@powerhousedao/reactor 6.2.3-dev.34 → 6.2.3-dev.36

package/dist/{forwarding-logger-BkwlvD9W.js → forwarding-logger-DMqDs9tE.js}

@@ -1,4 +1,4 @@
-import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, PEER_CAPABILITIES, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isUndoRedo, isV2ActionHash, localSupports, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, DowngradeNotSupportedError as DowngradeNotSupportedError$1, PEER_CAPABILITIES, PURGE_DOCUMENT, actionSignerIdentity, actionSigningTarget, appendWithoutApplying, applyAuthAction, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, createDocumentState, createPresignedHeader, decide, defaultBaseState, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isPurgeMarker, isUndoRedo, isV2ActionHash, localSupports, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, purgeDocumentAction, purgeMarkerOperation, purgedProtocolVersions, referencedGroupIds, signaturePolicyOf, sortOperations, targetDocumentId, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
 import { v4 } from "uuid";
 import { Migrator, TableNode, sql } from "kysely";
 //#region \0rolldown/runtime.js
@@ -271,8 +271,81 @@ var DocumentNotFoundError = class DocumentNotFoundError extends Error {
 		this.documentId = documentId;
 		Error.captureStackTrace(this, DocumentNotFoundError);
 	}
+	/** Also true for DocumentPurgedError: only the name crosses the queue. */
 	static isError(error) {
-		return Error.isError(error) && error.name === "DocumentNotFoundError";
+		return Error.isError(error) && (error.name === "DocumentNotFoundError" || error.name === "DocumentPurgedError");
+	}
+};
+/** The document was purged; readers treat it as absent. Terminal. */
+var DocumentPurgedError = class DocumentPurgedError extends DocumentNotFoundError {
+	purged = true;
+	constructor(documentId, message) {
+		super(documentId, message ?? `Document ${documentId} was purged`);
+		this.name = "DocumentPurgedError";
+		Error.captureStackTrace(this, DocumentPurgedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DocumentPurgedError";
+	}
+};
+/** A purge was asked for a document that is not deleted. Terminal. */
+var DocumentNotDeletedError = class DocumentNotDeletedError extends Error {
+	documentId;
+	constructor(documentId, message) {
+		super(message ?? `Document ${documentId} is not deleted`);
+		this.name = "DocumentNotDeletedError";
+		this.documentId = documentId;
+		Error.captureStackTrace(this, DocumentNotDeletedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DocumentNotDeletedError";
+	}
+};
+/** A surviving document's accepted auth history names the group. Terminal. */
+var GroupInUseError = class GroupInUseError extends Error {
+	groupId;
+	referencingDocumentIds;
+	constructor(groupId, referencingDocumentIds) {
+		super(`Group ${groupId} cannot be purged: the auth history of ${referencingDocumentIds.join(", ")} names it`);
+		this.name = "GroupInUseError";
+		this.groupId = groupId;
+		this.referencingDocumentIds = referencingDocumentIds;
+		Error.captureStackTrace(this, GroupInUseError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "GroupInUseError";
+	}
+};
+/** A purge above maxPurgeOperations without allowLarge. Terminal. */
+var PurgeTooLargeError = class PurgeTooLargeError extends Error {
+	documentId;
+	operationCount;
+	maxPurgeOperations;
+	constructor(documentId, operationCount, maxPurgeOperations) {
+		super(`Document ${documentId} has ${operationCount} operations, above the purge limit of ${maxPurgeOperations}; request it with allowLarge`);
+		this.name = "PurgeTooLargeError";
+		this.documentId = documentId;
+		this.operationCount = operationCount;
+		this.maxPurgeOperations = maxPurgeOperations;
+		Error.captureStackTrace(this, PurgeTooLargeError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "PurgeTooLargeError";
+	}
+};
+/** A regular write carried an action type only the reactor issues. Terminal. */
+var ReservedActionError = class ReservedActionError extends Error {
+	documentId;
+	actionType;
+	constructor(documentId, actionType) {
+		super(`Action ${actionType} is reserved and cannot be submitted to document ${documentId}`);
+		this.name = "ReservedActionError";
+		this.documentId = documentId;
+		this.actionType = actionType;
+		Error.captureStackTrace(this, ReservedActionError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ReservedActionError";
 	}
 };
 /**
@@ -490,9 +563,13 @@ async function buildDecisionModel(reader, definition, target, signal) {
 		model[key] = (await readStream(reader, projection.query, reads, signal)).state;
 	}
 	const staticModel = { ...model };
+	const derived = [];
 	for (const [key, projection] of projections) {
 		if (typeof projection.query !== "function") continue;
-		const queries = projection.query(staticModel);
+		derived.push([key, projection.query(staticModel)]);
+	}
+	if (derived.length > 0 && reader.fence) await reader.fence(derived.flatMap(([, queries]) => queries.map((q) => q.documentId)));
+	for (const [key, queries] of derived) {
 		const value = {};
 		for (const query of queries) {
 			let read;
@@ -1047,6 +1124,95 @@ function summarizeSubmittedActions(operations, submitted) {
 		allApplied: actions.every((action) => action.kind === "applied")
 	};
 }
+/** Tombstones a job has read, each under the shared lock it took first. */
+var PurgeFence = class {
+	locks;
+	checked;
+	purged;
+	constructor(locks, checked, purged) {
+		this.locks = locks;
+		this.checked = checked;
+		this.purged = purged;
+	}
+	/** Locks and reads an id the job start did not resolve. */
+	async isPurged(documentId) {
+		await this.isPurgedMany([documentId]);
+		return this.purged.has(documentId);
+	}
+	/** Locks and reads the unresolved ids in one lock and one lookup. */
+	async isPurgedMany(documentIds) {
+		const unchecked = [...new Set(documentIds)].filter((id) => !this.checked.has(id));
+		if (unchecked.length > 0) {
+			await this.locks.shared(unchecked);
+			const found = await this.locks.purged(unchecked);
+			for (const id of unchecked) this.checked.add(id);
+			for (const id of found) this.purged.add(id);
+		}
+		return new Set(documentIds.filter((id) => this.purged.has(id)));
+	}
+};
+/** Locks and checks an id on its first read; a purged id reads as purged. */
+var FencedWriteCache = class {
+	inner;
+	purgeFence;
+	evict;
+	evicted = /* @__PURE__ */ new Set();
+	constructor(inner, purgeFence, evict) {
+		this.inner = inner;
+		this.purgeFence = purgeFence;
+		this.evict = evict;
+	}
+	/** Fences ids known before their reads in one round trip. */
+	async fence(documentIds) {
+		await this.purgeFence.isPurgedMany(documentIds);
+	}
+	async getState(documentId, scope, branch, targetRevision, signal) {
+		if (await this.purgeFence.isPurged(documentId)) {
+			if (!this.evicted.has(documentId)) {
+				this.evicted.add(documentId);
+				this.evict(documentId);
+			}
+			throw new DocumentPurgedError(documentId);
+		}
+		return this.inner.getState(documentId, scope, branch, targetRevision, signal);
+	}
+	putState(documentId, scope, branch, revision, document, position) {
+		this.inner.putState(documentId, scope, branch, revision, document, position);
+	}
+	putRun(documentId, scope, branch, run) {
+		this.inner.putRun(documentId, scope, branch, run);
+	}
+	invalidate(documentId, scope, branch) {
+		return this.inner.invalidate(documentId, scope, branch);
+	}
+	clear() {
+		this.inner.clear();
+	}
+	startup() {
+		return this.inner.startup();
+	}
+	shutdown() {
+		return this.inner.shutdown();
+	}
+};
+/** The target whose membership an ADD or REMOVE_RELATIONSHIP writes. */
+function relationshipTarget(action) {
+	if (action.type !== "ADD_RELATIONSHIP" && action.type !== "REMOVE_RELATIONSHIP") return;
+	const target = action.input?.targetId;
+	return typeof target === "string" && target.length > 0 ? target : void 0;
+}
+/** The ids a job's locks cover, sorted: its write ids and groups it names. */
+function jobWriteIds(job) {
+	const ids = /* @__PURE__ */ new Set([job.documentId]);
+	const actions = [...job.actions, ...job.operations.map((operation) => operation.action)];
+	for (const action of actions) {
+		if (DOCUMENT_SCOPE_ACTIONS.has(action.type)) ids.add(targetDocumentId(action, job.documentId));
+		const target = relationshipTarget(action);
+		if (target !== void 0) ids.add(target);
+		if (action.scope === "auth") for (const groupId of mentionedGroupIds(action)) ids.add(groupId);
+	}
+	return [...ids].sort();
+}
 //#endregion
 //#region src/registry/errors.ts
 /**
@@ -1129,6 +1295,8 @@ var InvalidUpgradeStepError = class extends Error {
 };
 //#endregion
 //#region src/executor/types.ts
+/** 200k operations purge in 1.6 s on local Postgres; jobs time out at 30 s. */
+const DEFAULT_MAX_PURGE_OPERATIONS = 2e5;
 /** How long a deferred job waits for its document before it fails. */
 const DEFAULT_DEFERRED_JOB_TTL_MS = 3e4;
 /**
@@ -1342,27 +1510,44 @@ var DocumentMetaCache = class DocumentMetaCache {
 		const docScopeOps = await this.operationStore.getSince(documentId, "document", branch, -1, void 0, void 0, signal);
 		if (docScopeOps.results.length === 0) throw new DocumentNotFoundError(documentId);
 		const createOp = docScopeOps.results[0];
+		if (isPurgeMarker(createOp)) return purgedMeta(createOp.action);
 		if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Invalid document: first operation must be CREATE_DOCUMENT, found ${createOp.action.type}`);
 		const createAction = createOp.action;
 		const documentType = createAction.input.model;
 		let document = createDocumentFromAction(createAction);
 		let documentScopeRevision = 0;
+		let purged = false;
 		for (const op of docScopeOps.results) {
 			if (targetRevision !== void 0 && op.index > targetRevision) break;
 			documentScopeRevision = op.index;
 			if (op.action.type === "UPGRADE_DOCUMENT") {
 				const upgradeAction = op.action;
 				document = applyUpgradeDocumentAction$1(document, upgradeAction);
-			} else if (op.action.type === "DELETE_DOCUMENT") document = applyDeleteDocumentAction$1(document, op.action);
+			} else if (op.action.type === "DELETE_DOCUMENT" || op.action.type === PURGE_DOCUMENT) {
+				document = applyDeleteDocumentAction$1(document, op.action);
+				purged ||= op.action.type === PURGE_DOCUMENT;
+			}
 		}
 		return {
 			state: document.state.document,
 			documentType,
-			protocolVersions: createAction.input.protocolVersions,
+			protocolVersions: purged ? purgedProtocolVersions() : createAction.input.protocolVersions,
 			documentScopeRevision: documentScopeRevision + 1
 		};
 	}
 };
+/** A lone marker has no CREATE_DOCUMENT; the marker describes the stream. */
+function purgedMeta(action) {
+	return {
+		state: createDocumentState({
+			isDeleted: true,
+			deletedAtUtcIso: action.input.purgedAtUtcIso
+		}),
+		documentType: action.input.documentType,
+		protocolVersions: purgedProtocolVersions(),
+		documentScopeRevision: 1
+	};
+}
 //#endregion
 //#region src/catch-up/settled-watermark.ts
 const MAX_PENDING_PROBES = 64;
@@ -1569,6 +1754,36 @@ async function describeWaitingSessions(db, xids) {
 		return [];
 	}
 }
+//#endregion
+//#region src/storage/kysely/document-purges.ts
+/** Class key of every purge lock; the stream locks use the single-key space. */
+const PURGE_NS = 1347571013;
+/** Ids share this many lock keys, so a job's lock count stays bounded. */
+const PURGE_LOCK_BUCKETS = 1024;
+async function acquirePurgeLocks(trx, ids, mode) {
+	const unique = [...new Set(ids)];
+	if (unique.length === 0) return;
+	const lock = sql.raw(mode === "shared" ? "pg_advisory_xact_lock_shared" : "pg_advisory_xact_lock");
+	await sql`
+    with keys as materialized (
+      select distinct hashtext(id) & ${sql.lit(1023)} as key
+      from unnest(${unique}::text[]) as t(id)
+      order by key
+    )
+    select ${lock}(${sql.lit(PURGE_NS)}, key) from keys order by key
+  `.execute(trx);
+}
+/** The ids among `ids` that have a tombstone, read in the handle's schema. */
+async function findPurged(db, ids) {
+	const unique = [...new Set(ids)];
+	if (unique.length === 0) return /* @__PURE__ */ new Set();
+	const rows = await db.selectFrom("document_purges").select("documentId").where(sql`"documentId" = any(${unique}::text[])`).execute();
+	return new Set(rows.map((row) => row.documentId));
+}
+/** Every tombstoned id, read in the handle's schema. */
+async function listPurged(db) {
+	return (await db.selectFrom("document_purges").select("documentId").orderBy("documentId").execute()).map((row) => row.documentId);
+}
 /** Bind slots per statement: 16-bit on the wire, read signed in-process. */
 const MAX_BIND_PARAMETERS = 32767;
 /** Splits rows into runs that each bind at most MAX_BIND_PARAMETERS. */
@@ -1650,15 +1865,18 @@ var KyselyOperationIndexTxn = class {
 var KyselyOperationIndex = class KyselyOperationIndex {
 	db;
 	trx;
+	liveIds;
 	constructor(db) {
 		this.db = db;
 	}
 	get queryExecutor() {
 		return this.trx ?? this.db;
 	}
-	withTransaction(trx) {
+	/** `liveIds`: ids the transaction read untombstoned under its shared lock. */
+	withTransaction(trx, liveIds) {
 		const instance = new KyselyOperationIndex(this.db);
 		instance.trx = trx;
+		instance.liveIds = liveIds;
 		return instance;
 	}
 	start() {
@@ -1709,6 +1927,7 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		}
 		let operationOrdinals = [];
 		if (operations.length > 0) {
+			await this.refusePurgedOperations(trx, operations);
 			await this.assignXid(trx);
 			const operationRows = operations.map((op) => ({
 				opId: op.id || "",
@@ -1760,6 +1979,13 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		}
 		return operationOrdinals;
 	}
+	async getCollectionsInRange(after, through, among, signal) {
+		signal?.throwIfAborted();
+		if (through <= after || among?.length === 0) return [];
+		let query = this.queryExecutor.selectFrom("operation_index_operations as oi").innerJoin("document_collections as dc", "oi.documentId", "dc.documentId").select("dc.collectionId").distinct().where("oi.ordinal", ">", after).where("oi.ordinal", "<=", through);
+		if (among !== void 0) query = query.where("dc.collectionId", "in", [...among]);
+		return (await query.execute()).map((row) => row.collectionId);
+	}
 	async getOrdinalsInRange(after, through, limit, signal) {
 		signal?.throwIfAborted();
 		if (through <= after || limit <= 0) return [];
@@ -1777,9 +2003,9 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 		results.sort((a, b) => a.context.ordinal - b.context.ordinal);
 		return results;
 	}
-	async getStreamAfter(stream, after, signal) {
+	async getStreamAfter(stream, after, signal, limit) {
 		signal?.throwIfAborted();
-		return (await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("documentId", "=", stream.documentId).where("branch", "=", stream.branch).where("scope", "=", stream.scope).where("ordinal", ">", after).orderBy("ordinal", "asc").execute()).map((row) => this.rowToOperationWithContext(row));
+		return (await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("documentId", "=", stream.documentId).where("branch", "=", stream.branch).where("scope", "=", stream.scope).where("ordinal", ">", after).orderBy("ordinal", "asc").$if(limit !== void 0, (qb) => qb.limit(limit)).execute()).map((row) => this.rowToOperationWithContext(row));
 	}
 	async getGroupReferencers(groupId, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
@@ -1893,6 +2119,12 @@ var KyselyOperationIndex = class KyselyOperationIndex {
 			}, signal) : void 0
 		};
 	}
+	/** Backstop to the store's refusal: only a marker indexes a purged id. */
+	async refusePurgedOperations(trx, operations) {
+		const ids = new Set(operations.filter((operation) => !isPurgeMarker(operation)).map((operation) => operation.documentId).filter((id) => !this.liveIds?.has(id)));
+		const purged = await findPurged(trx, ids);
+		for (const id of ids) if (purged.has(id)) throw new DocumentPurgedError(id);
+	}
 	/** Takes the xid before the first ordinal, as the settled watermark needs. */
 	async assignXid(trx) {
 		let fn = xidFunctions.get(this.db);
@@ -2056,42 +2288,6 @@ function copyDocument(document) {
 		operations: { ...document.operations }
 	};
 }
-/**
-* In-memory write cache with keyframe persistence for PHDocuments.
-*
-* Caches document snapshots in ring buffers with LRU eviction. On cache miss,
-* rebuilds documents from nearest keyframe or full operation history.
-*
-* **Performance Characteristics:**
-* - Cache hit: O(1) lookup in ring buffer
-* - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
-* - Warm miss: O(m) where m is operations since cached revision
-* - Eviction: O(1) for LRU tracking and removal
-*
-* **Thread Safety:**
-* Not thread-safe. Designed for single-threaded job executor environment.
-* External synchronization required for concurrent access across multiple executors.
-*
-* **Example:**
-* ```typescript
-* const cache = new KyselyWriteCache(
-*   keyframeStore,
-*   operationStore,
-*   registry,
-*   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
-* );
-*
-* await cache.startup();
-*
-* // Retrieve or rebuild document
-* const doc = await cache.getState(docId, docType, scope, branch, revision);
-*
-* // Cache result after job execution
-* cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
-*
-* await cache.shutdown();
-* ```
-*/
 var KyselyWriteCache = class KyselyWriteCache {
 	streams;
 	lruTracker;
@@ -2099,6 +2295,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 	operationStore;
 	registry;
 	config;
+	reads = /* @__PURE__ */ new Map();
 	constructor(keyframeStore, operationStore, registry, config) {
 		this.keyframeStore = keyframeStore;
 		this.operationStore = operationStore;
@@ -2115,6 +2312,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		const scoped = new KyselyWriteCache(keyframeStore, operationStore, this.registry, this.config);
 		scoped.streams = this.streams;
 		scoped.lruTracker = this.lruTracker;
+		scoped.reads = this.reads;
 		return scoped;
 	}
 	/**
@@ -2148,11 +2346,27 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* @returns The document at the target revision
 	* @throws {Error} "Operation aborted" if signal is aborted
 	* @throws {ModuleNotFoundError} If document type not registered in registry
+	* @throws {DocumentPurgedError} If the stream's only row is a purge marker
 	* @throws {Error} "Failed to rebuild document" if operation store fails
 	* @throws {Error} If reducer throws during operation application
 	* @throws {Error} If document serialization fails
 	*/
 	async getState(documentId, scope, branch, targetRevision, signal) {
+		const read = { evicted: false };
+		let pending = this.reads.get(documentId);
+		if (!pending) {
+			pending = /* @__PURE__ */ new Set();
+			this.reads.set(documentId, pending);
+		}
+		pending.add(read);
+		try {
+			return await this.readState(documentId, scope, branch, targetRevision, signal, read);
+		} finally {
+			pending.delete(read);
+			if (pending.size === 0) this.reads.delete(documentId);
+		}
+	}
+	async readState(documentId, scope, branch, targetRevision, signal, read) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
 		const stream = this.streams.get(streamKey);
@@ -2166,7 +2380,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 				}
 				if (newest) {
 					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
-					this.store(documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, "head");
+					this.storeUnlessEvicted(read, documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, "head");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -2179,7 +2393,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
 				if (newestOlder) {
 					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
-					this.store(documentId, scope, branch, targetRevision, document, "historical");
+					this.storeUnlessEvicted(read, documentId, scope, branch, targetRevision, document, "historical");
 					this.lruTracker.touch(streamKey);
 					return document;
 				}
@@ -2187,7 +2401,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 		}
 		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
 		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
-		this.store(documentId, scope, branch, revision, document, targetRevision === void 0 ? "head" : "historical");
+		this.storeUnlessEvicted(read, documentId, scope, branch, revision, document, targetRevision === void 0 ? "head" : "historical");
 		return document;
 	}
 	/**
@@ -2224,6 +2438,9 @@ var KyselyWriteCache = class KyselyWriteCache {
 		const head = run[run.length - 1];
 		this.store(documentId, scope, branch, head.revision, head.document, "head");
 	}
+	storeUnlessEvicted(read, documentId, scope, branch, revision, document, position) {
+		if (!read.evicted) this.store(documentId, scope, branch, revision, document, position);
+	}
 	store(documentId, scope, branch, revision, document, position) {
 		const streamKey = this.makeStreamKey(documentId, scope, branch);
 		const stream = this.getOrCreateStream(streamKey);
@@ -2264,6 +2481,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* @returns The number of streams evicted
 	*/
 	invalidate(documentId, scope, branch) {
+		for (const read of this.reads.get(documentId) ?? []) read.evicted = true;
 		let evicted = 0;
 		if (scope === void 0 && branch === void 0) {
 			for (const [key] of this.streams.entries()) if (key.startsWith(`${documentId}:`)) {
@@ -2292,6 +2510,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 	* Resets LRU tracking state. This operation always succeeds.
 	*/
 	clear() {
+		for (const pending of this.reads.values()) for (const read of pending) read.evicted = true;
 		this.streams.clear();
 		this.lruTracker.clear();
 	}
@@ -2371,7 +2590,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 							subsequentDeletes: []
 						});
 					}
-				} else if (operation.action.type === "DELETE_DOCUMENT") {
+				} else if (operation.action.type === "DELETE_DOCUMENT" || operation.action.type === PURGE_DOCUMENT) {
 					applyDeleteDocumentAction(document, operation.action);
 					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				}
@@ -2384,6 +2603,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 			}, signal);
 			if (createOpResult.results.length === 0) throw new DocumentNotFoundError(documentId);
 			const createOp = createOpResult.results[0];
+			if (isPurgeMarker(createOp)) throw new DocumentPurgedError(documentId);
 			if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Failed to rebuild document ${documentId}: first operation in document scope must be CREATE_DOCUMENT, found ${createOp.action.type}`);
 			const documentCreateAction = createOp.action;
 			documentType = documentCreateAction.input.model;
@@ -2423,7 +2643,7 @@ var KyselyWriteCache = class KyselyWriteCache {
 						});
 					} else document = applyUpgradeDocumentAction(document, upgradeAction, void 0);
 					docModule = this.registry.getModule(documentType, normalizeDocumentModelVersion(toVersion));
-				} else if (operation.action.type === "DELETE_DOCUMENT") {
+				} else if (operation.action.type === "DELETE_DOCUMENT" || operation.action.type === PURGE_DOCUMENT) {
 					applyDeleteDocumentAction(document, operation.action);
 					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
 				} else {
@@ -2751,7 +2971,154 @@ function validateFeatureFlags(flags, prerequisites) {
 	}
 }
 //#endregion
+//#region src/storage/kysely/document-purger.ts
+/** An `Operation` row whose DELETE_DOCUMENT applied: not errored, not denied. */
+const appliedDelete = sql`action->>'type' = 'DELETE_DOCUMENT' and coalesce(error, '') = '' and coalesce("deniedReason", '') = ''`;
+/** Rows removed per statement from the tables a document can fill. */
+const DEFAULT_PURGE_DELETE_BATCH = 5e3;
+/** A purge transaction's statements; bound to the job's transaction. */
+var KyselyDocumentPurger = class {
+	batchSize;
+	db;
+	constructor(db, batchSize = DEFAULT_PURGE_DELETE_BATCH) {
+		this.batchSize = batchSize;
+		this.db = db;
+	}
+	/** Every stream the document holds operations in. */
+	async streams(documentId) {
+		return this.db.selectFrom("Operation").select(["scope", "branch"]).distinct().where("documentId", "=", documentId).orderBy("scope").orderBy("branch").execute();
+	}
+	async operationCount(documentId) {
+		const row = await this.db.selectFrom("operation_index_operations").select((eb) => eb.fn.countAll().as("count")).where("documentId", "=", documentId).executeTakeFirst();
+		return Number(row?.count ?? 0);
+	}
+	/** Untombstoned documents group_references records as naming the group. */
+	async groupReferencers(groupId) {
+		const ids = (await this.db.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).where("documentId", "<>", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
+		const purged = await findPurged(this.db, ids);
+		return ids.filter((id) => !purged.has(id));
+	}
+	/** Survivors whose accepted auth history names the group; refusals do not. */
+	async groupReferencersInHistory(groupId) {
+		const referencing = [];
+		for (const documentId of await this.groupReferencers(groupId)) if ([...(await this.authOperations(documentId)).values()].some((operations) => garbageCollect(sortOperations(operations)).some((operation) => operation.deniedReason === void 0 && operation.error === void 0 && mentionedGroupIds(operation.action).includes(groupId)))) referencing.push(documentId);
+		return referencing;
+	}
+	/** The document's auth-scope operations, per branch, in index order. */
+	async authOperations(documentId) {
+		const rows = await this.db.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", "auth").orderBy("branch").orderBy("index").execute();
+		const byBranch = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const operations = byBranch.get(row.branch) ?? [];
+			operations.push({
+				index: row.index,
+				timestampUtcMs: row.timestampUtcMs.toISOString(),
+				hash: row.hash,
+				skip: row.skip,
+				error: row.error || void 0,
+				deniedReason: row.deniedReason || void 0,
+				id: row.opId,
+				action: row.action
+			});
+			byBranch.set(row.branch, operations);
+		}
+		return byBranch;
+	}
+	/** Every document ever in the collection, but its owner and its own row. */
+	async collectionMembers(collectionId, ownerId, branch) {
+		return (await this.db.selectFrom("document_collections as dc").select("dc.documentId").select(sql`dc."leftOrdinal" is null`.as("openHere")).select((eb) => eb.exists(eb.selectFrom("Operation as op").select("op.opId").whereRef("op.documentId", "=", "dc.documentId").where("op.branch", "=", branch).where("op.scope", "=", "document").where(appliedDelete)).as("deleted")).select((eb) => eb.exists(eb.selectFrom("document_collections as other").select("other.documentId").whereRef("other.documentId", "=", "dc.documentId").where("other.collectionId", "<>", collectionId).where("other.leftOrdinal", "is", null)).as("openElsewhere")).where("dc.collectionId", "=", collectionId).where("dc.documentId", "not in", [ownerId, collectionId]).orderBy("dc.documentId").execute()).map((row) => {
+			const openElsewhere = Boolean(row.openElsewhere);
+			return {
+				documentId: row.documentId,
+				openElsewhere,
+				required: !openElsewhere && (Boolean(row.openHere) || Boolean(row.deleted))
+			};
+		});
+	}
+	async remoteCollection(remoteName) {
+		return (await this.db.selectFrom("sync_remotes").select("collection_id").where("name", "=", remoteName).executeTakeFirst())?.collection_id;
+	}
+	/** Deletes every row about the document; the counts are per table. */
+	async deleteRows(documentId) {
+		const removed = {};
+		removed.Operation = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("Operation").where("id", "in", (eb) => eb.selectFrom("Operation").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.operation_index_operations = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("operation_index_operations").where("ordinal", "in", (eb) => eb.selectFrom("operation_index_operations").select("ordinal").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.Keyframe = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("Keyframe").where("id", "in", (eb) => eb.selectFrom("Keyframe").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.DocumentSnapshot = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("DocumentSnapshot").where("id", "in", (eb) => eb.selectFrom("DocumentSnapshot").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.SlugMapping = await this.deleteWhere("SlugMapping", "documentId", documentId);
+		const relationships = await this.db.selectFrom("DocumentRelationship").select((eb) => eb.fn.countAll().as("count")).where((eb) => eb.or([eb("sourceId", "=", documentId), eb("targetId", "=", documentId)])).executeTakeFirst();
+		removed.DocumentRelationship = Number(relationships?.count ?? 0);
+		removed.Document = await this.deleteWhere("Document", "id", documentId);
+		removed.group_references = await this.deleteWhere("group_references", "documentId", documentId);
+		removed.sync_dead_letters = await this.deleteWhere("sync_dead_letters", "document_id", documentId);
+		removed.sync_holds = await this.deleteWhere("sync_holds", "document_id", documentId);
+		return removed;
+	}
+	async writeTombstone(tombstone) {
+		const values = {
+			documentId: tombstone.documentId,
+			ordinal: tombstone.ordinal,
+			removedRows: JSON.stringify(tombstone.removedRows),
+			purgedAtUtc: tombstone.purgedAtUtc,
+			requestId: tombstone.requestId
+		};
+		await this.db.insertInto("document_purges").values(values).onConflict((oc) => oc.column("documentId").doUpdateSet({
+			ordinal: values.ordinal,
+			removedRows: values.removedRows,
+			purgedAtUtc: values.purgedAtUtc,
+			requestId: values.requestId
+		})).execute();
+	}
+	/** Reopens every membership at the marker ordinal, plus `collectionIds`. */
+	async reopenMemberships(documentId, ordinal, collectionIds = []) {
+		await this.db.updateTable("document_collections").set({
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		}).where("documentId", "=", documentId).execute();
+		for (const collectionId of new Set(collectionIds)) await this.db.insertInto("document_collections").values({
+			documentId,
+			collectionId,
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		}).onConflict((oc) => oc.columns(["documentId", "collectionId"]).doUpdateSet({
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		})).execute();
+		return (await this.db.selectFrom("document_collections").select("collectionId").where("documentId", "=", documentId).orderBy("collectionId").execute()).map((row) => row.collectionId);
+	}
+	async deleteBatched(step) {
+		let total = 0;
+		for (;;) {
+			const deleted = await step();
+			total += deleted;
+			if (deleted < this.batchSize) return total;
+		}
+	}
+	async deleteWhere(table, column, documentId) {
+		const result = await this.db.deleteFrom(table).where(column, "=", documentId).executeTakeFirst();
+		return Number(result.numDeletedRows);
+	}
+};
+//#endregion
 //#region src/executor/execution-scope.ts
+/** For scopes without a transaction to hold a lock in. */
+const NOOP_DOCUMENT_LOCKS = {
+	shared: () => Promise.resolve(),
+	exclusive: () => Promise.resolve(),
+	purged: () => Promise.resolve(/* @__PURE__ */ new Set())
+};
 var DefaultExecutionScope = class {
 	operationStore;
 	operationIndex;
@@ -2772,7 +3139,8 @@ var DefaultExecutionScope = class {
 			operationIndex: this.operationIndex,
 			writeCache: this.writeCache,
 			documentMetaCache: this.documentMetaCache,
-			collectionMembershipCache: this.collectionMembershipCache
+			collectionMembershipCache: this.collectionMembershipCache,
+			documentLocks: NOOP_DOCUMENT_LOCKS
 		});
 	}
 };
@@ -2796,15 +3164,32 @@ var KyselyExecutionScope = class {
 	async run(fn, signal) {
 		signal?.throwIfAborted();
 		return this.db.transaction().execute(async (trx) => {
-			const scopedOperationStore = this.operationStore.withTransaction(trx);
-			const scopedOperationIndex = this.operationIndex.withTransaction(trx);
+			const sharedLocked = /* @__PURE__ */ new Set();
+			const liveIds = /* @__PURE__ */ new Set();
+			const scopedOperationStore = this.operationStore.withTransaction(trx, liveIds);
+			const scopedOperationIndex = this.operationIndex.withTransaction(trx, liveIds);
 			const scopedKeyframeStore = this.keyframeStore.withTransaction(trx);
 			return fn({
 				operationStore: scopedOperationStore,
 				operationIndex: scopedOperationIndex,
 				writeCache: this.writeCache.withScopedStores(scopedOperationStore, scopedKeyframeStore),
 				documentMetaCache: this.documentMetaCache.withScopedStore(scopedOperationStore),
-				collectionMembershipCache: this.collectionMembershipCache.withScopedIndex(scopedOperationIndex)
+				collectionMembershipCache: this.collectionMembershipCache.withScopedIndex(scopedOperationIndex),
+				documentLocks: {
+					shared: async (ids) => {
+						const list = [...ids];
+						await acquirePurgeLocks(trx, list, "shared");
+						for (const id of list) sharedLocked.add(id);
+					},
+					exclusive: (id) => acquirePurgeLocks(trx, [id], "exclusive"),
+					purged: async (ids) => {
+						const list = [...ids];
+						const found = await findPurged(trx, list);
+						for (const id of list) if (sharedLocked.has(id) && !found.has(id)) liveIds.add(id);
+						return found;
+					}
+				},
+				purger: new KyselyDocumentPurger(trx)
 			});
 		});
 	}
@@ -2818,6 +3203,7 @@ const STRICT_ORDER_ACTION_TYPES = /* @__PURE__ */ new Set([
 	"ADD_RELATIONSHIP",
 	"REMOVE_RELATIONSHIP",
 	"UPDATE_RELATIONSHIP",
+	"PURGE_DOCUMENT",
 	"ADD_FOLDER",
 	"UPDATE_FOLDER",
 	"REMOVE_FOLDER"
@@ -3023,6 +3409,15 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	const derivedSet = derivedReadSet(definition);
 	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
 	const evaluating = new Set(operations.map((operation) => operation.id));
+	const creation = operations.find((operation) => operation.action.type === "CREATE_DOCUMENT" && operation.action.input.documentId === target.documentId);
+	async function stateBefore(query) {
+		try {
+			return await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+		} catch (error) {
+			if (creation !== void 0 && query.documentId === target.documentId && error instanceof DocumentNotFoundError && !(error instanceof DocumentPurgedError)) return createDocumentFromAction(creation.action);
+			throw error;
+		}
+	}
 	const readStreams = await Promise.all(readSet.map(async (stream) => ({
 		stream,
 		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, -1, { actionTypes: stream.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id))
@@ -3035,7 +3430,7 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 	const histories = [];
 	for (const read of readStreams) {
 		const streamOperations = read.stream === writtenProjection ? [...read.operations, ...operations] : read.operations;
-		const before = await writeCache.getState(read.stream.query.documentId, read.stream.query.scope, read.stream.query.branch, -1, signal);
+		const before = await stateBefore(read.stream.query);
 		walked.push({
 			streamKey: streamKey(read.stream.query),
 			scope: read.stream.query.scope,
@@ -3057,7 +3452,7 @@ async function evaluateByPosition(model, target, subject, stores, signal) {
 			branch: target.branch
 		};
 		const storedOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, void 0, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
-		const before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+		const before = await stateBefore(query);
 		evaluatedStateKey = streamKey(query);
 		walked.push({
 			streamKey: evaluatedStateKey,
@@ -3175,6 +3570,7 @@ var DocumentActionHandler = class {
 			case "ADD_RELATIONSHIP": return this.executeAddRelationship(write, executing);
 			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(write, executing);
 			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(write, executing);
+			case "PURGE_DOCUMENT": return buildErrorResult(executing.job, new ReservedActionError(executing.job.documentId, action.type), executing.startTime);
 			default: return buildErrorResult(executing.job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), executing.startTime);
 		}
 	}
@@ -3496,18 +3892,36 @@ var DocumentActionHandler = class {
 		});
 		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
 	}
-	executeAddRelationship(write, executing) {
+	/** A submitted write naming a purged target was refused at job start. */
+	async isTargetPurged(write, executing) {
+		const target = relationshipTarget(write.action);
+		if (target === void 0 || !executing.purgeFence) return false;
+		return executing.purgeFence.isPurged(target);
+	}
+	async executeAddRelationship(write, executing) {
+		let targetPurged;
+		try {
+			targetPurged = await this.isTargetPurged(write, executing);
+		} catch (error) {
+			return buildErrorResult(executing.job, error instanceof Error ? error : new Error(String(error)), executing.startTime);
+		}
 		return this.withRelationshipAction("ADD_RELATIONSHIP", write, executing, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
-			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
+			if (!targetPurged && this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.addToCollection(collectionId, input.targetId);
 				s.collectionMembershipCache.invalidate(input.targetId);
 			}
 		});
 	}
-	executeRemoveRelationship(write, executing) {
+	async executeRemoveRelationship(write, executing) {
+		let targetPurged;
+		try {
+			targetPurged = await this.isTargetPurged(write, executing);
+		} catch (error) {
+			return buildErrorResult(executing.job, error instanceof Error ? error : new Error(String(error)), executing.startTime);
+		}
 		return this.withRelationshipAction("REMOVE_RELATIONSHIP", write, executing, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
-			if (this.driveContainerTypes.has(sourceDoc.header.documentType)) {
+			if (!targetPurged && this.driveContainerTypes.has(sourceDoc.header.documentType)) {
 				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
 				txn.removeFromCollection(collectionId, input.targetId);
 				s.collectionMembershipCache.invalidate(input.targetId);
@@ -3531,6 +3945,7 @@ var DocumentActionHandler = class {
 		try {
 			sourceDoc = await stores.writeCache.getState(input.sourceId, "document", job.branch, void 0, signal);
 		} catch (error) {
+			if (DocumentPurgedError.isError(error)) return buildErrorResult(job, error, startTime);
 			if (DocumentNotFoundError.isError(error)) return buildErrorResult(job, new DocumentNotFoundError(input.sourceId, `${actionTypeName}: source document ${input.sourceId} not found`), startTime);
 			return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName}: source document ${input.sourceId} not found: ${error instanceof Error ? error.message : String(error)}`), startTime);
 		}
@@ -4047,6 +4462,21 @@ var SignatureAdmission = class {
 		}
 		return dropped;
 	}
+	/** A marker is held to v2 and enforced whatever the policy and mode. */
+	async admitMarker(job, marker, signal) {
+		const entry = {
+			...candidate(marker.action, {
+				documentId: job.documentId,
+				scope: "document",
+				branch: job.branch
+			}),
+			operation: marker,
+			policy: "v2-required"
+		};
+		const verdict = await this.verdict(entry, /* @__PURE__ */ new Set(), void 0, "load", signal);
+		if (verdict.ok) return;
+		return this.record(job, entry, verdict, "load", true);
+	}
 	async verdict(entry, live, submitted, path, signal, known = false) {
 		const verdict = await verifyActionSignature(entry.action, {
 			documentId: entry.stream.documentId,
@@ -4148,8 +4578,7 @@ var SignatureAdmission = class {
 		return live;
 	}
 	/** Logs and counts a refusal; returns the error only when enforcing. */
-	record(job, entry, refusal, path) {
-		const enforced = this.mode === "enforce";
+	record(job, entry, refusal, path, enforced = this.mode === "enforce") {
 		const event = {
 			jobId: job.id,
 			documentId: entry.stream.documentId,
@@ -4274,6 +4703,30 @@ function isValidISOTimestamp(value) {
 * returned JobResult there, which is what the queue, the worker protocol and
 * every test expect a failed job to look like.
 */
+/** The ids of a purge job's request, which a drive purge may precede. */
+function purgeRequestDocumentIds(job) {
+	const ids = job.meta.purgeRequestDocumentIds;
+	return Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
+}
+const MARKER_INPUT_KEYS = /* @__PURE__ */ new Set([
+	"documentId",
+	"documentType",
+	"purgedAtUtcIso",
+	"requestId"
+]);
+/** A peer's marker must name this job's id on main and carry nothing else. */
+function malformedMarker(job) {
+	const action = job.operations.find((operation) => isPurgeMarker(operation))?.action;
+	const input = action?.input;
+	const refuse = (reason) => new InvalidSignatureError(job.documentId, "ID_MISMATCH", `marker ${action?.id ?? "?"} ${reason}`);
+	if (typeof input !== "object" || input === null) return refuse("carries no input");
+	const extra = Object.keys(input).filter((key) => !MARKER_INPUT_KEYS.has(key));
+	if (extra.length > 0) return refuse(`carries unexpected input ${extra.join(", ")}`);
+	for (const key of MARKER_INPUT_KEYS) if (typeof input[key] !== "string" || input[key] === "") return refuse(`input.${key} is not a non-empty string`);
+	const purgedAt = Date.parse(input.purgedAtUtcIso);
+	if (Number.isNaN(purgedAt) || new Date(purgedAt).toISOString() !== input.purgedAtUtcIso) return refuse("input.purgedAtUtcIso is not an ISO timestamp");
+	if (input.documentId !== job.documentId || job.branch !== "main" || action?.scope !== "document") return refuse(`does not purge ${job.documentId} on document/main`);
+}
 var JobRollbackSignal = class extends Error {
 	result;
 	constructor(result) {
@@ -4326,7 +4779,8 @@ var SimpleJobExecutor = class {
 			yieldDeadlineMs: config.yieldDeadlineMs ?? 50,
 			batchApplies: config.batchApplies ?? true,
 			signatureVerification: config.signatureVerification ?? "enforce",
-			protocolSupport: config.protocolSupport ?? localSupports(PEER_CAPABILITIES, this.featureFlags).protocols
+			protocolSupport: config.protocolSupport ?? localSupports(PEER_CAPABILITIES, this.featureFlags).protocols,
+			maxPurgeOperations: config.maxPurgeOperations ?? 2e5
 		};
 		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
 		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
@@ -4362,6 +4816,7 @@ var SimpleJobExecutor = class {
 		const touchedStreams = new TouchedStreams();
 		const postCommitInvalidations = [];
 		const postCommitMembershipInvalidations = [];
+		const postCommitMetaInvalidations = [];
 		let outcome;
 		try {
 			outcome = await this.executionScope.run(async (stores) => {
@@ -4372,7 +4827,8 @@ var SimpleJobExecutor = class {
 					signal,
 					touchedStreams,
 					postCommitInvalidations,
-					postCommitMembershipInvalidations
+					postCommitMembershipInvalidations,
+					postCommitMetaInvalidations
 				});
 				if (!scoped.result.success) throw new JobRollbackSignal(scoped.result);
 				return scoped;
@@ -4384,6 +4840,7 @@ var SimpleJobExecutor = class {
 		}
 		for (const entry of postCommitInvalidations) this.writeCache.invalidate(entry.documentId, entry.scope, entry.branch);
 		for (const documentId of postCommitMembershipInvalidations) this.collectionMembershipCache.invalidate(documentId);
+		for (const documentId of postCommitMetaInvalidations) this.documentMetaCache.invalidate(documentId);
 		const { pendingEvent } = outcome;
 		if (pendingEvent) this.eventBus.emit(ReactorEventTypes.JOB_WRITE_READY, pendingEvent).catch((error) => {
 			this.logger.error("Failed to emit JOB_WRITE_READY event: @Event : @Error", pendingEvent, error);
@@ -4399,8 +4856,36 @@ var SimpleJobExecutor = class {
 	* has not committed yet has nothing to announce.
 	*/
 	async executeInScope(params) {
-		const { job, startTime, stores, signal, touchedStreams, postCommitInvalidations, postCommitMembershipInvalidations } = params;
+		const { job, startTime, stores: scopeStores, signal, touchedStreams, postCommitInvalidations, postCommitMembershipInvalidations } = params;
 		let pendingEvent;
+		if (job.kind === "mutation") {
+			const reserved = job.actions.find((action) => isPurgeMarker(action));
+			if (reserved) return { result: buildErrorResult(job, new ReservedActionError(job.documentId, reserved.type), startTime) };
+		}
+		if (job.kind === "purge" || job.kind === "load" && job.operations.some((op) => isPurgeMarker(op))) return this.executePurge(params);
+		const lockedIds = jobWriteIds(job);
+		const lockFailure = (error) => ({ result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) });
+		try {
+			await scopeStores.documentLocks.shared(lockedIds);
+		} catch (error) {
+			return lockFailure(error);
+		}
+		let purged;
+		try {
+			purged = await scopeStores.documentLocks.purged(lockedIds);
+		} catch (error) {
+			return lockFailure(error);
+		}
+		const purgedRefusal = this.purgedRefusal(job, purged);
+		if (purgedRefusal) return { result: buildErrorResult(job, purgedRefusal, startTime) };
+		const purgeFence = new PurgeFence(scopeStores.documentLocks, new Set(lockedIds), purged);
+		const stores = {
+			...scopeStores,
+			writeCache: new FencedWriteCache(scopeStores.writeCache, purgeFence, (documentId) => {
+				scopeStores.writeCache.invalidate(documentId);
+				scopeStores.documentMetaCache.invalidate(documentId);
+			})
+		};
 		const unsupported = await this.unsupportedStoredProtocol(job, stores, signal);
 		if (unsupported) return { result: buildErrorResult(job, unsupported, startTime) };
 		const indexTxn = stores.operationIndex.start();
@@ -4415,7 +4900,8 @@ var SimpleJobExecutor = class {
 				evaluatedByPosition: false,
 				postCommitInvalidations,
 				postCommitMembershipInvalidations,
-				touchedStreams
+				touchedStreams,
+				purgeFence
 			});
 			if (loadResult.success && loadResult.operationsWithContext) {
 				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
@@ -4445,7 +4931,8 @@ var SimpleJobExecutor = class {
 				evaluatedByPosition: false,
 				postCommitInvalidations,
 				postCommitMembershipInvalidations,
-				touchedStreams
+				touchedStreams,
+				purgeFence
 			});
 			if (reevalResult.success && reevalResult.operationsWithContext) {
 				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
@@ -4497,7 +4984,8 @@ var SimpleJobExecutor = class {
 			evaluatedByPosition: positioned.evaluatedByPosition,
 			postCommitInvalidations,
 			postCommitMembershipInvalidations,
-			touchedStreams
+			touchedStreams,
+			purgeFence
 		};
 		const actionResult = await this.processActions(positioned.writes, executing);
 		if (!actionResult.success) return { result: {
@@ -4521,6 +5009,264 @@ var SimpleJobExecutor = class {
 		for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
 		return this.committedOutcome(job, committed, actionResult.operationsWithContext, actionResult.generatedOperations, stores, startTime);
 	}
+	/** A load names only its own id purged; a foreign one is ID_MISMATCH. */
+	purgedRefusal(job, purged) {
+		if (purged.size === 0) return;
+		if (purged.has(job.documentId)) return new DocumentPurgedError(job.documentId);
+		const actions = [...job.actions, ...job.operations.map((operation) => operation.action)];
+		for (const action of actions) {
+			if (!DOCUMENT_SCOPE_ACTIONS.has(action.type)) continue;
+			const target = targetDocumentId(action, job.documentId);
+			if (!purged.has(target)) continue;
+			if (job.kind === "mutation") return new DocumentPurgedError(target);
+			return new InvalidSignatureError(job.documentId, "ID_MISMATCH", `${action.type} ${action.id} in ${job.documentId} writes purged ${target}`);
+		}
+		if (job.kind !== "mutation") return;
+		for (const action of job.actions) {
+			const target = relationshipTarget(action);
+			if (action.type === "ADD_RELATIONSHIP" && target !== void 0 && purged.has(target)) return new DocumentPurgedError(target, `${action.type} target ${target} was purged`);
+			if (action.scope !== "auth") continue;
+			const group = mentionedGroupIds(action).find((id) => purged.has(id));
+			if (group !== void 0) return new DocumentPurgedError(group, `${action.type} names purged group ${group}`);
+		}
+	}
+	/** A purge job or a marker load: the exclusive lock is the job's only lock. */
+	async executePurge(params) {
+		const { job, startTime, stores } = params;
+		const fail = (error) => ({ result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) });
+		if (job.kind === "load") {
+			const malformed = malformedMarker(job);
+			if (malformed) return fail(malformed);
+		}
+		const purger = stores.purger;
+		if (!purger) return fail(/* @__PURE__ */ new Error(`Purge of ${job.documentId} needs a transactional scope`));
+		try {
+			await stores.documentLocks.exclusive(job.documentId);
+		} catch (error) {
+			return fail(error);
+		}
+		let alreadyPurged;
+		try {
+			alreadyPurged = (await stores.documentLocks.purged([job.documentId])).has(job.documentId);
+		} catch (error) {
+			return fail(error);
+		}
+		if (alreadyPurged) return {
+			result: {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			},
+			pendingEvent: {
+				jobId: job.id,
+				operations: [],
+				jobMeta: job.meta,
+				collectionMemberships: {}
+			}
+		};
+		let commit;
+		try {
+			commit = job.kind === "purge" ? await this.preparePurgeJob(params, purger) : await this.preparePurgeLoad(params, purger);
+		} catch (error) {
+			return fail(error);
+		}
+		if (commit instanceof Error) return fail(commit);
+		try {
+			return await this.commitPurge(params, commit);
+		} catch (error) {
+			return fail(error);
+		}
+	}
+	/** Preconditions 1-5, then the marker this host signs. */
+	async preparePurgeJob(params, purger) {
+		const { job, stores, signal } = params;
+		const documentId = job.documentId;
+		if (!job.purge) return /* @__PURE__ */ new Error(`Purge job ${job.id} carries no purge options`);
+		const held = await this.heldStreams(purger, documentId);
+		if (held.branches.length === 0) return new DocumentNotDeletedError(documentId, `Document ${documentId} is not held here`);
+		let documentType;
+		for (const branch of held.branches) {
+			let meta;
+			try {
+				meta = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			} catch (error) {
+				return new DocumentNotDeletedError(documentId, `Document ${documentId} has no readable state on ${branch}: ${error instanceof Error ? error.message : String(error)}`);
+			}
+			if (!meta.state.isDeleted) return new DocumentNotDeletedError(documentId, `Document ${documentId} is not deleted on branch ${branch}`);
+			documentType ??= meta.documentType;
+		}
+		if (documentType === void 0) return new DocumentNotDeletedError(documentId);
+		if (documentType === groupDocumentType) {
+			const referencers = await purger.groupReferencersInHistory(documentId);
+			if (referencers.length > 0) return new GroupInUseError(documentId, referencers);
+		}
+		let survivors = [];
+		if (this.driveContainerTypes.has(documentType)) {
+			const requested = new Set(purgeRequestDocumentIds(job));
+			const members = await this.driveMembers(purger, stores, documentId, held.branches);
+			const blocking = members.required.filter((id) => !requested.has(id));
+			if (blocking.length > 0) return new DocumentNotDeletedError(documentId, `Drive ${documentId} cannot be purged: ${blocking.join(", ")} neither purged nor in the request`);
+			survivors = members.survivors;
+		}
+		const operationCount = await purger.operationCount(documentId);
+		if (operationCount > this.config.maxPurgeOperations && !job.purge.allowLarge) return new PurgeTooLargeError(documentId, operationCount, this.config.maxPurgeOperations);
+		return {
+			purger,
+			marker: await this.signMarker(documentId, documentType, job.purge.requestId, signal),
+			documentType,
+			held,
+			sourceRemote: "",
+			collectionIds: [],
+			survivors
+		};
+	}
+	/** A peer's marker, admitted alone; a receiver cannot refuse an erasure. */
+	async preparePurgeLoad(params, purger) {
+		const { job, stores, signal } = params;
+		const documentId = job.documentId;
+		const marker = job.operations.find((operation) => isPurgeMarker(operation));
+		const refusal = await this.signatureAdmission.admitMarker(job, marker, signal);
+		if (refusal) return refusal;
+		const held = await this.heldStreams(purger, documentId);
+		let documentType = marker.action.input.documentType;
+		let appliedDeletion = held.branches.length > 0;
+		if (held.branches.length > 0) try {
+			const meta = await stores.documentMetaCache.getDocumentMeta(documentId, held.branches.includes("main") ? "main" : held.branches[0], signal);
+			documentType = meta.documentType;
+			appliedDeletion = !meta.state.isDeleted;
+		} catch {}
+		let survivors = [];
+		if (this.driveContainerTypes.has(documentType)) {
+			const members = await this.driveMembers(purger, stores, documentId, held.branches);
+			survivors = [...members.required, ...members.survivors];
+		}
+		const sourceRemote = typeof job.meta.sourceRemote === "string" ? job.meta.sourceRemote : "";
+		const collectionId = sourceRemote ? await purger.remoteCollection(sourceRemote) : void 0;
+		return {
+			purger,
+			marker: purgeMarkerOperation(marker.action),
+			documentType,
+			held,
+			sourceRemote,
+			collectionIds: collectionId === void 0 ? [] : [collectionId],
+			survivors,
+			...appliedDeletion ? { appliedDeletion: true } : {}
+		};
+	}
+	/** Execution: delete, write the marker and its twin, tombstone, reopen. */
+	async commitPurge(params, commit) {
+		const { job, startTime, stores, signal, touchedStreams } = params;
+		const { purger, marker, documentType, held, sourceRemote } = commit;
+		const documentId = job.documentId;
+		const streams = [...held.streams, {
+			scope: "document",
+			branch: "main"
+		}];
+		for (const stream of streams) {
+			touchedStreams.add(documentId, stream.scope, stream.branch);
+			params.postCommitInvalidations.push({
+				documentId,
+				...stream
+			});
+		}
+		params.postCommitMetaInvalidations.push(documentId);
+		const removedRows = await purger.deleteRows(documentId);
+		const [stored] = await stores.operationStore.apply(documentId, documentType, "document", "main", 0, (txn) => {
+			txn.addOperations(marker);
+		}, signal);
+		const indexTxn = stores.operationIndex.start();
+		indexTxn.write([{
+			...stored,
+			documentId,
+			documentType,
+			scope: "document",
+			branch: "main",
+			sourceRemote
+		}]);
+		const [ordinal] = await stores.operationIndex.commit(indexTxn, signal);
+		await purger.writeTombstone({
+			documentId,
+			ordinal,
+			removedRows,
+			purgedAtUtc: marker.action.input.purgedAtUtcIso,
+			requestId: marker.action.input.requestId
+		});
+		const collections = await purger.reopenMemberships(documentId, ordinal, commit.collectionIds);
+		params.postCommitMembershipInvalidations.push(documentId, ...commit.survivors, ...indexTxn.getMembershipInvalidations());
+		const operationWithContext = {
+			operation: stored,
+			context: {
+				documentId,
+				scope: "document",
+				branch: "main",
+				documentType,
+				ordinal,
+				...commit.appliedDeletion ? { appliedDeletion: true } : {}
+			}
+		};
+		return {
+			result: {
+				job,
+				success: true,
+				operations: [stored],
+				operationsWithContext: [operationWithContext],
+				duration: Date.now() - startTime
+			},
+			pendingEvent: {
+				jobId: job.id,
+				operations: [operationWithContext],
+				jobMeta: job.meta,
+				collectionMemberships: { [documentId]: collections }
+			}
+		};
+	}
+	async heldStreams(purger, documentId) {
+		const streams = await purger.streams(documentId);
+		return {
+			streams,
+			branches: [...new Set(streams.filter((stream) => stream.scope === "document").map((stream) => stream.branch))]
+		};
+	}
+	/** Members a drive purge needs gone, and those living on elsewhere. */
+	async driveMembers(purger, stores, driveId, branches) {
+		const required = /* @__PURE__ */ new Set();
+		const survivors = /* @__PURE__ */ new Set();
+		for (const branch of branches.length > 0 ? branches : ["main"]) {
+			const collectionId = DriveCollectionId.forDrive(driveId, branch).key;
+			const members = await purger.collectionMembers(collectionId, driveId, branch);
+			const purged = await stores.documentLocks.purged(members.map((member) => member.documentId));
+			for (const member of members) {
+				if (purged.has(member.documentId)) continue;
+				if (member.required) required.add(member.documentId);
+				else survivors.add(member.documentId);
+			}
+		}
+		return {
+			required: [...required],
+			survivors: [...survivors]
+		};
+	}
+	/** The marker, signed by this executor's signer as any peer admits it. */
+	async signMarker(documentId, documentType, requestId, signal) {
+		const action = purgeDocumentAction({
+			documentId,
+			documentType,
+			requestId
+		});
+		const signature = await this.signer.signAction(action, {
+			documentId,
+			branch: "main"
+		}, signal);
+		return purgeMarkerOperation({
+			...action,
+			context: { signer: {
+				...actionSignerIdentity(this.signer),
+				signatures: [signature]
+			} }
+		});
+	}
 	/** A stored document at a version this reactor does not run is read-only here. */
 	async unsupportedStoredProtocol(job, stores, signal) {
 		let versions;
@@ -5671,19 +6417,28 @@ var KyselyKeyframeStore = class KyselyKeyframeStore {
 	}
 	async putKeyframe(documentId, scope, branch, revision, document, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
-		await this.queryExecutor.insertInto("Keyframe").values({
-			documentId,
-			documentType: document.header.documentType,
-			scope,
-			branch,
-			revision,
-			document
-		}).onConflict((oc) => oc.columns([
-			"documentId",
-			"scope",
-			"branch",
-			"revision"
-		]).doUpdateSet({ document })).execute();
+		const write = async (trx) => {
+			await acquirePurgeLocks(trx, [documentId], "shared");
+			if ((await findPurged(trx, [documentId])).has(documentId)) return;
+			await trx.insertInto("Keyframe").values({
+				documentId,
+				documentType: document.header.documentType,
+				scope,
+				branch,
+				revision,
+				document
+			}).onConflict((oc) => oc.columns([
+				"documentId",
+				"scope",
+				"branch",
+				"revision"
+			]).doUpdateSet({ document })).execute();
+		};
+		if (this.trx) {
+			await write(this.trx);
+			return;
+		}
+		await this.db.transaction().execute(write);
 	}
 	async findNearestKeyframe(documentId, scope, branch, targetRevision, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
@@ -5797,15 +6552,18 @@ var _UniqueConstraintContext = class extends Error {
 var KyselyOperationStore = class KyselyOperationStore {
 	db;
 	trx;
+	liveIds;
 	constructor(db) {
 		this.db = db;
 	}
 	get queryExecutor() {
 		return this.trx ?? this.db;
 	}
-	withTransaction(trx) {
+	/** `liveIds`: ids the transaction read untombstoned under its shared lock. */
+	withTransaction(trx, liveIds) {
 		const instance = new KyselyOperationStore(this.db);
 		instance.trx = trx;
+		instance.liveIds = liveIds;
 		return instance;
 	}
 	async apply(documentId, documentType, scope, branch, revision, fn, signal, condition) {
@@ -5850,6 +6608,8 @@ var KyselyOperationStore = class KyselyOperationStore {
 		await fn(atomicTxn);
 		const operations = atomicTxn.getOperations();
 		if (operations.length === 0) return [];
+		const purgedHead = this.liveIds?.has(documentId) ? void 0 : await this.refusePurgedAppend(trx, documentId, operations);
+		if (purgedHead !== void 0) return purgedHead;
 		if (condition) await this.acquireStreamLocks(trx, documentId, scope, branch, condition);
 		const latestOp = await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "desc").limit(1).executeTakeFirst();
 		const currentRevision = latestOp ? latestOp.index : -1;
@@ -5965,6 +6725,24 @@ var KyselyOperationStore = class KyselyOperationStore {
 		}
 		return storedRows.map((row) => this.rowToOperation(row));
 	}
+	/** A purged stream refuses appends; a marker gets the stored one back. */
+	async refusePurgedAppend(trx, documentId, operations) {
+		if (!(await findPurged(trx, [documentId])).has(documentId)) return;
+		if (!operations.every((operation) => this.isMarker(operation))) throw new DocumentPurgedError(documentId);
+		return (await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where(sql`action->>'type' = ${PURGE_DOCUMENT}`).orderBy("index", "asc").execute()).map((row) => this.rowToOperation(row));
+	}
+	isMarker(operation) {
+		return this.actionType(operation) === PURGE_DOCUMENT;
+	}
+	actionType(operation) {
+		let action = operation.action;
+		if (typeof action === "string") try {
+			action = JSON.parse(action);
+		} catch {
+			return;
+		}
+		if (typeof action === "object" && action !== null && "type" in action && typeof action.type === "string") return action.type;
+	}
 	/** True when the staged write creates a document rather than appending to one. */
 	isCreate(operations) {
 		for (const operation of operations) {
@@ -6162,8 +6940,8 @@ function createForwardingPoolInstrumentation(name) {
 }
 //#endregion
 //#region src/storage/migrations/001_create_operation_table.ts
-var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$22 });
-async function up$22(db) {
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$25 });
+async function up$25(db) {
 	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
 		"documentId",
 		"scope",
@@ -6188,8 +6966,8 @@ async function up$22(db) {
 }
 //#endregion
 //#region src/storage/migrations/002_create_keyframe_table.ts
-var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$21 });
-async function up$21(db) {
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$24 });
+async function up$24(db) {
 	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
 		"documentId",
 		"scope",
@@ -6205,14 +6983,14 @@ async function up$21(db) {
 }
 //#endregion
 //#region src/storage/migrations/003_create_document_table.ts
-var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$20 });
-async function up$20(db) {
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$23 });
+async function up$23(db) {
 	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/004_create_document_relationship_table.ts
-var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$19 });
-async function up$19(db) {
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$22 });
+async function up$22(db) {
 	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
 		"sourceId",
 		"targetId",
@@ -6224,14 +7002,14 @@ async function up$19(db) {
 }
 //#endregion
 //#region src/storage/migrations/005_create_indexer_state_table.ts
-var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
-async function up$18(db) {
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$21 });
+async function up$21(db) {
 	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/006_create_document_snapshot_table.ts
-var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
-async function up$17(db) {
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$20 });
+async function up$20(db) {
 	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
 		"documentId",
 		"scope",
@@ -6252,8 +7030,8 @@ async function up$17(db) {
 }
 //#endregion
 //#region src/storage/migrations/007_create_slug_mapping_table.ts
-var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
-async function up$16(db) {
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$19 });
+async function up$19(db) {
 	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
 		"documentId",
 		"scope",
@@ -6263,14 +7041,14 @@ async function up$16(db) {
 }
 //#endregion
 //#region src/storage/migrations/008_create_view_state_table.ts
-var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
-async function up$15(db) {
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
+async function up$18(db) {
 	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/009_create_operation_index_tables.ts
-var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
-async function up$14(db) {
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
+async function up$17(db) {
 	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
 	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
 	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
@@ -6284,8 +7062,8 @@ async function up$14(db) {
 }
 //#endregion
 //#region src/storage/migrations/010_create_sync_tables.ts
-var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
-async function up$13(db) {
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
 	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
 	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
@@ -6293,8 +7071,8 @@ async function up$13(db) {
 }
 //#endregion
 //#region src/storage/migrations/011_add_cursor_type_column.ts
-var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
-async function up$12(db) {
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
 	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
 	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
 	await db.schema.dropTable("sync_cursors").execute();
@@ -6303,64 +7081,64 @@ async function up$12(db) {
 }
 //#endregion
 //#region src/storage/migrations/012_add_source_remote_column.ts
-var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$11 });
-async function up$11(db) {
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
 	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
 }
 //#endregion
 //#region src/storage/migrations/013_create_sync_dead_letters_table.ts
-var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$10 });
-async function up$10(db) {
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
 	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
 }
 //#endregion
 //#region src/storage/migrations/014_create_processor_cursor_table.ts
-var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$9 });
-async function up$9(db) {
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$12 });
+async function up$12(db) {
 	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
 }
 //#endregion
 //#region src/storage/migrations/015_add_operation_denied_reason.ts
 var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Records why authorization refused an operation. Separate from `error` so a
 * denial is distinguishable from a reducer failure without matching on a
 * message. Null for every operation written before decisions were enforced.
 */
-async function up$8(db) {
+async function up$11(db) {
 	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
 	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
 }
-async function down$8(db) {
+async function down$11(db) {
 	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
 	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
 }
 //#endregion
 //#region src/storage/migrations/016_add_dead_letter_error_type.ts
 var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * The classification a dead letter falls into, stored because it decides whether
 * the document stays quarantined and the in-memory error is gone after a restart.
 * Defaulted rather than nullable, so a pre-existing row rehydrates.
 */
-async function up$7(db) {
+async function up$10(db) {
 	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
 }
-async function down$7(db) {
+async function down$10(db) {
 	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
 }
 //#endregion
 //#region src/storage/migrations/017_create_group_references.ts
 var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * One row per (document, group) reference ever discovered from an auth
@@ -6371,18 +7149,18 @@ var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
 * requires (sync), and by groupId for the documents a group change affects
 * (re-evaluation).
 */
-async function up$6(db) {
+async function up$9(db) {
 	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
 	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
 }
-async function down$6(db) {
+async function down$9(db) {
 	await db.schema.dropTable("group_references").execute();
 }
 //#endregion
 //#region src/storage/migrations/018_add_sync_remote_bound_address.ts
 var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * The address a sync channel is bound to, so a channel created by one subject
@@ -6393,17 +7171,17 @@ var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
 * until its first authenticated poll adopts it. A default would claim them all
 * for one address.
 */
-async function up$5(db) {
+async function up$8(db) {
 	await db.schema.alterTable("sync_remotes").addColumn("bound_address", "text").execute();
 }
-async function down$5(db) {
+async function down$8(db) {
 	await db.schema.alterTable("sync_remotes").dropColumn("bound_address").execute();
 }
 //#endregion
 //#region src/storage/migrations/019_require_action_id.ts
 var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Makes an operation whose action carries no id physically unstorable.
@@ -6430,7 +7208,7 @@ var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
 * The empty string is rejected alongside null. It derives the same colliding
 * operation id as an absent id, so admitting it would leave the hole open.
 */
-async function up$4(db) {
+async function up$7(db) {
 	await db.updateTable("Operation").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
 	await db.updateTable("operation_index_operations as oio").from("Operation as op").set({ action: sql`jsonb_set(oio.action, '{id}', to_jsonb(op.action->>'id'))` }).whereRef("oio.opId", "=", "op.opId").whereRef("oio.index", "=", "op.index").whereRef("oio.skip", "=", "op.skip").where(sql`jsonb_typeof(oio.action) = 'object' and coalesce(oio.action->>'id', '') = ''`).where(sql`coalesce(op.action->>'id', '') <> ''`).execute();
 	await db.updateTable("operation_index_operations").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
@@ -6442,74 +7220,118 @@ async function up$4(db) {
 * their operations are now known by, and reverting them would reintroduce the
 * collision the migration removed.
 */
-async function down$4(db) {
+async function down$7(db) {
 	await db.schema.alterTable("operation_index_operations").dropConstraint("action_must_have_id").execute();
 	await db.schema.alterTable("Operation").dropConstraint("action_must_have_id").execute();
 }
 //#endregion
 //#region src/storage/migrations/020_add_snapshot_operation_ordinal.ts
 var _020_add_snapshot_operation_ordinal_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$6,
+	up: () => up$6
 });
 /** Orders header row writes across scopes; `lastOperationIndex` is per scope. */
-async function up$3(db) {
+async function up$6(db) {
 	await db.schema.alterTable("DocumentSnapshot").addColumn("lastOperationOrdinal", "integer", (col) => col.notNull().defaultTo(0)).execute();
 }
-async function down$3(db) {
+async function down$6(db) {
 	await db.schema.alterTable("DocumentSnapshot").dropColumn("lastOperationOrdinal").execute();
 }
 //#endregion
 //#region src/storage/migrations/021_add_sync_remote_peer.ts
 var _021_add_sync_remote_peer_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * The peer's manifest as canonical JSON, and when it was heard. Both null: not
 * yet heard. A time with no manifest: a silent peer, which gets the baselines.
 */
-async function up$2(db) {
+async function up$5(db) {
 	await db.schema.alterTable("sync_remotes").addColumn("peer_manifest", "text").addColumn("peer_manifest_at_utc_ms", "bigint").execute();
 }
-async function down$2(db) {
+async function down$5(db) {
 	await db.schema.alterTable("sync_remotes").dropColumn("peer_manifest").dropColumn("peer_manifest_at_utc_ms").execute();
 }
 //#endregion
 //#region src/storage/migrations/022_create_sync_holds.ts
 var _022_create_sync_holds_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$4,
+	up: () => up$4
 });
 /** Documents held back from a remote whose peer cannot run their versions. */
-async function up$1(db) {
+async function up$4(db) {
 	await db.schema.createTable("sync_holds").addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("protocol", "text", (col) => col.notNull()).addColumn("version", "integer", (col) => col.notNull()).addColumn("held_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_holds_pkey", [
 		"remote_name",
 		"document_id",
 		"branch"
 	]).execute();
 }
-async function down$1(db) {
+async function down$4(db) {
 	await db.schema.dropTable("sync_holds").execute();
 }
 //#endregion
 //#region src/storage/migrations/023_index_created_protocol_versions.ts
 var _023_index_created_protocol_versions_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$3,
+	up: () => up$3
 });
 /**
 * One entry per document created with protocolVersions, keyed by a hash so an
 * oversized header cannot make its creation unstorable. Startup reads the
 * distinct values without visiting every document.
 */
-async function up(db) {
+async function up$3(db) {
 	await db.schema.createIndex("idx_operation_created_protocol_versions").on("Operation").expression(sql`md5((action->'input'->'protocolVersions')::text)`).where(sql`scope = 'document' and "index" = 0 and (action->'input'->'protocolVersions') is not null`).execute();
 }
-async function down(db) {
+async function down$3(db) {
 	await db.schema.dropIndex("idx_operation_created_protocol_versions").execute();
 }
 //#endregion
+//#region src/storage/migrations/024_create_document_purges.ts
+var _024_create_document_purges_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/** One row per purged document: the tombstone. Written once, never deleted. */
+async function up$2(db) {
+	await db.schema.createTable("document_purges").addColumn("documentId", "text", (col) => col.primaryKey()).addColumn("ordinal", "bigint", (col) => col.notNull()).addColumn("removedRows", "jsonb", (col) => col.notNull()).addColumn("purgedAtUtc", "timestamptz", (col) => col.notNull()).addColumn("requestId", "text", (col) => col.notNull()).execute();
+}
+async function down$2(db) {
+	await db.schema.dropTable("document_purges").execute();
+}
+//#endregion
+//#region src/storage/migrations/025_create_sync_received_markers.ts
+var _025_create_sync_received_markers_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/** Received purge markers awaiting their outcome; removed with their remote. */
+async function up$1(db) {
+	await db.schema.createTable("sync_received_markers").addColumn("remote_name", "text", (col) => col.notNull()).addColumn("marker_id", "text", (col) => col.notNull()).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("operation", "jsonb", (col) => col.notNull()).addColumn("received_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_received_markers_pkey", ["remote_name", "marker_id"]).execute();
+}
+async function down$1(db) {
+	await db.schema.dropTable("sync_received_markers").execute();
+}
+//#endregion
+//#region src/storage/migrations/026_create_sync_purge_refusals.ts
+var _026_create_sync_purge_refusals_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/** A remote's refusal of a purge marker; payload-free, kept like the tombstone. */
+async function up(db) {
+	await db.schema.createTable("sync_purge_refusals").addColumn("remote_name", "text", (col) => col.notNull()).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("refused_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_purge_refusals_pkey", [
+		"remote_name",
+		"document_id",
+		"branch"
+	]).execute();
+	await db.schema.createIndex("idx_sync_purge_refusals_document").on("sync_purge_refusals").column("document_id").execute();
+}
+async function down(db) {
+	await db.schema.dropTable("sync_purge_refusals").execute();
+}
+//#endregion
 //#region src/storage/migrations/migrator.ts
 const REACTOR_SCHEMA = "reactor";
 const migrations = {
@@ -6535,7 +7357,10 @@ const migrations = {
 	"020_add_snapshot_operation_ordinal": _020_add_snapshot_operation_ordinal_exports,
 	"021_add_sync_remote_peer": _021_add_sync_remote_peer_exports,
 	"022_create_sync_holds": _022_create_sync_holds_exports,
-	"023_index_created_protocol_versions": _023_index_created_protocol_versions_exports
+	"023_index_created_protocol_versions": _023_index_created_protocol_versions_exports,
+	"024_create_document_purges": _024_create_document_purges_exports,
+	"025_create_sync_received_markers": _025_create_sync_received_markers_exports,
+	"026_create_sync_purge_refusals": _026_create_sync_purge_refusals_exports
 };
 var ProgrammaticMigrationProvider = class {
 	getMigrations() {
@@ -6610,6 +7435,8 @@ function toErrorInfo(err, depth = 0) {
 		};
 		if (typeof err.stack === "string") info.stack = err.stack.length > MAX_STACK_LENGTH ? err.stack.slice(0, MAX_STACK_LENGTH) : err.stack;
 		if (err.cause !== void 0) info.cause = toErrorInfo(err.cause, depth + 1);
+		const documentId = err.documentId;
+		if (typeof documentId === "string") info.documentId = documentId;
 		return info;
 	}
 	if (typeof err === "string") return {
@@ -6646,6 +7473,11 @@ function fromErrorInfo(info) {
 		writable: true
 	});
 	if (info.stack !== void 0) err.stack = info.stack;
+	if (info.documentId !== void 0) Object.defineProperty(err, "documentId", {
+		value: info.documentId,
+		configurable: true,
+		writable: true
+	});
 	if (info.cause !== void 0) Object.defineProperty(err, "cause", {
 		value: fromErrorInfo(info.cause),
 		configurable: true,
@@ -6735,6 +7567,6 @@ function createForwardingLogger(post, level = "info", tags = []) {
 	};
 }
 //#endregion
-export { OptimisticLockError as $, DEFAULT_DEFERRED_JOB_TTL_MS as A, summarizeSubmittedActions as B, SettledWatermark as C, snapshotFunctionsFor as D, parseSnapshot as E, ModuleNotFoundError as F, authDecisionModel as G, decideAtHead as H, GATED_DOCUMENT_ACTIONS as I, APPEND_CONDITION_FAILED_PREFIX as J, buildDecisionModel as K, createConsistencyToken as L, DuplicateManifestError as M, DuplicateModuleError as N, DocumentMetaCache as O, InvalidModuleError as P, DuplicateOperationError as Q, createEmptyConsistencyToken as R, ProbeSettler as S, describeWaitingSessions as T, selectDecisionModel as U, targetDocumentId as V, documentDecisionModel as W, DocumentAlreadyExistsError as X, AppendConditionFailedError as Y, DocumentExistence as Z, KyselyExecutionScope as _, throwIfAborted as _t, DEFAULT_DRIVE_CONTAINER_TYPES as a, DocumentNotFoundError as at, KyselyWriteCache as b, runMigrations as c, InvalidSignatureError as ct, KyselyOperationStore as d, UnsupportedStoredProtocolError as dt, RevisionMismatchError as et, KyselyKeyframeStore as f, UpgradePreconditionFailedError as ft, PassthroughSigner as g, parsePagingOptions as gt, verifyActionSignature as h, matchesScope as ht, fromErrorInfo as i, DocumentDeletedError as it, JobExecutorEventTypes as j, CollectionMembershipCache as k, createForwardingPoolInstrumentation as l, RelationshipNotFoundError as lt, SimpleJobExecutor as m, ReactorEventTypes as mt, errorToInfo as n, AuthTimestampNotMonotonicError as nt, REACTOR_SCHEMA as o, ExcessiveReshuffleError as ot, DocumentModelRegistry as p, EventBusAggregateError as pt, DriveCollectionId as q, sanitizeArg as r, AuthorizationDeniedError as rt, getMigrationStatus as s, InvalidOperationTimestampError as st, createForwardingLogger as t, AuthEnforcementDisabledError as tt, instrumentPgPool as u, UnsupportedProtocolVersionError as ut, resolveFeatureFlags as v, yieldToMain as vt, createKyselyWatermarkProbe as w, KyselyOperationIndex as x, EventBus as y, __exportAll as yt, submittedActionIds as z };
+export { selectDecisionModel as $, ProbeSettler as A, matchesScope as At, JobExecutorEventTypes as B, KyselyWriteCache as C, RelationshipNotFoundError as Ct, acquirePurgeLocks as D, UpgradePreconditionFailedError as Dt, PURGE_NS as E, UnsupportedStoredProtocolError as Et, snapshotFunctionsFor as F, GATED_DOCUMENT_ACTIONS as G, DuplicateModuleError as H, DocumentMetaCache as I, createEmptyConsistencyToken as J, createConsistencyToken as K, CollectionMembershipCache as L, createKyselyWatermarkProbe as M, throwIfAborted as Mt, describeWaitingSessions as N, yieldToMain as Nt, findPurged as O, EventBusAggregateError as Ot, parseSnapshot as P, __exportAll as Pt, decideAtHead as Q, DEFAULT_DEFERRED_JOB_TTL_MS as R, EventBus as S, PurgeTooLargeError as St, PURGE_LOCK_BUCKETS as T, UnsupportedProtocolVersionError as Tt, InvalidModuleError as U, DuplicateManifestError as V, ModuleNotFoundError as W, summarizeSubmittedActions as X, submittedActionIds as Y, targetDocumentId as Z, KyselyExecutionScope as _, DocumentPurgedError as _t, DEFAULT_DRIVE_CONTAINER_TYPES as a, AppendConditionFailedError as at, appliedDelete as b, InvalidOperationTimestampError as bt, runMigrations as c, DuplicateOperationError as ct, KyselyOperationStore as d, AuthEnforcementDisabledError as dt, documentDecisionModel as et, KyselyKeyframeStore as f, AuthTimestampNotMonotonicError as ft, PassthroughSigner as g, DocumentNotFoundError as gt, verifyActionSignature as h, DocumentNotDeletedError as ht, fromErrorInfo as i, APPEND_CONDITION_FAILED_PREFIX as it, SettledWatermark as j, parsePagingOptions as jt, listPurged as k, ReactorEventTypes as kt, createForwardingPoolInstrumentation as l, OptimisticLockError as lt, SimpleJobExecutor as m, DocumentDeletedError as mt, errorToInfo as n, buildDecisionModel as nt, REACTOR_SCHEMA as o, DocumentAlreadyExistsError as ot, DocumentModelRegistry as p, AuthorizationDeniedError as pt, createDocumentFromAction as q, sanitizeArg as r, DriveCollectionId as rt, getMigrationStatus as s, DocumentExistence as st, createForwardingLogger as t, authDecisionModel as tt, instrumentPgPool as u, RevisionMismatchError as ut, DEFAULT_PURGE_DELETE_BATCH as v, ExcessiveReshuffleError as vt, KyselyOperationIndex as w, ReservedActionError as wt, resolveFeatureFlags as x, InvalidSignatureError as xt, KyselyDocumentPurger as y, GroupInUseError as yt, DEFAULT_MAX_PURGE_OPERATIONS as z };
 
-//# sourceMappingURL=forwarding-logger-BkwlvD9W.js.map
+//# sourceMappingURL=forwarding-logger-DMqDs9tE.js.map