@agent-native/core 0.120.3 → 0.121.0

package/dist/server/gateway-access-check.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `GET /_agent-native/can-see` — the hosted Realtime Gateway's sharee-visibility
+ * check. Verifies a gateway access-check token (rationale in
+ * short-lived-token.ts), runs the app's own `resolveAccess`, answers
+ * `{ allowed }`, and fails closed.
+ */
+export declare function createGatewayAccessCheckHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    error: string;
+} | {
+    allowed: boolean;
+}>>;
+//# sourceMappingURL=gateway-access-check.d.ts.map

package/dist/server/gateway-access-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-access-check.d.ts","sourceRoot":"","sources":["../../src/server/gateway-access-check.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,wBAAgB,+BAA+B;;;;IA4C9C"}

package/dist/server/gateway-access-check.js

@@ -0,0 +1,49 @@
+/**
+ * `GET /_agent-native/can-see` — the hosted Realtime Gateway's sharee-visibility
+ * check. Verifies a gateway access-check token (rationale in
+ * short-lived-token.ts), runs the app's own `resolveAccess`, answers
+ * `{ allowed }`, and fails closed.
+ */
+import { defineEventHandler, getMethod, getQuery, setResponseHeader, setResponseStatus, } from "h3";
+import { resolveAccess } from "../sharing/access.js";
+import { getBuilderBranchProjectId } from "./builder-browser.js";
+import { getRealtimeSigningSecret } from "./realtime-token.js";
+import { runWithRequestContext } from "./request-context.js";
+import { verifyGatewayAccessToken } from "./short-lived-token.js";
+export function createGatewayAccessCheckHandler() {
+    return defineEventHandler(async (event) => {
+        setResponseHeader(event, "Cache-Control", "private, no-store");
+        if (getMethod(event) !== "GET") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const secret = getRealtimeSigningSecret();
+        if (!secret) {
+            setResponseStatus(event, 404);
+            return { error: "Realtime gateway not configured" };
+        }
+        const token = getQuery(event).token;
+        // Sync, env-only: binds the token's channel when this app's project id is
+        // known, and no-ops (undefined) for scoped-secret apps where it isn't.
+        const expectedProjectId = getBuilderBranchProjectId() || undefined;
+        const verified = typeof token === "string"
+            ? verifyGatewayAccessToken(token, secret, expectedProjectId)
+            : { ok: false, reason: "missing" };
+        if (!verified.ok) {
+            setResponseStatus(event, 401);
+            return { error: "Unauthorized" };
+        }
+        const { resourceType, resourceId, userEmail, orgId } = verified;
+        return runWithRequestContext({ userEmail, orgId }, async () => {
+            try {
+                const access = await resolveAccess(resourceType, resourceId, { userEmail, orgId }, { skipResourceBody: true });
+                return { allowed: access != null };
+            }
+            catch {
+                // Unknown resource type or lookup failure: fail closed.
+                return { allowed: false };
+            }
+        });
+    });
+}
+//# sourceMappingURL=gateway-access-check.js.map

package/dist/server/gateway-access-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-access-check.js","sourceRoot":"","sources":["../../src/server/gateway-access-check.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EAER,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,MAAM,UAAU,+BAA+B;IAC7C,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAE/D,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QACpC,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,iBAAiB,GAAG,yBAAyB,EAAE,IAAI,SAAS,CAAC;QACnE,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC;YAC5D,CAAC,CAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAY,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAChE,OAAO,qBAAqB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,YAAY,EACZ,UAAU,EACV,EAAE,SAAS,EAAE,KAAK,EAAE,EACpB,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC3B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;gBACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * `GET /_agent-native/can-see` — the hosted Realtime Gateway's sharee-visibility\n * check. Verifies a gateway access-check token (rationale in\n * short-lived-token.ts), runs the app's own `resolveAccess`, answers\n * `{ allowed }`, and fails closed.\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getQuery,\n  type H3Event,\n  setResponseHeader,\n  setResponseStatus,\n} from \"h3\";\n\nimport { resolveAccess } from \"../sharing/access.js\";\nimport { getBuilderBranchProjectId } from \"./builder-browser.js\";\nimport { getRealtimeSigningSecret } from \"./realtime-token.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { verifyGatewayAccessToken } from \"./short-lived-token.js\";\n\nexport function createGatewayAccessCheckHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    setResponseHeader(event, \"Cache-Control\", \"private, no-store\");\n\n    if (getMethod(event) !== \"GET\") {\n      setResponseStatus(event, 405);\n      return { error: \"Method not allowed\" };\n    }\n\n    const secret = getRealtimeSigningSecret();\n    if (!secret) {\n      setResponseStatus(event, 404);\n      return { error: \"Realtime gateway not configured\" };\n    }\n\n    const token = getQuery(event).token;\n    // Sync, env-only: binds the token's channel when this app's project id is\n    // known, and no-ops (undefined) for scoped-secret apps where it isn't.\n    const expectedProjectId = getBuilderBranchProjectId() || undefined;\n    const verified =\n      typeof token === \"string\"\n        ? verifyGatewayAccessToken(token, secret, expectedProjectId)\n        : ({ ok: false, reason: \"missing\" } as const);\n    if (!verified.ok) {\n      setResponseStatus(event, 401);\n      return { error: \"Unauthorized\" };\n    }\n\n    const { resourceType, resourceId, userEmail, orgId } = verified;\n    return runWithRequestContext({ userEmail, orgId }, async () => {\n      try {\n        const access = await resolveAccess(\n          resourceType,\n          resourceId,\n          { userEmail, orgId },\n          { skipResourceBody: true },\n        );\n        return { allowed: access != null };\n      } catch {\n        // Unknown resource type or lookup failure: fail closed.\n        return { allowed: false };\n      }\n    });\n  });\n}\n"]}

package/dist/server/poll.d.ts

@@ -98,6 +98,22 @@ export interface AppSyncStateOptions {
      * across instances.
      */
     deterministicEventIds?: boolean;
+    /**
+     * Allocate durable-event versions from the app's Postgres DB (a one-row
+     * allocator advanced with `GREATEST(v + 1, epoch_ms_now)` inside the insert
+     * statement) instead of the per-writer in-memory clock counter.
+     *
+     * Off by default: a single-writer app's clock counter is already monotonic.
+     * Hosted realtime has MULTIPLE writers per app DB (the app's serverless
+     * instances plus gateway instances), where clock skew can assign a LOWER
+     * version to a LATER event — a client whose cursor passed the higher value
+     * then filters the later event out forever. DB allocation serializes on the
+     * allocator row's lock, so version order equals commit order across all
+     * writers. Versions stay on the epoch-ms scale (existing cursors, the
+     * detector's timestamp-mixed seed, and lag metrics all assume it).
+     * Postgres only; ignored on SQLite.
+     */
+    dbAssignedVersions?: boolean;
 }
 /**
  * Per-app change-tracking state and read path. One instance per deployed app.
@@ -110,6 +126,13 @@ export declare class AppSyncState {
     private readonly isPg;
     private readonly resolveAccessFn;
     private readonly deterministicEventIds;
+    private readonly dbAssignedVersions;
+    /** Serializes gated recordChange calls so buffer/emit order matches
+     * allocation order (interleaved allocations could buffer out of order). */
+    private recordChain;
+    /** Count of DB-allocation failures that fell back to clock versions. */
+    private dbVersionFallbacks;
+    private warnedListenerThrow;
     private version;
     private readonly buffer;
     private readonly pollEmitter;
@@ -173,7 +196,28 @@ export declare class AppSyncState {
     wireLocalEmitters(): void;
     ensureSyncEventsTable(): Promise<boolean>;
     private pruneDurableEvents;
-    persistSyncEvent(event: ChangeEvent, dedupeKey?: string): Promise<void>;
+    persistSyncEvent(event: ChangeEvent, dedupeKey?: string, presetId?: string): Promise<void>;
+    /**
+     * Persist with a DB-allocated version (see ALLOCATING_INSERT_SQL). Returns
+     * the allocated version — for a deterministic-id dedupe loser, the winner's
+     * existing version — or null when persistence is unavailable (caller falls
+     * back to clock allocation). Unlike `persistSyncEvent`, errors PROPAGATE to
+     * the caller: silence here would silently drop the event entirely, since the
+     * buffer/emit are deferred behind this call.
+     */
+    private persistWithDbAssignedVersion;
+    /** Read back the version of an already-committed row (a failed allocating
+     * call whose statement actually committed). Null when absent/unreachable. */
+    private recoverCommittedVersion;
+    /**
+     * Lift the allocator to at least `floor`. Client cursors are max-only, so
+     * any value that can become a cursor (notably the seed's app-clock
+     * `updated_at` domain) must never exceed the allocator — a cursor above it
+     * would filter later, lower-allocated events out permanently. Failure is
+     * swallowed: alignment degrades to the same soft guarantee as the clock
+     * fallback.
+     */
+    private alignVersionAllocator;
     readMaxSyncEventVersion(): Promise<number>;
     /**
      * Oldest retained durable version. Used to detect a reconnect cursor that
@@ -232,6 +276,16 @@ export declare class AppSyncState {
     }, opts?: {
         dedupeKey?: string;
     }): void;
+    /** Buffer + emit. Shared by both version-allocation modes. */
+    private commitEntry;
+    private recordWithDbVersion;
+    /**
+     * `commitEntry` for the deferred (chained) path: the buffer push must land
+     * and a throwing pollEmitter listener must not reject the chain — the
+     * synchronous path propagates such throws to the recordChange caller, but
+     * here there is no caller to propagate to, only the chain to poison.
+     */
+    private commitEntryForChain;
     private recordExtensionChanges;
     private recordActionChanges;
     /** Get all changes after a given version. */

package/dist/server/poll.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poll.d.ts","sourceRoot":"","sources":["../../src/server/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAU3C,OAAO,EAAE,KAAK,MAAM,EAAyB,MAAM,iBAAiB,CAAC;AAUrE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAQD,eAAO,MAAM,mCAAmC,QAAS,CAAC;AAC1D,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AA6M/C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,KAClD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAW7B,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAKhD,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,qBAAqB,CAA+B;IAC5D,OAAO,CAAC,gBAAgB,CAAK;IAE7B;;;;;OAKG;IACH,OAAO,CAAC,aAAa,CAAS;IAE9B,OAAO,CAAC,WAAW,CAAK;IAIxB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,uBAAuB,CAA8B;IAC7D,OAAO,CAAC,qBAAqB,CAAK;IAClC,OAAO,CAAC,kBAAkB,CAAK;IAE/B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA6B;IAC1E,OAAO,CAAC,kBAAkB,CAAS;IAEnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IACJ,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA6B;IAErE,YAAY,OAAO,GAAE,mBAAwB,EAM5C;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAiBtB,uCAAuC;IACvC,UAAU,IAAI,MAAM,CAEnB;IAED,cAAc,IAAI,YAAY,CAE7B;IAED;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI,CAexB;IAEK,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAqE9C;YAEa,kBAAkB;IAY1B,gBAAgB,CACpB,KAAK,EAAE,WAAW,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEK,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU/C;IAED;;;;;OAKG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU/C;IAED,2BAA2B,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAa1E;IAED,OAAO,CAAC,cAAc;IAetB;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAkC3B;;;OAGG;IACH,0BAA0B,IAAI,IAAI,CAIjC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,CACjB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,GAAG,cAAc,GAAG,YAAY,CAAC,EAC3E,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAIT;IAED,OAAO,CAAC,0BAA0B;IA0ClC;;;;;OAKG;IACH,YAAY,CACV,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,EACD,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,IAAI,CASN;IAED,OAAO,CAAC,sBAAsB;IAwB9B,OAAO,CAAC,mBAAmB;IAyB3B,6CAA6C;IAC7C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,CAMzE;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,gBAAgB,CAuBlB;IAEK,6BAA6B,CACjC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,gBAAgB,CAAC,CA+F3B;IAEK,8BAA8B,CAClC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,gBAAgB,EAAE,OAAO,GACxB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC,CA2CrD;IAED;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CA0EvC;IAED;;;OAGG;IACG,sBAAsB,CAAC,OAAO,EAAE;QACpC,aAAa,EAAE,OAAO,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB;YAEa,wBAAwB;CAwNvC;AAID;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,YAAY,CAGrD;AAED,8CAA8C;AAC9C,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,cAAc,IAAI,YAAY,CAE7C;AAED,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,IAAI,CAKN;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,GAAG,cAAc,GAAG,YAAY,CAAC,EAC3E,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAET;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB,GAAG,IAAI,CAEP;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB,CAEA;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,gBAAgB,CAMlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,YAAuC;aAzcxB,MAAM;YAAU,WAAW,EAAE;;;IAqepD"}
+{"version":3,"file":"poll.d.ts","sourceRoot":"","sources":["../../src/server/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAU3C,OAAO,EAAE,KAAK,MAAM,EAAyB,MAAM,iBAAiB,CAAC;AAUrE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAQD,eAAO,MAAM,mCAAmC,QAAS,CAAC;AAC1D,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAiP/C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,KAClD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAW7B,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IAC7C;+EAC2E;IAC3E,OAAO,CAAC,WAAW,CAAoC;IACvD,wEAAwE;IACxE,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,mBAAmB,CAAS;IAKpC,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,qBAAqB,CAA+B;IAC5D,OAAO,CAAC,gBAAgB,CAAK;IAE7B;;;;;OAKG;IACH,OAAO,CAAC,aAAa,CAAS;IAE9B,OAAO,CAAC,WAAW,CAAK;IAIxB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,uBAAuB,CAA8B;IAC7D,OAAO,CAAC,qBAAqB,CAAK;IAClC,OAAO,CAAC,kBAAkB,CAAK;IAE/B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA6B;IAC1E,OAAO,CAAC,kBAAkB,CAAS;IAEnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IACJ,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA6B;IAErE,YAAY,OAAO,GAAE,mBAAwB,EAO5C;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAiBtB,uCAAuC;IACvC,UAAU,IAAI,MAAM,CAEnB;IAED,cAAc,IAAI,YAAY,CAE7B;IAED;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI,CAexB;IAEK,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CA+E9C;YAEa,kBAAkB;IAY1B,gBAAgB,CACpB,KAAK,EAAE,WAAW,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CA6Bf;IAED;;;;;;;OAOG;YACW,4BAA4B;IAkC1C;iFAC6E;YAC/D,uBAAuB;IAarC;;;;;;;OAOG;YACW,qBAAqB;IAa7B,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU/C;IAED;;;;;OAKG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAU/C;IAED,2BAA2B,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAa1E;IAED,OAAO,CAAC,cAAc;IAetB;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAkC3B;;;OAGG;IACH,0BAA0B,IAAI,IAAI,CAIjC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,CACjB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,GAAG,cAAc,GAAG,YAAY,CAAC,EAC3E,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAIT;IAED,OAAO,CAAC,0BAA0B;IA0ClC;;;;;OAKG;IACH,YAAY,CACV,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,EACD,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,IAAI,CAiBN;IAED,8DAA8D;IAC9D,OAAO,CAAC,WAAW;YAQL,mBAAmB;IA4DjC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAc3B,OAAO,CAAC,sBAAsB;IAwB9B,OAAO,CAAC,mBAAmB;IAyB3B,6CAA6C;IAC7C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,CAMzE;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,gBAAgB,CAuBlB;IAEK,6BAA6B,CACjC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,gBAAgB,CAAC,CA+F3B;IAEK,8BAA8B,CAClC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,gBAAgB,EAAE,OAAO,GACxB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC,CA2CrD;IAED;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiFvC;IAED;;;OAGG;IACG,sBAAsB,CAAC,OAAO,EAAE;QACpC,aAAa,EAAE,OAAO,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhB;YAEa,wBAAwB;CAwNvC;AAoBD;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,YAAY,CAOrD;AAED,8CAA8C;AAC9C,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,cAAc,IAAI,YAAY,CAE7C;AAED,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,IAAI,CAKN;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,GAAG,cAAc,GAAG,YAAY,CAAC,EAC3E,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAET;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB,GAAG,IAAI,CAEP;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB,CAEA;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,gBAAgB,CAMlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,YAAuC;aA/exB,MAAM;YAAU,WAAW,EAAE;;;IA2gBpD"}

package/dist/server/poll.js

@@ -48,6 +48,41 @@ const ACCESS_CACHE_DENY_TTL_MS = 5_000;
 /** Max cache entries before FIFO eviction kicks in. */
 const ACCESS_CACHE_MAX = 500;
 const SCREEN_REFRESH_KEY = "__screen_refresh__";
+/**
+ * DB-assigned version allocation (see `AppSyncStateOptions.dbAssignedVersions`).
+ * The allocator is a one-row table advanced with `GREATEST(v + 1, epoch_ms)` —
+ * the SQL analog of the in-memory `Math.max(version + 1, Date.now())` — inside
+ * the same autocommit statement as the event insert. The row lock is held to
+ * the statement's implicit commit, so version order equals commit order across
+ * every writer, closing the cross-writer clock-skew hole no sequence closes
+ * (sequences serialize allocation, not commit visibility). Single-statement is
+ * required: the gateway reaches the app DB through a pooled (transactionless)
+ * connection. `ON CONFLICT DO UPDATE` (not DO NOTHING) so a deterministic-id
+ * dedupe loser still gets the winner's version back and never emits a phantom
+ * version to its own clients. The stored JSON is restamped with the allocated
+ * version; the read path's column-wins override makes that belt-and-suspenders.
+ */
+const SEED_SYNC_VERSION_SQL = `
+  INSERT INTO sync_version (id, v)
+  SELECT 1, GREATEST(
+    COALESCE((SELECT MAX(version) FROM sync_events), 0),
+    (EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::BIGINT
+  )
+  ON CONFLICT (id) DO NOTHING
+`;
+const ALLOCATING_INSERT_SQL = `
+  WITH alloc AS (
+    UPDATE sync_version
+       SET v = GREATEST(v + 1, (EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::BIGINT, (?)::BIGINT)
+     WHERE id = 1
+     RETURNING v
+  )
+  INSERT INTO sync_events (id, version, event_json, source, type, event_key, owner, org_id, resource_type, resource_id, created_at)
+  SELECT ?, alloc.v, jsonb_set((?)::jsonb, '{version}', to_jsonb(alloc.v))::text, ?, ?, ?, ?, ?, ?, ?, ?
+    FROM alloc
+  ON CONFLICT (id) DO UPDATE SET id = excluded.id
+  RETURNING version
+`;
 function timestampValue(value) {
     if (typeof value === "number" && Number.isFinite(value))
         return value;
@@ -196,6 +231,13 @@ export class AppSyncState {
     isPg;
     resolveAccessFn;
     deterministicEventIds;
+    dbAssignedVersions;
+    /** Serializes gated recordChange calls so buffer/emit order matches
+     * allocation order (interleaved allocations could buffer out of order). */
+    recordChain = Promise.resolve();
+    /** Count of DB-allocation failures that fell back to clock versions. */
+    dbVersionFallbacks = 0;
+    warnedListenerThrow = false;
     // Timestamp-aligned versions so all serverless instances produce values in
     // the same range (seeded from DB, then incremented via Date.now). Plain
     // ++counter diverges across cold starts.
@@ -248,6 +290,7 @@ export class AppSyncState {
         this.isPg = options.isPostgres ?? isPostgres;
         this.resolveAccessFn = options.resolveAccess ?? defaultResolveAccess;
         this.deterministicEventIds = options.deterministicEventIds ?? false;
+        this.dbAssignedVersions = options.dbAssignedVersions ?? false;
         this.pollEmitter.setMaxListeners(0);
     }
     /**
@@ -337,6 +380,12 @@ export class AppSyncState {
                     await ensureIndexExists("sync_events_version_idx", "CREATE INDEX IF NOT EXISTS sync_events_version_idx ON sync_events (version)", guardOptions);
                     await ensureIndexExists("sync_events_owner_version_idx", "CREATE INDEX IF NOT EXISTS sync_events_owner_version_idx ON sync_events (owner, version)", guardOptions);
                     await ensureIndexExists("sync_events_org_version_idx", "CREATE INDEX IF NOT EXISTS sync_events_org_version_idx ON sync_events (org_id, version)", guardOptions);
+                    if (this.dbAssignedVersions) {
+                        await ensureTableExists("sync_version", "CREATE TABLE IF NOT EXISTS sync_version (id INT PRIMARY KEY, v BIGINT NOT NULL)", guardOptions);
+                        // Seed at/above both the existing durable max and wall clock, so
+                        // allocated versions never land below live client cursors.
+                        await client.execute(SEED_SYNC_VERSION_SQL);
+                    }
                     return true;
                 }
                 await client.execute(createSql);
@@ -372,7 +421,7 @@ export class AppSyncState {
         })
             .catch(() => { });
     }
-    async persistSyncEvent(event, dedupeKey) {
+    async persistSyncEvent(event, dedupeKey, presetId) {
         if (!(await this.ensureSyncEventsTable()))
             return;
         const client = this.getDb();
@@ -385,7 +434,9 @@ export class AppSyncState {
                 : `INSERT OR IGNORE INTO sync_events (id, version, event_json, source, type, event_key, owner, org_id, resource_type, resource_id, created_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
             args: [
-                this.durableEventId(event, dedupeKey),
+                // presetId lets a gated fallback reuse the allocating attempt's id,
+                // so a commit-then-timeout can't produce the same event twice.
+                presetId ?? this.durableEventId(event, dedupeKey),
                 event.version,
                 JSON.stringify(event),
                 event.source,
@@ -401,6 +452,83 @@ export class AppSyncState {
             .catch(() => { });
         await this.pruneDurableEvents(client);
     }
+    /**
+     * Persist with a DB-allocated version (see ALLOCATING_INSERT_SQL). Returns
+     * the allocated version — for a deterministic-id dedupe loser, the winner's
+     * existing version — or null when persistence is unavailable (caller falls
+     * back to clock allocation). Unlike `persistSyncEvent`, errors PROPAGATE to
+     * the caller: silence here would silently drop the event entirely, since the
+     * buffer/emit are deferred behind this call.
+     */
+    async persistWithDbAssignedVersion(event, id) {
+        if (!(await this.ensureSyncEventsTable()))
+            return null;
+        const client = this.getDb();
+        const args = [
+            // Local monotonicity floor: after a clock fallback, the next allocation
+            // must not land at/below versions this writer already emitted.
+            this.version + 1,
+            id,
+            // jsonb (unlike the legacy TEXT write) rejects \\u0000 escapes; strip
+            // them rather than diverting those events to the clock fallback.
+            JSON.stringify(event).split("\\u0000").join(""),
+            event.source,
+            event.type,
+            event.key ?? null,
+            event.owner ?? null,
+            event.orgId ?? null,
+            event.resourceType ?? null,
+            event.resourceId ?? null,
+            Date.now(),
+        ];
+        let result = await client.execute({ sql: ALLOCATING_INSERT_SQL, args });
+        if (result.rows.length === 0) {
+            // Allocator row missing (e.g. wiped after ensure): reseed, retry once.
+            await client.execute(SEED_SYNC_VERSION_SQL).catch(() => { });
+            result = await client.execute({ sql: ALLOCATING_INSERT_SQL, args });
+        }
+        const version = timestampValue(result.rows[0]?.version);
+        await this.pruneDurableEvents(client);
+        return version > 0 ? version : null;
+    }
+    /** Read back the version of an already-committed row (a failed allocating
+     * call whose statement actually committed). Null when absent/unreachable. */
+    async recoverCommittedVersion(id) {
+        try {
+            const result = await this.getDb().execute({
+                sql: "SELECT version FROM sync_events WHERE id = ?",
+                args: [id],
+            });
+            const version = timestampValue(result.rows[0]?.version);
+            return version > 0 ? version : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Lift the allocator to at least `floor`. Client cursors are max-only, so
+     * any value that can become a cursor (notably the seed's app-clock
+     * `updated_at` domain) must never exceed the allocator — a cursor above it
+     * would filter later, lower-allocated events out permanently. Failure is
+     * swallowed: alignment degrades to the same soft guarantee as the clock
+     * fallback.
+     */
+    async alignVersionAllocator(floor) {
+        if (floor <= 0)
+            return;
+        try {
+            if (!(await this.ensureSyncEventsTable()))
+                return;
+            await this.getDb().execute({
+                sql: "UPDATE sync_version SET v = GREATEST(v, (?)::BIGINT) WHERE id = 1",
+                args: [floor],
+            });
+        }
+        catch {
+            // Soft guarantee under DB failure, matching the clock fallback.
+        }
+    }
     async readMaxSyncEventVersion() {
         if (!(await this.ensureSyncEventsTable()))
             return 0;
@@ -559,14 +687,98 @@ export class AppSyncState {
      * concern and never stored on the event object.
      */
     recordChange(event, opts) {
+        if (this.dbAssignedVersions && this.isPg() && !syncEventsDisabled()) {
+            // No provisional version may reach clients: cursors are max-only, so an
+            // emitted clock version above a later DB allocation would recreate the
+            // skew bug. Buffer/emit happen only after the DB returns the version,
+            // serialized so entries land in allocation order. The catch is a
+            // backstop: one rejected link must never poison the chain and silently
+            // drop every later event.
+            this.recordChain = this.recordChain
+                .then(() => this.recordWithDbVersion(event, opts?.dedupeKey))
+                .catch(() => { });
+            return;
+        }
         this.version = Math.max(this.version + 1, Date.now());
         const entry = { ...event, version: this.version };
+        this.commitEntry(entry);
+        void this.persistSyncEvent(entry, opts?.dedupeKey);
+    }
+    /** Buffer + emit. Shared by both version-allocation modes. */
+    commitEntry(entry) {
         this.buffer.push(entry);
         if (this.buffer.length > MAX_BUFFER) {
             this.buffer.splice(0, this.buffer.length - MAX_BUFFER);
         }
         this.pollEmitter.emit(POLL_CHANGE_EVENT, entry);
-        void this.persistSyncEvent(entry, opts?.dedupeKey);
+    }
+    async recordWithDbVersion(event, dedupeKey) {
+        // One id for both the allocating attempt AND any fallback persist: if the
+        // allocating INSERT commits server-side but the call fails (e.g. a query
+        // timeout after commit), the fallback's ON CONFLICT dedupes against the
+        // committed row instead of writing the same event twice under two ids.
+        // Deterministic ids exclude version by design; the random fallback id gets
+        // a wall-clock prefix instead of its usual version prefix (the prefix is
+        // debuggability, not semantics — nothing parses row ids).
+        const id = this.deterministicEventIds && dedupeKey !== undefined
+            ? this.durableEventId({ ...event, version: 0 }, dedupeKey)
+            : `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+        let version = null;
+        try {
+            version = await this.persistWithDbAssignedVersion(event, id);
+        }
+        catch {
+            version = null;
+        }
+        if (version == null) {
+            // The statement may have COMMITTED even though the call failed (e.g. a
+            // timeout after commit). Recover the durable row's version by the shared
+            // id so clients see the allocator-assigned value, never a divergent
+            // clock one.
+            version = await this.recoverCommittedVersion(id);
+        }
+        if (version == null) {
+            // Availability fallback: a DB blip must not stall the in-process fast
+            // path. Clock-allocate and emit — but first make a best effort to lift
+            // the allocator to the fallback value, so other writers' next
+            // allocations land above the cursors this emit will advance (max-only
+            // cursors above the allocator would filter those events permanently).
+            // If the DB is down the lift fails too; the ordering guarantee is soft
+            // exactly while the DB is unhealthy.
+            this.dbVersionFallbacks++;
+            if (this.dbVersionFallbacks === 1) {
+                console.warn("[agent-native] sync version allocation failed; falling back to clock-assigned versions");
+            }
+            this.version = Math.max(this.version + 1, Date.now());
+            const entry = { ...event, version: this.version };
+            await this.alignVersionAllocator(this.version);
+            this.commitEntryForChain(entry);
+            void this.persistSyncEvent(entry, dedupeKey, id);
+            return;
+        }
+        // A deterministic-id dedupe loser adopts the winner's (possibly older)
+        // version here — buffer filtering is a full scan, so a non-tail version is
+        // delivered correctly and the version-keyed combined-read dedupe collapses
+        // it against the durable row.
+        this.version = Math.max(this.version, version);
+        this.commitEntryForChain({ ...event, version });
+    }
+    /**
+     * `commitEntry` for the deferred (chained) path: the buffer push must land
+     * and a throwing pollEmitter listener must not reject the chain — the
+     * synchronous path propagates such throws to the recordChange caller, but
+     * here there is no caller to propagate to, only the chain to poison.
+     */
+    commitEntryForChain(entry) {
+        try {
+            this.commitEntry(entry);
+        }
+        catch (err) {
+            if (!this.warnedListenerThrow) {
+                this.warnedListenerThrow = true;
+                console.warn("[agent-native] poll listener threw during deferred emit", err);
+            }
+        }
     }
     recordExtensionChanges(targets, dedupeKey) {
         const uniqueTargets = new Map();
@@ -785,8 +997,16 @@ export class AppSyncState {
             for (const row of refreshResult.rows) {
                 refreshTs = Math.max(refreshTs, timestampValue(row.updated_at));
             }
+            const seedMax = Math.max(syncEventsTs, appTs, settingsTs, extensionsTs, extensionMarkerTs, actionMarkerTs);
+            // The seed mixes app-clock `updated_at` values that can sit AHEAD of the
+            // allocator (a skew-fast writer's rows). Lift the allocator to the seed
+            // BEFORE the seed can reach this.version — and through it, client
+            // cursors — so no later allocation lands below a seeded cursor.
+            if (this.dbAssignedVersions && this.isPg() && !syncEventsDisabled()) {
+                await this.alignVersionAllocator(seedMax);
+            }
             // Seed version — never decrease an already-set value
-            this.version = Math.max(this.version, syncEventsTs, appTs, settingsTs, extensionsTs, extensionMarkerTs, actionMarkerTs);
+            this.version = Math.max(this.version, seedMax);
             // Set baselines so checkExternalDbChanges detects future writes
             this.lastAppStateTs = appTs;
             this.lastSettingsTs = settingsTs;
@@ -829,7 +1049,18 @@ export class AppSyncState {
         if (this.checkPromise)
             return this.checkPromise;
         this.lastDbCheck = now;
-        this.checkPromise = this.doCheckExternalDbChanges().finally(() => {
+        this.checkPromise = this.doCheckExternalDbChanges()
+            .then(() => {
+            // Gated: the detector's recordChange calls only SCHEDULED allocations.
+            // The poll handler awaits this check so detected cross-process writes
+            // land in the same response — drain the chain here to keep that
+            // contract (and so a serverless instance frozen after responding
+            // can't strand them). The chain never rejects (backstopped).
+            if (this.dbAssignedVersions && this.isPg() && !syncEventsDisabled()) {
+                return this.recordChain;
+            }
+        })
+            .finally(() => {
             this.checkPromise = null;
         });
         return this.checkPromise;
@@ -998,13 +1229,29 @@ export class AppSyncState {
     }
 }
 let _defaultState;
+/**
+ * Hosted-realtime gate for the default instance, env-only. Mirrors the
+ * fail-closed transport-AND-url pair in `sentry-config.ts`'s
+ * `resolveRealtimeClientConfig` (not imported — poll.ts is import-cycle
+ * sensitive). Hosted apps are multi-writer (their own serverless instances
+ * plus gateway instances share one DB), so THEY must DB-allocate versions too
+ * — gating only the gateway would leave the app's user-event writes
+ * clock-versioned and the cross-writer skew hole open.
+ */
+function hostedRealtimeTransportEnabled() {
+    return (process.env.AGENT_NATIVE_REALTIME_TRANSPORT?.trim() === "hosted" &&
+        !!process.env.AGENT_NATIVE_REALTIME_GATEWAY_URL?.trim());
+}
 /**
  * The process-wide default instance, bound to the global DB. All module-level
  * exports delegate here so self-hosted apps run exactly one code path.
  */
 export function getDefaultAppSyncState() {
-    if (!_defaultState)
-        _defaultState = new AppSyncState();
+    if (!_defaultState) {
+        _defaultState = new AppSyncState({
+            dbAssignedVersions: hostedRealtimeTransportEnabled(),
+        });
+    }
     return _defaultState;
 }
 /** Get the current global version counter. */