@korajs/server 1.0.0-beta.0 → 1.0.0-beta.10

package/dist/index.cjs

@@ -12,11 +12,11 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
+var __copyProps = (to, from, except, desc2) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
       if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc2 = __getOwnPropDesc(from, key)) || desc2.enumerable });
   }
   return to;
 };
@@ -176,6 +176,7 @@ __export(index_exports, {
   MixedAuthProvider: () => MixedAuthProvider,
   NoAuthProvider: () => NoAuthProvider,
   PostgresServerStore: () => PostgresServerStore,
+  RETRIABLE_REJECTION_CODES: () => RETRIABLE_REJECTION_CODES,
   SqliteServerStore: () => SqliteServerStore,
   TokenAuthProvider: () => TokenAuthProvider,
   WsServerTransport: () => WsServerTransport,
@@ -186,7 +187,8 @@ __export(index_exports, {
   createPrettyLogger: () => createPrettyLogger,
   createProductionServer: () => createProductionServer,
   createSilentLogger: () => createSilentLogger,
-  createSqliteServerStore: () => createSqliteServerStore
+  createSqliteServerStore: () => createSqliteServerStore,
+  isRetriableRejection: () => isRetriableRejection
 });
 module.exports = __toCommonJS(index_exports);
 init_cjs_shims();
@@ -248,6 +250,13 @@ function createDefaultLogger() {
   }
 }
 
+// src/apply/rejection-taxonomy.ts
+init_cjs_shims();
+var RETRIABLE_REJECTION_CODES = /* @__PURE__ */ new Set(["RATE_LIMIT"]);
+function isRetriableRejection(code) {
+  return RETRIABLE_REJECTION_CODES.has(code);
+}
+
 // src/store/memory-server-store.ts
 init_cjs_shims();
 var import_core2 = require("@korajs/core");
@@ -269,6 +278,14 @@ function fieldTypeToSql(descriptor, dialect) {
       return dialect === "postgres" ? "BIGINT" : "INTEGER";
     case "array":
       return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "object":
+      return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "json":
+      return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "blob":
+      return "TEXT";
+    case "secret":
+      return "TEXT";
     case "richtext":
       return dialect === "postgres" ? "BYTEA" : "BLOB";
   }
@@ -285,13 +302,13 @@ function generateCollectionDDL(name, collection, dialect) {
   const columns = ["id TEXT PRIMARY KEY NOT NULL"];
   for (const [fieldName, descriptor] of Object.entries(collection.fields)) {
     const sqlType = fieldTypeToSql(descriptor, dialect);
-    let colDef = `${fieldName} ${sqlType}`;
+    let colDef = `${(0, import_core.quoteIdent)(fieldName)} ${sqlType}`;
     if (descriptor.defaultValue !== void 0) {
       colDef += ` DEFAULT ${sqlDefaultLiteral(descriptor.defaultValue)}`;
     }
     if (descriptor.kind === "enum" && descriptor.enumValues) {
       const values = descriptor.enumValues.map((v) => `'${v}'`).join(", ");
-      colDef += ` CHECK (${fieldName} IN (${values}))`;
+      colDef += ` CHECK (${(0, import_core.quoteIdent)(fieldName)} IN (${values}))`;
     }
     columns.push(colDef);
   }
@@ -299,24 +316,26 @@ function generateCollectionDDL(name, collection, dialect) {
   columns.push(`_created_at ${tsType} NOT NULL DEFAULT 0`);
   columns.push(`_updated_at ${tsType} NOT NULL DEFAULT 0`);
   columns.push("_deleted INTEGER NOT NULL DEFAULT 0");
-  statements.push(`CREATE TABLE IF NOT EXISTS ${name} (
+  statements.push(`CREATE TABLE IF NOT EXISTS ${(0, import_core.quoteIdent)(name)} (
   ${columns.join(",\n  ")}
 )`);
   for (const [fieldName, descriptor] of Object.entries(collection.fields)) {
     const sqlType = fieldTypeToSql(descriptor, dialect);
-    let colDef = `${fieldName} ${sqlType}`;
+    let colDef = `${(0, import_core.quoteIdent)(fieldName)} ${sqlType}`;
     if (descriptor.defaultValue !== void 0) {
       colDef += ` DEFAULT ${sqlDefaultLiteral(descriptor.defaultValue)}`;
     }
     statements.push(`--kora:safe-alter
-ALTER TABLE ${name} ADD COLUMN ${colDef}`);
+ALTER TABLE ${(0, import_core.quoteIdent)(name)} ADD COLUMN ${colDef}`);
   }
   for (const indexField of collection.indexes) {
     statements.push(
-      `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${name} (${indexField})`
+      `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${(0, import_core.quoteIdent)(name)} (${(0, import_core.quoteIdent)(indexField)})`
     );
   }
-  statements.push(`CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${name} (_deleted)`);
+  statements.push(
+    `CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${(0, import_core.quoteIdent)(name)} (_deleted)`
+  );
   return statements;
 }
 function generateAllCollectionDDL(schema, dialect) {
@@ -326,30 +345,6 @@ function generateAllCollectionDDL(schema, dialect) {
   }
   return statements;
 }
-function replayOperationsForRecord(ops) {
-  let record = null;
-  let deleted = false;
-  for (const op of ops) {
-    switch (op.type) {
-      case "insert":
-        if (op.data) {
-          record = { ...op.data };
-          deleted = false;
-        }
-        break;
-      case "update":
-        if (op.data) {
-          record = { ...record ?? {}, ...op.data };
-          deleted = false;
-        }
-        break;
-      case "delete":
-        deleted = true;
-        break;
-    }
-  }
-  return deleted ? null : record;
-}
 var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 var BASE64_REVERSE = new Map(
   Array.from(BASE64_ALPHABET, (char, index3) => [char, index3])
@@ -400,6 +395,9 @@ function serializeFieldValue(value, descriptor) {
   if (value === null || value === void 0) return null;
   switch (descriptor.kind) {
     case "array":
+    case "object":
+    case "json":
+    case "blob":
       return typeof value === "string" ? value : JSON.stringify(value);
     case "boolean":
       return value ? 1 : 0;
@@ -413,6 +411,9 @@ function deserializeFieldValue(value, descriptor) {
   if (value === null || value === void 0) return null;
   switch (descriptor.kind) {
     case "array":
+    case "object":
+    case "json":
+    case "blob":
       return typeof value === "string" ? JSON.parse(value) : value;
     case "boolean":
       return value === 1 || value === true;
@@ -445,6 +446,14 @@ var MemoryServerStore = class {
   operations = [];
   operationIndex = /* @__PURE__ */ new Map();
   versionVector = /* @__PURE__ */ new Map();
+  /**
+   * Server-assigned delivery sequence per operation id. Single-process, so a plain
+   * counter incremented at insert time gives commit-order delivery sequence with no
+   * gaps. `operations` is kept in insertion (== delivery) order, so a delivery scan
+   * is a forward walk.
+   */
+  deliverySeqByOpId = /* @__PURE__ */ new Map();
+  deliverySeqCounter = 0;
   schema = null;
   /** Materialized records: collection -> recordId -> record data */
   materializedRecords = /* @__PURE__ */ new Map();
@@ -478,6 +487,8 @@ var MemoryServerStore = class {
     }
     this.operations.push(op);
     this.operationIndex.set(op.id, op);
+    this.deliverySeqCounter += 1;
+    this.deliverySeqByOpId.set(op.id, this.deliverySeqCounter);
     const currentSeq = this.versionVector.get(op.nodeId) ?? 0;
     if (op.sequenceNumber > currentSeq) {
       this.versionVector.set(op.nodeId, op.sequenceNumber);
@@ -497,6 +508,23 @@ var MemoryServerStore = class {
     this.assertOpen();
     return this.operations.length;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    return this.deliverySeqCounter;
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    const result = [];
+    if (limit <= 0) return result;
+    for (const op of this.operations) {
+      const deliverySequence = this.deliverySeqByOpId.get(op.id) ?? 0;
+      if (deliverySequence > afterDeliverySequence) {
+        result.push({ operation: op, deliverySequence });
+        if (result.length >= limit) break;
+      }
+    }
+    return result;
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     if (this.schema?.collections[collection]) {
@@ -641,12 +669,16 @@ var MemoryServerStore = class {
     this.operations.length = 0;
     this.operationIndex.clear();
     this.versionVector.clear();
+    this.deliverySeqByOpId.clear();
+    this.deliverySeqCounter = 0;
     for (const [nid, seq] of versionVector) {
       this.versionVector.set(nid, seq);
     }
     for (const op of operations2) {
       this.operations.push(op);
       this.operationIndex.set(op.id, op);
+      this.deliverySeqCounter += 1;
+      this.deliverySeqByOpId.set(op.id, this.deliverySeqCounter);
       if (this.schema?.collections[op.collection]) {
         this.rebuildMaterializedRecord(op.collection, op.recordId);
       }
@@ -676,13 +708,14 @@ var MemoryServerStore = class {
         return a.timestamp.wallTime - b.timestamp.wallTime;
       if (a.timestamp.logical !== b.timestamp.logical)
         return a.timestamp.logical - b.timestamp.logical;
-      return a.sequenceNumber - b.sequenceNumber;
+      return a.timestamp.nodeId < b.timestamp.nodeId ? -1 : a.timestamp.nodeId > b.timestamp.nodeId ? 1 : 0;
     });
     const parsedOps = recordOps.map((op) => ({
       type: op.type,
-      data: op.data
+      data: op.data,
+      atomicOps: op.atomicOps ?? null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     if (recordData) {
       const createdAt = recordOps.length > 0 ? recordOps[0].timestamp.wallTime : Date.now();
       const updatedAt = recordOps.length > 0 ? recordOps[recordOps.length - 1].timestamp.wallTime : Date.now();
@@ -805,6 +838,8 @@ var pgOperations = (0, import_pg_core.pgTable)(
     // JSON-serialized, null for deletes
     previousData: (0, import_pg_core.text)("previous_data"),
     // JSON-serialized, null for insert/delete
+    atomicOps: (0, import_pg_core.text)("atomic_ops"),
+    // JSON-serialized Record<field, AtomicOp>, null when none
     wallTime: (0, import_pg_core.bigint)("wall_time", { mode: "number" }).notNull(),
     logical: (0, import_pg_core.integer)("logical").notNull(),
     timestampNodeId: (0, import_pg_core.text)("timestamp_node_id").notNull(),
@@ -812,12 +847,18 @@ var pgOperations = (0, import_pg_core.pgTable)(
     causalDeps: (0, import_pg_core.text)("causal_deps").notNull().default("[]"),
     // JSON array of op IDs
     schemaVersion: (0, import_pg_core.integer)("schema_version").notNull(),
-    receivedAt: (0, import_pg_core.bigint)("received_at", { mode: "number" }).notNull()
+    receivedAt: (0, import_pg_core.bigint)("received_at", { mode: "number" }).notNull(),
+    // Server-assigned monotonic delivery sequence, ordered by commit (assigned from
+    // a counter row locked inside the append transaction, so delivery order equals
+    // visibility order even across instances). Drives the gap-free server->client
+    // delivery watermark. Nullable only for pre-column rows, backfilled on startup.
+    deliverySeq: (0, import_pg_core.bigint)("delivery_seq", { mode: "number" })
   },
   (table) => ({
     nodeSeqIdx: (0, import_pg_core.index)("idx_pg_node_seq").on(table.nodeId, table.sequenceNumber),
     collectionIdx: (0, import_pg_core.index)("idx_pg_collection").on(table.collection),
-    receivedIdx: (0, import_pg_core.index)("idx_pg_received").on(table.receivedAt)
+    receivedIdx: (0, import_pg_core.index)("idx_pg_received").on(table.receivedAt),
+    deliveryIdx: (0, import_pg_core.index)("idx_pg_delivery_seq").on(table.deliverySeq)
   })
 );
 var pgSyncState = (0, import_pg_core.pgTable)("sync_state", {
@@ -834,15 +875,43 @@ var PostgresServerStore = class {
   ready;
   schema = null;
   closed = false;
-  constructor(db, nodeId) {
+  /**
+   * Monotonic counter for this node's server-originated sequence numbers. Lazily
+   * seeded from the persisted version vector on first use, then advanced in memory
+   * (a synchronous `++`, atomic on the single JS thread) so concurrent conditional
+   * applies never receive the same number. Null means "not yet seeded"; reset to
+   * null after a backup import so it re-seeds from the restored version vector.
+   */
+  sequenceCounter = null;
+  /**
+   * Time source for HLC timestamps on server-originated operations. Injectable so a
+   * test can freeze wall-clock time and prove the conditional-apply ordering holds
+   * under same-millisecond commits (the case the advisory lock and clock advance
+   * exist to make correct). Defaults to the system clock in production.
+   */
+  timeSource;
+  constructor(db, nodeId, timeSource) {
     this.db = db;
     this.nodeId = nodeId ?? (0, import_core3.generateUUIDv7)();
+    this.timeSource = timeSource ?? { now: () => Date.now() };
     this.ready = this.initialize();
   }
   getVersionVector() {
     this.assertOpen();
     return new Map(this.versionVector);
   }
+  /**
+   * Atomically reserve this node's next server-operation sequence number. The
+   * synchronous increment cannot interleave on the single JS thread, so two
+   * concurrent conditional applies are always handed distinct numbers.
+   */
+  reserveSequenceNumber() {
+    if (this.sequenceCounter === null) {
+      this.sequenceCounter = this.versionVector.get(this.nodeId) ?? 0;
+    }
+    this.sequenceCounter += 1;
+    return this.sequenceCounter;
+  }
   getNodeId() {
     return this.nodeId;
   }
@@ -880,8 +949,9 @@ var PostgresServerStore = class {
       return "duplicate";
     }
     const now = Date.now();
-    const row = this.serializeOperation(op, now);
     await this.db.transaction(async (tx) => {
+      const deliverySeq = await this.nextDeliverySeq(tx);
+      const row = this.serializeOperation(op, now, deliverySeq);
       await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
       await tx.insert(pgSyncState).values({
         nodeId: op.nodeId,
@@ -904,6 +974,73 @@ var PostgresServerStore = class {
     }
     return "applied";
   }
+  /**
+   * Conditionally apply operations atomically, serialized across server instances
+   * on the target record via a transaction-scoped advisory lock. The lock makes
+   * the read-decide-write cycle atomic against concurrent instances, so a cap
+   * check like `responseCount < max` cannot be passed by two admissions at once.
+   */
+  async applyConditional(input) {
+    this.assertOpen();
+    await this.ready;
+    this.assertSchema();
+    this.assertCollection(input.target.collection);
+    const schema = this.schema;
+    const collectionDef = schema.collections[input.target.collection];
+    const lockKey = `kora:${input.target.collection}:${input.target.id}`;
+    const result = await this.db.transaction(async (tx) => {
+      await tx.execute(import_drizzle_orm.sql`SELECT pg_advisory_xact_lock(hashtextextended(${lockKey}, 0))`);
+      if (input.idempotencyKey) {
+        const existing = await tx.execute(
+          import_drizzle_orm.sql`SELECT 1 FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(input.idempotencyKey.collection))} WHERE id = ${input.idempotencyKey.id} AND _deleted = 0 LIMIT 1`
+        );
+        if (existing.length > 0) {
+          return { admitted: true, idempotent: true, applied: [] };
+        }
+      }
+      const rows = await tx.execute(
+        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(input.target.collection))} WHERE id = ${input.target.id} AND _deleted = 0`
+      );
+      const current = rows.length > 0 ? this.deserializeRow(rows[0], collectionDef) : null;
+      if (!input.admit(current)) {
+        return { admitted: false, idempotent: false, applied: [] };
+      }
+      const clock = new import_core3.HybridLogicalClock(this.nodeId, this.timeSource);
+      const latest = await this.latestOperationTimestamp(
+        tx,
+        input.target.collection,
+        input.target.id
+      );
+      if (latest) {
+        clock.advanceTo(latest);
+      }
+      const ops = await input.buildOperations(current, { clock });
+      const now = Date.now();
+      for (const op of ops) {
+        const deliverySeq = await this.nextDeliverySeq(tx);
+        const row = this.serializeOperation(op, now, deliverySeq);
+        await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
+        await tx.insert(pgSyncState).values({ nodeId: op.nodeId, maxSequenceNumber: op.sequenceNumber, lastSeenAt: now }).onConflictDoUpdate({
+          target: pgSyncState.nodeId,
+          set: {
+            maxSequenceNumber: import_drizzle_orm.sql`GREATEST(${pgSyncState.maxSequenceNumber}, ${op.sequenceNumber})`,
+            lastSeenAt: import_drizzle_orm.sql`${now}`
+          }
+        });
+        if (this.schema?.collections[op.collection]) {
+          await this.rebuildMaterializedRecord(tx, op.collection, op.recordId);
+        }
+      }
+      return { admitted: true, idempotent: false, applied: ops };
+    });
+    for (const op of result.applied) {
+      const currentMax = this.versionVector.get(op.nodeId) ?? 0;
+      if (op.sequenceNumber > currentMax) {
+        this.versionVector.set(op.nodeId, op.sequenceNumber);
+      }
+    }
+    return result;
+  }
   async getOperationRange(nodeId, fromSeq, toSeq) {
     this.assertOpen();
     await this.ready;
@@ -918,6 +1055,23 @@ var PostgresServerStore = class {
     const result = await this.db.select({ value: (0, import_drizzle_orm.count)() }).from(pgOperations);
     return result[0]?.value ?? 0;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    await this.ready;
+    const rows = await this.db.execute(
+      import_drizzle_orm.sql`SELECT COALESCE(MAX(delivery_seq), 0) AS m FROM operations`
+    );
+    return Number(rows[0]?.m ?? 0);
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    await this.ready;
+    const rows = await this.db.select().from(pgOperations).where((0, import_drizzle_orm.gt)(pgOperations.deliverySeq, afterDeliverySequence)).orderBy((0, import_drizzle_orm.asc)(pgOperations.deliverySeq)).limit(limit);
+    return rows.map((row) => ({
+      operation: this.deserializeOperation(row),
+      deliverySequence: row.deliverySeq ?? 0
+    }));
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     await this.ready;
@@ -952,7 +1106,7 @@ var PostgresServerStore = class {
     this.assertCollection(collection);
     const schema = this.schema;
     const collectionDef = schema.collections[collection];
-    const query = import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw(collection)} WHERE id = ${id} AND _deleted = 0`;
+    const query = import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collection))} WHERE id = ${id} AND _deleted = 0`;
     const rows = await this.db.execute(query);
     if (rows.length === 0) return null;
     return this.deserializeRow(rows[0], collectionDef);
@@ -969,7 +1123,7 @@ var PostgresServerStore = class {
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false);
-    const query = import_drizzle_orm.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm.sql.raw(collection)} WHERE ${whereClause}`;
+    const query = import_drizzle_orm.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collection))} WHERE ${whereClause}`;
     const rows = await this.db.execute(query);
     const cnt = rows[0]?.cnt;
     return typeof cnt === "string" ? Number.parseInt(cnt, 10) : cnt ?? 0;
@@ -981,7 +1135,7 @@ var PostgresServerStore = class {
     this.assertOpen();
     await this.ready;
     const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
-    const rows = await this.db.select().from(pgOperations).orderBy((0, import_drizzle_orm.asc)(pgOperations.sequenceNumber));
+    const rows = await this.db.select().from(pgOperations).orderBy((0, import_drizzle_orm.asc)(pgOperations.deliverySeq));
     const operations2 = rows.map((row) => this.deserializeOperation(row));
     return buildServerBackup2(this.nodeId, operations2, this.versionVector);
   }
@@ -996,6 +1150,7 @@ var PostgresServerStore = class {
         const result = await this.applyRemoteOperation(op);
         if (result === "applied") restored++;
       }
+      this.sequenceCounter = null;
       return { operationsRestored: restored, success: true };
     }
     const now = Date.now();
@@ -1005,20 +1160,49 @@ var PostgresServerStore = class {
       for (const [nid, seq] of versionVector) {
         await tx.insert(pgSyncState).values({ nodeId: nid, maxSequenceNumber: seq, lastSeenAt: now }).onConflictDoNothing({ target: pgSyncState.nodeId });
       }
+      let deliverySeq = 0;
       for (const op of operations2) {
-        const row = this.serializeOperation(op, now);
+        deliverySeq += 1;
+        const row = this.serializeOperation(op, now, deliverySeq);
         await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
       }
+      await tx.execute(
+        import_drizzle_orm.sql`INSERT INTO delivery_counter (id, value) VALUES (1, ${deliverySeq})
+					ON CONFLICT (id) DO UPDATE SET value = ${deliverySeq}`
+      );
     });
     this.versionVector.clear();
     for (const [nid, seq] of versionVector) {
       this.versionVector.set(nid, seq);
     }
+    this.sequenceCounter = null;
     return { operationsRestored: operations2.length, success: true };
   }
   // ---------------------------------------------------------------------------
   // Materialization internals
   // ---------------------------------------------------------------------------
+  /**
+   * The HLC timestamp of the most recent operation on a record, by total order
+   * (wallTime, logical, nodeId), or null when the record has no operations. Used
+   * by {@link applyConditional} to advance its clock past the record's latest
+   * write so newly built operations sort strictly after it.
+   */
+  async latestOperationTimestamp(txOrDb, collection, recordId) {
+    const rows = await txOrDb.select({
+      wallTime: pgOperations.wallTime,
+      logical: pgOperations.logical,
+      timestampNodeId: pgOperations.timestampNodeId
+    }).from(pgOperations).where((0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(pgOperations.collection, collection), (0, import_drizzle_orm.eq)(pgOperations.recordId, recordId))).orderBy(
+      (0, import_drizzle_orm.desc)(pgOperations.wallTime),
+      (0, import_drizzle_orm.desc)(pgOperations.logical),
+      (0, import_drizzle_orm.desc)(pgOperations.timestampNodeId)
+    ).limit(1);
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    return { wallTime: row.wallTime, logical: row.logical, nodeId: row.timestampNodeId };
+  }
   /**
    * Rebuild a single record in the materialized collection table by replaying
    * all operations for that record.
@@ -1029,17 +1213,19 @@ var PostgresServerStore = class {
     const ops = await txOrDb.select({
       type: pgOperations.type,
       data: pgOperations.data,
+      atomicOps: pgOperations.atomicOps,
       wallTime: pgOperations.wallTime
     }).from(pgOperations).where((0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(pgOperations.collection, collection), (0, import_drizzle_orm.eq)(pgOperations.recordId, recordId))).orderBy(
       (0, import_drizzle_orm.asc)(pgOperations.wallTime),
       (0, import_drizzle_orm.asc)(pgOperations.logical),
-      (0, import_drizzle_orm.asc)(pgOperations.sequenceNumber)
+      (0, import_drizzle_orm.asc)(pgOperations.timestampNodeId)
     );
     const parsedOps = ops.map((op) => ({
       type: op.type,
-      data: op.data !== null ? JSON.parse(op.data) : null
+      data: op.data !== null ? JSON.parse(op.data) : null,
+      atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     const fieldNames = Object.keys(collectionDef.fields);
     if (recordData) {
       const createdAt = ops.length > 0 ? ops[0].wallTime : Date.now();
@@ -1056,7 +1242,7 @@ var PostgresServerStore = class {
       );
     } else {
       await txOrDb.execute(
-        import_drizzle_orm.sql`UPDATE ${import_drizzle_orm.sql.raw(collection)} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
+        import_drizzle_orm.sql`UPDATE ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collection))} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
       );
     }
   }
@@ -1075,16 +1261,16 @@ var PostgresServerStore = class {
       updatedAt,
       0
     ];
-    const columnsSql = import_drizzle_orm.sql.raw(allColumns.join(", "));
+    const columnsSql = import_drizzle_orm.sql.raw(allColumns.map((c) => (0, import_core3.quoteIdent)(c)).join(", "));
     const valuesSql = import_drizzle_orm.sql.join(
       values.map((v) => import_drizzle_orm.sql`${v}`),
       import_drizzle_orm.sql.raw(", ")
     );
     const updateSet = import_drizzle_orm.sql.raw(
-      allColumns.slice(1).map((c) => `${c} = excluded.${c}`).join(", ")
+      allColumns.slice(1).map((c) => `${(0, import_core3.quoteIdent)(c)} = excluded.${(0, import_core3.quoteIdent)(c)}`).join(", ")
     );
     await txOrDb.execute(
-      import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw(tableName)} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+      import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
     );
   }
   /**
@@ -1106,11 +1292,12 @@ var PostgresServerStore = class {
       recordId: pgOperations.recordId,
       type: pgOperations.type,
       data: pgOperations.data,
+      atomicOps: pgOperations.atomicOps,
       wallTime: pgOperations.wallTime
     }).from(pgOperations).where((0, import_drizzle_orm.eq)(pgOperations.collection, collectionName)).orderBy(
       (0, import_drizzle_orm.asc)(pgOperations.wallTime),
       (0, import_drizzle_orm.asc)(pgOperations.logical),
-      (0, import_drizzle_orm.asc)(pgOperations.sequenceNumber)
+      (0, import_drizzle_orm.asc)(pgOperations.timestampNodeId)
     );
     if (allOps.length === 0) return;
     const grouped = /* @__PURE__ */ new Map();
@@ -1126,9 +1313,10 @@ var PostgresServerStore = class {
     for (const [recordId, recordOps] of grouped) {
       const parsedOps = recordOps.map((op) => ({
         type: op.type,
-        data: op.data !== null ? JSON.parse(op.data) : null
+        data: op.data !== null ? JSON.parse(op.data) : null,
+        atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
       }));
-      const recordData = replayOperationsForRecord(parsedOps);
+      const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
       if (recordData) {
         const createdAt = recordOps[0].wallTime;
         const updatedAt = recordOps[recordOps.length - 1].wallTime;
@@ -1144,7 +1332,7 @@ var PostgresServerStore = class {
         );
       } else {
         await this.db.execute(
-          import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw(collectionName)} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
+          import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collectionName))} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
         );
       }
     }
@@ -1157,10 +1345,12 @@ var PostgresServerStore = class {
       options?.where ?? {},
       options?.includeDeleted ?? false
     );
-    const parts = [import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw(collection)} WHERE ${whereClause}`];
+    const parts = [
+      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collection))} WHERE ${whereClause}`
+    ];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
-      parts.push(import_drizzle_orm.sql.raw(` ORDER BY ${options.orderBy} ${dir}`));
+      parts.push(import_drizzle_orm.sql.raw(` ORDER BY ${(0, import_core3.quoteIdent)(options.orderBy)} ${dir}`));
     }
     if (options?.limit !== void 0) {
       parts.push(import_drizzle_orm.sql` LIMIT ${options.limit}`);
@@ -1176,7 +1366,7 @@ var PostgresServerStore = class {
       conditions.push(import_drizzle_orm.sql.raw("_deleted = 0"));
     }
     for (const [key, value] of Object.entries(where)) {
-      conditions.push(import_drizzle_orm.sql`${import_drizzle_orm.sql.raw(key)} = ${value}`);
+      conditions.push(import_drizzle_orm.sql`${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(key))} = ${value}`);
     }
     if (conditions.length === 0) {
       return import_drizzle_orm.sql.raw("1 = 1");
@@ -1249,44 +1439,92 @@ var PostgresServerStore = class {
     }
   }
   async ensureTables() {
-    await this.db.execute(import_drizzle_orm.sql`
-			CREATE TABLE IF NOT EXISTS operations (
-				id TEXT PRIMARY KEY,
-				node_id TEXT NOT NULL,
-				type TEXT NOT NULL,
-				collection TEXT NOT NULL,
-				record_id TEXT NOT NULL,
-				data TEXT,
-				previous_data TEXT,
-				wall_time BIGINT NOT NULL,
-				logical INTEGER NOT NULL,
-				timestamp_node_id TEXT NOT NULL,
-				sequence_number INTEGER NOT NULL,
-				causal_deps TEXT NOT NULL DEFAULT '[]',
-				schema_version INTEGER NOT NULL,
-				received_at BIGINT NOT NULL
-			)
-		`);
-    await this.db.execute(
-      import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)`
-    );
-    await this.db.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)`);
-    await this.db.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_received ON operations (received_at)`);
-    await this.db.execute(
-      import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection_record ON operations (collection, record_id)`
+    await this.db.transaction(async (tx) => {
+      await tx.execute(import_drizzle_orm.sql`SELECT pg_advisory_xact_lock(hashtextextended('kora:ensure-tables', 0))`);
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS operations (
+					id TEXT PRIMARY KEY,
+					node_id TEXT NOT NULL,
+					type TEXT NOT NULL,
+					collection TEXT NOT NULL,
+					record_id TEXT NOT NULL,
+					data TEXT,
+					previous_data TEXT,
+					atomic_ops TEXT,
+					wall_time BIGINT NOT NULL,
+					logical INTEGER NOT NULL,
+					timestamp_node_id TEXT NOT NULL,
+					sequence_number INTEGER NOT NULL,
+					causal_deps TEXT NOT NULL DEFAULT '[]',
+					schema_version INTEGER NOT NULL,
+					received_at BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`ALTER TABLE operations ADD COLUMN IF NOT EXISTS atomic_ops TEXT`);
+      await tx.execute(import_drizzle_orm.sql`ALTER TABLE operations ADD COLUMN IF NOT EXISTS delivery_seq BIGINT`);
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)`
+      );
+      await tx.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)`);
+      await tx.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_received ON operations (received_at)`);
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_delivery_seq ON operations (delivery_seq)`
+      );
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection_record ON operations (collection, record_id)`
+      );
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS sync_state (
+					node_id TEXT PRIMARY KEY,
+					max_sequence_number INTEGER NOT NULL,
+					last_seen_at BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS delivery_counter (
+					id INTEGER PRIMARY KEY,
+					value BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				WITH ordered AS (
+					SELECT id, ROW_NUMBER() OVER (
+						ORDER BY received_at ASC, sequence_number ASC, id ASC
+					) + COALESCE((SELECT MAX(delivery_seq) FROM operations), 0) AS rn
+					FROM operations WHERE delivery_seq IS NULL
+				)
+				UPDATE operations o SET delivery_seq = ordered.rn
+				FROM ordered WHERE o.id = ordered.id
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				INSERT INTO delivery_counter (id, value)
+				VALUES (1, COALESCE((SELECT MAX(delivery_seq) FROM operations), 0))
+				ON CONFLICT (id) DO UPDATE
+					SET value = GREATEST(delivery_counter.value, EXCLUDED.value)
+			`);
+    });
+  }
+  /**
+   * Reserve the next delivery sequence inside an open append transaction. The
+   * `UPDATE ... RETURNING` locks the counter row until this transaction commits,
+   * serializing assignment into commit order (see the counter table comment).
+   */
+  async nextDeliverySeq(tx) {
+    const rows = await tx.execute(
+      import_drizzle_orm.sql`UPDATE delivery_counter SET value = value + 1 WHERE id = 1 RETURNING value`
     );
-    await this.db.execute(import_drizzle_orm.sql`
-			CREATE TABLE IF NOT EXISTS sync_state (
-				node_id TEXT PRIMARY KEY,
-				max_sequence_number INTEGER NOT NULL,
-				last_seen_at BIGINT NOT NULL
-			)
-		`);
+    const value = rows[0]?.value;
+    if (value === void 0 || value === null) {
+      throw new Error(
+        "delivery_counter row (id=1) is missing; the operations log cannot assign delivery sequences"
+      );
+    }
+    return Number(value);
   }
   // ---------------------------------------------------------------------------
   // Operation serialization
   // ---------------------------------------------------------------------------
-  serializeOperation(op, receivedAt) {
+  serializeOperation(op, receivedAt, deliverySeq) {
     return {
       id: op.id,
       nodeId: op.nodeId,
@@ -1295,16 +1533,19 @@ var PostgresServerStore = class {
       recordId: op.recordId,
       data: op.data !== null ? JSON.stringify(op.data) : null,
       previousData: op.previousData !== null ? JSON.stringify(op.previousData) : null,
+      atomicOps: op.atomicOps && Object.keys(op.atomicOps).length > 0 ? JSON.stringify(op.atomicOps) : null,
       wallTime: op.timestamp.wallTime,
       logical: op.timestamp.logical,
       timestampNodeId: op.timestamp.nodeId,
       sequenceNumber: op.sequenceNumber,
       causalDeps: JSON.stringify(op.causalDeps),
       schemaVersion: op.schemaVersion,
-      receivedAt
+      receivedAt,
+      deliverySeq
     };
   }
   deserializeOperation(row) {
+    const atomicOps = row.atomicOps != null ? JSON.parse(row.atomicOps) : void 0;
     return {
       id: row.id,
       nodeId: row.nodeId,
@@ -1320,7 +1561,8 @@ var PostgresServerStore = class {
       },
       sequenceNumber: row.sequenceNumber,
       causalDeps: JSON.parse(row.causalDeps),
-      schemaVersion: row.schemaVersion
+      schemaVersion: row.schemaVersion,
+      ...atomicOps ? { atomicOps } : {}
     };
   }
   // ---------------------------------------------------------------------------
@@ -1390,6 +1632,8 @@ var operations = (0, import_sqlite_core.sqliteTable)(
     // JSON-serialized, null for deletes
     previousData: (0, import_sqlite_core.text)("previous_data"),
     // JSON-serialized, null for insert/delete
+    atomicOps: (0, import_sqlite_core.text)("atomic_ops"),
+    // JSON-serialized Record<field, AtomicOp>, null when none
     wallTime: (0, import_sqlite_core.integer)("wall_time").notNull(),
     logical: (0, import_sqlite_core.integer)("logical").notNull(),
     timestampNodeId: (0, import_sqlite_core.text)("timestamp_node_id").notNull(),
@@ -1397,12 +1641,17 @@ var operations = (0, import_sqlite_core.sqliteTable)(
     causalDeps: (0, import_sqlite_core.text)("causal_deps").notNull().default("[]"),
     // JSON array of op IDs
     schemaVersion: (0, import_sqlite_core.integer)("schema_version").notNull(),
-    receivedAt: (0, import_sqlite_core.integer)("received_at").notNull()
+    receivedAt: (0, import_sqlite_core.integer)("received_at").notNull(),
+    // Server-assigned monotonic delivery sequence, ordered by commit. Drives the
+    // gap-free server->client delivery watermark. Nullable only for rows written
+    // before the column existed; those are backfilled on startup.
+    deliverySeq: (0, import_sqlite_core.integer)("delivery_seq")
   },
   (table) => ({
     nodeSeqIdx: (0, import_sqlite_core.index)("idx_node_seq").on(table.nodeId, table.sequenceNumber),
     collectionIdx: (0, import_sqlite_core.index)("idx_collection").on(table.collection),
-    receivedIdx: (0, import_sqlite_core.index)("idx_received").on(table.receivedAt)
+    receivedIdx: (0, import_sqlite_core.index)("idx_received").on(table.receivedAt),
+    deliveryIdx: (0, import_sqlite_core.index)("idx_delivery_seq").on(table.deliverySeq)
   })
 );
 var syncState = (0, import_sqlite_core.sqliteTable)("sync_state", {
@@ -1410,6 +1659,10 @@ var syncState = (0, import_sqlite_core.sqliteTable)("sync_state", {
   maxSequenceNumber: (0, import_sqlite_core.integer)("max_sequence_number").notNull(),
   lastSeenAt: (0, import_sqlite_core.integer)("last_seen_at").notNull()
 });
+var deliveryCounter = (0, import_sqlite_core.sqliteTable)("delivery_counter", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey(),
+  value: (0, import_sqlite_core.integer)("value").notNull()
+});
 
 // src/store/sqlite-server-store.ts
 var esmRequire = (0, import_node_module.createRequire)(importMetaUrl);
@@ -1463,12 +1716,15 @@ var SqliteServerStore = class {
   async applyRemoteOperation(op) {
     this.assertOpen();
     const now = Date.now();
-    const row = this.serializeOperation(op, now);
     const result = this.db.transaction((tx) => {
-      const insertResult = tx.insert(operations).values(row).onConflictDoNothing({ target: operations.id }).run();
-      if (insertResult.changes === 0) {
+      const existing = tx.all(
+        import_drizzle_orm2.sql`SELECT id FROM operations WHERE id = ${op.id} LIMIT 1`
+      );
+      if (existing.length > 0) {
         return "duplicate";
       }
+      const row = this.serializeOperation(op, now, this.nextDeliverySeq(tx));
+      tx.insert(operations).values(row).run();
       tx.insert(syncState).values({
         nodeId: op.nodeId,
         maxSequenceNumber: op.sequenceNumber,
@@ -1497,6 +1753,21 @@ var SqliteServerStore = class {
     const result = this.db.select({ value: (0, import_drizzle_orm2.count)() }).from(operations).all();
     return result[0]?.value ?? 0;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    const rows = this.db.all(
+      import_drizzle_orm2.sql`SELECT MAX(delivery_seq) AS m FROM operations`
+    );
+    return rows[0]?.m ?? 0;
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    const rows = this.db.select().from(operations).where((0, import_drizzle_orm2.gt)(operations.deliverySeq, afterDeliverySequence)).orderBy((0, import_drizzle_orm2.asc)(operations.deliverySeq)).limit(limit).all();
+    return rows.map((row) => ({
+      operation: this.deserializeOperation(row),
+      deliverySequence: row.deliverySeq ?? 0
+    }));
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     if (this.schema?.collections[collection]) {
@@ -1528,7 +1799,7 @@ var SqliteServerStore = class {
     this.assertCollection(collection);
     const schema = this.schema;
     const collectionDef = schema.collections[collection];
-    const query = import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE id = ${id} AND _deleted = 0`;
+    const query = import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collection))} WHERE id = ${id} AND _deleted = 0`;
     const rows = this.db.all(query);
     if (rows.length === 0) return null;
     return this.deserializeRow(rows[0], collectionDef);
@@ -1544,7 +1815,7 @@ var SqliteServerStore = class {
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false);
-    const query = import_drizzle_orm2.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE ${whereClause}`;
+    const query = import_drizzle_orm2.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collection))} WHERE ${whereClause}`;
     const rows = this.db.all(query);
     return rows[0]?.cnt ?? 0;
   }
@@ -1554,7 +1825,7 @@ var SqliteServerStore = class {
   async exportBackup() {
     this.assertOpen();
     const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
-    const rows = this.db.select().from(operations).all();
+    const rows = this.db.select().from(operations).orderBy((0, import_drizzle_orm2.asc)(operations.deliverySeq)).all();
     const deserialized = rows.map((row) => this.deserializeOperation(row));
     const vv = this.getVersionVector();
     return buildServerBackup2(this.nodeId, deserialized, vv);
@@ -1574,13 +1845,17 @@ var SqliteServerStore = class {
     this.db.transaction((tx) => {
       tx.run(import_drizzle_orm2.sql.raw("DELETE FROM operations"));
       tx.run(import_drizzle_orm2.sql.raw("DELETE FROM sync_state"));
+      tx.update(deliveryCounter).set({ value: 0 }).where((0, import_drizzle_orm2.eq)(deliveryCounter.id, 1)).run();
       for (const [nid, seq] of versionVector) {
         tx.insert(syncState).values({ nodeId: nid, maxSequenceNumber: seq, lastSeenAt: Date.now() }).run();
       }
+      let deliverySeq = 0;
       for (const op of ops) {
-        const row = this.serializeOperation(op, Date.now());
+        deliverySeq += 1;
+        const row = this.serializeOperation(op, Date.now(), deliverySeq);
         tx.insert(operations).values(row).run();
       }
+      tx.update(deliveryCounter).set({ value: deliverySeq }).where((0, import_drizzle_orm2.eq)(deliveryCounter.id, 1)).run();
     });
     return { operationsRestored: ops.length, success: true };
   }
@@ -1598,13 +1873,15 @@ var SqliteServerStore = class {
     const ops = txOrDb.select({
       type: operations.type,
       data: operations.data,
+      atomicOps: operations.atomicOps,
       wallTime: operations.wallTime
-    }).from(operations).where((0, import_drizzle_orm2.and)((0, import_drizzle_orm2.eq)(operations.collection, collection), (0, import_drizzle_orm2.eq)(operations.recordId, recordId))).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.sequenceNumber)).all();
+    }).from(operations).where((0, import_drizzle_orm2.and)((0, import_drizzle_orm2.eq)(operations.collection, collection), (0, import_drizzle_orm2.eq)(operations.recordId, recordId))).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.timestampNodeId)).all();
     const parsedOps = ops.map((op) => ({
       type: op.type,
-      data: op.data !== null ? JSON.parse(op.data) : null
+      data: op.data !== null ? JSON.parse(op.data) : null,
+      atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     const fieldNames = Object.keys(collectionDef.fields);
     if (recordData) {
       const createdAt = ops.length > 0 ? ops[0].wallTime : Date.now();
@@ -1621,7 +1898,7 @@ var SqliteServerStore = class {
       );
     } else {
       txOrDb.run(
-        import_drizzle_orm2.sql`UPDATE ${import_drizzle_orm2.sql.raw(collection)} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
+        import_drizzle_orm2.sql`UPDATE ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collection))} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
       );
     }
   }
@@ -1642,16 +1919,16 @@ var SqliteServerStore = class {
       0
       // _deleted = false
     ];
-    const columnsSql = import_drizzle_orm2.sql.raw(allColumns.join(", "));
+    const columnsSql = import_drizzle_orm2.sql.raw(allColumns.map((c) => (0, import_core4.quoteIdent)(c)).join(", "));
     const valuesSql = import_drizzle_orm2.sql.join(
       values.map((v) => import_drizzle_orm2.sql`${v}`),
       import_drizzle_orm2.sql.raw(", ")
     );
     const updateSet = import_drizzle_orm2.sql.raw(
-      allColumns.slice(1).map((c) => `${c} = excluded.${c}`).join(", ")
+      allColumns.slice(1).map((c) => `${(0, import_core4.quoteIdent)(c)} = excluded.${(0, import_core4.quoteIdent)(c)}`).join(", ")
     );
     txOrDb.run(
-      import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw(tableName)} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+      import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
     );
   }
   /**
@@ -1674,8 +1951,9 @@ var SqliteServerStore = class {
       recordId: operations.recordId,
       type: operations.type,
       data: operations.data,
+      atomicOps: operations.atomicOps,
       wallTime: operations.wallTime
-    }).from(operations).where((0, import_drizzle_orm2.eq)(operations.collection, collectionName)).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.sequenceNumber)).all();
+    }).from(operations).where((0, import_drizzle_orm2.eq)(operations.collection, collectionName)).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.timestampNodeId)).all();
     if (allOps.length === 0) return;
     const grouped = /* @__PURE__ */ new Map();
     for (const op of allOps) {
@@ -1691,9 +1969,10 @@ var SqliteServerStore = class {
       for (const [recordId, recordOps] of grouped) {
         const parsedOps = recordOps.map((op) => ({
           type: op.type,
-          data: op.data !== null ? JSON.parse(op.data) : null
+          data: op.data !== null ? JSON.parse(op.data) : null,
+          atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
         }));
-        const recordData = replayOperationsForRecord(parsedOps);
+        const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
         if (recordData) {
           const createdAt = recordOps[0].wallTime;
           const updatedAt = recordOps[recordOps.length - 1].wallTime;
@@ -1709,7 +1988,7 @@ var SqliteServerStore = class {
           );
         } else {
           tx.run(
-            import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw(collectionName)} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
+            import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collectionName))} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
           );
         }
       }
@@ -1723,10 +2002,12 @@ var SqliteServerStore = class {
       options?.where ?? {},
       options?.includeDeleted ?? false
     );
-    const parts = [import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE ${whereClause}`];
+    const parts = [
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collection))} WHERE ${whereClause}`
+    ];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
-      parts.push(import_drizzle_orm2.sql.raw(` ORDER BY ${options.orderBy} ${dir}`));
+      parts.push(import_drizzle_orm2.sql.raw(` ORDER BY ${(0, import_core4.quoteIdent)(options.orderBy)} ${dir}`));
     }
     if (options?.limit !== void 0) {
       parts.push(import_drizzle_orm2.sql` LIMIT ${options.limit}`);
@@ -1742,7 +2023,7 @@ var SqliteServerStore = class {
       conditions.push(import_drizzle_orm2.sql.raw("_deleted = 0"));
     }
     for (const [key, value] of Object.entries(where)) {
-      conditions.push(import_drizzle_orm2.sql`${import_drizzle_orm2.sql.raw(key)} = ${value}`);
+      conditions.push(import_drizzle_orm2.sql`${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(key))} = ${value}`);
     }
     if (conditions.length === 0) {
       return import_drizzle_orm2.sql.raw("1 = 1");
@@ -1813,6 +2094,7 @@ var SqliteServerStore = class {
 				record_id TEXT NOT NULL,
 				data TEXT,
 				previous_data TEXT,
+				atomic_ops TEXT,
 				wall_time INTEGER NOT NULL,
 				logical INTEGER NOT NULL,
 				timestamp_node_id TEXT NOT NULL,
@@ -1822,9 +2104,35 @@ var SqliteServerStore = class {
 				received_at INTEGER NOT NULL
 			)
 		`);
+    try {
+      this.db.run(import_drizzle_orm2.sql`ALTER TABLE operations ADD COLUMN atomic_ops TEXT`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : "";
+      const causeMsg = e instanceof Error && e.cause instanceof Error ? e.cause.message : "";
+      if (!msg.includes("duplicate column") && !causeMsg.includes("duplicate column")) {
+        throw e;
+      }
+    }
+    try {
+      this.db.run(import_drizzle_orm2.sql`ALTER TABLE operations ADD COLUMN delivery_seq INTEGER`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : "";
+      const causeMsg = e instanceof Error && e.cause instanceof Error ? e.cause.message : "";
+      if (!msg.includes("duplicate column") && !causeMsg.includes("duplicate column")) {
+        throw e;
+      }
+    }
     this.db.run(import_drizzle_orm2.sql`
 			CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)
 		`);
+    this.db.run(import_drizzle_orm2.sql`
+			CREATE INDEX IF NOT EXISTS idx_delivery_seq ON operations (delivery_seq)
+		`);
+    this.db.run(import_drizzle_orm2.sql`
+			CREATE UNIQUE INDEX IF NOT EXISTS idx_delivery_seq_unique
+			ON operations (delivery_seq)
+			WHERE delivery_seq IS NOT NULL
+		`);
     this.db.run(import_drizzle_orm2.sql`
 			CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)
 		`);
@@ -1841,11 +2149,60 @@ var SqliteServerStore = class {
 				last_seen_at INTEGER NOT NULL
 			)
 		`);
+    this.db.run(import_drizzle_orm2.sql`
+			CREATE TABLE IF NOT EXISTS delivery_counter (
+				id INTEGER PRIMARY KEY,
+				value INTEGER NOT NULL
+			)
+		`);
+    this.backfillDeliverySequence();
+  }
+  /**
+   * Assign delivery sequences to any operations written before the column existed,
+   * then seed the durable counter from the current max. Ordered by
+   * (received_at, sequence_number, id) so the backfill is deterministic and stable
+   * across restarts. A one-time migration: after it runs, all rows have a value.
+   */
+  backfillDeliverySequence() {
+    this.db.transaction((tx) => {
+      const maxRow = tx.all(
+        import_drizzle_orm2.sql`SELECT MAX(delivery_seq) AS m FROM operations`
+      );
+      let next = maxRow[0]?.m ?? 0;
+      const nullRows = tx.all(
+        import_drizzle_orm2.sql`SELECT id FROM operations WHERE delivery_seq IS NULL ORDER BY received_at ASC, sequence_number ASC, id ASC`
+      );
+      for (const row of nullRows) {
+        next += 1;
+        tx.run(import_drizzle_orm2.sql`UPDATE operations SET delivery_seq = ${next} WHERE id = ${row.id}`);
+      }
+      tx.insert(deliveryCounter).values({ id: 1, value: next }).onConflictDoUpdate({
+        target: deliveryCounter.id,
+        set: {
+          value: import_drizzle_orm2.sql`MAX(${deliveryCounter.value}, ${next})`
+        }
+      }).run();
+    });
+  }
+  /**
+   * Reserve the next delivery sequence inside the append transaction. SQLite locks
+   * the database for the write transaction, and this counter row keeps sequence
+   * allocation shared by every SqliteServerStore instance using the same file.
+   */
+  nextDeliverySeq(tx) {
+    const rows = tx.update(deliveryCounter).set({ value: import_drizzle_orm2.sql`${deliveryCounter.value} + 1` }).where((0, import_drizzle_orm2.eq)(deliveryCounter.id, 1)).returning({ value: deliveryCounter.value }).all();
+    const value = rows[0]?.value;
+    if (value === void 0 || value === null) {
+      throw new Error(
+        "delivery_counter row (id=1) is missing; the operations log cannot assign delivery sequences"
+      );
+    }
+    return value;
   }
   // ---------------------------------------------------------------------------
   // Operation serialization
   // ---------------------------------------------------------------------------
-  serializeOperation(op, receivedAt) {
+  serializeOperation(op, receivedAt, deliverySeq) {
     return {
       id: op.id,
       nodeId: op.nodeId,
@@ -1854,16 +2211,19 @@ var SqliteServerStore = class {
       recordId: op.recordId,
       data: op.data !== null ? JSON.stringify(op.data) : null,
       previousData: op.previousData !== null ? JSON.stringify(op.previousData) : null,
+      atomicOps: op.atomicOps && Object.keys(op.atomicOps).length > 0 ? JSON.stringify(op.atomicOps) : null,
       wallTime: op.timestamp.wallTime,
       logical: op.timestamp.logical,
       timestampNodeId: op.timestamp.nodeId,
       sequenceNumber: op.sequenceNumber,
       causalDeps: JSON.stringify(op.causalDeps),
       schemaVersion: op.schemaVersion,
-      receivedAt
+      receivedAt,
+      deliverySeq
     };
   }
   deserializeOperation(row) {
+    const atomicOps = row.atomicOps != null ? JSON.parse(row.atomicOps) : void 0;
     return {
       id: row.id,
       nodeId: row.nodeId,
@@ -1879,7 +2239,8 @@ var SqliteServerStore = class {
       },
       sequenceNumber: row.sequenceNumber,
       causalDeps: JSON.parse(row.causalDeps),
-      schemaVersion: row.schemaVersion
+      schemaVersion: row.schemaVersion,
+      ...atomicOps ? { atomicOps } : {}
     };
   }
   // ---------------------------------------------------------------------------
@@ -2065,8 +2426,10 @@ var WsServerTransport = class {
 // src/session/client-session.ts
 init_cjs_shims();
 var import_core10 = require("@korajs/core");
+var import_core11 = require("@korajs/core");
 var import_internal = require("@korajs/core/internal");
 var import_sync2 = require("@korajs/sync");
+var import_sync3 = require("@korajs/sync");
 
 // src/apply/apply-server-operation.ts
 init_cjs_shims();
@@ -2177,6 +2540,9 @@ async function createServerSideEffectOperation(store, parentOp, effect, schemaVe
   );
 }
 function nextServerSequenceNumber(store) {
+  if (store.reserveSequenceNumber) {
+    return store.reserveSequenceNumber();
+  }
   const nodeId = store.getNodeId();
   const current = store.getVersionVector().get(nodeId) ?? 0;
   return current + 1;
@@ -2186,14 +2552,28 @@ function nextServerSequenceNumber(store) {
 async function applyServerOperation(store, op, relationLookup) {
   const schema = store.getSchema();
   const lookup = relationLookup ?? (schema ? (0, import_merge2.buildMergeRelationLookup)(schema) : /* @__PURE__ */ new Map());
+  const shapeCheck = validateOperationShape(op, schema);
+  if (!shapeCheck.valid) {
+    return {
+      result: "skipped",
+      appliedOperations: [],
+      rejection: {
+        code: shapeCheck.code ?? "SCHEMA_VALIDATION_ERROR",
+        message: shapeCheck.message ?? `Operation "${op.id}" does not match the server schema`,
+        retriable: false
+      }
+    };
+  }
   const constraintCheck = await validateIncomingOperationConstraints(store, op, schema);
   if (!constraintCheck.valid) {
+    const code = constraintCheck.code ?? "CONSTRAINT_VIOLATION";
     return {
       result: "skipped",
       appliedOperations: [],
       rejection: {
-        code: constraintCheck.code ?? "CONSTRAINT_VIOLATION",
-        message: constraintCheck.message ?? `Operation "${op.id}" violates a schema constraint`
+        code,
+        message: constraintCheck.message ?? `Operation "${op.id}" violates a schema constraint`,
+        retriable: isRetriableRejection(code)
       }
     };
   }
@@ -2206,7 +2586,8 @@ async function applyServerOperation(store, op, relationLookup) {
         appliedOperations: [],
         rejection: {
           code: "REFERENTIAL_INTEGRITY",
-          message: `Operation "${op.id}" violates referential integrity on "${op.collection}"`
+          message: `Operation "${op.id}" violates referential integrity on "${op.collection}"`,
+          retriable: isRetriableRejection("REFERENTIAL_INTEGRITY")
         }
       };
     }
@@ -2215,16 +2596,14 @@ async function applyServerOperation(store, op, relationLookup) {
       return { result: primaryResult, appliedOperations: [] };
     }
     const appliedOperations = [op];
-    let serverSeq = nextServerSequenceNumber(store);
     for (const effect of referential.sideEffectOps) {
       const sideOp = await createServerSideEffectOperation(
         store,
         op,
         effect,
         op.schemaVersion,
-        serverSeq
+        nextServerSequenceNumber(store)
       );
-      serverSeq += 1;
       const sideResult = await store.applyRemoteOperation(sideOp);
       if (sideResult === "applied") {
         appliedOperations.push(sideOp);
@@ -2238,6 +2617,75 @@ async function applyServerOperation(store, op, relationLookup) {
     appliedOperations: result === "applied" ? [op] : []
   };
 }
+function validateOperationShape(op, schema) {
+  if (!schema) {
+    return { valid: true };
+  }
+  const collection = schema.collections[op.collection];
+  if (!collection) {
+    return {
+      valid: false,
+      code: "UNKNOWN_COLLECTION",
+      message: `Operation "${op.id}" targets unknown collection "${op.collection}".`
+    };
+  }
+  const declaredFields = new Set(Object.keys(collection.fields));
+  const systemPreviousFields = /* @__PURE__ */ new Set(["id", "_created_at", "_updated_at", "_deleted"]);
+  const invalidDataField = firstInvalidField(op.data, declaredFields);
+  if (invalidDataField) {
+    return {
+      valid: false,
+      code: "SCHEMA_VALIDATION_ERROR",
+      message: `Operation "${op.id}" contains undeclared field "${invalidDataField}" in data for collection "${op.collection}".`
+    };
+  }
+  const invalidPreviousField = firstInvalidField(
+    op.previousData,
+    declaredFields,
+    systemPreviousFields
+  );
+  if (invalidPreviousField) {
+    return {
+      valid: false,
+      code: "SCHEMA_VALIDATION_ERROR",
+      message: `Operation "${op.id}" contains undeclared field "${invalidPreviousField}" in previousData for collection "${op.collection}".`
+    };
+  }
+  if (op.atomicOps) {
+    for (const field of Object.keys(op.atomicOps)) {
+      if (!declaredFields.has(field)) {
+        return {
+          valid: false,
+          code: "SCHEMA_VALIDATION_ERROR",
+          message: `Operation "${op.id}" contains undeclared atomic field "${field}" for collection "${op.collection}".`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function firstInvalidField(value, declaredFields, extraAllowedFields) {
+  if (value === null || value === void 0) {
+    return null;
+  }
+  if (typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  for (const field of Object.keys(value)) {
+    if (!declaredFields.has(field) && !extraAllowedFields?.has(field)) {
+      return field;
+    }
+  }
+  return null;
+}
+
+// src/auth/no-auth.ts
+init_cjs_shims();
+var NoAuthProvider = class {
+  async authenticate(_token) {
+    return { userId: "anonymous" };
+  }
+};
 
 // src/scopes/resolve-session-scopes.ts
 init_cjs_shims();
@@ -2277,11 +2725,12 @@ function mergeScopeMaps(base, overlay, source) {
 
 // src/scopes/server-scope-filter.ts
 init_cjs_shims();
-function operationMatchesScopes(op, scopes) {
+function operationMatchesScopes(op, scopes, fullRecord) {
   if (!scopes) return true;
   const collectionScope = scopes[op.collection];
   if (!collectionScope) return false;
-  const snapshot = buildSnapshot(op);
+  if (Object.keys(collectionScope).length === 0) return true;
+  const snapshot = buildSnapshot(op, fullRecord);
   if (!snapshot) return false;
   for (const [field, expected] of Object.entries(collectionScope)) {
     if (snapshot[field] !== expected) {
@@ -2290,11 +2739,20 @@ function operationMatchesScopes(op, scopes) {
   }
   return true;
 }
-function buildSnapshot(op) {
+function missingScopeFields(op, scopes) {
+  if (!scopes) return [];
+  const collectionScope = scopes[op.collection];
+  if (!collectionScope) return [];
+  if (Object.keys(collectionScope).length === 0) return [];
+  const snapshot = buildSnapshot(op);
+  return Object.keys(collectionScope).filter((field) => !snapshot || !(field in snapshot));
+}
+function buildSnapshot(op, fullRecord) {
   const previous = asRecord(op.previousData);
   const next = asRecord(op.data);
-  if (!previous && !next) return null;
+  if (!previous && !next && !fullRecord) return null;
   return {
+    ...fullRecord ?? {},
     ...previous ?? {},
     ...next ?? {}
   };
@@ -2368,35 +2826,114 @@ var SessionRateLimiter = class {
 // src/session/client-session.ts
 var DEFAULT_BATCH_SIZE = 100;
 var DEFAULT_SCHEMA_VERSION = 1;
-var ClientSession = class {
+var warnedUnscopedProviders = /* @__PURE__ */ new WeakSet();
+function warnIfMultiTenantWithoutScopes(auth, resolvedScopes, schema) {
+  if (!auth || auth instanceof NoAuthProvider) {
+    return;
+  }
+  if (resolvedScopes) {
+    return;
+  }
+  if (!schema || Object.keys(schema.collections).length === 0) {
+    return;
+  }
+  if (warnedUnscopedProviders.has(auth)) {
+    return;
+  }
+  warnedUnscopedProviders.add(auth);
+  console.warn(
+    "[kora] An authenticated session resolved to no sync scopes, so every user will sync every other user's data. Return per-user sync scopes from your auth provider (for example KoraAuthProvider's resolveScopes) to isolate tenants. Note: declaring sync rules in your schema is not enough on its own \u2014 the per-user values come from the auth provider. (This warning is expected for single-tenant apps where all authenticated users are meant to share the same data.)"
+  );
+}
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    const entries = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function sameScopeMap(a, b) {
+  return stableStringify(a ?? null) === stableStringify(b ?? null);
+}
+var ClientSession = class _ClientSession {
   state = "connected";
   clientNodeId = null;
   authContext = null;
   syncQuerySubsets = [];
   resumeDeltaCursor = null;
+  /**
+   * The delivery watermark the client reported at handshake, or null when the client
+   * does not use the delivery watermark (old client, or no watermark yet). When set,
+   * the server drives the gap-free server->client stream from delivery sequences
+   * instead of the version-vector delta.
+   */
+  clientDeliveryWatermark = null;
+  /**
+   * The highest delivery sequence this client has ACKNOWLEDGED (its confirmed
+   * watermark, as reported in acks). Incremental streaming pushes resume from here, not
+   * from the highest sequence sent, so a dropped or unapplied batch is always
+   * re-included by the next push (which re-scans from the acknowledged position). This
+   * is what makes streaming recovery independent of any bounded retransmit buffer: there
+   * is no sent-but-unacked window that a buffer eviction could strand. Seeded from the
+   * client's reported watermark at handshake.
+   */
+  lastAckedDeliverySeq = 0;
+  /**
+   * Timestamp of the last delivery-stream send attempt. Periodic retransmission uses
+   * this as its stale window so a slow client does not receive duplicate full-stream
+   * batches every server tick while the first batch is still being applied.
+   */
+  lastDeliveryPushAttemptAtMs = 0;
+  deliveryStallRepeatCount = 0;
+  /** Serializes incremental delivery pushes so their batches never interleave. */
+  deliveryPushChain = Promise.resolve();
+  /**
+   * Relay batches sent to this client but not yet acknowledged, keyed by messageId.
+   * The client acks every operation-batch it applies; on ack the entry is cleared.
+   * {@link retransmitPendingRelays} re-sends anything still unacked, so a relay
+   * dropped by a lossy transport is redelivered instead of leaving the client with a
+   * permanent version-vector gap (a lost operation) that delta sync cannot recover.
+   * Bounded so a silent client cannot grow it without limit.
+   */
+  pendingRelays = /* @__PURE__ */ new Map();
+  static MAX_PENDING_RELAYS = 1e3;
   sessionId;
   transport;
   store;
   auth;
   serializer;
   emitter;
+  logger;
   batchSize;
   schemaVersion;
   supportedSchemaVersions;
+  operationTransforms;
   onRelay;
   onAwarenessUpdate;
   onYjsDocUpdate;
+  onBlobChunkRequest;
+  onBlobChunkResponse;
+  persistBlobChunk;
   onClose;
+  onOrphanedRelays;
+  takeOrphanedRelays;
   maxOperationBytes;
   maxOpsPerMinute;
   rateLimiter;
+  validateOperation;
+  koraContext;
   constructor(options) {
     this.sessionId = options.sessionId;
     this.transport = options.transport;
     this.store = options.store;
     this.auth = options.auth ?? null;
-    this.serializer = options.serializer ?? new import_sync2.NegotiatedMessageSerializer("json");
+    this.serializer = options.serializer ?? new import_sync3.NegotiatedMessageSerializer("json");
     this.emitter = options.emitter ?? null;
+    this.logger = options.logger ?? null;
     this.batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
     this.schemaVersion = options.schemaVersion ?? DEFAULT_SCHEMA_VERSION;
     const supported = options.supportedSchemaVersions;
@@ -2404,13 +2941,21 @@ var ClientSession = class {
       min: this.schemaVersion,
       max: this.schemaVersion
     };
+    this.operationTransforms = options.operationTransforms ?? [];
     this.onRelay = options.onRelay ?? null;
     this.onAwarenessUpdate = options.onAwarenessUpdate ?? null;
     this.onYjsDocUpdate = options.onYjsDocUpdate ?? null;
+    this.onBlobChunkRequest = options.onBlobChunkRequest ?? null;
+    this.onBlobChunkResponse = options.onBlobChunkResponse ?? null;
+    this.persistBlobChunk = options.persistBlobChunk ?? null;
     this.onClose = options.onClose ?? null;
+    this.onOrphanedRelays = options.onOrphanedRelays ?? null;
+    this.takeOrphanedRelays = options.takeOrphanedRelays ?? null;
     this.maxOperationBytes = options.maxOperationBytes ?? DEFAULT_MAX_OPERATION_BYTES;
     this.maxOpsPerMinute = options.maxOpsPerMinute ?? DEFAULT_MAX_OPS_PER_MINUTE;
     this.rateLimiter = new SessionRateLimiter(this.maxOpsPerMinute);
+    this.validateOperation = options.validateOperation ?? null;
+    this.koraContext = options.koraContext ?? null;
   }
   /**
    * Start handling messages from the client transport.
@@ -2430,39 +2975,143 @@ var ClientSession = class {
    */
   relayOperations(operations2) {
     if (this.state !== "streaming" || !this.transport.isConnected()) return;
+    if (this.clientDeliveryWatermark !== null) {
+      this.pushDeliveryStream();
+      return;
+    }
     if (operations2.length === 0) return;
-    const visibleOperations = operations2.filter((op) => this.operationVisibleToClient(op));
+    void this.relayVisibleOperations(operations2);
+  }
+  /**
+   * Push newly-available in-scope operations to a delivery-watermark client, resuming
+   * from the highest delivery sequence already sent. Pushes are serialized so their
+   * batches never interleave (which would break the base/max chain).
+   */
+  pushDeliveryStream() {
+    this.deliveryPushChain = this.deliveryPushChain.then(async () => {
+      if (this.state !== "streaming" || !this.transport.isConnected()) return;
+      try {
+        this.lastDeliveryPushAttemptAtMs = Date.now();
+        await this.sendDeliveryStream(
+          this.lastAckedDeliverySeq,
+          false,
+          this.clientNodeId ?? void 0
+        );
+      } catch {
+      }
+    });
+  }
+  async relayVisibleOperations(operations2) {
+    const visibleOperations = [];
+    for (const op of operations2) {
+      if (await this.operationVisibleToClient(op)) {
+        visibleOperations.push(op);
+      }
+    }
     if (visibleOperations.length === 0) return;
+    if (this.state !== "streaming" || !this.transport.isConnected()) return;
     const serializedOps = visibleOperations.map((op) => this.serializer.encodeOperation(op));
     const msg = {
       type: "operation-batch",
-      messageId: (0, import_core10.generateUUIDv7)(),
+      messageId: (0, import_core11.generateUUIDv7)(),
       operations: serializedOps,
       isFinal: true,
       batchIndex: 0
     };
+    this.trackPendingRelay(msg, visibleOperations);
     this.sendToClient(msg);
   }
+  /** Record a relay batch as awaiting acknowledgment, evicting the oldest if full. */
+  trackPendingRelay(msg, ops) {
+    if (this.pendingRelays.size >= _ClientSession.MAX_PENDING_RELAYS) {
+      const oldest = this.pendingRelays.keys().next().value;
+      if (oldest !== void 0) {
+        this.pendingRelays.delete(oldest);
+      }
+    }
+    this.pendingRelays.set(msg.messageId, { message: msg, ops, sentAtMs: Date.now() });
+  }
   /**
-   * Close this session.
+   * Retransmit relay batches this client has not acknowledged within `staleMs`.
+   * Called on a periodic tick by the server (and directly by tests). Redelivering an
+   * already-applied op is harmless: the client dedups by content-addressed id.
    */
-  close(reason) {
-    if (this.state === "closed") return;
-    this.state = "closed";
-    if (this.transport.isConnected()) {
-      this.transport.close(1e3, reason ?? "session closed");
+  retransmitPendingRelays(staleMs = 0) {
+    if (this.state !== "streaming" || !this.transport.isConnected()) return;
+    if (this.clientDeliveryWatermark !== null) {
+      return;
+    }
+    if (this.pendingRelays.size === 0) return;
+    const cutoff = Date.now() - staleMs;
+    for (const { message, sentAtMs } of this.pendingRelays.values()) {
+      if (sentAtMs <= cutoff) {
+        this.sendToClient(message);
+      }
     }
-    this.onClose?.(this.sessionId);
-  }
-  // --- Getters ---
-  getState() {
-    return this.state;
-  }
-  getSessionId() {
-    return this.sessionId;
   }
-  getClientNodeId() {
-    return this.clientNodeId;
+  /**
+   * Wake the durable delivery stream for clients that negotiated delivery
+   * watermarks. This is used both for dropped watermark batches and for operations
+   * appended by another server/store instance: the session always scans from its
+   * own acknowledged cursor and applies its visibility filter before sending.
+   */
+  pushDeliveryStreamIfSupported(staleMs = 0, options = {}) {
+    if (this.state !== "streaming" || !this.transport.isConnected()) return;
+    if (this.clientDeliveryWatermark === null) return;
+    if (staleMs > 0 && Date.now() - this.lastDeliveryPushAttemptAtMs < staleMs) {
+      return;
+    }
+    if (options.trackStall) {
+      this.deliveryStallRepeatCount += 1;
+      if (this.deliveryStallRepeatCount >= 3) {
+        this.emitter?.emit({
+          type: "sync:delivery-stalled",
+          sessionId: this.sessionId,
+          watermark: this.lastAckedDeliverySeq,
+          repeatCount: this.deliveryStallRepeatCount
+        });
+      }
+    }
+    this.pushDeliveryStream();
+  }
+  /**
+   * Close this session.
+   */
+  /**
+   * Hand any unacknowledged relays to the server so they survive this session and are
+   * redelivered when this client reconnects (per-node buffer), then clear them. Called
+   * from every session-teardown path (explicit close and transport close).
+   */
+  flushOrphanedRelays() {
+    if (this.onOrphanedRelays && this.clientNodeId && this.pendingRelays.size > 0) {
+      const ops = [];
+      for (const entry of this.pendingRelays.values()) {
+        ops.push(...entry.ops);
+      }
+      if (ops.length > 0) {
+        this.onOrphanedRelays(this.clientNodeId, ops);
+      }
+    }
+    this.pendingRelays.clear();
+  }
+  close(reason) {
+    if (this.state === "closed") return;
+    this.state = "closed";
+    this.flushOrphanedRelays();
+    if (this.transport.isConnected()) {
+      this.transport.close(1e3, reason ?? "session closed");
+    }
+    this.onClose?.(this.sessionId);
+  }
+  // --- Getters ---
+  getState() {
+    return this.state;
+  }
+  getSessionId() {
+    return this.sessionId;
+  }
+  getClientNodeId() {
+    return this.clientNodeId;
   }
   getAuthContext() {
     return this.authContext;
@@ -2503,6 +3152,11 @@ var ClientSession = class {
         await this.handleOperationBatch(message);
         break;
       case "acknowledgment":
+        this.pendingRelays.delete(message.acknowledgedMessageId);
+        if (message.deliverySequence !== void 0) {
+          this.lastAckedDeliverySeq = Math.max(this.lastAckedDeliverySeq, message.deliverySequence);
+          this.deliveryStallRepeatCount = 0;
+        }
         break;
       case "error":
         break;
@@ -2512,10 +3166,47 @@ var ClientSession = class {
       case "yjs-doc-update":
         this.handleYjsDocUpdate(message);
         break;
+      case "blob-chunk-request":
+        this.onBlobChunkRequest?.(this.sessionId, message);
+        break;
+      case "blob-chunk-response":
+        this.onBlobChunkResponse?.(this.sessionId, message);
+        break;
+      case "blob-chunk-push":
+        await this.handleBlobChunkPush(message);
+        break;
     }
   }
+  /**
+   * Persist a client-uploaded blob chunk (or manifest) centrally. The bytes are
+   * verified to hash to the declared hash before storing, so a corrupt or
+   * mislabeled upload is rejected rather than served later as trusted content.
+   */
+  async handleBlobChunkPush(message) {
+    if (!this.persistBlobChunk) {
+      return;
+    }
+    const bytes = (0, import_sync2.decodeBlobChunkBytes)(message.bytes);
+    const actual = await (0, import_core11.hashBlob)(bytes);
+    if (actual !== message.hash) {
+      return;
+    }
+    await this.persistBlobChunk(message.hash, bytes);
+  }
   handleMessageFailure(error) {
     const reason = error instanceof Error ? error.message : "Message handling failed";
+    this.logger?.log({
+      timestamp: Date.now(),
+      level: "error",
+      event: "session.message_failed",
+      sessionId: this.sessionId,
+      nodeId: this.clientNodeId ?? void 0,
+      error: reason,
+      details: {
+        state: this.state,
+        errorName: error instanceof Error ? error.name : typeof error
+      }
+    });
     this.sendError("SYNC_ERROR", reason, true);
     this.close(reason);
   }
@@ -2547,25 +3238,46 @@ var ClientSession = class {
         this.authContext = { userId: msg.nodeId, scopes: resolvedScopes };
       }
     }
+    warnIfMultiTenantWithoutScopes(this.auth, resolvedScopes, this.store.getSchema());
     if (msg.syncQueries && msg.syncQueries.length > 0) {
-      this.syncQuerySubsets = (0, import_sync2.dedupeQuerySubsets)(msg.syncQueries);
+      this.syncQuerySubsets = (0, import_sync3.dedupeQuerySubsets)(msg.syncQueries);
     } else {
       this.syncQuerySubsets = [];
     }
-    this.resumeDeltaCursor = msg.deltaCursor ? (0, import_sync2.decodeDeltaCursor)(msg.deltaCursor) : null;
+    this.resumeDeltaCursor = msg.deltaCursor ? (0, import_sync3.decodeDeltaCursor)(msg.deltaCursor) : null;
+    this.clientDeliveryWatermark = msg.lastDeliverySequence ?? null;
+    if (this.clientDeliveryWatermark !== null && !sameScopeMap(msg.syncScope, this.authContext?.scopes)) {
+      this.clientDeliveryWatermark = 0;
+    }
+    const clientUsesWatermark = this.clientDeliveryWatermark !== null;
+    let serverMaxDelivery = 0;
+    if (clientUsesWatermark) {
+      serverMaxDelivery = await this.store.getMaxDeliverySequence();
+      if (this.clientDeliveryWatermark !== null && this.clientDeliveryWatermark > serverMaxDelivery) {
+        this.clientDeliveryWatermark = 0;
+      }
+    }
     const serverVector = this.store.getVersionVector();
     const selectedWireFormat = selectWireFormat(msg.supportedWireFormats);
     this.setSerializerWireFormat(selectedWireFormat);
-    if (!(0, import_sync2.isClientSchemaVersionSupported)(msg.schemaVersion, this.supportedSchemaVersions)) {
+    if (!(0, import_sync3.isClientSchemaVersionSupported)(msg.schemaVersion, this.supportedSchemaVersions)) {
       const { min, max } = this.supportedSchemaVersions;
+      this.emitter?.emit({
+        type: "sync:schema-mismatch",
+        clientSchemaVersion: msg.schemaVersion,
+        serverSchemaVersion: this.schemaVersion,
+        supportedMin: min,
+        supportedMax: max,
+        reason: `${import_sync3.SCHEMA_MISMATCH_PREFIX}: client schema version ${msg.schemaVersion} not in supported range [${min}, ${max}]`
+      });
       const response2 = {
         type: "handshake-response",
-        messageId: (0, import_core10.generateUUIDv7)(),
+        messageId: (0, import_core11.generateUUIDv7)(),
         nodeId: this.store.getNodeId(),
-        versionVector: (0, import_sync2.versionVectorToWire)(serverVector),
+        versionVector: (0, import_sync3.versionVectorToWire)(serverVector),
         schemaVersion: this.schemaVersion,
         accepted: false,
-        rejectReason: `${import_sync2.SCHEMA_MISMATCH_PREFIX}: client schema version ${msg.schemaVersion} not in supported range [${min}, ${max}]`,
+        rejectReason: `${import_sync3.SCHEMA_MISMATCH_PREFIX}: client schema version ${msg.schemaVersion} not in supported range [${min}, ${max}]`,
         supportedSchemaMin: min,
         supportedSchemaMax: max,
         serverTime: Date.now()
@@ -2576,13 +3288,20 @@ var ClientSession = class {
     }
     const response = {
       type: "handshake-response",
-      messageId: (0, import_core10.generateUUIDv7)(),
+      messageId: (0, import_core11.generateUUIDv7)(),
       nodeId: this.store.getNodeId(),
-      versionVector: (0, import_sync2.versionVectorToWire)(serverVector),
+      versionVector: (0, import_sync3.versionVectorToWire)(serverVector),
       schemaVersion: this.schemaVersion,
       accepted: true,
       selectedWireFormat,
       serverTime: Date.now(),
+      // The server's highest delivery sequence, so a client whose persisted watermark
+      // is ahead of it (server rolled back) can reset to a full resync. Sent only to
+      // watermark-using clients.
+      ...clientUsesWatermark ? { serverMaxDeliverySequence: serverMaxDelivery } : {},
+      // Advertise central blob storage so the client uploads the bytes behind
+      // its blob fields, keeping them available after the author goes offline.
+      ...this.persistBlobChunk ? { blobStorageEnabled: true } : {},
       // Confirm the accepted scope so the client knows what data will be synced.
       // This may differ from what the client requested if auth scopes are narrower.
       ...this.authContext?.scopes ? { acceptedScope: this.authContext.scopes } : {}
@@ -2590,17 +3309,40 @@ var ClientSession = class {
     this.sendToClient(response);
     this.emitter?.emit({ type: "sync:connected", nodeId: msg.nodeId });
     this.state = "syncing";
-    const clientVector = (0, import_sync2.wireToVersionVector)(msg.versionVector);
-    await this.sendDelta(clientVector);
+    if (this.clientDeliveryWatermark !== null) {
+      this.lastAckedDeliverySeq = this.clientDeliveryWatermark;
+      const excludeOwn = this.clientDeliveryWatermark > 0 ? this.clientNodeId ?? void 0 : void 0;
+      this.lastDeliveryPushAttemptAtMs = Date.now();
+      await this.sendDeliveryStream(this.clientDeliveryWatermark, true, excludeOwn);
+    } else {
+      const clientVector = (0, import_sync3.wireToVersionVector)(msg.versionVector);
+      await this.sendDelta(clientVector);
+    }
     this.state = "streaming";
+    if (this.takeOrphanedRelays && this.clientNodeId) {
+      const buffered = this.takeOrphanedRelays(this.clientNodeId);
+      if (buffered.length > 0) {
+        this.relayOperations(buffered);
+      }
+    }
   }
   async handleOperationBatch(msg) {
     const operations2 = msg.operations.map((s) => this.serializer.decodeOperation(s));
     const applied = [];
-    const rejected = [];
+    let acknowledgedThrough = 0;
+    let canAdvanceAck = true;
     for (const op of operations2) {
-      if (!this.operationVisibleToClient(op)) {
-        rejected.push(op);
+      if (!canAdvanceAck) {
+        continue;
+      }
+      if (!await this.operationVisibleToClient(op)) {
+        this.sendOperationRejected(
+          op,
+          "SCOPE_VIOLATION",
+          `Operation "${op.id}" in collection "${op.collection}" is outside the client's sync scope. Refresh sync scopes and retry.`,
+          true
+        );
+        canAdvanceAck = false;
         continue;
       }
       if (!isOperationTimestampValid(op)) {
@@ -2609,6 +3351,7 @@ var ClientSession = class {
           `Operation "${op.id}" timestamp is too far in the future`,
           false
         );
+        canAdvanceAck = false;
         continue;
       }
       if (!this.rateLimiter.allow(1)) {
@@ -2617,6 +3360,7 @@ var ClientSession = class {
           `Session exceeded operation rate limit (${String(this.maxOpsPerMinute)} ops/min)`,
           true
         );
+        canAdvanceAck = false;
         continue;
       }
       const sizeCheck = validateOperationSize(op, this.maxOperationBytes);
@@ -2626,27 +3370,73 @@ var ClientSession = class {
           sizeCheck.message ?? `Operation "${op.id}" is too large`,
           false
         );
+        canAdvanceAck = false;
         continue;
       }
-      try {
-        const applyResult = await applyServerOperation(this.store, op);
-        if (applyResult.rejection) {
-          this.sendError(applyResult.rejection.code, applyResult.rejection.message, false);
+      const serverOp = this.transformForServerSchema(op);
+      if (serverOp === null) {
+        this.sendOperationRejected(
+          op,
+          "SCHEMA_TRANSFORM_UNAVAILABLE",
+          `Operation "${op.id}" cannot be transformed from schema v${op.schemaVersion} to server schema v${this.schemaVersion}.`,
+          false
+        );
+        acknowledgedThrough = op.sequenceNumber;
+        continue;
+      }
+      if (this.validateOperation && this.koraContext) {
+        let decision;
+        try {
+          decision = await this.validateOperation(serverOp, {
+            auth: this.authContext,
+            kora: this.koraContext
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "validator error";
+          this.sendOperationRejected(
+            serverOp,
+            "VALIDATION_ERROR",
+            `Validator threw: ${message}`,
+            true
+          );
+          canAdvanceAck = false;
           continue;
         }
-        if (applyResult.result === "applied") {
-          applied.push(...applyResult.appliedOperations);
+        if (decision.action === "reject") {
+          const retriable = decision.retriable ?? isRetriableRejection(decision.code);
+          this.sendOperationRejected(serverOp, decision.code, decision.message, retriable);
+          if (retriable) {
+            canAdvanceAck = false;
+          } else {
+            acknowledgedThrough = op.sequenceNumber;
+          }
+          continue;
+        }
+        if (decision.action === "ignore") {
+          acknowledgedThrough = op.sequenceNumber;
+          continue;
         }
-      } catch {
       }
-    }
-    if (rejected.length > 0) {
-      for (const op of rejected) {
-        this.sendError(
-          "SCOPE_VIOLATION",
-          `Operation "${op.id}" in collection "${op.collection}" is outside the client's sync scope`,
-          false
+      const applyResult = await applyServerOperation(this.store, serverOp);
+      if (applyResult.rejection) {
+        this.sendOperationRejected(
+          serverOp,
+          applyResult.rejection.code,
+          applyResult.rejection.message,
+          applyResult.rejection.retriable
         );
+        if (applyResult.rejection.retriable) {
+          canAdvanceAck = false;
+        } else {
+          acknowledgedThrough = op.sequenceNumber;
+        }
+        continue;
+      }
+      if (applyResult.result === "applied") {
+        applied.push(...applyResult.appliedOperations);
+        acknowledgedThrough = op.sequenceNumber;
+      } else {
+        acknowledgedThrough = op.sequenceNumber;
       }
     }
     if (operations2.length > 0) {
@@ -2659,15 +3449,21 @@ var ClientSession = class {
     const lastOp = operations2[operations2.length - 1];
     const ack = {
       type: "acknowledgment",
-      messageId: (0, import_core10.generateUUIDv7)(),
+      messageId: (0, import_core11.generateUUIDv7)(),
       acknowledgedMessageId: msg.messageId,
-      lastSequenceNumber: lastOp ? lastOp.sequenceNumber : 0
+      lastSequenceNumber: lastOp ? Math.min(acknowledgedThrough, lastOp.sequenceNumber) : 0
     };
     this.sendToClient(ack);
     if (applied.length > 0) {
       this.onRelay?.(this.sessionId, applied);
     }
   }
+  transformForServerSchema(op) {
+    if (op.schemaVersion === this.schemaVersion) {
+      return op;
+    }
+    return (0, import_core10.applyOperationTransforms)(op, this.schemaVersion, this.operationTransforms);
+  }
   async sendDelta(clientVector) {
     const serverVector = this.store.getVersionVector();
     const missing = [];
@@ -2675,14 +3471,17 @@ var ClientSession = class {
       const clientSeq = clientVector.get(nodeId) ?? 0;
       if (serverSeq > clientSeq) {
         const ops = await this.store.getOperationRange(nodeId, clientSeq + 1, serverSeq);
-        const visible = ops.filter((op) => this.operationVisibleToClient(op));
-        missing.push(...visible);
+        for (const op of ops) {
+          if (await this.operationVisibleToClient(op)) {
+            missing.push(op);
+          }
+        }
       }
     }
     if (missing.length === 0) {
       const emptyBatch = {
         type: "operation-batch",
-        messageId: (0, import_core10.generateUUIDv7)(),
+        messageId: (0, import_core11.generateUUIDv7)(),
         operations: [],
         isFinal: true,
         batchIndex: 0,
@@ -2692,12 +3491,12 @@ var ClientSession = class {
       return;
     }
     const sorted = (0, import_internal.topologicalSort)(missing);
-    const afterCursor = (0, import_sync2.sliceOperationsAfterCursor)(sorted, this.resumeDeltaCursor);
+    const afterCursor = (0, import_sync3.sliceOperationsAfterCursor)(sorted, this.resumeDeltaCursor);
     const totalBatches = Math.ceil(afterCursor.length / this.batchSize);
     if (afterCursor.length === 0) {
       const emptyBatch = {
         type: "operation-batch",
-        messageId: (0, import_core10.generateUUIDv7)(),
+        messageId: (0, import_core11.generateUUIDv7)(),
         operations: [],
         isFinal: true,
         batchIndex: this.resumeDeltaCursor?.batchIndex ?? 0,
@@ -2710,15 +3509,15 @@ var ClientSession = class {
       const start = i * this.batchSize;
       const batchOps = afterCursor.slice(start, start + this.batchSize);
       const serializedOps = batchOps.map((op) => this.serializer.encodeOperation(op));
-      const batchCursor = (0, import_sync2.createDeltaCursorFromBatch)(batchOps, i);
+      const batchCursor = (0, import_sync3.createDeltaCursorFromBatch)(batchOps, i);
       const batchMsg = {
         type: "operation-batch",
-        messageId: (0, import_core10.generateUUIDv7)(),
+        messageId: (0, import_core11.generateUUIDv7)(),
         operations: serializedOps,
         isFinal: i === totalBatches - 1,
         batchIndex: i,
         totalBatches,
-        ...batchCursor ? { cursor: (0, import_sync2.encodeDeltaCursor)(batchCursor) } : {}
+        ...batchCursor ? { cursor: (0, import_sync3.encodeDeltaCursor)(batchCursor) } : {}
       };
       this.sendToClient(batchMsg);
       this.emitter?.emit({
@@ -2728,11 +3527,111 @@ var ClientSession = class {
       });
     }
   }
-  operationVisibleToClient(op) {
-    if (!operationMatchesScopes(op, this.authContext?.scopes)) {
+  /**
+   * Send the gap-free server->client delivery stream, resuming just after
+   * `fromDeliverySeq`. Operations are scanned in server delivery-sequence order
+   * (commit order), scope-filtered for this session, and sent in batches that chain:
+   * each batch's `baseDeliverySequence` equals the previous batch's
+   * `maxDeliverySequence` (the first batch bases on `fromDeliverySeq`). The client
+   * applies a batch only when its watermark equals the base and advances the
+   * watermark to the max, so a dropped batch stalls the watermark and is recovered by
+   * the next handshake resend. Because delivery-sequence order respects causal order
+   * (a dependency is always committed, and thus sequenced, before its dependent), no
+   * topological sort is needed and the client never defers on a missing dependency
+   * that is itself in this stream.
+   *
+   * The final batch advances the watermark to the highest delivery sequence scanned,
+   * not merely the last in-scope one, so an out-of-scope tail is not re-scanned on the
+   * next reconnect. Returns the number of operations actually sent.
+   */
+  async sendDeliveryStream(fromDeliverySeq, finalizeWhenEmpty, excludeNodeId) {
+    const scanChunk = Math.max(this.batchSize, 1) * 5;
+    let scanCursor = fromDeliverySeq;
+    let maxScanned = fromDeliverySeq;
+    const visible = [];
+    while (true) {
+      const chunk = await this.store.getOperationsAfterDelivery(scanCursor, scanChunk);
+      const last = chunk[chunk.length - 1];
+      if (last === void 0) break;
+      scanCursor = last.deliverySequence;
+      maxScanned = scanCursor;
+      for (const delivered of chunk) {
+        if (excludeNodeId !== void 0 && delivered.operation.nodeId === excludeNodeId) {
+          continue;
+        }
+        if (await this.operationVisibleToClient(delivered.operation)) {
+          visible.push(delivered);
+        }
+      }
+      if (chunk.length < scanChunk) break;
+    }
+    if (visible.length === 0) {
+      if (finalizeWhenEmpty) {
+        this.sendDeliveryBatch([], fromDeliverySeq, maxScanned, 0, true);
+      }
+      return 0;
+    }
+    const totalBatches = Math.ceil(visible.length / this.batchSize);
+    let base = fromDeliverySeq;
+    for (let i = 0; i < totalBatches; i++) {
+      const slice = visible.slice(i * this.batchSize, (i + 1) * this.batchSize);
+      const lastInSlice = slice[slice.length - 1];
+      if (lastInSlice === void 0) continue;
+      const isFinal = i === totalBatches - 1;
+      const lastSeq = lastInSlice.deliverySequence;
+      const max = isFinal ? Math.max(maxScanned, lastSeq) : lastSeq;
+      this.sendDeliveryBatch(slice, base, max, i, isFinal);
+      base = max;
+    }
+    return visible.length;
+  }
+  /** Build, track, and send one chained delivery-stream batch. */
+  sendDeliveryBatch(slice, base, max, batchIndex, isFinal) {
+    const batchMsg = {
+      type: "operation-batch",
+      messageId: (0, import_core11.generateUUIDv7)(),
+      operations: slice.map((delivered) => this.serializer.encodeOperation(delivered.operation)),
+      isFinal,
+      batchIndex,
+      baseDeliverySequence: base,
+      maxDeliverySequence: max
+    };
+    this.sendToClient(batchMsg);
+    if (slice.length > 0) {
+      this.emitter?.emit({
+        type: "sync:sent",
+        operations: slice.map((delivered) => delivered.operation),
+        batchSize: slice.length
+      });
+    }
+  }
+  async operationVisibleToClient(op) {
+    const scopes = this.authContext?.scopes;
+    const subsets = this.syncQuerySubsets;
+    const needsBackfill = missingScopeFields(op, scopes).length > 0 || subsets !== void 0 && subsets.length > 0;
+    const fullRecord = needsBackfill ? await this.lookupRecordFields(op.collection, op.recordId) : void 0;
+    if (!operationMatchesScopes(op, scopes, fullRecord)) {
       return false;
     }
-    return (0, import_sync2.operationMatchesQuerySubsets)(op, this.syncQuerySubsets);
+    return (0, import_sync3.operationMatchesQuerySubsets)(op, subsets, fullRecord);
+  }
+  /**
+   * Read a record's current field values from the materialized store for scope /
+   * query-subset backfill. Includes soft-deleted rows so a relayed delete (whose op
+   * carries no fields) is still judged against the record's actual scope. Returns
+   * undefined when the record cannot be read (never materialized, or no schema).
+   */
+  async lookupRecordFields(collection, recordId) {
+    try {
+      const rows = await this.store.queryCollection(collection, {
+        where: { id: recordId },
+        includeDeleted: true,
+        limit: 1
+      });
+      return rows[0];
+    } catch {
+      return void 0;
+    }
   }
   handleAwarenessUpdate(msg) {
     this.onAwarenessUpdate?.(this.sessionId, msg);
@@ -2743,13 +3642,32 @@ var ClientSession = class {
   sendError(code, message, retriable) {
     const errorMsg = {
       type: "error",
-      messageId: (0, import_core10.generateUUIDv7)(),
+      messageId: (0, import_core11.generateUUIDv7)(),
       code,
       message,
       retriable
     };
     this.sendToClient(errorMsg);
   }
+  /**
+   * Reject one specific client operation, tied to its id, so the submitter can
+   * divert it out of its pending queue into a durable rejected store rather than
+   * losing it or retrying forever. The op is NOT materialized, so no other
+   * replica ever sees it.
+   */
+  sendOperationRejected(op, code, message, retriable) {
+    const rejectedMsg = {
+      type: "operation-rejected",
+      messageId: (0, import_core11.generateUUIDv7)(),
+      operationId: op.id,
+      collection: op.collection,
+      recordId: op.recordId,
+      code,
+      message,
+      retriable
+    };
+    this.sendToClient(rejectedMsg);
+  }
   setSerializerWireFormat(format) {
     if (typeof this.serializer.setWireFormat === "function") {
       this.serializer.setWireFormat(format);
@@ -2758,6 +3676,7 @@ var ClientSession = class {
   handleTransportClose() {
     if (this.state === "closed") return;
     this.state = "closed";
+    this.flushOrphanedRelays();
     this.emitter?.emit({ type: "sync:disconnected", reason: "transport closed" });
     this.onClose?.(this.sessionId);
   }
@@ -2771,13 +3690,13 @@ function selectWireFormat(supportedWireFormats) {
 
 // src/server/kora-sync-server.ts
 init_cjs_shims();
-var import_core12 = require("@korajs/core");
+var import_core14 = require("@korajs/core");
 var import_internal2 = require("@korajs/core/internal");
-var import_sync3 = require("@korajs/sync");
+var import_sync5 = require("@korajs/sync");
 
 // src/awareness/awareness-relay.ts
 init_cjs_shims();
-var import_core11 = require("@korajs/core");
+var import_core12 = require("@korajs/core");
 var AwarenessRelay = class {
   clients = /* @__PURE__ */ new Map();
   /**
@@ -2806,7 +3725,7 @@ var AwarenessRelay = class {
     if (hasStates) {
       const catchUpMsg = {
         type: "awareness-update",
-        messageId: (0, import_core11.generateUUIDv7)(),
+        messageId: (0, import_core12.generateUUIDv7)(),
         clientId: 0,
         // Server-sourced
         states: existingStates
@@ -2829,7 +3748,7 @@ var AwarenessRelay = class {
     };
     const msg = {
       type: "awareness-update",
-      messageId: (0, import_core11.generateUUIDv7)(),
+      messageId: (0, import_core12.generateUUIDv7)(),
       clientId: client.clientId,
       states: removalStates
     };
@@ -2990,6 +3909,114 @@ var ServerMetricsCollector = class {
   }
 };
 
+// src/richtext/blob-chunk-relay.ts
+init_cjs_shims();
+var import_sync4 = require("@korajs/sync");
+var BlobChunkRelay = class {
+  clients = /* @__PURE__ */ new Map();
+  /** requestId -> the session that originated the request (to route the answer back). */
+  pending = /* @__PURE__ */ new Map();
+  resolveBlobChunk;
+  constructor(resolveBlobChunk) {
+    this.resolveBlobChunk = resolveBlobChunk ?? null;
+  }
+  addClient(sessionId, transport) {
+    this.clients.set(sessionId, { sessionId, transport });
+  }
+  removeClient(sessionId) {
+    this.clients.delete(sessionId);
+    for (const [requestId, originSessionId] of this.pending) {
+      if (originSessionId === sessionId) {
+        this.pending.delete(requestId);
+      }
+    }
+  }
+  getClientCount() {
+    return this.clients.size;
+  }
+  getPendingCount() {
+    return this.pending.size;
+  }
+  clear() {
+    this.clients.clear();
+    this.pending.clear();
+  }
+  /**
+   * Handle an inbound chunk request from a session. Tries the server's own
+   * store first (if configured), otherwise forwards the request to peer
+   * sessions and remembers who to route the answer back to.
+   */
+  handleRequest(sourceSessionId, message) {
+    if (!this.clients.has(sourceSessionId)) {
+      return;
+    }
+    if (this.resolveBlobChunk) {
+      void this.resolveBlobChunk(message.hash).then(
+        (bytes) => {
+          if (bytes !== null) {
+            this.sendResponseTo(sourceSessionId, message.requestId, (0, import_sync4.encodeBlobChunkBytes)(bytes));
+            return;
+          }
+          this.forwardRequestToPeers(sourceSessionId, message);
+        },
+        () => {
+          this.forwardRequestToPeers(sourceSessionId, message);
+        }
+      );
+      return;
+    }
+    this.forwardRequestToPeers(sourceSessionId, message);
+  }
+  /**
+   * Handle an inbound chunk response from a peer. Routes it back to the session
+   * that originally requested it. A "not held" answer (bytes === null) is
+   * ignored so a peer without the chunk does not preempt one that has it; the
+   * requester's own per-request timeout bounds the wait.
+   */
+  handleResponse(sourceSessionId, message) {
+    if (!this.clients.has(sourceSessionId)) {
+      return;
+    }
+    if (message.bytes === null) {
+      return;
+    }
+    const originSessionId = this.pending.get(message.requestId);
+    if (!originSessionId) {
+      return;
+    }
+    this.pending.delete(message.requestId);
+    this.sendResponseTo(originSessionId, message.requestId, message.bytes);
+  }
+  forwardRequestToPeers(sourceSessionId, message) {
+    this.pending.set(message.requestId, sourceSessionId);
+    for (const [, client] of this.clients) {
+      if (client.sessionId === sourceSessionId) {
+        continue;
+      }
+      if (!client.transport.isConnected()) {
+        continue;
+      }
+      client.transport.send(message);
+    }
+  }
+  sendResponseTo(sessionId, requestId, bytes) {
+    const client = this.clients.get(sessionId);
+    if (!client || !client.transport.isConnected()) {
+      return;
+    }
+    const response = {
+      type: "blob-chunk-response",
+      messageId: generateResponseId(requestId),
+      requestId,
+      bytes
+    };
+    client.transport.send(response);
+  }
+};
+function generateResponseId(requestId) {
+  return `blob-resp-${requestId}`;
+}
+
 // src/richtext/yjs-doc-relay.ts
 init_cjs_shims();
 var YjsDocRelay = class {
@@ -3025,21 +4052,416 @@ var YjsDocRelay = class {
   }
 };
 
+// src/server/route-context.ts
+init_cjs_shims();
+var import_core13 = require("@korajs/core");
+
+// src/apply/route-predicate.ts
+init_cjs_shims();
+function evaluateField(actual, operators) {
+  if ("$eq" in operators && !Object.is(actual, operators.$eq)) {
+    return false;
+  }
+  if ("$ne" in operators && Object.is(actual, operators.$ne)) {
+    return false;
+  }
+  if (operators.$in !== void 0 && !operators.$in.some((candidate) => Object.is(actual, candidate))) {
+    return false;
+  }
+  const numericChecks = [
+    ["$lt", (a, b) => a < b],
+    ["$lte", (a, b) => a <= b],
+    ["$gt", (a, b) => a > b],
+    ["$gte", (a, b) => a >= b]
+  ];
+  for (const [operator, compare] of numericChecks) {
+    const bound = operators[operator];
+    if (bound === void 0) {
+      continue;
+    }
+    if (typeof actual !== "number" || typeof bound !== "number") {
+      return false;
+    }
+    if (!compare(actual, bound)) {
+      return false;
+    }
+  }
+  return true;
+}
+function evaluateRoutePredicate(record, predicate) {
+  const fields = Object.keys(predicate);
+  if (fields.length === 0) {
+    return true;
+  }
+  if (record === null) {
+    return false;
+  }
+  for (const field of fields) {
+    const operators = predicate[field];
+    if (operators && !evaluateField(record[field], operators)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// src/server/route-context.ts
+function recordMatchesScope(collection, record, scope) {
+  const collectionScope = scope[collection];
+  if (!collectionScope) {
+    return false;
+  }
+  for (const [field, expected] of Object.entries(collectionScope)) {
+    if (record[field] !== expected) {
+      return false;
+    }
+  }
+  return true;
+}
+function pickFields(record, keys) {
+  const picked = {};
+  for (const key of keys) {
+    if (key in record) {
+      picked[key] = record[key];
+    }
+  }
+  return picked;
+}
+async function buildRouteOperation(store, mutation, currentOverride, clockOverride) {
+  const nodeId = store.getNodeId();
+  const clock = clockOverride ?? new import_core13.HybridLogicalClock(nodeId);
+  const schemaVersion = store.getSchema()?.version ?? 1;
+  const sequenceNumber = nextServerSequenceNumber(store);
+  if (mutation.type === "insert") {
+    return (0, import_core13.createOperation)(
+      {
+        nodeId,
+        type: "insert",
+        collection: mutation.collection,
+        recordId: mutation.recordId ?? (0, import_core13.generateUUIDv7)(),
+        data: mutation.data ?? {},
+        previousData: null,
+        sequenceNumber,
+        causalDeps: [],
+        schemaVersion
+      },
+      clock
+    );
+  }
+  if (!mutation.recordId) {
+    throw new RouteMutationError(
+      "MISSING_RECORD_ID",
+      `A ${mutation.type} mutation on "${mutation.collection}" requires a recordId.`
+    );
+  }
+  const current = currentOverride ? currentOverride.record : await store.findRecord(mutation.collection, mutation.recordId);
+  if (mutation.type === "update") {
+    const rawData = mutation.data ?? {};
+    const data = {};
+    const atomicOps = {};
+    for (const key of Object.keys(rawData)) {
+      const value = rawData[key];
+      if ((0, import_core13.isAtomicOp)(value)) {
+        data[key] = (0, import_core13.resolveAtomicOp)(current ? current[key] : void 0, value);
+        atomicOps[key] = (0, import_core13.toAtomicOp)(value);
+      } else {
+        data[key] = value;
+      }
+    }
+    return (0, import_core13.createOperation)(
+      {
+        nodeId,
+        type: "update",
+        collection: mutation.collection,
+        recordId: mutation.recordId,
+        data,
+        previousData: current ? pickFields(current, Object.keys(rawData)) : {},
+        sequenceNumber,
+        causalDeps: [],
+        schemaVersion,
+        ...Object.keys(atomicOps).length > 0 ? { atomicOps } : {}
+      },
+      clock
+    );
+  }
+  return (0, import_core13.createOperation)(
+    {
+      nodeId,
+      type: "delete",
+      collection: mutation.collection,
+      recordId: mutation.recordId,
+      data: null,
+      previousData: current ? { ...current } : null,
+      sequenceNumber,
+      causalDeps: [],
+      schemaVersion
+    },
+    clock
+  );
+}
+var RouteMutationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "RouteMutationError";
+  }
+  code;
+};
+function createRouteContext(server, store) {
+  let mutationTail = Promise.resolve();
+  function serialize(work) {
+    const run = mutationTail.then(work, work);
+    mutationTail = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
+  async function prepareMutation(mutation, scope) {
+    let op;
+    try {
+      op = await buildRouteOperation(store, mutation);
+    } catch (error) {
+      if (error instanceof RouteMutationError) {
+        return {
+          ok: false,
+          rejection: {
+            ok: false,
+            code: error.code,
+            message: error.message,
+            retriable: isRetriableRejection(error.code)
+          }
+        };
+      }
+      throw error;
+    }
+    if (scope && !operationMatchesScopes(op, scope)) {
+      return {
+        ok: false,
+        rejection: {
+          ok: false,
+          code: "SCOPE_VIOLATION",
+          message: `Mutation on "${mutation.collection}" is outside the provided scope.`,
+          retriable: isRetriableRejection("SCOPE_VIOLATION")
+        }
+      };
+    }
+    return { ok: true, op };
+  }
+  async function commitOperation(op, collection) {
+    const result = await server.applyLocalOperation(op);
+    if (result.result !== "applied") {
+      const code = result.rejection?.code ?? "NOT_APPLIED";
+      return {
+        ok: false,
+        code,
+        message: result.rejection?.message ?? `Operation on "${collection}" was not applied (${result.result}).`,
+        // Prefer the pipeline's own classification when present; fall back
+        // to classifying the code so this stays correct if new codes appear.
+        retriable: result.rejection?.retriable ?? isRetriableRejection(code)
+      };
+    }
+    const record = await store.findRecord(collection, op.recordId);
+    return { ok: true, operation: op, record };
+  }
+  async function rawApply(mutation, scope) {
+    const prepared = await prepareMutation(mutation, scope);
+    if (!prepared.ok) {
+      return prepared.rejection;
+    }
+    return commitOperation(prepared.op, mutation.collection);
+  }
+  async function runConditionalViaStore(storeApplyConditional, spec, options) {
+    const scope = options?.scope;
+    const mutations = [];
+    const hasTargetUpdate = spec.update !== void 0 && spec.update !== null;
+    if (hasTargetUpdate) {
+      mutations.push({
+        collection: spec.collection,
+        type: "update",
+        recordId: spec.id,
+        data: spec.update
+      });
+    }
+    if (spec.also) {
+      mutations.push(...spec.also);
+    }
+    let result;
+    try {
+      result = await storeApplyConditional({
+        target: { collection: spec.collection, id: spec.id },
+        ...spec.idempotencyKey ? { idempotencyKey: spec.idempotencyKey } : {},
+        admit: (current) => spec.if && Object.keys(spec.if).length > 0 ? evaluateRoutePredicate(current, spec.if) : true,
+        buildOperations: async (current, context) => {
+          const ops = [];
+          for (let i = 0; i < mutations.length; i++) {
+            const mutation = mutations[i];
+            const useLockedCurrent = i === 0 && hasTargetUpdate;
+            const op = await buildRouteOperation(
+              store,
+              mutation,
+              useLockedCurrent ? { record: current } : void 0,
+              context.clock
+            );
+            if (scope && !operationMatchesScopes(op, scope)) {
+              throw new RouteMutationError(
+                "SCOPE_VIOLATION",
+                `Mutation on "${mutation.collection}" is outside the provided scope.`
+              );
+            }
+            ops.push(op);
+          }
+          return ops;
+        }
+      });
+    } catch (error) {
+      if (error instanceof RouteMutationError) {
+        return {
+          ok: false,
+          code: error.code,
+          message: error.message,
+          retriable: isRetriableRejection(error.code)
+        };
+      }
+      throw error;
+    }
+    if (!result.admitted) {
+      return {
+        ok: false,
+        code: spec.reject?.code ?? "CONDITION_NOT_MET",
+        message: spec.reject?.message ?? `Admission condition not met on "${spec.collection}" record "${spec.id}".`,
+        retriable: false
+      };
+    }
+    if (result.idempotent) {
+      const records2 = spec.idempotencyKey ? [await store.findRecord(spec.idempotencyKey.collection, spec.idempotencyKey.id)] : [];
+      return { ok: true, idempotent: true, operations: [], records: records2 };
+    }
+    server.relayServerOperations(result.applied);
+    const records = [];
+    for (const op of result.applied) {
+      records.push(await store.findRecord(op.collection, op.recordId));
+    }
+    return { ok: true, idempotent: false, operations: result.applied, records };
+  }
+  return {
+    apply(mutation, options) {
+      return serialize(() => rawApply(mutation, options?.scope));
+    },
+    applyConditional(spec, options) {
+      const storeApplyConditional = store.applyConditional;
+      if (storeApplyConditional) {
+        return runConditionalViaStore(storeApplyConditional.bind(store), spec, options);
+      }
+      return serialize(async () => {
+        if (spec.idempotencyKey) {
+          const existing = await store.findRecord(
+            spec.idempotencyKey.collection,
+            spec.idempotencyKey.id
+          );
+          if (existing) {
+            return { ok: true, idempotent: true, operations: [], records: [existing] };
+          }
+        }
+        if (spec.if && Object.keys(spec.if).length > 0) {
+          const target = await store.findRecord(spec.collection, spec.id);
+          if (!evaluateRoutePredicate(target, spec.if)) {
+            const code = spec.reject?.code ?? "CONDITION_NOT_MET";
+            return {
+              ok: false,
+              code,
+              message: spec.reject?.message ?? `Admission condition not met on "${spec.collection}" record "${spec.id}".`,
+              retriable: false
+            };
+          }
+        }
+        const mutations = [];
+        if (spec.update !== void 0 && spec.update !== null) {
+          mutations.push({
+            collection: spec.collection,
+            type: "update",
+            recordId: spec.id,
+            data: spec.update
+          });
+        }
+        if (spec.also) {
+          mutations.push(...spec.also);
+        }
+        const prepared = [];
+        for (const mutation of mutations) {
+          const p = await prepareMutation(mutation, options?.scope);
+          if (!p.ok) {
+            return p.rejection;
+          }
+          prepared.push({ op: p.op, collection: mutation.collection });
+        }
+        const operations2 = [];
+        const records = [];
+        for (const { op, collection } of prepared) {
+          const result = await commitOperation(op, collection);
+          if (!result.ok) {
+            return {
+              ok: false,
+              code: result.code,
+              message: result.message,
+              retriable: result.retriable
+            };
+          }
+          operations2.push(result.operation);
+          records.push(result.record);
+        }
+        return { ok: true, idempotent: false, operations: operations2, records };
+      });
+    },
+    async query(collection, options) {
+      const { scope, ...queryOptions } = options ?? {};
+      const records = await store.queryCollection(collection, queryOptions);
+      if (!scope) {
+        return records;
+      }
+      return records.filter((record) => recordMatchesScope(collection, record, scope));
+    },
+    async findById(collection, id, options) {
+      const record = await store.findRecord(collection, id);
+      if (!record) {
+        return null;
+      }
+      if (options?.scope && !recordMatchesScope(collection, record, options.scope)) {
+        return null;
+      }
+      return record;
+    }
+  };
+}
+
 // src/server/kora-sync-server.ts
 var DEFAULT_MAX_CONNECTIONS = 0;
 var DEFAULT_BATCH_SIZE2 = 100;
 var DEFAULT_SCHEMA_VERSION2 = 1;
 var DEFAULT_HOST = "0.0.0.0";
 var DEFAULT_PATH = "/";
-var KoraSyncServer = class {
+var DEFAULT_RELAY_RETRANSMIT_INTERVAL_MS = 2e3;
+var DEFAULT_DELIVERY_POLL_INTERVAL_MS = 2e3;
+function validateIntervalOption(name, value) {
+  if (!Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
+    throw new import_core14.SyncError(`${name} must be a non-negative integer number of milliseconds`, {
+      [name]: value
+    });
+  }
+  return value;
+}
+var KoraSyncServer = class _KoraSyncServer {
   store;
   auth;
   serializer;
   emitter;
   maxConnections;
   batchSize;
+  relayRetransmitIntervalMs;
+  deliveryPollIntervalMs;
   schemaVersion;
   supportedSchemaVersions;
+  operationTransforms;
   port;
   host;
   path;
@@ -3047,34 +4469,183 @@ var KoraSyncServer = class {
   metrics;
   awarenessRelay = new AwarenessRelay();
   yjsDocRelay = new YjsDocRelay();
+  blobChunkRelay;
+  persistBlobChunk;
+  maxOperationBytes;
+  maxOpsPerMinute;
+  validateOperation;
+  koraContext;
   sessions = /* @__PURE__ */ new Map();
   httpClients = /* @__PURE__ */ new Map();
   httpSessionToClient = /* @__PURE__ */ new Map();
-  serverVersion = "0.4.0";
+  // Informational value reported by getStatus(). Keep in sync with the
+  // @korajs/server package version on release; it is not used for protocol negotiation.
+  serverVersion = "1.0.0-beta.0";
   wsServer = null;
   running = false;
+  /**
+   * Periodic tick that retransmits relay batches connected clients have not
+   * acknowledged, so a relay dropped by a lossy transport is redelivered instead of
+   * leaving that client with a permanent version-vector gap (a lost operation).
+   */
+  relayRetransmitTimer = null;
+  deliveryPollTimer = null;
+  lastObservedDeliverySequence = 0;
+  deliveryPollInFlight = false;
+  /**
+   * Relay operations a client never acknowledged before it disconnected, buffered by
+   * client node id so they can be redelivered on its next connection. Bounded per
+   * node and expired by age so a client that never returns cannot grow this forever.
+   */
+  orphanedRelaysByNode = /* @__PURE__ */ new Map();
+  static MAX_ORPHANED_RELAY_OPS_PER_NODE = 5e3;
+  static ORPHANED_RELAY_TTL_MS = 5 * 6e4;
   constructor(config) {
     this.store = config.store;
+    const storeSchemaVersion = this.store.getSchema()?.version;
+    if (config.schemaVersion !== void 0 && storeSchemaVersion !== void 0 && config.schemaVersion !== storeSchemaVersion) {
+      throw new import_core14.SyncError("Sync schema version does not match the configured store schema.", {
+        syncSchemaVersion: config.schemaVersion,
+        storeSchemaVersion
+      });
+    }
     this.auth = config.auth ?? null;
-    this.serializer = config.serializer ?? new import_sync3.JsonMessageSerializer();
+    this.serializer = config.serializer ?? new import_sync5.JsonMessageSerializer();
     this.emitter = config.emitter ?? null;
     this.maxConnections = config.maxConnections ?? DEFAULT_MAX_CONNECTIONS;
     this.batchSize = config.batchSize ?? DEFAULT_BATCH_SIZE2;
-    this.schemaVersion = config.schemaVersion ?? DEFAULT_SCHEMA_VERSION2;
+    this.relayRetransmitIntervalMs = validateIntervalOption(
+      "relayRetransmitIntervalMs",
+      config.relayRetransmitIntervalMs ?? DEFAULT_RELAY_RETRANSMIT_INTERVAL_MS
+    );
+    this.deliveryPollIntervalMs = validateIntervalOption(
+      "deliveryPollIntervalMs",
+      config.deliveryPollIntervalMs ?? DEFAULT_DELIVERY_POLL_INTERVAL_MS
+    );
+    this.schemaVersion = config.schemaVersion ?? storeSchemaVersion ?? DEFAULT_SCHEMA_VERSION2;
     this.supportedSchemaVersions = config.supportedSchemaVersions ?? {
       min: this.schemaVersion,
       max: this.schemaVersion
     };
+    this.operationTransforms = config.operationTransforms ?? [];
     this.port = config.port;
     this.host = config.host ?? DEFAULT_HOST;
     this.path = config.path ?? DEFAULT_PATH;
     this.logger = config.logger ?? createDefaultLogger();
     this.metrics = config.metricsCollector ?? new ServerMetricsCollector();
     this.metrics.setSchemaVersion(this.schemaVersion);
+    this.blobChunkRelay = new BlobChunkRelay(config.resolveBlobChunk);
+    this.persistBlobChunk = config.persistBlobChunk ?? null;
+    this.maxOperationBytes = config.maxOperationBytes;
+    this.maxOpsPerMinute = config.maxOpsPerMinute;
+    this.validateOperation = config.validateOperation;
+    this.koraContext = createRouteContext(this, this.store);
     if (!this.emitter) {
       this.emitter = new import_internal2.SimpleEventEmitter();
     }
   }
+  ensureBackgroundTimersStarted() {
+    if (this.relayRetransmitIntervalMs > 0 && !this.relayRetransmitTimer) {
+      this.relayRetransmitTimer = setInterval(() => {
+        this.retransmitPendingRelays(this.relayRetransmitIntervalMs);
+      }, this.relayRetransmitIntervalMs);
+      this.relayRetransmitTimer.unref?.();
+    }
+    if (this.deliveryPollIntervalMs > 0 && !this.deliveryPollTimer) {
+      this.deliveryPollTimer = setInterval(() => {
+        void this.pollDeliveryLog();
+      }, this.deliveryPollIntervalMs);
+      this.deliveryPollTimer.unref?.();
+    }
+  }
+  /**
+   * Retransmit relay batches that connected clients have not acknowledged within
+   * `staleMs`. Called on a periodic tick and directly by tests. Redelivering an
+   * already-applied operation is harmless (clients dedup by content-addressed id).
+   */
+  retransmitPendingRelays(staleMs = 0) {
+    for (const session of this.sessions.values()) {
+      session.retransmitPendingRelays(staleMs);
+    }
+    this.expireOrphanedRelays();
+  }
+  /**
+   * Check whether the authoritative delivery log advanced without passing through
+   * this server instance, then wake delivery-watermark sessions to scan from their
+   * own acknowledged cursors. Session-level filtering remains the only fan-out path.
+   */
+  async pollDeliveryLog() {
+    if (this.deliveryPollInFlight) return;
+    this.deliveryPollInFlight = true;
+    try {
+      const maxDeliverySequence = await this.store.getMaxDeliverySequence();
+      if (maxDeliverySequence <= this.lastObservedDeliverySequence) {
+        for (const session of this.sessions.values()) {
+          session.pushDeliveryStreamIfSupported(this.deliveryPollIntervalMs, {
+            trackStall: true
+          });
+        }
+        return;
+      }
+      this.lastObservedDeliverySequence = maxDeliverySequence;
+      for (const session of this.sessions.values()) {
+        session.pushDeliveryStreamIfSupported(0);
+      }
+    } catch (error) {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "delivery_poll.failed",
+        details: { error: error instanceof Error ? error.message : String(error) }
+      });
+    } finally {
+      this.deliveryPollInFlight = false;
+    }
+  }
+  /**
+   * Buffer relay operations a disconnected client never acknowledged, keyed by its
+   * node id, deduped by operation id and bounded by count. Redelivered when the
+   * client reconnects (see {@link takeOrphanedRelays}).
+   */
+  bufferOrphanedRelays(nodeId, ops) {
+    if (ops.length === 0) return;
+    const existing = this.orphanedRelaysByNode.get(nodeId);
+    const merged = existing ? existing.ops : [];
+    const seen = new Set(merged.map((op) => op.id));
+    for (const op of ops) {
+      if (!seen.has(op.id)) {
+        merged.push(op);
+        seen.add(op.id);
+      }
+    }
+    const bounded = merged.length > _KoraSyncServer.MAX_ORPHANED_RELAY_OPS_PER_NODE ? merged.slice(merged.length - _KoraSyncServer.MAX_ORPHANED_RELAY_OPS_PER_NODE) : merged;
+    this.orphanedRelaysByNode.set(nodeId, { ops: bounded, bufferedAtMs: Date.now() });
+  }
+  /** Remove and return a node's buffered orphaned relay operations, if any. */
+  takeOrphanedRelays(nodeId) {
+    const entry = this.orphanedRelaysByNode.get(nodeId);
+    if (!entry) return [];
+    this.orphanedRelaysByNode.delete(nodeId);
+    return entry.ops;
+  }
+  /** Drop buffered orphaned relays older than the TTL (client never returned). */
+  expireOrphanedRelays() {
+    if (this.orphanedRelaysByNode.size === 0) return;
+    const cutoff = Date.now() - _KoraSyncServer.ORPHANED_RELAY_TTL_MS;
+    for (const [nodeId, entry] of this.orphanedRelaysByNode) {
+      if (entry.bufferedAtMs <= cutoff) {
+        this.orphanedRelaysByNode.delete(nodeId);
+      }
+    }
+  }
+  /**
+   * The trusted, scoped data-plane context (`apply` / `query` / `findById`).
+   * Shared with the production server so HTTP routes, the operation validator,
+   * and `server.kora` are all the same object over the same pipeline.
+   */
+  getKoraContext() {
+    return this.koraContext;
+  }
   /**
    * Subscribe to session-level events for metrics collection and logging.
    * Called when a new session is created.
@@ -3123,6 +4694,21 @@ var KoraSyncServer = class {
         details: { reason: event.reason }
       });
     });
+    sessionEmitter.on("sync:schema-mismatch", (event) => {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "session.schema_mismatch",
+        sessionId,
+        details: {
+          clientSchemaVersion: event.clientSchemaVersion,
+          serverSchemaVersion: event.serverSchemaVersion,
+          supportedMin: event.supportedMin,
+          supportedMax: event.supportedMax,
+          reason: event.reason
+        }
+      });
+    });
   }
   /**
    * Get the metrics collector for external access (e.g., HTTP endpoints).
@@ -3143,10 +4729,10 @@ var KoraSyncServer = class {
    */
   async start(wsServerImpl) {
     if (this.running) {
-      throw new import_core12.SyncError("Server is already running", { port: this.port });
+      throw new import_core14.SyncError("Server is already running", { port: this.port });
     }
     if (!wsServerImpl && this.port === void 0) {
-      throw new import_core12.SyncError(
+      throw new import_core14.SyncError(
         "Port is required for standalone mode. Provide port in config or use handleConnection() for attach mode.",
         {}
       );
@@ -3192,8 +4778,18 @@ var KoraSyncServer = class {
       event: "server.stopping",
       details: { connectedClients: this.sessions.size }
     });
+    if (this.relayRetransmitTimer) {
+      clearInterval(this.relayRetransmitTimer);
+      this.relayRetransmitTimer = null;
+    }
+    if (this.deliveryPollTimer) {
+      clearInterval(this.deliveryPollTimer);
+      this.deliveryPollTimer = null;
+    }
+    this.orphanedRelaysByNode.clear();
     this.awarenessRelay.clear();
     this.yjsDocRelay.clear();
+    this.blobChunkRelay.clear();
     for (const session of this.sessions.values()) {
       session.close("server shutting down");
     }
@@ -3255,7 +4851,7 @@ var KoraSyncServer = class {
     if (this.maxConnections > 0 && this.sessions.size >= this.maxConnections) {
       transport.send({
         type: "error",
-        messageId: (0, import_core12.generateUUIDv7)(),
+        messageId: (0, import_core14.generateUUIDv7)(),
         code: "MAX_CONNECTIONS",
         message: `Server has reached maximum connections (${this.maxConnections})`,
         retriable: true
@@ -3268,12 +4864,13 @@ var KoraSyncServer = class {
         event: "connection.rejected",
         details: { reason: "max_connections", max: this.maxConnections }
       });
-      throw new import_core12.SyncError("Maximum connections reached", {
+      throw new import_core14.SyncError("Maximum connections reached", {
         current: this.sessions.size,
         max: this.maxConnections
       });
     }
-    const sessionId = (0, import_core12.generateUUIDv7)();
+    this.ensureBackgroundTimersStarted();
+    const sessionId = (0, import_core14.generateUUIDv7)();
     this.metrics.recordConnection(sessionId);
     const sessionEmitter = new import_internal2.SimpleEventEmitter();
     sessionEmitter.on("sync:connected", (event) => {
@@ -3319,6 +4916,33 @@ var KoraSyncServer = class {
         sessionId
       });
     });
+    sessionEmitter.on("sync:schema-mismatch", (event) => {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "session.schema_mismatch",
+        sessionId,
+        details: {
+          clientSchemaVersion: event.clientSchemaVersion,
+          serverSchemaVersion: event.serverSchemaVersion,
+          supportedMin: event.supportedMin,
+          supportedMax: event.supportedMax,
+          reason: event.reason
+        }
+      });
+    });
+    sessionEmitter.on("sync:delivery-stalled", (event) => {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "session.delivery_stalled",
+        sessionId,
+        details: {
+          watermark: event.watermark,
+          repeatCount: event.repeatCount
+        }
+      });
+    });
     const session = new ClientSession({
       sessionId,
       transport,
@@ -3326,9 +4950,11 @@ var KoraSyncServer = class {
       auth: this.auth ?? void 0,
       serializer: this.serializer,
       emitter: sessionEmitter,
+      logger: this.logger,
       batchSize: this.batchSize,
       schemaVersion: this.schemaVersion,
       supportedSchemaVersions: this.supportedSchemaVersions,
+      operationTransforms: this.operationTransforms,
       onRelay: (sourceSessionId, operations2) => {
         this.handleRelay(sourceSessionId, operations2);
       },
@@ -3338,12 +4964,29 @@ var KoraSyncServer = class {
       onYjsDocUpdate: (sourceSessionId, message) => {
         this.handleYjsDocRelay(sourceSessionId, message);
       },
+      onBlobChunkRequest: (sourceSessionId, message) => {
+        this.blobChunkRelay.handleRequest(sourceSessionId, message);
+      },
+      onBlobChunkResponse: (sourceSessionId, message) => {
+        this.blobChunkRelay.handleResponse(sourceSessionId, message);
+      },
+      ...this.persistBlobChunk ? { persistBlobChunk: this.persistBlobChunk } : {},
+      // Only forward when configured, so an unset server value leaves the
+      // session on its own documented default rather than `undefined`.
+      ...this.maxOperationBytes !== void 0 ? { maxOperationBytes: this.maxOperationBytes } : {},
+      ...this.maxOpsPerMinute !== void 0 ? { maxOpsPerMinute: this.maxOpsPerMinute } : {},
+      ...this.validateOperation ? { validateOperation: this.validateOperation, koraContext: this.koraContext } : {},
       onClose: (sid) => {
         this.handleSessionClose(sid);
-      }
+      },
+      onOrphanedRelays: (nodeId, ops) => {
+        this.bufferOrphanedRelays(nodeId, ops);
+      },
+      takeOrphanedRelays: (nodeId) => this.takeOrphanedRelays(nodeId)
     });
     this.sessions.set(sessionId, session);
     this.yjsDocRelay.addClient(sessionId, transport);
+    this.blobChunkRelay.addClient(sessionId, transport);
     session.start();
     this.logger.log({
       timestamp: Date.now(),
@@ -3376,6 +5019,77 @@ var KoraSyncServer = class {
       errorCount: snapshot.errorCount
     };
   }
+  /**
+   * Apply a server-originated operation (for example one created by a custom
+   * HTTP route) through the same validated pipeline that incoming client
+   * operations use — Tier 2 constraints, referential integrity, and cascade
+   * side effects — then relay every applied operation to connected clients.
+   *
+   * Because the operation did not come from a client session, it is relayed to
+   * ALL sessions (there is no source session to exclude). Each session still
+   * applies its own per-scope visibility filter in `relayOperations`, so a
+   * client only receives the operation if it falls within that client's scope.
+   *
+   * @param op - A fully-formed, server-originated operation to apply
+   * @returns The apply result, including any server-generated side-effect ops
+   */
+  async applyLocalOperation(op) {
+    const result = await applyServerOperation(this.store, op);
+    if (result.result === "applied" && result.appliedOperations.length > 0) {
+      for (const session of this.sessions.values()) {
+        session.relayOperations(result.appliedOperations);
+      }
+    }
+    return result;
+  }
+  /**
+   * Relay already-applied, server-originated operations to every connected client.
+   * Used by the conditional route apply, which commits its operations atomically
+   * through the store (bypassing {@link applyLocalOperation}) and then fans them
+   * out. Each session still enforces its own per-scope visibility filter.
+   *
+   * @param operations - Operations that have already been committed to the store
+   */
+  relayServerOperations(operations2) {
+    if (operations2.length === 0) {
+      return;
+    }
+    for (const session of this.sessions.values()) {
+      session.relayOperations(operations2);
+    }
+  }
+  /**
+   * Collect every blob reference still reachable from live records on the server.
+   *
+   * This is the live set for garbage-collecting the server's central blob store:
+   * pass the result to `collectBlobGarbage(blobStore, liveRefs)` from
+   * `@korajs/store` to reclaim bytes no record references any more. Only
+   * collections that declare a `blob` field are scanned.
+   *
+   * @returns Every live blob reference across all collections
+   */
+  async getLiveBlobRefs() {
+    const schema = this.store.getSchema();
+    if (!schema) {
+      return [];
+    }
+    const refs = [];
+    for (const [name, collection] of Object.entries(schema.collections)) {
+      const hasBlobField = Object.values(collection.fields).some((field) => field.kind === "blob");
+      if (!hasBlobField) {
+        continue;
+      }
+      const records = await this.store.materializeCollection(name);
+      for (const record of records) {
+        for (const value of Object.values(record)) {
+          if ((0, import_core14.isBlobRef)(value)) {
+            refs.push(value);
+          }
+        }
+      }
+    }
+    return refs;
+  }
   /**
    * Get the number of currently connected clients.
    */
@@ -3409,6 +5123,7 @@ var KoraSyncServer = class {
     this.metrics.recordDisconnection(sessionId);
     this.awarenessRelay.removeClient(sessionId);
     this.yjsDocRelay.removeClient(sessionId);
+    this.blobChunkRelay.removeClient(sessionId);
     this.sessions.delete(sessionId);
     const clientId = this.httpSessionToClient.get(sessionId);
     if (clientId) {
@@ -3461,14 +5176,6 @@ function normalizeHttpBody(body, contentType) {
   return body;
 }
 
-// src/auth/no-auth.ts
-init_cjs_shims();
-var NoAuthProvider = class {
-  async authenticate(_token) {
-    return { userId: "anonymous" };
-  }
-};
-
 // src/auth/token-auth.ts
 init_cjs_shims();
 var TokenAuthProvider = class {
@@ -3573,11 +5280,13 @@ function createProductionServer(config) {
   const port = config.port ?? (Number(process.env.PORT) || 3001);
   const staticDir = config.staticDir ?? "./dist";
   const syncPath = config.syncPath ?? "/kora-sync";
+  const crossOriginEmbedderPolicy = config.crossOriginEmbedderPolicy ?? "credentialless";
   const syncServer = new KoraSyncServer({
     store: config.store,
     enableDashboard: true,
     ...config.syncOptions
   });
+  const routeContext = syncServer.getKoraContext();
   let httpServer = null;
   function getOperationalToken(kind) {
     const auth = config.operationalAuth;
@@ -3664,6 +5373,10 @@ function createProductionServer(config) {
       const chunks = [];
       req.on("data", (chunk) => chunks.push(chunk));
       req.on("end", () => resolve(Buffer.concat(chunks)));
+      if (!req.readableFlowing) {
+        req.resume();
+      }
+      req.on("error", () => resolve(Buffer.concat(chunks)));
     });
   }
   async function readJsonBody(req) {
@@ -3713,6 +5426,10 @@ function createProductionServer(config) {
     res.end(JSON.stringify(result.body ?? null));
   }
   return {
+    kora: routeContext,
+    getLiveBlobRefs() {
+      return syncServer.getLiveBlobRefs();
+    },
     async start() {
       const { createServer } = await import("http");
       const { createReadStream, existsSync, statSync } = await import("fs");
@@ -3720,8 +5437,21 @@ function createProductionServer(config) {
       const { WebSocketServer } = await import("ws");
       const distDir = resolve(staticDir);
       httpServer = createServer(async (req, res) => {
+        try {
+          await handleRequest(req, res);
+        } catch (error) {
+          console.error("[kora] Unhandled error in HTTP request handler:", error);
+          if (!res.headersSent) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Internal server error" }));
+          } else if (!res.writableEnded) {
+            res.end();
+          }
+        }
+      });
+      async function handleRequest(req, res) {
         res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
-        res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
+        res.setHeader("Cross-Origin-Embedder-Policy", crossOriginEmbedderPolicy);
         const url = new URL(req.url || "/", `http://${req.headers.host}`);
         if (url.pathname === "/health") {
           const status = await syncServer.getStatus();
@@ -3847,7 +5577,8 @@ data: ${JSON.stringify(s)}
             body: await readJsonBody(req),
             headers: req.headers,
             query: getQuery(url),
-            ip: getClientIp(req)
+            ip: getClientIp(req),
+            kora: routeContext
           });
           writeJsonResponse(res, result);
           return;
@@ -3881,7 +5612,7 @@ data: ${JSON.stringify(s)}
         const contentType = MIME_TYPES[ext] || "application/octet-stream";
         res.writeHead(200, { "Content-Type": contentType });
         createReadStream(filePath).pipe(res);
-      });
+      }
       const wss = new WebSocketServer({ noServer: true });
       httpServer.on("upgrade", (req, socket, head) => {
         const url = new URL(req.url || "/", `http://${req.headers.host}`);
@@ -3894,8 +5625,13 @@ data: ${JSON.stringify(s)}
           socket.destroy();
         }
       });
-      return new Promise((resolve2) => {
+      return new Promise((resolve2, reject) => {
+        const onError = (error) => {
+          reject(error);
+        };
+        httpServer?.once("error", onError);
         httpServer?.listen(port, "0.0.0.0", () => {
+          httpServer?.off("error", onError);
           resolve2(`http://localhost:${port}`);
         });
       });
@@ -3998,6 +5734,7 @@ function formatUptime(ms) {
   MixedAuthProvider,
   NoAuthProvider,
   PostgresServerStore,
+  RETRIABLE_REJECTION_CODES,
   SqliteServerStore,
   TokenAuthProvider,
   WsServerTransport,
@@ -4008,6 +5745,7 @@ function formatUptime(ms) {
   createPrettyLogger,
   createProductionServer,
   createSilentLogger,
-  createSqliteServerStore
+  createSqliteServerStore,
+  isRetriableRejection
 });
 //# sourceMappingURL=index.cjs.map