@powerhousedao/reactor 6.2.2-dev.50 → 6.2.2-dev.52

package/dist/entry.js

@@ -1,6 +1,6 @@
-import { o as instrumentPgPool } from "./drive-container-types-BoY5t12r.js";
+import { o as instrumentPgPool } from "./drive-container-types-RZa1wukO.js";
 import { n as errorToInfo, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { n as defaultLoadFactory, t as buildWorkerExecutor } from "./build-worker-executor-CkuJGUlJ.js";
+import { n as defaultLoadFactory, t as buildWorkerExecutor } from "./build-worker-executor-NT9b3rNm.js";
 import { ConsoleLogger } from "document-model";
 import { isMainThread, parentPort } from "node:worker_threads";
 //#region src/executor/worker/run-worker.ts

package/dist/index.d.ts

@@ -1659,6 +1659,104 @@ interface IReactorSubscriptionManager {
   onRelationshipChanged(callback: (parentId: string, childId: string, changeType: RelationshipChangeType) => void, search?: SearchFilter): () => void;
 }
 //#endregion
+//#region src/decision/types.d.ts
+/** One operation stream. */
+type StreamQuery = {
+  documentId: string;
+  branch: string;
+  scope: string;
+};
+/**
+ * What building a decision model reads a stream's state through.
+ *
+ * `IWriteCache` satisfies this and is what the write paths pass. The read path
+ * cannot: the write cache is a write-side projection invalidated by the process
+ * that runs the executor, so a reactor whose executors live in worker processes
+ * holds state in its parent that no commit ever invalidates. A read there would
+ * decide against a policy arbitrarily far behind the one the write paths
+ * enforce. Reads therefore pass a reader backed by the read side.
+ */
+interface IStreamStateReader {
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+}
+/** The document and branch a decision model is built for. */
+type DecisionTarget = {
+  documentId: string;
+  branch: string;
+};
+/**
+ * What a decision's conditions may read beyond the projections: the executing
+ * scope's own state and the attempted action's input. Populated only while
+ * authConditions is on; otherwise both stay undefined and conditional grants
+ * never apply.
+ */
+type DecisionContext = {
+  scopeState: unknown;
+  actionInput?: unknown;
+};
+/** A statically-queried stream's operations, named after its projection. */
+type StreamHistory = {
+  name: string;
+  operations: Operation[];
+};
+/**
+ * A named stream whose value in the model is that scope's state from the
+ * document rebuild the reactor already performs. A derived query may read
+ * only statically-queried projections, so composition is one layer deep.
+ */
+type Projection<M> = {
+  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
+  /**
+   * For a derived projection, the streams it may read anywhere in an
+   * evaluated range, derived from the statically-queried streams' operations
+   * (including the operations under evaluation). A positional walk cannot use
+   * `query`, because the folded state it depends on changes over the range;
+   * this over-approximates by design, since a stream referenced at any
+   * position stays readable when the earlier range is re-evaluated even if a
+   * later operation removes the reference. Ignored on static projections.
+   */
+  queryOverHistory?: (reads: StreamHistory[]) => StreamQuery[];
+  /**
+   * Action types in this stream that can change an evaluation. Reads of the stream
+   * are filtered to these, so anything left out is invisible to a decision.
+   */
+  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
+  apply: (document: PHDocument, operation: Operation) => PHDocument;
+};
+/**
+ * The outcome of evaluating one operation. A refusal carries the reason it is
+ * recorded with, because a model has more than one way to refuse.
+ */
+type Evaluation = {
+  decision: "allow";
+} | {
+  decision: "deny";
+  reason: string;
+};
+/** Projections plus a decision function over the built model. */
+type DecisionModel<M> = {
+  projections: { [K in keyof M]: Projection<M> };
+  /**
+   * Present when decide reads the executing scope's state through the
+   * decision context. A positional walk then folds the evaluated stream with
+   * this, from its base state through every effective operation, so
+   * conditions read the state as it stood at each operation's position
+   * rather than at the head.
+   */
+  foldEvaluatedScope?: (document: PHDocument, operation: Operation) => PHDocument;
+  /**
+   * Whether or not this model decides about operations in a given scope. That
+   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
+   */
+  evaluatesScope(scope: string): boolean;
+  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
+};
+/** A built model plus the read-set condition recording what the build read. */
+type BuiltDecisionModel<M> = {
+  model: M;
+  appendCondition: AppendCondition;
+};
+//#endregion
 //#region src/client/types.d.ts
 /**
  * Describes the types of document changes that can occur.
@@ -1766,6 +1864,33 @@ interface IDriveClient {
    */
   listNodes(driveIdentifier: string, parentFolder?: string | null, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Node>>;
 }
+/**
+ * One operation an authorization preflight predicts a verdict for. The input is
+ * what a conditional grant reads, so a candidate standing for a filled-in form
+ * carries that form's input.
+ */
+type ActionCandidate = {
+  scope: string;
+  type: string;
+  input?: unknown;
+};
+/**
+ * The predicted verdicts for a set of candidates, in the order they were given,
+ * with the aggregates a UI branches on.
+ *
+ * The aggregates are redundant -- a verdict is binary, so `allDenied` is
+ * `!anyAllowed` and `anyDenied` is `!allAllowed` -- and all four are returned
+ * so that a caller reads the one its question is phrased in rather than
+ * negating another. Over no candidates every aggregate is false: nothing is
+ * allowed and nothing is denied.
+ */
+type ActionEvaluations = {
+  evaluations: Evaluation[];
+  allAllowed: boolean;
+  anyAllowed: boolean;
+  allDenied: boolean;
+  anyDenied: boolean;
+};
 /**
  * The ReactorClient interface that wraps lower-level APIs to provide
  * a simpler interface for document operations.
@@ -1860,6 +1985,44 @@ interface IReactorClient {
    * @returns List of documents matching criteria and pagination cursor
    */
   find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Predicts whether the subject would be admitted to execute each of a set of
+   * candidate operations, without submitting any of them. A UI asks this to
+   * disable a control rather than offer an action that fails on submit.
+   *
+   * The answer is a prediction, not a promise. Three caveats hold:
+   *
+   * - Real admission compiles an append condition over everything it read and
+   *   the store enforces it at write time. A preflight reads no future, so a
+   *   policy change landing between this answer and the submit changes the
+   *   verdict. The submit path stays the only authority.
+   * - The verdict is evaluated at the stream heads. It is therefore correct for
+   *   a candidate that will be stamped at or after every timestamp the
+   *   evaluation read, which is the normal case for a control the user is about
+   *   to click. A backdated submission is out of contract: the reactor decides
+   *   that one by position, against the policy as it stood there.
+   * - A candidate whose input decides the verdict needs that input supplied.
+   *   With `authConditions` on, a conditional grant reads `action.input`, so
+   *   omitting the input predicts the denial an empty input would earn rather
+   *   than the verdict the filled-in form will get.
+   *
+   * Document-scope candidates are decided against the policy of the document
+   * their input names, not the one passed here: delete and upgrade name it in
+   * `input.documentId`, and the relationship actions in `input.sourceId`. This
+   * follows the executor's own gate, which decides against the document
+   * guarding the write. `CREATE_DOCUMENT` follows the gate's exemption: it runs
+   * before its document exists, so the executor never decides it against a
+   * policy and the preflight predicts allow.
+   *
+   * @param documentIdentifier - Document "id" or "slug" the candidates target
+   * @param branch - Branch to evaluate against
+   * @param candidates - Operations to predict a verdict for, each with the scope it would execute in
+   * @param subject - Optional subject to decide for, defaulting to the client's own signer. A plain subject rather than a ViewFilter: the evaluation reads no view, so a filter's branch or scopes would be silently ignored here
+   * @param signal - Optional abort signal to cancel the request
+   * @returns One evaluation per candidate, in the order given, with the aggregates over them
+   * @throws AuthEnforcementDisabledError if the reactor's authEnforcement flag is off, in which case it holds no decision model and the legacy host-table permission system cannot answer for one
+   */
+  evaluateActions(documentIdentifier: string, branch: string, candidates: ActionCandidate[], subject?: AuthSubject, signal?: AbortSignal): Promise<ActionEvaluations>;
   /**
    * Creates a document and waits for completion
    *
@@ -3220,104 +3383,6 @@ type ExecutorManagerStatus = {
   totalJobsProcessed: number;
 };
 //#endregion
-//#region src/decision/types.d.ts
-/** One operation stream. */
-type StreamQuery = {
-  documentId: string;
-  branch: string;
-  scope: string;
-};
-/**
- * What building a decision model reads a stream's state through.
- *
- * `IWriteCache` satisfies this and is what the write paths pass. The read path
- * cannot: the write cache is a write-side projection invalidated by the process
- * that runs the executor, so a reactor whose executors live in worker processes
- * holds state in its parent that no commit ever invalidates. A read there would
- * decide against a policy arbitrarily far behind the one the write paths
- * enforce. Reads therefore pass a reader backed by the read side.
- */
-interface IStreamStateReader {
-  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
-}
-/** The document and branch a decision model is built for. */
-type DecisionTarget = {
-  documentId: string;
-  branch: string;
-};
-/**
- * What a decision's conditions may read beyond the projections: the executing
- * scope's own state and the attempted action's input. Populated only while
- * authConditions is on; otherwise both stay undefined and conditional grants
- * never apply.
- */
-type DecisionContext = {
-  scopeState: unknown;
-  actionInput?: unknown;
-};
-/** A statically-queried stream's operations, named after its projection. */
-type StreamHistory = {
-  name: string;
-  operations: Operation[];
-};
-/**
- * A named stream whose value in the model is that scope's state from the
- * document rebuild the reactor already performs. A derived query may read
- * only statically-queried projections, so composition is one layer deep.
- */
-type Projection<M> = {
-  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
-  /**
-   * For a derived projection, the streams it may read anywhere in an
-   * evaluated range, derived from the statically-queried streams' operations
-   * (including the operations under evaluation). A positional walk cannot use
-   * `query`, because the folded state it depends on changes over the range;
-   * this over-approximates by design, since a stream referenced at any
-   * position stays readable when the earlier range is re-evaluated even if a
-   * later operation removes the reference. Ignored on static projections.
-   */
-  queryOverHistory?: (reads: StreamHistory[]) => StreamQuery[];
-  /**
-   * Action types in this stream that can change an evaluation. Reads of the stream
-   * are filtered to these, so anything left out is invisible to a decision.
-   */
-  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
-  apply: (document: PHDocument, operation: Operation) => PHDocument;
-};
-/**
- * The outcome of evaluating one operation. A refusal carries the reason it is
- * recorded with, because a model has more than one way to refuse.
- */
-type Evaluation = {
-  decision: "allow";
-} | {
-  decision: "deny";
-  reason: string;
-};
-/** Projections plus a decision function over the built model. */
-type DecisionModel<M> = {
-  projections: { [K in keyof M]: Projection<M> };
-  /**
-   * Present when decide reads the executing scope's state through the
-   * decision context. A positional walk then folds the evaluated stream with
-   * this, from its base state through every effective operation, so
-   * conditions read the state as it stood at each operation's position
-   * rather than at the head.
-   */
-  foldEvaluatedScope?: (document: PHDocument, operation: Operation) => PHDocument;
-  /**
-   * Whether or not this model decides about operations in a given scope. That
-   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
-   */
-  evaluatesScope(scope: string): boolean;
-  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
-};
-/** A built model plus the read-set condition recording what the build read. */
-type BuiltDecisionModel<M> = {
-  model: M;
-  appendCondition: AppendCondition;
-};
-//#endregion
 //#region src/decision/document-decision-model.d.ts
 /** What the document decision model reads: the target's document scope. */
 type DocumentDecisionModel = {
@@ -3406,6 +3471,31 @@ declare function readDecisionModel(flags: ReactorFeatureFlags, registry: IDocume
 declare class BareReadGate implements IReadGate {
   scopePredicate(document: PHDocument, subject: AuthSubject): Promise<(scope: string) => boolean>;
 }
+/**
+ * Answers a stream read from the document already fetched, and anything else
+ * through the read side.
+ *
+ * The seed is why routing reads through a decision model costs no extra I/O for
+ * the document being read: its `document` and `auth` scopes are the two static
+ * projections, and the caller has both in hand. Only a group stream the grant
+ * list names is fetched.
+ */
+declare class SeededStateReader implements IStreamStateReader {
+  private readonly documentView;
+  private readonly seed;
+  private readonly branch;
+  constructor(documentView: IDocumentView, seed: PHDocument, branch: string);
+  /**
+   * A stream this replica does not hold has to reach buildDecisionModel as the
+   * absence it recognises, or the whole read fails instead of leaving the group
+   * out of the model, where its principal does not match and the policy fails
+   * closed. The read side reports absence as a plain Error, so the absence is
+   * confirmed rather than inferred from the message: a transient failure must
+   * surface, not silently deny.
+   */
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  private assertAbsent;
+}
 /**
  * Evaluates a read against the registered decision model, built at the stream
  * heads. This is what makes `{ group }` principals and conditional grants apply
@@ -3499,6 +3589,21 @@ declare class ModelReadGate implements IReadGate {
 }
 //#endregion
 //#region src/client/reactor-client.d.ts
+/**
+ * What {@link IReactorClient.evaluateActions} decides against: the decision
+ * model this reactor enforces, and the flags that selected it.
+ *
+ * Both, because neither alone is enough. The flags say which of the model's
+ * inputs a decision may read, and the model itself cannot be derived from them
+ * here: selecting one needs the document model registry, which a client does not
+ * hold. Absent, this client answers no preflight at all -- which is the whole of
+ * the non-coexistence guarantee, since a client built without a reactor holding
+ * a decision model has nothing to answer from.
+ */
+type ActionEvaluationConfig = {
+  model: RegisteredDecisionModel;
+  flags: ReactorFeatureFlags;
+};
 /**
  * ReactorClient implementation that wraps lower-level APIs to provide
  * a simpler interface for document operations.
@@ -3518,8 +3623,9 @@ declare class ReactorClient implements IReactorClient {
   private documentIndexer;
   private documentView;
   private readGate;
+  private actionEvaluation;
   readonly drives: IDriveClient;
-  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView, readGate?: IReadGate);
+  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView, readGate?: IReadGate, actionEvaluation?: ActionEvaluationConfig);
   private readSubject;
   /**
    * Which scopes of one document the subject may read. Resolved once per
@@ -3580,6 +3686,37 @@ declare class ReactorClient implements IReactorClient {
    * Filters documents by criteria and returns a list of them
    */
   find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Predicts the admission verdict for each candidate. See
+   * {@link IReactorClient.evaluateActions} for the contract and its caveats.
+   *
+   * Read-only throughout, and never through the write cache: that cache is
+   * invalidated by whichever process runs the executor, so a reactor running
+   * its executors in worker processes would answer here from state no commit
+   * ever invalidates.
+   */
+  evaluateActions(documentIdentifier: string, branch: string, candidates: ActionCandidate[], subject?: AuthSubject, signal?: AbortSignal): Promise<ActionEvaluations>;
+  /**
+   * The decision model for one target document, built at its stream heads.
+   *
+   * The document is fetched unfiltered, because the policy is what decides:
+   * reading it through the read gate would withhold the very scopes the
+   * decision is about. A deleted document is served at its deletion boundary,
+   * which is what lets the model refuse an execute against it -- authEnforcement
+   * requires documentDecisions, so that read is available whenever this runs.
+   *
+   * Reading past the gate discloses nothing a submit does not. The `auth` and
+   * `document` scopes are readable by every holder, so a verdict resting on the
+   * policy alone is one the caller could compute unaided; and a verdict resting
+   * on a conditional grant reads the executing scope's state exactly as
+   * admission reads it, so the answer here is what submitting and being refused
+   * would have revealed anyway.
+   *
+   * The append condition the build records is dropped. It guards a write, and
+   * this makes none; reproducing it is also what the preflight cannot do, which
+   * is why the answer is a prediction.
+   */
+  private buildEvaluationTarget;
   /**
    * Creates a document and waits for completion
    */
@@ -5385,7 +5522,7 @@ declare class ReactorClientBuilder {
    */
   withReadGate(readGate: IReadGate): this;
   /**
-   * The gate this reactor's flags call for. Below authEnforcement there is no
+   * The gate the resolved model calls for. Below authEnforcement there is no
    * model to enforce -- the registered one ignores the auth scope -- so the
    * policy is evaluated on its own, which is what reads did before the model
    * existed. Group serving turns on with authGroups, because below it a
@@ -5393,6 +5530,20 @@ declare class ReactorClientBuilder {
    * use.
    */
   private resolveReadGate;
+  /**
+   * What the client answers an authorization preflight from, or undefined when
+   * it answers none.
+   *
+   * Resolved from the same model reads enforce, so a preflight and a read can
+   * never decide against different models. Undefined below authEnforcement, and
+   * undefined on the `withReactor` path, where there are no flags and no
+   * registry to select a model with -- a client with no model refuses the
+   * preflight rather than answering it from the legacy host-side permission
+   * tables. Deliberately not derived from the read gate: `withReadGate`
+   * overrides that, so sniffing the gate's type would report enforcement from a
+   * caller's substitution.
+   */
+  private resolveActionEvaluation;
   build(): Promise<ReactorClient>;
   buildModule(): Promise<InProcessReactorClientModule>;
 }
@@ -5465,6 +5616,28 @@ declare function parseDriveUrl(url: string): ParsedDriveUrl;
  */
 declare function driveIdFromUrl(url: string): string;
 //#endregion
+//#region src/shared/errors.d.ts
+/**
+ * An authorization preflight was asked for while the reactor's decision model
+ * is off, so there is no model to answer from.
+ *
+ * Thrown rather than answered from the legacy host-side permission tables. The
+ * two systems do not compose: the tables record which addresses a host lets
+ * near a drive, the policy records what a document's own grants permit, and an
+ * answer stitched from both would report an admission verdict neither system
+ * would reach. A caller that cannot get a prediction disables nothing, which
+ * leaves the submit path -- and its real gate -- as the only authority.
+ *
+ * Detection is by `name`, not `instanceof`: the SharedWorker RPC boundary
+ * rebuilds a thrown error from `{ name, message, stack, cause }` alone
+ * (`reactor-browser/src/rpc/error-info.ts`), so the class identity and any
+ * custom field are lost in transit. This error therefore carries no fields.
+ */
+declare class AuthEnforcementDisabledError extends Error {
+  constructor();
+  static isError(error: unknown): error is AuthEnforcementDisabledError;
+}
+//#endregion
 //#region src/shared/factories.d.ts
 /**
  * Factory method to create a ShutdownStatus that can be updated
@@ -6523,5 +6696,5 @@ declare class ProcessorManager extends BaseReadModel implements IProcessorManage
   private deleteProcessorCursors;
 }
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type AdmissionDecision, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, BareReadGate, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModelReadGate, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type ActionCandidate, type ActionEvaluationConfig, type ActionEvaluations, type AdmissionDecision, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModule, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModelReadGate, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, ReactorSubscriptionManager, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, type SanitizedArg, type SearchFilter, SeededStateReader, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 //# sourceMappingURL=index.d.ts.map