@korajs/server 1.0.0-beta.10 → 1.0.0-beta.12

package/dist/index.cjs

@@ -169,6 +169,7 @@ var index_exports = {};
 __export(index_exports, {
   AwarenessRelay: () => AwarenessRelay,
   ClientSession: () => ClientSession,
+  DEFAULT_MAX_SCOPE_PREDICATE_VALUES: () => DEFAULT_MAX_SCOPE_PREDICATE_VALUES,
   HttpServerTransport: () => HttpServerTransport,
   KoraAuthProvider: () => KoraAuthProvider,
   KoraSyncServer: () => KoraSyncServer,
@@ -188,7 +189,9 @@ __export(index_exports, {
   createProductionServer: () => createProductionServer,
   createSilentLogger: () => createSilentLogger,
   createSqliteServerStore: () => createSqliteServerStore,
-  isRetriableRejection: () => isRetriableRejection
+  isRetriableRejection: () => isRetriableRejection,
+  normalizeScopeMap: () => normalizeScopeMap,
+  operationMatchesScopes: () => operationMatchesScopes
 });
 module.exports = __toCommonJS(index_exports);
 init_cjs_shims();
@@ -2725,6 +2728,39 @@ function mergeScopeMaps(base, overlay, source) {
 
 // src/scopes/server-scope-filter.ts
 init_cjs_shims();
+var DEFAULT_MAX_SCOPE_PREDICATE_VALUES = 100;
+function normalizeScopeMap(scopes, maxValues = DEFAULT_MAX_SCOPE_PREDICATE_VALUES) {
+  const normalized = {};
+  for (const collection of Object.keys(scopes).sort()) {
+    const predicate = {};
+    for (const field of Object.keys(scopes[collection] ?? {}).sort()) {
+      const expected = scopes[collection]?.[field];
+      if (expected && typeof expected === "object" && !Array.isArray(expected) && "$in" in expected) {
+        const values = expected.$in;
+        if (!Array.isArray(values))
+          throw new Error(`Invalid $in predicate for ${collection}.${field}`);
+        const unique = [...new Map(values.map((value) => [stableValueKey(value), value])).values()];
+        if (unique.length > maxValues)
+          throw new Error(
+            `Scope predicate for ${collection}.${field} exceeds the ${maxValues}-value limit`
+          );
+        predicate[field] = {
+          $in: unique.sort((a, b) => stableValueKey(a).localeCompare(stableValueKey(b)))
+        };
+      } else predicate[field] = expected;
+    }
+    normalized[collection] = predicate;
+  }
+  return normalized;
+}
+function stableValueKey(value) {
+  if (Array.isArray(value)) return `[${value.map(stableValueKey).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value).sort().map(
+      (key) => `${JSON.stringify(key)}:${stableValueKey(value[key])}`
+    ).join(",")}}`;
+  return JSON.stringify(value);
+}
 function operationMatchesScopes(op, scopes, fullRecord) {
   if (!scopes) return true;
   const collectionScope = scopes[op.collection];
@@ -2733,12 +2769,33 @@ function operationMatchesScopes(op, scopes, fullRecord) {
   const snapshot = buildSnapshot(op, fullRecord);
   if (!snapshot) return false;
   for (const [field, expected] of Object.entries(collectionScope)) {
-    if (snapshot[field] !== expected) {
+    if (!matchesPredicate(snapshot[field], expected)) {
       return false;
     }
   }
   return true;
 }
+function operationExitsScopes(op, scopes, resultingRecord) {
+  if (!scopes || op.type !== "update" || !op.previousData) return false;
+  if (operationMatchesScopes(op, scopes, resultingRecord)) return false;
+  const previousSnapshot = {
+    ...resultingRecord ?? {},
+    ...op.data ?? {},
+    ...op.previousData
+  };
+  return operationMatchesScopes(
+    { ...op, type: "insert", data: previousSnapshot, previousData: null },
+    scopes,
+    previousSnapshot
+  );
+}
+function matchesPredicate(actual, expected) {
+  if (expected && typeof expected === "object" && !Array.isArray(expected) && "$in" in expected) {
+    const values = expected.$in;
+    return Array.isArray(values) && values.some((value) => Object.is(actual, value));
+  }
+  return Object.is(actual, expected);
+}
 function missingScopeFields(op, scopes) {
   if (!scopes) return [];
   const collectionScope = scopes[op.collection];
@@ -2857,13 +2914,15 @@ function stableStringify(value) {
   return JSON.stringify(value);
 }
 function sameScopeMap(a, b) {
-  return stableStringify(a ?? null) === stableStringify(b ?? null);
+  const normalize = (value) => value && typeof value === "object" ? normalizeScopeMap(value) : value;
+  return stableStringify(normalize(a) ?? null) === stableStringify(normalize(b) ?? null);
 }
 var ClientSession = class _ClientSession {
   state = "connected";
   clientNodeId = null;
   authContext = null;
   syncQuerySubsets = [];
+  scopeExitPolicy = "retain";
   resumeDeltaCursor = null;
   /**
    * The delivery watermark the client reported at handshake, or null when the client
@@ -2888,7 +2947,7 @@ var ClientSession = class _ClientSession {
    * batches every server tick while the first batch is still being applied.
    */
   lastDeliveryPushAttemptAtMs = 0;
-  deliveryStallRepeatCount = 0;
+  outstandingDelivery = null;
   /** Serializes incremental delivery pushes so their batches never interleave. */
   deliveryPushChain = Promise.resolve();
   /**
@@ -2987,34 +3046,66 @@ var ClientSession = class _ClientSession {
    * from the highest delivery sequence already sent. Pushes are serialized so their
    * batches never interleave (which would break the base/max chain).
    */
-  pushDeliveryStream() {
+  pushDeliveryStream(options = {}) {
     this.deliveryPushChain = this.deliveryPushChain.then(async () => {
       if (this.state !== "streaming" || !this.transport.isConnected()) return;
       try {
+        const previous = this.outstandingDelivery;
+        if (options.trackStall && previous && previous.max > this.lastAckedDeliverySeq) {
+          previous.repeatCount += 1;
+          if (previous.repeatCount >= 3) {
+            this.emitter?.emit({
+              type: "sync:delivery-stalled",
+              sessionId: this.sessionId,
+              watermark: this.lastAckedDeliverySeq,
+              outstandingMaxDeliverySequence: previous.max,
+              repeatCount: previous.repeatCount,
+              reason: "unacknowledged-delivery"
+            });
+          }
+        }
         this.lastDeliveryPushAttemptAtMs = Date.now();
-        await this.sendDeliveryStream(
+        const result = await this.sendDeliveryStream(
           this.lastAckedDeliverySeq,
           false,
           this.clientNodeId ?? void 0
         );
+        if (result.sent && result.maxScanned > this.lastAckedDeliverySeq) {
+          if (!this.outstandingDelivery || this.outstandingDelivery.base !== this.lastAckedDeliverySeq || this.outstandingDelivery.max !== result.maxScanned) {
+            this.outstandingDelivery = {
+              base: this.lastAckedDeliverySeq,
+              max: result.maxScanned,
+              sentAtMs: Date.now(),
+              repeatCount: 0
+            };
+          } else {
+            this.outstandingDelivery.sentAtMs = Date.now();
+          }
+        } else if (result.maxScanned <= this.lastAckedDeliverySeq) {
+          this.outstandingDelivery = null;
+        }
       } catch {
       }
     });
   }
   async relayVisibleOperations(operations2) {
     const visibleOperations = [];
+    const retractions = [];
     for (const op of operations2) {
       if (await this.operationVisibleToClient(op)) {
         visibleOperations.push(op);
+      } else if (await this.scopeRetractionFor(op)) {
+        retractions.push({ collection: op.collection, recordId: op.recordId });
       }
     }
-    if (visibleOperations.length === 0) return;
+    if (visibleOperations.length === 0 && retractions.length === 0) return;
     if (this.state !== "streaming" || !this.transport.isConnected()) return;
     const serializedOps = visibleOperations.map((op) => this.serializer.encodeOperation(op));
     const msg = {
       type: "operation-batch",
       messageId: (0, import_core11.generateUUIDv7)(),
       operations: serializedOps,
+      ...retractions.length > 0 ? { retractions } : {},
       isFinal: true,
       batchIndex: 0
     };
@@ -3058,21 +3149,14 @@ var ClientSession = class _ClientSession {
   pushDeliveryStreamIfSupported(staleMs = 0, options = {}) {
     if (this.state !== "streaming" || !this.transport.isConnected()) return;
     if (this.clientDeliveryWatermark === null) return;
-    if (staleMs > 0 && Date.now() - this.lastDeliveryPushAttemptAtMs < staleMs) {
+    if (options.serverFrontier !== void 0 && options.serverFrontier <= this.lastAckedDeliverySeq) {
+      this.outstandingDelivery = null;
       return;
     }
-    if (options.trackStall) {
-      this.deliveryStallRepeatCount += 1;
-      if (this.deliveryStallRepeatCount >= 3) {
-        this.emitter?.emit({
-          type: "sync:delivery-stalled",
-          sessionId: this.sessionId,
-          watermark: this.lastAckedDeliverySeq,
-          repeatCount: this.deliveryStallRepeatCount
-        });
-      }
+    if (staleMs > 0 && Date.now() - this.lastDeliveryPushAttemptAtMs < staleMs) {
+      return;
     }
-    this.pushDeliveryStream();
+    this.pushDeliveryStream({ trackStall: options.trackStall });
   }
   /**
    * Close this session.
@@ -3155,7 +3239,11 @@ var ClientSession = class _ClientSession {
         this.pendingRelays.delete(message.acknowledgedMessageId);
         if (message.deliverySequence !== void 0) {
           this.lastAckedDeliverySeq = Math.max(this.lastAckedDeliverySeq, message.deliverySequence);
-          this.deliveryStallRepeatCount = 0;
+          if (this.outstandingDelivery && this.lastAckedDeliverySeq >= this.outstandingDelivery.max) {
+            this.outstandingDelivery = null;
+          } else if (this.outstandingDelivery) {
+            this.outstandingDelivery.repeatCount = 0;
+          }
         }
         break;
       case "error":
@@ -3216,6 +3304,7 @@ var ClientSession = class _ClientSession {
       return;
     }
     this.clientNodeId = msg.nodeId;
+    this.scopeExitPolicy = msg.scopeExitPolicy ?? "retain";
     if (this.auth) {
       const token = msg.authToken ?? "";
       const context = await this.auth.authenticate(token);
@@ -3227,18 +3316,48 @@ var ClientSession = class _ClientSession {
       this.authContext = context;
       this.state = "authenticated";
     }
-    const resolvedScopes = resolveSessionScopes(this.store.getSchema(), {
+    const directionalScopesConfigured = this.authContext?.downlinkScopes !== void 0 || this.authContext?.uplinkScopes !== void 0;
+    const downlinkAuthScopes = directionalScopesConfigured ? this.authContext?.downlinkScopes ?? this.authContext?.scopes ?? {} : this.authContext?.scopes;
+    const uplinkAuthScopes = directionalScopesConfigured ? this.authContext?.uplinkScopes ?? this.authContext?.scopes ?? {} : this.authContext?.scopes;
+    const rawResolvedDownlinkScopes = resolveSessionScopes(this.store.getSchema(), {
       handshakeScope: msg.syncScope,
-      authScopes: this.authContext?.scopes
+      authScopes: downlinkAuthScopes
     });
-    if (resolvedScopes) {
+    const rawResolvedUplinkScopes = directionalScopesConfigured ? uplinkAuthScopes : rawResolvedDownlinkScopes;
+    let resolvedDownlinkScopes;
+    let resolvedUplinkScopes;
+    try {
+      resolvedDownlinkScopes = rawResolvedDownlinkScopes ? normalizeScopeMap(rawResolvedDownlinkScopes) : directionalScopesConfigured ? {} : void 0;
+      resolvedUplinkScopes = rawResolvedUplinkScopes ? normalizeScopeMap(rawResolvedUplinkScopes) : directionalScopesConfigured ? {} : void 0;
+    } catch (error) {
+      this.sendToClient({
+        type: "error",
+        messageId: (0, import_core11.generateUUIDv7)(),
+        code: "SCOPE_PREDICATE_LIMIT",
+        message: error instanceof Error ? error.message : "Invalid scope predicate",
+        retriable: false
+      });
+      this.close("invalid scope predicate");
+      return;
+    }
+    if (resolvedDownlinkScopes || resolvedUplinkScopes) {
       if (this.authContext) {
-        this.authContext = { ...this.authContext, scopes: resolvedScopes };
+        this.authContext = {
+          ...this.authContext,
+          scopes: resolvedDownlinkScopes,
+          downlinkScopes: resolvedDownlinkScopes,
+          uplinkScopes: resolvedUplinkScopes
+        };
       } else {
-        this.authContext = { userId: msg.nodeId, scopes: resolvedScopes };
+        this.authContext = {
+          userId: msg.nodeId,
+          scopes: resolvedDownlinkScopes,
+          downlinkScopes: resolvedDownlinkScopes,
+          uplinkScopes: resolvedUplinkScopes
+        };
       }
     }
-    warnIfMultiTenantWithoutScopes(this.auth, resolvedScopes, this.store.getSchema());
+    warnIfMultiTenantWithoutScopes(this.auth, resolvedDownlinkScopes, this.store.getSchema());
     if (msg.syncQueries && msg.syncQueries.length > 0) {
       this.syncQuerySubsets = (0, import_sync3.dedupeQuerySubsets)(msg.syncQueries);
     } else {
@@ -3246,7 +3365,7 @@ var ClientSession = class _ClientSession {
     }
     this.resumeDeltaCursor = msg.deltaCursor ? (0, import_sync3.decodeDeltaCursor)(msg.deltaCursor) : null;
     this.clientDeliveryWatermark = msg.lastDeliverySequence ?? null;
-    if (this.clientDeliveryWatermark !== null && !sameScopeMap(msg.syncScope, this.authContext?.scopes)) {
+    if (this.clientDeliveryWatermark !== null && !sameScopeMap(msg.syncScope, this.authContext?.downlinkScopes)) {
       this.clientDeliveryWatermark = 0;
     }
     const clientUsesWatermark = this.clientDeliveryWatermark !== null;
@@ -3304,7 +3423,11 @@ var ClientSession = class _ClientSession {
       ...this.persistBlobChunk ? { blobStorageEnabled: true } : {},
       // Confirm the accepted scope so the client knows what data will be synced.
       // This may differ from what the client requested if auth scopes are narrower.
-      ...this.authContext?.scopes ? { acceptedScope: this.authContext.scopes } : {}
+      ...this.authContext?.downlinkScopes ? {
+        acceptedScope: this.authContext.downlinkScopes,
+        acceptedDownlinkScopes: this.authContext.downlinkScopes
+      } : {},
+      ...this.authContext?.uplinkScopes ? { acceptedUplinkScopes: this.authContext.uplinkScopes } : {}
     };
     this.sendToClient(response);
     this.emitter?.emit({ type: "sync:connected", nodeId: msg.nodeId });
@@ -3331,18 +3454,22 @@ var ClientSession = class _ClientSession {
     const applied = [];
     let acknowledgedThrough = 0;
     let canAdvanceAck = true;
+    let uniqueOperations = 0;
+    let duplicateOperations = 0;
+    let rejectedOperations = 0;
     for (const op of operations2) {
       if (!canAdvanceAck) {
         continue;
       }
-      if (!await this.operationVisibleToClient(op)) {
+      if (!await this.operationAllowedFromClient(op)) {
         this.sendOperationRejected(
           op,
           "SCOPE_VIOLATION",
-          `Operation "${op.id}" in collection "${op.collection}" is outside the client's sync scope. Refresh sync scopes and retry.`,
-          true
+          `Operation "${op.id}" in collection "${op.collection}" is outside the accepted uplink scope. Refresh scopes before creating or explicitly resubmitting an authorized operation.`,
+          false
         );
-        canAdvanceAck = false;
+        rejectedOperations += 1;
+        acknowledgedThrough = op.sequenceNumber;
         continue;
       }
       if (!isOperationTimestampValid(op)) {
@@ -3381,6 +3508,7 @@ var ClientSession = class _ClientSession {
           `Operation "${op.id}" cannot be transformed from schema v${op.schemaVersion} to server schema v${this.schemaVersion}.`,
           false
         );
+        rejectedOperations += 1;
         acknowledgedThrough = op.sequenceNumber;
         continue;
       }
@@ -3405,6 +3533,7 @@ var ClientSession = class _ClientSession {
         if (decision.action === "reject") {
           const retriable = decision.retriable ?? isRetriableRejection(decision.code);
           this.sendOperationRejected(serverOp, decision.code, decision.message, retriable);
+          rejectedOperations += 1;
           if (retriable) {
             canAdvanceAck = false;
           } else {
@@ -3425,6 +3554,7 @@ var ClientSession = class _ClientSession {
           applyResult.rejection.message,
           applyResult.rejection.retriable
         );
+        rejectedOperations += 1;
         if (applyResult.rejection.retriable) {
           canAdvanceAck = false;
         } else {
@@ -3434,8 +3564,10 @@ var ClientSession = class _ClientSession {
       }
       if (applyResult.result === "applied") {
         applied.push(...applyResult.appliedOperations);
+        uniqueOperations += 1;
         acknowledgedThrough = op.sequenceNumber;
       } else {
+        duplicateOperations += 1;
         acknowledgedThrough = op.sequenceNumber;
       }
     }
@@ -3443,7 +3575,10 @@ var ClientSession = class _ClientSession {
       this.emitter?.emit({
         type: "sync:received",
         operations: operations2,
-        batchSize: operations2.length
+        batchSize: operations2.length,
+        uniqueOperations,
+        duplicateOperations,
+        rejectedOperations
       });
     }
     const lastOp = operations2[operations2.length - 1];
@@ -3548,7 +3683,7 @@ var ClientSession = class _ClientSession {
     const scanChunk = Math.max(this.batchSize, 1) * 5;
     let scanCursor = fromDeliverySeq;
     let maxScanned = fromDeliverySeq;
-    const visible = [];
+    const deliverable = [];
     while (true) {
       const chunk = await this.store.getOperationsAfterDelivery(scanCursor, scanChunk);
       const last = chunk[chunk.length - 1];
@@ -3560,21 +3695,24 @@ var ClientSession = class _ClientSession {
           continue;
         }
         if (await this.operationVisibleToClient(delivered.operation)) {
-          visible.push(delivered);
+          deliverable.push(delivered);
+        } else if (await this.scopeRetractionFor(delivered.operation)) {
+          deliverable.push({ ...delivered, retraction: true });
         }
       }
       if (chunk.length < scanChunk) break;
     }
-    if (visible.length === 0) {
-      if (finalizeWhenEmpty) {
-        this.sendDeliveryBatch([], fromDeliverySeq, maxScanned, 0, true);
+    if (deliverable.length === 0) {
+      let sent = false;
+      if (finalizeWhenEmpty || maxScanned > fromDeliverySeq) {
+        sent = this.sendDeliveryBatch([], fromDeliverySeq, maxScanned, 0, true);
       }
-      return 0;
+      return { sentOperations: 0, maxScanned, sent };
     }
-    const totalBatches = Math.ceil(visible.length / this.batchSize);
+    const totalBatches = Math.ceil(deliverable.length / this.batchSize);
     let base = fromDeliverySeq;
     for (let i = 0; i < totalBatches; i++) {
-      const slice = visible.slice(i * this.batchSize, (i + 1) * this.batchSize);
+      const slice = deliverable.slice(i * this.batchSize, (i + 1) * this.batchSize);
       const lastInSlice = slice[slice.length - 1];
       if (lastInSlice === void 0) continue;
       const isFinal = i === totalBatches - 1;
@@ -3583,30 +3721,42 @@ var ClientSession = class _ClientSession {
       this.sendDeliveryBatch(slice, base, max, i, isFinal);
       base = max;
     }
-    return visible.length;
+    return {
+      sentOperations: deliverable.filter((item) => !item.retraction).length,
+      maxScanned,
+      sent: true
+    };
   }
   /** Build, track, and send one chained delivery-stream batch. */
   sendDeliveryBatch(slice, base, max, batchIndex, isFinal) {
     const batchMsg = {
       type: "operation-batch",
       messageId: (0, import_core11.generateUUIDv7)(),
-      operations: slice.map((delivered) => this.serializer.encodeOperation(delivered.operation)),
+      operations: slice.filter((delivered) => !delivered.retraction).map((delivered) => this.serializer.encodeOperation(delivered.operation)),
+      ...slice.some((delivered) => delivered.retraction) ? {
+        retractions: slice.filter((delivered) => delivered.retraction).map((delivered) => ({
+          collection: delivered.operation.collection,
+          recordId: delivered.operation.recordId
+        }))
+      } : {},
       isFinal,
       batchIndex,
       baseDeliverySequence: base,
       maxDeliverySequence: max
     };
-    this.sendToClient(batchMsg);
-    if (slice.length > 0) {
+    const sent = this.sendToClient(batchMsg);
+    const sentOperations = slice.filter((delivered) => !delivered.retraction);
+    if (sentOperations.length > 0) {
       this.emitter?.emit({
         type: "sync:sent",
-        operations: slice.map((delivered) => delivered.operation),
-        batchSize: slice.length
+        operations: sentOperations.map((delivered) => delivered.operation),
+        batchSize: sentOperations.length
       });
     }
+    return sent;
   }
   async operationVisibleToClient(op) {
-    const scopes = this.authContext?.scopes;
+    const scopes = this.authContext?.downlinkScopes ?? this.authContext?.scopes;
     const subsets = this.syncQuerySubsets;
     const needsBackfill = missingScopeFields(op, scopes).length > 0 || subsets !== void 0 && subsets.length > 0;
     const fullRecord = needsBackfill ? await this.lookupRecordFields(op.collection, op.recordId) : void 0;
@@ -3615,6 +3765,20 @@ var ClientSession = class _ClientSession {
     }
     return (0, import_sync3.operationMatchesQuerySubsets)(op, subsets, fullRecord);
   }
+  /** Upload authorization is independent from the client's downloaded/query view. */
+  async operationAllowedFromClient(op) {
+    const scopes = this.authContext?.uplinkScopes ?? this.authContext?.scopes;
+    const needsBackfill = missingScopeFields(op, scopes).length > 0;
+    const fullRecord = needsBackfill ? await this.lookupRecordFields(op.collection, op.recordId) : void 0;
+    return operationMatchesScopes(op, scopes, fullRecord);
+  }
+  async scopeRetractionFor(op) {
+    if (this.scopeExitPolicy !== "retract") return false;
+    const scopes = this.authContext?.downlinkScopes ?? this.authContext?.scopes;
+    if (!scopes) return false;
+    const resultingRecord = await this.lookupRecordFields(op.collection, op.recordId);
+    return operationExitsScopes(op, scopes, resultingRecord);
+  }
   /**
    * Read a record's current field values from the materialized store for scope /
    * query-subset backfill. Includes soft-deleted rows so a relayed delete (whose op
@@ -3806,6 +3970,10 @@ var ServerMetricsCollector = class {
   peakConnections = 0;
   connectionsTotal = 0;
   operationsReceived = 0;
+  batchesReceived = 0;
+  uniqueOperationsReceived = 0;
+  duplicateOperationsReceived = 0;
+  rejectedOperations = 0;
   operationsSent = 0;
   bytesReceived = 0;
   bytesSent = 0;
@@ -3821,6 +3989,10 @@ var ServerMetricsCollector = class {
       state: "connected",
       connectedAt: Date.now(),
       operationsReceived: 0,
+      batchesReceived: 0,
+      uniqueOperationsReceived: 0,
+      duplicateOperationsReceived: 0,
+      rejectedOperations: 0,
       operationsSent: 0,
       authContext: null
     });
@@ -3852,12 +4024,24 @@ var ServerMetricsCollector = class {
     }
   }
   /** Record operations received from a client. */
-  recordReceived(sessionId, count3, byteSize) {
+  recordReceived(sessionId, count3, byteSize, outcomes = {
+    unique: count3,
+    duplicates: 0,
+    rejected: 0
+  }) {
     this.operationsReceived += count3;
+    this.batchesReceived += 1;
+    this.uniqueOperationsReceived += outcomes.unique;
+    this.duplicateOperationsReceived += outcomes.duplicates;
+    this.rejectedOperations += outcomes.rejected;
     this.bytesReceived += byteSize;
     const client = this.clientMetrics.get(sessionId);
     if (client) {
       client.operationsReceived += count3;
+      client.batchesReceived += 1;
+      client.uniqueOperationsReceived += outcomes.unique;
+      client.duplicateOperationsReceived += outcomes.duplicates;
+      client.rejectedOperations += outcomes.rejected;
     }
   }
   /** Record operations sent to a client. */
@@ -3885,6 +4069,10 @@ var ServerMetricsCollector = class {
       peakConnections: this.peakConnections,
       connectionsTotal: this.connectionsTotal,
       operationsReceived: this.operationsReceived,
+      batchesReceived: this.batchesReceived,
+      uniqueOperationsReceived: this.uniqueOperationsReceived,
+      duplicateOperationsReceived: this.duplicateOperationsReceived,
+      rejectedOperations: this.rejectedOperations,
       operationsSent: this.operationsSent,
       bytesReceived: this.bytesReceived,
       bytesSent: this.bytesSent,
@@ -3901,6 +4089,10 @@ var ServerMetricsCollector = class {
     this.peakConnections = 0;
     this.connectionsTotal = 0;
     this.operationsReceived = 0;
+    this.batchesReceived = 0;
+    this.uniqueOperationsReceived = 0;
+    this.duplicateOperationsReceived = 0;
+    this.rejectedOperations = 0;
     this.operationsSent = 0;
     this.bytesReceived = 0;
     this.bytesSent = 0;
@@ -4582,14 +4774,17 @@ var KoraSyncServer = class _KoraSyncServer {
       if (maxDeliverySequence <= this.lastObservedDeliverySequence) {
         for (const session of this.sessions.values()) {
           session.pushDeliveryStreamIfSupported(this.deliveryPollIntervalMs, {
-            trackStall: true
+            trackStall: true,
+            serverFrontier: maxDeliverySequence
           });
         }
         return;
       }
       this.lastObservedDeliverySequence = maxDeliverySequence;
       for (const session of this.sessions.values()) {
-        session.pushDeliveryStreamIfSupported(0);
+        session.pushDeliveryStreamIfSupported(0, {
+          serverFrontier: maxDeliverySequence
+        });
       }
     } catch (error) {
       this.logger.log({
@@ -4663,7 +4858,11 @@ var KoraSyncServer = class _KoraSyncServer {
     });
     sessionEmitter.on("sync:received", (event) => {
       const byteSize = estimateByteSize(event.operations);
-      this.metrics.recordReceived(sessionId, event.batchSize, byteSize);
+      this.metrics.recordReceived(sessionId, event.batchSize, byteSize, {
+        unique: event.uniqueOperations ?? event.batchSize,
+        duplicates: event.duplicateOperations ?? 0,
+        rejected: event.rejectedOperations ?? 0
+      });
       this.logger.log({
         timestamp: Date.now(),
         level: "info",
@@ -4886,7 +5085,11 @@ var KoraSyncServer = class _KoraSyncServer {
     });
     sessionEmitter.on("sync:received", (event) => {
       const byteSize = estimateOperationByteSize(event.operations);
-      this.metrics.recordReceived(sessionId, event.batchSize, byteSize);
+      this.metrics.recordReceived(sessionId, event.batchSize, byteSize, {
+        unique: event.uniqueOperations ?? event.batchSize,
+        duplicates: event.duplicateOperations ?? 0,
+        rejected: event.rejectedOperations ?? 0
+      });
       this.logger.log({
         timestamp: Date.now(),
         level: "info",
@@ -4939,7 +5142,9 @@ var KoraSyncServer = class _KoraSyncServer {
         sessionId,
         details: {
           watermark: event.watermark,
-          repeatCount: event.repeatCount
+          outstandingMaxDeliverySequence: event.outstandingMaxDeliverySequence,
+          repeatCount: event.repeatCount,
+          reason: event.reason
         }
       });
     });
@@ -5341,6 +5546,22 @@ function createProductionServer(config) {
       "# TYPE kora_operations_received_total counter",
       `kora_operations_received_total ${status.operationsReceived}`,
       "",
+      "# HELP kora_operation_batches_received_total Total operation batches received from clients",
+      "# TYPE kora_operation_batches_received_total counter",
+      `kora_operation_batches_received_total ${status.batchesReceived}`,
+      "",
+      "# HELP kora_unique_operations_received_total Newly materialized operations received from clients",
+      "# TYPE kora_unique_operations_received_total counter",
+      `kora_unique_operations_received_total ${status.uniqueOperationsReceived}`,
+      "",
+      "# HELP kora_duplicate_operations_received_total Duplicate operations received from clients",
+      "# TYPE kora_duplicate_operations_received_total counter",
+      `kora_duplicate_operations_received_total ${status.duplicateOperationsReceived}`,
+      "",
+      "# HELP kora_rejected_operations_total Operations rejected before authoritative materialization",
+      "# TYPE kora_rejected_operations_total counter",
+      `kora_rejected_operations_total ${status.rejectedOperations}`,
+      "",
       "# HELP kora_operations_sent_total Total operations sent to clients",
       "# TYPE kora_operations_sent_total counter",
       `kora_operations_sent_total ${status.operationsSent}`,
@@ -5727,6 +5948,7 @@ function formatUptime(ms) {
 0 && (module.exports = {
   AwarenessRelay,
   ClientSession,
+  DEFAULT_MAX_SCOPE_PREDICATE_VALUES,
   HttpServerTransport,
   KoraAuthProvider,
   KoraSyncServer,
@@ -5746,6 +5968,8 @@ function formatUptime(ms) {
   createProductionServer,
   createSilentLogger,
   createSqliteServerStore,
-  isRetriableRejection
+  isRetriableRejection,
+  normalizeScopeMap,
+  operationMatchesScopes
 });
 //# sourceMappingURL=index.cjs.map