@powerhousedao/reactor 6.2.3-dev.25 → 6.2.3-dev.27

package/dist/index.js

@@ -1,6 +1,6 @@
-import { $ as DocumentNotFoundError, A as ModuleNotFoundError, B as authDecisionModel, C as DocumentMetaCache, D as DuplicateManifestError, E as JobExecutorEventTypes, F as summarizeSubmittedActions, G as DocumentExistence, H as APPEND_CONDITION_FAILED_PREFIX, I as targetDocumentId, J as RevisionMismatchError, K as DuplicateOperationError, L as decideAtHead, M as createConsistencyToken, N as createEmptyConsistencyToken, O as DuplicateModuleError, P as submittedActionIds, Q as DocumentDeletedError, R as selectDecisionModel, S as KyselyOperationIndex, T as DEFAULT_DEFERRED_JOB_TTL_MS, U as AppendConditionFailedError, V as buildDecisionModel, W as DocumentAlreadyExistsError, X as AuthTimestampNotMonotonicError, Y as AuthEnforcementDisabledError, Z as AuthorizationDeniedError, _ as DriveCollectionId, a as DEFAULT_DRIVE_CONTAINER_TYPES, at as EventBusAggregateError, b as EventBus, c as runMigrations, ct as parsePagingOptions, d as KyselyOperationStore, dt as __exportAll, et as ExcessiveReshuffleError, f as KyselyKeyframeStore, g as PassthroughSigner, h as verifyActionSignature, it as UpgradePreconditionFailedError, j as GATED_DOCUMENT_ACTIONS, k as InvalidModuleError, l as createForwardingPoolInstrumentation, lt as throwIfAborted, m as SimpleJobExecutor, n as errorToInfo, nt as InvalidSignatureError, o as REACTOR_SCHEMA, ot as ReactorEventTypes, p as DocumentModelRegistry, q as OptimisticLockError, r as sanitizeArg, rt as RelationshipNotFoundError, s as getMigrationStatus, st as matchesScope, t as createForwardingLogger, tt as InvalidOperationTimestampError, u as instrumentPgPool, v as KyselyExecutionScope, w as CollectionMembershipCache, x as KyselyWriteCache, y as resolveFeatureFlags, z as documentDecisionModel } from "./forwarding-logger-CSsCJ38f.js";
+import { $ as DocumentNotFoundError, A as ModuleNotFoundError, B as authDecisionModel, C as DocumentMetaCache, D as DuplicateManifestError, E as JobExecutorEventTypes, F as summarizeSubmittedActions, G as DocumentExistence, H as APPEND_CONDITION_FAILED_PREFIX, I as targetDocumentId, J as RevisionMismatchError, K as DuplicateOperationError, L as decideAtHead, M as createConsistencyToken, N as createEmptyConsistencyToken, O as DuplicateModuleError, P as submittedActionIds, Q as DocumentDeletedError, R as selectDecisionModel, S as KyselyOperationIndex, T as DEFAULT_DEFERRED_JOB_TTL_MS, U as AppendConditionFailedError, V as buildDecisionModel, W as DocumentAlreadyExistsError, X as AuthTimestampNotMonotonicError, Y as AuthEnforcementDisabledError, Z as AuthorizationDeniedError, _ as DriveCollectionId, a as DEFAULT_DRIVE_CONTAINER_TYPES, at as EventBusAggregateError, b as EventBus, c as runMigrations, ct as parsePagingOptions, d as KyselyOperationStore, dt as __exportAll, et as ExcessiveReshuffleError, f as KyselyKeyframeStore, g as PassthroughSigner, h as verifyActionSignature, it as UpgradePreconditionFailedError, j as GATED_DOCUMENT_ACTIONS, k as InvalidModuleError, l as createForwardingPoolInstrumentation, lt as throwIfAborted, m as SimpleJobExecutor, n as errorToInfo, nt as InvalidSignatureError, o as REACTOR_SCHEMA, ot as ReactorEventTypes, p as DocumentModelRegistry, q as OptimisticLockError, r as sanitizeArg, rt as RelationshipNotFoundError, s as getMigrationStatus, st as matchesScope, t as createForwardingLogger, tt as InvalidOperationTimestampError, u as instrumentPgPool, v as KyselyExecutionScope, w as CollectionMembershipCache, x as KyselyWriteCache, y as resolveFeatureFlags, z as documentDecisionModel } from "./forwarding-logger-CnuVDVze.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-BM_ULVWd.js";
-import { a as KyselyDocumentView, c as ReadModelCoordinator, d as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, f as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as unchunkedReadModelIndexingConfig, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as DEFAULT_COMMIT_CHUNK_SIZE } from "./document-indexer-zbdzqZ3K.js";
+import { a as KyselyDocumentView, c as ReadModelCoordinator, d as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, f as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as BaseReadModel, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as unchunkedReadModelIndexingConfig, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as DEFAULT_COMMIT_CHUNK_SIZE } from "./document-indexer-BVTGbEB0.js";
 import { DEFAULT_SIGNATURE_POLICY, DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, requestedSignaturePolicy, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
@@ -504,8 +504,7 @@ var DriveClient = class {
 		return {
 			results: filtered.slice(startIndex, endIndex),
 			options: effective,
-			...endIndex < filtered.length ? { nextCursor: String(endIndex) } : {},
-			totalCount: filtered.length
+			...endIndex < filtered.length ? { nextCursor: String(endIndex) } : {}
 		};
 	}
 	/**
@@ -722,6 +721,53 @@ let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 * argument covers. Grants gate domain-scope reads only.
 */
 const ALWAYS_READABLE_SCOPES = /* @__PURE__ */ new Set(["auth", "document"]);
+const DECLARED_DOMAIN_SCOPES = ["global", "local"];
+/**
+* The scopes grants gate: the declared ones, and any other the document holds.
+* A document fetched for a narrowed view holds only that view's scopes.
+*/
+function domainScopesOf(document) {
+	const state = document.state;
+	const held = Object.keys(state ?? {}).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope));
+	return [.../* @__PURE__ */ new Set([...DECLARED_DOMAIN_SCOPES, ...held])];
+}
+function allowsSomeDomainScope(document, readable) {
+	return domainScopesOf(document).some(readable);
+}
+/** A document with no state at all is not policied, so nothing withholds it. */
+function refusesEveryDomainScope(document, readable) {
+	return document.state !== void 0 && !allowsSomeDomainScope(document, readable);
+}
+/**
+* The domain scopes the document does not hold whose read decision reads their
+* own state. A condition's `doc.<scope>` path resolves only for that scope, so
+* every other scope is decided on its name and the policy alone.
+*/
+function unheldScopesReadOnState(document) {
+	const grants = authOf(document)?.grants ?? [];
+	const onState = /* @__PURE__ */ new Set();
+	for (const grant of grants) {
+		collectStateScopes(grant.where, onState);
+		collectStateScopes(grant.principal, onState);
+	}
+	if (onState.size === 0) return [];
+	const held = document.state ?? {};
+	return domainScopesOf(document).filter((scope) => onState.has(scope) && !(scope in held));
+}
+function collectStateScopes(node, into) {
+	if (Array.isArray(node)) {
+		for (const child of node) collectStateScopes(child, into);
+		return;
+	}
+	if (typeof node !== "object" || node === null) return;
+	const { attr } = node;
+	if (typeof attr === "string") {
+		const [root, scope] = attr.split(".");
+		if (root === "doc" && scope) into.add(scope);
+		return;
+	}
+	for (const child of Object.values(node)) collectStateScopes(child, into);
+}
 /** What a gate does with an uninitialized policy when told nothing. */
 const OPEN_BY_DEFAULT = { withholdUninitialized: false };
 /**
@@ -784,8 +830,26 @@ var BareReadGate = class {
 			scope
 		}) === "allow");
 	}
+	prepare(document) {
+		return Promise.resolve((subject) => this.scopePredicate(document, subject));
+	}
 };
 /**
+* Rethrows a failed read unless the document is confirmed not live. The read
+* side reports absence as a plain Error, so absence is checked rather than
+* inferred from the message, and a failed check surfaces the read's own error.
+*/
+async function assertAbsent(documentView, documentId, error, signal) {
+	if (DocumentNotFoundError.isError(error)) return;
+	let exists;
+	try {
+		exists = await documentView.exists([documentId], "LiveOnly", void 0, signal);
+	} catch {
+		throw error;
+	}
+	if (exists[0]) throw error;
+}
+/**
 * Answers a stream read from the document already fetched, and anything else
 * through the read side.
 *
@@ -819,20 +883,10 @@ var SeededStateReader = class {
 				scopes: [scope]
 			}, void 0, signal);
 		} catch (error) {
-			await this.assertAbsent(documentId, error, signal);
+			await assertAbsent(this.documentView, documentId, error, signal);
 			throw new DocumentNotFoundError(documentId);
 		}
 	}
-	async assertAbsent(documentId, error, signal) {
-		if (DocumentNotFoundError.isError(error)) return;
-		let exists;
-		try {
-			exists = await this.documentView.exists([documentId], "LiveOnly", void 0, signal);
-		} catch {
-			throw error;
-		}
-		if (exists[0]) throw error;
-	}
 };
 /**
 * Evaluates a read against the registered decision model, built at the stream
@@ -868,10 +922,18 @@ var ModelReadGate = class {
 	* group's other scopes are its own business and stay behind its own grants.
 	*/
 	async scopePredicate(document, subject, branch, signal) {
-		const own = await this.ownPolicyPredicate(document, subject, branch, signal);
-		if (!this.servesGroup(document) || own(GROUP_MEMBERSHIP_SCOPE)) return own;
-		const audience = await this.servesGroupTo(document.header.id, subject, signal);
-		return (scope) => own(scope) || audience && scope === GROUP_MEMBERSHIP_SCOPE;
+		return (await this.prepare(document, branch, signal))(subject);
+	}
+	async prepare(document, branch, signal) {
+		const policy = await this.ownPolicy(document, branch, signal);
+		if (!this.servesGroup(document)) return (subject) => Promise.resolve(policy(subject));
+		const referencers = this.referencerReads(document.header.id, signal);
+		return async (subject) => {
+			const own = policy(subject);
+			if (own(GROUP_MEMBERSHIP_SCOPE)) return own;
+			const audience = await this.servesGroupTo(subject, referencers);
+			return (scope) => own(scope) || audience && scope === GROUP_MEMBERSHIP_SCOPE;
+		};
 	}
 	/**
 	* Whether the subject is served this group because a policy names it.
@@ -905,11 +967,8 @@ var ModelReadGate = class {
 	* running with nobody awaiting it, which is where unhandled rejections come
 	* from.
 	*/
-	async servesGroupTo(groupId, subject, signal) {
-		if (!this.operationIndex) return false;
-		const referencers = await this.operationIndex.getGroupReferencers(groupId, signal);
-		const examined = referencers.slice(0, MAX_EXAMINED_REFERENCERS);
-		if (examined.length < referencers.length) this.logger?.warn(`Group ${groupId} is referenced by ${referencers.length} documents; only the first ${MAX_EXAMINED_REFERENCERS} decide whether it is served`);
+	async servesGroupTo(subject, referencers) {
+		const examined = await referencers.examined();
 		const walk = {
 			next: 0,
 			served: false,
@@ -920,7 +979,7 @@ var ModelReadGate = class {
 				const referencerId = examined[walk.next++];
 				let serves = false;
 				try {
-					serves = await this.servesThrough(referencerId, subject, signal);
+					serves = (await referencers.serves(referencerId))(subject);
 				} catch (error) {
 					walk.failure ??= Error.isError(error) ? error : /* @__PURE__ */ new Error(`Probing referencer ${referencerId} failed`);
 				}
@@ -931,21 +990,44 @@ var ModelReadGate = class {
 		if (!walk.served && walk.failure) throw walk.failure;
 		return walk.served;
 	}
+	/** Each read made once, however many subjects the walk runs for. */
+	referencerReads(groupId, signal) {
+		let examined;
+		const serves = /* @__PURE__ */ new Map();
+		return {
+			examined: () => examined ??= this.examinedReferencers(groupId, signal),
+			serves: (referencerId) => {
+				let read = serves.get(referencerId);
+				if (!read) {
+					read = this.servesThrough(referencerId, signal);
+					serves.set(referencerId, read);
+				}
+				return read;
+			}
+		};
+	}
+	async examinedReferencers(groupId, signal) {
+		if (!this.operationIndex) return [];
+		const referencers = await this.operationIndex.getGroupReferencers(groupId, signal);
+		const examined = referencers.slice(0, MAX_EXAMINED_REFERENCERS);
+		if (examined.length < referencers.length) this.logger?.warn(`Group ${groupId} is referenced by ${referencers.length} documents; only the first ${MAX_EXAMINED_REFERENCERS} decide whether it is served`);
+		return examined;
+	}
 	/**
-	* Whether one referencing document serves the subject any domain scope. A
+	* Whether one referencing document serves a subject any domain scope. A
 	* referencer this replica does not hold serves nothing, which fails closed
 	* the same way a group it does not hold does.
 	*/
-	async servesThrough(referencerId, subject, signal) {
+	async servesThrough(referencerId, signal) {
 		let referencer;
 		try {
 			referencer = await this.documentView.get(referencerId, { branch: GROUP_BRANCH }, void 0, signal);
 		} catch {
-			return false;
+			return () => false;
 		}
-		if (this.servesGroup(referencer)) return false;
-		const readable = await this.ownPolicyPredicate(referencer, subject, GROUP_BRANCH, signal);
-		return Object.keys(referencer.state ?? {}).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope)).some((scope) => readable(scope));
+		if (this.servesGroup(referencer)) return () => false;
+		const policy = await this.ownPolicy(referencer, GROUP_BRANCH, signal);
+		return (subject) => allowsSomeDomainScope(referencer, policy(subject));
 	}
 	servesGroup(document) {
 		return this.servesGroups && this.operationIndex !== void 0 && document.header.documentType === groupDocumentType;
@@ -963,9 +1045,12 @@ var ModelReadGate = class {
 	* publish an unpoliced group it names: the referencer walk asks this question
 	* of the referencing document, whose real policy answers it.
 	*/
-	async ownPolicyPredicate(document, subject, branch, signal) {
+	async ownPolicy(document, branch, signal) {
 		const auth = authOf(document);
-		if (!auth || !auth.version) return this.options.withholdUninitialized ? (scope) => ALWAYS_READABLE_SCOPES.has(scope) : () => true;
+		if (!auth || !auth.version) {
+			const readable = this.options.withholdUninitialized ? (scope) => ALWAYS_READABLE_SCOPES.has(scope) : () => true;
+			return () => readable;
+		}
 		const target = {
 			documentId: document.header.id,
 			branch
@@ -973,7 +1058,7 @@ var ModelReadGate = class {
 		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), this.model, target, signal);
 		const definition = this.model(target);
 		const scopeStates = document.state ?? {};
-		return (scope) => ALWAYS_READABLE_SCOPES.has(scope) || definition.decide(built.model, subject, {
+		return (subject) => (scope) => ALWAYS_READABLE_SCOPES.has(scope) || definition.decide(built.model, subject, {
 			verb: "read",
 			scope
 		}, {
@@ -983,6 +1068,78 @@ var ModelReadGate = class {
 	}
 };
 //#endregion
+//#region src/client/event-reads.ts
+/** One change event's reads, shared by every subscription it reaches. */
+var EventReads = class {
+	reactor;
+	documentView;
+	readGate;
+	documents = /* @__PURE__ */ new Map();
+	existence = /* @__PURE__ */ new Map();
+	prepared = /* @__PURE__ */ new WeakMap();
+	constructor(reactor, documentView, readGate) {
+		this.reactor = reactor;
+		this.documentView = documentView;
+		this.readGate = readGate;
+	}
+	get(id, view) {
+		const key = JSON.stringify([
+			id,
+			view?.branch,
+			view?.scopes
+		]);
+		let read = this.documents.get(key);
+		if (!read) {
+			read = this.reactor.get(id, view);
+			this.documents.set(key, read);
+		}
+		return read;
+	}
+	exists(ids, existence) {
+		const key = JSON.stringify([ids, existence]);
+		let read = this.existence.get(key);
+		if (!read) {
+			read = this.documentView.exists(ids, existence);
+			this.existence.set(key, read);
+		}
+		return read;
+	}
+	async scopePredicate(document, subject, branch) {
+		if (!this.readGate.prepare) return this.readGate.scopePredicate(document, subject, branch);
+		let byBranch = this.prepared.get(document);
+		if (!byBranch) {
+			byBranch = /* @__PURE__ */ new Map();
+			this.prepared.set(document, byBranch);
+		}
+		let prepared = byBranch.get(branch);
+		if (!prepared) {
+			prepared = this.readGate.prepare(document, branch);
+			byBranch.set(branch, prepared);
+		}
+		return (await prepared)(subject);
+	}
+};
+var EventReadsSource = class {
+	reactor;
+	documentView;
+	readGate;
+	current;
+	constructor(reactor, documentView, readGate) {
+		this.reactor = reactor;
+		this.documentView = documentView;
+		this.readGate = readGate;
+	}
+	forEvent() {
+		if (!this.current) {
+			this.current = new EventReads(this.reactor, this.documentView, this.readGate);
+			queueMicrotask(() => {
+				this.current = void 0;
+			});
+		}
+		return this.current;
+	}
+};
+//#endregion
 //#region src/client/util.ts
 function authSubjectFromSigner(signer) {
 	return {
@@ -997,6 +1154,19 @@ function withAuthScope(view) {
 	};
 	return view;
 }
+function withAllScopes(view) {
+	if (!view?.scopes) return view;
+	const { scopes: _narrowed, ...whole } = view;
+	return whole;
+}
+function narrowedScopes(view) {
+	if (!view?.scopes || view.scopes.length === 0) return;
+	return /* @__PURE__ */ new Set([
+		"document",
+		"auth",
+		...view.scopes
+	]);
+}
 /**
 * Drops the scopes the predicate refuses. The predicate is resolved by the read
 * gate, which decides against the whole policy once per document; this only
@@ -1069,6 +1239,7 @@ var ReactorClient = class {
 	documentIndexer;
 	documentView;
 	readGate;
+	eventReads;
 	actionEvaluation;
 	createSignaturePolicy;
 	drives;
@@ -1081,33 +1252,12 @@ var ReactorClient = class {
 		this.documentIndexer = documentIndexer;
 		this.documentView = documentView;
 		this.readGate = readGate;
+		this.eventReads = new EventReadsSource(reactor, documentView, readGate);
 		this.actionEvaluation = actionEvaluation;
 		this.createSignaturePolicy = createSignaturePolicy;
 		this.drives = new DriveClient(this, logger, reactor, signer);
 		this.logger.verbose("ReactorClient initialized");
 	}
-	readSubject(subject) {
-		return subject ?? authSubjectFromSigner(this.signer);
-	}
-	/**
-	* Which scopes of one document the subject may read. Resolved once per
-	* document, so the gate builds its model once however many scopes are then
-	* tested, and the filtering itself stays synchronous.
-	*/
-	readableScopes(document, view, signal) {
-		return this.readGate.scopePredicate(document, this.readSubject(view?.subject), view?.branch ?? "main", signal);
-	}
-	/**
-	* One document, filtered to the scopes the subject may read. Every method
-	* that hands a document back goes through here, including the ones that
-	* follow a write: a document returned from a mutation is a read like any
-	* other, and returning it whole served scopes the same subject would be
-	* refused by `get`. Its author still sees what it wrote, because an allow on
-	* execute confers read of that scope.
-	*/
-	async gateDocument(document, view, signal) {
-		return filterReadableScopes(document, await this.readableScopes(document, view, signal));
-	}
 	/**
 	* Retrieves a list of document model modules.
 	*/
@@ -1213,31 +1363,6 @@ var ReactorClient = class {
 			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
 		};
 	}
-	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
-		const scopeCursors = decodeCompositeCursor(paging.cursor);
-		const allOperations = [];
-		const activeCursors = {};
-		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
-			if (!canRead(scopeName)) continue;
-			const scopeView = {
-				...view,
-				scopes: [scopeName]
-			};
-			const scopePaging = {
-				cursor,
-				limit: paging.limit
-			};
-			const scopeResult = (await this.reactor.getOperations(documentId, scopeView, filter, scopePaging, void 0, signal))[scopeName];
-			allOperations.push(...scopeResult.results);
-			if (scopeResult.nextCursor) activeCursors[scopeName] = scopeResult.nextCursor;
-		}
-		allOperations.sort((a, b) => a.index - b.index);
-		return {
-			results: allOperations,
-			options: paging,
-			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
-		};
-	}
 	/**
 	* Retrieves outgoing relationships of a given type from a source document.
 	*/
@@ -1291,68 +1416,24 @@ var ReactorClient = class {
 		return this.gateEdges(edges, "sourceId", view, signal);
 	}
 	/**
-	* Drops the edges whose far-end document the subject may read no domain scope
-	* of. An edge is withheld whole rather than stripped of its metadata: the
-	* document-shaped relationship reads already answer with the far end stripped
-	* to the scopes the gate allows, so the far end's existence is disclosed
-	* either way, but an edge's metadata is content about the pair that the far
-	* end's own reads would refuse. An edge to a far end stripped to nothing
-	* therefore carries content past a refusal, and there is no useful shell to
-	* hand back in its place.
-	*
-	* `nextCursor` and `options` are left as the underlying stream reported them,
-	* because a caller must feed them back to resume from the right position. A
-	* gated page can therefore be shorter than the limit it asked for.
-	*/
-	async gateEdges(page, farEnd, view, signal) {
-		const ids = [...new Set(page.results.map((edge) => edge[farEnd]))];
-		if (ids.length === 0) return page;
-		const farEndView = {
-			subject: view?.subject,
-			branch: view?.branch
-		};
-		const documents = await this.reactor.find({ ids }, farEndView, {
-			cursor: "0",
-			limit: ids.length
-		}, void 0, signal);
-		const readable = new Map(await Promise.all(documents.results.map(async (doc) => {
-			const allows = await this.readableScopes(doc, view, signal);
-			const domainScopes = Object.keys(doc.state).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope));
-			return [doc.header.id, domainScopes.length === 0 || domainScopes.some(allows)];
-		})));
-		const results = page.results.filter((edge) => readable.get(edge[farEnd]) !== false);
-		if (results.length === page.results.length) return page;
-		const nextPage = page.next;
-		return {
-			...page,
-			results,
-			next: nextPage ? async () => this.gateEdges(await nextPage(), farEnd, view, signal) : void 0
-		};
-	}
-	/**
-	* One relationship edge, or undefined when it does not exist. A point lookup:
-	* the pair is filtered in SQL rather than scanned out of the source's edge
-	* list, which on a drive with thousands of children is the difference between
-	* one query and dozens.
-	*/
-	async readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, view, signal) {
-		const sourceId = await this.documentView.resolveIdOrSlug(sourceIdentifier, view, void 0, signal);
-		const targetId = await this.documentView.resolveIdOrSlug(targetIdentifier, view, void 0, signal);
-		return (await this.documentIndexer.getDirectedRelationships(sourceId, targetId, [relationshipType], {
-			cursor: "0",
-			limit: 1
-		}, void 0, signal)).results[0];
-	}
-	/**
 	* Filters documents by criteria and returns a list of them
 	*/
 	async find(search, view, paging, signal) {
 		this.logger.verbose("find(@search, @view, @paging)", search, view, paging);
 		const results = await this.reactor.find(search, withAuthScope(view), paging, void 0, signal);
-		return {
-			...results,
-			results: await Promise.all(results.results.map(async (doc) => filterReadableScopes(doc, await this.readableScopes(doc, view, signal))))
-		};
+		return this.gateListing(results, view, signal);
+	}
+	/** Whether `find` would serve the document; false when it is absent. */
+	async isServed(identifier, view, signal) {
+		this.logger.verbose("isServed(@identifier, @view)", identifier, view);
+		let document;
+		try {
+			document = await this.reactor.getByIdOrSlug(identifier, withAuthScope(view), void 0, signal);
+		} catch (error) {
+			await assertAbsent(this.documentView, identifier, error, signal);
+			return false;
+		}
+		return await this.gateListed(document, view, signal) !== void 0;
 	}
 	/**
 	* Predicts the admission verdict for each candidate. See
@@ -1393,39 +1474,6 @@ var ReactorClient = class {
 			anyDenied: allowed < candidates.length
 		};
 	}
-	/**
-	* The decision model for one target document, built at its stream heads.
-	*
-	* The document is fetched unfiltered, because the policy is what decides:
-	* reading it through the read gate would withhold the very scopes the
-	* decision is about. A deleted document is served at its deletion boundary,
-	* which is what lets the model refuse an execute against it -- authEnforcement
-	* requires documentDecisions, so that read is available whenever this runs.
-	*
-	* Reading past the gate discloses nothing a submit does not. The `auth` and
-	* `document` scopes are readable by every holder, so a verdict resting on the
-	* policy alone is one the caller could compute unaided; and a verdict resting
-	* on a conditional grant reads the executing scope's state exactly as
-	* admission reads it, so the answer here is what submitting and being refused
-	* would have revealed anyway.
-	*
-	* The append condition the build records is dropped. It guards a write, and
-	* this makes none; reproducing it is also what the preflight cannot do, which
-	* is why the answer is a prediction.
-	*/
-	async buildEvaluationTarget(config, documentId, branch, signal) {
-		const document = await this.documentView.get(documentId, { branch }, void 0, signal);
-		const target = {
-			documentId,
-			branch
-		};
-		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), config.model, target, signal);
-		return {
-			definition: config.model(target),
-			model: built.model,
-			scopeStates: document.state ?? {}
-		};
-	}
 	getCreateSignaturePolicy() {
 		return Promise.resolve(this.createSignaturePolicy);
 	}
@@ -1608,18 +1656,6 @@ var ReactorClient = class {
 		}, signal);
 		return this.reactor.execute(documentId, branch, signedActions, signal);
 	}
-	/**
-	* The id a write on `identifier` is stored under, which its signatures bind.
-	* A create names its own id, and an id no slug maps to is taken as given, so
-	* a document still in flight resolves to itself.
-	*/
-	async resolveWriteTarget(identifier, branch, actions, signal) {
-		if (actions.some((action) => action.type === "CREATE_DOCUMENT")) return identifier;
-		const view = { branch };
-		const bySlug = await this.documentView.resolveSlug(identifier, view, void 0, signal);
-		if (bySlug === void 0 || bySlug === identifier) return identifier;
-		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
-	}
 	async executeBatch(request, signal) {
 		this.logger.verbose("executeBatch(@count jobs)", request.jobs.length);
 		const signedJobs = await Promise.all(request.jobs.map(async (job) => {
@@ -1776,7 +1812,13 @@ var ReactorClient = class {
 	*/
 	subscribe(search, callback, view) {
 		this.logger.verbose("subscribe(@search, @view)", search, view);
-		const readable = async (document) => filterReadableScopes(document, await this.readableScopes(document, view));
+		const served = async (type, documents, reads) => {
+			const documentsServed = await this.gateServedAll(documents, view, void 0, reads);
+			return documentsServed.length > 0 ? {
+				type,
+				documents: documentsServed
+			} : void 0;
+		};
 		let disposed = false;
 		let delivering = Promise.resolve();
 		/**
@@ -1790,49 +1832,46 @@ var ReactorClient = class {
 		* gated is withheld, because serving it unfiltered would leak the scopes
 		* the gate did not clear -- but it is logged rather than swallowed, since
 		* the gate rethrows a transient failure precisely so it is not read as a
-		* denial.
+		* denial. An event that resolves to undefined was withheld.
 		*/
 		const deliver = (event) => {
 			Promise.resolve(event).catch(() => void 0);
 			delivering = delivering.then(async () => {
 				const built = await event;
-				if (disposed) return;
+				if (disposed || !built) return;
 				callback(built);
 			}).catch((error) => {
 				this.logger.error("Subscription delivery failed for @search: @Error", { search }, error);
 			});
 		};
 		const unsubscribeCreated = this.subscriptionManager.onDocumentCreated((result) => {
+			const reads = this.eventReads.forEvent();
 			deliver((async () => {
-				const documents = await Promise.all(result.results.map((id) => this.reactor.get(id, withAuthScope(view), void 0, void 0)));
-				return {
-					type: "created",
-					documents: await Promise.all(documents.map(readable))
-				};
+				const documents = await Promise.all(result.results.map((id) => reads.get(id, withAllScopes(view))));
+				return served("created", documents, reads);
 			})());
 		}, search);
 		const unsubscribeDeleted = this.subscriptionManager.onDocumentDeleted((documentIds) => {
-			deliver({
+			const reads = this.eventReads.forEvent();
+			for (const childId of documentIds) deliver((async () => await this.servesEvery([childId], view, reads) ? {
 				type: "deleted",
 				documents: [],
-				context: { childId: documentIds[0] }
-			});
+				context: { childId }
+			} : void 0)());
 		}, search);
 		const unsubscribeUpdated = this.subscriptionManager.onDocumentStateUpdated((result) => {
-			deliver((async () => ({
-				type: "updated",
-				documents: await Promise.all(result.results.map(readable))
-			}))());
+			deliver(served("updated", result.results, this.eventReads.forEvent()));
 		}, search, view);
 		const unsubscribeRelationship = this.subscriptionManager.onRelationshipChanged((parentId, childId, changeType) => {
-			deliver({
+			const reads = this.eventReads.forEvent();
+			deliver((async () => await this.servesEvery([parentId, childId], view, reads) ? {
 				type: changeType === "added" ? "child_added" : "child_removed",
 				documents: [],
 				context: {
 					parentId,
 					childId
 				}
-			});
+			} : void 0)());
 		}, search);
 		return () => {
 			disposed = true;
@@ -1842,6 +1881,225 @@ var ReactorClient = class {
 			unsubscribeRelationship();
 		};
 	}
+	readSubject(subject) {
+		return subject ?? authSubjectFromSigner(this.signer);
+	}
+	/**
+	* Which scopes of one document the subject may read. Resolved once per
+	* document, so the gate builds its model once however many scopes are then
+	* tested, and the filtering itself stays synchronous.
+	*/
+	readableScopes(document, view, signal, reads) {
+		const subject = this.readSubject(view?.subject);
+		const branch = view?.branch ?? "main";
+		return reads ? reads.scopePredicate(document, subject, branch) : this.readGate.scopePredicate(document, subject, branch, signal);
+	}
+	/**
+	* One document, filtered to the scopes the subject may read. Every method
+	* that hands a document back goes through here, including the ones that
+	* follow a write: a document returned from a mutation is a read like any
+	* other, and returning it whole served scopes the same subject would be
+	* refused by `get`. Its author still sees what it wrote, because an allow on
+	* execute confers read of that scope.
+	*/
+	async gateDocument(document, view, signal) {
+		return filterReadableScopes(document, await this.readableScopes(document, view, signal));
+	}
+	/**
+	* One document as a listing or a feed serves it, or undefined when withheld.
+	* The document must hold every scope, or withholding is decided on a subset;
+	* a narrowing view is applied here instead.
+	*/
+	async gateServed(document, view, signal, reads) {
+		const readable = await this.readableScopes(document, view, signal, reads);
+		if (refusesEveryDomainScope(document, readable)) return;
+		const narrowed = narrowedScopes(view);
+		return filterReadableScopes(document, narrowed ? (scope) => readable(scope) && narrowed.has(scope) : readable);
+	}
+	async gateServedAll(documents, view, signal, reads) {
+		return (await Promise.all(documents.map((document) => this.gateServed(document, view, signal, reads)))).filter((document) => document !== void 0);
+	}
+	/**
+	* Gates a page and every page after it. `nextCursor` is left as the stream
+	* reported it.
+	*/
+	async gateListing(page, view, signal) {
+		const results = (await Promise.all(page.results.map((document) => this.gateListed(document, view, signal)))).filter((document) => document !== void 0);
+		const next = page.next;
+		return {
+			...page,
+			results,
+			next: next ? async () => this.gateListing(await next(), view, signal) : void 0
+		};
+	}
+	/**
+	* One document as a listing serves it, or undefined when withheld. It holds
+	* only the view's scopes; a domain scope it lacks is decided on its name, or
+	* on its state read now when a condition needs that.
+	*/
+	async gateListed(document, view, signal) {
+		const readable = await this.readableScopes(document, view, signal);
+		const unheld = unheldScopesReadOnState(document);
+		if (refusesEveryDomainScope(document, unheld.length === 0 ? readable : (scope) => !unheld.includes(scope) && readable(scope)) && !await this.servesUnheld(document, unheld, view, signal)) return;
+		return filterReadableScopes(document, readable);
+	}
+	async servesUnheld(document, scopes, view, signal) {
+		if (scopes.length === 0) return false;
+		const id = document.header.id;
+		let held;
+		try {
+			held = await this.reactor.get(id, withAuthScope({
+				...view,
+				scopes
+			}), void 0, signal);
+		} catch (error) {
+			await assertAbsent(this.documentView, id, error, signal);
+			return false;
+		}
+		const readable = await this.readableScopes(held, view, signal);
+		return scopes.some(readable);
+	}
+	/**
+	* Whether an event naming only these ids may reach the subject. An id with no
+	* live document behind it has no content left to protect, so it does not
+	* withhold; a deleted document is read at its deletion boundary when
+	* deletion is positional, and gated like any other.
+	*/
+	async servesEvery(ids, view, reads) {
+		return (await Promise.all(ids.map((id) => this.servesId(id, view, reads)))).every(Boolean);
+	}
+	async servesId(id, view, reads) {
+		let document;
+		try {
+			document = await reads.get(id, withAllScopes(view));
+		} catch (error) {
+			await assertAbsent(reads, id, error);
+			return true;
+		}
+		return !refusesEveryDomainScope(document, await this.readableScopes(document, view, void 0, reads));
+	}
+	async getOperationsWithCompositeCursor(documentId, view, filter, paging, signal, canRead) {
+		const scopeCursors = decodeCompositeCursor(paging.cursor);
+		const allOperations = [];
+		const activeCursors = {};
+		for (const [scopeName, cursor] of Object.entries(scopeCursors)) {
+			if (!canRead(scopeName)) continue;
+			const scopeView = {
+				...view,
+				scopes: [scopeName]
+			};
+			const scopePaging = {
+				cursor,
+				limit: paging.limit
+			};
+			const scopeResult = (await this.reactor.getOperations(documentId, scopeView, filter, scopePaging, void 0, signal))[scopeName];
+			allOperations.push(...scopeResult.results);
+			if (scopeResult.nextCursor) activeCursors[scopeName] = scopeResult.nextCursor;
+		}
+		allOperations.sort((a, b) => a.index - b.index);
+		return {
+			results: allOperations,
+			options: paging,
+			nextCursor: Object.keys(activeCursors).length > 0 ? encodeCompositeCursor(activeCursors) : void 0
+		};
+	}
+	/**
+	* Drops the edges whose far-end document the subject may read no domain scope
+	* of. An edge is withheld whole rather than stripped of its metadata: the
+	* document-shaped relationship reads already answer with the far end stripped
+	* to the scopes the gate allows, so the far end's existence is disclosed
+	* either way, but an edge's metadata is content about the pair that the far
+	* end's own reads would refuse. An edge to a far end stripped to nothing
+	* therefore carries content past a refusal, and there is no useful shell to
+	* hand back in its place.
+	*
+	* `nextCursor` and `options` are left as the underlying stream reported them,
+	* because a caller must feed them back to resume from the right position. A
+	* gated page can therefore be shorter than the limit it asked for.
+	*/
+	async gateEdges(page, farEnd, view, signal) {
+		const ids = [...new Set(page.results.map((edge) => edge[farEnd]))];
+		if (ids.length === 0) return page;
+		const farEndView = {
+			subject: view?.subject,
+			branch: view?.branch
+		};
+		const documents = await this.reactor.find({ ids }, farEndView, {
+			cursor: "0",
+			limit: ids.length
+		}, void 0, signal);
+		const readable = new Map(await Promise.all(documents.results.map(async (doc) => {
+			const allows = await this.readableScopes(doc, view, signal);
+			return [doc.header.id, !refusesEveryDomainScope(doc, allows)];
+		})));
+		const results = page.results.filter((edge) => readable.get(edge[farEnd]) !== false);
+		if (results.length === page.results.length) return page;
+		const nextPage = page.next;
+		return {
+			...page,
+			results,
+			next: nextPage ? async () => this.gateEdges(await nextPage(), farEnd, view, signal) : void 0
+		};
+	}
+	/**
+	* One relationship edge, or undefined when it does not exist. A point lookup:
+	* the pair is filtered in SQL rather than scanned out of the source's edge
+	* list, which on a drive with thousands of children is the difference between
+	* one query and dozens.
+	*/
+	async readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, view, signal) {
+		const sourceId = await this.documentView.resolveIdOrSlug(sourceIdentifier, view, void 0, signal);
+		const targetId = await this.documentView.resolveIdOrSlug(targetIdentifier, view, void 0, signal);
+		return (await this.documentIndexer.getDirectedRelationships(sourceId, targetId, [relationshipType], {
+			cursor: "0",
+			limit: 1
+		}, void 0, signal)).results[0];
+	}
+	/**
+	* The id a write on `identifier` is stored under, which its signatures bind.
+	* A create names its own id, and an id no slug maps to is taken as given, so
+	* a document still in flight resolves to itself.
+	*/
+	async resolveWriteTarget(identifier, branch, actions, signal) {
+		if (actions.some((action) => action.type === "CREATE_DOCUMENT")) return identifier;
+		const view = { branch };
+		const bySlug = await this.documentView.resolveSlug(identifier, view, void 0, signal);
+		if (bySlug === void 0 || bySlug === identifier) return identifier;
+		return this.documentView.resolveIdOrSlug(identifier, view, void 0, signal);
+	}
+	/**
+	* The decision model for one target document, built at its stream heads.
+	*
+	* The document is fetched unfiltered, because the policy is what decides:
+	* reading it through the read gate would withhold the very scopes the
+	* decision is about. A deleted document is served at its deletion boundary,
+	* which is what lets the model refuse an execute against it -- authEnforcement
+	* requires documentDecisions, so that read is available whenever this runs.
+	*
+	* Reading past the gate discloses nothing a submit does not. The `auth` and
+	* `document` scopes are readable by every holder, so a verdict resting on the
+	* policy alone is one the caller could compute unaided; and a verdict resting
+	* on a conditional grant reads the executing scope's state exactly as
+	* admission reads it, so the answer here is what submitting and being refused
+	* would have revealed anyway.
+	*
+	* The append condition the build records is dropped. It guards a write, and
+	* this makes none; reproducing it is also what the preflight cannot do, which
+	* is why the answer is a prediction.
+	*/
+	async buildEvaluationTarget(config, documentId, branch, signal) {
+		const document = await this.documentView.get(documentId, { branch }, void 0, signal);
+		const target = {
+			documentId,
+			branch
+		};
+		const built = await buildDecisionModel(new SeededStateReader(this.documentView, document, branch), config.model, target, signal);
+		return {
+			definition: config.model(target),
+			model: built.model,
+			scopeStates: document.state ?? {}
+		};
+	}
 	async removeAllIncomingRelationships(documentId, signal) {
 		const incoming = await this.documentIndexer.getIncoming(documentId, void 0, void 0, void 0, signal);
 		const jobs = [];
@@ -8827,7 +9085,7 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-B-j8VYzA.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-BpcqDtnQ.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
@@ -8871,7 +9129,7 @@ var ReactorBuilder = class {
 	*/
 	async createDefaultWorkerFactory(numWorkers, db) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-CwWNTpUg.js"),
+			import("./worker-handle-C2rLUHwv.js"),
 			import("./transport-CZDHzfvy.js"),
 			Promise.resolve().then(() => worker_exports)
 		]);