@powerhousedao/reactor 6.2.3-dev.22 → 6.2.3-dev.24

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-import { Action, AuthRequest, AuthSubject, CreateDocumentActionInput, DocumentModelModule, ISigner, Operation, OperationContext, OperationOutcome, OperationWithContext, OperationWithContext as OperationWithContext$1, PHAuthState, PHDocument, PHDocumentState, SignatureVerificationHandler, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
+import { Action, ActionSigner, AuthRequest, AuthSubject, CreateDocumentActionInput, DocumentModelModule, ISigner, Operation, OperationContext, OperationOutcome, OperationWithContext, OperationWithContext as OperationWithContext$1, PHAuthState, PHDocument, PHDocumentState, SignaturePolicy, SignatureVerificationHandler, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
 import { DocumentDriveDocument, DriveInput, FolderNode, Node } from "@powerhousedao/shared/document-drive";
 import { ILogger } from "document-model";
 import * as kysely from "kysely";
 import { Generated, Insertable, Kysely, Transaction } from "kysely";
-import { IProcessor, IProcessorHostModuleBase, IProcessorHostModuleBase as IProcessorHostModuleBase$1, IProcessorManager, IProcessorManager as IProcessorManager$1, IRelationalDb, ProcessorApp, ProcessorFactory, ProcessorFactory as ProcessorFactory$1, ProcessorFactoryBuilder, ProcessorFilter, ProcessorRecord, ProcessorStatus, RelationalDbProcessor, TrackedProcessor, TrackedProcessor as TrackedProcessor$1, createRelationalDb } from "@powerhousedao/shared/processors";
+import { IProcessor, IProcessorHostModuleBase, IProcessorHostModuleBase as IProcessorHostModuleBase$1, IProcessorManager, IProcessorManager as IProcessorManager$1, IRelationalDb, ProcessorApp, ProcessorFactory, ProcessorFactory as ProcessorFactory$1, ProcessorFactoryBuilder, ProcessorFilter, ProcessorRecord, ProcessorRecord as ProcessorRecord$1, ProcessorStatus, RelationalDbProcessor, TrackedProcessor, TrackedProcessor as TrackedProcessor$1, createRelationalDb } from "@powerhousedao/shared/processors";
 import { Pool } from "pg";
 
 //#region src/attachments/types.d.ts
@@ -784,6 +784,13 @@ interface IOperationStore {
    * timestamp, so a later timestamp can sit behind the last row.
    */
   getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
+  /**
+   * The subset of `opIds` stored anywhere in one stream, retracted rows
+   * included.
+   */
+  findOperationIds(documentId: string, scope: string, branch: string, opIds: string[], signal?: AbortSignal): Promise<Set<string>>;
+  /** The latest row of each of `opIds` stored in one stream. */
+  getOperationsByIds(documentId: string, scope: string, branch: string, opIds: string[], signal?: AbortSignal): Promise<Operation[]>;
 }
 /**
  * Stores periodic document snapshots (keyframes) so that document state
@@ -1332,6 +1339,8 @@ interface IOperationIndex {
    * reference other groups.
    */
   getGroupReferencers(groupId: string, signal?: AbortSignal): Promise<string[]>;
+  /** The latest ordinal of each of `opIds` indexed in one stream. */
+  getOrdinalsByOpIds(documentId: string, scope: string, branch: string, opIds: string[], signal?: AbortSignal): Promise<Map<string, number>>;
 }
 /**
  * Identifies the collection a remote synchronizes. Collections are drive-level
@@ -1524,2105 +1533,2188 @@ interface IWriteCache {
   shutdown(): Promise<void>;
 }
 //#endregion
-//#region src/events/types.d.ts
-/**
- * Describes a function to unsubscribe from an event.
- */
-type Unsubscribe = () => void;
-/**
- * A subscriber is a function that is called when an event is emitted.
- *
- * It is passed the event type and the data.
- * It can return a promise or a value.
- * If it returns a promise, the event bus will wait for the promise to resolve before calling the next subscriber.
- * If it throws an error, the event bus will reject with an aggregate error of all errors.
- *
- * @param type - The type of event to emit.
- * @param data - The data to pass to the subscriber.
- */
-type Subscriber = (type: number, data: any) => void | Promise<void>;
-/**
- * Custom error class that aggregates multiple errors from event subscribers.
- */
-declare class EventBusAggregateError extends Error {
-  readonly errors: any[];
-  constructor(errors: unknown[]);
+//#region src/cache/collection-membership-cache.d.ts
+interface ICollectionMembershipCache {
+  getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
+  invalidate(documentId: string): void;
 }
+//#endregion
+//#region src/cache/document-meta-cache-types.d.ts
 /**
- * Event types for reactor lifecycle events.
- */
-declare const ReactorEventTypes: {
-  readonly JOB_PENDING: 10001;
-  readonly JOB_RUNNING: 10002;
-  readonly JOB_WRITE_READY: 10003;
-  readonly JOB_READ_READY: 10004;
-  readonly JOB_FAILED: 10005;
-  readonly READMODEL_BATCH_COMPLETED: 10006;
-  readonly READMODEL_INDEXED: 10007;
-  readonly MODEL_LOADED: 10008;
-};
-/**
- * Stage within ReadModelCoordinator.runChain. Used as a dimension on
- * stage-attribution events and histograms.
- */
-type ReadModelStage = "pre_ready" | "emit" | "post_ready";
-/**
- * Stage in which an individual read model ran. The emit stage does not
- * involve a read model so it is excluded from this discriminant.
- */
-type ReadModelIndexingStage = "pre_ready" | "post_ready";
-/**
- * Emitted after the resolver loads a model on demand, so peers load it too.
- */
-type ModelLoadedEvent = {
-  documentType: string;
-};
-/**
- * Event emitted when a job is registered and waiting to be executed.
- */
-type JobPendingEvent = {
-  jobId: string;
-  jobMeta: JobMeta;
-};
-/**
- * Event emitted when a job starts executing.
- */
-type JobRunningEvent = {
-  jobId: string;
-  jobMeta: JobMeta;
-};
-/**
- * Event emitted when operations are written to IOperationStore.
- * Contains the operations directly to avoid round-trip queries.
+ * Cached document metadata from the "document" scope.
+ *
+ * This lightweight structure holds essential document information needed by
+ * the job executor without fetching full scope state. It provides an explicit
+ * cross-scope contract for accessing document scope metadata.
  */
-type JobWriteReadyEvent = {
-  jobId: string;
-  operations: OperationWithContext$1[];
-  jobMeta: JobMeta;
+type CachedDocumentMeta = {
   /**
-   * The ids of the actions the caller submitted with this job. `operations`
-   * can also carry operations the job merely moved into a new position, so a
-   * consumer reporting back to the caller needs this to tell the two apart.
-   * Absent on jobs that carry no submitted actions.
+   * The full PHDocumentState from document.state.document.
+   * Contains version, hash, isDeleted, deletedAtUtcIso, etc.
    */
-  submittedActionIds?: string[];
+  state: PHDocumentState;
   /**
-   * Maps documentId to the collection IDs it belongs to.
-   * Used by SyncManager to route operations only to remotes
-   * whose collection contains the document.
+   * The document type (from header), cached for convenience.
    */
-  collectionMemberships?: Record<string, string[]>;
+  documentType: string; /** From the CREATE_DOCUMENT input, which fixes them for the document's life. */
+  protocolVersions: {
+    [protocol: string]: number;
+  } | undefined;
+  /**
+   * The revision of the document scope when this metadata was captured.
+   * Used for cache invalidation and consistency checks.
+   */
+  documentScopeRevision: number;
 };
 /**
- * Event emitted after all read models have finished processing operations.
- * This event fires after JOB_WRITE_READY and guarantees that:
- * - All read models (DocumentView, DocumentIndexer, etc.) have indexed the operations
- * - All consistency trackers have been updated with the new operation indices
- * - Queries without consistency tokens will now see the updated data
+ * Interface for the document metadata cache.
  *
- * This event is useful for:
- * - Test synchronization (knowing when read models are ready)
- * - Observability (measuring read model latency)
- * - Event-driven workflows (triggering downstream processes)
- */
-type JobReadReadyEvent = {
-  jobId: string;
-  operations: OperationWithContext$1[];
-};
-/**
- * Event emitted when a job fails with an unrecoverable error.
- * This event allows the JobAwaiter and other subscribers to react to job failures
- * without polling.
- */
-type JobFailedEvent$1 = {
-  jobId: string;
-  error: Error;
-  job?: Job;
-};
-/**
- * Event emitted once per batch processed by ReadModelCoordinator.runChain,
- * after all three projection stages complete. Carries per-stage wall times,
- * the chain wait time, and the batch size so projection cost can be
- * attributed by an observer.
- */
-type ReadModelBatchCompletedEvent = {
-  jobId: string;
-  batchSize: number;
-  chainWaitDurationMs: number;
-  preReadyDurationMs: number;
-  emitDurationMs: number;
-  postReadyDurationMs: number;
-};
-/**
- * Event emitted once per individual read model per batch and stage, after
- * that read model's indexOperations call resolves (or rejects). Lets
- * observers attribute projection cost to a specific read model.
- */
-type ReadModelIndexedEvent = {
-  jobId: string;
-  readModelName: string;
-  stage: ReadModelIndexingStage;
-  durationMs: number;
-  operationCount: number;
-  success: boolean;
-};
-//#endregion
-//#region src/events/interfaces.d.ts
-/**
- * Describes an object that manages event subscriptions and emissions.
+ * This cache provides an explicit cross-scope contract for accessing document
+ * scope metadata. It solves the problem where job execution in one scope (e.g.,
+ * "global") needs access to document scope state (version, isDeleted, etc.)
+ * which may be stale in scope-specific caches or keyframes.
+ *
+ * The cache supports:
+ * - Latest metadata retrieval with LRU caching
+ * - Historical metadata reconstruction for reshuffling scenarios
+ * - Eager updates after document scope operations
  */
-interface IEventBus {
+interface IDocumentMetaCache {
   /**
-   * Register a new subscriber.
-   * Order is preserved by pushing to the end of the per-type array.
+   * Retrieves the LATEST document metadata from cache or rebuilds from operations.
    *
-   * @param type - The type of event to subscribe to.
-   * @param subscriber - The subscriber function to call when the event is emitted.
+   * On cache miss, fetches all document scope operations and reconstructs the
+   * current PHDocumentState by applying UPGRADE_DOCUMENT and DELETE_DOCUMENT
+   * operations.
    *
-   * @returns A function to unsubscribe from the event.
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The cached or rebuilt document metadata
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
    */
-  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
+  getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
   /**
-   * Emits an event and waits until **all** subscribers finish.
-   *  - Every subscriber present at emit-start is called, in registration order.
-   *  - Calls are invoked and settled sequentially.
-   *  - If subscribers throw/reject, `emit` rejects with an aggregate error of all errors.
+   * Rebuilds document metadata at a SPECIFIC revision (always rebuilds, no caching).
    *
-   * @param type - The type of event to emit.
-   * @param data - The data to pass to the subscribers.
+   * Used during reshuffling when operations need to be inserted at a previous
+   * revision and we need the document scope state as of that point in time.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param targetRevision - The document scope revision to reconstruct up to
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns Document metadata as of the target revision
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {Error} If document not found
    */
-  emit(type: number, data: any): Promise<void>;
-}
-//#endregion
-//#region src/shared/awaiter.d.ts
-interface IJobAwaiter {
+  rebuildAtRevision(documentId: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<CachedDocumentMeta>;
   /**
-   * Waits for a job to complete: turns a job into a promise.
+   * Eagerly updates cached metadata after document scope operations.
    *
-   * @param jobId - The job id or job object
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The result of the job
+   * Called by the job executor after CREATE_DOCUMENT, UPGRADE_DOCUMENT, or
+   * DELETE_DOCUMENT operations to keep the cache current.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Branch name
+   * @param meta - The new metadata to cache
    */
-  waitForJob(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
+  putDocumentMeta(documentId: string, branch: string, meta: CachedDocumentMeta): void;
   /**
-   * Shuts down the job awaiter. This will synchronously reject all pending jobs.
+   * Invalidates cached document metadata.
+   *
+   * Call before reshuffling operations that modify the document scope, or
+   * when document state may have changed externally.
+   *
+   * @param documentId - The document identifier
+   * @param branch - Optional branch to narrow invalidation (if omitted, all branches)
+   * @returns Number of entries invalidated
    */
-  shutdown(): void;
-}
-/**
- * Event-driven implementation of IJobAwaiter.
- * Subscribes to operation events to detect job completion without polling.
- */
-declare class JobAwaiter implements IJobAwaiter {
-  private eventBus;
-  private getJobStatus;
-  private pendingJobs;
-  private unsubscribers;
-  constructor(eventBus: IEventBus, getJobStatus: (jobId: string, signal?: AbortSignal) => Promise<JobInfo>);
-  private subscribeToEvents;
-  shutdown(): void;
-  waitForJob(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
-  private handleWriteReady;
-  private handleReadReady;
-  private handleJobFailed;
-  private checkAndResolveWaiters;
+  invalidate(documentId: string, branch?: string): number;
+  /**
+   * Clears all cached document metadata.
+   */
+  clear(): void;
+  /**
+   * Performs startup initialization.
+   */
+  startup(): Promise<void>;
+  /**
+   * Performs graceful shutdown.
+   */
+  shutdown(): Promise<void>;
 }
 //#endregion
-//#region src/subs/types.d.ts
+//#region src/storage/kysely/types.d.ts
+interface OperationTable {
+  id: Generated<number>;
+  jobId: string;
+  opId: string;
+  prevOpId: string;
+  writeTimestampUtcMs: Generated<Date>;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  timestampUtcMs: Date;
+  index: number;
+  action: unknown;
+  skip: number;
+  error?: string | null;
+  deniedReason?: string | null;
+  hash: string;
+}
+interface KeyframeTable {
+  id: Generated<number>;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  revision: number;
+  document: unknown;
+  createdAt: Generated<Date>;
+}
+interface DocumentCollectionTable {
+  documentId: string;
+  collectionId: string;
+  joinedOrdinal: bigint;
+  leftOrdinal: bigint | null;
+}
+interface OperationIndexOperationTable {
+  ordinal: Generated<number>;
+  opId: string;
+  documentId: string;
+  documentType: string;
+  scope: string;
+  branch: string;
+  timestampUtcMs: string;
+  writeTimestampUtcMs: Generated<Date>;
+  index: number;
+  skip: number;
+  hash: string;
+  action: unknown;
+  deniedReason?: string | null;
+  sourceRemote: Generated<string>;
+}
+interface SyncRemoteTable {
+  name: string;
+  collection_id: string;
+  channel_type: string;
+  channel_id: string;
+  remote_name: string;
+  channel_parameters: unknown;
+  filter_document_ids: unknown;
+  filter_scopes: unknown;
+  filter_branch: string;
+  push_state: string;
+  push_last_success_utc_ms: string | null;
+  push_last_failure_utc_ms: string | null;
+  push_failure_count: number;
+  pull_state: string;
+  pull_last_success_utc_ms: string | null;
+  pull_last_failure_utc_ms: string | null;
+  pull_failure_count: number;
+  bound_address: string | null;
+  created_at: Generated<Date>;
+  updated_at: Generated<Date>;
+}
+interface SyncCursorTable {
+  remote_name: string;
+  cursor_type: string;
+  cursor_ordinal: bigint;
+  last_synced_at_utc_ms: string | null;
+  updated_at: Generated<Date>;
+}
 /**
- * Error handler for subscription callback errors
+ * Kysely table definition for the `sync_dead_letters` table.
  */
-interface ISubscriptionErrorHandler {
-  /**
-   * Called when a subscription callback throws an error
-   * @param error - The error that was thrown
-   * @param context - Context about which subscription failed
-   */
-  handleError(error: unknown, context: SubscriptionErrorContext): void;
+interface SyncDeadLetterTable {
+  ordinal: Generated<number>;
+  id: string;
+  job_id: string;
+  job_dependencies: unknown;
+  remote_name: string;
+  document_id: string;
+  scopes: unknown;
+  branch: string;
+  operations: unknown;
+  error_source: string;
+  error_message: string;
+  error_type: Generated<string>;
+  created_at: Generated<Date>;
 }
 /**
- * Context information about a subscription error
+ * One (document, group) reference ever discovered from an auth operation's
+ * input. Rows are never updated or deleted (see migration 017).
  */
-interface SubscriptionErrorContext {
-  /** The type of event that was being processed */
-  eventType: "created" | "deleted" | "updated" | "relationshipChanged";
-  /** The subscription ID that failed */
-  subscriptionId: string;
-  /** Optional additional data about the event */
-  eventData?: unknown;
+interface GroupReferenceTable {
+  documentId: string;
+  groupId: string;
+}
+interface Database$1 {
+  Operation: OperationTable;
+  Keyframe: KeyframeTable;
+  document_collections: DocumentCollectionTable;
+  operation_index_operations: OperationIndexOperationTable;
+  group_references: GroupReferenceTable;
+  sync_remotes: SyncRemoteTable;
+  sync_cursors: SyncCursorTable;
+  sync_dead_letters: SyncDeadLetterTable;
+}
+interface DocumentTable {
+  id: string;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface DocumentRelationshipTable {
+  id: Generated<string>;
+  sourceId: string;
+  targetId: string;
+  relationshipType: string;
+  metadata: unknown;
+  createdAt: Generated<Date>;
+  updatedAt: Generated<Date>;
+}
+interface IndexerStateTable {
+  id: Generated<number>;
+  lastOperationId: number;
+  lastOperationTimestamp: Generated<Date>;
+}
+interface DocumentIndexerDatabase {
+  Document: DocumentTable;
+  DocumentRelationship: DocumentRelationshipTable;
+  IndexerState: IndexerStateTable;
 }
+//#endregion
+//#region src/core/model-sources.d.ts
+/** An importable file holding one or more document-model exports. */
+type FileModelSource = {
+  filePath: string;
+  exportName?: string;
+};
+/** An importable package specifier holding one or more document-model exports. */
+type PackageModelSource = {
+  packageName: string;
+  subpath?: string;
+  exportName?: string;
+};
 /**
- * Interface for subscribing to document events in the reactor.
+ * A source of document models: a live module, an importable file, or an
+ * importable package. File and package sources can cross a worker-thread
+ * boundary (workers re-import them); a live module cannot.
  */
-interface IReactorSubscriptionManager {
+type DocumentModelSource = DocumentModelModule<any> | FileModelSource | PackageModelSource;
+//#endregion
+//#region src/registry/interfaces.d.ts
+type RegistrationResult<T> = {
+  status: "success";
+  item: T;
+} | {
+  status: "error";
+  item: T;
+  error: Error;
+};
+/**
+ * Loader that asynchronously resolves a document type to a
+ * {@link DocumentModelSource}. Used by the queue to gate CREATE_DOCUMENT
+ * jobs until the required model is available in the registry.
+ *
+ * Return an importable source ({ filePath } or { packageName }) whenever
+ * possible: the resolver registers the resolved models on the host registry
+ * and broadcasts importable sources to executor workers. A live
+ * DocumentModelModule is also valid but host-only — it cannot cross a
+ * worker-thread boundary, so worker pools will not receive it.
+ */
+interface IDocumentModelLoader {
+  load(documentType: string): Promise<DocumentModelSource>;
+}
+/**
+ * Registry for managing document model modules.
+ * Provides centralized access to document models' reducers, utils, and specifications.
+ * Supports version-aware module storage and upgrade manifest management.
+ */
+interface IDocumentModelRegistry {
   /**
-   * Subscribes to document creation events
+   * Register multiple modules at once.
+   * Modules without a version field default to version 1.
+   * Invalid or duplicate modules are skipped without breaking registration of the remaining modules.
    *
-   * @param callback - Function called when documents are created
-   * @param search - Optional search filter to limit which documents trigger events
-   * @param view - Optional filter containing branch and scopes information
-   * @returns A function that unsubscribes from the events
+   * @param modules Document model modules to register
+   * @returns Array of results, one per module, indicating success or failure
    */
-  onDocumentCreated(callback: (result: PagedResults<string>) => void, search?: SearchFilter): () => void;
+  registerModules(...modules: DocumentModelModule<any>[]): RegistrationResult<DocumentModelModule<any>>[];
   /**
-   * Subscribes to document deletion events
+   * Unregister all versions of the specified document types.
    *
-   * @param callback - Function called when documents are deleted
-   * @param search - Optional search filter to limit which documents trigger events
-   * @returns A function that unsubscribes from the events
+   * @param documentTypes The document types to unregister
+   * @returns true if all modules were unregistered, false if any were not found
    */
-  onDocumentDeleted(callback: (documentIds: string[]) => void, search?: SearchFilter): () => void;
+  unregisterModules(...documentTypes: string[]): boolean;
   /**
-   * Subscribes to document state updates
+   * Get a specific document model module by document type and optional version.
+   * If version is not specified, returns the latest version.
    *
-   * @param callback - Function called when documents are updated
-   * @param search - Optional search filter to limit which documents trigger events
-   * @param view - Optional filter containing branch and scopes information
-   * @returns A function that unsubscribes from the events
+   * @param documentType The document type identifier
+   * @param version Optional version number to retrieve
+   * @returns The document model module
+   * @throws ModuleNotFoundError if the document type or version is not registered
    */
-  onDocumentStateUpdated(callback: (result: PagedResults<PHDocument>) => void, search?: SearchFilter, view?: ViewFilter): () => void;
+  getModule(documentType: string, version?: number): DocumentModelModule<any>;
   /**
-   * Subscribes to parent-child relationship change events
+   * Get all registered document model modules.
    *
-   * @param callback - Function called when parent-child relationships change
-   * @param search - Optional search filter to limit which documents trigger events
-   * @returns A function that unsubscribes from the events
+   * @returns Array of all registered modules
    */
-  onRelationshipChanged(callback: (parentId: string, childId: string, changeType: RelationshipChangeType) => void, search?: SearchFilter): () => void;
-}
-//#endregion
-//#region src/decision/types.d.ts
-/** One operation stream. */
-type StreamQuery = {
-  documentId: string;
-  branch: string;
-  scope: string;
-};
-/**
- * What building a decision model reads a stream's state through.
- *
- * `IWriteCache` satisfies this and is what the write paths pass. The read path
- * cannot: the write cache is a write-side projection invalidated by the process
- * that runs the executor, so a reactor whose executors live in worker processes
- * holds state in its parent that no commit ever invalidates. A read there would
- * decide against a policy arbitrarily far behind the one the write paths
- * enforce. Reads therefore pass a reader backed by the read side.
- */
-interface IStreamStateReader {
-  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
-}
-/** The document and branch a decision model is built for. */
-type DecisionTarget = {
-  documentId: string;
-  branch: string;
-};
-/**
- * What a decision's conditions may read beyond the projections: the executing
- * scope's own state and the attempted action's input. Populated only while
- * authConditions is on; otherwise both stay undefined and conditional grants
- * never apply.
- */
-type DecisionContext = {
-  scopeState: unknown;
-  actionInput?: unknown;
-};
-/** A statically-queried stream's operations, named after its projection. */
-type StreamHistory = {
-  name: string;
-  operations: Operation[];
-};
-/**
- * A named stream whose value in the model is that scope's state from the
- * document rebuild the reactor already performs. A derived query may read
- * only statically-queried projections, so composition is one layer deep.
- */
-type Projection<M> = {
-  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
-  /**
-   * For a derived projection, the streams it may read anywhere in an
-   * evaluated range, derived from the statically-queried streams' operations
-   * (including the operations under evaluation). A positional walk cannot use
-   * `query`, because the folded state it depends on changes over the range;
-   * this over-approximates by design, since a stream referenced at any
-   * position stays readable when the earlier range is re-evaluated even if a
-   * later operation removes the reference. Ignored on static projections.
-   */
-  queryOverHistory?: (reads: StreamHistory[]) => StreamQuery[];
-  /**
-   * Action types in this stream that can change an evaluation. Reads of the stream
-   * are filtered to these, so anything left out is invisible to a decision.
-   */
-  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
-  apply: (document: PHDocument, operation: Operation) => PHDocument;
-};
-/**
- * The outcome of evaluating one operation. A refusal carries the reason it is
- * recorded with, because a model has more than one way to refuse.
- */
-type Evaluation = {
-  decision: "allow";
-} | {
-  decision: "deny";
-  reason: string;
-};
-/** Projections plus a decision function over the built model. */
-type DecisionModel<M> = {
-  projections: { [K in keyof M]: Projection<M> };
-  /**
-   * Present when decide reads the executing scope's state through the
-   * decision context. A positional walk then folds the evaluated stream with
-   * this, from its base state through every effective operation, so
-   * conditions read the state as it stood at each operation's position
-   * rather than at the head.
-   */
-  foldEvaluatedScope?: (document: PHDocument, operation: Operation) => PHDocument;
+  getAllModules(): DocumentModelModule<any>[];
   /**
-   * Whether or not this model decides about operations in a given scope. That
-   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
+   * Clear all registered modules and upgrade manifests.
    */
-  evaluatesScope(scope: string): boolean;
-  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
-};
-/** A built model plus the read-set condition recording what the build read. */
-type BuiltDecisionModel<M> = {
-  model: M;
-  appendCondition: AppendCondition;
-};
-//#endregion
-//#region src/client/types.d.ts
-/**
- * Describes the types of document changes that can occur.
- */
-declare enum DocumentChangeType {
-  Created = "created",
-  Deleted = "deleted",
-  Updated = "updated",
-  ParentAdded = "parent_added",
-  ParentRemoved = "parent_removed",
-  ChildAdded = "child_added",
-  ChildRemoved = "child_removed"
-}
-/**
- * Represents a change event for documents.
- */
-type DocumentChangeEvent = {
-  type: DocumentChangeType;
-  documents: PHDocument[];
-  context?: {
-    parentId?: string;
-    childId?: string;
-  };
-};
-/**
- * Options for creating an empty document.
- */
-type CreateDocumentOptions = {
-  /** Optional "id" or "slug" of parent document */parentIdentifier?: string; /** Optional version of the document model to use (defaults to latest) */
-  documentModelVersion?: number;
-};
-/**
- * Options for upgrading a document.
- */
-type UpgradeDocumentOptions = {
+  clear(): void;
   /**
-   * How many times to retry with a fresh read when the executor rejects the
-   * upgrade because the document changed after it was read. Defaults to
-   * {@link DEFAULT_UPGRADE_CONFLICT_RETRIES}.
+   * Get all supported versions for a document type, sorted in ascending order.
+   *
+   * @param documentType The document type identifier
+   * @returns Array of version numbers sorted ascending
+   * @throws ModuleNotFoundError if no modules are registered for the document type
    */
-  maxConflictRetries?: number;
-};
-/**
- * Drive-aware operations grouped under `client.drives`.
- *
- * These methods orchestrate the multi-action, multi-document choreography
- * required to keep a drive's `state.global.nodes` array consistent with the
- * relationship index and the underlying documents. Use the flat
- * `IReactorClient` primitives (`get`, `execute`, `find`) for everything that
- * is not drive-aware.
- */
-interface IDriveClient {
+  getSupportedVersions(documentType: string): number[];
   /**
-   * Creates a new drive document and waits for completion.
+   * Get the latest (highest) version number for a document type.
+   *
+   * @param documentType The document type identifier
+   * @returns The highest version number registered for this document type
+   * @throws ModuleNotFoundError if no modules are registered for the document type
    */
-  create(input: DriveInput, signal?: AbortSignal): Promise<DocumentDriveDocument>;
+  getLatestVersion(documentType: string): number;
   /**
-   * Adds a document to a drive as a single batched operation.
+   * Register upgrade manifests that define upgrade paths between versions.
+   * Invalid or duplicate manifests are skipped without breaking registration of the remaining manifests.
    *
-   * Issues CREATE_DOCUMENT, UPGRADE_DOCUMENT, ADD_RELATIONSHIP on the new
-   * document and ADD_FILE on the drive in a single dependent batch.
+   * @param manifests Upgrade manifests to register
+   * @returns Array of results, one per manifest, indicating success or failure
    */
-  addFile<TDocument extends PHDocument = PHDocument>(driveIdentifier: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
+  registerUpgradeManifests(...manifests: UpgradeManifest<readonly number[]>[]): RegistrationResult<UpgradeManifest<readonly number[]>>[];
   /**
-   * Adds a folder node to a drive.
-   */
-  addFolder(driveIdentifier: string, name: string, parentFolder?: string, signal?: AbortSignal): Promise<FolderNode>;
+   * Unregister upgrade manifests for the specified document types.
+   * @param documentTypes The document types whose upgrade manifests should be unregistered
+   * @returns true if all modules were unregistered, false if any were not found
+   **/
+  unregisterUpgradeManifests(...documentTypes: string[]): boolean;
   /**
-   * Removes a node from a drive. Folder nodes cascade: descendant file
-   * documents are deleted first, then the folder node entry itself.
+   * Get the upgrade manifest for a document type.
+   *
+   * @param documentType The document type identifier
+   * @returns The upgrade manifest
+   * @throws ManifestNotFoundError if no manifest is registered for the document type
    */
-  removeNode(driveIdentifier: string, nodeId: string, signal?: AbortSignal): Promise<void>;
+  getUpgradeManifest(documentType: string): UpgradeManifest<readonly number[]>;
   /**
-   * Renames a node. Updates both the underlying document header and the
-   * drive's node entry.
+   * Compute the upgrade path from one version to another.
+   * Returns the sequence of upgrade transitions needed.
+   *
+   * @param documentType The document type identifier
+   * @param fromVersion The starting version
+   * @param toVersion The target version
+   * @returns Array of upgrade transitions in order
+   * @throws DowngradeNotSupportedError if toVersion is less than fromVersion
+   * @throws ManifestNotFoundError if no upgrade manifest is registered
+   * @throws MissingUpgradeTransitionError if any transition in the path is missing
    */
-  renameNode(driveIdentifier: string, nodeId: string, name: string, signal?: AbortSignal): Promise<Node>;
+  computeUpgradePath(documentType: string, fromVersion: number, toVersion: number): UpgradeTransition[];
   /**
-   * Updates the preferred editor recorded in the document header meta for
-   * a node. Pass `null` to clear it.
+   * Get the upgrade reducer for a single-step version transition.
+   *
+   * @param documentType The document type identifier
+   * @param fromVersion The starting version
+   * @param toVersion The target version (must be fromVersion + 1)
+   * @returns The upgrade reducer function
+   * @throws InvalidUpgradeStepError if toVersion is not fromVersion + 1
+   * @throws ManifestNotFoundError if no upgrade manifest is registered
+   * @throws MissingUpgradeTransitionError if the transition is not found
    */
-  setPreferredEditorOnNode(nodeId: string, preferredEditor: string | null, signal?: AbortSignal): Promise<PHDocument>;
+  getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
+}
+//#endregion
+//#region src/cache/buffer/ring-buffer.d.ts
+/**
+ * RingBuffer is a generic circular buffer implementation that stores a fixed number
+ * of items. When the buffer is full, new items overwrite the oldest items.
+ *
+ * This implementation maintains O(1) time complexity for push operations and provides
+ * items in chronological order (oldest to newest) via getAll().
+ *
+ * @template T - The type of items stored in the buffer
+ */
+declare class RingBuffer<T> {
+  private buffer;
+  private head;
+  private size;
+  private capacity;
+  constructor(capacity: number);
   /**
-   * Moves a node to a different parent folder within the same drive.
-   * Pass `undefined` to move the node to the drive root.
+   * Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
+   *
+   * @param item - The item to add
    */
-  moveNode(driveIdentifier: string, srcNodeId: string, targetParentFolderId: string | undefined, signal?: AbortSignal): Promise<DocumentDriveDocument>;
+  push(item: T): void;
   /**
-   * Copies a node (and its subtree, if it is a folder) within a drive.
-   * Each copied file gets a new id and a duplicated document.
+   * Returns all items in the buffer in chronological order (oldest to newest).
+   *
+   * @returns Array of items in insertion order
    */
-  copyNode(driveIdentifier: string, srcNodeId: string, targetParentFolderId: string | undefined, signal?: AbortSignal): Promise<DocumentDriveDocument>;
+  getAll(): T[];
   /**
-   * Returns a single node from the drive's `state.global.nodes` array.
+   * Clears all items from the buffer.
    */
-  getNode(driveIdentifier: string, nodeId: string, signal?: AbortSignal): Promise<Node>;
+  clear(): void;
   /**
-   * Returns nodes in the drive, optionally filtered by parent folder:
-   * - omit `parentFolder` (or pass `undefined`) to list every node in the drive.
-   * - pass `null` to list only root-level nodes.
-   * - pass a folder id to list only the direct children of that folder.
-   *
-   * Returns a paged result so callers can stream through drives with very
-   * large node counts without materialising the whole list in memory.
+   * Gets the current number of items in the buffer.
    */
-  listNodes(driveIdentifier: string, parentFolder?: string | null, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Node>>;
+  get length(): number;
 }
-/**
- * One operation an authorization preflight predicts a verdict for. The input is
- * what a conditional grant reads, so a candidate standing for a filled-in form
- * carries that form's input.
- */
-type ActionCandidate = {
-  scope: string;
-  type: string;
-  input?: unknown;
+//#endregion
+//#region src/cache/kysely-write-cache.d.ts
+type DocumentStream = {
+  key: string;
+  ringBuffer: RingBuffer<CachedSnapshot>;
 };
 /**
- * The predicted verdicts for a set of candidates, in the order they were given,
- * with the aggregates a UI branches on.
+ * In-memory write cache with keyframe persistence for PHDocuments.
  *
- * The aggregates are redundant -- a verdict is binary, so `allDenied` is
- * `!anyAllowed` and `anyDenied` is `!allAllowed` -- and all four are returned
- * so that a caller reads the one its question is phrased in rather than
- * negating another. Over no candidates every aggregate is false: nothing is
- * allowed and nothing is denied.
- */
-type ActionEvaluations = {
-  evaluations: Evaluation[];
-  allAllowed: boolean;
-  anyAllowed: boolean;
-  allDenied: boolean;
-  anyDenied: boolean;
-};
-/**
- * The ReactorClient interface that wraps lower-level APIs to provide
- * a simpler interface for document operations.
+ * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
+ * rebuilds documents from nearest keyframe or full operation history.
  *
- * Features:
- * - Wraps Jobs with Promises for easier async handling
- * - Manages signing of submitted Action objects
- * - Provides quality-of-life functions for common tasks
- * - Wraps subscription interface with ViewFilters
+ * **Performance Characteristics:**
+ * - Cache hit: O(1) lookup in ring buffer
+ * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
+ * - Warm miss: O(m) where m is operations since cached revision
+ * - Eviction: O(1) for LRU tracking and removal
+ *
+ * **Thread Safety:**
+ * Not thread-safe. Designed for single-threaded job executor environment.
+ * External synchronization required for concurrent access across multiple executors.
+ *
+ * **Example:**
+ * ```typescript
+ * const cache = new KyselyWriteCache(
+ *   keyframeStore,
+ *   operationStore,
+ *   registry,
+ *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
+ * );
+ *
+ * await cache.startup();
+ *
+ * // Retrieve or rebuild document
+ * const doc = await cache.getState(docId, docType, scope, branch, revision);
+ *
+ * // Cache result after job execution
+ * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
+ *
+ * await cache.shutdown();
+ * ```
  */
-interface IReactorClient {
+declare class KyselyWriteCache implements IWriteCache {
+  private streams;
+  private lruTracker;
+  private keyframeStore;
+  private operationStore;
+  private registry;
+  private config;
+  constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
+  withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
   /**
-   * Drive-aware operations. See {@link IDriveClient}.
+   * Initializes the write cache.
+   * Currently a no-op as keyframe store lifecycle is managed externally.
    */
-  readonly drives: IDriveClient;
+  startup(): Promise<void>;
   /**
-   * Retrieves a list of document model modules.
-   *
-   * @param namespace - Optional namespace like "powerhouse" or "sky", defaults to ""
-   * @param paging - Optional pagination options
-   * @param signal - Optional abort signal to cancel the request
-   * @returns List of document model modules
+   * Shuts down the write cache.
+   * Currently a no-op as keyframe store lifecycle is managed externally.
    */
-  getDocumentModelModules(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
+  shutdown(): Promise<void>;
   /**
-   * Retrieves a specific document model module by document type.
+   * Retrieves document state at a specific revision from cache or rebuilds it.
    *
-   * @param documentType - The document type identifier
-   * @returns The document model module
-   */
-  getDocumentModelModule(documentType: string): Promise<DocumentModelModule<any>>;
-  /**
-   * Retrieves a specific document by identifier (either id or slug).
+   * Note: this returns a _shallow_ copy of the document.
    *
-   * @param identifier - Required, this is the document id or slug
-   * @param view - Optional filter containing branch and scopes information
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The up-to-date PHDocument with scopes and list of child document ids
+   * Cache hit path: Returns cached snapshot if available (O(1))
+   * Warm miss path: Rebuilds from cached base revision + incremental ops
+   * Cold miss path: Rebuilds from keyframe or from scratch using all operations
+   *
+   * @param documentId - The document identifier
+   * @param scope - The operation scope
+   * @param branch - The operation branch
+   * @param targetRevision - The target revision, or undefined for newest
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The document at the target revision
+   * @throws {Error} "Operation aborted" if signal is aborted
+   * @throws {ModuleNotFoundError} If document type not registered in registry
+   * @throws {Error} "Failed to rebuild document" if operation store fails
+   * @throws {Error} If reducer throws during operation application
+   * @throws {Error} If document serialization fails
    */
-  get<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<TDocument>;
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * Resolves an identifier (either an id or a slug) to the canonical document
-   * id, using the same lookup as the read/operation data paths. Resolves
-   * against the "main" branch. Throws if the identifier cannot be resolved or
-   * is ambiguous.
+   * Stores a document snapshot in the cache at a specific revision.
    *
-   * @param identifier - Required, this is the document id or slug
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The canonical document id
+   * The cached document is a shallow copy of the input with its operation history
+   * truncated to the last operation per scope and its clipboard cleared. This keeps
+   * memory use and copy costs constant regardless of operation count. Consumers of
+   * getState() must not rely on the full operation history being present; the only
+   * guaranteed invariant is that operations[scope].at(-1) reflects the latest
+   * operation index for each scope.
+   *
+   * Updates LRU tracker and may evict least recently used stream if at capacity.
+   * Asynchronously persists keyframes at configured intervals (fire-and-forget).
+   *
+   * @param documentId - The document identifier
+   * @param scope - The operation scope
+   * @param branch - The operation branch
+   * @param revision - The revision number
+   * @param document - The document to cache
+   * @throws {Error} If document serialization fails
    */
-  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
-  /** True when the id is taken; a soft-deleted document's id is still taken. */
-  isDocumentIdTaken(documentId: string, signal?: AbortSignal): Promise<boolean>;
+  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
   /**
-   * Retrieves operations for a document.
-   *
-   * @param documentIdentifier - Required, this is either a document "id" field or a "slug"
-   * @param view - Optional filter containing branch and scopes information
-   * @param filter - Optional filter for actionTypes, timestamps, and revision
-   * @param paging - Optional pagination options
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Paginated list of operations
+   * Stores the run's head and mints a keyframe for every interval the run
+   * crossed on its way there. Only the head enters the ring buffer; the
+   * earlier revisions are keyframe candidates and nothing more.
    */
-  getOperations(documentIdentifier: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  putRun(documentId: string, scope: string, branch: string, run: readonly {
+    revision: number;
+    document: PHDocument;
+  }[]): void;
+  private store;
+  /** Persists the snapshot if this revision is one the interval falls on. */
+  private persistKeyframe;
   /**
-   * Retrieves outgoing relationships of a given type from a source document.
+   * Invalidates cached document streams.
    *
-   * @param sourceIdentifier - Required, this is either a document "id" field or a "slug"
-   * @param relationshipType - The relationship type to filter by
-   * @param view - Optional filter containing branch and scopes information
-   * @param paging - Optional pagination options
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The target documents and paging cursor
+   * Supports three invalidation scopes:
+   * - Document-level: invalidate(documentId) - removes all streams for document
+   * - Scope-level: invalidate(documentId, scope) - removes all branches for scope
+   * - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
+   *
+   * @param documentId - The document identifier
+   * @param scope - Optional scope to narrow invalidation
+   * @param branch - Optional branch to narrow invalidation (requires scope)
+   * @returns The number of streams evicted
    */
-  getOutgoingRelationships(sourceIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  invalidate(documentId: string, scope?: string, branch?: string): number;
   /**
-   * Retrieves incoming relationships of a given type to a target document.
-   *
-   * @param targetIdentifier - Required, this is either a document "id" field or a "slug"
-   * @param relationshipType - The relationship type to filter by
-   * @param view - Optional filter containing branch and scopes information
-   * @param paging - Optional pagination options
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The source documents and paging cursor
+   * Clears the entire cache, removing all cached document streams.
+   * Resets LRU tracking state. This operation always succeeds.
    */
-  getIncomingRelationships(targetIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  clear(): void;
   /**
-   * Retrieves the outgoing relationship edges of a source document.
-   *
-   * Unlike {@link IReactorClient.getOutgoingRelationships}, which returns the
-   * documents at the far end, this returns the edges themselves, carrying the
-   * metadata and timestamps recorded against each relationship.
+   * Retrieves a specific stream for a document. Exposed on the implementation
+   * for testing, but not on the interface.
    *
-   * @param sourceIdentifier - Required, this is either a document "id" field or a "slug"
-   * @param relationshipType - Optional relationship type to filter by
-   * @param view - Optional filter containing branch and scopes information
-   * @param paging - Optional pagination options
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The matching relationship edges and paging cursor
+   * @internal
    */
-  getOutgoingRelationshipEdges(sourceIdentifier: string, relationshipType?: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentRelationship>>;
+  getStream(documentId: string, scope: string, branch: string): DocumentStream | undefined;
+  private findNearestKeyframe;
   /**
-   * Retrieves the incoming relationship edges of a target document.
-   *
-   * Unlike {@link IReactorClient.getIncomingRelationships}, which returns the
-   * documents at the far end, this returns the edges themselves, carrying the
-   * metadata and timestamps recorded against each relationship.
+   * Rebuilds a scope from a keyframe or from the whole operation history.
    *
-   * @param targetIdentifier - Required, this is either a document "id" field or a "slug"
-   * @param relationshipType - Optional relationship type to filter by
-   * @param view - Optional filter containing branch and scopes information
-   * @param paging - Optional pagination options
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The matching relationship edges and paging cursor
+   * The document scope is always rebuilt first, because it carries the type,
+   * the upgrades and the deletion marker. Its version-changing upgrades are not
+   * applied there though: an upgrade reducer must see the state the requested
+   * scope has reached at that upgrade's boundary, so each one is held back and
+   * applied when the replay below crosses the boundary that
+   * resolveModuleVersionForOp derives from it. Upgrades whose boundary lies past
+   * the last replayed operation are applied at the end. Creation-time 0->N seed
+   * upgrades carry the initial state, so they still apply immediately.
    */
-  getIncomingRelationshipEdges(targetIdentifier: string, relationshipType?: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentRelationship>>;
+  private coldMissRebuild;
   /**
-   * Filters documents by criteria and returns a list of them
-   *
-   * @param search - Search filter options (type, parentId, identifiers)
-   * @param view - Optional filter containing branch and scopes information
-   * @param paging - Optional pagination options
-   * @param signal - Optional abort signal to cancel the request
-   * @returns List of documents matching criteria and pagination cursor
+   * Applies and removes every held-back upgrade whose target version is at or
+   * below `throughVersion`, in the order the document scope recorded them.
    */
-  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  private applyPendingUpgrades;
   /**
-   * Predicts whether the subject would be admitted to execute each of a set of
-   * candidate operations, without submitting any of them. A UI asks this to
-   * disable a control rather than offer an action that fails on submit.
-   *
-   * The answer is a prediction, not a promise. Three caveats hold:
-   *
-   * - Real admission compiles an append condition over everything it read and
-   *   the store enforces it at write time. A preflight reads no future, so a
-   *   policy change landing between this answer and the submit changes the
-   *   verdict. The submit path stays the only authority.
-   * - The verdict is evaluated at the stream heads. It is therefore correct for
-   *   a candidate that will be stamped at or after every timestamp the
-   *   evaluation read, which is the normal case for a control the user is about
-   *   to click. A backdated submission is out of contract: the reactor decides
-   *   that one by position, against the policy as it stood there.
-   * - A candidate whose input decides the verdict needs that input supplied.
-   *   With `authConditions` on, a conditional grant reads `action.input`, so
-   *   omitting the input predicts the denial an empty input would earn rather
-   *   than the verdict the filled-in form will get.
-   *
-   * Document-scope candidates are decided against the policy of the document
-   * their input names, not the one passed here: delete and upgrade name it in
-   * `input.documentId`, and the relationship actions in `input.sourceId`. This
-   * follows the executor's own gate, which decides against the document
-   * guarding the write. `CREATE_DOCUMENT` follows the gate's exemption: it runs
-   * before its document exists, so the executor never decides it against a
-   * policy and the preflight predicts allow.
-   *
-   * @param documentIdentifier - Document "id" or "slug" the candidates target
-   * @param branch - Branch to evaluate against
-   * @param candidates - Operations to predict a verdict for, each with the scope it would execute in
-   * @param subject - Optional subject to decide for, defaulting to the client's own signer. A plain subject rather than a ViewFilter: the evaluation reads no view, so a filter's branch or scopes would be silently ignored here
-   * @param signal - Optional abort signal to cancel the request
-   * @returns One evaluation per candidate, in the order given, with the aggregates over them
-   * @throws AuthEnforcementDisabledError if the reactor's authEnforcement flag is off, in which case it holds no decision model and the legacy host-table permission system cannot answer for one
+   * Applies the remaining held-back upgrades after the requested scope's
+   * replay has finished. A head read applies them all. A positional read
+   * applies only those whose boundary for this scope lies at or before the
+   * target position: applying a later one would label migrated state with a
+   * pre-upgrade revision, and a keyframe stored from that poisons every
+   * rebuild that resumes from it. Boundaries come from the upgrade's revision
+   * snapshot; an upgrade without one records no position for this scope, and
+   * the replay loop not having crossed it already places it past the target.
    */
-  evaluateActions(documentIdentifier: string, branch: string, candidates: ActionCandidate[], subject?: AuthSubject, signal?: AbortSignal): Promise<ActionEvaluations>;
+  private applyTailPendingUpgrades;
   /**
-   * Creates a document and waits for completion
-   *
-   * @param document - Document with optional id, slug, parent, model type, and initial state
-   * @param parentIdentifier - Optional "id" or "slug" of parent document
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The created document
+   * Applies one held-back upgrade, then re-applies the deletes the document
+   * scope recorded after it so the hold-back cannot invert their order.
    */
-  create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
+  private applyPendingUpgrade;
   /**
-   * Creates an empty document and waits for completion
-   *
-   * @param documentModelType - Type of document to create
-   * @param options - Optional creation options (parentIdentifier, documentModelVersion)
-   * @param signal - Optional abort signal to cancel the request
+   * Copies the current document revisions onto the document. Overwrites the
+   * requested scope revision with the target revision, if provided.
    */
-  createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  private stampRevisions;
+  /** The stored operation at `index`, or undefined if it is no longer there. */
+  private operationAt;
   /**
-   * Retrieves the document model module matching the version a document is
-   * stamped with. Use this instead of {@link getDocumentModelModule}
-   * whenever a specific document is in hand: the latest-wins lookup feeds
-   * not-yet-upgraded documents the wrong reducer, diverging from replay.
+   * Resolves which module version to use for a given operation in phase 2.
    *
-   * @param document - The document whose stamped version selects the module
-   * @returns The document model module registered for that version
-   * @throws UnsupportedDocumentModelVersionError if no module is registered for the stamped version
+   * Uses the validated-upgrade boundary rules from D7:
+   * - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
+   * - Otherwise: timestamp fallback
+   * - Falls back to final module version when neither is decidable
    */
-  getDocumentModelModuleForDocument(document: PHDocument): Promise<DocumentModelModule<any>>;
+  private resolveModuleVersionForOp;
+  private warmMissRebuild;
+  private findNearestOlderSnapshot;
+  private makeStreamKey;
+  private getOrCreateStream;
+  private isKeyframeRevision;
+}
+//#endregion
+//#region src/storage/kysely/store.d.ts
+declare class KyselyOperationStore implements IOperationStore {
+  private db;
+  private trx?;
+  constructor(db: Kysely<Database$1>);
+  private get queryExecutor();
+  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
+  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
+  private resolveUniqueConstraint;
+  private executeApply;
   /**
-   * Upgrades a document to a newer document model version by dispatching an
-   * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
-   * latest registered module version for the document's type. Returns the
-   * document unchanged when it is already at the target version.
-   *
-   * The action carries a snapshot of the document's version and per-scope
-   * revisions, which the executor validates before persisting. When an edit
-   * lands between the read and the upgrade executing, the upgrade is
-   * rejected and retried with a fresh read up to
-   * {@link UpgradeDocumentOptions.maxConflictRetries} times before the
-   * conflict is surfaced.
-   *
-   * @param documentIdentifier - Target document id or slug
-   * @param toVersion - Optional target document model version; defaults to latest
-   * @param options - Optional upgrade options (maxConflictRetries)
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The upgraded document
-   * @throws DowngradeNotSupportedError if toVersion is less than the document's current version
+   * Locks the written stream and every read-set stream, in sorted key order
+   * so that overlapping concurrent appends serialize rather than deadlock.
+   * The locks are still taken one row at a time, so the query preserves that
+   * order. It must stay separate from the guarded insert, which would
+   * otherwise read a snapshot taken before the locks were held.
    */
-  upgradeDocument<TDocument extends PHDocument = PHDocument>(documentIdentifier: string, toVersion?: number, options?: UpgradeDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  private acquireStreamLocks;
   /**
-   * Creates an empty document in a drive as a single batched operation.
-   * This is more efficient than createEmpty + addFile as it batches all
-   * actions into dependent jobs and waits for them to complete together.
-   *
-   * @deprecated Use {@link IDriveClient.addFile} via `client.drives.addFile`
-   * instead. This method will be removed in a future release.
-   * @param driveId - The drive document id or slug
-   * @param document - The document to create
-   * @param parentFolder - Optional folder id within the drive
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The created document
+   * Inserts the staged operations with the condition compiled in as a WHERE
+   * NOT EXISTS guard, making the check and the append one statement. Returns
+   * the rows inserted; zero means the guard failed and nothing was written.
    */
-  createDocumentInDrive<TDocument extends PHDocument>(driveId: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
+  private insertGuarded;
+  private findIdempotentReplay;
+  /** True when the staged write creates a document rather than appending to one. */
+  private isCreate;
   /**
-   * Applies a list of actions to a document and waits for completion
-   *
-   * The document handed back is a read like any other, so it goes through the
-   * read gate. `subject` names who that read is for, the same way
-   * {@link ViewFilter.subject} does on `get` and `find`; a host that shares one
-   * client across many callers has no meaningful signer to fall back to, and
-   * without it the gate would strip the domain scopes of a policied document
-   * and resolve with a husk whose `state.global` is absent — reading as a
-   * rejected write when the write in fact succeeded.
-   *
-   * @param documentIdentifier - Target document id or slug
-   * @param branch - Branch to apply actions to
-   * @param actions - List of actions to apply
-   * @param signal - Optional abort signal to cancel the request
-   * @param subject - Optional read subject for the returned document; defaults
-   *   to the client's signer
-   * @returns The updated document
+   * The paging cursor here encodes the index to resume from (one past the
+   * last row returned), not the last row's own index. This keeps "0" an
+   * unambiguous start-of-stream sentinel even when a page ends at index 0
+   * (e.g. `limit: 1` on a fresh stream), which would otherwise make
+   * `nextCursor` equal the start cursor and loop a caller that walks pages
+   * forever.
    */
-  execute<TDocument extends PHDocument>(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal, subject?: AuthSubject): Promise<TDocument>;
+  getSince(documentId: string, scope: string, branch: string, revision: number, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  getSinceId(id: number, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<OperationWithContext$1>>;
   /**
-   * Submits a list of actions to a document
-   *
-   * @param documentIdentifier - Target document id or slug
-   * @param branch - Branch to apply actions to
-   * @param actions - List of actions to apply
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The job
+   * The paging cursor here encodes the index to resume from (one past the
+   * last row returned), not the last row's own index, for the same reason as
+   * `getSince`: a page ending at index 0 must not produce a cursor that is
+   * indistinguishable from the start-of-stream sentinel.
    */
-  executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
+  getConflicting(documentId: string, scope: string, branch: string, minTimestamp: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
+  getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
+  getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
+  findOperationIds(documentId: string, scope: string, branch: string, opIds: string[], signal?: AbortSignal): Promise<Set<string>>;
+  getOperationsByIds(documentId: string, scope: string, branch: string, opIds: string[], signal?: AbortSignal): Promise<Operation[]>;
+  private rowToOperation;
+  private rowToOperationWithContext;
+}
+//#endregion
+//#region src/storage/kysely/keyframe-store.d.ts
+declare class KyselyKeyframeStore implements IKeyframeStore {
+  private db;
+  private trx?;
+  constructor(db: Kysely<Database$1>);
+  private get queryExecutor();
+  withTransaction(trx: Transaction<Database$1>): KyselyKeyframeStore;
+  putKeyframe(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, signal?: AbortSignal): Promise<void>;
+  findNearestKeyframe(documentId: string, scope: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<{
+    revision: number;
+    document: PHDocument;
+  } | undefined>;
+  listKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<Array<{
+    scope: string;
+    branch: string;
+    revision: number;
+    document: PHDocument;
+  }>>;
+  deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
+}
+//#endregion
+//#region src/executor/execution-scope.d.ts
+interface ExecutionStores {
+  operationStore: IOperationStore;
+  operationIndex: IOperationIndex;
+  writeCache: IWriteCache;
+  documentMetaCache: IDocumentMetaCache;
+  collectionMembershipCache: ICollectionMembershipCache;
+}
+interface IExecutionScope {
+  run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
+}
+//#endregion
+//#region src/executor/types.d.ts
+/**
+ * Represents the result of a job execution
+ */
+type JobResult = {
+  /** The job that was executed */job: Job; /** Whether the job executed successfully */
+  success: boolean; /** Error if the job failed */
+  error?: Error; /** The operations generated from the actions (if successful) */
+  operations?: Operation[];
   /**
-   * Applies multiple mutation jobs in dependency order and waits for all to
-   * complete. Actions on each job are signed by the client signer before
-   * dispatch. Throws on the first failed job; the others may still execute
-   * because dispatch is fire-and-await-all.
-   *
-   * @param request - Batch mutation request with per-job actions and dependsOn keys
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The completed batch result (job ids keyed by plan key)
+   * Operations with context (includes ephemeral resultingState).
+   * Used for emitting to IDocumentView via event bus.
    */
-  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
+  operationsWithContext?: OperationWithContext$1[]; /** Timestamp when the job execution completed */
+  completedAt?: string; /** Duration of job execution in milliseconds */
+  duration?: number; /** Any additional metadata from the execution */
+  metadata?: Record<string, any>;
+};
+/**
+ * Enforcement the reactor performs, each off by default.
+ *
+ * An evaluation made while replaying is part of the document's history, so two
+ * reactors that share documents and disagree on these diverge. A flag is turned
+ * on for a set of reactors that sync with each other, not for one node.
+ */
+type ReactorFeatureFlags = {
   /**
-   * Renames a document and waits for completion
-   *
-   * @param documentIdentifier - Target document id or slug
-   * @param name - The new name of the document
-   * @param branch - Optional branch to rename the document, defaults to "main"
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The updated document.
-   */
-  rename(documentIdentifier: string, name: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Updates the preferred editor in the document header meta and waits for completion.
-   *
-   * @param documentIdentifier - Target document id or slug
-   * @param preferredEditor - The new preferred editor, or `null` to clear it
-   * @param branch - Optional branch, defaults to "main"
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The updated document.
-   */
-  setPreferredEditor(documentIdentifier: string, preferredEditor: string | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Adds a relationship between two documents and waits for completion.
-   *
-   * Adding a relationship that already exists is a no-op, metadata included.
-   * Use {@link IReactorClient.updateRelationship} to change an existing edge.
-   *
-   * @param sourceIdentifier - Source document id or slug
-   * @param targetIdentifier - Target document id or slug
-   * @param relationshipType - Relationship type identifier
-   * @param metadata - Optional metadata to attach to the relationship
-   * @param branch - Optional branch to add the relationship to, defaults to "main"
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The updated source document
-   */
-  addRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, metadata?: Record<string, unknown>, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Replaces the metadata of an existing relationship and waits for completion.
-   * The relationship's createdAt is preserved.
-   *
-   * @param sourceIdentifier - Source document id or slug
-   * @param targetIdentifier - Target document id or slug
-   * @param relationshipType - Relationship type identifier
-   * @param metadata - The metadata to store; null clears it
-   * @param branch - Optional branch holding the relationship, defaults to "main"
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The updated source document
-   */
-  updateRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, metadata: Record<string, unknown> | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Removes a relationship between two documents and waits for completion.
-   *
-   * @param sourceIdentifier - Source document id or slug
-   * @param targetIdentifier - Target document id or slug
-   * @param relationshipType - Relationship type identifier
-   * @param branch - Optional branch to remove the relationship from, defaults to "main"
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The updated source document
-   */
-  removeRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Moves a relationship from one source document to another and waits for completion.
-   *
-   * @param sourceParentIdentifier - Source parent document id or slug
-   * @param targetParentIdentifier - Target parent document id or slug
-   * @param targetIdentifier - The target document id or slug
-   * @param relationshipType - Relationship type identifier
-   * @param branch - Optional branch to apply the move to, defaults to "main"
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The updated source and target documents
+   * Decide whether an operation may be admitted by building a decision model
+   * over the document stream, rather than reading the deleted flag from the
+   * document meta cache. Deletion then takes effect from the deleting
+   * operation's position rather than for the whole document.
    */
-  moveRelationship(sourceParentIdentifier: string, targetParentIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<{
-    source: PHDocument;
-    target: PHDocument;
-  }>;
+  documentDecisions: boolean;
   /**
-   * Deletes a document and waits for completion
-   *
-   * @param identifier - Document identifier (id or slug)
-   * @param propagate - Optional mode for handling children, CASCADE deletes child documents
-   * @param signal - Optional abort signal to cancel the request
-   * @returns a promise, resolving on deletion confirmation
+   * Evaluate the auth policy by reading the auth scope as a second projection.
+   * Requires documentDecisions.
    */
-  deleteDocument(identifier: string, propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  authEnforcement: boolean;
   /**
-   * Deletes documents and waits for completion
-   *
-   * @param identifiers - Document identifiers (ids or slugs)
-   * @param propagate - Optional mode for handling children, CASCADE deletes child documents
-   * @param signal - Optional abort signal to cancel the request
-   * @returns a promise, resolving on deletion confirmation
+   * Match { group } principals by folding the referenced PHGroup documents as
+   * derived projections. Requires authEnforcement.
    */
-  deleteDocuments(identifiers: string[], propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  authGroups: boolean;
   /**
-   * Loads multiple batches of pre-existing operations across documents with dependency management.
-   * Waits for all jobs to complete.
-   *
-   * @param request - Batch load request containing jobs with dependencies
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Map of job keys to completed job information
+   * Evaluate `where` clauses and { match } principals against the executing
+   * scope's state, the subject, and the action input. Requires authGroups.
    */
-  loadBatch(request: BatchLoadRequest, signal?: AbortSignal): Promise<BatchLoadResult>;
+  authConditions: boolean;
+};
+/**
+ * Configuration options for the job executor
+ */
+type JobExecutorConfig = {
+  /** Feature flags; anything unset is off. */featureFlags?: Partial<ReactorFeatureFlags>; /** Maximum number of conflicting operations to skip when reshuffling. */
+  maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
+  maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
+  jobTimeoutMs?: number;
+  /** How long a job whose document is missing waits for it before failing.
+   *  Unbounded deferral never resolves the caller awaiting the job. */
+  deferredJobTtlMs?: number; /** Base delay in milliseconds for exponential backoff retries */
+  retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
+  retryMaxDelayMs?: number;
+  /** Maximum elapsed milliseconds before yielding to the main thread between actions.
+   *  Keeps the UI responsive when processing large batches. */
+  yieldDeadlineMs?: number;
   /**
-   * Retrieves the status of a job
+   * Persist a job's writes in one store transaction rather than one each.
    *
-   * @param jobId - The job id
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The job status
-   */
-  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
-  /**
-   * Waits for a job to complete
+   * On by default. A job's operations are reduced sequentially either way; this
+   * only changes how many apply calls carry them, which is one advisory lock
+   * and one guarded insert per batch instead of per operation. Only runs that
+   * qualify are batched, and the executor falls back per write for the rest, so
+   * this never changes which operations are produced -- only how many
+   * transactions they arrive in.
    *
-   * @param jobId - The job id or job object
-   * @param signal - Optional abort signal to cancel the request
-   * @returns The result of the job
+   * Atomicity is not one of the things it changes. A job either fully applies
+   * or leaves nothing durable behind regardless of this setting, because the
+   * whole job runs inside the execution scope's transaction and a failure
+   * rolls it back.
+   * That guarantee belongs to KyselyExecutionScope, which backs both Postgres
+   * and PGlite; DefaultExecutionScope opens no transaction and is used only by
+   * unit-test harnesses, which therefore see writes survive a failed job.
    */
-  waitForJob(jobId: string | JobInfo, signal?: AbortSignal): Promise<JobInfo>;
+  batchApplies?: boolean; /** Defaults to `enforce`; `log` counts refusals and admits the write. */
+  signatureVerification?: SignatureVerificationMode;
+};
+/**
+ * Event types for the job executor
+ */
+declare const JobExecutorEventTypes: {
+  readonly JOB_STARTED: 20000;
+  readonly JOB_COMPLETED: 20001;
+  readonly JOB_FAILED: 20002;
+  readonly EXECUTOR_STARTED: 20003;
+  readonly EXECUTOR_STOPPED: 20004;
+};
+/**
+ * Event data for job execution events
+ */
+type JobStartedEvent = {
+  job: Job;
+  startedAt: string;
   /**
-   * Subscribes to changes for documents matching specified filters
-   *
-   * @param search - Search filter options (type, parentId, identifiers)
-   * @param callback - Function called when documents change with the change event details
-   * @param view - Optional filter containing branch and scopes information
-   * @returns A function that unsubscribes from the changes
+   * Identifier of the executor that took the job. For the worker pool this is
+   * the thread-worker id (e.g. "reactor-worker-3"); for the in-process simple
+   * manager it is "in-process-<index>". Optional for backwards compatibility
+   * with consumers built before the field was added.
    */
-  subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
-}
-//#endregion
-//#region src/cache/collection-membership-cache.d.ts
-interface ICollectionMembershipCache {
-  getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
-  invalidate(documentId: string): void;
-}
+  workerId?: string;
+};
+type JobCompletedEvent = {
+  job: Job;
+  result: JobResult; /** See {@link JobStartedEvent.workerId}. */
+  workerId?: string;
+};
+type JobFailedEvent = {
+  job: Job;
+  error: string;
+  willRetry: boolean;
+  retryCount: number; /** See {@link JobStartedEvent.workerId}. */
+  workerId?: string;
+};
+type ExecutorStartedEvent = {
+  config: JobExecutorConfig;
+  startedAt: string;
+};
+type ExecutorStoppedEvent = {
+  stoppedAt: string;
+  graceful: boolean;
+};
+/**
+ * Status information for the job executor manager
+ */
+type ExecutorManagerStatus = {
+  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
+  numExecutors: number; /** Number of jobs currently being processed */
+  activeJobs: number; /** Total number of jobs processed since start */
+  totalJobsProcessed: number;
+};
 //#endregion
-//#region src/cache/document-meta-cache-types.d.ts
+//#region src/executor/worker/protocol.d.ts
 /**
- * Cached document metadata from the "document" scope.
+ * A JSON-clonable value safe to send across the worker IPC boundary.
  *
- * This lightweight structure holds essential document information needed by
- * the job executor without fetching full scope state. It provides an explicit
- * cross-scope contract for accessing document scope metadata.
+ * The shape mirrors the structured-clone subset used by the parent's
+ * sanitizer: primitives, arrays, plain objects, plus the explicit
+ * {@link ErrorInfo} shape for marshalled Errors.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-type CachedDocumentMeta = {
-  /**
-   * The full PHDocumentState from document.state.document.
-   * Contains version, hash, isDeleted, deletedAtUtcIso, etc.
-   */
-  state: PHDocumentState;
-  /**
-   * The document type (from header), cached for convenience.
-   */
-  documentType: string;
-  /**
-   * The revision of the document scope when this metadata was captured.
-   * Used for cache invalidation and consistency checks.
-   */
-  documentScopeRevision: number;
+type SanitizedArg = null | boolean | number | string | ErrorInfo | SanitizedArg[] | {
+  [key: string]: SanitizedArg;
 };
 /**
- * Interface for the document metadata cache.
+ * Structured representation of an Error for IPC transport.
  *
- * This cache provides an explicit cross-scope contract for accessing document
- * scope metadata. It solves the problem where job execution in one scope (e.g.,
- * "global") needs access to document scope state (version, isDeleted, etc.)
- * which may be stale in scope-specific caches or keyframes.
+ * Class instances cannot be structured-cloned across worker boundaries,
+ * so Errors are flattened into this shape on the worker side and
+ * reconstructed on the parent side.
  *
- * The cache supports:
- * - Latest metadata retrieval with LRU caching
- * - Historical metadata reconstruction for reshuffling scenarios
- * - Eager updates after document scope operations
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-interface IDocumentMetaCache {
-  /**
-   * Retrieves the LATEST document metadata from cache or rebuilds from operations.
-   *
-   * On cache miss, fetches all document scope operations and reconstructs the
-   * current PHDocumentState by applying UPGRADE_DOCUMENT and DELETE_DOCUMENT
-   * operations.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The cached or rebuilt document metadata
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
-   */
-  getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
-  /**
-   * Rebuilds document metadata at a SPECIFIC revision (always rebuilds, no caching).
-   *
-   * Used during reshuffling when operations need to be inserted at a previous
-   * revision and we need the document scope state as of that point in time.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param targetRevision - The document scope revision to reconstruct up to
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns Document metadata as of the target revision
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found
-   */
-  rebuildAtRevision(documentId: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<CachedDocumentMeta>;
-  /**
-   * Eagerly updates cached metadata after document scope operations.
-   *
-   * Called by the job executor after CREATE_DOCUMENT, UPGRADE_DOCUMENT, or
-   * DELETE_DOCUMENT operations to keep the cache current.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Branch name
-   * @param meta - The new metadata to cache
-   */
-  putDocumentMeta(documentId: string, branch: string, meta: CachedDocumentMeta): void;
-  /**
-   * Invalidates cached document metadata.
-   *
-   * Call before reshuffling operations that modify the document scope, or
-   * when document state may have changed externally.
-   *
-   * @param documentId - The document identifier
-   * @param branch - Optional branch to narrow invalidation (if omitted, all branches)
-   * @returns Number of entries invalidated
-   */
-  invalidate(documentId: string, branch?: string): number;
-  /**
-   * Clears all cached document metadata.
-   */
-  clear(): void;
+type ErrorInfo = {
+  name: string;
+  message: string;
+  stack?: string;
+  cause?: ErrorInfo;
+};
+/**
+ * Reference to a module that the worker should `import()` at runtime,
+ * along with the named export to pluck out as the factory.
+ *
+ * Exactly one of `packageName` or `filePath` is provided.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModuleRef = {
+  /** Bare-specifier package name (resolved by the worker's module loader). */packageName: string; /** Named export within the module to invoke as the factory. */
+  exportName: string;
+} | {
+  /** Absolute or worker-resolvable file path to import. */filePath: string; /** Named export within the module to invoke as the factory. */
+  exportName: string;
+};
+/**
+ * Factory specification shared by the signer, trust policy and document
+ * model spec channels. The worker imports `module.exportName` and invokes
+ * it with `initArgs` to obtain the actual instance.
+ *
+ * `initArgs` must be JSON-clonable.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type FactorySpec = {
+  module: ModuleRef;
+  initArgs?: SanitizedArg;
+};
+/**
+ * Factory spec for a document model module the worker should instantiate.
+ *
+ * Structurally identical to {@link FactorySpec}; the alias exists so call
+ * sites read intent-fully.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type DocumentModelSpec = FactorySpec;
+/**
+ * One entry in the document model manifest the worker materializes on
+ * startup (or extends lazily via `load-model`).
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModelManifestEntry = {
+  /** Document type identifier (e.g. "ph/account"). */documentType: string; /** Document model version this entry registers. */
+  version: string; /** Factory spec the worker imports and invokes to obtain the model. */
+  spec: DocumentModelSpec;
+};
+/**
+ * JSON-clonable Postgres connection info passed to the worker so it can
+ * open its own pool. Storage-specific wiring may extend this shape in
+ * later phases.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type DbConfig = {
+  host: string;
+  port: number;
+  database: string;
+  user: string;
+  password: string;
+  ssl?: boolean;
+  applicationName?: string;
+  poolSize?: number;
   /**
-   * Performs startup initialization.
+   * Maximum time (ms) a caller will wait to acquire a connection from the
+   * pool before pg.Pool throws. When omitted, pg defaults to 0 (unlimited
+   * wait), which hides acquire-starvation as silent latency.
    */
-  startup(): Promise<void>;
+  connectionTimeoutMillis?: number;
   /**
-   * Performs graceful shutdown.
+   * How long (ms) an idle connection stays open before pg closes it. When
+   * omitted, pg defaults to 10000.
    */
-  shutdown(): Promise<void>;
-}
-//#endregion
-//#region src/storage/kysely/types.d.ts
-interface OperationTable {
-  id: Generated<number>;
-  jobId: string;
-  opId: string;
-  prevOpId: string;
-  writeTimestampUtcMs: Generated<Date>;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  timestampUtcMs: Date;
-  index: number;
-  action: unknown;
-  skip: number;
-  error?: string | null;
-  deniedReason?: string | null;
-  hash: string;
-}
-interface KeyframeTable {
-  id: Generated<number>;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  revision: number;
-  document: unknown;
-  createdAt: Generated<Date>;
-}
-interface DocumentCollectionTable {
-  documentId: string;
-  collectionId: string;
-  joinedOrdinal: bigint;
-  leftOrdinal: bigint | null;
-}
-interface OperationIndexOperationTable {
-  ordinal: Generated<number>;
-  opId: string;
-  documentId: string;
-  documentType: string;
-  scope: string;
-  branch: string;
-  timestampUtcMs: string;
-  writeTimestampUtcMs: Generated<Date>;
-  index: number;
-  skip: number;
-  hash: string;
-  action: unknown;
-  deniedReason?: string | null;
-  sourceRemote: Generated<string>;
-}
-interface SyncRemoteTable {
-  name: string;
-  collection_id: string;
-  channel_type: string;
-  channel_id: string;
-  remote_name: string;
-  channel_parameters: unknown;
-  filter_document_ids: unknown;
-  filter_scopes: unknown;
-  filter_branch: string;
-  push_state: string;
-  push_last_success_utc_ms: string | null;
-  push_last_failure_utc_ms: string | null;
-  push_failure_count: number;
-  pull_state: string;
-  pull_last_success_utc_ms: string | null;
-  pull_last_failure_utc_ms: string | null;
-  pull_failure_count: number;
-  bound_address: string | null;
-  created_at: Generated<Date>;
-  updated_at: Generated<Date>;
-}
-interface SyncCursorTable {
-  remote_name: string;
-  cursor_type: string;
-  cursor_ordinal: bigint;
-  last_synced_at_utc_ms: string | null;
-  updated_at: Generated<Date>;
-}
+  idleTimeoutMillis?: number;
+};
 /**
- * Kysely table definition for the `sync_dead_letters` table.
+ * Configuration for the executor worker pool.
+ *
+ * Mirrors the `workerPool` sub-config on {@link JobExecutorConfig};
+ * a later card wires this into the executor config.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-interface SyncDeadLetterTable {
-  ordinal: Generated<number>;
-  id: string;
-  job_id: string;
-  job_dependencies: unknown;
-  remote_name: string;
-  document_id: string;
-  scopes: unknown;
-  branch: string;
-  operations: unknown;
-  error_source: string;
-  error_message: string;
-  error_type: Generated<string>;
-  created_at: Generated<Date>;
-}
+type WorkerPoolConfig = {
+  /** Whether the worker pool is active; when false the executor runs in-process. */enabled: boolean; /** Number of worker instances to spawn. */
+  numWorkers: number; /** Worker isolation mode. */
+  workerType: "thread" | "process"; /** Optional heartbeat interval in milliseconds. */
+  heartbeatMs?: number; /** Optional per-worker Postgres pool size override. */
+  workerPgPoolSize?: number;
+};
 /**
- * One (document, group) reference ever discovered from an auth operation's
- * input. Rows are never updated or deleted (see migration 017).
+ * Payload the worker reports back when a job's write phase is complete.
+ *
+ * Parent fills `collectionMemberships` at emission time, so it is
+ * intentionally absent from the worker -> parent message.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-interface GroupReferenceTable {
-  documentId: string;
-  groupId: string;
-}
-interface Database$1 {
-  Operation: OperationTable;
-  Keyframe: KeyframeTable;
-  document_collections: DocumentCollectionTable;
-  operation_index_operations: OperationIndexOperationTable;
-  group_references: GroupReferenceTable;
-  sync_remotes: SyncRemoteTable;
-  sync_cursors: SyncCursorTable;
-  sync_dead_letters: SyncDeadLetterTable;
-}
-interface DocumentTable {
-  id: string;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface DocumentRelationshipTable {
-  id: Generated<string>;
-  sourceId: string;
-  targetId: string;
-  relationshipType: string;
-  metadata: unknown;
-  createdAt: Generated<Date>;
-  updatedAt: Generated<Date>;
-}
-interface IndexerStateTable {
-  id: Generated<number>;
-  lastOperationId: number;
-  lastOperationTimestamp: Generated<Date>;
-}
-interface DocumentIndexerDatabase {
-  Document: DocumentTable;
-  DocumentRelationship: DocumentRelationshipTable;
-  IndexerState: IndexerStateTable;
-}
-//#endregion
-//#region src/executor/worker/protocol.d.ts
+type JobWriteReadyPayload = {
+  operations: OperationWithContext$1[];
+  jobMeta: JobMeta;
+};
 /**
- * A JSON-clonable value safe to send across the worker IPC boundary.
+ * Initializes a freshly spawned worker with the configuration and
+ * factories it needs to start executing jobs.
  *
- * The shape mirrors the structured-clone subset used by the parent's
- * sanitizer: primitives, arrays, plain objects, plus the explicit
- * {@link ErrorInfo} shape for marshalled Errors.
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type InitMessage = {
+  type: "init";
+  correlationId: string;
+  workerId: string;
+  poolConfig: WorkerPoolConfig;
+  db: DbConfig;
+  models: ModelManifestEntry[]; /** Omitted = the worker builds its executor with the built-in defaults. */
+  executorConfig?: JobExecutorConfig; /** Builds the `ISigner` for synthesized operations; omitted = unsigned. */
+  signer?: FactorySpec; /** Builds the `SignatureTrustPolicy`; omitted = the default. */
+  trustPolicy?: FactorySpec;
+};
+/**
+ * Dispatches a job to the worker for execution.
  *
  * @see Wire Protocol Reference wiki page
  *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-type SanitizedArg = null | boolean | number | string | ErrorInfo | SanitizedArg[] | {
-  [key: string]: SanitizedArg;
+type ExecuteMessage = {
+  type: "execute";
+  correlationId: string;
+  job: Job;
 };
 /**
- * Structured representation of an Error for IPC transport.
+ * Requests cancellation of an in-flight job.
  *
- * Class instances cannot be structured-cloned across worker boundaries,
- * so Errors are flattened into this shape on the worker side and
- * reconstructed on the parent side.
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type AbortMessage = {
+  type: "abort";
+  correlationId: string; /** correlationId of the `execute` message being aborted. */
+  targetCorrelationId: string;
+  reason?: string;
+};
+/**
+ * Asks the worker to drain in-flight work and exit.
  *
  * @see Wire Protocol Reference wiki page
  *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-type ErrorInfo = {
-  name: string;
+type ShutdownMessage = {
+  type: "shutdown";
+  correlationId: string; /** Optional grace period before the parent force-terminates the worker. */
+  graceMs?: number;
+};
+/**
+ * Lazily registers an additional document model on a running worker.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type LoadModelMessage = {
+  type: "load-model";
+  correlationId: string;
+  model: ModelManifestEntry;
+};
+/**
+ * Union of all messages the parent may send to a worker.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ParentMessage = InitMessage | ExecuteMessage | AbortMessage | ShutdownMessage | LoadModelMessage;
+/**
+ * Announces that the worker has finished `init` and is ready to accept
+ * `execute` messages.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ReadyMessage = {
+  type: "ready"; /** correlationId of the originating `init` message. */
+  correlationId: string;
+  workerId: string;
+};
+/**
+ * Final result for an `execute` job.
+ *
+ * On success, `writeReady` carries the operations and job meta the
+ * parent needs to emit `JOB_WRITE_READY`. On failure, `error` is set
+ * and `result.success` is false.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ResultMessage = {
+  type: "result"; /** correlationId of the originating `execute` message. */
+  correlationId: string;
+  result: JobResult;
+  writeReady?: JobWriteReadyPayload; /** Re-emitted on the parent bus, which is where observers subscribe. */
+  signatureRefusals?: SignatureRefusedEvent[];
+  error?: ErrorInfo;
+};
+/**
+ * Acknowledges that a `load-model` request succeeded.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModelLoadedMessage = {
+  type: "model-loaded"; /** correlationId of the originating `load-model` message. */
+  correlationId: string;
+  documentType: string;
+  version: string;
+};
+/**
+ * Reports that a `load-model` request failed.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type ModelLoadFailedMessage = {
+  type: "model-load-failed"; /** correlationId of the originating `load-model` message. */
+  correlationId: string;
+  documentType: string;
+  version: string;
+  error: ErrorInfo;
+};
+/**
+ * Forwarded log line from the worker. `args` is constrained to
+ * {@link SanitizedArg} so callers cannot accidentally ship non-clonable
+ * values across the boundary.
+ *
+ * The sanitizer in `./sanitize.ts` enforces the {@link SanitizedArg}
+ * invariant on the producer side before each message is posted.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type LogMessage = {
+  type: "log";
+  level: "debug" | "info" | "warn" | "error";
   message: string;
-  stack?: string;
-  cause?: ErrorInfo;
+  args: SanitizedArg[]; /** Epoch milliseconds at which the worker generated the log line. */
+  timestamp: number;
+};
+/**
+ * Periodic liveness signal. Included now to unblock Phase-3 scaffolding;
+ * the wiki marks heartbeats as a Phase-5 future extension.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type HeartbeatMessage = {
+  type: "heartbeat";
+  workerId: string; /** Epoch milliseconds the worker generated the heartbeat. */
+  timestamp: number; /** Optional snapshot of in-flight job correlation ids. */
+  inFlightCorrelationIds?: string[];
+};
+/**
+ * Periodic counters / gauges the worker reports for observability.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type MetricsMessage = {
+  type: "metrics";
+  workerId: string; /** Epoch milliseconds the worker generated the metrics snapshot. */
+  timestamp: number;
+  counters: {
+    [name: string]: number;
+  };
+  gauges: {
+    [name: string]: number;
+  };
+};
+/**
+ * Snapshot of one worker pool's acquire-wait samples and pool-stat counters,
+ * forwarded periodically so the host can re-record into the shared
+ * pg.Pool histogram and observable gauges. The worker owns the real
+ * pg.Pool; the host's {@link PoolInstrumentation} is a forwarder driven
+ * by these messages.
+ */
+type PoolAcquireSamplesMessage = {
+  type: "pool-acquire-samples";
+  workerId: string; /** Stable identifier matching the host-side instrumentation name (e.g. "worker-0"). */
+  poolName: string; /** Epoch milliseconds the worker generated the batch. */
+  timestamp: number; /** Acquire-wait durations (ms) accumulated since the previous batch. */
+  durations: number[]; /** Most recent pg.Pool counter snapshot at batch send time. */
+  size: number;
+  idle: number;
+  waiting: number;
+};
+/**
+ * Union of all messages a worker may send to the parent.
+ *
+ * @see Wire Protocol Reference wiki page
+ *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ */
+type WorkerMessage = ReadyMessage | ResultMessage | ModelLoadedMessage | ModelLoadFailedMessage | LogMessage | HeartbeatMessage | MetricsMessage | PoolAcquireSamplesMessage;
+//#endregion
+//#region src/signer/types.d.ts
+/** The signer a client signs with and the executor signs synthesized operations with. */
+type SignerConfig = {
+  /**
+   * The signer used to sign actions before submission.
+   */
+  signer: ISigner;
+  /**
+   * What a pooled executor worker imports to build the same signer, which
+   * cannot cross the thread boundary itself. Omitted = pooled workers store
+   * synthesized operations unsigned.
+   */
+  workerSigner?: FactorySpec; /** Decides which keys may sign as which users; see {@link SignatureTrustPolicy}. */
+  trustPolicy?: SignatureTrustPolicy;
+  /**
+   * What a pooled executor worker imports to build the same trust policy.
+   * Omitted = pooled workers apply the default.
+   */
+  workerTrustPolicy?: FactorySpec;
 };
 /**
- * Reference to a module that the worker should `import()` at runtime,
- * along with the named export to pluck out as the factory.
+ * The host's answer to whether `key` may sign as `signer.user`. The reactor has
+ * already proven that `key` made the signature over this action in this
+ * document.
  *
- * Exactly one of `packageName` or `filePath` is provided.
+ * Asked once per signed write at admission, never on a re-append, and never for
+ * an unsigned action. `false` refuses the write as `SIGNER_UNAUTHORIZED`. A
+ * throw is a job error: the job is retried and nothing is dropped, so a
+ * transient failure must throw rather than answer `false`.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ModuleRef = {
-  /** Bare-specifier package name (resolved by the worker's module loader). */packageName: string; /** Named export within the module to invoke as the factory. */
-  exportName: string;
+ * The answer may not depend on when it is asked: replicas admit the same write
+ * at different times and must reach the same verdict. Cache an acceptance and
+ * never expire it.
+ *
+ * Key a cache on (`signer.user`, `key`) only. The reactor's own key signing as
+ * its current user is accepted before the policy is asked, read live on every
+ * ask, and never cached. Invalidate nothing when the local identity changes:
+ * other users' verdicts do not depend on it. Without a policy, a signed write
+ * is refused under `authEnforcement` and accepted otherwise.
+ */
+type SignatureTrustPolicy = {
+  authorizeSigner(signer: ActionSigner, key: string, documentId: string): Promise<boolean>;
+};
+/** `log` counts refusals and admits anyway; `enforce` refuses. */
+type SignatureVerificationMode = "log" | "enforce";
+declare const SIGNATURE_REFUSAL_CODES: readonly ["UNSIGNED_REQUIRED", "UNSIGNED_IDENTITY", "KEY_MISMATCH", "MALFORMED_TUPLE", "TIMESTAMP_MISMATCH", "HASH_MISMATCH", "BAD_SIGNATURE", "SCHEME_BELOW_POLICY", "ID_MISMATCH", "DUPLICATE_ACTION", "SIGNER_UNAUTHORIZED"];
+type SignatureRefusalCode = (typeof SIGNATURE_REFUSAL_CODES)[number];
+/** Read from the prefix or length of tuple[2]. */
+type SignatureScheme = "unsigned" | "v2" | "legacy-renown" | "legacy-shared" | "legacy-unknown";
+/** Where this reactor first stores the write. */
+type AdmissionPath = "mutation" | "load";
+type SignatureVerdict = {
+  ok: true;
+  scheme: SignatureScheme;
 } | {
-  /** Absolute or worker-resolvable file path to import. */filePath: string; /** Named export within the module to invoke as the factory. */
-  exportName: string;
+  ok: false;
+  scheme: SignatureScheme;
+  code: SignatureRefusalCode;
+  reason: string;
 };
+//#endregion
+//#region src/events/types.d.ts
 /**
- * Factory specification shared by the signature verifier and document
- * model spec channels. The worker imports `module.exportName` and invokes
- * it with `initArgs` to obtain the actual instance.
+ * Describes a function to unsubscribe from an event.
+ */
+type Unsubscribe = () => void;
+/**
+ * A subscriber is a function that is called when an event is emitted.
  *
- * `initArgs` must be JSON-clonable.
+ * It is passed the event type and the data.
+ * It can return a promise or a value.
+ * If it returns a promise, the event bus will wait for the promise to resolve before calling the next subscriber.
+ * If it throws an error, the event bus will reject with an aggregate error of all errors.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * @param type - The type of event to emit.
+ * @param data - The data to pass to the subscriber.
  */
-type FactorySpec = {
-  module: ModuleRef;
-  initArgs?: SanitizedArg;
+type Subscriber = (type: number, data: any) => void | Promise<void>;
+/**
+ * Custom error class that aggregates multiple errors from event subscribers.
+ */
+declare class EventBusAggregateError extends Error {
+  readonly errors: any[];
+  constructor(errors: unknown[]);
+}
+/**
+ * Event types for reactor lifecycle events.
+ */
+declare const ReactorEventTypes: {
+  readonly JOB_PENDING: 10001;
+  readonly JOB_RUNNING: 10002;
+  readonly JOB_WRITE_READY: 10003;
+  readonly JOB_READ_READY: 10004;
+  readonly JOB_FAILED: 10005;
+  readonly READMODEL_BATCH_COMPLETED: 10006;
+  readonly READMODEL_INDEXED: 10007;
+  readonly MODEL_LOADED: 10008;
+  readonly SIGNATURE_REFUSED: 10009;
 };
 /**
- * Factory spec for the signature verifier the worker should instantiate.
- *
- * Structurally identical to {@link FactorySpec}; the alias exists so call
- * sites read intent-fully.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Stage within ReadModelCoordinator.runChain. Used as a dimension on
+ * stage-attribution events and histograms.
+ */
+type ReadModelStage = "pre_ready" | "emit" | "post_ready";
+/**
+ * Stage in which an individual read model ran. The emit stage does not
+ * involve a read model so it is excluded from this discriminant.
  */
-type SignatureVerifierSpec = FactorySpec;
+type ReadModelIndexingStage = "pre_ready" | "post_ready";
 /**
- * Factory spec for a document model module the worker should instantiate.
- *
- * Structurally identical to {@link FactorySpec}; the alias exists so call
- * sites read intent-fully.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Emitted after the resolver loads a model on demand, so peers load it too.
  */
-type DocumentModelSpec = FactorySpec;
+type ModelLoadedEvent = {
+  documentType: string;
+};
 /**
- * One entry in the document model manifest the worker materializes on
- * startup (or extends lazily via `load-model`).
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Event emitted when a job is registered and waiting to be executed.
  */
-type ModelManifestEntry = {
-  /** Document type identifier (e.g. "ph/account"). */documentType: string; /** Document model version this entry registers. */
-  version: string; /** Factory spec the worker imports and invokes to obtain the model. */
-  spec: DocumentModelSpec;
+type JobPendingEvent = {
+  jobId: string;
+  jobMeta: JobMeta;
 };
 /**
- * JSON-clonable Postgres connection info passed to the worker so it can
- * open its own pool. Storage-specific wiring may extend this shape in
- * later phases.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Event emitted when a job starts executing.
  */
-type DbConfig = {
-  host: string;
-  port: number;
-  database: string;
-  user: string;
-  password: string;
-  ssl?: boolean;
-  applicationName?: string;
-  poolSize?: number;
+type JobRunningEvent = {
+  jobId: string;
+  jobMeta: JobMeta;
+};
+/**
+ * Event emitted when operations are written to IOperationStore.
+ * Contains the operations directly to avoid round-trip queries.
+ */
+type JobWriteReadyEvent = {
+  jobId: string;
+  operations: OperationWithContext$1[];
+  jobMeta: JobMeta;
   /**
-   * Maximum time (ms) a caller will wait to acquire a connection from the
-   * pool before pg.Pool throws. When omitted, pg defaults to 0 (unlimited
-   * wait), which hides acquire-starvation as silent latency.
+   * The ids of the actions the caller submitted with this job. `operations`
+   * can also carry operations the job merely moved into a new position, so a
+   * consumer reporting back to the caller needs this to tell the two apart.
+   * Absent on jobs that carry no submitted actions.
    */
-  connectionTimeoutMillis?: number;
+  submittedActionIds?: string[];
   /**
-   * How long (ms) an idle connection stays open before pg closes it. When
-   * omitted, pg defaults to 10000.
+   * Maps documentId to the collection IDs it belongs to.
+   * Used by SyncManager to route operations only to remotes
+   * whose collection contains the document.
    */
-  idleTimeoutMillis?: number;
+  collectionMemberships?: Record<string, string[]>;
 };
 /**
- * Configuration for the executor worker pool.
- *
- * Mirrors the `workerPool` sub-config on {@link JobExecutorConfig};
- * a later card wires this into the executor config.
+ * Event emitted after all read models have finished processing operations.
+ * This event fires after JOB_WRITE_READY and guarantees that:
+ * - All read models (DocumentView, DocumentIndexer, etc.) have indexed the operations
+ * - All consistency trackers have been updated with the new operation indices
+ * - Queries without consistency tokens will now see the updated data
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * This event is useful for:
+ * - Test synchronization (knowing when read models are ready)
+ * - Observability (measuring read model latency)
+ * - Event-driven workflows (triggering downstream processes)
  */
-type WorkerPoolConfig = {
-  /** Whether the worker pool is active; when false the executor runs in-process. */enabled: boolean; /** Number of worker instances to spawn. */
-  numWorkers: number; /** Worker isolation mode. */
-  workerType: "thread" | "process"; /** Optional heartbeat interval in milliseconds. */
-  heartbeatMs?: number; /** Optional per-worker Postgres pool size override. */
-  workerPgPoolSize?: number;
+type JobReadReadyEvent = {
+  jobId: string;
+  operations: OperationWithContext$1[];
 };
 /**
- * Payload the worker reports back when a job's write phase is complete.
- *
- * Parent fills `collectionMemberships` at emission time, so it is
- * intentionally absent from the worker -> parent message.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Event emitted when a job fails with an unrecoverable error.
+ * This event allows the JobAwaiter and other subscribers to react to job failures
+ * without polling.
  */
-type JobWriteReadyPayload = {
-  operations: OperationWithContext$1[];
-  jobMeta: JobMeta;
+type JobFailedEvent$1 = {
+  jobId: string;
+  error: Error;
+  job?: Job;
 };
 /**
- * Initializes a freshly spawned worker with the configuration and
- * factories it needs to start executing jobs.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Event emitted once per batch processed by ReadModelCoordinator.runChain,
+ * after all three projection stages complete. Carries per-stage wall times,
+ * the chain wait time, and the batch size so projection cost can be
+ * attributed by an observer.
  */
-type InitMessage = {
-  type: "init";
-  correlationId: string;
-  workerId: string;
-  poolConfig: WorkerPoolConfig;
-  db: DbConfig; /** Omitted = the worker performs no executor-side signature verification. */
-  signatureVerifier?: SignatureVerifierSpec;
-  models: ModelManifestEntry[]; /** Omitted = the worker builds its executor with the built-in defaults. */
-  executorConfig?: JobExecutorConfig;
+type ReadModelBatchCompletedEvent = {
+  jobId: string;
+  batchSize: number;
+  chainWaitDurationMs: number;
+  preReadyDurationMs: number;
+  emitDurationMs: number;
+  postReadyDurationMs: number;
+};
+/**
+ * Event emitted once per individual read model per batch and stage, after
+ * that read model's indexOperations call resolves (or rejects). Lets
+ * observers attribute projection cost to a specific read model.
+ */
+type ReadModelIndexedEvent = {
+  jobId: string;
+  readModelName: string;
+  stage: ReadModelIndexingStage;
+  durationMs: number;
+  operationCount: number;
+  success: boolean;
+};
+/** A write failed admission; `enforced` is false in log mode, which admits it. */
+type SignatureRefusedEvent = {
+  jobId: string;
+  documentId: string;
+  scope: string;
+  branch: string;
+  actionId: string;
+  code: SignatureRefusalCode;
+  scheme: SignatureScheme;
+  path: AdmissionPath;
+  enforced: boolean;
+  reason: string;
 };
+//#endregion
+//#region src/events/interfaces.d.ts
+/**
+ * Describes an object that manages event subscriptions and emissions.
+ */
+interface IEventBus {
+  /**
+   * Register a new subscriber.
+   * Order is preserved by pushing to the end of the per-type array.
+   *
+   * @param type - The type of event to subscribe to.
+   * @param subscriber - The subscriber function to call when the event is emitted.
+   *
+   * @returns A function to unsubscribe from the event.
+   */
+  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
+  /**
+   * Emits an event and waits until **all** subscribers finish.
+   *  - Every subscriber present at emit-start is called, in registration order.
+   *  - Calls are invoked and settled sequentially.
+   *  - If subscribers throw/reject, `emit` rejects with an aggregate error of all errors.
+   *
+   * @param type - The type of event to emit.
+   * @param data - The data to pass to the subscribers.
+   */
+  emit(type: number, data: any): Promise<void>;
+}
+//#endregion
+//#region src/shared/awaiter.d.ts
+interface IJobAwaiter {
+  /**
+   * Waits for a job to complete: turns a job into a promise.
+   *
+   * @param jobId - The job id or job object
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The result of the job
+   */
+  waitForJob(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
+  /**
+   * Shuts down the job awaiter. This will synchronously reject all pending jobs.
+   */
+  shutdown(): void;
+}
 /**
- * Dispatches a job to the worker for execution.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Event-driven implementation of IJobAwaiter.
+ * Subscribes to operation events to detect job completion without polling.
  */
-type ExecuteMessage = {
-  type: "execute";
-  correlationId: string;
-  job: Job;
-};
+declare class JobAwaiter implements IJobAwaiter {
+  private eventBus;
+  private getJobStatus;
+  private pendingJobs;
+  private unsubscribers;
+  constructor(eventBus: IEventBus, getJobStatus: (jobId: string, signal?: AbortSignal) => Promise<JobInfo>);
+  private subscribeToEvents;
+  shutdown(): void;
+  waitForJob(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
+  private handleWriteReady;
+  private handleReadReady;
+  private handleJobFailed;
+  private checkAndResolveWaiters;
+}
+//#endregion
+//#region src/subs/types.d.ts
 /**
- * Requests cancellation of an in-flight job.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Error handler for subscription callback errors
  */
-type AbortMessage = {
-  type: "abort";
-  correlationId: string; /** correlationId of the `execute` message being aborted. */
-  targetCorrelationId: string;
-  reason?: string;
-};
+interface ISubscriptionErrorHandler {
+  /**
+   * Called when a subscription callback throws an error
+   * @param error - The error that was thrown
+   * @param context - Context about which subscription failed
+   */
+  handleError(error: unknown, context: SubscriptionErrorContext): void;
+}
 /**
- * Asks the worker to drain in-flight work and exit.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Context information about a subscription error
  */
-type ShutdownMessage = {
-  type: "shutdown";
-  correlationId: string; /** Optional grace period before the parent force-terminates the worker. */
-  graceMs?: number;
-};
+interface SubscriptionErrorContext {
+  /** The type of event that was being processed */
+  eventType: "created" | "deleted" | "updated" | "relationshipChanged";
+  /** The subscription ID that failed */
+  subscriptionId: string;
+  /** Optional additional data about the event */
+  eventData?: unknown;
+}
 /**
- * Lazily registers an additional document model on a running worker.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Interface for subscribing to document events in the reactor.
  */
-type LoadModelMessage = {
-  type: "load-model";
-  correlationId: string;
-  model: ModelManifestEntry;
+interface IReactorSubscriptionManager {
+  /**
+   * Subscribes to document creation events
+   *
+   * @param callback - Function called when documents are created
+   * @param search - Optional search filter to limit which documents trigger events
+   * @param view - Optional filter containing branch and scopes information
+   * @returns A function that unsubscribes from the events
+   */
+  onDocumentCreated(callback: (result: PagedResults<string>) => void, search?: SearchFilter): () => void;
+  /**
+   * Subscribes to document deletion events
+   *
+   * @param callback - Function called when documents are deleted
+   * @param search - Optional search filter to limit which documents trigger events
+   * @returns A function that unsubscribes from the events
+   */
+  onDocumentDeleted(callback: (documentIds: string[]) => void, search?: SearchFilter): () => void;
+  /**
+   * Subscribes to document state updates
+   *
+   * @param callback - Function called when documents are updated
+   * @param search - Optional search filter to limit which documents trigger events
+   * @param view - Optional filter containing branch and scopes information
+   * @returns A function that unsubscribes from the events
+   */
+  onDocumentStateUpdated(callback: (result: PagedResults<PHDocument>) => void, search?: SearchFilter, view?: ViewFilter): () => void;
+  /**
+   * Subscribes to parent-child relationship change events
+   *
+   * @param callback - Function called when parent-child relationships change
+   * @param search - Optional search filter to limit which documents trigger events
+   * @returns A function that unsubscribes from the events
+   */
+  onRelationshipChanged(callback: (parentId: string, childId: string, changeType: RelationshipChangeType) => void, search?: SearchFilter): () => void;
+}
+//#endregion
+//#region src/decision/types.d.ts
+/** One operation stream. */
+type StreamQuery = {
+  documentId: string;
+  branch: string;
+  scope: string;
 };
 /**
- * Union of all messages the parent may send to a worker.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ParentMessage = InitMessage | ExecuteMessage | AbortMessage | ShutdownMessage | LoadModelMessage;
-/**
- * Announces that the worker has finished `init` and is ready to accept
- * `execute` messages.
+ * What building a decision model reads a stream's state through.
  *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * `IWriteCache` satisfies this and is what the write paths pass. The read path
+ * cannot: the write cache is a write-side projection invalidated by the process
+ * that runs the executor, so a reactor whose executors live in worker processes
+ * holds state in its parent that no commit ever invalidates. A read there would
+ * decide against a policy arbitrarily far behind the one the write paths
+ * enforce. Reads therefore pass a reader backed by the read side.
  */
-type ReadyMessage = {
-  type: "ready"; /** correlationId of the originating `init` message. */
-  correlationId: string;
-  workerId: string;
+interface IStreamStateReader {
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+}
+/** The document and branch a decision model is built for. */
+type DecisionTarget = {
+  documentId: string;
+  branch: string;
 };
 /**
- * Final result for an `execute` job.
- *
- * On success, `writeReady` carries the operations and job meta the
- * parent needs to emit `JOB_WRITE_READY`. On failure, `error` is set
- * and `result.success` is false.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * What a decision's conditions may read beyond the projections: the executing
+ * scope's own state and the attempted action's input. Populated only while
+ * authConditions is on; otherwise both stay undefined and conditional grants
+ * never apply.
  */
-type ResultMessage = {
-  type: "result"; /** correlationId of the originating `execute` message. */
-  correlationId: string;
-  result: JobResult;
-  writeReady?: JobWriteReadyPayload;
-  error?: ErrorInfo;
+type DecisionContext = {
+  scopeState: unknown;
+  actionInput?: unknown;
 };
-/**
- * Acknowledges that a `load-model` request succeeded.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type ModelLoadedMessage = {
-  type: "model-loaded"; /** correlationId of the originating `load-model` message. */
-  correlationId: string;
-  documentType: string;
-  version: string;
+/** A statically-queried stream's operations, named after its projection. */
+type StreamHistory = {
+  name: string;
+  operations: Operation[];
 };
 /**
- * Reports that a `load-model` request failed.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * A named stream whose value in the model is that scope's state from the
+ * document rebuild the reactor already performs. A derived query may read
+ * only statically-queried projections, so composition is one layer deep.
  */
-type ModelLoadFailedMessage = {
-  type: "model-load-failed"; /** correlationId of the originating `load-model` message. */
-  correlationId: string;
-  documentType: string;
-  version: string;
-  error: ErrorInfo;
+type Projection<M> = {
+  query: StreamQuery | ((model: Partial<M>) => StreamQuery[]);
+  /**
+   * For a derived projection, the streams it may read anywhere in an
+   * evaluated range, derived from the statically-queried streams' operations
+   * (including the operations under evaluation). A positional walk cannot use
+   * `query`, because the folded state it depends on changes over the range;
+   * this over-approximates by design, since a stream referenced at any
+   * position stays readable when the earlier range is re-evaluated even if a
+   * later operation removes the reference. Ignored on static projections.
+   */
+  queryOverHistory?: (reads: StreamHistory[]) => StreamQuery[];
+  /**
+   * Action types in this stream that can change an evaluation. Reads of the stream
+   * are filtered to these, so anything left out is invisible to a decision.
+   */
+  decidingActions: string[]; /** Applies one of this stream's operations while deciding. */
+  apply: (document: PHDocument, operation: Operation) => PHDocument;
 };
 /**
- * Forwarded log line from the worker. `args` is constrained to
- * {@link SanitizedArg} so callers cannot accidentally ship non-clonable
- * values across the boundary.
- *
- * The sanitizer in `./sanitize.ts` enforces the {@link SanitizedArg}
- * invariant on the producer side before each message is posted.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * The outcome of evaluating one operation. A refusal carries the reason it is
+ * recorded with, because a model has more than one way to refuse.
  */
-type LogMessage = {
-  type: "log";
-  level: "debug" | "info" | "warn" | "error";
-  message: string;
-  args: SanitizedArg[]; /** Epoch milliseconds at which the worker generated the log line. */
-  timestamp: number;
+type Evaluation = {
+  decision: "allow";
+} | {
+  decision: "deny";
+  reason: string;
+};
+/** Projections plus a decision function over the built model. */
+type DecisionModel<M> = {
+  projections: { [K in keyof M]: Projection<M> };
+  /**
+   * Present when decide reads the executing scope's state through the
+   * decision context. A positional walk then folds the evaluated stream with
+   * this, from its base state through every effective operation, so
+   * conditions read the state as it stood at each operation's position
+   * rather than at the head.
+   */
+  foldEvaluatedScope?: (document: PHDocument, operation: Operation) => PHDocument;
+  /**
+   * Whether or not this model decides about operations in a given scope. That
+   * is, a scope it reads is not necessarily one it evaluates, and vise-versa.
+   */
+  evaluatesScope(scope: string): boolean;
+  decide(model: M, subject: AuthSubject, request: AuthRequest, ctx: DecisionContext): Evaluation;
 };
-/**
- * Periodic liveness signal. Included now to unblock Phase-3 scaffolding;
- * the wiki marks heartbeats as a Phase-5 future extension.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
- */
-type HeartbeatMessage = {
-  type: "heartbeat";
-  workerId: string; /** Epoch milliseconds the worker generated the heartbeat. */
-  timestamp: number; /** Optional snapshot of in-flight job correlation ids. */
-  inFlightCorrelationIds?: string[];
+/** A built model plus the read-set condition recording what the build read. */
+type BuiltDecisionModel<M> = {
+  model: M;
+  appendCondition: AppendCondition;
 };
+//#endregion
+//#region src/client/types.d.ts
 /**
- * Periodic counters / gauges the worker reports for observability.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Describes the types of document changes that can occur.
  */
-type MetricsMessage = {
-  type: "metrics";
-  workerId: string; /** Epoch milliseconds the worker generated the metrics snapshot. */
-  timestamp: number;
-  counters: {
-    [name: string]: number;
-  };
-  gauges: {
-    [name: string]: number;
-  };
-};
+declare enum DocumentChangeType {
+  Created = "created",
+  Deleted = "deleted",
+  Updated = "updated",
+  ParentAdded = "parent_added",
+  ParentRemoved = "parent_removed",
+  ChildAdded = "child_added",
+  ChildRemoved = "child_removed"
+}
 /**
- * Snapshot of one worker pool's acquire-wait samples and pool-stat counters,
- * forwarded periodically so the host can re-record into the shared
- * pg.Pool histogram and observable gauges. The worker owns the real
- * pg.Pool; the host's {@link PoolInstrumentation} is a forwarder driven
- * by these messages.
+ * Represents a change event for documents.
  */
-type PoolAcquireSamplesMessage = {
-  type: "pool-acquire-samples";
-  workerId: string; /** Stable identifier matching the host-side instrumentation name (e.g. "worker-0"). */
-  poolName: string; /** Epoch milliseconds the worker generated the batch. */
-  timestamp: number; /** Acquire-wait durations (ms) accumulated since the previous batch. */
-  durations: number[]; /** Most recent pg.Pool counter snapshot at batch send time. */
-  size: number;
-  idle: number;
-  waiting: number;
+type DocumentChangeEvent = {
+  type: DocumentChangeType;
+  documents: PHDocument[];
+  context?: {
+    parentId?: string;
+    childId?: string;
+  };
 };
 /**
- * Union of all messages a worker may send to the parent.
- *
- * @see Wire Protocol Reference wiki page
- *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
+ * Options for creating an empty document.
  */
-type WorkerMessage = ReadyMessage | ResultMessage | ModelLoadedMessage | ModelLoadFailedMessage | LogMessage | HeartbeatMessage | MetricsMessage | PoolAcquireSamplesMessage;
-//#endregion
-//#region src/core/model-sources.d.ts
-/** An importable file holding one or more document-model exports. */
-type FileModelSource = {
-  filePath: string;
-  exportName?: string;
-};
-/** An importable package specifier holding one or more document-model exports. */
-type PackageModelSource = {
-  packageName: string;
-  subpath?: string;
-  exportName?: string;
+type CreateDocumentOptions = {
+  /** Optional "id" or "slug" of parent document */parentIdentifier?: string; /** Optional version of the document model to use (defaults to latest) */
+  documentModelVersion?: number; /** Merged over the model's defaults; `signature: 2` makes it v2-required. */
+  protocolVersions?: {
+    [protocol: string]: number;
+  }; /** Overrides the client's creation default for this document. */
+  signaturePolicy?: SignaturePolicy;
 };
 /**
- * A source of document models: a live module, an importable file, or an
- * importable package. File and package sources can cross a worker-thread
- * boundary (workers re-import them); a live module cannot.
+ * Options for upgrading a document.
  */
-type DocumentModelSource = DocumentModelModule<any> | FileModelSource | PackageModelSource;
-//#endregion
-//#region src/registry/interfaces.d.ts
-type RegistrationResult<T> = {
-  status: "success";
-  item: T;
-} | {
-  status: "error";
-  item: T;
-  error: Error;
+type UpgradeDocumentOptions = {
+  /**
+   * How many times to retry with a fresh read when the executor rejects the
+   * upgrade because the document changed after it was read. Defaults to
+   * {@link DEFAULT_UPGRADE_CONFLICT_RETRIES}.
+   */
+  maxConflictRetries?: number;
 };
 /**
- * Loader that asynchronously resolves a document type to a
- * {@link DocumentModelSource}. Used by the queue to gate CREATE_DOCUMENT
- * jobs until the required model is available in the registry.
+ * Drive-aware operations grouped under `client.drives`.
  *
- * Return an importable source ({ filePath } or { packageName }) whenever
- * possible: the resolver registers the resolved models on the host registry
- * and broadcasts importable sources to executor workers. A live
- * DocumentModelModule is also valid but host-only — it cannot cross a
- * worker-thread boundary, so worker pools will not receive it.
- */
-interface IDocumentModelLoader {
-  load(documentType: string): Promise<DocumentModelSource>;
-}
-/**
- * Registry for managing document model modules.
- * Provides centralized access to document models' reducers, utils, and specifications.
- * Supports version-aware module storage and upgrade manifest management.
+ * These methods orchestrate the multi-action, multi-document choreography
+ * required to keep a drive's `state.global.nodes` array consistent with the
+ * relationship index and the underlying documents. Use the flat
+ * `IReactorClient` primitives (`get`, `execute`, `find`) for everything that
+ * is not drive-aware.
  */
-interface IDocumentModelRegistry {
-  /**
-   * Register multiple modules at once.
-   * Modules without a version field default to version 1.
-   * Invalid or duplicate modules are skipped without breaking registration of the remaining modules.
-   *
-   * @param modules Document model modules to register
-   * @returns Array of results, one per module, indicating success or failure
-   */
-  registerModules(...modules: DocumentModelModule<any>[]): RegistrationResult<DocumentModelModule<any>>[];
+interface IDriveClient {
   /**
-   * Unregister all versions of the specified document types.
-   *
-   * @param documentTypes The document types to unregister
-   * @returns true if all modules were unregistered, false if any were not found
+   * Creates a new drive document and waits for completion.
    */
-  unregisterModules(...documentTypes: string[]): boolean;
+  create(input: DriveInput, signal?: AbortSignal): Promise<DocumentDriveDocument>;
   /**
-   * Get a specific document model module by document type and optional version.
-   * If version is not specified, returns the latest version.
+   * Adds a document to a drive as a single batched operation.
    *
-   * @param documentType The document type identifier
-   * @param version Optional version number to retrieve
-   * @returns The document model module
-   * @throws ModuleNotFoundError if the document type or version is not registered
+   * Issues CREATE_DOCUMENT, UPGRADE_DOCUMENT, ADD_RELATIONSHIP on the new
+   * document and ADD_FILE on the drive in a single dependent batch.
    */
-  getModule(documentType: string, version?: number): DocumentModelModule<any>;
+  addFile<TDocument extends PHDocument = PHDocument>(driveIdentifier: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
   /**
-   * Get all registered document model modules.
-   *
-   * @returns Array of all registered modules
+   * Adds a folder node to a drive.
    */
-  getAllModules(): DocumentModelModule<any>[];
+  addFolder(driveIdentifier: string, name: string, parentFolder?: string, signal?: AbortSignal): Promise<FolderNode>;
   /**
-   * Clear all registered modules and upgrade manifests.
+   * Removes a node from a drive. Folder nodes cascade: descendant file
+   * documents are deleted first, then the folder node entry itself.
    */
-  clear(): void;
+  removeNode(driveIdentifier: string, nodeId: string, signal?: AbortSignal): Promise<void>;
   /**
-   * Get all supported versions for a document type, sorted in ascending order.
-   *
-   * @param documentType The document type identifier
-   * @returns Array of version numbers sorted ascending
-   * @throws ModuleNotFoundError if no modules are registered for the document type
+   * Renames a node. Updates both the underlying document header and the
+   * drive's node entry.
    */
-  getSupportedVersions(documentType: string): number[];
+  renameNode(driveIdentifier: string, nodeId: string, name: string, signal?: AbortSignal): Promise<Node>;
   /**
-   * Get the latest (highest) version number for a document type.
-   *
-   * @param documentType The document type identifier
-   * @returns The highest version number registered for this document type
-   * @throws ModuleNotFoundError if no modules are registered for the document type
+   * Updates the preferred editor recorded in the document header meta for
+   * a node. Pass `null` to clear it.
    */
-  getLatestVersion(documentType: string): number;
+  setPreferredEditorOnNode(nodeId: string, preferredEditor: string | null, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * Register upgrade manifests that define upgrade paths between versions.
-   * Invalid or duplicate manifests are skipped without breaking registration of the remaining manifests.
-   *
-   * @param manifests Upgrade manifests to register
-   * @returns Array of results, one per manifest, indicating success or failure
+   * Moves a node to a different parent folder within the same drive.
+   * Pass `undefined` to move the node to the drive root.
    */
-  registerUpgradeManifests(...manifests: UpgradeManifest<readonly number[]>[]): RegistrationResult<UpgradeManifest<readonly number[]>>[];
-  /**
-   * Unregister upgrade manifests for the specified document types.
-   * @param documentTypes The document types whose upgrade manifests should be unregistered
-   * @returns true if all modules were unregistered, false if any were not found
-   **/
-  unregisterUpgradeManifests(...documentTypes: string[]): boolean;
+  moveNode(driveIdentifier: string, srcNodeId: string, targetParentFolderId: string | undefined, signal?: AbortSignal): Promise<DocumentDriveDocument>;
   /**
-   * Get the upgrade manifest for a document type.
-   *
-   * @param documentType The document type identifier
-   * @returns The upgrade manifest
-   * @throws ManifestNotFoundError if no manifest is registered for the document type
+   * Copies a node (and its subtree, if it is a folder) within a drive.
+   * Each copied file gets a new id and a duplicated document.
    */
-  getUpgradeManifest(documentType: string): UpgradeManifest<readonly number[]>;
+  copyNode(driveIdentifier: string, srcNodeId: string, targetParentFolderId: string | undefined, signal?: AbortSignal): Promise<DocumentDriveDocument>;
   /**
-   * Compute the upgrade path from one version to another.
-   * Returns the sequence of upgrade transitions needed.
-   *
-   * @param documentType The document type identifier
-   * @param fromVersion The starting version
-   * @param toVersion The target version
-   * @returns Array of upgrade transitions in order
-   * @throws DowngradeNotSupportedError if toVersion is less than fromVersion
-   * @throws ManifestNotFoundError if no upgrade manifest is registered
-   * @throws MissingUpgradeTransitionError if any transition in the path is missing
+   * Returns a single node from the drive's `state.global.nodes` array.
    */
-  computeUpgradePath(documentType: string, fromVersion: number, toVersion: number): UpgradeTransition[];
+  getNode(driveIdentifier: string, nodeId: string, signal?: AbortSignal): Promise<Node>;
   /**
-   * Get the upgrade reducer for a single-step version transition.
+   * Returns nodes in the drive, optionally filtered by parent folder:
+   * - omit `parentFolder` (or pass `undefined`) to list every node in the drive.
+   * - pass `null` to list only root-level nodes.
+   * - pass a folder id to list only the direct children of that folder.
    *
-   * @param documentType The document type identifier
-   * @param fromVersion The starting version
-   * @param toVersion The target version (must be fromVersion + 1)
-   * @returns The upgrade reducer function
-   * @throws InvalidUpgradeStepError if toVersion is not fromVersion + 1
-   * @throws ManifestNotFoundError if no upgrade manifest is registered
-   * @throws MissingUpgradeTransitionError if the transition is not found
+   * Returns a paged result so callers can stream through drives with very
+   * large node counts without materialising the whole list in memory.
    */
-  getUpgradeReducer(documentType: string, fromVersion: number, toVersion: number): UpgradeReducer<any, any>;
+  listNodes(driveIdentifier: string, parentFolder?: string | null, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Node>>;
 }
-//#endregion
-//#region src/cache/buffer/ring-buffer.d.ts
 /**
- * RingBuffer is a generic circular buffer implementation that stores a fixed number
- * of items. When the buffer is full, new items overwrite the oldest items.
+ * One operation an authorization preflight predicts a verdict for. The input is
+ * what a conditional grant reads, so a candidate standing for a filled-in form
+ * carries that form's input.
+ */
+type ActionCandidate = {
+  scope: string;
+  type: string;
+  input?: unknown;
+};
+/**
+ * The predicted verdicts for a set of candidates, in the order they were given,
+ * with the aggregates a UI branches on.
  *
- * This implementation maintains O(1) time complexity for push operations and provides
- * items in chronological order (oldest to newest) via getAll().
+ * The aggregates are redundant -- a verdict is binary, so `allDenied` is
+ * `!anyAllowed` and `anyDenied` is `!allAllowed` -- and all four are returned
+ * so that a caller reads the one its question is phrased in rather than
+ * negating another. Over no candidates every aggregate is false: nothing is
+ * allowed and nothing is denied.
+ */
+type ActionEvaluations = {
+  evaluations: Evaluation[];
+  allAllowed: boolean;
+  anyAllowed: boolean;
+  allDenied: boolean;
+  anyDenied: boolean;
+};
+/**
+ * The ReactorClient interface that wraps lower-level APIs to provide
+ * a simpler interface for document operations.
  *
- * @template T - The type of items stored in the buffer
+ * Features:
+ * - Wraps Jobs with Promises for easier async handling
+ * - Manages signing of submitted Action objects
+ * - Provides quality-of-life functions for common tasks
+ * - Wraps subscription interface with ViewFilters
  */
-declare class RingBuffer<T> {
-  private buffer;
-  private head;
-  private size;
-  private capacity;
-  constructor(capacity: number);
+interface IReactorClient {
   /**
-   * Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
+   * Drive-aware operations. See {@link IDriveClient}.
+   */
+  readonly drives: IDriveClient;
+  /**
+   * Retrieves a list of document model modules.
    *
-   * @param item - The item to add
+   * @param namespace - Optional namespace like "powerhouse" or "sky", defaults to ""
+   * @param paging - Optional pagination options
+   * @param signal - Optional abort signal to cancel the request
+   * @returns List of document model modules
    */
-  push(item: T): void;
+  getDocumentModelModules(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
   /**
-   * Returns all items in the buffer in chronological order (oldest to newest).
+   * Retrieves a specific document model module by document type.
    *
-   * @returns Array of items in insertion order
+   * @param documentType - The document type identifier
+   * @returns The document model module
    */
-  getAll(): T[];
+  getDocumentModelModule(documentType: string): Promise<DocumentModelModule<any>>;
   /**
-   * Clears all items from the buffer.
+   * Retrieves a specific document by identifier (either id or slug).
+   *
+   * @param identifier - Required, this is the document id or slug
+   * @param view - Optional filter containing branch and scopes information
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The up-to-date PHDocument with scopes and list of child document ids
    */
-  clear(): void;
+  get<TDocument extends PHDocument>(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<TDocument>;
   /**
-   * Gets the current number of items in the buffer.
+   * Resolves an identifier (either an id or a slug) to the canonical document
+   * id, using the same lookup as the read/operation data paths. Resolves
+   * against the "main" branch. Throws if the identifier cannot be resolved or
+   * is ambiguous.
+   *
+   * @param identifier - Required, this is the document id or slug
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The canonical document id
    */
-  get length(): number;
-}
-//#endregion
-//#region src/cache/kysely-write-cache.d.ts
-type DocumentStream = {
-  key: string;
-  ringBuffer: RingBuffer<CachedSnapshot>;
-};
-/**
- * In-memory write cache with keyframe persistence for PHDocuments.
- *
- * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
- * rebuilds documents from nearest keyframe or full operation history.
- *
- * **Performance Characteristics:**
- * - Cache hit: O(1) lookup in ring buffer
- * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
- * - Warm miss: O(m) where m is operations since cached revision
- * - Eviction: O(1) for LRU tracking and removal
- *
- * **Thread Safety:**
- * Not thread-safe. Designed for single-threaded job executor environment.
- * External synchronization required for concurrent access across multiple executors.
- *
- * **Example:**
- * ```typescript
- * const cache = new KyselyWriteCache(
- *   keyframeStore,
- *   operationStore,
- *   registry,
- *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
- * );
- *
- * await cache.startup();
- *
- * // Retrieve or rebuild document
- * const doc = await cache.getState(docId, docType, scope, branch, revision);
- *
- * // Cache result after job execution
- * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
- *
- * await cache.shutdown();
- * ```
- */
-declare class KyselyWriteCache implements IWriteCache {
-  private streams;
-  private lruTracker;
-  private keyframeStore;
-  private operationStore;
-  private registry;
-  private config;
-  constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
-  withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
+  resolveIdOrSlug(identifier: string, view?: ViewFilter, signal?: AbortSignal): Promise<string>;
+  /** True when the id is taken; a soft-deleted document's id is still taken. */
+  isDocumentIdTaken(documentId: string, signal?: AbortSignal): Promise<boolean>;
   /**
-   * Initializes the write cache.
-   * Currently a no-op as keyframe store lifecycle is managed externally.
+   * Retrieves operations for a document.
+   *
+   * @param documentIdentifier - Required, this is either a document "id" field or a "slug"
+   * @param view - Optional filter containing branch and scopes information
+   * @param filter - Optional filter for actionTypes, timestamps, and revision
+   * @param paging - Optional pagination options
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Paginated list of operations
    */
-  startup(): Promise<void>;
+  getOperations(documentIdentifier: string, view?: ViewFilter, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
   /**
-   * Shuts down the write cache.
-   * Currently a no-op as keyframe store lifecycle is managed externally.
+   * Retrieves outgoing relationships of a given type from a source document.
+   *
+   * @param sourceIdentifier - Required, this is either a document "id" field or a "slug"
+   * @param relationshipType - The relationship type to filter by
+   * @param view - Optional filter containing branch and scopes information
+   * @param paging - Optional pagination options
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The target documents and paging cursor
    */
-  shutdown(): Promise<void>;
+  getOutgoingRelationships(sourceIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
   /**
-   * Retrieves document state at a specific revision from cache or rebuilds it.
+   * Retrieves incoming relationships of a given type to a target document.
    *
-   * Note: this returns a _shallow_ copy of the document.
+   * @param targetIdentifier - Required, this is either a document "id" field or a "slug"
+   * @param relationshipType - The relationship type to filter by
+   * @param view - Optional filter containing branch and scopes information
+   * @param paging - Optional pagination options
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The source documents and paging cursor
+   */
+  getIncomingRelationships(targetIdentifier: string, relationshipType: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
+  /**
+   * Retrieves the outgoing relationship edges of a source document.
    *
-   * Cache hit path: Returns cached snapshot if available (O(1))
-   * Warm miss path: Rebuilds from cached base revision + incremental ops
-   * Cold miss path: Rebuilds from keyframe or from scratch using all operations
+   * Unlike {@link IReactorClient.getOutgoingRelationships}, which returns the
+   * documents at the far end, this returns the edges themselves, carrying the
+   * metadata and timestamps recorded against each relationship.
    *
-   * @param documentId - The document identifier
-   * @param scope - The operation scope
-   * @param branch - The operation branch
-   * @param targetRevision - The target revision, or undefined for newest
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The document at the target revision
-   * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {ModuleNotFoundError} If document type not registered in registry
-   * @throws {Error} "Failed to rebuild document" if operation store fails
-   * @throws {Error} If reducer throws during operation application
-   * @throws {Error} If document serialization fails
+   * @param sourceIdentifier - Required, this is either a document "id" field or a "slug"
+   * @param relationshipType - Optional relationship type to filter by
+   * @param view - Optional filter containing branch and scopes information
+   * @param paging - Optional pagination options
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The matching relationship edges and paging cursor
    */
-  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  getOutgoingRelationshipEdges(sourceIdentifier: string, relationshipType?: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentRelationship>>;
   /**
-   * Stores a document snapshot in the cache at a specific revision.
-   *
-   * The cached document is a shallow copy of the input with its operation history
-   * truncated to the last operation per scope and its clipboard cleared. This keeps
-   * memory use and copy costs constant regardless of operation count. Consumers of
-   * getState() must not rely on the full operation history being present; the only
-   * guaranteed invariant is that operations[scope].at(-1) reflects the latest
-   * operation index for each scope.
+   * Retrieves the incoming relationship edges of a target document.
    *
-   * Updates LRU tracker and may evict least recently used stream if at capacity.
-   * Asynchronously persists keyframes at configured intervals (fire-and-forget).
+   * Unlike {@link IReactorClient.getIncomingRelationships}, which returns the
+   * documents at the far end, this returns the edges themselves, carrying the
+   * metadata and timestamps recorded against each relationship.
    *
-   * @param documentId - The document identifier
-   * @param scope - The operation scope
-   * @param branch - The operation branch
-   * @param revision - The revision number
-   * @param document - The document to cache
-   * @throws {Error} If document serialization fails
+   * @param targetIdentifier - Required, this is either a document "id" field or a "slug"
+   * @param relationshipType - Optional relationship type to filter by
+   * @param view - Optional filter containing branch and scopes information
+   * @param paging - Optional pagination options
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The matching relationship edges and paging cursor
    */
-  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
+  getIncomingRelationshipEdges(targetIdentifier: string, relationshipType?: string, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentRelationship>>;
   /**
-   * Stores the run's head and mints a keyframe for every interval the run
-   * crossed on its way there. Only the head enters the ring buffer; the
-   * earlier revisions are keyframe candidates and nothing more.
+   * Filters documents by criteria and returns a list of them
+   *
+   * @param search - Search filter options (type, parentId, identifiers)
+   * @param view - Optional filter containing branch and scopes information
+   * @param paging - Optional pagination options
+   * @param signal - Optional abort signal to cancel the request
+   * @returns List of documents matching criteria and pagination cursor
    */
-  putRun(documentId: string, scope: string, branch: string, run: readonly {
-    revision: number;
-    document: PHDocument;
-  }[]): void;
-  private store;
-  /** Persists the snapshot if this revision is one the interval falls on. */
-  private persistKeyframe;
+  find(search: SearchFilter, view?: ViewFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<PHDocument>>;
   /**
-   * Invalidates cached document streams.
+   * Predicts whether the subject would be admitted to execute each of a set of
+   * candidate operations, without submitting any of them. A UI asks this to
+   * disable a control rather than offer an action that fails on submit.
+   *
+   * The answer is a prediction, not a promise. Three caveats hold:
+   *
+   * - Real admission compiles an append condition over everything it read and
+   *   the store enforces it at write time. A preflight reads no future, so a
+   *   policy change landing between this answer and the submit changes the
+   *   verdict. The submit path stays the only authority.
+   * - The verdict is evaluated at the stream heads. It is therefore correct for
+   *   a candidate that will be stamped at or after every timestamp the
+   *   evaluation read, which is the normal case for a control the user is about
+   *   to click. A backdated submission is out of contract: the reactor decides
+   *   that one by position, against the policy as it stood there.
+   * - A candidate whose input decides the verdict needs that input supplied.
+   *   With `authConditions` on, a conditional grant reads `action.input`, so
+   *   omitting the input predicts the denial an empty input would earn rather
+   *   than the verdict the filled-in form will get.
    *
-   * Supports three invalidation scopes:
-   * - Document-level: invalidate(documentId) - removes all streams for document
-   * - Scope-level: invalidate(documentId, scope) - removes all branches for scope
-   * - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
+   * Document-scope candidates are decided against the policy of the document
+   * their input names, not the one passed here: delete and upgrade name it in
+   * `input.documentId`, and the relationship actions in `input.sourceId`. This
+   * follows the executor's own gate, which decides against the document
+   * guarding the write. `CREATE_DOCUMENT` follows the gate's exemption: it runs
+   * before its document exists, so the executor never decides it against a
+   * policy and the preflight predicts allow.
    *
-   * @param documentId - The document identifier
-   * @param scope - Optional scope to narrow invalidation
-   * @param branch - Optional branch to narrow invalidation (requires scope)
-   * @returns The number of streams evicted
+   * @param documentIdentifier - Document "id" or "slug" the candidates target
+   * @param branch - Branch to evaluate against
+   * @param candidates - Operations to predict a verdict for, each with the scope it would execute in
+   * @param subject - Optional subject to decide for, defaulting to the client's own signer. A plain subject rather than a ViewFilter: the evaluation reads no view, so a filter's branch or scopes would be silently ignored here
+   * @param signal - Optional abort signal to cancel the request
+   * @returns One evaluation per candidate, in the order given, with the aggregates over them
+   * @throws AuthEnforcementDisabledError if the reactor's authEnforcement flag is off, in which case it holds no decision model and the legacy host-table permission system cannot answer for one
    */
-  invalidate(documentId: string, scope?: string, branch?: string): number;
+  evaluateActions(documentIdentifier: string, branch: string, candidates: ActionCandidate[], subject?: AuthSubject, signal?: AbortSignal): Promise<ActionEvaluations>;
   /**
-   * Clears the entire cache, removing all cached document streams.
-   * Resets LRU tracking state. This operation always succeeds.
+   * The signature policy this client gives the documents it creates when the
+   * caller does not choose one. It never changes an existing document.
    */
-  clear(): void;
+  getCreateSignaturePolicy(): Promise<SignaturePolicy>;
   /**
-   * Retrieves a specific stream for a document. Exposed on the implementation
-   * for testing, but not on the interface.
+   * Creates a document and waits for completion. The document keeps the
+   * signature policy and id its header carries.
    *
-   * @internal
+   * @param document - Document with optional id, slug, parent, model type, and initial state
+   * @param parentIdentifier - Optional "id" or "slug" of parent document
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The created document
    */
-  getStream(documentId: string, scope: string, branch: string): DocumentStream | undefined;
-  private findNearestKeyframe;
+  create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
   /**
-   * Rebuilds a scope from a keyframe or from the whole operation history.
+   * Creates an empty document and waits for completion
    *
-   * The document scope is always rebuilt first, because it carries the type,
-   * the upgrades and the deletion marker. Its version-changing upgrades are not
-   * applied there though: an upgrade reducer must see the state the requested
-   * scope has reached at that upgrade's boundary, so each one is held back and
-   * applied when the replay below crosses the boundary that
-   * resolveModuleVersionForOp derives from it. Upgrades whose boundary lies past
-   * the last replayed operation are applied at the end. Creation-time 0->N seed
-   * upgrades carry the initial state, so they still apply immediately.
-   */
-  private coldMissRebuild;
-  /**
-   * Applies and removes every held-back upgrade whose target version is at or
-   * below `throughVersion`, in the order the document scope recorded them.
+   * @param documentModelType - Type of document to create
+   * @param options - Optional creation options (parentIdentifier, documentModelVersion)
+   * @param signal - Optional abort signal to cancel the request
    */
-  private applyPendingUpgrades;
+  createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
   /**
-   * Applies the remaining held-back upgrades after the requested scope's
-   * replay has finished. A head read applies them all. A positional read
-   * applies only those whose boundary for this scope lies at or before the
-   * target position: applying a later one would label migrated state with a
-   * pre-upgrade revision, and a keyframe stored from that poisons every
-   * rebuild that resumes from it. Boundaries come from the upgrade's revision
-   * snapshot; an upgrade without one records no position for this scope, and
-   * the replay loop not having crossed it already places it past the target.
+   * Retrieves the document model module matching the version a document is
+   * stamped with. Use this instead of {@link getDocumentModelModule}
+   * whenever a specific document is in hand: the latest-wins lookup feeds
+   * not-yet-upgraded documents the wrong reducer, diverging from replay.
+   *
+   * @param document - The document whose stamped version selects the module
+   * @returns The document model module registered for that version
+   * @throws UnsupportedDocumentModelVersionError if no module is registered for the stamped version
    */
-  private applyTailPendingUpgrades;
+  getDocumentModelModuleForDocument(document: PHDocument): Promise<DocumentModelModule<any>>;
   /**
-   * Applies one held-back upgrade, then re-applies the deletes the document
-   * scope recorded after it so the hold-back cannot invert their order.
+   * Upgrades a document to a newer document model version by dispatching an
+   * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
+   * latest registered module version for the document's type. Returns the
+   * document unchanged when it is already at the target version.
+   *
+   * The action carries a snapshot of the document's version and per-scope
+   * revisions, which the executor validates before persisting. When an edit
+   * lands between the read and the upgrade executing, the upgrade is
+   * rejected and retried with a fresh read up to
+   * {@link UpgradeDocumentOptions.maxConflictRetries} times before the
+   * conflict is surfaced.
+   *
+   * @param documentIdentifier - Target document id or slug
+   * @param toVersion - Optional target document model version; defaults to latest
+   * @param options - Optional upgrade options (maxConflictRetries)
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The upgraded document
+   * @throws DowngradeNotSupportedError if toVersion is less than the document's current version
    */
-  private applyPendingUpgrade;
+  upgradeDocument<TDocument extends PHDocument = PHDocument>(documentIdentifier: string, toVersion?: number, options?: UpgradeDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
   /**
-   * Copies the current document revisions onto the document. Overwrites the
-   * requested scope revision with the target revision, if provided.
+   * Creates an empty document in a drive as a single batched operation.
+   * This is more efficient than createEmpty + addFile as it batches all
+   * actions into dependent jobs and waits for them to complete together.
+   *
+   * @deprecated Use {@link IDriveClient.addFile} via `client.drives.addFile`
+   * instead. This method will be removed in a future release.
+   * @param driveId - The drive document id or slug
+   * @param document - The document to create
+   * @param parentFolder - Optional folder id within the drive
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The created document
    */
-  private stampRevisions;
-  /** The stored operation at `index`, or undefined if it is no longer there. */
-  private operationAt;
+  createDocumentInDrive<TDocument extends PHDocument>(driveId: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
   /**
-   * Resolves which module version to use for a given operation in phase 2.
+   * Applies a list of actions to a document and waits for completion
    *
-   * Uses the validated-upgrade boundary rules from D7:
-   * - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
-   * - Otherwise: timestamp fallback
-   * - Falls back to final module version when neither is decidable
+   * The document handed back is a read like any other, so it goes through the
+   * read gate. `subject` names who that read is for, the same way
+   * {@link ViewFilter.subject} does on `get` and `find`; a host that shares one
+   * client across many callers has no meaningful signer to fall back to, and
+   * without it the gate would strip the domain scopes of a policied document
+   * and resolve with a husk whose `state.global` is absent — reading as a
+   * rejected write when the write in fact succeeded.
+   *
+   * @param documentIdentifier - Target document id or slug
+   * @param branch - Branch to apply actions to
+   * @param actions - List of actions to apply
+   * @param signal - Optional abort signal to cancel the request
+   * @param subject - Optional read subject for the returned document; defaults
+   *   to the client's signer
+   * @returns The updated document
    */
-  private resolveModuleVersionForOp;
-  private warmMissRebuild;
-  private findNearestOlderSnapshot;
-  private makeStreamKey;
-  private getOrCreateStream;
-  private isKeyframeRevision;
-}
-//#endregion
-//#region src/storage/kysely/store.d.ts
-declare class KyselyOperationStore implements IOperationStore {
-  private db;
-  private trx?;
-  constructor(db: Kysely<Database$1>);
-  private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
-  apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
-  private resolveUniqueConstraint;
-  private executeApply;
+  execute<TDocument extends PHDocument>(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal, subject?: AuthSubject): Promise<TDocument>;
   /**
-   * Locks the written stream and every read-set stream, in sorted key order
-   * so that overlapping concurrent appends serialize rather than deadlock.
-   * The locks are still taken one row at a time, so the query preserves that
-   * order. It must stay separate from the guarded insert, which would
-   * otherwise read a snapshot taken before the locks were held.
+   * Submits a list of actions to a document
+   *
+   * @param documentIdentifier - Target document id or slug
+   * @param branch - Branch to apply actions to
+   * @param actions - List of actions to apply
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The job
    */
-  private acquireStreamLocks;
+  executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
   /**
-   * Inserts the staged operations with the condition compiled in as a WHERE
-   * NOT EXISTS guard, making the check and the append one statement. Returns
-   * the rows inserted; zero means the guard failed and nothing was written.
+   * Applies multiple mutation jobs in dependency order and waits for all to
+   * complete. Actions on each job are signed by the client signer before
+   * dispatch. Throws on the first failed job; the others may still execute
+   * because dispatch is fire-and-await-all.
+   *
+   * @param request - Batch mutation request with per-job actions and dependsOn keys
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The completed batch result (job ids keyed by plan key)
    */
-  private insertGuarded;
-  private findIdempotentReplay;
-  /** True when the staged write creates a document rather than appending to one. */
-  private isCreate;
+  executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
   /**
-   * The paging cursor here encodes the index to resume from (one past the
-   * last row returned), not the last row's own index. This keeps "0" an
-   * unambiguous start-of-stream sentinel even when a page ends at index 0
-   * (e.g. `limit: 1` on a fresh stream), which would otherwise make
-   * `nextCursor` equal the start cursor and loop a caller that walks pages
-   * forever.
+   * Renames a document and waits for completion
+   *
+   * @param documentIdentifier - Target document id or slug
+   * @param name - The new name of the document
+   * @param branch - Optional branch to rename the document, defaults to "main"
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The updated document.
    */
-  getSince(documentId: string, scope: string, branch: string, revision: number, filter?: OperationFilter, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  getSinceId(id: number, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<OperationWithContext$1>>;
+  rename(documentIdentifier: string, name: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * The paging cursor here encodes the index to resume from (one past the
-   * last row returned), not the last row's own index, for the same reason as
-   * `getSince`: a page ending at index 0 must not produce a cursor that is
-   * indistinguishable from the start-of-stream sentinel.
-   */
-  getConflicting(documentId: string, scope: string, branch: string, minTimestamp: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<Operation>>;
-  getRevisions(documentId: string, branch: string, signal?: AbortSignal): Promise<DocumentRevisions>;
-  getStreamLatestTimestamp(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<string | undefined>;
-  private rowToOperation;
-  private rowToOperationWithContext;
-}
-//#endregion
-//#region src/storage/kysely/keyframe-store.d.ts
-declare class KyselyKeyframeStore implements IKeyframeStore {
-  private db;
-  private trx?;
-  constructor(db: Kysely<Database$1>);
-  private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyKeyframeStore;
-  putKeyframe(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, signal?: AbortSignal): Promise<void>;
-  findNearestKeyframe(documentId: string, scope: string, branch: string, targetRevision: number, signal?: AbortSignal): Promise<{
-    revision: number;
-    document: PHDocument;
-  } | undefined>;
-  listKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<Array<{
-    scope: string;
-    branch: string;
-    revision: number;
-    document: PHDocument;
-  }>>;
-  deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
-}
-//#endregion
-//#region src/executor/execution-scope.d.ts
-interface ExecutionStores {
-  operationStore: IOperationStore;
-  operationIndex: IOperationIndex;
-  writeCache: IWriteCache;
-  documentMetaCache: IDocumentMetaCache;
-  collectionMembershipCache: ICollectionMembershipCache;
-}
-interface IExecutionScope {
-  run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
-}
-//#endregion
-//#region src/executor/types.d.ts
-/**
- * Represents the result of a job execution
- */
-type JobResult = {
-  /** The job that was executed */job: Job; /** Whether the job executed successfully */
-  success: boolean; /** Error if the job failed */
-  error?: Error; /** The operations generated from the actions (if successful) */
-  operations?: Operation[];
+   * Updates the preferred editor in the document header meta and waits for completion.
+   *
+   * @param documentIdentifier - Target document id or slug
+   * @param preferredEditor - The new preferred editor, or `null` to clear it
+   * @param branch - Optional branch, defaults to "main"
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The updated document.
+   */
+  setPreferredEditor(documentIdentifier: string, preferredEditor: string | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * Operations with context (includes ephemeral resultingState).
-   * Used for emitting to IDocumentView via event bus.
+   * Adds a relationship between two documents and waits for completion.
+   *
+   * Adding a relationship that already exists is a no-op, metadata included.
+   * Use {@link IReactorClient.updateRelationship} to change an existing edge.
+   *
+   * @param sourceIdentifier - Source document id or slug
+   * @param targetIdentifier - Target document id or slug
+   * @param relationshipType - Relationship type identifier
+   * @param metadata - Optional metadata to attach to the relationship
+   * @param branch - Optional branch to add the relationship to, defaults to "main"
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The updated source document
    */
-  operationsWithContext?: OperationWithContext$1[]; /** Timestamp when the job execution completed */
-  completedAt?: string; /** Duration of job execution in milliseconds */
-  duration?: number; /** Any additional metadata from the execution */
-  metadata?: Record<string, any>;
-};
-/**
- * Enforcement the reactor performs, each off by default.
- *
- * An evaluation made while replaying is part of the document's history, so two
- * reactors that share documents and disagree on these diverge. A flag is turned
- * on for a set of reactors that sync with each other, not for one node.
- */
-type ReactorFeatureFlags = {
+  addRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, metadata?: Record<string, unknown>, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * Decide whether an operation may be admitted by building a decision model
-   * over the document stream, rather than reading the deleted flag from the
-   * document meta cache. Deletion then takes effect from the deleting
-   * operation's position rather than for the whole document.
+   * Replaces the metadata of an existing relationship and waits for completion.
+   * The relationship's createdAt is preserved.
+   *
+   * @param sourceIdentifier - Source document id or slug
+   * @param targetIdentifier - Target document id or slug
+   * @param relationshipType - Relationship type identifier
+   * @param metadata - The metadata to store; null clears it
+   * @param branch - Optional branch holding the relationship, defaults to "main"
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The updated source document
    */
-  documentDecisions: boolean;
+  updateRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, metadata: Record<string, unknown> | null, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * Evaluate the auth policy by reading the auth scope as a second projection.
-   * Requires documentDecisions.
+   * Removes a relationship between two documents and waits for completion.
+   *
+   * @param sourceIdentifier - Source document id or slug
+   * @param targetIdentifier - Target document id or slug
+   * @param relationshipType - Relationship type identifier
+   * @param branch - Optional branch to remove the relationship from, defaults to "main"
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The updated source document
    */
-  authEnforcement: boolean;
+  removeRelationship(sourceIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<PHDocument>;
   /**
-   * Match { group } principals by folding the referenced PHGroup documents as
-   * derived projections. Requires authEnforcement.
+   * Moves a relationship from one source document to another and waits for completion.
+   *
+   * @param sourceParentIdentifier - Source parent document id or slug
+   * @param targetParentIdentifier - Target parent document id or slug
+   * @param targetIdentifier - The target document id or slug
+   * @param relationshipType - Relationship type identifier
+   * @param branch - Optional branch to apply the move to, defaults to "main"
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The updated source and target documents
    */
-  authGroups: boolean;
+  moveRelationship(sourceParentIdentifier: string, targetParentIdentifier: string, targetIdentifier: string, relationshipType: string, branch?: string, signal?: AbortSignal): Promise<{
+    source: PHDocument;
+    target: PHDocument;
+  }>;
   /**
-   * Evaluate `where` clauses and { match } principals against the executing
-   * scope's state, the subject, and the action input. Requires authGroups.
+   * Deletes a document and waits for completion
+   *
+   * @param identifier - Document identifier (id or slug)
+   * @param propagate - Optional mode for handling children, CASCADE deletes child documents
+   * @param signal - Optional abort signal to cancel the request
+   * @returns a promise, resolving on deletion confirmation
    */
-  authConditions: boolean;
-};
-/**
- * Configuration options for the job executor
- */
-type JobExecutorConfig = {
-  /** Feature flags; anything unset is off. */featureFlags?: Partial<ReactorFeatureFlags>; /** Maximum number of conflicting operations to skip when reshuffling. */
-  maxSkipThreshold?: number; /** Maximum number of concurrent jobs to execute */
-  maxConcurrency?: number; /** Maximum time in milliseconds a job can run before being considered timed out */
-  jobTimeoutMs?: number;
-  /** How long a job whose document is missing waits for it before failing.
-   *  Unbounded deferral never resolves the caller awaiting the job. */
-  deferredJobTtlMs?: number; /** Base delay in milliseconds for exponential backoff retries */
-  retryBaseDelayMs?: number; /** Maximum delay in milliseconds for exponential backoff retries */
-  retryMaxDelayMs?: number;
-  /** Maximum elapsed milliseconds before yielding to the main thread between actions.
-   *  Keeps the UI responsive when processing large batches. */
-  yieldDeadlineMs?: number;
+  deleteDocument(identifier: string, propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
   /**
-   * Persist a job's writes in one store transaction rather than one each.
+   * Deletes documents and waits for completion
    *
-   * On by default. A job's operations are reduced sequentially either way; this
-   * only changes how many apply calls carry them, which is one advisory lock
-   * and one guarded insert per batch instead of per operation. Only runs that
-   * qualify are batched, and the executor falls back per write for the rest, so
-   * this never changes which operations are produced -- only how many
-   * transactions they arrive in.
+   * @param identifiers - Document identifiers (ids or slugs)
+   * @param propagate - Optional mode for handling children, CASCADE deletes child documents
+   * @param signal - Optional abort signal to cancel the request
+   * @returns a promise, resolving on deletion confirmation
+   */
+  deleteDocuments(identifiers: string[], propagate?: PropagationMode, signal?: AbortSignal): Promise<void>;
+  /**
+   * Loads multiple batches of pre-existing operations across documents with dependency management.
+   * Waits for all jobs to complete.
    *
-   * Atomicity is not one of the things it changes. A job either fully applies
-   * or leaves nothing durable behind regardless of this setting, because the
-   * whole job runs inside the execution scope's transaction and a failure
-   * rolls it back.
-   * That guarantee belongs to KyselyExecutionScope, which backs both Postgres
-   * and PGlite; DefaultExecutionScope opens no transaction and is used only by
-   * unit-test harnesses, which therefore see writes survive a failed job.
+   * @param request - Batch load request containing jobs with dependencies
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Map of job keys to completed job information
    */
-  batchApplies?: boolean;
-};
-/**
- * Event types for the job executor
- */
-declare const JobExecutorEventTypes: {
-  readonly JOB_STARTED: 20000;
-  readonly JOB_COMPLETED: 20001;
-  readonly JOB_FAILED: 20002;
-  readonly EXECUTOR_STARTED: 20003;
-  readonly EXECUTOR_STOPPED: 20004;
-};
-/**
- * Event data for job execution events
- */
-type JobStartedEvent = {
-  job: Job;
-  startedAt: string;
+  loadBatch(request: BatchLoadRequest, signal?: AbortSignal): Promise<BatchLoadResult>;
   /**
-   * Identifier of the executor that took the job. For the worker pool this is
-   * the thread-worker id (e.g. "reactor-worker-3"); for the in-process simple
-   * manager it is "in-process-<index>". Optional for backwards compatibility
-   * with consumers built before the field was added.
+   * Retrieves the status of a job
+   *
+   * @param jobId - The job id
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The job status
    */
-  workerId?: string;
-};
-type JobCompletedEvent = {
-  job: Job;
-  result: JobResult; /** See {@link JobStartedEvent.workerId}. */
-  workerId?: string;
-};
-type JobFailedEvent = {
-  job: Job;
-  error: string;
-  willRetry: boolean;
-  retryCount: number; /** See {@link JobStartedEvent.workerId}. */
-  workerId?: string;
-};
-type ExecutorStartedEvent = {
-  config: JobExecutorConfig;
-  startedAt: string;
-};
-type ExecutorStoppedEvent = {
-  stoppedAt: string;
-  graceful: boolean;
-};
-/**
- * Status information for the job executor manager
- */
-type ExecutorManagerStatus = {
-  /** Whether the manager is currently running */isRunning: boolean; /** Number of executor instances managed */
-  numExecutors: number; /** Number of jobs currently being processed */
-  activeJobs: number; /** Total number of jobs processed since start */
-  totalJobsProcessed: number;
-};
+  getJobStatus(jobId: string, signal?: AbortSignal): Promise<JobInfo>;
+  /**
+   * Waits for a job to complete
+   *
+   * @param jobId - The job id or job object
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The result of the job
+   */
+  waitForJob(jobId: string | JobInfo, signal?: AbortSignal): Promise<JobInfo>;
+  /**
+   * Subscribes to changes for documents matching specified filters
+   *
+   * @param search - Search filter options (type, parentId, identifiers)
+   * @param callback - Function called when documents change with the change event details
+   * @param view - Optional filter containing branch and scopes information
+   * @returns A function that unsubscribes from the changes
+   */
+  subscribe(search: SearchFilter, callback: (event: DocumentChangeEvent) => void, view?: ViewFilter): () => void;
+}
 //#endregion
 //#region src/decision/document-decision-model.d.ts
 /** What the document decision model reads: the target's document scope. */
@@ -3890,8 +3982,9 @@ declare class ReactorClient implements IReactorClient {
   private documentView;
   private readGate;
   private actionEvaluation;
+  private readonly createSignaturePolicy;
   readonly drives: IDriveClient;
-  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView, readGate?: IReadGate, actionEvaluation?: ActionEvaluationConfig);
+  constructor(logger: ILogger, reactor: IReactor, signer: ISigner, subscriptionManager: IReactorSubscriptionManager, jobAwaiter: IJobAwaiter, documentIndexer: IDocumentIndexer, documentView: IDocumentView, readGate?: IReadGate, actionEvaluation?: ActionEvaluationConfig, createSignaturePolicy?: SignaturePolicy);
   private readSubject;
   /**
    * Which scopes of one document the subject may read. Resolved once per
@@ -4017,6 +4110,7 @@ declare class ReactorClient implements IReactorClient {
    * is why the answer is a prediction.
    */
   private buildEvaluationTarget;
+  getCreateSignaturePolicy(): Promise<SignaturePolicy>;
   /**
    * Creates a document and waits for completion
    */
@@ -4056,6 +4150,12 @@ declare class ReactorClient implements IReactorClient {
    * Submits a list of actions to a document
    */
   executeAsync(documentIdentifier: string, branch: string, actions: Action[], signal?: AbortSignal): Promise<JobInfo>;
+  /**
+   * The id a write on `identifier` is stored under, which its signatures bind.
+   * A create names its own id, and an id no slug maps to is taken as given, so
+   * a document still in flight resolves to itself.
+   */
+  private resolveWriteTarget;
   executeBatch(request: BatchExecutionRequest, signal?: AbortSignal): Promise<BatchExecutionResult>;
   /**
    * Renames a document and waits for completion
@@ -4128,6 +4228,7 @@ type WorkerInFlightSnapshot = {
 type WorkerExecutionOutcome = {
   result: JobResult;
   writeReady?: JobWriteReadyPayload;
+  signatureRefusals?: SignatureRefusedEvent[];
 };
 /**
  * Parent-side handle for a single executor worker.
@@ -5996,22 +6097,6 @@ declare class HybridProjectionCoordinator implements ILiveReadModelCoordinator {
   private queueKeyFor;
 }
 //#endregion
-//#region src/signer/types.d.ts
-/**
- * Configuration for signing and verification.
- */
-type SignerConfig = {
-  /**
-   * The signer used to sign actions before submission.
-   */
-  signer: ISigner;
-  /**
-   * Optional handler for verifying signatures on incoming operations.
-   * If not provided, signature verification will be skipped.
-   */
-  verifier?: SignatureVerificationHandler;
-};
-//#endregion
 //#region src/storage/migrations/types.d.ts
 type MigrationStrategy = "auto" | "manual" | "none";
 interface MigrationResult {
@@ -6095,12 +6180,6 @@ interface ReadModelCoordinatorFactoryDeps {
 type ReadModelCoordinatorFactory = (deps: ReadModelCoordinatorFactoryDeps) => IReadModelCoordinator | Promise<IReadModelCoordinator>;
 type WorkerPoolBase = {
   /** Number of worker threads to spawn; also the sticky-routing modulus. */numWorkers: number;
-  /**
-   * Factory spec the default transport's workers import to instantiate
-   * their signature verifier. Omitted = no executor-side verification,
-   * parity with the in-process executor's default.
-   */
-  verifier?: SignatureVerifierSpec;
 };
 /**
  * Executor worker-pool configuration. Either `db` (default thread
@@ -6165,8 +6244,11 @@ declare class ReactorBuilder {
   private eventBus?;
   private readModelCoordinator?;
   private readModelCoordinatorFactory?;
-  private signatureVerifier?;
   private kyselyInstance?;
+  private signer?;
+  private workerSigner?;
+  private trustPolicy?;
+  private workerTrustPolicy?;
   private signalHandlersEnabled;
   private queueInstance?;
   private channelScheme?;
@@ -6214,7 +6296,22 @@ declare class ReactorBuilder {
   withMigrationStrategy(strategy: MigrationStrategy): this;
   withSync(syncBuilder: SyncBuilder): this;
   withEventBus(eventBus: IEventBus): this;
-  withSignatureVerifier(verifier: SignatureVerificationHandler): this;
+  /**
+   * Signs the operations the executor synthesizes: the NOOP an UNDO becomes and
+   * the action a REDO rebuilds. Without one they are stored unsigned. Pooled
+   * workers import `workerSigner` to build the same signer.
+   */
+  withSigner(signer: ISigner, workerSigner?: FactorySpec): this;
+  /** Whether {@link withSigner} was called. */
+  hasSigner(): boolean;
+  /**
+   * Decides at admission whether a key may sign as the user it claims; see
+   * {@link SignatureTrustPolicy} for the contract and the default. Pooled
+   * workers import `workerTrustPolicy` to build the same policy.
+   */
+  withTrustPolicy(trustPolicy: SignatureTrustPolicy, workerTrustPolicy?: FactorySpec): this;
+  /** Whether {@link withTrustPolicy} was called. */
+  hasTrustPolicy(): boolean;
   withKysely(kysely: Kysely<Database>): this;
   /**
    * Register an externally-constructed pg.Pool's {@link PoolInstrumentation}
@@ -6244,8 +6341,7 @@ declare class ReactorBuilder {
    * this enables the pool — there is no `enabled` flag. Provide `db`
    * (each worker opens its own Postgres pool; the parent database is built
    * from it too unless {@link withKysely} is set) or a custom `factory`
-   * transport. `verifier` is imported by the default transport's workers;
-   * omitted = no executor-side signature verification.
+   * transport.
    */
   withWorkerPool(options: WorkerPoolOptions): this;
   /**
@@ -6331,7 +6427,10 @@ declare class ReactorClientBuilder {
   private documentIndexer?;
   private documentView?;
   private signer?;
-  private signatureVerifier?;
+  private workerSigner?;
+  private trustPolicy?;
+  private workerTrustPolicy?;
+  private createSignaturePolicy;
   private subscriptionManager?;
   private jobAwaiter?;
   private documentModelLoader?;
@@ -6351,11 +6450,17 @@ declare class ReactorClientBuilder {
    */
   withReactor(reactor: IReactor, eventBus: IEventBus, documentIndexer: IDocumentIndexer, documentView: IDocumentView): this;
   /**
-   * Sets the signer configuration for signing and verifying actions.
-   *
-   * @param config - Either an ISigner for signing only, or a SignerConfig for both signing and verification
+   * Signs submitted actions, and the operations a reactor built from
+   * `withReactorBuilder` synthesizes unless that builder has its own signer.
+   * A `trustPolicy` reaches that builder unless it has its own.
    */
   withSigner(config: ISigner | SignerConfig): this;
+  /**
+   * What the client creates new documents as when a call does not say:
+   * `v2-required` (the default) or `legacy`, for a fleet with peers that
+   * predate v2-required documents. Existing documents keep their policy.
+   */
+  withCreateSignaturePolicy(policy: SignaturePolicy): this;
   withSubscriptionManager(subscriptionManager: IReactorSubscriptionManager): this;
   withJobAwaiter(jobAwaiter: IJobAwaiter): this;
   withDocumentModelLoader(loader: IDocumentModelLoader): this;
@@ -6465,6 +6570,14 @@ declare function parseDriveUrl(url: string): ParsedDriveUrl;
 declare function driveIdFromUrl(url: string): string;
 //#endregion
 //#region src/shared/errors.d.ts
+/** The message carries the code: only name and message cross the queue. */
+declare class InvalidSignatureError extends Error {
+  readonly documentId: string;
+  readonly code: SignatureRefusalCode;
+  readonly reason: string;
+  constructor(documentId: string, code: SignatureRefusalCode, reason: string);
+  static isError(error: unknown): error is InvalidSignatureError;
+}
 /**
  * An authorization preflight was asked for while the reactor's decision model
  * is off, so there is no model to answer from.
@@ -6523,6 +6636,20 @@ type ParsedPaging = {
  */
 declare function parsePagingOptions(paging: PagingOptions | undefined, defaultLimit: number): ParsedPaging;
 //#endregion
+//#region src/signer/verify-action-signature.d.ts
+type VerificationTarget = {
+  /** The stream the operation is stored in. */documentId: string;
+  branch: string; /** Of the document `documentId` names; legacy when omitted. */
+  policy?: SignaturePolicy;
+};
+/**
+ * Integrity only: identity binding and the live-id check sit with the caller.
+ * `operation` is the incoming operation at load admission.
+ */
+declare function verifyActionSignature(action: Action, target: VerificationTarget, path: AdmissionPath, operation?: {
+  timestampUtcMs: string;
+}): Promise<SignatureVerdict>;
+//#endregion
 //#region src/subs/default-error-handler.d.ts
 /**
  * Default error handler that re-throws subscription errors.
@@ -6761,10 +6888,15 @@ declare class SimpleJobExecutor implements IJobExecutor {
   private config;
   private featureFlags;
   private decisionModel;
-  private signatureVerifierModule;
+  private signatureAdmission;
   private documentActionHandler;
   private executionScope;
-  constructor(logger: ILogger, registry: IDocumentModelRegistry, operationStore: IOperationStore, eventBus: IEventBus, writeCache: IWriteCache, operationIndex: IOperationIndex, documentMetaCache: IDocumentMetaCache, collectionMembershipCache: ICollectionMembershipCache, driveContainerTypes: ReadonlySet<string>, config: JobExecutorConfig, signatureVerifier?: SignatureVerificationHandler, executionScope?: IExecutionScope);
+  private signer;
+  /**
+   * `signer` signs the operations the reducer synthesizes; unsigned if omitted.
+   * `trustPolicy` decides which keys may sign as which users at admission.
+   */
+  constructor(logger: ILogger, registry: IDocumentModelRegistry, operationStore: IOperationStore, eventBus: IEventBus, writeCache: IWriteCache, operationIndex: IOperationIndex, documentMetaCache: IDocumentMetaCache, collectionMembershipCache: ICollectionMembershipCache, driveContainerTypes: ReadonlySet<string>, config: JobExecutorConfig, executionScope?: IExecutionScope, signer?: ISigner, trustPolicy?: SignatureTrustPolicy);
   /**
    * Execute a single job by applying all its actions through the appropriate reducers.
    * Actions are processed sequentially in order.
@@ -6794,6 +6926,18 @@ declare class SimpleJobExecutor implements IJobExecutor {
    * has not committed yet has nothing to announce.
    */
   private executeInScope;
+  /**
+   * A successful mutation's result and the write-ready event it owes, carrying
+   * what earlier attempts committed ahead of what this one wrote.
+   */
+  private committedOutcome;
+  /**
+   * The stored operations of writes an earlier attempt committed, as a fresh
+   * write would report them. State is rebuilt from the write cache, and left
+   * out when it cannot be.
+   */
+  private reloadCommitted;
+  private rebuiltState;
   /**
    * Drops the cached state of every stream a job wrote, after its transaction
    * did not commit.
@@ -6842,7 +6986,7 @@ declare class SimpleJobExecutor implements IJobExecutor {
    *   apply and its own reasons for it.
    * - A positional or replayed run carries skips and re-appended operations,
    *   whose indices are not a simple ascending run from the head.
-   * - UNDO, REDO, PRUNE and NOOP-with-skip each invalidate the write cache to
+   * - UNDO, REDO and NOOP-with-skip each invalidate the write cache to
    *   force a full-history rebuild, so they cannot be reduced against state
    *   threaded from the write before them.
    * - The auth scope decides later writes against the policy earlier ones
@@ -6943,6 +7087,8 @@ declare class SimpleJobExecutor implements IJobExecutor {
    */
   private executeReevaluationJob;
   private executeLoadJob;
+  /** The conflicting window a load opens, and which of its operations are new. */
+  private selectLoadWrites;
   private accumulateResultOrReturnError;
 }
 //#endregion
@@ -7727,26 +7873,26 @@ declare class DocumentIntegrityService implements IDocumentIntegrityService {
 }
 //#endregion
 //#region src/processors/processor-manager.d.ts
+type PendingSlot = {
+  factoryId: string;
+  driveId: string;
+  reservedAt: number;
+  lowestRoutedOrdinal: number | undefined;
+  settled: Promise<void> | undefined;
+};
+type FactoryRun = () => Promise<void>;
 type ProcessorManagerOptions = {
   legacyProcessorIds?: boolean;
 };
-/**
- * Manages processor lifecycle based on operations.
- * Extends BaseReadModel to receive operations from ReadModelCoordinator.
- *
- * Responsibilities:
- * 1. Detect drive creation from CREATE_DOCUMENT operations
- * 2. Create processors for each drive using registered factories
- * 3. Route operations to matching processors based on filters
- * 4. Clean up processors when drives are deleted or factories are unregistered
- * 5. Track per-processor cursors for failure recovery and backfill
- */
 declare class ProcessorManager extends BaseReadModel implements IProcessorManager$1 {
   private factoryRegistry;
   private processorsByDrive;
-  private factoryToProcessors;
+  private pendingSlots;
   private knownDrives;
+  private highestRoutedOrdinal;
   private cursorCache;
+  private cursorWrites;
+  private draining;
   private logger;
   private driveContainerTypes;
   private legacyProcessorIds;
@@ -7757,23 +7903,36 @@ declare class ProcessorManager extends BaseReadModel implements IProcessorManage
   unregisterFactory(identifier: string): Promise<void>;
   get(processorId: string): TrackedProcessor$1 | undefined;
   getAll(): TrackedProcessor$1[];
+  /** Synchronous: reserves a slot per registered factory for each new drive. */
+  protected detectNewDrives(items: OperationWithContext$1[]): {
+    runs: FactoryRun[];
+    reserved: Set<PendingSlot>;
+  };
+  /** Synchronous: drops a deleted drive's processors from the tables. */
+  protected detectDeletedDrives(items: OperationWithContext$1[]): Promise<void>[];
+  /** Synchronous: puts each processor's share of the batch on its queue. */
+  protected enqueueRouted(items: OperationWithContext$1[], reserved: ReadonlySet<PendingSlot>): Promise<void>[];
+  /** Synchronous: binds records, or discards them if the slot was cancelled. */
+  protected bind(slot: PendingSlot, records: ProcessorRecord$1[] | undefined, creationOrdinal: number, creationItems: OperationWithContext$1[] | undefined): {
+    persisted: Promise<void>;
+    delivered: Promise<void>;
+  };
+  /** Synchronous: removes a factory's slots, processors and cursor rows. */
+  protected removeFactory(identifier: string): Promise<void>[];
+  private reserveSlot;
+  private runFactory;
+  private track;
+  private discard;
+  private highWater;
+  private allBound;
   private allTrackedProcessors;
-  private detectAndRegisterNewDrives;
   private isDriveCreation;
-  private detectAndCleanupDeletedDrives;
   private discoverExistingDrives;
-  private isDeletedDocumentADrive;
-  private createProcessorsForDrive;
-  private backfillProcessor;
-  private retryProcessor;
-  private cleanupDriveProcessors;
-  private safeDisconnect;
-  private routeOperationsToProcessors;
   private loadAllCursors;
-  private safeSaveProcessorCursor;
-  private saveProcessorCursor;
-  private deleteProcessorCursors;
+  private lane;
+  private writeCursor;
+  private deleteCursors;
 }
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type ActionCandidate, type ActionEvaluationConfig, type ActionEvaluations, type AdmissionDecision, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, type BaseReadModelConfig, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DegradedComponent, DeletedDocumentRead, DocumentAlreadyExistsError, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, DocumentExistence, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, HybridProjectionCoordinator, type HybridProjectionCoordinatorOptions, type HybridProjectionOptions, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModuleBase, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorProcessorHostModuleBase, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobResultSummary, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModelReadGate, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardHooks, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type ReactorHostModuleBaseOptions, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, type ReactorReadModels, ReactorSubscriptionManager, type ReadGateOptions, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelCoordinatorFactory, type ReadModelCoordinatorFactoryDeps, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingConfig, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, type SanitizedArg, type SearchFilter, SeededStateReader, type ShutdownMessage, type ShutdownStatus, type SignatureVerificationHandler, type SignatureVerifierSpec, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubmittedActionResult, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncScopeGate, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, type AbortMessage, type ActionCandidate, type ActionEvaluationConfig, type ActionEvaluations, type AdmissionDecision, type AdmissionPath, type AppendCondition, AppendConditionFailedError, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, type BaseReadModelConfig, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type ChannelConfig, ChannelError, ChannelErrorSource, type ChannelHealth, type ChannelMeta, ChannelScheme, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, ConsistencyTracker, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, DefaultSubscriptionErrorHandler, type DegradedComponent, DeletedDocumentRead, DocumentAlreadyExistsError, type DocumentChangeEvent, DocumentChangeType, type DocumentDecisionModel, DocumentExistence, type DocumentGraphEdge, type DocumentIndexerDatabase, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, type Evaluation, EventBus, EventBusAggregateError, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, type HeartbeatMessage, HybridProjectionCoordinator, type HybridProjectionCoordinatorOptions, type HybridProjectionOptions, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPollTimer, type IProcessor, type IProcessorHostModuleBase, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorProcessorHostModuleBase, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, type Job, type JobAvailableEvent, JobAwaiter, type JobCompletedEvent, type JobExecutorConfig, JobExecutorEventTypes, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobResultSummary, type JobRunningEvent, type JobStartedEvent, JobStatus, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, type LoadJobPlan, type LoadModelMessage, type LogMessage, Mailbox, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, ModelReadGate, ModuleNotFoundError, type ModuleRef, NullDocumentModelResolver, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, OptimisticLockError, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, PollBehavior, PollingChannelError, type PoolInstrumentation, type PoolStats, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, ProcessorManager, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardHooks, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, type ReactorClientModule, ReactorEventTypes, type ReactorFeatureFlags, type ReactorFeatures, type ReactorHostModuleBaseOptions, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, type ReactorReadModels, ReactorSubscriptionManager, type ReadGateOptions, type ReadModelBatchCompletedEvent, ReadModelCoordinator, type ReadModelCoordinatorFactory, type ReadModelCoordinatorFactoryDeps, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingConfig, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemoteRecord, type RemoteStatus, type ResultMessage, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, type SanitizedArg, type SearchFilter, SeededStateReader, type ShutdownMessage, type ShutdownStatus, type SignatureRefusalCode, type SignatureRefusedEvent, type SignatureScheme, type SignatureTrustPolicy, type SignatureVerificationHandler, type SignatureVerificationMode, type SignerConfig, SimpleJobExecutorManager, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubmittedActionResult, type SubscriptionErrorContext, SyncBuilder, type SyncEnvelope, type SyncEnvelopeType, SyncEventTypes, type SyncFailedEvent, type SyncModule, SyncOperation, SyncOperationAggregateError, type SyncOperationErrorType, SyncOperationStatus, type SyncPendingEvent, SyncScopeGate, SyncStatus, type SyncStatusChangeCallback, SyncStatusTracker, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type ValidationResult, type VerificationTarget, type ViewFilter, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
 //# sourceMappingURL=index.d.ts.map