@helipod/sync 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,944 @@
+import { JSONValue, Value } from '@helipod/values';
+import { SerializedKeyRange } from '@helipod/index-key-codec';
+import { FilterExpr } from '@helipod/query-engine';
+import { WrittenDoc } from '@helipod/transactor';
+import { DiffableRange, DiffablePage } from '@helipod/executor';
+
+/**
+ * The DLR row-diff vocabulary shared by the server (emit) and the client (apply). A DIFFABLE query's
+ * materialized value is a keyed `Map<docId, RowVersion>`; `applyChanges` is the ONE apply used on both
+ * sides so they cannot drift in how a diff materializes. `driftChecksum` is an order-independent XOR
+ * fold over `(key, ts)` — a cheap safety net: the client recomputes it after applying and, on
+ * mismatch, scoped-resyncs that one query. See docs/dev/architecture/reactivity-differential-log-tail.md §4.3-4.4.
+ */
+
+type Change = {
+    t: "add";
+    key: string;
+    row: JSONValue;
+    ts: number;
+    orderKey?: string;
+} | {
+    t: "remove";
+    key: string;
+} | {
+    t: "edit";
+    key: string;
+    row: JSONValue;
+    ts: number;
+    orderKey?: string;
+};
+interface RowVersion {
+    row: JSONValue;
+    ts: number;
+    orderKey?: string;
+}
+/** Apply changes to a keyed row-map, copy-on-write. Returns a NEW map (callers rely on a fresh
+ *  reference to fire listeners). `add`/`edit` set `{row, ts, orderKey}`; `remove` deletes the key. */
+declare function applyChanges(rows: Map<string, RowVersion>, changes: readonly Change[]): Map<string, RowVersion>;
+/** FNV-1a 32-bit of `"<key> <ts> <orderKey>"` per row, XOR-folded to 32 bits. Order-independent so server and
+ *  client agree regardless of iteration order. Hex string. */
+declare function driftChecksum(rows: Map<string, RowVersion>): string;
+
+/**
+ * The reactive sync protocol — the client↔server message catalog and the version model.
+ *
+ * State is **version-bracketed**: every `Transition` advances `startVersion → endVersion`,
+ * and a client applies one only if its `startVersion` matches the client's current version.
+ * A missed frame leaves a gap the client detects and resyncs from — so dropping a frame
+ * (backpressure) degrades to a resync, never to silent divergence. The `ServerMessage` union
+ * is versioned-by-shape and deliberately extensible (e.g. the non-commit `Broadcast` kind for
+ * the ephemeral path) so the wire can later gain a binary delta encoding.
+ */
+
+interface StateVersion {
+    /** Bumped when the set of subscribed queries changes. */
+    querySet: number;
+    /** The latest commit timestamp reflected (0 = none). */
+    ts: number;
+}
+declare const INITIAL_VERSION: StateVersion;
+declare function versionsEqual(a: StateVersion, b: StateVersion): boolean;
+declare function compareStateVersion(a: StateVersion, b: StateVersion): -1 | 0 | 1;
+/** Two brackets are contiguous when the next starts exactly where the previous ended. */
+declare function isContiguous(prevEnd: StateVersion, nextStart: StateVersion): boolean;
+/**
+ * `resultHash` (subscription resume, design 2025-11-28): the client's last-known server-minted
+ * fingerprint for this query, echoed back on resubscribe. Present only when the subscription was
+ * previously `answered` with a defined value; absent on a first subscribe, a prior `QueryFailed`,
+ * or an old client that predates this field — all of which fall through to today's full send.
+ */
+interface QueryRequest {
+    queryId: number;
+    udfPath: string;
+    args: JSONValue;
+    resultHash?: string;
+    /**
+     * DLR Stage 3 — the client's `maxObservedTs` at resume time; lets the server skip the re-run
+     * when nothing touched the query's read-set since. Present only on a resume resubscribe;
+     * absent on a fresh subscribe.
+     */
+    sinceTs?: number;
+}
+/**
+ * The durable per-tab client identity for a resend-safe mutation (Receipted Outbox, verdict §(b)/(e)).
+ * `clientId` is minted once per tab-session; `seq` is a per-tab monotone counter. The `(identity,
+ * clientId, seq)` triple is the write-once dedup key; `identity` is the session's ambient token,
+ * supplied server-side (never trusted from the client). Both fields absent → today's unconditional
+ * path, bit-for-bit — a mutation with no `clientId` writes no receipt and reads no classification.
+ */
+interface ClientMutationRef {
+    clientId: string;
+    seq: number;
+}
+/** One entry of a {@link MutationBatch} — the same shape a standalone `Mutation` carries. */
+interface MutationBatchEntry {
+    requestId: string;
+    udfPath: string;
+    args: JSONValue;
+    clientId?: string;
+    seq?: number;
+}
+/**
+ * A per-seq verdict as it travels on the wire (`ConnectAck.results`, verdict §(e)). `verdict`
+ * distinguishes a replayed success (`applied`), a replayed terminal failure (`failed`), a
+ * loudly-disowned pruned/holed seq (`stale`), and a never-seen seq the client must (re)send
+ * (`unknown`). `commitTs`/`value`/`valueMissing`/`code` mirror {@link MutationResponse}'s replay shape.
+ */
+interface ClientMutationVerdict {
+    clientId: string;
+    seq: number;
+    verdict: "applied" | "failed" | "stale" | "unknown";
+    commitTs?: number;
+    value?: JSONValue;
+    valueMissing?: true;
+    code?: string;
+}
+type ClientMessage = {
+    type: "Connect";
+    sessionId: string;
+    clientId?: string;
+    held?: ClientMutationRef[];
+    ackedThrough?: ClientMutationRef[];
+    supportsQueryDiff?: true;
+} | {
+    type: "ModifyQuerySet";
+    add: QueryRequest[];
+    remove: number[];
+} | {
+    type: "Mutation";
+    requestId: string;
+    udfPath: string;
+    args: JSONValue;
+    clientId?: string;
+    seq?: number;
+} | {
+    type: "MutationBatch";
+    entries: MutationBatchEntry[];
+} | {
+    type: "Action";
+    requestId: string;
+    udfPath: string;
+    args: JSONValue;
+} | {
+    type: "EphemeralPublish";
+    topic: string;
+    event: JSONValue;
+} | {
+    type: "SetAuth";
+    token: string | null;
+} | {
+    type: "SetAdminAuth";
+    key: string;
+};
+type StateModification = {
+    type: "QueryUpdated";
+    queryId: number;
+    value: JSONValue;
+    hash?: string;
+} | {
+    type: "QueryFailed";
+    queryId: number;
+    error: string;
+} | {
+    type: "QueryRemoved";
+    queryId: number;
+} | {
+    type: "QueryUnchanged";
+    queryId: number;
+} | {
+    type: "QueryDiff";
+    queryId: number;
+    changes: Change[];
+    checksum: string;
+    reset?: true | {
+        mode: "byid" | "range";
+        orderDir?: "asc" | "desc";
+    } | {
+        mode: "page";
+        orderDir: "asc" | "desc";
+        nextCursor: string | null;
+        hasMore: boolean;
+        scanCapped: boolean;
+    };
+    hash?: string;
+};
+type ServerMessage = {
+    type: "Transition";
+    startVersion: StateVersion;
+    endVersion: StateVersion;
+    modifications: StateModification[];
+} | {
+    type: "MutationResponse";
+    requestId: string;
+    success: true;
+    value?: JSONValue;
+    ts?: number;
+    replayed?: true;
+    valueMissing?: true;
+} | {
+    type: "MutationResponse";
+    requestId: string;
+    success: false;
+    error: string;
+    code?: string;
+} | {
+    type: "ActionResponse";
+    requestId: string;
+    success: true;
+    value: JSONValue;
+} | {
+    type: "ActionResponse";
+    requestId: string;
+    success: false;
+    error: string;
+} | {
+    type: "ConnectAck";
+    known: boolean;
+    results: ClientMutationVerdict[];
+    deploymentId: string;
+} | {
+    type: "Broadcast";
+    topic: string;
+    event: JSONValue;
+} | {
+    type: "FatalError";
+    message: string;
+} | {
+    type: "Ping";
+};
+declare function parseClientMessage(raw: string): ClientMessage;
+declare function encodeServerMessage(msg: ServerMessage): string;
+
+/**
+ * Classify a subscription as DIFFABLE_BYID (a single `db.get(id)`) vs RERUN, from its recorded read
+ * set + result. A by-id read records EXACTLY one point range in a table's primary keyspace
+ * (`table:<enc>`, NOT `index:...`), and returns a single document object or `null`. Anything else —
+ * multiple ranges, an index/collect read, a span range, an array result — is RERUN (safe fallback).
+ */
+
+interface ByIdRead {
+    keyspace: string;
+    /** base64 of the point-range start bytes (== the doc's primary-key bytes). */
+    key: string;
+    /** the public document id (the diff Change.key), taken from the returned doc's `_id`. */
+    docId: string;
+}
+/** A page's fixed metadata, as returned to the guest by `db.query(...).paginate()` — see
+ *  `DiffablePage`'s doc comment in `packages/executor/src/executor.ts`. */
+interface PageMeta {
+    nextCursor: string | null;
+    hasMore: boolean;
+    scanCapped: boolean;
+}
+interface RangeRead {
+    keyspace: string;
+    bounds: SerializedKeyRange;
+    filters: FilterExpr[];
+    order: "asc" | "desc";
+    fields: string[];
+    /** Present iff this range is a page (DLR Stage 2c) — the page's own fixed metadata. */
+    pageMeta?: PageMeta;
+}
+
+type MatchMode = "table" | "range";
+interface Subscription {
+    sessionId: string;
+    queryId: number;
+    udfPath: string;
+    args: JSONValue;
+    /** Tables this subscription's read set touched (table-level match key / fallback). */
+    tables: string[];
+    /** Precise read ranges (range-level match key — surgical invalidation). */
+    readRanges: readonly SerializedKeyRange[];
+    /**
+     * M2c: global (D1) tables this subscription's read set touched (a `.global()` read produces no
+     * `readRanges` entry, so these are NOT already covered by `tables`/`readRanges` above). Field +
+     * threading only — NOT yet indexed/matched here; Task 4 adds the dedicated `byGlobalTable` index,
+     * `findAffectedByRanges` matching, and a `subscribedGlobalTables()` accessor that read it.
+     */
+    globalTables?: string[];
+    /** DIFFABLE_BYID marker + the by-id read descriptor; absent ⇒ RERUN. Set at subscribe (classify). */
+    byId?: ByIdRead;
+    /** DIFFABLE_RANGE marker + the range read descriptor; absent ⇒ RERUN. Set at subscribe (classify). */
+    range?: RangeRead;
+    /**
+     * DLR Stage 3: the resume-registry key this sub was registered under, captured at subscribe time.
+     * Release MUST use this stored key — never a key re-derived from `session.identity` at teardown,
+     * because `SetAuth` can mutate `session.identity` in place after subscribe, which would otherwise
+     * release a different key than `upsert` created (a silent no-op → permanent registry leak).
+     */
+    resumeKey?: string;
+}
+declare class SubscriptionManager {
+    private readonly byKey;
+    private readonly byTable;
+    private readonly byRange;
+    private readonly tableFallbackKeys;
+    private readonly deserializedRanges;
+    /**
+     * M2c: index from global (D1) table name -> subscription keys whose read set touched it, via
+     * `Subscription.globalTables`. Populated UNCONDITIONALLY in `add` (independent of
+     * `readRanges`/`tableFallbackKeys`) so a MIXED subscription — one with both local `readRanges`
+     * and a global-table read — still lands here. Matched by a THIRD, ungated loop in
+     * `findAffectedByRanges`; the existing table-fallback loop is gated on `tableFallbackKeys`
+     * precisely because it must NOT fire for a sub with non-empty `readRanges`, but global-table
+     * reads have no `readRanges` entry of their own, so that gate would wrongly exclude a mixed sub.
+     */
+    private readonly byGlobalTable;
+    add(sub: Subscription): void;
+    private removeKey;
+    remove(sessionId: string, queryId: number): void;
+    removeSession(sessionId: string): void;
+    get(sessionId: string, queryId: number): Subscription | undefined;
+    /**
+     * Subscriptions whose read set intersects the given write ranges (surgical invalidation),
+     * unioned with table-fallback subscriptions (empty readRanges) touched by the write tables.
+     * Same result set as the retired linear scan, computed in O(log N + k) per write range.
+     */
+    findAffectedByRanges(writeRanges: readonly SerializedKeyRange[], writeTables: readonly string[]): Subscription[];
+    /** Subscriptions whose read set touched any of the given tables (deduped). */
+    findAffectedByTables(tables: readonly string[]): Subscription[];
+    /** All subscriptions for a session (e.g. to re-run them when identity changes). */
+    forSession(sessionId: string): Subscription[];
+    get size(): number;
+    /** Global (D1) table names with at least one live subscriber (M2c). */
+    subscribedGlobalTables(): string[];
+}
+
+/**
+ * The compute-saving half of reconnect resume (DLR Stage 3): for every LIVE query
+ * (identity+path+args), tracks the read set it last executed with and the timestamp through
+ * which its result is known-current (`lastInvalidatedTs`). A commit advances that timestamp for
+ * every registry entry whose ranges/tables intersect the write — using the SAME range-indexed
+ * matcher as `SubscriptionManager` (an `IntervalIndex` keyed by keyspace plus a `byTable`
+ * fallback) so this stays O(log N + k), not a linear scan.
+ *
+ * Entries are TTL-retained across disconnect: a query with zero live subscribers is not evicted
+ * immediately (a reconnect within `TTL_MS` should still be able to resume it), but it MUST stay
+ * indexed the whole time it's retained — a write landing during that "gap" still has to advance
+ * `lastInvalidatedTs`, or a resuming client would wrongly believe its stale result is current.
+ */
+
+declare const TTL_MS = 60000;
+declare function regKey(identity: string | null, path: string, argsJson: JSONValue): string;
+interface ResumeLookup {
+    readRanges: readonly SerializedKeyRange[];
+    tables: readonly string[];
+    globalTables: readonly string[];
+    lastInvalidatedTs: number;
+    wasDiffable: boolean;
+}
+declare class ResumeRegistry {
+    private readonly entries;
+    private readonly byTable;
+    private readonly byRange;
+    private readonly tableFallbackKeys;
+    private readonly deserializedRanges;
+    upsert(key: string, readRanges: readonly SerializedKeyRange[], tables: readonly string[], atTs: number, wasDiffable: boolean, globalTables?: readonly string[]): void;
+    private index;
+    private unindex;
+    /**
+     * Advances `lastInvalidatedTs` for every entry whose read set intersects the write — including
+     * entries with refCount 0 that are only TTL-retained (they remain indexed until swept).
+     */
+    advanceOnCommit(writtenRanges: readonly SerializedKeyRange[], writtenTables: readonly string[], commitTs: number): void;
+    lookup(key: string): ResumeLookup | undefined;
+    retain(key: string): void;
+    release(key: string, nowMs: number): void;
+    /** Evicts entries with no live subscribers whose TTL has elapsed. Removes them from both indexes. */
+    sweep(nowMs: number): void;
+    /** @internal test/debug only — a live entry's current refCount, or undefined if no such entry. */
+    __refCount(key: string): number | undefined;
+    /** @internal test/debug only — a live entry's pending TTL expiry, or undefined (not pending / no
+     *  such entry). */
+    __expiresAtMs(key: string): number | undefined;
+}
+
+/**
+ * Per-session flow-control controllers — the server half of Foundation seam 6 (fleet hardening).
+ *
+ * A reactive fan-out can push faster than a client can read. Two failure modes matter:
+ *  - **A slow reader** whose OS send buffer fills — without a cap, queued frames grow unbounded and
+ *    exhaust server memory. `SessionBackpressureController` bounds that: it becomes the SINGLE
+ *    outbound chokepoint for a session, sending straight through when the socket has room, queueing
+ *    (up to a frame cap) when it doesn't, and DROPPING frames once the queue is full or the client
+ *    has been backpressured for too long. Dropped frames are safe — the client resyncs from its last
+ *    acknowledged version — so we favour dropping over stalling the whole node. `MutationResponse`/
+ *    `ActionResponse` frames are the one exception: they carry `undroppable: true` and are never
+ *    dropped by cap or timeout (they only queue behind the cap; the queue's timeout-abandon path
+ *    also spares them) — a dropped response has no version bracket and no retransmit, so losing one
+ *    would strand a client-side mutation as permanently "inflight" instead of self-healing.
+ *    But "never dropped" cannot mean "never bounded" — a client that floods mutations into its own
+ *    deliberately-slow-reading socket would otherwise grow the undroppable queue without limit and
+ *    exhaust server memory, the exact resource-exhaustion hole the droppable cap exists to close.
+ *    So undroppable frames get their OWN cap (`maxUndroppableQueuedFrames`, counted separately from
+ *    `maxQueuedFrames` — a session's droppable-Transition backlog never affects how much undroppable-
+ *    response headroom it has, and vice versa). Crucially, exceeding that cap must NOT silently drop
+ *    the frame — that would corrupt exactly the "inflight" invariant this exemption exists to
+ *    protect. Instead it TERMINATES the session (`onOverflow`, wired by the handler to the same
+ *    reap-and-close path a dead heartbeat uses). A closed transport is protocol-safe: the client's
+ *    own close/reconnect handling turns every in-flight request into an explicit unknown-outcome
+ *    error, which is the honest outcome here — not a silent gap the client believes never happened.
+ *  - **A dead-but-not-closed connection** (half-open TCP: the peer vanished, no FIN/RST). Nothing
+ *    reads, nothing errors; the session lingers forever holding subscriptions. `SessionHeartbeat-
+ *    Controller` reaps it via transport-level ping/pong liveness — NOT inbound-message silence (an
+ *    idle-but-healthy client sends nothing yet must never be reaped).
+ *
+ * Both are transport-agnostic: they talk only to `SyncWebSocket`. A socket that cannot ping (the
+ * in-process loopback — `bufferedAmount` is always 0, there is no peer to die) is transparently
+ * exempt from heartbeat, and its sends always pass straight through the backpressure controller, so
+ * loopback behaviour is byte-identical to before these controllers existed.
+ */
+
+interface BackpressureOptions {
+    /** Above this `bufferedAmount`, frames queue instead of sending. Default 1 MiB. */
+    highWaterBytes?: number;
+    /** Queue depth past which new frames are dropped (drop-newest). Default 200. */
+    maxQueuedFrames?: number;
+    /** Sustained-backpressure duration after which the queue is abandoned to drops. Default 30s. */
+    slowClientTimeoutMs?: number;
+    /**
+     * Cap on queued undroppable (MutationResponse/ActionResponse) frames, counted SEPARATELY from
+     * `maxQueuedFrames` (a session's droppable backlog never eats into this budget or vice versa).
+     * Defaults to `maxQueuedFrames`'s own (effective, post-default) value — same order of magnitude
+     * headroom, no new tuning knob to reason about by default. Exceeding it does not drop the frame
+     * (see the class doc) — it terminates the session via `onOverflow`.
+     */
+    maxUndroppableQueuedFrames?: number;
+}
+declare class SessionBackpressureController {
+    private readonly socket;
+    private readonly now;
+    /**
+     * Fires exactly once when the undroppable queue overflows its cap. The controller only
+     * decides "this session must die" — it has no session registry to tear down itself, so it
+     * hands off to whatever the owner wires here (the handler reuses the same reap-and-close path
+     * a dead heartbeat uses). Defaults to a no-op so standalone/unit use of this class doesn't
+     * require wiring one up.
+     */
+    private readonly onOverflow;
+    private readonly highWaterBytes;
+    private readonly maxQueuedFrames;
+    private readonly slowClientTimeoutMs;
+    private readonly maxUndroppableQueuedFrames;
+    private readonly queue;
+    private _droppedFrames;
+    /** Count of undroppable frames currently sitting in `queue` — the separate overflow budget. */
+    private undroppableQueuedCount;
+    /** True once `onOverflow` has fired, so a dying session can't fire it twice. */
+    private overflowed;
+    /** Wall-clock ms at which the current backpressure episode began, or null if not backpressured. */
+    private backpressureSince;
+    /** True once any frame has been dropped in the current episode; resets on full drain. */
+    private _droppedThisEpisode;
+    constructor(socket: SyncWebSocket, opts?: BackpressureOptions, now?: () => number, 
+    /**
+     * Fires exactly once when the undroppable queue overflows its cap. The controller only
+     * decides "this session must die" — it has no session registry to tear down itself, so it
+     * hands off to whatever the owner wires here (the handler reuses the same reap-and-close path
+     * a dead heartbeat uses). Defaults to a no-op so standalone/unit use of this class doesn't
+     * require wiring one up.
+     */
+    onOverflow?: () => void);
+    get droppedFrames(): number;
+    /** True once anything was dropped since the last fully-drained state (the per-episode warn flag). */
+    get droppedThisEpisode(): boolean;
+    /**
+     * The ONLY way frames leave a session. Sends now, queues, or drops per the class contract.
+     * `undroppable` (default false) exempts a frame from BOTH drop paths below — the cap check
+     * and the sustained-backpressure abandon — so it only ever queues or sends, never vanishes.
+     */
+    send(data: string, undroppable?: boolean): void;
+    /**
+     * Deliver as many queued frames as the socket buffer will take. Called before each send and on a
+     * periodic sweep, so a client that recovers (or goes terminally slow) without new traffic still
+     * gets its queue drained (or abandoned). Resets the episode once fully drained.
+     */
+    flush(): void;
+    /** Abandon the queue to drops — EXCEPT undroppable frames, which stay queued for a later flush. */
+    private dropQueue;
+    private countDrop;
+    /**
+     * The undroppable queue exceeded its cap. Fires `onOverflow` exactly once (a session that's
+     * already dying doesn't need a second kill signal) with a distinct, greppable log reason —
+     * deliberately NOT reusing the backpressure-drop warning text, since this is a different failure
+     * mode (session termination, not a dropped frame) that ops needs to be able to tell apart.
+     */
+    private overflow;
+    private markEpisodeDropped;
+}
+interface HeartbeatOptions {
+    /** How often to send a transport-level ping. Default 30s. */
+    pingIntervalMs?: number;
+    /** Consecutive unanswered pings before the session is declared dead. Default 2. */
+    missedPongLimit?: number;
+}
+/**
+ * Transport-level ping/pong liveness for one session. Every `pingIntervalMs` it sends a ping and
+ * increments a miss counter; a pong (or any inbound activity via `noteActivity`) resets it to zero.
+ * After `missedPongLimit` consecutive unanswered pings the session is declared dead and `onDead`
+ * fires exactly once. A socket without a `ping` capability (loopback) is exempt: `start()` is a
+ * no-op, so its session is never reaped.
+ */
+declare class SessionHeartbeatController {
+    private readonly socket;
+    private readonly onDead;
+    private readonly pingIntervalMs;
+    private readonly missedPongLimit;
+    private timer;
+    private missed;
+    private dead;
+    constructor(socket: SyncWebSocket, onDead: () => void, opts?: HeartbeatOptions);
+    /** Begin pinging. No-op when the socket cannot ping (loopback exemption) or already started. */
+    start(): void;
+    stop(): void;
+    /** Any inbound message is liveness credit — resets the consecutive-miss counter. */
+    noteActivity(): void;
+    private tick;
+    private fireDead;
+}
+
+/** The minimal socket the handler needs (abstract — WS, Durable Object, or loopback). */
+interface SyncWebSocket {
+    send(data: string): void;
+    readonly bufferedAmount: number;
+    close(): void;
+    /**
+     * Send a transport-level ping; invoke `onPong` when the matching pong arrives. OPTIONAL — a
+     * socket that omits it (the in-process loopback, which has no peer to die) is exempt from
+     * heartbeat reaping. Real WebSocket transports implement it.
+     */
+    ping?(onPong: () => void): void;
+}
+/** Today's fresh-run mutation result (a real commit happened), tagged so the handler discriminates
+ *  it from a {@link MutationReplay}. */
+interface MutationRan {
+    replayed?: false;
+    value: Value;
+    tables: string[];
+    writeRanges: readonly SerializedKeyRange[];
+    commitTs: number;
+    forwarded?: boolean;
+}
+/**
+ * A replay of a prior verdict (Receipted Outbox, verdict §(c)) — NO commit happened on this call.
+ * The classification at the OWNER (`runMutation`'s `dedup` path) hit a recorded verdict (or the
+ * floor), so the mutation is NOT re-run. The handler must therefore skip `notifyWrites` AND the G4
+ * pending-frontier (nothing was written this call — verdict §(c) Risk R7).
+ */
+interface MutationReplay {
+    replayed: true;
+    verdict: "applied" | "failed" | "stale";
+    /** The ORIGINAL commitTs for an `applied`/`failed` record (keeps the client gate sound); absent
+     *  for `stale` (no commit ever happened). */
+    commitTs?: number;
+    /** Present only for `applied` with a recorded return value. */
+    value?: Value;
+    /** `applied` whose value was never recorded (crash-window) or exceeded the 64KB cap. */
+    valueMissing?: true;
+    /** The terminal verdict code for `failed` (the recorded error code) or `"STALE_CLIENT"` for `stale`. */
+    code?: string;
+}
+type RunMutationResult = MutationRan | MutationReplay;
+/** Runs UDFs for the sync tier. Backed by the executor; returns table sets + precise read ranges for matching. */
+interface SyncUdfExecutor {
+    runQuery(udfPath: string, args: JSONValue, identity?: string | null): Promise<{
+        value: Value;
+        tables: string[];
+        readRanges: readonly SerializedKeyRange[];
+        globalTables: string[];
+        diffableRange?: DiffableRange;
+        diffablePage?: DiffablePage;
+    }>;
+    /**
+     * `origin` (G4, client-sync verdict §(d) item 2): the committing session's id, threaded onto the
+     * commit's `OplogDelta.origin` so the fan-out can advance THAT session's own `version.ts` past its
+     * commit even when it touched nothing the session subscribes to. `forwarded` (fleet): true when
+     * the mutation committed on ANOTHER node (no local oplog) — its origin tag couldn't ride this
+     * node's local fan-out, so the handler advances the origin frontier via a drain-gated fallback.
+     *
+     * `dedup` (Receipted Outbox, verdict §(c)): the durable `(clientId, seq)` — absent = today's
+     * unconditional path, bit-for-bit (no classification read, no receipt write). Present → the OWNER's
+     * `runMutation` impl classifies: a recorded/floored verdict short-circuits to a {@link MutationReplay}
+     * (no commit); a miss runs the mutation with the dedup key rideng the commit meta (the receipts
+     * guard writes the `applied` receipt atomically). The handler only threads `dedup` down and
+     * interprets the discriminated return — it NEVER reads the classification store itself (it runs on
+     * any node, incl. a fleet follower; the read must run where the commit runs — verdict §(c) repair 3).
+     */
+    runMutation(udfPath: string, args: JSONValue, identity?: string | null, origin?: string, dedup?: ClientMutationRef): Promise<RunMutationResult>;
+    runAdminQuery(udfPath: string, args: JSONValue): Promise<{
+        value: Value;
+        tables: string[];
+        readRanges: readonly SerializedKeyRange[];
+        globalTables: string[];
+        diffableRange?: DiffableRange;
+        diffablePage?: DiffablePage;
+    }>;
+    /** One-shot, non-reactive: an action has no read/write set of its own to fan out. */
+    runAction(udfPath: string, args: JSONValue, identity?: string | null): Promise<{
+        value: Value;
+    }>;
+    /**
+     * Classify a presented `(identity, clientId, seq)` for the `Connect` resume handshake (verdict
+     * §(e)) — the read-only sibling of `runMutation`'s dedup path. Returns the recorded verdict, or
+     * `"stale"` (below the floor, no record), or `"unknown"` (never seen — the client should resend).
+     * Optional: an executor without receipts support (or an old one) omits it → `Connect` degrades to
+     * `known: false` with empty results.
+     */
+    classifyClientMutation?(identity: string | null, clientId: string, seq: number): Promise<ClientMutationVerdict>;
+    /** Ack-prune the contiguous settled prefix `seq <= ackedThrough` for `(identity, clientId)` on a
+     *  `Connect` (verdict §(c) Retention). Optional (same reason as `classifyClientMutation`). */
+    pruneClientMutations?(identity: string | null, clientId: string, ackedThrough: number): Promise<void>;
+    /** The deployment-id stamp for `ConnectAck` (verdict §(g) hazard 15 — same-timeline proof). */
+    deploymentId?(): string;
+}
+/** A committed write's invalidation — the transactor→sync fan-out payload (Tier 2: from a stream). */
+interface WriteInvalidation {
+    tables: string[];
+    /** Precise write ranges for surgical (range-level) invalidation. */
+    ranges: readonly SerializedKeyRange[];
+    commitTs: number;
+    /** Written docs for local row-diffing (§DLR 2a). Absent → affected DIFFABLE subs fall back to RERUN. */
+    writtenDocs?: WrittenDoc[];
+    /**
+     * M2c Critical fix: true for a GLOBAL (D1-backed) table invalidation, sourced from
+     * `GlobalReactivityPoller` rather than the local MVCC commit path. Global reactivity has its OWN
+     * clock (D1's `_global_versions` counter) — `commitTs` on a global invalidation is a harmless
+     * placeholder (`0`), never an oracle-issued local timestamp. A `global` invalidation is
+     * FRONTIER-NEUTRAL: it must never advance `session.version.ts` (the client-facing local-ts
+     * frontier) or the local-ts `ResumeRegistry` — mixing the two clock domains on that one shared
+     * scalar silently breaks local optimistic-update gating and local reconnect-resume for any
+     * session with both a local and a global subscription (see `doNotifyWrites`, `sendSessionTransition`,
+     * and `doModifyQuerySet`'s `globalTables.length > 0` reconnect bypass). Absent/false = a normal
+     * local commit — byte-identical to pre-M2c behavior.
+     */
+    global?: boolean;
+}
+interface SyncProtocolHandlerOptions {
+    /** Exclude the mutating session from the reactive transition (it has the MutationResponse). */
+    excludeOriginFromTransition?: boolean;
+    /**
+     * Whether a mutation handled here triggers `notifyWrites` inline (default true). Set false
+     * when an external write-fan-out drives invalidation (so commits via OTHER paths — e.g. HTTP
+     * — also push, and there's no double-notify).
+     */
+    autoNotifyOnMutation?: boolean;
+    /** Validate an admin key presented via `SetAdminAuth`. Defaults to `() => false` (no admin). */
+    verifyAdmin?: (key: string) => boolean;
+    /** Per-session outbound flow control (queue caps, slow-client drops). Defaults apply if omitted. */
+    backpressure?: BackpressureOptions;
+    /** Per-session ping/pong liveness reaping. Defaults apply if omitted. */
+    heartbeat?: HeartbeatOptions;
+    /**
+     * Disarm the handler's process-shaped background timers: the periodic `setInterval` flush/resume
+     * sweep AND every per-session heartbeat ping. Defaults to `false` — the long-lived process host
+     * (`Bun.serve`/`node:http`) is byte-for-byte unchanged.
+     *
+     * WHY (the Cloudflare Durable Object host, Slice 3): a DO **hibernates after ~seconds idle** to
+     * scale to zero, keeping its WebSockets alive while discarding in-memory state. On a DO these
+     * timers are actively harmful, not merely useless: (a) a `setInterval` sweep does not keep a DO
+     * alive and is silently lost on hibernation — dead weight; (b) an app-level `socket.ping` heartbeat
+     * would **wake the DO on every ping**, destroying the scale-to-zero economics that are the entire
+     * point of the DO host. Keepalive on a DO instead moves to the runtime-level
+     * `setWebSocketAutoResponse` (a ping/pong the runtime answers WITHOUT waking the object). So the DO
+     * host constructs the handler with this set; the process host never does. Additive + off by default
+     * so nothing but the DO host observes any change. See
+     * `docs/superpowers/specs/2026-03-20-do-host-slice3-design.md` §8.1.
+     */
+    disableBackgroundTimers?: boolean;
+}
+declare class SyncProtocolHandler {
+    private readonly executor;
+    private readonly options;
+    private readonly sessions;
+    private readonly subscriptions;
+    private notifyTail;
+    /**
+     * G4 fleet fallback (client-sync verdict §(d) item 2): sessionId → the commitTs of a FORWARDED
+     * mutation whose origin tag couldn't ride this (forwarding) node's local fan-out. Satisfied with
+     * an empty ts-advancing Transition once the drain processes a commit at-or-above it (gated on the
+     * drain's last-processed commitTs — see `sweepPendingFrontiers`). Holds at most one entry per
+     * in-flight forwarded mutation per session; cleared on satisfy or disconnect, so the sweep it
+     * drives stays tiny (usually empty on a single-node deployment, where nothing is ever forwarded).
+     */
+    private readonly pendingFrontiers;
+    /**
+     * DLR 2a CommitDiffer state: `${sessionId} ${queryId}` -> the current materialized 0-or-1-row map
+     * for a DIFFABLE_BYID sub whose client is diff-capable. EPHEMERAL — reseeded on every subscribe
+     * (`doModifyQuerySet`'s reset), updated on every incremental diff (`doNotifyWrites`), and dropped on
+     * unsubscribe/disconnect. NOT a durable CVR: if lost (process restart, or a sub falling back to the
+     * RERUN/QueryUpdated path for one turn) the drift checksum's client-side mismatch check is the
+     * backstop that resyncs the one affected query — see `change.ts`'s `driftChecksum` doc comment.
+     */
+    private readonly byIdRowMap;
+    /**
+     * DLR 2b — the response-before-Transition gate (replaces the fragile, timer-starvable
+     * `setTimeout(0)`). `commitTs` → a one-shot latch a diff-capable origin's OWN reactive Transition
+     * parks on inside `doNotifyWrites`, released once `processMutation` has actually enqueued that
+     * commit's `MutationResponse` onto the session's outbound queue.
+     *
+     * WHY commit-time registration (via {@link registerOriginResponseGate}, called from the runtime's
+     * fan-out subscribe callback) rather than lazily inside `doNotifyWrites`: the fan-out drain is
+     * SERIAL, so under load `doNotifyWrites` for a commit can run long after that commit's response was
+     * already sent (the drain is backed up behind a flood). Registering the gate inside `doNotifyWrites`
+     * would then happen AFTER the release — the release would find no gate (no-op), and the late gate
+     * would park FOREVER, wedging the whole `notifyTail` (the backpressure-flood regression). The
+     * subscribe callback instead fires SYNCHRONOUSLY inside the commit (before `runMutation` resolves,
+     * hence before the response can be sent), so the gate always exists before its release, whatever the
+     * drain backlog.
+     *
+     * WHY a microtask latch, not `setTimeout(0)`: the release runs as `processMutation` resumes after
+     * `await runMutation` — a MICROTASK, which a tight `await`-loop of mutations (`for (…) await
+     * client.mutation(…)`) drains between every iteration. The old timer sat in Node's TIMER phase,
+     * which that same loop STARVES; because the yield sat ON the single `notifyTail`, a starved timer
+     * stalled the entire fan-out chain. A microtask cannot be starved and cannot stall the tail.
+     *
+     * Scoped to a diff-capable LOCAL origin session (see `registerOriginResponseGate`), so every gate
+     * created here is balanced by exactly one release from that session's own `processMutation` — on
+     * EVERY post-commit outcome: the success path releases inline, and a commit-then-throw (or any
+     * throw after the commit) releases from its catch via the `committedTs` the executor stamps on the
+     * error (see `releaseOriginResponseGate`/`committedTsOfError`). Entries are transient: one per
+     * in-flight diff-capable-origin commit, created at commit and dropped on release (or on
+     * `disconnect`, which resolves+drops any still-pending gate for the vanishing session so a
+     * mid-flight teardown can never strand a parked `doNotifyWrites`). The `sessionId` is retained so
+     * that disconnect backstop can find a session's gates in this commitTs-keyed map.
+     */
+    private readonly originResponseGates;
+    /**
+     * DLR Stage 3: the compute-saving half of reconnect resume (see `resume-registry.ts`'s doc
+     * comment). Populated on every subscribe (`doModifyQuerySet`), advanced on every commit
+     * (`doNotifyWrites`, unconditionally — independent of `bySession`, so an entry with zero live
+     * subscribers still advances during its TTL-retained "gap"), and retain/release-tracked across
+     * subscribe/unsubscribe/disconnect. Not yet CONSULTED anywhere (that's a later task) — this task
+     * only keeps it correctly populated.
+     */
+    private readonly resumeRegistry;
+    /**
+     * M2c fix: callbacks registered via {@link onGlobalSubscribe}, fired whenever a subscription is
+     * (re-)registered with a non-empty `globalTables` read set — from `doModifyQuerySet` (fresh
+     * subscribe, or a resume-skip carrying a retained global-table read set), from `handleSetAuth`'s
+     * re-exec (an identity flip can make a query newly read a global table), and from
+     * `sendSessionTransition`'s live-re-run (a data/identity-dependent query can shift onto a global
+     * table across a RERUN refresh). See `DriverContext.onGlobalSubscribe`'s doc comment
+     * (`@helipod/component`) for why this exists — closing the busy-DO-late-subscribe gap in the
+     * M2c global-reactivity poller.
+     */
+    private readonly globalSubscribeListeners;
+    private readonly verifyAdmin;
+    /** Periodic drain sweep — drains recovered clients and abandons terminally-slow queues. */
+    private sweepTimer;
+    constructor(executor: SyncUdfExecutor, options?: SyncProtocolHandlerOptions);
+    connect(sessionId: string, socket: SyncWebSocket): void;
+    disconnect(sessionId: string): void;
+    /** Drop every `byIdRowMap` entry for a session (disconnect/reap) — ephemeral per-sub state, never
+     *  durable, so there's nothing to persist on the way out. */
+    private clearByIdRowMapForSession;
+    /** Reap a session whose heartbeat went dead: close the socket, then tear down like a disconnect. */
+    private reap;
+    /** Stop the background sweep. Call on shutdown; sessions must already be disconnected. */
+    dispose(): void;
+    /** @internal test/debug only — the live ResumeRegistry (DLR Stage 3), for tests to assert
+     *  population/advance/retain-release wiring without duplicating its internals. */
+    get __resumeRegistry(): ResumeRegistry;
+    /** @internal test/debug only — the live SubscriptionManager (M2c), for tests to assert
+     *  registration wiring (e.g. `globalTables`) without duplicating its internals. */
+    get __subscriptions(): SubscriptionManager;
+    /**
+     * M2c Task 6: global (D1-backed) table names with at least one live subscriber right now —
+     * delegates to `SubscriptionManager.subscribedGlobalTables()`. This is the ONLY thing a
+     * `GlobalReactivityPoller` needs from the sync tier to decide which tables are worth polling D1
+     * for (its other dependency, `notifyWrites`, already exists on this class). A public method
+     * (unlike `__subscriptions` above) because it is a real runtime dependency wired onto
+     * `DriverContext`, not a test-only escape hatch.
+     */
+    subscribedGlobalTables(): string[];
+    /**
+     * M2c fix: register `cb` to fire whenever a subscription is (re-)registered with a non-empty
+     * global-table read set — a fresh `doModifyQuerySet` subscribe/resume, a `handleSetAuth` re-exec,
+     * or a `sendSessionTransition` live-re-run (see the `globalSubscribeListeners` field doc for all
+     * three sites). A driver (e.g. `GlobalReactivityPollerDriver`) uses this to arm itself on any of
+     * these late/renewed subscribes, rather than relying solely on a boot-time force-arm that a busy
+     * (never-hibernating) DO may never repeat. Not unsubscribed — callers are drivers with the same
+     * lifetime as this handler.
+     */
+    onGlobalSubscribe(cb: () => void): void;
+    /** Fire every registered {@link onGlobalSubscribe} listener. Swallows listener throws (never let a
+     *  driver's own bug break subscription registration). */
+    private fireGlobalSubscribe;
+    private send;
+    /**
+     * `MutationResponse.ts` (W1) must be the mutation's real commitTs — a client-side optimistic-
+     * update gate treats it as an ack signal, and a `0` (or absent) commitTs there would either
+     * false-close the gate immediately or wedge a pending layer forever. `commitTs` SHOULD always
+     * be a positive integer for a committed mutation; the one known way it can leak as `<= 0` is
+     * the `?? 0n` fallback for a forwarded-fleet-write whose owner commitTs didn't make it back
+     * (`runtime-embedded/src/runtime.ts`). This codebase has no existing dev/prod split (no
+     * `NODE_ENV`/`__DEV__` convention anywhere in `packages/`), so this is unconditional: log
+     * loudly every time, and never put a lying `0` on the wire — omit `ts` instead, which is
+     * exactly the pre-W1 wire shape every client already knows how to handle.
+     */
+    private mutationResponseTs;
+    handleMessage(sessionId: string, raw: string): Promise<void>;
+    /** Run a subscription's query — privileged for _admin:* on a privileged session; else identity-scoped. */
+    private execSub;
+    /**
+     * G1 hardening (client-sync verdict §(d) item 3): a query-set change is SERIALIZED with the
+     * reactive fan-out on the same `notifyTail`, per handler. The shipped code ran MQS inline while
+     * `notifyWrites` ran on the tail, so a concurrent invalidation could deliver a NEWER value and
+     * then MQS deliver an OLDER one under contiguous brackets — a silent base regression (with
+     * optimistic layers, "your own committed write vanishes"). Enqueuing MQS on the tail makes the two
+     * strictly ordered: the enqueued unit reads `session.version` at EXECUTION time (inside
+     * `doModifyQuerySet`), so its bracket chains contiguously off whatever notify ran just before it.
+     * `execSub`→`runQuery` never re-enters this tail (it's a pure engine read), so there is no
+     * deadlock — subscribe just waits behind any pending notifies (the accepted latency cost).
+     */
+    private handleModifyQuerySet;
+    private doModifyQuerySet;
+    private handleMutation;
+    /**
+     * A drained-outbox chunk (verdict §(e)): ONE inbound message carrying N entries. Applied
+     * SEQUENTIALLY (`await` each in order) — the client sends only one unacked chunk at a time and
+     * relies on per-client FIFO, so units MUST commit in order. One `MutationResponse` is emitted per
+     * entry as it settles, EXCEPT when a unit fails TRANSIENTLY (see `processMutation`'s doc comment):
+     * that unit still gets its failure response, but the loop then STOPS — the remaining entries get
+     * NO response at all, preserving the FIFO drain obligation (a causally-dependent later unit must
+     * never apply after an earlier transient/infra failure). The client's one-unacked-chunk-at-a-time
+     * protocol resends the whole chunk on the next attempt; per-seq receipts make that resend safe
+     * (an already-applied unit replay-acks instead of re-running).
+     */
+    private handleMutationBatch;
+    /**
+     * The per-unit mutation core shared by `Mutation` and `MutationBatch` — threads the durable
+     * `(clientId, seq)` down to the OWNER's classification (verdict §(c)), sends the response, and
+     * (for a fresh commit only) fans out. A `MutationReplay` return skips `notifyWrites` AND the G4
+     * pending-frontier entirely (nothing was written this call — Risk R7): its `commitTs` is the
+     * ORIGINAL, long past the current frontier, so arming a frontier or fanning out would be a lie.
+     *
+     * Returns `"continue" | "stop"` — meaningful only to `handleMutationBatch`'s drain loop (a
+     * standalone `Mutation` ignores it). A thrown error is classified via the executor's retryable
+     * discipline (`isRetryableError`, `@helipod/errors` — the same classification
+     * `handleDedupError`'s dedup path already applies when deciding whether to record a verdict):
+     *  - TERMINAL (not retryable — a deterministic app error, a coded verdict failure/replay) means the
+     *    executor already recorded whatever verdict applies; the batch drain CONTINUES past it (a
+     *    poison unit never blocks the rest — matches the spec's documented mid-batch-continue case).
+     *  - TRANSIENT (retryable — infra/conflict) means nothing durable happened for this unit; the batch
+     *    drain STOPS here so a later, causally-dependent unit can never apply out of order relative to
+     *    it. The remaining units get no response and the client's FIFO resend picks them back up.
+     */
+    private processMutation;
+    /**
+     * The `Connect` resume handshake (verdict §(e)): activated from the reserved no-op. Classifies each
+     * presented `held` seq into `ConnectAck.results`, ack-prunes the `ackedThrough` contiguous
+     * settled-prefix, and stamps the `deploymentId` (same-timeline proof, §(g) hazard 15). `known`
+     * is false when the client presents history the server recognizes NONE of (a swept/foreign timeline
+     * → the client resets). A bare `Connect` (no `clientId`/`held`/`ackedThrough`, or an executor with
+     * no receipts support) stays the pre-Outbox no-op: no ConnectAck is sent, bit-for-bit.
+     */
+    private handleConnect;
+    /**
+     * A one-shot request→value call — NOT reactive (an action has no read/write set of its own).
+     * Deliberately does NOT call `notifyWrites`: any mutation the action invoked via
+     * `ctx.runMutation` already fanned out through that mutation's own commit.
+     */
+    private handleAction;
+    /**
+     * Reactive fan-out: recompute subscriptions a write touched and push transitions. Calls are
+     * serialized so per-session version brackets advance monotonically (concurrent notifies
+     * would otherwise reorder and trigger false client resyncs).
+     */
+    notifyWrites(invalidation: WriteInvalidation, originSessionId?: string): Promise<void>;
+    private doNotifyWrites;
+    /**
+     * DLR 2b — register the response-before-Transition gate for `commitTs`, at COMMIT time. Called
+     * SYNCHRONOUSLY from the runtime's fan-out subscribe callback (which fires inside the commit,
+     * before `runMutation` resolves and thus before this commit's `MutationResponse` can be sent), so
+     * the gate reliably exists before {@link releaseOriginResponseGate} runs — no matter how backed up
+     * the serial fan-out drain is. Public because the decoupled runtime owns the commit-time seam.
+     *
+     * Registers ONLY for a diff-capable LOCAL origin session — exactly the case `doNotifyWrites` parks
+     * on, and exactly the case whose own `processMutation` will release it, so every gate is balanced
+     * (no leak). A no-origin commit, a foreign/absent session, or a diff-incapable session registers
+     * nothing. Idempotent per `commitTs`.
+     */
+    registerOriginResponseGate(commitTs: number, originSessionId: string | undefined): void;
+    /**
+     * DLR 2b — release (and drop) the response gate for `commitTs`. Called right after the commit's
+     * `MutationResponse` is enqueued, so the parked origin Transition flushes strictly behind it. A
+     * no-op when no gate is registered (a diff-incapable / no-origin commit never registered one) — so
+     * an ordinary commit costs nothing here.
+     */
+    private releaseOriginResponseGate;
+    /**
+     * Compute one session's modifications for this commit (by-id / range `QueryDiff` incremental arms,
+     * or the RERUN `QueryUpdated`/`QueryFailed` arm) and send its Transition. Extracted from
+     * `doNotifyWrites`'s per-session loop body (byte-identical logic) so the origin session's own call
+     * can be deferred past the response-ordering macrotask yield while every non-origin session is
+     * computed+sent immediately, with no shared logic duplicated between the two call sites.
+     */
+    private sendSessionTransition;
+    /** Emit a standalone empty ts-advancing Transition — advances `session.version.ts` to `ts` with no
+     *  modifications. The one construct that closes a client's optimistic-update gate for a commit that
+     *  touched nothing the session subscribes to. Callers guard `ts > session.version.ts` (monotone). */
+    private emitEmptyFrontier;
+    /** G4 primary: advance the LOCAL origin session's frontier when its own commit missed all its
+     *  subscriptions. A local commit supersedes any stale forwarded fallback entry for that session. */
+    private advanceOriginFrontier;
+    /** G4 fleet fallback: satisfy pending forwarded-mutation frontiers now that the drain reached
+     *  `drainTs`. A frontier still above `drainTs` waits for a later drain; one already covered by the
+     *  session's own subscription update (in `bySession` this drain, or an earlier ts advance) clears
+     *  without a redundant frame; otherwise an empty ts-advance to the frontier is emitted. */
+    private sweepPendingFrontiers;
+    private handleSetAdminAuth;
+    private handleSetAuth;
+    /** Ephemeral broadcast (presence/typing) — bypasses the engine entirely. */
+    publishEphemeral(topic: string, event: JSONValue, fromSessionId?: string): void;
+}
+
+/**
+ * The client-side reducer: applies `ServerMessage`s to local state. It enforces the
+ * version-bracket contract — a `Transition` is applied only if its `startVersion` matches the
+ * client's current version; otherwise a frame was missed and the client must **resync from
+ * scratch**. This is what makes server-side frame drops (backpressure) safe. The real client
+ * SDK (M10) builds on this.
+ */
+
+interface MutationOutcome {
+    success: boolean;
+    value?: JSONValue;
+    error?: string;
+}
+interface SyncClientState {
+    version: StateVersion;
+    queries: Map<number, JSONValue>;
+    needsResync: boolean;
+    mutationResults: Map<string, MutationOutcome>;
+    broadcasts: Array<{
+        topic: string;
+        event: JSONValue;
+    }>;
+}
+declare function createClientState(): SyncClientState;
+declare function applyServerMessage(state: SyncClientState, msg: ServerMessage): void;
+
+export { type BackpressureOptions, type Change, type ClientMessage, type ClientMutationRef, type ClientMutationVerdict, type HeartbeatOptions, INITIAL_VERSION, type MatchMode, type MutationBatchEntry, type MutationOutcome, type MutationRan, type MutationReplay, type QueryRequest, type ResumeLookup, ResumeRegistry, type RowVersion, type RunMutationResult, type ServerMessage, SessionBackpressureController, SessionHeartbeatController, type StateModification, type StateVersion, type Subscription, SubscriptionManager, type SyncClientState, SyncProtocolHandler, type SyncProtocolHandlerOptions, type SyncUdfExecutor, type SyncWebSocket, TTL_MS, type WriteInvalidation, applyChanges, applyServerMessage, compareStateVersion, createClientState, driftChecksum, encodeServerMessage, isContiguous, parseClientMessage, regKey, versionsEqual };