@powerhousedao/reactor 6.2.3-dev.49 → 6.2.3-dev.50

package/dist/index.js

@@ -1,12 +1,14 @@
-import { A as CollectionMembershipCache, At as ReactorEventTypes, C as ProbeSettler, Ct as PurgeTooLargeError, D as parseSnapshot, Dt as UnsupportedStoredProtocolError, E as describeWaitingSessions, Et as UnsupportedProtocolVersionError, F as ModuleNotFoundError, Ft as __exportAll, G as createConsistencyToken, K as createDocumentFromAction, M as DuplicateModuleError, Mt as parsePagingOptions, N as InvalidModuleError, Nt as throwIfAborted, O as snapshotFunctionsFor, Ot as UpgradePreconditionFailedError, P as ModelNotWorkerImportableError, R as GATED_DOCUMENT_ACTIONS, S as listPurged, St as InvalidSignatureError, T as createKyselyWatermarkProbe, Tt as ReservedActionError, _ as KyselyOperationIndex, _t as DocumentNotFoundError, a as sanitizeArg, at as AppendConditionFailedError, b as acquirePurgeLocks, bt as GroupInUseError, c as getMigrationStatus, ct as DuplicateOperationError, d as instrumentPgPool, dt as AuthEnforcementDisabledError, et as submittedActionIds, f as KyselyOperationStore, ft as AuthTimestampNotMonotonicError, g as KyselyWriteCache, gt as DocumentNotDeletedError, h as EventBus, ht as DocumentDeletedError, i as errorToInfo, it as APPEND_CONDITION_FAILED_PREFIX, j as DuplicateManifestError, jt as matchesScope, k as DocumentMetaCache, kt as EventBusAggregateError, l as runMigrations, lt as OptimisticLockError, m as DocumentModelRegistry, mt as BatchJobFailedError, n as loadDocumentModelSpec, nt as targetDocumentId, ot as DocumentAlreadyExistsError, p as KyselyKeyframeStore, pt as AuthorizationDeniedError, q as createEmptyConsistencyToken, r as createForwardingLogger, s as REACTOR_SCHEMA, st as DocumentExistence, tt as summarizeSubmittedActions, u as createForwardingPoolInstrumentation, ut as RevisionMismatchError, v as PURGE_LOCK_BUCKETS, vt as DocumentPurgedError, w as SettledWatermark, wt as RelationshipNotFoundError, x as findPurged, xt as InvalidOperationTimestampError, y as PURGE_NS, yt as ExcessiveReshuffleError } from "./load-spec-D9lnje-H.js";
-import { _ as buildDecisionModel, a as KyselyExecutionScope, c as appliedDelete, d as DEFAULT_MAX_PURGE_OPERATIONS, f as JobExecutorEventTypes, g as authDecisionModel, h as documentDecisionModel, i as PassthroughSigner, l as resolveFeatureFlags, m as selectDecisionModel, n as SimpleJobExecutor, o as DEFAULT_PURGE_DELETE_BATCH, p as decideAtHead, r as verifyActionSignature, s as KyselyDocumentPurger, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as DEFAULT_DEFERRED_JOB_TTL_MS, v as DriveCollectionId } from "./drive-container-types-D380mcB3.js";
+import { $ as DocumentExistence, A as GATED_DOCUMENT_ACTIONS, C as describeWaitingSessions, Ct as matchesScope, D as CollectionMembershipCache, Dt as __exportAll, E as DocumentMetaCache, J as targetDocumentId, K as submittedActionIds, L as createConsistencyToken, Q as DocumentAlreadyExistsError, R as createDocumentFromAction, S as createKyselyWatermarkProbe, St as ReactorEventTypes, T as snapshotFunctionsFor, Tt as throwIfAborted, X as APPEND_CONDITION_FAILED_PREFIX, Z as AppendConditionFailedError, _ as acquirePurgeLocks, _t as ReservedActionError, a as REACTOR_SCHEMA, at as AuthorizationDeniedError, b as ProbeSettler, bt as UpgradePreconditionFailedError, c as createForwardingPoolInstrumentation, ct as DocumentNotDeletedError, d as KyselyKeyframeStore, dt as ExcessiveReshuffleError, et as DuplicateOperationError, f as EventBus, ft as GroupInUseError, g as PURGE_NS, gt as RelationshipNotFoundError, h as PURGE_LOCK_BUCKETS, ht as PurgeTooLargeError, it as AuthTimestampNotMonotonicError, l as instrumentPgPool, lt as DocumentNotFoundError, m as KyselyOperationIndex, mt as InvalidSignatureError, n as errorToInfo, nt as RevisionMismatchError, o as getMigrationStatus, ot as BatchJobFailedError, p as KyselyWriteCache, pt as InvalidOperationTimestampError, q as summarizeSubmittedActions, r as sanitizeArg, rt as AuthEnforcementDisabledError, s as runMigrations, st as DocumentDeletedError, t as createForwardingLogger, tt as OptimisticLockError, u as KyselyOperationStore, ut as DocumentPurgedError, v as findPurged, vt as UnsupportedProtocolVersionError, w as parseSnapshot, wt as parsePagingOptions, x as SettledWatermark, xt as EventBusAggregateError, y as listPurged, yt as UnsupportedStoredProtocolError, z as createEmptyConsistencyToken } from "./forwarding-logger-ByfBFgMS.js";
+import { _ as buildDecisionModel, a as KyselyExecutionScope, c as appliedDelete, d as DEFAULT_MAX_PURGE_OPERATIONS, f as JobExecutorEventTypes, g as authDecisionModel, h as documentDecisionModel, i as PassthroughSigner, l as resolveFeatureFlags, m as selectDecisionModel, n as SimpleJobExecutor, o as DEFAULT_PURGE_DELETE_BATCH, p as decideAtHead, r as verifyActionSignature, s as KyselyDocumentPurger, t as DEFAULT_DRIVE_CONTAINER_TYPES, u as DEFAULT_DEFERRED_JOB_TTL_MS, v as DriveCollectionId } from "./drive-container-types-Ci1pdv4X.js";
+import { a as DuplicateModuleError, c as ModuleNotFoundError, i as DuplicateManifestError, n as loadDocumentModelSpec, o as InvalidModuleError, r as DocumentModelRegistry, s as ModelNotWorkerImportableError } from "./load-spec-ZLjuyhxz.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-BM_ULVWd.js";
-import { _ as ContiguousCursor, a as KyselyDocumentView, b as isCatchUpConsumer, c as ReadModelCoordinator, d as reserveBatch, f as BaseReadModel, g as unchunkedReadModelIndexingConfig, h as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as indexReserved, m as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as DEFAULT_COMMIT_CHUNK_SIZE, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as releaseBatch, v as defaultCatchUpConfig, y as CatchUpScheduler } from "./document-indexer-Dc_Sv6yi.js";
+import { _ as ContiguousCursor, a as KyselyDocumentView, b as isCatchUpConsumer, c as ReadModelCoordinator, d as reserveBatch, f as BaseReadModel, g as unchunkedReadModelIndexingConfig, h as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as indexReserved, m as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as DEFAULT_COMMIT_CHUNK_SIZE, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as releaseBatch, v as defaultCatchUpConfig, y as CatchUpScheduler } from "./document-indexer-DwAMDVRI.js";
 import { DEFAULT_SIGNATURE_POLICY, DOCUMENT_PURGE_PROTOCOL, DowngradeNotSupportedError, MARKER_REFUSAL_FEATURE, MAX_AUTH_GRANTS, PEER_CAPABILITIES, PURGE_DOCUMENT, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, canonicalJson, coversLocal, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, holdReason, isOlderManifest, isPurgeMarker, isPurgeMarker as isPurgeMarker$1, legacySupports, localPeerManifest, localSupports, mergePeerCapabilities, normalizeDocumentModelVersion, peerSupports, purgedProtocolVersions, readPeerManifest, requestedSignaturePolicy, selectProtocolVersions, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
-import { sql } from "kysely";
+import { CompiledQuery, sql } from "kysely";
+import { PGliteDialect } from "kysely-pglite-dialect";
 import { RelationalDbProcessor, createRelationalDb } from "@powerhousedao/shared/processors";
 //#region src/actions/index.ts
 /**
@@ -5600,6 +5602,7 @@ var Mailbox = class {
 	itemsMap = /* @__PURE__ */ new Map();
 	/** Unapplied items carrying a marker, so the held ack reads only these. */
 	heldMarkers = /* @__PURE__ */ new Set();
+	held = /* @__PURE__ */ new Set();
 	addedCallbacks = [];
 	removedCallbacks = [];
 	paused = false;
@@ -5620,9 +5623,9 @@ var Mailbox = class {
 		return Array.from(this.itemsMap.values());
 	}
 	get ackOrdinal() {
-		if (!this.holdAckBelowMarkers) return this._ack;
+		if (!this.holdAckBelowMarkers && this.held.size === 0) return this._ack;
 		let floor = Number.POSITIVE_INFINITY;
-		for (const item of this.heldMarkers) for (const op of item.operations) {
+		for (const item of [...this.heldMarkers, ...this.held]) for (const op of item.operations) {
 			const ordinal = op.context.ordinal;
 			if (ordinal > 0 && ordinal < floor) floor = ordinal;
 		}
@@ -5631,13 +5634,21 @@ var Mailbox = class {
 	get latestOrdinal() {
 		return this._latestOrdinal;
 	}
+	hold(item) {
+		if (item.status === 2) return;
+		if (this.itemsMap.get(item.id) !== item) return;
+		this.held.add(item);
+	}
 	get(id) {
 		return this.itemsMap.get(id);
 	}
 	add(...items) {
 		for (const item of items) {
 			const replaced = this.itemsMap.get(item.id);
-			if (replaced !== void 0) this.heldMarkers.delete(replaced);
+			if (replaced !== void 0 && replaced !== item) {
+				this.heldMarkers.delete(replaced);
+				this.held.delete(replaced);
+			}
 			this.itemsMap.set(item.id, item);
 			let marker = false;
 			for (const op of item.operations) {
@@ -5648,6 +5659,7 @@ var Mailbox = class {
 			item.on((syncOp, _, next) => {
 				if (next === 2) {
 					this.heldMarkers.delete(syncOp);
+					this.held.delete(syncOp);
 					for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
 				}
 			});
@@ -5669,6 +5681,7 @@ var Mailbox = class {
 		for (const item of items) {
 			this.itemsMap.delete(item.id);
 			this.heldMarkers.delete(item);
+			this.held.delete(item);
 		}
 		if (this.paused) {
 			this.removedBuffer.push(...items);
@@ -5945,6 +5958,13 @@ function isDriveAuthError(error) {
 	if (error.category === "graphql") return Object.values(DRIVE_AUTH_ERROR_MESSAGES).some((m) => error.message.includes(m));
 	return false;
 }
+/** A repair lever declined a request it cannot carry out safely. */
+var SyncRepairRefusedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SyncRepairRefusedError";
+	}
+};
 var PollingChannelError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -6362,6 +6382,7 @@ function classifyJobFailure(errorName) {
 		case "HashMismatchError": return "HASH_MISMATCH";
 		case "UnsupportedProtocolVersionError": return "UNSUPPORTED_PROTOCOL";
 		case "DocumentPurgedError": return "DOCUMENT_PURGED";
+		case "DocumentNotFoundError": return "MISSING_OPERATIONS";
 		case "DocumentNotDeletedError":
 		case "GroupInUseError":
 		case "PurgeTooLargeError": return "PURGE_PRECONDITION";
@@ -6380,47 +6401,57 @@ const NON_QUARANTINING_ERROR_TYPES = /* @__PURE__ */ new Set([
 	"PEER_PROTOCOL_UNSUPPORTED",
 	"DOCUMENT_PURGED",
 	"PURGE_PRECONDITION",
-	"MARKER_REFUSED"
+	"MARKER_REFUSED",
+	"MISSING_OPERATIONS"
 ]);
 /**
 * A held auth operation must not quarantine: reconciling the two policies needs
 * the traffic a quarantine would stop. A protocol refusal concerns one peer,
-* and quarantine is global to the document.
+* and quarantine is global to the document. A missing ancestor arrives through
+* exactly the traffic a quarantine stops.
 */
 function quarantinesDocument(errorType) {
 	return !NON_QUARANTINING_ERROR_TYPES.has(errorType);
 }
 //#endregion
 //#region src/sync/channels/interval-poll-timer.ts
+/** Lower bound on the derived {@link PollTimerConfig.delegateTimeoutMs}. */
+const DELEGATE_TIMEOUT_FLOOR_MS = 3e4;
 const DEFAULT_CONFIG = {
 	intervalMs: 2e3,
 	maxQueueDepth: 100,
 	backpressureCheckIntervalMs: 500,
 	retryBaseDelayMs: 1e3,
 	retryMaxDelayMs: 3e5,
-	startPaused: false
+	startPaused: false,
+	delegateTimeoutMs: DELEGATE_TIMEOUT_FLOOR_MS,
+	queueProbeTimeoutMs: 1e4
 };
 function calculateBackoffDelay(consecutiveFailures, retryBaseDelayMs, retryMaxDelayMs, random) {
 	const backoff = Math.min(retryMaxDelayMs, retryBaseDelayMs * Math.pow(2, consecutiveFailures - 1));
 	return backoff / 2 + random * (backoff / 2);
 }
-/**
-* Default poll timer using setTimeout.
-* Waits for delegate completion before scheduling next tick.
-* Checks queue depth and defers polling when backpressure is detected.
-*/
+/** setTimeout poll timer; a stuck tick is cancelled and the next waits for it to settle. */
 var IntervalPollTimer = class {
 	delegate;
 	timer;
+	watchdog;
 	running;
 	paused;
 	consecutiveFailures;
+	tickToken = 0;
+	ticking = false;
+	tickAbort;
+	cancelledToken;
+	retriggerRequested = false;
 	queue;
 	config;
 	constructor(queue, config = {}) {
 		this.queue = queue;
+		const intervalMs = config.intervalMs ?? DEFAULT_CONFIG.intervalMs;
 		this.config = {
 			...DEFAULT_CONFIG,
+			delegateTimeoutMs: Math.max(DELEGATE_TIMEOUT_FLOOR_MS, intervalMs * 10),
 			...config
 		};
 		this.running = false;
@@ -6437,54 +6468,25 @@ var IntervalPollTimer = class {
 	}
 	stop() {
 		this.running = false;
-		if (this.timer) {
-			clearTimeout(this.timer);
-			this.timer = void 0;
-		}
-	}
-	tick() {
-		if (!this.delegate || !this.running) return;
-		const delegate = this.delegate;
-		this.queue.totalSize().then((size) => {
-			if (!this.running) return;
-			if (size > this.config.maxQueueDepth) this.scheduleBackpressureRecheck();
-			else delegate().then(() => {
-				this.consecutiveFailures = 0;
-				this.scheduleNext();
-			}).catch(() => {
-				this.consecutiveFailures++;
-				this.scheduleRetry();
-			});
-		}).catch(() => {
-			this.scheduleNext();
-		});
-	}
-	scheduleNext() {
-		if (!this.running || this.paused) return;
-		this.timer = setTimeout(() => this.tick(), this.config.intervalMs);
-	}
-	scheduleRetry() {
-		if (!this.running || this.paused) return;
-		const delay = calculateBackoffDelay(this.consecutiveFailures, this.config.retryBaseDelayMs, this.config.retryMaxDelayMs, Math.random());
-		this.timer = setTimeout(() => this.tick(), delay);
-	}
-	scheduleBackpressureRecheck() {
-		if (!this.running || this.paused) return;
-		this.timer = setTimeout(() => this.tick(), this.config.backpressureCheckIntervalMs);
+		this.retriggerRequested = false;
+		this.clearTimer();
+		this.clearWatchdog();
+		this.cancelTick(/* @__PURE__ */ new Error("poll timer stopped"));
+		this.tickToken++;
+		this.cancelledToken = void 0;
+		this.ticking = false;
 	}
 	pause() {
 		this.paused = true;
-		if (this.timer) {
-			clearTimeout(this.timer);
-			this.timer = void 0;
-		}
+		this.clearTimer();
 	}
 	resume() {
 		this.paused = false;
 		if (this.running) this.scheduleNext();
 	}
 	triggerNow() {
-		if (this.running && this.delegate) this.tick();
+		if (!this.running || !this.delegate) return;
+		this.tick();
 	}
 	isPaused() {
 		return this.paused;
@@ -6498,6 +6500,133 @@ var IntervalPollTimer = class {
 	setIntervalMs(ms) {
 		this.config.intervalMs = ms;
 	}
+	tick() {
+		if (!this.delegate || !this.running) return;
+		if (this.ticking) {
+			this.retriggerRequested = true;
+			return;
+		}
+		const delegate = this.delegate;
+		const token = ++this.tickToken;
+		this.ticking = true;
+		this.cancelledToken = void 0;
+		const abort = new AbortController();
+		this.tickAbort = abort;
+		this.clearTimer();
+		this.armWatchdog(token);
+		this.measureQueue(abort.signal).then((size) => {
+			if (!this.running) {
+				this.settle(token, "stopped");
+				return;
+			}
+			if (size === "cancelled") {
+				this.settle(token, "failure");
+				return;
+			}
+			if (size === "unknown") {
+				this.runDelegate(delegate, token, abort.signal);
+				return;
+			}
+			if (size > this.config.maxQueueDepth) {
+				this.settle(token, "backpressure");
+				return;
+			}
+			this.runDelegate(delegate, token, abort.signal);
+		});
+	}
+	runDelegate(delegate, token, signal) {
+		delegate(signal).then(() => this.settle(token, "success"), () => this.settle(token, "failure"));
+	}
+	/** `"unknown"` when the probe timed out or rejected; `"cancelled"` when the tick was. */
+	async measureQueue(signal) {
+		const timeoutMs = this.config.queueProbeTimeoutMs;
+		let handle;
+		const expiry = new Promise((resolve) => {
+			if (timeoutMs > 0) handle = setTimeout(() => resolve("unknown"), timeoutMs);
+		});
+		const cancelled = new Promise((resolve) => {
+			if (signal.aborted) {
+				resolve("cancelled");
+				return;
+			}
+			signal.addEventListener("abort", () => resolve("cancelled"), { once: true });
+		});
+		try {
+			return await Promise.race([
+				this.queue.totalSize(),
+				expiry,
+				cancelled
+			]);
+		} catch {
+			return "unknown";
+		} finally {
+			if (handle !== void 0) clearTimeout(handle);
+		}
+	}
+	settle(token, outcome) {
+		if (token !== this.tickToken) return;
+		this.clearWatchdog();
+		this.ticking = false;
+		this.tickAbort = void 0;
+		const cancelled = this.cancelledToken === token;
+		this.cancelledToken = void 0;
+		const effective = cancelled && outcome !== "stopped" ? "failure" : outcome;
+		if (effective === "success") this.consecutiveFailures = 0;
+		else if (effective === "failure") this.consecutiveFailures++;
+		if (effective === "stopped" || !this.running) return;
+		if (this.retriggerRequested) {
+			this.retriggerRequested = false;
+			this.tick();
+			return;
+		}
+		if (effective === "backpressure") this.scheduleBackpressureRecheck();
+		else if (effective === "failure") this.scheduleRetry();
+		else this.scheduleNext();
+	}
+	/** Cancels rather than abandons the tick, so two delegates never overlap. */
+	armWatchdog(token) {
+		const timeoutMs = this.config.delegateTimeoutMs;
+		if (timeoutMs <= 0) return;
+		this.watchdog = setTimeout(() => {
+			this.watchdog = void 0;
+			if (token !== this.tickToken || !this.ticking) return;
+			this.cancelledToken = token;
+			this.cancelTick(/* @__PURE__ */ new Error(`poll delegate exceeded its ${timeoutMs}ms bound`));
+		}, timeoutMs);
+	}
+	cancelTick(reason) {
+		const abort = this.tickAbort;
+		if (abort === void 0 || abort.signal.aborted) return;
+		abort.abort(reason);
+	}
+	clearWatchdog() {
+		if (this.watchdog) {
+			clearTimeout(this.watchdog);
+			this.watchdog = void 0;
+		}
+	}
+	clearTimer() {
+		if (this.timer) {
+			clearTimeout(this.timer);
+			this.timer = void 0;
+		}
+	}
+	scheduleNext() {
+		if (!this.running || this.paused) return;
+		this.clearTimer();
+		this.timer = setTimeout(() => this.tick(), this.config.intervalMs);
+	}
+	scheduleRetry() {
+		if (!this.running || this.paused) return;
+		const delay = calculateBackoffDelay(this.consecutiveFailures, this.config.retryBaseDelayMs, this.config.retryMaxDelayMs, Math.random());
+		this.clearTimer();
+		this.timer = setTimeout(() => this.tick(), delay);
+	}
+	scheduleBackpressureRecheck() {
+		if (!this.running || this.paused) return;
+		this.clearTimer();
+		this.timer = setTimeout(() => this.tick(), this.config.backpressureCheckIntervalMs);
+	}
 };
 //#endregion
 //#region src/sync/purge-refusals.ts
@@ -6620,6 +6749,7 @@ const getLatestAppliedOrdinal = (syncOps) => {
 };
 //#endregion
 //#region src/sync/channels/gql-req-channel.ts
+const DEFAULT_REQUEST_TIMEOUT_MS = 6e4;
 /**
 * Fields the auth projection added to the sync schema. A remote that predates
 * them rejects the whole query for naming one, so they are selected only while
@@ -6670,8 +6800,18 @@ var GqlRequestChannel = class {
 	failureCount;
 	lastSuccessUtcMs;
 	lastFailureUtcMs;
-	lastPersistedInboxOrdinal = 0;
-	lastPersistedOutboxOrdinal = 0;
+	cursorWriters = {
+		inbox: {
+			persisted: 0,
+			requested: 0,
+			tail: Promise.resolve()
+		},
+		outbox: {
+			persisted: 0,
+			requested: 0,
+			tail: Promise.resolve()
+		}
+	};
 	pushFailureCount = 0;
 	pushRetryTimer = null;
 	pushBlocked = false;
@@ -6698,6 +6838,8 @@ var GqlRequestChannel = class {
 	connectionState = "connecting";
 	/** Latest unrecoverable error was an auth rejection; cleared on connect. */
 	requiresAuth = false;
+	polling = false;
+	polledSinceStart = false;
 	connectionStateCallbacks = /* @__PURE__ */ new Set();
 	constructor(logger, channelId, remoteName, cursorStorage, config, operationIndex, pollTimer) {
 		this.logger = logger;
@@ -6713,7 +6855,8 @@ var GqlRequestChannel = class {
 			collectionId: config.collectionId,
 			filter: config.filter,
 			retryBaseDelayMs: config.retryBaseDelayMs,
-			retryMaxDelayMs: config.retryMaxDelayMs
+			retryMaxDelayMs: config.retryMaxDelayMs,
+			requestTimeoutMs: config.requestTimeoutMs ?? 6e4
 		};
 		this.isShutdown = false;
 		this.failureCount = 0;
@@ -6755,33 +6898,38 @@ var GqlRequestChannel = class {
 		this.outbox.onRemoved((syncOps) => {
 			for (const syncOp of syncOps) this.markerPushedAt.delete(syncOp.id);
 			const ordinal = Math.min(getLatestAppliedOrdinal(syncOps), this.unappliedFloor() - 1);
-			if (ordinal > this.lastPersistedOutboxOrdinal) {
-				this.lastPersistedOutboxOrdinal = ordinal;
-				this.cursorStorage.upsert({
-					remoteName: this.remoteName,
-					cursorType: "outbox",
-					cursorOrdinal: ordinal,
-					lastSyncedAtUtcMs: Date.now()
-				}).catch((error) => {
-					this.logger.error("Failed to update outbox cursor for @ChannelId! This means that future application runs may resend duplicate operations. This is recoverable (with deduplication protection), but not-optimal: @Error", this.channelId, error);
-				});
-			}
+			this.persistCursor("outbox", ordinal);
 		});
 		this.inbox.onRemoved(() => {
-			const maxOrdinal = this.inbox.ackOrdinal;
-			if (maxOrdinal > this.lastPersistedInboxOrdinal) {
-				this.lastPersistedInboxOrdinal = maxOrdinal;
-				this.cursorStorage.upsert({
-					remoteName: this.remoteName,
-					cursorType: "inbox",
-					cursorOrdinal: maxOrdinal,
-					lastSyncedAtUtcMs: Date.now()
-				}).catch((error) => {
-					this.logger.error("Failed to update inbox cursor for @ChannelId! This is unlikely to cause a problem, but not-optimal: @Error", this.channelId, error);
-				});
-			}
+			this.persistCursor("inbox", this.inbox.ackOrdinal);
 		});
 	}
+	/** Advances the watermark only once the write lands; writes per row run one at a time, coalesced. */
+	persistCursor(cursorType, ordinal) {
+		const writer = this.cursorWriters[cursorType];
+		if (ordinal <= Math.max(writer.persisted, writer.requested)) return;
+		writer.requested = ordinal;
+		writer.tail = writer.tail.then(() => this.writeCursor(cursorType));
+	}
+	/** One link of a cursor write chain; never rejects, so the chain survives. */
+	async writeCursor(cursorType) {
+		const writer = this.cursorWriters[cursorType];
+		const ordinal = writer.requested;
+		if (ordinal <= writer.persisted) return;
+		writer.requested = 0;
+		try {
+			await this.cursorStorage.upsert({
+				remoteName: this.remoteName,
+				cursorType,
+				cursorOrdinal: ordinal,
+				lastSyncedAtUtcMs: Date.now()
+			});
+		} catch (error) {
+			this.logger.error("Failed to update @CursorType cursor for @ChannelId at ordinal @Ordinal; the watermark stays put so the next advance retries it: @Error", cursorType, this.channelId, ordinal, error);
+			return;
+		}
+		writer.persisted = Math.max(writer.persisted, ordinal);
+	}
 	/**
 	* Shuts down the channel and prevents further operations.
 	*/
@@ -6789,7 +6937,7 @@ var GqlRequestChannel = class {
 		this.abortController.abort();
 		this.bufferedOutbox.flush();
 		this.isShutdown = true;
-		this.pollTimer.stop();
+		this.stopPolling();
 		if (this.pushRetryTimer) {
 			clearTimeout(this.pushRetryTimer);
 			this.pushRetryTimer = null;
@@ -6848,31 +6996,31 @@ var GqlRequestChannel = class {
 	}
 	/**
 	* Re-touches once when either side's manifest moved; touching is idempotent.
-	* False when the refresh failed, so polled rows must not be judged yet.
+	* False only when shutting down; a failed refresh raises as a recoverable
+	* poll failure, so the next tick retries it.
 	*/
-	async refreshManifestsIfStale(manifestRevision, peerManifestRevision) {
+	async refreshManifestsIfStale(manifestRevision, peerManifestRevision, signal) {
 		if (!this.peerServesAgreement || typeof manifestRevision !== "string") return true;
 		const local = this.localManifestProvider?.().revision ?? null;
 		if (manifestRevision === (this.peerManifest?.revision ?? null) && (peerManifestRevision ?? null) === local) return true;
 		if (this.isShutdown) return false;
-		this.manifestRefresh ??= this.touchRemoteChannel().then(({ ackOrdinal }) => {
+		this.manifestRefresh ??= this.touchRemoteChannel(signal).then(({ ackOrdinal }) => {
 			if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
 		}).finally(() => {
 			this.manifestRefresh = void 0;
 		});
 		try {
 			await this.manifestRefresh;
-			return true;
 		} catch (error) {
-			this.logger.error("GqlChannel @ChannelId manifest refresh failed: @Error", this.channelId, error);
-			return false;
+			throw new Error(`Manifest refresh failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
 		}
+		return true;
 	}
 	/** Re-touches a silent remote in case it was upgraded. */
-	async probeAgreement() {
+	async probeAgreement(signal) {
 		this.agreementStoppedUtcMs = Date.now();
 		try {
-			const { ackOrdinal } = await this.touchRemoteChannel();
+			const { ackOrdinal } = await this.touchRemoteChannel(signal);
 			if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
 		} catch (error) {
 			this.logger.error("GqlChannel @ChannelId agreement probe failed: @Error", this.channelId, error);
@@ -6882,21 +7030,38 @@ var GqlRequestChannel = class {
 	* Initializes the channel by registering it on the remote server and starting polling.
 	*/
 	async init() {
-		const { ackOrdinal } = await this.touchRemoteChannel();
+		const { ackOrdinal } = await this.touchRemoteChannel(void 0);
 		const cursors = await this.cursorStorage.list(this.remoteName);
 		const inboxOrdinal = cursors.find((c) => c.cursorType === "inbox")?.cursorOrdinal ?? 0;
 		const outboxOrdinal = cursors.find((c) => c.cursorType === "outbox")?.cursorOrdinal ?? 0;
 		this.inbox.init(inboxOrdinal);
 		this.outbox.init(outboxOrdinal);
-		this.lastPersistedInboxOrdinal = inboxOrdinal;
-		this.lastPersistedOutboxOrdinal = outboxOrdinal;
+		this.cursorWriters.inbox.persisted = inboxOrdinal;
+		this.cursorWriters.outbox.persisted = outboxOrdinal;
 		if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
-		this.pollTimer.setDelegate(() => this.poll());
+		this.pollTimer.setDelegate((signal) => this.poll(signal));
+		this.startPolling();
+		this.transitionConnectionState(this.reachedState());
+	}
+	startPolling() {
+		this.polling = true;
+		this.polledSinceStart = false;
 		this.pollTimer.start();
-		this.transitionConnectionState("connected");
+	}
+	stopPolling() {
+		this.polling = false;
+		this.polledSinceStart = false;
+		this.pollTimer.stop();
+	}
+	/**
+	* `"connected"` is earned by a poll completed since the loop last started; a
+	* timer that polls only on demand earns it with the touch that started it.
+	*/
+	reachedState() {
+		return this.polledSinceStart || this.pollTimer.isPaused?.() === true ? "connected" : "connecting";
 	}
 	transitionConnectionState(next) {
-		if (next === "connected") this.requiresAuth = false;
+		if (next === "connected" || next === "connecting") this.requiresAuth = false;
 		if (this.connectionState === next) return;
 		this.connectionState = next;
 		const snapshot = this.getConnectionState();
@@ -6907,23 +7072,26 @@ var GqlRequestChannel = class {
 		}
 	}
 	/**
-	* Polls the remote for new sync envelopes.
+	* Polls the remote for new sync envelopes; any failure of the body is recorded.
 	*/
-	async poll() {
+	async poll(signal) {
 		if (this.isShutdown) return;
-		if (!this.peerServesAgreement && Date.now() - this.agreementStoppedUtcMs >= AGREEMENT_PROBE_INTERVAL_MS) await this.probeAgreement();
-		let response;
 		try {
-			response = await this.pollSyncEnvelopes(this.inbox.ackOrdinal, this.inbox.latestOrdinal);
+			await this.pollOnce(signal);
 		} catch (error) {
 			if (!this.handlePollError(error)) throw error;
-			return;
 		}
+	}
+	async pollOnce(signal) {
+		if (!this.peerServesAgreement && Date.now() - this.agreementStoppedUtcMs >= AGREEMENT_PROBE_INTERVAL_MS) await this.probeAgreement(signal);
+		const response = await this.pollSyncEnvelopes(this.inbox.ackOrdinal, this.inbox.latestOrdinal, signal);
+		this.throwIfPollCancelled(signal);
 		const { envelopes, ackOrdinal, deadLetters, hasMore, manifestRevision, peerManifestRevision } = response;
 		if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
 		this.retireRefusedMarkers(deadLetters);
 		this.repushUnackedMarkers();
-		if (!await this.refreshManifestsIfStale(manifestRevision, peerManifestRevision)) return;
+		if (!await this.refreshManifestsIfStale(manifestRevision, peerManifestRevision, signal)) return;
+		this.throwIfPollCancelled(signal);
 		const allSyncOps = [];
 		for (const envelope of envelopes) if (envelope.type.toLowerCase() === "operations" && envelope.operations) {
 			const syncOps = envelopesToSyncOperations(envelope, this.remoteName);
@@ -6940,6 +7108,7 @@ var GqlRequestChannel = class {
 		}
 		this.lastSuccessUtcMs = Date.now();
 		this.failureCount = 0;
+		this.polledSinceStart = true;
 		this.transitionConnectionState("connected");
 	}
 	/**
@@ -6982,7 +7151,7 @@ var GqlRequestChannel = class {
 		const channelError = new ChannelError("inbox", err);
 		this.logger.error("GqlChannel poll error (@FailureCount, @Classification): @Error", this.failureCount, classification, channelError);
 		if (classification === "unrecoverable") {
-			this.pollTimer.stop();
+			this.stopPolling();
 			this.requiresAuth = isDriveAuthError(err);
 			this.transitionConnectionState("error");
 			return true;
@@ -6998,19 +7167,19 @@ var GqlRequestChannel = class {
 		if (this.isRecovering) return;
 		this.isRecovering = true;
 		this.logger.info("GqlChannel @ChannelId not found on remote, re-registering...", this.channelId);
-		this.pollTimer.stop();
+		this.stopPolling();
 		const attemptRecovery = (attempt) => {
 			if (this.isShutdown) {
 				this.isRecovering = false;
 				return;
 			}
-			this.touchRemoteChannel().then(({ ackOrdinal }) => {
+			this.touchRemoteChannel(void 0).then(({ ackOrdinal }) => {
 				this.logger.info("GqlChannel @ChannelId re-registered successfully", this.channelId);
 				this.isRecovering = false;
 				this.failureCount = 0;
 				if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
-				this.pollTimer.start();
-				this.transitionConnectionState("connected");
+				this.startPolling();
+				this.transitionConnectionState(this.reachedState());
 				this.resumePushAfterRecovery();
 			}).catch((recoveryError) => {
 				const err = recoveryError instanceof Error ? recoveryError : new Error(String(recoveryError));
@@ -7050,7 +7219,7 @@ var GqlRequestChannel = class {
 	/**
 	* Queries the remote GraphQL endpoint for sync envelopes.
 	*/
-	async pollSyncEnvelopes(ackOrdinal, latestOrdinal) {
+	async pollSyncEnvelopes(ackOrdinal, latestOrdinal, signal) {
 		const variables = {
 			channelId: this.channelId,
 			outboxAck: ackOrdinal,
@@ -7066,7 +7235,7 @@ var GqlRequestChannel = class {
 					...variables,
 					manifestRevision: revision,
 					refusals
-				} : variables);
+				} : variables, signal);
 				break;
 			} catch (error) {
 				if (this.rejectsAgreementFields(error)) {
@@ -7197,7 +7366,7 @@ var GqlRequestChannel = class {
 	* Registers or updates this channel on the remote server via GraphQL mutation.
 	* Returns the remote's ack ordinal so the client can trim its outbox.
 	*/
-	async touchRemoteChannel() {
+	async touchRemoteChannel(signal) {
 		let sinceTimestampUtcMs = "0";
 		try {
 			const result = await this.operationIndex.getLatestTimestampForCollection(this.config.collectionId.key);
@@ -7224,7 +7393,7 @@ var GqlRequestChannel = class {
 				},
 				sinceTimestampUtcMs,
 				...manifest ? { manifest } : {}
-			} });
+			} }, signal);
 		};
 		let data;
 		try {
@@ -7251,7 +7420,7 @@ var GqlRequestChannel = class {
 			this.isPushing = false;
 			this.pushBlocked = false;
 			this.pushFailureCount = 0;
-			if (this.connectionState === "reconnecting" || this.connectionState === "error") this.transitionConnectionState("connected");
+			if (this.polling && (this.connectionState === "reconnecting" || this.connectionState === "error")) this.transitionConnectionState(this.reachedState());
 			this.drainOutbox();
 		}).catch((error) => {
 			this.isPushing = false;
@@ -7268,7 +7437,7 @@ var GqlRequestChannel = class {
 				this.pushFailureCount++;
 				this.pushBlocked = true;
 				this.logger.error("GqlChannel push failed (attempt @FailureCount), will retry: @Error", this.pushFailureCount, err);
-				this.transitionConnectionState("reconnecting");
+				if (this.polling) this.transitionConnectionState("reconnecting");
 				this.schedulePushRetry();
 			} else {
 				const channelError = new ChannelError("outbox", err);
@@ -7342,6 +7511,7 @@ var GqlRequestChannel = class {
 				if (error.statusCode !== void 0 && error.statusCode >= 500) return "recoverable";
 				return "unrecoverable";
 			case "parse": return "recoverable";
+			case "timeout": return "recoverable";
 			case "graphql": return isRecoverableGraphQLError(error) ? "recoverable" : "unrecoverable";
 			case "missing-data": return "unrecoverable";
 		}
@@ -7361,7 +7531,7 @@ var GqlRequestChannel = class {
 			await this.executeGraphQL(pushMutation(gatedUnder !== void 0), {
 				envelopes: this.envelopesFor(syncOps),
 				...gatedUnder !== void 0 ? { peerManifestRevision: gatedUnder } : {}
-			});
+			}, void 0);
 			return;
 		} catch (error) {
 			if (gatedUnder === void 0 || !this.rejectsAgreementFields(error)) throw error;
@@ -7370,7 +7540,7 @@ var GqlRequestChannel = class {
 		const unsent = new Set(this.outbox.items);
 		const remaining = syncOps.filter((syncOp) => unsent.has(syncOp));
 		if (remaining.length === 0) return;
-		await this.executeGraphQL(pushMutation(false), { envelopes: this.envelopesFor(remaining) });
+		await this.executeGraphQL(pushMutation(false), { envelopes: this.envelopesFor(remaining) }, void 0);
 	}
 	/** One envelope per SyncOperation, with key/dependsOn for batch ordering. */
 	envelopesFor(syncOps) {
@@ -7411,36 +7581,95 @@ var GqlRequestChannel = class {
 			this.logger.error("JWT handler failed: @Error", error);
 		}
 	}
-	/**
-	* Executes a GraphQL query or mutation against the remote endpoint.
-	*/
-	async executeGraphQL(query, variables) {
+	/** Aborted by shutdown, tick cancellation or the deadline; `expired` bounds what ignores it. */
+	requestDeadline(timeoutMs, tick) {
+		const controller = new AbortController();
+		const onShutdown = () => controller.abort(this.abortController.signal.reason);
+		if (this.abortController.signal.aborted) onShutdown();
+		else this.abortController.signal.addEventListener("abort", onShutdown, { once: true });
+		let expireTick = () => void 0;
+		const onTickCancelled = () => {
+			controller.abort(tick?.reason);
+			expireTick();
+		};
+		if (tick?.aborted) onTickCancelled();
+		else tick?.addEventListener("abort", onTickCancelled, { once: true });
+		let timer;
+		const expired = new Promise((resolve) => {
+			expireTick = () => resolve();
+			if (tick?.aborted) resolve();
+			if (timeoutMs > 0) timer = setTimeout(() => {
+				controller.abort(/* @__PURE__ */ new Error("request deadline exceeded"));
+				resolve();
+			}, timeoutMs);
+		});
+		return {
+			signal: controller.signal,
+			expired,
+			timeoutMs,
+			dispose: () => {
+				if (timer !== void 0) clearTimeout(timer);
+				this.abortController.signal.removeEventListener("abort", onShutdown);
+				tick?.removeEventListener("abort", onTickCancelled);
+			}
+		};
+	}
+	/** A cancelled poll must not touch mailboxes or cursors the next poll will. */
+	throwIfPollCancelled(signal) {
+		if (signal?.aborted !== true) return;
+		const reason = signal.reason;
+		throw reason instanceof Error ? reason : /* @__PURE__ */ new Error(`poll cancelled: ${String(reason)}`);
+	}
+	async withDeadline(work, deadline, what) {
+		const timedOut = Symbol("timed-out");
+		const outcome = await Promise.race([work, deadline.expired.then(() => timedOut)]);
+		if (outcome === timedOut) throw new GraphQLRequestError(`GraphQL ${what} timed out after ${deadline.timeoutMs}ms`, "timeout");
+		return outcome;
+	}
+	/** Executes a GraphQL query or mutation against the remote endpoint. */
+	async executeGraphQL(query, variables, signal) {
 		const headers = { "Content-Type": "application/json" };
-		const authHeader = await this.getAuthorizationHeader();
-		if (authHeader) headers["Authorization"] = authHeader;
 		const operationName = query.match(/(?:query|mutation)\s+(\w+)/)?.[1] ?? "unknown";
+		const timeoutMs = this.config.requestTimeoutMs ?? 6e4;
+		const deadline = this.requestDeadline(timeoutMs, signal);
+		let authHeader;
+		try {
+			authHeader = await this.withDeadline(this.getAuthorizationHeader(), deadline, `${operationName} authorization`);
+		} catch (error) {
+			deadline.dispose();
+			throw error;
+		}
+		if (authHeader) headers["Authorization"] = authHeader;
 		this.logger.verbose("GQL request @channelId @operation @url vars=@variables", this.channelId, operationName, this.config.url, JSON.stringify(variables));
 		const fetchFn = this.config.fetchFn ?? fetch;
 		let response;
 		try {
-			response = await fetchFn(this.config.url, {
+			response = await this.withDeadline(fetchFn(this.config.url, {
 				method: "POST",
 				headers,
 				body: JSON.stringify({
 					query,
 					variables
 				}),
-				signal: this.abortController.signal
-			});
+				signal: deadline.signal
+			}), deadline, `${operationName} request`);
 		} catch (error) {
+			deadline.dispose();
+			if (error instanceof GraphQLRequestError) throw error;
 			throw new GraphQLRequestError(`GraphQL request failed: ${error instanceof Error ? error.message : String(error)}`, "network");
 		}
-		if (!response.ok) throw new GraphQLRequestError(`GraphQL request failed: ${response.status} ${response.statusText}`, "http", response.status);
+		if (!response.ok) {
+			deadline.dispose();
+			throw new GraphQLRequestError(`GraphQL request failed: ${response.status} ${response.statusText}`, "http", response.status);
+		}
 		let result;
 		try {
-			result = await response.json();
+			result = await this.withDeadline(response.json(), deadline, `${operationName} response body`);
 		} catch (error) {
+			if (error instanceof GraphQLRequestError) throw error;
 			throw new GraphQLRequestError(`Failed to parse GraphQL response: ${error instanceof Error ? error.message : String(error)}`, "parse");
+		} finally {
+			deadline.dispose();
 		}
 		this.logger.verbose("GQL response @channelId @operation status=@status data=@data errors=@errors", this.channelId, operationName, response.status, JSON.stringify(result.data), result.errors ? JSON.stringify(result.errors) : "none");
 		if (result.errors) throw new GraphQLRequestError(`GraphQL errors: ${JSON.stringify(result.errors, null, 2)}`, "graphql", void 0, result.errors.map((error) => error.extensions?.code));
@@ -7524,6 +7753,12 @@ var GqlRequestChannelFactory = class {
 		}
 		if (retryBaseDelayMs !== void 0) gqlConfig.retryBaseDelayMs = retryBaseDelayMs;
 		if (retryMaxDelayMs !== void 0) gqlConfig.retryMaxDelayMs = retryMaxDelayMs;
+		let requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS;
+		if (config.parameters.requestTimeoutMs !== void 0) {
+			if (typeof config.parameters.requestTimeoutMs !== "number") throw new Error("\"requestTimeoutMs\" parameter must be a number");
+			requestTimeoutMs = config.parameters.requestTimeoutMs;
+		}
+		gqlConfig.requestTimeoutMs = requestTimeoutMs;
 		let maxQueueDepth;
 		if (config.parameters.maxQueueDepth !== void 0) {
 			if (typeof config.parameters.maxQueueDepth !== "number") throw new Error("\"maxQueueDepth\" parameter must be a number");
@@ -7540,6 +7775,7 @@ var GqlRequestChannelFactory = class {
 			...retryMaxDelayMs !== void 0 && { retryMaxDelayMs },
 			...maxQueueDepth !== void 0 && { maxQueueDepth },
 			...backpressureCheckIntervalMs !== void 0 && { backpressureCheckIntervalMs },
+			delegateTimeoutMs: requestTimeoutMs > 0 ? Math.max(DELEGATE_TIMEOUT_FLOOR_MS, requestTimeoutMs * 6) : 0,
 			startPaused: options?.pollBehavior === "manual"
 		});
 		return new GqlRequestChannel(this.logger, remoteId, remoteName, cursorStorage, gqlConfig, operationIndex, pollTimer);
@@ -7901,7 +8137,11 @@ var KyselySyncDeadLetterStorage = class {
 			await acquirePurgeLocks(trx, [deadLetter.documentId], "shared");
 			if ((await findPurged(trx, [deadLetter.documentId])).size > 0) throw new DocumentPurgedError(deadLetter.documentId);
 			const insertable = deadLetterRecordToRow(deadLetter);
-			await trx.insertInto("sync_dead_letters").values(insertable).onConflict((oc) => oc.column("id").doNothing()).execute();
+			await trx.insertInto("sync_dead_letters").values(insertable).onConflict((oc) => oc.column("id").doUpdateSet((eb) => ({
+				error_source: eb.ref("excluded.error_source"),
+				error_message: eb.ref("excluded.error_message"),
+				error_type: eb.ref("excluded.error_type")
+			}))).execute();
 		});
 		if (signal?.aborted) throw new Error("Operation aborted");
 	}
@@ -7919,9 +8159,11 @@ var KyselySyncDeadLetterStorage = class {
 		});
 		if (signal?.aborted) throw new Error("Operation aborted");
 	}
-	async listQuarantinedDocumentIds(signal) {
+	async listQuarantinedDocumentIds(signal, exceptIds = []) {
 		if (signal?.aborted) throw new Error("Operation aborted");
-		const rows = await this.db.selectFrom("sync_dead_letters").select(["document_id", "error_type"]).distinct().execute();
+		let query = this.db.selectFrom("sync_dead_letters").select(["document_id", "error_type"]).distinct();
+		if (exceptIds.length > 0) query = query.where("id", "not in", [...exceptIds]);
+		const rows = await query.execute();
 		if (signal?.aborted) throw new Error("Operation aborted");
 		const quarantined = /* @__PURE__ */ new Set();
 		for (const row of rows) if (quarantinesDocument(row.error_type ?? "UNCLASSIFIED")) quarantined.add(row.document_id);
@@ -8672,7 +8914,7 @@ const PLAN_KEY_TO_JOB_UUID_CAP = 1e4;
 */
 function isCredentialOrNetworkError(error) {
 	if (isDriveAuthError(error)) return true;
-	return error instanceof GraphQLRequestError && error.category === "network";
+	return error instanceof GraphQLRequestError && (error.category === "network" || error.category === "timeout");
 }
 const holdKey = (documentId, branch) => `${documentId}\u0000${branch}`;
 const VERSION_CACHE_CAP = 1e4;
@@ -8719,7 +8961,10 @@ var SyncManager = class {
 	config;
 	connectionStateUnsubscribes = /* @__PURE__ */ new Map();
 	quarantinedDocumentIds = /* @__PURE__ */ new Set();
+	parkedByQuarantine = /* @__PURE__ */ new WeakSet();
 	purgedDocumentIds = /* @__PURE__ */ new Set();
+	requeuedDeadLetterIds = /* @__PURE__ */ new Map();
+	requeuesInFlight = /* @__PURE__ */ new Set();
 	purges;
 	delivery;
 	forgetDocument;
@@ -8731,6 +8976,8 @@ var SyncManager = class {
 	derivingOutboxes = 0;
 	pruneDrainDeferred = false;
 	removing = /* @__PURE__ */ new Set();
+	resets = /* @__PURE__ */ new Map();
+	queuedResets = /* @__PURE__ */ new Map();
 	lastEnqueuedJobIdByKey = /* @__PURE__ */ new Map();
 	watermark;
 	owed = /* @__PURE__ */ new Map();
@@ -9042,11 +9289,18 @@ var SyncManager = class {
 			if (stale.length > 0) remote.channel.outbox.remove(...stale);
 			const dead = remote.channel.deadLetter.items.filter((item) => item.documentId === documentId);
 			if (dead.length > 0) remote.channel.deadLetter.remove(...dead);
+			const parked = remote.channel.inbox.items.filter((item) => item.documentId === documentId && this.parkedByQuarantine.has(item));
+			for (const item of parked) {
+				this.parkedByQuarantine.delete(item);
+				item.executed();
+			}
+			if (parked.length > 0) remote.channel.inbox.remove(...parked);
 		}
 	}
 	async forgetRemote(name) {
 		this.records.delete(name);
 		this.heldKeys.delete(name);
+		for (const [id, pending] of [...this.requeuedDeadLetterIds]) if (pending.remoteName === name) this.requeuedDeadLetterIds.delete(id);
 		await this.holds.removeRemote(name);
 		await Promise.allSettled(this.markerWritesOf([name]));
 		await this.markerStorage.removeRemote(name);
@@ -9300,28 +9554,14 @@ var SyncManager = class {
 		};
 		this.remotes.set(name, remote);
 		this.records.set(name, meta);
-		await this.loadDeadLetters(remote);
-		await this.restoreReceivedMarkers(remote);
-		const unheard = [...remote.channel.inbox.items];
-		this.wireChannelCallbacks(remote);
+		const unheard = await this.wireRemote(remote);
 		try {
 			await channel.init();
 		} catch (error) {
 			await this.dropRemoteAfterFailedInit(remote, !isCredentialOrNetworkError(error));
 			throw error;
 		}
-		if (unheard.length > 0) this.handleInboxAdded(remote, unheard);
-		await this.peerUpdates.get(name);
-		this.owe(name, await this.watermarkHead());
-		const backfillController = new AbortController();
-		this.backfillAbortControllers.set(name, backfillController);
-		this.updateOutbox(remote, 0, "backfill", backfillController.signal).catch((error) => {
-			if (backfillController.signal.aborted) return;
-			this.logger.error("Backfill failed for remote @RemoteName: @Error", remote.meta.name, error instanceof Error ? error : new Error(String(error)));
-		}).finally(() => {
-			this.backfillAbortControllers.delete(name);
-			this.drainPrunes();
-		});
+		await this.activateRemote(remote, unheard, 0);
 		return remote;
 	}
 	triggerPull(name) {
@@ -9332,6 +9572,7 @@ var SyncManager = class {
 	async remove(name) {
 		const remote = this.remotes.get(name);
 		if (!remote) throw new Error(`Remote with name '${name}' does not exist`);
+		if (this.resets.has(name) || this.queuedResets.has(name)) throw new Error(`Remote with name '${name}' is being reset`);
 		this.removing.add(name);
 		this.owed.delete(name);
 		this.derivedThrough.delete(name);
@@ -9382,6 +9623,11 @@ var SyncManager = class {
 			backfillController.abort();
 			this.backfillAbortControllers.delete(name);
 		}
+		for (const [id, pending] of [...this.requeuedDeadLetterIds]) {
+			if (pending.remoteName !== name) continue;
+			const item = remote.channel.inbox.get(id);
+			if (item && this.parkedByQuarantine.has(item)) this.requeuedDeadLetterIds.delete(id);
+		}
 		try {
 			await remote.channel.shutdown();
 		} finally {
@@ -9421,6 +9667,255 @@ var SyncManager = class {
 	async receiptsStored(remoteNames) {
 		await Promise.all(this.markerWritesOf(remoteNames));
 	}
+	/** Never joins a running rebuild: it may have read state older than the request. */
+	resetChannel(remoteName) {
+		const queued = this.queuedResets.get(remoteName);
+		if (queued) return queued;
+		const running = this.resets.get(remoteName);
+		if (!running) return this.startReset(remoteName);
+		const next = running.catch(() => void 0).then(() => {
+			this.queuedResets.delete(remoteName);
+			return this.startReset(remoteName);
+		});
+		this.queuedResets.set(remoteName, next);
+		return next;
+	}
+	startReset(name) {
+		const reset = this.rebuildChannel(name).finally(() => {
+			this.resets.delete(name);
+		});
+		this.resets.set(name, reset);
+		return reset;
+	}
+	/** On failure the remote is unregistered, record kept, and can be reset again. */
+	async rebuildChannel(name) {
+		if (this.isShutdown) throw new Error("SyncManager is shutdown and cannot reset remotes");
+		if (this.removing.has(name)) throw new Error(`Remote with name '${name}' is being removed`);
+		const live = this.remotes.get(name);
+		const meta = live?.meta ?? this.records.get(name);
+		if (!meta) throw new Error(`Remote with name '${name}' does not exist`);
+		this.removing.add(name);
+		const requeued = new Set([...this.requeuedDeadLetterIds].filter(([, pending]) => pending.remoteName === name).map(([id]) => id));
+		if (live) try {
+			await this.teardownRemoteResources(live);
+		} catch (error) {
+			this.abandonReset(name, error);
+			throw error;
+		}
+		if (this.isShutdown) {
+			const error = /* @__PURE__ */ new Error("SyncManager shut down during the reset");
+			this.abandonReset(name, error);
+			throw error;
+		}
+		let channel;
+		try {
+			channel = this.channelFactory.instance(meta.id, meta.name, meta.channelConfig, this.cursorStorage, meta.collectionId, meta.filter, this.operationIndex, meta.options);
+		} catch (error) {
+			this.abandonReset(name, error);
+			throw error;
+		}
+		const fresh = {
+			meta,
+			channel
+		};
+		this.remotes.set(name, fresh);
+		if (live) this.carryParked(live, fresh, requeued);
+		let unheard;
+		try {
+			unheard = await this.wireRemote(fresh, true);
+		} catch (error) {
+			this.removing.delete(name);
+			await this.failReset(fresh, error);
+			throw error;
+		}
+		this.removing.delete(name);
+		try {
+			await channel.init();
+		} catch (error) {
+			await this.failReset(fresh, error);
+			throw error;
+		}
+		await this.activateRemote(fresh, unheard, channel.outbox.ackOrdinal);
+	}
+	/** A pushing remote never resends them, so the fresh inbox parks them again. */
+	carryParked(live, fresh, requeued) {
+		for (const item of live.channel.inbox.items) {
+			if (!this.parkedByQuarantine.has(item) || requeued.has(item.id)) continue;
+			const copy = new SyncOperation(item.id, item.jobId, item.jobDependencies, item.remoteName, item.documentId, item.scopes, item.branch, item.operations);
+			fresh.channel.inbox.add(copy);
+			fresh.channel.inbox.hold?.(copy);
+		}
+	}
+	/** Before a fresh channel is registered: nothing to tear down. */
+	abandonReset(name, error) {
+		this.logResetFailure(name, error);
+		this.remotes.delete(name);
+		this.removing.delete(name);
+	}
+	async failReset(fresh, error) {
+		this.logResetFailure(fresh.meta.name, error);
+		await this.dropRemoteAfterFailedInit(fresh, false);
+	}
+	logResetFailure(name, error) {
+		this.logger.error("Resetting remote @name failed; it stays down until reset again or restarted: @error", name, error instanceof Error ? error.message : String(error));
+	}
+	/**
+	* Restores and wires the mailboxes; returns the inbox items not yet heard.
+	* `strict` fails on a storage read rather than wiring a partial channel.
+	*/
+	async wireRemote(remote, strict = false) {
+		await this.loadDeadLetters(remote, strict);
+		await this.restoreReceivedMarkers(remote, strict);
+		const unheard = [...remote.channel.inbox.items];
+		this.wireChannelCallbacks(remote);
+		return unheard;
+	}
+	/** After init: hands over unheard items and starts the outbox backfill. */
+	async activateRemote(remote, unheard, backfillFrom) {
+		const name = remote.meta.name;
+		if (unheard.length > 0) this.handleInboxAdded(remote, unheard);
+		await this.peerUpdates.get(name);
+		this.owe(name, await this.watermarkHead());
+		const backfillController = new AbortController();
+		this.backfillAbortControllers.set(name, backfillController);
+		this.updateOutbox(remote, backfillFrom, "backfill", backfillController.signal).catch((error) => {
+			if (backfillController.signal.aborted) return;
+			this.logger.error("Backfill failed for remote @RemoteName: @Error", name, error instanceof Error ? error : new Error(String(error)));
+		}).finally(() => {
+			this.backfillAbortControllers.delete(name);
+			this.drainPrunes();
+		});
+	}
+	/** Keeps the row until the retry succeeds, so a crash cannot lose the op. */
+	async requeueDeadLetter(remoteName, id) {
+		const remote = this.getByName(remoteName);
+		if (this.requeuesInFlight.has(id) || this.requeuedDeadLetterIds.has(id) || remote.channel.inbox.get(id)) return;
+		this.requeuesInFlight.add(id);
+		try {
+			await this.requeue(remote, remoteName, id);
+		} finally {
+			this.requeuesInFlight.delete(id);
+		}
+	}
+	async requeue(remote, remoteName, id) {
+		const source = await this.findDeadLetter(remote, id);
+		if (!source) return;
+		this.assertServing(remote, id);
+		const errorSource = source instanceof SyncOperation ? source.error?.source : source.errorSource;
+		if (errorSource !== "inbox") throw new SyncRepairRefusedError(`Cannot requeue dead letter '${id}' of '${remoteName}': it failed on the ${errorSource ?? "unknown"} side, not while applying here.`);
+		const item = remote.channel.deadLetter.get(id);
+		if (item) remote.channel.deadLetter.remove(item);
+		this.requeuedDeadLetterIds.set(source.id, {
+			remoteName: remote.meta.name,
+			documentId: source.documentId
+		});
+		const lift = await this.mayLiftQuarantine(source.documentId);
+		try {
+			this.assertServing(remote, id);
+		} catch (error) {
+			this.requeuedDeadLetterIds.delete(source.id);
+			throw error;
+		}
+		const requeued = new SyncOperation(source.id, source.jobId, source.jobDependencies, source.remoteName, source.documentId, source.scopes, source.branch, source.operations);
+		remote.channel.inbox.add(requeued);
+		if (lift) this.liftQuarantine(source.documentId);
+	}
+	/** A requeue into a channel torn down meanwhile would never load. */
+	assertServing(remote, id) {
+		const name = remote.meta.name;
+		if (this.remotes.get(name) === remote && !this.removing.has(name)) return;
+		throw new SyncRepairRefusedError(`Remote '${name}' was reset or removed while requeueing dead letter '${id}'; requeue it again`);
+	}
+	async liftQuarantineIfClear(documentId) {
+		if (await this.mayLiftQuarantine(documentId)) this.liftQuarantine(documentId);
+	}
+	/** Whether the restart rule would lift it: no quarantining dead letter left. */
+	async mayLiftQuarantine(documentId) {
+		if (!this.quarantinedDocumentIds.has(documentId)) return false;
+		if (this.holdsQuarantiningDeadLetter(documentId)) return false;
+		let stored;
+		try {
+			stored = await this.storesQuarantiningDeadLetter(documentId);
+		} catch (error) {
+			this.logger.warn("Could not read dead letters for @documentId; its quarantine stays: @error", documentId, error instanceof Error ? error.message : String(error));
+			return false;
+		}
+		return !stored && this.quarantinedDocumentIds.has(documentId) && !this.holdsQuarantiningDeadLetter(documentId);
+	}
+	holdsQuarantiningDeadLetter(documentId) {
+		for (const remote of this.remotes.values()) for (const item of remote.channel.deadLetter.items) if (item.documentId === documentId && !this.requeuedDeadLetterIds.has(item.id) && quarantinesDocument(syncOperationErrorType(item.error))) return true;
+		return false;
+	}
+	/** The restart rule, less the rows kept only for a pending requeue. */
+	async storesQuarantiningDeadLetter(documentId) {
+		return (await this.deadLetterStorage.listQuarantinedDocumentIds(void 0, [...this.requeuedDeadLetterIds.keys()])).includes(documentId);
+	}
+	/** Hands the document's parked inbox items to the apply path again. */
+	liftQuarantine(documentId) {
+		if (!this.quarantinedDocumentIds.delete(documentId)) return;
+		for (const remote of this.remotes.values()) {
+			if (this.removing.has(remote.meta.name)) continue;
+			const parked = remote.channel.inbox.items.filter((item) => item.documentId === documentId && this.parkedByQuarantine.has(item)).sort((a, b) => firstOrdinalOf(a) - firstOrdinalOf(b));
+			if (parked.length === 0) continue;
+			for (const item of parked) this.parkedByQuarantine.delete(item);
+			const rounds = [];
+			const seen = /* @__PURE__ */ new Map();
+			for (const item of parked) {
+				const round = item.jobId ? seen.get(item.jobId) ?? 0 : 0;
+				if (item.jobId) seen.set(item.jobId, round + 1);
+				(rounds[round] ??= []).push(item);
+			}
+			for (const round of rounds) this.handleInboxAdded(remote, round);
+		}
+	}
+	/** A failed remove leaves a row for a later clear; the op itself is durable. */
+	async dropRequeuedDeadLetter(id, remoteName) {
+		if (this.requeuedDeadLetterIds.get(id)?.remoteName !== remoteName) return;
+		this.requeuedDeadLetterIds.delete(id);
+		const current = this.remotes.get(remoteName);
+		const reloaded = current?.channel.deadLetter.get(id);
+		if (current && reloaded) current.channel.deadLetter.remove(reloaded);
+		try {
+			await this.deadLetterStorage.remove(id);
+		} catch (error) {
+			this.logger.error("Failed to remove a requeued dead letter after its retry succeeded (@id, @error)", id, error instanceof Error ? error.message : String(error));
+		}
+	}
+	async clearDeadLetter(remoteName, id) {
+		const remote = this.getByName(remoteName);
+		const source = await this.findDeadLetter(remote, id);
+		if (!source) return;
+		await this.deadLetterStorage.remove(id);
+		for (const holder of /* @__PURE__ */ new Set([remote, this.remotes.get(remoteName)])) {
+			if (!holder) continue;
+			const item = holder.channel.deadLetter.get(id);
+			if (item) holder.channel.deadLetter.remove(item);
+			const parked = holder.channel.inbox.get(id);
+			if (parked && this.parkedByQuarantine.has(parked)) {
+				this.parkedByQuarantine.delete(parked);
+				parked.executed();
+				holder.channel.inbox.remove(parked);
+			}
+		}
+		this.requeuedDeadLetterIds.delete(id);
+		await this.liftQuarantineIfClear(source.documentId);
+	}
+	/** Live item first; else scans storage for one the capped mailbox evicted. */
+	async findDeadLetter(remote, id) {
+		const item = remote.channel.deadLetter.get(id);
+		if (item) return item;
+		let cursor = "0";
+		for (;;) {
+			const page = await this.deadLetterStorage.list(remote.meta.name, {
+				cursor,
+				limit: this.config.maxDeadLettersPerRemote
+			});
+			const match = page.results.find((record) => record.id === id);
+			if (match) return match;
+			if (!page.nextCursor) return;
+			cursor = page.nextCursor;
+		}
+	}
 	recordPlanKeyMapping(planKey, jobId) {
 		if (!this.planKeyToJobUuid.has(planKey) && this.planKeyToJobUuid.size >= PLAN_KEY_TO_JOB_UUID_CAP) {
 			const oldest = this.planKeyToJobUuid.keys().next().value;
@@ -9471,6 +9966,7 @@ var SyncManager = class {
 			if (purged.length > 0) remote.channel.deadLetter.remove(...purged);
 			const syncOps = remaining.filter((syncOp) => !purged.includes(syncOp));
 			for (const syncOp of syncOps) {
+				this.requeuedDeadLetterIds.delete(syncOp.id);
 				this.logger.error("Dead letter (@remote, @documentId, @jobId, @error, @dependencies)", remote.meta.name, syncOp.documentId, syncOp.jobId, syncOp.error?.message ?? "unknown", syncOp.jobDependencies);
 				const errorType = syncOperationErrorType(syncOp.error);
 				if (quarantinesDocument(errorType)) this.quarantinedDocumentIds.add(syncOp.documentId);
@@ -9511,7 +10007,7 @@ var SyncManager = class {
 			}
 		});
 	}
-	async loadDeadLetters(remote) {
+	async loadDeadLetters(remote, strict = false) {
 		let records;
 		try {
 			records = (await this.deadLetterStorage.list(remote.meta.name, {
@@ -9519,6 +10015,7 @@ var SyncManager = class {
 				limit: this.config.maxDeadLettersPerRemote
 			})).results;
 		} catch (error) {
+			if (strict) throw error;
 			this.logger.error("Failed to load dead letters for remote (@name, @error)", remote.meta.name, error instanceof Error ? error.message : String(error));
 			return;
 		}
@@ -9624,10 +10121,17 @@ var SyncManager = class {
 				this.storeReceivedMarker(remote, syncOp);
 				eligible.push(syncOp);
 			}
-		} else if (this.purgedDocumentIds.has(syncOp.documentId)) dropped.push(syncOp);
-		else if (!this.quarantinedDocumentIds.has(syncOp.documentId)) eligible.push(syncOp);
+		} else if (this.purgedDocumentIds.has(syncOp.documentId)) {
+			dropped.push(syncOp);
+			this.dropRequeuedDeadLetter(syncOp.id, remote.meta.name);
+		} else if (!this.quarantinedDocumentIds.has(syncOp.documentId)) eligible.push(syncOp);
+		else if (!this.requeuedDeadLetterIds.has(syncOp.id) && this.parkedCopyOf(remote, syncOp)) dropped.push(syncOp);
+		else {
+			this.parkedByQuarantine.add(syncOp);
+			remote.channel.inbox.hold?.(syncOp);
+		}
 		for (const syncOp of dropped) {
-			this.logger.debug("Dropping received operations of a purged or already-loading document (@remote, @documentId)", remote.meta.name, syncOp.documentId);
+			this.logger.debug("Dropping received operations of a purged, already-loading or already-parked document (@remote, @documentId)", remote.meta.name, syncOp.documentId);
 			syncOp.executed();
 		}
 		if (dropped.length > 0) remote.channel.inbox.remove(...dropped);
@@ -9645,6 +10149,11 @@ var SyncManager = class {
 			this.processInboxChunks(chunks);
 		}
 	}
+	parkedCopyOf(remote, syncOp) {
+		const ops = syncOp.operations.map((op) => op.operation);
+		if (ops.length === 0) return false;
+		return remote.channel.inbox.items.some((item) => item !== syncOp && this.parkedByQuarantine.has(item) && item.documentId === syncOp.documentId && item.branch === syncOp.branch && item.jobId === syncOp.jobId && ops.every((op) => item.operations.some(({ operation }) => operation.id === op.id && operation.index === op.index)));
+	}
 	/** Forgets a marker once the item loading it leaves the inbox. */
 	handleInboxRemoved(remote, syncOps) {
 		const received = this.receivedMarkers.get(remote.meta.name);
@@ -9692,12 +10201,13 @@ var SyncManager = class {
 		});
 	}
 	/** Queued before init resets latestOrdinal, so a puller is re-served above it. */
-	async restoreReceivedMarkers(remote) {
+	async restoreReceivedMarkers(remote, strict = false) {
 		const name = remote.meta.name;
 		let records;
 		try {
 			records = await this.markerStorage.list(name);
 		} catch (error) {
+			if (strict) throw error;
 			this.logger.error("Failed to load received markers for remote (@name, @error)", name, error instanceof Error ? error.message : String(error));
 			return;
 		}
@@ -9769,12 +10279,15 @@ var SyncManager = class {
 			return;
 		}
 		if (this.isShutdown) return;
+		let resolved = false;
 		if (completedJobInfo.status !== "FAILED") {
 			syncOp.executed();
 			if (carriesMarker(syncOp)) this.tombstone(syncOp.documentId);
+			resolved = true;
 		} else if (isPurgedFailure(completedJobInfo.error, syncOp.documentId)) {
 			this.tombstone(syncOp.documentId);
 			syncOp.executed();
+			resolved = true;
 		} else {
 			const errorMessage = completedJobInfo.error?.message || "Unknown error";
 			this.logger.error("Failed to apply operations from inbox (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, completedJobInfo.id, errorMessage);
@@ -9787,6 +10300,7 @@ var SyncManager = class {
 		}
 		this.markerRetries.delete(syncOp.id);
 		remote.channel.inbox.remove(syncOp);
+		if (resolved) await this.dropRequeuedDeadLetter(syncOp.id, remote.meta.name);
 	}
 	/** Reloads a marker with backoff; it stays in the inbox, not dead-lettered. */
 	retryMarker(remote, syncOp, reason) {
@@ -9816,6 +10330,7 @@ var SyncManager = class {
 			this.markerRetries.delete(syncOp.id);
 			syncOp.executed();
 			remote.channel.inbox.remove(syncOp);
+			await this.dropRequeuedDeadLetter(syncOp.id, name);
 			return;
 		}
 		await this.applyInboxJob(remote, syncOp);
@@ -9906,12 +10421,15 @@ var SyncManager = class {
 				continue;
 			}
 			if (this.isShutdown) return;
+			let resolved = false;
 			if (completedJobInfo.status !== "FAILED") {
 				syncOp.executed();
 				if (carriesMarker(syncOp)) this.tombstone(syncOp.documentId);
+				resolved = true;
 			} else if (isPurgedFailure(completedJobInfo.error, syncOp.documentId)) {
 				this.tombstone(syncOp.documentId);
 				syncOp.executed();
+				resolved = true;
 			} else if (carriesMarker(syncOp) && !isRefusedMarker(completedJobInfo.error)) {
 				this.retryMarker(remote, syncOp, completedJobInfo.error?.message || "Unknown error");
 				continue;
@@ -9920,6 +10438,7 @@ var SyncManager = class {
 				remote.channel.deadLetter.add(syncOp);
 			}
 			remote.channel.inbox.remove(syncOp);
+			if (resolved) await this.dropRequeuedDeadLetter(syncOp.id, remote.meta.name);
 		}
 	}
 	/**
@@ -10215,7 +10734,8 @@ var SyncBuilder = class {
 			deadLetterStorage,
 			holdStorage,
 			channelFactory: this.channelFactory,
-			syncManager
+			syncManager,
+			syncAdmin: syncManager
 		};
 	}
 };
@@ -10224,8 +10744,8 @@ var SyncBuilder = class {
 async function createDefaultDatabase() {
 	const { Kysely } = await import("kysely");
 	const { PGlite } = await import("@electric-sql/pglite");
-	const { PGliteDialect } = await import("kysely-pglite-dialect");
-	return new Kysely({ dialect: new PGliteDialect(new PGlite()) });
+	const { HardenedPGliteDialect } = await Promise.resolve().then(() => pglite_dialect_exports);
+	return new Kysely({ dialect: new HardenedPGliteDialect(new PGlite()) });
 }
 //#endregion
 //#region src/shared/factories.ts
@@ -11016,6 +11536,7 @@ var ReactorBuilder = class {
 		this.unsupportedStoredDocuments = mode;
 		return this;
 	}
+	/** Mutually exclusive with {@link withChannelScheme}; setting both fails the build. */
 	withSync(syncBuilder) {
 		this.syncBuilder = syncBuilder;
 		return this;
@@ -11079,6 +11600,7 @@ var ReactorBuilder = class {
 		this.queueInstance = queue;
 		return this;
 	}
+	/** Mutually exclusive with {@link withSync}; setting both fails the build. */
 	withChannelScheme(scheme) {
 		this.channelScheme = scheme;
 		return this;
@@ -11164,6 +11686,7 @@ var ReactorBuilder = class {
 			...this.executorConfig,
 			protocolSupport: localSupports(this.getPeerCapabilities(), featureFlags).protocols
 		};
+		if (this.channelScheme !== void 0 && this.syncBuilder !== void 0) throw new Error("withChannelScheme and withSync are mutually exclusive; use one (the scheme builds its own SyncBuilder)");
 		if (this.readModelCoordinator !== void 0 && this.readModelCoordinatorFactory !== void 0) throw new Error("withReadModelCoordinator and withReadModelCoordinatorFactory are mutually exclusive; register one coordinator source");
 		if (this.projectionShardConfig !== void 0 && this.readModelCoordinatorFactory !== void 0) throw new Error("withProjectionShards and withReadModelCoordinatorFactory are mutually exclusive; the factory owns the projection worker through its createProjectionShardManager dependency");
 		if (this.projectionShardConfig !== void 0 && this.readModelFactories.length > 0) throw new Error("withProjectionShards does not support read models registered through withReadModelFactory; projection workers cannot receive host-only factory dependencies");
@@ -11453,7 +11976,7 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-MRJ9BjVM.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-CQ5FwQmv.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
@@ -11498,7 +12021,7 @@ var ReactorBuilder = class {
 	*/
 	async createDefaultWorkerFactory(numWorkers, db) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-B48V1hDm.js"),
+			import("./worker-handle-CN2-oRv-.js"),
 			import("./transport-CZDHzfvy.js"),
 			Promise.resolve().then(() => worker_exports)
 		]);
@@ -12095,6 +12618,391 @@ function firstOutOfOrderPair(operations, options) {
 	}
 }
 //#endregion
+//#region src/storage/kysely/pglite-dialect.ts
+var pglite_dialect_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_LONG_STATEMENT_TIMEOUT_MS: () => DEFAULT_LONG_STATEMENT_TIMEOUT_MS,
+	DEFAULT_RECOVERY_TIMEOUT_MS: () => DEFAULT_RECOVERY_TIMEOUT_MS,
+	DEFAULT_STATEMENT_TIMEOUT_MS: () => DEFAULT_STATEMENT_TIMEOUT_MS,
+	HardenedPGliteDialect: () => HardenedPGliteDialect,
+	PGliteAbortedTransactionError: () => PGliteAbortedTransactionError,
+	PGliteAcquireTimeoutError: () => PGliteAcquireTimeoutError,
+	PGliteSessionError: () => PGliteSessionError,
+	PGliteSessionPoisonedError: () => PGliteSessionPoisonedError,
+	PGliteStatementTimeoutError: () => PGliteStatementTimeoutError,
+	isLongRunningStatement: () => isLongRunningStatement,
+	queryThroughDialect: () => queryThroughDialect
+});
+const DEFAULT_STATEMENT_TIMEOUT_MS = 12e4;
+const DEFAULT_LONG_STATEMENT_TIMEOUT_MS = 9e5;
+const DEFAULT_RECOVERY_TIMEOUT_MS = 15e3;
+const LONG_STATEMENT_PREFIXES = [
+	"vacuum",
+	"analyze",
+	"reindex",
+	"cluster",
+	"checkpoint",
+	"copy",
+	"alter ",
+	"create ",
+	"drop ",
+	"truncate",
+	"refresh "
+];
+/** Maintenance and DDL, matched on the leading keyword of the compiled SQL. */
+function isLongRunningStatement(statement) {
+	const normalized = statement.trimStart().toLowerCase();
+	return LONG_STATEMENT_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+function summarize(statement) {
+	const collapsed = statement.replace(/\s+/g, " ").trim();
+	return collapsed.length > 160 ? `${collapsed.slice(0, 160)}...` : collapsed;
+}
+/** COMMIT in an aborted transaction silently rolls back; the guard raises first. */
+const COMMIT_WITH_GUARD = "select 1 as __commit_guard; commit";
+const PROBE = "select 1 as __session_probe";
+const ABORTED_TRANSACTION_CODE = "25P02";
+var PGliteSessionError = class extends Error {
+	cause;
+	constructor(message, cause) {
+		super(message);
+		this.cause = cause;
+		this.name = "PGliteSessionError";
+	}
+};
+var PGliteAcquireTimeoutError = class extends PGliteSessionError {
+	constructor(timeoutMs) {
+		super(`Timed out after ${timeoutMs}ms waiting for the PGlite connection. The single session is held by a statement that never completed: a transaction awaiting a nested query on the base handle, or an abandoned stream iterator.`);
+		this.name = "PGliteAcquireTimeoutError";
+	}
+};
+/** The call cannot be aborted, so it is abandoned and the session treated as poisoned. */
+var PGliteStatementTimeoutError = class extends PGliteSessionError {
+	constructor(timeoutMs, statement) {
+		super(`A PGlite statement neither resolved nor rejected within ${timeoutMs}ms, so its wasm call is presumed dead and the session poisoned: ${summarize(statement)}`);
+		this.name = "PGliteStatementTimeoutError";
+	}
+};
+var PGliteAbortedTransactionError = class extends PGliteSessionError {
+	constructor(cause) {
+		super(`Refusing to report a commit for an aborted transaction: COMMIT would have been answered with a ROLLBACK tag and nothing written. Underlying error: ${errorOf(cause).message}`, cause);
+		this.name = "PGliteAbortedTransactionError";
+	}
+};
+/** No statement can clear the session (e.g. a stuck active portal). */
+var PGliteSessionPoisonedError = class extends PGliteSessionError {
+	constructor(cause) {
+		super(`The PGlite session is unrecoverable and cannot be reused; the component owning it must be restarted. Original error: ${errorOf(cause).message}`, cause);
+		this.name = "PGliteSessionPoisonedError";
+	}
+};
+function errorOf(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+const TIMED_OUT = Symbol("pglite-deadline-expired");
+/** Races a call that cannot be cancelled; on {@link TIMED_OUT} the call may still settle later. */
+async function withDeadline(pending, timeoutMs) {
+	let handle;
+	const expiry = new Promise((resolve) => {
+		handle = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+	});
+	try {
+		return await Promise.race([pending, expiry]);
+	} finally {
+		clearTimeout(handle);
+	}
+}
+function isAbortedTransactionError(error) {
+	if (error?.code === ABORTED_TRANSACTION_CODE) return true;
+	return errorOf(error).message.includes("current transaction is aborted");
+}
+/** `kysely-pglite-dialect` hardened for one shared session that a fault must not brick. */
+var HardenedPGliteDialect = class {
+	client;
+	inner;
+	options;
+	constructor(client, options = {}) {
+		this.client = client;
+		this.inner = new PGliteDialect(client);
+		this.options = {
+			acquireTimeoutMs: options.acquireTimeoutMs ?? 0,
+			statementTimeoutMs: options.statementTimeoutMs ?? 12e4,
+			longStatementTimeoutMs: options.longStatementTimeoutMs ?? 9e5,
+			recoveryTimeoutMs: options.recoveryTimeoutMs ?? 15e3,
+			onDiagnostic: options.onDiagnostic ?? ((message, error) => {
+				console.error(`[pglite-dialect] ${message}`, error);
+			}),
+			onPoisoned: options.onPoisoned ?? (() => void 0)
+		};
+	}
+	createAdapter() {
+		return this.inner.createAdapter();
+	}
+	createDriver() {
+		return new HardenedPGliteDriver(this.inner.createDriver(), this.client, this.options);
+	}
+	createQueryCompiler() {
+		return this.inner.createQueryCompiler();
+	}
+	createIntrospector(db) {
+		return this.inner.createIntrospector(db);
+	}
+};
+var HardenedPGliteConnection = class {
+	inner;
+	guard;
+	failure = void 0;
+	rollbackFailure = void 0;
+	transactionOpen = false;
+	constructor(inner, guard) {
+		this.inner = inner;
+		this.guard = guard;
+	}
+	/** Never retried: a replay could commit alone a write meant for another consumer's transaction. */
+	async executeQuery(compiledQuery) {
+		const generation = this.guard.generation;
+		try {
+			return await this.guard.runStatement(compiledQuery.sql, () => this.inner.executeQuery(compiledQuery));
+		} catch (error) {
+			this.guard.recordFailure(this, generation, error);
+			throw error;
+		}
+	}
+	streamQuery(compiledQuery, chunkSize) {
+		const inner = this.inner.streamQuery(compiledQuery, chunkSize);
+		return this.deadlinedStream(compiledQuery, inner);
+	}
+	/** Upstream issues the whole query on the first pull, so each pull is bounded like a statement. */
+	async *deadlinedStream(compiledQuery, inner) {
+		for (;;) {
+			const generation = this.guard.generation;
+			let next;
+			try {
+				next = await this.guard.runStatement(compiledQuery.sql, () => inner.next());
+			} catch (error) {
+				this.guard.recordFailure(this, generation, error);
+				throw error;
+			}
+			if (next.done === true) return;
+			yield next.value;
+		}
+	}
+	get suspect() {
+		return this.failure !== void 0 || this.rollbackFailure !== void 0 || this.transactionOpen;
+	}
+};
+var HardenedPGliteDriver = class {
+	inner;
+	client;
+	options;
+	/** Set when release could not reset the session; each acquire retries the reset. */
+	sessionFault = void 0;
+	/** Lets an abandoned call's late settlement be told apart from current failures. */
+	statementGeneration = 0;
+	/** A call abandoned at its deadline; PGlite would queue every later call behind it, so none is issued. */
+	deadCall = void 0;
+	poisonReported = false;
+	constructor(inner, client, options) {
+		this.inner = inner;
+		this.client = client;
+		this.options = options;
+	}
+	get generation() {
+		return this.statementGeneration;
+	}
+	/** Bounds one statement; an expiry is escalated as a poisoned session. */
+	async runStatement(statement, execute) {
+		if (this.deadCall !== void 0) throw new PGliteSessionPoisonedError(this.deadCall);
+		const timeoutMs = this.timeoutFor(statement);
+		if (timeoutMs <= 0) return execute();
+		const generation = this.statementGeneration;
+		const outcome = await withDeadline(execute(), timeoutMs);
+		if (outcome !== TIMED_OUT) return outcome;
+		throw this.escalateHungStatement(new PGliteStatementTimeoutError(timeoutMs, statement), generation);
+	}
+	recordFailure(connection, generation, error) {
+		if (generation === this.statementGeneration) connection.failure = errorOf(error);
+	}
+	async init() {
+		await this.inner.init();
+	}
+	async acquireConnection() {
+		const innerConnection = await this.acquireWithTimeout();
+		if (this.deadCall !== void 0) {
+			await this.inner.releaseConnection(innerConnection);
+			throw new PGliteSessionPoisonedError(this.deadCall);
+		}
+		if (this.sessionFault !== void 0) {
+			const fault = this.sessionFault;
+			let recovered = false;
+			try {
+				recovered = await this.tryRecoverSession(false);
+			} finally {
+				if (!recovered) await this.inner.releaseConnection(innerConnection);
+			}
+			if (!recovered) {
+				this.reportPoisoned(fault);
+				throw new PGliteSessionPoisonedError(fault);
+			}
+			this.sessionFault = void 0;
+		}
+		return new HardenedPGliteConnection(innerConnection, this);
+	}
+	/** Kysely never rolls back after a failed BEGIN, so an aborted session is reset here. */
+	async beginTransaction(connection, settings) {
+		const wrapper = asWrapper(connection);
+		const generation = this.statementGeneration;
+		try {
+			await this.runStatement("begin", () => this.inner.beginTransaction(wrapper.inner, settings));
+		} catch (error) {
+			this.recordFailure(wrapper, generation, error);
+			if (!isAbortedTransactionError(error)) throw error;
+			if (!await this.tryRecoverSession(false)) {
+				this.sessionFault = errorOf(error);
+				throw error;
+			}
+			const retryGeneration = this.statementGeneration;
+			try {
+				await this.runStatement("begin", () => this.inner.beginTransaction(wrapper.inner, settings));
+			} catch (retryError) {
+				this.recordFailure(wrapper, retryGeneration, retryError);
+				throw retryError;
+			}
+			wrapper.failure = void 0;
+		}
+		wrapper.transactionOpen = true;
+	}
+	async commitTransaction(connection) {
+		const wrapper = asWrapper(connection);
+		const generation = this.statementGeneration;
+		try {
+			await this.runStatement(COMMIT_WITH_GUARD, () => this.client.exec(COMMIT_WITH_GUARD));
+		} catch (error) {
+			this.recordFailure(wrapper, generation, error);
+			if (isAbortedTransactionError(error)) throw new PGliteAbortedTransactionError(error);
+			throw error;
+		}
+		wrapper.transactionOpen = false;
+		wrapper.failure = void 0;
+	}
+	/** Swallowed so the original failure propagates; release resets the session. */
+	async rollbackTransaction(connection) {
+		const wrapper = asWrapper(connection);
+		const generation = this.statementGeneration;
+		try {
+			await this.runStatement("rollback", () => this.inner.rollbackTransaction(wrapper.inner));
+			wrapper.transactionOpen = false;
+		} catch (error) {
+			if (generation === this.statementGeneration) wrapper.rollbackFailure = errorOf(error);
+			this.options.onDiagnostic("rollback failed; preserving the original failure and recovering the session on release", error);
+		}
+	}
+	async releaseConnection(connection) {
+		const wrapper = asWrapper(connection);
+		try {
+			if (wrapper.suspect && this.deadCall === void 0) {
+				if (!await this.tryRecoverSession(wrapper.transactionOpen)) {
+					this.sessionFault = wrapper.rollbackFailure ?? wrapper.failure ?? /* @__PURE__ */ new Error("session left in a transaction");
+					this.options.onDiagnostic("the PGlite session could not be reset and is being marked unrecoverable", this.sessionFault);
+				}
+			}
+		} finally {
+			await this.inner.releaseConnection(wrapper.inner);
+		}
+	}
+	async destroy() {
+		await this.inner.destroy();
+	}
+	reportPoisoned(cause) {
+		if (this.poisonReported) return;
+		this.poisonReported = true;
+		try {
+			this.options.onPoisoned(cause);
+		} catch (error) {
+			this.options.onDiagnostic("onPoisoned threw", error);
+		}
+	}
+	timeoutFor(statement) {
+		return isLongRunningStatement(statement) ? this.options.longStatementTimeoutMs : this.options.statementTimeoutMs;
+	}
+	/** Marks the session faulted once per generation; a stale expiry reports only itself. */
+	escalateHungStatement(cause, generation) {
+		if (generation !== this.statementGeneration) return cause;
+		this.statementGeneration += 1;
+		this.deadCall = cause;
+		this.reportPoisoned(cause);
+		this.options.onDiagnostic("a PGlite statement never settled within its deadline; treating the session as poisoned", cause);
+		return new PGliteSessionPoisonedError(cause);
+	}
+	/** A waiter that gave up still passes the lease on, so it cannot wedge the queue. */
+	async acquireWithTimeout() {
+		const timeoutMs = this.options.acquireTimeoutMs;
+		if (timeoutMs <= 0) return this.inner.acquireConnection();
+		let abandoned = false;
+		const pending = this.inner.acquireConnection().then((connection) => {
+			if (!abandoned) return connection;
+			this.inner.releaseConnection(connection).catch(() => void 0);
+			throw new PGliteAcquireTimeoutError(timeoutMs);
+		});
+		let handle;
+		const expiry = new Promise((_resolve, reject) => {
+			handle = setTimeout(() => {
+				abandoned = true;
+				reject(new PGliteAcquireTimeoutError(timeoutMs));
+			}, timeoutMs);
+		});
+		try {
+			return await Promise.race([pending, expiry]);
+		} finally {
+			clearTimeout(handle);
+		}
+	}
+	/** {@link recoverSession}, with a recovery that throws counted as failed. */
+	async tryRecoverSession(mustEndTransaction) {
+		try {
+			return await this.recoverSession(mustEndTransaction);
+		} catch (error) {
+			this.options.onDiagnostic("session recovery threw", error);
+			return false;
+		}
+	}
+	/** Rolls back only when told to or when the probe fails, sparing another consumer's live transaction. */
+	async recoverSession(mustEndTransaction) {
+		if (!mustEndTransaction && !this.client.isInTransaction() && await this.probeSession()) return true;
+		if (!await this.recoveryExec("rollback")) this.options.onDiagnostic("session rollback did not complete; the session stays suspect");
+		if (!await this.probeSession()) return false;
+		return !this.client.isInTransaction();
+	}
+	async probeSession() {
+		return this.recoveryExec(PROBE);
+	}
+	/** Kysely awaits release, so an unbounded recovery statement would hold the lease forever. */
+	async recoveryExec(statement) {
+		if (this.deadCall !== void 0) return false;
+		const timeoutMs = this.options.recoveryTimeoutMs;
+		const pending = this.client.exec(statement).then(() => true, (error) => {
+			this.options.onDiagnostic("recovery statement failed", error);
+			return false;
+		});
+		if (timeoutMs <= 0) return pending;
+		const outcome = await withDeadline(pending, timeoutMs);
+		if (outcome === TIMED_OUT) {
+			this.deadCall ??= new PGliteStatementTimeoutError(timeoutMs, statement);
+			this.reportPoisoned(this.deadCall);
+			this.options.onDiagnostic(`a PGlite recovery statement did not settle within ${timeoutMs}ms; the session is unrecoverable from SQL`);
+			return false;
+		}
+		return outcome;
+	}
+};
+function asWrapper(connection) {
+	if (!(connection instanceof HardenedPGliteConnection)) throw new PGliteSessionError("Connection was not created by HardenedPGliteDialect");
+	return connection;
+}
+/** Raw SQL through the dialect's queue, instead of into whatever transaction holds the session. */
+async function queryThroughDialect(db, sql, params) {
+	return [...(await db.executeQuery(CompiledQuery.raw(sql, params ?? []))).rows];
+}
+//#endregion
 //#region src/read-models/interfaces.ts
 function supportsLiveReadModelRegistration(coordinator) {
 	return "addReadModel" in coordinator && typeof coordinator.addReadModel === "function";
@@ -12248,6 +13156,6 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, BatchJobFailedError, CatchUpScheduler, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, ContiguousCursor, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_MAX_PURGE_OPERATIONS, DEFAULT_PURGE_DELETE_BATCH, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DocumentNotDeletedError, DocumentPurgeService, DocumentPurgedError, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, GroupInUseError, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, InMemorySyncHoldStorage, InMemorySyncPurgeRefusalStorage, InMemorySyncReceivedMarkerStorage, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentPurger, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncHoldStorage, KyselySyncPurgeRefusalStorage, KyselySyncReceivedMarkerStorage, KyselySyncRemoteStorage, KyselyWriteCache, MAX_POLLED_REFUSALS, Mailbox, ModelNotWorkerImportableError, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PURGE_DOCUMENT, PURGE_LOCK_BUCKETS, PURGE_NS, PollBehavior, PollingChannelError, ProbeSettler, ProcessorManager, PropagationMode, PurgeTooLargeError, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, ReservedActionError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SettledWatermark, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, UnsupportedStoredProtocolError, acquirePurgeLocks, addRelationshipAction, appliedDelete, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createKyselyWatermarkProbe, createMutableShutdownStatus, createPeerAgreement, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultCatchUpConfig, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, findPurged, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isCatchUpConsumer, isDriveAuthError, isPurgeMarker, isRecoverableGraphQLError, listPurged, loadDocumentModelSpec, makeConsistencyKey, parseDriveUrl, parsePagingOptions, parseSnapshot, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, snapshotFunctionsFor, supportsDeliveryTracking, supportsLiveReadModelRegistration, supportsPurgeRefusals, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, BatchJobFailedError, CatchUpScheduler, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, ContiguousCursor, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_LONG_STATEMENT_TIMEOUT_MS, DEFAULT_MAX_PURGE_OPERATIONS, DEFAULT_PURGE_DELETE_BATCH, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_STATEMENT_TIMEOUT_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DocumentNotDeletedError, DocumentPurgeService, DocumentPurgedError, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, GroupInUseError, HardenedPGliteDialect, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, InMemorySyncHoldStorage, InMemorySyncPurgeRefusalStorage, InMemorySyncReceivedMarkerStorage, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentPurger, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncHoldStorage, KyselySyncPurgeRefusalStorage, KyselySyncReceivedMarkerStorage, KyselySyncRemoteStorage, KyselyWriteCache, MAX_POLLED_REFUSALS, Mailbox, ModelNotWorkerImportableError, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PGliteAbortedTransactionError, PGliteAcquireTimeoutError, PGliteSessionError, PGliteSessionPoisonedError, PGliteStatementTimeoutError, PURGE_DOCUMENT, PURGE_LOCK_BUCKETS, PURGE_NS, PollBehavior, PollingChannelError, ProbeSettler, ProcessorManager, PropagationMode, PurgeTooLargeError, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, ReservedActionError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SettledWatermark, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncRepairRefusedError, SyncScopeGate, SyncStatus, SyncStatusTracker, UnsupportedStoredProtocolError, acquirePurgeLocks, addRelationshipAction, appliedDelete, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createKyselyWatermarkProbe, createMutableShutdownStatus, createPeerAgreement, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultCatchUpConfig, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, findPurged, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isCatchUpConsumer, isDriveAuthError, isLongRunningStatement, isPurgeMarker, isRecoverableGraphQLError, listPurged, loadDocumentModelSpec, makeConsistencyKey, parseDriveUrl, parsePagingOptions, parseSnapshot, quarantinesDocument, queryThroughDialect, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, snapshotFunctionsFor, supportsDeliveryTracking, supportsLiveReadModelRegistration, supportsPurgeRefusals, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
 
 //# sourceMappingURL=index.js.map