@korajs/server 1.0.0-beta.12 → 1.0.0-beta.13

package/dist/index.d.ts

@@ -1,7 +1,9 @@
-import { Operation, HybridLogicalClock, SchemaDefinition, BlobRef, KoraEventEmitter, OperationTransform, VersionVector, TimeSource } from '@korajs/core';
+import { KoraError, Operation, VersionVector, HLCTimestamp, RecordFieldVersions, FoldState, HybridLogicalClock, SchemaDefinition, OperationTransform, BlobRef, KoraEventEmitter, TimeSource, ScopeMap as ScopeMap$1 } from '@korajs/core';
+export { SCOPE_CLAIMS_KEY, claimScopes } from '@korajs/core';
 import * as _korajs_sync from '@korajs/sync';
-import { SyncStore, ApplyResult, MessageSerializer, SyncMessage, AwarenessUpdateMessage, YjsDocUpdateMessage, BlobChunkRequestMessage, BlobChunkResponseMessage } from '@korajs/sync';
-import { S as ServerTransport, a as ServerMessageHandler, b as ServerCloseHandler, c as ServerErrorHandler } from './server-transport-CU1BLWgr.js';
+import { SyncStore, ApplyResult, MessageSerializer, SyncMessage, EncryptionKeyRequestMessage, EncryptionKeyPutMessage, EncryptionKeyResponseMessage, WrappedKeyRecord, AwarenessUpdateMessage, YjsDocUpdateMessage, BlobChunkRequestMessage, BlobChunkResponseMessage } from '@korajs/sync';
+import { S as ServerTransport, a as ServerMessageHandler, b as ServerCloseHandler, c as ServerErrorHandler } from './server-transport-BGQkRCI4.js';
+import { SideEffectOp } from '@korajs/merge';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 import { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
 
@@ -36,7 +38,15 @@ type RoutePredicate = Record<string, RoutePredicateOperators>;
  */
 type ScopeMap = Record<string, Record<string, unknown>>;
 declare const DEFAULT_MAX_SCOPE_PREDICATE_VALUES = 100;
-/** Canonicalize bounded `$in` predicates so equivalent authorization has one signature. */
+/**
+ * Canonicalize bounded `$in` predicates so equivalent authorization has one signature.
+ *
+ * Fails closed: an `undefined`/`null` predicate value (also inside `$in`) would match
+ * every record lacking the field, so it is refused (RT-8).
+ *
+ * @throws {InvalidScopePredicateError} On an undefined/null predicate value
+ * @throws {ScopePredicateLimitError} On a malformed or oversized `$in`
+ */
 declare function normalizeScopeMap(scopes: ScopeMap, maxValues?: number): ScopeMap;
 /**
  * Returns true if an operation is visible to a session based on its scopes.
@@ -47,7 +57,91 @@ declare function normalizeScopeMap(scopes: ScopeMap, maxValues?: number): ScopeM
  * - All scoped field/value pairs must match the operation snapshot
  */
 declare function operationMatchesScopes(op: Operation, scopes: ScopeMap | undefined, fullRecord?: Record<string, unknown> | null): boolean;
+/** Why {@link authorizeUplinkWrite} refused a write. */
+type UplinkAuthorizationCode = 'SCOPE_VIOLATION' | 'INVALID_OPERATION';
+/** Result of {@link authorizeUplinkWrite}. */
+type UplinkAuthorizationResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    code: UplinkAuthorizationCode;
+    message: string;
+};
+/**
+ * Thrown by a server store when the uplink authorization re-check, evaluated inside
+ * the store's apply critical section against the row as it is at commit time,
+ * refuses an operation. Nothing was written.
+ */
+declare class UplinkAuthorizationError extends KoraError {
+    readonly rejectionCode: UplinkAuthorizationCode;
+    constructor(rejectionCode: UplinkAuthorizationCode, message: string, context?: Record<string, unknown>);
+}
+/**
+ * Decides whether an untrusted writer (a sync session or a scoped route) may apply
+ * `op`, given the record as it is currently stored and the writer's scope.
+ *
+ * This is the single authorization rule for every untrusted write path (sync
+ * uploads, `request.kora` routes, the conditional store path and the Yjs doc
+ * channel). It never reads `op.previousData` for scope decisions, because it is
+ * attacker-controlled, and it never lets op fields name a different record:
+ *
+ * 1. `op.data` / `op.previousData` must not carry an `id` other than `op.recordId`
+ *    (`INVALID_OPERATION`), whether or not scopes are configured.
+ * 2. Without scopes every (well-formed) write is allowed.
+ * 3. If a stored row exists (including a soft-deleted one) it must be in scope,
+ *    judged on the stored values only, for inserts, updates and deletes alike. This
+ *    stops editing, deleting or overwriting (same-id insert) another tenant's record.
+ * 4. The post-image must be in scope: `{...stored, ...op.data}` for updates,
+ *    `op.data` for inserts and the stored row for deletes. This stops moving a
+ *    record out of scope (ownership transfer is a trusted server-route operation).
+ *
+ * In both images `id` is `op.recordId`, assigned last.
+ *
+ * @param op - The operation the writer wants to apply
+ * @param storedRow - The record as stored now (including soft-deleted), or null
+ * @param scopes - The writer's uplink scope map, or undefined for no restriction
+ * @returns Whether the write is allowed, and why not when it is refused
+ */
+declare function authorizeUplinkWrite(op: Operation, storedRow: Record<string, unknown> | null | undefined, scopes: ScopeMap | undefined): UplinkAuthorizationResult;
 
+/** A stored legacy pair, reported to {@link ApplyRemoteOptions.onLegacySequencePair}. */
+interface LegacySequencePair {
+    operationId: string;
+    nodeId: string;
+    sequenceNumber: number;
+    /** The operations that already held the sequence. */
+    holderIds: string[];
+    /** True when accepted because the writer is a legacy client (not a pre-epoch holder). */
+    legacyWriter: boolean;
+}
+/**
+ * How the server resolved an uploaded operation it did NOT store under the submitted
+ * (node, sequence) (RT-43, RT-47):
+ * - `'ignored'`: the validator answered `ignore` (handled out of band, nothing stored);
+ * - `'refused'`: a terminal (non-retriable) rejection; the same id is answered with the
+ *   original rejection forever after;
+ * - `'stored-elsewhere'`: the id is stored under another sequence of the same node (a
+ *   client sequence repair renumbered it), acknowledged as a duplicate.
+ * A retriable rejection, and a `SEQUENCE_CONFLICT` (the client renumbers and resubmits
+ * under the same id), are never resolutions.
+ */
+type OperationResolutionOutcome = 'ignored' | 'refused' | 'stored-elsewhere';
+/** A durable record of how an uploaded operation was resolved without being stored. */
+interface OperationResolution {
+    operationId: string;
+    nodeId: string;
+    sequenceNumber: number;
+    outcome: OperationResolutionOutcome;
+    /** Rejection code, for `'refused'`. */
+    code: string | null;
+    /** Rejection message, for `'refused'`. */
+    message: string | null;
+}
+/** Where a stored operation sits in its node's sequence space. */
+interface StoredOperationKey {
+    nodeId: string;
+    sequenceNumber: number;
+}
 /**
  * A materialized record reconstructed from the operation log
  * or read from a materialized collection table.
@@ -100,6 +194,12 @@ interface ConditionalApplyContext {
      * it into operation creation) so they sort strictly after every prior write.
      */
     clock: HybridLogicalClock;
+    /**
+     * Read a record as stored (including a soft-deleted one) inside the store's
+     * conditional-apply transaction, for authorizing the built operations against the
+     * same state they commit over. Optional; callers fall back to a plain read.
+     */
+    readStoredRow?: (collection: string, id: string) => Promise<MaterializedRecord | null>;
 }
 /** Result of {@link ServerStore.applyConditional}. */
 interface ConditionalApplyResult {
@@ -119,6 +219,30 @@ interface ConditionalApplyResult {
 interface DeliveredOperation {
     operation: Operation;
     deliverySequence: number;
+    /**
+     * The record's scope-relevant values around this operation, captured from the
+     * server's own rows when it was applied (RT-14, RT-15). Absent (or null) for
+     * operations stored before snapshots existed that could not be backfilled.
+     */
+    scopeSnapshot?: OperationScopeSnapshot | null;
+}
+/**
+ * Scope-relevant field values of a record, captured by the store from its own rows
+ * when an operation is applied (never from the writer's `previousData`). Download
+ * visibility of a historical operation is judged on `post`, so a later ownership
+ * transfer does not disclose the record's earlier history to the new owner (RT-14),
+ * and a scope exit is judged from `pre` to `post` (RT-15).
+ *
+ * Only scalar fields (string, number, boolean, enum, timestamp) and `id` are kept:
+ * scope predicates compare with `Object.is`, so other kinds can never match. A
+ * string longer than {@link MAX_SCOPE_SNAPSHOT_STRING_LENGTH} is left out (fails
+ * closed for a scope on such a field) so a snapshot never copies large text.
+ */
+interface OperationScopeSnapshot {
+    /** Values before the operation; null when the record did not exist or was deleted. */
+    pre: Record<string, unknown> | null;
+    /** Values after it; a delete keeps the record's last values; null when unknown. */
+    post: Record<string, unknown> | null;
 }
 /**
  * Options for querying a materialized collection table.
@@ -137,11 +261,266 @@ interface CollectionQueryOptions {
     /** Include soft-deleted records (default: false) */
     includeDeleted?: boolean;
 }
+/**
+ * Options for {@link ServerStore.applyRemoteOperation}.
+ */
+interface ApplyRemoteOptions {
+    /**
+     * Authorization re-check for an operation submitted by an untrusted writer.
+     *
+     * The store calls it inside its apply critical section (the SQLite write
+     * transaction, the in-memory store's synchronous apply, or a Postgres
+     * transaction holding the per-record advisory lock shared with conditional
+     * applies) with the record as stored at that moment, including a soft-deleted
+     * one, or null when none exists. Returning a refusal aborts the apply and the
+     * store throws {@link UplinkAuthorizationError}; nothing is written.
+     *
+     * This closes the window between a caller's own pre-check and the write, where an
+     * ownership change or a same-id insert committed by another writer (or another
+     * server instance) could otherwise slip in.
+     */
+    authorize?: (storedRow: MaterializedRecord | null) => UplinkAuthorizationResult;
+    /**
+     * The writer does not reserve its sequence numbers inside the write transaction
+     * (a client that did not advertise the `sequenceReservation` handshake capability,
+     * Kora <= beta.12; RT-37). A different operation already holding the
+     * `(nodeId, sequenceNumber)` then does not refuse this one: both are stored as a
+     * legacy pair (each keeps its own delivery sequence, so both are delivered) instead
+     * of throwing {@link SequenceConflictError}. Default false: enforce.
+     */
+    legacySequenceWriter?: boolean;
+    /**
+     * Called once the operation was committed as the second holder of its sequence (a
+     * legacy pair), for logging and diagnostics. Never called for a refused write.
+     */
+    onLegacySequencePair?: (pair: LegacySequencePair) => void;
+}
+/** Options of {@link ServerStore.setSchema}. */
+interface ServerSchemaOptions {
+    /** Schema transforms the store folds with (transforms at fold time, RT-84). */
+    operationTransforms?: readonly OperationTransform[];
+}
+/** One stored end-to-end key record (opaque JSON) and its owner, as backups carry it. */
+interface EncryptionKeyRecordRow {
+    owner: string;
+    keyring: string;
+    revision: number;
+    /** The record's JSON, exactly as stored. */
+    record: string;
+}
 /**
  * Server-side store interface. Extends SyncStore with lifecycle,
  * introspection, and materialization methods needed by the sync server.
  */
 interface ServerStore extends SyncStore {
+    /**
+     * Apply an operation to the log and materialized state. With
+     * `options.authorize`, the authorization is re-checked atomically with the write
+     * (see {@link ApplyRemoteOptions}). Stores written before this option existed
+     * may ignore it; callers always pre-check as well.
+     *
+     * Built-in stores throw {@link SequenceConflictError} when a different operation
+     * already holds the operation's `(nodeId, sequenceNumber)` under enforcement
+     * (unless `options.legacySequenceWriter`, see {@link judgeSequenceHolders}), and return
+     * `'duplicate'` (writing nothing) for an operation id already stored, decided
+     * atomically with the write.
+     */
+    applyRemoteOperation(op: Operation, options?: ApplyRemoteOptions): Promise<ApplyResult>;
+    /**
+     * The version vector as committed in the shared database, read fresh (SRV-4). A
+     * store shared by several server instances must implement it: its synchronous
+     * {@link SyncStore.getVersionVector} can only reflect this instance's own writes.
+     * Optional; callers fall back to `getVersionVector()`.
+     */
+    readVersionVector?(): Promise<VersionVector>;
+    /**
+     * Several records of one collection by id, as stored (soft-deleted ones included),
+     * in one read: `id = ANY(...)` on Postgres, chunked `IN (...)` on SQLite (LMS #11).
+     * Ids with no row are absent from the result. Optional; the delivery stream falls
+     * back to one lookup per operation without it.
+     */
+    findRecordsByIds?(collection: string, ids: string[]): Promise<Map<string, MaterializedRecord>>;
+    /**
+     * Which of `ids` the operation log already holds, with the node and sequence each is
+     * stored under, in one read per batch (chunked `IN (...)`). The sync session asks before any other per-operation check, so a
+     * device re-uploading history the server already stores (the one-time upgrade
+     * re-upload, or an op the client's sequence repair renumbered under its original
+     * id) is acknowledged as a duplicate instead of being re-judged by today's
+     * authorization and validators. Optional; sessions fall back to a per-operation
+     * (node, sequence) lookup without it.
+     */
+    findStoredOperations?(ids: string[]): Promise<Map<string, StoredOperationKey>>;
+    /**
+     * Durably record how an uploaded operation was resolved without being stored under
+     * its sequence (RT-43, RT-47; see {@link OperationResolution}). Idempotent per
+     * operation id: the first resolution wins. The session awaits it BEFORE answering the
+     * client, so a client never acts on a resolution the server could forget. Optional
+     * for custom stores: without it an ignored tail op may be re-validated at reconnect
+     * and a refused id re-judged on resubmission.
+     */
+    recordOperationResolution?(resolution: OperationResolution): Promise<void>;
+    /**
+     * The resolutions recorded for `ids` under `nodeId` (ids resolved under another node
+     * are absent: the answer never crosses devices or tenants).
+     */
+    findOperationResolutions?(nodeId: string, ids: string[]): Promise<Map<string, OperationResolution>>;
+    /** The highest sequence number of `nodeId` with a recorded resolution (0 when none). */
+    getResolvedThrough?(nodeId: string): Promise<number>;
+    /**
+     * Forget the resolution recorded for `operationId` under `nodeId` (no-op when none).
+     * The session calls it for a stale `stored-elsewhere` record: one whose id the batch
+     * lookup did not find stored (RT-51). The operation is then judged normally, and its
+     * real outcome is recorded in place of the stale one. Optional for custom stores:
+     * without it the stale record is ignored but kept.
+     */
+    deleteOperationResolution?(nodeId: string, operationId: string): Promise<void>;
+    /**
+     * Every operation of `nodeId` at or below `throughSequence` that shares its sequence
+     * with another stored operation (a legacy pair, RT-37), ordered by sequence then
+     * delivery. A version-vector client reporting `throughSequence` for the node may hold
+     * only one of a pair, and a range read above its entry can never return the other
+     * (RT-48). Optional; without it such clients miss the second op of a pair.
+     */
+    getSequencePairOperations?(nodeId: string, throughSequence: number): Promise<Operation[]>;
+    /**
+     * The distinct node ids of the operations with `deliverySequence >
+     * afterDeliverySequence`. Optional; lets a handshake stop judging which nodes a
+     * scoped client will hear from as soon as every candidate was found visible.
+     */
+    getNodeIdsAfterDelivery?(afterDeliverySequence: number): Promise<string[]>;
+    /**
+     * Bind a client node id to the authenticated principal that first used it.
+     * Returns true when the node id is already owned by `userId`, was released by an
+     * admin (see {@link releaseNodeClaim}; the caller takes it over), or is unclaimed
+     * AND has no operation history. Returns false when another principal owns it, or
+     * when it is unclaimed but already has operations in the log: history written
+     * before node claims existed has no recorded writer, so nobody may adopt it
+     * until an admin releases it (RT-5). Called at handshake when auth is configured,
+     * so one user cannot upload operations under another user's device id. Every
+     * write after this check is preceded by a claim, so going forward the claim row
+     * records the writer of a node's history. Must be atomic per node id. Optional
+     * for custom stores; the built-in stores persist the claim.
+     */
+    claimNode?(nodeId: string, userId: string): Promise<boolean>;
+    /**
+     * Admin release of a node id (RT-5): the next principal to claim it takes it
+     * over, even when the node has operation history. Returns true when the node had
+     * a claim or history to release, false when it was unknown.
+     */
+    releaseNodeClaim?(nodeId: string): Promise<boolean>;
+    /**
+     * The owner a node id is currently claimed by, or null when unclaimed (RT-21).
+     * Optional; anonymous provisional claims need it together with
+     * {@link replaceNodeClaim}.
+     */
+    getNodeClaimOwner?(nodeId: string): Promise<string | null>;
+    /**
+     * Atomically replace the owner of a node claim, only if it is still
+     * `expectedOwner` (compare-and-set, RT-21). Returns true when replaced. Used to
+     * confirm or re-issue an anonymous device's provisional claim; never creates one.
+     */
+    replaceNodeClaim?(nodeId: string, expectedOwner: string, newOwner: string): Promise<boolean>;
+    /**
+     * The wrapped encryption key record (JSON) of one owner's keyring, or null (ENC-1).
+     * The record holds only salt, KDF parameters and wrapped keys: never a usable key.
+     * Optional for custom stores; without it the server answers key requests with
+     * `unsupported` (it never keeps key records in memory only, which would fork a
+     * user's keys after a restart).
+     */
+    getEncryptionKeyRecord?(owner: string, keyring: string): Promise<string | null>;
+    /**
+     * Write a key record with compare-and-set: store `record` at `revision` only when the
+     * stored revision is `expectedRevision` (0: no record yet). Returns false when
+     * another write won. Must be atomic per (owner, keyring) across server instances.
+     */
+    putEncryptionKeyRecord?(owner: string, keyring: string, record: string, revision: number, expectedRevision: number): Promise<boolean>;
+    /**
+     * Stored key records: every one (for `exportBackup`; RT-104: a server restored from
+     * its backup must still hold the records its encrypted history needs), or one owner's
+     * (the key service tells another keyring's history from a lost record with it).
+     * Optional.
+     */
+    listEncryptionKeyRecords?(owner?: string): Promise<EncryptionKeyRecordRow[]>;
+    /**
+     * Key ids named by stored encrypted operations (their envelope's `keyId`), a sample
+     * of at most `limit` distinct ids (RT-104). `nodeOwner` restricts it to operations of
+     * nodes claimed by that principal (see {@link claimNode}); null means every node (a
+     * server without authentication, whose clients share one keyring). The key service
+     * reports them when an owner has no key record, so a new device can tell a lost
+     * record (encrypted history exists) from a first one. Optional; without it a new
+     * device cannot tell, and a fork it creates is merged later by a device holding the
+     * old ring.
+     */
+    getEncryptedKeyIds?(nodeOwner: string | null, limit: number): Promise<string[]>;
+    /**
+     * Record that `owner` holds the bytes behind a blob content hash (it pushed them,
+     * proving possession) (RT-11). Idempotent. Optional; without it the sync server
+     * keeps ownership in memory (lost on restart, not shared between instances).
+     */
+    recordBlobOwner?(hash: string, owner: string): Promise<void>;
+    /** The owners recorded for each hash (an empty list for unowned hashes). */
+    getBlobOwners?(hashes: string[]): Promise<Map<string, string[]>>;
+    /**
+     * Atomically make `owner` the first owner of a hash nobody owns yet. Returns true
+     * when `owner` owns the hash afterwards (newly, or already), false when someone
+     * else does. Must be atomic per hash across server instances.
+     */
+    claimBlobIfUnowned?(hash: string, owner: string): Promise<boolean>;
+    /**
+     * The scope snapshots captured when the given operations were applied (RT-14).
+     * Operations without one are absent from the result.
+     */
+    getOperationScopeSnapshots?(operationIds: string[]): Promise<Map<string, OperationScopeSnapshot>>;
+    /**
+     * The greatest HLC timestamp among every stored operation of one record (its
+     * newest field write), or null when the record has no operations (RT-19). A
+     * scope-entry operation is stamped with it so it never overrides newer client data.
+     */
+    getRecordLatestTimestamp?(collection: string, recordId: string): Promise<HLCTimestamp | null>;
+    /**
+     * Per-field versions of one live record, folded from its stored operations exactly
+     * as the materialization folds its values (RT-27): each field's version is the HLC
+     * of the write that produced its current value, plus the record's first and newest
+     * operation. Null when the record is deleted or has no operations. A scope-entry
+     * operation carries them so a receiver resolves every field on its own.
+     */
+    getRecordFieldVersions?(collection: string, recordId: string): Promise<RecordFieldVersions | null>;
+    /**
+     * The record's fold state (W7): the per-field CRDT state its row is projected from.
+     * Null when the record has no operations or its collection is not materialized. A
+     * scope-entry operation carries it (filtered to the fields the receiver may see) so
+     * the receiver merges richtext, counter and resolver fields exactly (RT-29).
+     */
+    getRecordFoldState?(collection: string, recordId: string): Promise<FoldState | null>;
+    /** Every stored operation of one record, in delivery (commit) order. */
+    getRecordOperations?(collection: string, recordId: string): Promise<Operation[]>;
+    /**
+     * The record's row as it would be after merging `op` into its fold state, with
+     * nothing written: the candidate a Tier-2 constraint check judges at ingest. Null
+     * when the record would not be live (deleted, or never inserted).
+     */
+    previewOperation?(op: Operation): Promise<MaterializedRecord | null>;
+    /**
+     * Node ids whose operations win `merge('server-authoritative')` fields in the fold:
+     * this store's own node id (every server-originated operation is authored by it)
+     * plus any configured extras. The sync server advertises them in the handshake so
+     * clients fold with the same authority.
+     */
+    getAuthoritativeNodeIds?(): string[];
+    /** Explicit authoritative ids the deployment revoked (RT-81); advertised at handshake. */
+    getRevokedAuthoritativeNodeIds?(): string[];
+    /**
+     * Every explicit id the deployment ever held authoritative, revoked ones included
+     * (RT-81). The session never accepts one as a device node id.
+     */
+    getEverAuthoritativeNodeIds?(): string[];
+    /**
+     * Keyed id of a server-derived operation (cascade, set-null, constraint correction):
+     * deterministic across every instance of the deployment, unpredictable to clients
+     * (RT-64). Built-in stores key it with a persisted deployment secret. A store
+     * without it falls back to the unkeyed `deriveSideEffectOpId`.
+     */
+    deriveServerOperationId?(parentOpId: string, ruleId: string, targetRecordId: string): Promise<string>;
     /** Close the store and release resources */
     close(): Promise<void>;
     /** Get the total number of stored operations */
@@ -188,10 +567,23 @@ interface ServerStore extends SyncStore {
      * tables from the operation log.
      *
      * @param schema - The schema definition describing all collections
+     * @param options - `operationTransforms`: the schema transforms the store folds with
+     *   (transforms at fold time, RT-84). Pass the same list as the sync server's
+     *   `operationTransforms`, so the startup re-materialization folds with them once.
      */
-    setSchema(schema: SchemaDefinition): Promise<void>;
+    setSchema(schema: SchemaDefinition, options?: ServerSchemaOptions): Promise<void>;
     /** Schema used for materialized tables and server-side validation, if set. */
     getSchema(): SchemaDefinition | null;
+    /**
+     * Set the schema transforms the store folds with (RT-84). Operations are stored
+     * exactly as uploaded; the fold merges each operation as
+     * `operationSchemaView(op, schema.version, transforms)` reads it. Transforms are part
+     * of the fold plan fingerprint: a change re-folds every record (once). The sync
+     * server calls this with its `operationTransforms` at construction.
+     */
+    setOperationTransforms?(transforms: readonly OperationTransform[]): Promise<void>;
+    /** The schema transforms the store folds with (empty when none). */
+    getOperationTransforms?(): readonly OperationTransform[];
     /**
      * Get all records from a materialized collection.
      * When schema is set, reads directly from the collection table (O(1) indexed).
@@ -303,6 +695,68 @@ interface ApplyServerOperationResult {
     appliedOperations: Operation[];
     /** Rejection reason when the operation was not applied */
     rejection?: OperationRejection;
+    /**
+     * Side effects of an applied delete that were NOT derived because
+     * {@link ApplyServerOperationOptions.isAuthoredSideEffect} claimed them (RT-69). The
+     * caller must derive each one with {@link deriveServerSideEffects} unless the
+     * author's own copy is stored.
+     */
+    deferredSideEffects?: SideEffectOp[];
+}
+/**
+ * Decides whether an untrusted writer may cause one referential side effect of its
+ * delete. `effect` is the side effect shaped as the operation the server would
+ * write; `stored` is the affected record as stored now (including soft-deleted).
+ */
+type SideEffectAuthorizer = (effect: Operation, stored: MaterializedRecord | null) => UplinkAuthorizationResult;
+/** Options for {@link applyServerOperation}. */
+interface ApplyServerOperationOptions {
+    /**
+     * Uplink authorization for an untrusted writer, re-evaluated by the store inside
+     * its apply critical section against the row as stored at commit time (see
+     * `ApplyRemoteOptions.authorize`). A refusal becomes a non-retriable rejection and
+     * nothing is written.
+     */
+    authorize?: ApplyRemoteOptions['authorize'];
+    /**
+     * Authorization of the referential side effects (cascade delete, set-null) an
+     * untrusted writer's delete would cause (RT-10). Every side effect is checked
+     * against the writer's own scope BEFORE the delete is applied; if any falls
+     * outside it, the whole delete is refused and nothing is written.
+     *
+     * Design: integrity is judged on ALL children, in every tenant (a restrict or a
+     * cross-tenant cascade is never silently skipped, which would leave dangling
+     * references), but the writer learns nothing about children it cannot see: a
+     * restrict violation and an unauthorized side effect are refused with the same
+     * generic `RESTRICTED` rejection, with no ids and no counts. Setting `authorize`
+     * alone also switches restrict refusals to the generic form.
+     */
+    authorizeSideEffect?: SideEffectAuthorizer;
+    /**
+     * The writer is a legacy client that does not reserve sequence numbers (RT-37): a
+     * different operation under a held `(nodeId, sequenceNumber)` is stored as a legacy
+     * pair instead of being refused with `SEQUENCE_CONFLICT`. Applies to the primary
+     * operation only; server-originated side effects are always enforced.
+     */
+    legacySequenceWriter?: boolean;
+    /** See `ApplyRemoteOptions.onLegacySequencePair`; for the primary operation. */
+    onLegacySequencePair?: ApplyRemoteOptions['onLegacySequencePair'];
+    /**
+     * True for a referential side effect of this delete that the writer authored itself
+     * (its own cascade or set-null, later in the same upload, RT-69). Such an effect is
+     * not derived now but returned in `deferredSideEffects`, so the log stores one copy
+     * per child instead of the author's and the server's. Effects it does not claim (a
+     * child the author did not know, a legacy client that authors no cascades) are
+     * derived as before.
+     */
+    isAuthoredSideEffect?: (effect: SideEffectOp) => boolean;
+    /**
+     * The operation as the server schema reads it (transforms at fold time, RT-84), when
+     * the caller already computed it. Shape, constraint and referential checks judge the
+     * view; the store keeps `op` exactly as given and folds the same view. Default: the
+     * store's own view (`serverOperationView`).
+     */
+    view?: Operation;
 }
 
 /**
@@ -318,6 +772,13 @@ interface ServerMetricsSnapshot {
     uniqueOperationsReceived: number;
     duplicateOperationsReceived: number;
     rejectedOperations: number;
+    /**
+     * Operations from protocol-1 (beta.12) clients stored with an id that could not be
+     * verified (RT-71). Non-zero only while beta.12 clients write `undefined` members.
+     */
+    unverifiedLegacyOperations: number;
+    /** Uploads refused for reusing a stored operation id with other content (RT-77). */
+    forgedDuplicates: number;
     operationsSent: number;
     bytesReceived: number;
     bytesSent: number;
@@ -352,6 +813,8 @@ declare class ServerMetricsCollector {
     private uniqueOperationsReceived;
     private duplicateOperationsReceived;
     private rejectedOperations;
+    private unverifiedLegacyOperations;
+    private forgedDuplicates;
     private operationsSent;
     private bytesReceived;
     private bytesSent;
@@ -376,6 +839,10 @@ declare class ServerMetricsCollector {
     }): void;
     /** Record operations sent to a client. */
     recordSent(sessionId: string, count: number, byteSize: number): void;
+    /** Record an operation stored with an unverified legacy id (RT-71). */
+    recordUnverifiedLegacyOperation(): void;
+    /** Record an upload refused for reusing a stored id with other content (RT-77). */
+    recordForgedDuplicate(): void;
     /** Record an error. */
     recordError(): void;
     /** Set the schema version. */
@@ -440,6 +907,210 @@ declare function createSilentLogger(): Logger;
  */
 declare function createDefaultLogger(): Logger;
 
+/**
+ * Resolves a blob chunk by content hash from server-side storage. Optional: when
+ * provided, the server can answer chunk requests directly from its own store
+ * (central-store deployment). When absent, the server acts as a pure relay,
+ * forwarding chunk requests to peer sessions and their responses back.
+ */
+type ResolveBlobChunk = (hash: string) => Promise<Uint8Array | null>;
+
+/** Input to {@link BlobAccessIndex.authorizeReference}. */
+interface BlobReferenceRequest {
+    /** The content hash (blob, manifest or chunk) the writer wants to reference. */
+    hash: string;
+    /** The writer's download scope, or undefined for an unscoped writer. */
+    scopes: ScopeMap | undefined;
+    /**
+     * Stable ownership key of the writer: the user id for a signed-in principal, the
+     * node-claim owner for an anonymous device, a `kora:route:` key for a scoped route.
+     */
+    owner: string;
+    /** Hashes the written record already references as stored (unchanged references). */
+    alreadyReferenced?: ReadonlySet<string>;
+}
+/**
+ * Answers "does a live record inside this download scope reference this blob
+ * hash?" for the blob relay (RT-1), and "may this writer reference this hash?" at
+ * ingest (RT-11).
+ *
+ * **A content hash is not a secret.** Hashes of well-known content can be computed
+ * by anyone, and they travel in records, manifests and logs. So knowing a hash never
+ * grants access: a write may reference a hash only when the writer can already read
+ * a record that references it, or has proven possession of the bytes (pushed them).
+ * Only in peer-relay mode (no central store, so nothing can be pre-claimed and then
+ * read back from the server) may the first writer of a hash nobody references or
+ * owns claim it by reference alone.
+ *
+ * A hash is referenced in a scope when a live (not deleted) record in scope has a
+ * blob field whose `BlobRef.manifestHash` (or, for a bare reference without a
+ * manifest, `BlobRef.hash`) equals it, or when it is a chunk listed in such a manifest and the chunk is unowned or shares an owner with
+ * the manifest (so a crafted manifest listing someone else's chunk hashes exposes
+ * nothing). Manifests are read through `resolveBlobChunk` (central store) or learned
+ * from manifest bytes verified in transit.
+ *
+ * Cost: the referenced set of a scope is built by a scoped query over every
+ * collection that declares a blob field (O(records in scope with blobs)). It is
+ * cached per scope, rebuilt after a write to one of the blob collections it scanned
+ * ({@link invalidate}) or after `ttlMs` (writes through another server instance),
+ * and concurrent lookups for one scope share a single rebuild (RT-17). A full hash
+ * index in the store would make this O(1); this is the interim, correctness-first
+ * form.
+ */
+declare class BlobAccessIndex {
+    private readonly store;
+    private readonly resolveBlobChunk;
+    private readonly ttlMs;
+    private readonly byScope;
+    /** Rebuilds in progress per scope key, shared by concurrent lookups (RT-17). */
+    private readonly inflight;
+    /** manifestHash -> chunk hashes it lists (only from bytes verified against the hash). */
+    private readonly manifestChunks;
+    /** chunkHash -> manifests listing it. */
+    private readonly chunkManifests;
+    /** Ownership fallback for stores without blob-owner persistence. */
+    private readonly memoryOwners;
+    private globalGeneration;
+    private readonly collectionGeneration;
+    constructor(store: ServerStore, resolveBlobChunk: ResolveBlobChunk | null, ttlMs?: number);
+    /**
+     * Forget cached scope sets because records changed. With `collections`, only sets
+     * built from those collections are dropped (a write to a collection without blob
+     * fields drops nothing); without, every set is dropped (for example writes made
+     * through another server instance).
+     */
+    invalidate(collections?: Iterable<string>): void;
+    /**
+     * True when a live record inside `scopes` references `hash`.
+     *
+     * @param scopes - The session's download scope, or undefined for unscoped
+     * @param hash - The requested content hash
+     */
+    isReferenced(scopes: ScopeMap | undefined, hash: string): Promise<boolean>;
+    /**
+     * Decide whether a writer may reference `hash` in a blob field (RT-11). Allowed
+     * when the record already referenced it, when a live record inside the writer's
+     * download scope references it, when the writer owns it (pushed the bytes, or
+     * claimed it first), or when nobody references, owns or stores it yet: then the
+     * writer claims it, atomically, so a later forger cannot.
+     */
+    authorizeReference(request: BlobReferenceRequest): Promise<boolean>;
+    /** True when `owner` pushed (or first claimed) the bytes behind `hash`. */
+    isOwnedBy(hash: string, owner: string): Promise<boolean>;
+    /**
+     * Record that `owner` pushed bytes verified to hash to `hash` (proof of
+     * possession), and learn the chunk list when the bytes are a manifest.
+     */
+    recordPush(hash: string, bytes: Uint8Array, owner: string): Promise<void>;
+    /**
+     * When `bytes` are a manifest, true only if the pusher may reference every chunk
+     * it lists (the same rule as {@link authorizeReference}); true for non-manifest
+     * bytes. A manifest listing someone else's chunks is refused before it is stored.
+     */
+    authorizeManifestPush(bytes: Uint8Array, scopes: ScopeMap | undefined, owner: string): Promise<boolean>;
+    /**
+     * Learn a manifest's chunk list from bytes already verified to hash to `hash`.
+     * Bytes that are not a manifest are ignored. Unowned chunks of an owned manifest
+     * are claimed for the manifest's owner, so a manifest crafted later cannot adopt
+     * them.
+     */
+    observeVerifiedBytes(hash: string, bytes: Uint8Array): void;
+    private claimChunksForManifestOwner;
+    private currentStamp;
+    private isCurrent;
+    private blobCollections;
+    private directHashes;
+    private build;
+    /** Read unknown manifests from the central store, verifying them against their hash. */
+    private loadManifests;
+    private ownersOf;
+    private addOwner;
+    private claim;
+    private rememberMemoryOwner;
+    private rememberManifest;
+    private forgetManifest;
+}
+
+/**
+ * Minimal interface for a ws.WebSocket instance.
+ * Allows dependency injection for testing without importing ws directly.
+ */
+interface WsWebSocket {
+    readyState: number;
+    send(data: string | Uint8Array, callback?: (err?: Error) => void): void;
+    close(code?: number, reason?: string): void;
+    on(event: string, listener: (...args: unknown[]) => void): void;
+    removeAllListeners(): void;
+    /** Send a ping frame (ws). Without it, no liveness probing happens. */
+    ping?(): void;
+    /** Destroy the socket at once, emitting `close` (ws). Falls back to `close()`. */
+    terminate?(): void;
+    /** Bytes queued and not yet written to the network (ws). */
+    readonly bufferedAmount?: number;
+}
+/**
+ * Options for WsServerTransport.
+ */
+interface WsServerTransportOptions {
+    /** Message serializer. Defaults to JsonMessageSerializer. */
+    serializer?: MessageSerializer;
+    /**
+     * Interval between WebSocket pings, in ms (SRV-6). A connection that leaves
+     * `maxMissedPongs` pings in a row unanswered (and sends nothing else meanwhile) is
+     * terminated, which runs Kora's normal close path. Defaults to 25 seconds; 0
+     * disables probing. Keep it at 15 seconds or more on mobile networks.
+     */
+    heartbeatIntervalMs?: number;
+    /** Unanswered pings before the connection is terminated. Defaults to 2. */
+    maxMissedPongs?: number;
+    /**
+     * Bytes that may be queued for this client before it is disconnected as a slow
+     * consumer. Defaults to 32 MiB; 0 disables the ceiling.
+     */
+    maxBufferedBytes?: number;
+}
+/**
+ * Server-side transport wrapping a ws.WebSocket connection.
+ * Created for each incoming client connection.
+ *
+ * It probes liveness with WebSocket pings (both the standalone server and
+ * `createProductionServer` create their connections through it), so a half-open
+ * connection, a peer that vanished without a FIN, is detected and closed instead of
+ * holding a session forever.
+ */
+declare class WsServerTransport implements ServerTransport {
+    private readonly ws;
+    private readonly serializer;
+    private messageHandler;
+    private closeHandler;
+    private errorHandler;
+    private readonly maxMissedPongs;
+    private readonly maxBufferedBytes;
+    private heartbeatTimer;
+    private missedPongs;
+    private terminated;
+    constructor(ws: WsWebSocket, options?: WsServerTransportOptions);
+    send(message: SyncMessage): void;
+    onMessage(handler: ServerMessageHandler): void;
+    onClose(handler: ServerCloseHandler): void;
+    onError(handler: ServerErrorHandler): void;
+    isConnected(): boolean;
+    close(code?: number, reason?: string): void;
+    bufferedAmount(): number;
+    /**
+     * Ping every `intervalMs`; terminate once `maxMissedPongs` pings in a row went
+     * unanswered. A pong or any inbound message proves the peer alive.
+     */
+    private startHeartbeat;
+    private stopHeartbeat;
+    /**
+     * Drop the connection at once. ws emits `close` from `terminate()`, which runs
+     * Kora's normal close path (session, relays and side channels are released).
+     */
+    private terminate;
+    private setupListeners;
+}
+
 /**
  * Minimal interface for a ws.WebSocketServer instance.
  * Allows dependency injection for testing without importing ws directly.
@@ -458,6 +1129,8 @@ type WsServerConstructor = new (options: {
     port?: number;
     host?: string;
     path?: string;
+    maxPayload?: number;
+    perMessageDeflate?: false | Record<string, unknown>;
 }) => WsServerLike;
 /**
  * Self-hosted sync server. Accepts WebSocket connections from clients,
@@ -480,6 +1153,8 @@ declare class KoraSyncServer {
     private readonly schemaVersion;
     private readonly supportedSchemaVersions;
     private readonly operationTransforms;
+    /** The store's re-fold for the configured transforms (RT-84), awaited by start(). */
+    private storeTransformsReady;
     private readonly port;
     private readonly host;
     private readonly path;
@@ -488,14 +1163,49 @@ declare class KoraSyncServer {
     private readonly awarenessRelay;
     private readonly yjsDocRelay;
     private readonly blobChunkRelay;
+    /** Wrapped encryption key records (ENC-1, D4b), persisted in the server store. */
+    private readonly encryptionKeys;
+    /** Which blob hashes each download scope may obtain (RT-1). */
+    private readonly blobAccess;
     private readonly persistBlobChunk;
     private readonly maxOperationBytes;
     private readonly maxOpsPerMinute;
+    /** Per-principal ingest budget per minute; 0 when disabled. */
+    private readonly maxOpsPerMinutePerUser;
+    private readonly allowLegacyAnonymousClaims;
+    private readonly anonymousClaimTtlMs;
+    private readonly maxOpsPerBatch;
+    private readonly maxMessageBytes;
+    private readonly heartbeatIntervalMs;
+    private readonly appHeartbeatIntervalMs;
+    private readonly encryptionPolicy;
+    private readonly handshakeTimeoutMs;
+    private readonly maxBufferedBytes;
+    private readonly deliveryHighWaterBytes;
+    private readonly perMessageDeflate;
+    /**
+     * Ingest rate limiters by device node id, shared by that node's sessions so a
+     * reconnect does not reset the budget (SRV-6). Entries idle past the window are
+     * dropped by the background tick; insertion order doubles as LRU order.
+     */
+    private readonly rateLimiters;
+    /**
+     * Ingest budgets by authenticated principal, shared by every node of that user, so
+     * minting node ids does not multiply the per-node budget. Expired like the node map.
+     */
+    private readonly userRateLimiters;
+    private readonly blobLimits;
     private readonly validateOperation;
     private readonly koraContext;
     private readonly sessions;
-    private readonly httpClients;
-    private readonly httpSessionToClient;
+    /**
+     * HTTP long-poll sessions by their server-issued, high-entropy id (RT-2). Each is
+     * bound to the principal that opened it; every request must re-authenticate as it.
+     */
+    private readonly httpSessions;
+    /** Internal ClientSession id -> HTTP session id, for cleanup on close. */
+    private readonly httpSessionIdBySession;
+    private readonly httpSessionIdleTimeoutMs;
     private readonly serverVersion;
     private wsServer;
     private running;
@@ -508,6 +1218,17 @@ declare class KoraSyncServer {
     private deliveryPollTimer;
     private lastObservedDeliverySequence;
     private deliveryPollInFlight;
+    /**
+     * Re-validates every live session's credential against the auth provider, so a
+     * revocation persisted by ANOTHER server instance (whose in-process revocation
+     * listeners never reach this one) still ends the session here (RT-18).
+     */
+    private readonly sessionRevalidationIntervalMs;
+    private sessionRevalidationTimer;
+    private lastSessionRevalidationAtMs;
+    private sessionRevalidationInFlight;
+    /** Unsubscribes from the auth provider's revocation feed (AUTH-11). */
+    private revocationUnsubscribe;
     /**
      * Relay operations a client never acknowledged before it disconnected, buffered by
      * client node id so they can be redelivered on its next connection. Bounded per
@@ -517,19 +1238,113 @@ declare class KoraSyncServer {
     private static readonly MAX_ORPHANED_RELAY_OPS_PER_NODE;
     private static readonly ORPHANED_RELAY_TTL_MS;
     constructor(config: KoraSyncServerConfig);
+    /**
+     * Follow the auth provider's revocation feed, when it has one, so revoking a
+     * device or user ends its live sessions without any wiring by the app.
+     */
+    private ensureRevocationSubscribed;
+    /**
+     * End live sync sessions whose credential was revoked (AUTH-11).
+     *
+     * Each matching session receives a retriable `AUTH_REVOKED` (or `AUTH_EXPIRED`)
+     * error and is closed. The client refreshes its credentials and re-handshakes,
+     * so the server authenticates it again: a still-valid device reconnects, a
+     * revoked one is refused. Sessions still in their handshake are refused as soon
+     * as their principal is known.
+     *
+     * `createKoraAuthServer().bindSyncServer(server)` calls this on device revoke,
+     * sign-out, password reset or change, and admin revoke. A provider exposing
+     * `onRevoke` (the built-in one does) is followed automatically.
+     *
+     * @param filter - `userId` ends every session of that user; with `deviceId`,
+     *   only that device's sessions. At least one of the two is required.
+     * @returns The number of established sessions that were closed
+     *
+     * @example
+     * ```typescript
+     * server.terminateSessions({ userId: 'u1', deviceId: 'laptop' })
+     * ```
+     */
+    terminateSessions(filter: TerminateSessionsFilter): number;
+    /**
+     * Admin release of a device node id (RT-5). The next principal to handshake with
+     * this node id claims it, even when the node already has operation history.
+     *
+     * Use it to hand over operation history written before node claims existed (an
+     * upgrade from beta.12, where nobody may adopt such a node until it is released),
+     * or to reassign a lost device's node id. Live sessions on that node id are ended
+     * with a retriable `NODE_RELEASED` error so the handover starts clean.
+     *
+     * @param nodeId - The device node id to release
+     * @returns True when the node had a claim or history to release; false when it
+     *   was unknown or the store does not support node claims
+     *
+     * @example
+     * ```typescript
+     * await server.releaseNodeClaim('0190a1b2-...')
+     * ```
+     */
+    releaseNodeClaim(nodeId: string): Promise<boolean>;
     private ensureBackgroundTimersStarted;
+    /**
+     * Re-validate the credential of every live session with the auth provider and end
+     * the sessions whose credential is no longer accepted (RT-18).
+     *
+     * Revocations are persisted by the auth stores (token, device and per-user
+     * cut-offs), but `onRevoke` listeners only run in the process that handled the
+     * revocation. Every instance therefore re-checks its own live sessions
+     * periodically (`sessionRevalidationIntervalMs`, default 30 seconds, also driven by
+     * the delivery poll tick) by authenticating the session's credential again. A
+     * session whose credential is refused, or now resolves to another principal, gets
+     * a retriable `AUTH_REVOKED` (or `AUTH_EXPIRED`) and is closed. A provider error
+     * (for example the auth database is unreachable) ends nothing: it is logged and the
+     * next pass retries, so an outage does not disconnect every client.
+     *
+     * @returns The number of sessions ended by this pass
+     *
+     * @example
+     * ```typescript
+     * // After revoking through another instance's admin API:
+     * await server.revalidateSessions()
+     * ```
+     */
+    revalidateSessions(): Promise<number>;
+    /** Run {@link revalidateSessions} from the delivery poll tick once the interval elapsed. */
+    private maybeRevalidateSessions;
     /**
      * Retransmit relay batches that connected clients have not acknowledged within
      * `staleMs`. Called on a periodic tick and directly by tests. Redelivering an
      * already-applied operation is harmless (clients dedup by content-addressed id).
      */
     retransmitPendingRelays(staleMs?: number): void;
+    /**
+     * The ingest rate limiter of a device node, created on first use and shared by
+     * every session of that node, so reconnecting does not buy a fresh budget (SRV-6).
+     */
+    private rateLimiterFor;
+    /**
+     * Forget rate limiters of nodes with no live session whose window has long
+     * passed: their budget would be full again anyway.
+     */
+    private expireIdleRateLimiters;
+    /** Close HTTP long-poll sessions that sent no request within the idle timeout. */
+    private expireIdleHttpSessions;
     /**
      * Check whether the authoritative delivery log advanced without passing through
      * this server instance, then wake delivery-watermark sessions to scan from their
      * own acknowledged cursors. Session-level filtering remains the only fan-out path.
      */
     pollDeliveryLog(): Promise<void>;
+    /**
+     * Invalidate cached blob access sets for the collections written between two
+     * delivery frontiers. Falls back to dropping every set when the gap is large.
+     */
+    private invalidateBlobAccessSince;
+    /**
+     * The blob reference authority shared by every session and route (RT-11).
+     * @internal Used by the route context; not part of the public API.
+     */
+    getBlobAccessIndex(): BlobAccessIndex;
     /**
      * Buffer relay operations a disconnected client never acknowledged, keyed by its
      * node id, deduped by operation id and bounded by count. Redelivered when the
@@ -572,9 +1387,40 @@ declare class KoraSyncServer {
     /**
      * Handle one HTTP sync request for a long-polling client.
      *
-     * A stable `clientId` identifies the logical connection across requests.
+     * The POST that opens a session (the handshake, sent without `sessionId`) creates
+     * it and answers with a server-issued, high-entropy session id in the
+     * `x-kora-session` response header. Every later request must name that id.
+     *
+     * With an auth provider, EVERY request is authenticated from its `authorization`
+     * header and must resolve to the same principal (user, device and anonymity) as
+     * the request that opened the session and as the session's handshake, so knowing
+     * a session id alone grants nothing (RT-2). Sessions with no request for
+     * `httpSessionIdleTimeoutMs` are closed.
+     *
+     * Responses: 202 (POST accepted), 200/204/304 (GET), 400 (malformed), 401
+     * (credential missing or invalid), 403 (credential of another principal), 404
+     * (unknown or expired session), 405 (method), 410 (session closed).
      */
     handleHttpRequest(request: HttpSyncRequest): Promise<HttpSyncResponse>;
+    /**
+     * Authenticate one HTTP request. Returns the principal identity, null when the
+     * server has no real auth provider, or 'unauthorized'.
+     */
+    private authenticateHttpRequest;
+    /**
+     * True when a request's principal is the one that opened the session and, once
+     * the handshake authenticated, the session's own principal.
+     */
+    private httpPrincipalMatches;
+    /**
+     * Handle an accepted WebSocket (attach mode with `ws`): wraps it in a
+     * {@link WsServerTransport} configured like the standalone server's (serializer,
+     * ping/pong liveness probing, send-buffer ceiling) and starts a session.
+     *
+     * @param ws - A `ws` WebSocket from `WebSocketServer.handleUpgrade` or `connection`
+     * @returns The session ID
+     */
+    handleWebSocket(ws: WsWebSocket): string;
     /**
      * Handle an incoming client connection (attach mode).
      * Creates a new ClientSession for the transport.
@@ -599,9 +1445,10 @@ declare class KoraSyncServer {
      * client only receives the operation if it falls within that client's scope.
      *
      * @param op - A fully-formed, server-originated operation to apply
+     * @param options - Optional in-store authorization (used by scoped routes)
      * @returns The apply result, including any server-generated side-effect ops
      */
-    applyLocalOperation(op: Operation): Promise<ApplyServerOperationResult>;
+    applyLocalOperation(op: Operation, options?: ApplyServerOperationOptions): Promise<ApplyServerOperationResult>;
     /**
      * Relay already-applied, server-originated operations to every connected client.
      * Used by the conditional route apply, which commits its operations atomically
@@ -626,11 +1473,40 @@ declare class KoraSyncServer {
      * Get the number of currently connected clients.
      */
     getConnectionCount(): number;
+    /**
+     * Node ids whose operations win `merge('server-authoritative')` fields in the fold
+     * (W7): the store's own node id, which authors every server-originated operation
+     * (side effects, constraint corrections, route writes), plus any extras the store
+     * was configured with (`authoritativeNodeIds` store option). This is the one source
+     * of truth: every session advertises exactly this list in the handshake, so clients
+     * fold with the same authority as the server's stores.
+     */
+    get authoritativeNodeIds(): string[];
+    /**
+     * Blob access policy (RT-1): true when the session is streaming and a live record
+     * inside its download scope references the hash. Gates the central store.
+     */
+    private sessionReferencesBlob;
+    /** True when a session other than `exceptSessionId` is connected as `nodeId`. */
+    private isNodeLive;
+    /**
+     * Central-store read policy (RT-1, RT-25): the session owns the hash (it pushed
+     * the bytes) or a live record inside its download scope references it.
+     */
+    private sessionMayReadStoredBlob;
+    /**
+     * Blob access policy (RT-1): a request may be forwarded to a peer that shares the
+     * requester's exact download scope (the same tenant view, as for presence), which
+     * keeps manifests handed over out of band working; across scopes, only when both
+     * scopes reference the hash, so neither the hash nor the bytes cross a tenant.
+     */
+    private mayForwardBlobRequest;
     private handleRelay;
     private handleSessionClose;
     private handleAwarenessRelay;
     private handleYjsDocRelay;
-    private getOrCreateHttpClient;
+    /** Open a new HTTP long-poll session bound to `principal`, under a fresh random id. */
+    private openHttpSession;
 }
 
 /**
@@ -820,6 +1696,19 @@ interface AuthContext {
     uplinkScopes?: Record<string, Record<string, unknown>>;
     /** Arbitrary metadata about the authenticated user */
     metadata?: Record<string, unknown>;
+    /**
+     * True for an unauthenticated (anonymous) principal, such as the fallback of
+     * `MixedAuthProvider`. Its `userId` is not stable across connections, so node-id
+     * claims are keyed by the shared anonymous owner instead: an anonymous device can
+     * reconnect with its node id, but can never take a signed-in user's node id.
+     */
+    anonymous?: boolean;
+    /**
+     * When the credential that authenticated this session expires (ms since
+     * epoch). A session must not outlive its credential: the sync server can
+     * close it with a retriable AUTH_EXPIRED so the client refreshes (AUTH-11).
+     */
+    expiresAt?: number;
 }
 /**
  * Interface for authenticating incoming client connections.
@@ -832,6 +1721,33 @@ interface AuthProvider {
      * @returns AuthContext if valid, null if rejected
      */
     authenticate(token: string): Promise<AuthContext | null>;
+    /**
+     * Optional revocation feed. When present, `KoraSyncServer` subscribes on
+     * construction and calls {@link KoraSyncServer.terminateSessions} for every
+     * event, so a revoked device or user loses its live sync sessions immediately
+     * (AUTH-11). The built-in `createKoraAuthServer().auth` provides it.
+     *
+     * @returns An unsubscribe function
+     */
+    onRevoke?(listener: (event: SessionRevocation) => void | Promise<void>): () => void;
+}
+/**
+ * Which live sync sessions a credential revocation ends. `userId` alone ends
+ * every session of that user; with `deviceId` only that device's sessions
+ * (matched against `AuthContext.metadata.deviceId`).
+ */
+interface SessionRevocation {
+    userId?: string;
+    deviceId?: string;
+}
+/** Options for {@link KoraSyncServer.terminateSessions}. */
+interface TerminateSessionsFilter extends SessionRevocation {
+    /**
+     * Error code sent to the client before the session closes. Both are retriable:
+     * the client refreshes its credentials and re-handshakes, and the server then
+     * decides again. Defaults to `'AUTH_REVOKED'`.
+     */
+    code?: 'AUTH_REVOKED' | 'AUTH_EXPIRED';
 }
 /**
  * Configuration for creating a KoraSyncServer.
@@ -849,8 +1765,60 @@ interface KoraSyncServerConfig {
     serializer?: MessageSerializer;
     /** Event emitter for DevTools integration */
     emitter?: KoraEventEmitter;
-    /** Maximum concurrent client connections. 0 = unlimited. Defaults to 0. */
+    /**
+     * Maximum concurrent client connections (sessions, including ones still
+     * handshaking). A connection over the limit gets a retriable `MAX_CONNECTIONS` error
+     * and is closed. 0 = unlimited. Defaults to 10,000.
+     */
     maxConnections?: number;
+    /**
+     * Interval between WebSocket pings, in ms (SRV-6, LMS #12). A connection that
+     * leaves two pings in a row unanswered is terminated, which ends its session.
+     * Applies to the standalone server and `createProductionServer`. Defaults to 25
+     * seconds; 0 disables probing.
+     */
+    heartbeatIntervalMs?: number;
+    /**
+     * Interval of the application-level `heartbeat` message sent to clients that
+     * advertise support for it (browsers cannot see WebSocket pings), in ms. A client
+     * that hears nothing for about 2.5 intervals reconnects. Defaults to 25 seconds; 0
+     * disables it.
+     */
+    appHeartbeatIntervalMs?: number;
+    /**
+     * End-to-end encryption policy (protocol v2, ENC-3). With `required: true` an
+     * uploaded plaintext operation that carries data is refused non-retriably
+     * (`PLAINTEXT_REJECTED`), unless `allowPlaintextMigration` opens a migration window.
+     * Encrypted operations (envelope v2) are always stored opaquely, never transformed.
+     */
+    encryption?: {
+        required: boolean;
+        allowPlaintextMigration?: boolean;
+    };
+    /**
+     * Time a new connection has to send its handshake, in ms. Defaults to 10 seconds;
+     * 0 disables the deadline.
+     */
+    handshakeTimeoutMs?: number;
+    /**
+     * Bytes that may wait unsent for one client (WebSocket send buffer, or the queue of
+     * an HTTP long-poll client that stopped polling) before it is disconnected as a slow
+     * consumer. Defaults to 32 MiB; 0 disables the ceiling. The delivery stream pauses
+     * well before this (`deliveryHighWaterBytes`).
+     */
+    maxBufferedBytes?: number;
+    /**
+     * Queued outbound bytes above which a client's delivery stream pauses until the
+     * client drains them (backpressure). Defaults to 1 MiB.
+     */
+    deliveryHighWaterBytes?: number;
+    /**
+     * WebSocket permessage-deflate compression. `true` (the default) compresses messages
+     * of 1 KiB or more without keeping a compression context between messages, which
+     * cuts sync payloads several-fold on 2G/3G links at a bounded memory cost per
+     * connection. `false` disables it; an object is passed to `ws` as is.
+     */
+    perMessageDeflate?: boolean | Record<string, unknown>;
     /** Maximum operations per sync batch. Defaults to 100. */
     batchSize?: number;
     /**
@@ -878,10 +1846,13 @@ interface KoraSyncServerConfig {
         max: number;
     };
     /**
-     * Transform accepted legacy client operations into the server schema version
-     * before validation and materialization. Required when
-     * `supportedSchemaVersions.min` is lower than `schemaVersion` and operation
-     * shapes changed across versions.
+     * Schema transforms from older client schema versions to the server schema version.
+     * Required when `supportedSchemaVersions.min` is lower than `schemaVersion` and
+     * operation shapes changed across versions. They run at fold time (RT-84): every
+     * operation is stored and delivered exactly as uploaded; authorization, validators
+     * and the store's fold use its transformed view. The server hands this list to its
+     * store (`setOperationTransforms`); pass it to `store.setSchema` too to fold with it
+     * from the first start. Transforms must be pure and deterministic.
      */
     operationTransforms?: OperationTransform[];
     /** WebSocket path (standalone mode). Defaults to '/'. */
@@ -909,6 +1880,32 @@ interface KoraSyncServerConfig {
      * `@korajs/store` derives both from a `ContentAddressedBlobStore`.
      */
     persistBlobChunk?: (hash: string, bytes: Uint8Array) => Promise<void> | void;
+    /**
+     * Limits on the blob side channel. `maxChunkBytes` (default 1 MiB) caps one
+     * pushed chunk or manifest, `maxBytesPerSession` (default 256 MiB) caps the total
+     * a session may push for central persistence, `maxPendingRequestsPerSession`
+     * (default 256) and `pendingRequestTtlMs` (default 60s) bound the chunk requests
+     * the relay remembers per session.
+     */
+    blobLimits?: {
+        maxChunkBytes?: number;
+        maxBytesPerSession?: number;
+        maxPendingRequestsPerSession?: number;
+        pendingRequestTtlMs?: number;
+        /**
+         * Blob chunk requests one session may make per minute, a budget separate from
+         * `maxOpsPerMinute` (one request per chunk, so a large blob makes many). Over
+         * it, a request is answered with a retriable `throttled` response the client
+         * backs off on (RT-24). Defaults to 6000.
+         */
+        maxRequestsPerMinute?: number;
+    };
+    /**
+     * Largest WebSocket message the standalone server (and `createProductionServer`)
+     * accepts, in bytes. Larger frames are refused by the socket layer before they are
+     * buffered. Defaults to 32 MiB (the `ws` library default is 100 MiB).
+     */
+    maxMessageBytes?: number;
     /**
      * Maximum serialized byte size of a single client operation accepted at sync
      * ingest. Operations larger than this are rejected before materialization.
@@ -917,11 +1914,64 @@ interface KoraSyncServerConfig {
      */
     maxOperationBytes?: number;
     /**
-     * Maximum operations accepted per connected client per minute (sliding window).
-     * Operations beyond the limit are rejected until the window resets. Defaults to
-     * 600. Set once here to enforce one rate cap across every connected client.
+     * Maximum operations accepted per device node per minute (fixed window). The budget
+     * belongs to the node id (bound to its principal when auth is configured), not to
+     * the connection, so reconnecting does not reset it (SRV-6). Operations beyond the
+     * limit get a retriable `RATE_LIMIT` until the window resets. Defaults to 600.
      */
     maxOpsPerMinute?: number;
+    /**
+     * Maximum operations accepted per authenticated principal per minute, across all of
+     * its device nodes, on top of the per-node `maxOpsPerMinute`. Without it a user could
+     * multiply the per-node budget by minting node ids. Keyed by the provider's user id;
+     * anonymous and unauthenticated sessions (no stable principal) have only the per-node
+     * budget. Defaults to 4 x `maxOpsPerMinute` (2400), so one busy device never meets it
+     * and a user's devices share it. `0` disables the per-user budget.
+     */
+    maxOpsPerMinutePerUser?: number;
+    /**
+     * Largest operation batch accepted from a client in one message. A larger batch is
+     * refused whole with `BATCH_TOO_LARGE` before the server decodes it or reads the
+     * store, so one message cannot buy unbounded work. Defaults to 1000 (the client
+     * sends batches of 100 by default).
+     */
+    maxOpsPerBatch?: number;
+    /**
+     * Accept anonymous devices whose node claim predates confirmed claims (RT-21):
+     * nodes whose operation history predates node claims (a database written by a
+     * beta.12 or older server, which recorded no claims; RT-91), nodes held by the
+     * pre-release shared anonymous owner, and provisional claims that expired without
+     * the device ever confirming its node token (beta.12 and older clients have no
+     * token support). Accepted with a deprecation warning and re-issued a token.
+     * Defaults to `true` for 1.0.0-beta.13; the default flips to `false` in the next
+     * release, after which such devices rotate to a fresh node id instead (beta.12
+     * clients cannot rotate and stay refused).
+     *
+     * With `MixedAuthProvider`, a node with pre-claims history may also be a signed-in
+     * user's beta.12 device: an anonymous device can take such a node, as it could on
+     * beta.12. Set this to `false` if that matters more than keeping anonymous beta.12
+     * devices syncing.
+     */
+    allowLegacyAnonymousClaims?: boolean;
+    /**
+     * How long an anonymous device's provisional node claim may stay unconfirmed and
+     * still be re-issued to a device that presents no token (a handshake response lost
+     * in transit), in milliseconds (RT-21). Defaults to 24 hours.
+     */
+    anonymousClaimTtlMs?: number;
+    /**
+     * How often every live session's credential is re-validated with the auth
+     * provider, in milliseconds (RT-18). A revocation persisted by another server
+     * instance ends the session here within this interval. Defaults to 30 seconds; 0
+     * disables it (sessions then end only through this process's `onRevoke` feed,
+     * `terminateSessions`, or credential expiry).
+     */
+    sessionRevalidationIntervalMs?: number;
+    /**
+     * How long an HTTP long-poll session may go without any request before the server
+     * closes it, in milliseconds. Defaults to 2 minutes; 0 disables expiry.
+     */
+    httpSessionIdleTimeoutMs?: number;
     /**
      * Adjudicate untrusted client operations before they become authoritative.
      *
@@ -937,12 +1987,25 @@ interface KoraSyncServerConfig {
 }
 /**
  * Request envelope for the server-side HTTP sync endpoint.
+ *
+ * Map it from your HTTP framework: `sessionId` from the `x-kora-session` header and
+ * `authorization` from the `Authorization` header, on every request.
  */
 interface HttpSyncRequest {
-    /** Stable client identifier for binding HTTP requests to a server session */
-    clientId: string;
     /** HTTP method */
     method: 'GET' | 'POST';
+    /**
+     * The server-issued session id (`x-kora-session` request header). Absent only on
+     * the POST that opens a session (the handshake); the response to that POST
+     * carries the new id in its `x-kora-session` header. Never chosen by the client.
+     */
+    sessionId?: string;
+    /**
+     * The raw `Authorization` header (`Bearer <token>`). With an auth provider
+     * configured, EVERY request is authenticated and must resolve to the same
+     * principal and device as the session it names (RT-2).
+     */
+    authorization?: string;
     /** Optional raw request payload for POST */
     body?: string | Uint8Array;
     /** Value of the Content-Type header for POST payloads */
@@ -955,7 +2018,7 @@ interface HttpSyncRequest {
  */
 interface HttpSyncResponse {
     /** HTTP status code */
-    status: 200 | 202 | 204 | 304 | 400 | 405 | 410;
+    status: 200 | 202 | 204 | 304 | 400 | 401 | 403 | 404 | 405 | 410;
     /** Optional raw response payload */
     body?: string | Uint8Array;
     /** Optional response headers */
@@ -1002,6 +2065,20 @@ interface ServerStatus {
     errorCount: number;
 }
 
+/**
+ * Which reverse proxies in front of the server are trusted to report the client
+ * address in `X-Forwarded-For`.
+ *
+ * - `number`: trust that many hops, counting the socket peer as the first. `1` means
+ *   "one proxy (for example a load balancer) sits directly in front of the server".
+ * - `string[]`: trust peers whose address is in one of these IPs or CIDR ranges
+ *   (IPv4 and IPv6, for example `['10.0.0.0/8', '::1']`).
+ *
+ * When unset, `X-Forwarded-For` is ignored and the socket address is the client
+ * address, so a directly connected client cannot choose its own address.
+ */
+type TrustProxySetting = number | string[];
+
 interface HttpPollResponse {
     status: 200 | 204 | 304 | 410;
     body?: string | Uint8Array;
@@ -1021,56 +2098,104 @@ declare class HttpServerTransport implements ServerTransport {
     private connected;
     private nextSequence;
     private readonly queue;
-    constructor(serializer: MessageSerializer);
+    private queuedBytes;
+    private readonly maxQueuedBytes;
+    /**
+     * @param serializer - Message serializer
+     * @param options - `maxQueuedBytes`: close the session once this many bytes wait
+     *   unpolled (default 32 MiB; 0 disables the ceiling)
+     */
+    constructor(serializer: MessageSerializer, options?: {
+        maxQueuedBytes?: number;
+    });
     send(message: _korajs_sync.SyncMessage): void;
+    /** Bytes queued for the client and not yet polled (delivery-stream backpressure). */
+    bufferedAmount(): number;
     onMessage(handler: ServerMessageHandler): void;
     onClose(handler: ServerCloseHandler): void;
     onError(handler: ServerErrorHandler): void;
     isConnected(): boolean;
+    /**
+     * Close the session. Messages already queued (typically the final error that
+     * explains the close, for example a refused handshake) stay pollable, so a
+     * long-polling client learns why, exactly as a WebSocket client receives the error
+     * frame before the close; once drained, polls answer 410.
+     */
     close(code?: number, reason?: string): void;
+    /** True while messages queued before the close are still waiting to be polled. */
+    hasPending(): boolean;
     receive(payload: string | Uint8Array): void;
     poll(ifNoneMatch?: string): HttpPollResponse;
     private makeEtag;
 }
 
-/**
- * Minimal interface for a ws.WebSocket instance.
- * Allows dependency injection for testing without importing ws directly.
- */
-interface WsWebSocket {
-    readyState: number;
-    send(data: string | Uint8Array, callback?: (err?: Error) => void): void;
-    close(code?: number, reason?: string): void;
-    on(event: string, listener: (...args: unknown[]) => void): void;
-    removeAllListeners(): void;
+/** Outcome of one key-service message. */
+interface KeyServiceOutcome {
+    response: EncryptionKeyResponseMessage;
+    /** The record written, when the message was a successful write (to push to siblings). */
+    written: WrappedKeyRecord | null;
 }
 /**
- * Options for WsServerTransport.
+ * The sync server's key service (ENC-1, decision D4b). Stores each owner's wrapped key
+ * record and serves it back. It never sees a passphrase or a data key: a record is
+ * salt, KDF parameters, AES-GCM-wrapped data keys, key ids and versions.
+ *
+ * Rules it enforces:
+ * - **Owner from the session only.** The owner is the session's authenticated
+ *   principal (or the shared anonymous owner on a server without auth); a message
+ *   cannot name a user, so no session reads or writes another user's record.
+ * - **Compare-and-set.** A write names the revision it replaces; a concurrent write
+ *   loses with `conflict` and the current record, so two devices that both create a
+ *   first key converge on one.
+ * - **History is append-only.** A write must raise the revision, keep the ring id and
+ *   every key version (same key id), so no device can make old operations unreadable
+ *   for the others. A first write (or a re-upload after the record was lost) keeps the
+ *   revision it carries, since devices refuse revisions below the one they accepted.
+ * - **Lost records are visible.** A fetch with no record reports key ids of the owner's
+ *   stored encrypted operations, so a new device waits for one holding the ring.
+ *
+ * It cannot check the record MAC or that wraps open (only a holder of the ring's master
+ * key can): devices authenticate every record themselves and act on nothing else. A
+ * principal can still overwrite its own record with garbage; devices refuse it and
+ * keep their keys.
  */
-interface WsServerTransportOptions {
-    /** Message serializer. Defaults to JsonMessageSerializer. */
-    serializer?: MessageSerializer;
+declare class EncryptionKeyService {
+    private readonly store;
+    constructor(store: ServerStore);
+    /** Whether the store can persist key records (all built-in stores can). */
+    isSupported(): boolean;
+    /**
+     * Answer one key-service message for `owner`.
+     *
+     * @param owner - The session's owner key, or null when the session may not hold keys
+     * @param message - A request or a write
+     */
+    handle(owner: string | null, message: EncryptionKeyRequestMessage | EncryptionKeyPutMessage): Promise<KeyServiceOutcome>;
+    /**
+     * Key ids of the owner's stored encrypted operations (a sample). Reported only while
+     * no record exists: then non-empty means the record was lost, and a new device must
+     * wait for one that holds the ring instead of starting another (RT-104).
+     */
+    private knownKeyIds;
+    private read;
 }
-/**
- * Server-side transport wrapping a ws.WebSocket connection.
- * Created for each incoming client connection.
- */
-declare class WsServerTransport implements ServerTransport {
-    private readonly ws;
-    private readonly serializer;
-    private messageHandler;
-    private closeHandler;
-    private errorHandler;
-    constructor(ws: WsWebSocket, options?: WsServerTransportOptions);
-    send(message: SyncMessage): void;
-    onMessage(handler: ServerMessageHandler): void;
-    onClose(handler: ServerCloseHandler): void;
-    onError(handler: ServerErrorHandler): void;
-    isConnected(): boolean;
-    close(code?: number, reason?: string): void;
-    private setupListeners;
+
+/** What a session charges uploaded operations to. */
+interface IngestRateLimiter {
+    /** Units allowed per window (the tightest applicable budget). */
+    readonly limit: number;
+    /** Charge `count` units; false when a budget is exceeded (the units are refused). */
+    allow(count?: number): boolean;
+    /** Milliseconds until a refused unit may be retried. */
+    retryAfterMs(): number;
 }
 
+/**
+ * Session-ending error codes, all retriable. `AUTH_REVOKED` / `AUTH_EXPIRED`: the
+ * client refreshes its credential and re-handshakes. `SCOPE_CHANGED` (RT-26): the
+ * principal's grant changed; the client simply reconnects and gets the new scope.
+ */
+type SessionTerminationCode = 'AUTH_REVOKED' | 'AUTH_EXPIRED' | 'SCOPE_CHANGED';
 /**
  * Possible states for a client session.
  */
@@ -1086,7 +2211,7 @@ type AwarenessRelayCallback = (sourceSessionId: string, message: AwarenessUpdate
 /**
  * Callback invoked when a session receives a Yjs doc channel update to relay.
  */
-type YjsDocRelayCallback = (sourceSessionId: string, message: YjsDocUpdateMessage) => void;
+type YjsDocRelayCallback = (sourceSessionId: string, message: YjsDocUpdateMessage, storedRecord: MaterializedRecord | null) => void;
 /**
  * Callback invoked when a session receives a blob chunk request to route.
  */
@@ -1128,7 +2253,7 @@ interface ClientSessionOptions {
         min: number;
         max: number;
     };
-    /** Transform accepted legacy operations into the server schema before validation. */
+    /** Schema transforms: judged views of older operations (transforms at fold time, RT-84). */
     operationTransforms?: OperationTransform[];
     /** Called when this session has operations to relay to other sessions */
     onRelay?: RelayCallback;
@@ -1140,8 +2265,24 @@ interface ClientSessionOptions {
     onBlobChunkRequest?: BlobChunkRequestCallback;
     /** Called when this session receives a blob chunk response to route back */
     onBlobChunkResponse?: BlobChunkResponseCallback;
+    /** The key service storing wrapped encryption key records (ENC-1). */
+    encryptionKeys?: EncryptionKeyService;
+    /** Called after this session wrote a key record, to push it to the owner's other sessions. */
+    onEncryptionKeyWritten?: (sessionId: string, owner: string, keyring: string, record: WrappedKeyRecord) => void;
+    /** Key-service messages allowed per session per minute. Defaults to 60. */
+    maxKeyRequestsPerMinute?: number;
     /** Persist a client-uploaded blob chunk centrally (keyed by content hash) */
     persistBlobChunk?: PersistBlobChunk;
+    /**
+     * Called once the session completes an accepted handshake and reaches streaming.
+     * Side channels (Yjs doc, blob and awareness relays) register the session here,
+     * never at connect time, so an unauthenticated connection is never on a relay.
+     */
+    onReady?: (sessionId: string) => void;
+    /** Largest single blob chunk this session may push. Defaults to 1 MiB. */
+    maxBlobChunkBytes?: number;
+    /** Total blob bytes this session may push. Defaults to 256 MiB. */
+    maxBlobBytesPerSession?: number;
     /** Called when this session closes */
     onClose?: (sessionId: string) => void;
     /**
@@ -1161,6 +2302,18 @@ interface ClientSessionOptions {
     maxOperationBytes?: number;
     /** Maximum operations accepted per minute for this session. Defaults to 600. */
     maxOpsPerMinute?: number;
+    /**
+     * Blob chunk requests accepted per minute, separate from the operation budget
+     * (RT-24). Defaults to 6000.
+     */
+    maxBlobRequestsPerMinute?: number;
+    /** Length of the blob request window in ms. One minute; shorter only in tests. */
+    blobRequestWindowMs?: number;
+    /**
+     * Largest operation batch accepted in one message. A larger batch is refused whole
+     * (`BATCH_TOO_LARGE`) before it is decoded or the store is read. Defaults to 1000.
+     */
+    maxOpsPerBatch?: number;
     /**
      * Adjudicate untrusted client operations before materialization. When present,
      * each incoming operation is passed to this validator; a `reject` decision
@@ -1169,6 +2322,67 @@ interface ClientSessionOptions {
     validateOperation?: OperationValidator;
     /** Trusted data-plane context handed to the validator (read state, author derived ops). */
     koraContext?: ProductionHttpRouteContext;
+    /**
+     * Blob reference authority (RT-11): decides which content hashes this session may
+     * reference in blob fields and records the bytes it pushes. Without it, blob
+     * references are not checked at ingest.
+     */
+    blobAccess?: BlobAccessIndex;
+    /** See `KoraSyncServerConfig.allowLegacyAnonymousClaims` (RT-21). Defaults to true. */
+    allowLegacyAnonymousClaims?: boolean;
+    /** See `KoraSyncServerConfig.anonymousClaimTtlMs` (RT-21). Defaults to 24 hours. */
+    anonymousClaimTtlMs?: number;
+    /**
+     * True when another live session (not `exceptSessionId`) is connected as `nodeId`.
+     * A provisional anonymous claim is never re-issued away from a connected device.
+     */
+    isNodeLive?: (nodeId: string, exceptSessionId: string) => boolean;
+    /**
+     * Time a new connection has to deliver its handshake, in ms (SRV-6). A connection
+     * that sends none is closed with `HANDSHAKE_TIMEOUT`. Defaults to 10 seconds; 0
+     * disables the deadline.
+     */
+    handshakeTimeoutMs?: number;
+    /**
+     * Queued outbound bytes above which the delivery stream pauses until the client
+     * drains its socket (transports that report `bufferedAmount`). Defaults to 1 MiB.
+     */
+    deliveryHighWaterBytes?: number;
+    /**
+     * The ingest rate limiter for a node, shared across that node's sessions so a
+     * reconnect does not reset it (SRV-6). Called once the handshake binds the node,
+     * with the authenticated principal's user id (null for anonymous and
+     * unauthenticated sessions) so a per-user budget can be layered on top: a user
+     * minting node ids must not multiply the per-node budget.
+     * Without it the session keeps a private limiter.
+     */
+    rateLimiterFor?: (nodeId: string, principal: string | null) => IngestRateLimiter;
+    /**
+     * Interval of the application-level heartbeat sent to clients that advertised
+     * support for it, in ms (LMS #12). The handshake response tells the client the
+     * interval so it can declare the connection dead after missing two. 0 disables it.
+     */
+    appHeartbeatIntervalMs?: number;
+    /**
+     * Node ids whose operations this server authors (protocol v2). Sent to clients in
+     * the handshake response (`authoritativeNodeIds`); only operations from these nodes
+     * may carry server-authored metadata (`fieldVersions`, `foldState`). Defaults to the
+     * ids the store folds with (`ServerStore.getAuthoritativeNodeIds`), which is what
+     * `KoraSyncServer` always passes. Scope-entry operations (`kora:scope-entry`) are not
+     * listed: they carry the server's fold state and are joined, never folded as writes.
+     */
+    authoritativeNodeIds?: readonly string[];
+    /**
+     * End-to-end encryption policy (protocol v2, ENC-3). With `required`, every uploaded
+     * data-bearing operation must carry the encryption envelope; a plaintext one is
+     * refused non-retriably (`PLAINTEXT_REJECTED`), unless `allowPlaintextMigration` is
+     * set for a migration window. Without it, the server stores whatever it receives
+     * (envelope operations always opaquely).
+     */
+    encryption?: {
+        required: boolean;
+        allowPlaintextMigration?: boolean;
+    };
 }
 /**
  * Handles the sync protocol for a single connected client.
@@ -1188,6 +2402,29 @@ declare class ClientSession {
     private state;
     private clientNodeId;
     private authContext;
+    /**
+     * The context the auth provider returned, kept apart from {@link authContext}
+     * (which an unauthenticated session also gets, keyed by node id) so revocation
+     * only ever matches a verified principal.
+     */
+    private principal;
+    /** Closes the session when its credential expires (AUTH-11). */
+    private expiryTimer;
+    /** Revocations that arrived while the handshake was still authenticating. */
+    private readonly pendingRevocations;
+    /** Node token issued by this handshake's first anonymous claim, sent once in the response (RT-12). */
+    private issuedNodeToken;
+    /** The node-claim owner this session holds its node id under (userId, or an anonymous device key). */
+    private nodeOwnerKey;
+    /** A provisional anonymous claim awaiting the device's confirmation (RT-21). */
+    private pendingNodeClaim;
+    private readonly allowLegacyAnonymousClaims;
+    private readonly anonymousClaimTtlMs;
+    private readonly isNodeLive;
+    /** The credential presented at handshake, kept to re-validate the session (RT-18). */
+    private credential;
+    /** The scope the client asked for at handshake, kept to re-resolve scopes (RT-26). */
+    private handshakeScope;
     private syncQuerySubsets;
     private scopeExitPolicy;
     private resumeDeltaCursor;
@@ -1200,23 +2437,70 @@ declare class ClientSession {
     private clientDeliveryWatermark;
     /**
      * The highest delivery sequence this client has ACKNOWLEDGED (its confirmed
-     * watermark, as reported in acks). Incremental streaming pushes resume from here, not
-     * from the highest sequence sent, so a dropped or unapplied batch is always
-     * re-included by the next push (which re-scans from the acknowledged position). This
-     * is what makes streaming recovery independent of any bounded retransmit buffer: there
-     * is no sent-but-unacked window that a buffer eviction could strand. Seeded from the
-     * client's reported watermark at handshake.
+     * watermark, as reported in acks). A retransmission rewinds the send cursor to here,
+     * so a dropped or unapplied batch is always re-included by a re-scan from the
+     * acknowledged position: recovery never depends on a bounded retransmit buffer.
+     * Seeded from the client's reported watermark at handshake.
      */
     private lastAckedDeliverySeq;
     /**
-     * Timestamp of the last delivery-stream send attempt. Periodic retransmission uses
-     * this as its stale window so a slow client does not receive duplicate full-stream
-     * batches every server tick while the first batch is still being applied.
+     * The delivery send cursor (SRV-3): the max of the last batch sent. Live pushes
+     * chain from it (base = lastSent), so each operation goes out once per retransmit
+     * epoch instead of the whole unacknowledged backlog on every write. Invariant:
+     * lastAcked <= lastSent. It rewinds to lastAcked only when the outstanding delivery
+     * went unacknowledged for the (backed-off) stale window.
+     */
+    private lastSentDeliverySeq;
+    /** The highest batch max ever sent to this client (acks are capped by it). */
+    private highestSentDeliverySeq;
+    /**
+     * Own-node operations at or below this delivery sequence are streamed to this
+     * client; above it they are skipped (it uploaded them itself). Set at handshake: a
+     * full resync (watermark 0) recovers the client's own history up to the frontier
+     * at that moment; a resume excludes all of them.
      */
-    private lastDeliveryPushAttemptAtMs;
-    private outstandingDelivery;
-    /** Serializes incremental delivery pushes so their batches never interleave. */
+    private ownOperationsIncludedThrough;
+    /** When the delivery last made progress (an ack advanced, or a fresh send/rewind). */
+    private lastDeliveryProgressAtMs;
+    /** Consecutive rewinds without acknowledgment progress (drives the backoff, LMS #12). */
+    private deliveryRewinds;
+    /**
+     * Sent, not yet acknowledged delivery batches in send order (their max and send
+     * time), for round-trip samples. `resent` marks a re-sent range, which yields no
+     * sample (Karn's rule: its ack cannot be matched to one transmission).
+     */
+    private readonly unackedBatches;
+    private smoothedRttMs;
+    private rttVarianceMs;
+    /**
+     * Retransmit timeout of the delivery stream (RFC 6298 style: smoothed round trip
+     * plus four deviations, floored). An outstanding delivery with no acknowledgment
+     * progress for this long (doubled per consecutive re-send) is re-sent from the
+     * acknowledged position. Round trips include the client's apply time, so a slow
+     * device earns a longer timeout instead of spurious re-sends.
+     */
+    private retransmitTimeoutMs;
+    private retransmitTimer;
+    /** A delivery push is queued but not started: further wake-ups coalesce into it. */
+    private deliveryPushQueued;
+    /** Serializes delivery pushes so their batches never interleave. */
     private deliveryPushChain;
+    /**
+     * Records prefetched for the delivery chunk being filtered (LMS #11: one batched
+     * lookup per collection per chunk instead of one query per operation). Keyed
+     * `collection\u0000id`; null marks a record known to be absent. Only set while a
+     * chunk is filtered.
+     */
+    private recordLookupCache;
+    private readonly deliveryHighWaterBytes;
+    private readonly handshakeTimeoutMs;
+    private handshakeTimer;
+    private handshakeReceived;
+    private readonly rateLimiterFor;
+    private readonly appHeartbeatIntervalMs;
+    private appHeartbeatTimer;
+    /** Last time anything was sent to the client (a heartbeat is skipped when recent). */
+    private lastClientSendAtMs;
     /**
      * Relay batches sent to this client but not yet acknowledged, keyed by messageId.
      * The client acks every operation-batch it applies; on ack the entry is cleared.
@@ -1243,15 +2527,55 @@ declare class ClientSession {
     private readonly onYjsDocUpdate;
     private readonly onBlobChunkRequest;
     private readonly onBlobChunkResponse;
+    private readonly encryptionKeys;
+    private readonly onEncryptionKeyWritten;
+    /** Budget of key-service messages (each may cost a store read and write). */
+    private readonly keyRateLimiter;
     private readonly persistBlobChunk;
     private readonly onClose;
+    private readonly onReady;
+    private readonly maxBlobChunkBytes;
+    private readonly maxBlobBytesPerSession;
+    private blobBytesPushed;
     private readonly onOrphanedRelays;
     private readonly takeOrphanedRelays;
     private readonly maxOperationBytes;
     private readonly maxOpsPerMinute;
-    private readonly rateLimiter;
+    private readonly maxOpsPerBatch;
+    private rateLimiter;
+    /** Separate budget for blob chunk requests (RT-24). */
+    private readonly blobRateLimiter;
+    /** Operations refused by the rate limiter (RT-6), for diagnostics. */
+    private rateLimitedOperations;
+    /** Batches refused whole for exceeding {@link maxOpsPerBatch} (RT-6). */
+    private rejectedBatches;
+    /** Blob chunk requests answered "not held" because the session was over budget (RT-17). */
+    private rateLimitedBlobRequests;
+    /**
+     * The client advertised the `sequenceReservation` handshake capability (RT-37): it
+     * reserves sequence numbers in-transaction, so a second operation under a held
+     * (node, sequence) is refused with SEQUENCE_CONFLICT. False for a legacy client
+     * (Kora <= beta.12), whose duplicate pairs are stored instead.
+     */
+    private sequenceReservation;
+    /** Legacy duplicate pairs this session stored (RT-37), for diagnostics. */
+    private legacySequencePairs;
+    /** Protocol version the client declared in its handshake (1 when absent). */
+    private clientProtocolVersion;
+    private readonly authoritativeNodeIds;
+    /** Hash version an undeclared uploaded id was verified as (RT-64), by operation object. */
+    private readonly matchedHashVersions;
+    /** Uploads whose data is stored as the beta.12 writer held it (RT-71). */
+    private readonly restoredLegacyData;
+    /** Operations accepted with an unverified legacy (beta.12) id (RT-71). */
+    private unverifiedLegacyOperations;
+    private forgedDuplicates;
+    private readonly encryptionPolicy;
+    /** Uploaded operations refused because their id is not their content hash (CORE-1). */
+    private invalidOperationIds;
     private readonly validateOperation;
     private readonly koraContext;
+    private readonly blobAccess;
     constructor(options: ClientSessionOptions);
     /**
      * Start handling messages from the client transport.
@@ -1263,9 +2587,13 @@ declare class ClientSession {
      */
     relayOperations(operations: Operation[]): void;
     /**
-     * Push newly-available in-scope operations to a delivery-watermark client, resuming
-     * from the highest delivery sequence already sent. Pushes are serialized so their
-     * batches never interleave (which would break the base/max chain).
+     * Push newly-available in-scope operations to a delivery-watermark client, chained
+     * from the send cursor (SRV-3): only what was not sent yet goes out. `rewind`
+     * first moves the cursor back to the acknowledged position (a retransmission), and
+     * `initial` is the handshake stream (it always ends in a final batch, even an empty
+     * one, so the client completes initial sync). Pushes are serialized so their batches
+     * never interleave (which would break the base/max chain); wake-ups that arrive
+     * while one is queued coalesce into it.
      */
     private pushDeliveryStream;
     private relayVisibleOperations;
@@ -1275,18 +2603,63 @@ declare class ClientSession {
      * Retransmit relay batches this client has not acknowledged within `staleMs`.
      * Called on a periodic tick by the server (and directly by tests). Redelivering an
      * already-applied op is harmless: the client dedups by content-addressed id.
+     *
+     * For a delivery-watermark client it re-sends an outstanding (sent, unacknowledged)
+     * delivery from the acknowledged position, under the same backed-off window as the
+     * retransmit timer; `staleMs` 0 re-sends at once (a deterministic trigger for tests).
      */
     retransmitPendingRelays(staleMs?: number): void;
     /**
      * Wake the durable delivery stream for clients that negotiated delivery
-     * watermarks. This is used both for dropped watermark batches and for operations
-     * appended by another server/store instance: the session always scans from its
-     * own acknowledged cursor and applies its visibility filter before sending.
+     * watermarks: for operations appended by another server/store instance (sent from
+     * the send cursor), and for a delivery that went unacknowledged (re-sent from the
+     * acknowledged position once it made no progress for `staleMs`, backed off while it
+     * stays stuck). `staleMs` 0 re-sends at once.
+     *
+     * @param staleMs - Base stale window before an unacknowledged delivery is re-sent
+     * @param options - `serverFrontier`: the store's max delivery sequence, when known;
+     *   `trackStall`: emit `sync:delivery-stalled` after repeated re-sends
      */
     pushDeliveryStreamIfSupported(staleMs?: number, options?: {
         trackStall?: boolean;
         serverFrontier?: number;
     }): void;
+    /** Book-keeping for one sent delivery batch ending at `max`. */
+    private recordDeliverySent;
+    /**
+     * A delivery acknowledgment: advance the confirmed watermark (a retransmission
+     * rewinds to it), take a round-trip sample, and reset the backoff. The watermark
+     * never passes what was sent: a client cannot acknowledge what it never received.
+     */
+    private noteDeliveryAcked;
+    /** Fold one round-trip sample into the retransmit timeout (RFC 6298). */
+    private recordRoundTrip;
+    /**
+     * The current retransmit window: the timeout, which each re-send doubled (up to
+     * five minutes) and which only a fresh round-trip sample brings back down.
+     */
+    private retransmitWindowMs;
+    /**
+     * (Re)arm the retransmit timer for the outstanding delivery: it fires once no
+     * acknowledgment progress was made for the retransmit window.
+     */
+    private armRetransmitTimer;
+    /**
+     * No acknowledgment progress for the retransmit window: re-send from the
+     * acknowledged position (the batch was dropped, or the client could not apply it),
+     * unless the socket is still draining what was sent.
+     */
+    private onRetransmitTimeout;
+    /** Re-send the outstanding delivery from the acknowledged position. */
+    private rewindDelivery;
+    /** Bytes queued on the transport and not yet written to the network (0 if unknown). */
+    private transportBufferedAmount;
+    /**
+     * Wait until the transport's queued bytes drop to the high-water mark (SRV-5
+     * backpressure), so a slow client never makes the server buffer the whole stream
+     * in socket memory. Resolves early when the session closes.
+     */
+    private waitForSendWindow;
     /**
      * Close this session.
      */
@@ -1297,11 +2670,95 @@ declare class ClientSession {
      */
     private flushOrphanedRelays;
     close(reason?: string): void;
+    /**
+     * End this session if its verified principal matches a credential revocation
+     * (AUTH-11): send a retriable `code` error so the client refreshes and
+     * re-handshakes, then close. A session still authenticating remembers the
+     * revocation and applies it as soon as its principal is known.
+     *
+     * @returns True when the session was closed by this call
+     */
+    terminateIfMatches(filter: SessionRevocation, code: SessionTerminationCode): boolean;
+    /**
+     * Re-authenticate the credential that opened this session (RT-18). The session is
+     * ended with a retriable `AUTH_REVOKED` (`AUTH_EXPIRED` once past its expiry) when
+     * the provider now refuses the credential or resolves it to another principal, for
+     * example after a revocation persisted by another server instance.
+     *
+     * @returns `'terminated'` when this call ended the session, `'error'` when the
+     *   provider threw (nothing is ended; the caller retries later), else `'valid'`
+     */
+    revalidateCredential(): Promise<'valid' | 'terminated' | 'error'>;
+    /**
+     * True when `context` (a fresh authentication of this session's principal)
+     * resolves to download or upload scopes other than the ones this session holds.
+     * A grant that no longer resolves at all counts as changed.
+     */
+    private scopesChangedFor;
+    /**
+     * End this session because an admin released its node id (RT-5). Retriable: a
+     * client that still owns the node simply reconnects and claims it again.
+     */
+    endForNodeRelease(): void;
+    private terminate;
+    /** Clear every timer this session owns (expiry, handshake deadline, heartbeat). */
+    private clearSessionTimers;
+    /**
+     * Start the application-level heartbeat for a client that advertised support for it
+     * (LMS #12): a `heartbeat` message whenever nothing else was sent for an interval,
+     * so the client can detect a dead connection it cannot see (browsers never surface
+     * WebSocket pings).
+     */
+    private startAppHeartbeat;
+    /**
+     * Arm the expiry timer from `AuthContext.expiresAt`. Returns false when the
+     * credential has already expired (the caller refuses the handshake).
+     */
+    private armExpiryTimer;
+    private clearExpiryTimer;
     getState(): SessionState;
     getSessionId(): string;
     getClientNodeId(): string | null;
     getAuthContext(): AuthContext | null;
+    /**
+     * The principal the auth provider verified at handshake, or null before (or
+     * without) authentication. Unlike {@link getAuthContext}, never a context
+     * synthesized for an unauthenticated session.
+     */
+    getPrincipal(): AuthContext | null;
     isStreaming(): boolean;
+    /**
+     * Ingest refusals that happen before any store work (RT-6): operations refused by
+     * the per-minute rate limiter and batches refused for exceeding the per-batch cap.
+     */
+    getIngestLimitCounts(): {
+        rateLimitedOperations: number;
+        rejectedBatches: number;
+        rateLimitedBlobRequests: number;
+    };
+    /**
+     * True when the client did not advertise the `sequenceReservation` capability
+     * (RT-37): a legacy client (Kora <= beta.12) that may give two operations one
+     * sequence number. Such a pair is stored and delivered, never refused with
+     * SEQUENCE_CONFLICT. Meaningful once the handshake was accepted.
+     */
+    isLegacySequenceClient(): boolean;
+    /** Legacy duplicate (node, sequence) pairs this session stored (RT-37). */
+    getLegacySequencePairCount(): number;
+    /**
+     * True when a stored record is inside this session's download scope, so a side
+     * channel (for example a Yjs doc update) about it may be delivered here. A record
+     * not stored yet is judged by its id alone.
+     */
+    canReceiveRecord(collection: string, recordId: string, storedRecord: Record<string, unknown> | null): boolean;
+    /**
+     * A stable key for this session's download scope. Presence (awareness) is only
+     * relayed between sessions that share exactly the same key, so it never crosses a
+     * tenant boundary. Unscoped sessions share the key `"*"`.
+     */
+    /** This session's download scope, or undefined when it is unscoped. */
+    getDownlinkScopes(): ScopeMap | undefined;
+    getScopePartitionKey(): string;
     /**
      * Get the transport for this session.
      * Used by the awareness relay to send messages to this client.
@@ -1312,41 +2769,321 @@ declare class ClientSession {
     private sendToClient;
     private enqueueMessage;
     private handleMessageAsync;
+    /**
+     * The owner of this session's encryption key records (ENC-1), or null when it may
+     * hold none: the authenticated user, or on a server without auth the one shared
+     * anonymous owner. An anonymous principal of a mixed provider has no stable
+     * identity, so it holds no keys.
+     */
+    getEncryptionKeyOwner(): string | null;
+    /** Push a key record another session of the same owner wrote (rotation, new passphrase). */
+    pushEncryptionKeyRecord(keyring: string, record: WrappedKeyRecord): void;
+    private handleEncryptionKeyMessage;
     /**
      * Persist a client-uploaded blob chunk (or manifest) centrally. The bytes are
      * verified to hash to the declared hash before storing, so a corrupt or
      * mislabeled upload is rejected rather than served later as trusted content.
      */
     private handleBlobChunkPush;
+    /**
+     * Claim (or re-claim) a node id for an anonymous device (RT-12, RT-21).
+     *
+     * A device presenting a token holds the node when the claim is (or can become)
+     * `kora:anon-node:<hash(token)>`: its confirmed claim, a fresh claim, or its own
+     * provisional claim, which presenting the token confirms.
+     *
+     * A device presenting no token gets a fresh token and a PROVISIONAL claim, which it
+     * confirms by acknowledging the response with the token once saved (or by
+     * presenting it next time). Until then the claim may be re-issued to a device that
+     * again presents no token (the response was lost in transit), but only while no
+     * session is connected as that node and before the claim expires. Legacy claims
+     * (expired provisional ones, and nodes of the pre-release shared anonymous owner)
+     * are re-issued only with `allowLegacyAnonymousClaims`, with a deprecation warning.
+     */
+    private claimAnonymousNode;
+    /** The deprecation warning for an anonymous device adopted under a legacy claim (RT-21, RT-91). */
+    private warnLegacyAnonymousClaim;
+    /**
+     * The device proved it saved the node token issued by this handshake: make the
+     * provisional claim permanent (RT-21). A mismatched token is ignored.
+     */
+    private confirmNodeClaim;
+    /**
+     * The download scope references are authorized against (RT-11, RT-13), or
+     * undefined when they are not checked: without a real auth provider there is no
+     * tenant boundary to protect.
+     */
+    private referenceScopes;
+    /**
+     * Stable blob-ownership key of this session's principal: the user id, or for an
+     * anonymous device its node-claim owner (never shared by two anonymous devices).
+     */
+    getBlobOwnerKey(): string;
+    /**
+     * Partition key for peer-to-peer blob forwarding. Sessions with the same download
+     * scope share a tenant view, except anonymous devices: every anonymous session has
+     * the same grant but they are unrelated people, so each is its own partition.
+     */
+    getBlobPartitionKey(): string;
+    /** Authorize foreign-key targets and blob references of an untrusted write. */
+    private authorizeReferences;
     private handleMessageFailure;
     private handleHandshake;
+    /**
+     * The nodes whose operations after `fromDeliverySeq` this scoped session will
+     * receive, for the handshake vector (RT-7). Scans the delivery log without holding
+     * it (memory is O(nodes)), and judges each node only until one of its operations is
+     * visible, so most operations cost one scope comparison and no record read.
+     */
+    private collectVisibleNodeIds;
+    /**
+     * The version vector as committed in the store (SRV-4). A store shared by several
+     * instances reads it fresh; others serve their own (complete) vector.
+     */
+    private readServerVector;
+    /**
+     * Resolve this session's download and upload scopes from an auth context and the
+     * scope the client asked for at handshake. Side-effect free, so revalidation can
+     * recompute it and compare (RT-26). The legacy `scopes` contract remains shorthand
+     * for both directions.
+     */
+    private computeSessionScopes;
     private handleOperationBatch;
-    private transformForServerSchema;
-    private sendDelta;
     /**
-     * Send the gap-free server->client delivery stream, resuming just after
+     * For each delete of this session's node in an upload batch, the batch's later
+     * operations of the same node that name it as a causal parent: candidates for the
+     * author's own copies of its cascades and set-nulls (RT-69). Indexed by the delete's
+     * id, in the server's schema (field names as the server derives effects).
+     */
+    private indexAuthoredSideEffectCopies;
+    /**
+     * The referential effects of a delete that arrived again as a stored duplicate and
+     * are still undone (RT-73): effects the author covers later in this batch are
+     * deferred like a fresh delete's (derived after the batch unless a copy is stored);
+     * the rest are derived now. Derived ids are deterministic, so a concurrent retry or
+     * another instance stores the same operations.
+     *
+     * @returns The derived operations (to relay)
+     */
+    private resumeStoredDeleteEffects;
+    /**
+     * Derive the server's copy of each deferred side effect unless one of the author's
+     * copies is stored (applied or already held). A store with the batch lookup is asked
+     * again, so a copy stored by a concurrent session counts too.
+     */
+    private deriveUncoveredSideEffects;
+    /** {@link ServerStore.findStoredOperations} by id; empty without it or on a failed read. */
+    private findStoredOperationIds;
+    /**
+     * The operation as the server schema reads it (transforms at fold time, RT-84): the
+     * view authorization, validators, constraint checks and scope filters judge, and the
+     * one the server stores fold (core `operationSchemaView`, same transforms). Never
+     * stored: the store keeps the operation as uploaded. An envelope operation is opaque
+     * to the server (NEW-ENC-1) and judged as is; devices transform after decryption.
+     */
+    private schemaView;
+    /**
+     * Integrity checks on an uploaded operation before anything else judges it:
+     * - a version-2 plaintext id must be the content hash (`INVALID_OPERATION_ID`);
+     * - an unknown declared hash version is refused the same way;
+     * - with required encryption, a data-bearing plaintext operation is refused
+     *   (`PLAINTEXT_REJECTED`) unless the plaintext migration window is open.
+     *
+     * @returns null when the operation passes, or the refusal
+     */
+    private checkUploadIntegrity;
+    /**
+     * Whether an undeclared version-1 id that does not verify is accepted unverified
+     * (RT-71): only from a protocol-1 session (Kora <= beta.12), and only for the
+     * session's own node.
+     */
+    private acceptsUnverifiedLegacyId;
+    /** Log, count and emit an operation accepted with an unverified legacy id (RT-71). */
+    private reportUnverifiedLegacyOperation;
+    /** Operations this session accepted with an unverified legacy id (RT-71). */
+    getUnverifiedLegacyOperationCount(): number;
+    /**
+     * The operation as the server stores it: an undeclared plaintext id this server
+     * verified declares the version it matched (1, or 2 when the declaration was lost),
+     * so receivers verify it too (RT-64). An absent version is left only on ids nobody
+     * could verify (protocol-1 encrypted payloads, server-side transforms).
+     */
+    private declareVerifiedHashVersion;
+    /**
+     * True for a node id that is (or was) the server's own: the `kora:` namespace, the
+     * store's node id, and every id the server advertises or folds as authoritative
+     * (other instances, legacy server node ids, configured extras). No device may use one
+     * (RT-61), whether or not it has history yet.
+     */
+    private isServerAuthorNodeId;
+    /**
+     * The authoritative ids a handshake advertises (RT-75): only explicit ones (legacy
+     * server node ids, configured extras). Every `kora:server:` id is authoritative by
+     * prefix on every replica, and listing instance ids would make the list differ per
+     * instance and per start, which devices would have to treat as news.
+     */
+    /** The handshake's explicit revocations (RT-81), when the deployment has any. */
+    private advertisedRevocations;
+    private advertisedAuthoritativeNodeIds;
+    /** Node ids this server authors operations under (protocol v2 handshake response). */
+    private serverAuthoritativeNodeIds;
+    /**
+     * A protocol-1 client (Kora <= beta.12) is served for one release (beta.13) with a
+     * deprecation warning: its operation ids are version-1 hashes and its encrypted
+     * payloads have no envelope binding.
+     */
+    private warnLegacyProtocol;
+    /** The in-scope operations a version-vector client is missing (not yet sent). */
+    private collectDeltaOperations;
+    /** Send a collected version-vector delta in paginated, cursor-carrying batches. */
+    private sendCollectedDelta;
+    /**
+     * Stream the gap-free server->client delivery stream, resuming just after
      * `fromDeliverySeq`. Operations are scanned in server delivery-sequence order
      * (commit order), scope-filtered for this session, and sent in batches that chain:
      * each batch's `baseDeliverySequence` equals the previous batch's
      * `maxDeliverySequence` (the first batch bases on `fromDeliverySeq`). The client
      * applies a batch only when its watermark equals the base and advances the
      * watermark to the max, so a dropped batch stalls the watermark and is recovered by
-     * the next handshake resend. Because delivery-sequence order respects causal order
-     * (a dependency is always committed, and thus sequenced, before its dependent), no
-     * topological sort is needed and the client never defers on a missing dependency
-     * that is itself in this stream.
+     * a re-send from the acknowledged position. Because delivery-sequence order respects
+     * causal order (a dependency is always committed, and thus sequenced, before its
+     * dependent), no topological sort is needed.
+     *
+     * Batches go out as each scan chunk is filtered (SRV-5): the server holds at most
+     * one scan chunk plus two batches per stream, never the whole backlog, and the
+     * first batch reaches the client after one chunk. One full batch is held back so
+     * the stream's last batch can be marked `isFinal` (one-batch lookahead). The final
+     * batch carries the highest sequence scanned, not merely the last in-scope one, so
+     * an out-of-scope tail is not re-scanned. Every sent batch advances the send cursor
+     * ({@link lastSentDeliverySeq}). Between batches the stream waits for the client to
+     * drain its socket (backpressure).
      *
-     * The final batch advances the watermark to the highest delivery sequence scanned,
-     * not merely the last in-scope one, so an out-of-scope tail is not re-scanned on the
-     * next reconnect. Returns the number of operations actually sent.
+     * @param fromDeliverySeq - The chain base: the client's watermark or the send cursor
+     * @param finalizeWhenEmpty - Send an empty final batch even when nothing new was
+     *   scanned (the handshake stream, so the client completes initial sync)
+     */
+    private streamDelivery;
+    /**
+     * Filter one scan chunk of the delivery log down to what this session receives:
+     * visible operations (each preceded by its scope-entry insert, RT-19) and
+     * retractions. The records the decisions need are fetched for the whole chunk at
+     * once (LMS #11), one batched read per collection instead of one query per op.
      */
-    private sendDeliveryStream;
+    private filterDeliveryChunk;
+    /**
+     * Read, in one batched query per collection, every record the visibility decisions
+     * for these operations may look up, when the store supports batched reads. Returns
+     * null (per-operation lookups) otherwise. Over-fetching is harmless: the chunk
+     * bounds it.
+     */
+    private prefetchRecordsFor;
     /** Build, track, and send one chained delivery-stream batch. */
     private sendDeliveryBatch;
+    /** The scope snapshots of these operations, when the store keeps them (RT-14). */
+    private scopeSnapshotsFor;
+    /**
+     * Download visibility of one operation. With a scope snapshot (RT-14) the
+     * operation is judged on the record's scope values right after it was applied, so
+     * history written while a record belonged to someone else stays hidden after an
+     * ownership transfer, and a previous owner still receives its own history. Query
+     * subsets (a client-chosen narrowing, not an authorization) keep using the current
+     * row. Operations without a snapshot (legacy rows, custom stores) fall back to the
+     * current row plus `op.data`.
+     */
     private operationVisibleToClient;
-    /** Upload authorization is independent from the client's downloaded/query view. */
-    private operationAllowedFromClient;
+    /**
+     * Where the store already holds each of `operations` (by id), in one store read.
+     * Null when the store cannot answer by id (a custom store without
+     * `findStoredOperations`, or the read failed): callers then fall back to a
+     * per-operation (node, sequence) lookup and the store's own dedup at apply.
+     */
+    private findStoredOperations;
+    /**
+     * True when the batch lookup alone shows `op` is already stored and may be
+     * acknowledged as a duplicate with no further store work (RT-31, RT-39): this
+     * device's own operation stored under its node (its sequence repair may have
+     * renumbered it, keeping the id), or any other operation stored under exactly its
+     * (node, sequence, id), such as one the server itself delivered and the client
+     * echoed back. Never true for a store without the batch lookup.
+     */
+    private isStoredDuplicate;
+    /**
+     * The operation the store holds under `op`'s id (at the node and sequence the batch
+     * lookup found), or null when it cannot be read (the upload is then judged like any
+     * other: verified, validated, charged, and deduplicated by the store at apply).
+     */
+    private loadStoredOperation;
+    /**
+     * Refuse an upload that reuses a stored operation's id with different content (RT-77):
+     * terminal, nothing recorded or derived, logged and emitted as tampering. An honest
+     * client never does this (ids are content hashes), so the rejection only reaches a
+     * forger. No resolution is recorded: the id belongs to the stored operation.
+     */
+    private refuseForgedDuplicate;
+    /** Uploads refused for reusing a stored id with other content (RT-77). */
+    getForgedDuplicateCount(): number;
+    /**
+     * The recorded resolutions of the batch's own-node operations that the lookup did
+     * not find stored (RT-43, RT-47). Asked only for this session's own node, so the
+     * answer never reveals another device's (or tenant's) refusals.
+     */
+    private findResolutions;
+    /** The highest resolved sequence of `nodeId` (0 without the store method or on error). */
+    private resolvedThrough;
+    /**
+     * Durably record how this session's own operation was resolved without being stored
+     * under its sequence. Awaited before the answer is sent: a failure propagates (the
+     * batch fails and is not acknowledged), so the client never acts on a resolution the
+     * server could forget.
+     */
+    private recordResolution;
+    /**
+     * Refuse an operation for good (non-retriable): remember the refusal (RT-47), then
+     * tell the client. A resubmission of the same id is answered with this rejection
+     * without being judged again.
+     */
+    private refuseTerminally;
+    /**
+     * An own operation acknowledged as a duplicate of the copy stored under ANOTHER
+     * sequence (the client's sequence repair renumbered it, keeping its id): record the
+     * submitted sequence as resolved, so the handshake does not read it as lost (RT-43).
+     */
+    private noteStoredElsewhere;
+    /** Refuse the rest of a batch for the per-minute ingest budget (retriable). */
+    private sendRateLimited;
+    /**
+     * True when the store already holds exactly this operation (same node, sequence and
+     * id). Answered from the batch lookup when the store supports it.
+     */
+    private isStoredOperation;
+    /**
+     * The scopes this session may write under. Fails closed: with auth configured but
+     * no accepted authentication, the session may write nothing (an empty scope map),
+     * never everything.
+     */
+    private uplinkScopes;
+    /**
+     * Upload authorization, independent from the client's downloaded/query view. The
+     * stored row (including a soft-deleted one) is always loaded when scopes apply and
+     * is authoritative; client-supplied previousData is never consulted.
+     */
+    private authorizeClientOperation;
+    /**
+     * True when this update moved the record out of the session's scope, judged on the
+     * store's own before/after values (RT-15), never on the writer's previousData. An
+     * operation without a snapshot never produces a retraction (fail quiet: the
+     * client keeps what it already had, and no other tenant's record id leaks).
+     */
     private scopeRetractionFor;
+    /**
+     * The scope-entry operation to send before `op` when `op` moved an existing record
+     * into this session's download scope (RT-19), or null. Judged on the store's own
+     * pre/post snapshot; built from the record's CURRENT row, and only while that row
+     * is live and still inside the scope (a record that has since left again, or was
+     * deleted, gets no entry: its later operations retract or delete it anyway).
+     * Operations without a snapshot (legacy rows, custom stores) never produce one.
+     */
+    private scopeEntryFor;
     /**
      * Read a record's current field values from the materialized store for scope /
      * query-subset backfill. Includes soft-deleted rows so a relayed delete (whose op
@@ -1355,7 +3092,15 @@ declare class ClientSession {
      */
     private lookupRecordFields;
     private handleAwarenessUpdate;
+    /**
+     * A Yjs doc-channel update is a write to a richtext field: the sender must be
+     * allowed to write the stored record (same rule as operation uploads). The stored
+     * row is handed to the relay so delivery can be limited to sessions whose download
+     * scope contains the record.
+     */
     private handleYjsDocUpdate;
+    /** A legacy client's duplicate pair was stored (RT-37): count it and log it. */
+    private recordLegacySequencePair;
     private sendError;
     /**
      * Reject one specific client operation, tied to its id, so the submitter can
@@ -1364,7 +3109,6 @@ declare class ClientSession {
      * replica ever sees it.
      */
     private sendOperationRejected;
-    private setSerializerWireFormat;
     private handleTransportClose;
 }
 
@@ -1406,6 +3150,25 @@ interface ProductionServerConfig {
      * backupToken.
      */
     operationalAuth?: ProductionOperationalAuth;
+    /**
+     * Reverse proxies trusted to report the client address in `X-Forwarded-For`,
+     * which becomes `request.ip` (the key `@korajs/auth` rate-limits sign-in by).
+     * A hop count (`1` for a single load balancer in front) or a list of trusted
+     * proxy IPs / CIDR ranges. When unset, the header is ignored and `request.ip`
+     * is the socket address, so a client cannot pick its own rate-limit bucket.
+     */
+    trustProxy?: TrustProxySetting;
+    /**
+     * Largest request body a custom HTTP route (`httpRoutes`) accepts, in bytes. A
+     * larger body is refused with 413 before it is buffered (SRV-6), so an
+     * unauthenticated client cannot make the server hold arbitrary amounts of memory.
+     * Defaults to 1 MiB.
+     */
+    maxRequestBodyBytes?: number;
+    /**
+     * Largest backup accepted by `/__kora/backup/import`, in bytes. Defaults to 256 MiB.
+     */
+    maxBackupBytes?: number;
 }
 interface ProductionOperationalAuth {
     /** Protects /__kora, /__kora/status, and /__kora/events. */
@@ -1444,7 +3207,10 @@ interface ProductionHttpRoute {
  * A production server handle returned by createProductionServer.
  */
 interface ProductionServer {
-    /** Start listening. Returns the URL the server is available at. */
+    /**
+     * Start listening. Returns the URL the server is available at, with the port it
+     * actually bound (pass `port: 0` to let the OS pick a free one).
+     */
     start(): Promise<string>;
     /** Stop the server gracefully. */
     stop(): Promise<void>;
@@ -1496,6 +3262,10 @@ interface TokenAuthProviderOptions {
     /**
      * Validate a token and return an AuthContext if valid, or null if rejected.
      * This is where you implement your auth logic (JWT verification, database lookup, etc.).
+     *
+     * Return `scopes` to grant sync access explicitly. When the returned context
+     * has no scopes, schema-scoped collections are bound to `{ userId }` and any
+     * collection scoped by another key is denied.
      */
     validate: (token: string) => Promise<AuthContext | null>;
 }
@@ -1528,11 +3298,13 @@ interface TokenValidator {
         sub: string;
         dev: string;
         type: string;
+        exp?: number;
     } | null;
     validateTokenWithRevocation?(token: string): Promise<{
         sub: string;
         dev: string;
         type: string;
+        exp?: number;
     } | null>;
 }
 /**
@@ -1575,8 +3347,15 @@ interface KoraAuthProviderOptions {
      */
     deviceTracker?: DeviceToucher;
     /**
-     * Optional scope resolver. Called with the user ID to determine
-     * which collections/records the user can sync.
+     * Optional scope resolver. Called with the verified user ID to determine
+     * which collections/records the user can sync. Its result is the complete
+     * server grant: a collection it omits is not visible, and the client
+     * handshake can only narrow it. Use `claimScopes({ userId, orgId })` from
+     * `@korajs/core` to bind every schema-scoped collection from verified values.
+     *
+     * When omitted, the grant binds every schema-scoped collection from
+     * `{ userId: <verified sub> }`; collections scoped by any other key are denied
+     * until you supply it.
      */
     resolveScopes?: (userId: string) => Promise<Record<string, Record<string, unknown>>>;
 }
@@ -1630,7 +3409,9 @@ interface MixedAuthProviderOptions {
      */
     primary: AuthProvider;
     /**
-     * Scopes to apply to anonymous connections.
+     * Scopes to apply to anonymous connections. This is the complete anonymous
+     * grant: anonymous sessions can sync exactly these collections, and the
+     * client handshake can only narrow them, never add one.
      * Each key is a collection name; the value is a filter object
      * (use `{}` for unrestricted access to that collection).
      *
@@ -1654,10 +3435,10 @@ interface MixedAuthProviderOptions {
 /**
  * Auth provider that supports both authenticated and anonymous connections.
  *
- * When a client connects with a valid token, the primary auth provider
- * handles authentication normally. When a client connects without a token
- * (or with an invalid one), the connection is accepted as anonymous with
- * restricted sync scopes.
+ * When a client connects with a token, the primary auth provider decides:
+ * a valid token authenticates normally and an invalid, expired or revoked one
+ * is rejected (the client refreshes and reconnects). Only a client that sends
+ * no token at all is accepted as anonymous, with exactly `anonymousScopes`.
  *
  * This is the recommended pattern for apps that need public data access
  * alongside authenticated users — for example, a form builder where
@@ -1698,9 +3479,24 @@ declare class MixedAuthProvider implements AuthProvider {
     private readonly anonymousPrefix;
     private anonymousCounter;
     constructor(options: MixedAuthProviderOptions);
-    authenticate(token: string): Promise<AuthContext>;
+    /** The primary provider's revocation feed, when it has one. */
+    onRevoke?: AuthProvider['onRevoke'];
+    authenticate(token: string): Promise<AuthContext | null>;
 }
 
+/** Options for {@link MemoryServerStore}. */
+interface MemoryServerStoreOptions {
+    /**
+     * Node ids, besides this store's own, whose operations win
+     * `merge('server-authoritative')` fields (legacy server node ids). Every
+     * `kora:server:` node id is authoritative without being listed.
+     */
+    authoritativeNodeIds?: string[];
+    /** Revoked explicit authorities (see `ServerIdentityOptions.revokedAuthoritativeNodeIds`). */
+    revokedAuthoritativeNodeIds?: string[];
+    /** Instance id within the deployment (see `ServerIdentityOptions.instanceId`). */
+    instanceId?: string;
+}
 /**
  * In-memory server store for testing and quick prototyping.
  * Not suitable for production — data does not survive process restart.
@@ -1712,6 +3508,13 @@ declare class MemoryServerStore implements ServerStore {
     private readonly nodeId;
     private readonly operations;
     private readonly operationIndex;
+    /** (nodeId, sequenceNumber) -> the id of the operation holding it (W3 step 4). */
+    /** (node, sequence) -> ids holding it, in store order (several only for a legacy pair). */
+    private readonly operationIdsBySequence;
+    /** Node -> sequences held by more than one operation (legacy pairs, RT-48). */
+    private readonly pairSequencesByNode;
+    /** Operation id -> how it was resolved without being stored (RT-43, RT-47). */
+    private readonly resolutions;
     private readonly versionVector;
     /**
      * Server-assigned delivery sequence per operation id. Single-process, so a plain
@@ -1722,24 +3525,117 @@ declare class MemoryServerStore implements ServerStore {
     private readonly deliverySeqByOpId;
     private deliverySeqCounter;
     private schema;
+    /** Node id -> the authenticated principal that claimed it (see claimNode). */
+    private readonly nodeOwners;
+    /** Operation id -> scope snapshot captured at apply time (RT-14). */
+    private readonly scopeSnapshots;
+    /** Fields the current snapshots were captured with (RT-20). */
+    private snapshotFingerprint;
+    /** Blob content hash -> owners that pushed or first claimed it (RT-11). */
+    private readonly blobOwners;
+    /** Wrapped encryption key records (ENC-1): owner + keyring -> record JSON and revision. */
+    private readonly encryptionKeyRecords;
     /** Materialized records: collection -> recordId -> record data */
     private readonly materializedRecords;
+    /** Fold state per materialized record (W7): rows are projected from it. */
+    private readonly foldStates;
+    /** Every operation of a record, in store (delivery) order. */
+    private readonly recordOps;
+    private readonly authoritativeNodeIds;
+    /** Legacy and configured authorities (the `kora:server:` prefix needs no listing). */
+    private readonly explicitAuthorities;
+    /** Explicit authority over time: revoked and ever-held ids (RT-81). */
+    private readonly authorityHistory;
+    private foldOptions;
+    /** Schema transforms the fold applies (transforms at fold time, RT-84). */
+    private operationTransforms;
     private closed;
-    constructor(nodeId?: string);
+    /**
+     * Sequence-enforcement epoch (see SEQUENCE_ENFORCEMENT_EPOCH_KEY). A memory store
+     * starts empty under this release, so 0: every holder was stored under enforcement.
+     * A replace-mode backup import moves it to the restored log's end.
+     */
+    private sequenceEpoch;
+    /** Derivation secret of server-derived ids (RT-64). Per process: nothing persists. */
+    private readonly derivationSecret;
+    /**
+     * @param nodeId - Deprecated: a plain id is recorded as a legacy authoritative id; a
+     *   `kora:server:` id is used verbatim. Leave unset: the store authors under
+     *   `kora:server:<deployment>:<instance>` (a fresh deployment per process, since a
+     *   memory store persists nothing).
+     * @param options - Extra authoritative ids and the instance id
+     */
+    constructor(nodeId?: string, options?: MemoryServerStoreOptions);
+    deriveServerOperationId(parentOpId: string, ruleId: string, targetRecordId: string): Promise<string>;
+    getAuthoritativeNodeIds(): string[];
+    /** Explicit authoritative ids the deployment revoked (RT-81), advertised at handshake. */
+    getRevokedAuthoritativeNodeIds(): string[];
+    /**
+     * Every explicit id the deployment ever held authoritative, revoked ones included
+     * (RT-81): never accepted as a device node id.
+     */
+    getEverAuthoritativeNodeIds(): string[];
     getVersionVector(): VersionVector;
     getNodeId(): string;
     getSchema(): SchemaDefinition | null;
-    setSchema(schema: SchemaDefinition): Promise<void>;
-    applyRemoteOperation(op: Operation): Promise<ApplyResult>;
+    setSchema(schema: SchemaDefinition, options?: ServerSchemaOptions): Promise<void>;
+    getOperationTransforms(): readonly OperationTransform[];
+    setOperationTransforms(transforms: readonly OperationTransform[]): Promise<void>;
+    applyRemoteOperation(op: Operation, options?: ApplyRemoteOptions): Promise<ApplyResult>;
+    private addSequenceHolder;
+    getSequencePairOperations(nodeId: string, throughSequence: number): Promise<Operation[]>;
+    recordOperationResolution(resolution: OperationResolution): Promise<void>;
+    findOperationResolutions(nodeId: string, ids: string[]): Promise<Map<string, OperationResolution>>;
+    deleteOperationResolution(nodeId: string, operationId: string): Promise<void>;
+    getResolvedThrough(nodeId: string): Promise<number>;
+    findStoredOperations(ids: string[]): Promise<Map<string, StoredOperationKey>>;
+    getOperationScopeSnapshots(operationIds: string[]): Promise<Map<string, OperationScopeSnapshot>>;
+    getRecordLatestTimestamp(collection: string, recordId: string): Promise<HLCTimestamp | null>;
+    getRecordFieldVersions(collection: string, recordId: string): Promise<RecordFieldVersions | null>;
+    getRecordFoldState(collection: string, recordId: string): Promise<FoldState | null>;
+    getRecordOperations(collection: string, recordId: string): Promise<Operation[]>;
+    previewOperation(op: Operation): Promise<MaterializedRecord | null>;
+    /**
+     * The record's fold state: the stored one for a materialized collection, else
+     * folded from the record's operations (a collection outside the schema).
+     */
+    private readFoldState;
+    private addRecordOp;
+    recordBlobOwner(hash: string, owner: string): Promise<void>;
+    getBlobOwners(hashes: string[]): Promise<Map<string, string[]>>;
+    claimBlobIfUnowned(hash: string, owner: string): Promise<boolean>;
+    /** Scope values of a live record before a write; null when absent or deleted. */
+    private scopeValuesBefore;
+    /**
+     * Rebuild missing scope snapshots from the log (migration from a store without
+     * them, or a replace-mode backup import), replaying each record in commit order.
+     */
+    private backfillScopeSnapshots;
     getOperationRange(nodeId: string, fromSeq: number, toSeq: number): Promise<Operation[]>;
     getOperationCount(): Promise<number>;
     getMaxDeliverySequence(): Promise<number>;
     getOperationsAfterDelivery(afterDeliverySequence: number, limit: number): Promise<DeliveredOperation[]>;
     materializeCollection(collection: string): Promise<MaterializedRecord[]>;
+    getNodeIdsAfterDelivery(afterDeliverySequence: number): Promise<string[]>;
+    findRecordsByIds(collection: string, ids: string[]): Promise<Map<string, MaterializedRecord>>;
     queryCollection(collection: string, options?: CollectionQueryOptions): Promise<MaterializedRecord[]>;
     findRecord(collection: string, id: string): Promise<MaterializedRecord | null>;
     countCollection(collection: string, where?: Record<string, unknown>): Promise<number>;
     close(): Promise<void>;
+    getEncryptionKeyRecord(owner: string, keyring: string): Promise<string | null>;
+    putEncryptionKeyRecord(owner: string, keyring: string, record: string, revision: number, expectedRevision: number): Promise<boolean>;
+    listEncryptionKeyRecords(owner?: string): Promise<EncryptionKeyRecordRow[]>;
+    getEncryptedKeyIds(nodeOwner: string | null, limit: number): Promise<string[]>;
+    claimNode(nodeId: string, userId: string): Promise<boolean>;
+    getNodeClaimOwner(nodeId: string): Promise<string | null>;
+    replaceNodeClaim(nodeId: string, expectedOwner: string, newOwner: string): Promise<boolean>;
+    releaseNodeClaim(nodeId: string): Promise<boolean>;
+    /**
+     * The record as currently stored, including a soft-deleted one (whose last field
+     * values are kept), or null when it was never written. Without a materialized
+     * table, the last known values are replayed from the operation log.
+     */
+    private readStoredRow;
     /**
      * Wipes all in-memory state. For tests and E2E isolation only.
      */
@@ -1753,7 +3649,16 @@ declare class MemoryServerStore implements ServerStore {
      * Get all stored operations (for test assertions).
      */
     getAllOperations(): Operation[];
-    private rebuildMaterializedRecord;
+    /**
+     * Merge one just-appended operation into its record's fold state and project the
+     * row: O(fields the operation touches), independent of the record's history
+     * (SRV-7). Falls back to a full re-fold only when the stored state cannot take the
+     * operation (a field's fold kind changed with the schema).
+     */
+    private mergeIntoRecord;
+    /** Persist a record's fold state and project it onto its materialized row. */
+    private writeRecord;
+    /** Re-fold every record of every materialized collection (schema set, backup restore). */
     private backfillAllCollections;
     private materializeFromOps;
     private assertOpen;
@@ -1761,6 +3666,123 @@ declare class MemoryServerStore implements ServerStore {
     private assertCollection;
 }
 
+/**
+ * Server materialization through the one deterministic fold (W7 Stage B2).
+ *
+ * Every server store (memory, SQLite, Postgres) keeps, per materialized record, the
+ * record's serialized {@link FoldState} next to its collection row. Applying an
+ * operation is "append, then `mergeOp`": O(fields the operation touches), never a
+ * replay of the record's history (SRV-7). The collection row is a pure projection of
+ * the fold state ({@link projectFoldState}), so the server's rows are exactly what a
+ * client that holds the same operations materializes (SRV-1).
+ *
+ * The fold is pure JavaScript: ordering uses HLC stamps compared in JS, never a
+ * database collation (the Phase 1 COLLATE "C" concern disappears for materialization).
+ *
+ * Old helpers (`replayOperationsForRecord`, `mergeArraySet`) are no longer used to
+ * materialize; they stay exported from core for legacy comparison only.
+ */
+
+/** What a store's startup re-materialization did (W7 step 7). */
+interface FoldMigrationReport {
+    /** False when no schema was set (nothing is materialized). */
+    ran: boolean;
+    /** Records re-folded and rewritten. */
+    records: number;
+    /**
+     * Records that own quarantined operations (see `ServerLogIntegrityReport`): their log
+     * is incomplete, so their pre-fold rows were kept as a snapshot base with the
+     * remaining operations folded onto it (RT-70), never re-folded from the log alone.
+     */
+    skippedUnclean: number;
+    /** True when the fold plan (field kinds, strategies, resolvers) changed: every record was re-folded. */
+    fullRefold: boolean;
+}
+
+/** A row the scan quarantined. */
+interface ServerLogIntegrityRow {
+    operationId: string;
+    problem: string;
+    detail: string;
+}
+/** Result of the server scan. */
+interface ServerLogIntegrityReport {
+    /** Rows checked by this scan (0 when it already ran on this database). */
+    checkedRows: number;
+    /** Rows this scan moved to the quarantine table. */
+    quarantined: ServerLogIntegrityRow[];
+    /** False when the one-time scan had already run (only the quarantine is reported). */
+    ran: boolean;
+    /** Every row in the quarantine table. */
+    totalQuarantined: number;
+}
+
+/**
+ * Stable server identity (RT-61, RT-62, RT-64).
+ *
+ * Every operation the server authors (route writes, cascades, set-nulls, constraint
+ * corrections) is authored by a node id in the reserved namespace
+ * `kora:server:<deploymentId>:<instanceId>`:
+ *
+ * - `deploymentId` is generated once per database and persisted in `kora_server_meta`,
+ *   so every instance that shares the database (and every restart) belongs to one
+ *   deployment.
+ * - `instanceId` is distinct per running instance, so two instances never author the
+ *   same `(nodeId, sequenceNumber)`: SQLite persists one (a SQLite database has one
+ *   writer process), Postgres allocates a fresh one from a counter in the database on
+ *   every start unless the operator configures a stable `instanceId` per instance.
+ *
+ * Authority (`merge('server-authoritative')`) is the prefix rule: any operation whose
+ * node id starts with {@link SERVER_NODE_PREFIX} is authoritative, on the server and on
+ * every device. Devices can never use a `kora:` node id (the session refuses it at
+ * handshake). Server node ids written before this release (random per-process ids, or
+ * an id the operator configured) are recorded once, at the first start of this release,
+ * in a persisted list of legacy authoritative ids that the handshake keeps advertising,
+ * so earlier server decisions keep winning everywhere.
+ *
+ * Server-derived operation ids (cascades, corrections) are keyed with a persisted,
+ * deployment-wide secret (HMAC-SHA-256), so a writer cannot predict them and occupy one
+ * first; every instance of the deployment derives the same id for the same effect.
+ */
+
+/** Prefix of every node id the server authors under. */
+declare const SERVER_NODE_PREFIX = "kora:server:";
+/** Thrown for an invalid server identity configuration. */
+declare class ServerIdentityError extends KoraError {
+    constructor(message: string, context?: Record<string, unknown>);
+}
+/** Identity options every server store accepts. */
+interface ServerIdentityOptions {
+    /**
+     * Deprecated. A plain id (for example one set before beta.13) is no longer the id the
+     * server authors under: it is recorded as a legacy authoritative id, so operations
+     * already stored under it keep their authority, and no device may use it. An id in
+     * the `kora:server:` namespace is used verbatim (it must then be unique per instance).
+     */
+    nodeId?: string;
+    /**
+     * Stable id of this instance within the deployment (`[A-Za-z0-9._-]`, at most 64
+     * characters). Must be distinct per running instance. SQLite persists one on its own;
+     * Postgres allocates a new one per start when it is not configured.
+     */
+    instanceId?: string;
+    /**
+     * Extra node ids whose operations win `merge('server-authoritative')` fields. Every id
+     * listed here once stays authoritative (devices keep it too) until it is revoked with
+     * {@link revokedAuthoritativeNodeIds}: removing it from this list does not revoke it.
+     */
+    authoritativeNodeIds?: string[];
+    /**
+     * Explicit authoritative node ids to revoke (RT-81): they stop being authoritative on
+     * the server, the handshake tells every device to drop them (devices re-fold), and they
+     * are still never accepted as device node ids. Revocation is permanent (persisted); an
+     * id may not be both listed in `authoritativeNodeIds` and revoked.
+     */
+    revokedAuthoritativeNodeIds?: string[];
+}
+/** True for a node id the server authors under (current or any instance of any deployment). */
+declare function isServerNodeId(nodeId: string): boolean;
+
 /**
  * PostgreSQL-backed server store using Drizzle ORM.
  * All reads and writes go through Drizzle's typed query builder.
@@ -1769,7 +3791,18 @@ declare class MemoryServerStore implements ServerStore {
  * collection tables for efficient indexed queries (dual-write).
  */
 declare class PostgresServerStore implements ServerStore {
-    private readonly nodeId;
+    /** This instance's server node id; loaded from the database during startup (RT-62). */
+    private loadedNodeId;
+    private readonly configuredIdentity;
+    /** Derivation secret of server-derived ids, shared by the deployment (RT-64). */
+    private derivationSecret;
+    /** Legacy and configured authorities (the `kora:server:` prefix needs no listing). */
+    private explicitAuthorities;
+    /** Explicit authority over time: revoked and ever-held ids (RT-81). */
+    private authorityHistory;
+    /** Other `kora:server:` nodes with stored operations (advertised for older clients). */
+    /** Records owning quarantined operations: folded onto their kept rows (RT-70). */
+    private quarantine;
     private readonly db;
     private readonly versionVector;
     private readonly ready;
@@ -1783,6 +3816,9 @@ declare class PostgresServerStore implements ServerStore {
      * null after a backup import so it re-seeds from the restored version vector.
      */
     private sequenceCounter;
+    /** See {@link SEQUENCE_ENFORCEMENT_EPOCH_KEY}; fixed per database at first start. */
+    private sequenceEpoch;
+    private logIntegrity;
     /**
      * Time source for HLC timestamps on server-originated operations. Injectable so a
      * test can freeze wall-clock time and prove the conditional-apply ordering holds
@@ -1790,7 +3826,54 @@ declare class PostgresServerStore implements ServerStore {
      * exist to make correct). Defaults to the system clock in production.
      */
     private readonly timeSource;
-    constructor(db: PostgresJsDatabase, nodeId?: string, timeSource?: TimeSource);
+    private foldOptions;
+    /** Schema transforms the fold applies (transforms at fold time, RT-84). */
+    private operationTransforms;
+    private foldMigration;
+    /**
+     * @param db - The Drizzle database
+     * @param nodeId - Deprecated: a plain id is recorded as a legacy authoritative id; a
+     *   `kora:server:` id is used verbatim (it must then be unique per instance). Leave
+     *   unset: the store authors under `kora:server:<deployment>:<instance>`, with the
+     *   deployment persisted in the database and a distinct instance per process (RT-62).
+     * @param timeSource - Clock for server-originated operations (tests)
+     * @param options - Extra authoritative ids and a stable instance id
+     */
+    constructor(db: PostgresJsDatabase, nodeId?: string, timeSource?: TimeSource, options?: Omit<ServerIdentityOptions, 'nodeId'>);
+    /** Resolves once the store's tables and identity are loaded. */
+    whenReady(): Promise<void>;
+    /**
+     * This store's node id and the legacy and configured ids (explicit authorities).
+     * Other `kora:server:` instances are not listed: the prefix rule makes every one of
+     * them authoritative, and a list that grew by one instance id per start would make
+     * every device re-fold after each deploy (RT-75). Handshakes advertise only the
+     * explicit (non-prefixed) ids.
+     */
+    getAuthoritativeNodeIds(): string[];
+    /** Legacy and configured authorities (beside the `kora:server:` namespace). */
+    getLegacyAuthoritativeNodeIds(): string[];
+    /** Explicit authoritative ids the deployment revoked (RT-81), advertised at handshake. */
+    getRevokedAuthoritativeNodeIds(): string[];
+    /**
+     * Every explicit id the deployment ever held authoritative, revoked ones included
+     * (RT-81): never accepted as a device node id.
+     */
+    getEverAuthoritativeNodeIds(): string[];
+    deriveServerOperationId(parentOpId: string, ruleId: string, targetRecordId: string): Promise<string>;
+    private get nodeId();
+    /** Remember another `kora:server:` node that authored stored operations. */
+    /**
+     * Load (creating on first start) the persisted server identity under an advisory
+     * lock: the deployment id and derivation secret (one per database, shared by every
+     * instance), a fresh instance id from the database counter (unless configured), and
+     * the legacy authoritative ids. At the first start of this release, every node id
+     * whose operations hold an authority class in a stored fold state (a server decision
+     * folded under an earlier, per-process server node id) is recorded as a legacy
+     * authority, before any re-fold could drop that class.
+     */
+    private loadIdentity;
+    /** What the last startup re-materialization did (W7 step 7). */
+    getFoldMigrationReport(): FoldMigrationReport;
     getVersionVector(): VersionVector;
     /**
      * Atomically reserve this node's next server-operation sequence number. The
@@ -1800,8 +3883,51 @@ declare class PostgresServerStore implements ServerStore {
     reserveSequenceNumber(): number;
     getNodeId(): string;
     getSchema(): SchemaDefinition | null;
-    setSchema(schema: SchemaDefinition): Promise<void>;
-    applyRemoteOperation(op: Operation): Promise<ApplyResult>;
+    /**
+     * One-time migration (RT-101): drop the enum `CHECK` constraints (and any `NOT NULL`
+     * on a schema field) that beta.12 and earlier DDL put on collection tables, in one
+     * transaction. A check is dropped when it parses as an enum check (one column against
+     * string literals, in every form Postgres normalizes `IN (...)` to, the single-value
+     * `col = 'x'` included, RT-108) on an enum field of the schema, or as the multi-value
+     * `= ANY (ARRAY[...])` shape on another non-internal column; checks added by hand are
+     * kept. Idempotent and resumable: a later start finds nothing to drop.
+     */
+    private relaxValueDomainConstraints;
+    /**
+     * Throws {@link OperationTransformCoverageError} when a schema version in the stored
+     * log has no transform path to `version` (RT-103): those operations would fold as
+     * absent, silently erasing them from their records.
+     */
+    private assertTransformCoverage;
+    getOperationTransforms(): readonly OperationTransform[];
+    setOperationTransforms(transforms: readonly OperationTransform[]): Promise<void>;
+    setSchema(schema: SchemaDefinition, options?: ServerSchemaOptions): Promise<void>;
+    /**
+     * One-time migration of each collection table to the lossless text encoding (RT-65):
+     * rows written before it that contain U+FFFF (the escape introducer) are re-encoded,
+     * so the decoder returns them unchanged. Per table, under an advisory lock, recorded
+     * in `kora_server_meta`.
+     */
+    private migrateTextCodec;
+    applyRemoteOperation(op: Operation, options?: ApplyRemoteOptions): Promise<ApplyResult>;
+    /**
+     * The version vector as committed in `sync_state`, shared by every instance
+     * (SRV-4). Also refreshes this instance's cache, which `getVersionVector()` serves.
+     */
+    readVersionVector(): Promise<VersionVector>;
+    /**
+     * Insert one operation row inside an append transaction that already holds the
+     * delivery-counter lock. Returns `'duplicate'` (writing nothing) when an operation
+     * with the same id is stored; throws {@link SequenceConflictError} when a DIFFERENT
+     * operation stored after the sequence-enforcement epoch holds its (node, sequence)
+     * and the writer reserves its sequences (W3 step 4); a legacy holder or a legacy
+     * writer (RT-37) is accepted and the row is stored unflagged. Otherwise returns the
+     * verdict the row was stored under. The partial unique index over sole-holder rows
+     * backs the check against a writer that bypasses the counter lock.
+     */
+    private insertOperationRow;
+    /** Advance `sync_state` (the persisted version vector) for an appended operation. */
+    private advanceSyncState;
     /**
      * Conditionally apply operations atomically, serialized across server instances
      * on the target record via a transaction-scoped advisory lock. The lock makes
@@ -1813,7 +3939,37 @@ declare class PostgresServerStore implements ServerStore {
     getOperationCount(): Promise<number>;
     getMaxDeliverySequence(): Promise<number>;
     getOperationsAfterDelivery(afterDeliverySequence: number, limit: number): Promise<DeliveredOperation[]>;
+    getOperationScopeSnapshots(operationIds: string[]): Promise<Map<string, OperationScopeSnapshot>>;
+    getRecordLatestTimestamp(collection: string, recordId: string): Promise<HLCTimestamp | null>;
+    getRecordFieldVersions(collection: string, recordId: string): Promise<RecordFieldVersions | null>;
+    getRecordFoldState(collection: string, recordId: string): Promise<FoldState | null>;
+    getRecordOperations(collection: string, recordId: string): Promise<Operation[]>;
+    previewOperation(op: Operation): Promise<MaterializedRecord | null>;
+    recordBlobOwner(hash: string, owner: string): Promise<void>;
+    getBlobOwners(hashes: string[]): Promise<Map<string, string[]>>;
+    claimBlobIfUnowned(hash: string, owner: string): Promise<boolean>;
+    /**
+     * Scope values of a record as stored, for an operation's scope snapshot. With
+     * `includeDeleted` false a soft-deleted row counts as absent; with true it keeps
+     * its last values (a delete's post-image).
+     */
+    private readScopeValues;
+    /** Persist the scope snapshot of a just-applied operation (RT-14). */
+    private writeScopeSnapshot;
+    /**
+     * Rebuild missing scope snapshots from the log (migration from a database written
+     * before snapshots existed), replaying each affected record in commit order.
+     */
+    private backfillScopeSnapshots;
     materializeCollection(collection: string): Promise<MaterializedRecord[]>;
+    getNodeIdsAfterDelivery(afterDeliverySequence: number): Promise<string[]>;
+    getSequencePairOperations(nodeId: string, throughSequence: number): Promise<Operation[]>;
+    recordOperationResolution(resolution: OperationResolution): Promise<void>;
+    findOperationResolutions(nodeId: string, ids: string[]): Promise<Map<string, OperationResolution>>;
+    deleteOperationResolution(nodeId: string, operationId: string): Promise<void>;
+    getResolvedThrough(nodeId: string): Promise<number>;
+    findStoredOperations(ids: string[]): Promise<Map<string, StoredOperationKey>>;
+    findRecordsByIds(collection: string, ids: string[]): Promise<Map<string, MaterializedRecord>>;
     queryCollection(collection: string, options?: CollectionQueryOptions): Promise<MaterializedRecord[]>;
     findRecord(collection: string, id: string): Promise<MaterializedRecord | null>;
     countCollection(collection: string, where?: Record<string, unknown>): Promise<number>;
@@ -1830,28 +3986,105 @@ declare class PostgresServerStore implements ServerStore {
      * write so newly built operations sort strictly after it.
      */
     private latestOperationTimestamp;
+    getEncryptionKeyRecord(owner: string, keyring: string): Promise<string | null>;
+    putEncryptionKeyRecord(owner: string, keyring: string, record: string, revision: number, expectedRevision: number): Promise<boolean>;
+    listEncryptionKeyRecords(owner?: string): Promise<EncryptionKeyRecordRow[]>;
+    getEncryptedKeyIds(nodeOwner: string | null, limit: number): Promise<string[]>;
+    claimNode(nodeId: string, userId: string): Promise<boolean>;
+    getNodeClaimOwner(nodeId: string): Promise<string | null>;
+    replaceNodeClaim(nodeId: string, expectedOwner: string, newOwner: string): Promise<boolean>;
+    releaseNodeClaim(nodeId: string): Promise<boolean>;
     /**
-     * Rebuild a single record in the materialized collection table by replaying
-     * all operations for that record.
+     * The record as currently stored, including a soft-deleted one (whose last field
+     * values are kept), or null when it was never written. Without a materialized
+     * table, the last known values are replayed from the operation log.
+     */
+    private readStoredRow;
+    /**
+     * Merge a just-appended operation (stored under `deliverySeq`) into its record's
+     * fold state and project the row, inside the append transaction. O(fields the
+     * operation touches): the state is read by primary key and the freshness check is
+     * one index probe (SRV-7).
+     *
+     * Concurrency: every append on every instance holds the delivery-counter row lock
+     * until commit (see nextDeliverySeq), and applyConditional takes its per-record
+     * advisory lock before it, so this read-merge-write of one record's state is
+     * serialized across instances; the `FOR UPDATE` on the state row is defense in
+     * depth. A record whose log grew without this state (an older release during a
+     * rolling upgrade) has its missing tail merged first; an unreadable, newer-than-log
+     * or plan-incompatible state is re-folded from the log.
      */
-    private rebuildMaterializedRecord;
+    private mergeIntoRecord;
+    /**
+     * The fold state of a record that owns quarantined operations (RT-70): its stored
+     * state, or its kept row as a snapshot base, with every remaining operation of the
+     * record merged on top (`rebuildFromSnapshot`). Nothing is written.
+     */
+    private rebuildAffected;
+    /** True when the record's operation at delivery sequence `seq` has id `opId`. */
+    private coversStoredOperation;
+    /**
+     * The record's current fold state for a read: the stored one when it covers the
+     * record's whole log, else folded from the log (nothing is written).
+     */
+    private readFoldState;
+    /** A record's operations stored after `afterDeliverySeq`, in delivery order. */
+    private readRecordOperations;
+    /**
+     * Persist a record's fold state (covering the log up to `coveredSeq`) and project
+     * it onto the materialized row.
+     */
+    private writeFoldedRecord;
     /**
      * UPSERT a record into the materialized collection table.
      */
     private upsertMaterializedRecord;
     /**
-     * Backfill all materialized collection tables from the existing operation log.
+     * {@link writeFoldedRecord} for a batch of records of one collection, in a handful
+     * of multi-row statements (the migration's write path). Rows are chunked so a
+     * statement never nears the 65,535 bind-parameter limit, however wide the collection.
      */
-    private backfillAllCollections;
+    private writeFoldedRecords;
     /**
-     * Backfill a single collection's materialized table from operations.
+     * Re-materialization migration (W7 step 7), run by setSchema and after a
+     * replace-mode restore: every record whose fold state is missing, stale or built
+     * under a different fold plan is re-folded from its log; nothing else is touched.
+     * See the SQLite store's `rematerialize` for the rules (a record owning quarantined
+     * operations folds onto its kept row, RT-70; idempotent; resumable).
+     *
+     * Postgres specifics: records are paged in batches of
+     * {@link FOLD_MIGRATION_BATCH} through the (collection, record_id, delivery_seq)
+     * index, and every batch is one transaction that first takes the delivery-counter
+     * row lock. Appends on every instance take that lock too, so a batch reads each
+     * record's complete log and writes its state while no append to it can commit: a
+     * live write on another instance during a rolling deploy is never overwritten by a
+     * stale re-fold (NEW-SRV-5), it either committed before the batch (and is folded)
+     * or commits after it (and is merged into the batch's state).
+     */
+    /**
+     * Write the beta.12 clears the ids prove into the stored bodies, once per database
+     * (RT-85, see `provenLegacyClears`), and mark their records' fold states stale.
+     * Idempotent: concurrent first starts write the same bodies.
      */
-    private backfillCollection;
+    private canonicalizeLegacyBodies;
+    private rematerialize;
     private buildSelectQuery;
     private buildWhereClause;
     private deserializeRow;
     private materializeFromOpsLog;
     private initialize;
+    /**
+     * The startup log-integrity scan's result (W8 step 0): rows that could not be read
+     * back into an operation are moved to `operations_quarantine` once per database,
+     * before any fold reads them.
+     */
+    getLogIntegrityReport(): Promise<ServerLogIntegrityReport>;
+    /**
+     * One-time scan under the setup advisory lock (concurrent starts run it once). Keyset
+     * pages by id, so a large log is read in bounded chunks; like the delivery-sequence
+     * backfill it runs on the first start of this release only.
+     */
+    private scanLogIntegrityOnce;
     private ensureTables;
     /**
      * Reserve the next delivery sequence inside an open append transaction. The
@@ -1859,6 +4092,11 @@ declare class PostgresServerStore implements ServerStore {
      * serializing assignment into commit order (see the counter table comment).
      */
     private nextDeliverySeq;
+    /**
+     * @param soleHolder - Nothing else held the (node, sequence) at insert: the row is
+     *   flagged `seq_unique` and covered by {@link NODE_SEQ_UNIQUE_INDEX}. False for a
+     *   legacy pair's second operation and for restored backup rows.
+     */
     private serializeOperation;
     private deserializeOperation;
     private assertOpen;
@@ -1870,8 +4108,14 @@ declare class PostgresServerStore implements ServerStore {
  */
 declare function createPostgresServerStore(options: {
     connectionString: string;
-    nodeId?: string;
-}): Promise<PostgresServerStore>;
+} & ServerIdentityOptions): Promise<PostgresServerStore>;
+/**
+ * The Postgres server store could not start: the database is unreachable, refused the
+ * credentials, or its tables could not be created. `cause` is the driver's error.
+ */
+declare class ServerStoreUnavailableError extends KoraError {
+    constructor(connectionString: string, cause: unknown);
+}
 
 /**
  * SQLite-backed server store using Drizzle ORM.
@@ -1886,46 +4130,206 @@ declare class SqliteServerStore implements ServerStore {
     private readonly db;
     private schema;
     private closed;
-    constructor(db: BetterSQLite3Database, nodeId?: string);
+    /** See {@link SEQUENCE_ENFORCEMENT_EPOCH_KEY}; fixed per database at first start. */
+    private sequenceEpoch;
+    private logIntegrity;
+    /** Derivation secret of server-derived ids, shared by the deployment (RT-64). */
+    private readonly derivationSecret;
+    /** Legacy and configured authorities (the `kora:server:` prefix needs no listing). */
+    private readonly explicitAuthorities;
+    /** Explicit authority over time: revoked and ever-held ids (RT-81). */
+    private readonly authorityHistory;
+    /** Other `kora:server:` nodes with stored operations (advertised for older clients). */
+    /** Records owning quarantined operations: folded onto their kept rows (RT-70). */
+    private quarantine;
+    private foldOptions;
+    /** Schema transforms the fold applies (transforms at fold time, RT-84). */
+    private operationTransforms;
+    private foldMigration;
+    /**
+     * @param db - The Drizzle database
+     * @param nodeId - Deprecated: a plain id is recorded as a legacy authoritative id; a
+     *   `kora:server:` id is used verbatim. Leave unset: the store authors under
+     *   `kora:server:<deployment>:<instance>`, both persisted in the database (RT-62).
+     * @param options - Extra authoritative ids and the instance id
+     */
+    constructor(db: BetterSQLite3Database, nodeId?: string, options?: Omit<ServerIdentityOptions, 'nodeId'>);
+    /**
+     * This store's node id and the legacy and configured ids (explicit authorities).
+     * Other `kora:server:` instances are not listed: the prefix rule makes every one of
+     * them authoritative, and a list that grew by one instance id per start would make
+     * every device re-fold after each deploy (RT-75). Handshakes advertise only the
+     * explicit (non-prefixed) ids.
+     */
+    getAuthoritativeNodeIds(): string[];
+    /** Legacy and configured authorities (beside the `kora:server:` namespace). */
+    getLegacyAuthoritativeNodeIds(): string[];
+    /** Explicit authoritative ids the deployment revoked (RT-81), advertised at handshake. */
+    getRevokedAuthoritativeNodeIds(): string[];
+    /**
+     * Every explicit id the deployment ever held authoritative, revoked ones included
+     * (RT-81): never accepted as a device node id.
+     */
+    getEverAuthoritativeNodeIds(): string[];
+    deriveServerOperationId(parentOpId: string, ruleId: string, targetRecordId: string): Promise<string>;
+    /** Remember another `kora:server:` node that authored stored operations. */
+    /**
+     * Load (creating on first start) the persisted server identity: the deployment id,
+     * the derivation secret, this database's instance id and the legacy authoritative
+     * ids. At the first start of this release, every node id whose operations hold an
+     * authority class in a stored fold state (a server decision folded under an earlier,
+     * per-process server node id) is recorded as a legacy authority, before any re-fold
+     * could drop that class.
+     */
+    private loadIdentity;
+    /** What the last startup re-materialization did (W7 step 7). */
+    getFoldMigrationReport(): FoldMigrationReport;
     getVersionVector(): VersionVector;
     getNodeId(): string;
     getSchema(): SchemaDefinition | null;
-    setSchema(schema: SchemaDefinition): Promise<void>;
-    applyRemoteOperation(op: Operation): Promise<ApplyResult>;
+    setSchema(schema: SchemaDefinition, options?: ServerSchemaOptions): Promise<void>;
+    /**
+     * One-time migration (RT-101): rebuild collection tables that still carry an enum
+     * `CHECK` (or `NOT NULL` on a schema field), in one transaction, keeping rows, indexes
+     * and triggers. Idempotent (a relaxed table is left alone) and resumable (an
+     * interrupted rebuild rolls back and runs again at the next start).
+     */
+    private relaxValueDomainConstraints;
+    /**
+     * Throws {@link OperationTransformCoverageError} when a schema version in the stored
+     * log has no transform path to `version` (RT-103): those operations would fold as
+     * absent, silently erasing them from their records.
+     */
+    private assertTransformCoverage;
+    getOperationTransforms(): readonly OperationTransform[];
+    setOperationTransforms(transforms: readonly OperationTransform[]): Promise<void>;
+    applyRemoteOperation(op: Operation, options?: ApplyRemoteOptions): Promise<ApplyResult>;
+    private applyInTransaction;
     getOperationRange(nodeId: string, fromSeq: number, toSeq: number): Promise<Operation[]>;
     getOperationCount(): Promise<number>;
     getMaxDeliverySequence(): Promise<number>;
     getOperationsAfterDelivery(afterDeliverySequence: number, limit: number): Promise<DeliveredOperation[]>;
+    getOperationScopeSnapshots(operationIds: string[]): Promise<Map<string, OperationScopeSnapshot>>;
+    getRecordLatestTimestamp(collection: string, recordId: string): Promise<HLCTimestamp | null>;
+    getRecordFieldVersions(collection: string, recordId: string): Promise<RecordFieldVersions | null>;
+    getRecordFoldState(collection: string, recordId: string): Promise<FoldState | null>;
+    getRecordOperations(collection: string, recordId: string): Promise<Operation[]>;
+    previewOperation(op: Operation): Promise<MaterializedRecord | null>;
+    recordBlobOwner(hash: string, owner: string): Promise<void>;
+    getBlobOwners(hashes: string[]): Promise<Map<string, string[]>>;
+    claimBlobIfUnowned(hash: string, owner: string): Promise<boolean>;
+    /**
+     * Scope values of a record as stored, for an operation's scope snapshot. With
+     * `includeDeleted` false a soft-deleted row counts as absent (the pre-image of a
+     * write to a deleted record); with true it keeps its last values (a delete's
+     * post-image).
+     */
+    private readScopeValues;
+    /**
+     * Rebuild missing scope snapshots from the log (migration from a database written
+     * before snapshots existed), replaying each affected record in commit order.
+     */
+    private backfillScopeSnapshots;
     materializeCollection(collection: string): Promise<MaterializedRecord[]>;
+    getNodeIdsAfterDelivery(afterDeliverySequence: number): Promise<string[]>;
+    getSequencePairOperations(nodeId: string, throughSequence: number): Promise<Operation[]>;
+    recordOperationResolution(resolution: OperationResolution): Promise<void>;
+    findOperationResolutions(nodeId: string, ids: string[]): Promise<Map<string, OperationResolution>>;
+    deleteOperationResolution(nodeId: string, operationId: string): Promise<void>;
+    getResolvedThrough(nodeId: string): Promise<number>;
+    findStoredOperations(ids: string[]): Promise<Map<string, StoredOperationKey>>;
+    findRecordsByIds(collection: string, ids: string[]): Promise<Map<string, MaterializedRecord>>;
     queryCollection(collection: string, options?: CollectionQueryOptions): Promise<MaterializedRecord[]>;
     findRecord(collection: string, id: string): Promise<MaterializedRecord | null>;
     countCollection(collection: string, where?: Record<string, unknown>): Promise<number>;
     close(): Promise<void>;
+    getEncryptionKeyRecord(owner: string, keyring: string): Promise<string | null>;
+    putEncryptionKeyRecord(owner: string, keyring: string, record: string, revision: number, expectedRevision: number): Promise<boolean>;
+    listEncryptionKeyRecords(owner?: string): Promise<EncryptionKeyRecordRow[]>;
+    getEncryptedKeyIds(nodeOwner: string | null, limit: number): Promise<string[]>;
+    claimNode(nodeId: string, userId: string): Promise<boolean>;
+    getNodeClaimOwner(nodeId: string): Promise<string | null>;
+    replaceNodeClaim(nodeId: string, expectedOwner: string, newOwner: string): Promise<boolean>;
+    releaseNodeClaim(nodeId: string): Promise<boolean>;
+    /**
+     * The record as currently stored, including a soft-deleted one (whose last field
+     * values are kept), or null when it was never written. Without a materialized
+     * table, the last known values are replayed from the operation log.
+     */
+    private readStoredRow;
+    /**
+     * The fold state of a record that owns quarantined operations (RT-70): its stored
+     * state, or its kept row as a snapshot base, with every remaining operation of the
+     * record merged on top (`rebuildFromSnapshot`). Nothing is written.
+     */
+    private rebuildAffected;
     exportBackup(): Promise<Uint8Array>;
     importBackup(data: Uint8Array, merge?: boolean): Promise<{
         operationsRestored: number;
         success: boolean;
     }>;
     /**
-     * Rebuild a single record in the materialized collection table by replaying
-     * all operations for that record. Called within the applyRemoteOperation
-     * transaction for atomic dual-write.
+     * Merge a just-appended operation (stored under `deliverySeq`) into its record's
+     * fold state and project the row, inside the append transaction. O(fields the
+     * operation touches): the stored state is read by primary key and the freshness
+     * check is one index probe, never a scan of the record's history (SRV-7).
+     *
+     * The stored state records the highest delivery sequence it covers. If another
+     * writer appended operations to this record without folding them (an older release
+     * during a rolling upgrade), the missing tail is merged first; if the stored state
+     * is unreadable, newer than the log, or built under an incompatible field kind,
+     * the record is re-folded from its log.
+     */
+    private mergeIntoRecord;
+    /** True when the record's operation at delivery sequence `seq` has id `opId`. */
+    private coversStoredOperation;
+    /**
+     * The record's current fold state for a read: the stored one when it covers the
+     * record's whole log, else folded from the log (nothing is written).
      */
-    private rebuildMaterializedRecord;
+    private readFoldState;
+    /** A record's operations stored after `afterDeliverySeq`, in delivery order. */
+    private readRecordOperations;
+    /**
+     * Persist a record's fold state (covering the log up to `coveredSeq`) and project
+     * it onto the materialized row.
+     */
+    private writeFoldedRecord;
     /**
      * UPSERT a record into the materialized collection table.
      * Uses INSERT ... ON CONFLICT (id) DO UPDATE SET for atomic upsert.
      */
     private upsertMaterializedRecord;
     /**
-     * Backfill all materialized collection tables from the existing operation log.
-     * Called when setSchema() is invoked and operations already exist.
+     * Re-materialization migration (W7 step 7), run by setSchema and after a
+     * replace-mode restore. Every record whose fold state is missing, stale (it covers
+     * less, or more, of the log than is stored) or built under a different fold plan
+     * (field kind, merge strategy, resolver) is re-folded from its log and its row
+     * rewritten; nothing else is touched, so a restart on an up-to-date database does
+     * one aggregate read.
+     *
+     * - Runs only on a log the W8b integrity scan reports clean. With quarantined rows,
+     *   rows materialized before the fold existed are kept as they are (re-folding a
+     *   log that lost operations would bake the loss in) and the skip is logged loudly;
+     *   such a record is folded from its remaining log on its next write. Records with
+     *   no row yet, and fold states this release already wrote, are still processed.
+     * - Idempotent and resumable: each batch commits on its own, and staleness is
+     *   re-derived from the tables at every start, so a crash resumes where it stopped.
+     *   A plan change first marks every stored state stale (one statement), then
+     *   records the new fingerprint, so it is resumable too.
      */
-    private backfillAllCollections;
     /**
-     * Backfill a single collection's materialized table from operations.
+     * One-time migration of each collection table to the lossless text encoding (RT-65):
+     * rows written before it whose raw-string columns contain U+FFFF (the escape
+     * introducer) are re-encoded, so the decoder returns them unchanged.
      */
-    private backfillCollection;
+    private migrateTextCodec;
+    /**
+     * Write the beta.12 clears the ids prove into the stored bodies, once per database
+     * (RT-85, see `provenLegacyClears`), and mark their records' fold states stale.
+     */
+    private canonicalizeLegacyBodies;
+    private rematerialize;
     private buildSelectQuery;
     private buildWhereClause;
     private deserializeRow;
@@ -1934,6 +4338,29 @@ declare class SqliteServerStore implements ServerStore {
      * Create the operations and sync_state tables if they don't exist.
      */
     private ensureTables;
+    /**
+     * The startup log-integrity scan's result (W8 step 0): rows that could not be read
+     * back into an operation are moved to `operations_quarantine` once per database,
+     * before any fold reads them.
+     */
+    getLogIntegrityReport(): ServerLogIntegrityReport;
+    private scanLogIntegrityOnce;
+    /**
+     * Index the legacy pairs already in the log once (history written before the
+     * `sequence_pairs` table existed); appends maintain it from then on.
+     */
+    private backfillSequencePairs;
+    /**
+     * Record the sequence-enforcement epoch on the first start of this release (the log's
+     * highest delivery sequence then; see {@link SEQUENCE_ENFORCEMENT_EPOCH_KEY}) and
+     * back the append check with the partial unique index over sole-holder rows
+     * ({@link NODE_SEQ_UNIQUE_INDEX}), which therefore always exists: a legacy duplicate
+     * pair is stored unflagged. Replaces the earlier indexes (a full one, created only
+     * when the log had no duplicates, and one over the rows past the epoch, which a
+     * legacy client's pair would violate). Runs in one write transaction, so stores
+     * sharing a file agree on the epoch.
+     */
+    private ensureSequenceEnforcement;
     /**
      * Assign delivery sequences to any operations written before the column existed,
      * then seed the durable counter from the current max. Ordered by
@@ -1947,6 +4374,11 @@ declare class SqliteServerStore implements ServerStore {
      * allocation shared by every SqliteServerStore instance using the same file.
      */
     private nextDeliverySeq;
+    /**
+     * @param soleHolder - Nothing else held the (node, sequence) at insert: the row is
+     *   flagged `seq_unique` and covered by {@link NODE_SEQ_UNIQUE_INDEX}. False for a
+     *   legacy pair's second operation and for restored backup rows.
+     */
     private serializeOperation;
     private deserializeOperation;
     private assertOpen;
@@ -1959,7 +4391,9 @@ declare class SqliteServerStore implements ServerStore {
  *
  * @param options - Configuration options
  * @param options.filename - Path to SQLite database file. Defaults to ':memory:' for testing.
- * @param options.nodeId - Server node ID. Auto-generated if not provided.
+ * @param options.nodeId - Deprecated (a plain id becomes a legacy authoritative id). Leave
+ *   unset: the server authors under the persisted `kora:server:<deployment>:<instance>`.
+ * @param options.instanceId - Optional stable instance id
  * @returns A ready-to-use SqliteServerStore
  *
  * @example
@@ -1976,8 +4410,7 @@ declare class SqliteServerStore implements ServerStore {
  */
 declare function createSqliteServerStore(options: {
     filename?: string;
-    nodeId?: string;
-}): SqliteServerStore;
+} & ServerIdentityOptions): SqliteServerStore;
 
 /**
  * Auth provider that accepts all connections.
@@ -1988,33 +4421,147 @@ declare class NoAuthProvider implements AuthProvider {
     authenticate(_token: string): Promise<AuthContext>;
 }
 
+/**
+ * Thrown when a sync scope predicate value is `undefined` or `null` (also inside a
+ * `$in` list). Such a value matches every record that lacks the field, so a grant
+ * built from a failed lookup (for example `{ orgId: user.orgId }` with no org)
+ * would expose every unowned record. Kora refuses it instead (fail closed).
+ */
+declare class InvalidScopePredicateError extends KoraError {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string);
+}
+/** Thrown when a `$in` scope predicate is malformed or larger than the configured limit. */
+declare class ScopePredicateLimitError extends KoraError {
+    constructor(message: string, context: Record<string, unknown>);
+}
+
+interface ResolveSessionScopesOptions {
+    /** Scope map sent by the client during handshake. It can only NARROW the grant. */
+    handshakeScope?: ScopeMap$1;
+    /**
+     * The server grant from the auth provider. Its collection set is authoritative:
+     * a collection it does not list is not visible, whatever the handshake asks for.
+     * It may carry verified claim values under `$claims` (see `claimScopes` in
+     * `@korajs/core`), which are bound to every schema-scoped collection.
+     */
+    authScopes?: ScopeMap$1;
+    /**
+     * Verified, server-derived scope values (for example `{ userId: sub }`). Treated
+     * exactly like `$claims` in `authScopes`. Never pass client-supplied values here.
+     */
+    scopeValues?: Record<string, unknown>;
+    /**
+     * True when an auth provider authenticated this session. An authenticated
+     * session whose provider returned no grant at all is denied every
+     * schema-scoped collection instead of trusting the client handshake.
+     *
+     * Leave it false only for servers without an auth provider (or with
+     * `NoAuthProvider`), where the handshake is a client-side filter, not a grant.
+     * @default false
+     */
+    authenticated?: boolean;
+    /**
+     * What to do when a schema-scoped collection's bindings cannot all be resolved
+     * from the verified claims. `'deny'` hides the collection (fail closed);
+     * `'throw'` raises {@link ScopeRequiredError} so the caller can reject the
+     * handshake with `SCOPE_REQUIRED`.
+     * @default 'deny'
+     */
+    onUnresolved?: 'deny' | 'throw';
+}
+/** A schema-scoped collection the session was denied because a binding was unresolved. */
+interface DeniedScopeCollection {
+    collection: string;
+    /** Scope binding keys (for example `orgId`) that had no verified value. */
+    missingKeys: string[];
+}
+/** Detailed result of {@link resolveSessionScopeGrant}. */
+interface ResolvedSessionScopeGrant {
+    /**
+     * Effective scope map. `undefined` means "no scoping" and is only ever returned
+     * for unauthenticated servers without a grant. An empty object means "nothing
+     * visible".
+     */
+    scopes: ScopeMap$1 | undefined;
+    /** Collections denied because their scope bindings could not be resolved. */
+    denied: DeniedScopeCollection[];
+}
+/**
+ * Thrown (with `onUnresolved: 'throw'`) when an authenticated session cannot be
+ * bound to a schema-scoped collection because the server grant lacks a value.
+ */
+declare class ScopeRequiredError extends KoraError {
+    readonly denied: DeniedScopeCollection[];
+    constructor(denied: DeniedScopeCollection[]);
+}
+/**
+ * Resolve the effective per-session sync scope map.
+ *
+ * The result is the INTERSECTION of the server grant and the client handshake:
+ * - The collection set is the grant's collection set. A handshake can never add
+ *   a collection.
+ * - Per collection, handshake predicates only narrow: grant fields win, a
+ *   handshake field on an unconstrained field is added, and for an `$in` grant a
+ *   handshake value is used only when it is a subset of the granted values.
+ * - Schema-scoped collections bound from verified claims fail closed: an
+ *   unresolved binding denies the collection instead of producing `{}`.
+ *
+ * Invariant: the effective scope is a subset of the server grant, and no
+ * schema-scoped collection resolves to `{}` from claims for an authenticated
+ * principal.
+ *
+ * @returns The effective scope map; `undefined` only for unauthenticated servers
+ *   with neither a grant nor a handshake scope
+ */
+declare function resolveSessionScopes(schema: SchemaDefinition | null, options: ResolveSessionScopesOptions): ScopeMap$1 | undefined;
+/**
+ * Same as {@link resolveSessionScopes}, but also reports which collections were
+ * denied for unresolved bindings, so a caller can surface `SCOPE_REQUIRED`.
+ */
+declare function resolveSessionScopeGrant(schema: SchemaDefinition | null, options: ResolveSessionScopesOptions): ResolvedSessionScopeGrant;
+
 /**
  * Server-side awareness relay. Broadcasts ephemeral awareness states
  * (cursor positions, user presence) between connected clients.
  *
- * Awareness data is never persisted. The relay simply forwards awareness
- * updates from one client to all other connected clients, and broadcasts
- * removal notifications when a client disconnects.
+ * Awareness data is never persisted. Each session's awareness `clientId` is bound on
+ * registration: a session may only publish (or clear) its own state, never another
+ * client's, and its updates reach only clients in the same partition.
  */
 declare class AwarenessRelay {
     private readonly clients;
     /**
-     * Register a client for awareness broadcasting.
+     * Register a client for awareness broadcasting. A session registers once; later
+     * calls for an already-registered session are ignored, so a client cannot rebind
+     * itself to another client's id.
      *
      * @param sessionId - Unique session identifier
      * @param clientId - Client-assigned awareness ID
      * @param transport - Transport for sending messages to this client
+     * @param partition - Presence partition (clients only see their own partition)
+     */
+    addClient(sessionId: string, clientId: number, transport: ServerTransport, partition?: string): void;
+    /**
+     * True when the session is registered with the relay.
+     *
+     * @param sessionId - Session to check
      */
-    addClient(sessionId: string, clientId: number, transport: ServerTransport): void;
+    hasClient(sessionId: string): boolean;
     /**
-     * Remove a client and broadcast its removal to all remaining clients.
+     * Remove a client and broadcast its removal to the remaining clients in its partition.
      *
      * @param sessionId - Session ID of the disconnecting client
      */
     removeClient(sessionId: string): void;
     /**
-     * Handle an incoming awareness update from a client.
-     * Stores the state and relays to all other connected clients.
+     * Handle an incoming awareness update from a registered client.
+     *
+     * Only the sender's own entry is accepted: the message must be stamped with the
+     * sender's bound `clientId`, and only `states[clientId]` is stored and relayed.
+     * Entries for other clients are dropped, so a sender cannot overwrite or remove
+     * anyone else's presence. The sanitized update reaches only the sender's partition.
      *
      * @param sessionId - Session ID of the sending client
      * @param message - The awareness update message
@@ -2048,4 +4595,4 @@ declare class AwarenessRelay {
  */
 declare function createKoraServer(config: KoraSyncServerConfig): KoraSyncServer;
 
-export { type AuthContext, type AuthProvider, AwarenessRelay, type AwarenessRelayCallback, type ClientMetrics, ClientSession, type ClientSessionOptions, type CollectionQueryOptions, DEFAULT_MAX_SCOPE_PREDICATE_VALUES, type HttpPollResponse, HttpServerTransport, type HttpSyncRequest, type HttpSyncResponse, KoraAuthProvider, type KoraAuthProviderOptions, KoraSyncServer, type KoraSyncServerConfig, type LogEntry, type LogLevel, type Logger, type MaterializedRecord, MemoryServerStore, MixedAuthProvider, type MixedAuthProviderOptions, NoAuthProvider, type OperationDecision, type OperationRejection, type OperationValidationContext, type OperationValidator, PostgresServerStore, type ProductionHttpRoute, type ProductionHttpRouteContext, type ProductionHttpRouteRequest, type ProductionHttpRouteResponse, type ProductionServer, type ProductionServerConfig, RETRIABLE_REJECTION_CODES, type RelayCallback, type RouteApplyResult, type RouteConditionalApply, type RouteConditionalResult, type RouteMutation, type RoutePredicate, type RoutePredicateOperators, type RouteScopeOptions, ServerCloseHandler, ServerErrorHandler, ServerMessageHandler, ServerMetricsCollector, type ServerMetricsSnapshot, type ServerStatus, type ServerStore, ServerTransport, type SessionState, SqliteServerStore, TokenAuthProvider, type TokenAuthProviderOptions, type WsServerConstructor, type WsServerLike, WsServerTransport, type WsServerTransportOptions, type WsWebSocket, createDefaultLogger, createJsonLogger, createKoraServer, createPostgresServerStore, createPrettyLogger, createProductionServer, createSilentLogger, createSqliteServerStore, isRetriableRejection, normalizeScopeMap, operationMatchesScopes };
+export { type ApplyRemoteOptions, type AuthContext, type AuthProvider, AwarenessRelay, type AwarenessRelayCallback, type ClientMetrics, ClientSession, type ClientSessionOptions, type CollectionQueryOptions, DEFAULT_MAX_SCOPE_PREDICATE_VALUES, type DeniedScopeCollection, type FoldMigrationReport, type HttpPollResponse, HttpServerTransport, type HttpSyncRequest, type HttpSyncResponse, InvalidScopePredicateError, KoraAuthProvider, type KoraAuthProviderOptions, KoraSyncServer, type KoraSyncServerConfig, type LogEntry, type LogLevel, type Logger, type MaterializedRecord, MemoryServerStore, type MemoryServerStoreOptions, MixedAuthProvider, type MixedAuthProviderOptions, NoAuthProvider, type OperationDecision, type OperationRejection, type OperationValidationContext, type OperationValidator, PostgresServerStore, type ProductionHttpRoute, type ProductionHttpRouteContext, type ProductionHttpRouteRequest, type ProductionHttpRouteResponse, type ProductionServer, type ProductionServerConfig, RETRIABLE_REJECTION_CODES, type RelayCallback, type ResolveSessionScopesOptions, type ResolvedSessionScopeGrant, type RouteApplyResult, type RouteConditionalApply, type RouteConditionalResult, type RouteMutation, type RoutePredicate, type RoutePredicateOperators, type RouteScopeOptions, SERVER_NODE_PREFIX, ScopePredicateLimitError, ScopeRequiredError, ServerCloseHandler, ServerErrorHandler, ServerIdentityError, type ServerIdentityOptions, ServerMessageHandler, ServerMetricsCollector, type ServerMetricsSnapshot, type ServerSchemaOptions, type ServerStatus, type ServerStore, ServerStoreUnavailableError, ServerTransport, type SessionRevocation, type SessionState, type SessionTerminationCode, SqliteServerStore, type StoredOperationKey, type TerminateSessionsFilter, TokenAuthProvider, type TokenAuthProviderOptions, type TrustProxySetting, type UplinkAuthorizationCode, UplinkAuthorizationError, type UplinkAuthorizationResult, type WsServerConstructor, type WsServerLike, WsServerTransport, type WsServerTransportOptions, type WsWebSocket, authorizeUplinkWrite, createDefaultLogger, createJsonLogger, createKoraServer, createPostgresServerStore, createPrettyLogger, createProductionServer, createSilentLogger, createSqliteServerStore, isRetriableRejection, isServerNodeId, normalizeScopeMap, operationMatchesScopes, resolveSessionScopeGrant, resolveSessionScopes };