@powerhousedao/reactor 6.2.3-dev.0 → 6.2.3-dev.10

package/dist/index.js

@@ -1,9 +1,9 @@
-import { A as selectDecisionModel, B as RevisionMismatchError, C as InvalidModuleError, D as createEmptyConsistencyToken, E as createConsistencyToken, F as AppendConditionFailedError, G as DocumentNotFoundError, H as AuthTimestampNotMonotonicError, I as DocumentAlreadyExistsError, J as UpgradePreconditionFailedError, K as ExcessiveReshuffleError, L as DocumentExistence, M as authDecisionModel, N as buildDecisionModel, O as targetDocumentId, P as APPEND_CONDITION_FAILED_PREFIX, R as DuplicateOperationError, S as DuplicateModuleError, T as GATED_DOCUMENT_ACTIONS, U as AuthorizationDeniedError, V as AuthEnforcementDisabledError, W as DocumentDeletedError, X as parsePagingOptions, Y as matchesScope, Z as throwIfAborted, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as JobExecutorEventTypes, c as KyselyKeyframeStore, d as DriveCollectionId, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as documentDecisionModel, k as decideAtHead, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as resolveFeatureFlags, q as InvalidOperationTimestampError, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache, w as ModuleNotFoundError, x as DuplicateManifestError, y as DEFAULT_DEFERRED_JOB_TTL_MS, z as OptimisticLockError } from "./drive-container-types-yZrksiJR.js";
+import { $ as parsePagingOptions, A as targetDocumentId, B as DuplicateOperationError, C as InvalidModuleError, D as createEmptyConsistencyToken, E as createConsistencyToken, F as buildDecisionModel, G as AuthorizationDeniedError, H as RevisionMismatchError, I as APPEND_CONDITION_FAILED_PREFIX, J as ExcessiveReshuffleError, K as DocumentDeletedError, L as AppendConditionFailedError, M as selectDecisionModel, N as documentDecisionModel, O as submittedActionIds, P as authDecisionModel, Q as matchesScope, R as DocumentAlreadyExistsError, S as DuplicateModuleError, T as GATED_DOCUMENT_ACTIONS, U as AuthEnforcementDisabledError, V as OptimisticLockError, W as AuthTimestampNotMonotonicError, X as RelationshipNotFoundError, Y as InvalidOperationTimestampError, Z as UpgradePreconditionFailedError, _ as DocumentMetaCache, a as createForwardingPoolInstrumentation, b as JobExecutorEventTypes, c as KyselyKeyframeStore, d as DriveCollectionId, et as throwIfAborted, f as KyselyExecutionScope, g as KyselyOperationIndex, h as KyselyWriteCache, i as runMigrations, j as decideAtHead, k as summarizeSubmittedActions, l as DocumentModelRegistry, m as EventBus, n as REACTOR_SCHEMA, o as instrumentPgPool, p as resolveFeatureFlags, q as DocumentNotFoundError, r as getMigrationStatus, s as KyselyOperationStore, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as SimpleJobExecutor, v as CollectionMembershipCache, w as ModuleNotFoundError, x as DuplicateManifestError, y as DEFAULT_DEFERRED_JOB_TTL_MS, z as DocumentExistence } from "./drive-container-types-CE7dxz0_.js";
 import { n as ReactorEventTypes, t as EventBusAggregateError } from "./types-DMKLa0Ok.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-D3S6Eysd.js";
-import { a as DOCUMENT_INDEXER_READ_MODEL, c as BaseReadModel, i as KyselyDocumentView, n as ConsistencyTracker, o as DOCUMENT_VIEW_READ_MODEL, r as makeConsistencyKey, s as ReadModelCoordinator, t as KyselyDocumentIndexer } from "./document-indexer-C5Gsa1B3.js";
+import { a as DOCUMENT_INDEXER_READ_MODEL, c as BaseReadModel, i as KyselyDocumentView, n as ConsistencyTracker, o as DOCUMENT_VIEW_READ_MODEL, r as makeConsistencyKey, s as ReadModelCoordinator, t as KyselyDocumentIndexer } from "./document-indexer-BRqfWhe1.js";
 import { n as errorToInfo, r as sanitizeArg, t as createForwardingLogger } from "./forwarding-logger-BBkMSxuJ.js";
-import { t as workerEntryPath } from "./worker-HPysBfhx.js";
+import { t as workerEntryPath } from "./worker-B12tBZmr.js";
 import { DowngradeNotSupportedError, MAX_AUTH_GRANTS, UnsupportedDocumentModelVersionError, actions, actions as documentActions, createPresignedHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, normalizeDocumentModelVersion, sortOperations, toTransportAction } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
@@ -1248,6 +1248,79 @@ var ReactorClient = class {
 		return this.find({ ids: sourceIds }, view, paging, signal);
 	}
 	/**
+	* Retrieves the outgoing relationship edges of a source document, carrying the
+	* metadata and timestamps the far-end documents do not.
+	*/
+	async getOutgoingRelationshipEdges(sourceIdentifier, relationshipType, view, paging, signal) {
+		this.logger.verbose("getOutgoingRelationshipEdges(@sourceIdentifier, @relationshipType, @view, @paging)", sourceIdentifier, relationshipType, view, paging);
+		const sourceId = await this.documentView.resolveIdOrSlug(sourceIdentifier, view, void 0, signal);
+		const edges = await this.reactor.getOutgoingRelationshipEdges(sourceId, relationshipType, paging, void 0, signal);
+		return this.gateEdges(edges, "targetId", view, signal);
+	}
+	/**
+	* Retrieves the incoming relationship edges of a target document, carrying the
+	* metadata and timestamps the far-end documents do not.
+	*/
+	async getIncomingRelationshipEdges(targetIdentifier, relationshipType, view, paging, signal) {
+		this.logger.verbose("getIncomingRelationshipEdges(@targetIdentifier, @relationshipType, @view, @paging)", targetIdentifier, relationshipType, view, paging);
+		const targetId = await this.documentView.resolveIdOrSlug(targetIdentifier, view, void 0, signal);
+		const edges = await this.reactor.getIncomingRelationshipEdges(targetId, relationshipType, paging, void 0, signal);
+		return this.gateEdges(edges, "sourceId", view, signal);
+	}
+	/**
+	* Drops the edges whose far-end document the subject may read no domain scope
+	* of. An edge is withheld whole rather than stripped of its metadata: the
+	* document-shaped relationship reads already answer with the far end stripped
+	* to the scopes the gate allows, so the far end's existence is disclosed
+	* either way, but an edge's metadata is content about the pair that the far
+	* end's own reads would refuse. An edge to a far end stripped to nothing
+	* therefore carries content past a refusal, and there is no useful shell to
+	* hand back in its place.
+	*
+	* `nextCursor` and `options` are left as the underlying stream reported them,
+	* because a caller must feed them back to resume from the right position. A
+	* gated page can therefore be shorter than the limit it asked for.
+	*/
+	async gateEdges(page, farEnd, view, signal) {
+		const ids = [...new Set(page.results.map((edge) => edge[farEnd]))];
+		if (ids.length === 0) return page;
+		const farEndView = {
+			subject: view?.subject,
+			branch: view?.branch
+		};
+		const documents = await this.reactor.find({ ids }, farEndView, {
+			cursor: "0",
+			limit: ids.length
+		}, void 0, signal);
+		const readable = new Map(await Promise.all(documents.results.map(async (doc) => {
+			const allows = await this.readableScopes(doc, view, signal);
+			const domainScopes = Object.keys(doc.state).filter((scope) => !ALWAYS_READABLE_SCOPES.has(scope));
+			return [doc.header.id, domainScopes.length === 0 || domainScopes.some(allows)];
+		})));
+		const results = page.results.filter((edge) => readable.get(edge[farEnd]) !== false);
+		if (results.length === page.results.length) return page;
+		const nextPage = page.next;
+		return {
+			...page,
+			results,
+			next: nextPage ? async () => this.gateEdges(await nextPage(), farEnd, view, signal) : void 0
+		};
+	}
+	/**
+	* One relationship edge, or undefined when it does not exist. A point lookup:
+	* the pair is filtered in SQL rather than scanned out of the source's edge
+	* list, which on a drive with thousands of children is the difference between
+	* one query and dozens.
+	*/
+	async readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, view, signal) {
+		const sourceId = await this.documentView.resolveIdOrSlug(sourceIdentifier, view, void 0, signal);
+		const targetId = await this.documentView.resolveIdOrSlug(targetIdentifier, view, void 0, signal);
+		return (await this.documentIndexer.getDirectedRelationships(sourceId, targetId, [relationshipType], {
+			cursor: "0",
+			limit: 1
+		}, void 0, signal)).results[0];
+	}
+	/**
 	* Filters documents by criteria and returns a list of them
 	*/
 	async find(search, view, paging, signal) {
@@ -1515,9 +1588,21 @@ var ReactorClient = class {
 	/**
 	* Adds multiple documents as children to another and waits for completion
 	*/
-	async addRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch = "main", signal) {
-		this.logger.verbose("addRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @branch)", sourceIdentifier, targetIdentifier, relationshipType, branch);
-		const jobInfo = await this.reactor.addRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
+	async addRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch = "main", signal) {
+		this.logger.verbose("addRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @metadata, @branch)", sourceIdentifier, targetIdentifier, relationshipType, metadata, branch);
+		const jobInfo = await this.reactor.addRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
+		const completedJob = await this.waitForJob(jobInfo, signal);
+		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
+		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		return this.gateDocument(result, { branch }, signal);
+	}
+	/**
+	* Replaces the metadata of an existing relationship and waits for completion.
+	*/
+	async updateRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch = "main", signal) {
+		this.logger.verbose("updateRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @metadata, @branch)", sourceIdentifier, targetIdentifier, relationshipType, metadata, branch);
+		if (!await this.readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, { branch }, signal)) throw new RelationshipNotFoundError(sourceIdentifier, targetIdentifier, relationshipType);
+		const jobInfo = await this.reactor.updateRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === JobStatus.FAILED) throw new Error(completedJob.error?.message);
 		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
@@ -1539,10 +1624,11 @@ var ReactorClient = class {
 	*/
 	async moveRelationship(sourceParentIdentifier, targetParentIdentifier, targetIdentifier, relationshipType, branch = "main", signal) {
 		this.logger.verbose("moveRelationship(@sourceParentIdentifier, @targetParentIdentifier, @targetIdentifier, @relationshipType, @branch)", sourceParentIdentifier, targetParentIdentifier, targetIdentifier, relationshipType, branch);
+		const metadata = (await this.readRelationshipEdge(sourceParentIdentifier, targetIdentifier, relationshipType, { branch }, signal))?.metadata;
 		const removeJobInfo = await this.reactor.removeRelationship(sourceParentIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
 		const removeCompletedJob = await this.waitForJob(removeJobInfo, signal);
 		if (removeCompletedJob.status === JobStatus.FAILED) throw new Error(removeCompletedJob.error?.message);
-		const addJobInfo = await this.reactor.addRelationship(targetParentIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
+		const addJobInfo = await this.reactor.addRelationship(targetParentIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
 		const addCompletedJob = await this.waitForJob(addJobInfo, signal);
 		if (addCompletedJob.status === JobStatus.FAILED) throw new Error(addCompletedJob.error?.message);
 		const sourceResult = await this.reactor.getByIdOrSlug(sourceParentIdentifier, { branch }, removeCompletedJob.consistencyToken, signal);
@@ -2212,6 +2298,7 @@ var WorkerPoolJobExecutorManager = class {
 			jobId: job.id,
 			operations: payload.operations,
 			jobMeta: payload.jobMeta,
+			submittedActionIds: submittedActionIds(job),
 			collectionMemberships
 		};
 		try {
@@ -2495,7 +2582,8 @@ var InMemoryJobTracker = class {
 			this.jobs.set(jobId, {
 				...job,
 				status: JobStatus.WRITE_READY,
-				consistencyToken
+				consistencyToken,
+				result: summarizeSubmittedActions(event.operations, event.submittedActionIds)
 			});
 		}
 	}
@@ -4229,9 +4317,35 @@ const DRIVE_AUTH_ERROR_MESSAGES = {
 	forbidden: "Forbidden: insufficient permissions",
 	authenticationRequired: "Forbidden: authentication required"
 };
+/**
+* A non-GraphQL HTTP failure against a drive endpoint.
+*
+* Drive discovery (`GET <base>/d/:drive`) is REST, not GraphQL, so its
+* failures cannot be a `GraphQLRequestError` without the name lying about
+* what was called. It carries the status for the same reason that one does:
+* `isDriveAuthError` is what decides whether a failure prompts a login, and a
+* bare `Error` tells it nothing.
+*/
+var DriveRequestError = class extends Error {
+	statusCode;
+	constructor(message, statusCode) {
+		super(message);
+		this.name = "DriveRequestError";
+		this.statusCode = statusCode;
+	}
+};
 /** True when the remote rejected the caller as unauthenticated/unauthorized:
-* an HTTP 401/403, or a Forbidden/Unauthorized GraphQL error. */
+* an HTTP 401/403, or a Forbidden/Unauthorized GraphQL error.
+*
+* 403 and 401 only — NOT 404. The drive info endpoint answers a drive the
+* caller may not read with the same 404 it gives a drive that does not exist,
+* so that an unauthorized caller cannot enumerate drives by probing slugs.
+* That is deliberate, and it costs exactly this: a protected drive is
+* indistinguishable from a typo, and prompting for a login on every 404 would
+* fire on every mistyped URL. See the `WWW-Authenticate` note on the endpoint
+* for the signal that would let a client tell the two apart. */
 function isDriveAuthError(error) {
+	if (error instanceof DriveRequestError) return error.statusCode === 401 || error.statusCode === 403;
 	if (!(error instanceof GraphQLRequestError)) return false;
 	if (error.category === "http") return error.statusCode === 401 || error.statusCode === 403;
 	if (error.category === "graphql") return Object.values(DRIVE_AUTH_ERROR_MESSAGES).some((m) => error.message.includes(m));
@@ -5028,6 +5142,10 @@ var GqlRequestChannel = class {
 		if (this.isShutdown) return;
 		this.pollTimer.triggerNow();
 	}
+	/** This channel polls a remote itself; it has no holder to hear from. */
+	notePoll() {}
+	/** No holder, so nothing this channel reports may strand one. */
+	lastHolderPollUtcMs() {}
 	/**
 	* Initializes the channel by registering it on the remote server and starting polling.
 	*/
@@ -5611,6 +5729,7 @@ var GqlResponseChannel = class {
 	lastPersistedOutboxOrdinal = 0;
 	evictedOutboxFloor = Number.POSITIVE_INFINITY;
 	appliedOutboxOrdinal = 0;
+	lastPollUtcMs = Date.now();
 	connectionState = "connecting";
 	connectionStateCallbacks = /* @__PURE__ */ new Set();
 	constructor(logger, channelId, remoteName, cursorStorage) {
@@ -5653,7 +5772,7 @@ var GqlResponseChannel = class {
 		return {
 			state: this.connectionState,
 			failureCount: 0,
-			lastSuccessUtcMs: 0,
+			lastSuccessUtcMs: this.lastPollUtcMs,
 			lastFailureUtcMs: 0,
 			pushBlocked: false,
 			pushFailureCount: 0,
@@ -5669,6 +5788,13 @@ var GqlResponseChannel = class {
 	}
 	/** Response channels are push-driven; resolvers populate mailboxes directly. */
 	triggerPull() {}
+	notePoll() {
+		this.lastPollUtcMs = Date.now();
+	}
+	/** This channel is served: its holder's polls are the liveness it reports. */
+	lastHolderPollUtcMs() {
+		return this.lastPollUtcMs;
+	}
 	async init() {
 		const cursors = await this.cursorStorage.list(this.remoteName);
 		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
@@ -6348,9 +6474,19 @@ var OutboxMode = /* @__PURE__ */ function(OutboxMode) {
 const defaultSyncManagerConfig = {
 	maxDeadLettersPerRemote: 100,
 	maxInboxBatchSize: 32,
-	maxHeldOperationsPerRemote: 1e4
+	maxHeldOperationsPerRemote: 1e4,
+	staleRemotePollWindowMs: 5 * 6e4
 };
 const PLAN_KEY_TO_JOB_UUID_CAP = 1e4;
+/**
+* Whether a channel failure says the caller could not authenticate or could not
+* reach the remote, rather than that the remote itself is misconfigured. The
+* remote record stays on disk for these so a retry after sign-in can re-add it.
+*/
+function isCredentialOrNetworkError(error) {
+	if (isDriveAuthError(error)) return true;
+	return error instanceof GraphQLRequestError && error.category === "network";
+}
 /** Where a sync operation's run of ordinals begins. */
 function firstOrdinalOf(syncOp) {
 	return syncOp.operations.length > 0 ? syncOp.operations[0].context.ordinal : 0;
@@ -6379,6 +6515,11 @@ var SyncManager = class {
 	backfillAbortControllers = /* @__PURE__ */ new Map();
 	planKeyToJobUuid = /* @__PURE__ */ new Map();
 	evictedOutboxFloors = /* @__PURE__ */ new Map();
+	prunePending = /* @__PURE__ */ new Set();
+	pruneChain = Promise.resolve();
+	derivingOutboxes = 0;
+	pruneDrainDeferred = false;
+	removing = /* @__PURE__ */ new Set();
 	lastEnqueuedJobIdByKey = /* @__PURE__ */ new Map();
 	inboxChunkChain = Promise.resolve();
 	constructor(logger, remoteStorage, cursorStorage, deadLetterStorage, channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, config = {}) {
@@ -6430,7 +6571,7 @@ var SyncManager = class {
 				await channel.init();
 			} catch (error) {
 				this.logger.error("Error initializing channel for remote (@name, @error)", record.name, error instanceof Error ? error.message : String(error));
-				this.remotes.delete(record.name);
+				await this.dropRemoteAfterFailedInit(remote, false);
 				continue;
 			}
 			const outboxAckOrdinal = remote.channel.outbox.ackOrdinal;
@@ -6442,6 +6583,7 @@ var SyncManager = class {
 					this.logger.error("Backfill failed for remote @RemoteName: @Error", remote.meta.name, error instanceof Error ? error : new Error(String(error)));
 				}).finally(() => {
 					this.backfillAbortControllers.delete(record.name);
+					this.drainPrunes();
 				});
 			}
 		}
@@ -6455,6 +6597,8 @@ var SyncManager = class {
 		this.backfillAbortControllers.clear();
 		this.planKeyToJobUuid.clear();
 		this.lastEnqueuedJobIdByKey.clear();
+		this.prunePending.clear();
+		this.pruneDrainDeferred = false;
 		this.batchAggregator.clear();
 		if (this.eventUnsubscribe) {
 			this.eventUnsubscribe();
@@ -6548,8 +6692,7 @@ var SyncManager = class {
 		try {
 			await channel.init();
 		} catch (error) {
-			this.remotes.delete(name);
-			await this.remoteStorage.remove(name);
+			await this.dropRemoteAfterFailedInit(remote, !isCredentialOrNetworkError(error));
 			throw error;
 		}
 		const backfillController = new AbortController();
@@ -6559,6 +6702,7 @@ var SyncManager = class {
 			this.logger.error("Backfill failed for remote @RemoteName: @Error", remote.meta.name, error instanceof Error ? error : new Error(String(error)));
 		}).finally(() => {
 			this.backfillAbortControllers.delete(name);
+			this.drainPrunes();
 		});
 		return remote;
 	}
@@ -6570,21 +6714,62 @@ var SyncManager = class {
 	async remove(name) {
 		const remote = this.remotes.get(name);
 		if (!remote) throw new Error(`Remote with name '${name}' does not exist`);
+		this.removing.add(name);
+		try {
+			await this.teardownRemoteResources(remote);
+			await this.remoteStorage.remove(name);
+			await this.cursorStorage.remove(name);
+		} finally {
+			this.remotes.delete(name);
+			this.removing.delete(name);
+		}
+	}
+	/**
+	* Drops a remote whose channel.init() rejected, optionally removing its
+	* stored record. Ordered like remove(): the registry slot is released last,
+	* so a concurrent add of the same name cannot slip in and have its record
+	* deleted by the removal below. A failure to tear down must not replace the
+	* init error the caller has to classify.
+	*/
+	async dropRemoteAfterFailedInit(remote, removeStorageRecord) {
+		const name = remote.meta.name;
+		this.removing.add(name);
+		try {
+			await this.teardownRemoteResources(remote);
+			if (removeStorageRecord) await this.remoteStorage.remove(name);
+		} catch (error) {
+			this.logger.error("Error tearing down remote after failed init (@name, @error)", name, error instanceof Error ? error.message : String(error));
+		} finally {
+			this.remotes.delete(name);
+			this.removing.delete(name);
+		}
+	}
+	/**
+	* Releases everything wiring a remote up holds: the in-flight backfill, the
+	* channel, the status tracker entry and the connection-state subscription.
+	* The registry slot is deliberately NOT released here -- the caller holds it
+	* until any storage removal has finished, so a concurrent add of the same
+	* name is refused for the whole teardown.
+	*/
+	async teardownRemoteResources(remote) {
+		const name = remote.meta.name;
 		const backfillController = this.backfillAbortControllers.get(name);
 		if (backfillController) {
 			backfillController.abort();
 			this.backfillAbortControllers.delete(name);
 		}
-		await remote.channel.shutdown();
-		await this.remoteStorage.remove(name);
-		await this.cursorStorage.remove(name);
-		this.syncStatusTracker.untrackRemote(name);
-		const unsub = this.connectionStateUnsubscribes.get(name);
-		if (unsub) {
-			unsub();
-			this.connectionStateUnsubscribes.delete(name);
+		try {
+			await remote.channel.shutdown();
+		} finally {
+			this.syncStatusTracker.untrackRemote(name);
+			const unsub = this.connectionStateUnsubscribes.get(name);
+			if (unsub) {
+				unsub();
+				this.connectionStateUnsubscribes.delete(name);
+			}
+			this.evictedOutboxFloors.delete(name);
+			this.prunePending.delete(name);
 		}
-		this.remotes.delete(name);
 	}
 	list() {
 		return Array.from(this.remotes.values());
@@ -6679,7 +6864,7 @@ var SyncManager = class {
 		this.logger.debug("Loaded @count persisted dead letters for remote @name", records.length, remote.meta.name);
 	}
 	getRemotesForCollection(collectionId) {
-		return Array.from(this.remotes.values()).filter((remote) => remote.meta.collectionId.key === collectionId);
+		return Array.from(this.remotes.values()).filter((remote) => remote.meta.collectionId.key === collectionId && !this.removing.has(remote.meta.name));
 	}
 	async processCompleteBatch(batch) {
 		if (this.isShutdown) return;
@@ -6690,7 +6875,11 @@ var SyncManager = class {
 			for (const remote of remotes) if (!affectedRemotes.includes(remote)) affectedRemotes.push(remote);
 		}
 		for (const remote of affectedRemotes) trimMailboxFromBatch(remote.channel.inbox, batch);
-		for (const remote of affectedRemotes) await this.updateOutbox(remote, remote.channel.outbox.latestOrdinal, OutboxMode.BatchTriggered);
+		for (const remote of affectedRemotes) {
+			if (!this.remotes.has(remote.meta.name) || this.removing.has(remote.meta.name)) continue;
+			await this.updateOutbox(remote, remote.channel.outbox.latestOrdinal, OutboxMode.BatchTriggered);
+		}
+		await this.drainPrunes();
 	}
 	handleInboxAdded(remote, syncOps) {
 		if (this.isShutdown) return;
@@ -6891,15 +7080,95 @@ var SyncManager = class {
 		const floor = firstOrdinalOf(evicted[0]);
 		const known = this.evictedOutboxFloors.get(remote.meta.name);
 		this.evictedOutboxFloors.set(remote.meta.name, known === void 0 ? floor : Math.min(known, floor));
-		this.logger.warn("Outbox for @RemoteName is past its bound of @Cap operations; evicting @Count entries from ordinal @Floor, to be derived again once it drains", remote.meta.name, cap, evicted.length, floor);
+		const staleMs = this.stalePollAgeMs(remote);
+		if (staleMs !== void 0) {
+			let held = kept;
+			for (const syncOp of evicted) held += syncOp.operations.length;
+			if (!this.prunePending.has(remote.meta.name)) {
+				this.prunePending.add(remote.meta.name);
+				this.logger.warn("Outbox for @RemoteName (@Collection) is past its bound of @Cap operations holding @Held, and it has not been polled for @StaleMs ms; marking the channel for removal once this derivation ends", remote.meta.name, remote.meta.collectionId.key, cap, held, staleMs);
+			}
+		} else this.logger.warn("Outbox for @RemoteName is past its bound of @Cap operations; evicting @Count entries from ordinal @Floor, to be derived again once it drains", remote.meta.name, cap, evicted.length, floor);
 		remote.channel.outbox.remove(...evicted);
 	}
+	/**
+	* How long a served remote's holder has been silent, if past the window.
+	*
+	* The channel is asked, rather than its config inspected: SyncManager serves
+	* and subscribes with the same interface, both kinds report lastSuccessUtcMs,
+	* and the caller-supplied channelConfig.type is a free-form string the
+	* factories do not read -- so neither could tell a dead served channel from a
+	* client whose switchboard is merely unreachable. Only a channel that claims
+	* a holder by reporting when it last heard from one can be removed for that
+	* holder's silence; a channel that reports nothing (or 0) is never pruned.
+	*/
+	stalePollAgeMs(remote) {
+		const last = remote.channel.lastHolderPollUtcMs();
+		if (last === void 0 || last <= 0) return;
+		const age = Date.now() - last;
+		return age >= this.config.staleRemotePollWindowMs ? age : void 0;
+	}
+	/**
+	* Removes the remotes marked stale during eviction.
+	*
+	* Removing a remote that a derivation is still iterating would pull its
+	* mailboxes out from under it, so a drain that arrives during one is deferred
+	* rather than run; the last derivation to finish re-arms it.
+	*/
+	drainPrunes() {
+		if (this.derivingOutboxes > 0) {
+			this.pruneDrainDeferred = true;
+			return Promise.resolve();
+		}
+		const next = this.pruneChain.then(async () => {
+			if (this.isShutdown) return;
+			for (const name of [...this.prunePending]) {
+				if (this.derivingOutboxes > 0) {
+					this.pruneDrainDeferred = true;
+					return;
+				}
+				this.prunePending.delete(name);
+				const remote = this.remotes.get(name);
+				if (!remote) continue;
+				if (this.stalePollAgeMs(remote) === void 0) {
+					this.logger.info("Stale removal of @name revoked: its holder polled while the outbox was being derived", name);
+					continue;
+				}
+				try {
+					await this.remove(name);
+				} catch (error) {
+					this.logger.error("Failed to remove stale remote (@name, @error)", name, error instanceof Error ? error.message : String(error));
+				}
+			}
+		});
+		this.pruneChain = next.catch(() => {});
+		return next;
+	}
 	outboxOperationCount(remote) {
 		let count = 0;
 		for (const syncOp of remote.channel.outbox.items) count += syncOp.operations.length;
 		return count;
 	}
+	/**
+	* Derives this remote's outbox, holding off prunes for the duration.
+	*
+	* A backfill elsewhere can finish at any await in here and drain the prunes
+	* it marked; the count is what keeps that drain from removing the remote this
+	* call is still adding to.
+	*/
 	async updateOutbox(remote, ackOrdinal, mode = OutboxMode.Backfill, signal) {
+		this.derivingOutboxes++;
+		try {
+			await this.deriveOutbox(remote, ackOrdinal, mode, signal);
+		} finally {
+			this.derivingOutboxes--;
+			if (this.derivingOutboxes === 0 && this.pruneDrainDeferred) {
+				this.pruneDrainDeferred = false;
+				this.drainPrunes();
+			}
+		}
+	}
+	async deriveOutbox(remote, ackOrdinal, mode, signal) {
 		const composedSignal = signal ? AbortSignal.any([signal, this.abortController.signal]) : this.abortController.signal;
 		const startOrdinal = this.refillOrdinal(remote, ackOrdinal);
 		let maxOrdinal = startOrdinal;
@@ -7001,6 +7270,10 @@ var SyncBuilder = class {
 		this.config.maxHeldOperationsPerRemote = limit;
 		return this;
 	}
+	withStaleRemotePollWindowMs(windowMs) {
+		this.config.staleRemotePollWindowMs = windowMs;
+		return this;
+	}
 	build(reactor, logger, operationIndex, eventBus, db, driveContainerTypes) {
 		return this.buildModule(reactor, logger, operationIndex, eventBus, db, driveContainerTypes).syncManager;
 	}
@@ -7166,6 +7439,16 @@ var Reactor = class {
 		throwIfAborted(signal, () => new AbortError());
 		return relationships.results.map((rel) => rel.sourceId);
 	}
+	async getOutgoingRelationshipEdges(sourceId, relationshipType, paging, consistencyToken, signal) {
+		const relationships = await this.documentIndexer.getOutgoing(sourceId, relationshipType ? [relationshipType] : void 0, paging, consistencyToken, signal);
+		throwIfAborted(signal, () => new AbortError());
+		return relationships;
+	}
+	async getIncomingRelationshipEdges(targetId, relationshipType, paging, consistencyToken, signal) {
+		const relationships = await this.documentIndexer.getIncoming(targetId, relationshipType ? [relationshipType] : void 0, paging, consistencyToken, signal);
+		throwIfAborted(signal, () => new AbortError());
+		return relationships;
+	}
 	async getOperations(documentId, view, filter, paging, consistencyToken, signal) {
 		this.logger.verbose("getOperations(@documentId, @view, @filter, @paging)", documentId, view, filter, paging);
 		const branch = view?.branch || "main";
@@ -7528,10 +7811,17 @@ var Reactor = class {
 		}
 		return { jobs: Object.fromEntries(jobInfos) };
 	}
-	async addRelationship(sourceId, targetId, relationshipType, branch = "main", signer, signal) {
-		this.logger.verbose("addRelationship(@sourceId, @targetId, @relationshipType, @branch)", sourceId, targetId, relationshipType, branch);
+	async addRelationship(sourceId, targetId, relationshipType, metadata, branch = "main", signer, signal) {
+		this.logger.verbose("addRelationship(@sourceId, @targetId, @relationshipType, @metadata, @branch)", sourceId, targetId, relationshipType, metadata, branch);
 		throwIfAborted(signal, () => new AbortError());
-		let actions = [addRelationshipAction(sourceId, targetId, relationshipType)];
+		let actions = [addRelationshipAction(sourceId, targetId, relationshipType, metadata)];
+		if (signer) actions = await signActions(actions, signer, signal);
+		return await this.execute(sourceId, branch, actions, signal);
+	}
+	async updateRelationship(sourceId, targetId, relationshipType, metadata, branch = "main", signer, signal) {
+		this.logger.verbose("updateRelationship(@sourceId, @targetId, @relationshipType, @metadata, @branch)", sourceId, targetId, relationshipType, metadata, branch);
+		throwIfAborted(signal, () => new AbortError());
+		let actions = [updateRelationshipAction(sourceId, targetId, relationshipType, metadata)];
 		if (signer) actions = await signActions(actions, signer, signal);
 		return await this.execute(sourceId, branch, actions, signal);
 	}
@@ -7903,19 +8193,27 @@ var ReactorBuilder = class {
 		} else executorManager = new SimpleJobExecutorManager(() => new SimpleJobExecutor(this.logger, documentModelRegistry, operationStore, eventBus, writeCache, operationIndex, documentMetaCache, collectionMembershipCache, this.driveContainerTypes, this.executorConfig, this.signatureVerifier, executionScope), eventBus, queue, jobTracker, this.logger, resolver, this.executorConfig.jobTimeoutMs, this.executorConfig.deferredJobTtlMs);
 		await executorManager.start(executorStartCount);
 		const callerReadModels = Array.from(new Set([...this.readModels]));
+		const degradedComponents = [];
+		const startDegraded = (component, error) => {
+			degradedComponents.push({
+				component,
+				error: error instanceof Error ? error : new Error(String(error))
+			});
+			this.logger?.error("Reactor component started degraded: @component", component, error);
+		};
 		const documentViewConsistencyTracker = new ConsistencyTracker();
 		const documentView = new KyselyDocumentView(database, operationStore, operationIndex, writeCache, documentViewConsistencyTracker, featureFlags.documentDecisions);
 		try {
 			await documentView.init();
 		} catch (error) {
-			console.error("Error initializing document view", error);
+			startDegraded("document view", error);
 		}
 		const documentIndexerConsistencyTracker = new ConsistencyTracker();
 		const documentIndexer = new KyselyDocumentIndexer(database, operationIndex, writeCache, documentIndexerConsistencyTracker);
 		try {
 			await documentIndexer.init();
 		} catch (error) {
-			console.error("Error initializing document indexer", error);
+			startDegraded("document indexer", error);
 		}
 		const subscriptionManager = new ReactorSubscriptionManager(new DefaultSubscriptionErrorHandler());
 		const subscriptionNotificationReadModel = new SubscriptionNotificationReadModel(subscriptionManager, documentView);
@@ -7924,9 +8222,9 @@ var ReactorBuilder = class {
 		try {
 			await processorManager.init();
 		} catch (error) {
-			console.error("Error initializing processor manager", error);
+			startDegraded("processor manager", error);
 		}
-		for (const factory of this.readModelFactories) {
+		for (const [index, factory] of this.readModelFactories.entries()) try {
 			const readModel = await factory({
 				documentModelRegistry,
 				operationIndex,
@@ -7934,6 +8232,8 @@ var ReactorBuilder = class {
 				processorManagerConsistencyTracker
 			});
 			callerReadModels.push(readModel);
+		} catch (error) {
+			startDegraded(`read model ${index}${factory.name ? ` (${factory.name})` : ""}`, error);
 		}
 		const readModelInstances = [
 			...callerReadModels,
@@ -7993,8 +8293,10 @@ var ReactorBuilder = class {
 			syncModule,
 			reactor,
 			groupReevaluationTrigger,
-			pools: this.instrumentedPools
+			pools: this.instrumentedPools,
+			degradedComponents
 		};
+		if (degradedComponents.length > 0) this.logger.warn("Reactor started with @count degraded component(s): @components", degradedComponents.length, degradedComponents.map(({ component }) => component).join(", "));
 		if (this.signalHandlersEnabled) this.attachSignalHandlers(module);
 		return module;
 	}
@@ -8098,7 +8400,7 @@ var ReactorBuilder = class {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
 			import("./worker-handle-CrERzl8s.js"),
 			import("./transport-ByGviWdZ.js"),
-			import("./worker-HPysBfhx.js").then((n) => n.n)
+			import("./worker-B12tBZmr.js").then((n) => n.n)
 		]);
 		const poolConfig = {
 			enabled: true,
@@ -8792,6 +9094,6 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RetryAccounting, RevisionMismatchError, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, DEFAULT_DRIVE_CONTAINER_TYPES, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, IntervalPollTimer, InvalidModuleError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, RetryAccounting, RevisionMismatchError, SeededStateReader, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createMutableShutdownStatus, createReactorHostModuleBase, createRelationalDb, decideAtHead, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, updateRelationshipAction, upgradeDocumentAction, workerEntryPath };
 
 //# sourceMappingURL=index.js.map