mindoodb 0.0.73 → 0.0.75

package/dist/core/BaseMindooDB.js

@@ -8,9 +8,10 @@ const automerge_adapter_1 = require("./automerge-adapter");
 const values_1 = require("./values");
 const storeEntryTime_1 = require("./storeEntryTime");
 const types_1 = require("./types");
-const types_2 = require("./appendonlystores/types");
+const types_2 = require("./types");
+const types_3 = require("./appendonlystores/types");
 const syncStores_1 = require("./appendonlystores/syncStores");
-const types_3 = require("./appendonlystores/network/types");
+const types_4 = require("./appendonlystores/network/types");
 const MaterializationPlanner_1 = require("./appendonlystores/MaterializationPlanner");
 const DocumentDagAnalysis_1 = require("./DocumentDagAnalysis");
 const DocumentConflictAnalysis_1 = require("./DocumentConflictAnalysis");
@@ -33,13 +34,14 @@ const builtinDbInvariants_1 = require("./builtinDbInvariants");
 const recipients_1 = require("./userkeys/recipients");
 const sealedTypes_1 = require("./userkeys/sealedTypes");
 const DocumentSummaryStore_1 = require("./indexing/summary/DocumentSummaryStore");
-const types_4 = require("./indexing/summary/types");
+const types_5 = require("./indexing/summary/types");
 const DocumentFullTextIndex_1 = require("./indexing/fulltext/DocumentFullTextIndex");
-const types_5 = require("./indexing/fulltext/types");
-const types_6 = require("./extraction/types");
+const types_6 = require("./indexing/fulltext/types");
+const types_7 = require("./extraction/types");
 const executeQuery_1 = require("./query/executeQuery");
 const queryView_1 = require("./query/queryView");
 const queryLive_1 = require("./query/queryLive");
+const BackgroundTaskTracker_1 = require("./BackgroundTaskTracker");
 /**
  * Default chunk size for attachments: 256KB
  */
@@ -116,7 +118,7 @@ function networkErrorType(error) {
  * server's `Retry-After` when it asks for a longer wait than our backoff.
  */
 function rateLimitRetryDelayMs(error, attempt) {
-    if (networkErrorType(error) !== types_3.NetworkErrorType.RATE_LIMITED ||
+    if (networkErrorType(error) !== types_4.NetworkErrorType.RATE_LIMITED ||
         attempt >= PREFETCH_RATE_LIMIT_DELAYS_MS.length) {
         return null;
     }
@@ -249,10 +251,12 @@ class BaseMindooDB {
          */
         this.quarantineLog = new Map();
         /**
-         * Short-TTL cache of "is access control active for this tenant?" so the
-         * materialization fast-path does not re-query the directory on every load.
+         * Last known "is access control active for this tenant?" verdict. Only used
+         * as the fail-closed fallback when the directory cannot be consulted; the
+         * live check itself is cheap because the directory skips its rebuild while
+         * its changefeed `changeSeq` is unchanged.
          */
-        this.aclActiveCache = null;
+        this.aclActiveLastKnown = null;
         /**
          * Per-document cache of the original creator's signing public key and the
          * trusted time of the `doc_create` entry. Used by the client write prechecks
@@ -452,6 +456,8 @@ class BaseMindooDB {
         this.changeNotifyTimer = null;
         /** While > 0, timer-based emission is suppressed (e.g. during a sync batch). */
         this.changeNotificationHolds = 0;
+        /** Fire-and-forget work of this database; see {@link whenBackgroundIdle}. */
+        this.backgroundTasks = new BackgroundTaskTracker_1.BackgroundTaskTracker();
         // ---------------------------------------------------------------------------
         // Summary auto-follow (see setSummaryAutoUpdateEnabled): keeps the summary
         // buffer current as changes arrive (local writes and sync batches), so the
@@ -567,11 +573,11 @@ class BaseMindooDB {
         if (store.getId() !== attachmentStore.getId()) {
             throw new Error(`[BaseMindooDB] Expected document and attachment stores to share dbId but received ${store.getId()} and ${attachmentStore.getId()}`);
         }
-        if (store.getStoreKind() !== types_2.StoreKind.docs) {
-            throw new Error(`[BaseMindooDB] Expected primary store kind ${types_2.StoreKind.docs} but received ${store.getStoreKind()}`);
+        if (store.getStoreKind() !== types_3.StoreKind.docs) {
+            throw new Error(`[BaseMindooDB] Expected primary store kind ${types_3.StoreKind.docs} but received ${store.getStoreKind()}`);
         }
-        if (attachmentStore.getStoreKind() !== types_2.StoreKind.attachments) {
-            throw new Error(`[BaseMindooDB] Expected attachment store kind ${types_2.StoreKind.attachments} but received ${attachmentStore.getStoreKind()}`);
+        if (attachmentStore.getStoreKind() !== types_3.StoreKind.attachments) {
+            throw new Error(`[BaseMindooDB] Expected attachment store kind ${types_3.StoreKind.attachments} but received ${attachmentStore.getStoreKind()}`);
         }
         this.tenant = tenant;
         this.store = store;
@@ -898,7 +904,7 @@ class BaseMindooDB {
         this.dirtyDocIds.clear();
         this.cacheMetaDirty = false;
         this.summaryStore?.discardDirtyState();
-        this.fulltextIndex?.clearDirty();
+        this.fulltextIndex?.discardDirtyState();
         void cacheManager.deregister(this);
         if (this.summaryStore) {
             void cacheManager.deregister(this.summaryStore);
@@ -939,8 +945,8 @@ class BaseMindooDB {
      */
     async getSummarySetup() {
         try {
-            const doc = await this.getDocument(types_4.DB_SETUP_DOC_ID);
-            return (0, types_4.sanitizeSummaryConfig)(doc.getData()[types_4.SUMMARY_SETUP_FIELD]) ?? null;
+            const doc = await this.getDocument(types_5.DB_SETUP_DOC_ID);
+            return (0, types_5.sanitizeSummaryConfig)(doc.getData()[types_5.SUMMARY_SETUP_FIELD]) ?? null;
         }
         catch (error) {
             if (error instanceof errors_1.DocumentNotFoundError ||
@@ -962,14 +968,14 @@ class BaseMindooDB {
      * backfill — locally and, after sync, on every other replica.
      */
     async setSummarySetup(config) {
-        const doc = await this.createDocument({ id: types_4.DB_SETUP_DOC_ID });
+        const doc = await this.createDocument({ id: types_5.DB_SETUP_DOC_ID });
         await this.changeDoc(doc, (d) => {
             const data = d.getData();
             if (config === null) {
-                delete data[types_4.SUMMARY_SETUP_FIELD];
+                delete data[types_5.SUMMARY_SETUP_FIELD];
             }
             else {
-                data[types_4.SUMMARY_SETUP_FIELD] = (0, types_4.sanitizeSummaryConfig)(config) ?? {};
+                data[types_5.SUMMARY_SETUP_FIELD] = (0, types_5.sanitizeSummaryConfig)(config) ?? {};
             }
         });
     }
@@ -1013,12 +1019,12 @@ class BaseMindooDB {
             this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
-        const hasSetupChange = changes.some((change) => change.docId === types_4.DB_SETUP_DOC_ID);
+        const hasSetupChange = changes.some((change) => change.docId === types_5.DB_SETUP_DOC_ID);
         if (!hasSetupChange && this.summarySetupProbed) {
             return;
         }
         this.summarySetupProbed = true;
-        void this.activateSummaryFromSetupDoc();
+        this.backgroundTasks.run(this.activateSummaryFromSetupDoc());
     }
     /** Create the summary store when the setup document configures one. */
     async activateSummaryFromSetupDoc() {
@@ -1049,7 +1055,7 @@ class BaseMindooDB {
             return;
         }
         this.summaryAutoUpdateRunning = true;
-        void (async () => {
+        this.backgroundTasks.run((async () => {
             try {
                 do {
                     this.summaryAutoUpdatePending = false;
@@ -1063,7 +1069,7 @@ class BaseMindooDB {
             finally {
                 this.summaryAutoUpdateRunning = false;
             }
-        })();
+        })());
     }
     // ---------------------------------------------------------------------------
     // Full-text index (see docs/fulltext-search.md)
@@ -1103,8 +1109,8 @@ class BaseMindooDB {
      */
     async getFulltextSetup() {
         try {
-            const doc = await this.getDocument(types_4.DB_SETUP_DOC_ID);
-            return ((0, types_5.sanitizeFulltextConfig)(doc.getData()[types_5.FULLTEXT_SETUP_FIELD]) ?? null);
+            const doc = await this.getDocument(types_5.DB_SETUP_DOC_ID);
+            return ((0, types_6.sanitizeFulltextConfig)(doc.getData()[types_6.FULLTEXT_SETUP_FIELD]) ?? null);
         }
         catch (error) {
             if (error instanceof errors_1.DocumentNotFoundError ||
@@ -1128,19 +1134,19 @@ class BaseMindooDB {
      * resumable backfill — locally and, after sync, on every other replica.
      */
     async setFulltextSetup(config) {
-        const sanitized = config === null ? null : ((0, types_5.sanitizeFulltextConfig)(config) ?? {});
+        const sanitized = config === null ? null : ((0, types_6.sanitizeFulltextConfig)(config) ?? {});
         const current = await this.getFulltextSetup();
         if (JSON.stringify(current) === JSON.stringify(sanitized)) {
             return;
         }
-        const doc = await this.createDocument({ id: types_4.DB_SETUP_DOC_ID });
+        const doc = await this.createDocument({ id: types_5.DB_SETUP_DOC_ID });
         await this.changeDoc(doc, (d) => {
             const data = d.getData();
             if (sanitized === null) {
-                delete data[types_5.FULLTEXT_SETUP_FIELD];
+                delete data[types_6.FULLTEXT_SETUP_FIELD];
             }
             else {
-                data[types_5.FULLTEXT_SETUP_FIELD] = sanitized;
+                data[types_6.FULLTEXT_SETUP_FIELD] = sanitized;
             }
         });
     }
@@ -1154,8 +1160,8 @@ class BaseMindooDB {
      */
     async getExtractionSetup() {
         try {
-            const doc = await this.getDocument(types_4.DB_SETUP_DOC_ID);
-            return ((0, types_6.sanitizeExtractionConfig)(doc.getData()[types_6.EXTRACTION_SETUP_FIELD]) ?? null);
+            const doc = await this.getDocument(types_5.DB_SETUP_DOC_ID);
+            return ((0, types_7.sanitizeExtractionConfig)(doc.getData()[types_7.EXTRACTION_SETUP_FIELD]) ?? null);
         }
         catch (error) {
             if (error instanceof errors_1.DocumentNotFoundError ||
@@ -1175,19 +1181,19 @@ class BaseMindooDB {
      * without producing changefeed/sync churn.
      */
     async setExtractionSetup(config) {
-        const sanitized = config === null ? null : ((0, types_6.sanitizeExtractionConfig)(config) ?? {});
+        const sanitized = config === null ? null : ((0, types_7.sanitizeExtractionConfig)(config) ?? {});
         const current = await this.getExtractionSetup();
         if (JSON.stringify(current) === JSON.stringify(sanitized)) {
             return;
         }
-        const doc = await this.createDocument({ id: types_4.DB_SETUP_DOC_ID });
+        const doc = await this.createDocument({ id: types_5.DB_SETUP_DOC_ID });
         await this.changeDoc(doc, (d) => {
             const data = d.getData();
             if (sanitized === null) {
-                delete data[types_6.EXTRACTION_SETUP_FIELD];
+                delete data[types_7.EXTRACTION_SETUP_FIELD];
             }
             else {
-                data[types_6.EXTRACTION_SETUP_FIELD] = sanitized;
+                data[types_7.EXTRACTION_SETUP_FIELD] = sanitized;
             }
         });
     }
@@ -1255,12 +1261,12 @@ class BaseMindooDB {
             this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
-        const hasSetupChange = changes.some((change) => change.docId === types_4.DB_SETUP_DOC_ID);
+        const hasSetupChange = changes.some((change) => change.docId === types_5.DB_SETUP_DOC_ID);
         if (!hasSetupChange && this.fulltextSetupProbed) {
             return;
         }
         this.fulltextSetupProbed = true;
-        void this.activateFulltextFromSetupDoc();
+        this.backgroundTasks.run(this.activateFulltextFromSetupDoc());
     }
     /** Create the full-text index when the setup document enables one. */
     async activateFulltextFromSetupDoc() {
@@ -1290,7 +1296,7 @@ class BaseMindooDB {
             return;
         }
         this.fulltextAutoUpdateRunning = true;
-        void (async () => {
+        this.backgroundTasks.run((async () => {
             try {
                 do {
                     this.fulltextAutoUpdatePending = false;
@@ -1304,7 +1310,7 @@ class BaseMindooDB {
             finally {
                 this.fulltextAutoUpdateRunning = false;
             }
-        })();
+        })());
     }
     // ---------------------------------------------------------------------------
     // Change notifications (reactive support)
@@ -1325,6 +1331,29 @@ class BaseMindooDB {
             this.changeListeners.delete(listener);
         };
     }
+    /**
+     * Resolve once this database has no background work left: no coalesced
+     * change event waiting for its timer and no auto-follow catch-up or setup
+     * probe in flight (including work those start). Returns whether there was
+     * anything to wait for.
+     *
+     * @internal Shutdown and test hook; not part of the {@link MindooDB}
+     *   interface.
+     */
+    async whenBackgroundIdle() {
+        let waited = false;
+        for (;;) {
+            if (this.changeNotifyTimer !== null) {
+                waited = true;
+                await new Promise((resolve) => setTimeout(resolve, 0));
+                continue;
+            }
+            if (!(await this.backgroundTasks.settle())) {
+                return waited;
+            }
+            waited = true;
+        }
+    }
     /** Record a document transition for the coalesced change event. */
     noteChangeForListeners(docId, lastModified, isDeleted) {
         if (this.changeListeners.size === 0) {
@@ -2539,7 +2568,7 @@ class BaseMindooDB {
             return;
         }
         this.summarySetupProbed = true;
-        void (async () => {
+        this.backgroundTasks.run((async () => {
             try {
                 const config = await this.getSummarySetup();
                 if (config === null || this.summaryStore) {
@@ -2554,7 +2583,7 @@ class BaseMindooDB {
             catch (error) {
                 this.logger.warn(`Time-travel summary activation failed: ${error}`);
             }
-        })();
+        })());
     }
     /**
      * Open-time probe for full-text auto-activation. Without it, a
@@ -2580,7 +2609,7 @@ class BaseMindooDB {
             return;
         }
         this.fulltextSetupProbed = true;
-        void this.activateFulltextFromSetupDoc();
+        this.backgroundTasks.run(this.activateFulltextFromSetupDoc());
     }
     /**
      * Compute the current tenant KeyBag fingerprint, or `null` when the
@@ -7478,8 +7507,7 @@ class BaseMindooDB {
         try {
             newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (doc) => {
                 if (patch.baseHeads && patch.baseHeads.length > 0) {
-                    const result = automerge_adapter_1.Automerge.changeAt(doc, patch.baseHeads, applySpans);
-                    return result.newDoc;
+                    return this.changeOnForkAt(doc, patch.baseHeads, applySpans);
                 }
                 return automerge_adapter_1.Automerge.change(doc, applySpans);
             });
@@ -7505,6 +7533,120 @@ class BaseMindooDB {
             data: wrapped.getData(),
         };
     }
+    async applyDocumentUpdate(doc, update) {
+        this.assertWritable("applyDocumentUpdate");
+        const docId = doc.getId();
+        let internalDoc = this.getCachedDocument(docId);
+        if (!internalDoc) {
+            const loadedDoc = await this.loadDocumentInternal(docId);
+            if (!loadedDoc) {
+                throw new errors_1.DocumentNotFoundError(docId);
+            }
+            internalDoc = loadedDoc;
+        }
+        if (internalDoc.isDeleted) {
+            throw new errors_1.DocumentDeletedError(docId);
+        }
+        const baseHeads = (0, types_2.commonUpdateBaseHeads)(update);
+        if (baseHeads === null) {
+            throw new Error("applyDocumentUpdate: the parts of one update must share their baseHeads");
+        }
+        const hasFields = Object.keys(update.set ?? {}).length > 0 || (update.unset?.length ?? 0) > 0;
+        if (update.json)
+            this.validateJsonPatch(update.json);
+        for (const patch of update.text ?? [])
+            this.validateTextPatch(patch);
+        for (const patch of update.richText ?? [])
+            this.validateRichTextPatch(patch);
+        for (const patch of update.richTextSteps ?? [])
+            this.validateRichTextStepPatch(patch);
+        // top-level fields go through changeDoc elsewhere, which checks sealed access
+        if (hasFields)
+            await this.assertCurrentSealedAccess(internalDoc);
+        const now = (0, timeSource_1.semanticNow)();
+        const headsBeforeChange = automerge_adapter_1.Automerge.getHeads(internalDoc.doc);
+        const applyAll = (automergeDoc) => {
+            for (const [key, value] of Object.entries(update.set ?? {})) {
+                if (value !== undefined) {
+                    automergeDoc[key] = this.hydrateTypedValues(value);
+                }
+            }
+            for (const key of update.unset ?? []) {
+                delete automergeDoc[key];
+            }
+            if (update.json)
+                this.applyJsonPatchOperations(automergeDoc, update.json);
+            for (const patch of update.text ?? [])
+                this.applyTextEditsInChange(automergeDoc, patch);
+            for (const patch of update.richText ?? [])
+                this.applyRichTextSpansInChange(automergeDoc, patch, docId);
+            for (const patch of update.richTextSteps ?? [])
+                this.applyRichTextStepsInChange(automergeDoc, patch);
+            automergeDoc._lastModified = now;
+        };
+        let newDoc;
+        try {
+            newDoc = this.runChangeWithOutdatedDocRecovery(internalDoc, (current) => baseHeads
+                ? this.changeOnForkAt(current, baseHeads, applyAll)
+                : automerge_adapter_1.Automerge.change(current, applyAll));
+        }
+        catch (error) {
+            this.logger.error(`Error applying document update for document ${docId}:`, error);
+            throw error;
+        }
+        await this.persistDocumentChange({
+            internalDoc,
+            newDoc,
+            now,
+            headsBeforeChange,
+            useCustomKey: false,
+            successMessage: "document updated",
+        });
+        const wrapped = this.wrapDocument(internalDoc);
+        return {
+            doc: wrapped,
+            heads: wrapped.getHeads(),
+            data: wrapped.getData(),
+        };
+    }
+    /** The edits of one text patch, inside a change. */
+    applyTextEditsInChange(automergeDoc, patch) {
+        this.ensureTextPath(automergeDoc, patch.path);
+        for (const edit of patch.edits) {
+            automerge_adapter_1.Automerge.splice(automergeDoc, patch.path, edit.index, edit.deleteCount, edit.insert ?? "");
+        }
+    }
+    /** One rich-text snapshot (or sequence), inside a change, with the reset-and-retry recovery. */
+    applyRichTextSpansInChange(automergeDoc, patch, docId) {
+        this.ensureRichTextPath(automergeDoc, patch.path);
+        const spansSequence = patch.spansSequence ?? (patch.spans ? [patch.spans] : []);
+        for (const spans of spansSequence) {
+            const revivedSpans = this.reviveRichTextSpans(spans);
+            try {
+                automerge_adapter_1.Automerge.updateSpans(automergeDoc, patch.path, revivedSpans, patch.updateSpansConfig);
+            }
+            catch (error) {
+                if (!this.isRichTextUpdateSpansBoundsError(error)) {
+                    throw error;
+                }
+                this.logger.warn(`updateSpans failed for document ${docId} at '${patch.path.map(String).join(".")}', resetting rich-text field and applying snapshot from scratch`, error);
+                this.setJsonValueAtPath(automergeDoc, patch.path, "");
+                automerge_adapter_1.Automerge.updateSpans(automergeDoc, patch.path, revivedSpans, patch.updateSpansConfig);
+            }
+        }
+    }
+    /** Positional rich-text steps (splices and marks), inside a change. */
+    applyRichTextStepsInChange(automergeDoc, patch) {
+        this.ensureRichTextPath(automergeDoc, patch.path);
+        for (const step of patch.steps) {
+            automerge_adapter_1.Automerge.splice(automergeDoc, patch.path, step.index, step.deleteCount, step.insert ?? "");
+            for (const markRange of step.marks ?? []) {
+                for (const [name, value] of Object.entries(markRange.marks)) {
+                    automerge_adapter_1.Automerge.mark(automergeDoc, patch.path, { start: markRange.index, end: markRange.index + markRange.length, expand: "none" }, name, this.reviveRichTextValue(value));
+                }
+            }
+        }
+    }
     async applyRichTextStepsPatch(doc, patch) {
         this.assertWritable("applyRichTextStepsPatch");
         const docId = doc.getId();
@@ -7904,6 +8046,16 @@ class BaseMindooDB {
         // incrementCounter() calls, applied in call order after the field
         // assignments so they can target counters assigned in the same callback.
         const pendingCounterIncrements = [];
+        // Assignments and deletions are applied before the increments, so an
+        // assignment or deletion of a field supersedes the increments queued on it
+        // (or below it) earlier in the callback; later increments still apply.
+        const dropPendingCounterIncrements = (field) => {
+            for (let i = pendingCounterIncrements.length - 1; i >= 0; i--) {
+                if (pendingCounterIncrements[i].path[0] === field) {
+                    pendingCounterIncrements.splice(i, 1);
+                }
+            }
+        };
         // Reference to db for closures
         const db = this;
         // Guard flag to prevent operations after callback completes
@@ -7938,6 +8090,7 @@ class BaseMindooDB {
                     set: (target, prop, value) => {
                         throwIfCallbackInactive("set property");
                         if (typeof prop === "string") {
+                            dropPendingCounterIncrements(prop);
                             // If this property was marked for deletion, remove it from deletions
                             pendingDeletions.delete(prop);
                             // Track the change
@@ -7950,6 +8103,7 @@ class BaseMindooDB {
                     deleteProperty: (target, prop) => {
                         throwIfCallbackInactive("delete property");
                         if (typeof prop === "string") {
+                            dropPendingCounterIncrements(prop);
                             // Mark for deletion
                             pendingDeletions.add(prop);
                             // Remove from pending changes if it was there
@@ -8414,7 +8568,10 @@ class BaseMindooDB {
             return value;
         }
         if (Array.isArray(value)) {
-            return value.map((entry) => this.hydrateTypedValues(entry, depth + 1));
+            // Array.from, not map: map keeps the realm of an array that came from
+            // another realm (structuredClone in a VM context, another frame), and
+            // Automerge only assigns arrays that pass `instanceof Array`.
+            return Array.from(value, (entry) => this.hydrateTypedValues(entry, depth + 1));
         }
         const record = value;
         if (Object.prototype.hasOwnProperty.call(record, values_1.MINDOO_VALUE_TAG)) {
@@ -8851,6 +9008,34 @@ class BaseMindooDB {
      * {@link applyNewEntriesToCachedDocument} (line ~6606) for the sync
      * pipeline; this helper centralizes it for the patch / changeDoc paths.
      */
+    /**
+     * `Automerge.changeAt(doc, baseHeads, apply)` for changes that call
+     * `updateSpans`. Automerge 3.5's `updateSpans` inside `changeAt` diffs
+     * against the text as of `baseHeads` but applies the resulting indexes to the
+     * current text, so once a concurrent edit of that text is in the document it
+     * throws "out of bounds" (and the reset-and-retry recovery would then drop
+     * the concurrent edit) or edits the wrong characters. `splice`, `updateText`
+     * and `mark` are not affected.
+     *
+     * The change is made on a fork that stands exactly at `baseHeads` and then
+     * merged back: the same causal result `changeAt` would produce. The fork
+     * writes as this replica's actor, unless that actor changed the document
+     * after `baseHeads` (its next sequence number is taken then); in that case a
+     * fresh actor writes the one change.
+     */
+    changeOnForkAt(doc, baseHeads, apply) {
+        const current = automerge_adapter_1.Automerge.getHeads(doc);
+        if (current.length === baseHeads.length &&
+            current.every((head) => baseHeads.includes(head))) {
+            return automerge_adapter_1.Automerge.change(doc, apply);
+        }
+        const base = automerge_adapter_1.Automerge.view(doc, baseHeads);
+        const actor = automerge_adapter_1.Automerge.getActorId(doc);
+        const ownChangeSince = automerge_adapter_1.Automerge.getChanges(base, doc).some((change) => automerge_adapter_1.Automerge.decodeChange(change).actor === actor);
+        const fork = automerge_adapter_1.Automerge.clone(base, ownChangeSince ? undefined : { actor });
+        const changed = automerge_adapter_1.Automerge.change(fork, apply);
+        return automerge_adapter_1.Automerge.merge(doc, changed);
+    }
     runChangeWithOutdatedDocRecovery(internalDoc, apply) {
         try {
             return apply(internalDoc.doc);
@@ -8942,19 +9127,31 @@ class BaseMindooDB {
         if (!changeBytes) {
             throw new Error("Failed to get change bytes from Automerge document");
         }
-        await this.persistAutomergeDocumentChanges({
-            internalDoc,
-            newDoc,
-            now,
-            changeBytesList: [changeBytes],
-            useCustomKey,
-            signingKeyPair,
-            signingKeyPassword,
-            successMessage,
-            attachmentIds,
-            bypassPrecheck,
-            recipients: options.recipients,
-        });
+        try {
+            await this.persistAutomergeDocumentChanges({
+                internalDoc,
+                newDoc,
+                now,
+                changeBytesList: [changeBytes],
+                useCustomKey,
+                signingKeyPair,
+                signingKeyPassword,
+                successMessage,
+                attachmentIds,
+                bypassPrecheck,
+                recipients: options.recipients,
+            });
+        }
+        catch (error) {
+            // Automerge.change() outdated the cached document and moved its WASM
+            // handle to `newDoc`, so reads of the cache slot would return the change
+            // that was just refused (denied precheck, wrong signing password, failed
+            // store write). Fork the cache back to the heads the change started from.
+            if (internalDoc.doc !== newDoc && headsBeforeChange) {
+                internalDoc.doc = automerge_adapter_1.Automerge.clone(automerge_adapter_1.Automerge.view(newDoc, headsBeforeChange));
+            }
+            throw error;
+        }
     }
     async persistAutomergeDocumentChanges(options) {
         const { internalDoc, newDoc, now, changeBytesList, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck, recipients, } = options;
@@ -9221,7 +9418,7 @@ class BaseMindooDB {
             return await this.withRateLimitBackoff("entry prefetch", () => this.store.getEntries(ids));
         }
         catch (error) {
-            if (networkErrorType(error) !== types_3.NetworkErrorType.PAYLOAD_TOO_LARGE ||
+            if (networkErrorType(error) !== types_4.NetworkErrorType.PAYLOAD_TOO_LARGE ||
                 ids.length <= 1) {
                 throw error;
             }
@@ -10550,24 +10747,19 @@ class BaseMindooDB {
      * Whether access control is active for this tenant and should gate
      * materialization. Admin-only databases (incl. the directory itself) are
      * always exempt — admin is the root of trust, and exempting the directory DB
-     * also avoids re-entrancy. Cached briefly to keep the load fast-path cheap.
-     * Fails closed-to-disabled on any directory error so document loads never
-     * break due to a transient directory issue (Tier 2 only gates honest clients).
+     * also avoids re-entrancy. Not cached by wall-clock time: a policy change must
+     * take effect on the very next write or load, independent of machine speed.
      */
     async isAclEnforced() {
         if (this._isAdminOnlyDb)
             return false;
-        const now = Date.now();
-        if (this.aclActiveCache && now - this.aclActiveCache.at < 3000) {
-            return this.aclActiveCache.value;
-        }
         try {
             const directory = await this.tenant.openDirectory();
             let value = false;
             if (typeof directory.isAccessControlActive === "function") {
                 value = await directory.isAccessControlActive();
             }
-            this.aclActiveCache = { value, at: now };
+            this.aclActiveLastKnown = value;
             return value;
         }
         catch (error) {
@@ -10576,9 +10768,9 @@ class BaseMindooDB {
             // materialization gate entirely). Reuse the last known verdict if we have
             // one; otherwise assume enforced so the materialization path governs the
             // load and retries once the directory is reachable again.
-            if (this.aclActiveCache) {
-                this.logger.debug(`[ACL] active-check failed, reusing last known verdict (${this.aclActiveCache.value}): ${error}`);
-                return this.aclActiveCache.value;
+            if (this.aclActiveLastKnown !== null) {
+                this.logger.debug(`[ACL] active-check failed, reusing last known verdict (${this.aclActiveLastKnown}): ${error}`);
+                return this.aclActiveLastKnown;
             }
             this.logger.warn(`[ACL] active-check failed with no prior verdict, assuming enforced (fail closed): ${error}`);
             return true;
@@ -12531,15 +12723,15 @@ class BaseMindooDB {
      * Resolve a sync target to a ContentAddressedStore.
      * Accepts either a raw store or a MindooDB instance (calls getStore()).
      */
-    getStoreForKind(storeKind = types_2.StoreKind.docs) {
-        return storeKind === types_2.StoreKind.attachments
+    getStoreForKind(storeKind = types_3.StoreKind.docs) {
+        return storeKind === types_3.StoreKind.attachments
             ? this.attachmentStore
             : this.store;
     }
-    resolveStore(remote, storeKind = types_2.StoreKind.docs) {
+    resolveStore(remote, storeKind = types_3.StoreKind.docs) {
         if ("getStore" in remote &&
             typeof remote.getStore === "function") {
-            return storeKind === types_2.StoreKind.attachments
+            return storeKind === types_3.StoreKind.attachments
                 ? remote.getAttachmentStore()
                 : remote.getStore();
         }
@@ -12787,7 +12979,7 @@ class BaseMindooDB {
      */
     async pullChangesFrom(remote, options) {
         this.assertWritable("pullChangesFrom");
-        const storeKind = options?.storeKind ?? types_2.StoreKind.docs;
+        const storeKind = options?.storeKind ?? types_3.StoreKind.docs;
         const remoteStore = this.resolveStore(remote, storeKind);
         // Entries of documents purged by an admin-signed request are refused on the
         // way in, so a replica that has not executed the purge yet cannot hand the
@@ -12809,7 +13001,7 @@ class BaseMindooDB {
             // summary buffer / full-text index materialize and extract documents
             // while the next page is still on the wire, instead of all at once
             // after the transfer (see docs/adhoc-queries.md, "Cold start").
-            const syncResult = await this.syncEntriesFromStore(remoteStore, localStore, options, storeKind === types_2.StoreKind.docs
+            const syncResult = await this.syncEntriesFromStore(remoteStore, localStore, options, storeKind === types_3.StoreKind.docs
                 ? () => this.syncStoreChanges()
                 : undefined);
             const transferredBytes = syncResult.transferredBytes ?? 0;
@@ -12825,7 +13017,7 @@ class BaseMindooDB {
             }
             if (syncResult.transferred === 0) {
                 this.logger.debug(`No new entries to pull`);
-                if (storeKind === types_2.StoreKind.docs) {
+                if (storeKind === types_3.StoreKind.docs) {
                     await this.reconcileAfterDocsPull();
                 }
                 return {
@@ -12853,7 +13045,7 @@ class BaseMindooDB {
                     cancelled: true,
                 };
             }
-            if (storeKind === types_2.StoreKind.docs) {
+            if (storeKind === types_3.StoreKind.docs) {
                 await this.syncStoreChanges();
                 await this.reconcileAfterDocsPull();
             }
@@ -12922,7 +13114,7 @@ class BaseMindooDB {
      */
     async pushChangesTo(remote, options) {
         this.assertWritable("pushChangesTo");
-        const storeKind = options?.storeKind ?? types_2.StoreKind.docs;
+        const storeKind = options?.storeKind ?? types_3.StoreKind.docs;
         const localStore = this.getStoreForKind(storeKind);
         const remoteStore = this.resolveStore(remote, storeKind);
         if (localStore.getId() !== remoteStore.getId() ||