@powerhousedao/reactor 6.2.3-dev.23 → 6.2.3-dev.24

package/dist/{drive-container-types-CS5IxDiA.js → drive-container-types-Be5-EY9W.js}

@@ -1,5 +1,5 @@
-import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, isDenied, isUndoRedo, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, sortOperations } from "@powerhousedao/shared/document-model";
+import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DxDCmtId.js";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isUndoRedo, isV2ActionHash, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -167,19 +167,22 @@ var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
 		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
 	}
 };
-/**
-* Error thrown when an operation has an invalid signature.
-*/
+/** The message carries the code: only name and message cross the queue. */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
 	documentId;
+	code;
 	reason;
-	constructor(documentId, reason) {
-		super(`Invalid signature in document ${documentId}: ${reason}`);
+	constructor(documentId, code, reason) {
+		super(`Invalid signature in document ${documentId} [${code}]: ${reason}`);
 		this.name = "InvalidSignatureError";
 		this.documentId = documentId;
+		this.code = code;
 		this.reason = reason;
 		Error.captureStackTrace(this, InvalidSignatureError);
 	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidSignatureError";
+	}
 };
 /**
 * An UPGRADE_DOCUMENT action's preconditions (fromVersion and the per-scope
@@ -714,34 +717,13 @@ function selectDecisionModel(flags, registry) {
 //#endregion
 //#region src/executor/util.ts
 /** Actions the reactor reduces itself, onto the document scope. */
-const DOCUMENT_SCOPE_ACTIONS = new Set([
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP"
-]);
+const DOCUMENT_SCOPE_ACTIONS = DOCUMENT_SCOPE_ACTION_TYPES;
 /**
 * `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
 * so building a decision model would throw and defer the job forever.
 */
 const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
 /**
-* The document a document-scope action writes to, which is not always the job's
-* own document: delete and upgrade name it in `input.documentId`, and the
-* relationship actions in `input.sourceId`. `execute` only checks that a batch
-* shares one scope, so a caller can submit an action whose target is a document
-* other than the one the job is keyed by. The policy gate has to follow the
-* action rather than the job, or it decides against a policy the caller may
-* control instead of the one guarding the write.
-*/
-function targetDocumentId(action, fallback) {
-	const input = action.input;
-	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
-	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
-}
-/**
 * Creates a PHDocument from a CREATE_DOCUMENT action input.
 * Reconstructs the document header and initializes the base state.
 *
@@ -1264,6 +1246,7 @@ var DocumentMetaCache = class DocumentMetaCache {
 		return {
 			state: document.state.document,
 			documentType,
+			protocolVersions: createAction.input.protocolVersions,
 			documentScopeRevision: documentScopeRevision + 1
 		};
 	}
@@ -1459,6 +1442,12 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
 	}
+	async getOrdinalsByOpIds(documentId, scope, branch, opIds, signal) {
+		signal?.throwIfAborted();
+		if (opIds.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.queryExecutor.selectFrom("operation_index_operations").select("opId").select((eb) => eb.fn.max("ordinal").as("ordinal")).where("documentId", "=", documentId).where("branch", "=", branch).where("scope", "=", scope).where("opId", "in", opIds).groupBy("opId").execute();
+		return new Map(rows.map((row) => [row.opId, Number(row.ordinal)]));
+	}
 	async find(collectionId, cursor, view, paging, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const outerCursor = cursor ?? -1;
@@ -2099,10 +2088,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				} else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = docModule.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
-					});
+					}), document.header.protocolVersions);
 				}
 			}
 		}
@@ -2151,12 +2140,12 @@ var KyselyWriteCache = class KyselyWriteCache {
 					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 					else {
 						const protocolVersion = baseReducerVersion(document.header);
-						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+						document = withProtocolVersions(getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
 							skip: operation.skip,
 							protocolVersion,
 							replayOptions: { operation },
 							skipIndexValidation: true
-						});
+						}), document.header.protocolVersions);
 					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
@@ -2280,12 +2269,12 @@ var KyselyWriteCache = class KyselyWriteCache {
 				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 				else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = module.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(module.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion,
 						replayOptions: { operation },
 						skipIndexValidation: true
-					});
+					}), document.header.protocolVersions);
 				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
@@ -2925,6 +2914,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
 			state: standing.state.document,
 			documentType: standing.header.documentType,
+			protocolVersions: standing.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
@@ -2948,8 +2938,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
 		const writeResult = await this.writeOperationToStore({
@@ -2983,6 +2973,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(document.header.id, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: 1
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
@@ -3038,6 +3029,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3118,8 +3110,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		if (fromVersion > 0) resultingStateObj.__migrated = true;
 		const resultingState = JSON.stringify(resultingStateObj);
@@ -3154,6 +3146,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3242,6 +3235,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(input.sourceId, job.branch, {
 			state: sourceDoc.state.document,
 			documentType: sourceDoc.header.documentType,
+			protocolVersions: sourceDoc.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
@@ -3270,55 +3264,624 @@ var DocumentActionHandler = class {
 	}
 };
 //#endregion
-//#region src/executor/signature-verifier.ts
-var SignatureVerifier = class {
-	constructor(verifier) {
-		this.verifier = verifier;
-	}
-	async verifyActions(documentId, branch, actions) {
-		if (!this.verifier) return;
-		for (const action of actions) {
-			const signer = action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Action ${action.id} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				const tempOperation = {
-					id: deriveOperationId(documentId, action.scope, branch, action.id),
-					index: 0,
-					timestampUtcMs: action.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString(),
-					hash: "",
-					skip: 0,
-					action
-				};
-				isValid = await this.verifier(tempOperation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Action ${action.id} verification failed: ${errorMessage}`);
+//#region src/signer/passthrough-signer.ts
+/**
+* A no-op signer that returns empty values for all methods.
+* Used when signing is not required.
+*/
+var PassthroughSigner = class {
+	publicKey = {};
+	sign() {
+		return Promise.resolve(new Uint8Array(0));
+	}
+	verify() {
+		return Promise.resolve();
+	}
+	signAction() {
+		return Promise.resolve([
+			"",
+			"",
+			"",
+			"",
+			""
+		]);
+	}
+};
+//#endregion
+//#region src/signer/trust-policy.ts
+/**
+* The policy admission asks: the reactor's own key signing as its own user is
+* accepted, then the host's policy decides, else the default does. `own` is
+* read on every ask, since its user changes on login.
+*/
+function admissionTrustPolicy(own, authEnforcement, policy) {
+	return { authorizeSigner(signer, key, documentId) {
+		const identity = actionSignerIdentity(own);
+		if (identity.app.key !== "" && key === identity.app.key) {
+			if (sameUser(actionSignerIdentity(signer).user, identity.user)) return Promise.resolve(true);
+		}
+		if (policy) return policy.authorizeSigner(signer, key, documentId);
+		return Promise.resolve(!authEnforcement);
+	} };
+}
+function sameUser(a, b) {
+	return a.address.toLowerCase() === b.address.toLowerCase() && a.networkId === b.networkId && a.chainId === b.chainId;
+}
+//#endregion
+//#region src/signer/did-key.ts
+const DID_KEY_PREFIX = "did:key:z";
+const P256_MULTICODEC = [128, 36];
+const MAX_CACHED_KEYS = 1024;
+const P = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
+const A = BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc");
+const B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+/** A did:key that is not a compressed P-256 public key. */
+var MalformedDidKeyError = class extends Error {
+	constructor(did, detail) {
+		super(`Malformed did:key ${did}: ${detail}`);
+		this.name = "MalformedDidKeyError";
+	}
+};
+const keyCache = /* @__PURE__ */ new Map();
+/** Cached per process: decompressing the point costs a BigInt modPow. */
+async function importDidKey(did) {
+	const cached = keyCache.get(did);
+	if (cached) {
+		keyCache.delete(did);
+		keyCache.set(did, cached);
+		return cached;
+	}
+	const raw = decompressP256(compressedPointFromDid(did), did);
+	const key = await crypto.subtle.importKey("raw", raw.buffer, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	keyCache.set(did, key);
+	if (keyCache.size > MAX_CACHED_KEYS) {
+		const oldest = keyCache.keys().next().value;
+		if (oldest !== void 0) keyCache.delete(oldest);
+	}
+	return key;
+}
+function compressedPointFromDid(did) {
+	if (!did.startsWith(DID_KEY_PREFIX)) throw new MalformedDidKeyError(did, "not a base58btc did:key");
+	const decoded = base58Decode(did.slice(9));
+	if (!decoded || decoded.length !== 35) throw new MalformedDidKeyError(did, "not a compressed P-256 key");
+	if (decoded[0] !== P256_MULTICODEC[0] || decoded[1] !== P256_MULTICODEC[1]) throw new MalformedDidKeyError(did, "not a P-256 multicodec");
+	return decoded.subarray(2);
+}
+function decompressP256(compressed, did) {
+	const prefix = compressed[0];
+	if (prefix !== 2 && prefix !== 3) throw new MalformedDidKeyError(did, `compression prefix ${prefix}`);
+	let x = BigInt(0);
+	for (let i = 1; i < compressed.length; i++) x = x << BigInt(8) | BigInt(compressed[i]);
+	if (x >= P) throw new MalformedDidKeyError(did, "x outside the field");
+	const ySquared = (modPow(x, BigInt(3), P) + A * x + B) % P;
+	let y = modPow(ySquared, (P + BigInt(1)) / BigInt(4), P);
+	if (y * y % P !== ySquared) throw new MalformedDidKeyError(did, "x is not on the curve");
+	if (y % BigInt(2) === BigInt(0) !== (prefix === 2)) y = P - y;
+	const uncompressed = new Uint8Array(65);
+	uncompressed[0] = 4;
+	uncompressed.set(bigIntToBytes(x), 1);
+	uncompressed.set(bigIntToBytes(y), 33);
+	return uncompressed;
+}
+function modPow(base, exp, mod) {
+	let result = BigInt(1);
+	let b = base % mod;
+	let e = exp;
+	while (e > BigInt(0)) {
+		if (e & BigInt(1)) result = result * b % mod;
+		e >>= BigInt(1);
+		b = b * b % mod;
+	}
+	return result;
+}
+function bigIntToBytes(value) {
+	const bytes = new Uint8Array(32);
+	let v = value;
+	for (let i = 31; i >= 0; i--) {
+		bytes[i] = Number(v & BigInt(255));
+		v >>= BigInt(8);
+	}
+	return bytes;
+}
+//#endregion
+//#region src/signer/verify-action-signature.ts
+const RENOWN_HASH_LENGTH = 44;
+const SHARED_HASH_LENGTH = 28;
+const HEX_SIGNATURE = /^(0x)?([0-9a-fA-F]{2})+$/;
+/**
+* Integrity only: identity binding and the live-id check sit with the caller.
+* `operation` is the incoming operation at load admission.
+*/
+async function verifyActionSignature(action, target, path, operation) {
+	const policy = target.policy ?? "legacy";
+	const refusal = policyRefusal(action, policy);
+	if (refusal) return refusal;
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return policy === "v2-required" ? refuse("unsigned", "UNSIGNED_REQUIRED", `action ${action.id} is unsigned but ${target.documentId} requires v2 signatures`) : {
+		ok: true,
+		scheme: "unsigned"
+	};
+	if (shape.kind === "malformed") return refuse("legacy-unknown", "MALFORMED_TUPLE", `action ${action.id} ${shape.reason}`);
+	const { signer, tuple } = shape;
+	const scheme = schemeOf(tuple[2]);
+	if (tuple[1] !== signer.app.key) return refuse(scheme, "KEY_MISMATCH", `action ${action.id} tuple key does not match signer.app.key`);
+	if (scheme !== "v2" && policy === "v2-required") return refuse(scheme, "SCHEME_BELOW_POLICY", `action ${action.id} carries a legacy tuple but ${target.documentId} requires v2 signatures`);
+	if (scheme === "legacy-unknown" && path === "mutation") return refuse(scheme, "MALFORMED_TUPLE", `action ${action.id} carries a hash of unknown length ${tuple[2].length}`);
+	if (scheme === "v2") {
+		const refusal = await checkV2(action, tuple, target, operation);
+		if (refusal) return refusal;
+	} else if (path === "mutation") {
+		if (await legacyHash(scheme, action, target) !== tuple[2]) return refuse(scheme, "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+	}
+	return verifyEcdsa(tuple, scheme, action.id);
+}
+/** Refusals a document's policy makes before any tuple is read. */
+function policyRefusal(action, policy) {
+	if (action.type !== "CREATE_DOCUMENT") return;
+	const scheme = schemeOfAction(action);
+	const input = action.input;
+	const documentId = input?.documentId ?? "";
+	if (policy === "legacy") return isDerivedDocumentId(documentId) ? refuse(scheme, "ID_MISMATCH", `action ${action.id}: a legacy document cannot take the content-addressed id ${documentId}`) : void 0;
+	const expected = derivedCreateId(input);
+	if (expected === documentId) return;
+	return refuse(scheme, "ID_MISMATCH", expected === void 0 ? `action ${action.id} creates v2-required ${documentId} without the header params its id is derived from` : `action ${action.id} creates v2-required ${documentId}, but its header params derive ${expected}`);
+}
+function derivedCreateId(input) {
+	if (!input?.signing || !input.protocolVersions) return;
+	try {
+		return deriveDocumentId({
+			documentType: input.model,
+			createdAtUtcIso: input.signing.createdAtUtcIso,
+			nonce: input.signing.nonce,
+			protocolVersions: input.protocolVersions
+		});
+	} catch {
+		return;
+	}
+}
+function schemeOfAction(action) {
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return "unsigned";
+	return shape.kind === "signed" ? schemeOf(shape.tuple[2]) : "legacy-unknown";
+}
+/** Peers send arbitrary JSON, so nothing past `context` is assumed. */
+function signerShape(value) {
+	if (value === void 0 || value === null) return { kind: "unsigned" };
+	if (!isRecord(value)) return {
+		kind: "malformed",
+		reason: "has a signer that is not an object"
+	};
+	const { app, user, signatures } = value;
+	if (app !== void 0 && app !== null && !isRecord(app)) return {
+		kind: "malformed",
+		reason: "has a signer.app that is not an object"
+	};
+	const key = isRecord(app) ? app.key : void 0;
+	if (key !== void 0 && key !== null && typeof key !== "string") return {
+		kind: "malformed",
+		reason: "has a signer.app.key that is not a string"
+	};
+	if (!key) return { kind: "unsigned" };
+	if (!isRecord(user) || typeof user.address !== "string") return {
+		kind: "malformed",
+		reason: "has a signer without a user address"
+	};
+	if (!Array.isArray(signatures)) return {
+		kind: "malformed",
+		reason: "has a signer whose signatures are not a list"
+	};
+	const tuple = signatures.at(-1);
+	if (!isTuple(tuple)) return {
+		kind: "malformed",
+		reason: signatures.length === 0 ? "has a signer but no signatures" : "carries a malformed signature tuple"
+	};
+	return {
+		kind: "signed",
+		signer: value,
+		tuple
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function checkV2(action, tuple, target, operation) {
+	const problem = v2TupleProblem(tuple);
+	if (problem) return refuse("v2", "MALFORMED_TUPLE", `action ${action.id}: ${problem}`);
+	if (operation && !sameInstant(operation.timestampUtcMs, action.timestampUtcMs)) return refuse("v2", "TIMESTAMP_MISMATCH", `action ${action.id} is stamped ${action.timestampUtcMs} but its operation ${operation.timestampUtcMs}`);
+	let expected;
+	try {
+		expected = await hashActionV2(action, target, action.context.signer);
+	} catch (error) {
+		return refuse("v2", "HASH_MISMATCH", `action ${action.id} has no v2 hash: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (expected !== tuple[2]) return refuse("v2", "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+}
+function sameInstant(a, b) {
+	const left = Date.parse(a);
+	return !Number.isNaN(left) && left === Date.parse(b);
+}
+function schemeOf(hash) {
+	if (isV2ActionHash(hash)) return "v2";
+	if (hash.length === RENOWN_HASH_LENGTH) return "legacy-renown";
+	if (hash.length === SHARED_HASH_LENGTH) return "legacy-shared";
+	return "legacy-unknown";
+}
+async function legacyHash(scheme, action, target) {
+	if (scheme === "legacy-renown") {
+		const payload = [
+			action.scope,
+			action.type,
+			JSON.stringify(action.input)
+		].join("");
+		const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(payload));
+		return bytesToBase64(new Uint8Array(digest));
+	}
+	const signer = action.context.signer;
+	return buildOperationSignatureParams({
+		documentId: target.documentId,
+		signer,
+		action,
+		previousStateHash: ""
+	})[2];
+}
+async function verifyEcdsa(tuple, scheme, actionId) {
+	const [timestamp, key, hash, prevStateHash, signatureHex] = tuple;
+	if (!HEX_SIGNATURE.test(signatureHex)) return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId} signature is not hex`);
+	let cryptoKey;
+	try {
+		cryptoKey = await importDidKey(key);
+	} catch (error) {
+		return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const message = buildOperationSignatureMessage([
+		timestamp,
+		key,
+		hash,
+		prevStateHash
+	]);
+	let valid;
+	try {
+		valid = await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, cryptoKey, hexToBytes(signatureHex).buffer, message.buffer);
+	} catch {
+		valid = false;
+	}
+	if (!valid) return refuse(scheme, "BAD_SIGNATURE", `action ${actionId} signature does not verify under its key`);
+	return {
+		ok: true,
+		scheme
+	};
+}
+function isTuple(value) {
+	return Array.isArray(value) && value.length === 5 && value.every((element) => typeof element === "string");
+}
+function refuse(scheme, code, reason) {
+	return {
+		ok: false,
+		scheme,
+		code,
+		reason
+	};
+}
+function hexToBytes(hex) {
+	const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+	const bytes = new Uint8Array(clean.length / 2);
+	for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
+	return bytes;
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+}
+//#endregion
+//#region src/executor/synthesized-signing.ts
+/** Submitted types whose stored action the reducer writes in their place. */
+const SYNTHESIZING_TYPES = new Set(["UNDO", "REDO"]);
+/**
+* The id of the action synthesized from `submittedId`. Derived, so the stored
+* operation answers for the submitted id at the live-id check.
+*/
+function synthesizedActionId(submittedId) {
+	return hashBrowser(`synthesized:${submittedId}`, "sha1", "hex").slice(0, 32);
+}
+/**
+* Whether `operation` stores an action the reducer made from `submitted`
+* rather than `submitted` itself or an operation already in `history`.
+*/
+function isSynthesized(submitted, operation, history) {
+	if (!SYNTHESIZING_TYPES.has(submitted.type)) return false;
+	const id = operation.action.id;
+	if (!id) return true;
+	if (id === submitted.id) return false;
+	return !history.some((existing) => existing.action.id === id);
+}
+/**
+* Signs the synthesized action of `operation` in place as `signer`, under the
+* id {@link synthesizedActionId} derives from the submitted one. A REDO's
+* rebuilt action has no timestamp, so it takes the submitted one; the
+* operation timestamp is set to the action's, which a peer requires of a v2
+* tuple.
+*/
+async function signSynthesized(operation, submitted, target, signer, signal) {
+	const synthesized = operation.action;
+	const id = synthesizedActionId(submitted.id);
+	const timestampUtcMs = operation.timestampUtcMs || synthesized.timestampUtcMs || submitted.timestampUtcMs;
+	const action = {
+		id,
+		timestampUtcMs,
+		type: synthesized.type,
+		input: synthesized.input,
+		scope: synthesized.scope
+	};
+	const signature = await signer.signAction(action, {
+		documentId: target.documentId,
+		branch: target.branch
+	}, signal);
+	operation.action = {
+		...action,
+		context: { signer: {
+			...actionSignerIdentity(signer),
+			signatures: [signature]
+		} }
+	};
+	operation.id = deriveOperationId(target.documentId, target.scope, target.branch, id);
+	operation.timestampUtcMs = timestampUtcMs;
+}
+//#endregion
+//#region src/executor/signature-admission.ts
+const DEFAULT_TRUST_TIMEOUT_MS = 1e4;
+/** Runs once per write, when this reactor first stores it; never on re-appends. */
+var SignatureAdmission = class {
+	trustPolicy;
+	trustTimeoutMs;
+	constructor(mode, logger, eventBus, policySource = "meta", trust = {
+		authEnforcement: false,
+		timeoutMs: DEFAULT_TRUST_TIMEOUT_MS
+	}) {
+		this.mode = mode;
+		this.logger = logger;
+		this.eventBus = eventBus;
+		this.policySource = policySource;
+		this.trustPolicy = admissionTrustPolicy(trust.signer ?? new PassthroughSigner(), trust.authEnforcement, trust.policy);
+		this.trustTimeoutMs = trust.timeoutMs;
+	}
+	/** The first refusal of a mutation's submitted actions, when enforcing. */
+	async admitMutation(job, stores, signal) {
+		const { operationStore } = stores;
+		const candidates = job.actions.map((action) => candidate(action, mutationStream(action, job)));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const committed = await this.storedAsSubmitted(candidates, live, isRetry(job), operationStore, signal);
+		await resolvePolicies(candidates, job.actions, (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const submitted = /* @__PURE__ */ new Set();
+		for (const entry of candidates) {
+			if (committed.has(entry)) continue;
+			const verdict = await this.verdict(entry, live, submitted, "mutation", signal);
+			submitted.add(entry.opId);
+			if (verdict.ok) continue;
+			const refusal = this.record(job, entry, verdict, "mutation");
+			if (refusal) return {
+				kind: "refused",
+				error: refusal
+			};
+		}
+		return {
+			kind: "admitted",
+			committed: [...committed.values()]
+		};
+	}
+	/** The incoming operations a load drops, empty unless enforcing. */
+	async admitLoad(job, operations, stores, signal) {
+		const { operationStore } = stores;
+		const stream = {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		};
+		const candidates = operations.map((operation) => ({
+			...candidate(operation.action, stream),
+			operation
+		}));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		await resolvePolicies(candidates, job.operations.map((operation) => operation.action), (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const dropped = /* @__PURE__ */ new Set();
+		for (let i = 0; i < candidates.length; i++) {
+			const verdict = await this.verdict(candidates[i], live, void 0, "load", signal);
+			if (verdict.ok) continue;
+			if (this.record(job, candidates[i], verdict, "load")) dropped.add(operations[i]);
+		}
+		return dropped;
+	}
+	async verdict(entry, live, submitted, path, signal) {
+		const verdict = await verifyActionSignature(entry.action, {
+			documentId: entry.stream.documentId,
+			branch: entry.stream.branch,
+			policy: entry.policy
+		}, path, entry.operation);
+		if (!verdict.ok) return verdict;
+		if (isLive(entry, live) || submitted?.has(entry.opId)) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "DUPLICATE_ACTION",
+			reason: `action ${entry.action.id} is already in the stream`
+		};
+		if (verdict.scheme === "unsigned") {
+			const address = entry.action.context?.signer?.user?.address;
+			return address ? {
+				ok: false,
+				scheme: "unsigned",
+				code: "UNSIGNED_IDENTITY",
+				reason: `action ${entry.action.id} is unsigned but claims to act as ${address}`
+			} : verdict;
+		}
+		const signer = entry.action.context.signer;
+		if (!await this.authorize(signer, entry.stream.documentId, signal)) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "SIGNER_UNAUTHORIZED",
+			reason: `action ${entry.action.id}: key ${signer.app.key} may not sign as ${signer.user.address}`
+		};
+		return verdict;
+	}
+	/** Throws when the policy does, times out or the job is aborted. */
+	async authorize(signer, documentId, signal) {
+		signal?.throwIfAborted();
+		let timer;
+		let onAbort;
+		const stop = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`signature trust policy did not answer for ${signer.app.key} within ${this.trustTimeoutMs}ms`));
+			}, this.trustTimeoutMs);
+			if (signal) {
+				onAbort = () => reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason)));
+				signal.addEventListener("abort", onAbort, { once: true });
 			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Action ${action.id} signature verification returned false`);
+		});
+		try {
+			return await Promise.race([this.trustPolicy.authorizeSigner(signer, signer.app.key, documentId), stop]);
+		} finally {
+			clearTimeout(timer);
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
 		}
 	}
-	async verifyOperations(documentId, operations) {
-		if (!this.verifier) return;
-		for (let i = 0; i < operations.length; i++) {
-			const operation = operations[i];
-			const signer = operation.action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				isValid = await this.verifier(operation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} verification failed: ${errorMessage}`);
+	/**
+	* The live candidates stored exactly as submitted. A synthesized operation
+	* holds another action, so it cannot be compared; only a retry, whose first
+	* attempt this job was, takes it as committed.
+	*/
+	async storedAsSubmitted(candidates, live, retry, operationStore, signal) {
+		const committed = /* @__PURE__ */ new Map();
+		const toCompare = [];
+		for (const entry of candidates) if (entry.synthesizedOpId && live.has(entry.synthesizedOpId)) {
+			if (retry) committed.set(entry, committedWrite(entry, entry.synthesizedOpId));
+		} else if (live.has(entry.opId)) toCompare.push(entry);
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			const byId = new Map(stored.map((operation) => [operation.id, operation]));
+			for (const entry of entries) {
+				const operation = byId.get(entry.opId);
+				if (operation && sameContent(operation.action, entry.action)) committed.set(entry, committedWrite(entry, entry.opId));
 			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} signature verification returned false`);
 		}
+		return committed;
+	}
+	async liveOperationIds(candidates, operationStore, signal) {
+		const live = /* @__PURE__ */ new Set();
+		for (const [stream, entries] of byStream(candidates)) {
+			const found = await operationStore.findOperationIds(stream.documentId, stream.scope, stream.branch, entries.flatMap((entry) => entry.synthesizedOpId ? [entry.opId, entry.synthesizedOpId] : [entry.opId]), signal);
+			for (const opId of found) live.add(opId);
+		}
+		return live;
+	}
+	/** Logs and counts a refusal; returns the error only when enforcing. */
+	record(job, entry, refusal, path) {
+		const enforced = this.mode === "enforce";
+		const event = {
+			jobId: job.id,
+			documentId: entry.stream.documentId,
+			scope: entry.stream.scope,
+			branch: entry.stream.branch,
+			actionId: entry.action.id,
+			code: refusal.code,
+			scheme: refusal.scheme,
+			path,
+			enforced,
+			reason: refusal.reason
+		};
+		this.logger.warn(enforced ? "Signature refused: @Refusal" : "Signature refusal logged, write admitted: @Refusal", event);
+		this.eventBus.emit(ReactorEventTypes.SIGNATURE_REFUSED, event).catch((error) => {
+			this.logger.error("Failed to emit SIGNATURE_REFUSED: @Error", error);
+		});
+		return enforced ? new InvalidSignatureError(entry.stream.documentId, refusal.code, refusal.reason) : void 0;
 	}
 };
+/**
+* A CREATE_DOCUMENT is verified under its own input. Anything else takes the
+* stored document's policy, or, for a document this job creates, that CREATE's.
+*/
+async function resolvePolicies(candidates, jobActions, stored) {
+	const resolved = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		if (entry.action.type === "CREATE_DOCUMENT") {
+			entry.policy = createPolicy(entry.action);
+			continue;
+		}
+		const { documentId, branch } = entry.stream;
+		const key = `${documentId}\u0000${branch}`;
+		let policy = resolved.get(key);
+		if (policy === void 0) {
+			policy = await stored(documentId, branch) ?? createdPolicy(jobActions, documentId) ?? "legacy";
+			resolved.set(key, policy);
+		}
+		entry.policy = policy;
+	}
+}
+async function storedPolicy(stores, source, documentId, branch, signal) {
+	try {
+		if (source === "write-cache") return signaturePolicyOf((await stores.writeCache.getState(documentId, "document", branch, void 0, signal)).header);
+		return signaturePolicyOf((await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal)).protocolVersions);
+	} catch (error) {
+		if (DocumentNotFoundError.isError(error)) return;
+		throw error;
+	}
+}
+function createdPolicy(actions, documentId) {
+	const create = actions.find((action) => action.type === "CREATE_DOCUMENT" && action.input?.documentId === documentId);
+	return create ? createPolicy(create) : void 0;
+}
+function createPolicy(action) {
+	return signaturePolicyOf(action.input);
+}
+function candidate(action, stream) {
+	const opId = (actionId) => deriveOperationId(stream.documentId, stream.scope, stream.branch, actionId);
+	return {
+		action,
+		stream,
+		opId: opId(action.id),
+		synthesizedOpId: SYNTHESIZING_TYPES.has(action.type) ? opId(synthesizedActionId(action.id)) : void 0
+	};
+}
+function isLive(entry, live) {
+	return live.has(entry.opId) || entry.synthesizedOpId !== void 0 && live.has(entry.synthesizedOpId);
+}
+function mutationStream(action, job) {
+	return {
+		...actionSigningTarget(action, job.documentId, job.branch),
+		scope: job.scope
+	};
+}
+function byStream(candidates) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		const key = `${entry.stream.documentId}\u0000${entry.stream.scope}\u0000${entry.stream.branch}`;
+		const group = groups.get(key) ?? [entry.stream, []];
+		group[1].push(entry);
+		groups.set(key, group);
+	}
+	return [...groups.values()];
+}
+function isRetry(job) {
+	return job.errorHistory.length > 0 || (job.retryCount ?? 0) > 0;
+}
+function committedWrite(entry, opId) {
+	return {
+		...entry.stream,
+		actionId: entry.action.id,
+		opId
+	};
+}
+function sameContent(stored, submitted) {
+	try {
+		return canonicalJson(stored) === canonicalJson(submitted);
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/executor/simple-job-executor.ts
 const MAX_SKIP_THRESHOLD = 1e3;
@@ -3346,10 +3909,15 @@ var SimpleJobExecutor = class {
 	config;
 	featureFlags;
 	decisionModel;
-	signatureVerifierModule;
+	signatureAdmission;
 	documentActionHandler;
 	executionScope;
-	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, signatureVerifier, executionScope) {
+	signer;
+	/**
+	* `signer` signs the operations the reducer synthesizes; unsigned if omitted.
+	* `trustPolicy` decides which keys may sign as which users at admission.
+	*/
+	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, executionScope, signer, trustPolicy) {
 		this.logger = logger;
 		this.registry = registry;
 		this.operationStore = operationStore;
@@ -3359,6 +3927,7 @@ var SimpleJobExecutor = class {
 		this.documentMetaCache = documentMetaCache;
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
+		this.signer = signer ?? new PassthroughSigner();
 		this.config = {
 			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
@@ -3368,11 +3937,17 @@ var SimpleJobExecutor = class {
 			retryBaseDelayMs: config.retryBaseDelayMs ?? 100,
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50,
-			batchApplies: config.batchApplies ?? true
+			batchApplies: config.batchApplies ?? true,
+			signatureVerification: config.signatureVerification ?? "enforce"
 		};
 		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
-		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
+		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
+			signer: this.signer,
+			authEnforcement: this.featureFlags.authEnforcement,
+			policy: trustPolicy,
+			timeoutMs: Math.min(DEFAULT_TRUST_TIMEOUT_MS, this.config.jobTimeoutMs / 2)
+		});
 		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
@@ -3502,10 +4077,29 @@ var SimpleJobExecutor = class {
 				pendingEvent
 			};
 		}
-		const positioned = await this.positionByTimestamp(job, stores, signal);
+		let admission;
+		try {
+			admission = await this.signatureAdmission.admitMutation(job, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		if (admission.kind === "refused") return { result: buildErrorResult(job, admission.error, startTime) };
+		let committed;
+		try {
+			committed = await this.reloadCommitted(admission.committed, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		const committedIds = new Set(admission.committed.map((write) => write.actionId));
+		const fresh = committedIds.size === 0 ? job : {
+			...job,
+			actions: job.actions.filter((action) => !committedIds.has(action.id))
+		};
+		if (fresh.actions.length === 0) return this.committedOutcome(job, committed, [], [], stores, startTime);
+		const positioned = await this.positionByTimestamp(fresh, stores, signal);
 		if (positioned.error) return { result: buildErrorResult(job, positioned.error, startTime) };
 		const executing = {
-			job,
+			job: fresh,
 			startTime,
 			indexTxn,
 			stores,
@@ -3535,12 +4129,21 @@ var SimpleJobExecutor = class {
 		} };
 		const ordinals = await stores.operationIndex.commit(indexTxn, signal);
 		postCommitMembershipInvalidations.push(...indexTxn.getMembershipInvalidations());
-		if (actionResult.operationsWithContext.length > 0) {
-			for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
-			const collectionMemberships = await this.getCollectionMembershipsForOperations(actionResult.operationsWithContext, stores);
+		for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
+		return this.committedOutcome(job, committed, actionResult.operationsWithContext, actionResult.generatedOperations, stores, startTime);
+	}
+	/**
+	* A successful mutation's result and the write-ready event it owes, carrying
+	* what earlier attempts committed ahead of what this one wrote.
+	*/
+	async committedOutcome(job, reloaded, written, generated, stores, startTime) {
+		const operationsWithContext = [...reloaded, ...written];
+		let pendingEvent;
+		if (operationsWithContext.length > 0) {
+			const collectionMemberships = await this.getCollectionMembershipsForOperations(operationsWithContext, stores);
 			pendingEvent = {
 				jobId: job.id,
-				operations: actionResult.operationsWithContext,
+				operations: operationsWithContext,
 				jobMeta: job.meta,
 				submittedActionIds: submittedActionIds(job),
 				collectionMemberships
@@ -3550,14 +4153,62 @@ var SimpleJobExecutor = class {
 			result: {
 				job,
 				success: true,
-				operations: actionResult.generatedOperations,
-				operationsWithContext: actionResult.operationsWithContext,
+				operations: [...reloaded.map((entry) => entry.operation), ...generated],
+				operationsWithContext,
 				duration: Date.now() - startTime
 			},
 			pendingEvent
 		};
 	}
 	/**
+	* The stored operations of writes an earlier attempt committed, as a fresh
+	* write would report them. State is rebuilt from the write cache, and left
+	* out when it cannot be.
+	*/
+	async reloadCommitted(writes, stores, signal) {
+		const streams = /* @__PURE__ */ new Map();
+		for (const write of writes) {
+			const key = `${write.documentId}\u0000${write.scope}\u0000${write.branch}`;
+			streams.set(key, [...streams.get(key) ?? [], write]);
+		}
+		const reloaded = [];
+		for (const group of streams.values()) {
+			const { documentId, scope, branch } = group[0];
+			const opIds = [...new Set(group.map((write) => write.opId))];
+			const operations = await stores.operationStore.getOperationsByIds(documentId, scope, branch, opIds, signal);
+			const ordinals = await stores.operationIndex.getOrdinalsByOpIds(documentId, scope, branch, opIds, signal);
+			const { documentType } = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			for (const operation of operations.sort((a, b) => a.index - b.index)) reloaded.push({
+				operation,
+				context: {
+					documentId,
+					scope,
+					branch,
+					documentType,
+					resultingState: await this.rebuiltState(stores, {
+						documentId,
+						scope,
+						branch
+					}, operation, signal),
+					ordinal: ordinals.get(operation.id) ?? 0
+				}
+			});
+		}
+		return reloaded;
+	}
+	async rebuiltState(stores, stream, operation, signal) {
+		try {
+			const document = await stores.writeCache.getState(stream.documentId, stream.scope, stream.branch, operation.index, signal);
+			return JSON.stringify({
+				...document.state,
+				header: document.header
+			});
+		} catch (error) {
+			this.logger.warn("No state for committed operation @OperationId in @Stream: @Error", operation.id, stream, error);
+			return;
+		}
+	}
+	/**
 	* Drops the cached state of every stream a job wrote, after its transaction
 	* did not commit.
 	*
@@ -3586,16 +4237,6 @@ var SimpleJobExecutor = class {
 		const actions = writes.map((write) => write.action);
 		const generatedOperations = [];
 		const operationsWithContext = [];
-		try {
-			await this.signatureVerifierModule.verifyActions(job.documentId, job.branch, actions);
-		} catch (error) {
-			return {
-				success: false,
-				generatedOperations,
-				operationsWithContext,
-				error: error instanceof Error ? error : new Error(String(error))
-			};
-		}
 		for (const action of actions) if (action.timestampUtcMs && !isValidISOTimestamp(action.timestampUtcMs)) return {
 			success: false,
 			generatedOperations,
@@ -3693,7 +4334,7 @@ var SimpleJobExecutor = class {
 			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 			documentVersion = docMeta.state.version;
 		}
-		if (isUndoRedo(action) || action.type === "PRUNE" || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (isUndoRedo(action) || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		if (baseDocument !== void 0) document = baseDocument;
 		else try {
@@ -3753,7 +4394,7 @@ var SimpleJobExecutor = class {
 				branch: job.branch,
 				protocolVersion
 			};
-			updatedDocument = module.reducer(document, action, void 0, reducerOptions);
+			updatedDocument = withProtocolVersions(module.reducer(document, action, void 0, reducerOptions), document.header.protocolVersions);
 		} catch (error) {
 			const contextMessage = `Failed to apply action to document:\n  Action type: ${action.type}\n  Document ID: ${job.documentId}\n  Document type: ${document.header.documentType}\n  Scope: ${job.scope}\n  Original error: ${error instanceof Error ? error.message : String(error)}`;
 			const enhancedError = new Error(contextMessage);
@@ -3765,6 +4406,15 @@ var SimpleJobExecutor = class {
 		if (operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("No operation generated from action"), startTime);
 		const newOperation = operations[operations.length - 1];
 		if (!isUndoRedo(action)) newOperation.skip = skip;
+		if (deniedReason === void 0 && sourceOperation === void 0 && !executing.replayingAcceptedHistory && isSynthesized(action, newOperation, document.operations[scope] ?? [])) try {
+			await signSynthesized(newOperation, action, {
+				documentId: job.documentId,
+				scope,
+				branch: job.branch
+			}, this.signer, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
 		const resultingState = JSON.stringify({
 			...updatedDocument.state,
 			header: updatedDocument.header
@@ -3865,7 +4515,7 @@ var SimpleJobExecutor = class {
 	*   apply and its own reasons for it.
 	* - A positional or replayed run carries skips and re-appended operations,
 	*   whose indices are not a simple ascending run from the head.
-	* - UNDO, REDO, PRUNE and NOOP-with-skip each invalidate the write cache to
+	* - UNDO, REDO and NOOP-with-skip each invalidate the write cache to
 	*   force a full-history rebuild, so they cannot be reduced against state
 	*   threaded from the write before them.
 	* - The auth scope decides later writes against the policy earlier ones
@@ -3883,7 +4533,7 @@ var SimpleJobExecutor = class {
 		if (scope === "auth" || scope === "document") return false;
 		return writes.every((write) => {
 			const type = write.action.type;
-			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "PRUNE" && type !== "NOOP";
+			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "NOOP";
 		});
 	}
 	/**
@@ -4270,36 +4920,32 @@ var SimpleJobExecutor = class {
 			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
 			duration: Date.now() - startTime
 		};
-		let minIncomingIndex = Number.POSITIVE_INFINITY;
-		let minIncomingTimestamp = job.operations[0]?.timestampUtcMs || "";
-		for (const operation of job.operations) {
-			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
-			const ts = operation.timestampUtcMs || "";
-			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
-		}
-		let conflictingOps;
-		try {
-			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
-		} catch {
-			conflictingOps = [];
-		}
-		let allOpsFromMinConflictingIndex = conflictingOps;
-		if (conflictingOps.length > 0) {
-			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+		const dropped = /* @__PURE__ */ new Set();
+		const admitted = /* @__PURE__ */ new Set();
+		let selection = await this.selectLoadWrites(job, job.operations, stores, signal);
+		for (;;) {
+			const unadmitted = selection.incomingOpsToApply.filter((operation) => !admitted.has(operation));
+			if (unadmitted.length === 0) break;
+			let refused;
 			try {
-				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
-			} catch {
-				allOpsFromMinConflictingIndex = conflictingOps;
+				refused = await this.signatureAdmission.admitLoad(job, unadmitted, stores, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 			}
+			for (const operation of unadmitted) if (refused.has(operation)) dropped.add(operation);
+			else admitted.add(operation);
+			if (refused.size === 0) break;
+			const remaining = job.operations.filter((operation) => !dropped.has(operation));
+			if (remaining.length === 0) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
+			selection = await this.selectLoadWrites(job, remaining, stores, signal);
 		}
-		const incomingActionIds = new Set(job.operations.map((op) => op.action.id));
-		const nonSupersededOps = conflictingOps.filter((op) => {
-			if (op.index < minIncomingIndex && !incomingActionIds.has(op.action.id)) return false;
-			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0) {
-				if (laterOp.index - laterOp.skip <= op.index) return false;
-			}
-			return true;
-		});
+		const { nonSupersededOps, allOpsFromMinConflictingIndex, incomingOpsToApply } = selection;
 		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
 		const actionIdCounts = /* @__PURE__ */ new Map();
 		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
@@ -4320,14 +4966,6 @@ var SimpleJobExecutor = class {
 			const logicalSkip = latestRevision - minLogicalIndex;
 			if (logicalSkip > skipCount) skipCount = logicalSkip;
 		}
-		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
-		const seenIncomingActionIds = /* @__PURE__ */ new Set();
-		const incomingOpsToApply = job.operations.filter((op) => {
-			if (existingActionIds.has(op.action.id)) return false;
-			if (seenIncomingActionIds.has(op.action.id)) return false;
-			seenIncomingActionIds.add(op.action.id);
-			return true;
-		});
 		if (incomingOpsToApply.length === 0) return {
 			job,
 			success: true,
@@ -4407,6 +5045,53 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
+	/** The conflicting window a load opens, and which of its operations are new. */
+	async selectLoadWrites(job, operations, stores, signal) {
+		const scope = job.scope;
+		let minIncomingIndex = Number.POSITIVE_INFINITY;
+		let minIncomingTimestamp = operations[0]?.timestampUtcMs || "";
+		for (const operation of operations) {
+			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
+			const ts = operation.timestampUtcMs || "";
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
+		}
+		let conflictingOps;
+		try {
+			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
+		} catch {
+			conflictingOps = [];
+		}
+		let allOpsFromMinConflictingIndex = conflictingOps;
+		if (conflictingOps.length > 0) {
+			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+			try {
+				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
+			} catch {
+				allOpsFromMinConflictingIndex = conflictingOps;
+			}
+		}
+		const incomingActionIds = new Set(operations.map((op) => op.action.id));
+		const nonSupersededOps = conflictingOps.filter((op) => {
+			if (op.index < minIncomingIndex && !incomingActionIds.has(op.action.id)) return false;
+			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0) {
+				if (laterOp.index - laterOp.skip <= op.index) return false;
+			}
+			return true;
+		});
+		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
+		const seenIncomingActionIds = /* @__PURE__ */ new Set();
+		const incomingOpsToApply = operations.filter((op) => {
+			if (existingActionIds.has(op.action.id)) return false;
+			if (seenIncomingActionIds.has(op.action.id)) return false;
+			seenIncomingActionIds.add(op.action.id);
+			return true;
+		});
+		return {
+			nonSupersededOps,
+			allOpsFromMinConflictingIndex,
+			incomingOpsToApply
+		};
+	}
 	accumulateResultOrReturnError(result, generatedOperations, operationsWithContext) {
 		if (!result.success) return result;
 		if (result.operations && result.operations.length > 0) generatedOperations.push(...result.operations);
@@ -4939,6 +5624,20 @@ var KyselyOperationStore = class KyselyOperationStore {
 		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
 		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
 	}
+	async findOperationIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return /* @__PURE__ */ new Set();
+		const rows = await this.queryExecutor.selectFrom("Operation").select("opId").distinct().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).execute();
+		return new Set(rows.map((row) => row.opId));
+	}
+	async getOperationsByIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return [];
+		const rows = await this.queryExecutor.selectFrom("Operation").selectAll().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "asc").execute();
+		const latest = /* @__PURE__ */ new Map();
+		for (const row of rows) latest.set(row.opId, this.rowToOperation(row));
+		return [...latest.values()];
+	}
 	rowToOperation(row) {
 		return {
 			index: row.index,
@@ -5412,6 +6111,6 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 //#region src/core/drive-container-types.ts
 const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
 //#endregion
-export { parsePagingOptions as $, targetDocumentId as A, DuplicateOperationError as B, InvalidModuleError as C, createEmptyConsistencyToken as D, createConsistencyToken as E, buildDecisionModel as F, AuthorizationDeniedError as G, RevisionMismatchError as H, APPEND_CONDITION_FAILED_PREFIX as I, ExcessiveReshuffleError as J, DocumentDeletedError as K, AppendConditionFailedError as L, selectDecisionModel as M, documentDecisionModel as N, submittedActionIds as O, authDecisionModel as P, matchesScope as Q, DocumentAlreadyExistsError as R, DuplicateModuleError as S, GATED_DOCUMENT_ACTIONS as T, AuthEnforcementDisabledError as U, OptimisticLockError as V, AuthTimestampNotMonotonicError as W, RelationshipNotFoundError as X, InvalidOperationTimestampError as Y, UpgradePreconditionFailedError as Z, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, JobExecutorEventTypes as b, KyselyKeyframeStore as c, DriveCollectionId as d, throwIfAborted as et, KyselyExecutionScope as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, decideAtHead as j, summarizeSubmittedActions as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, __exportAll as nt, instrumentPgPool as o, resolveFeatureFlags as p, DocumentNotFoundError as q, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, yieldToMain as tt, SimpleJobExecutor as u, CollectionMembershipCache as v, ModuleNotFoundError as w, DuplicateManifestError as x, DEFAULT_DEFERRED_JOB_TTL_MS as y, DocumentExistence as z };
+export { RelationshipNotFoundError as $, submittedActionIds as A, DocumentAlreadyExistsError as B, DuplicateManifestError as C, GATED_DOCUMENT_ACTIONS as D, ModuleNotFoundError as E, documentDecisionModel as F, AuthEnforcementDisabledError as G, DuplicateOperationError as H, authDecisionModel as I, DocumentDeletedError as J, AuthTimestampNotMonotonicError as K, buildDecisionModel as L, targetDocumentId as M, decideAtHead as N, createConsistencyToken as O, selectDecisionModel as P, InvalidSignatureError as Q, APPEND_CONDITION_FAILED_PREFIX as R, JobExecutorEventTypes as S, InvalidModuleError as T, OptimisticLockError as U, DocumentExistence as V, RevisionMismatchError as W, ExcessiveReshuffleError as X, DocumentNotFoundError as Y, InvalidOperationTimestampError as Z, KyselyWriteCache as _, createForwardingPoolInstrumentation as a, __exportAll as at, CollectionMembershipCache as b, KyselyKeyframeStore as c, verifyActionSignature as d, UpgradePreconditionFailedError as et, PassthroughSigner as f, EventBus as g, resolveFeatureFlags as h, runMigrations as i, yieldToMain as it, summarizeSubmittedActions as j, createEmptyConsistencyToken as k, DocumentModelRegistry as l, KyselyExecutionScope as m, REACTOR_SCHEMA as n, parsePagingOptions as nt, instrumentPgPool as o, DriveCollectionId as p, AuthorizationDeniedError as q, getMigrationStatus as r, throwIfAborted as rt, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, matchesScope as tt, SimpleJobExecutor as u, KyselyOperationIndex as v, DuplicateModuleError as w, DEFAULT_DEFERRED_JOB_TTL_MS as x, DocumentMetaCache as y, AppendConditionFailedError as z };
 
-//# sourceMappingURL=drive-container-types-CS5IxDiA.js.map
+//# sourceMappingURL=drive-container-types-Be5-EY9W.js.map