@korajs/server 1.0.0-beta.1 → 1.0.0-beta.11

package/dist/index.cjs

@@ -12,11 +12,11 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
+var __copyProps = (to, from, except, desc2) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
       if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc2 = __getOwnPropDesc(from, key)) || desc2.enumerable });
   }
   return to;
 };
@@ -169,6 +169,7 @@ var index_exports = {};
 __export(index_exports, {
   AwarenessRelay: () => AwarenessRelay,
   ClientSession: () => ClientSession,
+  DEFAULT_MAX_SCOPE_PREDICATE_VALUES: () => DEFAULT_MAX_SCOPE_PREDICATE_VALUES,
   HttpServerTransport: () => HttpServerTransport,
   KoraAuthProvider: () => KoraAuthProvider,
   KoraSyncServer: () => KoraSyncServer,
@@ -176,6 +177,7 @@ __export(index_exports, {
   MixedAuthProvider: () => MixedAuthProvider,
   NoAuthProvider: () => NoAuthProvider,
   PostgresServerStore: () => PostgresServerStore,
+  RETRIABLE_REJECTION_CODES: () => RETRIABLE_REJECTION_CODES,
   SqliteServerStore: () => SqliteServerStore,
   TokenAuthProvider: () => TokenAuthProvider,
   WsServerTransport: () => WsServerTransport,
@@ -186,7 +188,10 @@ __export(index_exports, {
   createPrettyLogger: () => createPrettyLogger,
   createProductionServer: () => createProductionServer,
   createSilentLogger: () => createSilentLogger,
-  createSqliteServerStore: () => createSqliteServerStore
+  createSqliteServerStore: () => createSqliteServerStore,
+  isRetriableRejection: () => isRetriableRejection,
+  normalizeScopeMap: () => normalizeScopeMap,
+  operationMatchesScopes: () => operationMatchesScopes
 });
 module.exports = __toCommonJS(index_exports);
 init_cjs_shims();
@@ -248,6 +253,13 @@ function createDefaultLogger() {
   }
 }
 
+// src/apply/rejection-taxonomy.ts
+init_cjs_shims();
+var RETRIABLE_REJECTION_CODES = /* @__PURE__ */ new Set(["RATE_LIMIT"]);
+function isRetriableRejection(code) {
+  return RETRIABLE_REJECTION_CODES.has(code);
+}
+
 // src/store/memory-server-store.ts
 init_cjs_shims();
 var import_core2 = require("@korajs/core");
@@ -269,6 +281,14 @@ function fieldTypeToSql(descriptor, dialect) {
       return dialect === "postgres" ? "BIGINT" : "INTEGER";
     case "array":
       return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "object":
+      return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "json":
+      return dialect === "postgres" ? "JSONB" : "TEXT";
+    case "blob":
+      return "TEXT";
+    case "secret":
+      return "TEXT";
     case "richtext":
       return dialect === "postgres" ? "BYTEA" : "BLOB";
   }
@@ -285,13 +305,13 @@ function generateCollectionDDL(name, collection, dialect) {
   const columns = ["id TEXT PRIMARY KEY NOT NULL"];
   for (const [fieldName, descriptor] of Object.entries(collection.fields)) {
     const sqlType = fieldTypeToSql(descriptor, dialect);
-    let colDef = `${fieldName} ${sqlType}`;
+    let colDef = `${(0, import_core.quoteIdent)(fieldName)} ${sqlType}`;
     if (descriptor.defaultValue !== void 0) {
       colDef += ` DEFAULT ${sqlDefaultLiteral(descriptor.defaultValue)}`;
     }
     if (descriptor.kind === "enum" && descriptor.enumValues) {
       const values = descriptor.enumValues.map((v) => `'${v}'`).join(", ");
-      colDef += ` CHECK (${fieldName} IN (${values}))`;
+      colDef += ` CHECK (${(0, import_core.quoteIdent)(fieldName)} IN (${values}))`;
     }
     columns.push(colDef);
   }
@@ -299,24 +319,26 @@ function generateCollectionDDL(name, collection, dialect) {
   columns.push(`_created_at ${tsType} NOT NULL DEFAULT 0`);
   columns.push(`_updated_at ${tsType} NOT NULL DEFAULT 0`);
   columns.push("_deleted INTEGER NOT NULL DEFAULT 0");
-  statements.push(`CREATE TABLE IF NOT EXISTS ${name} (
+  statements.push(`CREATE TABLE IF NOT EXISTS ${(0, import_core.quoteIdent)(name)} (
   ${columns.join(",\n  ")}
 )`);
   for (const [fieldName, descriptor] of Object.entries(collection.fields)) {
     const sqlType = fieldTypeToSql(descriptor, dialect);
-    let colDef = `${fieldName} ${sqlType}`;
+    let colDef = `${(0, import_core.quoteIdent)(fieldName)} ${sqlType}`;
     if (descriptor.defaultValue !== void 0) {
       colDef += ` DEFAULT ${sqlDefaultLiteral(descriptor.defaultValue)}`;
     }
     statements.push(`--kora:safe-alter
-ALTER TABLE ${name} ADD COLUMN ${colDef}`);
+ALTER TABLE ${(0, import_core.quoteIdent)(name)} ADD COLUMN ${colDef}`);
   }
   for (const indexField of collection.indexes) {
     statements.push(
-      `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${name} (${indexField})`
+      `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${(0, import_core.quoteIdent)(name)} (${(0, import_core.quoteIdent)(indexField)})`
     );
   }
-  statements.push(`CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${name} (_deleted)`);
+  statements.push(
+    `CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${(0, import_core.quoteIdent)(name)} (_deleted)`
+  );
   return statements;
 }
 function generateAllCollectionDDL(schema, dialect) {
@@ -326,30 +348,6 @@ function generateAllCollectionDDL(schema, dialect) {
   }
   return statements;
 }
-function replayOperationsForRecord(ops) {
-  let record = null;
-  let deleted = false;
-  for (const op of ops) {
-    switch (op.type) {
-      case "insert":
-        if (op.data) {
-          record = { ...op.data };
-          deleted = false;
-        }
-        break;
-      case "update":
-        if (op.data) {
-          record = { ...record ?? {}, ...op.data };
-          deleted = false;
-        }
-        break;
-      case "delete":
-        deleted = true;
-        break;
-    }
-  }
-  return deleted ? null : record;
-}
 var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 var BASE64_REVERSE = new Map(
   Array.from(BASE64_ALPHABET, (char, index3) => [char, index3])
@@ -400,6 +398,9 @@ function serializeFieldValue(value, descriptor) {
   if (value === null || value === void 0) return null;
   switch (descriptor.kind) {
     case "array":
+    case "object":
+    case "json":
+    case "blob":
       return typeof value === "string" ? value : JSON.stringify(value);
     case "boolean":
       return value ? 1 : 0;
@@ -413,6 +414,9 @@ function deserializeFieldValue(value, descriptor) {
   if (value === null || value === void 0) return null;
   switch (descriptor.kind) {
     case "array":
+    case "object":
+    case "json":
+    case "blob":
       return typeof value === "string" ? JSON.parse(value) : value;
     case "boolean":
       return value === 1 || value === true;
@@ -445,6 +449,14 @@ var MemoryServerStore = class {
   operations = [];
   operationIndex = /* @__PURE__ */ new Map();
   versionVector = /* @__PURE__ */ new Map();
+  /**
+   * Server-assigned delivery sequence per operation id. Single-process, so a plain
+   * counter incremented at insert time gives commit-order delivery sequence with no
+   * gaps. `operations` is kept in insertion (== delivery) order, so a delivery scan
+   * is a forward walk.
+   */
+  deliverySeqByOpId = /* @__PURE__ */ new Map();
+  deliverySeqCounter = 0;
   schema = null;
   /** Materialized records: collection -> recordId -> record data */
   materializedRecords = /* @__PURE__ */ new Map();
@@ -478,6 +490,8 @@ var MemoryServerStore = class {
     }
     this.operations.push(op);
     this.operationIndex.set(op.id, op);
+    this.deliverySeqCounter += 1;
+    this.deliverySeqByOpId.set(op.id, this.deliverySeqCounter);
     const currentSeq = this.versionVector.get(op.nodeId) ?? 0;
     if (op.sequenceNumber > currentSeq) {
       this.versionVector.set(op.nodeId, op.sequenceNumber);
@@ -497,6 +511,23 @@ var MemoryServerStore = class {
     this.assertOpen();
     return this.operations.length;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    return this.deliverySeqCounter;
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    const result = [];
+    if (limit <= 0) return result;
+    for (const op of this.operations) {
+      const deliverySequence = this.deliverySeqByOpId.get(op.id) ?? 0;
+      if (deliverySequence > afterDeliverySequence) {
+        result.push({ operation: op, deliverySequence });
+        if (result.length >= limit) break;
+      }
+    }
+    return result;
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     if (this.schema?.collections[collection]) {
@@ -641,12 +672,16 @@ var MemoryServerStore = class {
     this.operations.length = 0;
     this.operationIndex.clear();
     this.versionVector.clear();
+    this.deliverySeqByOpId.clear();
+    this.deliverySeqCounter = 0;
     for (const [nid, seq] of versionVector) {
       this.versionVector.set(nid, seq);
     }
     for (const op of operations2) {
       this.operations.push(op);
       this.operationIndex.set(op.id, op);
+      this.deliverySeqCounter += 1;
+      this.deliverySeqByOpId.set(op.id, this.deliverySeqCounter);
       if (this.schema?.collections[op.collection]) {
         this.rebuildMaterializedRecord(op.collection, op.recordId);
       }
@@ -676,13 +711,14 @@ var MemoryServerStore = class {
         return a.timestamp.wallTime - b.timestamp.wallTime;
       if (a.timestamp.logical !== b.timestamp.logical)
         return a.timestamp.logical - b.timestamp.logical;
-      return a.sequenceNumber - b.sequenceNumber;
+      return a.timestamp.nodeId < b.timestamp.nodeId ? -1 : a.timestamp.nodeId > b.timestamp.nodeId ? 1 : 0;
     });
     const parsedOps = recordOps.map((op) => ({
       type: op.type,
-      data: op.data
+      data: op.data,
+      atomicOps: op.atomicOps ?? null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     if (recordData) {
       const createdAt = recordOps.length > 0 ? recordOps[0].timestamp.wallTime : Date.now();
       const updatedAt = recordOps.length > 0 ? recordOps[recordOps.length - 1].timestamp.wallTime : Date.now();
@@ -805,6 +841,8 @@ var pgOperations = (0, import_pg_core.pgTable)(
     // JSON-serialized, null for deletes
     previousData: (0, import_pg_core.text)("previous_data"),
     // JSON-serialized, null for insert/delete
+    atomicOps: (0, import_pg_core.text)("atomic_ops"),
+    // JSON-serialized Record<field, AtomicOp>, null when none
     wallTime: (0, import_pg_core.bigint)("wall_time", { mode: "number" }).notNull(),
     logical: (0, import_pg_core.integer)("logical").notNull(),
     timestampNodeId: (0, import_pg_core.text)("timestamp_node_id").notNull(),
@@ -812,12 +850,18 @@ var pgOperations = (0, import_pg_core.pgTable)(
     causalDeps: (0, import_pg_core.text)("causal_deps").notNull().default("[]"),
     // JSON array of op IDs
     schemaVersion: (0, import_pg_core.integer)("schema_version").notNull(),
-    receivedAt: (0, import_pg_core.bigint)("received_at", { mode: "number" }).notNull()
+    receivedAt: (0, import_pg_core.bigint)("received_at", { mode: "number" }).notNull(),
+    // Server-assigned monotonic delivery sequence, ordered by commit (assigned from
+    // a counter row locked inside the append transaction, so delivery order equals
+    // visibility order even across instances). Drives the gap-free server->client
+    // delivery watermark. Nullable only for pre-column rows, backfilled on startup.
+    deliverySeq: (0, import_pg_core.bigint)("delivery_seq", { mode: "number" })
   },
   (table) => ({
     nodeSeqIdx: (0, import_pg_core.index)("idx_pg_node_seq").on(table.nodeId, table.sequenceNumber),
     collectionIdx: (0, import_pg_core.index)("idx_pg_collection").on(table.collection),
-    receivedIdx: (0, import_pg_core.index)("idx_pg_received").on(table.receivedAt)
+    receivedIdx: (0, import_pg_core.index)("idx_pg_received").on(table.receivedAt),
+    deliveryIdx: (0, import_pg_core.index)("idx_pg_delivery_seq").on(table.deliverySeq)
   })
 );
 var pgSyncState = (0, import_pg_core.pgTable)("sync_state", {
@@ -834,15 +878,43 @@ var PostgresServerStore = class {
   ready;
   schema = null;
   closed = false;
-  constructor(db, nodeId) {
+  /**
+   * Monotonic counter for this node's server-originated sequence numbers. Lazily
+   * seeded from the persisted version vector on first use, then advanced in memory
+   * (a synchronous `++`, atomic on the single JS thread) so concurrent conditional
+   * applies never receive the same number. Null means "not yet seeded"; reset to
+   * null after a backup import so it re-seeds from the restored version vector.
+   */
+  sequenceCounter = null;
+  /**
+   * Time source for HLC timestamps on server-originated operations. Injectable so a
+   * test can freeze wall-clock time and prove the conditional-apply ordering holds
+   * under same-millisecond commits (the case the advisory lock and clock advance
+   * exist to make correct). Defaults to the system clock in production.
+   */
+  timeSource;
+  constructor(db, nodeId, timeSource) {
     this.db = db;
     this.nodeId = nodeId ?? (0, import_core3.generateUUIDv7)();
+    this.timeSource = timeSource ?? { now: () => Date.now() };
     this.ready = this.initialize();
   }
   getVersionVector() {
     this.assertOpen();
     return new Map(this.versionVector);
   }
+  /**
+   * Atomically reserve this node's next server-operation sequence number. The
+   * synchronous increment cannot interleave on the single JS thread, so two
+   * concurrent conditional applies are always handed distinct numbers.
+   */
+  reserveSequenceNumber() {
+    if (this.sequenceCounter === null) {
+      this.sequenceCounter = this.versionVector.get(this.nodeId) ?? 0;
+    }
+    this.sequenceCounter += 1;
+    return this.sequenceCounter;
+  }
   getNodeId() {
     return this.nodeId;
   }
@@ -880,8 +952,9 @@ var PostgresServerStore = class {
       return "duplicate";
     }
     const now = Date.now();
-    const row = this.serializeOperation(op, now);
     await this.db.transaction(async (tx) => {
+      const deliverySeq = await this.nextDeliverySeq(tx);
+      const row = this.serializeOperation(op, now, deliverySeq);
       await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
       await tx.insert(pgSyncState).values({
         nodeId: op.nodeId,
@@ -904,6 +977,73 @@ var PostgresServerStore = class {
     }
     return "applied";
   }
+  /**
+   * Conditionally apply operations atomically, serialized across server instances
+   * on the target record via a transaction-scoped advisory lock. The lock makes
+   * the read-decide-write cycle atomic against concurrent instances, so a cap
+   * check like `responseCount < max` cannot be passed by two admissions at once.
+   */
+  async applyConditional(input) {
+    this.assertOpen();
+    await this.ready;
+    this.assertSchema();
+    this.assertCollection(input.target.collection);
+    const schema = this.schema;
+    const collectionDef = schema.collections[input.target.collection];
+    const lockKey = `kora:${input.target.collection}:${input.target.id}`;
+    const result = await this.db.transaction(async (tx) => {
+      await tx.execute(import_drizzle_orm.sql`SELECT pg_advisory_xact_lock(hashtextextended(${lockKey}, 0))`);
+      if (input.idempotencyKey) {
+        const existing = await tx.execute(
+          import_drizzle_orm.sql`SELECT 1 FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(input.idempotencyKey.collection))} WHERE id = ${input.idempotencyKey.id} AND _deleted = 0 LIMIT 1`
+        );
+        if (existing.length > 0) {
+          return { admitted: true, idempotent: true, applied: [] };
+        }
+      }
+      const rows = await tx.execute(
+        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(input.target.collection))} WHERE id = ${input.target.id} AND _deleted = 0`
+      );
+      const current = rows.length > 0 ? this.deserializeRow(rows[0], collectionDef) : null;
+      if (!input.admit(current)) {
+        return { admitted: false, idempotent: false, applied: [] };
+      }
+      const clock = new import_core3.HybridLogicalClock(this.nodeId, this.timeSource);
+      const latest = await this.latestOperationTimestamp(
+        tx,
+        input.target.collection,
+        input.target.id
+      );
+      if (latest) {
+        clock.advanceTo(latest);
+      }
+      const ops = await input.buildOperations(current, { clock });
+      const now = Date.now();
+      for (const op of ops) {
+        const deliverySeq = await this.nextDeliverySeq(tx);
+        const row = this.serializeOperation(op, now, deliverySeq);
+        await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
+        await tx.insert(pgSyncState).values({ nodeId: op.nodeId, maxSequenceNumber: op.sequenceNumber, lastSeenAt: now }).onConflictDoUpdate({
+          target: pgSyncState.nodeId,
+          set: {
+            maxSequenceNumber: import_drizzle_orm.sql`GREATEST(${pgSyncState.maxSequenceNumber}, ${op.sequenceNumber})`,
+            lastSeenAt: import_drizzle_orm.sql`${now}`
+          }
+        });
+        if (this.schema?.collections[op.collection]) {
+          await this.rebuildMaterializedRecord(tx, op.collection, op.recordId);
+        }
+      }
+      return { admitted: true, idempotent: false, applied: ops };
+    });
+    for (const op of result.applied) {
+      const currentMax = this.versionVector.get(op.nodeId) ?? 0;
+      if (op.sequenceNumber > currentMax) {
+        this.versionVector.set(op.nodeId, op.sequenceNumber);
+      }
+    }
+    return result;
+  }
   async getOperationRange(nodeId, fromSeq, toSeq) {
     this.assertOpen();
     await this.ready;
@@ -918,6 +1058,23 @@ var PostgresServerStore = class {
     const result = await this.db.select({ value: (0, import_drizzle_orm.count)() }).from(pgOperations);
     return result[0]?.value ?? 0;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    await this.ready;
+    const rows = await this.db.execute(
+      import_drizzle_orm.sql`SELECT COALESCE(MAX(delivery_seq), 0) AS m FROM operations`
+    );
+    return Number(rows[0]?.m ?? 0);
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    await this.ready;
+    const rows = await this.db.select().from(pgOperations).where((0, import_drizzle_orm.gt)(pgOperations.deliverySeq, afterDeliverySequence)).orderBy((0, import_drizzle_orm.asc)(pgOperations.deliverySeq)).limit(limit);
+    return rows.map((row) => ({
+      operation: this.deserializeOperation(row),
+      deliverySequence: row.deliverySeq ?? 0
+    }));
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     await this.ready;
@@ -952,7 +1109,7 @@ var PostgresServerStore = class {
     this.assertCollection(collection);
     const schema = this.schema;
     const collectionDef = schema.collections[collection];
-    const query = import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw(collection)} WHERE id = ${id} AND _deleted = 0`;
+    const query = import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collection))} WHERE id = ${id} AND _deleted = 0`;
     const rows = await this.db.execute(query);
     if (rows.length === 0) return null;
     return this.deserializeRow(rows[0], collectionDef);
@@ -969,7 +1126,7 @@ var PostgresServerStore = class {
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false);
-    const query = import_drizzle_orm.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm.sql.raw(collection)} WHERE ${whereClause}`;
+    const query = import_drizzle_orm.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collection))} WHERE ${whereClause}`;
     const rows = await this.db.execute(query);
     const cnt = rows[0]?.cnt;
     return typeof cnt === "string" ? Number.parseInt(cnt, 10) : cnt ?? 0;
@@ -981,7 +1138,7 @@ var PostgresServerStore = class {
     this.assertOpen();
     await this.ready;
     const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
-    const rows = await this.db.select().from(pgOperations).orderBy((0, import_drizzle_orm.asc)(pgOperations.sequenceNumber));
+    const rows = await this.db.select().from(pgOperations).orderBy((0, import_drizzle_orm.asc)(pgOperations.deliverySeq));
     const operations2 = rows.map((row) => this.deserializeOperation(row));
     return buildServerBackup2(this.nodeId, operations2, this.versionVector);
   }
@@ -996,6 +1153,7 @@ var PostgresServerStore = class {
         const result = await this.applyRemoteOperation(op);
         if (result === "applied") restored++;
       }
+      this.sequenceCounter = null;
       return { operationsRestored: restored, success: true };
     }
     const now = Date.now();
@@ -1005,20 +1163,49 @@ var PostgresServerStore = class {
       for (const [nid, seq] of versionVector) {
         await tx.insert(pgSyncState).values({ nodeId: nid, maxSequenceNumber: seq, lastSeenAt: now }).onConflictDoNothing({ target: pgSyncState.nodeId });
       }
+      let deliverySeq = 0;
       for (const op of operations2) {
-        const row = this.serializeOperation(op, now);
+        deliverySeq += 1;
+        const row = this.serializeOperation(op, now, deliverySeq);
         await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
       }
+      await tx.execute(
+        import_drizzle_orm.sql`INSERT INTO delivery_counter (id, value) VALUES (1, ${deliverySeq})
+					ON CONFLICT (id) DO UPDATE SET value = ${deliverySeq}`
+      );
     });
     this.versionVector.clear();
     for (const [nid, seq] of versionVector) {
       this.versionVector.set(nid, seq);
     }
+    this.sequenceCounter = null;
     return { operationsRestored: operations2.length, success: true };
   }
   // ---------------------------------------------------------------------------
   // Materialization internals
   // ---------------------------------------------------------------------------
+  /**
+   * The HLC timestamp of the most recent operation on a record, by total order
+   * (wallTime, logical, nodeId), or null when the record has no operations. Used
+   * by {@link applyConditional} to advance its clock past the record's latest
+   * write so newly built operations sort strictly after it.
+   */
+  async latestOperationTimestamp(txOrDb, collection, recordId) {
+    const rows = await txOrDb.select({
+      wallTime: pgOperations.wallTime,
+      logical: pgOperations.logical,
+      timestampNodeId: pgOperations.timestampNodeId
+    }).from(pgOperations).where((0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(pgOperations.collection, collection), (0, import_drizzle_orm.eq)(pgOperations.recordId, recordId))).orderBy(
+      (0, import_drizzle_orm.desc)(pgOperations.wallTime),
+      (0, import_drizzle_orm.desc)(pgOperations.logical),
+      (0, import_drizzle_orm.desc)(pgOperations.timestampNodeId)
+    ).limit(1);
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    return { wallTime: row.wallTime, logical: row.logical, nodeId: row.timestampNodeId };
+  }
   /**
    * Rebuild a single record in the materialized collection table by replaying
    * all operations for that record.
@@ -1029,17 +1216,19 @@ var PostgresServerStore = class {
     const ops = await txOrDb.select({
       type: pgOperations.type,
       data: pgOperations.data,
+      atomicOps: pgOperations.atomicOps,
       wallTime: pgOperations.wallTime
     }).from(pgOperations).where((0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(pgOperations.collection, collection), (0, import_drizzle_orm.eq)(pgOperations.recordId, recordId))).orderBy(
       (0, import_drizzle_orm.asc)(pgOperations.wallTime),
       (0, import_drizzle_orm.asc)(pgOperations.logical),
-      (0, import_drizzle_orm.asc)(pgOperations.sequenceNumber)
+      (0, import_drizzle_orm.asc)(pgOperations.timestampNodeId)
     );
     const parsedOps = ops.map((op) => ({
       type: op.type,
-      data: op.data !== null ? JSON.parse(op.data) : null
+      data: op.data !== null ? JSON.parse(op.data) : null,
+      atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     const fieldNames = Object.keys(collectionDef.fields);
     if (recordData) {
       const createdAt = ops.length > 0 ? ops[0].wallTime : Date.now();
@@ -1056,7 +1245,7 @@ var PostgresServerStore = class {
       );
     } else {
       await txOrDb.execute(
-        import_drizzle_orm.sql`UPDATE ${import_drizzle_orm.sql.raw(collection)} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
+        import_drizzle_orm.sql`UPDATE ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collection))} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
       );
     }
   }
@@ -1075,16 +1264,16 @@ var PostgresServerStore = class {
       updatedAt,
       0
     ];
-    const columnsSql = import_drizzle_orm.sql.raw(allColumns.join(", "));
+    const columnsSql = import_drizzle_orm.sql.raw(allColumns.map((c) => (0, import_core3.quoteIdent)(c)).join(", "));
     const valuesSql = import_drizzle_orm.sql.join(
       values.map((v) => import_drizzle_orm.sql`${v}`),
       import_drizzle_orm.sql.raw(", ")
     );
     const updateSet = import_drizzle_orm.sql.raw(
-      allColumns.slice(1).map((c) => `${c} = excluded.${c}`).join(", ")
+      allColumns.slice(1).map((c) => `${(0, import_core3.quoteIdent)(c)} = excluded.${(0, import_core3.quoteIdent)(c)}`).join(", ")
     );
     await txOrDb.execute(
-      import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw(tableName)} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+      import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
     );
   }
   /**
@@ -1106,11 +1295,12 @@ var PostgresServerStore = class {
       recordId: pgOperations.recordId,
       type: pgOperations.type,
       data: pgOperations.data,
+      atomicOps: pgOperations.atomicOps,
       wallTime: pgOperations.wallTime
     }).from(pgOperations).where((0, import_drizzle_orm.eq)(pgOperations.collection, collectionName)).orderBy(
       (0, import_drizzle_orm.asc)(pgOperations.wallTime),
       (0, import_drizzle_orm.asc)(pgOperations.logical),
-      (0, import_drizzle_orm.asc)(pgOperations.sequenceNumber)
+      (0, import_drizzle_orm.asc)(pgOperations.timestampNodeId)
     );
     if (allOps.length === 0) return;
     const grouped = /* @__PURE__ */ new Map();
@@ -1126,9 +1316,10 @@ var PostgresServerStore = class {
     for (const [recordId, recordOps] of grouped) {
       const parsedOps = recordOps.map((op) => ({
         type: op.type,
-        data: op.data !== null ? JSON.parse(op.data) : null
+        data: op.data !== null ? JSON.parse(op.data) : null,
+        atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
       }));
-      const recordData = replayOperationsForRecord(parsedOps);
+      const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
       if (recordData) {
         const createdAt = recordOps[0].wallTime;
         const updatedAt = recordOps[recordOps.length - 1].wallTime;
@@ -1144,7 +1335,7 @@ var PostgresServerStore = class {
         );
       } else {
         await this.db.execute(
-          import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw(collectionName)} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
+          import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collectionName))} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
         );
       }
     }
@@ -1157,10 +1348,12 @@ var PostgresServerStore = class {
       options?.where ?? {},
       options?.includeDeleted ?? false
     );
-    const parts = [import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw(collection)} WHERE ${whereClause}`];
+    const parts = [
+      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(collection))} WHERE ${whereClause}`
+    ];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
-      parts.push(import_drizzle_orm.sql.raw(` ORDER BY ${options.orderBy} ${dir}`));
+      parts.push(import_drizzle_orm.sql.raw(` ORDER BY ${(0, import_core3.quoteIdent)(options.orderBy)} ${dir}`));
     }
     if (options?.limit !== void 0) {
       parts.push(import_drizzle_orm.sql` LIMIT ${options.limit}`);
@@ -1176,7 +1369,7 @@ var PostgresServerStore = class {
       conditions.push(import_drizzle_orm.sql.raw("_deleted = 0"));
     }
     for (const [key, value] of Object.entries(where)) {
-      conditions.push(import_drizzle_orm.sql`${import_drizzle_orm.sql.raw(key)} = ${value}`);
+      conditions.push(import_drizzle_orm.sql`${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(key))} = ${value}`);
     }
     if (conditions.length === 0) {
       return import_drizzle_orm.sql.raw("1 = 1");
@@ -1249,44 +1442,92 @@ var PostgresServerStore = class {
     }
   }
   async ensureTables() {
-    await this.db.execute(import_drizzle_orm.sql`
-			CREATE TABLE IF NOT EXISTS operations (
-				id TEXT PRIMARY KEY,
-				node_id TEXT NOT NULL,
-				type TEXT NOT NULL,
-				collection TEXT NOT NULL,
-				record_id TEXT NOT NULL,
-				data TEXT,
-				previous_data TEXT,
-				wall_time BIGINT NOT NULL,
-				logical INTEGER NOT NULL,
-				timestamp_node_id TEXT NOT NULL,
-				sequence_number INTEGER NOT NULL,
-				causal_deps TEXT NOT NULL DEFAULT '[]',
-				schema_version INTEGER NOT NULL,
-				received_at BIGINT NOT NULL
-			)
-		`);
-    await this.db.execute(
-      import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)`
-    );
-    await this.db.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)`);
-    await this.db.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_received ON operations (received_at)`);
-    await this.db.execute(
-      import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection_record ON operations (collection, record_id)`
+    await this.db.transaction(async (tx) => {
+      await tx.execute(import_drizzle_orm.sql`SELECT pg_advisory_xact_lock(hashtextextended('kora:ensure-tables', 0))`);
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS operations (
+					id TEXT PRIMARY KEY,
+					node_id TEXT NOT NULL,
+					type TEXT NOT NULL,
+					collection TEXT NOT NULL,
+					record_id TEXT NOT NULL,
+					data TEXT,
+					previous_data TEXT,
+					atomic_ops TEXT,
+					wall_time BIGINT NOT NULL,
+					logical INTEGER NOT NULL,
+					timestamp_node_id TEXT NOT NULL,
+					sequence_number INTEGER NOT NULL,
+					causal_deps TEXT NOT NULL DEFAULT '[]',
+					schema_version INTEGER NOT NULL,
+					received_at BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`ALTER TABLE operations ADD COLUMN IF NOT EXISTS atomic_ops TEXT`);
+      await tx.execute(import_drizzle_orm.sql`ALTER TABLE operations ADD COLUMN IF NOT EXISTS delivery_seq BIGINT`);
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)`
+      );
+      await tx.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)`);
+      await tx.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_received ON operations (received_at)`);
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_delivery_seq ON operations (delivery_seq)`
+      );
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection_record ON operations (collection, record_id)`
+      );
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS sync_state (
+					node_id TEXT PRIMARY KEY,
+					max_sequence_number INTEGER NOT NULL,
+					last_seen_at BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS delivery_counter (
+					id INTEGER PRIMARY KEY,
+					value BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				WITH ordered AS (
+					SELECT id, ROW_NUMBER() OVER (
+						ORDER BY received_at ASC, sequence_number ASC, id ASC
+					) + COALESCE((SELECT MAX(delivery_seq) FROM operations), 0) AS rn
+					FROM operations WHERE delivery_seq IS NULL
+				)
+				UPDATE operations o SET delivery_seq = ordered.rn
+				FROM ordered WHERE o.id = ordered.id
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				INSERT INTO delivery_counter (id, value)
+				VALUES (1, COALESCE((SELECT MAX(delivery_seq) FROM operations), 0))
+				ON CONFLICT (id) DO UPDATE
+					SET value = GREATEST(delivery_counter.value, EXCLUDED.value)
+			`);
+    });
+  }
+  /**
+   * Reserve the next delivery sequence inside an open append transaction. The
+   * `UPDATE ... RETURNING` locks the counter row until this transaction commits,
+   * serializing assignment into commit order (see the counter table comment).
+   */
+  async nextDeliverySeq(tx) {
+    const rows = await tx.execute(
+      import_drizzle_orm.sql`UPDATE delivery_counter SET value = value + 1 WHERE id = 1 RETURNING value`
     );
-    await this.db.execute(import_drizzle_orm.sql`
-			CREATE TABLE IF NOT EXISTS sync_state (
-				node_id TEXT PRIMARY KEY,
-				max_sequence_number INTEGER NOT NULL,
-				last_seen_at BIGINT NOT NULL
-			)
-		`);
+    const value = rows[0]?.value;
+    if (value === void 0 || value === null) {
+      throw new Error(
+        "delivery_counter row (id=1) is missing; the operations log cannot assign delivery sequences"
+      );
+    }
+    return Number(value);
   }
   // ---------------------------------------------------------------------------
   // Operation serialization
   // ---------------------------------------------------------------------------
-  serializeOperation(op, receivedAt) {
+  serializeOperation(op, receivedAt, deliverySeq) {
     return {
       id: op.id,
       nodeId: op.nodeId,
@@ -1295,16 +1536,19 @@ var PostgresServerStore = class {
       recordId: op.recordId,
       data: op.data !== null ? JSON.stringify(op.data) : null,
       previousData: op.previousData !== null ? JSON.stringify(op.previousData) : null,
+      atomicOps: op.atomicOps && Object.keys(op.atomicOps).length > 0 ? JSON.stringify(op.atomicOps) : null,
       wallTime: op.timestamp.wallTime,
       logical: op.timestamp.logical,
       timestampNodeId: op.timestamp.nodeId,
       sequenceNumber: op.sequenceNumber,
       causalDeps: JSON.stringify(op.causalDeps),
       schemaVersion: op.schemaVersion,
-      receivedAt
+      receivedAt,
+      deliverySeq
     };
   }
   deserializeOperation(row) {
+    const atomicOps = row.atomicOps != null ? JSON.parse(row.atomicOps) : void 0;
     return {
       id: row.id,
       nodeId: row.nodeId,
@@ -1320,7 +1564,8 @@ var PostgresServerStore = class {
       },
       sequenceNumber: row.sequenceNumber,
       causalDeps: JSON.parse(row.causalDeps),
-      schemaVersion: row.schemaVersion
+      schemaVersion: row.schemaVersion,
+      ...atomicOps ? { atomicOps } : {}
     };
   }
   // ---------------------------------------------------------------------------
@@ -1390,6 +1635,8 @@ var operations = (0, import_sqlite_core.sqliteTable)(
     // JSON-serialized, null for deletes
     previousData: (0, import_sqlite_core.text)("previous_data"),
     // JSON-serialized, null for insert/delete
+    atomicOps: (0, import_sqlite_core.text)("atomic_ops"),
+    // JSON-serialized Record<field, AtomicOp>, null when none
     wallTime: (0, import_sqlite_core.integer)("wall_time").notNull(),
     logical: (0, import_sqlite_core.integer)("logical").notNull(),
     timestampNodeId: (0, import_sqlite_core.text)("timestamp_node_id").notNull(),
@@ -1397,12 +1644,17 @@ var operations = (0, import_sqlite_core.sqliteTable)(
     causalDeps: (0, import_sqlite_core.text)("causal_deps").notNull().default("[]"),
     // JSON array of op IDs
     schemaVersion: (0, import_sqlite_core.integer)("schema_version").notNull(),
-    receivedAt: (0, import_sqlite_core.integer)("received_at").notNull()
+    receivedAt: (0, import_sqlite_core.integer)("received_at").notNull(),
+    // Server-assigned monotonic delivery sequence, ordered by commit. Drives the
+    // gap-free server->client delivery watermark. Nullable only for rows written
+    // before the column existed; those are backfilled on startup.
+    deliverySeq: (0, import_sqlite_core.integer)("delivery_seq")
   },
   (table) => ({
     nodeSeqIdx: (0, import_sqlite_core.index)("idx_node_seq").on(table.nodeId, table.sequenceNumber),
     collectionIdx: (0, import_sqlite_core.index)("idx_collection").on(table.collection),
-    receivedIdx: (0, import_sqlite_core.index)("idx_received").on(table.receivedAt)
+    receivedIdx: (0, import_sqlite_core.index)("idx_received").on(table.receivedAt),
+    deliveryIdx: (0, import_sqlite_core.index)("idx_delivery_seq").on(table.deliverySeq)
   })
 );
 var syncState = (0, import_sqlite_core.sqliteTable)("sync_state", {
@@ -1410,6 +1662,10 @@ var syncState = (0, import_sqlite_core.sqliteTable)("sync_state", {
   maxSequenceNumber: (0, import_sqlite_core.integer)("max_sequence_number").notNull(),
   lastSeenAt: (0, import_sqlite_core.integer)("last_seen_at").notNull()
 });
+var deliveryCounter = (0, import_sqlite_core.sqliteTable)("delivery_counter", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey(),
+  value: (0, import_sqlite_core.integer)("value").notNull()
+});
 
 // src/store/sqlite-server-store.ts
 var esmRequire = (0, import_node_module.createRequire)(importMetaUrl);
@@ -1463,12 +1719,15 @@ var SqliteServerStore = class {
   async applyRemoteOperation(op) {
     this.assertOpen();
     const now = Date.now();
-    const row = this.serializeOperation(op, now);
     const result = this.db.transaction((tx) => {
-      const insertResult = tx.insert(operations).values(row).onConflictDoNothing({ target: operations.id }).run();
-      if (insertResult.changes === 0) {
+      const existing = tx.all(
+        import_drizzle_orm2.sql`SELECT id FROM operations WHERE id = ${op.id} LIMIT 1`
+      );
+      if (existing.length > 0) {
         return "duplicate";
       }
+      const row = this.serializeOperation(op, now, this.nextDeliverySeq(tx));
+      tx.insert(operations).values(row).run();
       tx.insert(syncState).values({
         nodeId: op.nodeId,
         maxSequenceNumber: op.sequenceNumber,
@@ -1497,6 +1756,21 @@ var SqliteServerStore = class {
     const result = this.db.select({ value: (0, import_drizzle_orm2.count)() }).from(operations).all();
     return result[0]?.value ?? 0;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    const rows = this.db.all(
+      import_drizzle_orm2.sql`SELECT MAX(delivery_seq) AS m FROM operations`
+    );
+    return rows[0]?.m ?? 0;
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    const rows = this.db.select().from(operations).where((0, import_drizzle_orm2.gt)(operations.deliverySeq, afterDeliverySequence)).orderBy((0, import_drizzle_orm2.asc)(operations.deliverySeq)).limit(limit).all();
+    return rows.map((row) => ({
+      operation: this.deserializeOperation(row),
+      deliverySequence: row.deliverySeq ?? 0
+    }));
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     if (this.schema?.collections[collection]) {
@@ -1528,7 +1802,7 @@ var SqliteServerStore = class {
     this.assertCollection(collection);
     const schema = this.schema;
     const collectionDef = schema.collections[collection];
-    const query = import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE id = ${id} AND _deleted = 0`;
+    const query = import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collection))} WHERE id = ${id} AND _deleted = 0`;
     const rows = this.db.all(query);
     if (rows.length === 0) return null;
     return this.deserializeRow(rows[0], collectionDef);
@@ -1544,7 +1818,7 @@ var SqliteServerStore = class {
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false);
-    const query = import_drizzle_orm2.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE ${whereClause}`;
+    const query = import_drizzle_orm2.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collection))} WHERE ${whereClause}`;
     const rows = this.db.all(query);
     return rows[0]?.cnt ?? 0;
   }
@@ -1554,7 +1828,7 @@ var SqliteServerStore = class {
   async exportBackup() {
     this.assertOpen();
     const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
-    const rows = this.db.select().from(operations).all();
+    const rows = this.db.select().from(operations).orderBy((0, import_drizzle_orm2.asc)(operations.deliverySeq)).all();
     const deserialized = rows.map((row) => this.deserializeOperation(row));
     const vv = this.getVersionVector();
     return buildServerBackup2(this.nodeId, deserialized, vv);
@@ -1574,13 +1848,17 @@ var SqliteServerStore = class {
     this.db.transaction((tx) => {
       tx.run(import_drizzle_orm2.sql.raw("DELETE FROM operations"));
       tx.run(import_drizzle_orm2.sql.raw("DELETE FROM sync_state"));
+      tx.update(deliveryCounter).set({ value: 0 }).where((0, import_drizzle_orm2.eq)(deliveryCounter.id, 1)).run();
       for (const [nid, seq] of versionVector) {
         tx.insert(syncState).values({ nodeId: nid, maxSequenceNumber: seq, lastSeenAt: Date.now() }).run();
       }
+      let deliverySeq = 0;
       for (const op of ops) {
-        const row = this.serializeOperation(op, Date.now());
+        deliverySeq += 1;
+        const row = this.serializeOperation(op, Date.now(), deliverySeq);
         tx.insert(operations).values(row).run();
       }
+      tx.update(deliveryCounter).set({ value: deliverySeq }).where((0, import_drizzle_orm2.eq)(deliveryCounter.id, 1)).run();
     });
     return { operationsRestored: ops.length, success: true };
   }
@@ -1598,13 +1876,15 @@ var SqliteServerStore = class {
     const ops = txOrDb.select({
       type: operations.type,
       data: operations.data,
+      atomicOps: operations.atomicOps,
       wallTime: operations.wallTime
-    }).from(operations).where((0, import_drizzle_orm2.and)((0, import_drizzle_orm2.eq)(operations.collection, collection), (0, import_drizzle_orm2.eq)(operations.recordId, recordId))).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.sequenceNumber)).all();
+    }).from(operations).where((0, import_drizzle_orm2.and)((0, import_drizzle_orm2.eq)(operations.collection, collection), (0, import_drizzle_orm2.eq)(operations.recordId, recordId))).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.timestampNodeId)).all();
     const parsedOps = ops.map((op) => ({
       type: op.type,
-      data: op.data !== null ? JSON.parse(op.data) : null
+      data: op.data !== null ? JSON.parse(op.data) : null,
+      atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     const fieldNames = Object.keys(collectionDef.fields);
     if (recordData) {
       const createdAt = ops.length > 0 ? ops[0].wallTime : Date.now();
@@ -1621,7 +1901,7 @@ var SqliteServerStore = class {
       );
     } else {
       txOrDb.run(
-        import_drizzle_orm2.sql`UPDATE ${import_drizzle_orm2.sql.raw(collection)} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
+        import_drizzle_orm2.sql`UPDATE ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collection))} SET _deleted = 1, _updated_at = ${Date.now()} WHERE id = ${recordId}`
       );
     }
   }
@@ -1642,16 +1922,16 @@ var SqliteServerStore = class {
       0
       // _deleted = false
     ];
-    const columnsSql = import_drizzle_orm2.sql.raw(allColumns.join(", "));
+    const columnsSql = import_drizzle_orm2.sql.raw(allColumns.map((c) => (0, import_core4.quoteIdent)(c)).join(", "));
     const valuesSql = import_drizzle_orm2.sql.join(
       values.map((v) => import_drizzle_orm2.sql`${v}`),
       import_drizzle_orm2.sql.raw(", ")
     );
     const updateSet = import_drizzle_orm2.sql.raw(
-      allColumns.slice(1).map((c) => `${c} = excluded.${c}`).join(", ")
+      allColumns.slice(1).map((c) => `${(0, import_core4.quoteIdent)(c)} = excluded.${(0, import_core4.quoteIdent)(c)}`).join(", ")
     );
     txOrDb.run(
-      import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw(tableName)} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+      import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
     );
   }
   /**
@@ -1674,8 +1954,9 @@ var SqliteServerStore = class {
       recordId: operations.recordId,
       type: operations.type,
       data: operations.data,
+      atomicOps: operations.atomicOps,
       wallTime: operations.wallTime
-    }).from(operations).where((0, import_drizzle_orm2.eq)(operations.collection, collectionName)).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.sequenceNumber)).all();
+    }).from(operations).where((0, import_drizzle_orm2.eq)(operations.collection, collectionName)).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.timestampNodeId)).all();
     if (allOps.length === 0) return;
     const grouped = /* @__PURE__ */ new Map();
     for (const op of allOps) {
@@ -1691,9 +1972,10 @@ var SqliteServerStore = class {
       for (const [recordId, recordOps] of grouped) {
         const parsedOps = recordOps.map((op) => ({
           type: op.type,
-          data: op.data !== null ? JSON.parse(op.data) : null
+          data: op.data !== null ? JSON.parse(op.data) : null,
+          atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
         }));
-        const recordData = replayOperationsForRecord(parsedOps);
+        const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
         if (recordData) {
           const createdAt = recordOps[0].wallTime;
           const updatedAt = recordOps[recordOps.length - 1].wallTime;
@@ -1709,7 +1991,7 @@ var SqliteServerStore = class {
           );
         } else {
           tx.run(
-            import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw(collectionName)} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
+            import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collectionName))} (id, _deleted, _created_at, _updated_at) VALUES (${recordId}, 1, ${Date.now()}, ${Date.now()}) ON CONFLICT (id) DO UPDATE SET _deleted = 1, _updated_at = ${Date.now()}`
           );
         }
       }
@@ -1723,10 +2005,12 @@ var SqliteServerStore = class {
       options?.where ?? {},
       options?.includeDeleted ?? false
     );
-    const parts = [import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(collection)} WHERE ${whereClause}`];
+    const parts = [
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(collection))} WHERE ${whereClause}`
+    ];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
-      parts.push(import_drizzle_orm2.sql.raw(` ORDER BY ${options.orderBy} ${dir}`));
+      parts.push(import_drizzle_orm2.sql.raw(` ORDER BY ${(0, import_core4.quoteIdent)(options.orderBy)} ${dir}`));
     }
     if (options?.limit !== void 0) {
       parts.push(import_drizzle_orm2.sql` LIMIT ${options.limit}`);
@@ -1742,7 +2026,7 @@ var SqliteServerStore = class {
       conditions.push(import_drizzle_orm2.sql.raw("_deleted = 0"));
     }
     for (const [key, value] of Object.entries(where)) {
-      conditions.push(import_drizzle_orm2.sql`${import_drizzle_orm2.sql.raw(key)} = ${value}`);
+      conditions.push(import_drizzle_orm2.sql`${import_drizzle_orm2.sql.raw((0, import_core4.quoteIdent)(key))} = ${value}`);
     }
     if (conditions.length === 0) {
       return import_drizzle_orm2.sql.raw("1 = 1");
@@ -1813,6 +2097,7 @@ var SqliteServerStore = class {
 				record_id TEXT NOT NULL,
 				data TEXT,
 				previous_data TEXT,
+				atomic_ops TEXT,
 				wall_time INTEGER NOT NULL,
 				logical INTEGER NOT NULL,
 				timestamp_node_id TEXT NOT NULL,
@@ -1822,9 +2107,35 @@ var SqliteServerStore = class {
 				received_at INTEGER NOT NULL
 			)
 		`);
+    try {
+      this.db.run(import_drizzle_orm2.sql`ALTER TABLE operations ADD COLUMN atomic_ops TEXT`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : "";
+      const causeMsg = e instanceof Error && e.cause instanceof Error ? e.cause.message : "";
+      if (!msg.includes("duplicate column") && !causeMsg.includes("duplicate column")) {
+        throw e;
+      }
+    }
+    try {
+      this.db.run(import_drizzle_orm2.sql`ALTER TABLE operations ADD COLUMN delivery_seq INTEGER`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : "";
+      const causeMsg = e instanceof Error && e.cause instanceof Error ? e.cause.message : "";
+      if (!msg.includes("duplicate column") && !causeMsg.includes("duplicate column")) {
+        throw e;
+      }
+    }
     this.db.run(import_drizzle_orm2.sql`
 			CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)
 		`);
+    this.db.run(import_drizzle_orm2.sql`
+			CREATE INDEX IF NOT EXISTS idx_delivery_seq ON operations (delivery_seq)
+		`);
+    this.db.run(import_drizzle_orm2.sql`
+			CREATE UNIQUE INDEX IF NOT EXISTS idx_delivery_seq_unique
+			ON operations (delivery_seq)
+			WHERE delivery_seq IS NOT NULL
+		`);
     this.db.run(import_drizzle_orm2.sql`
 			CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)
 		`);
@@ -1841,11 +2152,60 @@ var SqliteServerStore = class {
 				last_seen_at INTEGER NOT NULL
 			)
 		`);
+    this.db.run(import_drizzle_orm2.sql`
+			CREATE TABLE IF NOT EXISTS delivery_counter (
+				id INTEGER PRIMARY KEY,
+				value INTEGER NOT NULL
+			)
+		`);
+    this.backfillDeliverySequence();
+  }
+  /**
+   * Assign delivery sequences to any operations written before the column existed,
+   * then seed the durable counter from the current max. Ordered by
+   * (received_at, sequence_number, id) so the backfill is deterministic and stable
+   * across restarts. A one-time migration: after it runs, all rows have a value.
+   */
+  backfillDeliverySequence() {
+    this.db.transaction((tx) => {
+      const maxRow = tx.all(
+        import_drizzle_orm2.sql`SELECT MAX(delivery_seq) AS m FROM operations`
+      );
+      let next = maxRow[0]?.m ?? 0;
+      const nullRows = tx.all(
+        import_drizzle_orm2.sql`SELECT id FROM operations WHERE delivery_seq IS NULL ORDER BY received_at ASC, sequence_number ASC, id ASC`
+      );
+      for (const row of nullRows) {
+        next += 1;
+        tx.run(import_drizzle_orm2.sql`UPDATE operations SET delivery_seq = ${next} WHERE id = ${row.id}`);
+      }
+      tx.insert(deliveryCounter).values({ id: 1, value: next }).onConflictDoUpdate({
+        target: deliveryCounter.id,
+        set: {
+          value: import_drizzle_orm2.sql`MAX(${deliveryCounter.value}, ${next})`
+        }
+      }).run();
+    });
+  }
+  /**
+   * Reserve the next delivery sequence inside the append transaction. SQLite locks
+   * the database for the write transaction, and this counter row keeps sequence
+   * allocation shared by every SqliteServerStore instance using the same file.
+   */
+  nextDeliverySeq(tx) {
+    const rows = tx.update(deliveryCounter).set({ value: import_drizzle_orm2.sql`${deliveryCounter.value} + 1` }).where((0, import_drizzle_orm2.eq)(deliveryCounter.id, 1)).returning({ value: deliveryCounter.value }).all();
+    const value = rows[0]?.value;
+    if (value === void 0 || value === null) {
+      throw new Error(
+        "delivery_counter row (id=1) is missing; the operations log cannot assign delivery sequences"
+      );
+    }
+    return value;
   }
   // ---------------------------------------------------------------------------
   // Operation serialization
   // ---------------------------------------------------------------------------
-  serializeOperation(op, receivedAt) {
+  serializeOperation(op, receivedAt, deliverySeq) {
     return {
       id: op.id,
       nodeId: op.nodeId,
@@ -1854,16 +2214,19 @@ var SqliteServerStore = class {
       recordId: op.recordId,
       data: op.data !== null ? JSON.stringify(op.data) : null,
       previousData: op.previousData !== null ? JSON.stringify(op.previousData) : null,
+      atomicOps: op.atomicOps && Object.keys(op.atomicOps).length > 0 ? JSON.stringify(op.atomicOps) : null,
       wallTime: op.timestamp.wallTime,
       logical: op.timestamp.logical,
       timestampNodeId: op.timestamp.nodeId,
       sequenceNumber: op.sequenceNumber,
       causalDeps: JSON.stringify(op.causalDeps),
       schemaVersion: op.schemaVersion,
-      receivedAt
+      receivedAt,
+      deliverySeq
     };
   }
   deserializeOperation(row) {
+    const atomicOps = row.atomicOps != null ? JSON.parse(row.atomicOps) : void 0;
     return {
       id: row.id,
       nodeId: row.nodeId,
@@ -1879,7 +2242,8 @@ var SqliteServerStore = class {
       },
       sequenceNumber: row.sequenceNumber,
       causalDeps: JSON.parse(row.causalDeps),
-      schemaVersion: row.schemaVersion
+      schemaVersion: row.schemaVersion,
+      ...atomicOps ? { atomicOps } : {}
     };
   }
   // ---------------------------------------------------------------------------
@@ -2065,6 +2429,7 @@ var WsServerTransport = class {
 // src/session/client-session.ts
 init_cjs_shims();
 var import_core10 = require("@korajs/core");
+var import_core11 = require("@korajs/core");
 var import_internal = require("@korajs/core/internal");
 var import_sync2 = require("@korajs/sync");
 var import_sync3 = require("@korajs/sync");
@@ -2178,6 +2543,9 @@ async function createServerSideEffectOperation(store, parentOp, effect, schemaVe
   );
 }
 function nextServerSequenceNumber(store) {
+  if (store.reserveSequenceNumber) {
+    return store.reserveSequenceNumber();
+  }
   const nodeId = store.getNodeId();
   const current = store.getVersionVector().get(nodeId) ?? 0;
   return current + 1;
@@ -2187,14 +2555,28 @@ function nextServerSequenceNumber(store) {
 async function applyServerOperation(store, op, relationLookup) {
   const schema = store.getSchema();
   const lookup = relationLookup ?? (schema ? (0, import_merge2.buildMergeRelationLookup)(schema) : /* @__PURE__ */ new Map());
+  const shapeCheck = validateOperationShape(op, schema);
+  if (!shapeCheck.valid) {
+    return {
+      result: "skipped",
+      appliedOperations: [],
+      rejection: {
+        code: shapeCheck.code ?? "SCHEMA_VALIDATION_ERROR",
+        message: shapeCheck.message ?? `Operation "${op.id}" does not match the server schema`,
+        retriable: false
+      }
+    };
+  }
   const constraintCheck = await validateIncomingOperationConstraints(store, op, schema);
   if (!constraintCheck.valid) {
+    const code = constraintCheck.code ?? "CONSTRAINT_VIOLATION";
     return {
       result: "skipped",
       appliedOperations: [],
       rejection: {
-        code: constraintCheck.code ?? "CONSTRAINT_VIOLATION",
-        message: constraintCheck.message ?? `Operation "${op.id}" violates a schema constraint`
+        code,
+        message: constraintCheck.message ?? `Operation "${op.id}" violates a schema constraint`,
+        retriable: isRetriableRejection(code)
       }
     };
   }
@@ -2207,7 +2589,8 @@ async function applyServerOperation(store, op, relationLookup) {
         appliedOperations: [],
         rejection: {
           code: "REFERENTIAL_INTEGRITY",
-          message: `Operation "${op.id}" violates referential integrity on "${op.collection}"`
+          message: `Operation "${op.id}" violates referential integrity on "${op.collection}"`,
+          retriable: isRetriableRejection("REFERENTIAL_INTEGRITY")
         }
       };
     }
@@ -2216,16 +2599,14 @@ async function applyServerOperation(store, op, relationLookup) {
       return { result: primaryResult, appliedOperations: [] };
     }
     const appliedOperations = [op];
-    let serverSeq = nextServerSequenceNumber(store);
     for (const effect of referential.sideEffectOps) {
       const sideOp = await createServerSideEffectOperation(
         store,
         op,
         effect,
         op.schemaVersion,
-        serverSeq
+        nextServerSequenceNumber(store)
       );
-      serverSeq += 1;
       const sideResult = await store.applyRemoteOperation(sideOp);
       if (sideResult === "applied") {
         appliedOperations.push(sideOp);
@@ -2239,6 +2620,67 @@ async function applyServerOperation(store, op, relationLookup) {
     appliedOperations: result === "applied" ? [op] : []
   };
 }
+function validateOperationShape(op, schema) {
+  if (!schema) {
+    return { valid: true };
+  }
+  const collection = schema.collections[op.collection];
+  if (!collection) {
+    return {
+      valid: false,
+      code: "UNKNOWN_COLLECTION",
+      message: `Operation "${op.id}" targets unknown collection "${op.collection}".`
+    };
+  }
+  const declaredFields = new Set(Object.keys(collection.fields));
+  const systemPreviousFields = /* @__PURE__ */ new Set(["id", "_created_at", "_updated_at", "_deleted"]);
+  const invalidDataField = firstInvalidField(op.data, declaredFields);
+  if (invalidDataField) {
+    return {
+      valid: false,
+      code: "SCHEMA_VALIDATION_ERROR",
+      message: `Operation "${op.id}" contains undeclared field "${invalidDataField}" in data for collection "${op.collection}".`
+    };
+  }
+  const invalidPreviousField = firstInvalidField(
+    op.previousData,
+    declaredFields,
+    systemPreviousFields
+  );
+  if (invalidPreviousField) {
+    return {
+      valid: false,
+      code: "SCHEMA_VALIDATION_ERROR",
+      message: `Operation "${op.id}" contains undeclared field "${invalidPreviousField}" in previousData for collection "${op.collection}".`
+    };
+  }
+  if (op.atomicOps) {
+    for (const field of Object.keys(op.atomicOps)) {
+      if (!declaredFields.has(field)) {
+        return {
+          valid: false,
+          code: "SCHEMA_VALIDATION_ERROR",
+          message: `Operation "${op.id}" contains undeclared atomic field "${field}" for collection "${op.collection}".`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+function firstInvalidField(value, declaredFields, extraAllowedFields) {
+  if (value === null || value === void 0) {
+    return null;
+  }
+  if (typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  for (const field of Object.keys(value)) {
+    if (!declaredFields.has(field) && !extraAllowedFields?.has(field)) {
+      return field;
+    }
+  }
+  return null;
+}
 
 // src/auth/no-auth.ts
 init_cjs_shims();
@@ -2286,24 +2728,74 @@ function mergeScopeMaps(base, overlay, source) {
 
 // src/scopes/server-scope-filter.ts
 init_cjs_shims();
-function operationMatchesScopes(op, scopes) {
+var DEFAULT_MAX_SCOPE_PREDICATE_VALUES = 100;
+function normalizeScopeMap(scopes, maxValues = DEFAULT_MAX_SCOPE_PREDICATE_VALUES) {
+  const normalized = {};
+  for (const collection of Object.keys(scopes).sort()) {
+    const predicate = {};
+    for (const field of Object.keys(scopes[collection] ?? {}).sort()) {
+      const expected = scopes[collection]?.[field];
+      if (expected && typeof expected === "object" && !Array.isArray(expected) && "$in" in expected) {
+        const values = expected.$in;
+        if (!Array.isArray(values))
+          throw new Error(`Invalid $in predicate for ${collection}.${field}`);
+        const unique = [...new Map(values.map((value) => [stableValueKey(value), value])).values()];
+        if (unique.length > maxValues)
+          throw new Error(
+            `Scope predicate for ${collection}.${field} exceeds the ${maxValues}-value limit`
+          );
+        predicate[field] = {
+          $in: unique.sort((a, b) => stableValueKey(a).localeCompare(stableValueKey(b)))
+        };
+      } else predicate[field] = expected;
+    }
+    normalized[collection] = predicate;
+  }
+  return normalized;
+}
+function stableValueKey(value) {
+  if (Array.isArray(value)) return `[${value.map(stableValueKey).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value).sort().map(
+      (key) => `${JSON.stringify(key)}:${stableValueKey(value[key])}`
+    ).join(",")}}`;
+  return JSON.stringify(value);
+}
+function operationMatchesScopes(op, scopes, fullRecord) {
   if (!scopes) return true;
   const collectionScope = scopes[op.collection];
   if (!collectionScope) return false;
-  const snapshot = buildSnapshot(op);
+  if (Object.keys(collectionScope).length === 0) return true;
+  const snapshot = buildSnapshot(op, fullRecord);
   if (!snapshot) return false;
   for (const [field, expected] of Object.entries(collectionScope)) {
-    if (snapshot[field] !== expected) {
+    if (!matchesPredicate(snapshot[field], expected)) {
       return false;
     }
   }
   return true;
 }
-function buildSnapshot(op) {
+function matchesPredicate(actual, expected) {
+  if (expected && typeof expected === "object" && !Array.isArray(expected) && "$in" in expected) {
+    const values = expected.$in;
+    return Array.isArray(values) && values.some((value) => Object.is(actual, value));
+  }
+  return Object.is(actual, expected);
+}
+function missingScopeFields(op, scopes) {
+  if (!scopes) return [];
+  const collectionScope = scopes[op.collection];
+  if (!collectionScope) return [];
+  if (Object.keys(collectionScope).length === 0) return [];
+  const snapshot = buildSnapshot(op);
+  return Object.keys(collectionScope).filter((field) => !snapshot || !(field in snapshot));
+}
+function buildSnapshot(op, fullRecord) {
   const previous = asRecord(op.previousData);
   const next = asRecord(op.data);
-  if (!previous && !next) return null;
+  if (!previous && !next && !fullRecord) return null;
   return {
+    ...fullRecord ?? {},
     ...previous ?? {},
     ...next ?? {}
   };
@@ -2396,21 +2888,74 @@ function warnIfMultiTenantWithoutScopes(auth, resolvedScopes, schema) {
     "[kora] An authenticated session resolved to no sync scopes, so every user will sync every other user's data. Return per-user sync scopes from your auth provider (for example KoraAuthProvider's resolveScopes) to isolate tenants. Note: declaring sync rules in your schema is not enough on its own \u2014 the per-user values come from the auth provider. (This warning is expected for single-tenant apps where all authenticated users are meant to share the same data.)"
   );
 }
-var ClientSession = class {
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    const entries = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function sameScopeMap(a, b) {
+  const normalize = (value) => value && typeof value === "object" ? normalizeScopeMap(value) : value;
+  return stableStringify(normalize(a) ?? null) === stableStringify(normalize(b) ?? null);
+}
+var ClientSession = class _ClientSession {
   state = "connected";
   clientNodeId = null;
   authContext = null;
   syncQuerySubsets = [];
   resumeDeltaCursor = null;
+  /**
+   * The delivery watermark the client reported at handshake, or null when the client
+   * does not use the delivery watermark (old client, or no watermark yet). When set,
+   * the server drives the gap-free server->client stream from delivery sequences
+   * instead of the version-vector delta.
+   */
+  clientDeliveryWatermark = null;
+  /**
+   * The highest delivery sequence this client has ACKNOWLEDGED (its confirmed
+   * watermark, as reported in acks). Incremental streaming pushes resume from here, not
+   * from the highest sequence sent, so a dropped or unapplied batch is always
+   * re-included by the next push (which re-scans from the acknowledged position). This
+   * is what makes streaming recovery independent of any bounded retransmit buffer: there
+   * is no sent-but-unacked window that a buffer eviction could strand. Seeded from the
+   * client's reported watermark at handshake.
+   */
+  lastAckedDeliverySeq = 0;
+  /**
+   * Timestamp of the last delivery-stream send attempt. Periodic retransmission uses
+   * this as its stale window so a slow client does not receive duplicate full-stream
+   * batches every server tick while the first batch is still being applied.
+   */
+  lastDeliveryPushAttemptAtMs = 0;
+  deliveryStallRepeatCount = 0;
+  /** Serializes incremental delivery pushes so their batches never interleave. */
+  deliveryPushChain = Promise.resolve();
+  /**
+   * Relay batches sent to this client but not yet acknowledged, keyed by messageId.
+   * The client acks every operation-batch it applies; on ack the entry is cleared.
+   * {@link retransmitPendingRelays} re-sends anything still unacked, so a relay
+   * dropped by a lossy transport is redelivered instead of leaving the client with a
+   * permanent version-vector gap (a lost operation) that delta sync cannot recover.
+   * Bounded so a silent client cannot grow it without limit.
+   */
+  pendingRelays = /* @__PURE__ */ new Map();
+  static MAX_PENDING_RELAYS = 1e3;
   sessionId;
   transport;
   store;
   auth;
   serializer;
   emitter;
+  logger;
   batchSize;
   schemaVersion;
   supportedSchemaVersions;
+  operationTransforms;
   onRelay;
   onAwarenessUpdate;
   onYjsDocUpdate;
@@ -2418,9 +2963,13 @@ var ClientSession = class {
   onBlobChunkResponse;
   persistBlobChunk;
   onClose;
+  onOrphanedRelays;
+  takeOrphanedRelays;
   maxOperationBytes;
   maxOpsPerMinute;
   rateLimiter;
+  validateOperation;
+  koraContext;
   constructor(options) {
     this.sessionId = options.sessionId;
     this.transport = options.transport;
@@ -2428,6 +2977,7 @@ var ClientSession = class {
     this.auth = options.auth ?? null;
     this.serializer = options.serializer ?? new import_sync3.NegotiatedMessageSerializer("json");
     this.emitter = options.emitter ?? null;
+    this.logger = options.logger ?? null;
     this.batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
     this.schemaVersion = options.schemaVersion ?? DEFAULT_SCHEMA_VERSION;
     const supported = options.supportedSchemaVersions;
@@ -2435,6 +2985,7 @@ var ClientSession = class {
       min: this.schemaVersion,
       max: this.schemaVersion
     };
+    this.operationTransforms = options.operationTransforms ?? [];
     this.onRelay = options.onRelay ?? null;
     this.onAwarenessUpdate = options.onAwarenessUpdate ?? null;
     this.onYjsDocUpdate = options.onYjsDocUpdate ?? null;
@@ -2442,9 +2993,13 @@ var ClientSession = class {
     this.onBlobChunkResponse = options.onBlobChunkResponse ?? null;
     this.persistBlobChunk = options.persistBlobChunk ?? null;
     this.onClose = options.onClose ?? null;
+    this.onOrphanedRelays = options.onOrphanedRelays ?? null;
+    this.takeOrphanedRelays = options.takeOrphanedRelays ?? null;
     this.maxOperationBytes = options.maxOperationBytes ?? DEFAULT_MAX_OPERATION_BYTES;
     this.maxOpsPerMinute = options.maxOpsPerMinute ?? DEFAULT_MAX_OPS_PER_MINUTE;
     this.rateLimiter = new SessionRateLimiter(this.maxOpsPerMinute);
+    this.validateOperation = options.validateOperation ?? null;
+    this.koraContext = options.koraContext ?? null;
   }
   /**
    * Start handling messages from the client transport.
@@ -2464,25 +3019,129 @@ var ClientSession = class {
    */
   relayOperations(operations2) {
     if (this.state !== "streaming" || !this.transport.isConnected()) return;
+    if (this.clientDeliveryWatermark !== null) {
+      this.pushDeliveryStream();
+      return;
+    }
     if (operations2.length === 0) return;
-    const visibleOperations = operations2.filter((op) => this.operationVisibleToClient(op));
+    void this.relayVisibleOperations(operations2);
+  }
+  /**
+   * Push newly-available in-scope operations to a delivery-watermark client, resuming
+   * from the highest delivery sequence already sent. Pushes are serialized so their
+   * batches never interleave (which would break the base/max chain).
+   */
+  pushDeliveryStream() {
+    this.deliveryPushChain = this.deliveryPushChain.then(async () => {
+      if (this.state !== "streaming" || !this.transport.isConnected()) return;
+      try {
+        this.lastDeliveryPushAttemptAtMs = Date.now();
+        await this.sendDeliveryStream(
+          this.lastAckedDeliverySeq,
+          false,
+          this.clientNodeId ?? void 0
+        );
+      } catch {
+      }
+    });
+  }
+  async relayVisibleOperations(operations2) {
+    const visibleOperations = [];
+    for (const op of operations2) {
+      if (await this.operationVisibleToClient(op)) {
+        visibleOperations.push(op);
+      }
+    }
     if (visibleOperations.length === 0) return;
+    if (this.state !== "streaming" || !this.transport.isConnected()) return;
     const serializedOps = visibleOperations.map((op) => this.serializer.encodeOperation(op));
     const msg = {
       type: "operation-batch",
-      messageId: (0, import_core10.generateUUIDv7)(),
+      messageId: (0, import_core11.generateUUIDv7)(),
       operations: serializedOps,
       isFinal: true,
       batchIndex: 0
     };
+    this.trackPendingRelay(msg, visibleOperations);
     this.sendToClient(msg);
   }
+  /** Record a relay batch as awaiting acknowledgment, evicting the oldest if full. */
+  trackPendingRelay(msg, ops) {
+    if (this.pendingRelays.size >= _ClientSession.MAX_PENDING_RELAYS) {
+      const oldest = this.pendingRelays.keys().next().value;
+      if (oldest !== void 0) {
+        this.pendingRelays.delete(oldest);
+      }
+    }
+    this.pendingRelays.set(msg.messageId, { message: msg, ops, sentAtMs: Date.now() });
+  }
+  /**
+   * Retransmit relay batches this client has not acknowledged within `staleMs`.
+   * Called on a periodic tick by the server (and directly by tests). Redelivering an
+   * already-applied op is harmless: the client dedups by content-addressed id.
+   */
+  retransmitPendingRelays(staleMs = 0) {
+    if (this.state !== "streaming" || !this.transport.isConnected()) return;
+    if (this.clientDeliveryWatermark !== null) {
+      return;
+    }
+    if (this.pendingRelays.size === 0) return;
+    const cutoff = Date.now() - staleMs;
+    for (const { message, sentAtMs } of this.pendingRelays.values()) {
+      if (sentAtMs <= cutoff) {
+        this.sendToClient(message);
+      }
+    }
+  }
+  /**
+   * Wake the durable delivery stream for clients that negotiated delivery
+   * watermarks. This is used both for dropped watermark batches and for operations
+   * appended by another server/store instance: the session always scans from its
+   * own acknowledged cursor and applies its visibility filter before sending.
+   */
+  pushDeliveryStreamIfSupported(staleMs = 0, options = {}) {
+    if (this.state !== "streaming" || !this.transport.isConnected()) return;
+    if (this.clientDeliveryWatermark === null) return;
+    if (staleMs > 0 && Date.now() - this.lastDeliveryPushAttemptAtMs < staleMs) {
+      return;
+    }
+    if (options.trackStall) {
+      this.deliveryStallRepeatCount += 1;
+      if (this.deliveryStallRepeatCount >= 3) {
+        this.emitter?.emit({
+          type: "sync:delivery-stalled",
+          sessionId: this.sessionId,
+          watermark: this.lastAckedDeliverySeq,
+          repeatCount: this.deliveryStallRepeatCount
+        });
+      }
+    }
+    this.pushDeliveryStream();
+  }
   /**
    * Close this session.
    */
+  /**
+   * Hand any unacknowledged relays to the server so they survive this session and are
+   * redelivered when this client reconnects (per-node buffer), then clear them. Called
+   * from every session-teardown path (explicit close and transport close).
+   */
+  flushOrphanedRelays() {
+    if (this.onOrphanedRelays && this.clientNodeId && this.pendingRelays.size > 0) {
+      const ops = [];
+      for (const entry of this.pendingRelays.values()) {
+        ops.push(...entry.ops);
+      }
+      if (ops.length > 0) {
+        this.onOrphanedRelays(this.clientNodeId, ops);
+      }
+    }
+    this.pendingRelays.clear();
+  }
   close(reason) {
     if (this.state === "closed") return;
     this.state = "closed";
+    this.flushOrphanedRelays();
     if (this.transport.isConnected()) {
       this.transport.close(1e3, reason ?? "session closed");
     }
@@ -2537,6 +3196,11 @@ var ClientSession = class {
         await this.handleOperationBatch(message);
         break;
       case "acknowledgment":
+        this.pendingRelays.delete(message.acknowledgedMessageId);
+        if (message.deliverySequence !== void 0) {
+          this.lastAckedDeliverySeq = Math.max(this.lastAckedDeliverySeq, message.deliverySequence);
+          this.deliveryStallRepeatCount = 0;
+        }
         break;
       case "error":
         break;
@@ -2567,7 +3231,7 @@ var ClientSession = class {
       return;
     }
     const bytes = (0, import_sync2.decodeBlobChunkBytes)(message.bytes);
-    const actual = await (0, import_core10.hashBlob)(bytes);
+    const actual = await (0, import_core11.hashBlob)(bytes);
     if (actual !== message.hash) {
       return;
     }
@@ -2575,6 +3239,18 @@ var ClientSession = class {
   }
   handleMessageFailure(error) {
     const reason = error instanceof Error ? error.message : "Message handling failed";
+    this.logger?.log({
+      timestamp: Date.now(),
+      level: "error",
+      event: "session.message_failed",
+      sessionId: this.sessionId,
+      nodeId: this.clientNodeId ?? void 0,
+      error: reason,
+      details: {
+        state: this.state,
+        errorName: error instanceof Error ? error.name : typeof error
+      }
+    });
     this.sendError("SYNC_ERROR", reason, true);
     this.close(reason);
   }
@@ -2595,11 +3271,25 @@ var ClientSession = class {
       this.authContext = context;
       this.state = "authenticated";
     }
-    const resolvedScopes = resolveSessionScopes(this.store.getSchema(), {
+    const rawResolvedScopes = resolveSessionScopes(this.store.getSchema(), {
       handshakeScope: msg.syncScope,
       authScopes: this.authContext?.scopes
     });
-    if (resolvedScopes) {
+    let resolvedScopes;
+    try {
+      resolvedScopes = rawResolvedScopes ? normalizeScopeMap(rawResolvedScopes) : void 0;
+    } catch (error) {
+      this.sendToClient({
+        type: "error",
+        messageId: (0, import_core11.generateUUIDv7)(),
+        code: "SCOPE_PREDICATE_LIMIT",
+        message: error instanceof Error ? error.message : "Invalid scope predicate",
+        retriable: false
+      });
+      this.close("invalid scope predicate");
+      return;
+    }
+    if (resolvedScopes) {
       if (this.authContext) {
         this.authContext = { ...this.authContext, scopes: resolvedScopes };
       } else {
@@ -2613,14 +3303,34 @@ var ClientSession = class {
       this.syncQuerySubsets = [];
     }
     this.resumeDeltaCursor = msg.deltaCursor ? (0, import_sync3.decodeDeltaCursor)(msg.deltaCursor) : null;
+    this.clientDeliveryWatermark = msg.lastDeliverySequence ?? null;
+    if (this.clientDeliveryWatermark !== null && !sameScopeMap(msg.syncScope, this.authContext?.scopes)) {
+      this.clientDeliveryWatermark = 0;
+    }
+    const clientUsesWatermark = this.clientDeliveryWatermark !== null;
+    let serverMaxDelivery = 0;
+    if (clientUsesWatermark) {
+      serverMaxDelivery = await this.store.getMaxDeliverySequence();
+      if (this.clientDeliveryWatermark !== null && this.clientDeliveryWatermark > serverMaxDelivery) {
+        this.clientDeliveryWatermark = 0;
+      }
+    }
     const serverVector = this.store.getVersionVector();
     const selectedWireFormat = selectWireFormat(msg.supportedWireFormats);
     this.setSerializerWireFormat(selectedWireFormat);
     if (!(0, import_sync3.isClientSchemaVersionSupported)(msg.schemaVersion, this.supportedSchemaVersions)) {
       const { min, max } = this.supportedSchemaVersions;
+      this.emitter?.emit({
+        type: "sync:schema-mismatch",
+        clientSchemaVersion: msg.schemaVersion,
+        serverSchemaVersion: this.schemaVersion,
+        supportedMin: min,
+        supportedMax: max,
+        reason: `${import_sync3.SCHEMA_MISMATCH_PREFIX}: client schema version ${msg.schemaVersion} not in supported range [${min}, ${max}]`
+      });
       const response2 = {
         type: "handshake-response",
-        messageId: (0, import_core10.generateUUIDv7)(),
+        messageId: (0, import_core11.generateUUIDv7)(),
         nodeId: this.store.getNodeId(),
         versionVector: (0, import_sync3.versionVectorToWire)(serverVector),
         schemaVersion: this.schemaVersion,
@@ -2636,13 +3346,17 @@ var ClientSession = class {
     }
     const response = {
       type: "handshake-response",
-      messageId: (0, import_core10.generateUUIDv7)(),
+      messageId: (0, import_core11.generateUUIDv7)(),
       nodeId: this.store.getNodeId(),
       versionVector: (0, import_sync3.versionVectorToWire)(serverVector),
       schemaVersion: this.schemaVersion,
       accepted: true,
       selectedWireFormat,
       serverTime: Date.now(),
+      // The server's highest delivery sequence, so a client whose persisted watermark
+      // is ahead of it (server rolled back) can reset to a full resync. Sent only to
+      // watermark-using clients.
+      ...clientUsesWatermark ? { serverMaxDeliverySequence: serverMaxDelivery } : {},
       // Advertise central blob storage so the client uploads the bytes behind
       // its blob fields, keeping them available after the author goes offline.
       ...this.persistBlobChunk ? { blobStorageEnabled: true } : {},
@@ -2653,17 +3367,40 @@ var ClientSession = class {
     this.sendToClient(response);
     this.emitter?.emit({ type: "sync:connected", nodeId: msg.nodeId });
     this.state = "syncing";
-    const clientVector = (0, import_sync3.wireToVersionVector)(msg.versionVector);
-    await this.sendDelta(clientVector);
+    if (this.clientDeliveryWatermark !== null) {
+      this.lastAckedDeliverySeq = this.clientDeliveryWatermark;
+      const excludeOwn = this.clientDeliveryWatermark > 0 ? this.clientNodeId ?? void 0 : void 0;
+      this.lastDeliveryPushAttemptAtMs = Date.now();
+      await this.sendDeliveryStream(this.clientDeliveryWatermark, true, excludeOwn);
+    } else {
+      const clientVector = (0, import_sync3.wireToVersionVector)(msg.versionVector);
+      await this.sendDelta(clientVector);
+    }
     this.state = "streaming";
+    if (this.takeOrphanedRelays && this.clientNodeId) {
+      const buffered = this.takeOrphanedRelays(this.clientNodeId);
+      if (buffered.length > 0) {
+        this.relayOperations(buffered);
+      }
+    }
   }
   async handleOperationBatch(msg) {
     const operations2 = msg.operations.map((s) => this.serializer.decodeOperation(s));
     const applied = [];
-    const rejected = [];
+    let acknowledgedThrough = 0;
+    let canAdvanceAck = true;
     for (const op of operations2) {
-      if (!this.operationVisibleToClient(op)) {
-        rejected.push(op);
+      if (!canAdvanceAck) {
+        continue;
+      }
+      if (!await this.operationVisibleToClient(op)) {
+        this.sendOperationRejected(
+          op,
+          "SCOPE_VIOLATION",
+          `Operation "${op.id}" in collection "${op.collection}" is outside the client's sync scope. Refresh sync scopes and retry.`,
+          true
+        );
+        canAdvanceAck = false;
         continue;
       }
       if (!isOperationTimestampValid(op)) {
@@ -2672,6 +3409,7 @@ var ClientSession = class {
           `Operation "${op.id}" timestamp is too far in the future`,
           false
         );
+        canAdvanceAck = false;
         continue;
       }
       if (!this.rateLimiter.allow(1)) {
@@ -2680,6 +3418,7 @@ var ClientSession = class {
           `Session exceeded operation rate limit (${String(this.maxOpsPerMinute)} ops/min)`,
           true
         );
+        canAdvanceAck = false;
         continue;
       }
       const sizeCheck = validateOperationSize(op, this.maxOperationBytes);
@@ -2689,27 +3428,73 @@ var ClientSession = class {
           sizeCheck.message ?? `Operation "${op.id}" is too large`,
           false
         );
+        canAdvanceAck = false;
         continue;
       }
-      try {
-        const applyResult = await applyServerOperation(this.store, op);
-        if (applyResult.rejection) {
-          this.sendError(applyResult.rejection.code, applyResult.rejection.message, false);
+      const serverOp = this.transformForServerSchema(op);
+      if (serverOp === null) {
+        this.sendOperationRejected(
+          op,
+          "SCHEMA_TRANSFORM_UNAVAILABLE",
+          `Operation "${op.id}" cannot be transformed from schema v${op.schemaVersion} to server schema v${this.schemaVersion}.`,
+          false
+        );
+        acknowledgedThrough = op.sequenceNumber;
+        continue;
+      }
+      if (this.validateOperation && this.koraContext) {
+        let decision;
+        try {
+          decision = await this.validateOperation(serverOp, {
+            auth: this.authContext,
+            kora: this.koraContext
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "validator error";
+          this.sendOperationRejected(
+            serverOp,
+            "VALIDATION_ERROR",
+            `Validator threw: ${message}`,
+            true
+          );
+          canAdvanceAck = false;
+          continue;
+        }
+        if (decision.action === "reject") {
+          const retriable = decision.retriable ?? isRetriableRejection(decision.code);
+          this.sendOperationRejected(serverOp, decision.code, decision.message, retriable);
+          if (retriable) {
+            canAdvanceAck = false;
+          } else {
+            acknowledgedThrough = op.sequenceNumber;
+          }
           continue;
         }
-        if (applyResult.result === "applied") {
-          applied.push(...applyResult.appliedOperations);
+        if (decision.action === "ignore") {
+          acknowledgedThrough = op.sequenceNumber;
+          continue;
         }
-      } catch {
       }
-    }
-    if (rejected.length > 0) {
-      for (const op of rejected) {
-        this.sendError(
-          "SCOPE_VIOLATION",
-          `Operation "${op.id}" in collection "${op.collection}" is outside the client's sync scope`,
-          false
+      const applyResult = await applyServerOperation(this.store, serverOp);
+      if (applyResult.rejection) {
+        this.sendOperationRejected(
+          serverOp,
+          applyResult.rejection.code,
+          applyResult.rejection.message,
+          applyResult.rejection.retriable
         );
+        if (applyResult.rejection.retriable) {
+          canAdvanceAck = false;
+        } else {
+          acknowledgedThrough = op.sequenceNumber;
+        }
+        continue;
+      }
+      if (applyResult.result === "applied") {
+        applied.push(...applyResult.appliedOperations);
+        acknowledgedThrough = op.sequenceNumber;
+      } else {
+        acknowledgedThrough = op.sequenceNumber;
       }
     }
     if (operations2.length > 0) {
@@ -2722,15 +3507,21 @@ var ClientSession = class {
     const lastOp = operations2[operations2.length - 1];
     const ack = {
       type: "acknowledgment",
-      messageId: (0, import_core10.generateUUIDv7)(),
+      messageId: (0, import_core11.generateUUIDv7)(),
       acknowledgedMessageId: msg.messageId,
-      lastSequenceNumber: lastOp ? lastOp.sequenceNumber : 0
+      lastSequenceNumber: lastOp ? Math.min(acknowledgedThrough, lastOp.sequenceNumber) : 0
     };
     this.sendToClient(ack);
     if (applied.length > 0) {
       this.onRelay?.(this.sessionId, applied);
     }
   }
+  transformForServerSchema(op) {
+    if (op.schemaVersion === this.schemaVersion) {
+      return op;
+    }
+    return (0, import_core10.applyOperationTransforms)(op, this.schemaVersion, this.operationTransforms);
+  }
   async sendDelta(clientVector) {
     const serverVector = this.store.getVersionVector();
     const missing = [];
@@ -2738,14 +3529,17 @@ var ClientSession = class {
       const clientSeq = clientVector.get(nodeId) ?? 0;
       if (serverSeq > clientSeq) {
         const ops = await this.store.getOperationRange(nodeId, clientSeq + 1, serverSeq);
-        const visible = ops.filter((op) => this.operationVisibleToClient(op));
-        missing.push(...visible);
+        for (const op of ops) {
+          if (await this.operationVisibleToClient(op)) {
+            missing.push(op);
+          }
+        }
       }
     }
     if (missing.length === 0) {
       const emptyBatch = {
         type: "operation-batch",
-        messageId: (0, import_core10.generateUUIDv7)(),
+        messageId: (0, import_core11.generateUUIDv7)(),
         operations: [],
         isFinal: true,
         batchIndex: 0,
@@ -2760,7 +3554,7 @@ var ClientSession = class {
     if (afterCursor.length === 0) {
       const emptyBatch = {
         type: "operation-batch",
-        messageId: (0, import_core10.generateUUIDv7)(),
+        messageId: (0, import_core11.generateUUIDv7)(),
         operations: [],
         isFinal: true,
         batchIndex: this.resumeDeltaCursor?.batchIndex ?? 0,
@@ -2776,7 +3570,7 @@ var ClientSession = class {
       const batchCursor = (0, import_sync3.createDeltaCursorFromBatch)(batchOps, i);
       const batchMsg = {
         type: "operation-batch",
-        messageId: (0, import_core10.generateUUIDv7)(),
+        messageId: (0, import_core11.generateUUIDv7)(),
         operations: serializedOps,
         isFinal: i === totalBatches - 1,
         batchIndex: i,
@@ -2791,11 +3585,111 @@ var ClientSession = class {
       });
     }
   }
-  operationVisibleToClient(op) {
-    if (!operationMatchesScopes(op, this.authContext?.scopes)) {
+  /**
+   * Send the gap-free server->client delivery stream, resuming just after
+   * `fromDeliverySeq`. Operations are scanned in server delivery-sequence order
+   * (commit order), scope-filtered for this session, and sent in batches that chain:
+   * each batch's `baseDeliverySequence` equals the previous batch's
+   * `maxDeliverySequence` (the first batch bases on `fromDeliverySeq`). The client
+   * applies a batch only when its watermark equals the base and advances the
+   * watermark to the max, so a dropped batch stalls the watermark and is recovered by
+   * the next handshake resend. Because delivery-sequence order respects causal order
+   * (a dependency is always committed, and thus sequenced, before its dependent), no
+   * topological sort is needed and the client never defers on a missing dependency
+   * that is itself in this stream.
+   *
+   * The final batch advances the watermark to the highest delivery sequence scanned,
+   * not merely the last in-scope one, so an out-of-scope tail is not re-scanned on the
+   * next reconnect. Returns the number of operations actually sent.
+   */
+  async sendDeliveryStream(fromDeliverySeq, finalizeWhenEmpty, excludeNodeId) {
+    const scanChunk = Math.max(this.batchSize, 1) * 5;
+    let scanCursor = fromDeliverySeq;
+    let maxScanned = fromDeliverySeq;
+    const visible = [];
+    while (true) {
+      const chunk = await this.store.getOperationsAfterDelivery(scanCursor, scanChunk);
+      const last = chunk[chunk.length - 1];
+      if (last === void 0) break;
+      scanCursor = last.deliverySequence;
+      maxScanned = scanCursor;
+      for (const delivered of chunk) {
+        if (excludeNodeId !== void 0 && delivered.operation.nodeId === excludeNodeId) {
+          continue;
+        }
+        if (await this.operationVisibleToClient(delivered.operation)) {
+          visible.push(delivered);
+        }
+      }
+      if (chunk.length < scanChunk) break;
+    }
+    if (visible.length === 0) {
+      if (finalizeWhenEmpty) {
+        this.sendDeliveryBatch([], fromDeliverySeq, maxScanned, 0, true);
+      }
+      return 0;
+    }
+    const totalBatches = Math.ceil(visible.length / this.batchSize);
+    let base = fromDeliverySeq;
+    for (let i = 0; i < totalBatches; i++) {
+      const slice = visible.slice(i * this.batchSize, (i + 1) * this.batchSize);
+      const lastInSlice = slice[slice.length - 1];
+      if (lastInSlice === void 0) continue;
+      const isFinal = i === totalBatches - 1;
+      const lastSeq = lastInSlice.deliverySequence;
+      const max = isFinal ? Math.max(maxScanned, lastSeq) : lastSeq;
+      this.sendDeliveryBatch(slice, base, max, i, isFinal);
+      base = max;
+    }
+    return visible.length;
+  }
+  /** Build, track, and send one chained delivery-stream batch. */
+  sendDeliveryBatch(slice, base, max, batchIndex, isFinal) {
+    const batchMsg = {
+      type: "operation-batch",
+      messageId: (0, import_core11.generateUUIDv7)(),
+      operations: slice.map((delivered) => this.serializer.encodeOperation(delivered.operation)),
+      isFinal,
+      batchIndex,
+      baseDeliverySequence: base,
+      maxDeliverySequence: max
+    };
+    this.sendToClient(batchMsg);
+    if (slice.length > 0) {
+      this.emitter?.emit({
+        type: "sync:sent",
+        operations: slice.map((delivered) => delivered.operation),
+        batchSize: slice.length
+      });
+    }
+  }
+  async operationVisibleToClient(op) {
+    const scopes = this.authContext?.scopes;
+    const subsets = this.syncQuerySubsets;
+    const needsBackfill = missingScopeFields(op, scopes).length > 0 || subsets !== void 0 && subsets.length > 0;
+    const fullRecord = needsBackfill ? await this.lookupRecordFields(op.collection, op.recordId) : void 0;
+    if (!operationMatchesScopes(op, scopes, fullRecord)) {
       return false;
     }
-    return (0, import_sync3.operationMatchesQuerySubsets)(op, this.syncQuerySubsets);
+    return (0, import_sync3.operationMatchesQuerySubsets)(op, subsets, fullRecord);
+  }
+  /**
+   * Read a record's current field values from the materialized store for scope /
+   * query-subset backfill. Includes soft-deleted rows so a relayed delete (whose op
+   * carries no fields) is still judged against the record's actual scope. Returns
+   * undefined when the record cannot be read (never materialized, or no schema).
+   */
+  async lookupRecordFields(collection, recordId) {
+    try {
+      const rows = await this.store.queryCollection(collection, {
+        where: { id: recordId },
+        includeDeleted: true,
+        limit: 1
+      });
+      return rows[0];
+    } catch {
+      return void 0;
+    }
   }
   handleAwarenessUpdate(msg) {
     this.onAwarenessUpdate?.(this.sessionId, msg);
@@ -2806,13 +3700,32 @@ var ClientSession = class {
   sendError(code, message, retriable) {
     const errorMsg = {
       type: "error",
-      messageId: (0, import_core10.generateUUIDv7)(),
+      messageId: (0, import_core11.generateUUIDv7)(),
       code,
       message,
       retriable
     };
     this.sendToClient(errorMsg);
   }
+  /**
+   * Reject one specific client operation, tied to its id, so the submitter can
+   * divert it out of its pending queue into a durable rejected store rather than
+   * losing it or retrying forever. The op is NOT materialized, so no other
+   * replica ever sees it.
+   */
+  sendOperationRejected(op, code, message, retriable) {
+    const rejectedMsg = {
+      type: "operation-rejected",
+      messageId: (0, import_core11.generateUUIDv7)(),
+      operationId: op.id,
+      collection: op.collection,
+      recordId: op.recordId,
+      code,
+      message,
+      retriable
+    };
+    this.sendToClient(rejectedMsg);
+  }
   setSerializerWireFormat(format) {
     if (typeof this.serializer.setWireFormat === "function") {
       this.serializer.setWireFormat(format);
@@ -2821,6 +3734,7 @@ var ClientSession = class {
   handleTransportClose() {
     if (this.state === "closed") return;
     this.state = "closed";
+    this.flushOrphanedRelays();
     this.emitter?.emit({ type: "sync:disconnected", reason: "transport closed" });
     this.onClose?.(this.sessionId);
   }
@@ -2834,13 +3748,13 @@ function selectWireFormat(supportedWireFormats) {
 
 // src/server/kora-sync-server.ts
 init_cjs_shims();
-var import_core12 = require("@korajs/core");
+var import_core14 = require("@korajs/core");
 var import_internal2 = require("@korajs/core/internal");
 var import_sync5 = require("@korajs/sync");
 
 // src/awareness/awareness-relay.ts
 init_cjs_shims();
-var import_core11 = require("@korajs/core");
+var import_core12 = require("@korajs/core");
 var AwarenessRelay = class {
   clients = /* @__PURE__ */ new Map();
   /**
@@ -2869,7 +3783,7 @@ var AwarenessRelay = class {
     if (hasStates) {
       const catchUpMsg = {
         type: "awareness-update",
-        messageId: (0, import_core11.generateUUIDv7)(),
+        messageId: (0, import_core12.generateUUIDv7)(),
         clientId: 0,
         // Server-sourced
         states: existingStates
@@ -2892,7 +3806,7 @@ var AwarenessRelay = class {
     };
     const msg = {
       type: "awareness-update",
-      messageId: (0, import_core11.generateUUIDv7)(),
+      messageId: (0, import_core12.generateUUIDv7)(),
       clientId: client.clientId,
       states: removalStates
     };
@@ -3188,13 +4102,395 @@ var YjsDocRelay = class {
       if (client.sessionId === excludeSessionId) {
         continue;
       }
-      if (!client.transport.isConnected()) {
-        continue;
+      if (!client.transport.isConnected()) {
+        continue;
+      }
+      client.transport.send(message);
+    }
+  }
+};
+
+// src/server/route-context.ts
+init_cjs_shims();
+var import_core13 = require("@korajs/core");
+
+// src/apply/route-predicate.ts
+init_cjs_shims();
+function evaluateField(actual, operators) {
+  if ("$eq" in operators && !Object.is(actual, operators.$eq)) {
+    return false;
+  }
+  if ("$ne" in operators && Object.is(actual, operators.$ne)) {
+    return false;
+  }
+  if (operators.$in !== void 0 && !operators.$in.some((candidate) => Object.is(actual, candidate))) {
+    return false;
+  }
+  const numericChecks = [
+    ["$lt", (a, b) => a < b],
+    ["$lte", (a, b) => a <= b],
+    ["$gt", (a, b) => a > b],
+    ["$gte", (a, b) => a >= b]
+  ];
+  for (const [operator, compare] of numericChecks) {
+    const bound = operators[operator];
+    if (bound === void 0) {
+      continue;
+    }
+    if (typeof actual !== "number" || typeof bound !== "number") {
+      return false;
+    }
+    if (!compare(actual, bound)) {
+      return false;
+    }
+  }
+  return true;
+}
+function evaluateRoutePredicate(record, predicate) {
+  const fields = Object.keys(predicate);
+  if (fields.length === 0) {
+    return true;
+  }
+  if (record === null) {
+    return false;
+  }
+  for (const field of fields) {
+    const operators = predicate[field];
+    if (operators && !evaluateField(record[field], operators)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// src/server/route-context.ts
+function recordMatchesScope(collection, record, scope) {
+  const collectionScope = scope[collection];
+  if (!collectionScope) {
+    return false;
+  }
+  for (const [field, expected] of Object.entries(collectionScope)) {
+    if (record[field] !== expected) {
+      return false;
+    }
+  }
+  return true;
+}
+function pickFields(record, keys) {
+  const picked = {};
+  for (const key of keys) {
+    if (key in record) {
+      picked[key] = record[key];
+    }
+  }
+  return picked;
+}
+async function buildRouteOperation(store, mutation, currentOverride, clockOverride) {
+  const nodeId = store.getNodeId();
+  const clock = clockOverride ?? new import_core13.HybridLogicalClock(nodeId);
+  const schemaVersion = store.getSchema()?.version ?? 1;
+  const sequenceNumber = nextServerSequenceNumber(store);
+  if (mutation.type === "insert") {
+    return (0, import_core13.createOperation)(
+      {
+        nodeId,
+        type: "insert",
+        collection: mutation.collection,
+        recordId: mutation.recordId ?? (0, import_core13.generateUUIDv7)(),
+        data: mutation.data ?? {},
+        previousData: null,
+        sequenceNumber,
+        causalDeps: [],
+        schemaVersion
+      },
+      clock
+    );
+  }
+  if (!mutation.recordId) {
+    throw new RouteMutationError(
+      "MISSING_RECORD_ID",
+      `A ${mutation.type} mutation on "${mutation.collection}" requires a recordId.`
+    );
+  }
+  const current = currentOverride ? currentOverride.record : await store.findRecord(mutation.collection, mutation.recordId);
+  if (mutation.type === "update") {
+    const rawData = mutation.data ?? {};
+    const data = {};
+    const atomicOps = {};
+    for (const key of Object.keys(rawData)) {
+      const value = rawData[key];
+      if ((0, import_core13.isAtomicOp)(value)) {
+        data[key] = (0, import_core13.resolveAtomicOp)(current ? current[key] : void 0, value);
+        atomicOps[key] = (0, import_core13.toAtomicOp)(value);
+      } else {
+        data[key] = value;
+      }
+    }
+    return (0, import_core13.createOperation)(
+      {
+        nodeId,
+        type: "update",
+        collection: mutation.collection,
+        recordId: mutation.recordId,
+        data,
+        previousData: current ? pickFields(current, Object.keys(rawData)) : {},
+        sequenceNumber,
+        causalDeps: [],
+        schemaVersion,
+        ...Object.keys(atomicOps).length > 0 ? { atomicOps } : {}
+      },
+      clock
+    );
+  }
+  return (0, import_core13.createOperation)(
+    {
+      nodeId,
+      type: "delete",
+      collection: mutation.collection,
+      recordId: mutation.recordId,
+      data: null,
+      previousData: current ? { ...current } : null,
+      sequenceNumber,
+      causalDeps: [],
+      schemaVersion
+    },
+    clock
+  );
+}
+var RouteMutationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "RouteMutationError";
+  }
+  code;
+};
+function createRouteContext(server, store) {
+  let mutationTail = Promise.resolve();
+  function serialize(work) {
+    const run = mutationTail.then(work, work);
+    mutationTail = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
+  async function prepareMutation(mutation, scope) {
+    let op;
+    try {
+      op = await buildRouteOperation(store, mutation);
+    } catch (error) {
+      if (error instanceof RouteMutationError) {
+        return {
+          ok: false,
+          rejection: {
+            ok: false,
+            code: error.code,
+            message: error.message,
+            retriable: isRetriableRejection(error.code)
+          }
+        };
+      }
+      throw error;
+    }
+    if (scope && !operationMatchesScopes(op, scope)) {
+      return {
+        ok: false,
+        rejection: {
+          ok: false,
+          code: "SCOPE_VIOLATION",
+          message: `Mutation on "${mutation.collection}" is outside the provided scope.`,
+          retriable: isRetriableRejection("SCOPE_VIOLATION")
+        }
+      };
+    }
+    return { ok: true, op };
+  }
+  async function commitOperation(op, collection) {
+    const result = await server.applyLocalOperation(op);
+    if (result.result !== "applied") {
+      const code = result.rejection?.code ?? "NOT_APPLIED";
+      return {
+        ok: false,
+        code,
+        message: result.rejection?.message ?? `Operation on "${collection}" was not applied (${result.result}).`,
+        // Prefer the pipeline's own classification when present; fall back
+        // to classifying the code so this stays correct if new codes appear.
+        retriable: result.rejection?.retriable ?? isRetriableRejection(code)
+      };
+    }
+    const record = await store.findRecord(collection, op.recordId);
+    return { ok: true, operation: op, record };
+  }
+  async function rawApply(mutation, scope) {
+    const prepared = await prepareMutation(mutation, scope);
+    if (!prepared.ok) {
+      return prepared.rejection;
+    }
+    return commitOperation(prepared.op, mutation.collection);
+  }
+  async function runConditionalViaStore(storeApplyConditional, spec, options) {
+    const scope = options?.scope;
+    const mutations = [];
+    const hasTargetUpdate = spec.update !== void 0 && spec.update !== null;
+    if (hasTargetUpdate) {
+      mutations.push({
+        collection: spec.collection,
+        type: "update",
+        recordId: spec.id,
+        data: spec.update
+      });
+    }
+    if (spec.also) {
+      mutations.push(...spec.also);
+    }
+    let result;
+    try {
+      result = await storeApplyConditional({
+        target: { collection: spec.collection, id: spec.id },
+        ...spec.idempotencyKey ? { idempotencyKey: spec.idempotencyKey } : {},
+        admit: (current) => spec.if && Object.keys(spec.if).length > 0 ? evaluateRoutePredicate(current, spec.if) : true,
+        buildOperations: async (current, context) => {
+          const ops = [];
+          for (let i = 0; i < mutations.length; i++) {
+            const mutation = mutations[i];
+            const useLockedCurrent = i === 0 && hasTargetUpdate;
+            const op = await buildRouteOperation(
+              store,
+              mutation,
+              useLockedCurrent ? { record: current } : void 0,
+              context.clock
+            );
+            if (scope && !operationMatchesScopes(op, scope)) {
+              throw new RouteMutationError(
+                "SCOPE_VIOLATION",
+                `Mutation on "${mutation.collection}" is outside the provided scope.`
+              );
+            }
+            ops.push(op);
+          }
+          return ops;
+        }
+      });
+    } catch (error) {
+      if (error instanceof RouteMutationError) {
+        return {
+          ok: false,
+          code: error.code,
+          message: error.message,
+          retriable: isRetriableRejection(error.code)
+        };
+      }
+      throw error;
+    }
+    if (!result.admitted) {
+      return {
+        ok: false,
+        code: spec.reject?.code ?? "CONDITION_NOT_MET",
+        message: spec.reject?.message ?? `Admission condition not met on "${spec.collection}" record "${spec.id}".`,
+        retriable: false
+      };
+    }
+    if (result.idempotent) {
+      const records2 = spec.idempotencyKey ? [await store.findRecord(spec.idempotencyKey.collection, spec.idempotencyKey.id)] : [];
+      return { ok: true, idempotent: true, operations: [], records: records2 };
+    }
+    server.relayServerOperations(result.applied);
+    const records = [];
+    for (const op of result.applied) {
+      records.push(await store.findRecord(op.collection, op.recordId));
+    }
+    return { ok: true, idempotent: false, operations: result.applied, records };
+  }
+  return {
+    apply(mutation, options) {
+      return serialize(() => rawApply(mutation, options?.scope));
+    },
+    applyConditional(spec, options) {
+      const storeApplyConditional = store.applyConditional;
+      if (storeApplyConditional) {
+        return runConditionalViaStore(storeApplyConditional.bind(store), spec, options);
+      }
+      return serialize(async () => {
+        if (spec.idempotencyKey) {
+          const existing = await store.findRecord(
+            spec.idempotencyKey.collection,
+            spec.idempotencyKey.id
+          );
+          if (existing) {
+            return { ok: true, idempotent: true, operations: [], records: [existing] };
+          }
+        }
+        if (spec.if && Object.keys(spec.if).length > 0) {
+          const target = await store.findRecord(spec.collection, spec.id);
+          if (!evaluateRoutePredicate(target, spec.if)) {
+            const code = spec.reject?.code ?? "CONDITION_NOT_MET";
+            return {
+              ok: false,
+              code,
+              message: spec.reject?.message ?? `Admission condition not met on "${spec.collection}" record "${spec.id}".`,
+              retriable: false
+            };
+          }
+        }
+        const mutations = [];
+        if (spec.update !== void 0 && spec.update !== null) {
+          mutations.push({
+            collection: spec.collection,
+            type: "update",
+            recordId: spec.id,
+            data: spec.update
+          });
+        }
+        if (spec.also) {
+          mutations.push(...spec.also);
+        }
+        const prepared = [];
+        for (const mutation of mutations) {
+          const p = await prepareMutation(mutation, options?.scope);
+          if (!p.ok) {
+            return p.rejection;
+          }
+          prepared.push({ op: p.op, collection: mutation.collection });
+        }
+        const operations2 = [];
+        const records = [];
+        for (const { op, collection } of prepared) {
+          const result = await commitOperation(op, collection);
+          if (!result.ok) {
+            return {
+              ok: false,
+              code: result.code,
+              message: result.message,
+              retriable: result.retriable
+            };
+          }
+          operations2.push(result.operation);
+          records.push(result.record);
+        }
+        return { ok: true, idempotent: false, operations: operations2, records };
+      });
+    },
+    async query(collection, options) {
+      const { scope, ...queryOptions } = options ?? {};
+      const records = await store.queryCollection(collection, queryOptions);
+      if (!scope) {
+        return records;
       }
-      client.transport.send(message);
+      return records.filter((record) => recordMatchesScope(collection, record, scope));
+    },
+    async findById(collection, id, options) {
+      const record = await store.findRecord(collection, id);
+      if (!record) {
+        return null;
+      }
+      if (options?.scope && !recordMatchesScope(collection, record, options.scope)) {
+        return null;
+      }
+      return record;
     }
-  }
-};
+  };
+}
 
 // src/server/kora-sync-server.ts
 var DEFAULT_MAX_CONNECTIONS = 0;
@@ -3202,15 +4498,28 @@ var DEFAULT_BATCH_SIZE2 = 100;
 var DEFAULT_SCHEMA_VERSION2 = 1;
 var DEFAULT_HOST = "0.0.0.0";
 var DEFAULT_PATH = "/";
-var KoraSyncServer = class {
+var DEFAULT_RELAY_RETRANSMIT_INTERVAL_MS = 2e3;
+var DEFAULT_DELIVERY_POLL_INTERVAL_MS = 2e3;
+function validateIntervalOption(name, value) {
+  if (!Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
+    throw new import_core14.SyncError(`${name} must be a non-negative integer number of milliseconds`, {
+      [name]: value
+    });
+  }
+  return value;
+}
+var KoraSyncServer = class _KoraSyncServer {
   store;
   auth;
   serializer;
   emitter;
   maxConnections;
   batchSize;
+  relayRetransmitIntervalMs;
+  deliveryPollIntervalMs;
   schemaVersion;
   supportedSchemaVersions;
+  operationTransforms;
   port;
   host;
   path;
@@ -3220,24 +4529,63 @@ var KoraSyncServer = class {
   yjsDocRelay = new YjsDocRelay();
   blobChunkRelay;
   persistBlobChunk;
+  maxOperationBytes;
+  maxOpsPerMinute;
+  validateOperation;
+  koraContext;
   sessions = /* @__PURE__ */ new Map();
   httpClients = /* @__PURE__ */ new Map();
   httpSessionToClient = /* @__PURE__ */ new Map();
-  serverVersion = "0.4.0";
+  // Informational value reported by getStatus(). Keep in sync with the
+  // @korajs/server package version on release; it is not used for protocol negotiation.
+  serverVersion = "1.0.0-beta.0";
   wsServer = null;
   running = false;
+  /**
+   * Periodic tick that retransmits relay batches connected clients have not
+   * acknowledged, so a relay dropped by a lossy transport is redelivered instead of
+   * leaving that client with a permanent version-vector gap (a lost operation).
+   */
+  relayRetransmitTimer = null;
+  deliveryPollTimer = null;
+  lastObservedDeliverySequence = 0;
+  deliveryPollInFlight = false;
+  /**
+   * Relay operations a client never acknowledged before it disconnected, buffered by
+   * client node id so they can be redelivered on its next connection. Bounded per
+   * node and expired by age so a client that never returns cannot grow this forever.
+   */
+  orphanedRelaysByNode = /* @__PURE__ */ new Map();
+  static MAX_ORPHANED_RELAY_OPS_PER_NODE = 5e3;
+  static ORPHANED_RELAY_TTL_MS = 5 * 6e4;
   constructor(config) {
     this.store = config.store;
+    const storeSchemaVersion = this.store.getSchema()?.version;
+    if (config.schemaVersion !== void 0 && storeSchemaVersion !== void 0 && config.schemaVersion !== storeSchemaVersion) {
+      throw new import_core14.SyncError("Sync schema version does not match the configured store schema.", {
+        syncSchemaVersion: config.schemaVersion,
+        storeSchemaVersion
+      });
+    }
     this.auth = config.auth ?? null;
     this.serializer = config.serializer ?? new import_sync5.JsonMessageSerializer();
     this.emitter = config.emitter ?? null;
     this.maxConnections = config.maxConnections ?? DEFAULT_MAX_CONNECTIONS;
     this.batchSize = config.batchSize ?? DEFAULT_BATCH_SIZE2;
-    this.schemaVersion = config.schemaVersion ?? DEFAULT_SCHEMA_VERSION2;
+    this.relayRetransmitIntervalMs = validateIntervalOption(
+      "relayRetransmitIntervalMs",
+      config.relayRetransmitIntervalMs ?? DEFAULT_RELAY_RETRANSMIT_INTERVAL_MS
+    );
+    this.deliveryPollIntervalMs = validateIntervalOption(
+      "deliveryPollIntervalMs",
+      config.deliveryPollIntervalMs ?? DEFAULT_DELIVERY_POLL_INTERVAL_MS
+    );
+    this.schemaVersion = config.schemaVersion ?? storeSchemaVersion ?? DEFAULT_SCHEMA_VERSION2;
     this.supportedSchemaVersions = config.supportedSchemaVersions ?? {
       min: this.schemaVersion,
       max: this.schemaVersion
     };
+    this.operationTransforms = config.operationTransforms ?? [];
     this.port = config.port;
     this.host = config.host ?? DEFAULT_HOST;
     this.path = config.path ?? DEFAULT_PATH;
@@ -3246,10 +4594,116 @@ var KoraSyncServer = class {
     this.metrics.setSchemaVersion(this.schemaVersion);
     this.blobChunkRelay = new BlobChunkRelay(config.resolveBlobChunk);
     this.persistBlobChunk = config.persistBlobChunk ?? null;
+    this.maxOperationBytes = config.maxOperationBytes;
+    this.maxOpsPerMinute = config.maxOpsPerMinute;
+    this.validateOperation = config.validateOperation;
+    this.koraContext = createRouteContext(this, this.store);
     if (!this.emitter) {
       this.emitter = new import_internal2.SimpleEventEmitter();
     }
   }
+  ensureBackgroundTimersStarted() {
+    if (this.relayRetransmitIntervalMs > 0 && !this.relayRetransmitTimer) {
+      this.relayRetransmitTimer = setInterval(() => {
+        this.retransmitPendingRelays(this.relayRetransmitIntervalMs);
+      }, this.relayRetransmitIntervalMs);
+      this.relayRetransmitTimer.unref?.();
+    }
+    if (this.deliveryPollIntervalMs > 0 && !this.deliveryPollTimer) {
+      this.deliveryPollTimer = setInterval(() => {
+        void this.pollDeliveryLog();
+      }, this.deliveryPollIntervalMs);
+      this.deliveryPollTimer.unref?.();
+    }
+  }
+  /**
+   * Retransmit relay batches that connected clients have not acknowledged within
+   * `staleMs`. Called on a periodic tick and directly by tests. Redelivering an
+   * already-applied operation is harmless (clients dedup by content-addressed id).
+   */
+  retransmitPendingRelays(staleMs = 0) {
+    for (const session of this.sessions.values()) {
+      session.retransmitPendingRelays(staleMs);
+    }
+    this.expireOrphanedRelays();
+  }
+  /**
+   * Check whether the authoritative delivery log advanced without passing through
+   * this server instance, then wake delivery-watermark sessions to scan from their
+   * own acknowledged cursors. Session-level filtering remains the only fan-out path.
+   */
+  async pollDeliveryLog() {
+    if (this.deliveryPollInFlight) return;
+    this.deliveryPollInFlight = true;
+    try {
+      const maxDeliverySequence = await this.store.getMaxDeliverySequence();
+      if (maxDeliverySequence <= this.lastObservedDeliverySequence) {
+        for (const session of this.sessions.values()) {
+          session.pushDeliveryStreamIfSupported(this.deliveryPollIntervalMs, {
+            trackStall: true
+          });
+        }
+        return;
+      }
+      this.lastObservedDeliverySequence = maxDeliverySequence;
+      for (const session of this.sessions.values()) {
+        session.pushDeliveryStreamIfSupported(0);
+      }
+    } catch (error) {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "delivery_poll.failed",
+        details: { error: error instanceof Error ? error.message : String(error) }
+      });
+    } finally {
+      this.deliveryPollInFlight = false;
+    }
+  }
+  /**
+   * Buffer relay operations a disconnected client never acknowledged, keyed by its
+   * node id, deduped by operation id and bounded by count. Redelivered when the
+   * client reconnects (see {@link takeOrphanedRelays}).
+   */
+  bufferOrphanedRelays(nodeId, ops) {
+    if (ops.length === 0) return;
+    const existing = this.orphanedRelaysByNode.get(nodeId);
+    const merged = existing ? existing.ops : [];
+    const seen = new Set(merged.map((op) => op.id));
+    for (const op of ops) {
+      if (!seen.has(op.id)) {
+        merged.push(op);
+        seen.add(op.id);
+      }
+    }
+    const bounded = merged.length > _KoraSyncServer.MAX_ORPHANED_RELAY_OPS_PER_NODE ? merged.slice(merged.length - _KoraSyncServer.MAX_ORPHANED_RELAY_OPS_PER_NODE) : merged;
+    this.orphanedRelaysByNode.set(nodeId, { ops: bounded, bufferedAtMs: Date.now() });
+  }
+  /** Remove and return a node's buffered orphaned relay operations, if any. */
+  takeOrphanedRelays(nodeId) {
+    const entry = this.orphanedRelaysByNode.get(nodeId);
+    if (!entry) return [];
+    this.orphanedRelaysByNode.delete(nodeId);
+    return entry.ops;
+  }
+  /** Drop buffered orphaned relays older than the TTL (client never returned). */
+  expireOrphanedRelays() {
+    if (this.orphanedRelaysByNode.size === 0) return;
+    const cutoff = Date.now() - _KoraSyncServer.ORPHANED_RELAY_TTL_MS;
+    for (const [nodeId, entry] of this.orphanedRelaysByNode) {
+      if (entry.bufferedAtMs <= cutoff) {
+        this.orphanedRelaysByNode.delete(nodeId);
+      }
+    }
+  }
+  /**
+   * The trusted, scoped data-plane context (`apply` / `query` / `findById`).
+   * Shared with the production server so HTTP routes, the operation validator,
+   * and `server.kora` are all the same object over the same pipeline.
+   */
+  getKoraContext() {
+    return this.koraContext;
+  }
   /**
    * Subscribe to session-level events for metrics collection and logging.
    * Called when a new session is created.
@@ -3298,6 +4752,21 @@ var KoraSyncServer = class {
         details: { reason: event.reason }
       });
     });
+    sessionEmitter.on("sync:schema-mismatch", (event) => {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "session.schema_mismatch",
+        sessionId,
+        details: {
+          clientSchemaVersion: event.clientSchemaVersion,
+          serverSchemaVersion: event.serverSchemaVersion,
+          supportedMin: event.supportedMin,
+          supportedMax: event.supportedMax,
+          reason: event.reason
+        }
+      });
+    });
   }
   /**
    * Get the metrics collector for external access (e.g., HTTP endpoints).
@@ -3318,10 +4787,10 @@ var KoraSyncServer = class {
    */
   async start(wsServerImpl) {
     if (this.running) {
-      throw new import_core12.SyncError("Server is already running", { port: this.port });
+      throw new import_core14.SyncError("Server is already running", { port: this.port });
     }
     if (!wsServerImpl && this.port === void 0) {
-      throw new import_core12.SyncError(
+      throw new import_core14.SyncError(
         "Port is required for standalone mode. Provide port in config or use handleConnection() for attach mode.",
         {}
       );
@@ -3367,6 +4836,15 @@ var KoraSyncServer = class {
       event: "server.stopping",
       details: { connectedClients: this.sessions.size }
     });
+    if (this.relayRetransmitTimer) {
+      clearInterval(this.relayRetransmitTimer);
+      this.relayRetransmitTimer = null;
+    }
+    if (this.deliveryPollTimer) {
+      clearInterval(this.deliveryPollTimer);
+      this.deliveryPollTimer = null;
+    }
+    this.orphanedRelaysByNode.clear();
     this.awarenessRelay.clear();
     this.yjsDocRelay.clear();
     this.blobChunkRelay.clear();
@@ -3431,7 +4909,7 @@ var KoraSyncServer = class {
     if (this.maxConnections > 0 && this.sessions.size >= this.maxConnections) {
       transport.send({
         type: "error",
-        messageId: (0, import_core12.generateUUIDv7)(),
+        messageId: (0, import_core14.generateUUIDv7)(),
         code: "MAX_CONNECTIONS",
         message: `Server has reached maximum connections (${this.maxConnections})`,
         retriable: true
@@ -3444,12 +4922,13 @@ var KoraSyncServer = class {
         event: "connection.rejected",
         details: { reason: "max_connections", max: this.maxConnections }
       });
-      throw new import_core12.SyncError("Maximum connections reached", {
+      throw new import_core14.SyncError("Maximum connections reached", {
         current: this.sessions.size,
         max: this.maxConnections
       });
     }
-    const sessionId = (0, import_core12.generateUUIDv7)();
+    this.ensureBackgroundTimersStarted();
+    const sessionId = (0, import_core14.generateUUIDv7)();
     this.metrics.recordConnection(sessionId);
     const sessionEmitter = new import_internal2.SimpleEventEmitter();
     sessionEmitter.on("sync:connected", (event) => {
@@ -3495,6 +4974,33 @@ var KoraSyncServer = class {
         sessionId
       });
     });
+    sessionEmitter.on("sync:schema-mismatch", (event) => {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "session.schema_mismatch",
+        sessionId,
+        details: {
+          clientSchemaVersion: event.clientSchemaVersion,
+          serverSchemaVersion: event.serverSchemaVersion,
+          supportedMin: event.supportedMin,
+          supportedMax: event.supportedMax,
+          reason: event.reason
+        }
+      });
+    });
+    sessionEmitter.on("sync:delivery-stalled", (event) => {
+      this.logger.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "session.delivery_stalled",
+        sessionId,
+        details: {
+          watermark: event.watermark,
+          repeatCount: event.repeatCount
+        }
+      });
+    });
     const session = new ClientSession({
       sessionId,
       transport,
@@ -3502,9 +5008,11 @@ var KoraSyncServer = class {
       auth: this.auth ?? void 0,
       serializer: this.serializer,
       emitter: sessionEmitter,
+      logger: this.logger,
       batchSize: this.batchSize,
       schemaVersion: this.schemaVersion,
       supportedSchemaVersions: this.supportedSchemaVersions,
+      operationTransforms: this.operationTransforms,
       onRelay: (sourceSessionId, operations2) => {
         this.handleRelay(sourceSessionId, operations2);
       },
@@ -3521,9 +5029,18 @@ var KoraSyncServer = class {
         this.blobChunkRelay.handleResponse(sourceSessionId, message);
       },
       ...this.persistBlobChunk ? { persistBlobChunk: this.persistBlobChunk } : {},
+      // Only forward when configured, so an unset server value leaves the
+      // session on its own documented default rather than `undefined`.
+      ...this.maxOperationBytes !== void 0 ? { maxOperationBytes: this.maxOperationBytes } : {},
+      ...this.maxOpsPerMinute !== void 0 ? { maxOpsPerMinute: this.maxOpsPerMinute } : {},
+      ...this.validateOperation ? { validateOperation: this.validateOperation, koraContext: this.koraContext } : {},
       onClose: (sid) => {
         this.handleSessionClose(sid);
-      }
+      },
+      onOrphanedRelays: (nodeId, ops) => {
+        this.bufferOrphanedRelays(nodeId, ops);
+      },
+      takeOrphanedRelays: (nodeId) => this.takeOrphanedRelays(nodeId)
     });
     this.sessions.set(sessionId, session);
     this.yjsDocRelay.addClient(sessionId, transport);
@@ -3583,6 +5100,22 @@ var KoraSyncServer = class {
     }
     return result;
   }
+  /**
+   * Relay already-applied, server-originated operations to every connected client.
+   * Used by the conditional route apply, which commits its operations atomically
+   * through the store (bypassing {@link applyLocalOperation}) and then fans them
+   * out. Each session still enforces its own per-scope visibility filter.
+   *
+   * @param operations - Operations that have already been committed to the store
+   */
+  relayServerOperations(operations2) {
+    if (operations2.length === 0) {
+      return;
+    }
+    for (const session of this.sessions.values()) {
+      session.relayOperations(operations2);
+    }
+  }
   /**
    * Collect every blob reference still reachable from live records on the server.
    *
@@ -3607,7 +5140,7 @@ var KoraSyncServer = class {
       const records = await this.store.materializeCollection(name);
       for (const record of records) {
         for (const value of Object.values(record)) {
-          if ((0, import_core12.isBlobRef)(value)) {
+          if ((0, import_core14.isBlobRef)(value)) {
             refs.push(value);
           }
         }
@@ -3787,162 +5320,6 @@ function createKoraServer(config) {
 
 // src/server/production-server.ts
 init_cjs_shims();
-
-// src/server/route-context.ts
-init_cjs_shims();
-var import_core13 = require("@korajs/core");
-function recordMatchesScope(collection, record, scope) {
-  const collectionScope = scope[collection];
-  if (!collectionScope) {
-    return false;
-  }
-  for (const [field, expected] of Object.entries(collectionScope)) {
-    if (record[field] !== expected) {
-      return false;
-    }
-  }
-  return true;
-}
-function pickFields(record, keys) {
-  const picked = {};
-  for (const key of keys) {
-    if (key in record) {
-      picked[key] = record[key];
-    }
-  }
-  return picked;
-}
-async function buildRouteOperation(store, mutation) {
-  const nodeId = store.getNodeId();
-  const clock = new import_core13.HybridLogicalClock(nodeId);
-  const schemaVersion = store.getSchema()?.version ?? 1;
-  const sequenceNumber = nextServerSequenceNumber(store);
-  if (mutation.type === "insert") {
-    return (0, import_core13.createOperation)(
-      {
-        nodeId,
-        type: "insert",
-        collection: mutation.collection,
-        recordId: mutation.recordId ?? (0, import_core13.generateUUIDv7)(),
-        data: mutation.data ?? {},
-        previousData: null,
-        sequenceNumber,
-        causalDeps: [],
-        schemaVersion
-      },
-      clock
-    );
-  }
-  if (!mutation.recordId) {
-    throw new RouteMutationError(
-      "MISSING_RECORD_ID",
-      `A ${mutation.type} mutation on "${mutation.collection}" requires a recordId.`
-    );
-  }
-  const current = await store.findRecord(mutation.collection, mutation.recordId);
-  if (mutation.type === "update") {
-    const data = mutation.data ?? {};
-    return (0, import_core13.createOperation)(
-      {
-        nodeId,
-        type: "update",
-        collection: mutation.collection,
-        recordId: mutation.recordId,
-        data,
-        previousData: current ? pickFields(current, Object.keys(data)) : {},
-        sequenceNumber,
-        causalDeps: [],
-        schemaVersion
-      },
-      clock
-    );
-  }
-  return (0, import_core13.createOperation)(
-    {
-      nodeId,
-      type: "delete",
-      collection: mutation.collection,
-      recordId: mutation.recordId,
-      data: null,
-      previousData: current ? { ...current } : null,
-      sequenceNumber,
-      causalDeps: [],
-      schemaVersion
-    },
-    clock
-  );
-}
-var RouteMutationError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "RouteMutationError";
-  }
-  code;
-};
-function createRouteContext(server, store) {
-  let mutationTail = Promise.resolve();
-  function serialize(work) {
-    const run = mutationTail.then(work, work);
-    mutationTail = run.then(
-      () => void 0,
-      () => void 0
-    );
-    return run;
-  }
-  return {
-    apply(mutation, options) {
-      return serialize(async () => {
-        let op;
-        try {
-          op = await buildRouteOperation(store, mutation);
-        } catch (error) {
-          if (error instanceof RouteMutationError) {
-            return { ok: false, code: error.code, message: error.message };
-          }
-          throw error;
-        }
-        if (options?.scope && !operationMatchesScopes(op, options.scope)) {
-          return {
-            ok: false,
-            code: "SCOPE_VIOLATION",
-            message: `Mutation on "${mutation.collection}" is outside the provided scope.`
-          };
-        }
-        const result = await server.applyLocalOperation(op);
-        if (result.result !== "applied") {
-          return {
-            ok: false,
-            code: result.rejection?.code ?? "NOT_APPLIED",
-            message: result.rejection?.message ?? `Operation on "${mutation.collection}" was not applied (${result.result}).`
-          };
-        }
-        const record = await store.findRecord(mutation.collection, op.recordId);
-        return { ok: true, operation: op, record };
-      });
-    },
-    async query(collection, options) {
-      const { scope, ...queryOptions } = options ?? {};
-      const records = await store.queryCollection(collection, queryOptions);
-      if (!scope) {
-        return records;
-      }
-      return records.filter((record) => recordMatchesScope(collection, record, scope));
-    },
-    async findById(collection, id, options) {
-      const record = await store.findRecord(collection, id);
-      if (!record) {
-        return null;
-      }
-      if (options?.scope && !recordMatchesScope(collection, record, options.scope)) {
-        return null;
-      }
-      return record;
-    }
-  };
-}
-
-// src/server/production-server.ts
 var MIME_TYPES = {
   ".html": "text/html",
   ".js": "text/javascript",
@@ -3961,12 +5338,13 @@ function createProductionServer(config) {
   const port = config.port ?? (Number(process.env.PORT) || 3001);
   const staticDir = config.staticDir ?? "./dist";
   const syncPath = config.syncPath ?? "/kora-sync";
+  const crossOriginEmbedderPolicy = config.crossOriginEmbedderPolicy ?? "credentialless";
   const syncServer = new KoraSyncServer({
     store: config.store,
     enableDashboard: true,
     ...config.syncOptions
   });
-  const routeContext = createRouteContext(syncServer, config.store);
+  const routeContext = syncServer.getKoraContext();
   let httpServer = null;
   function getOperationalToken(kind) {
     const auth = config.operationalAuth;
@@ -4106,6 +5484,10 @@ function createProductionServer(config) {
     res.end(JSON.stringify(result.body ?? null));
   }
   return {
+    kora: routeContext,
+    getLiveBlobRefs() {
+      return syncServer.getLiveBlobRefs();
+    },
     async start() {
       const { createServer } = await import("http");
       const { createReadStream, existsSync, statSync } = await import("fs");
@@ -4127,7 +5509,7 @@ function createProductionServer(config) {
       });
       async function handleRequest(req, res) {
         res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
-        res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
+        res.setHeader("Cross-Origin-Embedder-Policy", crossOriginEmbedderPolicy);
         const url = new URL(req.url || "/", `http://${req.headers.host}`);
         if (url.pathname === "/health") {
           const status = await syncServer.getStatus();
@@ -4301,8 +5683,13 @@ data: ${JSON.stringify(s)}
           socket.destroy();
         }
       });
-      return new Promise((resolve2) => {
+      return new Promise((resolve2, reject) => {
+        const onError = (error) => {
+          reject(error);
+        };
+        httpServer?.once("error", onError);
         httpServer?.listen(port, "0.0.0.0", () => {
+          httpServer?.off("error", onError);
           resolve2(`http://localhost:${port}`);
         });
       });
@@ -4398,6 +5785,7 @@ function formatUptime(ms) {
 0 && (module.exports = {
   AwarenessRelay,
   ClientSession,
+  DEFAULT_MAX_SCOPE_PREDICATE_VALUES,
   HttpServerTransport,
   KoraAuthProvider,
   KoraSyncServer,
@@ -4405,6 +5793,7 @@ function formatUptime(ms) {
   MixedAuthProvider,
   NoAuthProvider,
   PostgresServerStore,
+  RETRIABLE_REJECTION_CODES,
   SqliteServerStore,
   TokenAuthProvider,
   WsServerTransport,
@@ -4415,6 +5804,9 @@ function formatUptime(ms) {
   createPrettyLogger,
   createProductionServer,
   createSilentLogger,
-  createSqliteServerStore
+  createSqliteServerStore,
+  isRetriableRejection,
+  normalizeScopeMap,
+  operationMatchesScopes
 });
 //# sourceMappingURL=index.cjs.map