@powerhousedao/reactor 6.2.3-dev.23 → 6.2.3-dev.24

package/dist/index.js

@@ -1,10 +1,10 @@
-import { $ as parsePagingOptions, A as targetDocumentId, B as DuplicateOperationError, C as InvalidModuleError, D as createEmptyConsistencyToken, E as createConsistencyToken, F as buildDecisionModel, G as AuthorizationDeniedError, H as RevisionMismatchError, I as APPEND_CONDITION_FAILED_PREFIX, J as ExcessiveReshuffleError, K as DocumentDeletedError, L as AppendConditionFailedError, M as selectDecisionModel, N as documentDecisionModel, O as submittedActionIds, P as authDecisionModel, Q as matchesScope, R as DocumentAlreadyExistsError, S as DuplicateModuleError, T as GATED_DOCUMENT_ACTIONS, U as AuthEnforcementDisabledError, V as OptimisticLockError, W as AuthTimestampNotMonotonicError, X as RelationshipNotFoundError, Y as InvalidOperationTimestampError, Z as UpgradePreconditionFailedError, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as JobExecutorEventTypes, c as KyselyKeyframeStore, d as DriveCollectionId, et as throwIfAborted, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as decideAtHead, k as summarizeSubmittedActions, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as resolveFeatureFlags, q as DocumentNotFoundError, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache, w as ModuleNotFoundError, x as DuplicateManifestError, y as DEFAULT_DEFERRED_JOB_TTL_MS, z as DocumentExistence } from "./drive-container-types-CS5IxDiA.js";
-import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
+import { $ as RelationshipNotFoundError, A as submittedActionIds, B as DocumentAlreadyExistsError, C as DuplicateManifestError, D as GATED_DOCUMENT_ACTIONS, E as ModuleNotFoundError, F as documentDecisionModel, G as AuthEnforcementDisabledError, H as DuplicateOperationError, I as authDecisionModel, J as DocumentDeletedError, K as AuthTimestampNotMonotonicError, L as buildDecisionModel, M as targetDocumentId, N as decideAtHead, O as createConsistencyToken, P as selectDecisionModel, Q as InvalidSignatureError, R as APPEND_CONDITION_FAILED_PREFIX, S as JobExecutorEventTypes, T as InvalidModuleError, U as OptimisticLockError, V as DocumentExistence, W as RevisionMismatchError, X as ExcessiveReshuffleError, Y as DocumentNotFoundError, Z as InvalidOperationTimestampError, _ as KyselyWriteCache, a as createForwardingPoolInstrumentation, b as CollectionMembershipCache, c as KyselyKeyframeStore, d as verifyActionSignature, et as UpgradePreconditionFailedError, f as PassthroughSigner, g as EventBus, h as resolveFeatureFlags, i as runMigrations, j as summarizeSubmittedActions, k as createEmptyConsistencyToken, l as DocumentModelRegistry, m as KyselyExecutionScope, n as REACTOR_SCHEMA, nt as parsePagingOptions, o as instrumentPgPool, p as DriveCollectionId, q as AuthorizationDeniedError, r as getMigrationStatus, rt as throwIfAborted, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, tt as matchesScope, u as SimpleJobExecutor, v as KyselyOperationIndex, w as DuplicateModuleError, x as DEFAULT_DEFERRED_JOB_TTL_MS, y as DocumentMetaCache, z as AppendConditionFailedError } from "./drive-container-types-Be5-EY9W.js";
+import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DxDCmtId.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
-import { a as KyselyDocumentView, c as ReadModelCoordinator, d as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, f as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as unchunkedReadModelIndexingConfig, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as DEFAULT_COMMIT_CHUNK_SIZE } from "./document-indexer-CQzTEE1o.js";
+import { a as KyselyDocumentView, c as ReadModelCoordinator, d as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, f as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as unchunkedReadModelIndexingConfig, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as DEFAULT_COMMIT_CHUNK_SIZE } from "./document-indexer-Dn9RB0sg.js";
 import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-g03lNM42.js";
-import { DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actions, actions as documentActions, createPresignedHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, sortOperations, toTransportAction } from "@powerhousedao/shared/document-model";
+import { t as workerEntryPath } from "./worker-BDVzCtuf.js";
+import { DEFAULT_SIGNATURE_POLICY, DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, requestedSignaturePolicy, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -237,37 +237,31 @@ function getSharedActionScope(actions) {
 	return baseScope;
 }
 /**
-* Signs an action with the provided signer.
-* If the action already has valid signatures, it is returned unchanged.
+* Signs an action for `target`, the log it is written to. An action already
+* signed under a key is returned unchanged; one whose signer or last tuple has
+* no key is unsigned, and is signed like any other.
 */
-const signAction = async (action, signer, signal) => {
-	const existingSignatures = action.context?.signer?.signatures;
-	if (existingSignatures && existingSignatures.length > 0) return action;
-	const signature = await signer.signAction(action, signal);
+const signAction = async (action, signer, target, signal) => {
+	const existing = action.context?.signer;
+	if (existing?.app?.key && existing.signatures.at(-1)?.[1]) return action;
+	const signature = await signer.signAction(action, target, signal);
 	return {
 		...action,
 		context: {
 			...action.context,
 			signer: {
-				user: {
-					address: signer.user?.address || "",
-					networkId: signer.user?.networkId || "",
-					chainId: signer.user?.chainId || 0
-				},
-				app: {
-					name: signer.app?.name || "",
-					key: signer.app?.key || ""
-				},
+				...actionSignerIdentity(signer),
 				signatures: [signature]
 			}
 		}
 	};
 };
 /**
-* Signs multiple actions with the provided signer
+* Signs the actions of a job on `job.documentId`, each for the log it is
+* written to: a relationship action lands in its source document.
 */
-const signActions = async (actions, signer, signal) => {
-	return Promise.all(actions.map((action) => signAction(action, signer, signal)));
+const signActions = async (actions, signer, job, signal) => {
+	return Promise.all(actions.map((action) => signAction(action, signer, actionSigningTarget(action, job.documentId, job.branch), signal)));
 };
 function buildSingleJobMeta(jobId, callerMeta) {
 	return {
@@ -329,11 +323,11 @@ var DriveClient = class {
 	}
 	async create(input, signal) {
 		this.logger.verbose("drives.create(@input)", input);
-		const driveDoc = driveCreateDocument({ global: {
+		const driveDoc = withSignaturePolicy(driveCreateDocument({ global: {
 			name: input.global.name || "",
 			icon: input.global.icon ?? null,
 			nodes: []
-		} });
+		} }), requestedSignaturePolicy(input, await this.client.getCreateSignaturePolicy()), { protocolVersions: input.protocolVersions });
 		if (input.preferredEditor) driveDoc.header.meta = {
 			...driveDoc.header.meta,
 			preferredEditor: input.preferredEditor
@@ -369,13 +363,19 @@ var DriveClient = class {
 				initialState: document.state
 			}),
 			addRelationshipAction(driveIdentifier, documentId, "child")
-		], this.signer, signal);
+		], this.signer, {
+			documentId,
+			branch: "main"
+		}, signal);
 		const driveActions = await signActions([addFile({
 			id: documentId,
 			name: document.header.name || documentId,
 			documentType: document.header.documentType,
 			parentFolder
-		})], this.signer, signal);
+		})], this.signer, {
+			documentId: driveIdentifier,
+			branch: "main"
+		}, signal);
 		await this.runJobs([{
 			key: "document",
 			documentId,
@@ -465,18 +465,20 @@ var DriveClient = class {
 			});
 			resolvedNamesByTargetId.set(entry.targetId, resolved);
 		}
+		const policy = await this.client.getCreateSignaturePolicy();
 		for (const entry of copyPlan) {
 			const node = drive.state.global.nodes.find((n) => n.id === entry.srcId);
 			if (!node || !isFileNode(node)) continue;
 			const srcDoc = await this.client.get(entry.srcId, void 0, signal);
 			const duplicated = {
 				...srcDoc,
-				header: createPresignedHeader(entry.targetId, srcDoc.header.documentType),
+				header: createCopyHeader(srcDoc.header, entry.targetId, policy),
 				initialState: srcDoc.state,
 				operations: {}
 			};
 			const resolvedName = resolvedNamesByTargetId.get(entry.targetId);
 			if (resolvedName) duplicated.header.name = resolvedName;
+			entry.targetId = duplicated.header.id;
 			await this.addFile(driveIdentifier, duplicated, entry.targetParentFolder ?? void 0, signal);
 		}
 		return this.client.execute(driveIdentifier, "main", copyPlan.map((entry) => copyNode(entry)), signal);
@@ -529,8 +531,14 @@ var DriveClient = class {
 		}
 	}
 	async removeFileNode(driveId, fileId, signal) {
-		const relationshipActions = await signActions([removeRelationshipAction(driveId, fileId, "child")], this.signer, signal);
-		const driveActions = await signActions([deleteNode({ id: fileId })], this.signer, signal);
+		const relationshipActions = await signActions([removeRelationshipAction(driveId, fileId, "child")], this.signer, {
+			documentId: driveId,
+			branch: "main"
+		}, signal);
+		const driveActions = await signActions([deleteNode({ id: fileId })], this.signer, {
+			documentId: driveId,
+			branch: "main"
+		}, signal);
 		const batchResult = await this.reactor.executeBatch({ jobs: [{
 			key: "relationship",
 			documentId: driveId,
@@ -1049,8 +1057,9 @@ var ReactorClient = class {
 	documentView;
 	readGate;
 	actionEvaluation;
+	createSignaturePolicy;
 	drives;
-	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, readGate = new BareReadGate(), actionEvaluation) {
+	constructor(logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, readGate = new BareReadGate(), actionEvaluation, createSignaturePolicy = DEFAULT_SIGNATURE_POLICY) {
 		this.logger = logger;
 		this.reactor = reactor;
 		this.signer = signer;
@@ -1060,6 +1069,7 @@ var ReactorClient = class {
 		this.documentView = documentView;
 		this.readGate = readGate;
 		this.actionEvaluation = actionEvaluation;
+		this.createSignaturePolicy = createSignaturePolicy;
 		this.drives = new DriveClient(this, logger, reactor, signer);
 		this.logger.verbose("ReactorClient initialized");
 	}
@@ -1403,12 +1413,16 @@ var ReactorClient = class {
 			scopeStates: document.state ?? {}
 		};
 	}
+	getCreateSignaturePolicy() {
+		return Promise.resolve(this.createSignaturePolicy);
+	}
 	/**
 	* Creates a document and waits for completion
 	*/
 	async create(document, parentIdentifier, signal) {
 		this.logger.verbose("create(@id, @parentIdentifier)", document.header.id, parentIdentifier);
 		const documentId = document.header.id;
+		const branch = document.header.branch || "main";
 		const createActions = await signActions([createDocumentAction({
 			model: document.header.documentType,
 			version: 0,
@@ -1431,17 +1445,23 @@ var ReactorClient = class {
 			fromVersion: 0,
 			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 			initialState: document.state
-		})], this.signer, signal);
+		})], this.signer, {
+			documentId,
+			branch
+		}, signal);
 		const jobs = [{
 			key: "create",
 			documentId,
 			scope: getSharedActionScope(createActions),
-			branch: "main",
+			branch,
 			actions: createActions,
 			dependsOn: []
 		}];
 		if (parentIdentifier) {
-			const parentActions = await signActions([addRelationshipAction(parentIdentifier, documentId, "child")], this.signer, signal);
+			const parentActions = await signActions([addRelationshipAction(parentIdentifier, documentId, "child")], this.signer, {
+				documentId: parentIdentifier,
+				branch: "main"
+			}, signal);
 			jobs.push({
 				key: "parent",
 				documentId: parentIdentifier,
@@ -1475,7 +1495,7 @@ var ReactorClient = class {
 			}, void 0);
 			if (!module) throw new Error(`Document model not found for type: ${documentModelType}`);
 		}
-		const document = module.utils.createDocument();
+		const document = withSignaturePolicy(module.utils.createDocument(), requestedSignaturePolicy(options, this.createSignaturePolicy), { protocolVersions: options?.protocolVersions });
 		document.state.document.version = normalizeDocumentModelVersion(module.version);
 		return this.create(document, options?.parentIdentifier, signal);
 	}
@@ -1510,7 +1530,10 @@ var ReactorClient = class {
 				fromVersion,
 				toVersion: targetVersion,
 				revision: { ...document.header.revision }
-			})], this.signer, signal);
+			})], this.signer, {
+				documentId,
+				branch
+			}, signal);
 			const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
 			const completedJob = await this.waitForJob(jobInfo, signal);
 			if (completedJob.status !== JobStatus.FAILED) {
@@ -1540,8 +1563,12 @@ var ReactorClient = class {
 	*/
 	async execute(documentIdentifier, branch, actions, signal, subject) {
 		this.logger.verbose("execute(@documentIdentifier, @branch, @count actions)", documentIdentifier, branch, actions.length);
-		const signedActions = await signActions(actions, this.signer, signal);
-		const jobInfo = await this.reactor.execute(documentIdentifier, branch, signedActions, signal);
+		const documentId = await this.resolveWriteTarget(documentIdentifier, branch, actions, signal);
+		const signedActions = await signActions(actions, this.signer, {
+			documentId,
+			branch
+		}, signal);
+		const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
 		const view = {
@@ -1556,15 +1583,38 @@ var ReactorClient = class {
 	*/
 	async executeAsync(documentIdentifier, branch, actions, signal) {
 		this.logger.verbose("executeAsync(@documentIdentifier, @branch, @count actions)", documentIdentifier, branch, actions.length);
-		const signedActions = await signActions(actions, this.signer, signal);
-		return this.reactor.execute(documentIdentifier, branch, signedActions, signal);
+		const documentId = await this.resolveWriteTarget(documentIdentifier, branch, actions, signal);
+		const signedActions = await signActions(actions, this.signer, {
+			documentId,
+			branch
+		}, signal);
+		return this.reactor.execute(documentId, branch, signedActions, signal);
+	}
+	/**
+	* The id a write on `identifier` is stored under, which its signatures bind.
+	* A create names its own id, and an id no slug maps to is taken as given, so
+	* a document still in flight resolves to itself.
+	*/
+	async resolveWriteTarget(identifier, branch, actions, signal) {
+		if (actions.some((action) => action.type === "CREATE_DOCUMENT")) return identifier;
+		const view = { branch };
+		const bySlug = await this.documentView.resolveSlug(identifier, view, void 0, signal);
+		if (bySlug === void 0 || bySlug === identifier) return identifier;
+		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
 	}
 	async executeBatch(request, signal) {
 		this.logger.verbose("executeBatch(@count jobs)", request.jobs.length);
-		const signedJobs = await Promise.all(request.jobs.map(async (job) => ({
-			...job,
-			actions: await signActions(job.actions, this.signer, signal)
-		})));
+		const signedJobs = await Promise.all(request.jobs.map(async (job) => {
+			const documentId = await this.resolveWriteTarget(job.documentId, job.branch, job.actions, signal);
+			return {
+				...job,
+				documentId,
+				actions: await signActions(job.actions, this.signer, {
+					documentId,
+					branch: job.branch
+				}, signal)
+			};
+		}));
 		const batchResult = await this.reactor.executeBatch({ jobs: signedJobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
 		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
@@ -1870,7 +1920,7 @@ var JobResultHandler = class {
 			callbacks.deferJob(result.error.documentId, handle.job);
 			return;
 		}
-		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || InvalidSignatureError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -2258,6 +2308,7 @@ var WorkerPoolJobExecutorManager = class {
 			await this.tryDispatchFor(worker);
 			return;
 		}
+		for (const refusal of outcome.signatureRefusals ?? []) this.eventBus.emit(ReactorEventTypes.SIGNATURE_REFUSED, refusal).catch(() => {});
 		if (outcome.result.success) {
 			this.totalJobsProcessed++;
 			const completedEvent = {
@@ -7807,7 +7858,7 @@ var Reactor = class {
 		this.logger.verbose("create(@id, @type, @slug)", document.header.id, document.header.documentType, document.header.slug);
 		const createdAtUtcIso = (/* @__PURE__ */ new Date()).toISOString();
 		throwIfAborted(signal, () => new AbortError());
-		let actions = [createDocumentAction({
+		const createAction = createDocumentAction({
 			model: document.header.documentType,
 			version: 0,
 			documentId: document.header.id,
@@ -7823,14 +7874,20 @@ var Reactor = class {
 			branch: document.header.branch,
 			meta: document.header.meta,
 			protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
-		}), upgradeDocumentAction({
+		});
+		const upgradeAction = upgradeDocumentAction({
 			documentId: document.header.id,
 			model: document.header.documentType,
 			fromVersion: 0,
 			toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 			initialState: document.state
-		})];
-		if (signer) actions = await signActions(actions, signer, signal);
+		});
+		const branch = document.header.branch || "main";
+		let actions = [createAction, upgradeAction];
+		if (signer) actions = await signActions(actions, signer, {
+			documentId: document.header.id,
+			branch
+		}, signal);
 		const jobId = v4();
 		const jobMeta = buildSingleJobMeta(jobId, meta);
 		const job = {
@@ -7838,7 +7895,7 @@ var Reactor = class {
 			kind: "mutation",
 			documentId: document.header.id,
 			scope: "document",
-			branch: "main",
+			branch,
 			actions,
 			operations: [],
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -7869,7 +7926,10 @@ var Reactor = class {
 		const createdAtUtcIso = (/* @__PURE__ */ new Date()).toISOString();
 		throwIfAborted(signal, () => new AbortError());
 		let action = deleteDocumentAction(id);
-		if (signer) action = await signAction(action, signer, signal);
+		if (signer) action = await signAction(action, signer, {
+			documentId: id,
+			branch: "main"
+		}, signal);
 		const jobId = v4();
 		const jobMeta = buildSingleJobMeta(jobId, meta);
 		const job = {
@@ -8126,21 +8186,30 @@ var Reactor = class {
 		this.logger.verbose("addRelationship(@sourceId, @targetId, @relationshipType, @metadata, @branch)", sourceId, targetId, relationshipType, metadata, branch);
 		throwIfAborted(signal, () => new AbortError());
 		let actions = [addRelationshipAction(sourceId, targetId, relationshipType, metadata)];
-		if (signer) actions = await signActions(actions, signer, signal);
+		if (signer) actions = await signActions(actions, signer, {
+			documentId: sourceId,
+			branch
+		}, signal);
 		return await this.execute(sourceId, branch, actions, signal);
 	}
 	async updateRelationship(sourceId, targetId, relationshipType, metadata, branch = "main", signer, signal) {
 		this.logger.verbose("updateRelationship(@sourceId, @targetId, @relationshipType, @metadata, @branch)", sourceId, targetId, relationshipType, metadata, branch);
 		throwIfAborted(signal, () => new AbortError());
 		let actions = [updateRelationshipAction(sourceId, targetId, relationshipType, metadata)];
-		if (signer) actions = await signActions(actions, signer, signal);
+		if (signer) actions = await signActions(actions, signer, {
+			documentId: sourceId,
+			branch
+		}, signal);
 		return await this.execute(sourceId, branch, actions, signal);
 	}
 	async removeRelationship(sourceId, targetId, relationshipType, branch = "main", signer, signal) {
 		this.logger.verbose("removeRelationship(@sourceId, @targetId, @relationshipType, @branch)", sourceId, targetId, relationshipType, branch);
 		throwIfAborted(signal, () => new AbortError());
 		let actions = [removeRelationshipAction(sourceId, targetId, relationshipType)];
-		if (signer) actions = await signActions(actions, signer, signal);
+		if (signer) actions = await signActions(actions, signer, {
+			documentId: sourceId,
+			branch
+		}, signal);
 		return await this.execute(sourceId, branch, actions, signal);
 	}
 	getJobStatus(jobId, signal) {
@@ -8244,8 +8313,11 @@ var ReactorBuilder = class {
 	eventBus;
 	readModelCoordinator;
 	readModelCoordinatorFactory;
-	signatureVerifier;
 	kyselyInstance;
+	signer;
+	workerSigner;
+	trustPolicy;
+	workerTrustPolicy;
 	signalHandlersEnabled = false;
 	queueInstance;
 	channelScheme;
@@ -8344,10 +8416,34 @@ var ReactorBuilder = class {
 		this.eventBus = eventBus;
 		return this;
 	}
-	withSignatureVerifier(verifier) {
-		this.signatureVerifier = verifier;
+	/**
+	* Signs the operations the executor synthesizes: the NOOP an UNDO becomes and
+	* the action a REDO rebuilds. Without one they are stored unsigned. Pooled
+	* workers import `workerSigner` to build the same signer.
+	*/
+	withSigner(signer, workerSigner) {
+		this.signer = signer;
+		this.workerSigner = workerSigner;
+		return this;
+	}
+	/** Whether {@link withSigner} was called. */
+	hasSigner() {
+		return this.signer !== void 0;
+	}
+	/**
+	* Decides at admission whether a key may sign as the user it claims; see
+	* {@link SignatureTrustPolicy} for the contract and the default. Pooled
+	* workers import `workerTrustPolicy` to build the same policy.
+	*/
+	withTrustPolicy(trustPolicy, workerTrustPolicy) {
+		this.trustPolicy = trustPolicy;
+		this.workerTrustPolicy = workerTrustPolicy;
 		return this;
 	}
+	/** Whether {@link withTrustPolicy} was called. */
+	hasTrustPolicy() {
+		return this.trustPolicy !== void 0;
+	}
 	withKysely(kysely) {
 		this.kyselyInstance = kysely;
 		return this;
@@ -8401,8 +8497,7 @@ var ReactorBuilder = class {
 	* this enables the pool — there is no `enabled` flag. Provide `db`
 	* (each worker opens its own Postgres pool; the parent database is built
 	* from it too unless {@link withKysely} is set) or a custom `factory`
-	* transport. `verifier` is imported by the default transport's workers;
-	* omitted = no executor-side signature verification.
+	* transport.
 	*/
 	withWorkerPool(options) {
 		this.workerPool = options;
@@ -8495,13 +8590,15 @@ var ReactorBuilder = class {
 			let factory = pool.factory;
 			if (!factory) {
 				if (pool.db === void 0) throw new Error("unreachable: worker pool configured without db or factory");
-				factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db, pool.verifier);
+				if (this.signer && !this.workerSigner) this.logger.warn("Worker pool has no signer spec; pooled workers store synthesized operations unsigned");
+				if (this.trustPolicy && !this.workerTrustPolicy) this.logger.warn("Worker pool has no trust policy spec; pooled workers apply the default trust policy");
+				factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db);
 			}
 			const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, operationIndex, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
 			executorManager = poolManager;
 			executorStartCount = pool.numWorkers;
 			if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
-		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, this.signatureVerifier, executionScope), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
+		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, executionScope, this.signer, this.trustPolicy), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
 		await executorManager.start(executorStartCount);
 		const callerReadModels = Array.from(new Set([...this.readModels]));
 		const degradedComponents = [];
@@ -8674,7 +8771,7 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-CUo4bF4O.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-mQhfVipO.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
@@ -8716,11 +8813,11 @@ var ReactorBuilder = class {
 	* custom `factory`. Each worker spawns a real `node:worker_threads`
 	* Worker pointing at the compiled `worker/entry.js`.
 	*/
-	async createDefaultWorkerFactory(numWorkers, db, signatureVerifier) {
+	async createDefaultWorkerFactory(numWorkers, db) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-CrERzl8s.js"),
+			import("./worker-handle-B3p-nuqG.js"),
 			import("./transport-ByGviWdZ.js"),
-			import("./worker-g03lNM42.js").then((n) => n.n)
+			import("./worker-BDVzCtuf.js").then((n) => n.n)
 		]);
 		const poolConfig = {
 			enabled: true,
@@ -8740,9 +8837,10 @@ var ReactorBuilder = class {
 				initPayload: {
 					poolConfig,
 					db,
-					signatureVerifier,
 					models,
-					executorConfig: this.executorConfig
+					executorConfig: this.executorConfig,
+					signer: this.workerSigner,
+					trustPolicy: this.workerTrustPolicy
 				},
 				logger,
 				poolInstrumentation
@@ -8985,30 +9083,6 @@ function createHybridProjectionCoordinatorFactory(options = {}) {
 	};
 }
 //#endregion
-//#region src/signer/passthrough-signer.ts
-/**
-* A no-op signer that returns empty values for all methods.
-* Used when signing is not required.
-*/
-var PassthroughSigner = class {
-	publicKey = {};
-	sign() {
-		return Promise.resolve(new Uint8Array(0));
-	}
-	verify() {
-		return Promise.resolve();
-	}
-	signAction() {
-		return Promise.resolve([
-			"",
-			"",
-			"",
-			"",
-			""
-		]);
-	}
-};
-//#endregion
 //#region src/core/reactor-client-builder.ts
 /**
 * Builder class for constructing ReactorClient instances with proper configuration
@@ -9021,7 +9095,10 @@ var ReactorClientBuilder = class {
 	documentIndexer;
 	documentView;
 	signer;
-	signatureVerifier;
+	workerSigner;
+	trustPolicy;
+	workerTrustPolicy;
+	createSignaturePolicy = DEFAULT_SIGNATURE_POLICY;
 	subscriptionManager;
 	jobAwaiter;
 	documentModelLoader;
@@ -9055,17 +9132,28 @@ var ReactorClientBuilder = class {
 		return this;
 	}
 	/**
-	* Sets the signer configuration for signing and verifying actions.
-	*
-	* @param config - Either an ISigner for signing only, or a SignerConfig for both signing and verification
+	* Signs submitted actions, and the operations a reactor built from
+	* `withReactorBuilder` synthesizes unless that builder has its own signer.
+	* A `trustPolicy` reaches that builder unless it has its own.
 	*/
 	withSigner(config) {
 		if ("signer" in config) {
 			this.signer = config.signer;
-			this.signatureVerifier = config.verifier;
+			this.workerSigner = config.workerSigner;
+			this.trustPolicy = config.trustPolicy;
+			this.workerTrustPolicy = config.workerTrustPolicy;
 		} else this.signer = config;
 		return this;
 	}
+	/**
+	* What the client creates new documents as when a call does not say:
+	* `v2-required` (the default) or `legacy`, for a fleet with peers that
+	* predate v2-required documents. Existing documents keep their policy.
+	*/
+	withCreateSignaturePolicy(policy) {
+		this.createSignaturePolicy = policy;
+		return this;
+	}
 	withSubscriptionManager(subscriptionManager) {
 		this.subscriptionManager = subscriptionManager;
 		return this;
@@ -9130,8 +9218,9 @@ var ReactorClientBuilder = class {
 		let documentView;
 		let reactorModule;
 		if (this.reactorBuilder) {
-			if (this.signatureVerifier) this.reactorBuilder.withSignatureVerifier(this.signatureVerifier);
 			if (this.documentModelLoader) this.reactorBuilder.withDocumentModelLoader(this.documentModelLoader);
+			if (this.signer && !this.reactorBuilder.hasSigner()) this.reactorBuilder.withSigner(this.signer, this.workerSigner);
+			if (this.trustPolicy && !this.reactorBuilder.hasTrustPolicy()) this.reactorBuilder.withTrustPolicy(this.trustPolicy, this.workerTrustPolicy);
 			reactorModule = await this.reactorBuilder.buildModule();
 			reactor = reactorModule.reactor;
 			eventBus = reactorModule.eventBus;
@@ -9149,7 +9238,7 @@ var ReactorClientBuilder = class {
 		const jobAwaiter = this.jobAwaiter ?? new JobAwaiter(eventBus, (jobId, signal) => reactor.getJobStatus(jobId, signal));
 		const decisionModel = reactorModule ? readDecisionModel(reactorModule.featureFlags, reactorModule.documentModelRegistry) : void 0;
 		return {
-			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, this.readGate ?? this.resolveReadGate(reactorModule, documentView, decisionModel), this.resolveActionEvaluation(reactorModule, decisionModel)),
+			client: new ReactorClient(this.logger, reactor, signer, subscriptionManager, jobAwaiter, documentIndexer, documentView, this.readGate ?? this.resolveReadGate(reactorModule, documentView, decisionModel), this.resolveActionEvaluation(reactorModule, decisionModel), this.createSignaturePolicy),
 			reactor,
 			eventBus,
 			documentIndexer,
@@ -9187,6 +9276,21 @@ function driveIdFromUrl(url) {
 	return url.split("/").pop() ?? "";
 }
 //#endregion
+//#region src/signer/types.ts
+const SIGNATURE_REFUSAL_CODES = [
+	"UNSIGNED_REQUIRED",
+	"UNSIGNED_IDENTITY",
+	"KEY_MISMATCH",
+	"MALFORMED_TUPLE",
+	"TIMESTAMP_MISMATCH",
+	"HASH_MISMATCH",
+	"BAD_SIGNATURE",
+	"SCHEME_BELOW_POLICY",
+	"ID_MISMATCH",
+	"DUPLICATE_ACTION",
+	"SIGNER_UNAUTHORIZED"
+];
+//#endregion
 //#region src/decision/sync-scope-gate.ts
 /** What a subject may read of a document that is not there to be read. */
 const META_ONLY = (scope) => ALWAYS_READABLE_SCOPES.has(scope);
@@ -9414,6 +9518,6 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, RetryAccounting, RevisionMismatchError, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
 
 //# sourceMappingURL=index.js.map