@powerhousedao/reactor 6.2.3-dev.3 → 6.2.3-dev.30

package/dist/{build-worker-executor-DnU3ZU4H.js → build-worker-executor-Bvoba-AV.js}

@@ -1,5 +1,4 @@
-import { _ as DocumentMetaCache, c as KyselyKeyframeStore, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache } from "./drive-container-types-yZrksiJR.js";
-import { n as ReactorEventTypes } from "./types-DMKLa0Ok.js";
+import { C as DocumentMetaCache, S as KyselyOperationIndex, a as DEFAULT_DRIVE_CONTAINER_TYPES, b as EventBus, d as KyselyOperationStore, f as KyselyKeyframeStore, m as SimpleJobExecutor, o as REACTOR_SCHEMA, ot as ReactorEventTypes, p as DocumentModelRegistry, v as KyselyExecutionScope, w as CollectionMembershipCache, x as KyselyWriteCache } from "./forwarding-logger-CnuVDVze.js";
 //#region src/executor/worker/build-worker-executor.ts
 async function defaultLoadFactory(spec) {
 	const ref = spec.module;
@@ -38,11 +37,18 @@ async function buildWorkerExecutor(options) {
 	const loadFactory = options.loadFactory ?? defaultLoadFactory;
 	const registry = new DocumentModelRegistry();
 	await loadModelManifest(init.models, loadFactory, registry, logger);
-	let signatureVerifier;
-	if (init.signatureVerifier) try {
-		signatureVerifier = await loadFactory(init.signatureVerifier);
+	let signer;
+	if (init.signer) try {
+		signer = await loadFactory(init.signer);
 	} catch (error) {
-		logger.error("worker failed to load signature verifier: @spec @error", init.signatureVerifier, error);
+		logger.error("worker failed to load signer: @spec @error", init.signer.module, error);
+		throw error;
+	}
+	let trustPolicy;
+	if (init.trustPolicy) try {
+		trustPolicy = await loadFactory(init.trustPolicy);
+	} catch (error) {
+		logger.error("worker failed to load trust policy: @spec @error", init.trustPolicy.module, error);
 		throw error;
 	}
 	const database = baseDatabase.withSchema(REACTOR_SCHEMA);
@@ -67,17 +73,27 @@ async function buildWorkerExecutor(options) {
 			jobMeta: event.jobMeta
 		};
 	});
+	let signatureRefusals = [];
+	eventBus.subscribe(ReactorEventTypes.SIGNATURE_REFUSED, (_t, event) => {
+		signatureRefusals.push(event);
+	});
+	const executorConfig = options.executorConfig ?? {};
 	return {
-		executor: new SimpleJobExecutor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, options.executorConfig ?? {}, signatureVerifier, executionScope),
+		executor: new SimpleJobExecutor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, executorConfig, executionScope, signer, trustPolicy),
 		registry,
 		takeLastWriteReady() {
 			const captured = lastWriteReady;
 			lastWriteReady = null;
 			return captured;
+		},
+		takeSignatureRefusals() {
+			const captured = signatureRefusals;
+			signatureRefusals = [];
+			return captured;
 		}
 	};
 }
 //#endregion
 export { defaultLoadFactory as n, buildWorkerExecutor as t };
 
-//# sourceMappingURL=build-worker-executor-DnU3ZU4H.js.map
+//# sourceMappingURL=build-worker-executor-Bvoba-AV.js.map

package/dist/build-worker-executor-Bvoba-AV.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-worker-executor-Bvoba-AV.js","names":[],"sources":["../src/executor/worker/build-worker-executor.ts"],"sourcesContent":["import type {\n  DocumentModelModule,\n  ISigner,\n  OperationWithContext,\n} from \"@powerhousedao/shared/document-model\";\nimport type { ILogger } from \"document-model\";\nimport type { Kysely } from \"kysely\";\nimport { CollectionMembershipCache } from \"../../cache/collection-membership-cache.js\";\nimport { DocumentMetaCache } from \"../../cache/document-meta-cache.js\";\nimport { KyselyOperationIndex } from \"../../cache/kysely-operation-index.js\";\nimport { KyselyWriteCache } from \"../../cache/kysely-write-cache.js\";\nimport type { WriteCacheConfig } from \"../../cache/write-cache-types.js\";\nimport { DEFAULT_DRIVE_CONTAINER_TYPES } from \"../../core/drive-container-types.js\";\nimport type { Database } from \"../../core/types.js\";\nimport { EventBus } from \"../../events/event-bus.js\";\nimport {\n  ReactorEventTypes,\n  type JobWriteReadyEvent,\n  type SignatureRefusedEvent,\n} from \"../../events/types.js\";\nimport { DocumentModelRegistry } from \"../../registry/implementation.js\";\nimport type { JobMeta } from \"../../shared/types.js\";\nimport { KyselyKeyframeStore } from \"../../storage/kysely/keyframe-store.js\";\nimport { KyselyOperationStore } from \"../../storage/kysely/store.js\";\nimport type { Database as StorageDatabase } from \"../../storage/kysely/types.js\";\nimport { REACTOR_SCHEMA } from \"../../storage/migrations/migrator.js\";\nimport { KyselyExecutionScope } from \"../execution-scope.js\";\nimport { SimpleJobExecutor } from \"../simple-job-executor.js\";\nimport type { SignatureTrustPolicy } from \"../../signer/types.js\";\nimport type { JobExecutorConfig } from \"../types.js\";\nimport type {\n  FactorySpec,\n  InitMessage,\n  ModelManifestEntry,\n} from \"./protocol.js\";\n\n/**\n * In-worker capture of the JOB_WRITE_READY event emitted by the executor.\n * The worker forwards `operations` and `jobMeta` back to the parent; the\n * parent re-enriches `collectionMemberships` at emit time.\n */\nexport type WorkerWriteReadyCapture = {\n  operations: OperationWithContext[];\n  jobMeta: JobMeta;\n};\n\nexport type WorkerExecutorStack = {\n  executor: SimpleJobExecutor;\n  registry: DocumentModelRegistry;\n  /**\n   * Synchronously pops the most-recent JOB_WRITE_READY captured on this\n   * worker's local event bus and clears it. Returns null if the executor\n   * did not produce one for this job.\n   */\n  takeLastWriteReady(): WorkerWriteReadyCapture | null;\n  /** Drains the refusals this worker's executor emitted since the last call. */\n  takeSignatureRefusals(): SignatureRefusedEvent[];\n};\n\nexport type BuildWorkerExecutorOptions = {\n  init: InitMessage;\n  database: Kysely<Database>;\n  logger: ILogger;\n  executorConfig?: JobExecutorConfig;\n  driveContainerTypes?: ReadonlySet<string>;\n  /**\n   * Override the module loader used to materialize factory specs. Tests\n   * can inject a deterministic resolver instead of touching the real\n   * Node module loader.\n   */\n  loadFactory?: (spec: FactorySpec) => Promise<unknown>;\n};\n\nexport async function defaultLoadFactory(spec: FactorySpec): Promise<unknown> {\n  const ref = spec.module;\n  const specifier =\n    \"filePath\" in ref\n      ? new URL(`file://${ref.filePath}`).href\n      : ref.packageName;\n  const mod = (await import(specifier)) as Record<string, unknown>;\n  const exported = mod[ref.exportName];\n  if (typeof exported === \"function\") {\n    return (exported as (args: unknown) => unknown)(spec.initArgs);\n  }\n  return exported;\n}\n\nasync function loadModelManifest(\n  entries: ModelManifestEntry[],\n  loadFactory: (spec: FactorySpec) => Promise<unknown>,\n  registry: DocumentModelRegistry,\n  logger: ILogger,\n): Promise<void> {\n  for (const entry of entries) {\n    let module: DocumentModelModule;\n    try {\n      module = (await loadFactory(entry.spec)) as DocumentModelModule;\n    } catch (error) {\n      logger.error(\n        \"worker failed to load document model: @entry @error\",\n        entry,\n        error,\n      );\n      throw error;\n    }\n    const [result] = registry.registerModules(module);\n    if (result.status === \"error\") {\n      logger.error(\n        \"worker failed to register document model: @entry @error\",\n        entry,\n        result.error,\n      );\n      throw result.error;\n    }\n  }\n}\n\n/**\n * Assembles the in-worker storage stack plus a {@link SimpleJobExecutor}\n * bound to a pre-built Kysely instance. The parent owns the wire protocol\n * and routing; the worker owns everything below `SimpleJobExecutor`.\n *\n * The local event bus exists only to satisfy the executor's contract: its\n * JOB_WRITE_READY emissions are captured here and shipped to the parent\n * via {@link WorkerExecutorStack.takeLastWriteReady}.\n */\nexport async function buildWorkerExecutor(\n  options: BuildWorkerExecutorOptions,\n): Promise<WorkerExecutorStack> {\n  const { init, database: baseDatabase, logger } = options;\n  const driveContainerTypes =\n    options.driveContainerTypes ?? DEFAULT_DRIVE_CONTAINER_TYPES;\n  const loadFactory = options.loadFactory ?? defaultLoadFactory;\n\n  const registry = new DocumentModelRegistry();\n  await loadModelManifest(init.models, loadFactory, registry, logger);\n\n  let signer: ISigner | undefined;\n  if (init.signer) {\n    try {\n      signer = (await loadFactory(init.signer)) as ISigner;\n    } catch (error) {\n      logger.error(\n        \"worker failed to load signer: @spec @error\",\n        init.signer.module,\n        error,\n      );\n      throw error;\n    }\n  }\n\n  let trustPolicy: SignatureTrustPolicy | undefined;\n  if (init.trustPolicy) {\n    try {\n      trustPolicy = (await loadFactory(\n        init.trustPolicy,\n      )) as SignatureTrustPolicy;\n    } catch (error) {\n      logger.error(\n        \"worker failed to load trust policy: @spec @error\",\n        init.trustPolicy.module,\n        error,\n      );\n      throw error;\n    }\n  }\n\n  const database = baseDatabase.withSchema(REACTOR_SCHEMA);\n  const operationStore = new KyselyOperationStore(\n    database as unknown as Kysely<StorageDatabase>,\n  );\n  const keyframeStore = new KyselyKeyframeStore(\n    database as unknown as Kysely<StorageDatabase>,\n  );\n\n  const cacheConfig: WriteCacheConfig = {\n    maxDocuments: 100,\n    ringBufferSize: 10,\n    keyframeInterval: 10,\n  };\n  const writeCache = new KyselyWriteCache(\n    keyframeStore,\n    operationStore,\n    registry,\n    cacheConfig,\n  );\n  await writeCache.startup();\n\n  const operationIndex = new KyselyOperationIndex(\n    database as unknown as Kysely<StorageDatabase>,\n  );\n\n  const documentMetaCache = new DocumentMetaCache(operationStore, {\n    maxDocuments: 1000,\n  });\n  await documentMetaCache.startup();\n\n  const collectionMembershipCache = new CollectionMembershipCache(\n    operationIndex,\n  );\n\n  const executionScope = new KyselyExecutionScope(\n    database as unknown as Kysely<StorageDatabase>,\n    operationStore,\n    operationIndex,\n    keyframeStore,\n    writeCache,\n    documentMetaCache,\n    collectionMembershipCache,\n  );\n\n  const eventBus = new EventBus();\n  let lastWriteReady: WorkerWriteReadyCapture | null = null;\n  eventBus.subscribe(\n    ReactorEventTypes.JOB_WRITE_READY,\n    (_t: number, event: JobWriteReadyEvent) => {\n      lastWriteReady = {\n        operations: event.operations,\n        jobMeta: event.jobMeta,\n      };\n    },\n  );\n\n  let signatureRefusals: SignatureRefusedEvent[] = [];\n  eventBus.subscribe(\n    ReactorEventTypes.SIGNATURE_REFUSED,\n    (_t: number, event: SignatureRefusedEvent) => {\n      signatureRefusals.push(event);\n    },\n  );\n\n  const executorConfig = options.executorConfig ?? {};\n  const executor = new SimpleJobExecutor(\n    logger,\n    registry,\n    operationStore,\n    eventBus,\n    writeCache,\n    operationIndex,\n    documentMetaCache,\n    collectionMembershipCache,\n    driveContainerTypes,\n    executorConfig,\n    executionScope,\n    signer,\n    trustPolicy,\n  );\n\n  return {\n    executor,\n    registry,\n    takeLastWriteReady(): WorkerWriteReadyCapture | null {\n      const captured = lastWriteReady;\n      lastWriteReady = null;\n      return captured;\n    },\n    takeSignatureRefusals(): SignatureRefusedEvent[] {\n      const captured = signatureRefusals;\n      signatureRefusals = [];\n      return captured;\n    },\n  };\n}\n"],"mappings":";;AAyEA,eAAsB,mBAAmB,MAAqC;CAC5E,MAAM,MAAM,KAAK;CAMjB,MAAM,YAAW,OAJf,cAAc,MAAA,OACV,IAAI,IAAI,UAAU,IAAI,UAAU,CAAC,CAAC,QAAA,OAClC,IAAI,cAAA,CAEW,IAAI;CACzB,IAAI,OAAO,aAAa,YACtB,OAAQ,SAAwC,KAAK,QAAQ;CAE/D,OAAO;AACT;AAEA,eAAe,kBACb,SACA,aACA,UACA,QACe;CACf,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI;EACJ,IAAI;GACF,SAAU,MAAM,YAAY,MAAM,IAAI;EACxC,SAAS,OAAO;GACd,OAAO,MACL,uDACA,OACA,KACF;GACA,MAAM;EACR;EACA,MAAM,CAAC,UAAU,SAAS,gBAAgB,MAAM;EAChD,IAAI,OAAO,WAAW,SAAS;GAC7B,OAAO,MACL,2DACA,OACA,OAAO,KACT;GACA,MAAM,OAAO;EACf;CACF;AACF;;;;;;;;;;AAWA,eAAsB,oBACpB,SAC8B;CAC9B,MAAM,EAAE,MAAM,UAAU,cAAc,WAAW;CACjD,MAAM,sBACJ,QAAQ,uBAAuB;CACjC,MAAM,cAAc,QAAQ,eAAe;CAE3C,MAAM,WAAW,IAAI,sBAAsB;CAC3C,MAAM,kBAAkB,KAAK,QAAQ,aAAa,UAAU,MAAM;CAElE,IAAI;CACJ,IAAI,KAAK,QACP,IAAI;EACF,SAAU,MAAM,YAAY,KAAK,MAAM;CACzC,SAAS,OAAO;EACd,OAAO,MACL,8CACA,KAAK,OAAO,QACZ,KACF;EACA,MAAM;CACR;CAGF,IAAI;CACJ,IAAI,KAAK,aACP,IAAI;EACF,cAAe,MAAM,YACnB,KAAK,WACP;CACF,SAAS,OAAO;EACd,OAAO,MACL,oDACA,KAAK,YAAY,QACjB,KACF;EACA,MAAM;CACR;CAGF,MAAM,WAAW,aAAa,WAAW,cAAc;CACvD,MAAM,iBAAiB,IAAI,qBACzB,QACF;CACA,MAAM,gBAAgB,IAAI,oBACxB,QACF;CAOA,MAAM,aAAa,IAAI,iBACrB,eACA,gBACA,UACA;EARA,cAAc;EACd,gBAAgB;EAChB,kBAAkB;CAMR,CACZ;CACA,MAAM,WAAW,QAAQ;CAEzB,MAAM,iBAAiB,IAAI,qBACzB,QACF;CAEA,MAAM,oBAAoB,IAAI,kBAAkB,gBAAgB,EAC9D,cAAc,IAChB,CAAC;CACD,MAAM,kBAAkB,QAAQ;CAEhC,MAAM,4BAA4B,IAAI,0BACpC,cACF;CAEA,MAAM,iBAAiB,IAAI,qBACzB,UACA,gBACA,gBACA,eACA,YACA,mBACA,yBACF;CAEA,MAAM,WAAW,IAAI,SAAS;CAC9B,IAAI,iBAAiD;CACrD,SAAS,UACP,kBAAkB,kBACjB,IAAY,UAA8B;EACzC,iBAAiB;GACf,YAAY,MAAM;GAClB,SAAS,MAAM;EACjB;CACF,CACF;CAEA,IAAI,oBAA6C,CAAC;CAClD,SAAS,UACP,kBAAkB,oBACjB,IAAY,UAAiC;EAC5C,kBAAkB,KAAK,KAAK;CAC9B,CACF;CAEA,MAAM,iBAAiB,QAAQ,kBAAkB,CAAC;CAiBlD,OAAO;EACL,UAAA,IAjBmB,kBACnB,QACA,UACA,gBACA,UACA,YACA,gBACA,mBACA,2BACA,qBACA,gBACA,gBACA,QACA,WAIO;EACP;EACA,qBAAqD;GACnD,MAAM,WAAW;GACjB,iBAAiB;GACjB,OAAO;EACT;EACA,wBAAiD;GAC/C,MAAM,WAAW;GACjB,oBAAoB,CAAC;GACrB,OAAO;EACT;CACF;AACF"}

package/dist/{document-indexer-C5Gsa1B3.js → document-indexer-BVTGbEB0.js}

@@ -1,17 +1,55 @@
-import { L as DocumentExistence } from "./drive-container-types-yZrksiJR.js";
-import { n as ReactorEventTypes } from "./types-DMKLa0Ok.js";
+import { ot as ReactorEventTypes, ut as yieldToMain } from "./forwarding-logger-CnuVDVze.js";
 import { createAuthState, isDenied } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { childLogger } from "document-model";
 //#region src/read-models/base-read-model.ts
+/** Small enough that a chunk's transaction rarely outlasts the yield deadline. */
+const DEFAULT_COMMIT_CHUNK_SIZE = 50;
+/** Matches the executor's own default, so both paths yield on the same cadence. */
+const DEFAULT_READ_MODEL_YIELD_DEADLINE_MS = 50;
+const defaultReadModelIndexingConfig = {
+	commitChunkSize: 50,
+	yieldDeadlineMs: 50
+};
+/** For read models whose callers can observe where a batch was split. */
+const unchunkedReadModelIndexingConfig = {
+	commitChunkSize: Number.MAX_SAFE_INTEGER,
+	yieldDeadlineMs: 50
+};
+/**
+* Keeps the chunk size at one operation or more: a chunk of zero or less never
+* advances the indexing loop, so the pass would spin without ever resolving.
+*/
+function normalizeIndexingConfig(config) {
+	if (Number.isNaN(config.commitChunkSize)) return {
+		...config,
+		commitChunkSize: 50
+	};
+	return {
+		...config,
+		commitChunkSize: Math.max(1, Math.min(Math.floor(config.commitChunkSize), Number.MAX_SAFE_INTEGER))
+	};
+}
 /**
 * Base class for read models that provides catch-up/rewind functionality.
 * Handles initialization, state tracking via ViewState table, and consistency tracking.
 * Subclasses override commitOperations() with their specific domain logic.
 */
 var BaseReadModel = class {
+	db;
+	operationIndex;
+	writeCache;
+	consistencyTracker;
+	config;
 	lastOrdinal = 0;
 	name;
+	indexing;
+	/**
+	* Lowest ordinal this model failed to commit and has not committed since, or
+	* zero when there is none. The stored cursor is held below it so replay from
+	* the cursor still reaches every operation the failed pass left out.
+	*/
+	uncommittedOrdinal = 0;
 	constructor(db, operationIndex, writeCache, consistencyTracker, config) {
 		this.db = db;
 		this.operationIndex = operationIndex;
@@ -19,6 +57,7 @@ var BaseReadModel = class {
 		this.consistencyTracker = consistencyTracker;
 		this.config = config;
 		this.name = config.readModelId;
+		this.indexing = normalizeIndexingConfig(config.indexing ?? defaultReadModelIndexingConfig);
 	}
 	/**
 	* Initializes the read model by loading state and catching up on missed operations.
@@ -36,15 +75,33 @@ var BaseReadModel = class {
 		}
 	}
 	/**
-	* Template method: runs domain-specific commitOperations, then persists
-	* state and updates consistency tracking.
+	* Commits the batch in chunks, yielding between them with no transaction
+	* open. A chunk that throws leaves the earlier chunks committed, so the pass
+	* saves the cursor for that prefix and parks it below the operation it could
+	* not commit before rethrowing.
 	*/
 	async indexOperations(items) {
 		if (items.length === 0) return;
-		await this.commitOperations(items);
-		await this.db.transaction().execute(async (trx) => {
-			await this.saveState(trx, items);
-		});
+		const { commitChunkSize, yieldDeadlineMs } = this.indexing;
+		let lastYield = performance.now();
+		let committed = 0;
+		for (let start = 0; start < items.length; start += commitChunkSize) {
+			if (start > 0 && performance.now() - lastYield > yieldDeadlineMs) {
+				await yieldToMain();
+				lastYield = performance.now();
+			}
+			const chunk = items.slice(start, start + commitChunkSize);
+			try {
+				await this.commitOperations(chunk);
+			} catch (error) {
+				this.park(items, committed);
+				await this.recordCommittedPrefix(items.slice(0, committed));
+				throw error;
+			}
+			committed += chunk.length;
+		}
+		this.liftParkIfCommitted(items);
+		await this.persistCursor(items);
 		this.updateConsistencyTracker(items);
 	}
 	/**
@@ -96,9 +153,10 @@ var BaseReadModel = class {
 	async saveState(trx, items) {
 		let maxOrdinal = 0;
 		for (const item of items) maxOrdinal = Math.max(maxOrdinal, item.context.ordinal);
-		this.lastOrdinal = maxOrdinal;
+		const next = Math.max(this.lastOrdinal, maxOrdinal);
+		this.lastOrdinal = next;
 		await trx.updateTable("ViewState").set({
-			lastOrdinal: maxOrdinal,
+			lastOrdinal: next,
 			lastOperationTimestamp: /* @__PURE__ */ new Date()
 		}).where("readModelId", "=", this.config.readModelId).execute();
 	}
@@ -118,6 +176,59 @@ var BaseReadModel = class {
 		}
 		this.consistencyTracker.update(coordinates);
 	}
+	/**
+	* Saves the cursor for the chunks that did commit before a later chunk threw.
+	* A failure here is swallowed: the cursor simply stays where the pass found
+	* it, which is equally safe, and the commit error is the one worth raising.
+	*/
+	async recordCommittedPrefix(prefix) {
+		if (prefix.length === 0) return;
+		try {
+			await this.persistCursor(prefix);
+		} catch {
+			return;
+		}
+		this.updateConsistencyTracker(prefix);
+	}
+	/** Writes the cursor for the given items, never past a parked ordinal. */
+	async persistCursor(items) {
+		await this.db.transaction().execute(async (trx) => {
+			await this.saveState(trx, items);
+			await this.clampCursorToPark(trx);
+		});
+	}
+	/**
+	* Holds the cursor written by {@link saveState}, which subclasses may
+	* override, below the lowest operation this model failed to commit.
+	*/
+	async clampCursorToPark(trx) {
+		if (this.uncommittedOrdinal === 0) return;
+		const ceiling = this.uncommittedOrdinal - 1;
+		if (this.lastOrdinal <= ceiling) return;
+		this.lastOrdinal = ceiling;
+		await trx.updateTable("ViewState").set({
+			lastOrdinal: ceiling,
+			lastOperationTimestamp: /* @__PURE__ */ new Date()
+		}).where("readModelId", "=", this.config.readModelId).execute();
+	}
+	/** Remembers the lowest ordinal the failed pass left uncommitted. */
+	park(items, committed) {
+		let lowest = 0;
+		for (let i = committed; i < items.length; i++) {
+			const ordinal = items[i].context.ordinal;
+			if (lowest === 0 || ordinal < lowest) lowest = ordinal;
+		}
+		if (lowest === 0) return;
+		if (this.uncommittedOrdinal === 0 || lowest < this.uncommittedOrdinal) this.uncommittedOrdinal = lowest;
+	}
+	/** The park lifts once a later pass commits the operation that failed. */
+	liftParkIfCommitted(items) {
+		if (this.uncommittedOrdinal === 0) return;
+		for (const item of items) if (item.context.ordinal === this.uncommittedOrdinal) {
+			this.uncommittedOrdinal = 0;
+			return;
+		}
+	}
 };
 //#endregion
 //#region src/read-models/coordinator.ts
@@ -129,6 +240,9 @@ var BaseReadModel = class {
 * implicitly.
 */
 var ReadModelCoordinator = class {
+	eventBus;
+	preReady;
+	postReady;
 	unsubscribe;
 	isRunning = false;
 	chains = /* @__PURE__ */ new Map();
@@ -280,15 +394,36 @@ const DOCUMENT_VIEW_READ_MODEL = "document-view";
 const DOCUMENT_INDEXER_READ_MODEL = "document-indexer";
 //#endregion
 //#region src/read-models/document-view.ts
+/**
+* What a single-document read of a deleted document returns. A listing omits a
+* deleted document under either value.
+*/
+let DeletedDocumentRead = /* @__PURE__ */ function(DeletedDocumentRead) {
+	/**
+	* The document reads as missing: `get` throws and `resolveIdOrSlug` does not
+	* match its id.
+	*/
+	DeletedDocumentRead["NotFound"] = "NotFound";
+	/**
+	* The document's state as of the deletion, with `state.document.isDeleted`
+	* telling the caller what it holds. Only meaningful with `documentDecisions`,
+	* which is what makes deletion positional.
+	*/
+	DeletedDocumentRead["StateAtDeletion"] = "StateAtDeletion";
+	return DeletedDocumentRead;
+}({});
 var KyselyDocumentView = class extends BaseReadModel {
+	operationStore;
+	deletedDocumentRead;
 	_db;
-	constructor(db, operationStore, operationIndex, writeCache, consistencyTracker, servesDeletionBoundary) {
+	constructor(db, operationStore, operationIndex, writeCache, consistencyTracker, deletedDocumentRead, indexing = defaultReadModelIndexingConfig) {
 		super(db, operationIndex, writeCache, consistencyTracker, {
 			readModelId: DOCUMENT_VIEW_READ_MODEL,
-			rebuildStateOnInit: true
+			rebuildStateOnInit: true,
+			indexing
 		});
 		this.operationStore = operationStore;
-		this.servesDeletionBoundary = servesDeletionBoundary;
+		this.deletedDocumentRead = deletedDocumentRead;
 		this._db = db;
 	}
 	/**
@@ -300,12 +435,17 @@ var KyselyDocumentView = class extends BaseReadModel {
 	* without either fall back to header/document/auth, because their sibling
 	* echoes may be stale. All other action types index only header and their
 	* own scope.
+	*
+	* The header row is the one row every scope's chain writes, so it accepts a
+	* write only from an operation whose global ordinal is at least the one the
+	* row already carries. Without that, a chunked pass that started earlier
+	* reverts a concurrent rename with the stale echo its later chunks carry.
 	*/
 	async commitOperations(items) {
 		await this._db.transaction().execute(async (trx) => {
 			for (const item of items) {
 				const { operation, context } = item;
-				const { documentId, scope, branch, documentType, resultingState } = context;
+				const { documentId, scope, branch, documentType, resultingState, ordinal } = context;
 				const { index, hash } = operation;
 				if (!resultingState) throw new Error(`Missing resultingState in context for operation ${operation.id || "unknown"}. IDocumentView requires resultingState from upstream - it does not rebuild documents.`);
 				let fullState;
@@ -324,6 +464,7 @@ var KyselyDocumentView = class extends BaseReadModel {
 						deletedAt: now,
 						lastOperationIndex: index,
 						lastOperationHash: hash,
+						lastOperationOrdinal: ordinal,
 						lastUpdatedAt: now
 					}).where("documentId", "=", documentId).where("branch", "=", branch).execute();
 					const deletedDocumentScope = fullState?.document;
@@ -345,7 +486,15 @@ var KyselyDocumentView = class extends BaseReadModel {
 					else scopesToIndex.push([scope, {}]);
 				}
 				for (const [scopeName, scopeState] of scopesToIndex) {
-					const existingSnapshot = await trx.selectFrom("DocumentSnapshot").selectAll().where("documentId", "=", documentId).where("scope", "=", scopeName).where("branch", "=", branch).executeTakeFirst();
+					const needsExistingContent = scopeName === "header" && preserveHeaderMeta;
+					const existingSnapshot = await trx.selectFrom("DocumentSnapshot").select([
+						"slug",
+						"name",
+						"isDeleted",
+						"snapshotVersion",
+						"lastOperationOrdinal"
+					]).$if(needsExistingContent, (qb) => qb.select("content")).where("documentId", "=", documentId).where("scope", "=", scopeName).where("branch", "=", branch).executeTakeFirst();
+					if (scopeName === "header" && existingSnapshot !== void 0 && existingSnapshot.lastOperationOrdinal > ordinal) continue;
 					const newState = typeof scopeState === "object" && scopeState !== null ? scopeState : {};
 					let slug = existingSnapshot?.slug ?? null;
 					let name = existingSnapshot?.name ?? null;
@@ -354,7 +503,7 @@ var KyselyDocumentView = class extends BaseReadModel {
 						const headerName = newState.name;
 						if (typeof headerSlug === "string") slug = headerSlug;
 						if (typeof headerName === "string") name = headerName;
-						if (preserveHeaderMeta && existingSnapshot) {
+						if (needsExistingContent && existingSnapshot) {
 							const existingHeader = existingSnapshot.content;
 							if (existingHeader && "meta" in existingHeader) newState.meta = existingHeader.meta;
 						}
@@ -372,12 +521,13 @@ var KyselyDocumentView = class extends BaseReadModel {
 					if (existingSnapshot) await trx.updateTable("DocumentSnapshot").set({
 						lastOperationIndex: index,
 						lastOperationHash: hash,
+						lastOperationOrdinal: ordinal,
 						lastUpdatedAt: /* @__PURE__ */ new Date(),
 						snapshotVersion: existingSnapshot.snapshotVersion + 1,
 						content: newState,
 						slug,
 						name
-					}).where("documentId", "=", documentId).where("scope", "=", scopeName).where("branch", "=", branch).execute();
+					}).where("documentId", "=", documentId).where("scope", "=", scopeName).where("branch", "=", branch).$if(scopeName === "header", (qb) => qb.where("lastOperationOrdinal", "<=", ordinal)).execute();
 					else {
 						const snapshot = {
 							id: v4(),
@@ -390,6 +540,7 @@ var KyselyDocumentView = class extends BaseReadModel {
 							documentType,
 							lastOperationIndex: index,
 							lastOperationHash: hash,
+							lastOperationOrdinal: ordinal,
 							identifiers: null,
 							metadata: null,
 							deletedAt: null
@@ -404,7 +555,7 @@ var KyselyDocumentView = class extends BaseReadModel {
 		if (consistencyToken) await this.waitForConsistency(consistencyToken, void 0, signal);
 		if (signal?.aborted) throw new Error("Operation aborted");
 		if (documentIds.length === 0) return [];
-		const existingIds = existence === DocumentExistence.IncludingDeleted ? await this.idsWithStreams(documentIds, signal) : await this.liveIds(documentIds);
+		const existingIds = existence === "IncludingDeleted" ? await this.idsWithStreams(documentIds, signal) : await this.liveIds(documentIds);
 		return documentIds.map((id) => existingIds.has(id));
 	}
 	async get(documentId, view, consistencyToken, signal) {
@@ -412,14 +563,14 @@ var KyselyDocumentView = class extends BaseReadModel {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const branch = view?.branch || "main";
 		let scopesToQuery;
-		if (view?.scopes && view.scopes.length > 0) scopesToQuery = [...new Set([
+		if (view?.scopes && view.scopes.length > 0) scopesToQuery = [.../* @__PURE__ */ new Set([
 			"header",
 			"document",
 			...view.scopes
 		])];
 		else scopesToQuery = [];
 		let query = this._db.selectFrom("DocumentSnapshot").selectAll().where("documentId", "=", documentId).where("branch", "=", branch);
-		if (!this.servesDeletionBoundary) query = query.where("isDeleted", "=", false);
+		if (this.deletedDocumentRead === "NotFound") query = query.where("isDeleted", "=", false);
 		if (scopesToQuery.length > 0) query = query.where("scope", "in", scopesToQuery);
 		const snapshots = await query.execute();
 		if (snapshots.length === 0) throw new Error(`Document not found: ${documentId}`);
@@ -449,7 +600,7 @@ var KyselyDocumentView = class extends BaseReadModel {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const branch = view?.branch || "main";
 		let scopesToQuery;
-		if (view?.scopes && view.scopes.length > 0) scopesToQuery = [...new Set([
+		if (view?.scopes && view.scopes.length > 0) scopesToQuery = [.../* @__PURE__ */ new Set([
 			"header",
 			"document",
 			...view.scopes
@@ -508,17 +659,11 @@ var KyselyDocumentView = class extends BaseReadModel {
 		const branch = view?.branch || "main";
 		const startIndex = paging?.cursor ? parseInt(paging.cursor) : 0;
 		const limit = paging?.limit || 100;
-		const documents = [];
-		const processedDocumentIds = /* @__PURE__ */ new Set();
-		const allDocumentIds = [];
-		const snapshots = await this._db.selectFrom("DocumentSnapshot").selectAll().where("documentType", "=", type).where("branch", "=", branch).where("isDeleted", "=", false).orderBy("lastUpdatedAt", "desc").execute();
+		const rows = await this._db.selectFrom("DocumentSnapshot").select("documentId").select((eb) => eb.fn.max("lastUpdatedAt").as("lastUpdatedAt")).where("documentType", "=", type).where("branch", "=", branch).where("isDeleted", "=", false).groupBy("documentId").orderBy("lastUpdatedAt", "desc").orderBy("documentId", "asc").offset(startIndex).limit(limit + 1).execute();
 		if (signal?.aborted) throw new Error("Operation aborted");
-		for (const snapshot of snapshots) {
-			if (processedDocumentIds.has(snapshot.documentId)) continue;
-			processedDocumentIds.add(snapshot.documentId);
-			allDocumentIds.push(snapshot.documentId);
-		}
-		const docsToFetch = allDocumentIds.slice(startIndex, startIndex + limit);
+		const hasMore = rows.length > limit;
+		const docsToFetch = rows.slice(0, limit).map((row) => row.documentId);
+		const documents = [];
 		for (const documentId of docsToFetch) {
 			if (signal?.aborted) throw new Error("Operation aborted");
 			try {
@@ -528,7 +673,6 @@ var KyselyDocumentView = class extends BaseReadModel {
 				continue;
 			}
 		}
-		const hasMore = allDocumentIds.length > startIndex + limit;
 		const nextCursor = hasMore ? String(startIndex + limit) : void 0;
 		return {
 			results: documents,
@@ -537,7 +681,6 @@ var KyselyDocumentView = class extends BaseReadModel {
 				limit: 100
 			},
 			nextCursor,
-			totalCount: allDocumentIds.length,
 			next: hasMore ? () => this.findByType(type, view, {
 				cursor: nextCursor,
 				limit
@@ -564,7 +707,7 @@ var KyselyDocumentView = class extends BaseReadModel {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const branch = view?.branch || "main";
 		let idCheckQuery = this._db.selectFrom("DocumentSnapshot").select("documentId").where("documentId", "=", identifier).where("branch", "=", branch);
-		if (!this.servesDeletionBoundary) idCheckQuery = idCheckQuery.where("isDeleted", "=", false);
+		if (this.deletedDocumentRead === "NotFound") idCheckQuery = idCheckQuery.where("isDeleted", "=", false);
 		const idCheckPromise = idCheckQuery.executeTakeFirst();
 		const slugCheckPromise = this._db.selectFrom("SlugMapping").select("documentId").where("slug", "=", identifier).where("branch", "=", branch).executeTakeFirst();
 		const [idMatch, slugMatch] = await Promise.all([idCheckPromise, slugCheckPromise]);
@@ -713,18 +856,25 @@ async function collectAllPages(firstPage, signal) {
 }
 //#endregion
 //#region src/storage/kysely/document-indexer.ts
+function isRelationshipAction(actionType) {
+	return actionType === "ADD_RELATIONSHIP" || actionType === "REMOVE_RELATIONSHIP" || actionType === "UPDATE_RELATIONSHIP";
+}
 var KyselyDocumentIndexer = class extends BaseReadModel {
 	_db;
-	constructor(db, operationIndex, writeCache, consistencyTracker) {
+	constructor(db, operationIndex, writeCache, consistencyTracker, indexing = defaultReadModelIndexingConfig) {
 		super(db, operationIndex, writeCache, consistencyTracker, {
 			readModelId: DOCUMENT_INDEXER_READ_MODEL,
-			rebuildStateOnInit: false
+			rebuildStateOnInit: false,
+			indexing
 		});
 		this._db = db;
 	}
+	/** Opens no transaction for a batch carrying no relationship operation. */
 	async commitOperations(items) {
+		const relationshipOps = items.filter((item) => isRelationshipAction(item.operation.action.type));
+		if (relationshipOps.length === 0) return;
 		await this._db.transaction().execute(async (trx) => {
-			for (const item of items) {
+			for (const item of relationshipOps) {
 				const { operation } = item;
 				const actionType = operation.action.type;
 				if (actionType === "ADD_RELATIONSHIP") await this.handleAddRelationship(trx, operation);
@@ -896,7 +1046,7 @@ var KyselyDocumentIndexer = class extends BaseReadModel {
 	async findAncestors(documentId, types, consistencyToken, signal) {
 		if (consistencyToken) await this.waitForConsistency(consistencyToken, void 0, signal);
 		if (signal?.aborted) throw new Error("Operation aborted");
-		const nodes = new Set([documentId]);
+		const nodes = /* @__PURE__ */ new Set([documentId]);
 		const edges = [];
 		const queue = [documentId];
 		const visited = /* @__PURE__ */ new Set();
@@ -953,6 +1103,6 @@ var KyselyDocumentIndexer = class extends BaseReadModel {
 	}
 };
 //#endregion
-export { DOCUMENT_INDEXER_READ_MODEL as a, BaseReadModel as c, KyselyDocumentView as i, ConsistencyTracker as n, DOCUMENT_VIEW_READ_MODEL as o, makeConsistencyKey as r, ReadModelCoordinator as s, KyselyDocumentIndexer as t };
+export { KyselyDocumentView as a, ReadModelCoordinator as c, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS as d, defaultReadModelIndexingConfig as f, DeletedDocumentRead as i, BaseReadModel as l, ConsistencyTracker as n, DOCUMENT_INDEXER_READ_MODEL as o, unchunkedReadModelIndexingConfig as p, makeConsistencyKey as r, DOCUMENT_VIEW_READ_MODEL as s, KyselyDocumentIndexer as t, DEFAULT_COMMIT_CHUNK_SIZE as u };
 
-//# sourceMappingURL=document-indexer-C5Gsa1B3.js.map
+//# sourceMappingURL=document-indexer-BVTGbEB0.js.map