@powerhousedao/reactor 6.2.2-dev.53 → 6.2.2-dev.54

package/dist/index.js

@@ -1,10 +1,10 @@
-import { A as createEmptyConsistencyToken, B as DocumentDeletedError, C as RevisionMismatchError, D as ModuleNotFoundError, E as InvalidModuleError, F as authDecisionModel, G as matchesScope, H as ExcessiveReshuffleError, I as buildDecisionModel, K as parsePagingOptions, L as AuthEnforcementDisabledError, M as decideAtHead, N as selectDecisionModel, O as GATED_DOCUMENT_ACTIONS, P as documentDecisionModel, R as AuthTimestampNotMonotonicError, S as OptimisticLockError, T as DuplicateModuleError, U as InvalidOperationTimestampError, V as DocumentNotFoundError, W as UpgradePreconditionFailedError, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as AppendConditionFailedError, c as KyselyKeyframeStore, d as DriveCollectionId, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as targetDocumentId, k as createConsistencyToken, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as resolveFeatureFlags, q as throwIfAborted, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache, w as DuplicateManifestError, x as DuplicateOperationError, y as APPEND_CONDITION_FAILED_PREFIX, z as AuthorizationDeniedError } from "./drive-container-types-RZa1wukO.js";
+import { A as GATED_DOCUMENT_ACTIONS, B as AuthTimestampNotMonotonicError, C as DuplicateOperationError, D as DuplicateModuleError, E as DuplicateManifestError, F as selectDecisionModel, G as InvalidOperationTimestampError, H as DocumentDeletedError, I as documentDecisionModel, J as parsePagingOptions, K as UpgradePreconditionFailedError, L as authDecisionModel, M as createEmptyConsistencyToken, N as targetDocumentId, O as InvalidModuleError, P as decideAtHead, R as buildDecisionModel, S as AppendConditionFailedError, T as RevisionMismatchError, U as DocumentNotFoundError, V as AuthorizationDeniedError, W as ExcessiveReshuffleError, Y as throwIfAborted, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as JobExecutorEventTypes, c as KyselyKeyframeStore, d as DriveCollectionId, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as createConsistencyToken, k as ModuleNotFoundError, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as resolveFeatureFlags, q as matchesScope, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache, w as OptimisticLockError, x as APPEND_CONDITION_FAILED_PREFIX, y as DEFAULT_DEFERRED_JOB_TTL_MS, z as AuthEnforcementDisabledError } from "./drive-container-types-bVQ_8YwX.js";
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
 import { a as ReadModelCoordinator, i as KyselyDocumentView, n as ConsistencyTracker, o as BaseReadModel, r as makeConsistencyKey, t as KyselyDocumentIndexer } from "./document-indexer-DlpJB8AK.js";
 import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-sw2vjrd3.js";
-import { DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actions, actions as documentActions, createPresignedHeader, decide, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, sortOperations } from "@powerhousedao/shared/document-model";
+import { t as workerEntryPath } from "./worker-DXJpyHLW.js";
+import { DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actions, actions as documentActions, createPresignedHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, sortOperations, toTransportAction } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -695,6 +695,8 @@ let DocumentChangeType = /* @__PURE__ */ function(DocumentChangeType) {
 * argument covers. Grants gate domain-scope reads only.
 */
 const ALWAYS_READABLE_SCOPES = new Set(["auth", "document"]);
+/** What a gate does with an uninitialized policy when told nothing. */
+const OPEN_BY_DEFAULT = { withholdUninitialized: false };
 /**
 * The branch a group is read on. A group's member list lives on its main
 * branch whatever branch the document naming it is on, and the reference
@@ -816,12 +818,13 @@ var SeededStateReader = class {
 * from state no commit ever invalidates.
 */
 var ModelReadGate = class {
-	constructor(model, documentView, servesGroups, operationIndex, logger) {
+	constructor(model, documentView, servesGroups, operationIndex, logger, options = OPEN_BY_DEFAULT) {
 		this.model = model;
 		this.documentView = documentView;
 		this.servesGroups = servesGroups;
 		this.operationIndex = operationIndex;
 		this.logger = logger;
+		this.options = options;
 	}
 	/**
 	* A served group yields its member list and nothing else. What the audience
@@ -914,15 +917,19 @@ var ModelReadGate = class {
 	/**
 	* What this document's own policy says, with no group serving applied.
 	*
-	* An unpoliced document is readable in full, which is the common case and the
-	* one worth answering without building anything. The test is the one
-	* `evaluate` makes: a legacy `{}` auth scope and version 0 both mean
-	* uninitialized, and "no grants" does not, because a policy with a version and
-	* an empty grant list denies everything.
+	* An unpoliced document is readable in full unless the host closes by default,
+	* and either way it is the common case and the one worth answering without
+	* building anything. The test is the one `evaluate` makes: a legacy `{}` auth
+	* scope and version 0 both mean uninitialized, and "no grants" does not,
+	* because a policy with a version and an empty grant list denies everything.
+	*
+	* Closing here rather than around the gate is what keeps a policy able to
+	* publish an unpoliced group it names: the referencer walk asks this question
+	* of the referencing document, whose real policy answers it.
 	*/
 	async ownPolicyPredicate(document, subject, branch, signal) {
 		const auth = authOf(document);
-		if (!auth || !auth.version) return () => true;
+		if (!auth || !auth.version) return this.options.withholdUninitialized ? (scope) => ALWAYS_READABLE_SCOPES.has(scope) : () => true;
 		const target = {
 			documentId: document.header.id,
 			branch
@@ -1746,12 +1753,12 @@ var JobResultHandler = class {
 				return;
 			} catch {}
 		}
-		if (result.error && DocumentNotFoundError.isError(result.error)) {
+		if (result.error && DocumentNotFoundError.isError(result.error) && handle.job.kind === "load") {
 			handle.defer();
-			callbacks.deferJob(handle.job.documentId, handle.job);
+			callbacks.deferJob(result.error.documentId, handle.job);
 			return;
 		}
-		if (result.error && (DocumentDeletedError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -1817,16 +1824,127 @@ var JobResultHandler = class {
 	}
 };
 //#endregion
-//#region src/executor/types.ts
+//#region src/executor/deferred-jobs.ts
 /**
-* Event types for the job executor
+* The jobs held back because the document they write to was not there yet.
+*
+* A job whose document is missing is deferred rather than failed, because the
+* operations that create that document may still be on their way - out of order
+* from a peer, or a sibling job in the same batch. Deferring emits no event and
+* moves no job status, which is what makes it cheap: a job that gets flushed
+* runs as if it had merely waited its turn.
+*
+* That silence is also why the wait has to be bounded. A deferred job is only
+* released when a job carrying CREATE_DOCUMENT for that exact document id
+* completes, so a job deferred against an id nothing will ever create is
+* released by nothing. Its status stays RUNNING, which is not terminal, so a
+* caller awaiting it waits forever - there is no timeout on that side. The TTL
+* converts that silence into the failure the caller can act on.
+*
+* Failing through the queue rather than only the tracker matters: the queue
+* records the job as resolved, which is what unblocks anything that declared a
+* dependency on it. Deferring alone does not, so a dependent of a deferred job
+* is stranded at PENDING for as long as the deferral lasts.
 */
-const JobExecutorEventTypes = {
-	JOB_STARTED: 2e4,
-	JOB_COMPLETED: 20001,
-	JOB_FAILED: 20002,
-	EXECUTOR_STARTED: 20003,
-	EXECUTOR_STOPPED: 20004
+var DeferredJobs = class {
+	#byDocumentId = /* @__PURE__ */ new Map();
+	#timers = /* @__PURE__ */ new Map();
+	constructor(queue, jobTracker, eventBus, logger, ttlMs = DEFAULT_DEFERRED_JOB_TTL_MS, onReleased = () => Promise.resolve()) {
+		this.queue = queue;
+		this.jobTracker = jobTracker;
+		this.eventBus = eventBus;
+		this.logger = logger;
+		this.ttlMs = ttlMs;
+		this.onReleased = onReleased;
+	}
+	/**
+	* Holds a job until its document arrives, or until the TTL elapses.
+	*
+	* A job deferred again after a flush replaces its own timer rather than
+	* accumulating one, so the wait is measured from the most recent attempt.
+	*/
+	add(documentId, job) {
+		const existing = this.#byDocumentId.get(documentId) ?? [];
+		existing.push(job);
+		this.#byDocumentId.set(documentId, existing);
+		this.#clearTimer(job.id);
+		const timer = setTimeout(() => {
+			this.#expire(documentId, job);
+		}, this.ttlMs);
+		if (typeof timer === "object" && "unref" in timer) timer.unref();
+		this.#timers.set(job.id, timer);
+	}
+	/** Re-enqueues everything waiting on a document that has now arrived. */
+	async flush(documentId) {
+		const jobs = this.#byDocumentId.get(documentId);
+		if (!jobs || jobs.length === 0) return;
+		this.#byDocumentId.delete(documentId);
+		for (const job of jobs) {
+			this.#clearTimer(job.id);
+			try {
+				await this.queue.enqueue(job);
+			} catch (error) {
+				this.logger.error("Error re-enqueuing deferred job: @Error", error);
+			}
+		}
+	}
+	/**
+	* Fails everything still deferred, for a reactor that is shutting down.
+	*
+	* The queue is deliberately not told: it is going away too, and nothing is
+	* left to unblock.
+	*/
+	failAll() {
+		for (const [, jobs] of this.#byDocumentId) for (const job of jobs) {
+			this.#clearTimer(job.id);
+			this.#markFailed(job);
+		}
+		this.#byDocumentId.clear();
+	}
+	/** The jobs still waiting on a document. Exposed for assertions. */
+	waitingOn(documentId) {
+		return this.#byDocumentId.get(documentId) ?? [];
+	}
+	async #expire(documentId, job) {
+		const jobs = this.#byDocumentId.get(documentId);
+		if (!jobs?.includes(job)) return;
+		const remaining = jobs.filter((held) => held !== job);
+		if (remaining.length === 0) this.#byDocumentId.delete(documentId);
+		else this.#byDocumentId.set(documentId, remaining);
+		this.#timers.delete(job.id);
+		this.logger.error("Deferred job @jobId gave up waiting for document @documentId after @ttlMs ms", job.id, documentId, this.ttlMs);
+		const errorInfo = this.#markFailed(job);
+		try {
+			await this.queue.failJob(job.id, errorInfo);
+		} catch (error) {
+			this.logger.error("Error failing an expired deferred job: @Error", error);
+			return;
+		}
+		this.jobTracker.markFailed(job.id, errorInfo, job);
+		try {
+			await this.onReleased();
+		} catch (error) {
+			this.logger.error("Error dispatching after a deferred job expired: @Error", error);
+		}
+	}
+	#markFailed(job) {
+		const error = new DocumentNotFoundError(job.documentId);
+		const errorInfo = toErrorInfo(error);
+		this.jobTracker.markFailed(job.id, errorInfo, job);
+		this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
+			jobId: job.id,
+			error,
+			job
+		}).catch(() => {});
+		return errorInfo;
+	}
+	#clearTimer(jobId) {
+		const timer = this.#timers.get(jobId);
+		if (timer !== void 0) {
+			clearTimeout(timer);
+			this.#timers.delete(jobId);
+		}
+	}
 };
 //#endregion
 //#region src/executor/worker-pool-router.ts
@@ -1898,10 +2016,10 @@ var WorkerPoolJobExecutorManager = class {
 	activeJobs = 0;
 	totalJobsProcessed = 0;
 	unsubscribe;
-	deferredJobs = /* @__PURE__ */ new Map();
+	deferredJobs;
 	resultHandler;
 	jobTimeoutMs;
-	constructor(workerFactory, eventBus, queue, jobTracker, logger, resolver, collectionMembershipCache, jobTimeoutMs = 3e4) {
+	constructor(workerFactory, eventBus, queue, jobTracker, logger, resolver, collectionMembershipCache, jobTimeoutMs = 3e4, deferredJobTtlMs = DEFAULT_DEFERRED_JOB_TTL_MS) {
 		this.workerFactory = workerFactory;
 		this.eventBus = eventBus;
 		this.queue = queue;
@@ -1910,6 +2028,7 @@ var WorkerPoolJobExecutorManager = class {
 		this.resolver = resolver;
 		this.collectionMembershipCache = collectionMembershipCache;
 		this.jobTimeoutMs = jobTimeoutMs;
+		this.deferredJobs = new DeferredJobs(queue, jobTracker, eventBus, logger, deferredJobTtlMs, () => this.tryDispatchAll());
 		this.resultHandler = new JobResultHandler(queue, jobTracker, eventBus, resolver, logger);
 	}
 	async start(numWorkers) {
@@ -1930,16 +2049,7 @@ var WorkerPoolJobExecutorManager = class {
 			this.unsubscribe = void 0;
 		}
 		if (graceful) while (this.activeJobs > 0) await new Promise((resolve) => setTimeout(resolve, 10));
-		for (const [, jobs] of this.deferredJobs) for (const job of jobs) {
-			const errorInfo = toErrorInfo(new DocumentNotFoundError(job.documentId));
-			this.jobTracker.markFailed(job.id, errorInfo, job);
-			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
-				jobId: job.id,
-				error: new DocumentNotFoundError(job.documentId),
-				job
-			}).catch(() => {});
-		}
-		this.deferredJobs.clear();
+		this.deferredJobs.failAll();
 		await Promise.all(this.workers.map((w) => w.shutdown(graceful).catch((err) => {
 			this.logger.warn("worker shutdown failed: @Error", err);
 		})));
@@ -2061,12 +2171,8 @@ var WorkerPoolJobExecutorManager = class {
 			this.logger.error("emitWriteReady failed for job @jobId: @Error", { jobId: handle.job.id }, error);
 		});
 		await this.resultHandler.handleResult(handle, outcome.result, {
-			deferJob: (documentId, job) => {
-				const existing = this.deferredJobs.get(documentId) ?? [];
-				existing.push(job);
-				this.deferredJobs.set(documentId, existing);
-			},
-			flushDeferredFor: (documentId) => this.flushDeferredJobs(documentId)
+			deferJob: (documentId, job) => this.deferredJobs.add(documentId, job),
+			flushDeferredFor: (documentId) => this.deferredJobs.flush(documentId)
 		});
 		this.activeJobs--;
 		await this.tryDispatchFor(worker);
@@ -2148,16 +2254,6 @@ var WorkerPoolJobExecutorManager = class {
 		this.workers[deadIndex] = fresh;
 		await this.tryDispatchFor(fresh);
 	}
-	async flushDeferredJobs(documentId) {
-		const jobs = this.deferredJobs.get(documentId);
-		if (!jobs || jobs.length === 0) return;
-		this.deferredJobs.delete(documentId);
-		for (const job of jobs) try {
-			await this.queue.enqueue(job);
-		} catch (error) {
-			this.logger.error("Error re-enqueuing deferred job: @Error", error);
-		}
-	}
 };
 function isWorkerTransportError(error) {
 	return error instanceof WorkerExitedError || error instanceof WorkerInitFailedError || error instanceof WorkerAbortTimeoutError;
@@ -2186,10 +2282,10 @@ var SimpleJobExecutorManager = class {
 	activeJobs = 0;
 	totalJobsProcessed = 0;
 	unsubscribe;
-	deferredJobs = /* @__PURE__ */ new Map();
+	deferredJobs;
 	resultHandler;
 	jobTimeoutMs;
-	constructor(executorFactory, eventBus, queue, jobTracker, logger, resolver, jobTimeoutMs = 3e4) {
+	constructor(executorFactory, eventBus, queue, jobTracker, logger, resolver, jobTimeoutMs = 3e4, deferredJobTtlMs = DEFAULT_DEFERRED_JOB_TTL_MS) {
 		this.executorFactory = executorFactory;
 		this.eventBus = eventBus;
 		this.queue = queue;
@@ -2197,6 +2293,7 @@ var SimpleJobExecutorManager = class {
 		this.logger = logger;
 		this.resolver = resolver;
 		this.jobTimeoutMs = jobTimeoutMs;
+		this.deferredJobs = new DeferredJobs(queue, jobTracker, eventBus, logger, deferredJobTtlMs, () => this.checkForMoreJobs());
 		this.resultHandler = new JobResultHandler(queue, jobTracker, eventBus, resolver, logger);
 	}
 	async start(numExecutors) {
@@ -2217,16 +2314,7 @@ var SimpleJobExecutorManager = class {
 			this.unsubscribe = void 0;
 		}
 		if (graceful) while (this.activeJobs > 0) await new Promise((resolve) => setTimeout(resolve, 100));
-		for (const [, jobs] of this.deferredJobs) for (const job of jobs) {
-			const errorInfo = toErrorInfo(new DocumentNotFoundError(job.documentId));
-			this.jobTracker.markFailed(job.id, errorInfo, job);
-			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
-				jobId: job.id,
-				error: new DocumentNotFoundError(job.documentId),
-				job
-			}).catch(() => {});
-		}
-		this.deferredJobs.clear();
+		this.deferredJobs.failAll();
 		this.executors = [];
 		this.isRunning = false;
 	}
@@ -2319,12 +2407,8 @@ var SimpleJobExecutorManager = class {
 			this.eventBus.emit(JobExecutorEventTypes.JOB_FAILED, failedEvent).catch(() => {});
 		}
 		await this.resultHandler.handleResult(handle, result, {
-			deferJob: (documentId, job) => {
-				const existing = this.deferredJobs.get(documentId) ?? [];
-				existing.push(job);
-				this.deferredJobs.set(documentId, existing);
-			},
-			flushDeferredFor: (documentId) => this.flushDeferredJobs(documentId)
+			deferJob: (documentId, job) => this.deferredJobs.add(documentId, job),
+			flushDeferredFor: (documentId) => this.deferredJobs.flush(documentId)
 		});
 		this.activeJobs--;
 		await this.checkForMoreJobs();
@@ -2358,16 +2442,6 @@ var SimpleJobExecutorManager = class {
 			}
 		}
 	}
-	async flushDeferredJobs(documentId) {
-		const jobs = this.deferredJobs.get(documentId);
-		if (!jobs || jobs.length === 0) return;
-		this.deferredJobs.delete(documentId);
-		for (const job of jobs) try {
-			await this.queue.enqueue(job);
-		} catch (error) {
-			this.logger.error("Error re-enqueuing deferred job: @Error", error);
-		}
-	}
 };
 //#endregion
 //#region src/job-tracker/in-memory-job-tracker.ts
@@ -4057,13 +4131,42 @@ var BufferedMailbox = class {
 var GraphQLRequestError = class extends Error {
 	statusCode;
 	category;
-	constructor(message, category, statusCode) {
+	/**
+	* One entry per error the response carried, in order, holding its
+	* `extensions.code` - undefined where it declared none. Kept per error rather
+	* than as a set, because a response that mixes a classified error with an
+	* unclassified one must not be read as if only the classified one arrived.
+	*/
+	codes;
+	constructor(message, category, statusCode, codes = []) {
 		super(message);
 		this.name = "GraphQLRequestError";
 		this.category = category;
 		this.statusCode = statusCode;
+		this.codes = codes;
 	}
 };
+/**
+* Extension codes a remote uses to say a failure is worth polling through.
+*
+* Shared with reactor-api so the server throws what this check reads and the two
+* cannot drift. A `graphql` category error is otherwise permanent: it stops the
+* poll timer, and nothing restarts it, so a code that lands here is the
+* difference between a channel that recovers and one that is dead for the
+* process lifetime.
+*/
+const RECOVERABLE_GRAPHQL_ERROR_CODES = { malformedStoredOperation: "MALFORMED_STORED_OPERATION" };
+const RECOVERABLE_CODES = new Set(Object.values(RECOVERABLE_GRAPHQL_ERROR_CODES));
+/**
+* True when every error the response carried named a recoverable code.
+*
+* Unanimity is the requirement: one unclassified error alongside a recoverable
+* one means something else also went wrong, and polling through that would be
+* guessing.
+*/
+function isRecoverableGraphQLError(error) {
+	return error.codes.length > 0 && error.codes.every((code) => code !== void 0 && RECOVERABLE_CODES.has(code));
+}
 /** Auth-rejection message fragments the switchboard emits. Shared with
 * reactor-api so server throws and this client check can't drift. */
 const DRIVE_AUTH_ERROR_MESSAGES = {
@@ -4609,36 +4712,15 @@ var IntervalPollTimer = class {
 //#region src/sync/channels/utils.ts
 let syncOpCounter = 0;
 /**
-* Serializes an action for GraphQL transport, converting signature tuples to strings.
+* Serializes an action for GraphQL transport.
 *
-* Only the fields declared by the GraphQL `ActionInput` type are forwarded. This
-* guards against stale runtime-only fields (e.g. a legacy `attachments` array on
-* operations persisted before the attachment-system removal) leaking into the
-* mutation variables, where the tightened schema would reject them.
+* Projects onto exactly the fields `ActionInput` declares, which is what keeps a
+* stale runtime-only field - a legacy `attachments` array, say - from riding
+* along into the mutation variables, where the schema would reject the whole
+* request rather than the field.
 */
 function serializeAction(action) {
-	const base = {
-		id: action.id,
-		type: action.type,
-		timestampUtcMs: action.timestampUtcMs,
-		input: action.input,
-		scope: action.scope
-	};
-	const signer = action.context?.signer;
-	if (!signer?.signatures) return action.context ? {
-		...base,
-		context: action.context
-	} : base;
-	return {
-		...base,
-		context: {
-			...action.context,
-			signer: {
-				...signer,
-				signatures: signer.signatures.map((sig) => Array.isArray(sig) ? sig.join(", ") : sig)
-			}
-		}
-	};
+	return toTransportAction(action);
 }
 /**
 * Serializes a SyncEnvelope for GraphQL transport.
@@ -4676,16 +4758,6 @@ function serializeEnvelope(envelope) {
 	};
 }
 /**
-* Deserializes a signature from a comma-separated string back to a tuple.
-*
-* GraphQL serializes Signature tuples as comma-separated strings for transport.
-* This function converts them back to the expected [string, string, string, string, string] format.
-*/
-function deserializeSignature(sig) {
-	if (Array.isArray(sig)) return sig;
-	return sig.split(", ");
-}
-/**
 * `isDenied` tests strictly against undefined, so a null left in place would mark
 * every synced operation denied. The key is removed rather than set to undefined,
 * so an operation that arrived without it stays identical to the one sent.
@@ -5279,7 +5351,7 @@ var GqlRequestChannel = class {
 				if (error.statusCode !== void 0 && error.statusCode >= 500) return "recoverable";
 				return "unrecoverable";
 			case "parse": return "recoverable";
-			case "graphql": return "unrecoverable";
+			case "graphql": return isRecoverableGraphQLError(error) ? "recoverable" : "unrecoverable";
 			case "missing-data": return "unrecoverable";
 		}
 	}
@@ -5364,7 +5436,7 @@ var GqlRequestChannel = class {
 			throw new GraphQLRequestError(`Failed to parse GraphQL response: ${error instanceof Error ? error.message : String(error)}`, "parse");
 		}
 		this.logger.verbose("GQL response @channelId @operation status=@status data=@data errors=@errors", this.channelId, operationName, response.status, JSON.stringify(result.data), result.errors ? JSON.stringify(result.errors) : "none");
-		if (result.errors) throw new GraphQLRequestError(`GraphQL errors: ${JSON.stringify(result.errors, null, 2)}`, "graphql");
+		if (result.errors) throw new GraphQLRequestError(`GraphQL errors: ${JSON.stringify(result.errors, null, 2)}`, "graphql", void 0, result.errors.map((error) => error.extensions?.code));
 		if (!result.data) throw new GraphQLRequestError("GraphQL response missing data field", "missing-data");
 		return result.data;
 	}
@@ -5456,6 +5528,10 @@ var GqlRequestChannelFactory = class {
 };
 //#endregion
 //#region src/sync/channels/gql-res-channel.ts
+/** Where a sync operation's run of ordinals begins. */
+function firstOrdinalOf$1(syncOp) {
+	return syncOp.operations.length > 0 ? syncOp.operations[0].context.ordinal : 0;
+}
 /**
 * This class is used server-side to accumulate inbox + outbox operations.
 *
@@ -5471,6 +5547,8 @@ var GqlResponseChannel = class {
 	isShutdown;
 	lastPersistedInboxOrdinal = 0;
 	lastPersistedOutboxOrdinal = 0;
+	evictedOutboxFloor = Number.POSITIVE_INFINITY;
+	appliedOutboxOrdinal = 0;
 	connectionState = "connecting";
 	connectionStateCallbacks = /* @__PURE__ */ new Set();
 	constructor(logger, channelId, remoteName, cursorStorage) {
@@ -5483,18 +5561,11 @@ var GqlResponseChannel = class {
 		this.outbox = new Mailbox();
 		this.deadLetter = new Mailbox();
 		this.outbox.onRemoved((syncOps) => {
-			const maxOrdinal = getLatestAppliedOrdinal(syncOps);
-			if (maxOrdinal > this.lastPersistedOutboxOrdinal) {
-				this.lastPersistedOutboxOrdinal = maxOrdinal;
-				this.cursorStorage.upsert({
-					remoteName: this.remoteName,
-					cursorType: "outbox",
-					cursorOrdinal: maxOrdinal,
-					lastSyncedAtUtcMs: Date.now()
-				}).catch((error) => {
-					this.logger.error("Failed to update outbox cursor for @ChannelId! This means that future application runs may resend duplicate operations. This is recoverable (with deduplication protection), but not-optimal: @Error", this.channelId, error);
-				});
-			}
+			this.rememberUnserved(syncOps);
+			this.persistOutboxCursor(getLatestAppliedOrdinal(syncOps));
+		});
+		this.outbox.onAdded((syncOps) => {
+			this.forgetEvictedBelow(syncOps);
 		});
 		this.inbox.onRemoved((syncOps) => {
 			const maxOrdinal = getLatestAppliedOrdinal(syncOps);
@@ -5536,6 +5607,17 @@ var GqlResponseChannel = class {
 	}
 	/** Response channels are push-driven; resolvers populate mailboxes directly. */
 	triggerPull() {}
+	async init() {
+		const cursors = await this.cursorStorage.list(this.remoteName);
+		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
+		const outboxOrdinal = cursors.find((c) => c.cursorType === "outbox")?.cursorOrdinal ?? 0;
+		this.inbox.init(inboxOrdinal);
+		this.outbox.init(outboxOrdinal);
+		this.lastPersistedInboxOrdinal = inboxOrdinal;
+		this.lastPersistedOutboxOrdinal = outboxOrdinal;
+		this.appliedOutboxOrdinal = outboxOrdinal;
+		this.transitionConnectionState("connected");
+	}
 	transitionConnectionState(next) {
 		if (this.connectionState === next) return;
 		this.connectionState = next;
@@ -5546,15 +5628,68 @@ var GqlResponseChannel = class {
 			this.logger.error("Connection state change callback error: @Error", error);
 		}
 	}
-	async init() {
-		const cursors = await this.cursorStorage.list(this.remoteName);
-		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
-		const outboxOrdinal = cursors.find((c) => c.cursorType === "outbox")?.cursorOrdinal ?? 0;
-		this.inbox.init(inboxOrdinal);
-		this.outbox.init(outboxOrdinal);
-		this.lastPersistedInboxOrdinal = inboxOrdinal;
-		this.lastPersistedOutboxOrdinal = outboxOrdinal;
-		this.transitionConnectionState("connected");
+	/**
+	* Records the ordinals of entries that left the outbox without being served,
+	* so the cursor cannot advance past them.
+	*
+	* An entry can leave unserved because a bound evicted it, and an evicted entry
+	* is exactly one this channel intends to re-derive: it is still owed to the
+	* remote. Remembering the floor across the whole run rather than only while
+	* the entry is present is what makes that true after a later ack would
+	* otherwise have swept the cursor past it.
+	*/
+	rememberUnserved(syncOps) {
+		for (const syncOp of syncOps) {
+			if (syncOp.status === SyncOperationStatus.Applied) continue;
+			const first = firstOrdinalOf$1(syncOp);
+			if (first > 0 && first < this.evictedOutboxFloor) this.evictedOutboxFloor = first;
+		}
+	}
+	/**
+	* Persists the outbox cursor, never past an operation this remote has not
+	* been served.
+	*
+	* The cursor is where a restart resumes deriving the outbox from, so an
+	* ordinal persisted past an unserved entry loses that entry for good: the
+	* rebuild starts beyond it and nothing else remembers it was owed. Acks
+	* arrive out of order with respect to what is withheld -- a later entry can
+	* be acknowledged while an earlier one is still being withheld from this
+	* subject -- so the applied high-water mark alone is not a safe cursor.
+	*/
+	persistOutboxCursor(appliedOrdinal) {
+		this.appliedOutboxOrdinal = Math.max(this.appliedOutboxOrdinal, appliedOrdinal);
+		const ordinal = Math.min(this.appliedOutboxOrdinal, this.unservedFloor() - 1);
+		if (ordinal <= this.lastPersistedOutboxOrdinal) return;
+		this.lastPersistedOutboxOrdinal = ordinal;
+		this.cursorStorage.upsert({
+			remoteName: this.remoteName,
+			cursorType: "outbox",
+			cursorOrdinal: ordinal,
+			lastSyncedAtUtcMs: Date.now()
+		}).catch((error) => {
+			this.logger.error("Failed to update outbox cursor for @ChannelId! This means that future application runs may resend duplicate operations. This is recoverable (with deduplication protection), but not-optimal: @Error", this.channelId, error);
+		});
+	}
+	/** Drops the evicted floor once the entries it stood for are queued again. */
+	forgetEvictedBelow(syncOps) {
+		if (this.evictedOutboxFloor === Number.POSITIVE_INFINITY) return;
+		for (const syncOp of syncOps) {
+			const first = firstOrdinalOf$1(syncOp);
+			if (first > 0 && first <= this.evictedOutboxFloor) {
+				this.evictedOutboxFloor = Number.POSITIVE_INFINITY;
+				return;
+			}
+		}
+	}
+	/** The lowest ordinal still owed to this remote, evicted or still queued. */
+	unservedFloor() {
+		let floor = this.evictedOutboxFloor;
+		for (const syncOp of this.outbox.items) {
+			if (syncOp.status === SyncOperationStatus.Applied) continue;
+			const first = firstOrdinalOf$1(syncOp);
+			if (first > 0 && first < floor) floor = first;
+		}
+		return floor;
 	}
 };
 //#endregion
@@ -5738,7 +5873,10 @@ function rowToRemoteRecord(row) {
 			scope: row.filter_scopes ?? [],
 			branch: row.filter_branch
 		},
-		options: { sinceTimestampUtcMs: "0" },
+		options: {
+			sinceTimestampUtcMs: "0",
+			boundAddress: row.bound_address ?? void 0
+		},
 		status: {
 			push: {
 				state: row.push_state,
@@ -5778,7 +5916,8 @@ function remoteRecordToRow(remote) {
 		pull_state: remote.status.pull.state,
 		pull_last_success_utc_ms: remote.status.pull.lastSuccessUtcMs ? new Date(remote.status.pull.lastSuccessUtcMs).toISOString() : null,
 		pull_last_failure_utc_ms: remote.status.pull.lastFailureUtcMs ? new Date(remote.status.pull.lastFailureUtcMs).toISOString() : null,
-		pull_failure_count: remote.status.pull.failureCount
+		pull_failure_count: remote.status.pull.failureCount,
+		bound_address: remote.options.boundAddress ?? null
 	};
 }
 var KyselySyncRemoteStorage = class {
@@ -6146,9 +6285,14 @@ var OutboxMode = /* @__PURE__ */ function(OutboxMode) {
 }(OutboxMode || {});
 const defaultSyncManagerConfig = {
 	maxDeadLettersPerRemote: 100,
-	maxInboxBatchSize: 32
+	maxInboxBatchSize: 32,
+	maxHeldOperationsPerRemote: 1e4
 };
 const PLAN_KEY_TO_JOB_UUID_CAP = 1e4;
+/** Where a sync operation's run of ordinals begins. */
+function firstOrdinalOf(syncOp) {
+	return syncOp.operations.length > 0 ? syncOp.operations[0].context.ordinal : 0;
+}
 var SyncManager = class {
 	logger;
 	remoteStorage;
@@ -6172,6 +6316,7 @@ var SyncManager = class {
 	quarantinedDocumentIds = /* @__PURE__ */ new Set();
 	backfillAbortControllers = /* @__PURE__ */ new Map();
 	planKeyToJobUuid = /* @__PURE__ */ new Map();
+	evictedOutboxFloors = /* @__PURE__ */ new Map();
 	lastEnqueuedJobIdByKey = /* @__PURE__ */ new Map();
 	inboxChunkChain = Promise.resolve();
 	constructor(logger, remoteStorage, cursorStorage, deadLetterStorage, channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, config = {}) {
@@ -6279,6 +6424,28 @@ var SyncManager = class {
 		for (const remote of this.remotes.values()) if (remote.meta.id === id) return remote;
 		throw new Error(`Remote with id '${id}' does not exist`);
 	}
+	async bindRemote(id, boundAddress) {
+		const remote = this.getById(id);
+		const bound = remote.meta.options.boundAddress;
+		if (bound === boundAddress) return;
+		if (bound !== void 0) throw new Error(`Remote with id '${id}' is already bound to another address`);
+		remote.meta.options = {
+			...remote.meta.options,
+			boundAddress
+		};
+		await this.remoteStorage.upsert({
+			id: remote.meta.id,
+			name: remote.meta.name,
+			collectionId: remote.meta.collectionId,
+			channelConfig: remote.meta.channelConfig,
+			filter: remote.meta.filter,
+			options: remote.meta.options,
+			status: {
+				push: createIdleHealth(),
+				pull: createIdleHealth()
+			}
+		});
+	}
 	async add(name, collectionId, channelConfig, filter = {
 		documentId: [],
 		scope: [],
@@ -6621,9 +6788,59 @@ var SyncManager = class {
 		const message = error?.message || "Unknown error";
 		return new ChannelError(ChannelErrorSource.Inbox, /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
 	}
+	/**
+	* Where the next outbox derivation starts: at the evicted floor when there is
+	* room to take those entries back, and at the caller's cursor otherwise.
+	*
+	* The floor is forgotten as it is folded in. If the refill overflows again the
+	* eviction records a new one, and if it does not, the entries are queued and
+	* the outbox itself holds the cursor down.
+	*/
+	refillOrdinal(remote, ackOrdinal) {
+		const floor = this.evictedOutboxFloors.get(remote.meta.name);
+		if (floor === void 0) return ackOrdinal;
+		if (this.outboxOperationCount(remote) >= this.config.maxHeldOperationsPerRemote) return ackOrdinal;
+		this.evictedOutboxFloors.delete(remote.meta.name);
+		return Math.min(ackOrdinal, floor - 1);
+	}
+	/**
+	* Evicts the newest entries of an outbox that has grown past its bound.
+	*
+	* Only entries that have never been taken up for transport are eligible, which
+	* is what makes this a bound on withheld work rather than a way to drop
+	* something already in flight. One entry is always kept, so an outbox whose
+	* first entry is larger than the whole cap still makes progress.
+	*/
+	evictPastOutboxBound(remote) {
+		const cap = this.config.maxHeldOperationsPerRemote;
+		const queued = remote.channel.outbox.items.filter((syncOp) => syncOp.status === SyncOperationStatus.Unknown).sort((a, b) => firstOrdinalOf(a) - firstOrdinalOf(b));
+		let kept = 0;
+		let cut = queued.length;
+		for (let i = 0; i < queued.length; i++) {
+			const size = queued[i].operations.length;
+			if (i > 0 && kept + size > cap) {
+				cut = i;
+				break;
+			}
+			kept += size;
+		}
+		const evicted = queued.slice(cut);
+		if (evicted.length === 0) return;
+		const floor = firstOrdinalOf(evicted[0]);
+		const known = this.evictedOutboxFloors.get(remote.meta.name);
+		this.evictedOutboxFloors.set(remote.meta.name, known === void 0 ? floor : Math.min(known, floor));
+		this.logger.warn("Outbox for @RemoteName is past its bound of @Cap operations; evicting @Count entries from ordinal @Floor, to be derived again once it drains", remote.meta.name, cap, evicted.length, floor);
+		remote.channel.outbox.remove(...evicted);
+	}
+	outboxOperationCount(remote) {
+		let count = 0;
+		for (const syncOp of remote.channel.outbox.items) count += syncOp.operations.length;
+		return count;
+	}
 	async updateOutbox(remote, ackOrdinal, mode = OutboxMode.Backfill, signal) {
 		const composedSignal = signal ? AbortSignal.any([signal, this.abortController.signal]) : this.abortController.signal;
-		let maxOrdinal = ackOrdinal;
+		const startOrdinal = this.refillOrdinal(remote, ackOrdinal);
+		let maxOrdinal = startOrdinal;
 		const lastJobByDoc = /* @__PURE__ */ new Map();
 		let prevChainJobId;
 		const sinceTimestamp = remote.meta.options.sinceTimestampUtcMs;
@@ -6643,8 +6860,9 @@ var SyncManager = class {
 				if (mode === OutboxMode.BatchTriggered) prevChainJobId = jobId;
 			}
 			remote.channel.outbox.add(...syncOps);
+			this.evictPastOutboxBound(remote);
 		};
-		let page = await this.operationIndex.find(remote.meta.collectionId.key, ackOrdinal, { excludeSourceRemote: remote.meta.name }, void 0, composedSignal);
+		let page = await this.operationIndex.find(remote.meta.collectionId.key, startOrdinal, { excludeSourceRemote: remote.meta.name }, void 0, composedSignal);
 		let carry = [];
 		let hasMore;
 		do {
@@ -6709,6 +6927,10 @@ var SyncBuilder = class {
 		this.config.maxInboxBatchSize = limit;
 		return this;
 	}
+	withMaxHeldOperationsPerRemote(limit) {
+		this.config.maxHeldOperationsPerRemote = limit;
+		return this;
+	}
 	build(reactor, logger, operationIndex, eventBus, db, driveContainerTypes) {
 		return this.buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes).syncManager;
 	}
@@ -7571,11 +7793,11 @@ var ReactorBuilder = class {
 				if (pool.db === void 0) throw new Error("unreachable: worker pool configured without db or factory");
 				factory = await this.createDefaultWorkerFactory(pool.numWorkers, pool.db, pool.verifier);
 			}
-			const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, collectionMembershipCache, this.executorConfig.jobTimeoutMs);
+			const poolManager = new WorkerPoolJobExecutorManager(factory, eventBus, queue, jobTracker, this.logger, resolver, collectionMembershipCache, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
 			executorManager = poolManager;
 			executorStartCount = pool.numWorkers;
 			if (resolver instanceof DocumentModelResolver) resolver.setBroadcastHook((entry) => poolManager.loadModel(entry));
-		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, this.signatureVerifier, executionScope), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs);
+		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, this.signatureVerifier, executionScope), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
 		await executorManager.start(executorStartCount);
 		const readModelInstances = Array.from(new Set([...this.readModels]));
 		const documentViewConsistencyTracker = new ConsistencyTracker();
@@ -7725,7 +7947,7 @@ var ReactorBuilder = class {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
 			import("./worker-handle-CrERzl8s.js"),
 			import("./transport-ByGviWdZ.js"),
-			import("./worker-sw2vjrd3.js").then((n) => n.n)
+			import("./worker-DXJpyHLW.js").then((n) => n.n)
 		]);
 		const poolConfig = {
 			enabled: true,
@@ -8030,6 +8252,48 @@ function driveIdFromUrl(url) {
 	return url.split("/").pop() ?? "";
 }
 //#endregion
+//#region src/decision/sync-scope-gate.ts
+/** What a subject may read of a document that is not there to be read. */
+const META_ONLY = (scope) => ALWAYS_READABLE_SCOPES.has(scope);
+/**
+* A read gate asked by document id rather than by document.
+*
+* Serving works from an id: an outbox entry names a document, a branch and a
+* scope, and carries no state. Fetching the document is therefore the serving
+* path's own job, and it is the only thing this adds to the gate it wraps.
+*/
+var SyncScopeGate = class {
+	constructor(gate, documentView, logger) {
+		this.gate = gate;
+		this.documentView = documentView;
+		this.logger = logger;
+	}
+	/**
+	* Which scopes of one document the subject may be served.
+	*
+	* A document this replica cannot produce yields the metadata scopes and
+	* nothing else. That is the fail-closed direction, and it is safe to fail
+	* closed here precisely because serving withholds rather than consumes: the
+	* entry stays in the outbox and the next poll asks again, so a document that
+	* is merely not indexed yet is delayed rather than lost.
+	*
+	* Any other failure is rethrown. A read side that is down must not read as a
+	* silent, universal denial, because a denial that looks like a policy is one
+	* nobody investigates.
+	*/
+	async scopePredicateById(documentId, subject, branch, signal) {
+		let document;
+		try {
+			document = await this.documentView.get(documentId, { branch }, void 0, signal);
+		} catch (error) {
+			if (!DocumentNotFoundError.isError(error)) throw error;
+			this.logger?.verbose(`Withholding ${documentId} on branch ${branch}: the read side does not hold it`);
+			return META_ONLY;
+		}
+		return this.gate.scopePredicate(document, subject, branch, signal);
+	}
+};
+//#endregion
 //#region src/decision/stream-order.ts
 /**
 * The first pair of effective operations whose stored order contradicts their
@@ -8193,6 +8457,6 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentChangeType, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createMutableShutdownStatus, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 
 //# sourceMappingURL=index.js.map