@powerhousedao/reactor 6.2.3-dev.5 → 6.2.3-dev.51

package/dist/drive-container-types-BAfFzBOf.js

@@ -0,0 +1,3892 @@
+import { A as GATED_DOCUMENT_ACTIONS, At as yieldToMain, B as createOperation, Ct as ReactorEventTypes, F as buildErrorResult, G as relationshipTarget, H as isGenesisOperation, I as buildSuccessResult, J as targetDocumentId, K as submittedActionIds, M as TouchedStreams, N as applyDeleteDocumentAction$1, O as DOCUMENT_SCOPE_ACTIONS, P as applyUpgradeDocumentAction$1, R as createDocumentFromAction, Tt as delay, U as jobWriteIds, V as getNextIndexForScope, W as refusalError, Y as updateDocumentRevision, Z as AppendConditionFailedError, _ as acquirePurgeLocks, at as AuthorizationDeniedError, ct as DocumentNotDeletedError, dt as ExcessiveReshuffleError, ft as GroupInUseError, gt as PurgeTooLargeError, it as AuthTimestampNotMonotonicError, j as PurgeFence, k as FencedWriteCache, kt as withDeadline, lt as DocumentNotFoundError, mt as InvalidSignatureError, pt as InvalidOperationTimestampError, st as DocumentDeletedError, ut as DocumentPurgedError, v as findPurged, vt as ReservedActionError, wt as TIMED_OUT, xt as UpgradePreconditionFailedError, yt as UnsupportedProtocolVersionError } from "./forwarding-logger-B9LLXItm.js";
+import { AUTH_ACTION_TYPES, AUTH_DENIED_BY_GRANT_REASON, AUTH_NO_GRANT_REASON, AUTH_VERSION_UNSUPPORTED_REASON, DOCUMENT_DELETED_REASON, PEER_CAPABILITIES, actionSignerIdentity, actionSigningTarget, applyAuthAction, applyDeleteDocumentAction, base58Decode, baseReducerVersion, buildOperationSignatureMessage, buildOperationSignatureParams, canonicalJson, decide, deriveDocumentId, deriveOperationId, evaluate, garbageCollect, groupDocumentType, groupMembershipActionTypes, hashActionV2, hashBrowser, hashDocumentStateForScope, isDenied, isDerivedDocumentId, isPurgeMarker, isUndoRedo, isV2ActionHash, localSupports, mentionedGroupIds, normalizeDocumentModelVersion, purgeDocumentAction, purgeMarkerOperation, referencedGroupIds, signaturePolicyOf, sortOperations, v2TupleProblem, withProtocolVersions } from "@powerhousedao/shared/document-model";
+import { sql } from "kysely";
+//#region src/shared/types.ts
+/**
+* Enum that determines deletion propagation.
+*/
+let PropagationMode = /* @__PURE__ */ function(PropagationMode) {
+	PropagationMode["None"] = "none";
+	PropagationMode["Cascade"] = "cascade";
+	return PropagationMode;
+}({});
+/**
+* Enum that describes the type of relationship change.
+*/
+let RelationshipChangeType = /* @__PURE__ */ function(RelationshipChangeType) {
+	RelationshipChangeType["Added"] = "added";
+	RelationshipChangeType["Removed"] = "removed";
+	return RelationshipChangeType;
+}({});
+/**
+* Marks a load whose operations a sync cursor keeps re-pullable, so its
+* write-ready needs no flush. A symbol, not exported from the package: it
+* cannot be set by an outside caller or survive any serialization boundary.
+*/
+const CURSOR_PROTECTED = Symbol("cursorProtected");
+/** Load meta for the sync manager's inbox, the only owner of the cursor. */
+function cursorProtectedLoadMeta(sourceRemote) {
+	return {
+		sourceRemote,
+		[CURSOR_PROTECTED]: true
+	};
+}
+function isCursorProtectedLoad(job) {
+	const meta = job.meta;
+	return job.kind === "load" && meta[CURSOR_PROTECTED] === true;
+}
+/**
+* Job execution statuses
+*/
+let JobStatus = /* @__PURE__ */ function(JobStatus) {
+	/** Job is queued but not yet started */
+	JobStatus["PENDING"] = "PENDING";
+	/** Job is currently being executed */
+	JobStatus["RUNNING"] = "RUNNING";
+	/** Operations have been written to the operation store (JOB_WRITE_READY event) */
+	JobStatus["WRITE_READY"] = "WRITE_READY";
+	/** Read models have finished indexing operations (JOB_READ_READY event) */
+	JobStatus["READ_READY"] = "READ_READY";
+	/** Job failed (may be retried) */
+	JobStatus["FAILED"] = "FAILED";
+	return JobStatus;
+}({});
+//#endregion
+//#region src/cache/operation-index-types.ts
+const DRIVE_COLLECTION_PREFIX = "drive.";
+/**
+* Identifies the collection a remote synchronizes. Collections are drive-level
+* abstractions (document-drive and reactor-drive), so a collection id is the
+* drive document id plus the branch it scopes to rather than an opaque string.
+*
+* The canonical string form (`drive.${branch}.${driveId}`) is produced only by
+* `key` and parsed only by `fromKey`; that string is the wire and storage
+* representation and is byte-for-byte identical to the legacy
+* `driveCollectionId(branch, driveId)` output, so existing `document_collections`
+* rows and persisted remotes remain valid without migration.
+*/
+var DriveCollectionId = class DriveCollectionId {
+	driveId;
+	branch;
+	constructor(driveId, branch) {
+		this.driveId = driveId;
+		this.branch = branch;
+	}
+	static forDrive(driveId, branch = "main") {
+		return new DriveCollectionId(driveId, branch);
+	}
+	/**
+	* The single deserializer for the wire/storage form. `branch` may contain
+	* dots, while `driveId` is a dot-free document id, so the drive id is the
+	* final dot-delimited segment.
+	*
+	* That asymmetry is a real constraint, not a convention: a drive id
+	* containing a dot does NOT survive `key` -> `fromKey`, because the split
+	* takes the LAST dot and so hands the tail of the drive id back as the drive
+	* id and everything before it as the branch. The key format is the wire and
+	* storage representation of existing `document_collections` rows, so it
+	* cannot be changed; callers that accept a drive id or branch from outside
+	* (a UI field, an RPC payload) must reject dots in the drive id at their own
+	* boundary. The round-trip is verifiable without parsing rules:
+	* `DriveCollectionId.fromKey(id.key).key === id.key`.
+	*/
+	static fromKey(key) {
+		if (!key.startsWith(DRIVE_COLLECTION_PREFIX)) throw new Error(`Unsupported collection id: ${key}`);
+		const rest = key.slice(6);
+		const lastDot = rest.lastIndexOf(".");
+		if (lastDot === -1 || lastDot === rest.length - 1) throw new Error(`Malformed drive collection id: ${key}`);
+		return new DriveCollectionId(rest.slice(lastDot + 1), rest.slice(0, lastDot));
+	}
+	get key() {
+		return `${DRIVE_COLLECTION_PREFIX}${this.branch}.${this.driveId}`;
+	}
+	toString() {
+		return this.key;
+	}
+	equals(other) {
+		return this.driveId === other.driveId && this.branch === other.branch;
+	}
+};
+//#endregion
+//#region src/decision/build-decision-model.ts
+/**
+* Reads each projection's stream through the supplied reader, recording the
+* revision observed. Static projections resolve first; derived projections
+* see only those and contribute a map from document id to state. Each
+* distinct stream is read once and yields one append condition entry.
+*/
+async function buildDecisionModel(reader, definition, target, signal) {
+	const decisionModel = definition(target);
+	const projections = Object.entries(decisionModel.projections);
+	const reads = /* @__PURE__ */ new Map();
+	const model = {};
+	for (const [key, projection] of projections) {
+		if (typeof projection.query === "function") continue;
+		model[key] = (await readStream(reader, projection.query, reads, signal)).state;
+	}
+	const staticModel = { ...model };
+	const derived = [];
+	for (const [key, projection] of projections) {
+		if (typeof projection.query !== "function") continue;
+		derived.push([key, projection.query(staticModel)]);
+	}
+	if (derived.length > 0 && reader.fence) await reader.fence(derived.flatMap(([, queries]) => queries.map((q) => q.documentId)));
+	for (const [key, queries] of derived) {
+		const value = {};
+		for (const query of queries) {
+			let read;
+			try {
+				read = await readStream(reader, query, reads, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) {
+					recordEmptyStream(query, reads);
+					continue;
+				}
+				throw error;
+			}
+			value[query.documentId] = read.state;
+		}
+		model[key] = value;
+	}
+	return {
+		model,
+		appendCondition: { streams: [...reads.values()].map((read) => read.stream) }
+	};
+}
+/** Guards a stream that holds nothing yet: any operation appearing is growth. */
+function recordEmptyStream(query, reads) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	if (reads.has(key)) return;
+	reads.set(key, {
+		state: void 0,
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: -1
+		}
+	});
+}
+async function readStream(reader, query, reads, signal) {
+	const key = `${query.documentId}:${query.scope}:${query.branch}`;
+	const existing = reads.get(key);
+	if (existing) return existing;
+	const document = await reader.getState(query.documentId, query.scope, query.branch, void 0, signal);
+	const read = {
+		state: document.state[query.scope],
+		stream: {
+			documentId: query.documentId,
+			scope: query.scope,
+			branch: query.branch,
+			revision: observedRevision(document, query.scope)
+		}
+	};
+	reads.set(key, read);
+	return read;
+}
+/**
+* The highest operation index the document reflects for the scope, or -1 if
+* empty. `header.revision` is authoritative, not the rebuilt operation list.
+*/
+function observedRevision(document, scope) {
+	if (scope in document.header.revision) return document.header.revision[scope] - 1;
+	if (scope in document.operations) {
+		const operations = document.operations[scope];
+		if (operations.length > 0) return operations[operations.length - 1].index;
+	}
+	if (!(scope in document.header.revision)) return -1;
+	return document.header.revision[scope] - 1;
+}
+/**
+* The projections whose queries depend on folded state. A positional walk
+* resolves their streams through `queryOverHistory`; a projection without one
+* contributes no streams to a walk.
+*/
+function derivedReadSet(definition) {
+	const projections = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query !== "function") continue;
+		projections.push({
+			name,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply,
+			queryOverHistory: projection.queryOverHistory
+		});
+	}
+	return projections;
+}
+/**
+* The streams a model reads whose queries are known before it is built. A
+* derived query needs the statically-queried projections first, so it is not
+* included here.
+*/
+function staticReadSet(definition) {
+	const streams = [];
+	for (const [name, projection] of Object.entries(definition.projections)) {
+		if (typeof projection.query === "function") continue;
+		streams.push({
+			name,
+			query: projection.query,
+			decidingActions: projection.decidingActions,
+			apply: projection.apply
+		});
+	}
+	return streams;
+}
+//#endregion
+//#region src/decision/auth-decision-model.ts
+function refusalReason(refusal) {
+	switch (refusal) {
+		case "version-unsupported": return AUTH_VERSION_UNSUPPORTED_REASON;
+		case "denied-by-grant": return AUTH_DENIED_BY_GRANT_REASON;
+		case "no-applicable-grant": return AUTH_NO_GRANT_REASON;
+	}
+}
+function decideAuthModel(model, subject, request, groups, conditions) {
+	if (request.verb === "execute" && model.document.isDeleted) return {
+		decision: "deny",
+		reason: DOCUMENT_DELETED_REASON
+	};
+	const evaluation = evaluate(model.auth, subject, request, groups, conditions);
+	if (evaluation.decision === "allow") return { decision: "allow" };
+	return {
+		decision: "deny",
+		reason: refusalReason(evaluation.refusal)
+	};
+}
+function documentProjection(target) {
+	return {
+		decidingActions: ["DELETE_DOCUMENT"],
+		apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+			...document,
+			state: { ...document.state }
+		}, operation.action) : document,
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "document"
+		}
+	};
+}
+function authProjection(target) {
+	return {
+		decidingActions: [...AUTH_ACTION_TYPES],
+		apply: (document, operation) => applyAuthAction(document, operation.action),
+		query: {
+			documentId: target.documentId,
+			branch: target.branch,
+			scope: "auth"
+		}
+	};
+}
+/** This decision model uses both the document and the auth streams. */
+function authDecisionModel(target) {
+	return {
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target)
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return decideAuthModel(model, subject, request);
+		}
+	};
+}
+/**
+* Folds one group-stream operation with the registered group model's reducer.
+* A reactor without the module registered folds nothing, so the member list
+* stays as read and a missing reducer never widens access.
+*/
+function applyGroupOperation(registry, document, operation) {
+	let reducer;
+	try {
+		reducer = registry.getModule(groupDocumentType).reducer;
+	} catch {
+		return document;
+	}
+	return reducer(document, operation.action);
+}
+/**
+* Folds one evaluated-scope operation with the reducer registered for the
+* document's own type, at the document's stamped version. A reactor without
+* that module folds nothing, so conditions read the base state and an
+* unresolvable reducer never widens access.
+*/
+function applyModelOperation(registry, document, operation) {
+	let reducer;
+	try {
+		const version = normalizeDocumentModelVersion(document.state.document?.version);
+		reducer = registry.getModule(document.header.documentType, version).reducer;
+	} catch {
+		return document;
+	}
+	return reducer(document, operation.action);
+}
+/**
+* The auth model extended with a derived groups projection: the streams it
+* reads are the group documents the folded grant list names, so adding a
+* grant that names a new group pulls that group's stream into the read-set.
+* Group queries pin the main branch, because a group's member list lives on
+* its main branch no matter which branch the referencing document is on.
+*/
+function groupsProjection(registry) {
+	return {
+		decidingActions: [...groupMembershipActionTypes],
+		apply: (document, operation) => applyGroupOperation(registry, document, operation),
+		query: (model) => referencedGroupIds(model.auth?.grants ?? []).map((id) => ({
+			documentId: id,
+			branch: "main",
+			scope: "global"
+		})),
+		queryOverHistory: (reads) => {
+			const ids = [];
+			for (const read of reads) {
+				if (read.name !== "auth") continue;
+				for (const operation of read.operations) for (const id of mentionedGroupIds(operation.action)) if (!ids.includes(id)) ids.push(id);
+			}
+			return ids.map((id) => ({
+				documentId: id,
+				branch: "main",
+				scope: "global"
+			}));
+		}
+	};
+}
+function authGroupsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return decideAuthModel(model, subject, request, model.groups);
+		}
+	});
+}
+/**
+* The groups model with conditions live: decide hands the executing scope's
+* state and the action input through to the evaluator, so `where` clauses
+* and { match } principals apply. The model folds the evaluated scope during
+* a positional walk, so a condition reads the state as it stood at each
+* operation's position.
+*/
+function authConditionsDecisionModel(registry) {
+	return (target) => ({
+		projections: {
+			document: documentProjection(target),
+			auth: authProjection(target),
+			groups: groupsProjection(registry)
+		},
+		foldEvaluatedScope: (document, operation) => applyModelOperation(registry, document, operation),
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request, ctx) {
+			return decideAuthModel(model, subject, request, model.groups, {
+				scopeState: ctx.scopeState,
+				actionInput: ctx.actionInput
+			});
+		}
+	});
+}
+//#endregion
+//#region src/decision/document-decision-model.ts
+/**
+* The simplest decision model: one projection over the document scope, which
+* rejects on a deleted document.
+*/
+function documentDecisionModel(target) {
+	return {
+		projections: { document: {
+			decidingActions: ["DELETE_DOCUMENT"],
+			apply: (document, operation) => operation.action.type === "DELETE_DOCUMENT" ? applyDeleteDocumentAction({
+				...document,
+				state: { ...document.state }
+			}, operation.action) : document,
+			query: {
+				documentId: target.documentId,
+				branch: target.branch,
+				scope: "document"
+			}
+		} },
+		evaluatesScope() {
+			return true;
+		},
+		decide(model, subject, request) {
+			return request.verb === "execute" && model.document.isDeleted ? {
+				decision: "deny",
+				reason: DOCUMENT_DELETED_REASON
+			} : { decision: "allow" };
+		}
+	};
+}
+//#endregion
+//#region src/decision/registered-model.ts
+/**
+* Builds the model at the stream heads and decides one request against it. The
+* append condition it returns is the read-set the store enforces at write time.
+*
+* With `conditions` supplied, the executing scope's state is read at the head
+* for `doc.<scope>.*` paths, or taken from the run's carried document when the
+* caller has already reduced earlier writes into it. That read carries no
+* append-condition entry of its own: the written stream's expected-revision
+* check already refuses a write whose scope grew between the read and the
+* append.
+*/
+async function decideAtHead(model, cache, target, subject, request, signal, conditions) {
+	const built = await buildDecisionModel(cache, model, target, signal);
+	let scopeState;
+	if (conditions !== void 0) scopeState = (conditions.carriedDocument ?? await cache.getState(target.documentId, request.scope, target.branch, void 0, signal)).state[request.scope];
+	return {
+		evaluation: model(target).decide(built.model, subject, request, {
+			scopeState,
+			actionInput: conditions?.actionInput
+		}),
+		appendCondition: built.appendCondition,
+		documentVersion: built.model.document.version,
+		deletedAtUtcIso: built.model.document.deletedAtUtcIso ?? null
+	};
+}
+/**
+* The model this reactor enforces. With `authEnforcement` off the auth scope is
+* absent from every append condition and no load walks it; with `authGroups`
+* on, the group documents the grant list names join the read-set and the
+* registry supplies the reducer that folds them.
+*/
+function selectDecisionModel(flags, registry) {
+	if (flags.authConditions) return authConditionsDecisionModel(registry);
+	if (flags.authGroups) return authGroupsDecisionModel(registry);
+	return flags.authEnforcement ? authDecisionModel : documentDecisionModel;
+}
+//#endregion
+//#region src/executor/types.ts
+/** 200k operations purge in 1.6 s on local Postgres; jobs time out at 30 s. */
+const DEFAULT_MAX_PURGE_OPERATIONS = 2e5;
+/** How long a deferred job waits for its document before it fails. */
+const DEFAULT_DEFERRED_JOB_TTL_MS = 3e4;
+const DEFAULT_JOB_TIMEOUT_MS = 3e4;
+/**
+* Event types for the job executor
+*/
+const JobExecutorEventTypes = {
+	JOB_STARTED: 2e4,
+	JOB_COMPLETED: 20001,
+	JOB_FAILED: 20002,
+	EXECUTOR_STARTED: 20003,
+	EXECUTOR_STOPPED: 20004
+};
+//#endregion
+//#region src/core/feature-flags.ts
+/**
+* Every flag this reactor knows, with the flags it requires. A stage adds its
+* flag here when it ships, so asking an older reactor for a later stage's flag
+* is an unrecognized name rather than a flag that quietly does nothing.
+*/
+const FLAG_PREREQUISITES = {
+	documentDecisions: [],
+	authEnforcement: ["documentDecisions"],
+	authGroups: ["authEnforcement"],
+	authConditions: ["authGroups"]
+};
+/**
+* The flags as plain booleans, with anything unset off, validated. Callers hold
+* a partial set, because that is what crosses to a pooled worker, and every
+* consumer needs the same resolution of it.
+*/
+function resolveFeatureFlags(flags = {}) {
+	const resolved = {
+		documentDecisions: flags.documentDecisions ?? false,
+		authEnforcement: flags.authEnforcement ?? false,
+		authGroups: flags.authGroups ?? false,
+		authConditions: flags.authConditions ?? false
+	};
+	validateFeatureFlags(flags, FLAG_PREREQUISITES);
+	return resolved;
+}
+/**
+* Throws when the flags ask for enforcement the reactor cannot deliver. Either
+* failure would otherwise read as enforcement being on while the reactor
+* applies less than the caller asked for.
+*/
+function validateFeatureFlags(flags, prerequisites) {
+	const known = Object.keys(prerequisites);
+	const unrecognized = Object.keys(flags).filter((name) => !known.includes(name));
+	if (unrecognized.length > 0) throw new Error(`Unrecognized reactor feature flag: ${unrecognized.join(", ")}. This reactor knows: ${known.join(", ")}.`);
+	for (const name of known) {
+		if (flags[name] !== true) continue;
+		const missing = prerequisites[name].filter((required) => flags[required] !== true);
+		if (missing.length > 0) throw new Error(`Reactor feature flag ${name} requires ${missing.join(", ")}.`);
+	}
+}
+//#endregion
+//#region src/storage/kysely/document-purger.ts
+/** An `Operation` row whose DELETE_DOCUMENT applied: not errored, not denied. */
+const appliedDelete = sql`action->>'type' = 'DELETE_DOCUMENT' and coalesce(error, '') = '' and coalesce("deniedReason", '') = ''`;
+/** Rows removed per statement from the tables a document can fill. */
+const DEFAULT_PURGE_DELETE_BATCH = 5e3;
+/** A purge transaction's statements; bound to the job's transaction. */
+var KyselyDocumentPurger = class {
+	batchSize;
+	db;
+	constructor(db, batchSize = DEFAULT_PURGE_DELETE_BATCH) {
+		this.batchSize = batchSize;
+		this.db = db;
+	}
+	/** Every stream the document holds operations in. */
+	async streams(documentId) {
+		return this.db.selectFrom("Operation").select(["scope", "branch"]).distinct().where("documentId", "=", documentId).orderBy("scope").orderBy("branch").execute();
+	}
+	async operationCount(documentId) {
+		const row = await this.db.selectFrom("operation_index_operations").select((eb) => eb.fn.countAll().as("count")).where("documentId", "=", documentId).executeTakeFirst();
+		return Number(row?.count ?? 0);
+	}
+	/** Untombstoned documents group_references records as naming the group. */
+	async groupReferencers(groupId) {
+		const ids = (await this.db.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).where("documentId", "<>", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
+		const purged = await findPurged(this.db, ids);
+		return ids.filter((id) => !purged.has(id));
+	}
+	/** Survivors whose accepted auth history names the group; refusals do not. */
+	async groupReferencersInHistory(groupId) {
+		const referencing = [];
+		for (const documentId of await this.groupReferencers(groupId)) if ([...(await this.authOperations(documentId)).values()].some((operations) => garbageCollect(sortOperations(operations)).some((operation) => operation.deniedReason === void 0 && operation.error === void 0 && mentionedGroupIds(operation.action).includes(groupId)))) referencing.push(documentId);
+		return referencing;
+	}
+	/** The document's auth-scope operations, per branch, in index order. */
+	async authOperations(documentId) {
+		const rows = await this.db.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", "auth").orderBy("branch").orderBy("index").execute();
+		const byBranch = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const operations = byBranch.get(row.branch) ?? [];
+			operations.push({
+				index: row.index,
+				timestampUtcMs: row.timestampUtcMs.toISOString(),
+				hash: row.hash,
+				skip: row.skip,
+				error: row.error || void 0,
+				deniedReason: row.deniedReason || void 0,
+				id: row.opId,
+				action: row.action
+			});
+			byBranch.set(row.branch, operations);
+		}
+		return byBranch;
+	}
+	/** Every document ever in the collection, but its owner and its own row. */
+	async collectionMembers(collectionId, ownerId, branch) {
+		return (await this.db.selectFrom("document_collections as dc").select("dc.documentId").select(sql`dc."leftOrdinal" is null`.as("openHere")).select((eb) => eb.exists(eb.selectFrom("Operation as op").select("op.opId").whereRef("op.documentId", "=", "dc.documentId").where("op.branch", "=", branch).where("op.scope", "=", "document").where(appliedDelete)).as("deleted")).select((eb) => eb.exists(eb.selectFrom("document_collections as other").select("other.documentId").whereRef("other.documentId", "=", "dc.documentId").where("other.collectionId", "<>", collectionId).where("other.leftOrdinal", "is", null)).as("openElsewhere")).where("dc.collectionId", "=", collectionId).where("dc.documentId", "not in", [ownerId, collectionId]).orderBy("dc.documentId").execute()).map((row) => {
+			const openElsewhere = Boolean(row.openElsewhere);
+			return {
+				documentId: row.documentId,
+				openElsewhere,
+				required: !openElsewhere && (Boolean(row.openHere) || Boolean(row.deleted))
+			};
+		});
+	}
+	async remoteCollection(remoteName) {
+		return (await this.db.selectFrom("sync_remotes").select("collection_id").where("name", "=", remoteName).executeTakeFirst())?.collection_id;
+	}
+	/** Deletes every row about the document; the counts are per table. */
+	async deleteRows(documentId) {
+		const removed = {};
+		removed.Operation = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("Operation").where("id", "in", (eb) => eb.selectFrom("Operation").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.operation_index_operations = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("operation_index_operations").where("ordinal", "in", (eb) => eb.selectFrom("operation_index_operations").select("ordinal").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.Keyframe = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("Keyframe").where("id", "in", (eb) => eb.selectFrom("Keyframe").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.DocumentSnapshot = await this.deleteBatched(async () => {
+			const result = await this.db.deleteFrom("DocumentSnapshot").where("id", "in", (eb) => eb.selectFrom("DocumentSnapshot").select("id").where("documentId", "=", documentId).limit(this.batchSize)).executeTakeFirst();
+			return Number(result.numDeletedRows);
+		});
+		removed.SlugMapping = await this.deleteWhere("SlugMapping", "documentId", documentId);
+		const relationships = await this.db.selectFrom("DocumentRelationship").select((eb) => eb.fn.countAll().as("count")).where((eb) => eb.or([eb("sourceId", "=", documentId), eb("targetId", "=", documentId)])).executeTakeFirst();
+		removed.DocumentRelationship = Number(relationships?.count ?? 0);
+		removed.Document = await this.deleteWhere("Document", "id", documentId);
+		removed.group_references = await this.deleteWhere("group_references", "documentId", documentId);
+		removed.sync_dead_letters = await this.deleteWhere("sync_dead_letters", "document_id", documentId);
+		removed.sync_holds = await this.deleteWhere("sync_holds", "document_id", documentId);
+		return removed;
+	}
+	async writeTombstone(tombstone) {
+		const values = {
+			documentId: tombstone.documentId,
+			ordinal: tombstone.ordinal,
+			removedRows: JSON.stringify(tombstone.removedRows),
+			purgedAtUtc: tombstone.purgedAtUtc,
+			requestId: tombstone.requestId
+		};
+		await this.db.insertInto("document_purges").values(values).onConflict((oc) => oc.column("documentId").doUpdateSet({
+			ordinal: values.ordinal,
+			removedRows: values.removedRows,
+			purgedAtUtc: values.purgedAtUtc,
+			requestId: values.requestId
+		})).execute();
+	}
+	/** Reopens every membership at the marker ordinal, plus `collectionIds`. */
+	async reopenMemberships(documentId, ordinal, collectionIds = []) {
+		await this.db.updateTable("document_collections").set({
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		}).where("documentId", "=", documentId).execute();
+		for (const collectionId of new Set(collectionIds)) await this.db.insertInto("document_collections").values({
+			documentId,
+			collectionId,
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		}).onConflict((oc) => oc.columns(["documentId", "collectionId"]).doUpdateSet({
+			joinedOrdinal: BigInt(ordinal),
+			leftOrdinal: null
+		})).execute();
+		return (await this.db.selectFrom("document_collections").select("collectionId").where("documentId", "=", documentId).orderBy("collectionId").execute()).map((row) => row.collectionId);
+	}
+	async deleteBatched(step) {
+		let total = 0;
+		for (;;) {
+			const deleted = await step();
+			total += deleted;
+			if (deleted < this.batchSize) return total;
+		}
+	}
+	async deleteWhere(table, column, documentId) {
+		const result = await this.db.deleteFrom(table).where(column, "=", documentId).executeTakeFirst();
+		return Number(result.numDeletedRows);
+	}
+};
+//#endregion
+//#region src/executor/execution-scope.ts
+/** For scopes without a transaction to hold a lock in. */
+const NOOP_DOCUMENT_LOCKS = {
+	shared: () => Promise.resolve(),
+	exclusive: () => Promise.resolve(),
+	purged: () => Promise.resolve(/* @__PURE__ */ new Set())
+};
+var DefaultExecutionScope = class {
+	operationStore;
+	operationIndex;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
+	constructor(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache) {
+		this.operationStore = operationStore;
+		this.operationIndex = operationIndex;
+		this.writeCache = writeCache;
+		this.documentMetaCache = documentMetaCache;
+		this.collectionMembershipCache = collectionMembershipCache;
+	}
+	async run(fn, signal) {
+		signal?.throwIfAborted();
+		return fn({
+			operationStore: this.operationStore,
+			operationIndex: this.operationIndex,
+			writeCache: this.writeCache,
+			documentMetaCache: this.documentMetaCache,
+			collectionMembershipCache: this.collectionMembershipCache,
+			documentLocks: NOOP_DOCUMENT_LOCKS
+		});
+	}
+};
+var KyselyExecutionScope = class {
+	db;
+	operationStore;
+	operationIndex;
+	keyframeStore;
+	writeCache;
+	documentMetaCache;
+	collectionMembershipCache;
+	constructor(db, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache) {
+		this.db = db;
+		this.operationStore = operationStore;
+		this.operationIndex = operationIndex;
+		this.keyframeStore = keyframeStore;
+		this.writeCache = writeCache;
+		this.documentMetaCache = documentMetaCache;
+		this.collectionMembershipCache = collectionMembershipCache;
+	}
+	async run(fn, signal) {
+		signal?.throwIfAborted();
+		return this.db.transaction().execute(async (trx) => {
+			const sharedLocked = /* @__PURE__ */ new Set();
+			const liveIds = /* @__PURE__ */ new Set();
+			const scopedOperationStore = this.operationStore.withTransaction(trx, liveIds);
+			const scopedOperationIndex = this.operationIndex.withTransaction(trx, liveIds);
+			const scopedKeyframeStore = this.keyframeStore.withTransaction(trx);
+			return fn({
+				operationStore: scopedOperationStore,
+				operationIndex: scopedOperationIndex,
+				writeCache: this.writeCache.withScopedStores(scopedOperationStore, scopedKeyframeStore),
+				documentMetaCache: this.documentMetaCache.withScopedStore(scopedOperationStore),
+				collectionMembershipCache: this.collectionMembershipCache.withScopedIndex(scopedOperationIndex),
+				documentLocks: {
+					shared: async (ids) => {
+						const list = [...ids];
+						await acquirePurgeLocks(trx, list, "shared");
+						for (const id of list) sharedLocked.add(id);
+					},
+					exclusive: (id) => acquirePurgeLocks(trx, [id], "exclusive"),
+					purged: async (ids) => {
+						const list = [...ids];
+						const found = await findPurged(trx, list);
+						for (const id of list) if (sharedLocked.has(id) && !found.has(id)) liveIds.add(id);
+						return found;
+					}
+				},
+				purger: new KyselyDocumentPurger(trx)
+			});
+		});
+	}
+};
+//#endregion
+//#region src/storage/storage-flush.ts
+/** The store's session is poisoned; only a host restart recovers it. */
+var StoragePoisonedError = class extends Error {
+	constructor(message, cause) {
+		super(message, { cause });
+		this.name = "StoragePoisonedError";
+	}
+};
+var NoopStorageFlusher = class {
+	flush() {
+		return Promise.resolve();
+	}
+};
+//#endregion
+//#region src/utils/reshuffle.ts
+const STRICT_ORDER_ACTION_TYPES = /* @__PURE__ */ new Set([
+	"CREATE_DOCUMENT",
+	"DELETE_DOCUMENT",
+	"UPGRADE_DOCUMENT",
+	"ADD_RELATIONSHIP",
+	"REMOVE_RELATIONSHIP",
+	"UPDATE_RELATIONSHIP",
+	"PURGE_DOCUMENT",
+	"ADD_FOLDER",
+	"UPDATE_FOLDER",
+	"REMOVE_FOLDER"
+]);
+/**
+* Reshuffles operations by timestamp, then applies deterministic tie-breaking.
+* Used for merging concurrent operations from different branches.
+*
+* For strict document-structure actions (e.g., CREATE_DOCUMENT/UPGRADE_DOCUMENT),
+* logical index (index - skip) is prioritized to preserve causal replay order.
+*
+* For other actions, action ID is prioritized to ensure a canonical cross-reactor order
+* for concurrent operations that may have diverged local indices due to prior reshuffles.
+* Logical index and operation ID are then used as deterministic tie-breakers.
+*
+* Example:
+* [0:0, 1:0, 2:0, A3:0, A4:0, A5:0] + [0:0, 1:0, 2:0, B3:0, B4:2, B5:0]
+* GC               => [0:0, 1:0, 2:0, A3:0, A4:0, A5:0] + [0:0, 1:0, B4:2, B5:0]
+* Split            => [0:0, 1:0] + [2:0, A3:0, A4:0, A5:0] + [B4:2, B5:0]
+* Reshuffle(6:4)   => [6:4, 7:0, 8:0, 9:0, 10:0, 11:0]
+* merge            => [0:0, 1:0, 6:4, 7:0, 8:0, 9:0, 10:0, 11:0]
+*/
+function reshuffleByTimestamp(startIndex, opsA, opsB) {
+	return [...opsA, ...opsB].sort((a, b) => {
+		const timestampDiff = new Date(a.timestampUtcMs).getTime() - new Date(b.timestampUtcMs).getTime();
+		if (timestampDiff !== 0) return timestampDiff;
+		const rank = (op) => STRICT_ORDER_ACTION_TYPES.has(op.action?.type ?? "") ? 0 : 1;
+		const rankDiff = rank(a) - rank(b);
+		if (rankDiff !== 0) return rankDiff;
+		if (rank(a) === 0) {
+			const logicalIndexDiff = a.index - a.skip - (b.index - b.skip);
+			if (logicalIndexDiff !== 0) return logicalIndexDiff;
+		}
+		const actionIdDiff = (a.action?.id ?? "").localeCompare(b.action?.id ?? "");
+		if (actionIdDiff !== 0) return actionIdDiff;
+		return a.id.localeCompare(b.id);
+	}).map((op, i) => ({
+		...op,
+		index: startIndex.index + i,
+		skip: i === 0 ? startIndex.skip : 0
+	}));
+}
+//#endregion
+//#region src/decision/merged-order.ts
+/** Identifies a stream within a walk. */
+function streamKey(query) {
+	return `${query.documentId}:${query.scope}:${query.branch}`;
+}
+/**
+* Orders two operations from different streams by position. Timestamp decides;
+* an equal timestamp puts an auth operation first, and otherwise falls to the
+* action id and then the operation id, so that two replicas holding the same
+* operations agree on the order whatever order they happen to store them in.
+*/
+function comparePositions(a, b) {
+	const aTime = Date.parse(a.operation.timestampUtcMs);
+	const bTime = Date.parse(b.operation.timestampUtcMs);
+	if (aTime !== bTime) return aTime - bTime;
+	if (a.streamKey === b.streamKey) return a.operation.index - b.operation.index;
+	const aAuth = a.scope === "auth";
+	if (aAuth !== (b.scope === "auth")) return aAuth ? -1 : 1;
+	const actionIds = (a.operation.action.id ?? "").localeCompare(b.operation.action.id ?? "");
+	if (actionIds !== 0) return actionIds;
+	return (a.operation.id ?? "").localeCompare(b.operation.id ?? "");
+}
+/**
+* Merges the read-set streams into one sequence by position. An operation's
+* place in the result is the bound a decision at that operation reads to: every
+* operation before it has been applied, and it has not.
+*/
+function mergeByPosition(streams) {
+	const merged = [];
+	for (const stream of streams) for (const operation of stream.operations) merged.push({
+		streamKey: stream.streamKey,
+		scope: stream.scope,
+		operation
+	});
+	return merged.sort(comparePositions);
+}
+/**
+* The skip that retracts everything from `firstRetractedIndex` up to where the
+* re-appended operation lands. It spans the indexes rather than counting the
+* operations, because a stream with a gap in it makes those differ.
+*/
+function retractionSkip(nextIndex, firstRetractedIndex) {
+	return nextIndex - firstRetractedIndex;
+}
+//#endregion
+//#region src/decision/walk.ts
+/**
+* A single forward pass is only correct while a stream's effective operations
+* are ordered.
+*/
+function assertPositionOrder(streamKey, scope, operations) {
+	for (let i = 1; i < operations.length; i++) {
+		const previous = operations[i - 1];
+		const current = operations[i];
+		if (comparePositions({
+			streamKey,
+			scope,
+			operation: previous
+		}, {
+			streamKey,
+			scope,
+			operation: current
+		}) > 0) throw new Error(`Stream ${streamKey} is out of position order: index ${previous.index} at ${previous.timestampUtcMs} precedes index ${current.index} at ${current.timestampUtcMs}`);
+	}
+}
+/**
+* Visits every operation in the read-set once, in the order their positions
+* fall, and hands back the state each stream held just before it. That state is
+* what a decision at that operation reads.
+*
+* Skips are resolved first (i.e. this is performed on a garbage collected
+* stream), which means we can do a single forward pass.
+*
+* An operation that contributes no state, whether denied or holding a reducer
+* error, is visited but not applied (this matches the write cache's rebuild).
+*
+* The consumer sends back whether it refused the operation it was handed: a
+* refusal this pass produced must suppress it the same way a stored one does.
+*/
+function* walkByPosition(streams) {
+	const merged = mergeByPosition(streams.map((stream) => {
+		const operations = garbageCollect(sortOperations([...stream.operations]));
+		assertPositionOrder(stream.streamKey, stream.scope, operations);
+		return {
+			streamKey: stream.streamKey,
+			scope: stream.scope,
+			operations
+		};
+	}));
+	const byKey = new Map(streams.map((stream) => [stream.streamKey, stream]));
+	const states = new Map(streams.map((stream) => [stream.streamKey, stream.document]));
+	for (const { streamKey, operation } of merged) {
+		if ((yield {
+			streamKey,
+			operation,
+			states: new Map(states)
+		}) || operation.error !== void 0 || isDenied(operation)) continue;
+		const stream = byKey.get(streamKey);
+		const before = states.get(streamKey);
+		if (before === void 0 || stream === void 0) throw new Error(`No state for stream ${streamKey}`);
+		states.set(streamKey, stream.apply(before, operation));
+	}
+}
+//#endregion
+//#region src/decision/evaluation.ts
+/** The stream key for evaluated operations whose scope no projection reads. */
+const EVALUATED_ONLY = "evaluated";
+/**
+* Whether any stream the model reads declares this operation's action type as
+* one that can change an evaluation.
+*/
+function isDecidingAction(operation, readSet) {
+	return readSet.some((stream) => stream.decidingActions.includes(operation.action.type));
+}
+/**
+* Who an operation acts as. A replayed operation is evaluated as its own signer,
+* so an address-scoped policy does not deny its own author's history.
+*/
+function subjectOf(operation) {
+	const signer = operation.action.context?.signer;
+	return {
+		address: signer?.user.address,
+		key: signer?.app.key
+	};
+}
+/**
+* The model as the walk reached this operation: each static projection's value
+* is its own scope's state, and each derived projection's value maps document
+* id to that document's state, holding only the streams this replica walked. A
+* derived stream it does not hold stays out of the map, which fails closed.
+*/
+function modelAt(readSet, derivedNames, derived, states) {
+	const model = {};
+	for (const stream of readSet) {
+		const document = states.get(streamKey(stream.query));
+		if (document === void 0) throw new Error(`No state walked for projection ${stream.name}`);
+		model[stream.name] = document.state[stream.query.scope];
+	}
+	for (const name of derivedNames) model[name] = {};
+	for (const entry of derived) {
+		const map = model[entry.name];
+		const document = states.get(streamKey(entry.query));
+		if (document !== void 0) map[entry.query.documentId] = document.state[entry.query.scope];
+	}
+	return model;
+}
+/**
+* Evaluates each operation at its own position and returns the refusals in an
+* array parallel to the operations, where undefined means allowed.
+*
+* A position is a timestamp, so an operation refused by a delete is one that
+* sorts after it, and the operations before it are left alone. That holds
+* whether the delete is already stored or is among the operations passed in.
+*/
+async function evaluateByPosition(model, target, subject, stores, signal) {
+	const { scope, operations } = subject;
+	const { writeCache, operationStore } = stores;
+	const definition = model(target);
+	const readSet = staticReadSet(definition);
+	const derivedSet = derivedReadSet(definition);
+	if (!definition.evaluatesScope(scope)) return operations.map(() => void 0);
+	const evaluating = new Set(operations.map((operation) => operation.id));
+	const creation = operations.find((operation) => operation.action.type === "CREATE_DOCUMENT" && operation.action.input.documentId === target.documentId);
+	async function stateBefore(query) {
+		try {
+			return await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+		} catch (error) {
+			if (creation !== void 0 && query.documentId === target.documentId && error instanceof DocumentNotFoundError && !(error instanceof DocumentPurgedError)) return createDocumentFromAction(creation.action);
+			throw error;
+		}
+	}
+	const readStreams = await Promise.all(readSet.map(async (stream) => ({
+		stream,
+		operations: (await operationStore.getSince(stream.query.documentId, stream.query.scope, stream.query.branch, -1, { actionTypes: stream.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id))
+	})));
+	const decidingOperations = operations.filter((operation) => isDecidingAction(operation, readSet));
+	if (readStreams.every((read) => read.operations.length === 0) && decidingOperations.length === 0) return operations.map(() => void 0);
+	if (readStreams.length === 0) throw new Error(`Decision model for ${target.documentId} reads no stream whose query is known before it is built`);
+	const writtenProjection = readSet.find((stream) => stream.query.scope === scope);
+	const walked = [];
+	const histories = [];
+	for (const read of readStreams) {
+		const streamOperations = read.stream === writtenProjection ? [...read.operations, ...operations] : read.operations;
+		const before = await stateBefore(read.stream.query);
+		walked.push({
+			streamKey: streamKey(read.stream.query),
+			scope: read.stream.query.scope,
+			document: before,
+			operations: streamOperations,
+			apply: read.stream.apply
+		});
+		histories.push({
+			name: read.stream.name,
+			operations: streamOperations
+		});
+	}
+	let evaluatedStateKey;
+	if (writtenProjection !== void 0) evaluatedStateKey = streamKey(writtenProjection.query);
+	else if (definition.foldEvaluatedScope !== void 0) {
+		const query = {
+			documentId: target.documentId,
+			scope,
+			branch: target.branch
+		};
+		const storedOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, void 0, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
+		const before = await stateBefore(query);
+		evaluatedStateKey = streamKey(query);
+		walked.push({
+			streamKey: evaluatedStateKey,
+			scope,
+			document: before,
+			operations: [...storedOperations, ...operations],
+			apply: definition.foldEvaluatedScope
+		});
+	} else walked.push({
+		streamKey: EVALUATED_ONLY,
+		scope,
+		document: walked[0].document,
+		operations,
+		apply: (document) => document
+	});
+	const derivedEntries = [];
+	const walkedKeys = new Set(walked.map((stream) => stream.streamKey));
+	for (const projection of derivedSet) {
+		const queries = projection.queryOverHistory?.(histories) ?? [];
+		for (const query of queries) {
+			const key = streamKey(query);
+			if (walkedKeys.has(key)) continue;
+			let before;
+			try {
+				before = await writeCache.getState(query.documentId, query.scope, query.branch, -1, signal);
+			} catch (error) {
+				if (error instanceof DocumentNotFoundError) continue;
+				throw error;
+			}
+			const streamOperations = (await operationStore.getSince(query.documentId, query.scope, query.branch, -1, { actionTypes: projection.decidingActions }, void 0, signal)).results.filter((operation) => !evaluating.has(operation.id));
+			walkedKeys.add(key);
+			walked.push({
+				streamKey: key,
+				scope: query.scope,
+				document: before,
+				operations: streamOperations,
+				apply: projection.apply
+			});
+			derivedEntries.push({
+				name: projection.name,
+				query
+			});
+		}
+	}
+	const reasons = /* @__PURE__ */ new Map();
+	const walk = walkByPosition(walked);
+	let step = walk.next(false);
+	while (!step.done) {
+		const position = step.value;
+		if (!evaluating.has(position.operation.id)) {
+			step = walk.next(false);
+			continue;
+		}
+		const evaluatedDocument = evaluatedStateKey === void 0 ? void 0 : position.states.get(evaluatedStateKey);
+		const scopeState = evaluatedDocument === void 0 ? void 0 : evaluatedDocument.state[scope];
+		const evaluation = definition.decide(modelAt(readSet, derivedSet.map((projection) => projection.name), derivedEntries, position.states), subjectOf(position.operation), {
+			verb: "execute",
+			scope: position.operation.action.scope,
+			operation: position.operation.action.type
+		}, {
+			scopeState,
+			actionInput: position.operation.action.input
+		});
+		const denied = evaluation.decision === "deny";
+		reasons.set(position.operation.id, denied ? evaluation.reason : void 0);
+		step = walk.next(denied);
+	}
+	return operations.map((operation) => reasons.get(operation.id));
+}
+//#endregion
+//#region src/executor/document-action-handler.ts
+var DocumentActionHandler = class {
+	registry;
+	logger;
+	driveContainerTypes;
+	featureFlags;
+	decisionModel;
+	protocolSupport;
+	loggedUnregisteredProtocols = /* @__PURE__ */ new Set();
+	constructor(registry, logger, driveContainerTypes, featureFlags, decisionModel, protocolSupport) {
+		this.registry = registry;
+		this.logger = logger;
+		this.driveContainerTypes = driveContainerTypes;
+		this.featureFlags = featureFlags;
+		this.decisionModel = decisionModel;
+		this.protocolSupport = protocolSupport;
+	}
+	/** Keys this reactor does not register are admitted: it cannot judge them. */
+	unsupportedProtocol(documentId, protocolVersions) {
+		for (const [protocol, version] of Object.entries(protocolVersions ?? {})) {
+			const supported = this.protocolSupport[protocol];
+			if (supported === void 0) {
+				if (!this.loggedUnregisteredProtocols.has(protocol)) {
+					this.loggedUnregisteredProtocols.add(protocol);
+					this.logger.info("Admitting document @documentId with unregistered protocol @protocol @version", documentId, protocol, version);
+				}
+				continue;
+			}
+			if (!supported.includes(version)) return new UnsupportedProtocolVersionError(documentId, protocol, version);
+		}
+	}
+	/** Whether the write arrives with its evaluation already decided. */
+	alreadyEvaluated(executing) {
+		return this.featureFlags.documentDecisions && (executing.replayingAcceptedHistory || executing.evaluatedByPosition);
+	}
+	async execute(write, executing) {
+		const { action } = write;
+		if (write.deniedReason !== void 0) return this.writeDenied(write, executing);
+		const refusal = await this.refuseIfPolicyDenies(write, executing);
+		if (refusal) return refusal;
+		switch (action.type) {
+			case "CREATE_DOCUMENT": return this.executeCreate(write, executing);
+			case "DELETE_DOCUMENT": return this.executeDelete(write, executing);
+			case "UPGRADE_DOCUMENT": return this.executeUpgrade(write, executing);
+			case "ADD_RELATIONSHIP": return this.executeAddRelationship(write, executing);
+			case "REMOVE_RELATIONSHIP": return this.executeRemoveRelationship(write, executing);
+			case "UPDATE_RELATIONSHIP": return this.executeUpdateRelationship(write, executing);
+			case "PURGE_DOCUMENT": return buildErrorResult(executing.job, new ReservedActionError(executing.job.documentId, action.type), executing.startTime);
+			default: return buildErrorResult(executing.job, /* @__PURE__ */ new Error(`Unknown document action type: ${action.type}`), executing.startTime);
+		}
+	}
+	/**
+	* Refuses a document-scope write the policy denies, or undefined to proceed.
+	* Without this an `execute`-on-`document` grant is unenforceable.
+	*/
+	async refuseIfPolicyDenies(write, executing) {
+		const { action } = write;
+		const { job, startTime, stores, signal } = executing;
+		if (!this.featureFlags.documentDecisions || !this.featureFlags.authEnforcement || this.alreadyEvaluated(executing) || !GATED_DOCUMENT_ACTIONS.has(action.type)) return;
+		const documentId = targetDocumentId(action, job.documentId);
+		let admission;
+		try {
+			admission = await decideAtHead(this.decisionModel, stores.writeCache, {
+				documentId,
+				branch: job.branch
+			}, {
+				address: action.context?.signer?.user.address,
+				key: action.context?.signer?.app.key
+			}, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}, signal, this.featureFlags.authConditions ? { actionInput: action.input } : void 0);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		if (admission.evaluation.decision === "allow") return;
+		return buildErrorResult(job, refusalError(admission.evaluation.reason, documentId, admission.deletedAtUtcIso, action), startTime);
+	}
+	/** A refused operation holds a position in the stream but changes nothing. */
+	async writeDenied(write, executing) {
+		const { action, skip, sourceRemote, deniedReason } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		let document;
+		try {
+			document = await stores.writeCache.getState(job.documentId, job.scope, job.branch, void 0, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		const index = getNextIndexForScope(document, job.scope);
+		let standing = document;
+		if (skip > 0) try {
+			standing = await stores.writeCache.getState(job.documentId, job.scope, job.branch, index - skip - 1, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		let operation = createOperation(action, index, skip, {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		});
+		operation.deniedReason = deniedReason;
+		operation.hash = hashDocumentStateForScope(standing, job.scope);
+		const writeResult = await this.writeOperationToStore({
+			documentId: job.documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
+		if (!Array.isArray(writeResult)) return writeResult;
+		operation = writeResult[0];
+		updateDocumentRevision(standing, job.scope, operation.index);
+		standing.operations = {
+			...standing.operations,
+			[job.scope]: [...standing.operations[job.scope] ?? [], operation]
+		};
+		executing.touchedStreams.add(job.documentId, job.scope, job.branch);
+		stores.writeCache.putState(job.documentId, job.scope, job.branch, operation.index, standing, "head");
+		indexTxn.write([{
+			...operation,
+			documentId: job.documentId,
+			documentType: document.header.documentType,
+			branch: job.branch,
+			scope: job.scope,
+			sourceRemote
+		}]);
+		stores.documentMetaCache.putDocumentMeta(job.documentId, job.branch, {
+			state: standing.state.document,
+			documentType: standing.header.documentType,
+			protocolVersions: standing.header.protocolVersions,
+			documentScopeRevision: operation.index + 1
+		});
+		return buildSuccessResult(job, operation, job.documentId, standing.header.documentType, JSON.stringify({
+			header: standing.header,
+			document: standing.state.document
+		}), startTime);
+	}
+	async executeCreate(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		if (job.scope !== "document") return {
+			job,
+			success: false,
+			error: /* @__PURE__ */ new Error(`CREATE_DOCUMENT must be in "document" scope, got "${job.scope}"`),
+			duration: Date.now() - startTime
+		};
+		const input = action.input;
+		const unsupported = this.unsupportedProtocol(input.documentId, input.protocolVersions);
+		if (unsupported) return buildErrorResult(job, unsupported, startTime);
+		const document = createDocumentFromAction(action);
+		let operation = createOperation(action, 0, skip, {
+			documentId: document.header.id,
+			scope: job.scope,
+			branch: job.branch
+		});
+		const resultingStateObj = {
+			...document.state,
+			header: document.header
+		};
+		const resultingState = JSON.stringify(resultingStateObj);
+		const writeResult = await this.writeOperationToStore({
+			documentId: document.header.id,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
+		if (!Array.isArray(writeResult)) return writeResult;
+		operation = writeResult[0];
+		updateDocumentRevision(document, job.scope, operation.index);
+		document.operations = {
+			...document.operations,
+			[job.scope]: [...document.operations[job.scope] ?? [], operation]
+		};
+		executing.touchedStreams.add(document.header.id, job.scope, job.branch);
+		stores.writeCache.putState(document.header.id, job.scope, job.branch, operation.index, document, "head");
+		indexTxn.write([{
+			...operation,
+			documentId: document.header.id,
+			documentType: document.header.documentType,
+			branch: job.branch,
+			scope: job.scope,
+			sourceRemote
+		}]);
+		if (this.driveContainerTypes.has(document.header.documentType)) {
+			const collectionId = DriveCollectionId.forDrive(document.header.id, job.branch).key;
+			indexTxn.createCollection(collectionId);
+			indexTxn.addToCollection(collectionId, document.header.id);
+		}
+		stores.documentMetaCache.putDocumentMeta(document.header.id, job.branch, {
+			state: document.state.document,
+			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
+			documentScopeRevision: 1
+		});
+		return buildSuccessResult(job, operation, document.header.id, document.header.documentType, resultingState, startTime);
+	}
+	async executeDelete(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		const input = action.input;
+		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("DELETE_DOCUMENT action requires a documentId in input"), startTime);
+		const documentId = input.documentId;
+		let document;
+		try {
+			document = await stores.writeCache.getState(documentId, job.scope, job.branch, void 0, signal);
+		} catch (error) {
+			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document before deletion: ${error instanceof Error ? error.message : String(error)}`), startTime);
+		}
+		const documentState = document.state.document;
+		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		const nextIndex = getNextIndexForScope(document, job.scope);
+		let operation = createOperation(action, nextIndex, skip, {
+			documentId,
+			scope: job.scope,
+			branch: job.branch
+		});
+		applyDeleteDocumentAction$1(document, action);
+		const resultingStateObj = {
+			header: document.header,
+			document: document.state.document
+		};
+		const resultingState = JSON.stringify(resultingStateObj);
+		const writeResult = await this.writeOperationToStore({
+			documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
+		if (!Array.isArray(writeResult)) return writeResult;
+		operation = writeResult[0];
+		updateDocumentRevision(document, job.scope, operation.index);
+		document.operations = {
+			...document.operations,
+			[job.scope]: [...document.operations[job.scope] ?? [], operation]
+		};
+		executing.touchedStreams.add(documentId, job.scope, job.branch);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
+		indexTxn.write([{
+			...operation,
+			documentId,
+			documentType: document.header.documentType,
+			branch: job.branch,
+			scope: job.scope,
+			sourceRemote
+		}]);
+		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
+			state: document.state.document,
+			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
+			documentScopeRevision: operation.index + 1
+		});
+		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
+	}
+	async executeUpgrade(write, executing) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		const input = action.input;
+		if (!input.documentId) return buildErrorResult(job, /* @__PURE__ */ new Error("UPGRADE_DOCUMENT action requires a documentId in input"), startTime);
+		const documentId = input.documentId;
+		const fromVersion = input.fromVersion;
+		const toVersion = input.toVersion;
+		let document;
+		try {
+			document = await stores.writeCache.getState(documentId, job.scope, job.branch, void 0, signal);
+		} catch (error) {
+			return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch document for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
+		}
+		const documentState = document.state.document;
+		if (documentState.isDeleted && !this.alreadyEvaluated(executing)) return buildErrorResult(job, new DocumentDeletedError(documentId, documentState.deletedAtUtcIso), startTime);
+		if (fromVersion === toVersion && fromVersion > 0) return {
+			job,
+			success: true,
+			operations: [],
+			operationsWithContext: [],
+			duration: Date.now() - startTime
+		};
+		const arrivesDecided = executing.replayingAcceptedHistory || executing.evaluatedByPosition;
+		if (fromVersion > 0 && !arrivesDecided) {
+			const stampedVersion = normalizeDocumentModelVersion(documentState.version);
+			if (fromVersion !== stampedVersion) return buildErrorResult(job, new UpgradePreconditionFailedError(documentId, `fromVersion ${fromVersion} does not match the document's version ${stampedVersion}`), startTime);
+			if (input.revision !== void 0) {
+				let actualRevisions;
+				try {
+					actualRevisions = (await stores.operationStore.getRevisions(documentId, job.branch, signal)).revision;
+				} catch (error) {
+					return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch revisions for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
+				}
+				const revisionScopes = /* @__PURE__ */ new Set([...Object.keys(input.revision), ...Object.keys(actualRevisions)]);
+				for (const revisionScope of revisionScopes) {
+					const snapshot = input.revision[revisionScope] ?? 0;
+					const actual = actualRevisions[revisionScope] ?? 0;
+					if (snapshot !== actual) return buildErrorResult(job, new UpgradePreconditionFailedError(documentId, `revision snapshot for scope "${revisionScope}" is ${snapshot} but the document is at ${actual}`), startTime);
+				}
+			}
+		}
+		let upgradePath;
+		if (fromVersion > 0 && fromVersion < toVersion) try {
+			upgradePath = this.registry.computeUpgradePath(document.header.documentType, fromVersion, toVersion);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		const otherScopes = Object.keys(document.state).filter((scope) => scope !== job.scope);
+		if (fromVersion > 0) for (const scope of otherScopes) {
+			let scopedDocument;
+			try {
+				scopedDocument = await stores.writeCache.getState(documentId, scope, job.branch, void 0, signal);
+			} catch (error) {
+				return buildErrorResult(job, /* @__PURE__ */ new Error(`Failed to fetch ${scope} scope for upgrade: ${error instanceof Error ? error.message : String(error)}`), startTime);
+			}
+			document = {
+				...document,
+				state: {
+					...document.state,
+					[scope]: scopedDocument.state[scope]
+				}
+			};
+		}
+		const nextIndex = getNextIndexForScope(document, job.scope);
+		try {
+			document = applyUpgradeDocumentAction$1(document, action, upgradePath);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		let operation = createOperation(action, nextIndex, skip, {
+			documentId,
+			scope: job.scope,
+			branch: job.branch
+		});
+		const resultingStateObj = {
+			...document.state,
+			header: document.header
+		};
+		if (fromVersion > 0) resultingStateObj.__migrated = true;
+		const resultingState = JSON.stringify(resultingStateObj);
+		const writeResult = await this.writeOperationToStore({
+			documentId,
+			documentType: document.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
+		if (!Array.isArray(writeResult)) return writeResult;
+		operation = writeResult[0];
+		updateDocumentRevision(document, job.scope, operation.index);
+		document.operations = {
+			...document.operations,
+			[job.scope]: [...document.operations[job.scope] ?? [], operation]
+		};
+		executing.touchedStreams.add(documentId, job.scope, job.branch);
+		stores.writeCache.putState(documentId, job.scope, job.branch, operation.index, document, "head");
+		for (const scope of otherScopes) executing.postCommitInvalidations.push({
+			documentId,
+			scope,
+			branch: job.branch
+		});
+		indexTxn.write([{
+			...operation,
+			documentId,
+			documentType: document.header.documentType,
+			branch: job.branch,
+			scope: job.scope,
+			sourceRemote
+		}]);
+		stores.documentMetaCache.putDocumentMeta(documentId, job.branch, {
+			state: document.state.document,
+			documentType: document.header.documentType,
+			protocolVersions: document.header.protocolVersions,
+			documentScopeRevision: operation.index + 1
+		});
+		return buildSuccessResult(job, operation, documentId, document.header.documentType, resultingState, startTime);
+	}
+	/** A submitted write naming a purged target was refused at job start. */
+	async isTargetPurged(write, executing) {
+		const target = relationshipTarget(write.action);
+		if (target === void 0 || !executing.purgeFence) return false;
+		return executing.purgeFence.isPurged(target);
+	}
+	async executeAddRelationship(write, executing) {
+		let targetPurged;
+		try {
+			targetPurged = await this.isTargetPurged(write, executing);
+		} catch (error) {
+			return buildErrorResult(executing.job, error instanceof Error ? error : new Error(String(error)), executing.startTime);
+		}
+		return this.withRelationshipAction("ADD_RELATIONSHIP", write, executing, (input) => input.sourceId === input.targetId ? /* @__PURE__ */ new Error("ADD_RELATIONSHIP: sourceId and targetId cannot be the same (self-relationships not allowed)") : null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
+			if (!targetPurged && this.driveContainerTypes.has(sourceDoc.header.documentType)) {
+				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
+				txn.addToCollection(collectionId, input.targetId);
+				s.collectionMembershipCache.invalidate(input.targetId);
+			}
+		});
+	}
+	async executeRemoveRelationship(write, executing) {
+		let targetPurged;
+		try {
+			targetPurged = await this.isTargetPurged(write, executing);
+		} catch (error) {
+			return buildErrorResult(executing.job, error instanceof Error ? error : new Error(String(error)), executing.startTime);
+		}
+		return this.withRelationshipAction("REMOVE_RELATIONSHIP", write, executing, null, ({ indexTxn: txn, stores: s, sourceDoc, input, job: j }) => {
+			if (!targetPurged && this.driveContainerTypes.has(sourceDoc.header.documentType)) {
+				const collectionId = DriveCollectionId.forDrive(input.sourceId, j.branch).key;
+				txn.removeFromCollection(collectionId, input.targetId);
+				s.collectionMembershipCache.invalidate(input.targetId);
+			}
+		});
+	}
+	executeUpdateRelationship(write, executing) {
+		return this.withRelationshipAction("UPDATE_RELATIONSHIP", write, executing, null, null);
+	}
+	async withRelationshipAction(actionTypeName, write, executing, preValidate, postWrite) {
+		const { action, skip, sourceRemote } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		if (job.scope !== "document") return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName} must be in "document" scope, got "${job.scope}"`), startTime);
+		const input = action.input;
+		if (!input.sourceId || !input.targetId || !input.relationshipType) return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName} action requires sourceId, targetId, and relationshipType in input`), startTime);
+		if (preValidate !== null) {
+			const validationError = preValidate(input);
+			if (validationError !== null) return buildErrorResult(job, validationError, startTime);
+		}
+		let sourceDoc;
+		try {
+			sourceDoc = await stores.writeCache.getState(input.sourceId, "document", job.branch, void 0, signal);
+		} catch (error) {
+			if (DocumentPurgedError.isError(error)) return buildErrorResult(job, error, startTime);
+			if (DocumentNotFoundError.isError(error)) return buildErrorResult(job, new DocumentNotFoundError(input.sourceId, `${actionTypeName}: source document ${input.sourceId} not found`), startTime);
+			return buildErrorResult(job, /* @__PURE__ */ new Error(`${actionTypeName}: source document ${input.sourceId} not found: ${error instanceof Error ? error.message : String(error)}`), startTime);
+		}
+		const nextIndex = getNextIndexForScope(sourceDoc, job.scope);
+		let operation = createOperation(action, nextIndex, skip, {
+			documentId: input.sourceId,
+			scope: job.scope,
+			branch: job.branch
+		});
+		const writeResult = await this.writeOperationToStore({
+			documentId: input.sourceId,
+			documentType: sourceDoc.header.documentType,
+			scope: job.scope,
+			branch: job.branch
+		}, operation, executing);
+		if (!Array.isArray(writeResult)) return writeResult;
+		operation = writeResult[0];
+		sourceDoc.header.lastModifiedAtUtcIso = operation.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString();
+		updateDocumentRevision(sourceDoc, job.scope, operation.index);
+		sourceDoc.operations = {
+			...sourceDoc.operations,
+			[job.scope]: [...sourceDoc.operations[job.scope] ?? [], operation]
+		};
+		const scopeState = sourceDoc.state[job.scope];
+		const resultingStateObj = {
+			header: structuredClone(sourceDoc.header),
+			[job.scope]: scopeState === void 0 ? {} : structuredClone(scopeState)
+		};
+		const resultingState = JSON.stringify(resultingStateObj);
+		executing.touchedStreams.add(input.sourceId, job.scope, job.branch);
+		executing.touchedStreams.add(input.targetId, job.scope, job.branch);
+		stores.writeCache.putState(input.sourceId, job.scope, job.branch, operation.index, sourceDoc, "head");
+		indexTxn.write([{
+			...operation,
+			documentId: input.sourceId,
+			documentType: sourceDoc.header.documentType,
+			branch: job.branch,
+			scope: job.scope,
+			sourceRemote
+		}]);
+		if (postWrite !== null) postWrite({
+			indexTxn,
+			stores,
+			sourceDoc,
+			input,
+			job
+		});
+		stores.documentMetaCache.putDocumentMeta(input.sourceId, job.branch, {
+			state: sourceDoc.state.document,
+			documentType: sourceDoc.header.documentType,
+			protocolVersions: sourceDoc.header.protocolVersions,
+			documentScopeRevision: operation.index + 1
+		});
+		return buildSuccessResult(job, operation, input.sourceId, sourceDoc.header.documentType, resultingState, startTime);
+	}
+	async writeOperationToStore(target, operation, executing) {
+		const { documentId, documentType, scope, branch } = target;
+		const { job, startTime, stores, signal } = executing;
+		executing.touchedStreams.add(documentId, scope, branch);
+		let storedOperations;
+		try {
+			storedOperations = await stores.operationStore.apply(documentId, documentType, scope, branch, operation.index, (txn) => {
+				txn.addOperations(operation);
+			}, signal);
+		} catch (error) {
+			this.logger.error("Failed to write operation to IOperationStore (@documentId @scope @branch): @Operation @Error", documentId, scope, branch, operation, error);
+			stores.writeCache.invalidate(documentId, scope, branch);
+			if (AppendConditionFailedError.isError(error)) for (const stream of error.condition.streams) stores.writeCache.invalidate(stream.documentId, stream.scope, stream.branch);
+			return {
+				job,
+				success: false,
+				error: error instanceof Error ? error : /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${String(error)}`),
+				duration: Date.now() - startTime
+			};
+		}
+		return storedOperations;
+	}
+};
+//#endregion
+//#region src/signer/passthrough-signer.ts
+/**
+* A no-op signer that returns empty values for all methods.
+* Used when signing is not required.
+*/
+var PassthroughSigner = class {
+	publicKey = {};
+	sign() {
+		return Promise.resolve(/* @__PURE__ */ new Uint8Array(0));
+	}
+	verify() {
+		return Promise.resolve();
+	}
+	signAction() {
+		return Promise.resolve([
+			"",
+			"",
+			"",
+			"",
+			""
+		]);
+	}
+};
+//#endregion
+//#region src/signer/trust-policy.ts
+/**
+* The policy admission asks: the reactor's own key signing as its own user is
+* accepted, then the host's policy decides, else the default does. `own` is
+* read on every ask, since its user changes on login.
+*/
+function admissionTrustPolicy(own, authEnforcement, policy) {
+	return { authorizeSigner(signer, key, documentId) {
+		const identity = actionSignerIdentity(own);
+		if (identity.app.key !== "" && key === identity.app.key) {
+			if (sameUser(actionSignerIdentity(signer).user, identity.user)) return Promise.resolve(true);
+		}
+		if (policy) return policy.authorizeSigner(signer, key, documentId);
+		return Promise.resolve(!authEnforcement);
+	} };
+}
+function sameUser(a, b) {
+	return a.address.toLowerCase() === b.address.toLowerCase() && a.networkId === b.networkId && a.chainId === b.chainId;
+}
+//#endregion
+//#region src/signer/did-key.ts
+const DID_KEY_PREFIX = "did:key:z";
+const P256_MULTICODEC = [128, 36];
+const MAX_CACHED_KEYS = 1024;
+const P = BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff");
+const A = BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc");
+const B = BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b");
+/** A did:key that is not a compressed P-256 public key. */
+var MalformedDidKeyError = class extends Error {
+	constructor(did, detail) {
+		super(`Malformed did:key ${did}: ${detail}`);
+		this.name = "MalformedDidKeyError";
+	}
+};
+const keyCache = /* @__PURE__ */ new Map();
+/** Cached per process: decompressing the point costs a BigInt modPow. */
+async function importDidKey(did) {
+	const cached = keyCache.get(did);
+	if (cached) {
+		keyCache.delete(did);
+		keyCache.set(did, cached);
+		return cached;
+	}
+	const raw = decompressP256(compressedPointFromDid(did), did);
+	const key = await crypto.subtle.importKey("raw", raw.buffer, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	keyCache.set(did, key);
+	if (keyCache.size > MAX_CACHED_KEYS) {
+		const oldest = keyCache.keys().next().value;
+		if (oldest !== void 0) keyCache.delete(oldest);
+	}
+	return key;
+}
+function compressedPointFromDid(did) {
+	if (!did.startsWith(DID_KEY_PREFIX)) throw new MalformedDidKeyError(did, "not a base58btc did:key");
+	const decoded = base58Decode(did.slice(9));
+	if (!decoded || decoded.length !== 35) throw new MalformedDidKeyError(did, "not a compressed P-256 key");
+	if (decoded[0] !== P256_MULTICODEC[0] || decoded[1] !== P256_MULTICODEC[1]) throw new MalformedDidKeyError(did, "not a P-256 multicodec");
+	return decoded.subarray(2);
+}
+function decompressP256(compressed, did) {
+	const prefix = compressed[0];
+	if (prefix !== 2 && prefix !== 3) throw new MalformedDidKeyError(did, `compression prefix ${prefix}`);
+	let x = BigInt(0);
+	for (let i = 1; i < compressed.length; i++) x = x << BigInt(8) | BigInt(compressed[i]);
+	if (x >= P) throw new MalformedDidKeyError(did, "x outside the field");
+	const ySquared = (modPow(x, BigInt(3), P) + A * x + B) % P;
+	let y = modPow(ySquared, (P + BigInt(1)) / BigInt(4), P);
+	if (y * y % P !== ySquared) throw new MalformedDidKeyError(did, "x is not on the curve");
+	if (y % BigInt(2) === BigInt(0) !== (prefix === 2)) y = P - y;
+	const uncompressed = /* @__PURE__ */ new Uint8Array(65);
+	uncompressed[0] = 4;
+	uncompressed.set(bigIntToBytes(x), 1);
+	uncompressed.set(bigIntToBytes(y), 33);
+	return uncompressed;
+}
+function modPow(base, exp, mod) {
+	let result = BigInt(1);
+	let b = base % mod;
+	let e = exp;
+	while (e > BigInt(0)) {
+		if (e & BigInt(1)) result = result * b % mod;
+		e >>= BigInt(1);
+		b = b * b % mod;
+	}
+	return result;
+}
+function bigIntToBytes(value) {
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	let v = value;
+	for (let i = 31; i >= 0; i--) {
+		bytes[i] = Number(v & BigInt(255));
+		v >>= BigInt(8);
+	}
+	return bytes;
+}
+//#endregion
+//#region src/signer/verify-action-signature.ts
+const RENOWN_HASH_LENGTH = 44;
+const SHARED_HASH_LENGTH = 28;
+const HEX_SIGNATURE = /^(0x)?([0-9a-fA-F]{2})+$/;
+/**
+* Integrity only: identity binding and the live-id check sit with the caller.
+* `operation` is the incoming operation at load admission.
+*/
+async function verifyActionSignature(action, target, path, operation) {
+	const policy = target.policy ?? "legacy";
+	const refusal = policyRefusal(action, policy);
+	if (refusal) return refusal;
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return policy === "v2-required" ? refuse("unsigned", "UNSIGNED_REQUIRED", `action ${action.id} is unsigned but ${target.documentId} requires v2 signatures`) : {
+		ok: true,
+		scheme: "unsigned"
+	};
+	if (shape.kind === "malformed") return refuse("legacy-unknown", "MALFORMED_TUPLE", `action ${action.id} ${shape.reason}`);
+	const { signer, tuple } = shape;
+	const scheme = schemeOf(tuple[2]);
+	if (tuple[1] !== signer.app.key) return refuse(scheme, "KEY_MISMATCH", `action ${action.id} tuple key does not match signer.app.key`);
+	if (scheme !== "v2" && policy === "v2-required") return refuse(scheme, "SCHEME_BELOW_POLICY", `action ${action.id} carries a legacy tuple but ${target.documentId} requires v2 signatures`);
+	if (scheme === "legacy-unknown" && path === "mutation") return refuse(scheme, "MALFORMED_TUPLE", `action ${action.id} carries a hash of unknown length ${tuple[2].length}`);
+	if (scheme === "v2") {
+		const refusal = await checkV2(action, tuple, target, operation);
+		if (refusal) return refusal;
+	} else if (path === "mutation") {
+		if (await legacyHash(scheme, action, target) !== tuple[2]) return refuse(scheme, "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+	}
+	return verifyEcdsa(tuple, scheme, action.id);
+}
+/** Refusals a document's policy makes before any tuple is read. */
+function policyRefusal(action, policy) {
+	if (action.type !== "CREATE_DOCUMENT") return;
+	const scheme = schemeOfAction(action);
+	const input = action.input;
+	const documentId = input?.documentId ?? "";
+	if (policy === "legacy") return isDerivedDocumentId(documentId) ? refuse(scheme, "ID_MISMATCH", `action ${action.id}: a legacy document cannot take the content-addressed id ${documentId}`) : void 0;
+	const expected = derivedCreateId(input);
+	if (expected === documentId) return;
+	return refuse(scheme, "ID_MISMATCH", expected === void 0 ? `action ${action.id} creates v2-required ${documentId} without the header params its id is derived from` : `action ${action.id} creates v2-required ${documentId}, but its header params derive ${expected}`);
+}
+function derivedCreateId(input) {
+	if (!input?.signing || !input.protocolVersions) return;
+	try {
+		return deriveDocumentId({
+			documentType: input.model,
+			createdAtUtcIso: input.signing.createdAtUtcIso,
+			nonce: input.signing.nonce,
+			protocolVersions: input.protocolVersions
+		});
+	} catch {
+		return;
+	}
+}
+function schemeOfAction(action) {
+	const shape = signerShape(action.context?.signer);
+	if (shape.kind === "unsigned") return "unsigned";
+	return shape.kind === "signed" ? schemeOf(shape.tuple[2]) : "legacy-unknown";
+}
+/** Peers send arbitrary JSON, so nothing past `context` is assumed. */
+function signerShape(value) {
+	if (value === void 0 || value === null) return { kind: "unsigned" };
+	if (!isRecord(value)) return {
+		kind: "malformed",
+		reason: "has a signer that is not an object"
+	};
+	const { app, user, signatures } = value;
+	if (app !== void 0 && app !== null && !isRecord(app)) return {
+		kind: "malformed",
+		reason: "has a signer.app that is not an object"
+	};
+	const key = isRecord(app) ? app.key : void 0;
+	if (key !== void 0 && key !== null && typeof key !== "string") return {
+		kind: "malformed",
+		reason: "has a signer.app.key that is not a string"
+	};
+	if (!key) return { kind: "unsigned" };
+	if (!isRecord(user) || typeof user.address !== "string") return {
+		kind: "malformed",
+		reason: "has a signer without a user address"
+	};
+	if (!Array.isArray(signatures)) return {
+		kind: "malformed",
+		reason: "has a signer whose signatures are not a list"
+	};
+	const tuple = signatures.at(-1);
+	if (!isTuple(tuple)) return {
+		kind: "malformed",
+		reason: signatures.length === 0 ? "has a signer but no signatures" : "carries a malformed signature tuple"
+	};
+	return {
+		kind: "signed",
+		signer: value,
+		tuple
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function checkV2(action, tuple, target, operation) {
+	const problem = v2TupleProblem(tuple);
+	if (problem) return refuse("v2", "MALFORMED_TUPLE", `action ${action.id}: ${problem}`);
+	if (operation && !sameInstant(operation.timestampUtcMs, action.timestampUtcMs)) return refuse("v2", "TIMESTAMP_MISMATCH", `action ${action.id} is stamped ${action.timestampUtcMs} but its operation ${operation.timestampUtcMs}`);
+	let expected;
+	try {
+		expected = await hashActionV2(action, target, action.context.signer);
+	} catch (error) {
+		return refuse("v2", "HASH_MISMATCH", `action ${action.id} has no v2 hash: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (expected !== tuple[2]) return refuse("v2", "HASH_MISMATCH", `action ${action.id} does not match the hash its signature covers`);
+}
+function sameInstant(a, b) {
+	const left = Date.parse(a);
+	return !Number.isNaN(left) && left === Date.parse(b);
+}
+function schemeOf(hash) {
+	if (isV2ActionHash(hash)) return "v2";
+	if (hash.length === RENOWN_HASH_LENGTH) return "legacy-renown";
+	if (hash.length === SHARED_HASH_LENGTH) return "legacy-shared";
+	return "legacy-unknown";
+}
+async function legacyHash(scheme, action, target) {
+	if (scheme === "legacy-renown") {
+		const payload = [
+			action.scope,
+			action.type,
+			JSON.stringify(action.input)
+		].join("");
+		const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(payload));
+		return bytesToBase64(new Uint8Array(digest));
+	}
+	const signer = action.context.signer;
+	return buildOperationSignatureParams({
+		documentId: target.documentId,
+		signer,
+		action,
+		previousStateHash: ""
+	})[2];
+}
+async function verifyEcdsa(tuple, scheme, actionId) {
+	const [timestamp, key, hash, prevStateHash, signatureHex] = tuple;
+	if (!HEX_SIGNATURE.test(signatureHex)) return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId} signature is not hex`);
+	let cryptoKey;
+	try {
+		cryptoKey = await importDidKey(key);
+	} catch (error) {
+		return refuse(scheme, "MALFORMED_TUPLE", `action ${actionId}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const message = buildOperationSignatureMessage([
+		timestamp,
+		key,
+		hash,
+		prevStateHash
+	]);
+	let valid;
+	try {
+		valid = await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, cryptoKey, hexToBytes(signatureHex).buffer, message.buffer);
+	} catch {
+		valid = false;
+	}
+	if (!valid) return refuse(scheme, "BAD_SIGNATURE", `action ${actionId} signature does not verify under its key`);
+	return {
+		ok: true,
+		scheme
+	};
+}
+function isTuple(value) {
+	return Array.isArray(value) && value.length === 5 && value.every((element) => typeof element === "string");
+}
+function refuse(scheme, code, reason) {
+	return {
+		ok: false,
+		scheme,
+		code,
+		reason
+	};
+}
+function hexToBytes(hex) {
+	const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+	const bytes = new Uint8Array(clean.length / 2);
+	for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
+	return bytes;
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+}
+//#endregion
+//#region src/executor/synthesized-signing.ts
+/** Submitted types whose stored action the reducer writes in their place. */
+const SYNTHESIZING_TYPES = /* @__PURE__ */ new Set(["UNDO", "REDO"]);
+/**
+* The id of the action synthesized from `submittedId`. Derived, so the stored
+* operation answers for the submitted id at the live-id check.
+*/
+function synthesizedActionId(submittedId) {
+	return hashBrowser(`synthesized:${submittedId}`, "sha1", "hex").slice(0, 32);
+}
+/**
+* Whether `operation` stores an action the reducer made from `submitted`
+* rather than `submitted` itself or an operation already in `history`.
+*/
+function isSynthesized(submitted, operation, history) {
+	if (!SYNTHESIZING_TYPES.has(submitted.type)) return false;
+	const id = operation.action.id;
+	if (!id) return true;
+	if (id === submitted.id) return false;
+	return !history.some((existing) => existing.action.id === id);
+}
+/**
+* Signs the synthesized action of `operation` in place as `signer`, under the
+* id {@link synthesizedActionId} derives from the submitted one. A REDO's
+* rebuilt action has no timestamp, so it takes the submitted one; the
+* operation timestamp is set to the action's, which a peer requires of a v2
+* tuple.
+*/
+async function signSynthesized(operation, submitted, target, signer, signal) {
+	const synthesized = operation.action;
+	const id = synthesizedActionId(submitted.id);
+	const timestampUtcMs = operation.timestampUtcMs || synthesized.timestampUtcMs || submitted.timestampUtcMs;
+	const action = {
+		id,
+		timestampUtcMs,
+		type: synthesized.type,
+		input: synthesized.input,
+		scope: synthesized.scope
+	};
+	const signature = await signer.signAction(action, {
+		documentId: target.documentId,
+		branch: target.branch
+	}, signal);
+	operation.action = {
+		...action,
+		context: { signer: {
+			...actionSignerIdentity(signer),
+			signatures: [signature]
+		} }
+	};
+	operation.id = deriveOperationId(target.documentId, target.scope, target.branch, id);
+	operation.timestampUtcMs = timestampUtcMs;
+}
+//#endregion
+//#region src/executor/signature-admission.ts
+const DEFAULT_TRUST_TIMEOUT_MS = 1e4;
+/** Runs once per write, when this reactor first stores it; never on re-appends. */
+var SignatureAdmission = class {
+	mode;
+	logger;
+	eventBus;
+	policySource;
+	trustPolicy;
+	trustTimeoutMs;
+	constructor(mode, logger, eventBus, policySource = "meta", trust = {
+		authEnforcement: false,
+		timeoutMs: DEFAULT_TRUST_TIMEOUT_MS
+	}) {
+		this.mode = mode;
+		this.logger = logger;
+		this.eventBus = eventBus;
+		this.policySource = policySource;
+		this.trustPolicy = admissionTrustPolicy(trust.signer ?? new PassthroughSigner(), trust.authEnforcement, trust.policy);
+		this.trustTimeoutMs = trust.timeoutMs;
+	}
+	/** The first refusal of a mutation's submitted actions, when enforcing. */
+	async admitMutation(job, stores, signal) {
+		const { operationStore } = stores;
+		const candidates = job.actions.map((action) => candidate(action, mutationStream(action, job)));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const committed = await this.storedAsSubmitted(candidates, live, isRetry(job), operationStore, signal);
+		await resolvePolicies(candidates, job.actions, (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const submitted = /* @__PURE__ */ new Set();
+		for (const entry of candidates) {
+			if (committed.has(entry)) continue;
+			const verdict = await this.verdict(entry, live, submitted, "mutation", signal);
+			submitted.add(entry.opId);
+			if (verdict.ok) continue;
+			const refusal = this.record(job, entry, verdict, "mutation");
+			if (refusal) return {
+				kind: "refused",
+				error: refusal
+			};
+		}
+		return {
+			kind: "admitted",
+			committed: [...committed.values()]
+		};
+	}
+	/** The incoming operations a load drops, empty unless enforcing. */
+	async admitLoad(job, operations, stores, signal) {
+		const { operationStore } = stores;
+		const stream = {
+			documentId: job.documentId,
+			scope: job.scope,
+			branch: job.branch
+		};
+		const candidates = operations.map((operation) => ({
+			...candidate(operation.action, stream),
+			operation
+		}));
+		const live = await this.liveOperationIds(candidates, operationStore, signal);
+		const redelivered = await this.redelivered(candidates, live, operationStore, signal);
+		await resolvePolicies(candidates, job.operations.map((operation) => operation.action), (documentId, branch) => storedPolicy(stores, this.policySource, documentId, branch, signal));
+		const dropped = /* @__PURE__ */ new Set();
+		for (let i = 0; i < candidates.length; i++) {
+			const verdict = await this.verdict(candidates[i], live, void 0, "load", signal, redelivered.has(candidates[i]));
+			if (verdict.ok) continue;
+			if (this.record(job, candidates[i], verdict, "load")) dropped.add(operations[i]);
+		}
+		return dropped;
+	}
+	/** A marker is held to v2 and enforced whatever the policy and mode. */
+	async admitMarker(job, marker, signal) {
+		const entry = {
+			...candidate(marker.action, {
+				documentId: job.documentId,
+				scope: "document",
+				branch: job.branch
+			}),
+			operation: marker,
+			policy: "v2-required"
+		};
+		const verdict = await this.verdict(entry, /* @__PURE__ */ new Set(), void 0, "load", signal);
+		if (verdict.ok) return;
+		return this.record(job, entry, verdict, "load", true);
+	}
+	async verdict(entry, live, submitted, path, signal, known = false) {
+		const verdict = await verifyActionSignature(entry.action, {
+			documentId: entry.stream.documentId,
+			branch: entry.stream.branch,
+			policy: entry.policy
+		}, path, entry.operation);
+		if (!verdict.ok) return verdict;
+		if (!known && (isLive(entry, live) || submitted?.has(entry.opId))) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "DUPLICATE_ACTION",
+			reason: `action ${entry.action.id} is already in the stream`
+		};
+		if (verdict.scheme === "unsigned") {
+			const address = entry.action.context?.signer?.user?.address;
+			return address ? {
+				ok: false,
+				scheme: "unsigned",
+				code: "UNSIGNED_IDENTITY",
+				reason: `action ${entry.action.id} is unsigned but claims to act as ${address}`
+			} : verdict;
+		}
+		if (known) return verdict;
+		const signer = entry.action.context.signer;
+		if (!await this.authorize(signer, entry.stream.documentId, signal)) return {
+			ok: false,
+			scheme: verdict.scheme,
+			code: "SIGNER_UNAUTHORIZED",
+			reason: `action ${entry.action.id}: key ${signer.app.key} may not sign as ${signer.user.address}`
+		};
+		return verdict;
+	}
+	/** Throws when the policy does, times out or the job is aborted. */
+	async authorize(signer, documentId, signal) {
+		signal?.throwIfAborted();
+		let timer;
+		let onAbort;
+		const stop = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`signature trust policy did not answer for ${signer.app.key} within ${this.trustTimeoutMs}ms`));
+			}, this.trustTimeoutMs);
+			if (signal) {
+				onAbort = () => reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason)));
+				signal.addEventListener("abort", onAbort, { once: true });
+			}
+		});
+		try {
+			return await Promise.race([this.trustPolicy.authorizeSigner(signer, signer.app.key, documentId), stop]);
+		} finally {
+			clearTimeout(timer);
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
+		}
+	}
+	/**
+	* The live candidates stored exactly as submitted and still standing: one
+	* an undo or a reshuffle has since superseded is refused, not re-emitted with
+	* the state it once produced. A synthesized operation
+	* holds another action, so it cannot be compared; only a retry, whose first
+	* attempt this job was, takes it as committed.
+	*/
+	async storedAsSubmitted(candidates, live, retry, operationStore, signal) {
+		const committed = /* @__PURE__ */ new Map();
+		const toCompare = [];
+		for (const entry of candidates) if (entry.synthesizedOpId && live.has(entry.synthesizedOpId)) {
+			if (retry) committed.set(entry, committedWrite(entry, entry.synthesizedOpId));
+		} else if (live.has(entry.opId)) toCompare.push(entry);
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			const byId = new Map(stored.map((operation) => [operation.id, operation]));
+			const matching = entries.filter((entry) => {
+				const operation = byId.get(entry.opId);
+				return operation && sameContent(operation.action, entry.action);
+			});
+			if (matching.length === 0) continue;
+			const later = await operationStore.getSince(stream.documentId, stream.scope, stream.branch, Math.min(...matching.map((entry) => byId.get(entry.opId).index)), void 0, void 0, signal);
+			for (const entry of matching) if (!isSuperseded(byId.get(entry.opId), later.results)) committed.set(entry, committedWrite(entry, entry.opId));
+		}
+		return committed;
+	}
+	/**
+	* The load candidates stored exactly as they arrive, timestamp included: a
+	* peer re-sending what this stream holds, not a replay of its action.
+	*/
+	async redelivered(candidates, live, operationStore, signal) {
+		const found = /* @__PURE__ */ new Set();
+		const toCompare = candidates.filter((entry) => live.has(entry.opId) && !(entry.synthesizedOpId && live.has(entry.synthesizedOpId)));
+		for (const [stream, entries] of byStream(toCompare)) {
+			const stored = await operationStore.getOperationsByIds(stream.documentId, stream.scope, stream.branch, entries.map((entry) => entry.opId), signal);
+			for (const entry of entries) if (stored.some((operation) => operation.id === entry.opId && Date.parse(operation.timestampUtcMs) === Date.parse(entry.operation?.timestampUtcMs ?? "") && sameContent(operation.action, entry.action))) found.add(entry);
+		}
+		return found;
+	}
+	async liveOperationIds(candidates, operationStore, signal) {
+		const live = /* @__PURE__ */ new Set();
+		for (const [stream, entries] of byStream(candidates)) {
+			const found = await operationStore.findOperationIds(stream.documentId, stream.scope, stream.branch, entries.flatMap((entry) => entry.synthesizedOpId ? [entry.opId, entry.synthesizedOpId] : [entry.opId]), signal);
+			for (const opId of found) live.add(opId);
+		}
+		return live;
+	}
+	/** Logs and counts a refusal; returns the error only when enforcing. */
+	record(job, entry, refusal, path, enforced = this.mode === "enforce") {
+		const event = {
+			jobId: job.id,
+			documentId: entry.stream.documentId,
+			scope: entry.stream.scope,
+			branch: entry.stream.branch,
+			actionId: entry.action.id,
+			code: refusal.code,
+			scheme: refusal.scheme,
+			path,
+			enforced,
+			reason: refusal.reason
+		};
+		this.logger.warn(enforced ? "Signature refused: @Refusal" : "Signature refusal logged, write admitted: @Refusal", event);
+		this.eventBus.emit(ReactorEventTypes.SIGNATURE_REFUSED, event).catch((error) => {
+			this.logger.error("Failed to emit SIGNATURE_REFUSED: @Error", error);
+		});
+		return enforced ? new InvalidSignatureError(entry.stream.documentId, refusal.code, refusal.reason) : void 0;
+	}
+};
+/**
+* A CREATE_DOCUMENT is verified under its own input. Anything else takes the
+* stored document's policy, or, for a document this job creates, that CREATE's.
+*/
+async function resolvePolicies(candidates, jobActions, stored) {
+	const resolved = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		if (entry.action.type === "CREATE_DOCUMENT") {
+			entry.policy = createPolicy(entry.action);
+			continue;
+		}
+		const { documentId, branch } = entry.stream;
+		const key = `${documentId}\u0000${branch}`;
+		let policy = resolved.get(key);
+		if (policy === void 0) {
+			policy = await stored(documentId, branch) ?? createdPolicy(jobActions, documentId) ?? "legacy";
+			resolved.set(key, policy);
+		}
+		entry.policy = policy;
+	}
+}
+async function storedPolicy(stores, source, documentId, branch, signal) {
+	try {
+		if (source === "write-cache") {
+			const document = await stores.writeCache.getState(documentId, "document", branch, void 0, signal);
+			return signaturePolicyOf(document.header);
+		}
+		const meta = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+		return signaturePolicyOf(meta.protocolVersions);
+	} catch (error) {
+		if (DocumentNotFoundError.isError(error)) return;
+		throw error;
+	}
+}
+function createdPolicy(actions, documentId) {
+	const create = actions.find((action) => action.type === "CREATE_DOCUMENT" && action.input?.documentId === documentId);
+	return create ? createPolicy(create) : void 0;
+}
+function createPolicy(action) {
+	return signaturePolicyOf(action.input);
+}
+function candidate(action, stream) {
+	const opId = (actionId) => deriveOperationId(stream.documentId, stream.scope, stream.branch, actionId);
+	return {
+		action,
+		stream,
+		opId: opId(action.id),
+		synthesizedOpId: SYNTHESIZING_TYPES.has(action.type) ? opId(synthesizedActionId(action.id)) : void 0
+	};
+}
+function isLive(entry, live) {
+	return live.has(entry.opId) || entry.synthesizedOpId !== void 0 && live.has(entry.synthesizedOpId);
+}
+function mutationStream(action, job) {
+	return {
+		...actionSigningTarget(action, job.documentId, job.branch),
+		scope: job.scope
+	};
+}
+function byStream(candidates) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of candidates) {
+		const key = `${entry.stream.documentId}\u0000${entry.stream.scope}\u0000${entry.stream.branch}`;
+		const group = groups.get(key) ?? [entry.stream, []];
+		group[1].push(entry);
+		groups.set(key, group);
+	}
+	return [...groups.values()];
+}
+function isRetry(job) {
+	return job.errorHistory.length > 0 || (job.retryCount ?? 0) > 0;
+}
+function committedWrite(entry, opId) {
+	return {
+		...entry.stream,
+		actionId: entry.action.id,
+		opId
+	};
+}
+function isSuperseded(operation, later) {
+	return later.some((next) => next.index > operation.index && next.skip > 0 && next.index - next.skip <= operation.index);
+}
+function sameContent(stored, submitted) {
+	try {
+		return canonicalJson(stored) === canonicalJson(submitted);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/executor/simple-job-executor.ts
+const MAX_SKIP_THRESHOLD = 1e3;
+/** Retries of a failed flush before a committed job's write-ready is withheld. */
+const MAX_ANNOUNCE_FLUSH_ATTEMPTS = 5;
+const ISO_TIMESTAMP_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+function isValidISOTimestamp(value) {
+	if (!ISO_TIMESTAMP_REGEX.test(value)) return false;
+	return !isNaN(new Date(value).getTime());
+}
+/**
+* Carries a failed job out of the execution scope so its transaction rolls
+* back. A scope callback that returns commits, whatever result it returns, so
+* a returned failure would leave the writes the job made before it failed
+* standing. Never escapes executeJob: the failure goes back to being a
+* returned JobResult there, which is what the queue, the worker protocol and
+* every test expect a failed job to look like.
+*/
+/** The ids of a purge job's request, which a drive purge may precede. */
+function purgeRequestDocumentIds(job) {
+	const ids = job.meta.purgeRequestDocumentIds;
+	return Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
+}
+const MARKER_INPUT_KEYS = /* @__PURE__ */ new Set([
+	"documentId",
+	"documentType",
+	"purgedAtUtcIso",
+	"requestId"
+]);
+/** A peer's marker must name this job's id on main and carry nothing else. */
+function malformedMarker(job) {
+	const action = job.operations.find((operation) => isPurgeMarker(operation))?.action;
+	const input = action?.input;
+	const refuse = (reason) => new InvalidSignatureError(job.documentId, "ID_MISMATCH", `marker ${action?.id ?? "?"} ${reason}`);
+	if (typeof input !== "object" || input === null) return refuse("carries no input");
+	const extra = Object.keys(input).filter((key) => !MARKER_INPUT_KEYS.has(key));
+	if (extra.length > 0) return refuse(`carries unexpected input ${extra.join(", ")}`);
+	for (const key of MARKER_INPUT_KEYS) if (typeof input[key] !== "string" || input[key] === "") return refuse(`input.${key} is not a non-empty string`);
+	const purgedAt = Date.parse(input.purgedAtUtcIso);
+	if (Number.isNaN(purgedAt) || new Date(purgedAt).toISOString() !== input.purgedAtUtcIso) return refuse("input.purgedAtUtcIso is not an ISO timestamp");
+	if (input.documentId !== job.documentId || job.branch !== "main" || action?.scope !== "document") return refuse(`does not purge ${job.documentId} on document/main`);
+}
+var JobRollbackSignal = class extends Error {
+	result;
+	constructor(result) {
+		super("job rolled back");
+		this.result = result;
+		this.name = "JobRollbackSignal";
+	}
+};
+var SimpleJobExecutor = class {
+	logger;
+	registry;
+	operationStore;
+	eventBus;
+	writeCache;
+	operationIndex;
+	documentMetaCache;
+	collectionMembershipCache;
+	driveContainerTypes;
+	config;
+	featureFlags;
+	decisionModel;
+	signatureAdmission;
+	documentActionHandler;
+	executionScope;
+	signer;
+	flusher;
+	/**
+	* `signer` signs the operations the reducer synthesizes; unsigned if omitted.
+	* `trustPolicy` decides which keys may sign as which users at admission.
+	* `flusher` makes a job durable before its write-ready is announced.
+	*/
+	constructor(logger, registry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, driveContainerTypes, config, executionScope, signer, trustPolicy, flusher = new NoopStorageFlusher()) {
+		this.logger = logger;
+		this.registry = registry;
+		this.operationStore = operationStore;
+		this.eventBus = eventBus;
+		this.writeCache = writeCache;
+		this.operationIndex = operationIndex;
+		this.documentMetaCache = documentMetaCache;
+		this.collectionMembershipCache = collectionMembershipCache;
+		this.driveContainerTypes = driveContainerTypes;
+		this.flusher = flusher;
+		this.signer = signer ?? new PassthroughSigner();
+		this.featureFlags = resolveFeatureFlags(config.featureFlags);
+		this.config = {
+			featureFlags: config.featureFlags ?? {},
+			maxSkipThreshold: config.maxSkipThreshold ?? MAX_SKIP_THRESHOLD,
+			maxConcurrency: config.maxConcurrency ?? 1,
+			jobTimeoutMs: config.jobTimeoutMs ?? 3e4,
+			deferredJobTtlMs: config.deferredJobTtlMs ?? 3e4,
+			retryBaseDelayMs: config.retryBaseDelayMs ?? 100,
+			retryMaxDelayMs: config.retryMaxDelayMs ?? 5e3,
+			yieldDeadlineMs: config.yieldDeadlineMs ?? 50,
+			batchApplies: config.batchApplies ?? true,
+			signatureVerification: config.signatureVerification ?? "enforce",
+			protocolSupport: config.protocolSupport ?? localSupports(PEER_CAPABILITIES, this.featureFlags).protocols,
+			maxPurgeOperations: config.maxPurgeOperations ?? 2e5,
+			durabilityWaitMs: config.durabilityWaitMs ?? 0
+		};
+		this.decisionModel = selectDecisionModel(this.featureFlags, registry);
+		this.signatureAdmission = new SignatureAdmission(this.config.signatureVerification, logger, eventBus, this.featureFlags.documentDecisions ? "write-cache" : "meta", {
+			signer: this.signer,
+			authEnforcement: this.featureFlags.authEnforcement,
+			policy: trustPolicy,
+			timeoutMs: Math.min(DEFAULT_TRUST_TIMEOUT_MS, this.config.jobTimeoutMs / 2)
+		});
+		this.documentActionHandler = new DocumentActionHandler(registry, logger, driveContainerTypes, this.featureFlags, this.decisionModel, this.config.protocolSupport);
+		this.executionScope = executionScope ?? new DefaultExecutionScope(operationStore, operationIndex, writeCache, documentMetaCache, collectionMembershipCache);
+	}
+	/**
+	* Execute a single job by applying all its actions through the appropriate reducers.
+	* Actions are processed sequentially in order.
+	*
+	* The whole job runs inside one execution scope, and a scope callback that
+	* returns commits. A failed job must therefore leave the scope by throwing,
+	* or the writes it made before it failed would be durable: JobRollbackSignal
+	* carries the failure out through the transaction and this method turns it
+	* back into the returned JobResult every caller expects. A job either fully
+	* applies or leaves nothing durable behind.
+	*
+	* Durable is the whole of the guarantee. The caches are shared with the
+	* copies the scope hands the job, so a failed job's writes sit in them from
+	* the moment it makes them until the eviction below, and a concurrent read
+	* in that window sees a write that is never going to commit. The window is
+	* not new -- it has always been there for a job that failed by throwing --
+	* but nothing here closes it, and a caller that needs to know a write is
+	* real has the job status to ask.
+	*/
+	async executeJob(job, signal, onCommitting) {
+		const startTime = Date.now();
+		const touchedStreams = new TouchedStreams();
+		const postCommitInvalidations = [];
+		const postCommitMembershipInvalidations = [];
+		const postCommitMetaInvalidations = [];
+		let outcome;
+		try {
+			outcome = await this.executionScope.run(async (stores) => {
+				const scoped = await this.executeInScope({
+					job,
+					startTime,
+					stores,
+					signal,
+					touchedStreams,
+					postCommitInvalidations,
+					postCommitMembershipInvalidations,
+					postCommitMetaInvalidations
+				});
+				if (!scoped.result.success) throw new JobRollbackSignal(scoped.result);
+				signal?.throwIfAborted();
+				onCommitting?.();
+				return scoped;
+			}, signal);
+		} catch (error) {
+			this.evictTouchedStreams(touchedStreams);
+			if (error instanceof JobRollbackSignal) return error.result;
+			throw error;
+		}
+		for (const entry of postCommitInvalidations) this.writeCache.invalidate(entry.documentId, entry.scope, entry.branch);
+		for (const documentId of postCommitMembershipInvalidations) this.collectionMembershipCache.invalidate(documentId);
+		for (const documentId of postCommitMetaInvalidations) this.documentMetaCache.invalidate(documentId);
+		const { pendingEvent } = outcome;
+		if (pendingEvent && await this.awaitDurable(job, signal)) this.eventBus.emit(ReactorEventTypes.JOB_WRITE_READY, pendingEvent).catch((error) => {
+			this.logger.error("Failed to emit JOB_WRITE_READY event: @Event : @Error", pendingEvent, error);
+		});
+		return outcome.result;
+	}
+	/**
+	* Waits for a flush covering the committed job before its write-ready goes
+	* out; false withholds the announcement. A failed flush is never a failed
+	* job, since the commit stands: it is retried, and the announcement is
+	* withheld once the store is poisoned (the host restarts), the attempts run
+	* out, the wait outlives `durabilityWaitMs`, or the job's signal aborts.
+	*/
+	async awaitDurable(job, signal) {
+		if (isCursorProtectedLoad(job)) return true;
+		const budgetMs = this.config.durabilityWaitMs;
+		const deadline = budgetMs > 0 ? Date.now() + budgetMs : Infinity;
+		for (let attempt = 1;; attempt++) {
+			try {
+				if (await this.withinDurabilityWait(this.flusher.flush(), deadline, signal) !== TIMED_OUT) return true;
+				this.logger.error("Job @JobId committed but its flush outlived the durability wait or the job was aborted; its write-ready is withheld", job.id);
+				return false;
+			} catch (error) {
+				this.logger.error("Flush before announcing job @JobId failed (attempt @Attempt): @Error", job.id, attempt, error);
+				if (error instanceof StoragePoisonedError || attempt >= MAX_ANNOUNCE_FLUSH_ATTEMPTS) {
+					this.logger.error("Job @JobId committed but is not durable; its write-ready is withheld", job.id);
+					return false;
+				}
+			}
+			if (await this.withinDurabilityWait(delay(Math.min(this.config.retryMaxDelayMs, this.config.retryBaseDelayMs * 2 ** (attempt - 1))), deadline, signal) === TIMED_OUT) return false;
+		}
+	}
+	/** Settles with TIMED_OUT at the deadline or on abort; the wait itself is abandoned. */
+	async withinDurabilityWait(pending, deadline, signal) {
+		pending.catch(() => void 0);
+		if (signal?.aborted) return TIMED_OUT;
+		let onAbort;
+		const aborted = new Promise((resolve) => {
+			onAbort = () => resolve(TIMED_OUT);
+			signal?.addEventListener("abort", onAbort, { once: true });
+		});
+		try {
+			const raced = Promise.race([pending, aborted]);
+			return deadline === Infinity ? await raced : await withDeadline(raced, Math.max(0, deadline - Date.now()));
+		} finally {
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
+		}
+	}
+	/**
+	* The body of a job, run inside the execution scope's transaction.
+	*
+	* The stores and caches it works through are the copies scoped to that
+	* transaction, so nothing it does is durable until the scope commits. The
+	* write-ready event is handed back rather than emitted, because a job that
+	* has not committed yet has nothing to announce.
+	*/
+	async executeInScope(params) {
+		const { job, startTime, stores: scopeStores, signal, touchedStreams, postCommitInvalidations, postCommitMembershipInvalidations } = params;
+		let pendingEvent;
+		if (job.kind === "mutation") {
+			const reserved = job.actions.find((action) => isPurgeMarker(action));
+			if (reserved) return { result: buildErrorResult(job, new ReservedActionError(job.documentId, reserved.type), startTime) };
+		}
+		if (job.kind === "purge" || job.kind === "load" && job.operations.some((op) => isPurgeMarker(op))) return this.executePurge(params);
+		const lockedIds = jobWriteIds(job);
+		const lockFailure = (error) => ({ result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) });
+		try {
+			await scopeStores.documentLocks.shared(lockedIds);
+		} catch (error) {
+			return lockFailure(error);
+		}
+		let purged;
+		try {
+			purged = await scopeStores.documentLocks.purged(lockedIds);
+		} catch (error) {
+			return lockFailure(error);
+		}
+		const purgedRefusal = this.purgedRefusal(job, purged);
+		if (purgedRefusal) return { result: buildErrorResult(job, purgedRefusal, startTime) };
+		const purgeFence = new PurgeFence(scopeStores.documentLocks, new Set(lockedIds), purged);
+		const stores = {
+			...scopeStores,
+			writeCache: new FencedWriteCache(scopeStores.writeCache, purgeFence, (documentId) => {
+				scopeStores.writeCache.invalidate(documentId);
+				scopeStores.documentMetaCache.invalidate(documentId);
+			})
+		};
+		const unsupported = await this.unsupportedStoredProtocol(job, stores, signal);
+		if (unsupported) return { result: buildErrorResult(job, unsupported, startTime) };
+		const indexTxn = stores.operationIndex.start();
+		if (job.kind === "load") {
+			const loadResult = await this.executeLoadJob({
+				job,
+				startTime,
+				indexTxn,
+				stores,
+				signal,
+				replayingAcceptedHistory: true,
+				evaluatedByPosition: false,
+				postCommitInvalidations,
+				postCommitMembershipInvalidations,
+				touchedStreams,
+				purgeFence
+			});
+			if (loadResult.success && loadResult.operationsWithContext) {
+				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
+				postCommitMembershipInvalidations.push(...indexTxn.getMembershipInvalidations());
+				for (let i = 0; i < loadResult.operationsWithContext.length; i++) loadResult.operationsWithContext[i].context.ordinal = ordinals[i];
+				const collectionMemberships = loadResult.operationsWithContext.length > 0 ? await this.getCollectionMembershipsForOperations(loadResult.operationsWithContext, stores) : {};
+				pendingEvent = {
+					jobId: job.id,
+					operations: loadResult.operationsWithContext,
+					jobMeta: job.meta,
+					collectionMemberships
+				};
+			}
+			return {
+				result: loadResult,
+				pendingEvent
+			};
+		}
+		if (job.kind === "reevaluation") {
+			const reevalResult = await this.executeReevaluationJob({
+				job,
+				startTime,
+				indexTxn,
+				stores,
+				signal,
+				replayingAcceptedHistory: false,
+				evaluatedByPosition: false,
+				postCommitInvalidations,
+				postCommitMembershipInvalidations,
+				touchedStreams,
+				purgeFence
+			});
+			if (reevalResult.success && reevalResult.operationsWithContext) {
+				const ordinals = await stores.operationIndex.commit(indexTxn, signal);
+				postCommitMembershipInvalidations.push(...indexTxn.getMembershipInvalidations());
+				for (let i = 0; i < reevalResult.operationsWithContext.length; i++) reevalResult.operationsWithContext[i].context.ordinal = ordinals[i];
+				if (reevalResult.operationsWithContext.length > 0) {
+					const collectionMemberships = await this.getCollectionMembershipsForOperations(reevalResult.operationsWithContext, stores);
+					pendingEvent = {
+						jobId: job.id,
+						operations: reevalResult.operationsWithContext,
+						jobMeta: job.meta,
+						collectionMemberships
+					};
+				}
+			}
+			return {
+				result: reevalResult,
+				pendingEvent
+			};
+		}
+		let admission;
+		try {
+			admission = await this.signatureAdmission.admitMutation(job, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		if (admission.kind === "refused") return { result: buildErrorResult(job, admission.error, startTime) };
+		let committed;
+		try {
+			committed = await this.reloadCommitted(admission.committed, stores, signal);
+		} catch (error) {
+			return { result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) };
+		}
+		const committedIds = new Set(admission.committed.map((write) => write.actionId));
+		const fresh = committedIds.size === 0 ? job : {
+			...job,
+			actions: job.actions.filter((action) => !committedIds.has(action.id))
+		};
+		if (fresh.actions.length === 0) return this.committedOutcome(job, committed, [], [], stores, startTime);
+		const positioned = await this.positionByTimestamp(fresh, stores, signal);
+		if (positioned.error) return { result: buildErrorResult(job, positioned.error, startTime) };
+		const executing = {
+			job: fresh,
+			startTime,
+			indexTxn,
+			stores,
+			signal,
+			replayingAcceptedHistory: false,
+			evaluatedByPosition: positioned.evaluatedByPosition,
+			postCommitInvalidations,
+			postCommitMembershipInvalidations,
+			touchedStreams,
+			purgeFence
+		};
+		const actionResult = await this.processActions(positioned.writes, executing);
+		if (!actionResult.success) return { result: {
+			job,
+			success: false,
+			error: actionResult.error,
+			duration: Date.now() - startTime
+		} };
+		const reevaluationError = await this.reevaluateIfCriteriaMet({
+			scope: job.scope,
+			operations: actionResult.generatedOperations
+		}, executing);
+		if (reevaluationError) return { result: {
+			job,
+			success: false,
+			error: reevaluationError,
+			duration: Date.now() - startTime
+		} };
+		const ordinals = await stores.operationIndex.commit(indexTxn, signal);
+		postCommitMembershipInvalidations.push(...indexTxn.getMembershipInvalidations());
+		for (let i = 0; i < actionResult.operationsWithContext.length; i++) actionResult.operationsWithContext[i].context.ordinal = ordinals[i];
+		return this.committedOutcome(job, committed, actionResult.operationsWithContext, actionResult.generatedOperations, stores, startTime);
+	}
+	/** A load names only its own id purged; a foreign one is ID_MISMATCH. */
+	purgedRefusal(job, purged) {
+		if (purged.size === 0) return;
+		if (purged.has(job.documentId)) return new DocumentPurgedError(job.documentId);
+		const actions = [...job.actions, ...job.operations.map((operation) => operation.action)];
+		for (const action of actions) {
+			if (!DOCUMENT_SCOPE_ACTIONS.has(action.type)) continue;
+			const target = targetDocumentId(action, job.documentId);
+			if (!purged.has(target)) continue;
+			if (job.kind === "mutation") return new DocumentPurgedError(target);
+			return new InvalidSignatureError(job.documentId, "ID_MISMATCH", `${action.type} ${action.id} in ${job.documentId} writes purged ${target}`);
+		}
+		if (job.kind !== "mutation") return;
+		for (const action of job.actions) {
+			const target = relationshipTarget(action);
+			if (action.type === "ADD_RELATIONSHIP" && target !== void 0 && purged.has(target)) return new DocumentPurgedError(target, `${action.type} target ${target} was purged`);
+			if (action.scope !== "auth") continue;
+			const group = mentionedGroupIds(action).find((id) => purged.has(id));
+			if (group !== void 0) return new DocumentPurgedError(group, `${action.type} names purged group ${group}`);
+		}
+	}
+	/** A purge job or a marker load: the exclusive lock is the job's only lock. */
+	async executePurge(params) {
+		const { job, startTime, stores } = params;
+		const fail = (error) => ({ result: buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime) });
+		if (job.kind === "load") {
+			const malformed = malformedMarker(job);
+			if (malformed) return fail(malformed);
+		}
+		const purger = stores.purger;
+		if (!purger) return fail(/* @__PURE__ */ new Error(`Purge of ${job.documentId} needs a transactional scope`));
+		try {
+			await stores.documentLocks.exclusive(job.documentId);
+		} catch (error) {
+			return fail(error);
+		}
+		let alreadyPurged;
+		try {
+			alreadyPurged = (await stores.documentLocks.purged([job.documentId])).has(job.documentId);
+		} catch (error) {
+			return fail(error);
+		}
+		if (alreadyPurged) return {
+			result: {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			},
+			pendingEvent: {
+				jobId: job.id,
+				operations: [],
+				jobMeta: job.meta,
+				collectionMemberships: {}
+			}
+		};
+		let commit;
+		try {
+			commit = job.kind === "purge" ? await this.preparePurgeJob(params, purger) : await this.preparePurgeLoad(params, purger);
+		} catch (error) {
+			return fail(error);
+		}
+		if (commit instanceof Error) return fail(commit);
+		try {
+			return await this.commitPurge(params, commit);
+		} catch (error) {
+			return fail(error);
+		}
+	}
+	/** Preconditions 1-5, then the marker this host signs. */
+	async preparePurgeJob(params, purger) {
+		const { job, stores, signal } = params;
+		const documentId = job.documentId;
+		if (!job.purge) return /* @__PURE__ */ new Error(`Purge job ${job.id} carries no purge options`);
+		const held = await this.heldStreams(purger, documentId);
+		if (held.branches.length === 0) return new DocumentNotDeletedError(documentId, `Document ${documentId} is not held here`);
+		let documentType;
+		for (const branch of held.branches) {
+			let meta;
+			try {
+				meta = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			} catch (error) {
+				return new DocumentNotDeletedError(documentId, `Document ${documentId} has no readable state on ${branch}: ${error instanceof Error ? error.message : String(error)}`);
+			}
+			if (!meta.state.isDeleted) return new DocumentNotDeletedError(documentId, `Document ${documentId} is not deleted on branch ${branch}`);
+			documentType ??= meta.documentType;
+		}
+		if (documentType === void 0) return new DocumentNotDeletedError(documentId);
+		if (documentType === groupDocumentType) {
+			const referencers = await purger.groupReferencersInHistory(documentId);
+			if (referencers.length > 0) return new GroupInUseError(documentId, referencers);
+		}
+		let survivors = [];
+		if (this.driveContainerTypes.has(documentType)) {
+			const requested = new Set(purgeRequestDocumentIds(job));
+			const members = await this.driveMembers(purger, stores, documentId, held.branches);
+			const blocking = members.required.filter((id) => !requested.has(id));
+			if (blocking.length > 0) return new DocumentNotDeletedError(documentId, `Drive ${documentId} cannot be purged: ${blocking.join(", ")} neither purged nor in the request`);
+			survivors = members.survivors;
+		}
+		const operationCount = await purger.operationCount(documentId);
+		if (operationCount > this.config.maxPurgeOperations && !job.purge.allowLarge) return new PurgeTooLargeError(documentId, operationCount, this.config.maxPurgeOperations);
+		return {
+			purger,
+			marker: await this.signMarker(documentId, documentType, job.purge.requestId, signal),
+			documentType,
+			held,
+			sourceRemote: "",
+			collectionIds: [],
+			survivors
+		};
+	}
+	/** A peer's marker, admitted alone; a receiver cannot refuse an erasure. */
+	async preparePurgeLoad(params, purger) {
+		const { job, stores, signal } = params;
+		const documentId = job.documentId;
+		const marker = job.operations.find((operation) => isPurgeMarker(operation));
+		const refusal = await this.signatureAdmission.admitMarker(job, marker, signal);
+		if (refusal) return refusal;
+		const held = await this.heldStreams(purger, documentId);
+		let documentType = marker.action.input.documentType;
+		let appliedDeletion = held.branches.length > 0;
+		if (held.branches.length > 0) try {
+			const meta = await stores.documentMetaCache.getDocumentMeta(documentId, held.branches.includes("main") ? "main" : held.branches[0], signal);
+			documentType = meta.documentType;
+			appliedDeletion = !meta.state.isDeleted;
+		} catch {}
+		let survivors = [];
+		if (this.driveContainerTypes.has(documentType)) {
+			const members = await this.driveMembers(purger, stores, documentId, held.branches);
+			survivors = [...members.required, ...members.survivors];
+		}
+		const sourceRemote = typeof job.meta.sourceRemote === "string" ? job.meta.sourceRemote : "";
+		const collectionId = sourceRemote ? await purger.remoteCollection(sourceRemote) : void 0;
+		return {
+			purger,
+			marker: purgeMarkerOperation(marker.action),
+			documentType,
+			held,
+			sourceRemote,
+			collectionIds: collectionId === void 0 ? [] : [collectionId],
+			survivors,
+			...appliedDeletion ? { appliedDeletion: true } : {}
+		};
+	}
+	/** Execution: delete, write the marker and its twin, tombstone, reopen. */
+	async commitPurge(params, commit) {
+		const { job, startTime, stores, signal, touchedStreams } = params;
+		const { purger, marker, documentType, held, sourceRemote } = commit;
+		const documentId = job.documentId;
+		const streams = [...held.streams, {
+			scope: "document",
+			branch: "main"
+		}];
+		for (const stream of streams) {
+			touchedStreams.add(documentId, stream.scope, stream.branch);
+			params.postCommitInvalidations.push({
+				documentId,
+				...stream
+			});
+		}
+		params.postCommitMetaInvalidations.push(documentId);
+		const removedRows = await purger.deleteRows(documentId);
+		const [stored] = await stores.operationStore.apply(documentId, documentType, "document", "main", 0, (txn) => {
+			txn.addOperations(marker);
+		}, signal);
+		const indexTxn = stores.operationIndex.start();
+		indexTxn.write([{
+			...stored,
+			documentId,
+			documentType,
+			scope: "document",
+			branch: "main",
+			sourceRemote
+		}]);
+		const [ordinal] = await stores.operationIndex.commit(indexTxn, signal);
+		await purger.writeTombstone({
+			documentId,
+			ordinal,
+			removedRows,
+			purgedAtUtc: marker.action.input.purgedAtUtcIso,
+			requestId: marker.action.input.requestId
+		});
+		const collections = await purger.reopenMemberships(documentId, ordinal, commit.collectionIds);
+		params.postCommitMembershipInvalidations.push(documentId, ...commit.survivors, ...indexTxn.getMembershipInvalidations());
+		const operationWithContext = {
+			operation: stored,
+			context: {
+				documentId,
+				scope: "document",
+				branch: "main",
+				documentType,
+				ordinal,
+				...commit.appliedDeletion ? { appliedDeletion: true } : {}
+			}
+		};
+		return {
+			result: {
+				job,
+				success: true,
+				operations: [stored],
+				operationsWithContext: [operationWithContext],
+				duration: Date.now() - startTime
+			},
+			pendingEvent: {
+				jobId: job.id,
+				operations: [operationWithContext],
+				jobMeta: job.meta,
+				collectionMemberships: { [documentId]: collections }
+			}
+		};
+	}
+	async heldStreams(purger, documentId) {
+		const streams = await purger.streams(documentId);
+		return {
+			streams,
+			branches: [...new Set(streams.filter((stream) => stream.scope === "document").map((stream) => stream.branch))]
+		};
+	}
+	/** Members a drive purge needs gone, and those living on elsewhere. */
+	async driveMembers(purger, stores, driveId, branches) {
+		const required = /* @__PURE__ */ new Set();
+		const survivors = /* @__PURE__ */ new Set();
+		for (const branch of branches.length > 0 ? branches : ["main"]) {
+			const collectionId = DriveCollectionId.forDrive(driveId, branch).key;
+			const members = await purger.collectionMembers(collectionId, driveId, branch);
+			const purged = await stores.documentLocks.purged(members.map((member) => member.documentId));
+			for (const member of members) {
+				if (purged.has(member.documentId)) continue;
+				if (member.required) required.add(member.documentId);
+				else survivors.add(member.documentId);
+			}
+		}
+		return {
+			required: [...required],
+			survivors: [...survivors]
+		};
+	}
+	/** The marker, signed by this executor's signer as any peer admits it. */
+	async signMarker(documentId, documentType, requestId, signal) {
+		const action = purgeDocumentAction({
+			documentId,
+			documentType,
+			requestId
+		});
+		const signature = await this.signer.signAction(action, {
+			documentId,
+			branch: "main"
+		}, signal);
+		return purgeMarkerOperation({
+			...action,
+			context: { signer: {
+				...actionSignerIdentity(this.signer),
+				signatures: [signature]
+			} }
+		});
+	}
+	/** A stored document at a version this reactor does not run is read-only here. */
+	async unsupportedStoredProtocol(job, stores, signal) {
+		let versions;
+		try {
+			versions = this.featureFlags.documentDecisions && job.kind !== "load" ? (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).header.protocolVersions : (await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal)).protocolVersions;
+		} catch {
+			return;
+		}
+		return this.documentActionHandler.unsupportedProtocol(job.documentId, versions);
+	}
+	/**
+	* A successful mutation's result and the write-ready event it owes, carrying
+	* what earlier attempts committed ahead of what this one wrote.
+	*/
+	async committedOutcome(job, reloaded, written, generated, stores, startTime) {
+		const operationsWithContext = [...reloaded, ...written];
+		let pendingEvent;
+		if (operationsWithContext.length > 0) {
+			const collectionMemberships = await this.getCollectionMembershipsForOperations(operationsWithContext, stores);
+			pendingEvent = {
+				jobId: job.id,
+				operations: operationsWithContext,
+				jobMeta: job.meta,
+				submittedActionIds: submittedActionIds(job),
+				collectionMemberships
+			};
+		}
+		return {
+			result: {
+				job,
+				success: true,
+				operations: [...reloaded.map((entry) => entry.operation), ...generated],
+				operationsWithContext,
+				duration: Date.now() - startTime
+			},
+			pendingEvent
+		};
+	}
+	/**
+	* The stored operations of writes an earlier attempt committed, as a fresh
+	* write would report them. State is rebuilt from the write cache, and left
+	* out when it cannot be.
+	*/
+	async reloadCommitted(writes, stores, signal) {
+		const streams = /* @__PURE__ */ new Map();
+		for (const write of writes) {
+			const key = `${write.documentId}\u0000${write.scope}\u0000${write.branch}`;
+			streams.set(key, [...streams.get(key) ?? [], write]);
+		}
+		const reloaded = [];
+		for (const group of streams.values()) {
+			const { documentId, scope, branch } = group[0];
+			const opIds = [...new Set(group.map((write) => write.opId))];
+			const operations = await stores.operationStore.getOperationsByIds(documentId, scope, branch, opIds, signal);
+			const ordinals = await stores.operationIndex.getOrdinalsByOpIds(documentId, scope, branch, opIds, signal);
+			const { documentType } = await stores.documentMetaCache.getDocumentMeta(documentId, branch, signal);
+			for (const operation of operations.sort((a, b) => a.index - b.index)) reloaded.push({
+				operation,
+				context: {
+					documentId,
+					scope,
+					branch,
+					documentType,
+					resultingState: await this.rebuiltState(stores, {
+						documentId,
+						scope,
+						branch
+					}, operation, signal),
+					ordinal: ordinals.get(operation.id) ?? 0
+				}
+			});
+		}
+		return reloaded;
+	}
+	async rebuiltState(stores, stream, operation, signal) {
+		try {
+			const document = await stores.writeCache.getState(stream.documentId, stream.scope, stream.branch, operation.index, signal);
+			return JSON.stringify({
+				...document.state,
+				header: document.header
+			});
+		} catch (error) {
+			this.logger.warn("No state for committed operation @OperationId in @Stream: @Error", operation.id, stream, error);
+			return;
+		}
+	}
+	/**
+	* Drops the cached state of every stream a job wrote, after its transaction
+	* did not commit.
+	*
+	* The caches are shared by reference with the copies the scope hands the job,
+	* so a rollback undoes nothing in them: what the job put there survives, as
+	* does anything a read filled from the store while the job's own writes were
+	* still uncommitted. An eviction that throws is swallowed rather than allowed
+	* to replace the failure the caller is owed, and the remaining streams are
+	* still evicted.
+	*/
+	evictTouchedStreams(touchedStreams) {
+		for (const entry of touchedStreams) try {
+			this.writeCache.invalidate(entry.documentId, entry.scope, entry.branch);
+			this.documentMetaCache.invalidate(entry.documentId, entry.branch);
+			this.collectionMembershipCache.invalidate(entry.documentId);
+		} catch (error) {
+			this.logger.error("Failed to evict cached state for rolled back @Stream : @Error", entry, error);
+		}
+	}
+	async getCollectionMembershipsForOperations(operations, stores) {
+		const documentIds = [...new Set(operations.map((op) => op.context.documentId))];
+		return stores.collectionMembershipCache.getCollectionsForDocuments(documentIds);
+	}
+	async processActions(writes, executing) {
+		const { job, signal } = executing;
+		const actions = writes.map((write) => write.action);
+		const generatedOperations = [];
+		const operationsWithContext = [];
+		for (const action of actions) if (action.timestampUtcMs && !isValidISOTimestamp(action.timestampUtcMs)) return {
+			success: false,
+			generatedOperations,
+			operationsWithContext,
+			error: new InvalidOperationTimestampError(job.documentId, action.scope, action.timestampUtcMs, `action ${action.type} (id: ${action.id})`)
+		};
+		let lastYield = performance.now();
+		if (this.config.batchApplies && this.canBatch(writes, executing)) {
+			const batched = await this.executeRegularActionsBatched(writes, executing);
+			const error = this.accumulateResultOrReturnError(batched, generatedOperations, operationsWithContext);
+			if (error !== null) return {
+				success: false,
+				generatedOperations,
+				operationsWithContext,
+				error: error.error
+			};
+			return {
+				success: true,
+				generatedOperations,
+				operationsWithContext
+			};
+		}
+		for (const write of writes) {
+			const result = DOCUMENT_SCOPE_ACTIONS.has(write.action.type) ? await this.documentActionHandler.execute(write, executing) : await this.executeRegularAction(write, executing);
+			const error = this.accumulateResultOrReturnError(result, generatedOperations, operationsWithContext);
+			if (error !== null) return {
+				success: false,
+				generatedOperations,
+				operationsWithContext,
+				error: error.error
+			};
+			if (performance.now() - lastYield > this.config.yieldDeadlineMs) {
+				await yieldToMain();
+				lastYield = performance.now();
+				if (signal?.aborted) return {
+					success: false,
+					generatedOperations,
+					operationsWithContext,
+					error: /* @__PURE__ */ new Error("Aborted")
+				};
+			}
+		}
+		return {
+			success: true,
+			generatedOperations,
+			operationsWithContext
+		};
+	}
+	/**
+	* Decides a write and reduces it, without persisting anything.
+	*
+	* Split from the commit so one write and a batch of them share this logic
+	* rather than keeping two copies of it. `baseDocument` lets a batch thread
+	* the previous action's result forward instead of reading its own write back
+	* out of the cache, which is the only reason the reduce has to be sequential.
+	*/
+	async prepareRegularWrite(write, executing, baseDocument) {
+		const { action, skip, sourceOperation, sourceRemote, deniedReason } = write;
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		let appendCondition;
+		let documentVersion;
+		const alreadyEvaluated = this.featureFlags.documentDecisions && (executing.replayingAcceptedHistory || executing.evaluatedByPosition);
+		if (this.featureFlags.documentDecisions && !alreadyEvaluated) {
+			const target = {
+				documentId: job.documentId,
+				branch: job.branch
+			};
+			let admission;
+			try {
+				admission = await decideAtHead(this.decisionModel, stores.writeCache, target, {
+					address: action.context?.signer?.user.address,
+					key: action.context?.signer?.app.key
+				}, {
+					verb: "execute",
+					scope: action.scope,
+					operation: action.type
+				}, signal, this.featureFlags.authConditions ? {
+					actionInput: action.input,
+					carriedDocument: baseDocument
+				} : void 0);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (admission.evaluation.decision === "deny") return buildErrorResult(job, refusalError(admission.evaluation.reason, job.documentId, admission.deletedAtUtcIso, action), startTime);
+			appendCondition = admission.appendCondition;
+			documentVersion = admission.documentVersion;
+		} else if (alreadyEvaluated) documentVersion = (await stores.writeCache.getState(job.documentId, "document", job.branch, void 0, signal)).state.document.version;
+		else {
+			let docMeta;
+			try {
+				docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			if (docMeta.state.isDeleted) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+			documentVersion = docMeta.state.version;
+		}
+		if (isUndoRedo(action) || skip > 0) stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		let document;
+		if (baseDocument !== void 0) document = baseDocument;
+		else try {
+			document = await stores.writeCache.getState(job.documentId, job.scope, job.branch, void 0, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		if (!this.featureFlags.authEnforcement && !executing.replayingAcceptedHistory) {
+			const subject = {
+				address: write.action.context?.signer?.user.address,
+				key: write.action.context?.signer?.app.key
+			};
+			if (decide(document.state.auth, subject, {
+				verb: "execute",
+				scope: action.scope,
+				operation: action.type
+			}) === "deny") return buildErrorResult(job, new AuthorizationDeniedError(job.documentId, action.scope, action.type, subject.address), startTime);
+		}
+		let module;
+		try {
+			module = this.registry.getModule(document.header.documentType, normalizeDocumentModelVersion(documentVersion));
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		let updatedDocument;
+		if (deniedReason !== void 0) {
+			const index = getNextIndexForScope(document, job.scope);
+			const denied = createOperation(action, index, skip, {
+				documentId: job.documentId,
+				scope: job.scope,
+				branch: job.branch
+			});
+			denied.deniedReason = deniedReason;
+			let standing = document;
+			if (skip > 0) try {
+				standing = await stores.writeCache.getState(job.documentId, job.scope, job.branch, index - skip - 1, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			denied.hash = hashDocumentStateForScope(standing, job.scope);
+			updatedDocument = {
+				...standing,
+				operations: {
+					...standing.operations,
+					[job.scope]: [...standing.operations[job.scope] ?? [], denied]
+				}
+			};
+		} else try {
+			const protocolVersion = baseReducerVersion(document.header);
+			const reducerOptions = sourceOperation ? {
+				skip,
+				branch: job.branch,
+				replayOptions: { operation: sourceOperation },
+				protocolVersion
+			} : {
+				skip,
+				branch: job.branch,
+				protocolVersion
+			};
+			updatedDocument = withProtocolVersions(module.reducer(document, action, void 0, reducerOptions), document.header.protocolVersions);
+		} catch (error) {
+			const contextMessage = `Failed to apply action to document:\n  Action type: ${action.type}\n  Document ID: ${job.documentId}\n  Document type: ${document.header.documentType}\n  Scope: ${job.scope}\n  Original error: ${error instanceof Error ? error.message : String(error)}`;
+			const enhancedError = new Error(contextMessage);
+			if (error instanceof Error && error.stack) enhancedError.stack = `${contextMessage}\n\nOriginal stack trace:\n${error.stack}`;
+			return buildErrorResult(job, enhancedError, startTime);
+		}
+		const scope = job.scope;
+		const operations = updatedDocument.operations[scope];
+		if (operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("No operation generated from action"), startTime);
+		const newOperation = operations[operations.length - 1];
+		if (!isUndoRedo(action)) newOperation.skip = skip;
+		if (deniedReason === void 0 && sourceOperation === void 0 && !executing.replayingAcceptedHistory && isSynthesized(action, newOperation, document.operations[scope] ?? [])) try {
+			await signSynthesized(newOperation, action, {
+				documentId: job.documentId,
+				scope,
+				branch: job.branch
+			}, this.signer, signal);
+		} catch (error) {
+			return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+		}
+		const resultingState = JSON.stringify({
+			...updatedDocument.state,
+			header: updatedDocument.header
+		});
+		return {
+			action,
+			sourceRemote,
+			scope,
+			document,
+			updatedDocument,
+			operation: newOperation,
+			resultingState,
+			appendCondition,
+			denied: deniedReason !== void 0
+		};
+	}
+	/**
+	* Persists a run of prepared writes in one store transaction.
+	*
+	* The store has always accepted many operations per apply; the executor only
+	* ever handed it one. Passing the whole run means one advisory lock over the
+	* read set and one guarded insert for the batch, instead of one of each per
+	* operation.
+	*
+	* The append condition is taken from the first write. Every write in a run
+	* reads the same streams at the same revisions, because nothing outside the
+	* run can change them mid-batch, and the caller has already refused to batch
+	* the scopes where that does not hold.
+	*/
+	async commitPreparedWrites(prepared, executing) {
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		const first = prepared[0];
+		const last = prepared[prepared.length - 1];
+		const scope = first.scope;
+		const documentType = first.document.header.documentType;
+		const operations = prepared.map((write) => write.operation);
+		executing.touchedStreams.add(job.documentId, scope, job.branch);
+		let storedOperations;
+		try {
+			storedOperations = await stores.operationStore.apply(job.documentId, documentType, scope, job.branch, first.operation.index, (txn) => {
+				txn.addOperations(...operations);
+			}, signal, first.appendCondition);
+		} catch (error) {
+			this.logger.error("Failed to write operation to IOperationStore (@documentId @scope @branch): @Operation @Error", job.documentId, scope, job.branch, operations, error);
+			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			if (AppendConditionFailedError.isError(error)) for (const stream of error.condition.streams) stores.writeCache.invalidate(stream.documentId, stream.scope, stream.branch);
+			return {
+				job,
+				success: false,
+				error: error instanceof Error ? error : /* @__PURE__ */ new Error(`Failed to write operation to IOperationStore: ${String(error)}`),
+				duration: Date.now() - startTime
+			};
+		}
+		const head = storedOperations[storedOperations.length - 1];
+		last.updatedDocument.header.revision = {
+			...last.updatedDocument.header.revision,
+			[scope]: head.index + 1
+		};
+		stores.writeCache.putRun(job.documentId, scope, job.branch, storedOperations.map((operation, position) => ({
+			revision: operation.index,
+			document: prepared[position].updatedDocument
+		})));
+		indexTxn.write(storedOperations.map((operation, position) => ({
+			...operation,
+			documentId: job.documentId,
+			documentType,
+			branch: job.branch,
+			scope,
+			sourceRemote: prepared[position].sourceRemote
+		})));
+		if (scope === "auth") for (const write of prepared) indexTxn.recordGroupReferences(job.documentId, mentionedGroupIds(write.action));
+		return {
+			job,
+			success: true,
+			operations: storedOperations,
+			operationsWithContext: storedOperations.map((operation, position) => ({
+				operation,
+				context: {
+					documentId: job.documentId,
+					scope,
+					branch: job.branch,
+					documentType,
+					resultingState: prepared[position].resultingState,
+					ordinal: 0
+				}
+			})),
+			duration: Date.now() - startTime
+		};
+	}
+	/**
+	* Whether a job's writes may share one store transaction.
+	*
+	* Deliberately narrow. Batching changes only how many transactions the
+	* operations arrive in, and every condition below is a case where that would
+	* change something else as well:
+	*
+	* - A document-scope action goes through its own handler, which has its own
+	*   apply and its own reasons for it.
+	* - A positional or replayed run carries skips and re-appended operations,
+	*   whose indices are not a simple ascending run from the head.
+	* - UNDO, REDO and NOOP-with-skip each invalidate the write cache to
+	*   force a full-history rebuild, so they cannot be reduced against state
+	*   threaded from the write before them.
+	* - The auth scope decides later writes against the policy earlier ones
+	*   install, so a batch would decide them all against the policy as it stood
+	*   before the batch.
+	* - The document scope is read by every decision model, so writing it is
+	*   writing part of the read set; the per-write conditions would not agree.
+	*
+	* A run that fails any of these is executed one write at a time, unchanged.
+	*/
+	canBatch(writes, executing) {
+		if (writes.length < 2) return false;
+		if (executing.evaluatedByPosition || executing.replayingAcceptedHistory) return false;
+		const scope = executing.job.scope;
+		if (scope === "auth" || scope === "document") return false;
+		return writes.every((write) => {
+			const type = write.action.type;
+			return write.skip === 0 && write.deniedReason === void 0 && write.sourceOperation === void 0 && !DOCUMENT_SCOPE_ACTIONS.has(type) && !isUndoRedo(write.action) && type !== "NOOP";
+		});
+	}
+	/**
+	* Decides and reduces a run of writes, then persists them together.
+	*
+	* The reduce stays sequential - each action needs the state the one before it
+	* produced - but the result is threaded in memory rather than read back from
+	* the cache, and the whole run reaches the store in a single apply.
+	*
+	* A write that turns out to be denied abandons the batch and replays the run
+	* one write at a time, because a denied write holds a position of its own and
+	* that is the path where the per-write behaviour is load-bearing. A write
+	* that cannot be prepared fails the job outright: preparing is a read, so the
+	* replay would only reach the same failure, and the job leaves nothing behind
+	* either way.
+	*/
+	async executeRegularActionsBatched(writes, executing) {
+		const prepared = [];
+		let carried;
+		let lastYield = performance.now();
+		for (const write of writes) {
+			const outcome = await this.prepareRegularWrite(write, executing, carried);
+			if ("success" in outcome) return outcome;
+			if (outcome.denied) return this.executeRegularActionsSequentially(writes, executing);
+			prepared.push(outcome);
+			carried = outcome.updatedDocument;
+			if (performance.now() - lastYield > this.config.yieldDeadlineMs) {
+				await yieldToMain();
+				lastYield = performance.now();
+				if (executing.signal?.aborted) return buildErrorResult(executing.job, /* @__PURE__ */ new Error("Aborted"), executing.startTime);
+			}
+		}
+		if (!this.conditionsAgree(prepared)) return this.executeRegularActionsSequentially(writes, executing);
+		return this.commitPreparedWrites(prepared, executing);
+	}
+	/** Whether every prepared write carries the same read-set condition. */
+	conditionsAgree(prepared) {
+		const shape = (write) => write.appendCondition === void 0 ? "none" : JSON.stringify([...write.appendCondition.streams].map((stream) => [
+			stream.documentId,
+			stream.scope,
+			stream.branch,
+			stream.revision
+		]).sort());
+		const first = shape(prepared[0]);
+		return prepared.every((write) => shape(write) === first);
+	}
+	/**
+	* The unbatched path, for a run that turned out not to qualify after its
+	* writes were prepared. Nothing has been persisted at that point, so
+	* replaying the whole run per write is safe.
+	*/
+	async executeRegularActionsSequentially(writes, executing) {
+		const operations = [];
+		const contexts = [];
+		let lastYield = performance.now();
+		for (const write of writes) {
+			const result = await this.executeRegularAction(write, executing);
+			if (!result.success) return result;
+			operations.push(...result.operations ?? []);
+			contexts.push(...result.operationsWithContext ?? []);
+			if (performance.now() - lastYield > this.config.yieldDeadlineMs) {
+				await yieldToMain();
+				lastYield = performance.now();
+				if (executing.signal?.aborted) return buildErrorResult(executing.job, /* @__PURE__ */ new Error("Aborted"), executing.startTime);
+			}
+		}
+		return {
+			job: executing.job,
+			success: true,
+			operations,
+			operationsWithContext: contexts,
+			duration: Date.now() - executing.startTime
+		};
+	}
+	/** Decides, reduces and persists one write. */
+	async executeRegularAction(write, executing) {
+		const prepared = await this.prepareRegularWrite(write, executing);
+		if ("success" in prepared) return prepared;
+		return this.commitPreparedWrites([prepared], executing);
+	}
+	/**
+	* Orders a write by timestamp and decides it where it lands. The caller
+	* supplies the timestamp, so a write can belong before operations already
+	* stored; those are re-appended alongside it, the way a load reshuffles.
+	*
+	* Deciding a backdated write at the stream heads instead of at its position
+	* would overwrite the verdict every other replica computes for it.
+	*/
+	async positionByTimestamp(job, stores, signal) {
+		const plain = () => ({
+			writes: job.actions.map((action) => ({
+				action,
+				skip: 0,
+				sourceRemote: ""
+			})),
+			evaluatedByPosition: false
+		});
+		if (!this.featureFlags.documentDecisions || job.actions.length === 0) return plain();
+		let earliest = job.actions[0].timestampUtcMs;
+		let earliestAt = Date.parse(earliest);
+		for (const action of job.actions) {
+			const at = Date.parse(action.timestampUtcMs);
+			if (at < earliestAt) {
+				earliest = action.timestampUtcMs;
+				earliestAt = at;
+			}
+		}
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		const backdated = earliestAt < Date.parse(revisions.latestTimestamp);
+		if (this.featureFlags.authEnforcement && job.scope === "auth") {
+			const newest = await stores.operationStore.getStreamLatestTimestamp(job.documentId, "auth", job.branch, signal);
+			const violation = this.firstNonMonotonicTimestamp(job.actions, newest, job.documentId, job.branch);
+			if (violation) return {
+				writes: [],
+				evaluatedByPosition: false,
+				error: violation
+			};
+			if (!backdated) return plain();
+			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
+		}
+		if (!backdated) return plain();
+		const conflicting = (await stores.operationStore.getConflicting(job.documentId, job.scope, job.branch, earliest, void 0, signal)).results.filter((operation) => !isGenesisOperation(operation));
+		const nothingToMove = async () => {
+			if (!this.featureFlags.authEnforcement) return plain();
+			return this.evaluatePositioned(job, stores, this.appendedOperations(job, revisions.revision[job.scope] ?? 0), signal);
+		};
+		if (conflicting.length === 0) return nothingToMove();
+		const nextIndex = revisions.revision[job.scope] ?? 0;
+		let firstConflicting = conflicting[0].index;
+		for (const operation of conflicting) if (operation.index < firstConflicting) firstConflicting = operation.index;
+		const stored = (await stores.operationStore.getSince(job.documentId, job.scope, job.branch, firstConflicting - 1, void 0, void 0, signal)).results;
+		const conflictingIds = new Set(conflicting.map((operation) => operation.id));
+		const effective = garbageCollect(sortOperations(stored)).filter((operation) => !isGenesisOperation(operation));
+		const firstMoving = effective.findIndex((operation) => conflictingIds.has(operation.id));
+		const moving = firstMoving === -1 ? [] : effective.slice(firstMoving);
+		if (moving.length === 0) return nothingToMove();
+		let firstRetracted = moving[0].index;
+		for (const operation of moving) firstRetracted = Math.min(firstRetracted, operation.index - operation.skip);
+		const incoming = job.actions.map((action, i) => ({
+			id: action.id,
+			index: nextIndex + i,
+			skip: 0,
+			hash: "",
+			timestampUtcMs: action.timestampUtcMs,
+			action
+		}));
+		const merged = reshuffleByTimestamp({
+			index: nextIndex,
+			skip: retractionSkip(nextIndex, firstRetracted)
+		}, moving, incoming);
+		stores.writeCache.invalidate(job.documentId, job.scope, job.branch);
+		if (!this.featureFlags.authEnforcement) return {
+			writes: merged.map((operation) => ({
+				action: operation.action,
+				skip: operation.skip,
+				sourceRemote: ""
+			})),
+			evaluatedByPosition: false
+		};
+		return this.evaluatePositioned(job, stores, merged, signal);
+	}
+	/**
+	* Decides each operation where it lands and carries the verdict on it. A
+	* refused submitted action is reported to the caller and nothing is stored; a
+	* refused operation the reshuffle merely moved keeps its verdict, because it
+	* already holds a position.
+	*
+	* The operations carry the indexes and skips they will be stored at, because
+	* the walk resolves skips before it orders them.
+	*/
+	async evaluatePositioned(job, stores, operations, signal) {
+		const reasons = await evaluateByPosition(this.decisionModel, {
+			documentId: job.documentId,
+			branch: job.branch
+		}, {
+			scope: job.scope,
+			operations
+		}, stores, signal);
+		const submitted = new Set(job.actions.map((action) => action.id));
+		for (let i = 0; i < operations.length; i++) {
+			const reason = reasons[i];
+			if (reason !== void 0 && submitted.has(operations[i].action.id)) return {
+				writes: [],
+				evaluatedByPosition: false,
+				error: refusalError(reason, job.documentId, null, operations[i].action)
+			};
+		}
+		return {
+			writes: operations.map((operation, i) => ({
+				action: operation.action,
+				skip: operation.skip,
+				sourceRemote: "",
+				deniedReason: reasons[i]
+			})),
+			evaluatedByPosition: true
+		};
+	}
+	/**
+	* The scopes a re-evaluation pass visits, in a fixed order.
+	*
+	* The revisions map comes from a query with no ORDER BY, and the order is
+	* load-bearing: each scope's pass re-reads the auth stream, and the walk skips
+	* an operation by its stored denial, so a denial this pass just wrote is
+	* visible to a later-visited scope and invisible to an earlier one. The model's
+	* own projection order leads, then the rest sorted, so the pass is reproducible
+	* across replicas and across runs.
+	*/
+	evaluationOrder(target, revision) {
+		const definition = this.decisionModel(target);
+		const evaluated = Object.keys(revision).filter((scope) => definition.evaluatesScope(scope));
+		const leading = [];
+		for (const stream of staticReadSet(definition)) {
+			const scope = stream.query.scope;
+			if (evaluated.includes(scope) && !leading.includes(scope)) leading.push(scope);
+		}
+		const rest = evaluated.filter((scope) => !leading.includes(scope)).sort((a, b) => a.localeCompare(b));
+		return [...leading, ...rest];
+	}
+	/**
+	* The first timestamp in the batch that does not strictly exceed everything
+	* ahead of it, or undefined when the whole batch is monotonic.
+	*
+	* The bound is carried forward rather than compared against one stored maximum,
+	* because a single execute can carry several auth actions stamped in the same
+	* millisecond. Letting a tie through would store a stream the position walk
+	* then refuses to read, with no repair path.
+	*/
+	firstNonMonotonicTimestamp(entries, newest, documentId, branch) {
+		let boundIso = newest;
+		let bound = newest === void 0 ? Number.NEGATIVE_INFINITY : Date.parse(newest);
+		for (const entry of entries) {
+			if (!isValidISOTimestamp(entry.timestampUtcMs)) return new InvalidOperationTimestampError(documentId, "auth", entry.timestampUtcMs, "auth operation");
+			const at = Date.parse(entry.timestampUtcMs);
+			if (boundIso !== void 0 && at <= bound) return new AuthTimestampNotMonotonicError(documentId, branch, entry.timestampUtcMs, boundIso);
+			bound = at;
+			boundIso = entry.timestampUtcMs;
+		}
+	}
+	/** The operations a batch of submitted actions appends at the scope's tail. */
+	appendedOperations(job, nextIndex) {
+		return job.actions.map((action, i) => ({
+			id: action.id,
+			index: nextIndex + i,
+			skip: 0,
+			hash: "",
+			timestampUtcMs: action.timestampUtcMs,
+			action
+		}));
+	}
+	/**
+	* Re-evaluates the document when a write meets both criteria: it was written
+	* to a stream the model reads, and it is timestamped before an operation
+	* already stored. The caller supplies the timestamp and the reactor does not replace
+	* it, so a mutation job can write such an operation just as a load job can,
+	* which is why both executeJob and executeLoadJob call this.
+	*/
+	async reevaluateIfCriteriaMet(criteria, executing) {
+		if (!this.featureFlags.documentDecisions) return;
+		const { job, stores, signal } = executing;
+		const target = {
+			documentId: job.documentId,
+			branch: job.branch
+		};
+		if (!staticReadSet(this.decisionModel(target)).some((stream) => stream.query.documentId === job.documentId && stream.query.scope === criteria.scope && stream.query.branch === job.branch)) return;
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		const latest = Date.parse(revisions.latestTimestamp);
+		if (!criteria.operations.some((operation) => Date.parse(operation.timestampUtcMs) < latest)) return;
+		return (await this.reevaluateDocument(executing)).error;
+	}
+	/**
+	* Re-evaluates every scope the model evaluates. Where an operation's
+	* evaluation differs from what is stored, the tail from that operation is
+	* re-appended, carrying a skip that spans the indices it supersedes.
+	*/
+	async reevaluateDocument(executing) {
+		const { job, stores, signal } = executing;
+		const target = {
+			documentId: job.documentId,
+			branch: job.branch
+		};
+		const reappended = [];
+		const revisions = await stores.operationStore.getRevisions(job.documentId, job.branch, signal);
+		for (const scope of this.evaluationOrder(target, revisions.revision)) {
+			const stored = (await stores.operationStore.getSince(job.documentId, scope, job.branch, -1, void 0, void 0, signal)).results;
+			const effective = garbageCollect(sortOperations([...stored]));
+			if (effective.length === 0) continue;
+			const reevaluated = await evaluateByPosition(this.decisionModel, target, {
+				scope,
+				operations: effective
+			}, stores, signal);
+			const firstChange = effective.findIndex((operation, i) => operation.deniedReason !== reevaluated[i]);
+			if (firstChange === -1) continue;
+			const tail = effective.slice(firstChange);
+			const nextIndex = revisions.revision[scope];
+			stores.writeCache.invalidate(job.documentId, scope, job.branch);
+			const result = await this.processActions(tail.map((operation, i) => ({
+				action: operation.action,
+				skip: i === 0 ? retractionSkip(nextIndex, tail[0].index - tail[0].skip) : 0,
+				sourceRemote: "",
+				deniedReason: reevaluated[firstChange + i]
+			})), {
+				...executing,
+				job: {
+					...job,
+					scope
+				},
+				replayingAcceptedHistory: true,
+				evaluatedByPosition: true
+			});
+			if (!result.success) return {
+				error: result.error ?? /* @__PURE__ */ new Error(`Re-evaluation of ${job.documentId} ${scope} failed`),
+				operationsWithContext: reappended
+			};
+			reappended.push(...result.operationsWithContext);
+		}
+		return { operationsWithContext: reappended };
+	}
+	/**
+	* Re-judges a document's stored operations because a read-set stream in
+	* another document (a group) gained an operation. The trigger timestamp
+	* bounds the work: an operation later than everything this document holds
+	* cannot change any evaluation, so the pass is skipped.
+	*/
+	async executeReevaluationJob(executing) {
+		const { job, startTime, stores, signal } = executing;
+		if (!this.featureFlags.documentDecisions) return {
+			job,
+			success: true,
+			operations: [],
+			operationsWithContext: [],
+			duration: Date.now() - startTime
+		};
+		const trigger = job.meta.triggerTimestampUtcMs;
+		if (typeof trigger === "string") {
+			let latestTimestamp;
+			try {
+				latestTimestamp = (await stores.operationStore.getRevisions(job.documentId, job.branch, signal)).latestTimestamp;
+			} catch {
+				return {
+					job,
+					success: true,
+					operations: [],
+					operationsWithContext: [],
+					duration: Date.now() - startTime
+				};
+			}
+			if (Date.parse(trigger) > Date.parse(latestTimestamp)) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
+		}
+		const outcome = await this.reevaluateDocument(executing);
+		if (outcome.error) return buildErrorResult(job, outcome.error, startTime);
+		return {
+			job,
+			success: true,
+			operations: outcome.operationsWithContext.map((owc) => owc.operation),
+			operationsWithContext: outcome.operationsWithContext,
+			duration: Date.now() - startTime
+		};
+	}
+	async executeLoadJob(executing) {
+		const { job, startTime, indexTxn, stores, signal } = executing;
+		if (job.operations.length === 0) return buildErrorResult(job, /* @__PURE__ */ new Error("Load job must include at least one operation"), startTime);
+		let docMeta;
+		try {
+			docMeta = await stores.documentMetaCache.getDocumentMeta(job.documentId, job.branch, signal);
+		} catch {}
+		if (docMeta?.state.isDeleted && !this.featureFlags.documentDecisions) return buildErrorResult(job, new DocumentDeletedError(job.documentId, docMeta.state.deletedAtUtcIso), startTime);
+		const scope = job.scope;
+		const monotonicAuthStream = this.featureFlags.authEnforcement && scope === "auth";
+		let latestRevision;
+		try {
+			latestRevision = (await stores.operationStore.getRevisions(job.documentId, job.branch, signal)).revision[scope] ?? 0;
+		} catch {
+			latestRevision = 0;
+		}
+		for (const operation of job.operations) if (operation.timestampUtcMs && !isValidISOTimestamp(operation.timestampUtcMs)) return {
+			job,
+			success: false,
+			error: new InvalidOperationTimestampError(job.documentId, scope, operation.timestampUtcMs, `operation (index: ${operation.index})`),
+			duration: Date.now() - startTime
+		};
+		const dropped = /* @__PURE__ */ new Set();
+		const admitted = /* @__PURE__ */ new Set();
+		let selection = await this.selectLoadWrites(job, job.operations, stores, signal);
+		for (;;) {
+			const unadmitted = selection.incomingOpsToApply.filter((operation) => !admitted.has(operation));
+			if (unadmitted.length === 0) break;
+			let refused;
+			try {
+				refused = await this.signatureAdmission.admitLoad(job, unadmitted, stores, signal);
+			} catch (error) {
+				return buildErrorResult(job, error instanceof Error ? error : new Error(String(error)), startTime);
+			}
+			for (const operation of unadmitted) if (refused.has(operation)) dropped.add(operation);
+			else admitted.add(operation);
+			if (refused.size === 0) break;
+			const remaining = job.operations.filter((operation) => !dropped.has(operation));
+			if (remaining.length === 0) return {
+				job,
+				success: true,
+				operations: [],
+				operationsWithContext: [],
+				duration: Date.now() - startTime
+			};
+			selection = await this.selectLoadWrites(job, remaining, stores, signal);
+		}
+		const { nonSupersededOps, allOpsFromMinConflictingIndex, incomingOpsToApply } = selection;
+		if (incomingOpsToApply.length === 0) return {
+			job,
+			success: true,
+			operations: [],
+			operationsWithContext: [],
+			duration: Date.now() - startTime
+		};
+		const existingOpsToReshuffle = monotonicAuthStream ? [] : nonSupersededOps.filter((operation) => !isGenesisOperation(operation));
+		const actionIdCounts = /* @__PURE__ */ new Map();
+		for (const operation of allOpsFromMinConflictingIndex) actionIdCounts.set(operation.action.id, (actionIdCounts.get(operation.action.id) ?? 0) + 1);
+		const reshuffleCost = existingOpsToReshuffle.filter((operation) => (actionIdCounts.get(operation.action.id) ?? 0) < 2).length;
+		if (reshuffleCost > this.config.maxSkipThreshold) return {
+			job,
+			success: false,
+			error: new ExcessiveReshuffleError(job.documentId, scope, reshuffleCost, this.config.maxSkipThreshold),
+			duration: Date.now() - startTime
+		};
+		let skipCount = existingOpsToReshuffle.length;
+		if (existingOpsToReshuffle.length > 0) {
+			let minLogicalIndex = Number.POSITIVE_INFINITY;
+			for (const op of existingOpsToReshuffle) {
+				const logical = op.index - op.skip;
+				if (logical < minLogicalIndex) minLogicalIndex = logical;
+			}
+			const logicalSkip = latestRevision - minLogicalIndex;
+			if (logicalSkip > skipCount) skipCount = logicalSkip;
+		}
+		if (monotonicAuthStream) {
+			const newest = await stores.operationStore.getStreamLatestTimestamp(job.documentId, "auth", job.branch, signal);
+			const violation = this.firstNonMonotonicTimestamp([...incomingOpsToApply].sort((a, b) => a.index - b.index), newest, job.documentId, job.branch);
+			if (violation) return {
+				job,
+				success: false,
+				error: violation,
+				duration: Date.now() - startTime
+			};
+		}
+		const reshuffledOperations = existingOpsToReshuffle.length === 0 && skipCount === 0 ? incomingOpsToApply.slice().sort((a, b) => a.index - b.index).map((operation, i) => ({
+			...operation,
+			index: latestRevision + i
+		})) : reshuffleByTimestamp({
+			index: latestRevision,
+			skip: skipCount
+		}, existingOpsToReshuffle, incomingOpsToApply.map((operation) => ({
+			...operation,
+			id: operation.id
+		})));
+		const incomingIds = new Set(incomingOpsToApply.map((operation) => operation.action.id));
+		for (const operation of reshuffledOperations) if (operation.action.type === "NOOP" && operation.skip === 0 && incomingIds.has(operation.action.id)) operation.skip = 1;
+		let deniedReasons;
+		if (this.featureFlags.documentDecisions) try {
+			deniedReasons = await evaluateByPosition(this.decisionModel, {
+				documentId: job.documentId,
+				branch: job.branch
+			}, {
+				scope,
+				operations: reshuffledOperations
+			}, stores, signal);
+		} catch (error) {
+			return {
+				job,
+				success: false,
+				error: error instanceof Error ? error : new Error(String(error)),
+				duration: Date.now() - startTime
+			};
+		}
+		const effectiveSourceRemote = skipCount > 0 ? "" : job.meta.sourceRemote || "";
+		const result = await this.processActions(reshuffledOperations.map((operation, i) => ({
+			action: operation.action,
+			skip: operation.skip,
+			sourceOperation: operation,
+			sourceRemote: effectiveSourceRemote,
+			deniedReason: deniedReasons?.[i]
+		})), executing);
+		if (!result.success) return {
+			job,
+			success: false,
+			error: result.error,
+			duration: Date.now() - startTime
+		};
+		stores.writeCache.invalidate(job.documentId, scope, job.branch);
+		if (scope === "document") stores.documentMetaCache.invalidate(job.documentId, job.branch);
+		const reevaluationError = await this.reevaluateIfCriteriaMet({
+			scope,
+			operations: result.generatedOperations
+		}, executing);
+		if (reevaluationError) return {
+			job,
+			success: false,
+			error: reevaluationError,
+			duration: Date.now() - startTime
+		};
+		return {
+			job,
+			success: true,
+			operations: result.generatedOperations,
+			operationsWithContext: result.operationsWithContext,
+			duration: Date.now() - startTime
+		};
+	}
+	/** The conflicting window a load opens, and which of its operations are new. */
+	async selectLoadWrites(job, operations, stores, signal) {
+		const scope = job.scope;
+		let minIncomingIndex = Number.POSITIVE_INFINITY;
+		let minIncomingTimestamp = operations[0]?.timestampUtcMs || "";
+		for (const operation of operations) {
+			minIncomingIndex = Math.min(minIncomingIndex, operation.index);
+			const ts = operation.timestampUtcMs || "";
+			if (Date.parse(ts) < Date.parse(minIncomingTimestamp)) minIncomingTimestamp = ts;
+		}
+		let conflictingOps;
+		try {
+			conflictingOps = (await stores.operationStore.getConflicting(job.documentId, scope, job.branch, minIncomingTimestamp, void 0, signal)).results;
+		} catch {
+			conflictingOps = [];
+		}
+		let allOpsFromMinConflictingIndex = conflictingOps;
+		if (conflictingOps.length > 0) {
+			const minConflictingIndex = Math.min(...conflictingOps.map((op) => op.index));
+			try {
+				allOpsFromMinConflictingIndex = (await stores.operationStore.getSince(job.documentId, scope, job.branch, minConflictingIndex - 1, void 0, void 0, signal)).results;
+			} catch {
+				allOpsFromMinConflictingIndex = conflictingOps;
+			}
+		}
+		const incomingActionIds = new Set(operations.map((op) => op.action.id));
+		const supersededBy = (op) => {
+			let nearest;
+			for (const laterOp of allOpsFromMinConflictingIndex) if (laterOp.index > op.index && laterOp.skip > 0 && laterOp.index - laterOp.skip <= op.index && (nearest === void 0 || laterOp.index < nearest.index)) nearest = laterOp;
+			return nearest;
+		};
+		const undoneActionIds = /* @__PURE__ */ new Set();
+		let predecessorBound = minIncomingIndex;
+		const rowsByActionId = /* @__PURE__ */ new Map();
+		for (const op of conflictingOps) if (incomingActionIds.has(op.action.id)) rowsByActionId.set(op.action.id, [...rowsByActionId.get(op.action.id) ?? [], op]);
+		const liveOps = /* @__PURE__ */ new Set();
+		for (const op of conflictingOps) if (supersededBy(op) === void 0) liveOps.add(op);
+		for (const [actionId, rows] of rowsByActionId) {
+			if (rows.some((row) => liveOps.has(row))) continue;
+			if (rows.some((row) => supersededBy(row)?.action.type === "NOOP")) undoneActionIds.add(actionId);
+			else predecessorBound = Math.min(predecessorBound, Math.max(...rows.map((row) => row.index)));
+		}
+		const nonSupersededOps = conflictingOps.filter((op) => {
+			if (op.index < predecessorBound && !incomingActionIds.has(op.action.id)) return false;
+			return liveOps.has(op);
+		});
+		let rewoundFrom = Number.POSITIVE_INFINITY;
+		for (const op of nonSupersededOps) if (!isGenesisOperation(op)) rewoundFrom = Math.min(rewoundFrom, op.index - op.skip);
+		const reappended = new Set(nonSupersededOps.map((op) => op.index));
+		for (const op of allOpsFromMinConflictingIndex) if (op.index >= rewoundFrom && !reappended.has(op.index) && supersededBy(op) === void 0) nonSupersededOps.push(op);
+		const existingActionIds = new Set(nonSupersededOps.map((op) => op.action.id));
+		const seenIncomingActionIds = /* @__PURE__ */ new Set();
+		const incomingOpsToApply = operations.filter((op) => {
+			if (existingActionIds.has(op.action.id)) return false;
+			if (undoneActionIds.has(op.action.id)) return false;
+			if (seenIncomingActionIds.has(op.action.id)) return false;
+			seenIncomingActionIds.add(op.action.id);
+			return true;
+		});
+		return {
+			nonSupersededOps,
+			allOpsFromMinConflictingIndex,
+			incomingOpsToApply
+		};
+	}
+	accumulateResultOrReturnError(result, generatedOperations, operationsWithContext) {
+		if (!result.success) return result;
+		if (result.operations && result.operations.length > 0) generatedOperations.push(...result.operations);
+		if (result.operationsWithContext) operationsWithContext.push(...result.operationsWithContext);
+		return null;
+	}
+};
+//#endregion
+//#region src/core/drive-container-types.ts
+const DEFAULT_DRIVE_CONTAINER_TYPES = /* @__PURE__ */ new Set(["powerhouse/document-drive", "powerhouse/reactor-drive"]);
+//#endregion
+export { PropagationMode as C, JobStatus as S, cursorProtectedLoadMeta as T, selectDecisionModel as _, NoopStorageFlusher as a, buildDecisionModel as b, DEFAULT_PURGE_DELETE_BATCH as c, resolveFeatureFlags as d, DEFAULT_DEFERRED_JOB_TTL_MS as f, decideAtHead as g, JobExecutorEventTypes as h, PassthroughSigner as i, KyselyDocumentPurger as l, DEFAULT_MAX_PURGE_OPERATIONS as m, SimpleJobExecutor as n, StoragePoisonedError as o, DEFAULT_JOB_TIMEOUT_MS as p, verifyActionSignature as r, KyselyExecutionScope as s, DEFAULT_DRIVE_CONTAINER_TYPES as t, appliedDelete as u, documentDecisionModel as v, RelationshipChangeType as w, DriveCollectionId as x, authDecisionModel as y };
+
+//# sourceMappingURL=drive-container-types-BAfFzBOf.js.map