@korajs/server 1.0.0-beta.0 → 1.0.0-beta.2

package/dist/index.js

@@ -54,11 +54,17 @@ function createDefaultLogger() {
   }
 }
 
+// src/apply/rejection-taxonomy.ts
+var RETRIABLE_REJECTION_CODES = /* @__PURE__ */ new Set(["RATE_LIMIT"]);
+function isRetriableRejection(code) {
+  return RETRIABLE_REJECTION_CODES.has(code);
+}
+
 // src/store/memory-server-store.ts
 import { generateUUIDv7 } from "@korajs/core";
 
 // src/store/materialization.ts
-import { StorageError } from "@korajs/core";
+import { StorageError, quoteIdent } from "@korajs/core";
 function fieldTypeToSql(descriptor, dialect) {
   switch (descriptor.kind) {
     case "string":
@@ -73,6 +79,14 @@ function fieldTypeToSql(descriptor, dialect) {
       return dialect === "postgres" ? "BIGINT" : "INTEGER";
     case "array":
       return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "object":
+      return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "json":
+      return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "blob":
+      return "TEXT";
+    case "secret":
+      return "TEXT";
     case "richtext":
       return dialect === "postgres" ? "BYTEA" : "BLOB";
   }
@@ -89,13 +103,13 @@ function generateCollectionDDL(name, collection, dialect) {
   const columns = ["id TEXT PRIMARY KEY NOT NULL"];
   for (const [fieldName, descriptor] of Object.entries(collection.fields)) {
     const sqlType = fieldTypeToSql(descriptor, dialect);
-    let colDef = `${fieldName} ${sqlType}`;
+    let colDef = `${quoteIdent(fieldName)} ${sqlType}`;
     if (descriptor.defaultValue !== void 0) {
       colDef += ` DEFAULT ${sqlDefaultLiteral(descriptor.defaultValue)}`;
     }
     if (descriptor.kind === "enum" && descriptor.enumValues) {
       const values = descriptor.enumValues.map((v) => `'${v}'`).join(", ");
-      colDef += ` CHECK (${fieldName} IN (${values}))`;
+      colDef += ` CHECK (${quoteIdent(fieldName)} IN (${values}))`;
     }
     columns.push(colDef);
   }
@@ -103,24 +117,26 @@ function generateCollectionDDL(name, collection, dialect) {
   columns.push(`_created_at ${tsType} NOT NULL DEFAULT 0`);
   columns.push(`_updated_at ${tsType} NOT NULL DEFAULT 0`);
   columns.push("_deleted INTEGER NOT NULL DEFAULT 0");
-  statements.push(`CREATE TABLE IF NOT EXISTS ${name} (
+  statements.push(`CREATE TABLE IF NOT EXISTS ${quoteIdent(name)} (
   ${columns.join(",\n  ")}
 )`);
   for (const [fieldName, descriptor] of Object.entries(collection.fields)) {
     const sqlType = fieldTypeToSql(descriptor, dialect);
-    let colDef = `${fieldName} ${sqlType}`;
+    let colDef = `${quoteIdent(fieldName)} ${sqlType}`;
     if (descriptor.defaultValue !== void 0) {
       colDef += ` DEFAULT ${sqlDefaultLiteral(descriptor.defaultValue)}`;
     }
     statements.push(`--kora:safe-alter
-ALTER TABLE ${name} ADD COLUMN ${colDef}`);
+ALTER TABLE ${quoteIdent(name)} ADD COLUMN ${colDef}`);
   }
   for (const indexField of collection.indexes) {
     statements.push(
-      `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${name} (${indexField})`
+      `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${quoteIdent(name)} (${quoteIdent(indexField)})`
     );
   }
-  statements.push(`CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${name} (_deleted)`);
+  statements.push(
+    `CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${quoteIdent(name)} (_deleted)`
+  );
   return statements;
 }
 function generateAllCollectionDDL(schema, dialect) {
@@ -590,7 +606,7 @@ var MemoryServerStore = class {
 };
 
 // src/store/postgres-server-store.ts
-import { generateUUIDv7 as generateUUIDv72 } from "@korajs/core";
+import { generateUUIDv7 as generateUUIDv72, quoteIdent as quoteIdent2 } from "@korajs/core";
 import { and, asc, between, count, eq, sql } from "drizzle-orm";
 
 // src/store/drizzle-pg-schema.ts
@@ -754,7 +770,7 @@ var PostgresServerStore = class {
     this.assertCollection(collection);
     const schema = this.schema;
     const collectionDef = schema.collections[collection];
-    const query = sql`SELECT * FROM ${sql.raw(collection)} WHERE id = ${id} AND _deleted = 0`;
+    const query = sql`SELECT * FROM ${sql.raw(quoteIdent2(collection))} WHERE id = ${id} AND _deleted = 0`;
     const rows = await this.db.execute(query);
     if (rows.length === 0) return null;
     return this.deserializeRow(rows[0], collectionDef);
@@ -771,7 +787,7 @@ var PostgresServerStore = class {
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false);
-    const query = sql`SELECT COUNT(*) as cnt FROM ${sql.raw(collection)} WHERE ${whereClause}`;
+    const query = sql`SELECT COUNT(*) as cnt FROM ${sql.raw(quoteIdent2(collection))} WHERE ${whereClause}`;
     const rows = await this.db.execute(query);
     const cnt = rows[0]?.cnt;
     return typeof cnt === "string" ? Number.parseInt(cnt, 10) : cnt ?? 0;
@@ -858,7 +874,7 @@ var PostgresServerStore = class {
       );
     } else {
       await txOrDb.execute(
-        sql`UPDATE ${sql.raw(collection)} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
+        sql`UPDATE ${sql.raw(quoteIdent2(collection))} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
       );
     }
   }
@@ -877,16 +893,16 @@ var PostgresServerStore = class {
       updatedAt,
       0
     ];
-    const columnsSql = sql.raw(allColumns.join(", "));
+    const columnsSql = sql.raw(allColumns.map((c) => quoteIdent2(c)).join(", "));
     const valuesSql = sql.join(
       values.map((v) => sql`${v}`),
       sql.raw(", ")
     );
     const updateSet = sql.raw(
-      allColumns.slice(1).map((c) => `${c} = excluded.${c}`).join(", ")
+      allColumns.slice(1).map((c) => `${quoteIdent2(c)} = excluded.${quoteIdent2(c)}`).join(", ")
     );
     await txOrDb.execute(
-      sql`INSERT INTO ${sql.raw(tableName)} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+      sql`INSERT INTO ${sql.raw(quoteIdent2(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
     );
   }
   /**
@@ -946,7 +962,7 @@ var PostgresServerStore = class {
         );
       } else {
         await this.db.execute(
-          sql`INSERT INTO ${sql.raw(collectionName)} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
+          sql`INSERT INTO ${sql.raw(quoteIdent2(collectionName))} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
         );
       }
     }
@@ -959,10 +975,12 @@ var PostgresServerStore = class {
       options?.where ?? {},
       options?.includeDeleted ?? false
     );
-    const parts = [sql`SELECT * FROM ${sql.raw(collection)} WHERE ${whereClause}`];
+    const parts = [
+      sql`SELECT * FROM ${sql.raw(quoteIdent2(collection))} WHERE ${whereClause}`
+    ];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
-      parts.push(sql.raw(` ORDER BY ${options.orderBy} ${dir}`));
+      parts.push(sql.raw(` ORDER BY ${quoteIdent2(options.orderBy)} ${dir}`));
     }
     if (options?.limit !== void 0) {
       parts.push(sql` LIMIT ${options.limit}`);
@@ -978,7 +996,7 @@ var PostgresServerStore = class {
       conditions.push(sql.raw("_deleted = 0"));
     }
     for (const [key, value] of Object.entries(where)) {
-      conditions.push(sql`${sql.raw(key)} = ${value}`);
+      conditions.push(sql`${sql.raw(quoteIdent2(key))} = ${value}`);
     }
     if (conditions.length === 0) {
       return sql.raw("1 = 1");
@@ -1173,7 +1191,7 @@ async function loadPostgresDeps() {
 
 // src/store/sqlite-server-store.ts
 import { createRequire } from "module";
-import { generateUUIDv7 as generateUUIDv73 } from "@korajs/core";
+import { generateUUIDv7 as generateUUIDv73, quoteIdent as quoteIdent3 } from "@korajs/core";
 import { and as and2, asc as asc2, between as between2, count as count2, eq as eq2, sql as sql2 } from "drizzle-orm";
 
 // src/store/drizzle-schema.ts
@@ -1328,7 +1346,7 @@ var SqliteServerStore = class {
     this.assertCollection(collection);
     const schema = this.schema;
     const collectionDef = schema.collections[collection];
-    const query = sql2`SELECT * FROM ${sql2.raw(collection)} WHERE id = ${id} AND _deleted = 0`;
+    const query = sql2`SELECT * FROM ${sql2.raw(quoteIdent3(collection))} WHERE id = ${id} AND _deleted = 0`;
     const rows = this.db.all(query);
     if (rows.length === 0) return null;
     return this.deserializeRow(rows[0], collectionDef);
@@ -1344,7 +1362,7 @@ var SqliteServerStore = class {
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false);
-    const query = sql2`SELECT COUNT(*) as cnt FROM ${sql2.raw(collection)} WHERE ${whereClause}`;
+    const query = sql2`SELECT COUNT(*) as cnt FROM ${sql2.raw(quoteIdent3(collection))} WHERE ${whereClause}`;
     const rows = this.db.all(query);
     return rows[0]?.cnt ?? 0;
   }
@@ -1421,7 +1439,7 @@ var SqliteServerStore = class {
       );
     } else {
       txOrDb.run(
-        sql2`UPDATE ${sql2.raw(collection)} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
+        sql2`UPDATE ${sql2.raw(quoteIdent3(collection))} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
       );
     }
   }
@@ -1442,16 +1460,16 @@ var SqliteServerStore = class {
       0
       // _deleted = false
     ];
-    const columnsSql = sql2.raw(allColumns.join(", "));
+    const columnsSql = sql2.raw(allColumns.map((c) => quoteIdent3(c)).join(", "));
     const valuesSql = sql2.join(
       values.map((v) => sql2`${v}`),
       sql2.raw(", ")
     );
     const updateSet = sql2.raw(
-      allColumns.slice(1).map((c) => `${c} = excluded.${c}`).join(", ")
+      allColumns.slice(1).map((c) => `${quoteIdent3(c)} = excluded.${quoteIdent3(c)}`).join(", ")
     );
     txOrDb.run(
-      sql2`INSERT INTO ${sql2.raw(tableName)} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+      sql2`INSERT INTO ${sql2.raw(quoteIdent3(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
     );
   }
   /**
@@ -1509,7 +1527,7 @@ var SqliteServerStore = class {
           );
         } else {
           tx.run(
-            sql2`INSERT INTO ${sql2.raw(collectionName)} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
+            sql2`INSERT INTO ${sql2.raw(quoteIdent3(collectionName))} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
           );
         }
       }
@@ -1523,10 +1541,12 @@ var SqliteServerStore = class {
       options?.where ?? {},
       options?.includeDeleted ?? false
     );
-    const parts = [sql2`SELECT * FROM ${sql2.raw(collection)} WHERE ${whereClause}`];
+    const parts = [
+      sql2`SELECT * FROM ${sql2.raw(quoteIdent3(collection))} WHERE ${whereClause}`
+    ];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
-      parts.push(sql2.raw(` ORDER BY ${options.orderBy} ${dir}`));
+      parts.push(sql2.raw(` ORDER BY ${quoteIdent3(options.orderBy)} ${dir}`));
     }
     if (options?.limit !== void 0) {
       parts.push(sql2` LIMIT ${options.limit}`);
@@ -1542,7 +1562,7 @@ var SqliteServerStore = class {
       conditions.push(sql2.raw("_deleted = 0"));
     }
     for (const [key, value] of Object.entries(where)) {
-      conditions.push(sql2`${sql2.raw(key)} = ${value}`);
+      conditions.push(sql2`${sql2.raw(quoteIdent3(key))} = ${value}`);
     }
     if (conditions.length === 0) {
       return sql2.raw("1 = 1");
@@ -1861,8 +1881,9 @@ var WsServerTransport = class {
 };
 
 // src/session/client-session.ts
-import { generateUUIDv7 as generateUUIDv74 } from "@korajs/core";
+import { generateUUIDv7 as generateUUIDv74, hashBlob } from "@korajs/core";
 import { topologicalSort } from "@korajs/core/internal";
+import { decodeBlobChunkBytes } from "@korajs/sync";
 import {
   NegotiatedMessageSerializer,
   SCHEMA_MISMATCH_PREFIX,
@@ -1992,12 +2013,14 @@ async function applyServerOperation(store, op, relationLookup) {
   const lookup = relationLookup ?? (schema ? buildMergeRelationLookup(schema) : /* @__PURE__ */ new Map());
   const constraintCheck = await validateIncomingOperationConstraints(store, op, schema);
   if (!constraintCheck.valid) {
+    const code = constraintCheck.code ?? "CONSTRAINT_VIOLATION";
     return {
       result: "skipped",
       appliedOperations: [],
       rejection: {
-        code: constraintCheck.code ?? "CONSTRAINT_VIOLATION",
-        message: constraintCheck.message ?? `Operation "${op.id}" violates a schema constraint`
+        code,
+        message: constraintCheck.message ?? `Operation "${op.id}" violates a schema constraint`,
+        retriable: isRetriableRejection(code)
       }
     };
   }
@@ -2010,7 +2033,8 @@ async function applyServerOperation(store, op, relationLookup) {
         appliedOperations: [],
         rejection: {
           code: "REFERENTIAL_INTEGRITY",
-          message: `Operation "${op.id}" violates referential integrity on "${op.collection}"`
+          message: `Operation "${op.id}" violates referential integrity on "${op.collection}"`,
+          retriable: isRetriableRejection("REFERENTIAL_INTEGRITY")
         }
       };
     }
@@ -2043,6 +2067,13 @@ async function applyServerOperation(store, op, relationLookup) {
   };
 }
 
+// src/auth/no-auth.ts
+var NoAuthProvider = class {
+  async authenticate(_token) {
+    return { userId: "anonymous" };
+  }
+};
+
 // src/scopes/resolve-session-scopes.ts
 import { buildScopeMap } from "@korajs/core";
 function resolveSessionScopes(schema, options) {
@@ -2168,6 +2199,25 @@ var SessionRateLimiter = class {
 // src/session/client-session.ts
 var DEFAULT_BATCH_SIZE = 100;
 var DEFAULT_SCHEMA_VERSION = 1;
+var warnedUnscopedProviders = /* @__PURE__ */ new WeakSet();
+function warnIfMultiTenantWithoutScopes(auth, resolvedScopes, schema) {
+  if (!auth || auth instanceof NoAuthProvider) {
+    return;
+  }
+  if (resolvedScopes) {
+    return;
+  }
+  if (!schema || Object.keys(schema.collections).length === 0) {
+    return;
+  }
+  if (warnedUnscopedProviders.has(auth)) {
+    return;
+  }
+  warnedUnscopedProviders.add(auth);
+  console.warn(
+    "[kora] An authenticated session resolved to no sync scopes, so every user will sync every other user's data. Return per-user sync scopes from your auth provider (for example KoraAuthProvider's resolveScopes) to isolate tenants. Note: declaring sync rules in your schema is not enough on its own \u2014 the per-user values come from the auth provider. (This warning is expected for single-tenant apps where all authenticated users are meant to share the same data.)"
+  );
+}
 var ClientSession = class {
   state = "connected";
   clientNodeId = null;
@@ -2186,10 +2236,15 @@ var ClientSession = class {
   onRelay;
   onAwarenessUpdate;
   onYjsDocUpdate;
+  onBlobChunkRequest;
+  onBlobChunkResponse;
+  persistBlobChunk;
   onClose;
   maxOperationBytes;
   maxOpsPerMinute;
   rateLimiter;
+  validateOperation;
+  koraContext;
   constructor(options) {
     this.sessionId = options.sessionId;
     this.transport = options.transport;
@@ -2207,10 +2262,15 @@ var ClientSession = class {
     this.onRelay = options.onRelay ?? null;
     this.onAwarenessUpdate = options.onAwarenessUpdate ?? null;
     this.onYjsDocUpdate = options.onYjsDocUpdate ?? null;
+    this.onBlobChunkRequest = options.onBlobChunkRequest ?? null;
+    this.onBlobChunkResponse = options.onBlobChunkResponse ?? null;
+    this.persistBlobChunk = options.persistBlobChunk ?? null;
     this.onClose = options.onClose ?? null;
     this.maxOperationBytes = options.maxOperationBytes ?? DEFAULT_MAX_OPERATION_BYTES;
     this.maxOpsPerMinute = options.maxOpsPerMinute ?? DEFAULT_MAX_OPS_PER_MINUTE;
     this.rateLimiter = new SessionRateLimiter(this.maxOpsPerMinute);
+    this.validateOperation = options.validateOperation ?? null;
+    this.koraContext = options.koraContext ?? null;
   }
   /**
    * Start handling messages from the client transport.
@@ -2312,8 +2372,33 @@ var ClientSession = class {
       case "yjs-doc-update":
         this.handleYjsDocUpdate(message);
         break;
+      case "blob-chunk-request":
+        this.onBlobChunkRequest?.(this.sessionId, message);
+        break;
+      case "blob-chunk-response":
+        this.onBlobChunkResponse?.(this.sessionId, message);
+        break;
+      case "blob-chunk-push":
+        await this.handleBlobChunkPush(message);
+        break;
     }
   }
+  /**
+   * Persist a client-uploaded blob chunk (or manifest) centrally. The bytes are
+   * verified to hash to the declared hash before storing, so a corrupt or
+   * mislabeled upload is rejected rather than served later as trusted content.
+   */
+  async handleBlobChunkPush(message) {
+    if (!this.persistBlobChunk) {
+      return;
+    }
+    const bytes = decodeBlobChunkBytes(message.bytes);
+    const actual = await hashBlob(bytes);
+    if (actual !== message.hash) {
+      return;
+    }
+    await this.persistBlobChunk(message.hash, bytes);
+  }
   handleMessageFailure(error) {
     const reason = error instanceof Error ? error.message : "Message handling failed";
     this.sendError("SYNC_ERROR", reason, true);
@@ -2347,6 +2432,7 @@ var ClientSession = class {
         this.authContext = { userId: msg.nodeId, scopes: resolvedScopes };
       }
     }
+    warnIfMultiTenantWithoutScopes(this.auth, resolvedScopes, this.store.getSchema());
     if (msg.syncQueries && msg.syncQueries.length > 0) {
       this.syncQuerySubsets = dedupeQuerySubsets(msg.syncQueries);
     } else {
@@ -2383,6 +2469,9 @@ var ClientSession = class {
       accepted: true,
       selectedWireFormat,
       serverTime: Date.now(),
+      // Advertise central blob storage so the client uploads the bytes behind
+      // its blob fields, keeping them available after the author goes offline.
+      ...this.persistBlobChunk ? { blobStorageEnabled: true } : {},
       // Confirm the accepted scope so the client knows what data will be synced.
       // This may differ from what the client requested if auth scopes are narrower.
       ...this.authContext?.scopes ? { acceptedScope: this.authContext.scopes } : {}
@@ -2428,10 +2517,39 @@ var ClientSession = class {
         );
         continue;
       }
+      if (this.validateOperation && this.koraContext) {
+        let decision;
+        try {
+          decision = await this.validateOperation(op, {
+            auth: this.authContext,
+            kora: this.koraContext
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "validator error";
+          this.sendOperationRejected(op, "VALIDATION_ERROR", `Validator threw: ${message}`, true);
+          continue;
+        }
+        if (decision.action === "reject") {
+          this.sendOperationRejected(
+            op,
+            decision.code,
+            decision.message,
+            decision.retriable ?? isRetriableRejection(decision.code)
+          );
+          continue;
+        }
+        if (decision.action === "ignore") {
+          continue;
+        }
+      }
       try {
         const applyResult = await applyServerOperation(this.store, op);
         if (applyResult.rejection) {
-          this.sendError(applyResult.rejection.code, applyResult.rejection.message, false);
+          this.sendError(
+            applyResult.rejection.code,
+            applyResult.rejection.message,
+            applyResult.rejection.retriable
+          );
           continue;
         }
         if (applyResult.result === "applied") {
@@ -2550,6 +2668,25 @@ var ClientSession = class {
     };
     this.sendToClient(errorMsg);
   }
+  /**
+   * Reject one specific client operation, tied to its id, so the submitter can
+   * divert it out of its pending queue into a durable rejected store rather than
+   * losing it or retrying forever. The op is NOT materialized, so no other
+   * replica ever sees it.
+   */
+  sendOperationRejected(op, code, message, retriable) {
+    const rejectedMsg = {
+      type: "operation-rejected",
+      messageId: generateUUIDv74(),
+      operationId: op.id,
+      collection: op.collection,
+      recordId: op.recordId,
+      code,
+      message,
+      retriable
+    };
+    this.sendToClient(rejectedMsg);
+  }
   setSerializerWireFormat(format) {
     if (typeof this.serializer.setWireFormat === "function") {
       this.serializer.setWireFormat(format);
@@ -2570,7 +2707,7 @@ function selectWireFormat(supportedWireFormats) {
 }
 
 // src/server/kora-sync-server.ts
-import { SyncError as SyncError4, generateUUIDv7 as generateUUIDv76 } from "@korajs/core";
+import { SyncError as SyncError4, generateUUIDv7 as generateUUIDv77, isBlobRef } from "@korajs/core";
 import { SimpleEventEmitter } from "@korajs/core/internal";
 import { JsonMessageSerializer as JsonMessageSerializer2 } from "@korajs/sync";
 
@@ -2787,6 +2924,115 @@ var ServerMetricsCollector = class {
   }
 };
 
+// src/richtext/blob-chunk-relay.ts
+import {
+  encodeBlobChunkBytes
+} from "@korajs/sync";
+var BlobChunkRelay = class {
+  clients = /* @__PURE__ */ new Map();
+  /** requestId -> the session that originated the request (to route the answer back). */
+  pending = /* @__PURE__ */ new Map();
+  resolveBlobChunk;
+  constructor(resolveBlobChunk) {
+    this.resolveBlobChunk = resolveBlobChunk ?? null;
+  }
+  addClient(sessionId, transport) {
+    this.clients.set(sessionId, { sessionId, transport });
+  }
+  removeClient(sessionId) {
+    this.clients.delete(sessionId);
+    for (const [requestId, originSessionId] of this.pending) {
+      if (originSessionId === sessionId) {
+        this.pending.delete(requestId);
+      }
+    }
+  }
+  getClientCount() {
+    return this.clients.size;
+  }
+  getPendingCount() {
+    return this.pending.size;
+  }
+  clear() {
+    this.clients.clear();
+    this.pending.clear();
+  }
+  /**
+   * Handle an inbound chunk request from a session. Tries the server's own
+   * store first (if configured), otherwise forwards the request to peer
+   * sessions and remembers who to route the answer back to.
+   */
+  handleRequest(sourceSessionId, message) {
+    if (!this.clients.has(sourceSessionId)) {
+      return;
+    }
+    if (this.resolveBlobChunk) {
+      void this.resolveBlobChunk(message.hash).then(
+        (bytes) => {
+          if (bytes !== null) {
+            this.sendResponseTo(sourceSessionId, message.requestId, encodeBlobChunkBytes(bytes));
+            return;
+          }
+          this.forwardRequestToPeers(sourceSessionId, message);
+        },
+        () => {
+          this.forwardRequestToPeers(sourceSessionId, message);
+        }
+      );
+      return;
+    }
+    this.forwardRequestToPeers(sourceSessionId, message);
+  }
+  /**
+   * Handle an inbound chunk response from a peer. Routes it back to the session
+   * that originally requested it. A "not held" answer (bytes === null) is
+   * ignored so a peer without the chunk does not preempt one that has it; the
+   * requester's own per-request timeout bounds the wait.
+   */
+  handleResponse(sourceSessionId, message) {
+    if (!this.clients.has(sourceSessionId)) {
+      return;
+    }
+    if (message.bytes === null) {
+      return;
+    }
+    const originSessionId = this.pending.get(message.requestId);
+    if (!originSessionId) {
+      return;
+    }
+    this.pending.delete(message.requestId);
+    this.sendResponseTo(originSessionId, message.requestId, message.bytes);
+  }
+  forwardRequestToPeers(sourceSessionId, message) {
+    this.pending.set(message.requestId, sourceSessionId);
+    for (const [, client] of this.clients) {
+      if (client.sessionId === sourceSessionId) {
+        continue;
+      }
+      if (!client.transport.isConnected()) {
+        continue;
+      }
+      client.transport.send(message);
+    }
+  }
+  sendResponseTo(sessionId, requestId, bytes) {
+    const client = this.clients.get(sessionId);
+    if (!client || !client.transport.isConnected()) {
+      return;
+    }
+    const response = {
+      type: "blob-chunk-response",
+      messageId: generateResponseId(requestId),
+      requestId,
+      bytes
+    };
+    client.transport.send(response);
+  }
+};
+function generateResponseId(requestId) {
+  return `blob-resp-${requestId}`;
+}
+
 // src/richtext/yjs-doc-relay.ts
 var YjsDocRelay = class {
   clients = /* @__PURE__ */ new Map();
@@ -2821,6 +3067,169 @@ var YjsDocRelay = class {
   }
 };
 
+// src/server/route-context.ts
+import { HybridLogicalClock as HybridLogicalClock2, createOperation as createOperation2, generateUUIDv7 as generateUUIDv76 } from "@korajs/core";
+function recordMatchesScope(collection, record, scope) {
+  const collectionScope = scope[collection];
+  if (!collectionScope) {
+    return false;
+  }
+  for (const [field, expected] of Object.entries(collectionScope)) {
+    if (record[field] !== expected) {
+      return false;
+    }
+  }
+  return true;
+}
+function pickFields(record, keys) {
+  const picked = {};
+  for (const key of keys) {
+    if (key in record) {
+      picked[key] = record[key];
+    }
+  }
+  return picked;
+}
+async function buildRouteOperation(store, mutation) {
+  const nodeId = store.getNodeId();
+  const clock = new HybridLogicalClock2(nodeId);
+  const schemaVersion = store.getSchema()?.version ?? 1;
+  const sequenceNumber = nextServerSequenceNumber(store);
+  if (mutation.type === "insert") {
+    return createOperation2(
+      {
+        nodeId,
+        type: "insert",
+        collection: mutation.collection,
+        recordId: mutation.recordId ?? generateUUIDv76(),
+        data: mutation.data ?? {},
+        previousData: null,
+        sequenceNumber,
+        causalDeps: [],
+        schemaVersion
+      },
+      clock
+    );
+  }
+  if (!mutation.recordId) {
+    throw new RouteMutationError(
+      "MISSING_RECORD_ID",
+      `A ${mutation.type} mutation on "${mutation.collection}" requires a recordId.`
+    );
+  }
+  const current = await store.findRecord(mutation.collection, mutation.recordId);
+  if (mutation.type === "update") {
+    const data = mutation.data ?? {};
+    return createOperation2(
+      {
+        nodeId,
+        type: "update",
+        collection: mutation.collection,
+        recordId: mutation.recordId,
+        data,
+        previousData: current ? pickFields(current, Object.keys(data)) : {},
+        sequenceNumber,
+        causalDeps: [],
+        schemaVersion
+      },
+      clock
+    );
+  }
+  return createOperation2(
+    {
+      nodeId,
+      type: "delete",
+      collection: mutation.collection,
+      recordId: mutation.recordId,
+      data: null,
+      previousData: current ? { ...current } : null,
+      sequenceNumber,
+      causalDeps: [],
+      schemaVersion
+    },
+    clock
+  );
+}
+var RouteMutationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "RouteMutationError";
+  }
+  code;
+};
+function createRouteContext(server, store) {
+  let mutationTail = Promise.resolve();
+  function serialize(work) {
+    const run = mutationTail.then(work, work);
+    mutationTail = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
+  return {
+    apply(mutation, options) {
+      return serialize(async () => {
+        let op;
+        try {
+          op = await buildRouteOperation(store, mutation);
+        } catch (error) {
+          if (error instanceof RouteMutationError) {
+            return {
+              ok: false,
+              code: error.code,
+              message: error.message,
+              retriable: isRetriableRejection(error.code)
+            };
+          }
+          throw error;
+        }
+        if (options?.scope && !operationMatchesScopes(op, options.scope)) {
+          return {
+            ok: false,
+            code: "SCOPE_VIOLATION",
+            message: `Mutation on "${mutation.collection}" is outside the provided scope.`,
+            retriable: isRetriableRejection("SCOPE_VIOLATION")
+          };
+        }
+        const result = await server.applyLocalOperation(op);
+        if (result.result !== "applied") {
+          const code = result.rejection?.code ?? "NOT_APPLIED";
+          return {
+            ok: false,
+            code,
+            message: result.rejection?.message ?? `Operation on "${mutation.collection}" was not applied (${result.result}).`,
+            // Prefer the pipeline's own classification when present; fall back
+            // to classifying the code so this stays correct if new codes appear.
+            retriable: result.rejection?.retriable ?? isRetriableRejection(code)
+          };
+        }
+        const record = await store.findRecord(mutation.collection, op.recordId);
+        return { ok: true, operation: op, record };
+      });
+    },
+    async query(collection, options) {
+      const { scope, ...queryOptions } = options ?? {};
+      const records = await store.queryCollection(collection, queryOptions);
+      if (!scope) {
+        return records;
+      }
+      return records.filter((record) => recordMatchesScope(collection, record, scope));
+    },
+    async findById(collection, id, options) {
+      const record = await store.findRecord(collection, id);
+      if (!record) {
+        return null;
+      }
+      if (options?.scope && !recordMatchesScope(collection, record, options.scope)) {
+        return null;
+      }
+      return record;
+    }
+  };
+}
+
 // src/server/kora-sync-server.ts
 var DEFAULT_MAX_CONNECTIONS = 0;
 var DEFAULT_BATCH_SIZE2 = 100;
@@ -2843,10 +3252,18 @@ var KoraSyncServer = class {
   metrics;
   awarenessRelay = new AwarenessRelay();
   yjsDocRelay = new YjsDocRelay();
+  blobChunkRelay;
+  persistBlobChunk;
+  maxOperationBytes;
+  maxOpsPerMinute;
+  validateOperation;
+  koraContext;
   sessions = /* @__PURE__ */ new Map();
   httpClients = /* @__PURE__ */ new Map();
   httpSessionToClient = /* @__PURE__ */ new Map();
-  serverVersion = "0.4.0";
+  // Informational value reported by getStatus(). Keep in sync with the
+  // @korajs/server package version on release; it is not used for protocol negotiation.
+  serverVersion = "1.0.0-beta.0";
   wsServer = null;
   running = false;
   constructor(config) {
@@ -2867,10 +3284,24 @@ var KoraSyncServer = class {
     this.logger = config.logger ?? createDefaultLogger();
     this.metrics = config.metricsCollector ?? new ServerMetricsCollector();
     this.metrics.setSchemaVersion(this.schemaVersion);
+    this.blobChunkRelay = new BlobChunkRelay(config.resolveBlobChunk);
+    this.persistBlobChunk = config.persistBlobChunk ?? null;
+    this.maxOperationBytes = config.maxOperationBytes;
+    this.maxOpsPerMinute = config.maxOpsPerMinute;
+    this.validateOperation = config.validateOperation;
+    this.koraContext = createRouteContext(this, this.store);
     if (!this.emitter) {
       this.emitter = new SimpleEventEmitter();
     }
   }
+  /**
+   * The trusted, scoped data-plane context (`apply` / `query` / `findById`).
+   * Shared with the production server so HTTP routes, the operation validator,
+   * and `server.kora` are all the same object over the same pipeline.
+   */
+  getKoraContext() {
+    return this.koraContext;
+  }
   /**
    * Subscribe to session-level events for metrics collection and logging.
    * Called when a new session is created.
@@ -2990,6 +3421,7 @@ var KoraSyncServer = class {
     });
     this.awarenessRelay.clear();
     this.yjsDocRelay.clear();
+    this.blobChunkRelay.clear();
     for (const session of this.sessions.values()) {
       session.close("server shutting down");
     }
@@ -3051,7 +3483,7 @@ var KoraSyncServer = class {
     if (this.maxConnections > 0 && this.sessions.size >= this.maxConnections) {
       transport.send({
         type: "error",
-        messageId: generateUUIDv76(),
+        messageId: generateUUIDv77(),
         code: "MAX_CONNECTIONS",
         message: `Server has reached maximum connections (${this.maxConnections})`,
         retriable: true
@@ -3069,7 +3501,7 @@ var KoraSyncServer = class {
         max: this.maxConnections
       });
     }
-    const sessionId = generateUUIDv76();
+    const sessionId = generateUUIDv77();
     this.metrics.recordConnection(sessionId);
     const sessionEmitter = new SimpleEventEmitter();
     sessionEmitter.on("sync:connected", (event) => {
@@ -3134,12 +3566,25 @@ var KoraSyncServer = class {
       onYjsDocUpdate: (sourceSessionId, message) => {
         this.handleYjsDocRelay(sourceSessionId, message);
       },
+      onBlobChunkRequest: (sourceSessionId, message) => {
+        this.blobChunkRelay.handleRequest(sourceSessionId, message);
+      },
+      onBlobChunkResponse: (sourceSessionId, message) => {
+        this.blobChunkRelay.handleResponse(sourceSessionId, message);
+      },
+      ...this.persistBlobChunk ? { persistBlobChunk: this.persistBlobChunk } : {},
+      // Only forward when configured, so an unset server value leaves the
+      // session on its own documented default rather than `undefined`.
+      ...this.maxOperationBytes !== void 0 ? { maxOperationBytes: this.maxOperationBytes } : {},
+      ...this.maxOpsPerMinute !== void 0 ? { maxOpsPerMinute: this.maxOpsPerMinute } : {},
+      ...this.validateOperation ? { validateOperation: this.validateOperation, koraContext: this.koraContext } : {},
       onClose: (sid) => {
         this.handleSessionClose(sid);
       }
     });
     this.sessions.set(sessionId, session);
     this.yjsDocRelay.addClient(sessionId, transport);
+    this.blobChunkRelay.addClient(sessionId, transport);
     session.start();
     this.logger.log({
       timestamp: Date.now(),
@@ -3172,6 +3617,61 @@ var KoraSyncServer = class {
       errorCount: snapshot.errorCount
     };
   }
+  /**
+   * Apply a server-originated operation (for example one created by a custom
+   * HTTP route) through the same validated pipeline that incoming client
+   * operations use — Tier 2 constraints, referential integrity, and cascade
+   * side effects — then relay every applied operation to connected clients.
+   *
+   * Because the operation did not come from a client session, it is relayed to
+   * ALL sessions (there is no source session to exclude). Each session still
+   * applies its own per-scope visibility filter in `relayOperations`, so a
+   * client only receives the operation if it falls within that client's scope.
+   *
+   * @param op - A fully-formed, server-originated operation to apply
+   * @returns The apply result, including any server-generated side-effect ops
+   */
+  async applyLocalOperation(op) {
+    const result = await applyServerOperation(this.store, op);
+    if (result.result === "applied" && result.appliedOperations.length > 0) {
+      for (const session of this.sessions.values()) {
+        session.relayOperations(result.appliedOperations);
+      }
+    }
+    return result;
+  }
+  /**
+   * Collect every blob reference still reachable from live records on the server.
+   *
+   * This is the live set for garbage-collecting the server's central blob store:
+   * pass the result to `collectBlobGarbage(blobStore, liveRefs)` from
+   * `@korajs/store` to reclaim bytes no record references any more. Only
+   * collections that declare a `blob` field are scanned.
+   *
+   * @returns Every live blob reference across all collections
+   */
+  async getLiveBlobRefs() {
+    const schema = this.store.getSchema();
+    if (!schema) {
+      return [];
+    }
+    const refs = [];
+    for (const [name, collection] of Object.entries(schema.collections)) {
+      const hasBlobField = Object.values(collection.fields).some((field) => field.kind === "blob");
+      if (!hasBlobField) {
+        continue;
+      }
+      const records = await this.store.materializeCollection(name);
+      for (const record of records) {
+        for (const value of Object.values(record)) {
+          if (isBlobRef(value)) {
+            refs.push(value);
+          }
+        }
+      }
+    }
+    return refs;
+  }
   /**
    * Get the number of currently connected clients.
    */
@@ -3205,6 +3705,7 @@ var KoraSyncServer = class {
     this.metrics.recordDisconnection(sessionId);
     this.awarenessRelay.removeClient(sessionId);
     this.yjsDocRelay.removeClient(sessionId);
+    this.blobChunkRelay.removeClient(sessionId);
     this.sessions.delete(sessionId);
     const clientId = this.httpSessionToClient.get(sessionId);
     if (clientId) {
@@ -3257,13 +3758,6 @@ function normalizeHttpBody(body, contentType) {
   return body;
 }
 
-// src/auth/no-auth.ts
-var NoAuthProvider = class {
-  async authenticate(_token) {
-    return { userId: "anonymous" };
-  }
-};
-
 // src/auth/token-auth.ts
 var TokenAuthProvider = class {
   validate;
@@ -3368,6 +3862,7 @@ function createProductionServer(config) {
     enableDashboard: true,
     ...config.syncOptions
   });
+  const routeContext = syncServer.getKoraContext();
   let httpServer = null;
   function getOperationalToken(kind) {
     const auth = config.operationalAuth;
@@ -3454,6 +3949,10 @@ function createProductionServer(config) {
       const chunks = [];
       req.on("data", (chunk) => chunks.push(chunk));
       req.on("end", () => resolve(Buffer.concat(chunks)));
+      if (!req.readableFlowing) {
+        req.resume();
+      }
+      req.on("error", () => resolve(Buffer.concat(chunks)));
     });
   }
   async function readJsonBody(req) {
@@ -3503,6 +4002,10 @@ function createProductionServer(config) {
     res.end(JSON.stringify(result.body ?? null));
   }
   return {
+    kora: routeContext,
+    getLiveBlobRefs() {
+      return syncServer.getLiveBlobRefs();
+    },
     async start() {
       const { createServer } = await import("http");
       const { createReadStream, existsSync, statSync } = await import("fs");
@@ -3510,6 +4013,19 @@ function createProductionServer(config) {
       const { WebSocketServer } = await import("ws");
       const distDir = resolve(staticDir);
       httpServer = createServer(async (req, res) => {
+        try {
+          await handleRequest(req, res);
+        } catch (error) {
+          console.error("[kora] Unhandled error in HTTP request handler:", error);
+          if (!res.headersSent) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Internal server error" }));
+          } else if (!res.writableEnded) {
+            res.end();
+          }
+        }
+      });
+      async function handleRequest(req, res) {
         res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
         res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
         const url = new URL(req.url || "/", `http://${req.headers.host}`);
@@ -3637,7 +4153,8 @@ data: ${JSON.stringify(s)}
             body: await readJsonBody(req),
             headers: req.headers,
             query: getQuery(url),
-            ip: getClientIp(req)
+            ip: getClientIp(req),
+            kora: routeContext
           });
           writeJsonResponse(res, result);
           return;
@@ -3671,7 +4188,7 @@ data: ${JSON.stringify(s)}
         const contentType = MIME_TYPES[ext] || "application/octet-stream";
         res.writeHead(200, { "Content-Type": contentType });
         createReadStream(filePath).pipe(res);
-      });
+      }
       const wss = new WebSocketServer({ noServer: true });
       httpServer.on("upgrade", (req, socket, head) => {
         const url = new URL(req.url || "/", `http://${req.headers.host}`);
@@ -3787,6 +4304,7 @@ export {
   MixedAuthProvider,
   NoAuthProvider,
   PostgresServerStore,
+  RETRIABLE_REJECTION_CODES,
   SqliteServerStore,
   TokenAuthProvider,
   WsServerTransport,
@@ -3797,6 +4315,7 @@ export {
   createPrettyLogger,
   createProductionServer,
   createSilentLogger,
-  createSqliteServerStore
+  createSqliteServerStore,
+  isRetriableRejection
 };
 //# sourceMappingURL=index.js.map