@powerhousedao/reactor 6.2.3-dev.24 → 6.2.3-dev.26

package/dist/index.js

@@ -1,9 +1,6 @@
-import { $ as RelationshipNotFoundError, A as submittedActionIds, B as DocumentAlreadyExistsError, C as DuplicateManifestError, D as GATED_DOCUMENT_ACTIONS, E as ModuleNotFoundError, F as documentDecisionModel, G as AuthEnforcementDisabledError, H as DuplicateOperationError, I as authDecisionModel, J as DocumentDeletedError, K as AuthTimestampNotMonotonicError, L as buildDecisionModel, M as targetDocumentId, N as decideAtHead, O as createConsistencyToken, P as selectDecisionModel, Q as InvalidSignatureError, R as APPEND_CONDITION_FAILED_PREFIX, S as JobExecutorEventTypes, T as InvalidModuleError, U as OptimisticLockError, V as DocumentExistence, W as RevisionMismatchError, X as ExcessiveReshuffleError, Y as DocumentNotFoundError, Z as InvalidOperationTimestampError, _ as KyselyWriteCache, a as createForwardingPoolInstrumentation, b as CollectionMembershipCache, c as KyselyKeyframeStore, d as verifyActionSignature, et as UpgradePreconditionFailedError, f as PassthroughSigner, g as EventBus, h as resolveFeatureFlags, i as runMigrations, j as summarizeSubmittedActions, k as createEmptyConsistencyToken, l as DocumentModelRegistry, m as KyselyExecutionScope, n as REACTOR_SCHEMA, nt as parsePagingOptions, o as instrumentPgPool, p as DriveCollectionId, q as AuthorizationDeniedError, r as getMigrationStatus, rt as throwIfAborted, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, tt as matchesScope, u as SimpleJobExecutor, v as KyselyOperationIndex, w as DuplicateModuleError, x as DEFAULT_DEFERRED_JOB_TTL_MS, y as DocumentMetaCache, z as AppendConditionFailedError } from "./drive-container-types-Be5-EY9W.js";
-import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DxDCmtId.js";
-import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
-import { a as KyselyDocumentView, c as ReadModelCoordinator, d as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, f as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as unchunkedReadModelIndexingConfig, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as DEFAULT_COMMIT_CHUNK_SIZE } from "./document-indexer-Dn9RB0sg.js";
-import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-BDVzCtuf.js";
+import { $ as DocumentNotFoundError, A as ModuleNotFoundError, B as authDecisionModel, C as DocumentMetaCache, D as DuplicateManifestError, E as JobExecutorEventTypes, F as summarizeSubmittedActions, G as DocumentExistence, H as APPEND_CONDITION_FAILED_PREFIX, I as targetDocumentId, J as RevisionMismatchError, K as DuplicateOperationError, L as decideAtHead, M as createConsistencyToken, N as createEmptyConsistencyToken, O as DuplicateModuleError, P as submittedActionIds, Q as DocumentDeletedError, R as selectDecisionModel, S as KyselyOperationIndex, T as DEFAULT_DEFERRED_JOB_TTL_MS, U as AppendConditionFailedError, V as buildDecisionModel, W as DocumentAlreadyExistsError, X as AuthTimestampNotMonotonicError, Y as AuthEnforcementDisabledError, Z as AuthorizationDeniedError, _ as DriveCollectionId, a as DEFAULT_DRIVE_CONTAINER_TYPES, at as EventBusAggregateError, b as EventBus, c as runMigrations, ct as parsePagingOptions, d as KyselyOperationStore, dt as __exportAll, et as ExcessiveReshuffleError, f as KyselyKeyframeStore, g as PassthroughSigner, h as verifyActionSignature, it as UpgradePreconditionFailedError, j as GATED_DOCUMENT_ACTIONS, k as InvalidModuleError, l as createForwardingPoolInstrumentation, lt as throwIfAborted, m as SimpleJobExecutor, n as errorToInfo, nt as InvalidSignatureError, o as REACTOR_SCHEMA, ot as ReactorEventTypes, p as DocumentModelRegistry, q as OptimisticLockError, r as sanitizeArg, rt as RelationshipNotFoundError, s as getMigrationStatus, st as matchesScope, t as createForwardingLogger, tt as InvalidOperationTimestampError, u as instrumentPgPool, v as KyselyExecutionScope, w as CollectionMembershipCache, x as KyselyWriteCache, y as resolveFeatureFlags, z as documentDecisionModel } from "./forwarding-logger-CnuVDVze.js";
+import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-BM_ULVWd.js";
+import { a as KyselyDocumentView, c as ReadModelCoordinator, d as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, f as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as unchunkedReadModelIndexingConfig, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as DEFAULT_COMMIT_CHUNK_SIZE } from "./document-indexer-BVTGbEB0.js";
 import { DEFAULT_SIGNATURE_POLICY, DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, requestedSignaturePolicy, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
@@ -315,6 +312,10 @@ let JobStatus = /* @__PURE__ */ function(JobStatus) {
 * during construction, so the partial-`this` hazard does not apply.
 */
 var DriveClient = class {
+	client;
+	logger;
+	reactor;
+	signer;
 	constructor(client, logger, reactor, signer) {
 		this.client = client;
 		this.logger = logger;
@@ -337,24 +338,25 @@ var DriveClient = class {
 	async addFile(driveIdentifier, document, parentFolder, signal) {
 		this.logger.verbose("drives.addFile(@driveIdentifier, @document, @parentFolder)", driveIdentifier, document.header.id, parentFolder);
 		const documentId = document.header.id;
+		const createInput = {
+			model: document.header.documentType,
+			version: 0,
+			documentId: document.header.id,
+			signing: {
+				signature: document.header.id,
+				publicKey: document.header.sig.publicKey,
+				nonce: document.header.sig.nonce,
+				createdAtUtcIso: document.header.createdAtUtcIso,
+				documentType: document.header.documentType
+			},
+			slug: document.header.slug,
+			name: document.header.name,
+			branch: document.header.branch,
+			meta: document.header.meta,
+			protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
+		};
 		const documentActions = await signActions([
-			createDocumentAction({
-				model: document.header.documentType,
-				version: 0,
-				documentId: document.header.id,
-				signing: {
-					signature: document.header.id,
-					publicKey: document.header.sig.publicKey,
-					nonce: document.header.sig.nonce,
-					createdAtUtcIso: document.header.createdAtUtcIso,
-					documentType: document.header.documentType
-				},
-				slug: document.header.slug,
-				name: document.header.name,
-				branch: document.header.branch,
-				meta: document.header.meta,
-				protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
-			}),
+			createDocumentAction(createInput),
 			upgradeDocumentAction({
 				documentId: document.header.id,
 				model: document.header.documentType,
@@ -502,8 +504,7 @@ var DriveClient = class {
 		return {
 			results: filtered.slice(startIndex, endIndex),
 			options: effective,
-			...endIndex < filtered.length ? { nextCursor: String(endIndex) } : {},
-			totalCount: filtered.length
+			...endIndex < filtered.length ? { nextCursor: String(endIndex) } : {}
 		};
 	}
 	/**
@@ -514,7 +515,7 @@ var DriveClient = class {
 	async runJobs(jobs, signal) {
 		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw this.toError(job);
+		for (const job of completedJobs) if (job.status === "FAILED") throw this.toError(job);
 		return completedJobs;
 	}
 	toError(job) {
@@ -555,10 +556,10 @@ var DriveClient = class {
 			dependsOn: ["relationship"]
 		}] }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
+		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
 		const deleteJob = await this.reactor.deleteDocument(fileId, this.signer, signal);
 		const deleteCompleted = await this.client.waitForJob(deleteJob, signal);
-		if (deleteCompleted.status === JobStatus.FAILED) throw new Error(deleteCompleted.error?.message);
+		if (deleteCompleted.status === "FAILED") throw new Error(deleteCompleted.error?.message);
 	}
 };
 //#endregion
@@ -569,13 +570,15 @@ var DriveClient = class {
 * Only READ_READY and FAILED are truly terminal.
 */
 function isTerminalStatus(status) {
-	return status === JobStatus.READ_READY || status === JobStatus.FAILED;
+	return status === "READ_READY" || status === "FAILED";
 }
 /**
 * Event-driven implementation of IJobAwaiter.
 * Subscribes to operation events to detect job completion without polling.
 */
 var JobAwaiter = class {
+	eventBus;
+	getJobStatus;
 	pendingJobs = /* @__PURE__ */ new Map();
 	unsubscribers = [];
 	constructor(eventBus, getJobStatus) {
@@ -717,7 +720,54 @@ let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 * would diverge permanently. The document scope carries the metadata the same
 * argument covers. Grants gate domain-scope reads only.
 */
-const ALWAYS_READABLE_SCOPES = new Set(["auth", "document"]);
+const ALWAYS_READABLE_SCOPES = /* @__PURE__ */ new Set(["auth", "document"]);
+const DECLARED_DOMAIN_SCOPES = ["global", "local"];
+/**
+* The scopes grants gate: the declared ones, and any other the document holds.
+* A document fetched for a narrowed view holds only that view's scopes.
+*/
+function domainScopesOf(document) {
+	const state = document.state;
+	const held = Object.keys(state ?? {}).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope));
+	return [.../* @__PURE__ */ new Set([...DECLARED_DOMAIN_SCOPES, ...held])];
+}
+function allowsSomeDomainScope(document, readable) {
+	return domainScopesOf(document).some(readable);
+}
+/** A document with no state at all is not policied, so nothing withholds it. */
+function refusesEveryDomainScope(document, readable) {
+	return document.state !== void 0 && !allowsSomeDomainScope(document, readable);
+}
+/**
+* The domain scopes the document does not hold whose read decision reads their
+* own state. A condition's `doc.<scope>` path resolves only for that scope, so
+* every other scope is decided on its name and the policy alone.
+*/
+function unheldScopesReadOnState(document) {
+	const grants = authOf(document)?.grants ?? [];
+	const onState = /* @__PURE__ */ new Set();
+	for (const grant of grants) {
+		collectStateScopes(grant.where, onState);
+		collectStateScopes(grant.principal, onState);
+	}
+	if (onState.size === 0) return [];
+	const held = document.state ?? {};
+	return domainScopesOf(document).filter((scope) => onState.has(scope) && !(scope in held));
+}
+function collectStateScopes(node, into) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectStateScopes(child, into);
+		return;
+	}
+	if (typeof node !== "object" || node === null) return;
+	const { attr } = node;
+	if (typeof attr === "string") {
+		const [root, scope] = attr.split(".");
+		if (root === "doc" && scope) into.add(scope);
+		return;
+	}
+	for (const child of Object.values(node)) collectStateScopes(child, into);
+}
 /** What a gate does with an uninitialized policy when told nothing. */
 const OPEN_BY_DEFAULT = { withholdUninitialized: false };
 /**
@@ -780,8 +830,26 @@ var BareReadGate = class {
 			scope
 		}) === "allow");
 	}
+	prepare(document) {
+		return Promise.resolve((subject) => this.scopePredicate(document, subject));
+	}
 };
 /**
+* Rethrows a failed read unless the document is confirmed not live. The read
+* side reports absence as a plain Error, so absence is checked rather than
+* inferred from the message, and a failed check surfaces the read's own error.
+*/
+async function assertAbsent(documentView, documentId, error, signal) {
+	if (DocumentNotFoundError.isError(error)) return;
+	let exists;
+	try {
+		exists = await documentView.exists([documentId], "LiveOnly", void 0, signal);
+	} catch {
+		throw error;
+	}
+	if (exists[0]) throw error;
+}
+/**
 * Answers a stream read from the document already fetched, and anything else
 * through the read side.
 *
@@ -791,6 +859,9 @@ var BareReadGate = class {
 * list names is fetched.
 */
 var SeededStateReader = class {
+	documentView;
+	seed;
+	branch;
 	constructor(documentView, seed, branch) {
 		this.documentView = documentView;
 		this.seed = seed;
@@ -812,20 +883,10 @@ var SeededStateReader = class {
 				scopes: [scope]
 			}, void 0, signal);
 		} catch (error) {
-			await this.assertAbsent(documentId, error, signal);
+			await assertAbsent(this.documentView, documentId, error, signal);
 			throw new DocumentNotFoundError(documentId);
 		}
 	}
-	async assertAbsent(documentId, error, signal) {
-		if (DocumentNotFoundError.isError(error)) return;
-		let exists;
-		try {
-			exists = await this.documentView.exists([documentId], DocumentExistence.LiveOnly, void 0, signal);
-		} catch {
-			throw error;
-		}
-		if (exists[0]) throw error;
-	}
 };
 /**
 * Evaluates a read against the registered decision model, built at the stream
@@ -841,6 +902,12 @@ var SeededStateReader = class {
 * from state no commit ever invalidates.
 */
 var ModelReadGate = class {
+	model;
+	documentView;
+	servesGroups;
+	operationIndex;
+	logger;
+	options;
 	constructor(model, documentView, servesGroups, operationIndex, logger, options = OPEN_BY_DEFAULT) {
 		this.model = model;
 		this.documentView = documentView;
@@ -855,10 +922,18 @@ var ModelReadGate = class {
 	* group's other scopes are its own business and stay behind its own grants.
 	*/
 	async scopePredicate(document, subject, branch, signal) {
-		const own = await this.ownPolicyPredicate(document, subject, branch, signal);
-		if (!this.servesGroup(document) || own(GROUP_MEMBERSHIP_SCOPE)) return own;
-		const audience = await this.servesGroupTo(document.header.id, subject, signal);
-		return (scope) => own(scope) || audience && scope === GROUP_MEMBERSHIP_SCOPE;
+		return (await this.prepare(document, branch, signal))(subject);
+	}
+	async prepare(document, branch, signal) {
+		const policy = await this.ownPolicy(document, branch, signal);
+		if (!this.servesGroup(document)) return (subject) => Promise.resolve(policy(subject));
+		const referencers = this.referencerReads(document.header.id, signal);
+		return async (subject) => {
+			const own = policy(subject);
+			if (own(GROUP_MEMBERSHIP_SCOPE)) return own;
+			const audience = await this.servesGroupTo(subject, referencers);
+			return (scope) => own(scope) || audience && scope === GROUP_MEMBERSHIP_SCOPE;
+		};
 	}
 	/**
 	* Whether the subject is served this group because a policy names it.
@@ -892,11 +967,8 @@ var ModelReadGate = class {
 	* running with nobody awaiting it, which is where unhandled rejections come
 	* from.
 	*/
-	async servesGroupTo(groupId, subject, signal) {
-		if (!this.operationIndex) return false;
-		const referencers = await this.operationIndex.getGroupReferencers(groupId, signal);
-		const examined = referencers.slice(0, MAX_EXAMINED_REFERENCERS);
-		if (examined.length < referencers.length) this.logger?.warn(`Group ${groupId} is referenced by ${referencers.length} documents; only the first ${MAX_EXAMINED_REFERENCERS} decide whether it is served`);
+	async servesGroupTo(subject, referencers) {
+		const examined = await referencers.examined();
 		const walk = {
 			next: 0,
 			served: false,
@@ -907,7 +979,7 @@ var ModelReadGate = class {
 				const referencerId = examined[walk.next++];
 				let serves = false;
 				try {
-					serves = await this.servesThrough(referencerId, subject, signal);
+					serves = (await referencers.serves(referencerId))(subject);
 				} catch (error) {
 					walk.failure ??= Error.isError(error) ? error : /* @__PURE__ */ new Error(`Probing referencer ${referencerId} failed`);
 				}
@@ -918,21 +990,44 @@ var ModelReadGate = class {
 		if (!walk.served && walk.failure) throw walk.failure;
 		return walk.served;
 	}
+	/** Each read made once, however many subjects the walk runs for. */
+	referencerReads(groupId, signal) {
+		let examined;
+		const serves = /* @__PURE__ */ new Map();
+		return {
+			examined: () => examined ??= this.examinedReferencers(groupId, signal),
+			serves: (referencerId) => {
+				let read = serves.get(referencerId);
+				if (!read) {
+					read = this.servesThrough(referencerId, signal);
+					serves.set(referencerId, read);
+				}
+				return read;
+			}
+		};
+	}
+	async examinedReferencers(groupId, signal) {
+		if (!this.operationIndex) return [];
+		const referencers = await this.operationIndex.getGroupReferencers(groupId, signal);
+		const examined = referencers.slice(0, MAX_EXAMINED_REFERENCERS);
+		if (examined.length < referencers.length) this.logger?.warn(`Group ${groupId} is referenced by ${referencers.length} documents; only the first ${MAX_EXAMINED_REFERENCERS} decide whether it is served`);
+		return examined;
+	}
 	/**
-	* Whether one referencing document serves the subject any domain scope. A
+	* Whether one referencing document serves a subject any domain scope. A
 	* referencer this replica does not hold serves nothing, which fails closed
 	* the same way a group it does not hold does.
 	*/
-	async servesThrough(referencerId, subject, signal) {
+	async servesThrough(referencerId, signal) {
 		let referencer;
 		try {
 			referencer = await this.documentView.get(referencerId, { branch: GROUP_BRANCH }, void 0, signal);
 		} catch {
-			return false;
+			return () => false;
 		}
-		if (this.servesGroup(referencer)) return false;
-		const readable = await this.ownPolicyPredicate(referencer, subject, GROUP_BRANCH, signal);
-		return Object.keys(referencer.state ?? {}).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope)).some((scope) => readable(scope));
+		if (this.servesGroup(referencer)) return () => false;
+		const policy = await this.ownPolicy(referencer, GROUP_BRANCH, signal);
+		return (subject) => allowsSomeDomainScope(referencer, policy(subject));
 	}
 	servesGroup(document) {
 		return this.servesGroups && this.operationIndex !== void 0 && document.header.documentType === groupDocumentType;
@@ -950,9 +1045,12 @@ var ModelReadGate = class {
 	* publish an unpoliced group it names: the referencer walk asks this question
 	* of the referencing document, whose real policy answers it.
 	*/
-	async ownPolicyPredicate(document, subject, branch, signal) {
+	async ownPolicy(document, branch, signal) {
 		const auth = authOf(document);
-		if (!auth || !auth.version) return this.options.withholdUninitialized ? (scope) => ALWAYS_READABLE_SCOPES.has(scope) : () => true;
+		if (!auth || !auth.version) {
+			const readable = this.options.withholdUninitialized ? (scope) => ALWAYS_READABLE_SCOPES.has(scope) : () => true;
+			return () => readable;
+		}
 		const target = {
 			documentId: document.header.id,
 			branch
@@ -960,7 +1058,7 @@ var ModelReadGate = class {
 		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), this.model, target, signal);
 		const definition = this.model(target);
 		const scopeStates = document.state ?? {};
-		return (scope) => ALWAYS_READABLE_SCOPES.has(scope) || definition.decide(built.model, subject, {
+		return (subject) => (scope) => ALWAYS_READABLE_SCOPES.has(scope) || definition.decide(built.model, subject, {
 			verb: "read",
 			scope
 		}, {
@@ -970,6 +1068,78 @@ var ModelReadGate = class {
 	}
 };
 //#endregion
+//#region src/client/event-reads.ts
+/** One change event's reads, shared by every subscription it reaches. */
+var EventReads = class {
+	reactor;
+	documentView;
+	readGate;
+	documents = /* @__PURE__ */ new Map();
+	existence = /* @__PURE__ */ new Map();
+	prepared = /* @__PURE__ */ new WeakMap();
+	constructor(reactor, documentView, readGate) {
+		this.reactor = reactor;
+		this.documentView = documentView;
+		this.readGate = readGate;
+	}
+	get(id, view) {
+		const key = JSON.stringify([
+			id,
+			view?.branch,
+			view?.scopes
+		]);
+		let read = this.documents.get(key);
+		if (!read) {
+			read = this.reactor.get(id, view);
+			this.documents.set(key, read);
+		}
+		return read;
+	}
+	exists(ids, existence) {
+		const key = JSON.stringify([ids, existence]);
+		let read = this.existence.get(key);
+		if (!read) {
+			read = this.documentView.exists(ids, existence);
+			this.existence.set(key, read);
+		}
+		return read;
+	}
+	async scopePredicate(document, subject, branch) {
+		if (!this.readGate.prepare) return this.readGate.scopePredicate(document, subject, branch);
+		let byBranch = this.prepared.get(document);
+		if (!byBranch) {
+			byBranch = /* @__PURE__ */ new Map();
+			this.prepared.set(document, byBranch);
+		}
+		let prepared = byBranch.get(branch);
+		if (!prepared) {
+			prepared = this.readGate.prepare(document, branch);
+			byBranch.set(branch, prepared);
+		}
+		return (await prepared)(subject);
+	}
+};
+var EventReadsSource = class {
+	reactor;
+	documentView;
+	readGate;
+	current;
+	constructor(reactor, documentView, readGate) {
+		this.reactor = reactor;
+		this.documentView = documentView;
+		this.readGate = readGate;
+	}
+	forEvent() {
+		if (!this.current) {
+			this.current = new EventReads(this.reactor, this.documentView, this.readGate);
+			queueMicrotask(() => {
+				this.current = void 0;
+			});
+		}
+		return this.current;
+	}
+};
+//#endregion
 //#region src/client/util.ts
 function authSubjectFromSigner(signer) {
 	return {
@@ -980,10 +1150,23 @@ function authSubjectFromSigner(signer) {
 function withAuthScope(view) {
 	if (view?.scopes && view.scopes.length > 0) return {
 		...view,
-		scopes: [...new Set([...view.scopes, "auth"])]
+		scopes: [.../* @__PURE__ */ new Set([...view.scopes, "auth"])]
 	};
 	return view;
 }
+function withAllScopes(view) {
+	if (!view?.scopes) return view;
+	const { scopes: _narrowed, ...whole } = view;
+	return whole;
+}
+function narrowedScopes(view) {
+	if (!view?.scopes || view.scopes.length === 0) return;
+	return /* @__PURE__ */ new Set([
+		"document",
+		"auth",
+		...view.scopes
+	]);
+}
 /**
 * Drops the scopes the predicate refuses. The predicate is resolved by the read
 * gate, which decides against the whole policy once per document; this only
@@ -1056,6 +1239,7 @@ var ReactorClient = class {
 	documentIndexer;
 	documentView;
 	readGate;
+	eventReads;
 	actionEvaluation;
 	createSignaturePolicy;
 	drives;
@@ -1068,33 +1252,12 @@ var ReactorClient = class {
 		this.documentIndexer = documentIndexer;
 		this.documentView = documentView;
 		this.readGate = readGate;
+		this.eventReads = new EventReadsSource(reactor, documentView, readGate);
 		this.actionEvaluation = actionEvaluation;
 		this.createSignaturePolicy = createSignaturePolicy;
 		this.drives = new DriveClient(this, logger, reactor, signer);
 		this.logger.verbose("ReactorClient initialized");
 	}
-	readSubject(subject) {
-		return subject ?? authSubjectFromSigner(this.signer);
-	}
-	/**
-	* Which scopes of one document the subject may read. Resolved once per
-	* document, so the gate builds its model once however many scopes are then
-	* tested, and the filtering itself stays synchronous.
-	*/
-	readableScopes(document, view, signal) {
-		return this.readGate.scopePredicate(document, this.readSubject(view?.subject), view?.branch ?? "main", signal);
-	}
-	/**
-	* One document, filtered to the scopes the subject may read. Every method
-	* that hands a document back goes through here, including the ones that
-	* follow a write: a document returned from a mutation is a read like any
-	* other, and returning it whole served scopes the same subject would be
-	* refused by `get`. Its author still sees what it wrote, because an allow on
-	* execute confers read of that scope.
-	*/
-	async gateDocument(document, view, signal) {
-		return filterReadableScopes(document, await this.readableScopes(document, view, signal));
-	}
 	/**
 	* Retrieves a list of document model modules.
 	*/
@@ -1160,7 +1323,7 @@ var ReactorClient = class {
 	/** True when the id is taken; a soft-deleted document's id is still taken. */
 	async isDocumentIdTaken(documentId, signal) {
 		this.logger.verbose("isDocumentIdTaken(@documentId)", documentId);
-		return (await this.documentView.exists([documentId], DocumentExistence.IncludingDeleted, void 0, signal))[0];
+		return (await this.documentView.exists([documentId], "IncludingDeleted", void 0, signal))[0];
 	}
 	/**
 	* Retrieves operations for a document
@@ -1200,31 +1363,6 @@ var ReactorClient = class {
 			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
 		};
 	}
-	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
-		const scopeCursors = decodeCompositeCursor(paging.cursor);
-		const allOperations = [];
-		const activeCursors = {};
-		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
-			if (!canRead(scopeName)) continue;
-			const scopeView = {
-				...view,
-				scopes: [scopeName]
-			};
-			const scopePaging = {
-				cursor,
-				limit: paging.limit
-			};
-			const scopeResult = (await this.reactor.getOperations(documentId, scopeView, filter, scopePaging, void 0, signal))[scopeName];
-			allOperations.push(...scopeResult.results);
-			if (scopeResult.nextCursor) activeCursors[scopeName] = scopeResult.nextCursor;
-		}
-		allOperations.sort((a, b) => a.index - b.index);
-		return {
-			results: allOperations,
-			options: paging,
-			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
-		};
-	}
 	/**
 	* Retrieves outgoing relationships of a given type from a source document.
 	*/
@@ -1278,68 +1416,24 @@ var ReactorClient = class {
 		return this.gateEdges(edges, "sourceId", view, signal);
 	}
 	/**
-	* Drops the edges whose far-end document the subject may read no domain scope
-	* of. An edge is withheld whole rather than stripped of its metadata: the
-	* document-shaped relationship reads already answer with the far end stripped
-	* to the scopes the gate allows, so the far end's existence is disclosed
-	* either way, but an edge's metadata is content about the pair that the far
-	* end's own reads would refuse. An edge to a far end stripped to nothing
-	* therefore carries content past a refusal, and there is no useful shell to
-	* hand back in its place.
-	*
-	* `nextCursor` and `options` are left as the underlying stream reported them,
-	* because a caller must feed them back to resume from the right position. A
-	* gated page can therefore be shorter than the limit it asked for.
-	*/
-	async gateEdges(page, farEnd, view, signal) {
-		const ids = [...new Set(page.results.map((edge) => edge[farEnd]))];
-		if (ids.length === 0) return page;
-		const farEndView = {
-			subject: view?.subject,
-			branch: view?.branch
-		};
-		const documents = await this.reactor.find({ ids }, farEndView, {
-			cursor: "0",
-			limit: ids.length
-		}, void 0, signal);
-		const readable = new Map(await Promise.all(documents.results.map(async (doc) => {
-			const allows = await this.readableScopes(doc, view, signal);
-			const domainScopes = Object.keys(doc.state).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope));
-			return [doc.header.id, domainScopes.length === 0 || domainScopes.some(allows)];
-		})));
-		const results = page.results.filter((edge) => readable.get(edge[farEnd]) !== false);
-		if (results.length === page.results.length) return page;
-		const nextPage = page.next;
-		return {
-			...page,
-			results,
-			next: nextPage ? async () => this.gateEdges(await nextPage(), farEnd, view, signal) : void 0
-		};
-	}
-	/**
-	* One relationship edge, or undefined when it does not exist. A point lookup:
-	* the pair is filtered in SQL rather than scanned out of the source's edge
-	* list, which on a drive with thousands of children is the difference between
-	* one query and dozens.
-	*/
-	async readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, view, signal) {
-		const sourceId = await this.documentView.resolveIdOrSlug(sourceIdentifier, view, void 0, signal);
-		const targetId = await this.documentView.resolveIdOrSlug(targetIdentifier, view, void 0, signal);
-		return (await this.documentIndexer.getDirectedRelationships(sourceId, targetId, [relationshipType], {
-			cursor: "0",
-			limit: 1
-		}, void 0, signal)).results[0];
-	}
-	/**
 	* Filters documents by criteria and returns a list of them
 	*/
 	async find(search, view, paging, signal) {
 		this.logger.verbose("find(@search, @view, @paging)", search, view, paging);
 		const results = await this.reactor.find(search, withAuthScope(view), paging, void 0, signal);
-		return {
-			...results,
-			results: await Promise.all(results.results.map(async (doc) => filterReadableScopes(doc, await this.readableScopes(doc, view, signal))))
-		};
+		return this.gateListing(results, view, signal);
+	}
+	/** Whether `find` would serve the document; false when it is absent. */
+	async isServed(identifier, view, signal) {
+		this.logger.verbose("isServed(@identifier, @view)", identifier, view);
+		let document;
+		try {
+			document = await this.reactor.getByIdOrSlug(identifier, withAuthScope(view), void 0, signal);
+		} catch (error) {
+			await assertAbsent(this.documentView, identifier, error, signal);
+			return false;
+		}
+		return await this.gateListed(document, view, signal) !== void 0;
 	}
 	/**
 	* Predicts the admission verdict for each candidate. See
@@ -1380,39 +1474,6 @@ var ReactorClient = class {
 			anyDenied: allowed < candidates.length
 		};
 	}
-	/**
-	* The decision model for one target document, built at its stream heads.
-	*
-	* The document is fetched unfiltered, because the policy is what decides:
-	* reading it through the read gate would withhold the very scopes the
-	* decision is about. A deleted document is served at its deletion boundary,
-	* which is what lets the model refuse an execute against it -- authEnforcement
-	* requires documentDecisions, so that read is available whenever this runs.
-	*
-	* Reading past the gate discloses nothing a submit does not. The `auth` and
-	* `document` scopes are readable by every holder, so a verdict resting on the
-	* policy alone is one the caller could compute unaided; and a verdict resting
-	* on a conditional grant reads the executing scope's state exactly as
-	* admission reads it, so the answer here is what submitting and being refused
-	* would have revealed anyway.
-	*
-	* The append condition the build records is dropped. It guards a write, and
-	* this makes none; reproducing it is also what the preflight cannot do, which
-	* is why the answer is a prediction.
-	*/
-	async buildEvaluationTarget(config, documentId, branch, signal) {
-		const document = await this.documentView.get(documentId, { branch }, void 0, signal);
-		const target = {
-			documentId,
-			branch
-		};
-		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), config.model, target, signal);
-		return {
-			definition: config.model(target),
-			model: built.model,
-			scopeStates: document.state ?? {}
-		};
-	}
 	getCreateSignaturePolicy() {
 		return Promise.resolve(this.createSignaturePolicy);
 	}
@@ -1423,7 +1484,7 @@ var ReactorClient = class {
 		this.logger.verbose("create(@id, @parentIdentifier)", document.header.id, parentIdentifier);
 		const documentId = document.header.id;
 		const branch = document.header.branch || "main";
-		const createActions = await signActions([createDocumentAction({
+		const createInput = {
 			model: document.header.documentType,
 			version: 0,
 			documentId,
@@ -1439,7 +1500,8 @@ var ReactorClient = class {
 			branch: document.header.branch,
 			meta: document.header.meta,
 			protocolVersions: document.header.protocolVersions ?? { "base-reducer": 2 }
-		}), upgradeDocumentAction({
+		};
+		const createActions = await signActions([createDocumentAction(createInput), upgradeDocumentAction({
 			documentId,
 			model: document.header.documentType,
 			fromVersion: 0,
@@ -1473,7 +1535,7 @@ var ReactorClient = class {
 		}
 		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
+		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
 		const created = await this.reactor.get(documentId);
 		return this.gateDocument(created, void 0, signal);
 	}
@@ -1521,22 +1583,26 @@ var ReactorClient = class {
 			const branch = document.header.branch || "main";
 			const fromVersion = normalizeDocumentModelVersion(document.state.document?.version);
 			let targetVersion = toVersion;
-			if (targetVersion === void 0) targetVersion = normalizeDocumentModelVersion((await this.getDocumentModelModule(documentType)).version);
+			if (targetVersion === void 0) {
+				const module = await this.getDocumentModelModule(documentType);
+				targetVersion = normalizeDocumentModelVersion(module.version);
+			}
 			if (targetVersion === fromVersion) return this.gateDocument(document, { branch }, signal);
 			if (targetVersion < fromVersion) throw new DowngradeNotSupportedError(documentType, fromVersion, targetVersion);
-			const signedActions = await signActions([upgradeDocumentAction({
+			const action = upgradeDocumentAction({
 				documentId,
 				model: documentType,
 				fromVersion,
 				toVersion: targetVersion,
 				revision: { ...document.header.revision }
-			})], this.signer, {
+			});
+			const signedActions = await signActions([action], this.signer, {
 				documentId,
 				branch
 			}, signal);
 			const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
 			const completedJob = await this.waitForJob(jobInfo, signal);
-			if (completedJob.status !== JobStatus.FAILED) {
+			if (completedJob.status !== "FAILED") {
 				const upgraded = await this.reactor.getByIdOrSlug(documentId, { branch }, completedJob.consistencyToken, signal);
 				return this.gateDocument(upgraded, { branch }, signal);
 			}
@@ -1570,7 +1636,7 @@ var ReactorClient = class {
 		}, signal);
 		const jobInfo = await this.reactor.execute(documentId, branch, signedActions, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
-		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		const view = {
 			branch,
 			subject
@@ -1590,18 +1656,6 @@ var ReactorClient = class {
 		}, signal);
 		return this.reactor.execute(documentId, branch, signedActions, signal);
 	}
-	/**
-	* The id a write on `identifier` is stored under, which its signatures bind.
-	* A create names its own id, and an id no slug maps to is taken as given, so
-	* a document still in flight resolves to itself.
-	*/
-	async resolveWriteTarget(identifier, branch, actions, signal) {
-		if (actions.some((action) => action.type === "CREATE_DOCUMENT")) return identifier;
-		const view = { branch };
-		const bySlug = await this.documentView.resolveSlug(identifier, view, void 0, signal);
-		if (bySlug === void 0 || bySlug === identifier) return identifier;
-		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
-	}
 	async executeBatch(request, signal) {
 		this.logger.verbose("executeBatch(@count jobs)", request.jobs.length);
 		const signedJobs = await Promise.all(request.jobs.map(async (job) => {
@@ -1617,7 +1671,7 @@ var ReactorClient = class {
 		}));
 		const batchResult = await this.reactor.executeBatch({ jobs: signedJobs }, signal);
 		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === JobStatus.FAILED) throw new Error(job.error?.message);
+		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
 		return batchResult;
 	}
 	/**
@@ -1642,7 +1696,7 @@ var ReactorClient = class {
 		this.logger.verbose("addRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @metadata, @branch)", sourceIdentifier, targetIdentifier, relationshipType, metadata, branch);
 		const jobInfo = await this.reactor.addRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
-		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
 		return this.gateDocument(result, { branch }, signal);
 	}
@@ -1654,7 +1708,7 @@ var ReactorClient = class {
 		if (!await this.readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, { branch }, signal)) throw new RelationshipNotFoundError(sourceIdentifier, targetIdentifier, relationshipType);
 		const jobInfo = await this.reactor.updateRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
-		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
 		return this.gateDocument(result, { branch }, signal);
 	}
@@ -1665,7 +1719,7 @@ var ReactorClient = class {
 		this.logger.verbose("removeRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @branch)", sourceIdentifier, targetIdentifier, relationshipType, branch);
 		const jobInfo = await this.reactor.removeRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
-		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
 		return this.gateDocument(result, { branch }, signal);
 	}
@@ -1677,10 +1731,10 @@ var ReactorClient = class {
 		const metadata = (await this.readRelationshipEdge(sourceParentIdentifier, targetIdentifier, relationshipType, { branch }, signal))?.metadata;
 		const removeJobInfo = await this.reactor.removeRelationship(sourceParentIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const removeCompletedJob = await this.waitForJob(removeJobInfo, signal);
-		if (removeCompletedJob.status === JobStatus.FAILED) throw new Error(removeCompletedJob.error?.message);
+		if (removeCompletedJob.status === "FAILED") throw new Error(removeCompletedJob.error?.message);
 		const addJobInfo = await this.reactor.addRelationship(targetParentIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
 		const addCompletedJob = await this.waitForJob(addJobInfo, signal);
-		if (addCompletedJob.status === JobStatus.FAILED) throw new Error(addCompletedJob.error?.message);
+		if (addCompletedJob.status === "FAILED") throw new Error(addCompletedJob.error?.message);
 		const sourceResult = await this.reactor.getByIdOrSlug(sourceParentIdentifier, { branch }, removeCompletedJob.consistencyToken, signal);
 		const targetResult = await this.reactor.getByIdOrSlug(targetParentIdentifier, { branch }, addCompletedJob.consistencyToken, signal);
 		return {
@@ -1694,7 +1748,7 @@ var ReactorClient = class {
 		const completedJobs = await Promise.all(Object.entries(result.jobs).map(async ([key, jobInfo]) => {
 			return [key, await this.waitForJob(jobInfo, signal)];
 		}));
-		for (const [, completedJob] of completedJobs) if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		for (const [, completedJob] of completedJobs) if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 		return { jobs: Object.fromEntries(completedJobs) };
 	}
 	/**
@@ -1703,8 +1757,8 @@ var ReactorClient = class {
 	async deleteDocument(identifier, propagate, signal) {
 		this.logger.verbose("deleteDocument(@identifier, @propagate)", identifier, propagate);
 		const jobs = [];
-		if (propagate === PropagationMode.Cascade) {
-			const toDelete = new Set([identifier]);
+		if (propagate === "cascade") {
+			const toDelete = /* @__PURE__ */ new Set([identifier]);
 			let changed = true;
 			while (changed) {
 				if (signal?.aborted) throw new Error("Operation aborted");
@@ -1728,7 +1782,7 @@ var ReactorClient = class {
 		const jobInfo = await this.reactor.deleteDocument(identifier, this.signer, signal);
 		jobs.push(jobInfo);
 		const completedJobs = await Promise.all(jobs.map((job) => this.waitForJob(job, signal)));
-		for (const completedJob of completedJobs) if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		for (const completedJob of completedJobs) if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 	}
 	/**
 	* Deletes documents and waits for completion
@@ -1758,7 +1812,13 @@ var ReactorClient = class {
 	*/
 	subscribe(search, callback, view) {
 		this.logger.verbose("subscribe(@search, @view)", search, view);
-		const readable = async (document) => filterReadableScopes(document, await this.readableScopes(document, view));
+		const served = async (type, documents, reads) => {
+			const documentsServed = await this.gateServedAll(documents, view, void 0, reads);
+			return documentsServed.length > 0 ? {
+				type,
+				documents: documentsServed
+			} : void 0;
+		};
 		let disposed = false;
 		let delivering = Promise.resolve();
 		/**
@@ -1772,49 +1832,46 @@ var ReactorClient = class {
 		* gated is withheld, because serving it unfiltered would leak the scopes
 		* the gate did not clear -- but it is logged rather than swallowed, since
 		* the gate rethrows a transient failure precisely so it is not read as a
-		* denial.
+		* denial. An event that resolves to undefined was withheld.
 		*/
 		const deliver = (event) => {
 			Promise.resolve(event).catch(() => void 0);
 			delivering = delivering.then(async () => {
 				const built = await event;
-				if (disposed) return;
+				if (disposed || !built) return;
 				callback(built);
 			}).catch((error) => {
 				this.logger.error("Subscription delivery failed for @search: @Error", { search }, error);
 			});
 		};
 		const unsubscribeCreated = this.subscriptionManager.onDocumentCreated((result) => {
+			const reads = this.eventReads.forEvent();
 			deliver((async () => {
-				const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, withAuthScope(view), void 0, void 0)));
-				return {
-					type: DocumentChangeType.Created,
-					documents: await Promise.all(documents.map(readable))
-				};
+				const documents = await Promise.all(result.results.map((id) => reads.get(id, withAllScopes(view))));
+				return served("created", documents, reads);
 			})());
 		}, search);
 		const unsubscribeDeleted = this.subscriptionManager.onDocumentDeleted((documentIds) => {
-			deliver({
-				type: DocumentChangeType.Deleted,
+			const reads = this.eventReads.forEvent();
+			for (const childId of documentIds) deliver((async () => await this.servesEvery([childId], view, reads) ? {
+				type: "deleted",
 				documents: [],
-				context: { childId: documentIds[0] }
-			});
+				context: { childId }
+			} : void 0)());
 		}, search);
 		const unsubscribeUpdated = this.subscriptionManager.onDocumentStateUpdated((result) => {
-			deliver((async () => ({
-				type: DocumentChangeType.Updated,
-				documents: await Promise.all(result.results.map(readable))
-			}))());
+			deliver(served("updated", result.results, this.eventReads.forEvent()));
 		}, search, view);
 		const unsubscribeRelationship = this.subscriptionManager.onRelationshipChanged((parentId, childId, changeType) => {
-			deliver({
-				type: changeType === RelationshipChangeType.Added ? DocumentChangeType.ChildAdded : DocumentChangeType.ChildRemoved,
+			const reads = this.eventReads.forEvent();
+			deliver((async () => await this.servesEvery([parentId, childId], view, reads) ? {
+				type: changeType === "added" ? "child_added" : "child_removed",
 				documents: [],
 				context: {
 					parentId,
 					childId
 				}
-			});
+			} : void 0)());
 		}, search);
 		return () => {
 			disposed = true;
@@ -1824,6 +1881,225 @@ var ReactorClient = class {
 			unsubscribeRelationship();
 		};
 	}
+	readSubject(subject) {
+		return subject ?? authSubjectFromSigner(this.signer);
+	}
+	/**
+	* Which scopes of one document the subject may read. Resolved once per
+	* document, so the gate builds its model once however many scopes are then
+	* tested, and the filtering itself stays synchronous.
+	*/
+	readableScopes(document, view, signal, reads) {
+		const subject = this.readSubject(view?.subject);
+		const branch = view?.branch ?? "main";
+		return reads ? reads.scopePredicate(document, subject, branch) : this.readGate.scopePredicate(document, subject, branch, signal);
+	}
+	/**
+	* One document, filtered to the scopes the subject may read. Every method
+	* that hands a document back goes through here, including the ones that
+	* follow a write: a document returned from a mutation is a read like any
+	* other, and returning it whole served scopes the same subject would be
+	* refused by `get`. Its author still sees what it wrote, because an allow on
+	* execute confers read of that scope.
+	*/
+	async gateDocument(document, view, signal) {
+		return filterReadableScopes(document, await this.readableScopes(document, view, signal));
+	}
+	/**
+	* One document as a listing or a feed serves it, or undefined when withheld.
+	* The document must hold every scope, or withholding is decided on a subset;
+	* a narrowing view is applied here instead.
+	*/
+	async gateServed(document, view, signal, reads) {
+		const readable = await this.readableScopes(document, view, signal, reads);
+		if (refusesEveryDomainScope(document, readable)) return;
+		const narrowed = narrowedScopes(view);
+		return filterReadableScopes(document, narrowed ? (scope) => readable(scope) && narrowed.has(scope) : readable);
+	}
+	async gateServedAll(documents, view, signal, reads) {
+		return (await Promise.all(documents.map((document) => this.gateServed(document, view, signal, reads)))).filter((document) => document !== void 0);
+	}
+	/**
+	* Gates a page and every page after it. `nextCursor` is left as the stream
+	* reported it.
+	*/
+	async gateListing(page, view, signal) {
+		const results = (await Promise.all(page.results.map((document) => this.gateListed(document, view, signal)))).filter((document) => document !== void 0);
+		const next = page.next;
+		return {
+			...page,
+			results,
+			next: next ? async () => this.gateListing(await next(), view, signal) : void 0
+		};
+	}
+	/**
+	* One document as a listing serves it, or undefined when withheld. It holds
+	* only the view's scopes; a domain scope it lacks is decided on its name, or
+	* on its state read now when a condition needs that.
+	*/
+	async gateListed(document, view, signal) {
+		const readable = await this.readableScopes(document, view, signal);
+		const unheld = unheldScopesReadOnState(document);
+		if (refusesEveryDomainScope(document, unheld.length === 0 ? readable : (scope) => !unheld.includes(scope) && readable(scope)) && !await this.servesUnheld(document, unheld, view, signal)) return;
+		return filterReadableScopes(document, readable);
+	}
+	async servesUnheld(document, scopes, view, signal) {
+		if (scopes.length === 0) return false;
+		const id = document.header.id;
+		let held;
+		try {
+			held = await this.reactor.get(id, withAuthScope({
+				...view,
+				scopes
+			}), void 0, signal);
+		} catch (error) {
+			await assertAbsent(this.documentView, id, error, signal);
+			return false;
+		}
+		const readable = await this.readableScopes(held, view, signal);
+		return scopes.some(readable);
+	}
+	/**
+	* Whether an event naming only these ids may reach the subject. An id with no
+	* live document behind it has no content left to protect, so it does not
+	* withhold; a deleted document is read at its deletion boundary when
+	* deletion is positional, and gated like any other.
+	*/
+	async servesEvery(ids, view, reads) {
+		return (await Promise.all(ids.map((id) => this.servesId(id, view, reads)))).every(Boolean);
+	}
+	async servesId(id, view, reads) {
+		let document;
+		try {
+			document = await reads.get(id, withAllScopes(view));
+		} catch (error) {
+			await assertAbsent(reads, id, error);
+			return true;
+		}
+		return !refusesEveryDomainScope(document, await this.readableScopes(document, view, void 0, reads));
+	}
+	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
+		const scopeCursors = decodeCompositeCursor(paging.cursor);
+		const allOperations = [];
+		const activeCursors = {};
+		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
+			if (!canRead(scopeName)) continue;
+			const scopeView = {
+				...view,
+				scopes: [scopeName]
+			};
+			const scopePaging = {
+				cursor,
+				limit: paging.limit
+			};
+			const scopeResult = (await this.reactor.getOperations(documentId, scopeView, filter, scopePaging, void 0, signal))[scopeName];
+			allOperations.push(...scopeResult.results);
+			if (scopeResult.nextCursor) activeCursors[scopeName] = scopeResult.nextCursor;
+		}
+		allOperations.sort((a, b) => a.index - b.index);
+		return {
+			results: allOperations,
+			options: paging,
+			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
+		};
+	}
+	/**
+	* Drops the edges whose far-end document the subject may read no domain scope
+	* of. An edge is withheld whole rather than stripped of its metadata: the
+	* document-shaped relationship reads already answer with the far end stripped
+	* to the scopes the gate allows, so the far end's existence is disclosed
+	* either way, but an edge's metadata is content about the pair that the far
+	* end's own reads would refuse. An edge to a far end stripped to nothing
+	* therefore carries content past a refusal, and there is no useful shell to
+	* hand back in its place.
+	*
+	* `nextCursor` and `options` are left as the underlying stream reported them,
+	* because a caller must feed them back to resume from the right position. A
+	* gated page can therefore be shorter than the limit it asked for.
+	*/
+	async gateEdges(page, farEnd, view, signal) {
+		const ids = [...new Set(page.results.map((edge) => edge[farEnd]))];
+		if (ids.length === 0) return page;
+		const farEndView = {
+			subject: view?.subject,
+			branch: view?.branch
+		};
+		const documents = await this.reactor.find({ ids }, farEndView, {
+			cursor: "0",
+			limit: ids.length
+		}, void 0, signal);
+		const readable = new Map(await Promise.all(documents.results.map(async (doc) => {
+			const allows = await this.readableScopes(doc, view, signal);
+			return [doc.header.id, !refusesEveryDomainScope(doc, allows)];
+		})));
+		const results = page.results.filter((edge) => readable.get(edge[farEnd]) !== false);
+		if (results.length === page.results.length) return page;
+		const nextPage = page.next;
+		return {
+			...page,
+			results,
+			next: nextPage ? async () => this.gateEdges(await nextPage(), farEnd, view, signal) : void 0
+		};
+	}
+	/**
+	* One relationship edge, or undefined when it does not exist. A point lookup:
+	* the pair is filtered in SQL rather than scanned out of the source's edge
+	* list, which on a drive with thousands of children is the difference between
+	* one query and dozens.
+	*/
+	async readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, view, signal) {
+		const sourceId = await this.documentView.resolveIdOrSlug(sourceIdentifier, view, void 0, signal);
+		const targetId = await this.documentView.resolveIdOrSlug(targetIdentifier, view, void 0, signal);
+		return (await this.documentIndexer.getDirectedRelationships(sourceId, targetId, [relationshipType], {
+			cursor: "0",
+			limit: 1
+		}, void 0, signal)).results[0];
+	}
+	/**
+	* The id a write on `identifier` is stored under, which its signatures bind.
+	* A create names its own id, and an id no slug maps to is taken as given, so
+	* a document still in flight resolves to itself.
+	*/
+	async resolveWriteTarget(identifier, branch, actions, signal) {
+		if (actions.some((action) => action.type === "CREATE_DOCUMENT")) return identifier;
+		const view = { branch };
+		const bySlug = await this.documentView.resolveSlug(identifier, view, void 0, signal);
+		if (bySlug === void 0 || bySlug === identifier) return identifier;
+		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
+	}
+	/**
+	* The decision model for one target document, built at its stream heads.
+	*
+	* The document is fetched unfiltered, because the policy is what decides:
+	* reading it through the read gate would withhold the very scopes the
+	* decision is about. A deleted document is served at its deletion boundary,
+	* which is what lets the model refuse an execute against it -- authEnforcement
+	* requires documentDecisions, so that read is available whenever this runs.
+	*
+	* Reading past the gate discloses nothing a submit does not. The `auth` and
+	* `document` scopes are readable by every holder, so a verdict resting on the
+	* policy alone is one the caller could compute unaided; and a verdict resting
+	* on a conditional grant reads the executing scope's state exactly as
+	* admission reads it, so the answer here is what submitting and being refused
+	* would have revealed anyway.
+	*
+	* The append condition the build records is dropped. It guards a write, and
+	* this makes none; reproducing it is also what the preflight cannot do, which
+	* is why the answer is a prediction.
+	*/
+	async buildEvaluationTarget(config, documentId, branch, signal) {
+		const document = await this.documentView.get(documentId, { branch }, void 0, signal);
+		const target = {
+			documentId,
+			branch
+		};
+		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), config.model, target, signal);
+		return {
+			definition: config.model(target),
+			model: built.model,
+			scopeStates: document.state ?? {}
+		};
+	}
 	async removeAllIncomingRelationships(documentId, signal) {
 		const incoming = await this.documentIndexer.getIncoming(documentId, void 0, void 0, void 0, signal);
 		const jobs = [];
@@ -1837,18 +2113,6 @@ var ReactorClient = class {
 //#endregion
 //#region src/queue/types.ts
 /**
-* State of a job in the queue
-*/
-let JobQueueState = /* @__PURE__ */ function(JobQueueState) {
-	JobQueueState[JobQueueState["UNKNOWN"] = -1] = "UNKNOWN";
-	JobQueueState[JobQueueState["PREPROCESSING"] = 0] = "PREPROCESSING";
-	JobQueueState[JobQueueState["PENDING"] = 1] = "PENDING";
-	JobQueueState[JobQueueState["READY"] = 2] = "READY";
-	JobQueueState[JobQueueState["RUNNING"] = 3] = "RUNNING";
-	JobQueueState[JobQueueState["RESOLVED"] = 4] = "RESOLVED";
-	return JobQueueState;
-}({});
-/**
 * How a retry is accounted against the job's retry limit.
 * - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
 *   retries and fails terminally.
@@ -1881,6 +2145,11 @@ function toErrorInfo(error) {
 	};
 }
 var JobResultHandler = class {
+	queue;
+	jobTracker;
+	eventBus;
+	resolver;
+	logger;
 	constructor(queue, jobTracker, eventBus, resolver, logger) {
 		this.queue = queue;
 		this.jobTracker = jobTracker;
@@ -1911,7 +2180,7 @@ var JobResultHandler = class {
 		if (result.error && AppendConditionFailedError.isError(result.error) && this.countConflicts(handle.job) < MAX_EXEMPT_CONFLICT_RETRIES) {
 			const errorInfo = toErrorInfo(result.error);
 			try {
-				await this.queue.retryJob(handle.job.id, errorInfo, RetryAccounting.ExemptFromLimit);
+				await this.queue.retryJob(handle.job.id, errorInfo, "exempt-from-limit");
 				return;
 			} catch {}
 		}
@@ -2009,6 +2278,12 @@ var JobResultHandler = class {
 * is stranded at PENDING for as long as the deferral lasts.
 */
 var DeferredJobs = class {
+	queue;
+	jobTracker;
+	eventBus;
+	logger;
+	ttlMs;
+	onReleased;
 	#byDocumentId = /* @__PURE__ */ new Map();
 	#timers = /* @__PURE__ */ new Map();
 	constructor(queue, jobTracker, eventBus, logger, ttlMs = DEFAULT_DEFERRED_JOB_TTL_MS, onReleased = () => Promise.resolve()) {
@@ -2170,6 +2445,13 @@ function bucketFor(documentId, numWorkers) {
 *   (Powerhouse board wiki id: d400d711-f07e-4389-a226-4e9fdd4fa8ba)
 */
 var WorkerPoolJobExecutorManager = class {
+	workerFactory;
+	eventBus;
+	queue;
+	jobTracker;
+	logger;
+	resolver;
+	operationIndex;
 	workers = [];
 	isRunning = false;
 	activeJobs = 0;
@@ -2434,6 +2716,12 @@ function fillMissingMemberships(documentIds, found) {
 * Listens for job available events and dispatches jobs to executors.
 */
 var SimpleJobExecutorManager = class {
+	executorFactory;
+	eventBus;
+	queue;
+	jobTracker;
+	logger;
+	resolver;
 	executors = [];
 	isRunning = false;
 	activeJobs = 0;
@@ -2608,6 +2896,7 @@ var SimpleJobExecutorManager = class {
 * Subscribes to operation events to update job states.
 */
 var InMemoryJobTracker = class {
+	eventBus;
 	jobs = /* @__PURE__ */ new Map();
 	unsubscribers = [];
 	constructor(eventBus) {
@@ -2628,11 +2917,11 @@ var InMemoryJobTracker = class {
 	handleWriteReady(event) {
 		const jobId = event.jobId;
 		const job = this.jobs.get(jobId);
-		if (job && job.status === JobStatus.RUNNING) {
+		if (job && job.status === "RUNNING") {
 			const consistencyToken = createConsistencyToken(event.operations);
 			this.jobs.set(jobId, {
 				...job,
-				status: JobStatus.WRITE_READY,
+				status: "WRITE_READY",
 				consistencyToken,
 				result: summarizeSubmittedActions(event.operations, event.submittedActionIds)
 			});
@@ -2641,9 +2930,9 @@ var InMemoryJobTracker = class {
 	handleReadReady(event) {
 		const jobId = event.jobId;
 		const job = this.jobs.get(jobId);
-		if (job && job.status === JobStatus.WRITE_READY) this.jobs.set(jobId, {
+		if (job && job.status === "WRITE_READY") this.jobs.set(jobId, {
 			...job,
-			status: JobStatus.READ_READY
+			status: "READ_READY"
 		});
 	}
 	handleJobFailed(event) {
@@ -2666,7 +2955,7 @@ var InMemoryJobTracker = class {
 			this.jobs.set(jobId, {
 				id: jobId,
 				documentId: "",
-				status: JobStatus.RUNNING,
+				status: "RUNNING",
 				createdAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
 				consistencyToken: createEmptyConsistencyToken(),
 				meta: {
@@ -2678,7 +2967,7 @@ var InMemoryJobTracker = class {
 		}
 		this.jobs.set(jobId, {
 			...job,
-			status: JobStatus.RUNNING
+			status: "RUNNING"
 		});
 	}
 	markFailed(jobId, error, job) {
@@ -2687,7 +2976,7 @@ var InMemoryJobTracker = class {
 			this.jobs.set(jobId, {
 				id: jobId,
 				documentId: job?.documentId ?? "",
-				status: JobStatus.FAILED,
+				status: "FAILED",
 				createdAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
 				completedAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
 				error,
@@ -2702,7 +2991,7 @@ var InMemoryJobTracker = class {
 		}
 		this.jobs.set(jobId, {
 			...existing,
-			status: JobStatus.FAILED,
+			status: "FAILED",
 			completedAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
 			error,
 			job,
@@ -2796,6 +3085,7 @@ function highestOf(ops) {
 	return highest;
 }
 var ProcessorQueue = class {
+	options;
 	tasks = [];
 	running = false;
 	closed = false;
@@ -3378,11 +3668,11 @@ var JobExecutionHandle = class {
 	onDefer;
 	getStateName(state) {
 		switch (state) {
-			case JobQueueState.PREPROCESSING: return "PREPROCESSING";
-			case JobQueueState.PENDING: return "PENDING";
-			case JobQueueState.READY: return "READY";
-			case JobQueueState.RUNNING: return "RUNNING";
-			case JobQueueState.RESOLVED: return "RESOLVED";
+			case 0: return "PREPROCESSING";
+			case 1: return "PENDING";
+			case 2: return "READY";
+			case 3: return "RUNNING";
+			case 4: return "RESOLVED";
 			default: return `UNKNOWN`;
 		}
 	}
@@ -3401,23 +3691,23 @@ var JobExecutionHandle = class {
 		return this._state;
 	}
 	start() {
-		if (this._state !== JobQueueState.READY) throw new Error(`Cannot start job in state ${this.getStateName(this._state)}`);
-		this._state = JobQueueState.RUNNING;
+		if (this._state !== 2) throw new Error(`Cannot start job in state ${this.getStateName(this._state)}`);
+		this._state = 3;
 		this.onStart?.();
 	}
 	complete() {
-		if (this._state !== JobQueueState.RUNNING) throw new Error(`Cannot complete job in state ${this.getStateName(this._state)}`);
-		this._state = JobQueueState.RESOLVED;
+		if (this._state !== 3) throw new Error(`Cannot complete job in state ${this.getStateName(this._state)}`);
+		this._state = 4;
 		this.onComplete?.();
 	}
 	fail(error) {
-		if (this._state !== JobQueueState.RUNNING) throw new Error(`Cannot fail job in state ${this.getStateName(this._state)}`);
-		this._state = JobQueueState.RESOLVED;
+		if (this._state !== 3) throw new Error(`Cannot fail job in state ${this.getStateName(this._state)}`);
+		this._state = 4;
 		this.onFail?.(error);
 	}
 	defer() {
-		if (this._state !== JobQueueState.RUNNING) throw new Error(`Cannot defer job in state ${this.getStateName(this._state)}`);
-		this._state = JobQueueState.RESOLVED;
+		if (this._state !== 3) throw new Error(`Cannot defer job in state ${this.getStateName(this._state)}`);
+		this._state = 4;
 		this.onDefer?.();
 	}
 };
@@ -3430,6 +3720,8 @@ var JobExecutionHandle = class {
 * Implements dependency management through queue hints.
 */
 var InMemoryQueue = class {
+	eventBus;
+	resolver;
 	queues = /* @__PURE__ */ new Map();
 	jobIdToQueueKey = /* @__PURE__ */ new Map();
 	docIdToJobId = /* @__PURE__ */ new Map();
@@ -3564,7 +3856,7 @@ var InMemoryQueue = class {
 		this.jobIdToQueueKey.delete(job.id);
 		this.markJobExecuting(job);
 		if (queue.length === 0) this.queues.delete(queueKey);
-		const handle = new JobExecutionHandle(job, JobQueueState.READY, {
+		const handle = new JobExecutionHandle(job, 2, {
 			onStart: () => {},
 			onComplete: () => {
 				this.completeJob(job.id);
@@ -3590,7 +3882,7 @@ var InMemoryQueue = class {
 				this.jobIdToQueueKey.delete(job.id);
 				this.markJobExecuting(job);
 				if (queue.length === 0) this.queues.delete(queueKey);
-				const handle = new JobExecutionHandle(job, JobQueueState.READY, {
+				const handle = new JobExecutionHandle(job, 2, {
 					onStart: () => {},
 					onComplete: () => {
 						this.completeJob(job.id);
@@ -3624,7 +3916,7 @@ var InMemoryQueue = class {
 			this.jobIdToQueueKey.delete(job.id);
 			this.markJobExecuting(job);
 			if (queue.length === 0) this.queues.delete(queueKey);
-			const handle = new JobExecutionHandle(job, JobQueueState.READY, {
+			const handle = new JobExecutionHandle(job, 2, {
 				onStart: () => {},
 				onComplete: () => {
 					this.completeJob(job.id);
@@ -3726,7 +4018,7 @@ var InMemoryQueue = class {
 		if (documentId) this.markJobComplete(jobId, documentId);
 		this.jobIndex.delete(jobId);
 	}
-	async retryJob(jobId, error, accounting = RetryAccounting.CountAgainstLimit) {
+	async retryJob(jobId, error, accounting = "count-against-limit") {
 		const job = this.jobIndex.get(jobId);
 		if (!job) return;
 		job.lastError = error;
@@ -3738,7 +4030,7 @@ var InMemoryQueue = class {
 		const retryCount = job.retryCount || 0;
 		const updatedJob = {
 			...job,
-			retryCount: accounting === RetryAccounting.CountAgainstLimit ? retryCount + 1 : retryCount,
+			retryCount: accounting === "count-against-limit" ? retryCount + 1 : retryCount,
 			lastError: error
 		};
 		await this.enqueue(updatedJob);
@@ -3939,6 +4231,8 @@ function describeSource(source) {
 * and failure-caching state.
 */
 var DocumentModelResolver = class {
+	registry;
+	loader;
 	loadingModels = /* @__PURE__ */ new Map();
 	failedModelTypes = /* @__PURE__ */ new Set();
 	broadcastHook = null;
@@ -4009,6 +4303,7 @@ var DocumentModelResolver = class {
 * Since there is no loader, missing models cannot be recovered.
 */
 var NullDocumentModelResolver = class {
+	registry;
 	constructor(registry) {
 		this.registry = registry;
 	}
@@ -4232,6 +4527,8 @@ var ReactorSubscriptionManager = class {
 * is emitted, so that reactor.get() returns fresh data when callbacks fire.
 */
 var SubscriptionNotificationReadModel = class {
+	subscriptionManager;
+	documentView;
 	name = "subscription-notification";
 	constructor(subscriptionManager, documentView) {
 		this.subscriptionManager = subscriptionManager;
@@ -4254,10 +4551,10 @@ var SubscriptionNotificationReadModel = class {
 				deleted.push(deletedId);
 			} else if (actionType === "ADD_RELATIONSHIP") {
 				const input = operation.action.input;
-				this.subscriptionManager.notifyRelationshipChanged(input.sourceId, input.targetId, RelationshipChangeType.Added, input.childType);
+				this.subscriptionManager.notifyRelationshipChanged(input.sourceId, input.targetId, "added", input.childType);
 			} else if (actionType === "REMOVE_RELATIONSHIP") {
 				const input = operation.action.input;
-				this.subscriptionManager.notifyRelationshipChanged(input.sourceId, input.targetId, RelationshipChangeType.Removed, input.childType);
+				this.subscriptionManager.notifyRelationshipChanged(input.sourceId, input.targetId, "removed", input.childType);
 			} else if (!created.includes(context.documentId)) updatedIds.add(context.documentId);
 		}
 		if (created.length > 0) this.subscriptionManager.notifyDocumentsCreated(created, documentTypes, parentIds);
@@ -4282,6 +4579,10 @@ var SubscriptionNotificationReadModel = class {
 * keeps the common case (a membership write later than all history) free.
 */
 var GroupReevaluationTrigger = class {
+	logger;
+	eventBus;
+	queue;
+	operationIndex;
 	unsubscribe;
 	constructor(logger, eventBus, queue, operationIndex) {
 		this.logger = logger;
@@ -4433,7 +4734,7 @@ var Mailbox = class {
 			this.itemsMap.set(item.id, item);
 			for (const op of item.operations) this._latestOrdinal = Math.max(this._latestOrdinal, op.context.ordinal);
 			item.on((syncOp, _, next) => {
-				if (next === SyncOperationStatus.Applied) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
+				if (next === 2) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
 			});
 		}
 		if (this.paused) {
@@ -4547,7 +4848,7 @@ var BufferedMailbox = class {
 			this.itemsMap.set(item.id, item);
 			for (const op of item.operations) this._latestOrdinal = Math.max(this._latestOrdinal, op.context.ordinal);
 			item.on((syncOp, _, next) => {
-				if (next === SyncOperationStatus.Applied) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
+				if (next === 2) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
 			});
 		}
 		this.addedBuffer.push(...items);
@@ -4661,7 +4962,14 @@ var GraphQLRequestError = class extends Error {
 * difference between a channel that recovers and one that is dead for the
 * process lifetime.
 */
-const RECOVERABLE_GRAPHQL_ERROR_CODES = { malformedStoredOperation: "MALFORMED_STORED_OPERATION" };
+const RECOVERABLE_GRAPHQL_ERROR_CODES = { 
+/**
+* A stored operation cannot be represented in the schema - an action with no
+* id, say. The document holding it needs repairing, but the channel serves
+* every other document, and a peer that stopped polling would stop receiving
+* those too.
+*/
+malformedStoredOperation: "MALFORMED_STORED_OPERATION" };
 const RECOVERABLE_CODES = new Set(Object.values(RECOVERABLE_GRAPHQL_ERROR_CODES));
 /**
 * True when every error the response carried named a recoverable code.
@@ -4770,23 +5078,23 @@ var SyncOperation = class {
 		this.scopes = scopes;
 		this.branch = branch;
 		this.operations = operations;
-		this.status = SyncOperationStatus.Unknown;
+		this.status = -1;
 	}
 	on(callback) {
 		this.callbacks.push(callback);
 	}
 	started() {
-		this.transition(SyncOperationStatus.TransportPending);
+		this.transition(0);
 	}
 	transported() {
-		this.transition(SyncOperationStatus.ExecutionPending);
+		this.transition(1);
 	}
 	executed() {
-		this.transition(SyncOperationStatus.Applied);
+		this.transition(2);
 	}
 	failed(error) {
 		this.error = error;
-		this.transition(SyncOperationStatus.Error);
+		this.transition(3);
 	}
 	transition(next) {
 		const prev = this.status;
@@ -4996,9 +5304,11 @@ function consolidateSyncOperations(syncOps) {
 		}
 		const first = group.ops[0];
 		const merged = new SyncOperation(first.id, first.jobId, remappedDeps, first.remoteName, first.documentId, first.scopes, first.branch, allOperations);
-		if (first.status > SyncOperationStatus.TransportPending) if (first.status >= SyncOperationStatus.Error) merged.executed();
-		else if (first.status >= SyncOperationStatus.Applied) merged.transported();
-		else merged.started();
+		if (first.status > 0) {
+			if (first.status >= 3) merged.executed();
+			else if (first.status >= 2) merged.transported();
+			else merged.started();
+		}
 		result.push(merged);
 	}
 	return result;
@@ -5129,7 +5439,7 @@ function syncOperationErrorType(error) {
 	return error?.errorType ?? classifyJobFailure(error?.error?.name ?? "Error");
 }
 /** Dead-letter types that must not stop the document syncing. */
-const NON_QUARANTINING_ERROR_TYPES = new Set(["AUTH_TIMESTAMP_NOT_MONOTONIC"]);
+const NON_QUARANTINING_ERROR_TYPES = /* @__PURE__ */ new Set(["AUTH_TIMESTAMP_NOT_MONOTONIC"]);
 /**
 * A held auth operation must not quarantine: reconciling the two policies needs
 * the traffic a quarantine would stop.
@@ -5355,7 +5665,7 @@ function envelopesToSyncOperations(envelope, remoteName) {
 }
 const getLatestAppliedOrdinal = (syncOps) => {
 	let maxOrdinal = 0;
-	for (const syncOp of syncOps) if (syncOp.status === SyncOperationStatus.Applied) for (const op of syncOp.operations) maxOrdinal = Math.max(maxOrdinal, op.context.ordinal);
+	for (const syncOp of syncOps) if (syncOp.status === 2) for (const op of syncOp.operations) maxOrdinal = Math.max(maxOrdinal, op.context.ordinal);
 	return maxOrdinal;
 };
 //#endregion
@@ -5370,6 +5680,7 @@ const DECISION_FIELDS = ["deniedReason", "errorType"];
 * GraphQL-based synchronization channel for network communication between reactors.
 */
 var GqlRequestChannel = class {
+	logger;
 	inbox;
 	outbox;
 	deadLetter;
@@ -5577,7 +5888,7 @@ var GqlRequestChannel = class {
 		const syncOps = [];
 		for (const dl of deadLetters) {
 			const syncOp = new SyncOperation(crypto.randomUUID(), dl.jobId, [], this.remoteName, dl.documentId, dl.scopes, dl.branch, []);
-			syncOp.failed(new ChannelError(ChannelErrorSource.Outbox, new Error(dl.error), dl.errorType ?? void 0));
+			syncOp.failed(new ChannelError("outbox", new Error(dl.error), dl.errorType ?? void 0));
 			syncOps.push(syncOp);
 		}
 		this.deadLetter.add(...syncOps);
@@ -5597,7 +5908,7 @@ var GqlRequestChannel = class {
 		const classification = this.classifyError(err);
 		this.failureCount++;
 		this.lastFailureUtcMs = Date.now();
-		const channelError = new ChannelError(ChannelErrorSource.Inbox, err);
+		const channelError = new ChannelError("inbox", err);
 		this.logger.error("GqlChannel poll error (@FailureCount, @Classification): @Error", this.failureCount, classification, channelError);
 		if (classification === "unrecoverable") {
 			this.pollTimer.stop();
@@ -5841,7 +6152,7 @@ var GqlRequestChannel = class {
 				this.transitionConnectionState("reconnecting");
 				this.schedulePushRetry();
 			} else {
-				const channelError = new ChannelError(ChannelErrorSource.Outbox, err);
+				const channelError = new ChannelError("outbox", err);
 				for (const syncOp of syncOps) syncOp.failed(channelError);
 				this.deadLetter.add(...syncOps);
 				this.outbox.remove(...syncOps);
@@ -6063,7 +6374,7 @@ var GqlRequestChannelFactory = class {
 			...retryMaxDelayMs !== void 0 && { retryMaxDelayMs },
 			...maxQueueDepth !== void 0 && { maxQueueDepth },
 			...backpressureCheckIntervalMs !== void 0 && { backpressureCheckIntervalMs },
-			startPaused: options?.pollBehavior === PollBehavior.Manual
+			startPaused: options?.pollBehavior === "manual"
 		});
 		return new GqlRequestChannel(this.logger, remoteId, remoteName, cursorStorage, gqlConfig, operationIndex, pollTimer);
 	}
@@ -6080,6 +6391,7 @@ function firstOrdinalOf$1(syncOp) {
 * In general, the resolvers are responsible for updating mailboxes.
 */
 var GqlResponseChannel = class {
+	logger;
 	inbox;
 	outbox;
 	deadLetter;
@@ -6190,7 +6502,7 @@ var GqlResponseChannel = class {
 	*/
 	rememberUnserved(syncOps) {
 		for (const syncOp of syncOps) {
-			if (syncOp.status === SyncOperationStatus.Applied) continue;
+			if (syncOp.status === 2) continue;
 			const first = firstOrdinalOf$1(syncOp);
 			if (first > 0 && first < this.evictedOutboxFloor) this.evictedOutboxFloor = first;
 		}
@@ -6235,7 +6547,7 @@ var GqlResponseChannel = class {
 	unservedFloor() {
 		let floor = this.evictedOutboxFloor;
 		for (const syncOp of this.outbox.items) {
-			if (syncOp.status === SyncOperationStatus.Applied) continue;
+			if (syncOp.status === 2) continue;
 			const first = firstOrdinalOf$1(syncOp);
 			if (first > 0 && first < floor) floor = first;
 		}
@@ -6275,6 +6587,7 @@ function remoteCursorToRow(cursor) {
 	};
 }
 var KyselySyncCursorStorage = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}
@@ -6350,6 +6663,7 @@ function deadLetterRecordToRow(record) {
 * PGlite/Kysely-backed implementation of {@link ISyncDeadLetterStorage}.
 */
 var KyselySyncDeadLetterStorage = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}
@@ -6471,6 +6785,7 @@ function remoteRecordToRow(remote) {
 	};
 }
 var KyselySyncRemoteStorage = class {
+	db;
 	constructor(db) {
 		this.db = db;
 	}
@@ -6621,6 +6936,7 @@ var BatchAggregator = class {
 * to provide a fast path for jobs that have already synced.
 */
 var SyncAwaiter = class {
+	eventBus;
 	completedResults = /* @__PURE__ */ new Map();
 	pendingWaiters = /* @__PURE__ */ new Map();
 	unsubscribers = [];
@@ -6820,24 +7136,19 @@ var SyncStatusTracker = class {
 	}
 };
 function deriveStatus(inboxCount, outboxCount, errorCount) {
-	if (errorCount > 0) return SyncStatus.Error;
-	if (inboxCount > 0 && outboxCount > 0) return SyncStatus.OutgoingAndIncoming;
-	if (inboxCount > 0) return SyncStatus.Incoming;
-	if (outboxCount > 0) return SyncStatus.Outgoing;
-	return SyncStatus.Synced;
+	if (errorCount > 0) return "ERROR";
+	if (inboxCount > 0 && outboxCount > 0) return "OUTGOING_AND_INCOMING";
+	if (inboxCount > 0) return "INCOMING";
+	if (outboxCount > 0) return "OUTGOING";
+	return "SYNCED";
 }
 //#endregion
 //#region src/sync/sync-manager.ts
-var OutboxMode = /* @__PURE__ */ function(OutboxMode) {
-	OutboxMode["Backfill"] = "backfill";
-	OutboxMode["BatchTriggered"] = "batch-triggered";
-	return OutboxMode;
-}(OutboxMode || {});
 const defaultSyncManagerConfig = {
 	maxDeadLettersPerRemote: 100,
 	maxInboxBatchSize: 32,
 	maxHeldOperationsPerRemote: 1e4,
-	staleRemotePollWindowMs: 5 * 6e4
+	staleRemotePollWindowMs: 3e5
 };
 const PLAN_KEY_TO_JOB_UUID_CAP = 1e4;
 /**
@@ -6940,7 +7251,7 @@ var SyncManager = class {
 			if (outboxAckOrdinal > 0) {
 				const backfillController = new AbortController();
 				this.backfillAbortControllers.set(record.name, backfillController);
-				this.updateOutbox(remote, outboxAckOrdinal, OutboxMode.Backfill, backfillController.signal).catch((error) => {
+				this.updateOutbox(remote, outboxAckOrdinal, "backfill", backfillController.signal).catch((error) => {
 					if (backfillController.signal.aborted) return;
 					this.logger.error("Backfill failed for remote @RemoteName: @Error", remote.meta.name, error instanceof Error ? error : new Error(String(error)));
 				}).finally(() => {
@@ -7059,7 +7370,7 @@ var SyncManager = class {
 		}
 		const backfillController = new AbortController();
 		this.backfillAbortControllers.set(name, backfillController);
-		this.updateOutbox(remote, 0, OutboxMode.Backfill, backfillController.signal).catch((error) => {
+		this.updateOutbox(remote, 0, "backfill", backfillController.signal).catch((error) => {
 			if (backfillController.signal.aborted) return;
 			this.logger.error("Backfill failed for remote @RemoteName: @Error", remote.meta.name, error instanceof Error ? error : new Error(String(error)));
 		}).finally(() => {
@@ -7179,7 +7490,7 @@ var SyncManager = class {
 					scopes: syncOp.scopes,
 					branch: syncOp.branch,
 					operations: syncOp.operations,
-					errorSource: syncOp.error?.source ?? ChannelErrorSource.None,
+					errorSource: syncOp.error?.source ?? "none",
 					errorMessage: syncOp.error?.error.message ?? "unknown",
 					errorType
 				};
@@ -7239,7 +7550,7 @@ var SyncManager = class {
 		for (const remote of affectedRemotes) trimMailboxFromBatch(remote.channel.inbox, batch);
 		for (const remote of affectedRemotes) {
 			if (!this.remotes.has(remote.meta.name) || this.removing.has(remote.meta.name)) continue;
-			await this.updateOutbox(remote, remote.channel.outbox.latestOrdinal, OutboxMode.BatchTriggered);
+			await this.updateOutbox(remote, remote.channel.outbox.latestOrdinal, "batch-triggered");
 		}
 		await this.drainPrunes();
 	}
@@ -7281,7 +7592,7 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			const err = error instanceof Error ? error : new Error(String(error));
 			this.logger.error("Failed to load operations from inbox (@remote, @documentId, @error)", remote.meta.name, syncOp.documentId, err.message);
-			const channelError = new ChannelError(ChannelErrorSource.Inbox, err);
+			const channelError = new ChannelError("inbox", err);
 			syncOp.failed(channelError);
 			remote.channel.deadLetter.add(syncOp);
 			remote.channel.inbox.remove(syncOp);
@@ -7294,14 +7605,14 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			const err = error instanceof Error ? error : new Error(String(error));
 			this.logger.error("Failed to wait for job completion (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, jobInfo.id, err.message);
-			const channelError = new ChannelError(ChannelErrorSource.Inbox, err);
+			const channelError = new ChannelError("inbox", err);
 			syncOp.failed(channelError);
 			remote.channel.deadLetter.add(syncOp);
 			remote.channel.inbox.remove(syncOp);
 			return;
 		}
 		if (this.isShutdown) return;
-		if (completedJobInfo.status === JobStatus.FAILED) {
+		if (completedJobInfo.status === "FAILED") {
 			const errorMessage = completedJobInfo.error?.message || "Unknown error";
 			this.logger.error("Failed to apply operations from inbox (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, completedJobInfo.id, errorMessage);
 			syncOp.failed(this.inboxFailure(completedJobInfo.error));
@@ -7344,7 +7655,7 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			for (const { remote, syncOp } of items) {
 				const err = error instanceof Error ? error : new Error(String(error));
-				syncOp.failed(new ChannelError(ChannelErrorSource.Inbox, err));
+				syncOp.failed(new ChannelError("inbox", err));
 				remote.channel.deadLetter.add(syncOp);
 				remote.channel.inbox.remove(syncOp);
 			}
@@ -7361,7 +7672,7 @@ var SyncManager = class {
 		for (const { remote, syncOp } of items) {
 			if (!(syncOp.jobId in result.jobs)) {
 				this.logger.error("Job key missing from batch load result (@remote, @documentId, @jobId)", remote.meta.name, syncOp.documentId, syncOp.jobId);
-				const error = new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Job key '${syncOp.jobId}' missing from batch load result`));
+				const error = new ChannelError("inbox", /* @__PURE__ */ new Error(`Job key '${syncOp.jobId}' missing from batch load result`));
 				syncOp.failed(error);
 				remote.channel.deadLetter.add(syncOp);
 				remote.channel.inbox.remove(syncOp);
@@ -7374,13 +7685,13 @@ var SyncManager = class {
 			} catch (error) {
 				if (this.isShutdown) continue;
 				const err = error instanceof Error ? error : new Error(String(error));
-				syncOp.failed(new ChannelError(ChannelErrorSource.Inbox, err));
+				syncOp.failed(new ChannelError("inbox", err));
 				remote.channel.deadLetter.add(syncOp);
 				remote.channel.inbox.remove(syncOp);
 				continue;
 			}
 			if (this.isShutdown) return;
-			if (completedJobInfo.status === JobStatus.FAILED) {
+			if (completedJobInfo.status === "FAILED") {
 				syncOp.failed(this.inboxFailure(completedJobInfo.error));
 				remote.channel.deadLetter.add(syncOp);
 			} else syncOp.executed();
@@ -7399,7 +7710,7 @@ var SyncManager = class {
 	*/
 	inboxFailure(error) {
 		const message = error?.message || "Unknown error";
-		return new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
+		return new ChannelError("inbox", /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
 	}
 	/**
 	* Where the next outbox derivation starts: at the evicted floor when there is
@@ -7426,7 +7737,7 @@ var SyncManager = class {
 	*/
 	evictPastOutboxBound(remote) {
 		const cap = this.config.maxHeldOperationsPerRemote;
-		const queued = remote.channel.outbox.items.filter((syncOp) => syncOp.status === SyncOperationStatus.Unknown).sort((a, b) => firstOrdinalOf(a) - firstOrdinalOf(b));
+		const queued = remote.channel.outbox.items.filter((syncOp) => syncOp.status === -1).sort((a, b) => firstOrdinalOf(a) - firstOrdinalOf(b));
 		let kept = 0;
 		let cut = queued.length;
 		for (let i = 0; i < queued.length; i++) {
@@ -7518,7 +7829,7 @@ var SyncManager = class {
 	* it marked; the count is what keeps that drain from removing the remote this
 	* call is still adding to.
 	*/
-	async updateOutbox(remote, ackOrdinal, mode = OutboxMode.Backfill, signal) {
+	async updateOutbox(remote, ackOrdinal, mode = "backfill", signal) {
 		this.derivingOutboxes++;
 		try {
 			await this.deriveOutbox(remote, ackOrdinal, mode, signal);
@@ -7546,11 +7857,11 @@ var SyncManager = class {
 				const prevJobId = lastJobByDoc.get(batch.documentId);
 				const deps = [];
 				if (prevJobId) deps.push(prevJobId);
-				if (mode === OutboxMode.BatchTriggered && prevChainJobId && prevChainJobId !== prevJobId) deps.push(prevChainJobId);
+				if (mode === "batch-triggered" && prevChainJobId && prevChainJobId !== prevJobId) deps.push(prevChainJobId);
 				const syncOp = new SyncOperation(crypto.randomUUID(), jobId, deps, remote.meta.name, batch.documentId, [batch.scope], batch.branch, batch.operations);
 				syncOps.push(syncOp);
 				lastJobByDoc.set(batch.documentId, jobId);
-				if (mode === OutboxMode.BatchTriggered) prevChainJobId = jobId;
+				if (mode === "batch-triggered") prevChainJobId = jobId;
 			}
 			remote.channel.outbox.add(...syncOps);
 			this.evictPastOutboxBound(remote);
@@ -7907,7 +8218,7 @@ var Reactor = class {
 		const jobInfo = {
 			id: jobId,
 			documentId: job.documentId,
-			status: JobStatus.PENDING,
+			status: "PENDING",
 			createdAtUtcIso,
 			consistencyToken: {
 				version: 1,
@@ -7949,7 +8260,7 @@ var Reactor = class {
 		const jobInfo = {
 			id: jobId,
 			documentId: job.documentId,
-			status: JobStatus.PENDING,
+			status: "PENDING",
 			createdAtUtcIso,
 			consistencyToken: {
 				version: 1,
@@ -7987,7 +8298,7 @@ var Reactor = class {
 		const jobInfo = {
 			id: jobId,
 			documentId: job.documentId,
-			status: JobStatus.PENDING,
+			status: "PENDING",
 			createdAtUtcIso,
 			consistencyToken: {
 				version: 1,
@@ -8027,7 +8338,7 @@ var Reactor = class {
 		const jobInfo = {
 			id: jobId,
 			documentId: job.documentId,
-			status: JobStatus.PENDING,
+			status: "PENDING",
 			createdAtUtcIso,
 			consistencyToken: {
 				version: 1,
@@ -8062,7 +8373,7 @@ var Reactor = class {
 			const jobInfo = {
 				id: planKeyToJobId.get(jobPlan.key),
 				documentId: jobPlan.documentId,
-				status: JobStatus.PENDING,
+				status: "PENDING",
 				createdAtUtcIso,
 				consistencyToken: {
 					version: 1,
@@ -8132,7 +8443,7 @@ var Reactor = class {
 			const jobInfo = {
 				id: planKeyToJobId.get(jobPlan.key),
 				documentId: jobPlan.documentId,
-				status: JobStatus.PENDING,
+				status: "PENDING",
 				createdAtUtcIso,
 				consistencyToken: {
 					version: 1,
@@ -8221,7 +8532,7 @@ var Reactor = class {
 			return Promise.resolve({
 				id: jobId,
 				documentId: "",
-				status: JobStatus.FAILED,
+				status: "FAILED",
 				createdAtUtcIso: now,
 				completedAtUtcIso: now,
 				error: toErrorInfo$1("Job not found"),
@@ -8572,11 +8883,12 @@ var ReactorBuilder = class {
 		if (resolver instanceof DocumentModelResolver) resolver.setModelLoadedHook((documentType) => eventBus.emit(ReactorEventTypes.MODEL_LOADED, { documentType }));
 		const queue = this.queueInstance ?? new InMemoryQueue(eventBus, resolver);
 		const jobTracker = new InMemoryJobTracker(eventBus);
-		const writeCache = new KyselyWriteCache(keyframeStore, operationStore, documentModelRegistry, {
+		const cacheConfig = {
 			maxDocuments: this.writeCacheConfig?.maxDocuments ?? 100,
 			ringBufferSize: this.writeCacheConfig?.ringBufferSize ?? 10,
 			keyframeInterval: this.writeCacheConfig?.keyframeInterval ?? 10
-		});
+		};
+		const writeCache = new KyselyWriteCache(keyframeStore, operationStore, documentModelRegistry, cacheConfig);
 		await writeCache.startup();
 		const operationIndex = new KyselyOperationIndex(database);
 		const documentMetaCache = new DocumentMetaCache(operationStore, { maxDocuments: 1e3 });
@@ -8585,22 +8897,24 @@ var ReactorBuilder = class {
 		const executionScope = new KyselyExecutionScope(database, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache);
 		let executorManager = this.executorManager;
 		let executorStartCount = this.executorConfig.maxConcurrency ?? 1;
-		if (!executorManager) if (this.workerPool) {
-			const pool = this.workerPool;
-			let factory = pool.factory;
-			if (!factory) {
-				if (pool.db === void 0) throw new Error("unreachable: worker pool configured without db or factory");
-				if (this.signer && !this.workerSigner) this.logger.warn("Worker pool has no signer spec; pooled workers store synthesized operations unsigned");
-				if (this.trustPolicy && !this.workerTrustPolicy) this.logger.warn("Worker pool has no trust policy spec; pooled workers apply the default trust policy");
-				factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db);
-			}
-			const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, operationIndex, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
-			executorManager = poolManager;
-			executorStartCount = pool.numWorkers;
-			if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
-		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, executionScope, this.signer, this.trustPolicy), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
+		if (!executorManager) {
+			if (this.workerPool) {
+				const pool = this.workerPool;
+				let factory = pool.factory;
+				if (!factory) {
+					if (pool.db === void 0) throw new Error("unreachable: worker pool configured without db or factory");
+					if (this.signer && !this.workerSigner) this.logger.warn("Worker pool has no signer spec; pooled workers store synthesized operations unsigned");
+					if (this.trustPolicy && !this.workerTrustPolicy) this.logger.warn("Worker pool has no trust policy spec; pooled workers apply the default trust policy");
+					factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db);
+				}
+				const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, operationIndex, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
+				executorManager = poolManager;
+				executorStartCount = pool.numWorkers;
+				if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
+			} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, executionScope, this.signer, this.trustPolicy), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
+		}
 		await executorManager.start(executorStartCount);
-		const callerReadModels = Array.from(new Set([...this.readModels]));
+		const callerReadModels = Array.from(/* @__PURE__ */ new Set([...this.readModels]));
 		const degradedComponents = [];
 		const startDegraded = (component, error) => {
 			degradedComponents.push({
@@ -8614,7 +8928,7 @@ var ReactorBuilder = class {
 			yieldDeadlineMs: this.executorConfig.yieldDeadlineMs ?? 50
 		};
 		const documentViewConsistencyTracker = new ConsistencyTracker();
-		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, featureFlags.documentDecisions ? DeletedDocumentRead.StateAtDeletion : DeletedDocumentRead.NotFound, readModelIndexing);
+		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, featureFlags.documentDecisions ? "StateAtDeletion" : "NotFound", readModelIndexing);
 		try {
 			await documentView.init();
 		} catch (error) {
@@ -8670,7 +8984,7 @@ var ReactorBuilder = class {
 		const reactor = new Reactor(this.logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, this.features, documentView, documentIndexer, operationStore, eventBus, executorManager);
 		let syncModule = void 0;
 		if (this.channelScheme) {
-			const factory = this.channelScheme === ChannelScheme.CONNECT ? new GqlRequestChannelFactory(this.logger, this.jwtHandler, queue) : new GqlResponseChannelFactory(this.logger);
+			const factory = this.channelScheme === "connect" ? new GqlRequestChannelFactory(this.logger, this.jwtHandler, queue) : new GqlResponseChannelFactory(this.logger);
 			syncModule = new SyncBuilder().withChannelFactory(factory).buildModule(reactor, this.logger, operationIndex, eventBus, database, this.driveContainerTypes);
 			await syncModule.syncManager.startup();
 		} else if (this.syncBuilder) {
@@ -8771,7 +9085,7 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-mQhfVipO.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-BpcqDtnQ.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
@@ -8805,7 +9119,7 @@ var ReactorBuilder = class {
 		return manager;
 	}
 	async createDefaultProjectionWorkerFactory() {
-		const [{ createProjectionThreadTransport }, { projectionWorkerEntryPath }] = await Promise.all([import("./transport-CuogVKN_.js"), import("./projection-worker-wI4PwcV2.js")]);
+		const [{ createProjectionThreadTransport }, { projectionWorkerEntryPath }] = await Promise.all([import("./transport-B3G50KVd.js"), import("./projection-worker-D8uNFdwX.js")]);
 		return () => createProjectionThreadTransport(projectionWorkerEntryPath);
 	}
 	/**
@@ -8815,9 +9129,9 @@ var ReactorBuilder = class {
 	*/
 	async createDefaultWorkerFactory(numWorkers, db) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-B3p-nuqG.js"),
-			import("./transport-ByGviWdZ.js"),
-			import("./worker-BDVzCtuf.js").then((n) => n.n)
+			import("./worker-handle-C2rLUHwv.js"),
+			import("./transport-CZDHzfvy.js"),
+			Promise.resolve().then(() => worker_exports)
 		]);
 		const poolConfig = {
 			enabled: true,
@@ -9291,6 +9605,23 @@ const SIGNATURE_REFUSAL_CODES = [
 	"SIGNER_UNAUTHORIZED"
 ];
 //#endregion
+//#region src/executor/worker/index.ts
+var worker_exports = /* @__PURE__ */ __exportAll({
+	createForwardingLogger: () => createForwardingLogger,
+	errorToInfo: () => errorToInfo,
+	sanitizeArg: () => sanitizeArg,
+	workerEntryPath: () => workerEntryPath
+});
+function resolveWorkerEntryPath() {
+	const url = new URL("./entry.js", import.meta.url);
+	if (url.protocol !== "file:") return url.href;
+	let pathname = decodeURIComponent(url.pathname);
+	if (/^\/[A-Za-z]:[/\\]/.test(pathname)) pathname = pathname.slice(1);
+	return pathname;
+}
+/** Absolute path to the worker entry script for use with `new Worker(workerEntryPath)`. */
+const workerEntryPath = resolveWorkerEntryPath();
+//#endregion
 //#region src/decision/sync-scope-gate.ts
 /** What a subject may read of a document that is not there to be read. */
 const META_ONLY = (scope) => ALWAYS_READABLE_SCOPES.has(scope);
@@ -9302,6 +9633,9 @@ const META_ONLY = (scope) => ALWAYS_READABLE_SCOPES.has(scope);
 * path's own job, and it is the only thing this adds to the gate it wraps.
 */
 var SyncScopeGate = class {
+	gate;
+	documentView;
+	logger;
 	constructor(gate, documentView, logger) {
 		this.gate = gate;
 		this.documentView = documentView;