@korajs/server 0.3.3 → 0.5.0

package/dist/index.cjs

@@ -5,6 +5,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -27,34 +30,230 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// ../../node_modules/.pnpm/tsup@8.5.1_jiti@2.7.0_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl, importMetaUrl;
+var init_cjs_shims = __esm({
+  "../../node_modules/.pnpm/tsup@8.5.1_jiti@2.7.0_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/assets/cjs_shims.js"() {
+    "use strict";
+    getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+    importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+  }
+});
+
+// src/store/server-backup.ts
+var server_backup_exports = {};
+__export(server_backup_exports, {
+  buildServerBackup: () => buildServerBackup,
+  parseServerBackup: () => parseServerBackup
+});
+function encodeSection(name, content) {
+  const nameBytes = new TextEncoder().encode(name);
+  const header = new Uint8Array(8);
+  const dv = new DataView(header.buffer);
+  dv.setUint32(0, nameBytes.length, true);
+  dv.setUint32(4, content.length, true);
+  const result = new Uint8Array(header.length + nameBytes.length + content.length);
+  result.set(header, 0);
+  result.set(nameBytes, 8);
+  result.set(content, 8 + nameBytes.length);
+  return result;
+}
+function encodeJsonSection(name, data) {
+  return encodeSection(name, new TextEncoder().encode(JSON.stringify(data)));
+}
+function parseSections(data) {
+  const sections = [];
+  const dv = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  let offset = 0;
+  while (offset + 8 <= data.byteLength) {
+    const nameLen = dv.getUint32(offset, true);
+    const contentLen = dv.getUint32(offset + 4, true);
+    offset += 8;
+    if (offset + nameLen + contentLen > data.byteLength) break;
+    const name = new TextDecoder().decode(data.slice(offset, offset + nameLen));
+    offset += nameLen;
+    const content = data.slice(offset, offset + contentLen);
+    offset += contentLen;
+    sections.push({ name, content });
+  }
+  return sections;
+}
+function findSection(sections, name) {
+  for (const s of sections) {
+    if (s.name === name) return s.content;
+  }
+  return null;
+}
+function parseJsonSection(sections, name) {
+  const content = findSection(sections, name);
+  if (!content) return null;
+  return JSON.parse(new TextDecoder().decode(content));
+}
+async function computeSha256(data) {
+  const digestInput = new Uint8Array(data);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", digestInput);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function buildServerBackup(nodeId, operations2, versionVector) {
+  const sections = [];
+  let allContentForChecksum = new Uint8Array(0);
+  const addSection = (name, data) => {
+    sections.push(data);
+    const newLen = allContentForChecksum.length + data.length;
+    const combined = new Uint8Array(newLen);
+    combined.set(allContentForChecksum, 0);
+    combined.set(data, allContentForChecksum.length);
+    allContentForChecksum = combined;
+  };
+  const vvObj = {};
+  for (const [nid, seq] of versionVector) {
+    vvObj[nid] = seq;
+  }
+  addSection("version_vector", encodeJsonSection("version_vector", vvObj));
+  const opLines = `${operations2.map((op) => JSON.stringify(op)).join("\n")}
+`;
+  addSection("operations", encodeSection("operations", new TextEncoder().encode(opLines)));
+  const checksumHex = await computeSha256(allContentForChecksum);
+  const manifest = {
+    version: BACKUP_VERSION,
+    createdAt: Date.now(),
+    nodeId,
+    schemaVersion: 1,
+    operationCount: operations2.length,
+    collections: [],
+    includesRecords: false,
+    checksum: checksumHex
+  };
+  const manifestSection = encodeJsonSection("manifest", manifest);
+  const checksumSection = encodeSection("checksum", new TextEncoder().encode(checksumHex));
+  const totalLen = manifestSection.length + allContentForChecksum.length + checksumSection.length;
+  const result = new Uint8Array(totalLen);
+  let pos = 0;
+  result.set(manifestSection, pos);
+  pos += manifestSection.length;
+  result.set(allContentForChecksum, pos);
+  pos += allContentForChecksum.length;
+  result.set(checksumSection, pos);
+  return result;
+}
+function parseServerBackup(data) {
+  const sections = parseSections(data);
+  const opsContent = findSection(sections, "operations");
+  let operations2 = [];
+  if (opsContent) {
+    const text3 = new TextDecoder().decode(opsContent);
+    const lines = text3.trim().split("\n").filter((l) => l.length > 0);
+    operations2 = lines.map((line) => JSON.parse(line));
+  }
+  const vvData = parseJsonSection(sections, "version_vector");
+  const versionVector = /* @__PURE__ */ new Map();
+  if (vvData) {
+    for (const [nid, seq] of Object.entries(vvData)) {
+      versionVector.set(nid, seq);
+    }
+  }
+  return { operations: operations2, versionVector };
+}
+var BACKUP_VERSION;
+var init_server_backup = __esm({
+  "src/store/server-backup.ts"() {
+    "use strict";
+    init_cjs_shims();
+    BACKUP_VERSION = 1;
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AwarenessRelay: () => AwarenessRelay,
   ClientSession: () => ClientSession,
   HttpServerTransport: () => HttpServerTransport,
   KoraAuthProvider: () => KoraAuthProvider,
   KoraSyncServer: () => KoraSyncServer,
   MemoryServerStore: () => MemoryServerStore,
+  MixedAuthProvider: () => MixedAuthProvider,
   NoAuthProvider: () => NoAuthProvider,
   PostgresServerStore: () => PostgresServerStore,
   SqliteServerStore: () => SqliteServerStore,
   TokenAuthProvider: () => TokenAuthProvider,
   WsServerTransport: () => WsServerTransport,
+  createDefaultLogger: () => createDefaultLogger,
+  createJsonLogger: () => createJsonLogger,
   createKoraServer: () => createKoraServer,
   createPostgresServerStore: () => createPostgresServerStore,
+  createPrettyLogger: () => createPrettyLogger,
   createProductionServer: () => createProductionServer,
+  createSilentLogger: () => createSilentLogger,
   createSqliteServerStore: () => createSqliteServerStore
 });
 module.exports = __toCommonJS(index_exports);
+init_cjs_shims();
 
-// ../../node_modules/.pnpm/tsup@8.5.1_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/assets/cjs_shims.js
-var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
-var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+// src/logging/structured-logger.ts
+init_cjs_shims();
+function defaultJsonSerializer(entry) {
+  return JSON.stringify(entry);
+}
+function defaultPrettySerializer(entry) {
+  const time = new Date(entry.timestamp).toISOString().slice(11, 23);
+  const levelTag = { info: " INFO", warn: " WARN", error: "ERROR" }[entry.level];
+  const node = entry.nodeId ? ` [${entry.nodeId.slice(0, 8)}]` : "";
+  const session = entry.sessionId ? ` [session:${entry.sessionId.slice(0, 8)}]` : "";
+  const dur = entry.duration !== void 0 ? ` +${entry.duration}ms` : "";
+  const count3 = entry.count !== void 0 ? ` (${entry.count})` : "";
+  const err = entry.error ? ` \u2014 ${entry.error}` : "";
+  return `${time} ${levelTag}${node}${session} ${entry.event}${count3}${dur}${err}`;
+}
+function createJsonLogger(writer) {
+  const out = writer ?? {
+    info: (s) => process.stdout.write(`${s}
+`),
+    error: (s) => process.stderr.write(`${s}
+`)
+  };
+  return {
+    log(entry) {
+      const line = defaultJsonSerializer(entry);
+      if (entry.level === "error") {
+        out.error(line);
+      } else {
+        out.info(line);
+      }
+    }
+  };
+}
+function createPrettyLogger(writer) {
+  const out = writer ?? { write: (s) => process.stdout.write(`${s}
+`) };
+  return {
+    log(entry) {
+      out.write(defaultPrettySerializer(entry));
+    }
+  };
+}
+function createSilentLogger() {
+  return { log() {
+  } };
+}
+function createDefaultLogger() {
+  switch (process.env.NODE_ENV) {
+    case "production":
+      return createJsonLogger();
+    case "test":
+      return createSilentLogger();
+    default:
+      return createPrettyLogger();
+  }
+}
 
 // src/store/memory-server-store.ts
+init_cjs_shims();
 var import_core = require("@korajs/core");
 
 // src/store/materialization.ts
+init_cjs_shims();
 function fieldTypeToSql(descriptor, dialect) {
   switch (descriptor.kind) {
     case "string":
@@ -116,9 +315,7 @@ ALTER TABLE ${name} ADD COLUMN ${colDef}`);
       `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${name} (${indexField})`
     );
   }
-  statements.push(
-    `CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${name} (_deleted)`
-  );
+  statements.push(`CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${name} (_deleted)`);
   return statements;
 }
 function generateAllCollectionDDL(schema, dialect) {
@@ -212,6 +409,9 @@ var MemoryServerStore = class {
   getNodeId() {
     return this.nodeId;
   }
+  getSchema() {
+    return this.schema;
+  }
   async setSchema(schema) {
     this.assertOpen();
     this.schema = schema;
@@ -233,7 +433,7 @@ var MemoryServerStore = class {
     if (op.sequenceNumber > currentSeq) {
       this.versionVector.set(op.nodeId, op.sequenceNumber);
     }
-    if (this.schema && this.schema.collections[op.collection]) {
+    if (this.schema?.collections[op.collection]) {
       this.rebuildMaterializedRecord(op.collection, op.recordId);
     }
     return "applied";
@@ -250,7 +450,7 @@ var MemoryServerStore = class {
   }
   async materializeCollection(collection) {
     this.assertOpen();
-    if (this.schema && this.schema.collections[collection]) {
+    if (this.schema?.collections[collection]) {
       return this.queryCollection(collection);
     }
     return this.materializeFromOps(collection);
@@ -259,13 +459,14 @@ var MemoryServerStore = class {
     this.assertOpen();
     this.assertSchema();
     this.assertCollection(collection);
+    const schema = this.schema;
     if (options?.where) {
       for (const key of Object.keys(options.where)) {
-        validateFieldName(collection, key, this.schema);
+        validateFieldName(collection, key, schema);
       }
     }
     if (options?.orderBy) {
-      validateFieldName(collection, options.orderBy, this.schema);
+      validateFieldName(collection, options.orderBy, schema);
     }
     const collectionMap = this.materializedRecords.get(collection);
     if (!collectionMap) return [];
@@ -332,9 +533,10 @@ var MemoryServerStore = class {
     this.assertOpen();
     this.assertSchema();
     this.assertCollection(collection);
+    const schema = this.schema;
     if (where) {
       for (const key of Object.keys(where)) {
-        validateFieldName(collection, key, this.schema);
+        validateFieldName(collection, key, schema);
       }
     }
     const collectionMap = this.materializedRecords.get(collection);
@@ -359,6 +561,49 @@ var MemoryServerStore = class {
   async close() {
     this.closed = true;
   }
+  /**
+   * Wipes all in-memory state. For tests and E2E isolation only.
+   */
+  resetForTests() {
+    this.assertOpen();
+    this.operations.length = 0;
+    this.operationIndex.clear();
+    this.versionVector.clear();
+    this.materializedRecords.clear();
+    this.schema = null;
+  }
+  async exportBackup() {
+    this.assertOpen();
+    const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
+    return buildServerBackup2(this.nodeId, this.operations, this.versionVector);
+  }
+  async importBackup(data, merge) {
+    this.assertOpen();
+    const { parseServerBackup: parseServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
+    const { operations: operations2, versionVector } = parseServerBackup2(data);
+    if (merge) {
+      let restored = 0;
+      for (const op of operations2) {
+        const result = await this.applyRemoteOperation(op);
+        if (result === "applied") restored++;
+      }
+      return { operationsRestored: restored, success: true };
+    }
+    this.operations.length = 0;
+    this.operationIndex.clear();
+    this.versionVector.clear();
+    for (const [nid, seq] of versionVector) {
+      this.versionVector.set(nid, seq);
+    }
+    for (const op of operations2) {
+      this.operations.push(op);
+      this.operationIndex.set(op.id, op);
+      if (this.schema?.collections[op.collection]) {
+        this.rebuildMaterializedRecord(op.collection, op.recordId);
+      }
+    }
+    return { operationsRestored: operations2.length, success: true };
+  }
   // --- Testing helpers (not on interface) ---
   /**
    * Get all stored operations (for test assertions).
@@ -370,7 +615,7 @@ var MemoryServerStore = class {
   // Materialization internals
   // ---------------------------------------------------------------------------
   rebuildMaterializedRecord(collection, recordId) {
-    const collectionDef = this.schema.collections[collection];
+    const collectionDef = this.schema?.collections[collection];
     if (!collectionDef) return;
     let collectionMap = this.materializedRecords.get(collection);
     if (!collectionMap) {
@@ -378,8 +623,10 @@ var MemoryServerStore = class {
       this.materializedRecords.set(collection, collectionMap);
     }
     const recordOps = this.operations.filter((op) => op.collection === collection && op.recordId === recordId).sort((a, b) => {
-      if (a.timestamp.wallTime !== b.timestamp.wallTime) return a.timestamp.wallTime - b.timestamp.wallTime;
-      if (a.timestamp.logical !== b.timestamp.logical) return a.timestamp.logical - b.timestamp.logical;
+      if (a.timestamp.wallTime !== b.timestamp.wallTime)
+        return a.timestamp.wallTime - b.timestamp.wallTime;
+      if (a.timestamp.logical !== b.timestamp.logical)
+        return a.timestamp.logical - b.timestamp.logical;
       return a.sequenceNumber - b.sequenceNumber;
     });
     const parsedOps = recordOps.map((op) => ({
@@ -431,8 +678,10 @@ var MemoryServerStore = class {
   // ---------------------------------------------------------------------------
   materializeFromOps(collection) {
     const collectionOps = this.operations.filter((op) => op.collection === collection).sort((a, b) => {
-      if (a.timestamp.wallTime !== b.timestamp.wallTime) return a.timestamp.wallTime - b.timestamp.wallTime;
-      if (a.timestamp.logical !== b.timestamp.logical) return a.timestamp.logical - b.timestamp.logical;
+      if (a.timestamp.wallTime !== b.timestamp.wallTime)
+        return a.timestamp.wallTime - b.timestamp.wallTime;
+      if (a.timestamp.logical !== b.timestamp.logical)
+        return a.timestamp.logical - b.timestamp.logical;
       return a.sequenceNumber - b.sequenceNumber;
     });
     const records = /* @__PURE__ */ new Map();
@@ -478,19 +727,22 @@ var MemoryServerStore = class {
     }
   }
   assertCollection(collection) {
-    if (!this.schema.collections[collection]) {
+    const schema = this.schema;
+    if (!schema.collections[collection]) {
       throw new Error(
-        `Unknown collection "${collection}". Available: ${Object.keys(this.schema.collections).join(", ")}`
+        `Unknown collection "${collection}". Available: ${Object.keys(schema.collections).join(", ")}`
       );
     }
   }
 };
 
 // src/store/postgres-server-store.ts
+init_cjs_shims();
 var import_core2 = require("@korajs/core");
 var import_drizzle_orm = require("drizzle-orm");
 
 // src/store/drizzle-pg-schema.ts
+init_cjs_shims();
 var import_pg_core = require("drizzle-orm/pg-core");
 var pgOperations = (0, import_pg_core.pgTable)(
   "operations",
@@ -545,6 +797,9 @@ var PostgresServerStore = class {
   getNodeId() {
     return this.nodeId;
   }
+  getSchema() {
+    return this.schema;
+  }
   async setSchema(schema) {
     this.assertOpen();
     await this.ready;
@@ -590,7 +845,7 @@ var PostgresServerStore = class {
           lastSeenAt: import_drizzle_orm.sql`${now}`
         }
       });
-      if (this.schema && this.schema.collections[op.collection]) {
+      if (this.schema?.collections[op.collection]) {
         await this.rebuildMaterializedRecord(tx, op.collection, op.recordId);
       }
     });
@@ -604,10 +859,7 @@ var PostgresServerStore = class {
     this.assertOpen();
     await this.ready;
     const rows = await this.db.select().from(pgOperations).where(
-      (0, import_drizzle_orm.and)(
-        (0, import_drizzle_orm.eq)(pgOperations.nodeId, nodeId),
-        (0, import_drizzle_orm.between)(pgOperations.sequenceNumber, fromSeq, toSeq)
-      )
+      (0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(pgOperations.nodeId, nodeId), (0, import_drizzle_orm.between)(pgOperations.sequenceNumber, fromSeq, toSeq))
     ).orderBy((0, import_drizzle_orm.asc)(pgOperations.sequenceNumber));
     return rows.map((row) => this.deserializeOperation(row));
   }
@@ -620,7 +872,7 @@ var PostgresServerStore = class {
   async materializeCollection(collection) {
     this.assertOpen();
     await this.ready;
-    if (this.schema && this.schema.collections[collection]) {
+    if (this.schema?.collections[collection]) {
       return this.queryCollection(collection);
     }
     return this.materializeFromOpsLog(collection);
@@ -630,14 +882,15 @@ var PostgresServerStore = class {
     await this.ready;
     this.assertSchema();
     this.assertCollection(collection);
-    const collectionDef = this.schema.collections[collection];
+    const schema = this.schema;
+    const collectionDef = schema.collections[collection];
     if (options?.where) {
       for (const key of Object.keys(options.where)) {
-        validateFieldName(collection, key, this.schema);
+        validateFieldName(collection, key, schema);
       }
     }
     if (options?.orderBy) {
-      validateFieldName(collection, options.orderBy, this.schema);
+      validateFieldName(collection, options.orderBy, schema);
     }
     const query = this.buildSelectQuery(collection, options);
     const rows = await this.db.execute(query);
@@ -648,7 +901,8 @@ var PostgresServerStore = class {
     await this.ready;
     this.assertSchema();
     this.assertCollection(collection);
-    const collectionDef = this.schema.collections[collection];
+    const schema = this.schema;
+    const collectionDef = schema.collections[collection];
     const query = import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw(collection)} WHERE id = ${id} AND _deleted = 0`;
     const rows = await this.db.execute(query);
     if (rows.length === 0) return null;
@@ -659,9 +913,10 @@ var PostgresServerStore = class {
     await this.ready;
     this.assertSchema();
     this.assertCollection(collection);
+    const schema = this.schema;
     if (where) {
       for (const key of Object.keys(where)) {
-        validateFieldName(collection, key, this.schema);
+        validateFieldName(collection, key, schema);
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false);
@@ -673,6 +928,45 @@ var PostgresServerStore = class {
   async close() {
     this.closed = true;
   }
+  async exportBackup() {
+    this.assertOpen();
+    await this.ready;
+    const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
+    const rows = await this.db.select().from(pgOperations).orderBy((0, import_drizzle_orm.asc)(pgOperations.sequenceNumber));
+    const operations2 = rows.map((row) => this.deserializeOperation(row));
+    return buildServerBackup2(this.nodeId, operations2, this.versionVector);
+  }
+  async importBackup(data, merge) {
+    this.assertOpen();
+    await this.ready;
+    const { parseServerBackup: parseServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
+    const { operations: operations2, versionVector } = parseServerBackup2(data);
+    if (merge) {
+      let restored = 0;
+      for (const op of operations2) {
+        const result = await this.applyRemoteOperation(op);
+        if (result === "applied") restored++;
+      }
+      return { operationsRestored: restored, success: true };
+    }
+    const now = Date.now();
+    await this.db.transaction(async (tx) => {
+      await tx.delete(pgOperations);
+      await tx.delete(pgSyncState);
+      for (const [nid, seq] of versionVector) {
+        await tx.insert(pgSyncState).values({ nodeId: nid, maxSequenceNumber: seq, lastSeenAt: now }).onConflictDoNothing({ target: pgSyncState.nodeId });
+      }
+      for (const op of operations2) {
+        const row = this.serializeOperation(op, now);
+        await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
+      }
+    });
+    this.versionVector.clear();
+    for (const [nid, seq] of versionVector) {
+      this.versionVector.set(nid, seq);
+    }
+    return { operationsRestored: operations2.length, success: true };
+  }
   // ---------------------------------------------------------------------------
   // Materialization internals
   // ---------------------------------------------------------------------------
@@ -681,18 +975,13 @@ var PostgresServerStore = class {
    * all operations for that record.
    */
   async rebuildMaterializedRecord(txOrDb, collection, recordId) {
-    const collectionDef = this.schema.collections[collection];
+    const collectionDef = this.schema?.collections[collection];
     if (!collectionDef) return;
     const ops = await txOrDb.select({
       type: pgOperations.type,
       data: pgOperations.data,
       wallTime: pgOperations.wallTime
-    }).from(pgOperations).where(
-      (0, import_drizzle_orm.and)(
-        (0, import_drizzle_orm.eq)(pgOperations.collection, collection),
-        (0, import_drizzle_orm.eq)(pgOperations.recordId, recordId)
-      )
-    ).orderBy(
+    }).from(pgOperations).where((0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(pgOperations.collection, collection), (0, import_drizzle_orm.eq)(pgOperations.recordId, recordId))).orderBy(
       (0, import_drizzle_orm.asc)(pgOperations.wallTime),
       (0, import_drizzle_orm.asc)(pgOperations.logical),
       (0, import_drizzle_orm.asc)(pgOperations.sequenceNumber)
@@ -762,7 +1051,7 @@ var PostgresServerStore = class {
    * Backfill a single collection's materialized table from operations.
    */
   async backfillCollection(collectionName) {
-    const collectionDef = this.schema.collections[collectionName];
+    const collectionDef = this.schema?.collections[collectionName];
     if (!collectionDef) return;
     const allOps = await this.db.select({
       recordId: pgOperations.recordId,
@@ -819,9 +1108,7 @@ var PostgresServerStore = class {
       options?.where ?? {},
       options?.includeDeleted ?? false
     );
-    const parts = [
-      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw(collection)} WHERE ${whereClause}`
-    ];
+    const parts = [import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw(collection)} WHERE ${whereClause}`];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
       parts.push(import_drizzle_orm.sql.raw(` ORDER BY ${options.orderBy} ${dir}`));
@@ -934,12 +1221,8 @@ var PostgresServerStore = class {
     await this.db.execute(
       import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)`
     );
-    await this.db.execute(
-      import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)`
-    );
-    await this.db.execute(
-      import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_received ON operations (received_at)`
-    );
+    await this.db.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)`);
+    await this.db.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_received ON operations (received_at)`);
     await this.db.execute(
       import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection_record ON operations (collection, record_id)`
     );
@@ -1007,9 +1290,10 @@ var PostgresServerStore = class {
     }
   }
   assertCollection(collection) {
-    if (!this.schema.collections[collection]) {
+    const schema = this.schema;
+    if (!schema.collections[collection]) {
       throw new Error(
-        `Unknown collection "${collection}". Available: ${Object.keys(this.schema.collections).join(", ")}`
+        `Unknown collection "${collection}". Available: ${Object.keys(schema.collections).join(", ")}`
       );
     }
   }
@@ -1037,11 +1321,13 @@ async function loadPostgresDeps() {
 }
 
 // src/store/sqlite-server-store.ts
+init_cjs_shims();
 var import_node_module = require("module");
 var import_core3 = require("@korajs/core");
 var import_drizzle_orm2 = require("drizzle-orm");
 
 // src/store/drizzle-schema.ts
+init_cjs_shims();
 var import_sqlite_core = require("drizzle-orm/sqlite-core");
 var operations = (0, import_sqlite_core.sqliteTable)(
   "operations",
@@ -1100,6 +1386,9 @@ var SqliteServerStore = class {
   getNodeId() {
     return this.nodeId;
   }
+  getSchema() {
+    return this.schema;
+  }
   async setSchema(schema) {
     this.assertOpen();
     this.schema = schema;
@@ -1142,7 +1431,7 @@ var SqliteServerStore = class {
           lastSeenAt: import_drizzle_orm2.sql`${now}`
         }
       }).run();
-      if (this.schema && this.schema.collections[op.collection]) {
+      if (this.schema?.collections[op.collection]) {
         this.rebuildMaterializedRecord(tx, op.collection, op.recordId);
       }
       return "applied";
@@ -1161,7 +1450,7 @@ var SqliteServerStore = class {
   }
   async materializeCollection(collection) {
     this.assertOpen();
-    if (this.schema && this.schema.collections[collection]) {
+    if (this.schema?.collections[collection]) {
       return this.queryCollection(collection);
     }
     return this.materializeFromOpsLog(collection);
@@ -1170,14 +1459,15 @@ var SqliteServerStore = class {
     this.assertOpen();
     this.assertSchema();
     this.assertCollection(collection);
-    const collectionDef = this.schema.collections[collection];
+    const schema = this.schema;
+    const collectionDef = schema.collections[collection];
     if (options?.where) {
       for (const key of Object.keys(options.where)) {
-        validateFieldName(collection, key, this.schema);
+        validateFieldName(collection, key, schema);
       }
     }
     if (options?.orderBy) {
-      validateFieldName(collection, options.orderBy, this.schema);
+      validateFieldName(collection, options.orderBy, schema);
     }
     const query = this.buildSelectQuery(collection, options);
     const rows = this.db.all(query);
@@ -1187,7 +1477,8 @@ var SqliteServerStore = class {
     this.assertOpen();
     this.assertSchema();
     this.assertCollection(collection);
-    const collectionDef = this.schema.collections[collection];
+    const schema = this.schema;
+    const collectionDef = schema.collections[collection];
     const query = import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE id = ${id} AND _deleted = 0`;
     const rows = this.db.all(query);
     if (rows.length === 0) return null;
@@ -1197,9 +1488,10 @@ var SqliteServerStore = class {
     this.assertOpen();
     this.assertSchema();
     this.assertCollection(collection);
+    const schema = this.schema;
     if (where) {
       for (const key of Object.keys(where)) {
-        validateFieldName(collection, key, this.schema);
+        validateFieldName(collection, key, schema);
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false);
@@ -1210,6 +1502,39 @@ var SqliteServerStore = class {
   async close() {
     this.closed = true;
   }
+  async exportBackup() {
+    this.assertOpen();
+    const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
+    const rows = this.db.select().from(operations).all();
+    const deserialized = rows.map((row) => this.deserializeOperation(row));
+    const vv = this.getVersionVector();
+    return buildServerBackup2(this.nodeId, deserialized, vv);
+  }
+  async importBackup(data, merge) {
+    this.assertOpen();
+    const { parseServerBackup: parseServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
+    const { operations: ops, versionVector } = parseServerBackup2(data);
+    if (merge) {
+      let restored = 0;
+      for (const op of ops) {
+        const result = await this.applyRemoteOperation(op);
+        if (result === "applied") restored++;
+      }
+      return { operationsRestored: restored, success: true };
+    }
+    this.db.transaction((tx) => {
+      tx.run(import_drizzle_orm2.sql.raw("DELETE FROM operations"));
+      tx.run(import_drizzle_orm2.sql.raw("DELETE FROM sync_state"));
+      for (const [nid, seq] of versionVector) {
+        tx.insert(syncState).values({ nodeId: nid, maxSequenceNumber: seq, lastSeenAt: Date.now() }).run();
+      }
+      for (const op of ops) {
+        const row = this.serializeOperation(op, Date.now());
+        tx.insert(operations).values(row).run();
+      }
+    });
+    return { operationsRestored: ops.length, success: true };
+  }
   // ---------------------------------------------------------------------------
   // Materialization internals
   // ---------------------------------------------------------------------------
@@ -1219,18 +1544,13 @@ var SqliteServerStore = class {
    * transaction for atomic dual-write.
    */
   rebuildMaterializedRecord(txOrDb, collection, recordId) {
-    const collectionDef = this.schema.collections[collection];
+    const collectionDef = this.schema?.collections[collection];
     if (!collectionDef) return;
     const ops = txOrDb.select({
       type: operations.type,
       data: operations.data,
       wallTime: operations.wallTime
-    }).from(operations).where(
-      (0, import_drizzle_orm2.and)(
-        (0, import_drizzle_orm2.eq)(operations.collection, collection),
-        (0, import_drizzle_orm2.eq)(operations.recordId, recordId)
-      )
-    ).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.sequenceNumber)).all();
+    }).from(operations).where((0, import_drizzle_orm2.and)((0, import_drizzle_orm2.eq)(operations.collection, collection), (0, import_drizzle_orm2.eq)(operations.recordId, recordId))).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.sequenceNumber)).all();
     const parsedOps = ops.map((op) => ({
       type: op.type,
       data: op.data !== null ? JSON.parse(op.data) : null
@@ -1299,7 +1619,7 @@ var SqliteServerStore = class {
    * Backfill a single collection's materialized table from operations.
    */
   backfillCollection(collectionName) {
-    const collectionDef = this.schema.collections[collectionName];
+    const collectionDef = this.schema?.collections[collectionName];
     if (!collectionDef) return;
     const allOps = this.db.select({
       recordId: operations.recordId,
@@ -1354,9 +1674,7 @@ var SqliteServerStore = class {
       options?.where ?? {},
       options?.includeDeleted ?? false
     );
-    const parts = [
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE ${whereClause}`
-    ];
+    const parts = [import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE ${whereClause}`];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
       parts.push(import_drizzle_orm2.sql.raw(` ORDER BY ${options.orderBy} ${dir}`));
@@ -1531,9 +1849,10 @@ var SqliteServerStore = class {
     }
   }
   assertCollection(collection) {
-    if (!this.schema.collections[collection]) {
+    const schema = this.schema;
+    if (!schema.collections[collection]) {
       throw new Error(
-        `Unknown collection "${collection}". Available: ${Object.keys(this.schema.collections).join(", ")}`
+        `Unknown collection "${collection}". Available: ${Object.keys(schema.collections).join(", ")}`
       );
     }
   }
@@ -1549,6 +1868,7 @@ function createSqliteServerStore(options) {
 }
 
 // src/transport/http-server-transport.ts
+init_cjs_shims();
 var import_core4 = require("@korajs/core");
 var HttpServerTransport = class {
   serializer;
@@ -1630,6 +1950,7 @@ var HttpServerTransport = class {
 };
 
 // src/transport/ws-server-transport.ts
+init_cjs_shims();
 var import_core5 = require("@korajs/core");
 var import_sync = require("@korajs/sync");
 var WS_OPEN = 1;
@@ -1693,11 +2014,220 @@ var WsServerTransport = class {
 };
 
 // src/session/client-session.ts
-var import_core6 = require("@korajs/core");
+init_cjs_shims();
+var import_core8 = require("@korajs/core");
 var import_internal = require("@korajs/core/internal");
 var import_sync2 = require("@korajs/sync");
 
+// src/apply/apply-server-operation.ts
+init_cjs_shims();
+var import_merge2 = require("@korajs/merge");
+
+// src/constraints/operation-constraint-validator.ts
+init_cjs_shims();
+var import_merge = require("@korajs/merge");
+
+// src/constraints/server-constraint-context.ts
+init_cjs_shims();
+function createServerConstraintContext(store) {
+  return {
+    async queryRecords(collection, where) {
+      const rows = await store.queryCollection(collection, { where });
+      return rows.map((row) => ({ ...row }));
+    },
+    async countRecords(collection, where) {
+      return store.countCollection(collection, where);
+    }
+  };
+}
+
+// src/constraints/operation-constraint-validator.ts
+async function validateIncomingOperationConstraints(store, op, schema) {
+  if (!schema) {
+    return { valid: true };
+  }
+  if (op.type === "delete") {
+    return { valid: true };
+  }
+  const collectionDef = schema.collections[op.collection];
+  if (!collectionDef || collectionDef.constraints.length === 0) {
+    return { valid: true };
+  }
+  const candidate = await projectCandidateRecord(store, op);
+  if (candidate === null) {
+    return { valid: true };
+  }
+  const ctx = createServerConstraintContext(store);
+  const violations = await (0, import_merge.checkConstraints)(
+    candidate,
+    op.recordId,
+    op.collection,
+    collectionDef,
+    ctx
+  );
+  if (violations.length === 0) {
+    return { valid: true };
+  }
+  const first = violations[0];
+  if (first === void 0) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    code: "CONSTRAINT_VIOLATION",
+    message: first.message
+  };
+}
+async function projectCandidateRecord(store, op) {
+  if (op.data === null) {
+    return null;
+  }
+  const existing = await store.findRecord(op.collection, op.recordId);
+  const base = existing ? { ...existing } : {};
+  if (op.type === "insert") {
+    return { ...op.data, id: op.recordId };
+  }
+  return { ...base, ...op.data, id: op.recordId };
+}
+
+// src/constraints/server-referential-context.ts
+init_cjs_shims();
+function createServerReferentialContext(store) {
+  return {
+    async queryRecords(collection, where) {
+      const rows = await store.queryCollection(collection, { where });
+      return rows.map((row) => ({ ...row }));
+    },
+    async recordExists(collection, recordId) {
+      const row = await store.findRecord(collection, recordId);
+      return row !== null && row._deleted !== 1;
+    }
+  };
+}
+
+// src/apply/server-side-effect-operation.ts
+init_cjs_shims();
+var import_core6 = require("@korajs/core");
+async function createServerSideEffectOperation(store, parentOp, effect, schemaVersion, sequenceNumber) {
+  const nodeId = store.getNodeId();
+  const clock = new import_core6.HybridLogicalClock(nodeId);
+  clock.receive(parentOp.timestamp);
+  return (0, import_core6.createOperation)(
+    {
+      nodeId,
+      type: effect.type === "delete" ? "delete" : "update",
+      collection: effect.collection,
+      recordId: effect.recordId,
+      data: effect.data,
+      previousData: effect.previousData,
+      sequenceNumber,
+      causalDeps: [parentOp.id],
+      schemaVersion
+    },
+    clock
+  );
+}
+function nextServerSequenceNumber(store) {
+  const nodeId = store.getNodeId();
+  const current = store.getVersionVector().get(nodeId) ?? 0;
+  return current + 1;
+}
+
+// src/apply/apply-server-operation.ts
+async function applyServerOperation(store, op, relationLookup) {
+  const schema = store.getSchema();
+  const lookup = relationLookup ?? (schema ? (0, import_merge2.buildMergeRelationLookup)(schema) : /* @__PURE__ */ new Map());
+  const constraintCheck = await validateIncomingOperationConstraints(store, op, schema);
+  if (!constraintCheck.valid) {
+    return {
+      result: "skipped",
+      appliedOperations: [],
+      rejection: {
+        code: constraintCheck.code ?? "CONSTRAINT_VIOLATION",
+        message: constraintCheck.message ?? `Operation "${op.id}" violates a schema constraint`
+      }
+    };
+  }
+  if (op.type === "delete" && schema) {
+    const refCtx = createServerReferentialContext(store);
+    const referential = await (0, import_merge2.checkReferentialIntegrityOnDelete)(op, schema, refCtx, lookup);
+    if (!referential.allowed) {
+      return {
+        result: "skipped",
+        appliedOperations: [],
+        rejection: {
+          code: "REFERENTIAL_INTEGRITY",
+          message: `Operation "${op.id}" violates referential integrity on "${op.collection}"`
+        }
+      };
+    }
+    const primaryResult = await store.applyRemoteOperation(op);
+    if (primaryResult !== "applied") {
+      return { result: primaryResult, appliedOperations: [] };
+    }
+    const appliedOperations = [op];
+    let serverSeq = nextServerSequenceNumber(store);
+    for (const effect of referential.sideEffectOps) {
+      const sideOp = await createServerSideEffectOperation(
+        store,
+        op,
+        effect,
+        op.schemaVersion,
+        serverSeq
+      );
+      serverSeq += 1;
+      const sideResult = await store.applyRemoteOperation(sideOp);
+      if (sideResult === "applied") {
+        appliedOperations.push(sideOp);
+      }
+    }
+    return { result: "applied", appliedOperations };
+  }
+  const result = await store.applyRemoteOperation(op);
+  return {
+    result,
+    appliedOperations: result === "applied" ? [op] : []
+  };
+}
+
+// src/scopes/resolve-session-scopes.ts
+init_cjs_shims();
+var import_core7 = require("@korajs/core");
+function resolveSessionScopes(schema, options) {
+  const { handshakeScope, authScopes, scopeValues } = options;
+  let resolved;
+  if (schema && scopeValues && Object.keys(scopeValues).length > 0) {
+    resolved = (0, import_core7.buildScopeMap)(schema, scopeValues);
+  } else if (handshakeScope) {
+    resolved = { ...handshakeScope };
+  } else if (authScopes) {
+    resolved = { ...authScopes };
+  }
+  if (schema && !resolved && scopeValues) {
+    resolved = (0, import_core7.buildScopeMap)(schema, scopeValues);
+  }
+  if (authScopes) {
+    resolved = mergeScopeMaps(resolved, authScopes, "auth");
+  }
+  if (handshakeScope) {
+    resolved = mergeScopeMaps(resolved, handshakeScope, "handshake");
+  }
+  return resolved && Object.keys(resolved).length > 0 ? resolved : void 0;
+}
+function mergeScopeMaps(base, overlay, source) {
+  const merged = { ...base ?? {} };
+  for (const [collection, overlayScope] of Object.entries(overlay)) {
+    if (source === "auth") {
+      merged[collection] = { ...merged[collection] ?? {}, ...overlayScope };
+    } else {
+      merged[collection] = { ...overlayScope ?? {}, ...merged[collection] ?? {} };
+    }
+  }
+  return merged;
+}
+
 // src/scopes/server-scope-filter.ts
+init_cjs_shims();
 function operationMatchesScopes(op, scopes) {
   if (!scopes) return true;
   const collectionScope = scopes[op.collection];
@@ -1727,6 +2257,57 @@ function asRecord(value) {
   return value;
 }
 
+// src/session/operation-validation.ts
+init_cjs_shims();
+var SERVER_MAX_TIMESTAMP_FUTURE_MS = 6e4;
+function isOperationTimestampValid(op, now = Date.now()) {
+  return op.timestamp.wallTime <= now + SERVER_MAX_TIMESTAMP_FUTURE_MS;
+}
+
+// src/session/session-operation-limits.ts
+init_cjs_shims();
+var DEFAULT_MAX_OPERATION_BYTES = 256 * 1024;
+var DEFAULT_MAX_OPS_PER_MINUTE = 600;
+function measureOperationBytes(op) {
+  return Buffer.byteLength(JSON.stringify(op), "utf8");
+}
+function validateOperationSize(op, maxBytes = DEFAULT_MAX_OPERATION_BYTES) {
+  const bytes = measureOperationBytes(op);
+  if (bytes <= maxBytes) {
+    return { valid: true, bytes };
+  }
+  return {
+    valid: false,
+    bytes,
+    message: `Operation "${op.id}" exceeds max size (${String(bytes)} > ${String(maxBytes)} bytes)`
+  };
+}
+var SessionRateLimiter = class {
+  constructor(maxOpsPerMinute = DEFAULT_MAX_OPS_PER_MINUTE) {
+    this.maxOpsPerMinute = maxOpsPerMinute;
+  }
+  maxOpsPerMinute;
+  windowStartMs = Date.now();
+  count = 0;
+  get limit() {
+    return this.maxOpsPerMinute;
+  }
+  /** Record N operations and return false when the limit is exceeded. */
+  allow(count3 = 1) {
+    const now = Date.now();
+    if (now - this.windowStartMs >= 6e4) {
+      this.windowStartMs = now;
+      this.count = 0;
+    }
+    this.count += count3;
+    return this.count <= this.maxOpsPerMinute;
+  }
+  reset() {
+    this.windowStartMs = Date.now();
+    this.count = 0;
+  }
+};
+
 // src/session/client-session.ts
 var DEFAULT_BATCH_SIZE = 100;
 var DEFAULT_SCHEMA_VERSION = 1;
@@ -1734,6 +2315,8 @@ var ClientSession = class {
   state = "connected";
   clientNodeId = null;
   authContext = null;
+  syncQuerySubsets = [];
+  resumeDeltaCursor = null;
   sessionId;
   transport;
   store;
@@ -1742,8 +2325,14 @@ var ClientSession = class {
   emitter;
   batchSize;
   schemaVersion;
+  supportedSchemaVersions;
   onRelay;
+  onAwarenessUpdate;
+  onYjsDocUpdate;
   onClose;
+  maxOperationBytes;
+  maxOpsPerMinute;
+  rateLimiter;
   constructor(options) {
     this.sessionId = options.sessionId;
     this.transport = options.transport;
@@ -1753,14 +2342,24 @@ var ClientSession = class {
     this.emitter = options.emitter ?? null;
     this.batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
     this.schemaVersion = options.schemaVersion ?? DEFAULT_SCHEMA_VERSION;
+    const supported = options.supportedSchemaVersions;
+    this.supportedSchemaVersions = supported ?? {
+      min: this.schemaVersion,
+      max: this.schemaVersion
+    };
     this.onRelay = options.onRelay ?? null;
+    this.onAwarenessUpdate = options.onAwarenessUpdate ?? null;
+    this.onYjsDocUpdate = options.onYjsDocUpdate ?? null;
     this.onClose = options.onClose ?? null;
+    this.maxOperationBytes = options.maxOperationBytes ?? DEFAULT_MAX_OPERATION_BYTES;
+    this.maxOpsPerMinute = options.maxOpsPerMinute ?? DEFAULT_MAX_OPS_PER_MINUTE;
+    this.rateLimiter = new SessionRateLimiter(this.maxOpsPerMinute);
   }
   /**
    * Start handling messages from the client transport.
    */
   start() {
-    this.transport.onMessage((msg) => this.handleMessage(msg));
+    this.transport.onMessage((msg) => this.enqueueMessage(msg));
     this.transport.onClose((_code, _reason) => this.handleTransportClose());
     this.transport.onError((_err) => {
       if (this.state !== "closed") {
@@ -1775,19 +2374,17 @@ var ClientSession = class {
   relayOperations(operations2) {
     if (this.state !== "streaming" || !this.transport.isConnected()) return;
     if (operations2.length === 0) return;
-    const visibleOperations = operations2.filter(
-      (op) => operationMatchesScopes(op, this.authContext?.scopes)
-    );
+    const visibleOperations = operations2.filter((op) => this.operationVisibleToClient(op));
     if (visibleOperations.length === 0) return;
     const serializedOps = visibleOperations.map((op) => this.serializer.encodeOperation(op));
     const msg = {
       type: "operation-batch",
-      messageId: (0, import_core6.generateUUIDv7)(),
+      messageId: (0, import_core8.generateUUIDv7)(),
       operations: serializedOps,
       isFinal: true,
       batchIndex: 0
     };
-    this.transport.send(msg);
+    this.sendToClient(msg);
   }
   /**
    * Close this session.
@@ -1816,22 +2413,55 @@ var ClientSession = class {
   isStreaming() {
     return this.state === "streaming";
   }
+  /**
+   * Get the transport for this session.
+   * Used by the awareness relay to send messages to this client.
+   */
+  getTransport() {
+    return this.transport;
+  }
   // --- Private protocol handlers ---
-  handleMessage(message) {
+  messageChain = Promise.resolve();
+  /** Send to the client when the transport is still connected; no-op otherwise. */
+  sendToClient(message) {
+    if (!this.transport.isConnected()) {
+      return false;
+    }
+    try {
+      this.transport.send(message);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  enqueueMessage(message) {
+    this.messageChain = this.messageChain.then(() => this.handleMessageAsync(message)).catch((error) => this.handleMessageFailure(error));
+  }
+  async handleMessageAsync(message) {
     switch (message.type) {
       case "handshake":
-        this.handleHandshake(message);
+        await this.handleHandshake(message);
         break;
       case "operation-batch":
-        this.handleOperationBatch(message);
+        await this.handleOperationBatch(message);
         break;
-      // Acknowledgments from clients are noted but no action needed on server
       case "acknowledgment":
         break;
       case "error":
         break;
+      case "awareness-update":
+        this.handleAwarenessUpdate(message);
+        break;
+      case "yjs-doc-update":
+        this.handleYjsDocUpdate(message);
+        break;
     }
   }
+  handleMessageFailure(error) {
+    const reason = error instanceof Error ? error.message : "Message handling failed";
+    this.sendError("SYNC_ERROR", reason, true);
+    this.close(reason);
+  }
   async handleHandshake(msg) {
     if (this.state !== "connected") {
       this.sendError("DUPLICATE_HANDSHAKE", "Handshake already completed", false);
@@ -1849,19 +2479,56 @@ var ClientSession = class {
       this.authContext = context;
       this.state = "authenticated";
     }
+    const resolvedScopes = resolveSessionScopes(this.store.getSchema(), {
+      handshakeScope: msg.syncScope,
+      authScopes: this.authContext?.scopes
+    });
+    if (resolvedScopes) {
+      if (this.authContext) {
+        this.authContext = { ...this.authContext, scopes: resolvedScopes };
+      } else {
+        this.authContext = { userId: msg.nodeId, scopes: resolvedScopes };
+      }
+    }
+    if (msg.syncQueries && msg.syncQueries.length > 0) {
+      this.syncQuerySubsets = (0, import_sync2.dedupeQuerySubsets)(msg.syncQueries);
+    } else {
+      this.syncQuerySubsets = [];
+    }
+    this.resumeDeltaCursor = msg.deltaCursor ? (0, import_sync2.decodeDeltaCursor)(msg.deltaCursor) : null;
     const serverVector = this.store.getVersionVector();
     const selectedWireFormat = selectWireFormat(msg.supportedWireFormats);
     this.setSerializerWireFormat(selectedWireFormat);
+    if (!(0, import_sync2.isClientSchemaVersionSupported)(msg.schemaVersion, this.supportedSchemaVersions)) {
+      const { min, max } = this.supportedSchemaVersions;
+      const response2 = {
+        type: "handshake-response",
+        messageId: (0, import_core8.generateUUIDv7)(),
+        nodeId: this.store.getNodeId(),
+        versionVector: (0, import_sync2.versionVectorToWire)(serverVector),
+        schemaVersion: this.schemaVersion,
+        accepted: false,
+        rejectReason: `${import_sync2.SCHEMA_MISMATCH_PREFIX}: client schema version ${msg.schemaVersion} not in supported range [${min}, ${max}]`,
+        supportedSchemaMin: min,
+        supportedSchemaMax: max
+      };
+      this.sendToClient(response2);
+      this.close("schema version mismatch");
+      return;
+    }
     const response = {
       type: "handshake-response",
-      messageId: (0, import_core6.generateUUIDv7)(),
+      messageId: (0, import_core8.generateUUIDv7)(),
       nodeId: this.store.getNodeId(),
       versionVector: (0, import_sync2.versionVectorToWire)(serverVector),
       schemaVersion: this.schemaVersion,
       accepted: true,
-      selectedWireFormat
+      selectedWireFormat,
+      // Confirm the accepted scope so the client knows what data will be synced.
+      // This may differ from what the client requested if auth scopes are narrower.
+      ...this.authContext?.scopes ? { acceptedScope: this.authContext.scopes } : {}
     };
-    this.transport.send(response);
+    this.sendToClient(response);
     this.emitter?.emit({ type: "sync:connected", nodeId: msg.nodeId });
     this.state = "syncing";
     const clientVector = (0, import_sync2.wireToVersionVector)(msg.versionVector);
@@ -1871,13 +2538,56 @@ var ClientSession = class {
   async handleOperationBatch(msg) {
     const operations2 = msg.operations.map((s) => this.serializer.decodeOperation(s));
     const applied = [];
+    const rejected = [];
     for (const op of operations2) {
-      if (!operationMatchesScopes(op, this.authContext?.scopes)) {
+      if (!this.operationVisibleToClient(op)) {
+        rejected.push(op);
+        continue;
+      }
+      if (!isOperationTimestampValid(op)) {
+        this.sendError(
+          "INVALID_TIMESTAMP",
+          `Operation "${op.id}" timestamp is too far in the future`,
+          false
+        );
+        continue;
+      }
+      if (!this.rateLimiter.allow(1)) {
+        this.sendError(
+          "RATE_LIMIT",
+          `Session exceeded operation rate limit (${String(this.maxOpsPerMinute)} ops/min)`,
+          true
+        );
         continue;
       }
-      const result = await this.store.applyRemoteOperation(op);
-      if (result === "applied") {
-        applied.push(op);
+      const sizeCheck = validateOperationSize(op, this.maxOperationBytes);
+      if (!sizeCheck.valid) {
+        this.sendError(
+          "OPERATION_TOO_LARGE",
+          sizeCheck.message ?? `Operation "${op.id}" is too large`,
+          false
+        );
+        continue;
+      }
+      try {
+        const applyResult = await applyServerOperation(this.store, op);
+        if (applyResult.rejection) {
+          this.sendError(applyResult.rejection.code, applyResult.rejection.message, false);
+          continue;
+        }
+        if (applyResult.result === "applied") {
+          applied.push(...applyResult.appliedOperations);
+        }
+      } catch {
+      }
+    }
+    if (rejected.length > 0) {
+      for (const op of rejected) {
+        this.sendError(
+          "SCOPE_VIOLATION",
+          `Operation "${op.id}" in collection "${op.collection}" is outside the client's sync scope`,
+          false
+        );
       }
     }
     if (operations2.length > 0) {
@@ -1890,11 +2600,11 @@ var ClientSession = class {
     const lastOp = operations2[operations2.length - 1];
     const ack = {
       type: "acknowledgment",
-      messageId: (0, import_core6.generateUUIDv7)(),
+      messageId: (0, import_core8.generateUUIDv7)(),
       acknowledgedMessageId: msg.messageId,
       lastSequenceNumber: lastOp ? lastOp.sequenceNumber : 0
     };
-    this.transport.send(ack);
+    this.sendToClient(ack);
     if (applied.length > 0) {
       this.onRelay?.(this.sessionId, applied);
     }
@@ -1906,35 +2616,52 @@ var ClientSession = class {
       const clientSeq = clientVector.get(nodeId) ?? 0;
       if (serverSeq > clientSeq) {
         const ops = await this.store.getOperationRange(nodeId, clientSeq + 1, serverSeq);
-        const visible = ops.filter((op) => operationMatchesScopes(op, this.authContext?.scopes));
+        const visible = ops.filter((op) => this.operationVisibleToClient(op));
         missing.push(...visible);
       }
     }
     if (missing.length === 0) {
       const emptyBatch = {
         type: "operation-batch",
-        messageId: (0, import_core6.generateUUIDv7)(),
+        messageId: (0, import_core8.generateUUIDv7)(),
         operations: [],
         isFinal: true,
-        batchIndex: 0
+        batchIndex: 0,
+        totalBatches: 1
       };
-      this.transport.send(emptyBatch);
+      this.sendToClient(emptyBatch);
       return;
     }
     const sorted = (0, import_internal.topologicalSort)(missing);
-    const totalBatches = Math.ceil(sorted.length / this.batchSize);
+    const afterCursor = (0, import_sync2.sliceOperationsAfterCursor)(sorted, this.resumeDeltaCursor);
+    const totalBatches = Math.ceil(afterCursor.length / this.batchSize);
+    if (afterCursor.length === 0) {
+      const emptyBatch = {
+        type: "operation-batch",
+        messageId: (0, import_core8.generateUUIDv7)(),
+        operations: [],
+        isFinal: true,
+        batchIndex: this.resumeDeltaCursor?.batchIndex ?? 0,
+        totalBatches: 1
+      };
+      this.sendToClient(emptyBatch);
+      return;
+    }
     for (let i = 0; i < totalBatches; i++) {
       const start = i * this.batchSize;
-      const batchOps = sorted.slice(start, start + this.batchSize);
+      const batchOps = afterCursor.slice(start, start + this.batchSize);
       const serializedOps = batchOps.map((op) => this.serializer.encodeOperation(op));
+      const batchCursor = (0, import_sync2.createDeltaCursorFromBatch)(batchOps, i);
       const batchMsg = {
         type: "operation-batch",
-        messageId: (0, import_core6.generateUUIDv7)(),
+        messageId: (0, import_core8.generateUUIDv7)(),
         operations: serializedOps,
         isFinal: i === totalBatches - 1,
-        batchIndex: i
+        batchIndex: i,
+        totalBatches,
+        ...batchCursor ? { cursor: (0, import_sync2.encodeDeltaCursor)(batchCursor) } : {}
       };
-      this.transport.send(batchMsg);
+      this.sendToClient(batchMsg);
       this.emitter?.emit({
         type: "sync:sent",
         operations: batchOps,
@@ -1942,15 +2669,27 @@ var ClientSession = class {
       });
     }
   }
+  operationVisibleToClient(op) {
+    if (!operationMatchesScopes(op, this.authContext?.scopes)) {
+      return false;
+    }
+    return (0, import_sync2.operationMatchesQuerySubsets)(op, this.syncQuerySubsets);
+  }
+  handleAwarenessUpdate(msg) {
+    this.onAwarenessUpdate?.(this.sessionId, msg);
+  }
+  handleYjsDocUpdate(msg) {
+    this.onYjsDocUpdate?.(this.sessionId, msg);
+  }
   sendError(code, message, retriable) {
     const errorMsg = {
       type: "error",
-      messageId: (0, import_core6.generateUUIDv7)(),
+      messageId: (0, import_core8.generateUUIDv7)(),
       code,
       message,
       retriable
     };
-    this.transport.send(errorMsg);
+    this.sendToClient(errorMsg);
   }
   setSerializerWireFormat(format) {
     if (typeof this.serializer.setWireFormat === "function") {
@@ -1972,8 +2711,262 @@ function selectWireFormat(supportedWireFormats) {
 }
 
 // src/server/kora-sync-server.ts
-var import_core7 = require("@korajs/core");
+init_cjs_shims();
+var import_core10 = require("@korajs/core");
+var import_internal2 = require("@korajs/core/internal");
 var import_sync3 = require("@korajs/sync");
+
+// src/awareness/awareness-relay.ts
+init_cjs_shims();
+var import_core9 = require("@korajs/core");
+var AwarenessRelay = class {
+  clients = /* @__PURE__ */ new Map();
+  /**
+   * Register a client for awareness broadcasting.
+   *
+   * @param sessionId - Unique session identifier
+   * @param clientId - Client-assigned awareness ID
+   * @param transport - Transport for sending messages to this client
+   */
+  addClient(sessionId, clientId, transport) {
+    this.clients.set(sessionId, {
+      sessionId,
+      clientId,
+      transport,
+      state: null
+    });
+    const existingStates = {};
+    let hasStates = false;
+    for (const [, client] of this.clients) {
+      if (client.sessionId === sessionId) continue;
+      if (client.state) {
+        existingStates[String(client.clientId)] = client.state;
+        hasStates = true;
+      }
+    }
+    if (hasStates) {
+      const catchUpMsg = {
+        type: "awareness-update",
+        messageId: (0, import_core9.generateUUIDv7)(),
+        clientId: 0,
+        // Server-sourced
+        states: existingStates
+      };
+      transport.send(catchUpMsg);
+    }
+  }
+  /**
+   * Remove a client and broadcast its removal to all remaining clients.
+   *
+   * @param sessionId - Session ID of the disconnecting client
+   */
+  removeClient(sessionId) {
+    const client = this.clients.get(sessionId);
+    if (!client) return;
+    this.clients.delete(sessionId);
+    if (client.state === null) return;
+    const removalStates = {
+      [String(client.clientId)]: null
+    };
+    const msg = {
+      type: "awareness-update",
+      messageId: (0, import_core9.generateUUIDv7)(),
+      clientId: client.clientId,
+      states: removalStates
+    };
+    this.broadcastExcept(sessionId, msg);
+  }
+  /**
+   * Handle an incoming awareness update from a client.
+   * Stores the state and relays to all other connected clients.
+   *
+   * @param sessionId - Session ID of the sending client
+   * @param message - The awareness update message
+   */
+  handleUpdate(sessionId, message) {
+    const sender = this.clients.get(sessionId);
+    if (!sender) return;
+    const senderState = message.states[String(message.clientId)];
+    if (senderState !== void 0) {
+      sender.state = senderState;
+    }
+    this.broadcastExcept(sessionId, message);
+  }
+  /**
+   * Get the number of registered awareness clients.
+   */
+  getClientCount() {
+    return this.clients.size;
+  }
+  /**
+   * Remove all clients and clear all state.
+   */
+  clear() {
+    this.clients.clear();
+  }
+  // --- Private ---
+  broadcastExcept(excludeSessionId, message) {
+    for (const [, client] of this.clients) {
+      if (client.sessionId === excludeSessionId) continue;
+      if (!client.transport.isConnected()) continue;
+      client.transport.send(message);
+    }
+  }
+};
+
+// src/diagnostics/server-metrics-collector.ts
+init_cjs_shims();
+function estimateByteSize(operations2) {
+  let total = 0;
+  for (const op of operations2) {
+    total += JSON.stringify(op).length;
+  }
+  return total;
+}
+var ServerMetricsCollector = class {
+  startedAt = Date.now();
+  peakConnections = 0;
+  connectionsTotal = 0;
+  operationsReceived = 0;
+  operationsSent = 0;
+  bytesReceived = 0;
+  bytesSent = 0;
+  errorCount = 0;
+  schemaVersion = 1;
+  clientMetrics = /* @__PURE__ */ new Map();
+  /** Record a new client connection. */
+  recordConnection(sessionId) {
+    this.connectionsTotal++;
+    this.clientMetrics.set(sessionId, {
+      sessionId,
+      nodeId: null,
+      state: "connected",
+      connectedAt: Date.now(),
+      operationsReceived: 0,
+      operationsSent: 0,
+      authContext: null
+    });
+    this.peakConnections = Math.max(this.peakConnections, this.clientMetrics.size);
+  }
+  /** Record a client disconnection. */
+  recordDisconnection(sessionId) {
+    this.clientMetrics.delete(sessionId);
+  }
+  /** Update the node ID after a handshake completes. */
+  recordHandshake(sessionId, nodeId) {
+    const client = this.clientMetrics.get(sessionId);
+    if (client) {
+      client.nodeId = nodeId;
+    }
+  }
+  /** Update session state. */
+  updateSessionState(sessionId, state) {
+    const client = this.clientMetrics.get(sessionId);
+    if (client) {
+      client.state = state;
+    }
+  }
+  /** Record authentication context for a session. */
+  recordAuth(sessionId, authContext) {
+    const client = this.clientMetrics.get(sessionId);
+    if (client) {
+      client.authContext = authContext;
+    }
+  }
+  /** Record operations received from a client. */
+  recordReceived(sessionId, count3, byteSize) {
+    this.operationsReceived += count3;
+    this.bytesReceived += byteSize;
+    const client = this.clientMetrics.get(sessionId);
+    if (client) {
+      client.operationsReceived += count3;
+    }
+  }
+  /** Record operations sent to a client. */
+  recordSent(sessionId, count3, byteSize) {
+    this.operationsSent += count3;
+    this.bytesSent += byteSize;
+    const client = this.clientMetrics.get(sessionId);
+    if (client) {
+      client.operationsSent += count3;
+    }
+  }
+  /** Record an error. */
+  recordError() {
+    this.errorCount++;
+  }
+  /** Set the schema version. */
+  setSchemaVersion(version) {
+    this.schemaVersion = version;
+  }
+  /** Return a full snapshot of current metrics. */
+  getSnapshot(totalOperations) {
+    return {
+      connectedClients: this.clientMetrics.size,
+      connectedNodeIds: Array.from(this.clientMetrics.values()).filter((c) => c.nodeId !== null).map((c) => c.nodeId),
+      peakConnections: this.peakConnections,
+      connectionsTotal: this.connectionsTotal,
+      operationsReceived: this.operationsReceived,
+      operationsSent: this.operationsSent,
+      bytesReceived: this.bytesReceived,
+      bytesSent: this.bytesSent,
+      clients: Array.from(this.clientMetrics.values()),
+      uptime: Date.now() - this.startedAt,
+      totalOperations,
+      errorCount: this.errorCount,
+      schemaVersion: this.schemaVersion
+    };
+  }
+  /** Reset all metrics. */
+  reset() {
+    this.startedAt = Date.now();
+    this.peakConnections = 0;
+    this.connectionsTotal = 0;
+    this.operationsReceived = 0;
+    this.operationsSent = 0;
+    this.bytesReceived = 0;
+    this.bytesSent = 0;
+    this.errorCount = 0;
+    this.clientMetrics.clear();
+  }
+};
+
+// src/richtext/yjs-doc-relay.ts
+init_cjs_shims();
+var YjsDocRelay = class {
+  clients = /* @__PURE__ */ new Map();
+  addClient(sessionId, transport) {
+    this.clients.set(sessionId, { sessionId, transport });
+  }
+  removeClient(sessionId) {
+    this.clients.delete(sessionId);
+  }
+  handleUpdate(sourceSessionId, message) {
+    if (!this.clients.has(sourceSessionId)) {
+      return;
+    }
+    this.broadcastExcept(sourceSessionId, message);
+  }
+  getClientCount() {
+    return this.clients.size;
+  }
+  clear() {
+    this.clients.clear();
+  }
+  broadcastExcept(excludeSessionId, message) {
+    for (const [, client] of this.clients) {
+      if (client.sessionId === excludeSessionId) {
+        continue;
+      }
+      if (!client.transport.isConnected()) {
+        continue;
+      }
+      client.transport.send(message);
+    }
+  }
+};
+
+// src/server/kora-sync-server.ts
 var DEFAULT_MAX_CONNECTIONS = 0;
 var DEFAULT_BATCH_SIZE2 = 100;
 var DEFAULT_SCHEMA_VERSION2 = 1;
@@ -1987,12 +2980,18 @@ var KoraSyncServer = class {
   maxConnections;
   batchSize;
   schemaVersion;
+  supportedSchemaVersions;
   port;
   host;
   path;
+  logger;
+  metrics;
+  awarenessRelay = new AwarenessRelay();
+  yjsDocRelay = new YjsDocRelay();
   sessions = /* @__PURE__ */ new Map();
   httpClients = /* @__PURE__ */ new Map();
   httpSessionToClient = /* @__PURE__ */ new Map();
+  serverVersion = "0.4.0";
   wsServer = null;
   running = false;
   constructor(config) {
@@ -2003,9 +3002,80 @@ var KoraSyncServer = class {
     this.maxConnections = config.maxConnections ?? DEFAULT_MAX_CONNECTIONS;
     this.batchSize = config.batchSize ?? DEFAULT_BATCH_SIZE2;
     this.schemaVersion = config.schemaVersion ?? DEFAULT_SCHEMA_VERSION2;
+    this.supportedSchemaVersions = config.supportedSchemaVersions ?? {
+      min: this.schemaVersion,
+      max: this.schemaVersion
+    };
     this.port = config.port;
     this.host = config.host ?? DEFAULT_HOST;
     this.path = config.path ?? DEFAULT_PATH;
+    this.logger = config.logger ?? createDefaultLogger();
+    this.metrics = config.metricsCollector ?? new ServerMetricsCollector();
+    this.metrics.setSchemaVersion(this.schemaVersion);
+    if (!this.emitter) {
+      this.emitter = new import_internal2.SimpleEventEmitter();
+    }
+  }
+  /**
+   * Subscribe to session-level events for metrics collection and logging.
+   * Called when a new session is created.
+   */
+  attachSessionEvents(sessionId, sessionEmitter) {
+    sessionEmitter.on("sync:connected", (event) => {
+      this.metrics.recordHandshake(sessionId, event.nodeId);
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "info",
+        event: "session.handshake",
+        sessionId,
+        nodeId: event.nodeId
+      });
+    });
+    sessionEmitter.on("sync:received", (event) => {
+      const byteSize = estimateByteSize(event.operations);
+      this.metrics.recordReceived(sessionId, event.batchSize, byteSize);
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "info",
+        event: "operations.received",
+        sessionId,
+        count: event.batchSize,
+        bytes: byteSize
+      });
+    });
+    sessionEmitter.on("sync:sent", (event) => {
+      const byteSize = estimateByteSize(event.operations);
+      this.metrics.recordSent(sessionId, event.batchSize, byteSize);
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "info",
+        event: "operations.sent",
+        sessionId,
+        count: event.batchSize,
+        bytes: byteSize
+      });
+    });
+    sessionEmitter.on("sync:disconnected", (event) => {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "info",
+        event: "session.disconnected",
+        sessionId,
+        details: { reason: event.reason }
+      });
+    });
+  }
+  /**
+   * Get the metrics collector for external access (e.g., HTTP endpoints).
+   */
+  getMetricsCollector() {
+    return this.metrics;
+  }
+  /**
+   * Get the logger for external access (e.g., event streaming).
+   */
+  getLogger() {
+    return this.logger;
   }
   /**
    * Start the WebSocket server in standalone mode.
@@ -2014,10 +3084,10 @@ var KoraSyncServer = class {
    */
   async start(wsServerImpl) {
     if (this.running) {
-      throw new import_core7.SyncError("Server is already running", { port: this.port });
+      throw new import_core10.SyncError("Server is already running", { port: this.port });
     }
     if (!wsServerImpl && this.port === void 0) {
-      throw new import_core7.SyncError(
+      throw new import_core10.SyncError(
         "Port is required for standalone mode. Provide port in config or use handleConnection() for attach mode.",
         {}
       );
@@ -2046,11 +3116,25 @@ var KoraSyncServer = class {
       this.handleConnection(transport);
     });
     this.running = true;
+    this.logger.log({
+      timestamp: Date.now(),
+      level: "info",
+      event: "server.started",
+      details: { port: this.port, host: this.host, path: this.path }
+    });
   }
   /**
    * Stop the server. Closes all sessions and the WebSocket server.
    */
   async stop() {
+    this.logger.log({
+      timestamp: Date.now(),
+      level: "info",
+      event: "server.stopping",
+      details: { connectedClients: this.sessions.size }
+    });
+    this.awarenessRelay.clear();
+    this.yjsDocRelay.clear();
     for (const session of this.sessions.values()) {
       session.close("server shutting down");
     }
@@ -2064,6 +3148,11 @@ var KoraSyncServer = class {
       this.wsServer = null;
     }
     this.running = false;
+    this.logger.log({
+      timestamp: Date.now(),
+      level: "info",
+      event: "server.stopped"
+    });
   }
   /**
    * Handle one HTTP sync request for a long-polling client.
@@ -2107,47 +3196,125 @@ var KoraSyncServer = class {
     if (this.maxConnections > 0 && this.sessions.size >= this.maxConnections) {
       transport.send({
         type: "error",
-        messageId: (0, import_core7.generateUUIDv7)(),
+        messageId: (0, import_core10.generateUUIDv7)(),
         code: "MAX_CONNECTIONS",
         message: `Server has reached maximum connections (${this.maxConnections})`,
         retriable: true
       });
       transport.close(4029, "max connections reached");
-      throw new import_core7.SyncError("Maximum connections reached", {
+      this.metrics.recordError();
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "connection.rejected",
+        details: { reason: "max_connections", max: this.maxConnections }
+      });
+      throw new import_core10.SyncError("Maximum connections reached", {
         current: this.sessions.size,
         max: this.maxConnections
       });
     }
-    const sessionId = (0, import_core7.generateUUIDv7)();
+    const sessionId = (0, import_core10.generateUUIDv7)();
+    this.metrics.recordConnection(sessionId);
+    const sessionEmitter = new import_internal2.SimpleEventEmitter();
+    sessionEmitter.on("sync:connected", (event) => {
+      this.metrics.recordHandshake(sessionId, event.nodeId);
+      this.metrics.updateSessionState(sessionId, "authenticated");
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "info",
+        event: "session.handshake",
+        sessionId,
+        nodeId: event.nodeId
+      });
+    });
+    sessionEmitter.on("sync:received", (event) => {
+      const byteSize = estimateOperationByteSize(event.operations);
+      this.metrics.recordReceived(sessionId, event.batchSize, byteSize);
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "info",
+        event: "operations.received",
+        sessionId,
+        count: event.batchSize,
+        bytes: byteSize
+      });
+    });
+    sessionEmitter.on("sync:sent", (event) => {
+      const byteSize = estimateOperationByteSize(event.operations);
+      this.metrics.recordSent(sessionId, event.batchSize, byteSize);
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "info",
+        event: "operations.sent",
+        sessionId,
+        count: event.batchSize,
+        bytes: byteSize
+      });
+    });
+    sessionEmitter.on("sync:disconnected", () => {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "info",
+        event: "session.disconnected",
+        sessionId
+      });
+    });
     const session = new ClientSession({
       sessionId,
       transport,
       store: this.store,
       auth: this.auth ?? void 0,
       serializer: this.serializer,
-      emitter: this.emitter ?? void 0,
+      emitter: sessionEmitter,
       batchSize: this.batchSize,
       schemaVersion: this.schemaVersion,
+      supportedSchemaVersions: this.supportedSchemaVersions,
       onRelay: (sourceSessionId, operations2) => {
         this.handleRelay(sourceSessionId, operations2);
       },
+      onAwarenessUpdate: (sourceSessionId, message) => {
+        this.handleAwarenessRelay(sourceSessionId, message);
+      },
+      onYjsDocUpdate: (sourceSessionId, message) => {
+        this.handleYjsDocRelay(sourceSessionId, message);
+      },
       onClose: (sid) => {
         this.handleSessionClose(sid);
       }
     });
     this.sessions.set(sessionId, session);
+    this.yjsDocRelay.addClient(sessionId, transport);
     session.start();
+    this.logger.log({
+      timestamp: Date.now(),
+      level: "info",
+      event: "session.connected",
+      sessionId,
+      details: { totalSessions: this.sessions.size }
+    });
     return sessionId;
   }
   /**
    * Get the current server status.
    */
   async getStatus() {
+    const totalOps = await this.store.getOperationCount();
+    const snapshot = this.metrics.getSnapshot(totalOps);
     return {
       running: this.running,
-      connectedClients: this.sessions.size,
+      connectedClients: snapshot.connectedClients,
       port: this.port ?? null,
-      totalOperations: await this.store.getOperationCount()
+      totalOperations: snapshot.totalOperations,
+      uptime: snapshot.uptime,
+      version: this.serverVersion,
+      schemaVersion: this.schemaVersion,
+      connectedNodeIds: snapshot.connectedNodeIds,
+      peakConnections: snapshot.peakConnections,
+      connectionsTotal: snapshot.connectionsTotal,
+      operationsReceived: snapshot.operationsReceived,
+      operationsSent: snapshot.operationsSent,
+      errorCount: snapshot.errorCount
     };
   }
   /**
@@ -2158,12 +3325,31 @@ var KoraSyncServer = class {
   }
   // --- Private ---
   handleRelay(sourceSessionId, operations2) {
+    const targetCount = this.sessions.size - 1;
+    const byteSize = estimateOperationByteSize(operations2);
+    this.metrics.recordSent(
+      sourceSessionId,
+      operations2.length * targetCount,
+      byteSize * targetCount
+    );
+    this.logger.log({
+      timestamp: Date.now(),
+      level: "info",
+      event: "operations.relayed",
+      sessionId: sourceSessionId,
+      count: operations2.length,
+      bytes: byteSize * targetCount,
+      details: { targetSessions: targetCount }
+    });
     for (const [sessionId, session] of this.sessions) {
       if (sessionId === sourceSessionId) continue;
       session.relayOperations(operations2);
     }
   }
   handleSessionClose(sessionId) {
+    this.metrics.recordDisconnection(sessionId);
+    this.awarenessRelay.removeClient(sessionId);
+    this.yjsDocRelay.removeClient(sessionId);
     this.sessions.delete(sessionId);
     const clientId = this.httpSessionToClient.get(sessionId);
     if (clientId) {
@@ -2171,6 +3357,21 @@ var KoraSyncServer = class {
       this.httpClients.delete(clientId);
     }
   }
+  handleAwarenessRelay(sourceSessionId, message) {
+    const session = this.sessions.get(sourceSessionId);
+    if (!session) return;
+    const transport = session.getTransport();
+    if (!this.awarenessRelay.getClientCount() || !transport) {
+    }
+    this.awarenessRelay.addClient(sourceSessionId, message.clientId, transport);
+    this.awarenessRelay.handleUpdate(sourceSessionId, message);
+  }
+  handleYjsDocRelay(sourceSessionId, message) {
+    if (!this.sessions.has(sourceSessionId)) {
+      return;
+    }
+    this.yjsDocRelay.handleUpdate(sourceSessionId, message);
+  }
   getOrCreateHttpClient(clientId) {
     const existing = this.httpClients.get(clientId);
     if (existing) {
@@ -2184,6 +3385,13 @@ var KoraSyncServer = class {
     return client;
   }
 };
+function estimateOperationByteSize(operations2) {
+  let total = 0;
+  for (const op of operations2) {
+    total += JSON.stringify(op).length;
+  }
+  return total;
+}
 function normalizeHttpBody(body, contentType) {
   if (body instanceof Uint8Array) {
     return body;
@@ -2195,6 +3403,7 @@ function normalizeHttpBody(body, contentType) {
 }
 
 // src/auth/no-auth.ts
+init_cjs_shims();
 var NoAuthProvider = class {
   async authenticate(_token) {
     return { userId: "anonymous" };
@@ -2202,6 +3411,7 @@ var NoAuthProvider = class {
 };
 
 // src/auth/token-auth.ts
+init_cjs_shims();
 var TokenAuthProvider = class {
   validate;
   constructor(options) {
@@ -2213,6 +3423,7 @@ var TokenAuthProvider = class {
 };
 
 // src/auth/kora-auth-provider.ts
+init_cjs_shims();
 var KoraAuthProvider = class {
   tokenValidator;
   userLookup;
@@ -2225,7 +3436,7 @@ var KoraAuthProvider = class {
     this.resolveScopes = options.resolveScopes;
   }
   async authenticate(token) {
-    const payload = this.tokenValidator.validateToken(token);
+    const payload = this.tokenValidator.validateTokenWithRevocation ? await this.tokenValidator.validateTokenWithRevocation(token) : this.tokenValidator.validateToken(token);
     if (payload === null) {
       return null;
     }
@@ -2252,12 +3463,39 @@ var KoraAuthProvider = class {
   }
 };
 
+// src/auth/mixed-auth-provider.ts
+init_cjs_shims();
+var MixedAuthProvider = class {
+  primary;
+  anonymousScopes;
+  anonymousPrefix;
+  anonymousCounter = 0;
+  constructor(options) {
+    this.primary = options.primary;
+    this.anonymousScopes = options.anonymousScopes;
+    this.anonymousPrefix = options.anonymousPrefix ?? "anon";
+  }
+  async authenticate(token) {
+    if (token) {
+      const ctx = await this.primary.authenticate(token);
+      if (ctx) return ctx;
+    }
+    this.anonymousCounter++;
+    return {
+      userId: `${this.anonymousPrefix}-${Date.now()}-${this.anonymousCounter}`,
+      scopes: this.anonymousScopes
+    };
+  }
+};
+
 // src/server/create-server.ts
+init_cjs_shims();
 function createKoraServer(config) {
   return new KoraSyncServer(config);
 }
 
 // src/server/production-server.ts
+init_cjs_shims();
 var MIME_TYPES = {
   ".html": "text/html",
   ".js": "text/javascript",
@@ -2278,9 +3516,143 @@ function createProductionServer(config) {
   const syncPath = config.syncPath ?? "/kora-sync";
   const syncServer = new KoraSyncServer({
     store: config.store,
+    enableDashboard: true,
     ...config.syncOptions
   });
   let httpServer = null;
+  function getOperationalToken(kind) {
+    const auth = config.operationalAuth;
+    if (!auth) return void 0;
+    if (kind === "metrics") return auth.metricsToken || auth.adminToken;
+    if (kind === "backup") return auth.backupToken || auth.adminToken;
+    return auth.adminToken;
+  }
+  function extractRequestToken(req) {
+    const authorization = req.headers.authorization;
+    if (authorization?.startsWith("Bearer ")) {
+      return authorization.slice("Bearer ".length).trim();
+    }
+    const headerNames = ["x-kora-admin-token", "x-kora-metrics-token", "x-kora-backup-token"];
+    for (const name of headerNames) {
+      const value = req.headers[name];
+      if (typeof value === "string" && value.length > 0) return value;
+      if (Array.isArray(value) && typeof value[0] === "string" && value[0].length > 0) {
+        return value[0];
+      }
+    }
+    return null;
+  }
+  function isOperationalRequestAllowed(req, kind) {
+    const expected = getOperationalToken(kind);
+    if (!expected) return true;
+    return extractRequestToken(req) === expected;
+  }
+  function rejectUnauthorized(res) {
+    res.writeHead(401, {
+      "Content-Type": "application/json",
+      "WWW-Authenticate": 'Bearer realm="kora"'
+    });
+    res.end(JSON.stringify({ error: "Unauthorized" }));
+  }
+  function formatPrometheusMetrics() {
+    const status = syncServer.getMetricsCollector().getSnapshot(0);
+    const lines = [
+      "# HELP kora_connected_clients Current number of connected clients",
+      "# TYPE kora_connected_clients gauge",
+      `kora_connected_clients ${status.connectedClients}`,
+      "",
+      "# HELP kora_peak_connections Peak number of simultaneous connections since server start",
+      "# TYPE kora_peak_connections gauge",
+      `kora_peak_connections ${status.peakConnections}`,
+      "",
+      "# HELP kora_connections_total Total number of connections handled since server start",
+      "# TYPE kora_connections_total counter",
+      `kora_connections_total ${status.connectionsTotal}`,
+      "",
+      "# HELP kora_operations_received_total Total operations received from clients",
+      "# TYPE kora_operations_received_total counter",
+      `kora_operations_received_total ${status.operationsReceived}`,
+      "",
+      "# HELP kora_operations_sent_total Total operations sent to clients",
+      "# TYPE kora_operations_sent_total counter",
+      `kora_operations_sent_total ${status.operationsSent}`,
+      "",
+      "# HELP kora_bytes_received_total Total bytes received from clients",
+      "# TYPE kora_bytes_received_total counter",
+      `kora_bytes_received_total ${status.bytesReceived}`,
+      "",
+      "# HELP kora_bytes_sent_total Total bytes sent to clients",
+      "# TYPE kora_bytes_sent_total counter",
+      `kora_bytes_sent_total ${status.bytesSent}`,
+      "",
+      "# HELP kora_errors_total Total errors since server start",
+      "# TYPE kora_errors_total counter",
+      `kora_errors_total ${status.errorCount}`,
+      "",
+      "# HELP kora_uptime_seconds Server uptime in seconds",
+      "# TYPE kora_uptime_seconds gauge",
+      `kora_uptime_seconds ${Math.floor(status.uptime / 1e3)}`,
+      "",
+      "# HELP kora_schema_version Schema version the server expects",
+      "# TYPE kora_schema_version gauge",
+      `kora_schema_version ${status.schemaVersion}`,
+      ""
+    ];
+    return lines.join("\n");
+  }
+  function readBodyBuffer(req) {
+    return new Promise((resolve) => {
+      const chunks = [];
+      req.on("data", (chunk) => chunks.push(chunk));
+      req.on("end", () => resolve(Buffer.concat(chunks)));
+    });
+  }
+  async function readJsonBody(req) {
+    const buffer = await readBodyBuffer(req);
+    if (buffer.byteLength === 0) return void 0;
+    try {
+      return JSON.parse(buffer.toString("utf8"));
+    } catch {
+      return void 0;
+    }
+  }
+  function matchesRoutePrefix(pathname, prefix) {
+    const normalizedPrefix = normalizeRoutePath(prefix);
+    return pathname === normalizedPrefix || pathname.startsWith(`${normalizedPrefix}/`);
+  }
+  function normalizeRoutePath(path) {
+    const prefixed = path.startsWith("/") ? path : `/${path}`;
+    return prefixed.length > 1 ? prefixed.replace(/\/+$/, "") : prefixed;
+  }
+  function getClientIp(req) {
+    const forwarded = req.headers["x-forwarded-for"];
+    if (typeof forwarded === "string" && forwarded.length > 0) {
+      return forwarded.split(",")[0]?.trim();
+    }
+    return req.socket.remoteAddress;
+  }
+  function getQuery(url) {
+    const query = {};
+    for (const [key, value] of url.searchParams) {
+      const existing = query[key];
+      if (existing === void 0) {
+        query[key] = value;
+      } else if (Array.isArray(existing)) {
+        existing.push(value);
+      } else {
+        query[key] = [existing, value];
+      }
+    }
+    return query;
+  }
+  function writeJsonResponse(res, result) {
+    const headers = {
+      "Content-Type": "application/json",
+      ...result.headers ?? {}
+    };
+    res.writeHead(result.status, headers);
+    res.end(JSON.stringify(result.body ?? null));
+  }
   return {
     async start() {
       const { createServer } = await import("http");
@@ -2288,13 +3660,137 @@ function createProductionServer(config) {
       const { extname, join, resolve } = await import("path");
       const { WebSocketServer } = await import("ws");
       const distDir = resolve(staticDir);
-      httpServer = createServer((req, res) => {
+      httpServer = createServer(async (req, res) => {
         res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
         res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
         const url = new URL(req.url || "/", `http://${req.headers.host}`);
         if (url.pathname === "/health") {
+          const status = await syncServer.getStatus();
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(
+            JSON.stringify({
+              status: "ok",
+              version: status.version,
+              uptime: status.uptime,
+              connectedClients: status.connectedClients,
+              totalOperations: status.totalOperations,
+              timestamp: Date.now()
+            })
+          );
+          return;
+        }
+        if (url.pathname === "/__kora/status") {
+          if (!isOperationalRequestAllowed(req, "admin")) {
+            rejectUnauthorized(res);
+            return;
+          }
+          const status = await syncServer.getStatus();
           res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ status: "ok", timestamp: Date.now() }));
+          res.end(JSON.stringify(status, null, 2));
+          return;
+        }
+        if (url.pathname === "/__kora/metrics") {
+          if (!isOperationalRequestAllowed(req, "metrics")) {
+            rejectUnauthorized(res);
+            return;
+          }
+          res.writeHead(200, { "Content-Type": "text/plain; version=0.0.4" });
+          res.end(formatPrometheusMetrics());
+          return;
+        }
+        if (url.pathname === "/__kora/events") {
+          if (!isOperationalRequestAllowed(req, "admin")) {
+            rejectUnauthorized(res);
+            return;
+          }
+          res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            Connection: "keep-alive",
+            "X-Accel-Buffering": "no"
+          });
+          const status = await syncServer.getStatus();
+          res.write(`event: status
+data: ${JSON.stringify(status)}
+
+`);
+          const interval = setInterval(async () => {
+            try {
+              const s = await syncServer.getStatus();
+              res.write(`event: status
+data: ${JSON.stringify(s)}
+
+`);
+            } catch {
+            }
+          }, 2e3);
+          req.on("close", () => {
+            clearInterval(interval);
+          });
+          return;
+        }
+        if (url.pathname === "/__kora" || url.pathname === "/__kora/") {
+          if (!isOperationalRequestAllowed(req, "admin")) {
+            rejectUnauthorized(res);
+            return;
+          }
+          const status = await syncServer.getStatus();
+          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(renderDashboardHtml(status));
+          return;
+        }
+        if (url.pathname === "/__kora/backup/export" && req.method === "POST") {
+          if (!isOperationalRequestAllowed(req, "backup")) {
+            rejectUnauthorized(res);
+            return;
+          }
+          try {
+            const backup = await config.store.exportBackup();
+            res.writeHead(200, {
+              "Content-Type": "application/octet-stream",
+              "Content-Disposition": `attachment; filename="kora-backup-${Date.now()}.kora"`,
+              "Content-Length": String(backup.byteLength)
+            });
+            res.end(Buffer.from(backup));
+          } catch (error) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Backup failed", message: error.message }));
+          }
+          return;
+        }
+        if (url.pathname === "/__kora/backup/import" && req.method === "POST") {
+          if (!isOperationalRequestAllowed(req, "backup")) {
+            rejectUnauthorized(res);
+            return;
+          }
+          try {
+            const body = await readBodyBuffer(req);
+            const merge = url.searchParams.get("merge") === "true";
+            const result = await config.store.importBackup(
+              new Uint8Array(body.buffer, body.byteOffset, body.byteLength),
+              merge
+            );
+            res.writeHead(result.success ? 200 : 400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(result));
+          } catch (error) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Restore failed", message: error.message }));
+          }
+          return;
+        }
+        const customRoute = config.httpRoutes?.find(
+          (route) => matchesRoutePrefix(url.pathname, route.path)
+        );
+        if (customRoute) {
+          const result = await customRoute.handle({
+            method: req.method ?? "GET",
+            path: url.pathname,
+            body: await readJsonBody(req),
+            headers: req.headers,
+            query: getQuery(url),
+            ip: getClientIp(req)
+          });
+          writeJsonResponse(res, result);
           return;
         }
         let filePath = join(distDir, url.pathname);
@@ -2340,7 +3836,7 @@ function createProductionServer(config) {
         }
       });
       return new Promise((resolve2) => {
-        httpServer.listen(port, "0.0.0.0", () => {
+        httpServer?.listen(port, "0.0.0.0", () => {
           resolve2(`http://localhost:${port}`);
         });
       });
@@ -2349,28 +3845,110 @@ function createProductionServer(config) {
       await syncServer.stop();
       if (httpServer) {
         await new Promise((resolve) => {
-          httpServer.close(() => resolve());
+          httpServer?.close(() => resolve());
         });
         httpServer = null;
       }
     }
   };
 }
+function renderDashboardHtml(status) {
+  const version = status.version;
+  const uptime = formatUptime(status.uptime);
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Kora Dashboard</title>
+<style>
+  * { box-sizing: border-box; margin: 0; padding: 0 }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #0f172a; color: #e2e8f0; padding: 2rem }
+  h1 { font-size: 1.5rem; font-weight: 600; margin-bottom: 0.25rem }
+  .subtitle { color: #64748b; margin-bottom: 2rem; font-size: 0.875rem }
+  .grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 1rem; margin-bottom: 2rem }
+  .card { background: #1e293b; border: 1px solid #334155; border-radius: 0.75rem; padding: 1.25rem }
+  .card .label { font-size: 0.75rem; text-transform: uppercase; letter-spacing: 0.05em; color: #64748b; margin-bottom: 0.5rem }
+  .card .value { font-size: 1.75rem; font-weight: 700; color: #38bdf8 }
+  .card .value.green { color: #4ade80 }
+  .card .value.red { color: #f87171 }
+  .card .value.yellow { color: #fbbf24 }
+  .section-title { font-size: 1rem; font-weight: 600; margin-bottom: 0.75rem; margin-top: 1.5rem }
+  table { width: 100%; border-collapse: collapse; font-size: 0.875rem }
+  th { text-align: left; padding: 0.5rem 0.75rem; color: #64748b; font-weight: 500; border-bottom: 1px solid #334155 }
+  td { padding: 0.5rem 0.75rem; border-bottom: 1px solid #1e293b }
+  .status-dot { display: inline-block; width: 0.5rem; height: 0.5rem; border-radius: 50%; margin-right: 0.375rem }
+  .status-dot.running { background: #4ade80 }
+  .status-dot.stopped { background: #f87171 }
+</style>
+</head>
+<body>
+<h1>Kora Sync Server</h1>
+<p class="subtitle">v${version} &middot; <span class="status-dot running"></span>Running</p>
+<div class="grid">
+  <div class="card"><div class="label">Uptime</div><div class="value">${uptime}</div></div>
+  <div class="card"><div class="label">Connected Clients</div><div class="value" id="connectedClients">${status.connectedClients}</div></div>
+  <div class="card"><div class="label">Total Operations</div><div class="value" id="totalOperations">${status.totalOperations}</div></div>
+  <div class="card"><div class="label">Peak Connections</div><div class="value green" id="peakConnections">${status.peakConnections}</div></div>
+  <div class="card"><div class="label">Ops Received</div><div class="value" id="opsReceived">${status.operationsReceived}</div></div>
+  <div class="card"><div class="label">Ops Sent</div><div class="value" id="opsSent">${status.operationsSent}</div></div>
+  <div class="card"><div class="label">Errors</div><div class="value ${status.errorCount > 0 ? "red" : "green"}" id="errors">${status.errorCount}</div></div>
+  <div class="card"><div class="label">Schema Version</div><div class="value">${status.schemaVersion}</div></div>
+</div>
+<script>
+(function() {
+  const es = new EventSource('/__kora/events');
+  es.addEventListener('status', (e) => {
+    const s = JSON.parse(e.data);
+    for (const [id, val] of Object.entries({
+      connectedClients: s.connectedClients,
+      totalOperations: s.totalOperations,
+      peakConnections: s.peakConnections,
+      opsReceived: s.operationsReceived,
+      opsSent: s.operationsSent,
+      errors: s.errorCount,
+    })) {
+      const el = document.getElementById(id);
+      if (el) { el.textContent = String(val); el.className = 'value' + (id === 'errors' && val > 0 ? ' red' : id === 'errors' ? ' green' : ''); }
+    }
+  });
+  es.onerror = () => { setTimeout(() => document.location.reload(), 5000); };
+})();
+</script>
+</body>
+</html>`;
+}
+function formatUptime(ms) {
+  const seconds = Math.floor(ms / 1e3);
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  const parts = [];
+  if (hours > 0) parts.push(`${hours}h`);
+  if (minutes % 60 > 0) parts.push(`${minutes % 60}m`);
+  parts.push(`${seconds % 60}s`);
+  return parts.join(" ");
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AwarenessRelay,
   ClientSession,
   HttpServerTransport,
   KoraAuthProvider,
   KoraSyncServer,
   MemoryServerStore,
+  MixedAuthProvider,
   NoAuthProvider,
   PostgresServerStore,
   SqliteServerStore,
   TokenAuthProvider,
   WsServerTransport,
+  createDefaultLogger,
+  createJsonLogger,
   createKoraServer,
   createPostgresServerStore,
+  createPrettyLogger,
   createProductionServer,
+  createSilentLogger,
   createSqliteServerStore
 });
 //# sourceMappingURL=index.cjs.map