetter.add(...syncOps);
@@ -4349,7 +5055,44 @@ var GqlRequestChannel = class {
 	* Queries the remote GraphQL endpoint for sync envelopes.
 	*/
 	async pollSyncEnvelopes(ackOrdinal, latestOrdinal) {
-		const query = `
+		const variables = {
+			channelId: this.channelId,
+			outboxAck: ackOrdinal,
+			outboxLatest: latestOrdinal
+		};
+		let response;
+		try {
+			response = await this.executeGraphQL(this.pollQuery(this.peerServesDecisionFields), variables);
+		} catch (error) {
+			if (!this.rejectsDecisionFields(error)) throw error;
+			this.logger.warn("Remote @channelId does not serve deniedReason/errorType; polling without them. The remote is on an older schema, so it has neither to report.", this.channelId);
+			this.peerServesDecisionFields = false;
+			response = await this.executeGraphQL(this.pollQuery(false), variables);
+		}
+		return {
+			envelopes: response.pollSyncEnvelopes.envelopes,
+			ackOrdinal: response.pollSyncEnvelopes.ackOrdinal,
+			deadLetters: response.pollSyncEnvelopes.deadLetters ?? [],
+			hasMore: response.pollSyncEnvelopes.hasMore
+		};
+	}
+	/**
+	* True when the remote rejected the query for naming a field it does not
+	* have. Selecting an unknown field fails validation for the whole query, so
+	* an unhandled one takes the channel's polling down until the process
+	* restarts rather than degrading.
+	*/
+	rejectsDecisionFields(error) {
+		if (!this.peerServesDecisionFields) return false;
+		if (!(error instanceof GraphQLRequestError) || error.category !== "graphql") return false;
+		return DECISION_FIELDS.some((field) => error.message.includes(field));
+	}
+	/**
+	* The poll query. `withDecisionFields` selects the two fields added with the
+	* auth projection; a remote on the previous schema is polled without them.
+	*/
+	pollQuery(withDecisionFields) {
+		return `
       query PollSyncEnvelopes($channelId: String!, $outboxAck: Int!, $outboxLatest: Int!) {
         pollSyncEnvelopes(channelId: $channelId, outboxAck: $outboxAck, outboxLatest: $outboxLatest) {
           envelopes {
@@ -4364,6 +5107,7 @@ var GqlRequestChannel = class {
                 hash
                 skip
                 error
+                ${withDecisionFields ? "deniedReason" : ""}
                 id
                 action {
                   id
@@ -4407,6 +5151,7 @@ var GqlRequestChannel = class {
           deadLetters {
             documentId
             error
+            ${withDecisionFields ? "errorType" : ""}
             jobId
             branch
             scopes
@@ -4416,18 +5161,6 @@ var GqlRequestChannel = class {
         }
       }
     `;
-		const variables = {
-			channelId: this.channelId,
-			outboxAck: ackOrdinal,
-			outboxLatest: latestOrdinal
-		};
-		const response = await this.executeGraphQL(query, variables);
-		return {
-			envelopes: response.pollSyncEnvelopes.envelopes,
-			ackOrdinal: response.pollSyncEnvelopes.ackOrdinal,
-			deadLetters: response.pollSyncEnvelopes.deadLetters ?? [],
-			hasMore: response.pollSyncEnvelopes.hasMore
-		};
 	}
 	/**
 	* Registers or updates this channel on the remote server via GraphQL mutation.
@@ -4909,7 +5642,8 @@ function rowToDeadLetterRecord(row) {
 		branch: row.branch,
 		operations: row.operations,
 		errorSource: row.error_source,
-		errorMessage: row.error_message
+		errorMessage: row.error_message,
+		errorType: row.error_type ?? "UNCLASSIFIED"
 	};
 }
 function deadLetterRecordToRow(record) {
@@ -4923,7 +5657,8 @@ function deadLetterRecordToRow(record) {
 		branch: record.branch,
 		operations: JSON.stringify(record.operations),
 		error_source: record.errorSource,
-		error_message: record.errorMessage
+		error_message: record.errorMessage,
+		error_type: record.errorType
 	};
 }
 /**
@@ -4980,9 +5715,11 @@ var KyselySyncDeadLetterStorage = class {
 	}
 	async listQuarantinedDocumentIds(signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
-		const rows = await this.db.selectFrom("sync_dead_letters").select("document_id").distinct().execute();
+		const rows = await this.db.selectFrom("sync_dead_letters").select(["document_id", "error_type"]).distinct().execute();
 		if (signal?.aborted) throw new Error("Operation aborted");
-		return rows.map((row) => row.document_id);
+		const quarantined = /* @__PURE__ */ new Set();
+		for (const row of rows) if (quarantinesDocument(row.error_type ?? "UNCLASSIFIED")) quarantined.add(row.document_id);
+		return [...quarantined];
 	}
 };
 //#endregion
@@ -5655,7 +6392,8 @@ var SyncManager = class {
 		remote.channel.deadLetter.onAdded((syncOps) => {
 			for (const syncOp of syncOps) {
 				this.logger.error("Dead letter (@remote, @documentId, @jobId, @error, @dependencies)", remote.meta.name, syncOp.documentId, syncOp.jobId, syncOp.error?.message ?? "unknown", syncOp.jobDependencies);
-				this.quarantinedDocumentIds.add(syncOp.documentId);
+				const errorType = syncOperationErrorType(syncOp.error);
+				if (quarantinesDocument(errorType)) this.quarantinedDocumentIds.add(syncOp.documentId);
 				const record = {
 					id: syncOp.id,
 					jobId: syncOp.jobId,
@@ -5666,7 +6404,8 @@ var SyncManager = class {
 					branch: syncOp.branch,
 					operations: syncOp.operations,
 					errorSource: syncOp.error?.source ?? ChannelErrorSource.None,
-					errorMessage: syncOp.error?.error.message ?? "unknown"
+					errorMessage: syncOp.error?.error.message ?? "unknown",
+					errorType
 				};
 				this.deadLetterStorage.add(record).catch((err) => {
 					this.logger.error("Failed to persist dead letter (@id, @error)", record.id, err instanceof Error ? err.message : String(err));
@@ -5676,7 +6415,8 @@ var SyncManager = class {
 					jobId: record.jobId,
 					remoteName: record.remoteName,
 					documentId: record.documentId,
-					errorSource: record.errorSource
+					errorSource: record.errorSource,
+					errorType: record.errorType
 				}).catch(() => {});
 			}
 			const items = remote.channel.deadLetter.items;
@@ -5703,7 +6443,7 @@ var SyncManager = class {
 		const syncOps = [];
 		for (const record of records) {
 			const syncOp = new SyncOperation(record.id, record.jobId, record.jobDependencies, record.remoteName, record.documentId, record.scopes, record.branch, record.operations);
-			syncOp.failed(new ChannelError(record.errorSource, new Error(record.errorMessage)));
+			syncOp.failed(new ChannelError(record.errorSource, new Error(record.errorMessage), record.errorType));
 			syncOps.push(syncOp);
 		}
 		remote.channel.deadLetter.add(...syncOps);
@@ -5784,8 +6524,7 @@ var SyncManager = class {
 		if (completedJobInfo.status === JobStatus.FAILED) {
 			const errorMessage = completedJobInfo.error?.message || "Unknown error";
 			this.logger.error("Failed to apply operations from inbox (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, completedJobInfo.id, errorMessage);
-			const error = new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${errorMessage}`));
-			syncOp.failed(error);
+			syncOp.failed(this.inboxFailure(completedJobInfo.error));
 			remote.channel.deadLetter.add(syncOp);
 		} else syncOp.executed();
 		remote.channel.inbox.remove(syncOp);
@@ -5862,14 +6601,26 @@ var SyncManager = class {
 			}
 			if (this.isShutdown) return;
 			if (completedJobInfo.status === JobStatus.FAILED) {
-				const errorMessage = completedJobInfo.error?.message || "Unknown error";
-				const channelError = new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${errorMessage}`));
-				syncOp.failed(channelError);
+				syncOp.failed(this.inboxFailure(completedJobInfo.error));
 				remote.channel.deadLetter.add(syncOp);
 			} else syncOp.executed();
 			remote.channel.inbox.remove(syncOp);
 		}
 	}
+	/**
+	* The dead letter for a load job the executor failed.
+	*
+	* The classification is passed explicitly because it cannot be recovered
+	* downstream: the wrapper carries the failure's message, not the failure, so
+	* deriving it from the wrapper's own name would classify every one of these
+	* as unclassified and quarantine the document. A held auth operation must
+	* keep syncing, because reconciling the two policies needs the traffic a
+	* quarantine would stop.
+	*/
+	inboxFailure(error) {
+		const message = error?.message || "Unknown error";
+		return new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
+	}
 	async updateOutbox(remote, ackOrdinal, mode = OutboxMode.Backfill, signal) {
 		const composedSignal = signal ? AbortSignal.any([signal, this.abortController.signal]) : this.abortController.signal;
 		let maxOrdinal = ackOrdinal;
@@ -6190,7 +6941,7 @@ var Reactor = class {
 			documentId: document.header.id,
 			model: document.header.documentType,
 			fromVersion: 0,
-			toVersion: document.state.document.version,
+			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 			initialState: document.state
 		})];
 		if (signer) actions = await signActions(actions, signer, signal);
@@ -6769,6 +7520,8 @@ var ReactorBuilder = class {
 	}
 	async buildModule() {
 		if (!this.logger) this.logger = new ConsoleLogger(["reactor"]);
+		const featureFlags = resolveFeatureFlags(this.executorConfig.featureFlags);
+		if (this.projectionShardConfig !== void 0 && this.readModelFactories.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModelFactory; projection workers cannot receive host-only factory dependencies");
 		const resolvedSources = await resolveModelSources(this.documentModelSources);
 		if (this.workerPool) {
 			if (resolvedSources.manifest.length === 0) throw new Error("withWorkerPool requires at least one worker-importable document-model source ({ filePath } or { packageName }).");
@@ -6826,7 +7579,7 @@ var ReactorBuilder = class {
 		await executorManager.start(executorStartCount);
 		const readModelInstances = Array.from(new Set([...this.readModels]));
 		const documentViewConsistencyTracker = new ConsistencyTracker();
-		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker);
+		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, featureFlags.documentDecisions);
 		try {
 			await documentView.init();
 		} catch (error) {
@@ -6852,6 +7605,7 @@ var ReactorBuilder = class {
 		}
 		for (const factory of this.readModelFactories) {
 			const readModel = await factory({
+				documentModelRegistry,
 				operationIndex,
 				writeCache,
 				processorManagerConsistencyTracker
@@ -6869,9 +7623,15 @@ var ReactorBuilder = class {
 			syncModule = this.syncBuilder.buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes);
 			await syncModule.syncManager.startup();
 		}
+		let groupReevaluationTrigger;
+		if (featureFlags.authGroups) {
+			groupReevaluationTrigger = new GroupReevaluationTrigger(this.logger, eventBus, queue, operationIndex);
+			groupReevaluationTrigger.startup();
+		}
 		const module = {
 			eventBus,
 			documentModelRegistry,
+			featureFlags,
 			queue,
 			jobTracker,
 			executorManager,
@@ -6890,6 +7650,7 @@ var ReactorBuilder = class {
 			processorManagerConsistencyTracker,
 			syncModule,
 			reactor,
+			groupReevaluationTrigger,
 			pools: this.instrumentedPools
 		};
 		if (this.signalHandlersEnabled) this.attachSignalHandlers(module);
@@ -6962,9 +7723,9 @@ var ReactorBuilder = class {
 	*/
 	async createDefaultWorkerFactory(numWorkers, db, signatureVerifier) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-B1w03nRA.js"),
+			import("./worker-handle-CrERzl8s.js"),
 			import("./transport-ByGviWdZ.js"),
-			import("./worker-DBJOv8Gp.js").then((n) => n.n)
+			import("./worker-sw2vjrd3.js").then((n) => n.n)
 		]);
 		const poolConfig = {
 			enabled: true,
@@ -6985,7 +7746,8 @@ var ReactorBuilder = class {
 					poolConfig,
 					db,
 					signatureVerifier,
-					models
+					models,
+					executorConfig: this.executorConfig
 				},
 				logger,
 				poolInstrumentation
@@ -7106,6 +7868,7 @@ var ReactorClientBuilder = class {
 	subscriptionManager;
 	jobAwaiter;
 	documentModelLoader;
+	readGate;
 	/**
 	* Sets the logger for the ReactorClient.
 	* @param logger - The logger to use.
@@ -7158,6 +7921,47 @@ var ReactorClientBuilder = class {
 		this.documentModelLoader = loader;
 		return this;
 	}
+	/**
+	* Overrides how reads are gated. A client built from a ReactorBuilder derives
+	* this from that reactor's flags; one built from `withReactor` cannot, because
+	* it is handed no flags and no registry, so it gates on the policy alone
+	* unless a gate is supplied here.
+	*/
+	withReadGate(readGate) {
+		this.readGate = readGate;
+		return this;
+	}
+	/**
+	* The gate the resolved model calls for. Below authEnforcement there is no
+	* model to enforce -- the registered one ignores the auth scope -- so the
+	* policy is evaluated on its own, which is what reads did before the model
+	* existed. Group serving turns on with authGroups, because below it a
+	* `{ group }` grant does not match, so a served roster is one no grant can
+	* use.
+	*/
+	resolveReadGate(reactorModule, documentView, model) {
+		if (!reactorModule || model === void 0) return new BareReadGate();
+		return new ModelReadGate(model, documentView, reactorModule.featureFlags.authGroups, reactorModule.operationIndex, this.logger);
+	}
+	/**
+	* What the client answers an authorization preflight from, or undefined when
+	* it answers none.
+	*
+	* Resolved from the same model reads enforce, so a preflight and a read can
+	* never decide against different models. Undefined below authEnforcement, and
+	* undefined on the `withReactor` path, where there are no flags and no
+	* registry to select a model with -- a client with no model refuses the
+	* preflight rather than answering it from the legacy host-side permission
+	* tables. Deliberately not derived from the read gate: `withReadGate`
+	* overrides that, so sniffing the gate's type would report enforcement from a
+	* caller's substitution.
+	*/
+	resolveActionEvaluation(reactorModule, model) {
+		return reactorModule && model ? {
+			model,
+			flags: reactorModule.featureFlags
+		} : void 0;
+	}
 	async build() {
 		return (await this.buildModule()).client;
 	}
@@ -7186,8 +7990,9 @@ var ReactorClientBuilder = class {
 		const signer = this.signer ?? new PassthroughSigner();
 		const subscriptionManager = this.subscriptionManager ?? reactorModule?.subscriptionManager ?? new ReactorSubscriptionManager(new DefaultSubscriptionErrorHandler());
 		const jobAwaiter = this.jobAwaiter ?? new JobAwaiter(eventBus, (jobId, signal) => reactor.getJobStatus(jobId, signal));
+		const decisionModel = reactorModule ? readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry) : void 0;
 		return {
-			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView),
+			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, this.readGate ?? this.resolveReadGate(reactorModule, documentView, decisionModel), this.resolveActionEvaluation(reactorModule, decisionModel)),
 			reactor,
 			eventBus,
 			documentIndexer,
@@ -7225,6 +8030,43 @@ function driveIdFromUrl(url) {
 	return url.split("/").pop() ?? "";
 }
 //#endregion
+//#region src/decision/stream-order.ts
+/**
+* The first pair of effective operations whose stored order contradicts their
+* timestamps, or undefined when the stream is in position order.
+*
+* Such a stream cannot be walked, and the auth stream is never reshuffled once
+* the monotonic rule is on, so run this before enabling enforcement on a fleet.
+*
+* `requireStrict` additionally rejects a tie, which is what the auth stream's
+* monotonic rule requires and what the walk alone does not care about.
+*/
+function firstOutOfOrderPair(operations, options) {
+	const requireStrict = options?.requireStrict ?? false;
+	const effective = garbageCollect(sortOperations([...operations]));
+	for (let i = 1; i < effective.length; i++) {
+		const previous = effective[i - 1];
+		const current = effective[i];
+		const previousAt = Date.parse(previous.timestampUtcMs);
+		const currentAt = Date.parse(current.timestampUtcMs);
+		if (currentAt < previousAt) return {
+			previous,
+			current,
+			kind: "descending"
+		};
+		if (requireStrict && currentAt === previousAt) return {
+			previous,
+			current,
+			kind: "tied"
+		};
+	}
+}
+//#endregion
+//#region src/read-models/interfaces.ts
+function supportsLiveReadModelRegistration(coordinator) {
+	return "addReadModel" in coordinator && typeof coordinator.addReadModel === "function";
+}
+//#endregion
 //#region src/admin/passthrough-keyframe-store.ts
 const passthroughKeyframeStore = {
 	putKeyframe: () => Promise.resolve(),
@@ -7250,6 +8092,7 @@ var DocumentIntegrityService = class {
 	async validateDocument(documentId, branch = "main", signal) {
 		const keyframeIssues = [];
 		const snapshotIssues = [];
+		const streamOrderIssues = await this.findStreamOrderIssues(documentId, branch, signal);
 		const replayCache = new KyselyWriteCache(passthroughKeyframeStore, this.operationStore, this.documentModelRegistry, {
 			maxDocuments: 1,
 			ringBufferSize: 1,
@@ -7276,9 +8119,10 @@ var DocumentIntegrityService = class {
 		} catch {
 			return {
 				documentId,
-				isConsistent: keyframeIssues.length === 0,
+				isConsistent: keyframeIssues.length === 0 && streamOrderIssues.length === 0,
 				keyframeIssues,
-				snapshotIssues
+				snapshotIssues,
+				streamOrderIssues
 			};
 		}
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
@@ -7304,9 +8148,10 @@ var DocumentIntegrityService = class {
 		}
 		return {
 			documentId,
-			isConsistent: keyframeIssues.length === 0 && snapshotIssues.length === 0,
+			isConsistent: keyframeIssues.length === 0 && snapshotIssues.length === 0 && streamOrderIssues.length === 0,
 			keyframeIssues,
-			snapshotIssues
+			snapshotIssues,
+			streamOrderIssues
 		};
 	}
 	async rebuildKeyframes(documentId, branch = "main", signal) {
@@ -7328,12 +8173,26 @@ var DocumentIntegrityService = class {
 			scopesInvalidated: scopes.length
 		};
 	}
+	async findStreamOrderIssues(documentId, branch, signal) {
+		const scopes = await this.discoverScopes(documentId, branch, signal);
+		const issues = [];
+		for (const scope of scopes) {
+			throwIfAborted(signal);
+			const pair = firstOutOfOrderPair((await this.operationStore.getSince(documentId, scope, branch, -1, void 0, void 0, signal)).results, { requireStrict: scope === "auth" });
+			if (pair !== void 0) issues.push({
+				scope,
+				branch,
+				...pair
+			});
+		}
+		return issues;
+	}
 	async discoverScopes(documentId, branch, signal) {
 		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
 		return Object.keys(revisions.revision);
 	}
 };
 //#endregion
-export { BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RevisionMismatchError, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncStatus, SyncStatusTracker, addRelationshipAction, batchOperationsByDocument, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, deleteDocumentAction, documentActions, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, removeRelationshipAction, runMigrations, sanitizeArg, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 
 //# sourceMappingURL=index.js.map