@powerhousedao/reactor 6.2.3-dev.5 → 6.2.3-dev.51

package/dist/forwarding-logger-B9LLXItm.js

@@ -0,0 +1,3667 @@
+import { DOCUMENT_DELETED_REASON, DOCUMENT_SCOPE_ACTION_TYPES, PURGE_DOCUMENT, appendWithoutApplying, applyDeleteDocumentAction, applyDeleteDocumentAction as applyDeleteDocumentAction$1, applyUpgradeDocumentAction, applyUpgradeDocumentAction as applyUpgradeDocumentAction$1, baseReducerVersion, createDocumentState, createPresignedHeader, defaultBaseState, deriveOperationId, isDenied, isPurgeMarker, mentionedGroupIds, normalizeDocumentModelVersion, operationOutcome, purgedProtocolVersions, targetDocumentId, withProtocolVersions } from "@powerhousedao/shared/document-model";
+import { v4 } from "uuid";
+import { Migrator, TableNode, sql } from "kysely";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/shared/utils.ts
+function matchesScope(view = {}, scope) {
+	if (view.scopes) return view.scopes.includes(scope);
+	return true;
+}
+function yieldToMain() {
+	const s = globalThis.scheduler;
+	if (s?.yield) return s.yield();
+	return new Promise((resolve) => setTimeout(resolve, 0));
+}
+const defaultAbortError = () => /* @__PURE__ */ new Error("Operation aborted");
+function throwIfAborted(signal, makeError = defaultAbortError) {
+	if (signal?.aborted) throw makeError();
+}
+const TIMED_OUT = Symbol("deadline-expired");
+/** Races a call that cannot be cancelled; on {@link TIMED_OUT} the call may still settle later. */
+async function withDeadline(pending, timeoutMs) {
+	let handle;
+	const expiry = new Promise((resolve) => {
+		handle = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+	});
+	try {
+		return await Promise.race([pending, expiry]);
+	} finally {
+		clearTimeout(handle);
+	}
+}
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* Validates PagingOptions and returns a normalized offset and limit.
+* Throws if the cursor is not empty and not a non-negative integer, or if
+* limit is less than 1. When `paging` is undefined, returns offset 0 and
+* the caller-supplied `defaultLimit`.
+*/
+function parsePagingOptions(paging, defaultLimit) {
+	if (paging === void 0) return {
+		offset: 0,
+		limit: defaultLimit
+	};
+	if (!Number.isInteger(paging.limit) || paging.limit < 1) throw new Error(`Invalid paging limit: ${String(paging.limit)} (must be an integer >= 1)`);
+	if (paging.cursor === "") return {
+		offset: 0,
+		limit: paging.limit
+	};
+	const parsed = Number(paging.cursor);
+	if (!Number.isInteger(parsed) || parsed < 0) throw new Error(`Invalid paging cursor: ${JSON.stringify(paging.cursor)} (must be empty or a non-negative integer)`);
+	return {
+		offset: parsed,
+		limit: paging.limit
+	};
+}
+//#endregion
+//#region src/events/types.ts
+/**
+* Custom error class that aggregates multiple errors from event subscribers.
+*/
+var EventBusAggregateError = class extends Error {
+	errors;
+	constructor(errors) {
+		const message = `EventBus emit failed with ${errors.length} error(s): ${errors.map((e) => {
+			if (e && typeof e === "object" && "message" in e) return e.message;
+			return String(e);
+		}).join("; ")}`;
+		super(message);
+		this.name = "EventBusAggregateError";
+		this.errors = errors;
+	}
+};
+/**
+* Event types for reactor lifecycle events.
+*/
+const ReactorEventTypes = {
+	JOB_PENDING: 10001,
+	JOB_RUNNING: 10002,
+	JOB_WRITE_READY: 10003,
+	JOB_READ_READY: 10004,
+	JOB_FAILED: 10005,
+	READMODEL_BATCH_COMPLETED: 10006,
+	READMODEL_INDEXED: 10007,
+	MODEL_LOADED: 10008,
+	SIGNATURE_REFUSED: 10009,
+	CATCHUP_SWEPT: 10010
+};
+//#endregion
+//#region src/shared/errors.ts
+/**
+* Error thrown when attempting to access a deleted document.
+*/
+/** The error name on a job the reactor does not know. */
+const JOB_NOT_FOUND_ERROR_NAME = "JobNotFoundError";
+var DocumentDeletedError = class DocumentDeletedError extends Error {
+	documentId;
+	deletedAtUtcIso;
+	constructor(documentId, deletedAtUtcIso = null) {
+		const message = deletedAtUtcIso ? `Document ${documentId} was deleted at ${deletedAtUtcIso}` : `Document ${documentId} has been deleted`;
+		super(message);
+		this.name = "DocumentDeletedError";
+		this.documentId = documentId;
+		this.deletedAtUtcIso = deletedAtUtcIso;
+		Error.captureStackTrace(this, DocumentDeletedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DocumentDeletedError";
+	}
+};
+/**
+* Error thrown when the auth policy denies an action at the executor gate.
+*/
+var AuthorizationDeniedError = class AuthorizationDeniedError extends Error {
+	documentId;
+	scope;
+	operation;
+	subject;
+	constructor(documentId, scope, operation, subject) {
+		super(`Authorization denied: ${subject ?? "anonymous"} may not execute ${operation} in scope "${scope}" of document ${documentId}`);
+		this.name = "AuthorizationDeniedError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.operation = operation;
+		this.subject = subject;
+		Error.captureStackTrace(this, AuthorizationDeniedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthorizationDeniedError";
+	}
+};
+/**
+* An auth operation did not strictly exceed the newest timestamp in its stream.
+*
+* Terminal and asymmetric by design: no ordering rule can reconcile two replicas
+* that each accepted an auth operation offline, because either order hands one
+* authority the other never granted, so the replica ahead holds the arrival.
+*/
+var AuthTimestampNotMonotonicError = class AuthTimestampNotMonotonicError extends Error {
+	documentId;
+	branch;
+	timestampUtcMs;
+	newestTimestampUtcMs;
+	constructor(documentId, branch, timestampUtcMs, newestTimestampUtcMs) {
+		super(`Auth timestamp not monotonic: ${timestampUtcMs} does not exceed ${newestTimestampUtcMs} in the auth stream of document ${documentId} on branch ${branch}`);
+		this.name = "AuthTimestampNotMonotonicError";
+		this.documentId = documentId;
+		this.branch = branch;
+		this.timestampUtcMs = timestampUtcMs;
+		this.newestTimestampUtcMs = newestTimestampUtcMs;
+		Error.captureStackTrace(this, AuthTimestampNotMonotonicError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthTimestampNotMonotonicError";
+	}
+};
+/**
+* An operation or action carried a timestamp that is not an ISO-8601 UTC
+* instant.
+*
+* Terminal rather than retryable: the value does not change between attempts,
+* so a retry re-runs the whole job to fail identically. Quarantining, unlike a
+* held auth operation — this is malformed data rather than two replicas
+* disagreeing, and nothing further from that source should be trusted until it
+* is looked at.
+*/
+var InvalidOperationTimestampError = class InvalidOperationTimestampError extends Error {
+	documentId;
+	scope;
+	timestampUtcMs;
+	constructor(documentId, scope, timestampUtcMs, context) {
+		super(`Invalid timestamp "${timestampUtcMs}" on ${context} in scope "${scope}" of document ${documentId}`);
+		this.name = "InvalidOperationTimestampError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.timestampUtcMs = timestampUtcMs;
+		Error.captureStackTrace(this, InvalidOperationTimestampError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidOperationTimestampError";
+	}
+};
+/** A document requires a protocol version this reactor does not run. Terminal. */
+var UnsupportedProtocolVersionError = class UnsupportedProtocolVersionError extends Error {
+	documentId;
+	protocol;
+	version;
+	constructor(documentId, protocol, version) {
+		super(`Document ${documentId} requires ${protocol} ${version}, which this reactor does not support`);
+		this.name = "UnsupportedProtocolVersionError";
+		this.documentId = documentId;
+		this.protocol = protocol;
+		this.version = version;
+		Error.captureStackTrace(this, UnsupportedProtocolVersionError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedProtocolVersionError";
+	}
+};
+/**
+* A load would move more operations than the bound allows, indicating a real
+* divergence between local and incoming history. Counts only first-time moves,
+* so a re-evaluation pass's re-appends do not make busy documents
+* revocation-proof. Terminal: the condition is deterministic.
+*/
+var ExcessiveReshuffleError = class ExcessiveReshuffleError extends Error {
+	documentId;
+	scope;
+	count;
+	threshold;
+	constructor(documentId, scope, count, threshold) {
+		super(`Excessive reshuffle detected: ${count} operations in scope "${scope}" of document ${documentId} exceeds the threshold of ${threshold}. This indicates a significant divergence between local and incoming operations.`);
+		this.name = "ExcessiveReshuffleError";
+		this.documentId = documentId;
+		this.scope = scope;
+		this.count = count;
+		this.threshold = threshold;
+		Error.captureStackTrace(this, ExcessiveReshuffleError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ExcessiveReshuffleError";
+	}
+};
+/** The message carries the code: only name and message cross the queue. */
+var InvalidSignatureError = class InvalidSignatureError extends Error {
+	documentId;
+	code;
+	reason;
+	constructor(documentId, code, reason) {
+		super(`Invalid signature in document ${documentId} [${code}]: ${reason}`);
+		this.name = "InvalidSignatureError";
+		this.documentId = documentId;
+		this.code = code;
+		this.reason = reason;
+		Error.captureStackTrace(this, InvalidSignatureError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "InvalidSignatureError";
+	}
+};
+/**
+* An UPGRADE_DOCUMENT action's preconditions (fromVersion and the per-scope
+* revision snapshot) did not match the document state the executor loaded.
+*
+* Terminal rather than retryable: the action carries the client's snapshot,
+* which stays stale no matter how often the job re-runs. The client is
+* expected to re-read the document and submit a fresh action instead.
+*/
+var UpgradePreconditionFailedError = class UpgradePreconditionFailedError extends Error {
+	documentId;
+	detail;
+	constructor(documentId, detail) {
+		super(`Upgrade precondition failed for document ${documentId}: ${detail}`);
+		this.name = "UpgradePreconditionFailedError";
+		this.documentId = documentId;
+		this.detail = detail;
+		Error.captureStackTrace(this, UpgradePreconditionFailedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UpgradePreconditionFailedError";
+	}
+};
+/**
+* Error thrown when a document is not found (no operations exist for the document ID).
+*/
+var DocumentNotFoundError = class DocumentNotFoundError extends Error {
+	documentId;
+	/**
+	* @param message Overrides the default text. A handler that knows which of
+	* several documents an action reads - a relationship's source, say - says so
+	* here rather than rewrapping in a bare Error, which would strip the name the
+	* executor classifies by.
+	*/
+	constructor(documentId, message) {
+		super(message ?? `Document ${documentId} not found`);
+		this.name = "DocumentNotFoundError";
+		this.documentId = documentId;
+		Error.captureStackTrace(this, DocumentNotFoundError);
+	}
+	/** Also true for DocumentPurgedError: only the name crosses the queue. */
+	static isError(error) {
+		return Error.isError(error) && (error.name === "DocumentNotFoundError" || error.name === "DocumentPurgedError");
+	}
+};
+/** The document was purged; readers treat it as absent. Terminal. */
+var DocumentPurgedError = class DocumentPurgedError extends DocumentNotFoundError {
+	purged = true;
+	constructor(documentId, message) {
+		super(documentId, message ?? `Document ${documentId} was purged`);
+		this.name = "DocumentPurgedError";
+		Error.captureStackTrace(this, DocumentPurgedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DocumentPurgedError";
+	}
+};
+/** A purge was asked for a document that is not deleted. Terminal. */
+var DocumentNotDeletedError = class DocumentNotDeletedError extends Error {
+	documentId;
+	constructor(documentId, message) {
+		super(message ?? `Document ${documentId} is not deleted`);
+		this.name = "DocumentNotDeletedError";
+		this.documentId = documentId;
+		Error.captureStackTrace(this, DocumentNotDeletedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DocumentNotDeletedError";
+	}
+};
+/** A surviving document's accepted auth history names the group. Terminal. */
+var GroupInUseError = class GroupInUseError extends Error {
+	groupId;
+	referencingDocumentIds;
+	constructor(groupId, referencingDocumentIds) {
+		super(`Group ${groupId} cannot be purged: the auth history of ${referencingDocumentIds.join(", ")} names it`);
+		this.name = "GroupInUseError";
+		this.groupId = groupId;
+		this.referencingDocumentIds = referencingDocumentIds;
+		Error.captureStackTrace(this, GroupInUseError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "GroupInUseError";
+	}
+};
+/** A purge above maxPurgeOperations without allowLarge. Terminal. */
+var PurgeTooLargeError = class PurgeTooLargeError extends Error {
+	documentId;
+	operationCount;
+	maxPurgeOperations;
+	constructor(documentId, operationCount, maxPurgeOperations) {
+		super(`Document ${documentId} has ${operationCount} operations, above the purge limit of ${maxPurgeOperations}; request it with allowLarge`);
+		this.name = "PurgeTooLargeError";
+		this.documentId = documentId;
+		this.operationCount = operationCount;
+		this.maxPurgeOperations = maxPurgeOperations;
+		Error.captureStackTrace(this, PurgeTooLargeError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "PurgeTooLargeError";
+	}
+};
+/** A regular write carried an action type only the reactor issues. Terminal. */
+var ReservedActionError = class ReservedActionError extends Error {
+	documentId;
+	actionType;
+	constructor(documentId, actionType) {
+		super(`Action ${actionType} is reserved and cannot be submitted to document ${documentId}`);
+		this.name = "ReservedActionError";
+		this.documentId = documentId;
+		this.actionType = actionType;
+		Error.captureStackTrace(this, ReservedActionError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "ReservedActionError";
+	}
+};
+/**
+* An authorization preflight was asked for while the reactor's decision model
+* is off, so there is no model to answer from.
+*
+* Thrown rather than answered from the legacy host-side permission tables. The
+* two systems do not compose: the tables record which addresses a host lets
+* near a drive, the policy records what a document's own grants permit, and an
+* answer stitched from both would report an admission verdict neither system
+* would reach. A caller that cannot get a prediction disables nothing, which
+* leaves the submit path -- and its real gate -- as the only authority.
+*
+* Detection is by `name`, not `instanceof`: the SharedWorker RPC boundary
+* rebuilds a thrown error from `{ name, message, stack, cause }` alone
+* (`reactor-browser/src/rpc/error-info.ts`), so the class identity and any
+* custom field are lost in transit. This error therefore carries no fields.
+*/
+var AuthEnforcementDisabledError = class AuthEnforcementDisabledError extends Error {
+	constructor() {
+		super("Authorization evaluation requires the authEnforcement feature flag; this reactor holds no decision model, and the legacy host-table permission system cannot answer for one");
+		this.name = "AuthEnforcementDisabledError";
+		Error.captureStackTrace(this, AuthEnforcementDisabledError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AuthEnforcementDisabledError";
+	}
+};
+/**
+* Error thrown when a relationship edge an operation names does not exist.
+*
+* Detection is by `name`, not `instanceof`: the SharedWorker RPC boundary
+* rebuilds a thrown error from `{ name, message, stack, cause }` alone
+* (`reactor-browser/src/rpc/error-info.ts`), so the class identity is lost in
+* transit.
+*/
+var RelationshipNotFoundError = class RelationshipNotFoundError extends Error {
+	sourceId;
+	targetId;
+	relationshipType;
+	constructor(sourceId, targetId, relationshipType) {
+		super(`No ${relationshipType} relationship from ${sourceId} to ${targetId}`);
+		this.name = "RelationshipNotFoundError";
+		this.sourceId = sourceId;
+		this.targetId = targetId;
+		this.relationshipType = relationshipType;
+		Error.captureStackTrace(this, RelationshipNotFoundError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "RelationshipNotFoundError";
+	}
+};
+/** The store holds documents at protocol versions this reactor does not run. */
+var UnsupportedStoredProtocolError = class UnsupportedStoredProtocolError extends Error {
+	versions;
+	documents;
+	constructor(versions, documents) {
+		const named = versions.map(({ protocol, version }) => `${protocol} ${version}`).join(", ");
+		super(`${documents} stored document(s) require ${named}, which this reactor does not run. Start a build that runs them, or accept them read-only with withUnsupportedStoredDocuments("read-only")`);
+		this.name = "UnsupportedStoredProtocolError";
+		this.versions = versions;
+		this.documents = documents;
+		Error.captureStackTrace(this, UnsupportedStoredProtocolError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "UnsupportedStoredProtocolError";
+	}
+};
+/**
+* A batch job failed. A batch is not atomic, so `jobs` holds every job's final
+* state, keyed by plan key; `cause` carries the failed job's own error name.
+*
+* The SharedWorker RPC boundary rebuilds a thrown error from `{ name, message,
+* stack, cause }` alone (`src/rpc/error-info.ts`), so `key` and
+* `jobs` do not survive it. `isError` therefore checks for them, not only the
+* name; across that boundary, classify by the `cause` chain's names instead.
+*/
+var BatchJobFailedError = class BatchJobFailedError extends Error {
+	key;
+	jobs;
+	constructor(key, jobs) {
+		const failure = jobs[key].error;
+		const cause = new Error(failure?.message ?? "Job failed");
+		cause.name = failure?.name ?? "Error";
+		super(failure?.message ?? "Job failed", { cause });
+		this.name = "BatchJobFailedError";
+		this.key = key;
+		this.jobs = jobs;
+		Error.captureStackTrace(this, BatchJobFailedError);
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "BatchJobFailedError" && typeof error.key === "string" && typeof error.jobs === "object";
+	}
+};
+//#endregion
+//#region src/storage/interfaces.ts
+/**
+* Thrown when an operation with the same identity already exists in the store.
+*/
+var DuplicateOperationError = class extends Error {
+	constructor(description) {
+		super(`Duplicate operation: ${description}`);
+		this.name = "DuplicateOperationError";
+	}
+};
+/**
+* Thrown when a concurrent write conflict is detected during an atomic apply.
+*/
+var OptimisticLockError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OptimisticLockError";
+	}
+};
+/**
+* Thrown when the caller-provided revision does not match the current
+* stored revision, indicating a stale read.
+*/
+var RevisionMismatchError = class extends Error {
+	constructor(expected, actual) {
+		super(`Revision mismatch: expected ${expected}, got ${actual}`);
+		this.name = "RevisionMismatchError";
+	}
+};
+/**
+* A create based on an empty stream that already has operations: the id is
+* taken, and no retry can resolve it. Matched by `name`, all the RPC boundary keeps.
+*/
+var DocumentAlreadyExistsError = class extends Error {
+	documentId;
+	constructor(documentId, scope, headRevision) {
+		super(`Document ${documentId} already exists: create requested revision 0 but the "${scope}" stream is at revision ${headRevision}`);
+		this.name = "DocumentAlreadyExistsError";
+		this.documentId = documentId;
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "DocumentAlreadyExistsError";
+	}
+};
+/** Error history keeps messages, not classes, so failures match by prefix. */
+const APPEND_CONDITION_FAILED_PREFIX = "Append condition failed: ";
+/**
+* A read-set stream grew before the append committed. A concurrency
+* conflict, not a fault: the caller retries against the new stream heads.
+*/
+var AppendConditionFailedError = class extends Error {
+	condition;
+	constructor(condition) {
+		const streams = condition.streams.map((s) => `${s.documentId}:${s.scope}:${s.branch}@${s.revision}`).join(", ");
+		super(`${APPEND_CONDITION_FAILED_PREFIX}a read-set stream advanced [${streams}]`);
+		this.condition = condition;
+		this.name = "AppendConditionFailedError";
+	}
+	static isError(error) {
+		return Error.isError(error) && error.name === "AppendConditionFailedError";
+	}
+	/** True when a recorded error message is an append-condition failure. */
+	static isFailureMessage(message) {
+		return message.startsWith(APPEND_CONDITION_FAILED_PREFIX);
+	}
+};
+/**
+* Which sense of "exists" a caller of {@link IDocumentView.exists} means.
+*/
+let DocumentExistence = /* @__PURE__ */ function(DocumentExistence) {
+	/**
+	* A document that is present and not deleted. This is the question a read
+	* asks: a deleted document is not readable, so it does not exist.
+	*/
+	DocumentExistence["LiveOnly"] = "LiveOnly";
+	/**
+	* Whether the id is taken, deleted or not. This is the question a write
+	* asks: a deleted document keeps its operation stream, so its id can never
+	* be reused, and answering from snapshots alone would say otherwise whenever
+	* a snapshot row is missing while the stream is intact.
+	*/
+	DocumentExistence["IncludingDeleted"] = "IncludingDeleted";
+	return DocumentExistence;
+}({});
+//#endregion
+//#region src/executor/util.ts
+/** Actions the reactor reduces itself, onto the document scope. */
+const DOCUMENT_SCOPE_ACTIONS = DOCUMENT_SCOPE_ACTION_TYPES;
+/**
+* `CREATE_DOCUMENT` is exempt by necessity: it runs before the document exists,
+* so building a decision model would throw and defer the job forever.
+*/
+const GATED_DOCUMENT_ACTIONS = new Set([...DOCUMENT_SCOPE_ACTIONS].filter((type) => type !== "CREATE_DOCUMENT"));
+/**
+* Creates a PHDocument from a CREATE_DOCUMENT action input.
+* Reconstructs the document header and initializes the base state.
+*
+* @param action - The CREATE_DOCUMENT action containing the document parameters
+* @returns A newly constructed PHDocument with initialized header and base state
+*/
+function createDocumentFromAction(action) {
+	const input = action.input;
+	const header = createPresignedHeader();
+	header.id = input.documentId;
+	header.documentType = input.model;
+	if (input.signing) {
+		header.createdAtUtcIso = input.signing.createdAtUtcIso;
+		header.lastModifiedAtUtcIso = input.signing.createdAtUtcIso;
+		header.sig = {
+			publicKey: input.signing.publicKey,
+			nonce: input.signing.nonce
+		};
+	}
+	if (input.slug !== void 0) header.slug = input.slug;
+	if (!header.slug) header.slug = input.documentId;
+	if (input.name !== void 0) header.name = input.name;
+	if (input.branch !== void 0) header.branch = input.branch;
+	if (input.meta !== void 0) header.meta = input.meta;
+	if (input.protocolVersions !== void 0) header.protocolVersions = input.protocolVersions;
+	const baseState = defaultBaseState();
+	return {
+		header,
+		operations: {},
+		state: baseState,
+		initialState: baseState,
+		clipboard: []
+	};
+}
+/**
+* Calculate the next operation index for a specific scope.
+* Each scope maintains its own independent index sequence.
+*
+* Per-scope indexing means:
+* - Each scope (document, global, local, etc.) has independent indexes
+* - Indexes start at 0 for each scope
+* - Different scopes can have operations with the same index value
+*
+* This function uses header.revision which is populated by the cache/storage layer
+* and contains the next available index for each scope. This design avoids requiring
+* the full operation history to be loaded, which is crucial for snapshot-based caching.
+*
+* @param document - The document whose header.revision to inspect
+* @param scope - The scope to calculate the next index for
+* @returns The next available index in the specified scope
+*/
+const getNextIndexForScope = (document, scope) => {
+	return document.header.revision[scope] || 0;
+};
+/**
+* Creates an empty consistency token with no coordinates.
+* Used when a job is registered or fails without writing operations.
+*
+* @returns A consistency token with an empty coordinates array
+*/
+function createEmptyConsistencyToken() {
+	return {
+		version: 1,
+		createdAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
+		coordinates: []
+	};
+}
+/**
+* Creates a consistency token from operations written during job execution.
+* Maps each operation to a consistency coordinate tracking (documentId, scope, branch, operationIndex).
+* If no operations are provided, returns an empty token.
+*
+* @param operationsWithContext - Array of operations with their execution context
+* @returns A consistency token representing all operations written
+*/
+function createConsistencyToken(operationsWithContext) {
+	if (operationsWithContext.length === 0) return createEmptyConsistencyToken();
+	const coordinates = [];
+	for (let i = 0; i < operationsWithContext.length; i++) {
+		const opWithContext = operationsWithContext[i];
+		coordinates.push({
+			documentId: opWithContext.context.documentId,
+			scope: opWithContext.context.scope,
+			branch: opWithContext.context.branch,
+			operationIndex: opWithContext.operation.index
+		});
+	}
+	return {
+		version: 1,
+		createdAtUtcIso: (/* @__PURE__ */ new Date()).toISOString(),
+		coordinates
+	};
+}
+function createOperation(action, index, skip, context) {
+	return {
+		id: deriveOperationId(context.documentId, context.scope, context.branch, action.id),
+		index,
+		timestampUtcMs: action.timestampUtcMs || (/* @__PURE__ */ new Date()).toISOString(),
+		hash: "",
+		skip,
+		action
+	};
+}
+function updateDocumentRevision(document, scope, operationIndex) {
+	document.header.revision = {
+		...document.header.revision,
+		[scope]: operationIndex + 1
+	};
+}
+function buildSuccessResult(job, operation, documentId, documentType, resultingState, startTime) {
+	return {
+		job,
+		success: true,
+		operations: [operation],
+		operationsWithContext: [{
+			operation,
+			context: {
+				documentId,
+				scope: job.scope,
+				branch: job.branch,
+				documentType,
+				resultingState,
+				ordinal: 0
+			}
+		}],
+		duration: Date.now() - startTime
+	};
+}
+function buildErrorResult(job, error, startTime) {
+	return {
+		job,
+		success: false,
+		error,
+		duration: Date.now() - startTime
+	};
+}
+/**
+* The error a refusal surfaces as. Both classes are already terminal in the job
+* result handler, so a refusal never burns a retry.
+*/
+function refusalError(reason, documentId, deletedAtUtcIso, action) {
+	if (reason === DOCUMENT_DELETED_REASON) return new DocumentDeletedError(documentId, deletedAtUtcIso);
+	return new AuthorizationDeniedError(documentId, action.scope, action.type, action.context?.signer?.user.address);
+}
+/**
+* Whether this operation is part of the document's creation. The create and the
+* upgrade from version zero hold the first two indexes for the life of the
+* document, so a reshuffle has to leave them where they are.
+*/
+function isGenesisOperation(operation) {
+	if (operation.action.type === "CREATE_DOCUMENT") return true;
+	if (operation.action.type !== "UPGRADE_DOCUMENT") return false;
+	return operation.action.input.fromVersion === 0;
+}
+/**
+* The distinct streams a job wrote, collected so a rollback knows what to evict.
+*
+* A write records its stream on every apply, and a long run applies the same
+* stream hundreds of times, so this keeps one entry per stream rather than one
+* per write: the eviction only cares which streams were touched, and the
+* successful jobs that never read this back pay for a lookup instead of an
+* allocation.
+*/
+var TouchedStreams = class {
+	streams = /* @__PURE__ */ new Map();
+	add(documentId, scope, branch) {
+		const key = `${documentId}\u0000${scope}\u0000${branch}`;
+		if (this.streams.has(key)) return;
+		this.streams.set(key, {
+			documentId,
+			scope,
+			branch
+		});
+	}
+	[Symbol.iterator]() {
+		return this.streams.values();
+	}
+};
+/**
+* The ids of the actions the caller handed to a job. Load and reevaluation
+* jobs write operations nobody submitted, so they report none.
+*/
+function submittedActionIds(job) {
+	return job.kind === "mutation" ? job.actions.map((action) => action.id) : [];
+}
+/**
+* Reports what became of each submitted action.
+*
+* A job's operations can include ones it only moved to a new index, so only
+* those carrying a submitted action are reported. Returns undefined when the
+* job submitted nothing, which keeps `JobInfo.result` null for the jobs that
+* have no caller to answer to.
+*/
+function summarizeSubmittedActions(operations, submitted) {
+	if (!submitted || submitted.length === 0) return;
+	const ids = new Set(submitted);
+	const actions = [];
+	for (const { operation, context } of operations) {
+		if (!ids.has(operation.action.id)) continue;
+		actions.push({
+			actionId: operation.action.id,
+			scope: context.scope,
+			index: operation.index,
+			...operationOutcome(operation)
+		});
+	}
+	if (actions.length === 0) return;
+	return {
+		actions,
+		allApplied: actions.every((action) => action.kind === "applied")
+	};
+}
+/** Tombstones a job has read, each under the shared lock it took first. */
+var PurgeFence = class {
+	locks;
+	checked;
+	purged;
+	constructor(locks, checked, purged) {
+		this.locks = locks;
+		this.checked = checked;
+		this.purged = purged;
+	}
+	/** Locks and reads an id the job start did not resolve. */
+	async isPurged(documentId) {
+		await this.isPurgedMany([documentId]);
+		return this.purged.has(documentId);
+	}
+	/** Locks and reads the unresolved ids in one lock and one lookup. */
+	async isPurgedMany(documentIds) {
+		const unchecked = [...new Set(documentIds)].filter((id) => !this.checked.has(id));
+		if (unchecked.length > 0) {
+			await this.locks.shared(unchecked);
+			const found = await this.locks.purged(unchecked);
+			for (const id of unchecked) this.checked.add(id);
+			for (const id of found) this.purged.add(id);
+		}
+		return new Set(documentIds.filter((id) => this.purged.has(id)));
+	}
+};
+/** Locks and checks an id on its first read; a purged id reads as purged. */
+var FencedWriteCache = class {
+	inner;
+	purgeFence;
+	evict;
+	evicted = /* @__PURE__ */ new Set();
+	constructor(inner, purgeFence, evict) {
+		this.inner = inner;
+		this.purgeFence = purgeFence;
+		this.evict = evict;
+	}
+	/** Fences ids known before their reads in one round trip. */
+	async fence(documentIds) {
+		await this.purgeFence.isPurgedMany(documentIds);
+	}
+	async getState(documentId, scope, branch, targetRevision, signal) {
+		if (await this.purgeFence.isPurged(documentId)) {
+			if (!this.evicted.has(documentId)) {
+				this.evicted.add(documentId);
+				this.evict(documentId);
+			}
+			throw new DocumentPurgedError(documentId);
+		}
+		return this.inner.getState(documentId, scope, branch, targetRevision, signal);
+	}
+	putState(documentId, scope, branch, revision, document, position) {
+		this.inner.putState(documentId, scope, branch, revision, document, position);
+	}
+	putRun(documentId, scope, branch, run) {
+		this.inner.putRun(documentId, scope, branch, run);
+	}
+	invalidate(documentId, scope, branch) {
+		return this.inner.invalidate(documentId, scope, branch);
+	}
+	clear() {
+		this.inner.clear();
+	}
+	startup() {
+		return this.inner.startup();
+	}
+	shutdown() {
+		return this.inner.shutdown();
+	}
+};
+/** The target whose membership an ADD or REMOVE_RELATIONSHIP writes. */
+function relationshipTarget(action) {
+	if (action.type !== "ADD_RELATIONSHIP" && action.type !== "REMOVE_RELATIONSHIP") return;
+	const target = action.input?.targetId;
+	return typeof target === "string" && target.length > 0 ? target : void 0;
+}
+/** The ids a job's locks cover, sorted: its write ids and groups it names. */
+function jobWriteIds(job) {
+	const ids = /* @__PURE__ */ new Set([job.documentId]);
+	const actions = [...job.actions, ...job.operations.map((operation) => operation.action)];
+	for (const action of actions) {
+		if (DOCUMENT_SCOPE_ACTIONS.has(action.type)) ids.add(targetDocumentId(action, job.documentId));
+		const target = relationshipTarget(action);
+		if (target !== void 0) ids.add(target);
+		if (action.scope === "auth") for (const groupId of mentionedGroupIds(action)) ids.add(groupId);
+	}
+	return [...ids].sort();
+}
+//#endregion
+//#region src/cache/collection-membership-cache.ts
+var CollectionMembershipCache = class CollectionMembershipCache {
+	operationIndex;
+	cache = /* @__PURE__ */ new Map();
+	constructor(operationIndex) {
+		this.operationIndex = operationIndex;
+	}
+	withScopedIndex(operationIndex) {
+		const scoped = new CollectionMembershipCache(operationIndex);
+		scoped.cache = this.cache;
+		return scoped;
+	}
+	async getCollectionsForDocuments(documentIds) {
+		const result = {};
+		const missing = [];
+		for (const docId of documentIds) {
+			const cached = this.cache.get(docId);
+			if (cached !== void 0) result[docId] = cached;
+			else missing.push(docId);
+		}
+		if (missing.length > 0) {
+			const fromDb = await this.operationIndex.getCollectionsForDocuments(missing);
+			for (const docId of missing) {
+				const collections = fromDb[docId] ?? [];
+				result[docId] = collections;
+				this.cache.set(docId, collections);
+			}
+		}
+		return result;
+	}
+	invalidate(documentId) {
+		this.cache.delete(documentId);
+	}
+};
+//#endregion
+//#region src/cache/lru/lru-tracker.ts
+var LRUNode = class {
+	key;
+	prev;
+	next;
+	constructor(key) {
+		this.key = key;
+		this.prev = void 0;
+		this.next = void 0;
+	}
+};
+var LRUTracker = class {
+	map;
+	head;
+	tail;
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+		this.head = void 0;
+		this.tail = void 0;
+	}
+	get size() {
+		return this.map.size;
+	}
+	touch(key) {
+		const node = this.map.get(key);
+		if (node) this.moveToFront(node);
+		else this.addToFront(key);
+	}
+	evict() {
+		if (!this.tail) return;
+		const key = this.tail.key;
+		this.remove(key);
+		return key;
+	}
+	remove(key) {
+		const node = this.map.get(key);
+		if (!node) return;
+		this.removeNode(node);
+		this.map.delete(key);
+	}
+	clear() {
+		this.map.clear();
+		this.head = void 0;
+		this.tail = void 0;
+	}
+	addToFront(key) {
+		const node = new LRUNode(key);
+		this.map.set(key, node);
+		if (!this.head) {
+			this.head = node;
+			this.tail = node;
+		} else {
+			node.next = this.head;
+			this.head.prev = node;
+			this.head = node;
+		}
+	}
+	moveToFront(node) {
+		if (node === this.head) return;
+		this.removeNode(node);
+		node.prev = void 0;
+		node.next = this.head;
+		if (this.head) this.head.prev = node;
+		this.head = node;
+		if (!this.tail) this.tail = node;
+	}
+	removeNode(node) {
+		if (node.prev) node.prev.next = node.next;
+		else this.head = node.next;
+		if (node.next) node.next.prev = node.prev;
+		else this.tail = node.prev;
+	}
+};
+//#endregion
+//#region src/cache/document-meta-cache.ts
+/**
+* In-memory document metadata cache with LRU eviction.
+*
+* Caches PHDocumentState per (documentId, branch) key. On cache miss,
+* rebuilds from document scope operations. Provides an explicit cross-scope
+* contract for accessing document scope metadata.
+*
+* **Thread Safety:**
+* Not thread-safe. Designed for single-threaded job executor environment.
+*/
+var DocumentMetaCache = class DocumentMetaCache {
+	cache;
+	lruTracker;
+	operationStore;
+	config;
+	constructor(operationStore, config) {
+		this.operationStore = operationStore;
+		this.config = { maxDocuments: config.maxDocuments };
+		this.cache = /* @__PURE__ */ new Map();
+		this.lruTracker = new LRUTracker();
+	}
+	withScopedStore(operationStore) {
+		const scoped = new DocumentMetaCache(operationStore, this.config);
+		scoped.cache = this.cache;
+		scoped.lruTracker = this.lruTracker;
+		return scoped;
+	}
+	async startup() {
+		return Promise.resolve();
+	}
+	async shutdown() {
+		return Promise.resolve();
+	}
+	async getDocumentMeta(documentId, branch, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		const key = this.makeKey(documentId, branch);
+		const cached = this.cache.get(key);
+		if (cached) {
+			this.lruTracker.touch(key);
+			return cached;
+		}
+		const meta = await this.rebuildLatest(documentId, branch, signal);
+		this.putDocumentMeta(documentId, branch, meta);
+		return meta;
+	}
+	async rebuildAtRevision(documentId, branch, targetRevision, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		return this.rebuildFromOperations(documentId, branch, targetRevision, signal);
+	}
+	putDocumentMeta(documentId, branch, meta) {
+		const key = this.makeKey(documentId, branch);
+		if (!this.cache.has(key) && this.cache.size >= this.config.maxDocuments) {
+			const evictKey = this.lruTracker.evict();
+			if (evictKey) this.cache.delete(evictKey);
+		}
+		this.cache.set(key, structuredClone(meta));
+		this.lruTracker.touch(key);
+	}
+	invalidate(documentId, branch) {
+		let evicted = 0;
+		if (branch === void 0) {
+			for (const key of this.cache.keys()) if (key.startsWith(`${documentId}:`)) {
+				this.cache.delete(key);
+				this.lruTracker.remove(key);
+				evicted++;
+			}
+		} else {
+			const key = this.makeKey(documentId, branch);
+			if (this.cache.has(key)) {
+				this.cache.delete(key);
+				this.lruTracker.remove(key);
+				evicted = 1;
+			}
+		}
+		return evicted;
+	}
+	clear() {
+		this.cache.clear();
+		this.lruTracker.clear();
+	}
+	makeKey(documentId, branch) {
+		return `${documentId}:${branch}`;
+	}
+	async rebuildLatest(documentId, branch, signal) {
+		return this.rebuildFromOperations(documentId, branch, void 0, signal);
+	}
+	async rebuildFromOperations(documentId, branch, targetRevision, signal) {
+		const docScopeOps = await this.operationStore.getSince(documentId, "document", branch, -1, void 0, void 0, signal);
+		if (docScopeOps.results.length === 0) throw new DocumentNotFoundError(documentId);
+		const createOp = docScopeOps.results[0];
+		if (isPurgeMarker(createOp)) return purgedMeta(createOp.action);
+		if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Invalid document: first operation must be CREATE_DOCUMENT, found ${createOp.action.type}`);
+		const createAction = createOp.action;
+		const documentType = createAction.input.model;
+		let document = createDocumentFromAction(createAction);
+		let documentScopeRevision = 0;
+		let purged = false;
+		for (const op of docScopeOps.results) {
+			if (targetRevision !== void 0 && op.index > targetRevision) break;
+			documentScopeRevision = op.index;
+			if (op.action.type === "UPGRADE_DOCUMENT") {
+				const upgradeAction = op.action;
+				document = applyUpgradeDocumentAction$1(document, upgradeAction);
+			} else if (op.action.type === "DELETE_DOCUMENT" || op.action.type === PURGE_DOCUMENT) {
+				document = applyDeleteDocumentAction$1(document, op.action);
+				purged ||= op.action.type === PURGE_DOCUMENT;
+			}
+		}
+		return {
+			state: document.state.document,
+			documentType,
+			protocolVersions: purged ? purgedProtocolVersions() : createAction.input.protocolVersions,
+			documentScopeRevision: documentScopeRevision + 1
+		};
+	}
+};
+/** A lone marker has no CREATE_DOCUMENT; the marker describes the stream. */
+function purgedMeta(action) {
+	return {
+		state: createDocumentState({
+			isDeleted: true,
+			deletedAtUtcIso: action.input.purgedAtUtcIso
+		}),
+		documentType: action.input.documentType,
+		protocolVersions: purgedProtocolVersions(),
+		documentScopeRevision: 1
+	};
+}
+//#endregion
+//#region src/catch-up/settled-watermark.ts
+const MAX_PENDING_PROBES = 64;
+/** pg_sequence_last_value needs 10; pg_current_* replaced txid_* in 13. */
+function snapshotFunctionsFor(serverVersionNum) {
+	if (serverVersionNum >= 13e4) return {
+		snapshot: "pg_current_snapshot",
+		currentXid: "pg_current_xact_id",
+		xidIfAssigned: "pg_current_xact_id_if_assigned"
+	};
+	if (serverVersionNum >= 1e5) return {
+		snapshot: "txid_current_snapshot",
+		currentXid: "txid_current",
+		xidIfAssigned: "txid_current_if_assigned"
+	};
+	throw new Error(`PostgreSQL server_version_num ${serverVersionNum} is not supported: read-side catch-up needs 10 or later`);
+}
+/** Parses the `xmin:xmax:xip,...` text form of a snapshot. */
+function parseSnapshot(text) {
+	const parts = text.split(":");
+	if (parts.length !== 3) throw new Error(`Malformed snapshot: ${text}`);
+	const [xmin, xmax, xip] = parts;
+	return {
+		xmin: BigInt(xmin),
+		xmax: BigInt(xmax),
+		xip: xip === "" ? [] : xip.split(",").map((xid) => BigInt(xid))
+	};
+}
+async function readSnapshotFunctions(db) {
+	const result = await sql`select current_setting('server_version_num') as version`.execute(db);
+	return snapshotFunctionsFor(Number(result.rows[0].version));
+}
+/** A probe settles once an xmin passes the xid it took after its head. */
+var ProbeSettler = class {
+	settled = 0;
+	lastHead = 0;
+	covered = 0;
+	lastXip = [];
+	pending = [];
+	get settledThrough() {
+		return this.settled;
+	}
+	get head() {
+		return this.lastHead;
+	}
+	/** The highest head a settled or pending probe covers. */
+	get probedHead() {
+		return this.covered;
+	}
+	observe(head, xid, snapshot, nowUtcMs) {
+		this.lastHead = Math.max(this.lastHead, head);
+		this.lastXip = snapshot.xip;
+		if (xid !== null && head > this.covered) {
+			this.covered = head;
+			this.pending.push({
+				head,
+				xid,
+				takenAtUtcMs: nowUtcMs
+			});
+			if (this.pending.length > MAX_PENDING_PROBES) this.pending.shift();
+		}
+		const stillPending = [];
+		for (const probe of this.pending) if (snapshot.xmin > probe.xid) this.settled = Math.max(this.settled, probe.head);
+		else stillPending.push(probe);
+		this.pending = stillPending.filter((probe) => probe.head > this.settled);
+		return this.settled;
+	}
+	/** Xids an unsettled probe still waits on. */
+	waitingOn() {
+		if (this.pending.length === 0) return [];
+		const xid = this.pending[0].xid;
+		return this.lastXip.filter((open) => open < xid).map((open) => open.toString());
+	}
+	stalledSinceUtcMs() {
+		return this.pending[0]?.takenAtUtcMs;
+	}
+};
+function operationIndexTableName(db) {
+	const from = db.selectFrom("operation_index_operations").selectAll().toOperationNode().from?.froms[0];
+	const schema = from !== void 0 && TableNode.is(from) ? from.table.schema?.name : void 0;
+	const quote = (identifier) => `"${identifier.replace(/"/g, "\"\"")}"`;
+	return schema === void 0 ? quote("operation_index_operations") : `${quote(schema)}.${quote("operation_index_operations")}`;
+}
+/** Reads the head, takes and commits an xid, then reads a snapshot, in order. */
+function createKyselyWatermarkProbe(db) {
+	let resolved = null;
+	const resolve = async () => {
+		const fns = await readSnapshotFunctions(db);
+		const table = operationIndexTableName(db);
+		const sequence = (await sql`select pg_get_serial_sequence(${table}, 'ordinal') as sequence`.execute(db)).rows[0]?.sequence;
+		if (!sequence) throw new Error(`No ordinal sequence found for ${table}`);
+		return {
+			fns,
+			sequence
+		};
+	};
+	return async (probedHead) => {
+		resolved ??= resolve().catch((error) => {
+			resolved = null;
+			throw error;
+		});
+		const { fns, sequence } = await resolved;
+		const headRow = (await sql`select coalesce(pg_sequence_last_value(${sequence}::regclass), 0) as head, ${sql.raw(fns.xidIfAssigned)}() is null as outside_write`.execute(db)).rows[0];
+		const head = Number(headRow.head);
+		let xid = null;
+		if (headRow.outside_write && head > probedHead) {
+			const xidResult = await sql`select ${sql.raw(fns.currentXid)}()::text as xid`.execute(db);
+			xid = BigInt(xidResult.rows[0].xid);
+		}
+		const row = (await sql`select ${sql.raw(fns.snapshot)}()::text as snapshot, ${sql.raw(fns.xidIfAssigned)}() is null as outside_write`.execute(db)).rows[0];
+		return {
+			head,
+			xid,
+			snapshot: parseSnapshot(row.snapshot),
+			outsideWrite: headRow.outside_write && row.outside_write
+		};
+	};
+}
+/** Knows when an ordinal gap is final by asking which transactions are open. */
+var SettledWatermark = class {
+	probe;
+	logger;
+	now;
+	settler = new ProbeSettler();
+	listeners = /* @__PURE__ */ new Set();
+	current;
+	next;
+	warnedInsideWrite = false;
+	constructor(probe, logger, now = Date.now) {
+		this.probe = probe;
+		this.logger = logger;
+		this.now = now;
+	}
+	get settledThrough() {
+		return this.settler.settledThrough;
+	}
+	refresh(signal) {
+		signal?.throwIfAborted();
+		if (this.next !== void 0) return this.next;
+		if (this.current === void 0) return this.start();
+		const next = this.current.catch(() => this.settledThrough).then(() => {
+			this.next = void 0;
+			return this.start();
+		});
+		this.next = next;
+		return next;
+	}
+	onAdvance(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	status() {
+		const stalledSinceUtcMs = this.settler.head > this.settledThrough ? this.settler.stalledSinceUtcMs() : void 0;
+		return {
+			head: this.settler.head,
+			settledThrough: this.settledThrough,
+			waitingOn: this.settler.waitingOn(),
+			...stalledSinceUtcMs !== void 0 ? { stalledSinceUtcMs } : {}
+		};
+	}
+	start() {
+		const run = this.probeOnce().finally(() => {
+			if (this.current === run) this.current = void 0;
+		});
+		this.current = run;
+		return run;
+	}
+	async probeOnce() {
+		const reading = await this.probe(this.settler.probedHead);
+		if (!reading.outsideWrite) {
+			if (!this.warnedInsideWrite) {
+				this.warnedInsideWrite = true;
+				this.logger.warn("settled watermark probe ran inside another session's write transaction; discarded");
+			}
+			return this.settledThrough;
+		}
+		const before = this.settledThrough;
+		const after = this.settler.observe(reading.head, reading.xid, reading.snapshot, this.now());
+		if (after > before) for (const listener of this.listeners) try {
+			listener(after);
+		} catch (error) {
+			this.logger.error("settled watermark listener failed: @error", error);
+		}
+		return after;
+	}
+};
+/** Sessions holding these xids open; empty without pg_stat_activity. */
+async function describeWaitingSessions(db, xids) {
+	if (xids.length === 0) return [];
+	const epochless = xids.map((xid) => (BigInt(xid) % 2n ** 32n).toString());
+	try {
+		return (await sql`select pid, application_name, state, xact_start, backend_xid::text as xid
+       from pg_stat_activity
+       where backend_xid::text in (${sql.join(epochless)})`.execute(db)).rows.map((row) => ({
+			pid: Number(row.pid),
+			applicationName: row.application_name ?? "",
+			state: row.state ?? "",
+			xactStart: row.xact_start === null ? null : new Date(row.xact_start).toISOString(),
+			xid: row.xid
+		}));
+	} catch {
+		return [];
+	}
+}
+//#endregion
+//#region src/storage/kysely/document-purges.ts
+/** Class key of every purge lock; the stream locks use the single-key space. */
+const PURGE_NS = 1347571013;
+/** Ids share this many lock keys, so a job's lock count stays bounded. */
+const PURGE_LOCK_BUCKETS = 1024;
+async function acquirePurgeLocks(trx, ids, mode) {
+	const unique = [...new Set(ids)];
+	if (unique.length === 0) return;
+	const lock = sql.raw(mode === "shared" ? "pg_advisory_xact_lock_shared" : "pg_advisory_xact_lock");
+	await sql`
+    with keys as materialized (
+      select distinct hashtext(id) & ${sql.lit(1023)} as key
+      from unnest(${unique}::text[]) as t(id)
+      order by key
+    )
+    select ${lock}(${sql.lit(PURGE_NS)}, key) from keys order by key
+  `.execute(trx);
+}
+/** The ids among `ids` that have a tombstone, read in the handle's schema. */
+async function findPurged(db, ids) {
+	const unique = [...new Set(ids)];
+	if (unique.length === 0) return /* @__PURE__ */ new Set();
+	const rows = await db.selectFrom("document_purges").select("documentId").where(sql`"documentId" = any(${unique}::text[])`).execute();
+	return new Set(rows.map((row) => row.documentId));
+}
+/** Every tombstoned id, read in the handle's schema. */
+async function listPurged(db) {
+	return (await db.selectFrom("document_purges").select("documentId").orderBy("documentId").execute()).map((row) => row.documentId);
+}
+/** Bind slots per statement: 16-bit on the wire, read signed in-process. */
+const MAX_BIND_PARAMETERS = 32767;
+/** Splits rows into runs that each bind at most MAX_BIND_PARAMETERS. */
+function chunkRows(rows) {
+	if (rows.length === 0) return [];
+	const columnsPerRow = Math.max(1, Object.keys(rows[0]).length);
+	const perChunk = Math.max(1, Math.floor(MAX_BIND_PARAMETERS / columnsPerRow));
+	if (rows.length <= perChunk) return [rows];
+	const chunks = [];
+	for (let i = 0; i < rows.length; i += perChunk) chunks.push(rows.slice(i, i + perChunk));
+	return chunks;
+}
+/** Per database: the function that assigns the transaction's xid. */
+const xidFunctions = /* @__PURE__ */ new WeakMap();
+var KyselyOperationIndexTxn = class {
+	collections = [];
+	collectionMemberships = [];
+	collectionRemovals = [];
+	groupReferences = [];
+	operations = [];
+	membershipInvalidations = /* @__PURE__ */ new Set();
+	/** Called by the commit as it writes each document_collections row. */
+	recordMembershipInvalidation(documentId) {
+		this.membershipInvalidations.add(documentId);
+	}
+	getMembershipInvalidations() {
+		return [...this.membershipInvalidations];
+	}
+	createCollection(collectionId) {
+		this.collections.push(collectionId);
+	}
+	addToCollection(collectionId, documentId) {
+		const lastOpIndex = this.operations.length - 1;
+		if (lastOpIndex < 0) throw new Error("addToCollection must be called after write() - no operations in transaction");
+		this.collectionMemberships.push({
+			collectionId,
+			documentId,
+			operationIndex: lastOpIndex
+		});
+	}
+	removeFromCollection(collectionId, documentId) {
+		const lastOpIndex = this.operations.length - 1;
+		if (lastOpIndex < 0) throw new Error("removeFromCollection must be called after write() - no operations in transaction");
+		this.collectionRemovals.push({
+			collectionId,
+			documentId,
+			operationIndex: lastOpIndex
+		});
+	}
+	recordGroupReferences(documentId, groupIds) {
+		const lastOpIndex = this.operations.length - 1;
+		if (lastOpIndex < 0) throw new Error("recordGroupReferences must be called after write() - no operations in transaction");
+		if (groupIds.length === 0) return;
+		this.groupReferences.push({
+			documentId,
+			groupIds,
+			operationIndex: lastOpIndex
+		});
+	}
+	write(operations) {
+		this.operations.push(...operations);
+	}
+	getCollections() {
+		return this.collections;
+	}
+	getGroupReferenceRecords() {
+		return this.groupReferences;
+	}
+	getCollectionMembershipRecords() {
+		return this.collectionMemberships;
+	}
+	getCollectionRemovals() {
+		return this.collectionRemovals;
+	}
+	getOperations() {
+		return this.operations;
+	}
+};
+var KyselyOperationIndex = class KyselyOperationIndex {
+	db;
+	trx;
+	liveIds;
+	constructor(db) {
+		this.db = db;
+	}
+	get queryExecutor() {
+		return this.trx ?? this.db;
+	}
+	/** `liveIds`: ids the transaction read untombstoned under its shared lock. */
+	withTransaction(trx, liveIds) {
+		const instance = new KyselyOperationIndex(this.db);
+		instance.trx = trx;
+		instance.liveIds = liveIds;
+		return instance;
+	}
+	start() {
+		return new KyselyOperationIndexTxn();
+	}
+	async commit(txn, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		const kyselyTxn = txn;
+		if (this.trx) return this.executeCommit(this.trx, kyselyTxn);
+		let resultOrdinals = [];
+		await this.db.transaction().execute(async (trx) => {
+			resultOrdinals = await this.executeCommit(trx, kyselyTxn);
+		});
+		return resultOrdinals;
+	}
+	/**
+	* A policy-driven join: keeps the earliest join so a rediscovered reference
+	* never shrinks a backfill window remotes already rely on, and reopens a
+	* closed membership because a policy reference is not a removable one.
+	*/
+	async joinKeepingEarliest(trx, kyselyTxn, documentId, collectionId, ordinal) {
+		kyselyTxn.recordMembershipInvalidation(documentId);
+		await trx.insertInto("document_collections").values({
+			documentId,
+			collectionId,
+			joinedOrdinal: ordinal,
+			leftOrdinal: null
+		}).onConflict((oc) => oc.columns(["documentId", "collectionId"]).doUpdateSet({
+			joinedOrdinal: sql`LEAST("document_collections"."joinedOrdinal", EXCLUDED."joinedOrdinal")`,
+			leftOrdinal: null
+		})).execute();
+	}
+	async executeCommit(trx, kyselyTxn) {
+		const collections = kyselyTxn.getCollections();
+		const memberships = kyselyTxn.getCollectionMembershipRecords();
+		const removals = kyselyTxn.getCollectionRemovals();
+		const groupReferences = kyselyTxn.getGroupReferenceRecords();
+		const operations = kyselyTxn.getOperations();
+		if (collections.length > 0) {
+			const collectionRows = collections.map((collectionId) => ({
+				documentId: collectionId,
+				collectionId,
+				joinedOrdinal: BigInt(0),
+				leftOrdinal: null
+			}));
+			for (const collectionId of collections) kyselyTxn.recordMembershipInvalidation(collectionId);
+			for (const chunk of chunkRows(collectionRows)) await trx.insertInto("document_collections").values(chunk).onConflict((oc) => oc.doNothing()).execute();
+		}
+		let operationOrdinals = [];
+		if (operations.length > 0) {
+			await this.refusePurgedOperations(trx, operations);
+			await this.assignXid(trx);
+			const operationRows = operations.map((op) => ({
+				opId: op.id || "",
+				documentId: op.documentId,
+				documentType: op.documentType,
+				scope: op.scope,
+				branch: op.branch,
+				timestampUtcMs: op.timestampUtcMs,
+				index: op.index,
+				skip: op.skip,
+				hash: op.hash,
+				action: op.action,
+				deniedReason: op.deniedReason ?? null,
+				sourceRemote: op.sourceRemote
+			}));
+			for (const chunk of chunkRows(operationRows)) {
+				const insertedOps = await trx.insertInto("operation_index_operations").values(chunk).returning("ordinal").execute();
+				operationOrdinals = operationOrdinals.concat(insertedOps.map((row) => row.ordinal));
+			}
+		}
+		if (memberships.length > 0) for (const m of memberships) {
+			const ordinal = operationOrdinals[m.operationIndex];
+			kyselyTxn.recordMembershipInvalidation(m.documentId);
+			await trx.insertInto("document_collections").values({
+				documentId: m.documentId,
+				collectionId: m.collectionId,
+				joinedOrdinal: BigInt(ordinal),
+				leftOrdinal: null
+			}).onConflict((oc) => oc.columns(["documentId", "collectionId"]).doUpdateSet({
+				joinedOrdinal: BigInt(ordinal),
+				leftOrdinal: null
+			})).execute();
+			const references = await trx.selectFrom("group_references").select("groupId").where("documentId", "=", m.documentId).execute();
+			for (const { groupId } of references) await this.joinKeepingEarliest(trx, kyselyTxn, groupId, m.collectionId, BigInt(ordinal));
+		}
+		if (removals.length > 0) for (const r of removals) {
+			const ordinal = operationOrdinals[r.operationIndex];
+			kyselyTxn.recordMembershipInvalidation(r.documentId);
+			await trx.updateTable("document_collections").set({ leftOrdinal: BigInt(ordinal) }).where("collectionId", "=", r.collectionId).where("documentId", "=", r.documentId).where("leftOrdinal", "is", null).execute();
+		}
+		if (groupReferences.length > 0) for (const record of groupReferences) {
+			const ordinal = operationOrdinals[record.operationIndex];
+			await trx.insertInto("group_references").values(record.groupIds.map((groupId) => ({
+				documentId: record.documentId,
+				groupId
+			}))).onConflict((oc) => oc.doNothing()).execute();
+			const rows = await trx.selectFrom("document_collections").select("collectionId").where("documentId", "=", record.documentId).execute();
+			for (const groupId of record.groupIds) for (const { collectionId } of rows) await this.joinKeepingEarliest(trx, kyselyTxn, groupId, collectionId, BigInt(ordinal));
+		}
+		return operationOrdinals;
+	}
+	async getCollectionsInRange(after, through, among, signal) {
+		signal?.throwIfAborted();
+		if (through <= after || among?.length === 0) return [];
+		let query = this.queryExecutor.selectFrom("operation_index_operations as oi").innerJoin("document_collections as dc", "oi.documentId", "dc.documentId").select("dc.collectionId").distinct().where("oi.ordinal", ">", after).where("oi.ordinal", "<=", through);
+		if (among !== void 0) query = query.where("dc.collectionId", "in", [...among]);
+		return (await query.execute()).map((row) => row.collectionId);
+	}
+	async getOrdinalsInRange(after, through, limit, signal) {
+		signal?.throwIfAborted();
+		if (through <= after || limit <= 0) return [];
+		return (await this.queryExecutor.selectFrom("operation_index_operations").select("ordinal").where("ordinal", ">", after).where("ordinal", "<=", through).orderBy("ordinal", "asc").limit(limit).execute()).map((row) => Number(row.ordinal));
+	}
+	async getByOrdinals(ordinals, signal) {
+		signal?.throwIfAborted();
+		if (ordinals.length === 0) return [];
+		const results = [];
+		for (let i = 0; i < ordinals.length; i += MAX_BIND_PARAMETERS) {
+			const chunk = ordinals.slice(i, i + MAX_BIND_PARAMETERS);
+			const rows = await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("ordinal", "in", chunk).orderBy("ordinal", "asc").execute();
+			for (const row of rows) results.push(this.rowToOperationWithContext(row));
+		}
+		results.sort((a, b) => a.context.ordinal - b.context.ordinal);
+		return results;
+	}
+	async getStreamAfter(stream, after, signal, limit) {
+		signal?.throwIfAborted();
+		return (await this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("documentId", "=", stream.documentId).where("branch", "=", stream.branch).where("scope", "=", stream.scope).where("ordinal", ">", after).orderBy("ordinal", "asc").$if(limit !== void 0, (qb) => qb.limit(limit)).execute()).map((row) => this.rowToOperationWithContext(row));
+	}
+	async getGroupReferencers(groupId, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		return (await this.queryExecutor.selectFrom("group_references").select("documentId").where("groupId", "=", groupId).orderBy("documentId").execute()).map((row) => row.documentId);
+	}
+	async getOrdinalsByOpIds(documentId, scope, branch, opIds, signal) {
+		signal?.throwIfAborted();
+		if (opIds.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.queryExecutor.selectFrom("operation_index_operations").select("opId").select((eb) => eb.fn.max("ordinal").as("ordinal")).where("documentId", "=", documentId).where("branch", "=", branch).where("scope", "=", scope).where("opId", "in", opIds).groupBy("opId").execute();
+		return new Map(rows.map((row) => [row.opId, Number(row.ordinal)]));
+	}
+	async find(collectionId, cursor, view, paging, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		const outerCursor = cursor ?? -1;
+		const limit = paging?.limit ?? 500;
+		const pagingCursorOrdinal = paging?.cursor !== void 0 ? Number.parseInt(paging.cursor, 10) : -1;
+		const buildBranch = (kind) => {
+			let qb = this.queryExecutor.selectFrom("operation_index_operations as oi").innerJoin("document_collections as dc", "oi.documentId", "dc.documentId").selectAll("oi").select(["dc.documentId", "dc.collectionId"]).where("dc.collectionId", "=", collectionId).where(sql`(dc."leftOrdinal" IS NULL OR oi.ordinal < dc."leftOrdinal")`);
+			if (kind === "joiner") qb = qb.where("dc.joinedOrdinal", ">", BigInt(outerCursor)).where("oi.ordinal", "<=", outerCursor);
+			else qb = qb.where("oi.ordinal", ">", outerCursor);
+			qb = qb.where("oi.ordinal", ">", pagingCursorOrdinal);
+			if (view?.branch) qb = qb.where("oi.branch", "=", view.branch);
+			if (view?.scopes && view.scopes.length > 0) qb = qb.where("oi.scope", "in", view.scopes);
+			if (view?.excludeSourceRemote) qb = qb.where("oi.sourceRemote", "!=", view.excludeSourceRemote);
+			if (view?.throughOrdinal !== void 0) qb = qb.where("oi.ordinal", "<=", view.throughOrdinal).where("dc.joinedOrdinal", "<=", BigInt(view.throughOrdinal));
+			return qb;
+		};
+		const rows = await buildBranch("joiner").unionAll(buildBranch("newOps")).orderBy("ordinal", "asc").limit(limit + 1).execute();
+		let hasMore = false;
+		let items = rows;
+		if (rows.length > limit) {
+			hasMore = true;
+			items = rows.slice(0, limit);
+		}
+		const nextCursor = hasMore && items.length > 0 ? items[items.length - 1].ordinal.toString() : void 0;
+		const cursorValue = paging?.cursor || "0";
+		return {
+			results: items.map((row) => this.rowToOperationIndexEntry(row)),
+			options: {
+				cursor: cursorValue,
+				limit
+			},
+			nextCursor,
+			next: hasMore ? () => this.find(collectionId, cursor, view, {
+				cursor: nextCursor,
+				limit
+			}, signal) : void 0
+		};
+	}
+	async get(documentId, view, paging, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		const limit = paging?.limit ?? 500;
+		let query = this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("documentId", "=", documentId).orderBy("ordinal", "asc");
+		if (view?.branch) query = query.where("branch", "=", view.branch);
+		if (view?.scopes && view.scopes.length > 0) query = query.where("scope", "in", view.scopes);
+		if (paging?.cursor) {
+			const cursorOrdinal = Number.parseInt(paging.cursor, 10);
+			query = query.where("ordinal", ">", cursorOrdinal);
+		}
+		query = query.limit(limit + 1);
+		const rows = await query.execute();
+		let hasMore = false;
+		let items = rows;
+		if (rows.length > limit) {
+			hasMore = true;
+			items = rows.slice(0, limit);
+		}
+		const nextCursor = hasMore && items.length > 0 ? items[items.length - 1].ordinal.toString() : void 0;
+		const cursorValue = paging?.cursor || "0";
+		return {
+			results: items.map((row) => this.rowToOperationIndexEntry(row)),
+			options: {
+				cursor: cursorValue,
+				limit
+			},
+			nextCursor,
+			next: hasMore ? () => this.get(documentId, view, {
+				cursor: nextCursor,
+				limit
+			}, signal) : void 0
+		};
+	}
+	async getSinceOrdinal(ordinal, paging, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		const limit = paging?.limit ?? 500;
+		let query = this.queryExecutor.selectFrom("operation_index_operations").selectAll().where("ordinal", ">", ordinal).orderBy("ordinal", "asc");
+		if (paging?.cursor) {
+			const cursorOrdinal = Number.parseInt(paging.cursor, 10);
+			query = query.where("ordinal", ">", cursorOrdinal);
+		}
+		query = query.limit(limit + 1);
+		const rows = await query.execute();
+		let hasMore = false;
+		let items = rows;
+		if (rows.length > limit) {
+			hasMore = true;
+			items = rows.slice(0, limit);
+		}
+		const nextCursor = hasMore && items.length > 0 ? items[items.length - 1].ordinal.toString() : void 0;
+		const cursorValue = paging?.cursor || "0";
+		return {
+			results: items.map((row) => this.rowToOperationWithContext(row)),
+			options: {
+				cursor: cursorValue,
+				limit
+			},
+			nextCursor,
+			next: hasMore ? () => this.getSinceOrdinal(ordinal, {
+				cursor: nextCursor,
+				limit
+			}, signal) : void 0
+		};
+	}
+	/** Backstop to the store's refusal: only a marker indexes a purged id. */
+	async refusePurgedOperations(trx, operations) {
+		const ids = new Set(operations.filter((operation) => !isPurgeMarker(operation)).map((operation) => operation.documentId).filter((id) => !this.liveIds?.has(id)));
+		const purged = await findPurged(trx, ids);
+		for (const id of ids) if (purged.has(id)) throw new DocumentPurgedError(id);
+	}
+	/** Takes the xid before the first ordinal, as the settled watermark needs. */
+	async assignXid(trx) {
+		let fn = xidFunctions.get(this.db);
+		if (fn === void 0) {
+			fn = readSnapshotFunctions(trx).then((fns) => fns.currentXid);
+			xidFunctions.set(this.db, fn);
+			fn.catch(() => xidFunctions.delete(this.db));
+		}
+		const name = await fn;
+		await sql`select ${sql.raw(name)}()`.execute(trx);
+	}
+	rowToOperationWithContext(row) {
+		return {
+			operation: {
+				index: row.index,
+				timestampUtcMs: row.timestampUtcMs,
+				hash: row.hash,
+				skip: row.skip,
+				action: row.action,
+				deniedReason: row.deniedReason ?? void 0,
+				id: row.opId
+			},
+			context: {
+				documentId: row.documentId,
+				documentType: row.documentType,
+				scope: row.scope,
+				branch: row.branch,
+				ordinal: row.ordinal
+			}
+		};
+	}
+	rowToOperationIndexEntry(row) {
+		return {
+			ordinal: row.ordinal,
+			documentId: row.documentId,
+			documentType: row.documentType,
+			branch: row.branch,
+			scope: row.scope,
+			index: row.index,
+			timestampUtcMs: row.timestampUtcMs,
+			hash: row.hash,
+			skip: row.skip,
+			action: row.action,
+			deniedReason: row.deniedReason ?? void 0,
+			id: row.opId,
+			sourceRemote: row.sourceRemote
+		};
+	}
+	async getLatestTimestampForCollection(collectionId, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		return (await this.queryExecutor.selectFrom("operation_index_operations as oi").innerJoin("document_collections as dc", "oi.documentId", "dc.documentId").select("oi.timestampUtcMs").where("dc.collectionId", "=", collectionId).where(sql`(dc."leftOrdinal" IS NULL OR oi.ordinal < dc."leftOrdinal")`).orderBy("oi.ordinal", "desc").limit(1).executeTakeFirst())?.timestampUtcMs ?? null;
+	}
+	async getCollectionsForDocuments(documentIds) {
+		if (documentIds.length === 0) return {};
+		const rows = await this.queryExecutor.selectFrom("document_collections").select(["documentId", "collectionId"]).where("documentId", "in", documentIds).where("leftOrdinal", "is", null).execute();
+		const result = {};
+		for (const row of rows) {
+			if (!(row.documentId in result)) result[row.documentId] = [];
+			result[row.documentId].push(row.collectionId);
+		}
+		return result;
+	}
+};
+//#endregion
+//#region src/cache/buffer/ring-buffer.ts
+/**
+* RingBuffer is a generic circular buffer implementation that stores a fixed number
+* of items. When the buffer is full, new items overwrite the oldest items.
+*
+* This implementation maintains O(1) time complexity for push operations and provides
+* items in chronological order (oldest to newest) via getAll().
+*
+* @template T - The type of items stored in the buffer
+*/
+var RingBuffer = class {
+	buffer;
+	head = 0;
+	size = 0;
+	capacity;
+	constructor(capacity) {
+		if (capacity <= 0) throw new Error("Ring buffer capacity must be greater than 0");
+		this.capacity = capacity;
+		this.buffer = new Array(capacity);
+	}
+	/**
+	* Adds an item to the buffer. If the buffer is full, overwrites the oldest item.
+	*
+	* @param item - The item to add
+	*/
+	push(item) {
+		const index = (this.head + this.size) % this.capacity;
+		if (this.size < this.capacity) {
+			this.buffer[index] = item;
+			this.size++;
+		} else {
+			this.buffer[this.head] = item;
+			this.head = (this.head + 1) % this.capacity;
+		}
+	}
+	/**
+	* Returns all items in the buffer in chronological order (oldest to newest).
+	*
+	* @returns Array of items in insertion order
+	*/
+	getAll() {
+		if (this.size === 0) return [];
+		const result = [];
+		for (let i = 0; i < this.size; i++) {
+			const index = (this.head + i) % this.capacity;
+			result.push(this.buffer[index]);
+		}
+		return result;
+	}
+	/**
+	* Clears all items from the buffer.
+	*/
+	clear() {
+		this.buffer = new Array(this.capacity);
+		this.head = 0;
+		this.size = 0;
+	}
+	/**
+	* Gets the current number of items in the buffer.
+	*/
+	get length() {
+		return this.size;
+	}
+};
+//#endregion
+//#region src/cache/kysely-write-cache.ts
+/**
+* The last operation index a keyframe's document reflects for the scope. A
+* keyframe only exists for a scope that has operations, so a missing entry
+* means the stored row is corrupt.
+*/
+function keyframeRevision(keyframe, documentId, scope) {
+	const nextIndex = keyframe.document.header.revision[scope];
+	if (typeof nextIndex !== "number") throw new Error(`Corrupt keyframe for document ${documentId} at revision ${keyframe.revision}: header carries no ${scope} revision`);
+	return nextIndex - 1;
+}
+function extractModuleVersion(doc) {
+	const v = doc.state.document.version;
+	return normalizeDocumentModelVersion(v);
+}
+/** The highest revision held, latest push winning a tie. */
+function highestRevision(snapshots) {
+	let newest = void 0;
+	for (const snapshot of snapshots) if (!newest || snapshot.revision >= newest.revision) newest = snapshot;
+	return newest;
+}
+/**
+* Copies a document far enough that the caller cannot write through it. Inside
+* this class, callers only ever replace whole fields on these four, so one
+* level each is enough.
+*/
+function copyDocument(document) {
+	return {
+		...document,
+		header: { ...document.header },
+		state: { ...document.state },
+		operations: { ...document.operations }
+	};
+}
+var KyselyWriteCache = class KyselyWriteCache {
+	streams;
+	lruTracker;
+	keyframeStore;
+	operationStore;
+	registry;
+	config;
+	reads = /* @__PURE__ */ new Map();
+	constructor(keyframeStore, operationStore, registry, config) {
+		this.keyframeStore = keyframeStore;
+		this.operationStore = operationStore;
+		this.registry = registry;
+		this.config = {
+			maxDocuments: config.maxDocuments,
+			ringBufferSize: config.ringBufferSize,
+			keyframeInterval: config.keyframeInterval
+		};
+		this.streams = /* @__PURE__ */ new Map();
+		this.lruTracker = new LRUTracker();
+	}
+	withScopedStores(operationStore, keyframeStore) {
+		const scoped = new KyselyWriteCache(keyframeStore, operationStore, this.registry, this.config);
+		scoped.streams = this.streams;
+		scoped.lruTracker = this.lruTracker;
+		scoped.reads = this.reads;
+		return scoped;
+	}
+	/**
+	* Initializes the write cache.
+	* Currently a no-op as keyframe store lifecycle is managed externally.
+	*/
+	async startup() {
+		return Promise.resolve();
+	}
+	/**
+	* Shuts down the write cache.
+	* Currently a no-op as keyframe store lifecycle is managed externally.
+	*/
+	async shutdown() {
+		return Promise.resolve();
+	}
+	/**
+	* Retrieves document state at a specific revision from cache or rebuilds it.
+	*
+	* Note: this returns a _shallow_ copy of the document.
+	*
+	* Cache hit path: Returns cached snapshot if available (O(1))
+	* Warm miss path: Rebuilds from cached base revision + incremental ops
+	* Cold miss path: Rebuilds from keyframe or from scratch using all operations
+	*
+	* @param documentId - The document identifier
+	* @param scope - The operation scope
+	* @param branch - The operation branch
+	* @param targetRevision - The target revision, or undefined for newest
+	* @param signal - Optional abort signal to cancel the operation
+	* @returns The document at the target revision
+	* @throws {Error} "Operation aborted" if signal is aborted
+	* @throws {ModuleNotFoundError} If document type not registered in registry
+	* @throws {DocumentPurgedError} If the stream's only row is a purge marker
+	* @throws {Error} "Failed to rebuild document" if operation store fails
+	* @throws {Error} If reducer throws during operation application
+	* @throws {Error} If document serialization fails
+	*/
+	async getState(documentId, scope, branch, targetRevision, signal) {
+		const read = { evicted: false };
+		let pending = this.reads.get(documentId);
+		if (!pending) {
+			pending = /* @__PURE__ */ new Set();
+			this.reads.set(documentId, pending);
+		}
+		pending.add(read);
+		try {
+			return await this.readState(documentId, scope, branch, targetRevision, signal, read);
+		} finally {
+			pending.delete(read);
+			if (pending.size === 0) this.reads.delete(documentId);
+		}
+	}
+	async readState(documentId, scope, branch, targetRevision, signal, read) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		const streamKey = this.makeStreamKey(documentId, scope, branch);
+		const stream = this.streams.get(streamKey);
+		if (stream) {
+			const snapshots = stream.ringBuffer.getAll();
+			if (targetRevision === void 0) {
+				const newest = highestRevision(snapshots);
+				if (newest?.position === "head") {
+					this.lruTracker.touch(streamKey);
+					return copyDocument(newest.document);
+				}
+				if (newest) {
+					const document = await this.warmMissRebuild(newest.document, newest.revision, documentId, scope, branch, void 0, signal);
+					this.storeUnlessEvicted(read, documentId, scope, branch, (document.header.revision[scope] ?? 0) - 1, document, "head");
+					this.lruTracker.touch(streamKey);
+					return document;
+				}
+			} else {
+				const exactMatch = snapshots.findLast((s) => s.revision === targetRevision);
+				if (exactMatch) {
+					this.lruTracker.touch(streamKey);
+					return copyDocument(exactMatch.document);
+				}
+				const newestOlder = this.findNearestOlderSnapshot(snapshots, targetRevision);
+				if (newestOlder) {
+					const document = await this.warmMissRebuild(newestOlder.document, newestOlder.revision, documentId, scope, branch, targetRevision, signal);
+					this.storeUnlessEvicted(read, documentId, scope, branch, targetRevision, document, "historical");
+					this.lruTracker.touch(streamKey);
+					return document;
+				}
+			}
+		}
+		const document = await this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
+		const revision = targetRevision ?? (document.header.revision[scope] ?? 0) - 1;
+		this.storeUnlessEvicted(read, documentId, scope, branch, revision, document, targetRevision === void 0 ? "head" : "historical");
+		return document;
+	}
+	/**
+	* Stores a document snapshot in the cache at a specific revision.
+	*
+	* The cached document is a shallow copy of the input with its operation history
+	* truncated to the last operation per scope and its clipboard cleared. This keeps
+	* memory use and copy costs constant regardless of operation count. Consumers of
+	* getState() must not rely on the full operation history being present; the only
+	* guaranteed invariant is that operations[scope].at(-1) reflects the latest
+	* operation index for each scope.
+	*
+	* Updates LRU tracker and may evict least recently used stream if at capacity.
+	* Asynchronously persists keyframes at configured intervals (fire-and-forget).
+	*
+	* @param documentId - The document identifier
+	* @param scope - The operation scope
+	* @param branch - The operation branch
+	* @param revision - The revision number
+	* @param document - The document to cache
+	* @throws {Error} If document serialization fails
+	*/
+	putState(documentId, scope, branch, revision, document, position) {
+		this.store(documentId, scope, branch, revision, document, position);
+	}
+	/**
+	* Stores the run's head and mints a keyframe for every interval the run
+	* crossed on its way there. Only the head enters the ring buffer; the
+	* earlier revisions are keyframe candidates and nothing more.
+	*/
+	putRun(documentId, scope, branch, run) {
+		if (run.length === 0) return;
+		for (const entry of run.slice(0, -1)) this.persistKeyframe(documentId, scope, branch, entry.revision, entry.document);
+		const head = run[run.length - 1];
+		this.store(documentId, scope, branch, head.revision, head.document, "head");
+	}
+	storeUnlessEvicted(read, documentId, scope, branch, revision, document, position) {
+		if (!read.evicted) this.store(documentId, scope, branch, revision, document, position);
+	}
+	store(documentId, scope, branch, revision, document, position) {
+		const streamKey = this.makeStreamKey(documentId, scope, branch);
+		const stream = this.getOrCreateStream(streamKey);
+		const snapshot = {
+			revision,
+			document: {
+				...copyDocument(document),
+				operations: Object.fromEntries(Object.entries(document.operations).map(([k, ops]) => [k, ops.length ? [ops.at(-1)] : []])),
+				clipboard: []
+			},
+			position
+		};
+		stream.ringBuffer.push(snapshot);
+		this.persistKeyframe(documentId, scope, branch, revision, document);
+	}
+	/** Persists the snapshot if this revision is one the interval falls on. */
+	persistKeyframe(documentId, scope, branch, revision, document) {
+		if (!this.isKeyframeRevision(revision)) return;
+		this.keyframeStore.putKeyframe(documentId, scope, branch, revision, {
+			...document,
+			operations: {},
+			clipboard: []
+		}).catch((err) => {
+			console.error(`Failed to persist keyframe ${documentId}@${revision}:`, err);
+		});
+	}
+	/**
+	* Invalidates cached document streams.
+	*
+	* Supports three invalidation scopes:
+	* - Document-level: invalidate(documentId) - removes all streams for document
+	* - Scope-level: invalidate(documentId, scope) - removes all branches for scope
+	* - Stream-level: invalidate(documentId, scope, branch) - removes specific stream
+	*
+	* @param documentId - The document identifier
+	* @param scope - Optional scope to narrow invalidation
+	* @param branch - Optional branch to narrow invalidation (requires scope)
+	* @returns The number of streams evicted
+	*/
+	invalidate(documentId, scope, branch) {
+		for (const read of this.reads.get(documentId) ?? []) read.evicted = true;
+		let evicted = 0;
+		if (scope === void 0 && branch === void 0) {
+			for (const [key] of this.streams.entries()) if (key.startsWith(`${documentId}:`)) {
+				this.streams.delete(key);
+				this.lruTracker.remove(key);
+				evicted++;
+			}
+		} else if (scope !== void 0 && branch === void 0) {
+			for (const [key] of this.streams.entries()) if (key.startsWith(`${documentId}:${scope}:`)) {
+				this.streams.delete(key);
+				this.lruTracker.remove(key);
+				evicted++;
+			}
+		} else if (scope !== void 0 && branch !== void 0) {
+			const key = this.makeStreamKey(documentId, scope, branch);
+			if (this.streams.has(key)) {
+				this.streams.delete(key);
+				this.lruTracker.remove(key);
+				evicted = 1;
+			}
+		}
+		return evicted;
+	}
+	/**
+	* Clears the entire cache, removing all cached document streams.
+	* Resets LRU tracking state. This operation always succeeds.
+	*/
+	clear() {
+		for (const pending of this.reads.values()) for (const read of pending) read.evicted = true;
+		this.streams.clear();
+		this.lruTracker.clear();
+	}
+	/**
+	* Retrieves a specific stream for a document. Exposed on the implementation
+	* for testing, but not on the interface.
+	*
+	* @internal
+	*/
+	getStream(documentId, scope, branch) {
+		const key = this.makeStreamKey(documentId, scope, branch);
+		return this.streams.get(key);
+	}
+	async findNearestKeyframe(documentId, scope, branch, targetRevision, signal) {
+		if (targetRevision === Number.MAX_SAFE_INTEGER || targetRevision <= 0) return;
+		const keyframe = await this.keyframeStore.findNearestKeyframe(documentId, scope, branch, targetRevision, signal);
+		if (!keyframe) return;
+		return {
+			revision: Math.min(keyframeRevision(keyframe, documentId, scope), keyframe.revision),
+			document: keyframe.document
+		};
+	}
+	/**
+	* Rebuilds a scope from a keyframe or from the whole operation history.
+	*
+	* The document scope is always rebuilt first, because it carries the type,
+	* the upgrades and the deletion marker. Its version-changing upgrades are not
+	* applied there though: an upgrade reducer must see the state the requested
+	* scope has reached at that upgrade's boundary, so each one is held back and
+	* applied when the replay below crosses the boundary that
+	* resolveModuleVersionForOp derives from it. Upgrades whose boundary lies past
+	* the last replayed operation are applied at the end. Creation-time 0->N seed
+	* upgrades carry the initial state, so they still apply immediately.
+	*/
+	async coldMissRebuild(documentId, scope, branch, targetRevision, signal, fromKeyframe = true) {
+		const effectiveTargetRevision = targetRevision || Number.MAX_SAFE_INTEGER;
+		const keyframe = fromKeyframe ? await this.findNearestKeyframe(documentId, scope, branch, effectiveTargetRevision, signal) : void 0;
+		const documentScopeBound = scope === "document" ? targetRevision : void 0;
+		let document;
+		let startRevision;
+		let documentType;
+		const validatedUpgrades = [];
+		const pendingUpgrades = [];
+		let lastDocumentScopeOperation;
+		if (keyframe) {
+			document = keyframe.document;
+			startRevision = keyframe.revision;
+			documentType = keyframe.document.header.documentType;
+			const documentScopeResume = scope === "document" ? keyframe.revision : keyframeRevision(keyframe, documentId, "document");
+			const docScopeOpsAfterKeyframe = await this.operationStore.getSince(documentId, "document", branch, documentScopeResume, void 0, void 0, signal);
+			for (const operation of docScopeOpsAfterKeyframe.results) {
+				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
+				lastDocumentScopeOperation = operation;
+				if (operation.error || isDenied(operation)) continue;
+				if (operation.action.type === "UPGRADE_DOCUMENT") {
+					const upgradeAction = operation.action;
+					const fromVersion = upgradeAction.input.fromVersion;
+					const toVersion = upgradeAction.input.toVersion;
+					if (fromVersion > 0 && fromVersion < toVersion) {
+						let upgradePath;
+						try {
+							upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
+						} catch (err) {
+							if (upgradeAction.input.initialState !== void 0) upgradePath = void 0;
+							else throw new Error(`Failed to rebuild document ${documentId}: no upgrade manifest for ${documentType} v${fromVersion}→v${toVersion} and no initialState snapshot. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+						}
+						validatedUpgrades.push({
+							fromVersion,
+							toVersion,
+							revision: upgradeAction.input.revision,
+							timestampUtcMs: operation.timestampUtcMs
+						});
+						pendingUpgrades.push({
+							action: upgradeAction,
+							upgradePath,
+							index: operation.index,
+							subsequentDeletes: []
+						});
+					}
+				} else if (operation.action.type === "DELETE_DOCUMENT" || operation.action.type === PURGE_DOCUMENT) {
+					applyDeleteDocumentAction(document, operation.action);
+					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
+				}
+			}
+		} else {
+			startRevision = -1;
+			const createOpResult = await this.operationStore.getSince(documentId, "document", branch, -1, void 0, {
+				cursor: "0",
+				limit: 1
+			}, signal);
+			if (createOpResult.results.length === 0) throw new DocumentNotFoundError(documentId);
+			const createOp = createOpResult.results[0];
+			if (isPurgeMarker(createOp)) throw new DocumentPurgedError(documentId);
+			if (createOp.action.type !== "CREATE_DOCUMENT") throw new Error(`Failed to rebuild document ${documentId}: first operation in document scope must be CREATE_DOCUMENT, found ${createOp.action.type}`);
+			const documentCreateAction = createOp.action;
+			documentType = documentCreateAction.input.model;
+			if (!documentType) throw new Error(`Failed to rebuild document ${documentId}: CREATE_DOCUMENT action missing model in input`);
+			document = createDocumentFromAction(documentCreateAction);
+			lastDocumentScopeOperation = createOp;
+			let docModule = this.registry.getModule(documentType, extractModuleVersion(document));
+			const docScopeOps = await this.operationStore.getSince(documentId, "document", branch, 0, void 0, void 0, signal);
+			for (const operation of docScopeOps.results) {
+				if (documentScopeBound !== void 0 && operation.index > documentScopeBound) break;
+				lastDocumentScopeOperation = operation;
+				if (operation.index === 0) continue;
+				if (operation.error || isDenied(operation)) continue;
+				if (operation.action.type === "UPGRADE_DOCUMENT") {
+					const upgradeAction = operation.action;
+					const fromVersion = upgradeAction.input.fromVersion;
+					const toVersion = upgradeAction.input.toVersion;
+					if (fromVersion > 0 && fromVersion < toVersion) {
+						let upgradePath;
+						try {
+							upgradePath = this.registry.computeUpgradePath(documentType, fromVersion, toVersion);
+						} catch (err) {
+							if (upgradeAction.input.initialState !== void 0) upgradePath = void 0;
+							else throw new Error(`Failed to rebuild document ${documentId}: no upgrade manifest for ${documentType} v${fromVersion}→v${toVersion} and no initialState snapshot. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+						}
+						validatedUpgrades.push({
+							fromVersion,
+							toVersion,
+							revision: upgradeAction.input.revision,
+							timestampUtcMs: operation.timestampUtcMs
+						});
+						pendingUpgrades.push({
+							action: upgradeAction,
+							upgradePath,
+							index: operation.index,
+							subsequentDeletes: []
+						});
+					} else document = applyUpgradeDocumentAction(document, upgradeAction, void 0);
+					docModule = this.registry.getModule(documentType, normalizeDocumentModelVersion(toVersion));
+				} else if (operation.action.type === "DELETE_DOCUMENT" || operation.action.type === PURGE_DOCUMENT) {
+					applyDeleteDocumentAction(document, operation.action);
+					for (const pending of pendingUpgrades) pending.subsequentDeletes.push(operation.action);
+				} else {
+					const protocolVersion = baseReducerVersion(document.header);
+					document = withProtocolVersions(docModule.reducer(document, operation.action, void 0, {
+						skip: operation.skip,
+						protocolVersion
+					}), document.header.protocolVersions);
+				}
+			}
+		}
+		if (scope === "document") {
+			document = this.applyPendingUpgrades(document, pendingUpgrades, Number.MAX_SAFE_INTEGER);
+			const last = lastDocumentScopeOperation ?? await this.operationAt(documentId, "document", branch, startRevision, signal);
+			document.operations = {
+				...document.operations,
+				document: last ? [last] : []
+			};
+			return this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+		}
+		if (keyframe) {
+			const resumeOperation = await this.operationAt(documentId, scope, branch, startRevision, signal);
+			if (resumeOperation) document.operations = {
+				...document.operations,
+				[scope]: [resumeOperation]
+			};
+		}
+		const moduleCache = /* @__PURE__ */ new Map();
+		const getModuleCached = (version) => {
+			const key = version ?? 0;
+			let mod = moduleCache.get(key);
+			if (!mod) {
+				mod = this.registry.getModule(documentType, version);
+				moduleCache.set(key, mod);
+			}
+			return mod;
+		};
+		const finalVersion = validatedUpgrades.at(-1)?.toVersion ?? extractModuleVersion(document);
+		let cursor = void 0;
+		const pageSize = 100;
+		let hasMorePages;
+		let needsFullReplay = false;
+		do {
+			if (signal?.aborted) throw new Error("Operation aborted");
+			const paging = {
+				cursor: cursor || "0",
+				limit: pageSize
+			};
+			try {
+				const result = await this.operationStore.getSince(documentId, scope, branch, startRevision, void 0, paging, signal);
+				for (const operation of result.results) {
+					if (targetRevision !== void 0 && operation.index > targetRevision) break;
+					if (keyframe && operation.skip > 0) {
+						needsFullReplay = true;
+						break;
+					}
+					const moduleVersion = this.resolveModuleVersionForOp(operation.index, operation.timestampUtcMs, scope, validatedUpgrades, finalVersion);
+					document = this.applyPendingUpgrades(document, pendingUpgrades, moduleVersion ?? Number.MAX_SAFE_INTEGER);
+					if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
+					else {
+						const protocolVersion = baseReducerVersion(document.header);
+						document = withProtocolVersions(getModuleCached(moduleVersion).reducer(document, operation.action, void 0, {
+							skip: operation.skip,
+							protocolVersion,
+							replayOptions: { operation },
+							skipIndexValidation: true
+						}), document.header.protocolVersions);
+					}
+				}
+				const reachedTarget = targetRevision !== void 0 && result.results.some((op) => op.index >= targetRevision);
+				hasMorePages = Boolean(result.nextCursor) && !reachedTarget && !needsFullReplay;
+				if (hasMorePages) cursor = result.nextCursor;
+			} catch (err) {
+				throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			}
+		} while (hasMorePages);
+		if (needsFullReplay) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal, false);
+		document = this.applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision);
+		document = await this.stampRevisions(document, documentId, scope, branch, targetRevision, signal);
+		if (pendingUpgrades.length > 0) {
+			const firstHeldBack = pendingUpgrades[0];
+			const stamped = document.header.revision["document"] ?? 0;
+			document.header.revision = {
+				...document.header.revision,
+				document: Math.min(stamped, firstHeldBack.index)
+			};
+		}
+		return document;
+	}
+	/**
+	* Applies and removes every held-back upgrade whose target version is at or
+	* below `throughVersion`, in the order the document scope recorded them.
+	*/
+	applyPendingUpgrades(document, pendingUpgrades, throughVersion) {
+		while (pendingUpgrades.length > 0) {
+			const pending = pendingUpgrades[0];
+			if (throughVersion < pending.action.input.toVersion) break;
+			pendingUpgrades.shift();
+			document = this.applyPendingUpgrade(document, pending);
+		}
+		return document;
+	}
+	/**
+	* Applies the remaining held-back upgrades after the requested scope's
+	* replay has finished. A head read applies them all. A positional read
+	* applies only those whose boundary for this scope lies at or before the
+	* target position: applying a later one would label migrated state with a
+	* pre-upgrade revision, and a keyframe stored from that poisons every
+	* rebuild that resumes from it. Boundaries come from the upgrade's revision
+	* snapshot; an upgrade without one records no position for this scope, and
+	* the replay loop not having crossed it already places it past the target.
+	*/
+	applyTailPendingUpgrades(document, pendingUpgrades, scope, targetRevision) {
+		while (pendingUpgrades.length > 0) {
+			const pending = pendingUpgrades[0];
+			if (targetRevision !== void 0) {
+				const snapshot = pending.action.input.revision;
+				if (snapshot === void 0) break;
+				if ((snapshot[scope] ?? 0) > targetRevision) break;
+			}
+			pendingUpgrades.shift();
+			document = this.applyPendingUpgrade(document, pending);
+		}
+		return document;
+	}
+	/**
+	* Applies one held-back upgrade, then re-applies the deletes the document
+	* scope recorded after it so the hold-back cannot invert their order.
+	*/
+	applyPendingUpgrade(document, pending) {
+		document = applyUpgradeDocumentAction(document, pending.action, pending.upgradePath);
+		for (const deleteAction of pending.subsequentDeletes) document = applyDeleteDocumentAction(document, deleteAction);
+		return document;
+	}
+	/**
+	* Copies the current document revisions onto the document. Overwrites the
+	* requested scope revision with the target revision, if provided.
+	*/
+	async stampRevisions(document, documentId, scope, branch, targetRevision, signal) {
+		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
+		document.header.revision = revisions.revision;
+		if (targetRevision !== void 0) document.header.revision = {
+			...document.header.revision,
+			[scope]: targetRevision + 1
+		};
+		document.header.lastModifiedAtUtcIso = revisions.latestTimestamp;
+		return document;
+	}
+	/** The stored operation at `index`, or undefined if it is no longer there. */
+	async operationAt(documentId, scope, branch, index, signal) {
+		if (index < 0) return;
+		const operation = (await this.operationStore.getSince(documentId, scope, branch, index - 1, void 0, {
+			cursor: "0",
+			limit: 1
+		}, signal)).results[0];
+		return operation && operation.index === index ? operation : void 0;
+	}
+	/**
+	* Resolves which module version to use for a given operation in phase 2.
+	*
+	* Uses the validated-upgrade boundary rules from D7:
+	* - If `input.revision` is present: op.index < revision[scope] → before the upgrade boundary
+	* - Otherwise: timestamp fallback
+	* - Falls back to final module version when neither is decidable
+	*/
+	resolveModuleVersionForOp(opIndex, opTimestamp, scope, validatedUpgrades, finalVersion) {
+		if (validatedUpgrades.length === 0) return finalVersion;
+		let currentVersion = validatedUpgrades[0]?.fromVersion;
+		for (const upgrade of validatedUpgrades) {
+			let beforeUpgrade;
+			if (upgrade.revision !== void 0) beforeUpgrade = opIndex < (upgrade.revision[scope] ?? 0);
+			else beforeUpgrade = opTimestamp < upgrade.timestampUtcMs;
+			if (beforeUpgrade) return currentVersion;
+			currentVersion = upgrade.toVersion;
+		}
+		return currentVersion;
+	}
+	async warmMissRebuild(baseDocument, baseRevision, documentId, scope, branch, targetRevision, signal) {
+		const documentType = baseDocument.header.documentType;
+		const docScopeNextIndex = baseDocument.header.revision["document"] ?? 0;
+		if ((await this.operationStore.getSince(documentId, "document", branch, docScopeNextIndex - 1, void 0, void 0, signal)).results.length > 0) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal);
+		const module = this.registry.getModule(documentType, extractModuleVersion(baseDocument));
+		let document = copyDocument(baseDocument);
+		let needsFullReplay = false;
+		try {
+			const pagedResults = await this.operationStore.getSince(documentId, scope, branch, baseRevision, void 0, void 0, signal);
+			for (const operation of pagedResults.results) {
+				if (signal?.aborted) throw new Error("Operation aborted");
+				if (targetRevision !== void 0 && operation.index > targetRevision) break;
+				if (operation.skip > 0) {
+					needsFullReplay = true;
+					break;
+				}
+				if (isDenied(operation)) document = appendWithoutApplying(document, operation, scope);
+				else {
+					const protocolVersion = baseReducerVersion(document.header);
+					document = withProtocolVersions(module.reducer(document, operation.action, void 0, {
+						skip: operation.skip,
+						protocolVersion,
+						replayOptions: { operation },
+						skipIndexValidation: true
+					}), document.header.protocolVersions);
+				}
+				if (targetRevision !== void 0 && operation.index === targetRevision) break;
+			}
+		} catch (err) {
+			throw new Error(`Failed to rebuild document ${documentId}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+		}
+		if (needsFullReplay) return this.coldMissRebuild(documentId, scope, branch, targetRevision, signal, false);
+		const revisions = await this.operationStore.getRevisions(documentId, branch, signal);
+		document.header.revision = revisions.revision;
+		if (targetRevision !== void 0) document.header.revision = {
+			...document.header.revision,
+			[scope]: targetRevision + 1
+		};
+		document.header.lastModifiedAtUtcIso = revisions.latestTimestamp;
+		return document;
+	}
+	findNearestOlderSnapshot(snapshots, targetRevision) {
+		let nearest = void 0;
+		for (const snapshot of snapshots) if (snapshot.revision < targetRevision) {
+			if (!nearest || snapshot.revision > nearest.revision) nearest = snapshot;
+		}
+		return nearest;
+	}
+	makeStreamKey(documentId, scope, branch) {
+		return `${documentId}:${scope}:${branch}`;
+	}
+	getOrCreateStream(key) {
+		let stream = this.streams.get(key);
+		if (!stream) {
+			if (this.streams.size >= this.config.maxDocuments) {
+				const evictKey = this.lruTracker.evict();
+				if (evictKey) this.streams.delete(evictKey);
+			}
+			stream = {
+				key,
+				ringBuffer: new RingBuffer(this.config.ringBufferSize)
+			};
+			this.streams.set(key, stream);
+		}
+		this.lruTracker.touch(key);
+		return stream;
+	}
+	isKeyframeRevision(revision) {
+		return revision > 0 && revision % this.config.keyframeInterval === 0;
+	}
+};
+//#endregion
+//#region src/events/event-bus.ts
+var EventBus = class {
+	eventTypeToSubscribers = /* @__PURE__ */ new Map();
+	subscribe(type, subscriber) {
+		let list = this.eventTypeToSubscribers.get(type);
+		if (!list) {
+			list = [];
+			this.eventTypeToSubscribers.set(type, list);
+		}
+		list.push(subscriber);
+		let done = false;
+		return () => {
+			if (done) return;
+			done = true;
+			const arr = this.eventTypeToSubscribers.get(type);
+			if (!arr) return;
+			const idx = arr.indexOf(subscriber);
+			if (idx !== -1) arr.splice(idx, 1);
+			if (arr.length === 0) this.eventTypeToSubscribers.delete(type);
+		};
+	}
+	async emit(type, data) {
+		const list = this.eventTypeToSubscribers.get(type);
+		if (!list || list.length === 0) return;
+		const snapshot = list.slice();
+		const errors = [];
+		for (const fn of snapshot) try {
+			await Promise.resolve(fn(type, data));
+		} catch (err) {
+			errors.push(err);
+		}
+		if (errors.length > 0) throw new EventBusAggregateError(errors);
+	}
+};
+//#endregion
+//#region src/storage/kysely/keyframe-store.ts
+var KyselyKeyframeStore = class KyselyKeyframeStore {
+	db;
+	trx;
+	constructor(db) {
+		this.db = db;
+	}
+	get queryExecutor() {
+		return this.trx ?? this.db;
+	}
+	withTransaction(trx) {
+		const instance = new KyselyKeyframeStore(this.db);
+		instance.trx = trx;
+		return instance;
+	}
+	async putKeyframe(documentId, scope, branch, revision, document, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		const write = async (trx) => {
+			await acquirePurgeLocks(trx, [documentId], "shared");
+			if ((await findPurged(trx, [documentId])).has(documentId)) return;
+			await trx.insertInto("Keyframe").values({
+				documentId,
+				documentType: document.header.documentType,
+				scope,
+				branch,
+				revision,
+				document
+			}).onConflict((oc) => oc.columns([
+				"documentId",
+				"scope",
+				"branch",
+				"revision"
+			]).doUpdateSet({ document })).execute();
+		};
+		if (this.trx) {
+			await write(this.trx);
+			return;
+		}
+		await this.db.transaction().execute(write);
+	}
+	async findNearestKeyframe(documentId, scope, branch, targetRevision, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		const row = await this.queryExecutor.selectFrom("Keyframe").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("revision", "<=", targetRevision).orderBy("revision", "desc").limit(1).executeTakeFirst();
+		if (!row) return;
+		return {
+			revision: row.revision,
+			document: row.document
+		};
+	}
+	async listKeyframes(documentId, scope, branch, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		let query = this.queryExecutor.selectFrom("Keyframe").selectAll().where("documentId", "=", documentId).orderBy("revision", "asc");
+		if (scope !== void 0) query = query.where("scope", "=", scope);
+		if (branch !== void 0) query = query.where("branch", "=", branch);
+		return (await query.execute()).map((row) => ({
+			scope: row.scope,
+			branch: row.branch,
+			revision: row.revision,
+			document: row.document
+		}));
+	}
+	async deleteKeyframes(documentId, scope, branch, signal) {
+		if (signal?.aborted) throw new Error("Operation aborted");
+		let query = this.queryExecutor.deleteFrom("Keyframe").where("documentId", "=", documentId);
+		if (scope !== void 0 && branch !== void 0) query = query.where("scope", "=", scope).where("branch", "=", branch);
+		else if (scope !== void 0) query = query.where("scope", "=", scope);
+		const result = await query.executeTakeFirst();
+		return Number(result.numDeletedRows || 0n);
+	}
+};
+//#endregion
+//#region src/storage/kysely/pagination.ts
+const DEFAULT_LIMIT = 100;
+function paginateRows(rows, paging, cursorOf, toItem, refetch) {
+	let hasMore = false;
+	let items = rows;
+	if (paging?.limit && rows.length > paging.limit) {
+		hasMore = true;
+		items = rows.slice(0, paging.limit);
+	}
+	const nextCursor = hasMore && items.length > 0 ? cursorOf(items[items.length - 1]).toString() : void 0;
+	const cursor = paging?.cursor || "0";
+	const limit = paging?.limit || DEFAULT_LIMIT;
+	return {
+		results: items.map(toItem),
+		options: {
+			cursor,
+			limit
+		},
+		nextCursor,
+		next: hasMore ? () => refetch(nextCursor, limit) : void 0
+	};
+}
+//#endregion
+//#region src/storage/txn.ts
+var AtomicTransaction = class {
+	documentId;
+	documentType;
+	scope;
+	branch;
+	baseRevision;
+	operations = [];
+	constructor(documentId, documentType, scope, branch, baseRevision) {
+		this.documentId = documentId;
+		this.documentType = documentType;
+		this.scope = scope;
+		this.branch = branch;
+		this.baseRevision = baseRevision;
+	}
+	addOperations(...operations) {
+		for (const op of operations) this.operations.push({
+			jobId: v4(),
+			opId: op.id,
+			prevOpId: "",
+			documentId: this.documentId,
+			documentType: this.documentType,
+			scope: this.scope,
+			branch: this.branch,
+			timestampUtcMs: new Date(op.timestampUtcMs),
+			index: op.index,
+			action: JSON.stringify(op.action),
+			skip: op.skip,
+			error: op.error || null,
+			deniedReason: op.deniedReason || null,
+			hash: op.hash
+		});
+	}
+	getOperations() {
+		return this.operations;
+	}
+};
+//#endregion
+//#region src/storage/kysely/store.ts
+var _UniqueConstraintContext = class extends Error {
+	documentId;
+	scope;
+	branch;
+	revision;
+	stagedOps;
+	constructor(documentId, scope, branch, revision, stagedOps) {
+		super("unique constraint");
+		this.documentId = documentId;
+		this.scope = scope;
+		this.branch = branch;
+		this.revision = revision;
+		this.stagedOps = stagedOps;
+		this.name = "UniqueConstraintContext";
+	}
+};
+function duplicateOf(ctx) {
+	const op = ctx.stagedOps[0];
+	return new DuplicateOperationError(`${op.opId} at index ${op.index} with skip ${op.skip}`);
+}
+var KyselyOperationStore = class KyselyOperationStore {
+	db;
+	trx;
+	liveIds;
+	constructor(db) {
+		this.db = db;
+	}
+	get queryExecutor() {
+		return this.trx ?? this.db;
+	}
+	/** `liveIds`: ids the transaction read untombstoned under its shared lock. */
+	withTransaction(trx, liveIds) {
+		const instance = new KyselyOperationStore(this.db);
+		instance.trx = trx;
+		instance.liveIds = liveIds;
+		return instance;
+	}
+	async apply(documentId, documentType, scope, branch, revision, fn, signal, condition) {
+		if (this.trx) {
+			let executeResult = null;
+			let uniqueCtx = null;
+			try {
+				executeResult = await this.executeApply(this.trx, documentId, documentType, scope, branch, revision, fn, signal, condition);
+			} catch (error) {
+				if (error instanceof _UniqueConstraintContext) uniqueCtx = error;
+				else throw error;
+			}
+			if (uniqueCtx !== null) throw duplicateOf(uniqueCtx);
+			return executeResult;
+		} else {
+			let transactionResult = null;
+			let uniqueCtx = null;
+			try {
+				transactionResult = await this.db.transaction().execute(async (trx) => {
+					return this.executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal, condition);
+				});
+			} catch (error) {
+				if (error instanceof _UniqueConstraintContext) uniqueCtx = error;
+				else throw error;
+			}
+			if (uniqueCtx !== null) return this.resolveUniqueConstraint(uniqueCtx);
+			return transactionResult;
+		}
+	}
+	async resolveUniqueConstraint(ctx) {
+		let replayOps = null;
+		try {
+			replayOps = await this.findIdempotentReplay(this.db, ctx.documentId, ctx.scope, ctx.branch, ctx.revision, ctx.stagedOps);
+		} catch {}
+		if (replayOps !== null) return replayOps;
+		throw duplicateOf(ctx);
+	}
+	async executeApply(trx, documentId, documentType, scope, branch, revision, fn, signal, condition) {
+		throwIfAborted(signal);
+		const atomicTxn = new AtomicTransaction(documentId, documentType, scope, branch, revision);
+		await fn(atomicTxn);
+		const operations = atomicTxn.getOperations();
+		if (operations.length === 0) return [];
+		const purgedHead = this.liveIds?.has(documentId) ? void 0 : await this.refusePurgedAppend(trx, documentId, operations);
+		if (purgedHead !== void 0) return purgedHead;
+		if (condition) await this.acquireStreamLocks(trx, documentId, scope, branch, condition);
+		const latestOp = await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "desc").limit(1).executeTakeFirst();
+		const currentRevision = latestOp ? latestOp.index : -1;
+		if (currentRevision !== revision - 1) {
+			let replayOps = null;
+			try {
+				replayOps = await this.findIdempotentReplay(trx, documentId, scope, branch, revision, operations);
+			} catch {}
+			if (replayOps !== null) return replayOps;
+			if (revision === 0 && this.isCreate(operations)) throw new DocumentAlreadyExistsError(documentId, scope, currentRevision);
+			throw new RevisionMismatchError(currentRevision + 1, revision);
+		}
+		let prevOpId = latestOp?.opId || "";
+		for (const op of operations) {
+			op.prevOpId = prevOpId;
+			prevOpId = op.opId;
+		}
+		let insertedCount = operations.length;
+		try {
+			if (condition && condition.streams.length > 0) insertedCount = await this.insertGuarded(trx, operations, condition);
+			else await trx.insertInto("Operation").values(operations).execute();
+		} catch (error) {
+			if (error instanceof Error && error.message.includes("unique constraint")) throw new _UniqueConstraintContext(documentId, scope, branch, revision, operations);
+			throw error;
+		}
+		if (insertedCount !== operations.length) throw new AppendConditionFailedError(condition);
+		return operations.map((op) => ({
+			index: op.index,
+			timestampUtcMs: op.timestampUtcMs.toISOString(),
+			hash: op.hash,
+			skip: op.skip,
+			error: op.error || void 0,
+			deniedReason: op.deniedReason || void 0,
+			id: op.opId,
+			action: JSON.parse(op.action)
+		}));
+	}
+	/**
+	* Locks the written stream and every read-set stream, in sorted key order
+	* so that overlapping concurrent appends serialize rather than deadlock.
+	* The locks are still taken one row at a time, so the query preserves that
+	* order. It must stay separate from the guarded insert, which would
+	* otherwise read a snapshot taken before the locks were held.
+	*/
+	async acquireStreamLocks(trx, documentId, scope, branch, condition) {
+		const keys = /* @__PURE__ */ new Set([`${documentId}:${scope}:${branch}`]);
+		for (const stream of condition.streams) keys.add(`${stream.documentId}:${stream.scope}:${stream.branch}`);
+		const sortedKeys = sql.join([...keys].sort());
+		await sql`
+      with ordered as materialized (
+        select key
+        from unnest(array[${sortedKeys}]::text[]) with ordinality as t(key, ord)
+        order by ord
+      )
+      select pg_advisory_xact_lock(hashtext(key)) from ordered
+    `.execute(trx);
+	}
+	/**
+	* Inserts the staged operations with the condition compiled in as a WHERE
+	* NOT EXISTS guard, making the check and the append one statement. Returns
+	* the rows inserted; zero means the guard failed and nothing was written.
+	*/
+	async insertGuarded(trx, operations, condition) {
+		const branches = operations.map((op) => trx.selectNoFrom([
+			sql`${op.jobId}::text`.as("jobId"),
+			sql`${op.opId}::text`.as("opId"),
+			sql`${op.prevOpId}::text`.as("prevOpId"),
+			sql`${op.documentId}::text`.as("documentId"),
+			sql`${op.documentType}::text`.as("documentType"),
+			sql`${op.scope}::text`.as("scope"),
+			sql`${op.branch}::text`.as("branch"),
+			sql`${op.timestampUtcMs}::timestamptz`.as("timestampUtcMs"),
+			sql`${op.index}::integer`.as("index"),
+			sql`${op.action}::jsonb`.as("action"),
+			sql`${op.skip}::integer`.as("skip"),
+			sql`${op.error ?? null}::text`.as("error"),
+			sql`${op.deniedReason ?? null}::text`.as("deniedReason"),
+			sql`${op.hash}::text`.as("hash")
+		]).where((eb) => eb.not(eb.exists(eb.selectFrom("Operation").select("Operation.id").where((web) => web.or(condition.streams.map((s) => web.and([
+			web("Operation.documentId", "=", s.documentId),
+			web("Operation.scope", "=", s.scope),
+			web("Operation.branch", "=", s.branch),
+			web("Operation.index", ">", s.revision)
+		]))))))));
+		let expression = branches[0];
+		for (let i = 1; i < branches.length; i++) expression = expression.unionAll(branches[i]);
+		return (await trx.insertInto("Operation").columns([
+			"jobId",
+			"opId",
+			"prevOpId",
+			"documentId",
+			"documentType",
+			"scope",
+			"branch",
+			"timestampUtcMs",
+			"index",
+			"action",
+			"skip",
+			"error",
+			"deniedReason",
+			"hash"
+		]).expression(expression).returning("id").execute()).length;
+	}
+	async findIdempotentReplay(executor, documentId, scope, branch, revision, stagedOps) {
+		const minIndex = revision;
+		const maxIndex = revision + stagedOps.length - 1;
+		const storedRows = await executor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("index", ">=", minIndex).where("index", "<=", maxIndex).orderBy("index", "asc").execute();
+		if (storedRows.length !== stagedOps.length) return null;
+		for (let i = 0; i < stagedOps.length; i++) {
+			const staged = stagedOps[i];
+			const stored = storedRows[i];
+			if (stored.opId !== staged.opId || stored.index !== staged.index || stored.skip !== staged.skip) return null;
+		}
+		return storedRows.map((row) => this.rowToOperation(row));
+	}
+	/** A purged stream refuses appends; a marker gets the stored one back. */
+	async refusePurgedAppend(trx, documentId, operations) {
+		if (!(await findPurged(trx, [documentId])).has(documentId)) return;
+		if (!operations.every((operation) => this.isMarker(operation))) throw new DocumentPurgedError(documentId);
+		return (await trx.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where(sql`action->>'type' = ${PURGE_DOCUMENT}`).orderBy("index", "asc").execute()).map((row) => this.rowToOperation(row));
+	}
+	isMarker(operation) {
+		return this.actionType(operation) === PURGE_DOCUMENT;
+	}
+	actionType(operation) {
+		let action = operation.action;
+		if (typeof action === "string") try {
+			action = JSON.parse(action);
+		} catch {
+			return;
+		}
+		if (typeof action === "object" && action !== null && "type" in action && typeof action.type === "string") return action.type;
+	}
+	/** True when the staged write creates a document rather than appending to one. */
+	isCreate(operations) {
+		for (const operation of operations) {
+			let action = operation.action;
+			if (typeof action === "string") try {
+				action = JSON.parse(action);
+			} catch {
+				continue;
+			}
+			if (typeof action === "object" && action !== null && "type" in action && typeof action.type === "string" && action.type === "CREATE_DOCUMENT") return true;
+		}
+		return false;
+	}
+	/**
+	* The paging cursor here encodes the index to resume from (one past the
+	* last row returned), not the last row's own index. This keeps "0" an
+	* unambiguous start-of-stream sentinel even when a page ends at index 0
+	* (e.g. `limit: 1` on a fresh stream), which would otherwise make
+	* `nextCursor` equal the start cursor and loop a caller that walks pages
+	* forever.
+	*/
+	async getSince(documentId, scope, branch, revision, filter, paging, signal) {
+		throwIfAborted(signal);
+		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("index", ">", revision).orderBy("index", "asc");
+		if (filter) {
+			if (filter.actionTypes && filter.actionTypes.length > 0) {
+				const actionTypesArray = filter.actionTypes.map((t) => `'${t.replace(/'/g, "''")}'`).join(",");
+				query = query.where(sql`action->>'type' = ANY(ARRAY[${sql.raw(actionTypesArray)}]::text[])`);
+			}
+			if (filter.timestampFrom) query = query.where("timestampUtcMs", ">=", new Date(filter.timestampFrom));
+			if (filter.timestampTo) query = query.where("timestampUtcMs", "<=", new Date(filter.timestampTo));
+			if (filter.sinceRevision !== void 0) query = query.where("index", ">=", filter.sinceRevision);
+		}
+		if (paging) {
+			const cursorValue = Number.parseInt(paging.cursor, 10);
+			if (Number.isFinite(cursorValue) && cursorValue > 0) query = query.where("index", ">=", cursorValue);
+			if (paging.limit) query = query.limit(paging.limit + 1);
+		}
+		return paginateRows(await query.execute(), paging, (row) => row.index + 1, (row) => this.rowToOperation(row), (cursor, limit) => this.getSince(documentId, scope, branch, revision, filter, {
+			cursor,
+			limit
+		}, signal));
+	}
+	async getSinceId(id, paging, signal) {
+		throwIfAborted(signal);
+		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("id", ">", id).orderBy("id", "asc");
+		if (paging) {
+			const cursorValue = Number.parseInt(paging.cursor, 10);
+			if (cursorValue > 0) query = query.where("id", ">", cursorValue);
+			if (paging.limit) query = query.limit(paging.limit + 1);
+		}
+		return paginateRows(await query.execute(), paging, (row) => row.id, (row) => this.rowToOperationWithContext(row), (cursor, limit) => this.getSinceId(id, {
+			cursor,
+			limit
+		}, signal));
+	}
+	/**
+	* The paging cursor here encodes the index to resume from (one past the
+	* last row returned), not the last row's own index, for the same reason as
+	* `getSince`: a page ending at index 0 must not produce a cursor that is
+	* indistinguishable from the start-of-stream sentinel.
+	*/
+	async getConflicting(documentId, scope, branch, minTimestamp, paging, signal) {
+		throwIfAborted(signal);
+		let query = this.queryExecutor.selectFrom("Operation").selectAll().where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).where("timestampUtcMs", ">=", new Date(minTimestamp)).orderBy("index", "asc");
+		if (paging) {
+			const cursorValue = Number.parseInt(paging.cursor, 10);
+			if (Number.isFinite(cursorValue) && cursorValue > 0) query = query.where("index", ">=", cursorValue);
+			if (paging.limit) query = query.limit(paging.limit + 1);
+		}
+		return paginateRows(await query.execute(), paging, (row) => row.index + 1, (row) => this.rowToOperation(row), (cursor, limit) => this.getConflicting(documentId, scope, branch, minTimestamp, {
+			cursor,
+			limit
+		}, signal));
+	}
+	async getRevisions(documentId, branch, signal) {
+		throwIfAborted(signal);
+		const scopeRevisions = await this.queryExecutor.selectFrom("Operation").select("scope").select((eb) => eb.fn.max("index").as("index")).where("documentId", "=", documentId).where("branch", "=", branch).groupBy("scope").execute();
+		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("branch", "=", branch).executeTakeFirst();
+		const revision = {};
+		for (const row of scopeRevisions) revision[row.scope] = row.index + 1;
+		return {
+			revision,
+			latestTimestamp: latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : (/* @__PURE__ */ new Date(0)).toISOString()
+		};
+	}
+	async getStreamLatestTimestamp(documentId, scope, branch, signal) {
+		const latest = await this.queryExecutor.selectFrom("Operation").select((eb) => eb.fn.max("timestampUtcMs").as("latestTimestamp")).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).executeTakeFirst();
+		return latest?.latestTimestamp ? new Date(latest.latestTimestamp).toISOString() : void 0;
+	}
+	async findOperationIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return /* @__PURE__ */ new Set();
+		const rows = await this.queryExecutor.selectFrom("Operation").select("opId").distinct().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).execute();
+		return new Set(rows.map((row) => row.opId));
+	}
+	async getOperationsByIds(documentId, scope, branch, opIds, signal) {
+		throwIfAborted(signal);
+		if (opIds.length === 0) return [];
+		const rows = await this.queryExecutor.selectFrom("Operation").selectAll().where("opId", "in", opIds).where("documentId", "=", documentId).where("scope", "=", scope).where("branch", "=", branch).orderBy("index", "asc").execute();
+		const latest = /* @__PURE__ */ new Map();
+		for (const row of rows) latest.set(row.opId, this.rowToOperation(row));
+		return [...latest.values()];
+	}
+	rowToOperation(row) {
+		return {
+			index: row.index,
+			timestampUtcMs: row.timestampUtcMs.toISOString(),
+			hash: row.hash,
+			skip: row.skip,
+			error: row.error || void 0,
+			deniedReason: row.deniedReason || void 0,
+			id: row.opId,
+			action: row.action
+		};
+	}
+	rowToOperationWithContext(row) {
+		return {
+			operation: this.rowToOperation(row),
+			context: {
+				documentId: row.documentId,
+				documentType: row.documentType,
+				scope: row.scope,
+				branch: row.branch,
+				ordinal: row.id
+			}
+		};
+	}
+};
+//#endregion
+//#region src/storage/pool-instrumentation.ts
+/**
+* Wraps an existing pg.Pool with acquire-wait timing and an event
+* subscription surface. The pool is mutated in place: pool.connect()
+* is replaced with a timing wrapper so all callers (Kysely included)
+* pick up the instrumentation transparently.
+*/
+function instrumentPgPool(pool, name) {
+	const listeners = /* @__PURE__ */ new Set();
+	const originalConnect = pool.connect.bind(pool);
+	const wrappedConnect = async () => {
+		const start = performance.now();
+		const client = await originalConnect();
+		const durationMs = performance.now() - start;
+		for (const listener of listeners) try {
+			listener(durationMs);
+		} catch {}
+		return client;
+	};
+	pool.connect = wrappedConnect;
+	return {
+		name,
+		getStats() {
+			return {
+				size: pool.totalCount,
+				idle: pool.idleCount,
+				waiting: pool.waitingCount
+			};
+		},
+		onAcquire(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		}
+	};
+}
+function createForwardingPoolInstrumentation(name) {
+	const listeners = /* @__PURE__ */ new Set();
+	let stats = {
+		size: 0,
+		idle: 0,
+		waiting: 0
+	};
+	return {
+		name,
+		getStats() {
+			return stats;
+		},
+		onAcquire(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		pushSamples(durations) {
+			for (const durationMs of durations) for (const listener of listeners) try {
+				listener(durationMs);
+			} catch {}
+		},
+		updateStats(next) {
+			stats = next;
+		}
+	};
+}
+//#endregion
+//#region src/storage/migrations/001_create_operation_table.ts
+var _001_create_operation_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$26 });
+async function up$26(db) {
+	await db.schema.createTable("Operation").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("jobId", "text", (col) => col.notNull()).addColumn("opId", "text", (col) => col.notNull()).addColumn("prevOpId", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "timestamptz", (col) => col.notNull()).addColumn("index", "integer", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("error", "text").addColumn("hash", "text", (col) => col.notNull()).addUniqueConstraint("unique_revision", [
+		"documentId",
+		"scope",
+		"branch",
+		"index"
+	]).addUniqueConstraint("unique_operation_instance", [
+		"opId",
+		"index",
+		"skip"
+	]).execute();
+	await db.schema.createIndex("streamOperations").on("Operation").columns([
+		"documentId",
+		"scope",
+		"branch",
+		"id"
+	]).execute();
+	await db.schema.createIndex("branchlessStreamOperations").on("Operation").columns([
+		"documentId",
+		"scope",
+		"id"
+	]).execute();
+}
+//#endregion
+//#region src/storage/migrations/002_create_keyframe_table.ts
+var _002_create_keyframe_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$25 });
+async function up$25(db) {
+	await db.schema.createTable("Keyframe").addColumn("id", "serial", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("revision", "integer", (col) => col.notNull()).addColumn("document", "jsonb", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_keyframe", [
+		"documentId",
+		"scope",
+		"branch",
+		"revision"
+	]).execute();
+	await db.schema.createIndex("keyframe_lookup").on("Keyframe").columns([
+		"documentId",
+		"scope",
+		"branch",
+		"revision"
+	]).execute();
+}
+//#endregion
+//#region src/storage/migrations/003_create_document_table.ts
+var _003_create_document_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$24 });
+async function up$24(db) {
+	await db.schema.createTable("Document").addColumn("id", "text", (col) => col.primaryKey()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
+}
+//#endregion
+//#region src/storage/migrations/004_create_document_relationship_table.ts
+var _004_create_document_relationship_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$23 });
+async function up$23(db) {
+	await db.schema.createTable("DocumentRelationship").addColumn("id", "text", (col) => col.primaryKey()).addColumn("sourceId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("targetId", "text", (col) => col.notNull().references("Document.id").onDelete("cascade")).addColumn("relationshipType", "text", (col) => col.notNull()).addColumn("metadata", "jsonb").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_source_target_type", [
+		"sourceId",
+		"targetId",
+		"relationshipType"
+	]).execute();
+	await db.schema.createIndex("idx_relationship_source").on("DocumentRelationship").column("sourceId").execute();
+	await db.schema.createIndex("idx_relationship_target").on("DocumentRelationship").column("targetId").execute();
+	await db.schema.createIndex("idx_relationship_type").on("DocumentRelationship").column("relationshipType").execute();
+}
+//#endregion
+//#region src/storage/migrations/005_create_indexer_state_table.ts
+var _005_create_indexer_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$22 });
+async function up$22(db) {
+	await db.schema.createTable("IndexerState").addColumn("id", "integer", (col) => col.primaryKey().generatedAlwaysAsIdentity()).addColumn("lastOperationId", "integer", (col) => col.notNull()).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
+}
+//#endregion
+//#region src/storage/migrations/006_create_document_snapshot_table.ts
+var _006_create_document_snapshot_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$21 });
+async function up$21(db) {
+	await db.schema.createTable("DocumentSnapshot").addColumn("id", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("slug", "text").addColumn("name", "text").addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("content", "jsonb", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("lastOperationIndex", "integer", (col) => col.notNull()).addColumn("lastOperationHash", "text", (col) => col.notNull()).addColumn("lastUpdatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("snapshotVersion", "integer", (col) => col.notNull().defaultTo(1)).addColumn("identifiers", "jsonb").addColumn("metadata", "jsonb").addColumn("isDeleted", "boolean", (col) => col.notNull().defaultTo(false)).addColumn("deletedAt", "timestamptz").addUniqueConstraint("unique_doc_scope_branch", [
+		"documentId",
+		"scope",
+		"branch"
+	]).execute();
+	await db.schema.createIndex("idx_slug_scope_branch").on("DocumentSnapshot").columns([
+		"slug",
+		"scope",
+		"branch"
+	]).execute();
+	await db.schema.createIndex("idx_doctype_scope_branch").on("DocumentSnapshot").columns([
+		"documentType",
+		"scope",
+		"branch"
+	]).execute();
+	await db.schema.createIndex("idx_last_updated").on("DocumentSnapshot").column("lastUpdatedAt").execute();
+	await db.schema.createIndex("idx_is_deleted").on("DocumentSnapshot").column("isDeleted").execute();
+}
+//#endregion
+//#region src/storage/migrations/007_create_slug_mapping_table.ts
+var _007_create_slug_mapping_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$20 });
+async function up$20(db) {
+	await db.schema.createTable("SlugMapping").addColumn("slug", "text", (col) => col.primaryKey()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addUniqueConstraint("unique_docid_scope_branch", [
+		"documentId",
+		"scope",
+		"branch"
+	]).execute();
+	await db.schema.createIndex("idx_slug_documentid").on("SlugMapping").column("documentId").execute();
+}
+//#endregion
+//#region src/storage/migrations/008_create_view_state_table.ts
+var _008_create_view_state_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$19 });
+async function up$19(db) {
+	await db.schema.createTable("ViewState").addColumn("readModelId", "text", (col) => col.primaryKey()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(0)).addColumn("lastOperationTimestamp", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
+}
+//#endregion
+//#region src/storage/migrations/009_create_operation_index_tables.ts
+var _009_create_operation_index_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$18 });
+async function up$18(db) {
+	await db.schema.createTable("document_collections").addColumn("documentId", "text", (col) => col.notNull()).addColumn("collectionId", "text", (col) => col.notNull()).addColumn("joinedOrdinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("leftOrdinal", "bigint").addPrimaryKeyConstraint("document_collections_pkey", ["documentId", "collectionId"]).execute();
+	await db.schema.createIndex("idx_document_collections_collectionId").on("document_collections").column("collectionId").execute();
+	await db.schema.createIndex("idx_doc_collections_collection_range").on("document_collections").columns(["collectionId", "joinedOrdinal"]).execute();
+	await db.schema.createTable("operation_index_operations").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("opId", "text", (col) => col.notNull()).addColumn("documentId", "text", (col) => col.notNull()).addColumn("documentType", "text", (col) => col.notNull()).addColumn("scope", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("timestampUtcMs", "text", (col) => col.notNull()).addColumn("writeTimestampUtcMs", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("index", "integer", (col) => col.notNull()).addColumn("skip", "integer", (col) => col.notNull()).addColumn("hash", "text", (col) => col.notNull()).addColumn("action", "jsonb", (col) => col.notNull()).execute();
+	await db.schema.createIndex("idx_operation_index_operations_document").on("operation_index_operations").columns([
+		"documentId",
+		"branch",
+		"scope"
+	]).execute();
+	await db.schema.createIndex("idx_operation_index_operations_ordinal").on("operation_index_operations").column("ordinal").execute();
+}
+//#endregion
+//#region src/storage/migrations/010_create_sync_tables.ts
+var _010_create_sync_tables_exports = /* @__PURE__ */ __exportAll({ up: () => up$17 });
+async function up$17(db) {
+	await db.schema.createTable("sync_remotes").addColumn("name", "text", (col) => col.primaryKey()).addColumn("collection_id", "text", (col) => col.notNull()).addColumn("channel_type", "text", (col) => col.notNull()).addColumn("channel_id", "text", (col) => col.notNull().defaultTo("")).addColumn("remote_name", "text", (col) => col.notNull().defaultTo("")).addColumn("channel_parameters", "jsonb", (col) => col.notNull().defaultTo(sql`'{}'::jsonb`)).addColumn("filter_document_ids", "jsonb").addColumn("filter_scopes", "jsonb").addColumn("filter_branch", "text", (col) => col.notNull().defaultTo("main")).addColumn("push_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("push_last_success_utc_ms", "text").addColumn("push_last_failure_utc_ms", "text").addColumn("push_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("pull_state", "text", (col) => col.notNull().defaultTo("idle")).addColumn("pull_last_success_utc_ms", "text").addColumn("pull_last_failure_utc_ms", "text").addColumn("pull_failure_count", "integer", (col) => col.notNull().defaultTo(0)).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
+	await db.schema.createIndex("idx_sync_remotes_collection").on("sync_remotes").column("collection_id").execute();
+	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.primaryKey().references("sync_remotes.name").onDelete("cascade")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
+	await db.schema.createIndex("idx_sync_cursors_ordinal").on("sync_cursors").column("cursor_ordinal").execute();
+}
+//#endregion
+//#region src/storage/migrations/011_add_cursor_type_column.ts
+var _011_add_cursor_type_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$16 });
+async function up$16(db) {
+	await db.deleteFrom("sync_cursors").where("remote_name", "like", "outbox::%").execute();
+	await db.deleteFrom("sync_remotes").where("name", "like", "outbox::%").execute();
+	await db.schema.dropTable("sync_cursors").execute();
+	await db.schema.createTable("sync_cursors").addColumn("remote_name", "text", (col) => col.notNull()).addColumn("cursor_type", "text", (col) => col.notNull().defaultTo("inbox")).addColumn("cursor_ordinal", "bigint", (col) => col.notNull().defaultTo(0)).addColumn("last_synced_at_utc_ms", "text").addColumn("updated_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addPrimaryKeyConstraint("sync_cursors_pk", ["remote_name", "cursor_type"]).execute();
+	await db.schema.createIndex("idx_sync_cursors_ordinal").on("sync_cursors").column("cursor_ordinal").execute();
+}
+//#endregion
+//#region src/storage/migrations/012_add_source_remote_column.ts
+var _012_add_source_remote_column_exports = /* @__PURE__ */ __exportAll({ up: () => up$15 });
+async function up$15(db) {
+	await db.schema.alterTable("operation_index_operations").addColumn("sourceRemote", "text", (col) => col.notNull().defaultTo("")).execute();
+}
+//#endregion
+//#region src/storage/migrations/013_create_sync_dead_letters_table.ts
+var _013_create_sync_dead_letters_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$14 });
+async function up$14(db) {
+	await db.schema.createTable("sync_dead_letters").addColumn("ordinal", "serial", (col) => col.primaryKey()).addColumn("id", "text", (col) => col.unique().notNull()).addColumn("job_id", "text", (col) => col.notNull()).addColumn("job_dependencies", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("scopes", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("branch", "text", (col) => col.notNull()).addColumn("operations", "jsonb", (col) => col.notNull().defaultTo(sql`'[]'::jsonb`)).addColumn("error_source", "text", (col) => col.notNull()).addColumn("error_message", "text", (col) => col.notNull()).addColumn("created_at", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
+	await db.schema.createIndex("idx_sync_dead_letters_remote").on("sync_dead_letters").column("remote_name").execute();
+}
+//#endregion
+//#region src/storage/migrations/014_create_processor_cursor_table.ts
+var _014_create_processor_cursor_table_exports = /* @__PURE__ */ __exportAll({ up: () => up$13 });
+async function up$13(db) {
+	await db.schema.createTable("ProcessorCursor").addColumn("processorId", "text", (col) => col.primaryKey()).addColumn("factoryId", "text", (col) => col.notNull()).addColumn("driveId", "text", (col) => col.notNull()).addColumn("processorIndex", "integer", (col) => col.notNull()).addColumn("lastOrdinal", "integer", (col) => col.notNull().defaultTo(sql`0`)).addColumn("status", "text", (col) => col.notNull().defaultTo(sql`'active'`)).addColumn("lastError", "text").addColumn("lastErrorTimestamp", "timestamptz").addColumn("createdAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).addColumn("updatedAt", "timestamptz", (col) => col.notNull().defaultTo(sql`NOW()`)).execute();
+}
+//#endregion
+//#region src/storage/migrations/015_add_operation_denied_reason.ts
+var _015_add_operation_denied_reason_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$12,
+	up: () => up$12
+});
+/**
+* Records why authorization refused an operation. Separate from `error` so a
+* denial is distinguishable from a reducer failure without matching on a
+* message. Null for every operation written before decisions were enforced.
+*/
+async function up$12(db) {
+	await db.schema.alterTable("Operation").addColumn("deniedReason", "text").execute();
+	await db.schema.alterTable("operation_index_operations").addColumn("deniedReason", "text").execute();
+}
+async function down$12(db) {
+	await db.schema.alterTable("operation_index_operations").dropColumn("deniedReason").execute();
+	await db.schema.alterTable("Operation").dropColumn("deniedReason").execute();
+}
+//#endregion
+//#region src/storage/migrations/016_add_dead_letter_error_type.ts
+var _016_add_dead_letter_error_type_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$11,
+	up: () => up$11
+});
+/**
+* The classification a dead letter falls into, stored because it decides whether
+* the document stays quarantined and the in-memory error is gone after a restart.
+* Defaulted rather than nullable, so a pre-existing row rehydrates.
+*/
+async function up$11(db) {
+	await db.schema.alterTable("sync_dead_letters").addColumn("error_type", "text", (col) => col.notNull().defaultTo("UNCLASSIFIED")).execute();
+}
+async function down$11(db) {
+	await db.schema.alterTable("sync_dead_letters").dropColumn("error_type").execute();
+}
+//#endregion
+//#region src/storage/migrations/017_create_group_references.ts
+var _017_create_group_references_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$10,
+	up: () => up$10
+});
+/**
+* One row per (document, group) reference ever discovered from an auth
+* operation's input. Rows are never updated or deleted: auth evaluation is
+* positional, so a grant that named a group at any position keeps that
+* group's stream in the document's read-set even after a later operation
+* removes the reference. Read by documentId for the groups a document
+* requires (sync), and by groupId for the documents a group change affects
+* (re-evaluation).
+*/
+async function up$10(db) {
+	await db.schema.createTable("group_references").addColumn("documentId", "text", (col) => col.notNull()).addColumn("groupId", "text", (col) => col.notNull()).addPrimaryKeyConstraint("group_references_pkey", ["documentId", "groupId"]).execute();
+	await db.schema.createIndex("idx_group_references_groupId").on("group_references").column("groupId").execute();
+}
+async function down$10(db) {
+	await db.schema.dropTable("group_references").execute();
+}
+//#endregion
+//#region src/storage/migrations/018_add_sync_remote_bound_address.ts
+var _018_add_sync_remote_bound_address_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$9,
+	up: () => up$9
+});
+/**
+* The address a sync channel is bound to, so a channel created by one subject
+* cannot be polled by another.
+*
+* Nullable rather than defaulted: null is a channel nobody has claimed, which is
+* what every pre-existing row is and what an anonymously created channel stays
+* until its first authenticated poll adopts it. A default would claim them all
+* for one address.
+*/
+async function up$9(db) {
+	await db.schema.alterTable("sync_remotes").addColumn("bound_address", "text").execute();
+}
+async function down$9(db) {
+	await db.schema.alterTable("sync_remotes").dropColumn("bound_address").execute();
+}
+//#endregion
+//#region src/storage/migrations/019_require_action_id.ts
+var _019_require_action_id_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$8,
+	up: () => up$8
+});
+/**
+* Makes an operation whose action carries no id physically unstorable.
+*
+* The id is not decoration: `deriveOperationId` hashes it into the operation id
+* and replay dedupes incoming operations by it, so an action without one
+* collapses every id-less operation on a document/scope/branch onto a single
+* derived operation id. The API rejects such an action now, and this is the
+* last line of defense behind it.
+*
+* Both tables are constrained because sync reads operations from the index
+* rather than the operation table, so poison reaching only the index would
+* still be served to a replica.
+*
+* Pre-existing rows are backfilled rather than left behind a NOT VALID
+* constraint: a row the index and the operation table disagree about is worse
+* than a missing id, because dedup keys off the value each side serves. The
+* backfill therefore mints one id per operation and writes that same id to both
+* tables, joined on the identity they share. Rewriting the action is safe: the
+* operation hash is taken over the resulting state, not over the action, and a
+* signature is verified from the params carried in the signature tuple, which
+* do not include the action id.
+*
+* The empty string is rejected alongside null. It derives the same colliding
+* operation id as an absent id, so admitting it would leave the hole open.
+*/
+async function up$8(db) {
+	await db.updateTable("Operation").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
+	await db.updateTable("operation_index_operations as oio").from("Operation as op").set({ action: sql`jsonb_set(oio.action, '{id}', to_jsonb(op.action->>'id'))` }).whereRef("oio.opId", "=", "op.opId").whereRef("oio.index", "=", "op.index").whereRef("oio.skip", "=", "op.skip").where(sql`jsonb_typeof(oio.action) = 'object' and coalesce(oio.action->>'id', '') = ''`).where(sql`coalesce(op.action->>'id', '') <> ''`).execute();
+	await db.updateTable("operation_index_operations").set({ action: sql`jsonb_set(action, '{id}', to_jsonb(gen_random_uuid()::text))` }).where(sql`jsonb_typeof(action) = 'object' and coalesce(action->>'id', '') = ''`).execute();
+	await db.schema.alterTable("Operation").addCheckConstraint("action_must_have_id", sql`action->>'id' is not null and action->>'id' <> ''`).execute();
+	await db.schema.alterTable("operation_index_operations").addCheckConstraint("action_must_have_id", sql`action->>'id' is not null and action->>'id' <> ''`).execute();
+}
+/**
+* Only the constraints are dropped. The backfilled ids stay: they are the ids
+* their operations are now known by, and reverting them would reintroduce the
+* collision the migration removed.
+*/
+async function down$8(db) {
+	await db.schema.alterTable("operation_index_operations").dropConstraint("action_must_have_id").execute();
+	await db.schema.alterTable("Operation").dropConstraint("action_must_have_id").execute();
+}
+//#endregion
+//#region src/storage/migrations/020_add_snapshot_operation_ordinal.ts
+var _020_add_snapshot_operation_ordinal_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$7,
+	up: () => up$7
+});
+/** Orders header row writes across scopes; `lastOperationIndex` is per scope. */
+async function up$7(db) {
+	await db.schema.alterTable("DocumentSnapshot").addColumn("lastOperationOrdinal", "integer", (col) => col.notNull().defaultTo(0)).execute();
+}
+async function down$7(db) {
+	await db.schema.alterTable("DocumentSnapshot").dropColumn("lastOperationOrdinal").execute();
+}
+//#endregion
+//#region src/storage/migrations/021_add_sync_remote_peer.ts
+var _021_add_sync_remote_peer_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$6,
+	up: () => up$6
+});
+/**
+* The peer's manifest as canonical JSON, and when it was heard. Both null: not
+* yet heard. A time with no manifest: a silent peer, which gets the baselines.
+*/
+async function up$6(db) {
+	await db.schema.alterTable("sync_remotes").addColumn("peer_manifest", "text").addColumn("peer_manifest_at_utc_ms", "bigint").execute();
+}
+async function down$6(db) {
+	await db.schema.alterTable("sync_remotes").dropColumn("peer_manifest").dropColumn("peer_manifest_at_utc_ms").execute();
+}
+//#endregion
+//#region src/storage/migrations/022_create_sync_holds.ts
+var _022_create_sync_holds_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$5,
+	up: () => up$5
+});
+/** Documents held back from a remote whose peer cannot run their versions. */
+async function up$5(db) {
+	await db.schema.createTable("sync_holds").addColumn("remote_name", "text", (col) => col.notNull().references("sync_remotes.name").onDelete("cascade")).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("protocol", "text", (col) => col.notNull()).addColumn("version", "integer", (col) => col.notNull()).addColumn("held_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_holds_pkey", [
+		"remote_name",
+		"document_id",
+		"branch"
+	]).execute();
+}
+async function down$5(db) {
+	await db.schema.dropTable("sync_holds").execute();
+}
+//#endregion
+//#region src/storage/migrations/023_index_created_protocol_versions.ts
+var _023_index_created_protocol_versions_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$4,
+	up: () => up$4
+});
+/**
+* One entry per document created with protocolVersions, keyed by a hash so an
+* oversized header cannot make its creation unstorable. Startup reads the
+* distinct values without visiting every document.
+*/
+async function up$4(db) {
+	await db.schema.createIndex("idx_operation_created_protocol_versions").on("Operation").expression(sql`md5((action->'input'->'protocolVersions')::text)`).where(sql`scope = 'document' and "index" = 0 and (action->'input'->'protocolVersions') is not null`).execute();
+}
+async function down$4(db) {
+	await db.schema.dropIndex("idx_operation_created_protocol_versions").execute();
+}
+//#endregion
+//#region src/storage/migrations/024_create_document_purges.ts
+var _024_create_document_purges_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/** One row per purged document: the tombstone. Written once, never deleted. */
+async function up$3(db) {
+	await db.schema.createTable("document_purges").addColumn("documentId", "text", (col) => col.primaryKey()).addColumn("ordinal", "bigint", (col) => col.notNull()).addColumn("removedRows", "jsonb", (col) => col.notNull()).addColumn("purgedAtUtc", "timestamptz", (col) => col.notNull()).addColumn("requestId", "text", (col) => col.notNull()).execute();
+}
+async function down$3(db) {
+	await db.schema.dropTable("document_purges").execute();
+}
+//#endregion
+//#region src/storage/migrations/025_create_sync_received_markers.ts
+var _025_create_sync_received_markers_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/** Received purge markers awaiting their outcome; removed with their remote. */
+async function up$2(db) {
+	await db.schema.createTable("sync_received_markers").addColumn("remote_name", "text", (col) => col.notNull()).addColumn("marker_id", "text", (col) => col.notNull()).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("operation", "jsonb", (col) => col.notNull()).addColumn("received_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_received_markers_pkey", ["remote_name", "marker_id"]).execute();
+}
+async function down$2(db) {
+	await db.schema.dropTable("sync_received_markers").execute();
+}
+//#endregion
+//#region src/storage/migrations/026_create_sync_purge_refusals.ts
+var _026_create_sync_purge_refusals_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/** A remote's refusal of a purge marker; payload-free, kept like the tombstone. */
+async function up$1(db) {
+	await db.schema.createTable("sync_purge_refusals").addColumn("remote_name", "text", (col) => col.notNull()).addColumn("document_id", "text", (col) => col.notNull()).addColumn("branch", "text", (col) => col.notNull()).addColumn("refused_at_utc_ms", "bigint", (col) => col.notNull()).addPrimaryKeyConstraint("sync_purge_refusals_pkey", [
+		"remote_name",
+		"document_id",
+		"branch"
+	]).execute();
+	await db.schema.createIndex("idx_sync_purge_refusals_document").on("sync_purge_refusals").column("document_id").execute();
+}
+async function down$1(db) {
+	await db.schema.dropTable("sync_purge_refusals").execute();
+}
+//#endregion
+//#region src/storage/migrations/027_add_sync_remote_persistence.ts
+var _027_add_sync_remote_persistence_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/** A session remote's row exists so its cursors, holds and dead letters have a parent. */
+async function up(db) {
+	await db.schema.alterTable("sync_remotes").addColumn("persistence", "text", (col) => col.notNull().defaultTo("durable")).execute();
+}
+async function down(db) {
+	await db.schema.alterTable("sync_remotes").dropColumn("persistence").execute();
+}
+//#endregion
+//#region src/storage/migrations/migrator.ts
+const REACTOR_SCHEMA = "reactor";
+const migrations = {
+	"001_create_operation_table": _001_create_operation_table_exports,
+	"002_create_keyframe_table": _002_create_keyframe_table_exports,
+	"003_create_document_table": _003_create_document_table_exports,
+	"004_create_document_relationship_table": _004_create_document_relationship_table_exports,
+	"005_create_indexer_state_table": _005_create_indexer_state_table_exports,
+	"006_create_document_snapshot_table": _006_create_document_snapshot_table_exports,
+	"007_create_slug_mapping_table": _007_create_slug_mapping_table_exports,
+	"008_create_view_state_table": _008_create_view_state_table_exports,
+	"009_create_operation_index_tables": _009_create_operation_index_tables_exports,
+	"010_create_sync_tables": _010_create_sync_tables_exports,
+	"011_add_cursor_type_column": _011_add_cursor_type_column_exports,
+	"012_add_source_remote_column": _012_add_source_remote_column_exports,
+	"013_create_sync_dead_letters_table": _013_create_sync_dead_letters_table_exports,
+	"014_create_processor_cursor_table": _014_create_processor_cursor_table_exports,
+	"015_add_operation_denied_reason": _015_add_operation_denied_reason_exports,
+	"016_add_dead_letter_error_type": _016_add_dead_letter_error_type_exports,
+	"017_create_group_references": _017_create_group_references_exports,
+	"018_add_sync_remote_bound_address": _018_add_sync_remote_bound_address_exports,
+	"019_require_action_id": _019_require_action_id_exports,
+	"020_add_snapshot_operation_ordinal": _020_add_snapshot_operation_ordinal_exports,
+	"021_add_sync_remote_peer": _021_add_sync_remote_peer_exports,
+	"022_create_sync_holds": _022_create_sync_holds_exports,
+	"023_index_created_protocol_versions": _023_index_created_protocol_versions_exports,
+	"024_create_document_purges": _024_create_document_purges_exports,
+	"025_create_sync_received_markers": _025_create_sync_received_markers_exports,
+	"026_create_sync_purge_refusals": _026_create_sync_purge_refusals_exports,
+	"027_add_sync_remote_persistence": _027_add_sync_remote_persistence_exports
+};
+var ProgrammaticMigrationProvider = class {
+	getMigrations() {
+		return Promise.resolve(migrations);
+	}
+};
+/**
+* Applies every pending migration, or every one up to and including `upTo`.
+*
+* The bound exists so a test can reach the schema a data migration is written
+* against, populate it, and then migrate across the migration under test.
+*/
+async function runMigrations(db, schema = REACTOR_SCHEMA, upTo) {
+	try {
+		await sql`CREATE SCHEMA IF NOT EXISTS ${sql.id(schema)}`.execute(db);
+	} catch (error) {
+		return {
+			success: false,
+			migrationsExecuted: [],
+			error: error instanceof Error ? error : /* @__PURE__ */ new Error("Failed to create schema")
+		};
+	}
+	const migrator = new Migrator({
+		db: db.withSchema(schema),
+		provider: new ProgrammaticMigrationProvider(),
+		migrationTableSchema: schema
+	});
+	let error;
+	let results;
+	try {
+		const result = upTo ? await migrator.migrateTo(upTo) : await migrator.migrateToLatest();
+		error = result.error;
+		results = result.results;
+	} catch (e) {
+		error = e;
+		results = [];
+	}
+	const migrationsExecuted = results?.map((result) => result.migrationName) ?? [];
+	if (error) return {
+		success: false,
+		migrationsExecuted,
+		error: error instanceof Error ? error : /* @__PURE__ */ new Error("Unknown migration error")
+	};
+	return {
+		success: true,
+		migrationsExecuted
+	};
+}
+async function getMigrationStatus(db, schema = REACTOR_SCHEMA) {
+	return await new Migrator({
+		db: db.withSchema(schema),
+		provider: new ProgrammaticMigrationProvider(),
+		migrationTableSchema: schema
+	}).getMigrations();
+}
+//#endregion
+//#region src/executor/worker/error-info.ts
+const MAX_STACK_LENGTH = 8192;
+const MAX_CAUSE_DEPTH = 8;
+function toErrorInfo(err, depth = 0) {
+	if (depth > MAX_CAUSE_DEPTH) return {
+		name: "Error",
+		message: "cause chain truncated"
+	};
+	if (err instanceof Error) {
+		const info = {
+			name: err.name || "Error",
+			message: err.message
+		};
+		if (typeof err.stack === "string") info.stack = err.stack.length > MAX_STACK_LENGTH ? err.stack.slice(0, MAX_STACK_LENGTH) : err.stack;
+		if (err.cause !== void 0) info.cause = toErrorInfo(err.cause, depth + 1);
+		const documentId = err.documentId;
+		if (typeof documentId === "string") info.documentId = documentId;
+		const { documentType, requestedVersion } = err;
+		if (typeof documentType === "string") info.documentType = documentType;
+		if (typeof requestedVersion === "number") info.requestedVersion = requestedVersion;
+		return info;
+	}
+	if (typeof err === "string") return {
+		name: "Error",
+		message: err
+	};
+	if (err && typeof err === "object") {
+		const record = err;
+		return {
+			name: typeof record.name === "string" ? record.name : "Error",
+			message: typeof record.message === "string" ? record.message : safeStringify(err)
+		};
+	}
+	return {
+		name: "Error",
+		message: safeStringify(err)
+	};
+}
+function safeStringify(value) {
+	if (value === null || value === void 0) return String(value);
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return "[unserializable]";
+	}
+}
+function fromErrorInfo(info) {
+	const err = new Error(info.message);
+	Object.defineProperty(err, "name", {
+		value: info.name,
+		configurable: true,
+		writable: true
+	});
+	if (info.stack !== void 0) err.stack = info.stack;
+	if (info.documentId !== void 0) Object.defineProperty(err, "documentId", {
+		value: info.documentId,
+		configurable: true,
+		writable: true
+	});
+	for (const key of ["documentType", "requestedVersion"]) if (info[key] !== void 0) Object.defineProperty(err, key, {
+		value: info[key],
+		configurable: true,
+		writable: true
+	});
+	if (info.cause !== void 0) Object.defineProperty(err, "cause", {
+		value: fromErrorInfo(info.cause),
+		configurable: true,
+		writable: true
+	});
+	return err;
+}
+//#endregion
+//#region src/executor/worker/sanitize.ts
+const MAX_DEPTH = 8;
+function errorToInfo(err) {
+	return toErrorInfo(err);
+}
+function sanitizeArg(value, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
+	if (depth > MAX_DEPTH) return "[Truncated]";
+	if (value === null || value === void 0) return null;
+	if (typeof value === "boolean") return value;
+	if (typeof value === "number") return value;
+	if (typeof value === "string") return value;
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "function" || typeof value === "symbol") return null;
+	if (value instanceof Error) return toErrorInfo(value);
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof Map) {
+		const obj = {};
+		for (const [k, v] of value.entries()) obj[String(k)] = sanitizeArg(v, depth + 1, seen);
+		return obj;
+	}
+	if (value instanceof Set) {
+		const arr = [];
+		for (const v of value.values()) arr.push(sanitizeArg(v, depth + 1, seen));
+		return arr;
+	}
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = value.map((v) => sanitizeArg(v, depth + 1, seen));
+		seen.delete(value);
+		return result;
+	}
+	if (typeof value === "object") {
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) return { __nonClonable: value.constructor?.name || "Unknown" };
+		if (seen.has(value)) return "[Circular]";
+		seen.add(value);
+		const result = {};
+		for (const [k, v] of Object.entries(value)) result[k] = sanitizeArg(v, depth + 1, seen);
+		seen.delete(value);
+		return result;
+	}
+	return null;
+}
+//#endregion
+//#region src/executor/worker/forwarding-logger.ts
+function createForwardingLogger(post, level = "info", tags = []) {
+	function safePost(msg) {
+		try {
+			post(msg);
+		} catch {
+			try {
+				process.stderr.write(`[forwarding-logger] postMessage failed: ${msg.level} ${msg.message}\n`);
+			} catch {}
+		}
+	}
+	function emit(wireLevel, message, args) {
+		const sanitizedArgs = args.map((a) => sanitizeArg(a));
+		safePost({
+			type: "log",
+			level: wireLevel,
+			message,
+			args: tags.length > 0 ? [sanitizeArg({ tags }), ...sanitizedArgs] : sanitizedArgs,
+			timestamp: Date.now()
+		});
+	}
+	return {
+		level,
+		verbose: (message, ...args) => emit("debug", message, args),
+		debug: (message, ...args) => emit("debug", message, args),
+		info: (message, ...args) => emit("info", message, args),
+		warn: (message, ...args) => emit("warn", message, args),
+		error: (message, ...args) => emit("error", message, args),
+		errorHandler: ((...data) => {
+			const first = data[0];
+			emit("error", typeof first === "string" ? first : "", data.slice(1));
+		}),
+		child: (childTags) => createForwardingLogger(post, level, [...tags, ...childTags])
+	};
+}
+//#endregion
+export { DocumentExistence as $, GATED_DOCUMENT_ACTIONS as A, yieldToMain as At, createOperation as B, describeWaitingSessions as C, ReactorEventTypes as Ct, CollectionMembershipCache as D, parsePagingOptions as Dt, DocumentMetaCache as E, matchesScope as Et, buildErrorResult as F, relationshipTarget as G, isGenesisOperation as H, buildSuccessResult as I, targetDocumentId as J, submittedActionIds as K, createConsistencyToken as L, TouchedStreams as M, applyDeleteDocumentAction$1 as N, DOCUMENT_SCOPE_ACTIONS as O, throwIfAborted as Ot, applyUpgradeDocumentAction$1 as P, DocumentAlreadyExistsError as Q, createDocumentFromAction as R, createKyselyWatermarkProbe as S, EventBusAggregateError as St, snapshotFunctionsFor as T, delay as Tt, jobWriteIds as U, getNextIndexForScope as V, refusalError as W, APPEND_CONDITION_FAILED_PREFIX as X, updateDocumentRevision as Y, AppendConditionFailedError as Z, acquirePurgeLocks as _, RelationshipNotFoundError as _t, REACTOR_SCHEMA as a, AuthorizationDeniedError as at, ProbeSettler as b, UnsupportedStoredProtocolError as bt, createForwardingPoolInstrumentation as c, DocumentNotDeletedError as ct, KyselyKeyframeStore as d, ExcessiveReshuffleError as dt, DuplicateOperationError as et, EventBus as f, GroupInUseError as ft, PURGE_NS as g, PurgeTooLargeError as gt, PURGE_LOCK_BUCKETS as h, JOB_NOT_FOUND_ERROR_NAME as ht, fromErrorInfo as i, AuthTimestampNotMonotonicError as it, PurgeFence as j, __exportAll as jt, FencedWriteCache as k, withDeadline as kt, instrumentPgPool as l, DocumentNotFoundError as lt, KyselyOperationIndex as m, InvalidSignatureError as mt, errorToInfo as n, RevisionMismatchError as nt, getMigrationStatus as o, BatchJobFailedError as ot, KyselyWriteCache as p, InvalidOperationTimestampError as pt, summarizeSubmittedActions as q, sanitizeArg as r, AuthEnforcementDisabledError as rt, runMigrations as s, DocumentDeletedError as st, createForwardingLogger as t, OptimisticLockError as tt, KyselyOperationStore as u, DocumentPurgedError as ut, findPurged as v, ReservedActionError as vt, parseSnapshot as w, TIMED_OUT as wt, SettledWatermark as x, UpgradePreconditionFailedError as xt, listPurged as y, UnsupportedProtocolVersionError as yt, createEmptyConsistencyToken as z };
+
+//# sourceMappingURL=forwarding-logger-B9LLXItm.js.map