@powerhousedao/reactor 6.2.3-dev.23 → 6.2.3-dev.25

package/dist/{drive-container-types-CS5IxDiA.js → forwarding-logger-CSsCJ38f.js}

@@ -1,5 +1,4 @@
-import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DowngradeNotSupportedError as DowngradeNotSupportedError$1, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createPresignedHeader, decide, defaultBaseState, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, isDenied, isUndoRedo, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, sortOperations } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isUndoRedo, isV2ActionHash, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -52,6 +51,37 @@ function parsePagingOptions(paging, defaultLimit) {
 	};
 }
 //#endregion
+//#region src/events/types.ts
+/**
+* Custom error class that aggregates multiple errors from event subscribers.
+*/
+var EventBusAggregateError = class extends Error {
+	errors;
+	constructor(errors) {
+		const message = `EventBus emit failed with ${errors.length} error(s): ${errors.map((e) => {
+			if (e && typeof e === "object" && "message" in e) return e.message;
+			return String(e);
+		}).join("; ")}`;
+		super(message);
+		this.name = "EventBusAggregateError";
+		this.errors = errors;
+	}
+};
+/**
+* Event types for reactor lifecycle events.
+*/
+const ReactorEventTypes = {
+	JOB_PENDING: 10001,
+	JOB_RUNNING: 10002,
+	JOB_WRITE_READY: 10003,
+	JOB_READ_READY: 10004,
+	JOB_FAILED: 10005,
+	READMODEL_BATCH_COMPLETED: 10006,
+	READMODEL_INDEXED: 10007,
+	MODEL_LOADED: 10008,
+	SIGNATURE_REFUSED: 10009
+};
+//#endregion
 //#region src/shared/errors.ts
 /**
 * Error thrown when attempting to access a deleted document.
@@ -167,19 +197,22 @@ var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
 		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
 	}
 };
-/**
-* Error thrown when an operation has an invalid signature.
-*/
+/** The message carries the code: only name and message cross the queue. */
 var InvalidSignatureError = class InvalidSignatureError extends Error {
 	documentId;
+	code;
 	reason;
-	constructor(documentId, reason) {
-		super(`Invalid signature in document ${documentId}: ${reason}`);
+	constructor(documentId, code, reason) {
+		super(`Invalid signature in document ${documentId} [${code}]: ${reason}`);
 		this.name = "InvalidSignatureError";
 		this.documentId = documentId;
+		this.code = code;
 		this.reason = reason;
 		Error.captureStackTrace(this, InvalidSignatureError);
 	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidSignatureError";
+	}
 };
 /**
 * An UPGRADE_DOCUMENT action's preconditions (fromVersion and the per-scope
@@ -326,6 +359,7 @@ const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
 * conflict, not a fault: the caller retries against the new stream heads.
 */
 var AppendConditionFailedError = class extends Error {
+	condition;
 	constructor(condition) {
 		const streams = condition.streams.map((s) => `${s.documentId}:${s.scope}:${s.branch}@${s.revision}`).join(", ");
 		super(`${APPEND_CONDITION_FAILED_PREFIX}a read-set stream advanced [${streams}]`);
@@ -714,34 +748,13 @@ function selectDecisionModel(flags, registry) {
 //#endregion
 //#region src/executor/util.ts
 /** Actions the reactor reduces itself, onto the document scope. */
-const DOCUMENT_SCOPE_ACTIONS = new Set([
-	"CREATE_DOCUMENT",
-	"DELETE_DOCUMENT",
-	"UPGRADE_DOCUMENT",
-	"ADD_RELATIONSHIP",
-	"REMOVE_RELATIONSHIP",
-	"UPDATE_RELATIONSHIP"
-]);
+const DOCUMENT_SCOPE_ACTIONS = DOCUMENT_SCOPE_ACTION_TYPES;
 /**
 * `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
 * so building a decision model would throw and defer the job forever.
 */
 const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
 /**
-* The document a document-scope action writes to, which is not always the job's
-* own document: delete and upgrade name it in `input.documentId`, and the
-* relationship actions in `input.sourceId`. `execute` only checks that a batch
-* shares one scope, so a caller can submit an action whose target is a document
-* other than the one the job is keyed by. The policy gate has to follow the
-* action rather than the job, or it decides against a policy the caller may
-* control instead of the one guarding the write.
-*/
-function targetDocumentId(action, fallback) {
-	const input = action.input;
-	if (action.type === "ADD_RELATIONSHIP" || action.type === "REMOVE_RELATIONSHIP" || action.type === "UPDATE_RELATIONSHIP") return typeof input?.sourceId === "string" && input.sourceId.length > 0 ? input.sourceId : fallback;
-	return typeof input?.documentId === "string" && input.documentId.length > 0 ? input.documentId : fallback;
-}
-/**
 * Creates a PHDocument from a CREATE_DOCUMENT action input.
 * Reconstructs the document header and initializes the base state.
 *
@@ -1051,6 +1064,7 @@ const JobExecutorEventTypes = {
 //#endregion
 //#region src/cache/collection-membership-cache.ts
 var CollectionMembershipCache = class CollectionMembershipCache {
+	operationIndex;
 	cache = /* @__PURE__ */ new Map();
 	constructor(operationIndex) {
 		this.operationIndex = operationIndex;
@@ -1264,6 +1278,7 @@ var DocumentMetaCache = class DocumentMetaCache {
 		return {
 			state: document.state.document,
 			documentType,
+			protocolVersions: createAction.input.protocolVersions,
 			documentScopeRevision: documentScopeRevision + 1
 		};
 	}
@@ -1345,6 +1360,7 @@ var KyselyOperationIndexTxn = class {
 	}
 };
 var KyselyOperationIndex = class KyselyOperationIndex {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -1459,6 +1475,12 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
 	}
+	async getOrdinalsByOpIds(documentId, scope, branch, opIds, signal) {
+		signal?.throwIfAborted();
+		if (opIds.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.queryExecutor.selectFrom("operation_index_operations").select("opId").select((eb) => eb.fn.max("ordinal").as("ordinal")).where("documentId", "=", documentId).where("branch", "=", branch).where("scope", "=", scope).where("opId", "in", opIds).groupBy("opId").execute();
+		return new Map(rows.map((row) => [row.opId, Number(row.ordinal)]));
+	}
 	async find(collectionId, cursor, view, paging, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const outerCursor = cursor ?? -1;
@@ -1678,21 +1700,6 @@ var RingBuffer = class {
 	}
 };
 //#endregion
-//#region src/cache/write-cache-types.ts
-/**
-* Where a snapshot sits in its stream.
-*
-* - `Head`: the newest revision of the stream when it was stored. Only these
-*   can answer a read that asks for the head.
-* - `Historical`: state at an earlier revision. Usable as a starting point to
-*   replay forward from, and as an answer to a read for that same revision.
-*/
-let SnapshotPosition = /* @__PURE__ */ function(SnapshotPosition) {
-	SnapshotPosition["Head"] = "head";
-	SnapshotPosition["Historical"] = "historical";
-	return SnapshotPosition;
-}({});
-//#endregion
 //#region src/cache/kysely-write-cache.ts
 /**
 * The last operation index a keyframe's document reflects for the scope. A
@@ -1831,13 +1838,13 @@ var KyselyWriteCache = class KyselyWriteCache {
 			const snapshots = stream.ringBuffer.getAll();
 			if (targetRevision === void 0) {
 				const newest = highestRevision(snapshots);
-				if (newest?.position === SnapshotPosition.Head) {
+				if (newest?.position === "head") {
 					this.lruTracker.touch(streamKey);
 					return copyDocument(newest.document);
 				}
 				if (newest) {
 					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
-					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, SnapshotPosition.Head);
+					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, "head");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -1850,7 +1857,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
 				if (newestOlder) {
 					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
-					this.store(documentId, scope, branch, targetRevision, document, SnapshotPosition.Historical);
+					this.store(documentId, scope, branch, targetRevision, document, "historical");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -1858,7 +1865,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		}
 		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
-		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? SnapshotPosition.Head : SnapshotPosition.Historical);
+		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? "head" : "historical");
 		return document;
 	}
 	/**
@@ -1893,7 +1900,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		if (run.length === 0) return;
 		for (const entry of run.slice(0, -1)) this.persistKeyframe(documentId, scope, branch, entry.revision, entry.document);
 		const head = run[run.length - 1];
-		this.store(documentId, scope, branch, head.revision, head.document, SnapshotPosition.Head);
+		this.store(documentId, scope, branch, head.revision, head.document, "head");
 	}
 	store(documentId, scope, branch, revision, document, position) {
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
@@ -2099,10 +2106,10 @@ var KyselyWriteCache = class KyselyWriteCache {
 					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				} else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = docModule.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(docModule.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion
-					});
+					}), document.header.protocolVersions);
 				}
 			}
 		}
@@ -2151,12 +2158,12 @@ var KyselyWriteCache = class KyselyWriteCache {
 					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 					else {
 						const protocolVersion = baseReducerVersion(document.header);
-						document = getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+						document = withProtocolVersions(getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
 							skip: operation.skip,
 							protocolVersion,
 							replayOptions: { operation },
 							skipIndexValidation: true
-						});
+						}), document.header.protocolVersions);
 					}
 				}
 				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
@@ -2280,12 +2287,12 @@ var KyselyWriteCache = class KyselyWriteCache {
 				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
 				else {
 					const protocolVersion = baseReducerVersion(document.header);
-					document = module.reducer(document, operation.action, void 0, {
+					document = withProtocolVersions(module.reducer(document, operation.action, void 0, {
 						skip: operation.skip,
 						protocolVersion,
 						replayOptions: { operation },
 						skipIndexValidation: true
-					});
+					}), document.header.protocolVersions);
 				}
 				if (targetRevision !== void 0 && operation.index === targetRevision) break;
 			}
@@ -2412,6 +2419,11 @@ function validateFeatureFlags(flags, prerequisites) {
 //#endregion
 //#region src/executor/execution-scope.ts
 var DefaultExecutionScope = class {
+	operationStore;
+	operationIndex;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
 	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
 		this.operationStore = operationStore;
 		this.operationIndex = operationIndex;
@@ -2431,6 +2443,13 @@ var DefaultExecutionScope = class {
 	}
 };
 var KyselyExecutionScope = class {
+	db;
+	operationStore;
+	operationIndex;
+	keyframeStore;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
 	constructor(db, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache) {
 		this.db = db;
 		this.operationStore = operationStore;
@@ -2458,7 +2477,7 @@ var KyselyExecutionScope = class {
 };
 //#endregion
 //#region src/utils/reshuffle.ts
-const STRICT_ORDER_ACTION_TYPES = new Set([
+const STRICT_ORDER_ACTION_TYPES = /* @__PURE__ */ new Set([
 	"CREATE_DOCUMENT",
 	"DELETE_DOCUMENT",
 	"UPGRADE_DOCUMENT",
@@ -2789,6 +2808,8 @@ const DRIVE_COLLECTION_PREFIX = "drive.";
 * rows and persisted remotes remain valid without migration.
 */
 var DriveCollectionId = class DriveCollectionId {
+	driveId;
+	branch;
 	constructor(driveId, branch) {
 		this.driveId = driveId;
 		this.branch = branch;
@@ -2821,6 +2842,11 @@ var DriveCollectionId = class DriveCollectionId {
 //#endregion
 //#region src/executor/document-action-handler.ts
 var DocumentActionHandler = class {
+	registry;
+	logger;
+	driveContainerTypes;
+	featureFlags;
+	decisionModel;
 	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel) {
 		this.registry = registry;
 		this.logger = logger;
@@ -2913,7 +2939,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...standing.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(job.documentId, job.scope, job.branch);
-		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, SnapshotPosition.Head);
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: job.documentId,
@@ -2925,6 +2951,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
 			state: standing.state.document,
 			documentType: standing.header.documentType,
+			protocolVersions: standing.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
@@ -2948,8 +2975,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		const resultingState = JSON.stringify(resultingStateObj);
 		const writeResult = await this.writeOperationToStore({
@@ -2966,7 +2993,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(document.header.id, job.scope, job.branch);
-		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: document.header.id,
@@ -2983,6 +3010,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(document.header.id, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: 1
 		});
 		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
@@ -3026,7 +3054,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(documentId, job.scope, job.branch);
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
 		indexTxn.write([{
 			...operation,
 			documentId,
@@ -3038,6 +3066,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3076,7 +3105,7 @@ var DocumentActionHandler = class {
 				} catch (error) {
 					return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch revisions for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
 				}
-				const revisionScopes = new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
+				const revisionScopes = /* @__PURE__ */ new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
 				for (const revisionScope of revisionScopes) {
 					const snapshot = input.revision[revisionScope] ?? 0;
 					const actual = actualRevisions[revisionScope] ?? 0;
@@ -3118,8 +3147,8 @@ var DocumentActionHandler = class {
 			branch: job.branch
 		});
 		const resultingStateObj = {
-			header: document.header,
-			...document.state
+			...document.state,
+			header: document.header
 		};
 		if (fromVersion > 0) resultingStateObj.__migrated = true;
 		const resultingState = JSON.stringify(resultingStateObj);
@@ -3137,7 +3166,7 @@ var DocumentActionHandler = class {
 			[job.scope]: [...document.operations[job.scope] ?? [], operation]
 		};
 		executing.touchedStreams.add(documentId, job.scope, job.branch);
-		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, SnapshotPosition.Head);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
 		for (const scope of otherScopes) executing.postCommitInvalidations.push({
 			documentId,
 			scope,
@@ -3154,6 +3183,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
 			state: document.state.document,
 			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
@@ -3223,7 +3253,7 @@ var DocumentActionHandler = class {
 		const resultingState = JSON.stringify(resultingStateObj);
 		executing.touchedStreams.add(input.sourceId, job.scope, job.branch);
 		executing.touchedStreams.add(input.targetId, job.scope, job.branch);
-		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, SnapshotPosition.Head);
+		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, "head");
 		indexTxn.write([{
 			...operation,
 			documentId: input.sourceId,
@@ -3242,6 +3272,7 @@ var DocumentActionHandler = class {
 		stores.documentMetaCache.putDocumentMeta(input.sourceId, job.branch, {
 			state: sourceDoc.state.document,
 			documentType: sourceDoc.header.documentType,
+			protocolVersions: sourceDoc.header.protocolVersions,
 			documentScopeRevision: operation.index + 1
 		});
 		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
@@ -3270,55 +3301,632 @@ var DocumentActionHandler = class {
 	}
 };
 //#endregion
-//#region src/executor/signature-verifier.ts
-var SignatureVerifier = class {
-	constructor(verifier) {
-		this.verifier = verifier;
-	}
-	async verifyActions(documentId, branch, actions) {
-		if (!this.verifier) return;
-		for (const action of actions) {
-			const signer = action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Action ${action.id} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				const tempOperation = {
-					id: deriveOperationId(documentId, action.scope, branch, action.id),
-					index: 0,
-					timestampUtcMs: action.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString(),
-					hash: "",
-					skip: 0,
-					action
-				};
-				isValid = await this.verifier(tempOperation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Action ${action.id} verification failed: ${errorMessage}`);
+//#region src/signer/passthrough-signer.ts
+/**
+* A no-op signer that returns empty values for all methods.
+* Used when signing is not required.
+*/
+var PassthroughSigner = class {
+	publicKey = {};
+	sign() {
+		return Promise.resolve(/* @__PURE__ */ new Uint8Array(0));
+	}
+	verify() {
+		return Promise.resolve();
+	}
+	signAction() {
+		return Promise.resolve([
+			"",
+			"",
+			"",
+			"",
+			""
+		]);
+	}
+};
+//#endregion
+//#region src/signer/trust-policy.ts
+/**
+* The policy admission asks: the reactor's own key signing as its own user is
+* accepted, then the host's policy decides, else the default does. `own` is
+* read on every ask, since its user changes on login.
+*/
+function admissionTrustPolicy(own, authEnforcement, policy) {
+	return { authorizeSigner(signer, key, documentId) {
+		const identity = actionSignerIdentity(own);
+		if (identity.app.key !== "" && key === identity.app.key) {
+			if (sameUser(actionSignerIdentity(signer).user, identity.user)) return Promise.resolve(true);
+		}
+		if (policy) return policy.authorizeSigner(signer, key, documentId);
+		return Promise.resolve(!authEnforcement);
+	} };
+}
+function sameUser(a, b) {
+	return a.address.toLowerCase() === b.address.toLowerCase() && a.networkId === b.networkId && a.chainId === b.chainId;
+}
+//#endregion
+//#region src/signer/did-key.ts
+const DID_KEY_PREFIX = "did:key:z";
+const P256_MULTICODEC = [128, 36];
+const MAX_CACHED_KEYS = 1024;
+const P = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
+const A = BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc");
+const B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+/** A did:key that is not a compressed P-256 public key. */
+var MalformedDidKeyError = class extends Error {
+	constructor(did, detail) {
+		super(`Malformed did:key ${did}: ${detail}`);
+		this.name = "MalformedDidKeyError";
+	}
+};
+const keyCache = /* @__PURE__ */ new Map();
+/** Cached per process: decompressing the point costs a BigInt modPow. */
+async function importDidKey(did) {
+	const cached = keyCache.get(did);
+	if (cached) {
+		keyCache.delete(did);
+		keyCache.set(did, cached);
+		return cached;
+	}
+	const raw = decompressP256(compressedPointFromDid(did), did);
+	const key = await crypto.subtle.importKey("raw", raw.buffer, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	keyCache.set(did, key);
+	if (keyCache.size > MAX_CACHED_KEYS) {
+		const oldest = keyCache.keys().next().value;
+		if (oldest !== void 0) keyCache.delete(oldest);
+	}
+	return key;
+}
+function compressedPointFromDid(did) {
+	if (!did.startsWith(DID_KEY_PREFIX)) throw new MalformedDidKeyError(did, "not a base58btc did:key");
+	const decoded = base58Decode(did.slice(9));
+	if (!decoded || decoded.length !== 35) throw new MalformedDidKeyError(did, "not a compressed P-256 key");
+	if (decoded[0] !== P256_MULTICODEC[0] || decoded[1] !== P256_MULTICODEC[1]) throw new MalformedDidKeyError(did, "not a P-256 multicodec");
+	return decoded.subarray(2);
+}
+function decompressP256(compressed, did) {
+	const prefix = compressed[0];
+	if (prefix !== 2 && prefix !== 3) throw new MalformedDidKeyError(did, `compression prefix ${prefix}`);
+	let x = BigInt(0);
+	for (let i = 1; i < compressed.length; i++) x = x << BigInt(8) | BigInt(compressed[i]);
+	if (x >= P) throw new MalformedDidKeyError(did, "x outside the field");
+	const ySquared = (modPow(x, BigInt(3), P) + A * x + B) % P;
+	let y = modPow(ySquared, (P + BigInt(1)) / BigInt(4), P);
+	if (y * y % P !== ySquared) throw new MalformedDidKeyError(did, "x is not on the curve");
+	if (y % BigInt(2) === BigInt(0) !== (prefix === 2)) y = P - y;
+	const uncompressed = /* @__PURE__ */ new Uint8Array(65);
+	uncompressed[0] = 4;
+	uncompressed.set(bigIntToBytes(x), 1);
+	uncompressed.set(bigIntToBytes(y), 33);
+	return uncompressed;
+}
+function modPow(base, exp, mod) {
+	let result = BigInt(1);
+	let b = base % mod;
+	let e = exp;
+	while (e > BigInt(0)) {
+		if (e & BigInt(1)) result = result * b % mod;
+		e >>= BigInt(1);
+		b = b * b % mod;
+	}
+	return result;
+}
+function bigIntToBytes(value) {
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	let v = value;
+	for (let i = 31; i >= 0; i--) {
+		bytes[i] = Number(v & BigInt(255));
+		v >>= BigInt(8);
+	}
+	return bytes;
+}
+//#endregion
+//#region src/signer/verify-action-signature.ts
+const RENOWN_HASH_LENGTH = 44;
+const SHARED_HASH_LENGTH = 28;
+const HEX_SIGNATURE = /^(0x)?([0-9a-fA-F]{2})+$/;
+/**
+* Integrity only: identity binding and the live-id check sit with the caller.
+* `operation` is the incoming operation at load admission.
+*/
+async function verifyActionSignature(action, target, path, operation) {
+	const policy = target.policy ?? "legacy";
+	const refusal = policyRefusal(action, policy);
+	if (refusal) return refusal;
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return policy === "v2-required" ? refuse("unsigned", "UNSIGNED_REQUIRED", `action ${action.id} is unsigned but ${target.documentId} requires v2 signatures`) : {
+		ok: true,
+		scheme: "unsigned"
+	};
+	if (shape.kind === "malformed") return refuse("legacy-unknown", "MALFORMED_TUPLE", `action ${action.id} ${shape.reason}`);
+	const { signer, tuple } = shape;
+	const scheme = schemeOf(tuple[2]);
+	if (tuple[1] !== signer.app.key) return refuse(scheme, "KEY_MISMATCH", `action ${action.id} tuple key does not match signer.app.key`);
+	if (scheme !== "v2" && policy === "v2-required") return refuse(scheme, "SCHEME_BELOW_POLICY", `action ${action.id} carries a legacy tuple but ${target.documentId} requires v2 signatures`);
+	if (scheme === "legacy-unknown" && path === "mutation") return refuse(scheme, "MALFORMED_TUPLE", `action ${action.id} carries a hash of unknown length ${tuple[2].length}`);
+	if (scheme === "v2") {
+		const refusal = await checkV2(action, tuple, target, operation);
+		if (refusal) return refusal;
+	} else if (path === "mutation") {
+		if (await legacyHash(scheme, action, target) !== tuple[2]) return refuse(scheme, "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+	}
+	return verifyEcdsa(tuple, scheme, action.id);
+}
+/** Refusals a document's policy makes before any tuple is read. */
+function policyRefusal(action, policy) {
+	if (action.type !== "CREATE_DOCUMENT") return;
+	const scheme = schemeOfAction(action);
+	const input = action.input;
+	const documentId = input?.documentId ?? "";
+	if (policy === "legacy") return isDerivedDocumentId(documentId) ? refuse(scheme, "ID_MISMATCH", `action ${action.id}: a legacy document cannot take the content-addressed id ${documentId}`) : void 0;
+	const expected = derivedCreateId(input);
+	if (expected === documentId) return;
+	return refuse(scheme, "ID_MISMATCH", expected === void 0 ? `action ${action.id} creates v2-required ${documentId} without the header params its id is derived from` : `action ${action.id} creates v2-required ${documentId}, but its header params derive ${expected}`);
+}
+function derivedCreateId(input) {
+	if (!input?.signing || !input.protocolVersions) return;
+	try {
+		return deriveDocumentId({
+			documentType: input.model,
+			createdAtUtcIso: input.signing.createdAtUtcIso,
+			nonce: input.signing.nonce,
+			protocolVersions: input.protocolVersions
+		});
+	} catch {
+		return;
+	}
+}
+function schemeOfAction(action) {
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return "unsigned";
+	return shape.kind === "signed" ? schemeOf(shape.tuple[2]) : "legacy-unknown";
+}
+/** Peers send arbitrary JSON, so nothing past `context` is assumed. */
+function signerShape(value) {
+	if (value === void 0 || value === null) return { kind: "unsigned" };
+	if (!isRecord(value)) return {
+		kind: "malformed",
+		reason: "has a signer that is not an object"
+	};
+	const { app, user, signatures } = value;
+	if (app !== void 0 && app !== null && !isRecord(app)) return {
+		kind: "malformed",
+		reason: "has a signer.app that is not an object"
+	};
+	const key = isRecord(app) ? app.key : void 0;
+	if (key !== void 0 && key !== null && typeof key !== "string") return {
+		kind: "malformed",
+		reason: "has a signer.app.key that is not a string"
+	};
+	if (!key) return { kind: "unsigned" };
+	if (!isRecord(user) || typeof user.address !== "string") return {
+		kind: "malformed",
+		reason: "has a signer without a user address"
+	};
+	if (!Array.isArray(signatures)) return {
+		kind: "malformed",
+		reason: "has a signer whose signatures are not a list"
+	};
+	const tuple = signatures.at(-1);
+	if (!isTuple(tuple)) return {
+		kind: "malformed",
+		reason: signatures.length === 0 ? "has a signer but no signatures" : "carries a malformed signature tuple"
+	};
+	return {
+		kind: "signed",
+		signer: value,
+		tuple
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function checkV2(action, tuple, target, operation) {
+	const problem = v2TupleProblem(tuple);
+	if (problem) return refuse("v2", "MALFORMED_TUPLE", `action ${action.id}: ${problem}`);
+	if (operation && !sameInstant(operation.timestampUtcMs, action.timestampUtcMs)) return refuse("v2", "TIMESTAMP_MISMATCH", `action ${action.id} is stamped ${action.timestampUtcMs} but its operation ${operation.timestampUtcMs}`);
+	let expected;
+	try {
+		expected = await hashActionV2(action, target, action.context.signer);
+	} catch (error) {
+		return refuse("v2", "HASH_MISMATCH", `action ${action.id} has no v2 hash: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (expected !== tuple[2]) return refuse("v2", "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+}
+function sameInstant(a, b) {
+	const left = Date.parse(a);
+	return !Number.isNaN(left) && left === Date.parse(b);
+}
+function schemeOf(hash) {
+	if (isV2ActionHash(hash)) return "v2";
+	if (hash.length === RENOWN_HASH_LENGTH) return "legacy-renown";
+	if (hash.length === SHARED_HASH_LENGTH) return "legacy-shared";
+	return "legacy-unknown";
+}
+async function legacyHash(scheme, action, target) {
+	if (scheme === "legacy-renown") {
+		const payload = [
+			action.scope,
+			action.type,
+			JSON.stringify(action.input)
+		].join("");
+		const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(payload));
+		return bytesToBase64(new Uint8Array(digest));
+	}
+	const signer = action.context.signer;
+	return buildOperationSignatureParams({
+		documentId: target.documentId,
+		signer,
+		action,
+		previousStateHash: ""
+	})[2];
+}
+async function verifyEcdsa(tuple, scheme, actionId) {
+	const [timestamp, key, hash, prevStateHash, signatureHex] = tuple;
+	if (!HEX_SIGNATURE.test(signatureHex)) return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId} signature is not hex`);
+	let cryptoKey;
+	try {
+		cryptoKey = await importDidKey(key);
+	} catch (error) {
+		return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const message = buildOperationSignatureMessage([
+		timestamp,
+		key,
+		hash,
+		prevStateHash
+	]);
+	let valid;
+	try {
+		valid = await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, cryptoKey, hexToBytes(signatureHex).buffer, message.buffer);
+	} catch {
+		valid = false;
+	}
+	if (!valid) return refuse(scheme, "BAD_SIGNATURE", `action ${actionId} signature does not verify under its key`);
+	return {
+		ok: true,
+		scheme
+	};
+}
+function isTuple(value) {
+	return Array.isArray(value) && value.length === 5 && value.every((element) => typeof element === "string");
+}
+function refuse(scheme, code, reason) {
+	return {
+		ok: false,
+		scheme,
+		code,
+		reason
+	};
+}
+function hexToBytes(hex) {
+	const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+	const bytes = new Uint8Array(clean.length / 2);
+	for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
+	return bytes;
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+}
+//#endregion
+//#region src/executor/synthesized-signing.ts
+/** Submitted types whose stored action the reducer writes in their place. */
+const SYNTHESIZING_TYPES = /* @__PURE__ */ new Set(["UNDO", "REDO"]);
+/**
+* The id of the action synthesized from `submittedId`. Derived, so the stored
+* operation answers for the submitted id at the live-id check.
+*/
+function synthesizedActionId(submittedId) {
+	return hashBrowser(`synthesized:${submittedId}`, "sha1", "hex").slice(0, 32);
+}
+/**
+* Whether `operation` stores an action the reducer made from `submitted`
+* rather than `submitted` itself or an operation already in `history`.
+*/
+function isSynthesized(submitted, operation, history) {
+	if (!SYNTHESIZING_TYPES.has(submitted.type)) return false;
+	const id = operation.action.id;
+	if (!id) return true;
+	if (id === submitted.id) return false;
+	return !history.some((existing) => existing.action.id === id);
+}
+/**
+* Signs the synthesized action of `operation` in place as `signer`, under the
+* id {@link synthesizedActionId} derives from the submitted one. A REDO's
+* rebuilt action has no timestamp, so it takes the submitted one; the
+* operation timestamp is set to the action's, which a peer requires of a v2
+* tuple.
+*/
+async function signSynthesized(operation, submitted, target, signer, signal) {
+	const synthesized = operation.action;
+	const id = synthesizedActionId(submitted.id);
+	const timestampUtcMs = operation.timestampUtcMs || synthesized.timestampUtcMs || submitted.timestampUtcMs;
+	const action = {
+		id,
+		timestampUtcMs,
+		type: synthesized.type,
+		input: synthesized.input,
+		scope: synthesized.scope
+	};
+	const signature = await signer.signAction(action, {
+		documentId: target.documentId,
+		branch: target.branch
+	}, signal);
+	operation.action = {
+		...action,
+		context: { signer: {
+			...actionSignerIdentity(signer),
+			signatures: [signature]
+		} }
+	};
+	operation.id = deriveOperationId(target.documentId, target.scope, target.branch, id);
+	operation.timestampUtcMs = timestampUtcMs;
+}
+//#endregion
+//#region src/executor/signature-admission.ts
+const DEFAULT_TRUST_TIMEOUT_MS = 1e4;
+/** Runs once per write, when this reactor first stores it; never on re-appends. */
+var SignatureAdmission = class {
+	mode;
+	logger;
+	eventBus;
+	policySource;
+	trustPolicy;
+	trustTimeoutMs;
+	constructor(mode, logger, eventBus, policySource = "meta", trust = {
+		authEnforcement: false,
+		timeoutMs: DEFAULT_TRUST_TIMEOUT_MS
+	}) {
+		this.mode = mode;
+		this.logger = logger;
+		this.eventBus = eventBus;
+		this.policySource = policySource;
+		this.trustPolicy = admissionTrustPolicy(trust.signer ?? new PassthroughSigner(), trust.authEnforcement, trust.policy);
+		this.trustTimeoutMs = trust.timeoutMs;
+	}
+	/** The first refusal of a mutation's submitted actions, when enforcing. */
+	async admitMutation(job, stores, signal) {
+		const { operationStore } = stores;
+		const candidates = job.actions.map((action) => candidate(action, mutationStream(action, job)));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const committed = await this.storedAsSubmitted(candidates, live, isRetry(job), operationStore, signal);
+		await resolvePolicies(candidates, job.actions, (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const submitted = /* @__PURE__ */ new Set();
+		for (const entry of candidates) {
+			if (committed.has(entry)) continue;
+			const verdict = await this.verdict(entry, live, submitted, "mutation", signal);
+			submitted.add(entry.opId);
+			if (verdict.ok) continue;
+			const refusal = this.record(job, entry, verdict, "mutation");
+			if (refusal) return {
+				kind: "refused",
+				error: refusal
+			};
+		}
+		return {
+			kind: "admitted",
+			committed: [...committed.values()]
+		};
+	}
+	/** The incoming operations a load drops, empty unless enforcing. */
+	async admitLoad(job, operations, stores, signal) {
+		const { operationStore } = stores;
+		const stream = {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		};
+		const candidates = operations.map((operation) => ({
+			...candidate(operation.action, stream),
+			operation
+		}));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		await resolvePolicies(candidates, job.operations.map((operation) => operation.action), (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const dropped = /* @__PURE__ */ new Set();
+		for (let i = 0; i < candidates.length; i++) {
+			const verdict = await this.verdict(candidates[i], live, void 0, "load", signal);
+			if (verdict.ok) continue;
+			if (this.record(job, candidates[i], verdict, "load")) dropped.add(operations[i]);
+		}
+		return dropped;
+	}
+	async verdict(entry, live, submitted, path, signal) {
+		const verdict = await verifyActionSignature(entry.action, {
+			documentId: entry.stream.documentId,
+			branch: entry.stream.branch,
+			policy: entry.policy
+		}, path, entry.operation);
+		if (!verdict.ok) return verdict;
+		if (isLive(entry, live) || submitted?.has(entry.opId)) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "DUPLICATE_ACTION",
+			reason: `action ${entry.action.id} is already in the stream`
+		};
+		if (verdict.scheme === "unsigned") {
+			const address = entry.action.context?.signer?.user?.address;
+			return address ? {
+				ok: false,
+				scheme: "unsigned",
+				code: "UNSIGNED_IDENTITY",
+				reason: `action ${entry.action.id} is unsigned but claims to act as ${address}`
+			} : verdict;
+		}
+		const signer = entry.action.context.signer;
+		if (!await this.authorize(signer, entry.stream.documentId, signal)) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "SIGNER_UNAUTHORIZED",
+			reason: `action ${entry.action.id}: key ${signer.app.key} may not sign as ${signer.user.address}`
+		};
+		return verdict;
+	}
+	/** Throws when the policy does, times out or the job is aborted. */
+	async authorize(signer, documentId, signal) {
+		signal?.throwIfAborted();
+		let timer;
+		let onAbort;
+		const stop = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`signature trust policy did not answer for ${signer.app.key} within ${this.trustTimeoutMs}ms`));
+			}, this.trustTimeoutMs);
+			if (signal) {
+				onAbort = () => reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason)));
+				signal.addEventListener("abort", onAbort, { once: true });
 			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Action ${action.id} signature verification returned false`);
+		});
+		try {
+			return await Promise.race([this.trustPolicy.authorizeSigner(signer, signer.app.key, documentId), stop]);
+		} finally {
+			clearTimeout(timer);
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
 		}
 	}
-	async verifyOperations(documentId, operations) {
-		if (!this.verifier) return;
-		for (let i = 0; i < operations.length; i++) {
-			const operation = operations[i];
-			const signer = operation.action.context?.signer;
-			if (!signer) continue;
-			if (signer.signatures.length === 0) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} has signer but no signatures`);
-			const publicKey = signer.app.key;
-			let isValid;
-			try {
-				isValid = await this.verifier(operation, publicKey);
-			} catch (error) {
-				const errorMessage = error instanceof Error ? error.message : String(error);
-				throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} verification failed: ${errorMessage}`);
+	/**
+	* The live candidates stored exactly as submitted. A synthesized operation
+	* holds another action, so it cannot be compared; only a retry, whose first
+	* attempt this job was, takes it as committed.
+	*/
+	async storedAsSubmitted(candidates, live, retry, operationStore, signal) {
+		const committed = /* @__PURE__ */ new Map();
+		const toCompare = [];
+		for (const entry of candidates) if (entry.synthesizedOpId && live.has(entry.synthesizedOpId)) {
+			if (retry) committed.set(entry, committedWrite(entry, entry.synthesizedOpId));
+		} else if (live.has(entry.opId)) toCompare.push(entry);
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			const byId = new Map(stored.map((operation) => [operation.id, operation]));
+			for (const entry of entries) {
+				const operation = byId.get(entry.opId);
+				if (operation && sameContent(operation.action, entry.action)) committed.set(entry, committedWrite(entry, entry.opId));
 			}
-			if (!isValid) throw new InvalidSignatureError(documentId, `Operation ${operation.id} at index ${operation.index} signature verification returned false`);
 		}
+		return committed;
+	}
+	async liveOperationIds(candidates, operationStore, signal) {
+		const live = /* @__PURE__ */ new Set();
+		for (const [stream, entries] of byStream(candidates)) {
+			const found = await operationStore.findOperationIds(stream.documentId, stream.scope, stream.branch, entries.flatMap((entry) => entry.synthesizedOpId ? [entry.opId, entry.synthesizedOpId] : [entry.opId]), signal);
+			for (const opId of found) live.add(opId);
+		}
+		return live;
+	}
+	/** Logs and counts a refusal; returns the error only when enforcing. */
+	record(job, entry, refusal, path) {
+		const enforced = this.mode === "enforce";
+		const event = {
+			jobId: job.id,
+			documentId: entry.stream.documentId,
+			scope: entry.stream.scope,
+			branch: entry.stream.branch,
+			actionId: entry.action.id,
+			code: refusal.code,
+			scheme: refusal.scheme,
+			path,
+			enforced,
+			reason: refusal.reason
+		};
+		this.logger.warn(enforced ? "Signature refused: @Refusal" : "Signature refusal logged, write admitted: @Refusal", event);
+		this.eventBus.emit(ReactorEventTypes.SIGNATURE_REFUSED, event).catch((error) => {
+			this.logger.error("Failed to emit SIGNATURE_REFUSED: @Error", error);
+		});
+		return enforced ? new InvalidSignatureError(entry.stream.documentId, refusal.code, refusal.reason) : void 0;
 	}
 };
+/**
+* A CREATE_DOCUMENT is verified under its own input. Anything else takes the
+* stored document's policy, or, for a document this job creates, that CREATE's.
+*/
+async function resolvePolicies(candidates, jobActions, stored) {
+	const resolved = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		if (entry.action.type === "CREATE_DOCUMENT") {
+			entry.policy = createPolicy(entry.action);
+			continue;
+		}
+		const { documentId, branch } = entry.stream;
+		const key = `${documentId}\u0000${branch}`;
+		let policy = resolved.get(key);
+		if (policy === void 0) {
+			policy = await stored(documentId, branch) ?? createdPolicy(jobActions, documentId) ?? "legacy";
+			resolved.set(key, policy);
+		}
+		entry.policy = policy;
+	}
+}
+async function storedPolicy(stores, source, documentId, branch, signal) {
+	try {
+		if (source === "write-cache") {
+			const document = await stores.writeCache.getState(documentId, "document", branch, void 0, signal);
+			return signaturePolicyOf(document.header);
+		}
+		const meta = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+		return signaturePolicyOf(meta.protocolVersions);
+	} catch (error) {
+		if (DocumentNotFoundError.isError(error)) return;
+		throw error;
+	}
+}
+function createdPolicy(actions, documentId) {
+	const create = actions.find((action) => action.type === "CREATE_DOCUMENT" && action.input?.documentId === documentId);
+	return create ? createPolicy(create) : void 0;
+}
+function createPolicy(action) {
+	return signaturePolicyOf(action.input);
+}
+function candidate(action, stream) {
+	const opId = (actionId) => deriveOperationId(stream.documentId, stream.scope, stream.branch, actionId);
+	return {
+		action,
+		stream,
+		opId: opId(action.id),
+		synthesizedOpId: SYNTHESIZING_TYPES.has(action.type) ? opId(synthesizedActionId(action.id)) : void 0
+	};
+}
+function isLive(entry, live) {
+	return live.has(entry.opId) || entry.synthesizedOpId !== void 0 && live.has(entry.synthesizedOpId);
+}
+function mutationStream(action, job) {
+	return {
+		...actionSigningTarget(action, job.documentId, job.branch),
+		scope: job.scope
+	};
+}
+function byStream(candidates) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		const key = `${entry.stream.documentId}\u0000${entry.stream.scope}\u0000${entry.stream.branch}`;
+		const group = groups.get(key) ?? [entry.stream, []];
+		group[1].push(entry);
+		groups.set(key, group);
+	}
+	return [...groups.values()];
+}
+function isRetry(job) {
+	return job.errorHistory.length > 0 || (job.retryCount ?? 0) > 0;
+}
+function committedWrite(entry, opId) {
+	return {
+		...entry.stream,
+		actionId: entry.action.id,
+		opId
+	};
+}
+function sameContent(stored, submitted) {
+	try {
+		return canonicalJson(stored) === canonicalJson(submitted);
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/executor/simple-job-executor.ts
 const MAX_SKIP_THRESHOLD = 1e3;
@@ -3336,6 +3944,7 @@ function isValidISOTimestamp(value) {
 * every test expect a failed job to look like.
 */
 var JobRollbackSignal = class extends Error {
+	result;
 	constructor(result) {
 		super("job rolled back");
 		this.result = result;
@@ -3343,13 +3952,27 @@ var JobRollbackSignal = class extends Error {
 	}
 };
 var SimpleJobExecutor = class {
+	logger;
+	registry;
+	operationStore;
+	eventBus;
+	writeCache;
+	operationIndex;
+	documentMetaCache;
+	collectionMembershipCache;
+	driveContainerTypes;
 	config;
 	featureFlags;
 	decisionModel;
-	signatureVerifierModule;
+	signatureAdmission;
 	documentActionHandler;
 	executionScope;
-	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, signatureVerifier, executionScope) {
+	signer;
+	/**
+	* `signer` signs the operations the reducer synthesizes; unsigned if omitted.
+	* `trustPolicy` decides which keys may sign as which users at admission.
+	*/
+	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, executionScope, signer, trustPolicy) {
 		this.logger = logger;
 		this.registry = registry;
 		this.operationStore = operationStore;
@@ -3359,6 +3982,7 @@ var SimpleJobExecutor = class {
 		this.documentMetaCache = documentMetaCache;
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.driveContainerTypes = driveContainerTypes;
+		this.signer = signer ?? new PassthroughSigner();
 		this.config = {
 			featureFlags: config.featureFlags ?? {},
 			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
@@ -3368,11 +3992,17 @@ var SimpleJobExecutor = class {
 			retryBaseDelayMs: config.retryBaseDelayMs ?? 100,
 			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50,
-			batchApplies: config.batchApplies ?? true
+			batchApplies: config.batchApplies ?? true,
+			signatureVerification: config.signatureVerification ?? "enforce"
 		};
 		this.featureFlags = resolveFeatureFlags(config.featureFlags);
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
-		this.signatureVerifierModule = new SignatureVerifier(signatureVerifier);
+		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
+			signer: this.signer,
+			authEnforcement: this.featureFlags.authEnforcement,
+			policy: trustPolicy,
+			timeoutMs: Math.min(DEFAULT_TRUST_TIMEOUT_MS, this.config.jobTimeoutMs / 2)
+		});
 		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel);
 		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
 	}
@@ -3502,10 +4132,29 @@ var SimpleJobExecutor = class {
 				pendingEvent
 			};
 		}
-		const positioned = await this.positionByTimestamp(job, stores, signal);
+		let admission;
+		try {
+			admission = await this.signatureAdmission.admitMutation(job, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		if (admission.kind === "refused") return { result: buildErrorResult(job, admission.error, startTime) };
+		let committed;
+		try {
+			committed = await this.reloadCommitted(admission.committed, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		const committedIds = new Set(admission.committed.map((write) => write.actionId));
+		const fresh = committedIds.size === 0 ? job : {
+			...job,
+			actions: job.actions.filter((action) => !committedIds.has(action.id))
+		};
+		if (fresh.actions.length === 0) return this.committedOutcome(job, committed, [], [], stores, startTime);
+		const positioned = await this.positionByTimestamp(fresh, stores, signal);
 		if (positioned.error) return { result: buildErrorResult(job, positioned.error, startTime) };
 		const executing = {
-			job,
+			job: fresh,
 			startTime,
 			indexTxn,
 			stores,
@@ -3535,12 +4184,21 @@ var SimpleJobExecutor = class {
 		} };
 		const ordinals = await stores.operationIndex.commit(indexTxn, signal);
 		postCommitMembershipInvalidations.push(...indexTxn.getMembershipInvalidations());
-		if (actionResult.operationsWithContext.length > 0) {
-			for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
-			const collectionMemberships = await this.getCollectionMembershipsForOperations(actionResult.operationsWithContext, stores);
+		for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
+		return this.committedOutcome(job, committed, actionResult.operationsWithContext, actionResult.generatedOperations, stores, startTime);
+	}
+	/**
+	* A successful mutation's result and the write-ready event it owes, carrying
+	* what earlier attempts committed ahead of what this one wrote.
+	*/
+	async committedOutcome(job, reloaded, written, generated, stores, startTime) {
+		const operationsWithContext = [...reloaded, ...written];
+		let pendingEvent;
+		if (operationsWithContext.length > 0) {
+			const collectionMemberships = await this.getCollectionMembershipsForOperations(operationsWithContext, stores);
 			pendingEvent = {
 				jobId: job.id,
-				operations: actionResult.operationsWithContext,
+				operations: operationsWithContext,
 				jobMeta: job.meta,
 				submittedActionIds: submittedActionIds(job),
 				collectionMemberships
@@ -3550,14 +4208,62 @@ var SimpleJobExecutor = class {
 			result: {
 				job,
 				success: true,
-				operations: actionResult.generatedOperations,
-				operationsWithContext: actionResult.operationsWithContext,
+				operations: [...reloaded.map((entry) => entry.operation), ...generated],
+				operationsWithContext,
 				duration: Date.now() - startTime
 			},
 			pendingEvent
 		};
 	}
 	/**
+	* The stored operations of writes an earlier attempt committed, as a fresh
+	* write would report them. State is rebuilt from the write cache, and left
+	* out when it cannot be.
+	*/
+	async reloadCommitted(writes, stores, signal) {
+		const streams = /* @__PURE__ */ new Map();
+		for (const write of writes) {
+			const key = `${write.documentId}\u0000${write.scope}\u0000${write.branch}`;
+			streams.set(key, [...streams.get(key) ?? [], write]);
+		}
+		const reloaded = [];
+		for (const group of streams.values()) {
+			const { documentId, scope, branch } = group[0];
+			const opIds = [...new Set(group.map((write) => write.opId))];
+			const operations = await stores.operationStore.getOperationsByIds(documentId, scope, branch, opIds, signal);
+			const ordinals = await stores.operationIndex.getOrdinalsByOpIds(documentId, scope, branch, opIds, signal);
+			const { documentType } = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			for (const operation of operations.sort((a, b) => a.index - b.index)) reloaded.push({
+				operation,
+				context: {
+					documentId,
+					scope,
+					branch,
+					documentType,
+					resultingState: await this.rebuiltState(stores, {
+						documentId,
+						scope,
+						branch
+					}, operation, signal),
+					ordinal: ordinals.get(operation.id) ?? 0
+				}
+			});
+		}
+		return reloaded;
+	}
+	async rebuiltState(stores, stream, operation, signal) {
+		try {
+			const document = await stores.writeCache.getState(stream.documentId, stream.scope, stream.branch, operation.index, signal);
+			return JSON.stringify({
+				...document.state,
+				header: document.header
+			});
+		} catch (error) {
+			this.logger.warn("No state for committed operation @OperationId in @Stream: @Error", operation.id, stream, error);
+			return;
+		}
+	}
+	/**
 	* Drops the cached state of every stream a job wrote, after its transaction
 	* did not commit.
 	*
@@ -3586,16 +4292,6 @@ var SimpleJobExecutor = class {
 		const actions = writes.map((write) => write.action);
 		const generatedOperations = [];
 		const operationsWithContext = [];
-		try {
-			await this.signatureVerifierModule.verifyActions(job.documentId, job.branch, actions);
-		} catch (error) {
-			return {
-				success: false,
-				generatedOperations,
-				operationsWithContext,
-				error: error instanceof Error ? error : new Error(String(error))
-			};
-		}
 		for (const action of actions) if (action.timestampUtcMs && !isValidISOTimestamp(action.timestampUtcMs)) return {
 			success: false,
 			generatedOperations,
@@ -3693,7 +4389,7 @@ var SimpleJobExecutor = class {
 			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
 			documentVersion = docMeta.state.version;
 		}
-		if (isUndoRedo(action) || action.type === "PRUNE" || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (isUndoRedo(action) || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
 		let document;
 		if (baseDocument !== void 0) document = baseDocument;
 		else try {
@@ -3753,7 +4449,7 @@ var SimpleJobExecutor = class {
 				branch: job.branch,
 				protocolVersion
 			};
-			updatedDocument = module.reducer(document, action, void 0, reducerOptions);
+			updatedDocument = withProtocolVersions(module.reducer(document, action, void 0, reducerOptions), document.header.protocolVersions);
 		} catch (error) {
 			const contextMessage = `Failed to apply action to document:\n  Action type: ${action.type}\n  Document ID: ${job.documentId}\n  Document type: ${document.header.documentType}\n  Scope: ${job.scope}\n  Original error: ${error instanceof Error ? error.message : String(error)}`;
 			const enhancedError = new Error(contextMessage);
@@ -3765,6 +4461,15 @@ var SimpleJobExecutor = class {
 		if (operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("No operation generated from action"), startTime);
 		const newOperation = operations[operations.length - 1];
 		if (!isUndoRedo(action)) newOperation.skip = skip;
+		if (deniedReason === void 0 && sourceOperation === void 0 && !executing.replayingAcceptedHistory && isSynthesized(action, newOperation, document.operations[scope] ?? [])) try {
+			await signSynthesized(newOperation, action, {
+				documentId: job.documentId,
+				scope,
+				branch: job.branch
+			}, this.signer, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
 		const resultingState = JSON.stringify({
 			...updatedDocument.state,
 			header: updatedDocument.header
@@ -3865,7 +4570,7 @@ var SimpleJobExecutor = class {
 	*   apply and its own reasons for it.
 	* - A positional or replayed run carries skips and re-appended operations,
 	*   whose indices are not a simple ascending run from the head.
-	* - UNDO, REDO, PRUNE and NOOP-with-skip each invalidate the write cache to
+	* - UNDO, REDO and NOOP-with-skip each invalidate the write cache to
 	*   force a full-history rebuild, so they cannot be reduced against state
 	*   threaded from the write before them.
 	* - The auth scope decides later writes against the policy earlier ones
@@ -3883,7 +4588,7 @@ var SimpleJobExecutor = class {
 		if (scope === "auth" || scope === "document") return false;
 		return writes.every((write) => {
 			const type = write.action.type;
-			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "PRUNE" && type !== "NOOP";
+			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "NOOP";
 		});
 	}
 	/**
@@ -4270,36 +4975,32 @@ var SimpleJobExecutor = class {
 			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
 			duration: Date.now() - startTime
 		};
-		let minIncomingIndex = Number.POSITIVE_INFINITY;
-		let minIncomingTimestamp = job.operations[0]?.timestampUtcMs || "";
-		for (const operation of job.operations) {
-			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
-			const ts = operation.timestampUtcMs || "";
-			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
-		}
-		let conflictingOps;
-		try {
-			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
-		} catch {
-			conflictingOps = [];
-		}
-		let allOpsFromMinConflictingIndex = conflictingOps;
-		if (conflictingOps.length > 0) {
-			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+		const dropped = /* @__PURE__ */ new Set();
+		const admitted = /* @__PURE__ */ new Set();
+		let selection = await this.selectLoadWrites(job, job.operations, stores, signal);
+		for (;;) {
+			const unadmitted = selection.incomingOpsToApply.filter((operation) => !admitted.has(operation));
+			if (unadmitted.length === 0) break;
+			let refused;
 			try {
-				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
-			} catch {
-				allOpsFromMinConflictingIndex = conflictingOps;
+				refused = await this.signatureAdmission.admitLoad(job, unadmitted, stores, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
 			}
+			for (const operation of unadmitted) if (refused.has(operation)) dropped.add(operation);
+			else admitted.add(operation);
+			if (refused.size === 0) break;
+			const remaining = job.operations.filter((operation) => !dropped.has(operation));
+			if (remaining.length === 0) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
+			selection = await this.selectLoadWrites(job, remaining, stores, signal);
 		}
-		const incomingActionIds = new Set(job.operations.map((op) => op.action.id));
-		const nonSupersededOps = conflictingOps.filter((op) => {
-			if (op.index < minIncomingIndex && !incomingActionIds.has(op.action.id)) return false;
-			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0) {
-				if (laterOp.index - laterOp.skip <= op.index) return false;
-			}
-			return true;
-		});
+		const { nonSupersededOps, allOpsFromMinConflictingIndex, incomingOpsToApply } = selection;
 		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
 		const actionIdCounts = /* @__PURE__ */ new Map();
 		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
@@ -4320,14 +5021,6 @@ var SimpleJobExecutor = class {
 			const logicalSkip = latestRevision - minLogicalIndex;
 			if (logicalSkip > skipCount) skipCount = logicalSkip;
 		}
-		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
-		const seenIncomingActionIds = /* @__PURE__ */ new Set();
-		const incomingOpsToApply = job.operations.filter((op) => {
-			if (existingActionIds.has(op.action.id)) return false;
-			if (seenIncomingActionIds.has(op.action.id)) return false;
-			seenIncomingActionIds.add(op.action.id);
-			return true;
-		});
 		if (incomingOpsToApply.length === 0) return {
 			job,
 			success: true,
@@ -4407,6 +5100,53 @@ var SimpleJobExecutor = class {
 			duration: Date.now() - startTime
 		};
 	}
+	/** The conflicting window a load opens, and which of its operations are new. */
+	async selectLoadWrites(job, operations, stores, signal) {
+		const scope = job.scope;
+		let minIncomingIndex = Number.POSITIVE_INFINITY;
+		let minIncomingTimestamp = operations[0]?.timestampUtcMs || "";
+		for (const operation of operations) {
+			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
+			const ts = operation.timestampUtcMs || "";
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
+		}
+		let conflictingOps;
+		try {
+			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
+		} catch {
+			conflictingOps = [];
+		}
+		let allOpsFromMinConflictingIndex = conflictingOps;
+		if (conflictingOps.length > 0) {
+			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+			try {
+				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
+			} catch {
+				allOpsFromMinConflictingIndex = conflictingOps;
+			}
+		}
+		const incomingActionIds = new Set(operations.map((op) => op.action.id));
+		const nonSupersededOps = conflictingOps.filter((op) => {
+			if (op.index < minIncomingIndex && !incomingActionIds.has(op.action.id)) return false;
+			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0) {
+				if (laterOp.index - laterOp.skip <= op.index) return false;
+			}
+			return true;
+		});
+		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
+		const seenIncomingActionIds = /* @__PURE__ */ new Set();
+		const incomingOpsToApply = operations.filter((op) => {
+			if (existingActionIds.has(op.action.id)) return false;
+			if (seenIncomingActionIds.has(op.action.id)) return false;
+			seenIncomingActionIds.add(op.action.id);
+			return true;
+		});
+		return {
+			nonSupersededOps,
+			allOpsFromMinConflictingIndex,
+			incomingOpsToApply
+		};
+	}
 	accumulateResultOrReturnError(result, generatedOperations, operationsWithContext) {
 		if (!result.success) return result;
 		if (result.operations && result.operations.length > 0) generatedOperations.push(...result.operations);
@@ -4553,6 +5293,7 @@ var DocumentModelRegistry = class {
 //#endregion
 //#region src/storage/kysely/keyframe-store.ts
 var KyselyKeyframeStore = class KyselyKeyframeStore {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -4637,6 +5378,11 @@ function paginateRows(rows, paging, cursorOf, toItem, refetch) {
 //#endregion
 //#region src/storage/txn.ts
 var AtomicTransaction = class {
+	documentId;
+	documentType;
+	scope;
+	branch;
+	baseRevision;
 	operations = [];
 	constructor(documentId, documentType, scope, branch, baseRevision) {
 		this.documentId = documentId;
@@ -4670,6 +5416,11 @@ var AtomicTransaction = class {
 //#endregion
 //#region src/storage/kysely/store.ts
 var _UniqueConstraintContext = class extends Error {
+	documentId;
+	scope;
+	branch;
+	revision;
+	stagedOps;
 	constructor(documentId, scope, branch, revision, stagedOps) {
 		super("unique constraint");
 		this.documentId = documentId;
@@ -4681,6 +5432,7 @@ var _UniqueConstraintContext = class extends Error {
 	}
 };
 var KyselyOperationStore = class KyselyOperationStore {
+	db;
 	trx;
 	constructor(db) {
 		this.db = db;
@@ -4780,12 +5532,13 @@ var KyselyOperationStore = class KyselyOperationStore {
 	* otherwise read a snapshot taken before the locks were held.
 	*/
 	async acquireStreamLocks(trx, documentId, scope, branch, condition) {
-		const keys = new Set([`${documentId}:${scope}:${branch}`]);
+		const keys = /* @__PURE__ */ new Set([`${documentId}:${scope}:${branch}`]);
 		for (const stream of condition.streams) keys.add(`${stream.documentId}:${stream.scope}:${stream.branch}`);
+		const sortedKeys = sql.join([...keys].sort());
 		await sql`
       with ordered as materialized (
         select key
-        from unnest(array[${sql.join([...keys].sort())}]::text[]) with ordinality as t(key, ord)
+        from unnest(array[${sortedKeys}]::text[]) with ordinality as t(key, ord)
         order by ord
       )
       select pg_advisory_xact_lock(hashtext(key)) from ordered
@@ -4939,6 +5692,20 @@ var KyselyOperationStore = class KyselyOperationStore {
 		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
 		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
 	}
+	async findOperationIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return /* @__PURE__ */ new Set();
+		const rows = await this.queryExecutor.selectFrom("Operation").select("opId").distinct().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).execute();
+		return new Set(rows.map((row) => row.opId));
+	}
+	async getOperationsByIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return [];
+		const rows = await this.queryExecutor.selectFrom("Operation").selectAll().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "asc").execute();
+		const latest = /* @__PURE__ */ new Map();
+		for (const row of rows) latest.set(row.opId, this.rowToOperation(row));
+		return [...latest.values()];
+	}
 	rowToOperation(row) {
 		return {
 			index: row.index,
@@ -5410,8 +6177,148 @@ async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
 }
 //#endregion
 //#region src/core/drive-container-types.ts
-const DEFAULT_DRIVE_CONTAINER_TYPES = new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+const DEFAULT_DRIVE_CONTAINER_TYPES = /* @__PURE__ */ new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+//#endregion
+//#region src/executor/worker/error-info.ts
+const MAX_STACK_LENGTH = 8192;
+const MAX_CAUSE_DEPTH = 8;
+function toErrorInfo(err, depth = 0) {
+	if (depth > MAX_CAUSE_DEPTH) return {
+		name: "Error",
+		message: "cause chain truncated"
+	};
+	if (err instanceof Error) {
+		const info = {
+			name: err.name || "Error",
+			message: err.message
+		};
+		if (typeof err.stack === "string") info.stack = err.stack.length > MAX_STACK_LENGTH ? err.stack.slice(0, MAX_STACK_LENGTH) : err.stack;
+		if (err.cause !== void 0) info.cause = toErrorInfo(err.cause, depth + 1);
+		return info;
+	}
+	if (typeof err === "string") return {
+		name: "Error",
+		message: err
+	};
+	if (err && typeof err === "object") {
+		const record = err;
+		return {
+			name: typeof record.name === "string" ? record.name : "Error",
+			message: typeof record.message === "string" ? record.message : safeStringify(err)
+		};
+	}
+	return {
+		name: "Error",
+		message: safeStringify(err)
+	};
+}
+function safeStringify(value) {
+	if (value === null || value === void 0) return String(value);
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return "[unserializable]";
+	}
+}
+function fromErrorInfo(info) {
+	const err = new Error(info.message);
+	Object.defineProperty(err, "name", {
+		value: info.name,
+		configurable: true,
+		writable: true
+	});
+	if (info.stack !== void 0) err.stack = info.stack;
+	if (info.cause !== void 0) Object.defineProperty(err, "cause", {
+		value: fromErrorInfo(info.cause),
+		configurable: true,
+		writable: true
+	});
+	return err;
+}
+//#endregion
+//#region src/executor/worker/sanitize.ts
+const MAX_DEPTH = 8;
+function errorToInfo(err) {
+	return toErrorInfo(err);
+}
+function sanitizeArg(value, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
+	if (depth > MAX_DEPTH) return "[Truncated]";
+	if (value === null || value === void 0) return null;
+	if (typeof value === "boolean") return value;
+	if (typeof value === "number") return value;
+	if (typeof value === "string") return value;
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "function" || typeof value === "symbol") return null;
+	if (value instanceof Error) return toErrorInfo(value);
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof Map) {
+		const obj = {};
+		for (const [k, v] of value.entries()) obj[String(k)] = sanitizeArg(v, depth + 1, seen);
+		return obj;
+	}
+	if (value instanceof Set) {
+		const arr = [];
+		for (const v of value.values()) arr.push(sanitizeArg(v, depth + 1, seen));
+		return arr;
+	}
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = value.map((v) => sanitizeArg(v, depth + 1, seen));
+		seen.delete(value);
+		return result;
+	}
+	if (typeof value === "object") {
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) return { __nonClonable: value.constructor?.name || "Unknown" };
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = {};
+		for (const [k, v] of Object.entries(value)) result[k] = sanitizeArg(v, depth + 1, seen);
+		seen.delete(value);
+		return result;
+	}
+	return null;
+}
+//#endregion
+//#region src/executor/worker/forwarding-logger.ts
+function createForwardingLogger(post, level = "info", tags = []) {
+	function safePost(msg) {
+		try {
+			post(msg);
+		} catch {
+			try {
+				process.stderr.write(`[forwarding-logger] postMessage failed: ${msg.level} ${msg.message}\n`);
+			} catch {}
+		}
+	}
+	function emit(wireLevel, message, args) {
+		const sanitizedArgs = args.map((a) => sanitizeArg(a));
+		safePost({
+			type: "log",
+			level: wireLevel,
+			message,
+			args: tags.length > 0 ? [sanitizeArg({ tags }), ...sanitizedArgs] : sanitizedArgs,
+			timestamp: Date.now()
+		});
+	}
+	return {
+		level,
+		verbose: (message, ...args) => emit("debug", message, args),
+		debug: (message, ...args) => emit("debug", message, args),
+		info: (message, ...args) => emit("info", message, args),
+		warn: (message, ...args) => emit("warn", message, args),
+		error: (message, ...args) => emit("error", message, args),
+		errorHandler: ((...data) => {
+			const first = data[0];
+			emit("error", typeof first === "string" ? first : "", data.slice(1));
+		}),
+		child: (childTags) => createForwardingLogger(post, level, [...tags, ...childTags])
+	};
+}
 //#endregion
-export { parsePagingOptions as $, targetDocumentId as A, DuplicateOperationError as B, InvalidModuleError as C, createEmptyConsistencyToken as D, createConsistencyToken as E, buildDecisionModel as F, AuthorizationDeniedError as G, RevisionMismatchError as H, APPEND_CONDITION_FAILED_PREFIX as I, ExcessiveReshuffleError as J, DocumentDeletedError as K, AppendConditionFailedError as L, selectDecisionModel as M, documentDecisionModel as N, submittedActionIds as O, authDecisionModel as P, matchesScope as Q, DocumentAlreadyExistsError as R, DuplicateModuleError as S, GATED_DOCUMENT_ACTIONS as T, AuthEnforcementDisabledError as U, OptimisticLockError as V, AuthTimestampNotMonotonicError as W, RelationshipNotFoundError as X, InvalidOperationTimestampError as Y, UpgradePreconditionFailedError as Z, DocumentMetaCache as _, createForwardingPoolInstrumentation as a, JobExecutorEventTypes as b, KyselyKeyframeStore as c, DriveCollectionId as d, throwIfAborted as et, KyselyExecutionScope as f, KyselyOperationIndex as g, KyselyWriteCache as h, runMigrations as i, decideAtHead as j, summarizeSubmittedActions as k, DocumentModelRegistry as l, EventBus as m, REACTOR_SCHEMA as n, __exportAll as nt, instrumentPgPool as o, resolveFeatureFlags as p, DocumentNotFoundError as q, getMigrationStatus as r, KyselyOperationStore as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, yieldToMain as tt, SimpleJobExecutor as u, CollectionMembershipCache as v, ModuleNotFoundError as w, DuplicateManifestError as x, DEFAULT_DEFERRED_JOB_TTL_MS as y, DocumentExistence as z };
+export { DocumentNotFoundError as $, ModuleNotFoundError as A, authDecisionModel as B, DocumentMetaCache as C, DuplicateManifestError as D, JobExecutorEventTypes as E, summarizeSubmittedActions as F, DocumentExistence as G, APPEND_CONDITION_FAILED_PREFIX as H, targetDocumentId as I, RevisionMismatchError as J, DuplicateOperationError as K, decideAtHead as L, createConsistencyToken as M, createEmptyConsistencyToken as N, DuplicateModuleError as O, submittedActionIds as P, DocumentDeletedError as Q, selectDecisionModel as R, KyselyOperationIndex as S, DEFAULT_DEFERRED_JOB_TTL_MS as T, AppendConditionFailedError as U, buildDecisionModel as V, DocumentAlreadyExistsError as W, AuthTimestampNotMonotonicError as X, AuthEnforcementDisabledError as Y, AuthorizationDeniedError as Z, DriveCollectionId as _, DEFAULT_DRIVE_CONTAINER_TYPES as a, EventBusAggregateError as at, EventBus as b, runMigrations as c, parsePagingOptions as ct, KyselyOperationStore as d, __exportAll as dt, ExcessiveReshuffleError as et, KyselyKeyframeStore as f, PassthroughSigner as g, verifyActionSignature as h, fromErrorInfo as i, UpgradePreconditionFailedError as it, GATED_DOCUMENT_ACTIONS as j, InvalidModuleError as k, createForwardingPoolInstrumentation as l, throwIfAborted as lt, SimpleJobExecutor as m, errorToInfo as n, InvalidSignatureError as nt, REACTOR_SCHEMA as o, ReactorEventTypes as ot, DocumentModelRegistry as p, OptimisticLockError as q, sanitizeArg as r, RelationshipNotFoundError as rt, getMigrationStatus as s, matchesScope as st, createForwardingLogger as t, InvalidOperationTimestampError as tt, instrumentPgPool as u, yieldToMain as ut, KyselyExecutionScope as v, CollectionMembershipCache as w, KyselyWriteCache as x, resolveFeatureFlags as y, documentDecisionModel as z };
 
-//# sourceMappingURL=drive-container-types-CS5IxDiA.js.map
+//# sourceMappingURL=forwarding-logger-CSsCJ38f.js.map