@korajs/server 1.0.0-beta.12 → 1.0.0-beta.14

package/dist/index.d.cts

@@ -1,7 +1,9 @@
-import { Operation, HybridLogicalClock, SchemaDefinition, BlobRef, KoraEventEmitter, OperationTransform, VersionVector, TimeSource } from '@korajs/core';
+import { KoraError, Operation, VersionVector, HLCTimestamp, RecordFieldVersions, FoldState, HybridLogicalClock, SchemaDefinition, OperationTransform, BlobRef, KoraEventEmitter, TimeSource, ScopeMap as ScopeMap$1 } from '@korajs/core';
+export { SCOPE_CLAIMS_KEY, claimScopes } from '@korajs/core';
 import * as _korajs_sync from '@korajs/sync';
-import { SyncStore, ApplyResult, MessageSerializer, SyncMessage, AwarenessUpdateMessage, YjsDocUpdateMessage, BlobChunkRequestMessage, BlobChunkResponseMessage } from '@korajs/sync';
-import { S as ServerTransport, a as ServerMessageHandler, b as ServerCloseHandler, c as ServerErrorHandler } from './server-transport-CU1BLWgr.cjs';
+import { SyncStore, ApplyResult, MessageSerializer, SyncMessage, EncryptionKeyRequestMessage, EncryptionKeyPutMessage, EncryptionKeyResponseMessage, WrappedKeyRecord, AwarenessUpdateMessage, YjsDocUpdateMessage, BlobChunkRequestMessage, BlobChunkResponseMessage } from '@korajs/sync';
+import { S as ServerTransport, a as ServerMessageHandler, b as ServerCloseHandler, c as ServerErrorHandler } from './server-transport-BGQkRCI4.cjs';
+import { SideEffectOp } from '@korajs/merge';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 import { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
 
@@ -36,7 +38,15 @@ type RoutePredicate = Record<string, RoutePredicateOperators>;
  */
 type ScopeMap = Record<string, Record<string, unknown>>;
 declare const DEFAULT_MAX_SCOPE_PREDICATE_VALUES = 100;
-/** Canonicalize bounded `$in` predicates so equivalent authorization has one signature. */
+/**
+ * Canonicalize bounded `$in` predicates so equivalent authorization has one signature.
+ *
+ * Fails closed: an `undefined`/`null` predicate value (also inside `$in`) would match
+ * every record lacking the field, so it is refused (RT-8).
+ *
+ * @throws {InvalidScopePredicateError} On an undefined/null predicate value
+ * @throws {ScopePredicateLimitError} On a malformed or oversized `$in`
+ */
 declare function normalizeScopeMap(scopes: ScopeMap, maxValues?: number): ScopeMap;
 /**
  * Returns true if an operation is visible to a session based on its scopes.
@@ -47,7 +57,91 @@ declare function normalizeScopeMap(scopes: ScopeMap, maxValues?: number): ScopeM
  * - All scoped field/value pairs must match the operation snapshot
  */
 declare function operationMatchesScopes(op: Operation, scopes: ScopeMap | undefined, fullRecord?: Record<string, unknown> | null): boolean;
+/** Why {@link authorizeUplinkWrite} refused a write. */
+type UplinkAuthorizationCode = 'SCOPE_VIOLATION' | 'INVALID_OPERATION';
+/** Result of {@link authorizeUplinkWrite}. */
+type UplinkAuthorizationResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    code: UplinkAuthorizationCode;
+    message: string;
+};
+/**
+ * Thrown by a server store when the uplink authorization re-check, evaluated inside
+ * the store's apply critical section against the row as it is at commit time,
+ * refuses an operation. Nothing was written.
+ */
+declare class UplinkAuthorizationError extends KoraError {
+    readonly rejectionCode: UplinkAuthorizationCode;
+    constructor(rejectionCode: UplinkAuthorizationCode, message: string, context?: Record<string, unknown>);
+}
+/**
+ * Decides whether an untrusted writer (a sync session or a scoped route) may apply
+ * `op`, given the record as it is currently stored and the writer's scope.
+ *
+ * This is the single authorization rule for every untrusted write path (sync
+ * uploads, `request.kora` routes, the conditional store path and the Yjs doc
+ * channel). It never reads `op.previousData` for scope decisions, because it is
+ * attacker-controlled, and it never lets op fields name a different record:
+ *
+ * 1. `op.data` / `op.previousData` must not carry an `id` other than `op.recordId`
+ *    (`INVALID_OPERATION`), whether or not scopes are configured.
+ * 2. Without scopes every (well-formed) write is allowed.
+ * 3. If a stored row exists (including a soft-deleted one) it must be in scope,
+ *    judged on the stored values only, for inserts, updates and deletes alike. This
+ *    stops editing, deleting or overwriting (same-id insert) another tenant's record.
+ * 4. The post-image must be in scope: `{...stored, ...op.data}` for updates,
+ *    `op.data` for inserts and the stored row for deletes. This stops moving a
+ *    record out of scope (ownership transfer is a trusted server-route operation).
+ *
+ * In both images `id` is `op.recordId`, assigned last.
+ *
+ * @param op - The operation the writer wants to apply
+ * @param storedRow - The record as stored now (including soft-deleted), or null
+ * @param scopes - The writer's uplink scope map, or undefined for no restriction
+ * @returns Whether the write is allowed, and why not when it is refused
+ */
+declare function authorizeUplinkWrite(op: Operation, storedRow: Record<string, unknown> | null | undefined, scopes: ScopeMap | undefined): UplinkAuthorizationResult;
 
+/** A stored legacy pair, reported to {@link ApplyRemoteOptions.onLegacySequencePair}. */
+interface LegacySequencePair {
+    operationId: string;
+    nodeId: string;
+    sequenceNumber: number;
+    /** The operations that already held the sequence. */
+    holderIds: string[];
+    /** True when accepted because the writer is a legacy client (not a pre-epoch holder). */
+    legacyWriter: boolean;
+}
+/**
+ * How the server resolved an uploaded operation it did NOT store under the submitted
+ * (node, sequence) (RT-43, RT-47):
+ * - `'ignored'`: the validator answered `ignore` (handled out of band, nothing stored);
+ * - `'refused'`: a terminal (non-retriable) rejection; the same id is answered with the
+ *   original rejection forever after;
+ * - `'stored-elsewhere'`: the id is stored under another sequence of the same node (a
+ *   client sequence repair renumbered it), acknowledged as a duplicate.
+ * A retriable rejection, and a `SEQUENCE_CONFLICT` (the client renumbers and resubmits
+ * under the same id), are never resolutions.
+ */
+type OperationResolutionOutcome = 'ignored' | 'refused' | 'stored-elsewhere';
+/** A durable record of how an uploaded operation was resolved without being stored. */
+interface OperationResolution {
+    operationId: string;
+    nodeId: string;
+    sequenceNumber: number;
+    outcome: OperationResolutionOutcome;
+    /** Rejection code, for `'refused'`. */
+    code: string | null;
+    /** Rejection message, for `'refused'`. */
+    message: string | null;
+}
+/** Where a stored operation sits in its node's sequence space. */
+interface StoredOperationKey {
+    nodeId: string;
+    sequenceNumber: number;
+}
 /**
  * A materialized record reconstructed from the operation log
  * or read from a materialized collection table.
@@ -100,6 +194,12 @@ interface ConditionalApplyContext {
      * it into operation creation) so they sort strictly after every prior write.
      */
     clock: HybridLogicalClock;
+    /**
+     * Read a record as stored (including a soft-deleted one) inside the store's
+     * conditional-apply transaction, for authorizing the built operations against the
+     * same state they commit over. Optional; callers fall back to a plain read.
+     */
+    readStoredRow?: (collection: string, id: string) => Promise<MaterializedRecord | null>;
 }
 /** Result of {@link ServerStore.applyConditional}. */
 interface ConditionalApplyResult {
@@ -119,6 +219,30 @@ interface ConditionalApplyResult {
 interface DeliveredOperation {
     operation: Operation;
     deliverySequence: number;
+    /**
+     * The record's scope-relevant values around this operation, captured from the
+     * server's own rows when it was applied (RT-14, RT-15). Absent (or null) for
+     * operations stored before snapshots existed that could not be backfilled.
+     */
+    scopeSnapshot?: OperationScopeSnapshot | null;
+}
+/**
+ * Scope-relevant field values of a record, captured by the store from its own rows
+ * when an operation is applied (never from the writer's `previousData`). Download
+ * visibility of a historical operation is judged on `post`, so a later ownership
+ * transfer does not disclose the record's earlier history to the new owner (RT-14),
+ * and a scope exit is judged from `pre` to `post` (RT-15).
+ *
+ * Only scalar fields (string, number, boolean, enum, timestamp) and `id` are kept:
+ * scope predicates compare with `Object.is`, so other kinds can never match. A
+ * string longer than {@link MAX_SCOPE_SNAPSHOT_STRING_LENGTH} is left out (fails
+ * closed for a scope on such a field) so a snapshot never copies large text.
+ */
+interface OperationScopeSnapshot {
+    /** Values before the operation; null when the record did not exist or was deleted. */
+    pre: Record<string, unknown> | null;
+    /** Values after it; a delete keeps the record's last values; null when unknown. */
+    post: Record<string, unknown> | null;
 }
 /**
  * Options for querying a materialized collection table.
@@ -137,11 +261,277 @@ interface CollectionQueryOptions {
     /** Include soft-deleted records (default: false) */
     includeDeleted?: boolean;
 }
+/**
+ * Options for {@link ServerStore.applyRemoteOperation}.
+ */
+interface ApplyRemoteOptions {
+    /**
+     * Authorization re-check for an operation submitted by an untrusted writer.
+     *
+     * The store calls it inside its apply critical section (the SQLite write
+     * transaction, the in-memory store's synchronous apply, or a Postgres
+     * transaction holding the per-record advisory lock shared with conditional
+     * applies) with the record as stored at that moment, including a soft-deleted
+     * one, or null when none exists. Returning a refusal aborts the apply and the
+     * store throws {@link UplinkAuthorizationError}; nothing is written.
+     *
+     * This closes the window between a caller's own pre-check and the write, where an
+     * ownership change or a same-id insert committed by another writer (or another
+     * server instance) could otherwise slip in.
+     */
+    authorize?: (storedRow: MaterializedRecord | null) => UplinkAuthorizationResult;
+    /**
+     * The writer does not reserve its sequence numbers inside the write transaction
+     * (a client that did not advertise the `sequenceReservation` handshake capability,
+     * Kora <= beta.12; RT-37). A different operation already holding the
+     * `(nodeId, sequenceNumber)` then does not refuse this one: both are stored as a
+     * legacy pair (each keeps its own delivery sequence, so both are delivered) instead
+     * of throwing {@link SequenceConflictError}. Default false: enforce.
+     */
+    legacySequenceWriter?: boolean;
+    /**
+     * Called once the operation was committed as the second holder of its sequence (a
+     * legacy pair), for logging and diagnostics. Never called for a refused write.
+     */
+    onLegacySequencePair?: (pair: LegacySequencePair) => void;
+}
+/** Options of {@link ServerStore.setSchema}. */
+interface ServerSchemaOptions {
+    /** Schema transforms the store folds with (transforms at fold time, RT-84). */
+    operationTransforms?: readonly OperationTransform[];
+}
+/** One stored end-to-end key record (opaque JSON) and its owner, as backups carry it. */
+interface EncryptionKeyRecordRow {
+    owner: string;
+    keyring: string;
+    revision: number;
+    /** The record's JSON, exactly as stored. */
+    record: string;
+}
 /**
  * Server-side store interface. Extends SyncStore with lifecycle,
  * introspection, and materialization methods needed by the sync server.
  */
 interface ServerStore extends SyncStore {
+    /**
+     * Apply an operation to the log and materialized state. With
+     * `options.authorize`, the authorization is re-checked atomically with the write
+     * (see {@link ApplyRemoteOptions}). Stores written before this option existed
+     * may ignore it; callers always pre-check as well.
+     *
+     * Built-in stores throw {@link SequenceConflictError} when a different operation
+     * already holds the operation's `(nodeId, sequenceNumber)` under enforcement
+     * (unless `options.legacySequenceWriter`, see {@link judgeSequenceHolders}), and return
+     * `'duplicate'` (writing nothing) for an operation id already stored, decided
+     * atomically with the write.
+     */
+    applyRemoteOperation(op: Operation, options?: ApplyRemoteOptions): Promise<ApplyResult>;
+    /**
+     * The version vector as committed in the shared database, read fresh (SRV-4). A
+     * store shared by several server instances must implement it: its synchronous
+     * {@link SyncStore.getVersionVector} can only reflect this instance's own writes.
+     * Optional; callers fall back to `getVersionVector()`.
+     */
+    readVersionVector?(): Promise<VersionVector>;
+    /**
+     * Several records of one collection by id, as stored (soft-deleted ones included),
+     * in one read: `id = ANY(...)` on Postgres, chunked `IN (...)` on SQLite (LMS #11).
+     * Ids with no row are absent from the result. Optional; the delivery stream falls
+     * back to one lookup per operation without it.
+     */
+    findRecordsByIds?(collection: string, ids: string[]): Promise<Map<string, MaterializedRecord>>;
+    /**
+     * Which of `ids` the operation log already holds, with the node and sequence each is
+     * stored under, in one read per batch (chunked `IN (...)`). The sync session asks before any other per-operation check, so a
+     * device re-uploading history the server already stores (the one-time upgrade
+     * re-upload, or an op the client's sequence repair renumbered under its original
+     * id) is acknowledged as a duplicate instead of being re-judged by today's
+     * authorization and validators. Optional; sessions fall back to a per-operation
+     * (node, sequence) lookup without it.
+     */
+    findStoredOperations?(ids: string[]): Promise<Map<string, StoredOperationKey>>;
+    /**
+     * Durably record how an uploaded operation was resolved without being stored under
+     * its sequence (RT-43, RT-47; see {@link OperationResolution}). Idempotent per
+     * operation id: the first resolution wins. The session awaits it BEFORE answering the
+     * client, so a client never acts on a resolution the server could forget. Optional
+     * for custom stores: without it an ignored tail op may be re-validated at reconnect
+     * and a refused id re-judged on resubmission.
+     */
+    recordOperationResolution?(resolution: OperationResolution): Promise<void>;
+    /**
+     * The resolutions recorded for `ids` under `nodeId` (ids resolved under another node
+     * are absent: the answer never crosses devices or tenants).
+     */
+    findOperationResolutions?(nodeId: string, ids: string[]): Promise<Map<string, OperationResolution>>;
+    /** The highest sequence number of `nodeId` with a recorded resolution (0 when none). */
+    getResolvedThrough?(nodeId: string): Promise<number>;
+    /**
+     * Forget the resolution recorded for `operationId` under `nodeId` (no-op when none).
+     * The session calls it for a stale `stored-elsewhere` record: one whose id the batch
+     * lookup did not find stored (RT-51). The operation is then judged normally, and its
+     * real outcome is recorded in place of the stale one. Optional for custom stores:
+     * without it the stale record is ignored but kept.
+     */
+    deleteOperationResolution?(nodeId: string, operationId: string): Promise<void>;
+    /**
+     * Every operation of `nodeId` at or below `throughSequence` that shares its sequence
+     * with another stored operation (a legacy pair, RT-37), ordered by sequence then
+     * delivery. A version-vector client reporting `throughSequence` for the node may hold
+     * only one of a pair, and a range read above its entry can never return the other
+     * (RT-48). Optional; without it such clients miss the second op of a pair.
+     */
+    getSequencePairOperations?(nodeId: string, throughSequence: number): Promise<Operation[]>;
+    /**
+     * The distinct node ids of the operations with `deliverySequence >
+     * afterDeliverySequence`. Optional; lets a handshake stop judging which nodes a
+     * scoped client will hear from as soon as every candidate was found visible.
+     */
+    getNodeIdsAfterDelivery?(afterDeliverySequence: number): Promise<string[]>;
+    /**
+     * Bind a client node id to the authenticated principal that first used it.
+     * Returns true when the node id is already owned by `userId`, was released by an
+     * admin (see {@link releaseNodeClaim}; the caller takes it over), or is unclaimed
+     * AND has no operation history. Returns false when another principal owns it, or
+     * when it is unclaimed but already has operations in the log: history written
+     * before node claims existed has no recorded writer, so nobody may adopt it
+     * until an admin releases it (RT-5). Called at handshake when auth is configured,
+     * so one user cannot upload operations under another user's device id. Every
+     * write after this check is preceded by a claim, so going forward the claim row
+     * records the writer of a node's history. Must be atomic per node id. Optional
+     * for custom stores; the built-in stores persist the claim.
+     */
+    claimNode?(nodeId: string, userId: string): Promise<boolean>;
+    /**
+     * Atomically claim a node id that has no real owner for `userId` (F1): a node
+     * with operation history but no claim (written before node claims existed, by a
+     * beta.12 or older server) or one an admin released (owner `''`). A node another
+     * principal owns is never taken. One statement, so there is no gap between a
+     * release and a claim another claimant could slip into. Returns true when
+     * `userId` owns the node afterwards. The server calls it only for a node whose id
+     * equals the device id the auth provider verified for that user. Optional for
+     * custom stores; without it such nodes stay refused until an admin binds them.
+     */
+    claimUnownedNode?(nodeId: string, userId: string): Promise<boolean>;
+    /**
+     * Admin release of a node id (RT-5): the next principal to claim it takes it
+     * over, even when the node has operation history. Returns true when the node had
+     * a claim or history to release, false when it was unknown.
+     */
+    releaseNodeClaim?(nodeId: string): Promise<boolean>;
+    /**
+     * The owner a node id is currently claimed by, or null when unclaimed (RT-21).
+     * Optional; anonymous provisional claims need it together with
+     * {@link replaceNodeClaim}.
+     */
+    getNodeClaimOwner?(nodeId: string): Promise<string | null>;
+    /**
+     * Atomically replace the owner of a node claim, only if it is still
+     * `expectedOwner` (compare-and-set, RT-21). Returns true when replaced. Used to
+     * confirm or re-issue an anonymous device's provisional claim; never creates one.
+     */
+    replaceNodeClaim?(nodeId: string, expectedOwner: string, newOwner: string): Promise<boolean>;
+    /**
+     * The wrapped encryption key record (JSON) of one owner's keyring, or null (ENC-1).
+     * The record holds only salt, KDF parameters and wrapped keys: never a usable key.
+     * Optional for custom stores; without it the server answers key requests with
+     * `unsupported` (it never keeps key records in memory only, which would fork a
+     * user's keys after a restart).
+     */
+    getEncryptionKeyRecord?(owner: string, keyring: string): Promise<string | null>;
+    /**
+     * Write a key record with compare-and-set: store `record` at `revision` only when the
+     * stored revision is `expectedRevision` (0: no record yet). Returns false when
+     * another write won. Must be atomic per (owner, keyring) across server instances.
+     */
+    putEncryptionKeyRecord?(owner: string, keyring: string, record: string, revision: number, expectedRevision: number): Promise<boolean>;
+    /**
+     * Stored key records: every one (for `exportBackup`; RT-104: a server restored from
+     * its backup must still hold the records its encrypted history needs), or one owner's
+     * (the key service tells another keyring's history from a lost record with it).
+     * Optional.
+     */
+    listEncryptionKeyRecords?(owner?: string): Promise<EncryptionKeyRecordRow[]>;
+    /**
+     * Key ids named by stored encrypted operations (their envelope's `keyId`), a sample
+     * of at most `limit` distinct ids (RT-104). `nodeOwner` restricts it to operations of
+     * nodes claimed by that principal (see {@link claimNode}); null means every node (a
+     * server without authentication, whose clients share one keyring). The key service
+     * reports them when an owner has no key record, so a new device can tell a lost
+     * record (encrypted history exists) from a first one. Optional; without it a new
+     * device cannot tell, and a fork it creates is merged later by a device holding the
+     * old ring.
+     */
+    getEncryptedKeyIds?(nodeOwner: string | null, limit: number): Promise<string[]>;
+    /**
+     * Record that `owner` holds the bytes behind a blob content hash (it pushed them,
+     * proving possession) (RT-11). Idempotent. Optional; without it the sync server
+     * keeps ownership in memory (lost on restart, not shared between instances).
+     */
+    recordBlobOwner?(hash: string, owner: string): Promise<void>;
+    /** The owners recorded for each hash (an empty list for unowned hashes). */
+    getBlobOwners?(hashes: string[]): Promise<Map<string, string[]>>;
+    /**
+     * Atomically make `owner` the first owner of a hash nobody owns yet. Returns true
+     * when `owner` owns the hash afterwards (newly, or already), false when someone
+     * else does. Must be atomic per hash across server instances.
+     */
+    claimBlobIfUnowned?(hash: string, owner: string): Promise<boolean>;
+    /**
+     * The scope snapshots captured when the given operations were applied (RT-14).
+     * Operations without one are absent from the result.
+     */
+    getOperationScopeSnapshots?(operationIds: string[]): Promise<Map<string, OperationScopeSnapshot>>;
+    /**
+     * The greatest HLC timestamp among every stored operation of one record (its
+     * newest field write), or null when the record has no operations (RT-19). A
+     * scope-entry operation is stamped with it so it never overrides newer client data.
+     */
+    getRecordLatestTimestamp?(collection: string, recordId: string): Promise<HLCTimestamp | null>;
+    /**
+     * Per-field versions of one live record, folded from its stored operations exactly
+     * as the materialization folds its values (RT-27): each field's version is the HLC
+     * of the write that produced its current value, plus the record's first and newest
+     * operation. Null when the record is deleted or has no operations. A scope-entry
+     * operation carries them so a receiver resolves every field on its own.
+     */
+    getRecordFieldVersions?(collection: string, recordId: string): Promise<RecordFieldVersions | null>;
+    /**
+     * The record's fold state (W7): the per-field CRDT state its row is projected from.
+     * Null when the record has no operations or its collection is not materialized. A
+     * scope-entry operation carries it (filtered to the fields the receiver may see) so
+     * the receiver merges richtext, counter and resolver fields exactly (RT-29).
+     */
+    getRecordFoldState?(collection: string, recordId: string): Promise<FoldState | null>;
+    /** Every stored operation of one record, in delivery (commit) order. */
+    getRecordOperations?(collection: string, recordId: string): Promise<Operation[]>;
+    /**
+     * The record's row as it would be after merging `op` into its fold state, with
+     * nothing written: the candidate a Tier-2 constraint check judges at ingest. Null
+     * when the record would not be live (deleted, or never inserted).
+     */
+    previewOperation?(op: Operation): Promise<MaterializedRecord | null>;
+    /**
+     * Node ids whose operations win `merge('server-authoritative')` fields in the fold:
+     * this store's own node id (every server-originated operation is authored by it)
+     * plus any configured extras. The sync server advertises them in the handshake so
+     * clients fold with the same authority.
+     */
+    getAuthoritativeNodeIds?(): string[];
+    /** Explicit authoritative ids the deployment revoked (RT-81); advertised at handshake. */
+    getRevokedAuthoritativeNodeIds?(): string[];
+    /**
+     * Every explicit id the deployment ever held authoritative, revoked ones included
+     * (RT-81). The session never accepts one as a device node id.
+     */
+    getEverAuthoritativeNodeIds?(): string[];
+    /**
+     * Keyed id of a server-derived operation (cascade, set-null, constraint correction):
+     * deterministic across every instance of the deployment, unpredictable to clients
+     * (RT-64). Built-in stores key it with a persisted deployment secret. A store
+     * without it falls back to the unkeyed `deriveSideEffectOpId`.
+     */
+    deriveServerOperationId?(parentOpId: string, ruleId: string, targetRecordId: string): Promise<string>;
     /** Close the store and release resources */
     close(): Promise<void>;
     /** Get the total number of stored operations */
@@ -188,10 +578,23 @@ interface ServerStore extends SyncStore {
      * tables from the operation log.
      *
      * @param schema - The schema definition describing all collections
+     * @param options - `operationTransforms`: the schema transforms the store folds with
+     *   (transforms at fold time, RT-84). Pass the same list as the sync server's
+     *   `operationTransforms`, so the startup re-materialization folds with them once.
      */
-    setSchema(schema: SchemaDefinition): Promise<void>;
+    setSchema(schema: SchemaDefinition, options?: ServerSchemaOptions): Promise<void>;
     /** Schema used for materialized tables and server-side validation, if set. */
     getSchema(): SchemaDefinition | null;
+    /**
+     * Set the schema transforms the store folds with (RT-84). Operations are stored
+     * exactly as uploaded; the fold merges each operation as
+     * `operationSchemaView(op, schema.version, transforms)` reads it. Transforms are part
+     * of the fold plan fingerprint: a change re-folds every record (once). The sync
+     * server calls this with its `operationTransforms` at construction.
+     */
+    setOperationTransforms?(transforms: readonly OperationTransform[]): Promise<void>;
+    /** The schema transforms the store folds with (empty when none). */
+    getOperationTransforms?(): readonly OperationTransform[];
     /**
      * Get all records from a materialized collection.
      * When schema is set, reads directly from the collection table (O(1) indexed).
@@ -303,6 +706,68 @@ interface ApplyServerOperationResult {
     appliedOperations: Operation[];
     /** Rejection reason when the operation was not applied */
     rejection?: OperationRejection;
+    /**
+     * Side effects of an applied delete that were NOT derived because
+     * {@link ApplyServerOperationOptions.isAuthoredSideEffect} claimed them (RT-69). The
+     * caller must derive each one with {@link deriveServerSideEffects} unless the
+     * author's own copy is stored.
+     */
+    deferredSideEffects?: SideEffectOp[];
+}
+/**
+ * Decides whether an untrusted writer may cause one referential side effect of its
+ * delete. `effect` is the side effect shaped as the operation the server would
+ * write; `stored` is the affected record as stored now (including soft-deleted).
+ */
+type SideEffectAuthorizer = (effect: Operation, stored: MaterializedRecord | null) => UplinkAuthorizationResult;
+/** Options for {@link applyServerOperation}. */
+interface ApplyServerOperationOptions {
+    /**
+     * Uplink authorization for an untrusted writer, re-evaluated by the store inside
+     * its apply critical section against the row as stored at commit time (see
+     * `ApplyRemoteOptions.authorize`). A refusal becomes a non-retriable rejection and
+     * nothing is written.
+     */
+    authorize?: ApplyRemoteOptions['authorize'];
+    /**
+     * Authorization of the referential side effects (cascade delete, set-null) an
+     * untrusted writer's delete would cause (RT-10). Every side effect is checked
+     * against the writer's own scope BEFORE the delete is applied; if any falls
+     * outside it, the whole delete is refused and nothing is written.
+     *
+     * Design: integrity is judged on ALL children, in every tenant (a restrict or a
+     * cross-tenant cascade is never silently skipped, which would leave dangling
+     * references), but the writer learns nothing about children it cannot see: a
+     * restrict violation and an unauthorized side effect are refused with the same
+     * generic `RESTRICTED` rejection, with no ids and no counts. Setting `authorize`
+     * alone also switches restrict refusals to the generic form.
+     */
+    authorizeSideEffect?: SideEffectAuthorizer;
+    /**
+     * The writer is a legacy client that does not reserve sequence numbers (RT-37): a
+     * different operation under a held `(nodeId, sequenceNumber)` is stored as a legacy
+     * pair instead of being refused with `SEQUENCE_CONFLICT`. Applies to the primary
+     * operation only; server-originated side effects are always enforced.
+     */
+    legacySequenceWriter?: boolean;
+    /** See `ApplyRemoteOptions.onLegacySequencePair`; for the primary operation. */
+    onLegacySequencePair?: ApplyRemoteOptions['onLegacySequencePair'];
+    /**
+     * True for a referential side effect of this delete that the writer authored itself
+     * (its own cascade or set-null, later in the same upload, RT-69). Such an effect is
+     * not derived now but returned in `deferredSideEffects`, so the log stores one copy
+     * per child instead of the author's and the server's. Effects it does not claim (a
+     * child the author did not know, a legacy client that authors no cascades) are
+     * derived as before.
+     */
+    isAuthoredSideEffect?: (effect: SideEffectOp) => boolean;
+    /**
+     * The operation as the server schema reads it (transforms at fold time, RT-84), when
+     * the caller already computed it. Shape, constraint and referential checks judge the
+     * view; the store keeps `op` exactly as given and folds the same view. Default: the
+     * store's own view (`serverOperationView`).
+     */
+    view?: Operation;
 }
 
 /**
@@ -318,6 +783,13 @@ interface ServerMetricsSnapshot {
     uniqueOperationsReceived: number;
     duplicateOperationsReceived: number;
     rejectedOperations: number;
+    /**
+     * Operations from protocol-1 (beta.12) clients stored with an id that could not be
+     * verified (RT-71). Non-zero only while beta.12 clients write `undefined` members.
+     */
+    unverifiedLegacyOperations: number;
+    /** Uploads refused for reusing a stored operation id with other content (RT-77). */
+    forgedDuplicates: number;
     operationsSent: number;
     bytesReceived: number;
     bytesSent: number;
@@ -352,6 +824,8 @@ declare class ServerMetricsCollector {
     private uniqueOperationsReceived;
     private duplicateOperationsReceived;
     private rejectedOperations;
+    private unverifiedLegacyOperations;
+    private forgedDuplicates;
     private operationsSent;
     private bytesReceived;
     private bytesSent;
@@ -376,6 +850,10 @@ declare class ServerMetricsCollector {
     }): void;
     /** Record operations sent to a client. */
     recordSent(sessionId: string, count: number, byteSize: number): void;
+    /** Record an operation stored with an unverified legacy id (RT-71). */
+    recordUnverifiedLegacyOperation(): void;
+    /** Record an upload refused for reusing a stored id with other content (RT-77). */
+    recordForgedDuplicate(): void;
     /** Record an error. */
     recordError(): void;
     /** Set the schema version. */
@@ -440,6 +918,210 @@ declare function createSilentLogger(): Logger;
  */
 declare function createDefaultLogger(): Logger;
 
+/**
+ * Resolves a blob chunk by content hash from server-side storage. Optional: when
+ * provided, the server can answer chunk requests directly from its own store
+ * (central-store deployment). When absent, the server acts as a pure relay,
+ * forwarding chunk requests to peer sessions and their responses back.
+ */
+type ResolveBlobChunk = (hash: string) => Promise<Uint8Array | null>;
+
+/** Input to {@link BlobAccessIndex.authorizeReference}. */
+interface BlobReferenceRequest {
+    /** The content hash (blob, manifest or chunk) the writer wants to reference. */
+    hash: string;
+    /** The writer's download scope, or undefined for an unscoped writer. */
+    scopes: ScopeMap | undefined;
+    /**
+     * Stable ownership key of the writer: the user id for a signed-in principal, the
+     * node-claim owner for an anonymous device, a `kora:route:` key for a scoped route.
+     */
+    owner: string;
+    /** Hashes the written record already references as stored (unchanged references). */
+    alreadyReferenced?: ReadonlySet<string>;
+}
+/**
+ * Answers "does a live record inside this download scope reference this blob
+ * hash?" for the blob relay (RT-1), and "may this writer reference this hash?" at
+ * ingest (RT-11).
+ *
+ * **A content hash is not a secret.** Hashes of well-known content can be computed
+ * by anyone, and they travel in records, manifests and logs. So knowing a hash never
+ * grants access: a write may reference a hash only when the writer can already read
+ * a record that references it, or has proven possession of the bytes (pushed them).
+ * Only in peer-relay mode (no central store, so nothing can be pre-claimed and then
+ * read back from the server) may the first writer of a hash nobody references or
+ * owns claim it by reference alone.
+ *
+ * A hash is referenced in a scope when a live (not deleted) record in scope has a
+ * blob field whose `BlobRef.manifestHash` (or, for a bare reference without a
+ * manifest, `BlobRef.hash`) equals it, or when it is a chunk listed in such a manifest and the chunk is unowned or shares an owner with
+ * the manifest (so a crafted manifest listing someone else's chunk hashes exposes
+ * nothing). Manifests are read through `resolveBlobChunk` (central store) or learned
+ * from manifest bytes verified in transit.
+ *
+ * Cost: the referenced set of a scope is built by a scoped query over every
+ * collection that declares a blob field (O(records in scope with blobs)). It is
+ * cached per scope, rebuilt after a write to one of the blob collections it scanned
+ * ({@link invalidate}) or after `ttlMs` (writes through another server instance),
+ * and concurrent lookups for one scope share a single rebuild (RT-17). A full hash
+ * index in the store would make this O(1); this is the interim, correctness-first
+ * form.
+ */
+declare class BlobAccessIndex {
+    private readonly store;
+    private readonly resolveBlobChunk;
+    private readonly ttlMs;
+    private readonly byScope;
+    /** Rebuilds in progress per scope key, shared by concurrent lookups (RT-17). */
+    private readonly inflight;
+    /** manifestHash -> chunk hashes it lists (only from bytes verified against the hash). */
+    private readonly manifestChunks;
+    /** chunkHash -> manifests listing it. */
+    private readonly chunkManifests;
+    /** Ownership fallback for stores without blob-owner persistence. */
+    private readonly memoryOwners;
+    private globalGeneration;
+    private readonly collectionGeneration;
+    constructor(store: ServerStore, resolveBlobChunk: ResolveBlobChunk | null, ttlMs?: number);
+    /**
+     * Forget cached scope sets because records changed. With `collections`, only sets
+     * built from those collections are dropped (a write to a collection without blob
+     * fields drops nothing); without, every set is dropped (for example writes made
+     * through another server instance).
+     */
+    invalidate(collections?: Iterable<string>): void;
+    /**
+     * True when a live record inside `scopes` references `hash`.
+     *
+     * @param scopes - The session's download scope, or undefined for unscoped
+     * @param hash - The requested content hash
+     */
+    isReferenced(scopes: ScopeMap | undefined, hash: string): Promise<boolean>;
+    /**
+     * Decide whether a writer may reference `hash` in a blob field (RT-11). Allowed
+     * when the record already referenced it, when a live record inside the writer's
+     * download scope references it, when the writer owns it (pushed the bytes, or
+     * claimed it first), or when nobody references, owns or stores it yet: then the
+     * writer claims it, atomically, so a later forger cannot.
+     */
+    authorizeReference(request: BlobReferenceRequest): Promise<boolean>;
+    /** True when `owner` pushed (or first claimed) the bytes behind `hash`. */
+    isOwnedBy(hash: string, owner: string): Promise<boolean>;
+    /**
+     * Record that `owner` pushed bytes verified to hash to `hash` (proof of
+     * possession), and learn the chunk list when the bytes are a manifest.
+     */
+    recordPush(hash: string, bytes: Uint8Array, owner: string): Promise<void>;
+    /**
+     * When `bytes` are a manifest, true only if the pusher may reference every chunk
+     * it lists (the same rule as {@link authorizeReference}); true for non-manifest
+     * bytes. A manifest listing someone else's chunks is refused before it is stored.
+     */
+    authorizeManifestPush(bytes: Uint8Array, scopes: ScopeMap | undefined, owner: string): Promise<boolean>;
+    /**
+     * Learn a manifest's chunk list from bytes already verified to hash to `hash`.
+     * Bytes that are not a manifest are ignored. Unowned chunks of an owned manifest
+     * are claimed for the manifest's owner, so a manifest crafted later cannot adopt
+     * them.
+     */
+    observeVerifiedBytes(hash: string, bytes: Uint8Array): void;
+    private claimChunksForManifestOwner;
+    private currentStamp;
+    private isCurrent;
+    private blobCollections;
+    private directHashes;
+    private build;
+    /** Read unknown manifests from the central store, verifying them against their hash. */
+    private loadManifests;
+    private ownersOf;
+    private addOwner;
+    private claim;
+    private rememberMemoryOwner;
+    private rememberManifest;
+    private forgetManifest;
+}
+
+/**
+ * Minimal interface for a ws.WebSocket instance.
+ * Allows dependency injection for testing without importing ws directly.
+ */
+interface WsWebSocket {
+    readyState: number;
+    send(data: string | Uint8Array, callback?: (err?: Error) => void): void;
+    close(code?: number, reason?: string): void;
+    on(event: string, listener: (...args: unknown[]) => void): void;
+    removeAllListeners(): void;
+    /** Send a ping frame (ws). Without it, no liveness probing happens. */
+    ping?(): void;
+    /** Destroy the socket at once, emitting `close` (ws). Falls back to `close()`. */
+    terminate?(): void;
+    /** Bytes queued and not yet written to the network (ws). */
+    readonly bufferedAmount?: number;
+}
+/**
+ * Options for WsServerTransport.
+ */
+interface WsServerTransportOptions {
+    /** Message serializer. Defaults to JsonMessageSerializer. */
+    serializer?: MessageSerializer;
+    /**
+     * Interval between WebSocket pings, in ms (SRV-6). A connection that leaves
+     * `maxMissedPongs` pings in a row unanswered (and sends nothing else meanwhile) is
+     * terminated, which runs Kora's normal close path. Defaults to 25 seconds; 0
+     * disables probing. Keep it at 15 seconds or more on mobile networks.
+     */
+    heartbeatIntervalMs?: number;
+    /** Unanswered pings before the connection is terminated. Defaults to 2. */
+    maxMissedPongs?: number;
+    /**
+     * Bytes that may be queued for this client before it is disconnected as a slow
+     * consumer. Defaults to 32 MiB; 0 disables the ceiling.
+     */
+    maxBufferedBytes?: number;
+}
+/**
+ * Server-side transport wrapping a ws.WebSocket connection.
+ * Created for each incoming client connection.
+ *
+ * It probes liveness with WebSocket pings (both the standalone server and
+ * `createProductionServer` create their connections through it), so a half-open
+ * connection, a peer that vanished without a FIN, is detected and closed instead of
+ * holding a session forever.
+ */
+declare class WsServerTransport implements ServerTransport {
+    private readonly ws;
+    private readonly serializer;
+    private messageHandler;
+    private closeHandler;
+    private errorHandler;
+    private readonly maxMissedPongs;
+    private readonly maxBufferedBytes;
+    private heartbeatTimer;
+    private missedPongs;
+    private terminated;
+    constructor(ws: WsWebSocket, options?: WsServerTransportOptions);
+    send(message: SyncMessage): void;
+    onMessage(handler: ServerMessageHandler): void;
+    onClose(handler: ServerCloseHandler): void;
+    onError(handler: ServerErrorHandler): void;
+    isConnected(): boolean;
+    close(code?: number, reason?: string): void;
+    bufferedAmount(): number;
+    /**
+     * Ping every `intervalMs`; terminate once `maxMissedPongs` pings in a row went
+     * unanswered. A pong or any inbound message proves the peer alive.
+     */
+    private startHeartbeat;
+    private stopHeartbeat;
+    /**
+     * Drop the connection at once. ws emits `close` from `terminate()`, which runs
+     * Kora's normal close path (session, relays and side channels are released).
+     */
+    private terminate;
+    private setupListeners;
+}
+
 /**
  * Minimal interface for a ws.WebSocketServer instance.
  * Allows dependency injection for testing without importing ws directly.
@@ -458,6 +1140,8 @@ type WsServerConstructor = new (options: {
     port?: number;
     host?: string;
     path?: string;
+    maxPayload?: number;
+    perMessageDeflate?: false | Record<string, unknown>;
 }) => WsServerLike;
 /**
  * Self-hosted sync server. Accepts WebSocket connections from clients,
@@ -480,22 +1164,74 @@ declare class KoraSyncServer {
     private readonly schemaVersion;
     private readonly supportedSchemaVersions;
     private readonly operationTransforms;
+    /** The store's re-fold for the configured transforms (RT-84), awaited by start(). */
+    private storeTransformsReady;
     private readonly port;
     private readonly host;
     private readonly path;
     private readonly logger;
     private readonly metrics;
     private readonly awarenessRelay;
+    /** Reads the records presence cursors name, for every session (F16). */
+    private readonly presenceRecords;
+    /** The record each session's current presence cursor names (F16). */
+    private readonly presenceTargets;
+    /** The sessions whose presence cursor names each record, by record key. */
+    private readonly presenceTargetsByKey;
+    /**
+     * Audience re-decisions running, one per record: a write while one runs marks it
+     * dirty, so it reads again and the last decision applied is always from a read that
+     * began after the last write (never an older read finishing late).
+     */
+    private readonly presenceRefreshes;
     private readonly yjsDocRelay;
     private readonly blobChunkRelay;
+    /** Wrapped encryption key records (ENC-1, D4b), persisted in the server store. */
+    private readonly encryptionKeys;
+    /** Which blob hashes each download scope may obtain (RT-1). */
+    private readonly blobAccess;
     private readonly persistBlobChunk;
     private readonly maxOperationBytes;
     private readonly maxOpsPerMinute;
+    /** Per-principal ingest budget per minute; 0 when disabled. */
+    private readonly maxOpsPerMinutePerUser;
+    private readonly allowLegacyAnonymousClaims;
+    private readonly deviceNodeHandover;
+    private readonly unscopedSharing;
+    private readonly anonymousClaimTtlMs;
+    private readonly maxOpsPerBatch;
+    private readonly maxScopePredicateValues;
+    private readonly maxMessageBytes;
+    private readonly heartbeatIntervalMs;
+    private readonly appHeartbeatIntervalMs;
+    private readonly encryptionPolicy;
+    private readonly handshakeTimeoutMs;
+    private readonly maxBufferedBytes;
+    private readonly deliveryHighWaterBytes;
+    private readonly perMessageDeflate;
+    /**
+     * Ingest rate limiters by device node id, shared by that node's sessions so a
+     * reconnect does not reset the budget (SRV-6). Entries idle past the window are
+     * dropped by the background tick; insertion order doubles as LRU order.
+     */
+    private readonly rateLimiters;
+    /**
+     * Ingest budgets by authenticated principal, shared by every node of that user, so
+     * minting node ids does not multiply the per-node budget. Expired like the node map.
+     */
+    private readonly userRateLimiters;
+    private readonly blobLimits;
     private readonly validateOperation;
     private readonly koraContext;
     private readonly sessions;
-    private readonly httpClients;
-    private readonly httpSessionToClient;
+    /**
+     * HTTP long-poll sessions by their server-issued, high-entropy id (RT-2). Each is
+     * bound to the principal that opened it; every request must re-authenticate as it.
+     */
+    private readonly httpSessions;
+    /** Internal ClientSession id -> HTTP session id, for cleanup on close. */
+    private readonly httpSessionIdBySession;
+    private readonly httpSessionIdleTimeoutMs;
     private readonly serverVersion;
     private wsServer;
     private running;
@@ -508,6 +1244,17 @@ declare class KoraSyncServer {
     private deliveryPollTimer;
     private lastObservedDeliverySequence;
     private deliveryPollInFlight;
+    /**
+     * Re-validates every live session's credential against the auth provider, so a
+     * revocation persisted by ANOTHER server instance (whose in-process revocation
+     * listeners never reach this one) still ends the session here (RT-18).
+     */
+    private readonly sessionRevalidationIntervalMs;
+    private sessionRevalidationTimer;
+    private lastSessionRevalidationAtMs;
+    private sessionRevalidationInFlight;
+    /** Unsubscribes from the auth provider's revocation feed (AUTH-11). */
+    private revocationUnsubscribe;
     /**
      * Relay operations a client never acknowledged before it disconnected, buffered by
      * client node id so they can be redelivered on its next connection. Bounded per
@@ -517,19 +1264,142 @@ declare class KoraSyncServer {
     private static readonly MAX_ORPHANED_RELAY_OPS_PER_NODE;
     private static readonly ORPHANED_RELAY_TTL_MS;
     constructor(config: KoraSyncServerConfig);
+    /**
+     * Follow the auth provider's revocation feed, when it has one, so revoking a
+     * device or user ends its live sessions without any wiring by the app.
+     */
+    private ensureRevocationSubscribed;
+    /**
+     * End live sync sessions whose credential was revoked (AUTH-11).
+     *
+     * Each matching session receives a retriable `AUTH_REVOKED` (or `AUTH_EXPIRED`)
+     * error and is closed. The client refreshes its credentials and re-handshakes,
+     * so the server authenticates it again: a still-valid device reconnects, a
+     * revoked one is refused. Sessions still in their handshake are refused as soon
+     * as their principal is known.
+     *
+     * `createKoraAuthServer().bindSyncServer(server)` calls this on device revoke,
+     * sign-out, password reset or change, and admin revoke. A provider exposing
+     * `onRevoke` (the built-in one does) is followed automatically.
+     *
+     * @param filter - `userId` ends every session of that user; with `deviceId`,
+     *   only that device's sessions. At least one of the two is required.
+     * @returns The number of established sessions that were closed
+     *
+     * @example
+     * ```typescript
+     * server.terminateSessions({ userId: 'u1', deviceId: 'laptop' })
+     * ```
+     */
+    terminateSessions(filter: TerminateSessionsFilter): number;
+    /**
+     * Admin release of a device node id (RT-5). The next principal to handshake with
+     * this node id claims it, even when the node already has operation history.
+     *
+     * Use it to hand over operation history written before node claims existed (an
+     * upgrade from beta.12, where nobody may adopt such a node until it is released),
+     * or to reassign a lost device's node id. Live sessions on that node id are ended
+     * with a retriable `NODE_RELEASED` error so the handover starts clean.
+     *
+     * @param nodeId - The device node id to release
+     * @returns True when the node had a claim or history to release; false when it
+     *   was unknown or the store does not support node claims
+     *
+     * @example
+     * ```typescript
+     * await server.releaseNodeClaim('0190a1b2-...')
+     * ```
+     */
+    releaseNodeClaim(nodeId: string): Promise<boolean>;
     private ensureBackgroundTimersStarted;
+    /**
+     * Re-validate the credential of every live session with the auth provider and end
+     * the sessions whose credential is no longer accepted (RT-18).
+     *
+     * Revocations are persisted by the auth stores (token, device and per-user
+     * cut-offs), but `onRevoke` listeners only run in the process that handled the
+     * revocation. Every instance therefore re-checks its own live sessions
+     * periodically (`sessionRevalidationIntervalMs`, default 30 seconds, also driven by
+     * the delivery poll tick) by authenticating the session's credential again. A
+     * session whose credential is refused, or now resolves to another principal, gets
+     * a retriable `AUTH_REVOKED` (or `AUTH_EXPIRED`) and is closed. A provider error
+     * (for example the auth database is unreachable) ends nothing: it is logged and the
+     * next pass retries, so an outage does not disconnect every client.
+     *
+     * @returns The number of sessions ended by this pass
+     *
+     * @example
+     * ```typescript
+     * // After revoking through another instance's admin API:
+     * await server.revalidateSessions()
+     * ```
+     */
+    revalidateSessions(): Promise<number>;
+    /**
+     * Re-resolve one user's grant on every live session of that user now, instead of
+     * waiting for the next revalidation pass (`sessionRevalidationIntervalMs`). Call it
+     * after a membership change the auth provider's grant depends on: an invitation
+     * accepted, a collaborator removed, a role changed.
+     *
+     * Each of the user's sessions re-authenticates its credential with the provider. A
+     * session whose resolved download or upload scope changed ends with a retriable
+     * `SCOPE_CHANGED`; its client reconnects at once and receives the new grant. A
+     * narrowed grant applies the client's `scopeExit` policy at that handshake
+     * (`'retract'` hides the rows that left the scope), and the device's unsynced writes
+     * outside the new upload scope are refused. A session still in its handshake
+     * re-checks as soon as it is established, so a grant read before the change never
+     * outlives this call. Sessions whose grant did not change are kept.
+     *
+     * Only this process's sessions are refreshed. Other instances apply the change at
+     * their next revalidation pass, or call this too (for example from a pub/sub
+     * message).
+     *
+     * @param userId - The user whose grant changed (the auth provider's `userId`)
+     * @returns The number of sessions this call ended
+     *
+     * @example
+     * ```typescript
+     * await removeCollaborator(documentId, bobId)
+     * await server.refreshScopes(bobId)
+     * ```
+     */
+    refreshScopes(userId: string): Promise<number>;
+    /** Run {@link revalidateSessions} from the delivery poll tick once the interval elapsed. */
+    private maybeRevalidateSessions;
     /**
      * Retransmit relay batches that connected clients have not acknowledged within
      * `staleMs`. Called on a periodic tick and directly by tests. Redelivering an
      * already-applied operation is harmless (clients dedup by content-addressed id).
      */
     retransmitPendingRelays(staleMs?: number): void;
+    /**
+     * The ingest rate limiter of a device node, created on first use and shared by
+     * every session of that node, so reconnecting does not buy a fresh budget (SRV-6).
+     */
+    private rateLimiterFor;
+    /**
+     * Forget rate limiters of nodes with no live session whose window has long
+     * passed: their budget would be full again anyway.
+     */
+    private expireIdleRateLimiters;
+    /** Close HTTP long-poll sessions that sent no request within the idle timeout. */
+    private expireIdleHttpSessions;
     /**
      * Check whether the authoritative delivery log advanced without passing through
      * this server instance, then wake delivery-watermark sessions to scan from their
      * own acknowledged cursors. Session-level filtering remains the only fan-out path.
      */
     pollDeliveryLog(): Promise<void>;
+    /**
+     * Invalidate cached blob access sets for the collections written between two
+     * delivery frontiers. Falls back to dropping every set when the gap is large.
+     */
+    private invalidateBlobAccessSince;
+    /**
+     * The blob reference authority shared by every session and route (RT-11).
+     * @internal Used by the route context; not part of the public API.
+     */
+    getBlobAccessIndex(): BlobAccessIndex;
     /**
      * Buffer relay operations a disconnected client never acknowledged, keyed by its
      * node id, deduped by operation id and bounded by count. Redelivered when the
@@ -572,19 +1442,50 @@ declare class KoraSyncServer {
     /**
      * Handle one HTTP sync request for a long-polling client.
      *
-     * A stable `clientId` identifies the logical connection across requests.
+     * The POST that opens a session (the handshake, sent without `sessionId`) creates
+     * it and answers with a server-issued, high-entropy session id in the
+     * `x-kora-session` response header. Every later request must name that id.
+     *
+     * With an auth provider, EVERY request is authenticated from its `authorization`
+     * header and must resolve to the same principal (user, device and anonymity) as
+     * the request that opened the session and as the session's handshake, so knowing
+     * a session id alone grants nothing (RT-2). Sessions with no request for
+     * `httpSessionIdleTimeoutMs` are closed.
+     *
+     * Responses: 202 (POST accepted), 200/204/304 (GET), 400 (malformed), 401
+     * (credential missing or invalid), 403 (credential of another principal), 404
+     * (unknown or expired session), 405 (method), 410 (session closed).
      */
     handleHttpRequest(request: HttpSyncRequest): Promise<HttpSyncResponse>;
     /**
-     * Handle an incoming client connection (attach mode).
-     * Creates a new ClientSession for the transport.
-     *
-     * @param transport - The server transport for the new connection
-     * @returns The session ID
+     * Authenticate one HTTP request. Returns the principal identity, null when the
+     * server has no real auth provider, or 'unauthorized'.
      */
-    handleConnection(transport: ServerTransport): string;
+    private authenticateHttpRequest;
     /**
-     * Get the current server status.
+     * True when a request's principal is the one that opened the session and, once
+     * the handshake authenticated, the session's own principal.
+     */
+    private httpPrincipalMatches;
+    /**
+     * Handle an accepted WebSocket (attach mode with `ws`): wraps it in a
+     * {@link WsServerTransport} configured like the standalone server's (serializer,
+     * ping/pong liveness probing, send-buffer ceiling) and starts a session.
+     *
+     * @param ws - A `ws` WebSocket from `WebSocketServer.handleUpgrade` or `connection`
+     * @returns The session ID
+     */
+    handleWebSocket(ws: WsWebSocket): string;
+    /**
+     * Handle an incoming client connection (attach mode).
+     * Creates a new ClientSession for the transport.
+     *
+     * @param transport - The server transport for the new connection
+     * @returns The session ID
+     */
+    handleConnection(transport: ServerTransport): string;
+    /**
+     * Get the current server status.
      */
     getStatus(): Promise<ServerStatus>;
     /**
@@ -599,9 +1500,10 @@ declare class KoraSyncServer {
      * client only receives the operation if it falls within that client's scope.
      *
      * @param op - A fully-formed, server-originated operation to apply
+     * @param options - Optional in-store authorization (used by scoped routes)
      * @returns The apply result, including any server-generated side-effect ops
      */
-    applyLocalOperation(op: Operation): Promise<ApplyServerOperationResult>;
+    applyLocalOperation(op: Operation, options?: ApplyServerOperationOptions): Promise<ApplyServerOperationResult>;
     /**
      * Relay already-applied, server-originated operations to every connected client.
      * Used by the conditional route apply, which commits its operations atomically
@@ -626,11 +1528,65 @@ declare class KoraSyncServer {
      * Get the number of currently connected clients.
      */
     getConnectionCount(): number;
+    /**
+     * Node ids whose operations win `merge('server-authoritative')` fields in the fold
+     * (W7): the store's own node id, which authors every server-originated operation
+     * (side effects, constraint corrections, route writes), plus any extras the store
+     * was configured with (`authoritativeNodeIds` store option). This is the one source
+     * of truth: every session advertises exactly this list in the handshake, so clients
+     * fold with the same authority as the server's stores.
+     */
+    get authoritativeNodeIds(): string[];
+    /**
+     * Blob access policy (RT-1): true when the session is streaming and a live record
+     * inside its download scope references the hash. Gates the central store.
+     */
+    private sessionReferencesBlob;
+    /** True when a session other than `exceptSessionId` is connected as `nodeId`. */
+    private isNodeLive;
+    /**
+     * Central-store read policy (RT-1, RT-25): the session owns the hash (it pushed
+     * the bytes) or a live record inside its download scope references it.
+     */
+    private sessionMayReadStoredBlob;
+    /**
+     * Blob access policy (RT-1): a request may be forwarded to a peer that shares the
+     * requester's exact download scope (the same tenant view, as for presence), which
+     * keeps manifests handed over out of band working; across scopes, only when both
+     * scopes reference the hash, so neither the hash nor the bytes cross a tenant.
+     */
+    private mayForwardBlobRequest;
     private handleRelay;
     private handleSessionClose;
     private handleAwarenessRelay;
+    /** Point a session's presence at a record (or at none), keeping the index in step. */
+    private setPresenceTarget;
+    /**
+     * Records changed (`operations`, or anything when null): re-decide the audience of
+     * every presence cursor on one of them (F16). A record that moved out of a session's
+     * grant takes the presence on it out of that session, and one that moved in brings
+     * it, without waiting for the sender's next update; catch-ups use the new audience.
+     * Every write is noted first, so a presence read that began before it is never
+     * taken as current.
+     */
+    private refreshPresence;
+    /** Re-decide the presence on one record, coalesced with a re-decision already running. */
+    private schedulePresenceRefresh;
+    private runPresenceRefresh;
+    /**
+     * Who may see a presence state (F16). A state whose cursor names a record reaches
+     * exactly the sessions whose download scope contains that record, the rule of the
+     * Yjs doc channel, and only when the sender may read the record too: collaborators
+     * with different grants see each other on the documents they share, and nobody
+     * sees presence on a record outside their grant. A malformed cursor reaches
+     * nobody. A state without a cursor names no record: it reaches only sessions of
+     * the same presence partition (identical download scope; anonymous sessions are
+     * each their own partition).
+     */
+    private awarenessAudience;
     private handleYjsDocRelay;
-    private getOrCreateHttpClient;
+    /** Open a new HTTP long-poll session bound to `principal`, under a fresh random id. */
+    private openHttpSession;
 }
 
 /**
@@ -820,6 +1776,19 @@ interface AuthContext {
     uplinkScopes?: Record<string, Record<string, unknown>>;
     /** Arbitrary metadata about the authenticated user */
     metadata?: Record<string, unknown>;
+    /**
+     * True for an unauthenticated (anonymous) principal, such as the fallback of
+     * `MixedAuthProvider`. Its `userId` is not stable across connections, so node-id
+     * claims are keyed by the shared anonymous owner instead: an anonymous device can
+     * reconnect with its node id, but can never take a signed-in user's node id.
+     */
+    anonymous?: boolean;
+    /**
+     * When the credential that authenticated this session expires (ms since
+     * epoch). A session must not outlive its credential: the sync server can
+     * close it with a retriable AUTH_EXPIRED so the client refreshes (AUTH-11).
+     */
+    expiresAt?: number;
 }
 /**
  * Interface for authenticating incoming client connections.
@@ -832,6 +1801,33 @@ interface AuthProvider {
      * @returns AuthContext if valid, null if rejected
      */
     authenticate(token: string): Promise<AuthContext | null>;
+    /**
+     * Optional revocation feed. When present, `KoraSyncServer` subscribes on
+     * construction and calls {@link KoraSyncServer.terminateSessions} for every
+     * event, so a revoked device or user loses its live sync sessions immediately
+     * (AUTH-11). The built-in `createKoraAuthServer().auth` provides it.
+     *
+     * @returns An unsubscribe function
+     */
+    onRevoke?(listener: (event: SessionRevocation) => void | Promise<void>): () => void;
+}
+/**
+ * Which live sync sessions a credential revocation ends. `userId` alone ends
+ * every session of that user; with `deviceId` only that device's sessions
+ * (matched against `AuthContext.metadata.deviceId`).
+ */
+interface SessionRevocation {
+    userId?: string;
+    deviceId?: string;
+}
+/** Options for {@link KoraSyncServer.terminateSessions}. */
+interface TerminateSessionsFilter extends SessionRevocation {
+    /**
+     * Error code sent to the client before the session closes. Both are retriable:
+     * the client refreshes its credentials and re-handshakes, and the server then
+     * decides again. Defaults to `'AUTH_REVOKED'`.
+     */
+    code?: 'AUTH_REVOKED' | 'AUTH_EXPIRED';
 }
 /**
  * Configuration for creating a KoraSyncServer.
@@ -849,8 +1845,60 @@ interface KoraSyncServerConfig {
     serializer?: MessageSerializer;
     /** Event emitter for DevTools integration */
     emitter?: KoraEventEmitter;
-    /** Maximum concurrent client connections. 0 = unlimited. Defaults to 0. */
+    /**
+     * Maximum concurrent client connections (sessions, including ones still
+     * handshaking). A connection over the limit gets a retriable `MAX_CONNECTIONS` error
+     * and is closed. 0 = unlimited. Defaults to 10,000.
+     */
     maxConnections?: number;
+    /**
+     * Interval between WebSocket pings, in ms (SRV-6, LMS #12). A connection that
+     * leaves two pings in a row unanswered is terminated, which ends its session.
+     * Applies to the standalone server and `createProductionServer`. Defaults to 25
+     * seconds; 0 disables probing.
+     */
+    heartbeatIntervalMs?: number;
+    /**
+     * Interval of the application-level `heartbeat` message sent to clients that
+     * advertise support for it (browsers cannot see WebSocket pings), in ms. A client
+     * that hears nothing for about 2.5 intervals reconnects. Defaults to 25 seconds; 0
+     * disables it.
+     */
+    appHeartbeatIntervalMs?: number;
+    /**
+     * End-to-end encryption policy (protocol v2, ENC-3). With `required: true` an
+     * uploaded plaintext operation that carries data is refused non-retriably
+     * (`PLAINTEXT_REJECTED`), unless `allowPlaintextMigration` opens a migration window.
+     * Encrypted operations (envelope v2) are always stored opaquely, never transformed.
+     */
+    encryption?: {
+        required: boolean;
+        allowPlaintextMigration?: boolean;
+    };
+    /**
+     * Time a new connection has to send its handshake, in ms. Defaults to 10 seconds;
+     * 0 disables the deadline.
+     */
+    handshakeTimeoutMs?: number;
+    /**
+     * Bytes that may wait unsent for one client (WebSocket send buffer, or the queue of
+     * an HTTP long-poll client that stopped polling) before it is disconnected as a slow
+     * consumer. Defaults to 32 MiB; 0 disables the ceiling. The delivery stream pauses
+     * well before this (`deliveryHighWaterBytes`).
+     */
+    maxBufferedBytes?: number;
+    /**
+     * Queued outbound bytes above which a client's delivery stream pauses until the
+     * client drains them (backpressure). Defaults to 1 MiB.
+     */
+    deliveryHighWaterBytes?: number;
+    /**
+     * WebSocket permessage-deflate compression. `true` (the default) compresses messages
+     * of 1 KiB or more without keeping a compression context between messages, which
+     * cuts sync payloads several-fold on 2G/3G links at a bounded memory cost per
+     * connection. `false` disables it; an object is passed to `ws` as is.
+     */
+    perMessageDeflate?: boolean | Record<string, unknown>;
     /** Maximum operations per sync batch. Defaults to 100. */
     batchSize?: number;
     /**
@@ -878,10 +1926,13 @@ interface KoraSyncServerConfig {
         max: number;
     };
     /**
-     * Transform accepted legacy client operations into the server schema version
-     * before validation and materialization. Required when
-     * `supportedSchemaVersions.min` is lower than `schemaVersion` and operation
-     * shapes changed across versions.
+     * Schema transforms from older client schema versions to the server schema version.
+     * Required when `supportedSchemaVersions.min` is lower than `schemaVersion` and
+     * operation shapes changed across versions. They run at fold time (RT-84): every
+     * operation is stored and delivered exactly as uploaded; authorization, validators
+     * and the store's fold use its transformed view. The server hands this list to its
+     * store (`setOperationTransforms`); pass it to `store.setSchema` too to fold with it
+     * from the first start. Transforms must be pure and deterministic.
      */
     operationTransforms?: OperationTransform[];
     /** WebSocket path (standalone mode). Defaults to '/'. */
@@ -909,6 +1960,32 @@ interface KoraSyncServerConfig {
      * `@korajs/store` derives both from a `ContentAddressedBlobStore`.
      */
     persistBlobChunk?: (hash: string, bytes: Uint8Array) => Promise<void> | void;
+    /**
+     * Limits on the blob side channel. `maxChunkBytes` (default 1 MiB) caps one
+     * pushed chunk or manifest, `maxBytesPerSession` (default 256 MiB) caps the total
+     * a session may push for central persistence, `maxPendingRequestsPerSession`
+     * (default 256) and `pendingRequestTtlMs` (default 60s) bound the chunk requests
+     * the relay remembers per session.
+     */
+    blobLimits?: {
+        maxChunkBytes?: number;
+        maxBytesPerSession?: number;
+        maxPendingRequestsPerSession?: number;
+        pendingRequestTtlMs?: number;
+        /**
+         * Blob chunk requests one session may make per minute, a budget separate from
+         * `maxOpsPerMinute` (one request per chunk, so a large blob makes many). Over
+         * it, a request is answered with a retriable `throttled` response the client
+         * backs off on (RT-24). Defaults to 6000.
+         */
+        maxRequestsPerMinute?: number;
+    };
+    /**
+     * Largest WebSocket message the standalone server (and `createProductionServer`)
+     * accepts, in bytes. Larger frames are refused by the socket layer before they are
+     * buffered. Defaults to 32 MiB (the `ws` library default is 100 MiB).
+     */
+    maxMessageBytes?: number;
     /**
      * Maximum serialized byte size of a single client operation accepted at sync
      * ingest. Operations larger than this are rejected before materialization.
@@ -917,11 +1994,95 @@ interface KoraSyncServerConfig {
      */
     maxOperationBytes?: number;
     /**
-     * Maximum operations accepted per connected client per minute (sliding window).
-     * Operations beyond the limit are rejected until the window resets. Defaults to
-     * 600. Set once here to enforce one rate cap across every connected client.
+     * Maximum operations accepted per device node per minute (fixed window). The budget
+     * belongs to the node id (bound to its principal when auth is configured), not to
+     * the connection, so reconnecting does not reset it (SRV-6). Operations beyond the
+     * limit get a retriable `RATE_LIMIT` until the window resets. Defaults to 600.
      */
     maxOpsPerMinute?: number;
+    /**
+     * Maximum operations accepted per authenticated principal per minute, across all of
+     * its device nodes, on top of the per-node `maxOpsPerMinute`. Without it a user could
+     * multiply the per-node budget by minting node ids. Keyed by the provider's user id;
+     * anonymous and unauthenticated sessions (no stable principal) have only the per-node
+     * budget. Defaults to 4 x `maxOpsPerMinute` (2400), so one busy device never meets it
+     * and a user's devices share it. `0` disables the per-user budget.
+     */
+    maxOpsPerMinutePerUser?: number;
+    /**
+     * Largest operation batch accepted from a client in one message. A larger batch is
+     * refused whole with `BATCH_TOO_LARGE` before the server decodes it or reads the
+     * store, so one message cannot buy unbounded work. Defaults to 1000 (the client
+     * sends batches of 100 by default).
+     */
+    maxOpsPerBatch?: number;
+    /**
+     * Most values one `$in` scope predicate may hold, in either direction. A grant
+     * with more is refused at handshake with `SCOPE_PREDICATE_LIMIT`, so an auth
+     * provider bug cannot hand one session an unbounded predicate that every delivery
+     * and revalidation then evaluates. Defaults to 100. See the production server
+     * guide for the measured cost of larger values before raising it.
+     */
+    maxScopePredicateValues?: number;
+    /**
+     * Accept anonymous devices whose node claim predates confirmed claims (RT-21):
+     * nodes whose operation history predates node claims (a database written by a
+     * beta.12 or older server, which recorded no claims; RT-91), nodes held by the
+     * pre-release shared anonymous owner, and provisional claims that expired without
+     * the device ever confirming its node token (beta.12 and older clients have no
+     * token support). Accepted with a deprecation warning and re-issued a token.
+     * Defaults to `true` for 1.0.0-beta.13; the default flips to `false` in the next
+     * release, after which such devices rotate to a fresh node id instead (beta.12
+     * clients cannot rotate and stay refused).
+     *
+     * With `MixedAuthProvider`, a node with pre-claims history may also be a signed-in
+     * user's beta.12 device: an anonymous device can take such a node, as it could on
+     * beta.12. Set this to `false` if that matters more than keeping anonymous beta.12
+     * devices syncing.
+     */
+    allowLegacyAnonymousClaims?: boolean;
+    /**
+     * Automatic device handover after an upgrade from beta.12 (F1). When a signed-in
+     * device presents a node id that has operation history but no owner (beta.12
+     * recorded no node claims) or that an administrator released, and the node id
+     * equals the device id the auth provider verified for that user
+     * (`AuthContext.metadata.deviceId`, set by the built-in `KoraAuthProvider` from the
+     * token), the node is claimed for that user in one atomic step instead of being
+     * refused `NODE_ID_CLAIMED`. A node another principal owns is never taken.
+     * Defaults to `true`. A custom auth provider must set `metadata.deviceId` only to
+     * a device id it verified as registered to the user; set this to `false` if yours
+     * cannot guarantee that.
+     */
+    deviceNodeHandover?: boolean;
+    /**
+     * What to do when a signed-in session's grant restricts no collection, so every user
+     * syncs every other user's data (F4). That happens when the auth provider returns
+     * a claims grant (the built-in provider's default) and the schema declares no sync
+     * rule binding it, or when a provider returns no scopes. `'warn'` (default) logs it
+     * once per provider; `'allow'` silences it for apps whose users all share one data
+     * set; `'refuse'` refuses such handshakes with `UNSCOPED_SHARING_REFUSED`.
+     * Anonymous sessions are not judged: their grant is the app's own choice.
+     */
+    unscopedSharing?: 'warn' | 'allow' | 'refuse';
+    /**
+     * How long an anonymous device's provisional node claim may stay unconfirmed and
+     * still be re-issued to a device that presents no token (a handshake response lost
+     * in transit), in milliseconds (RT-21). Defaults to 24 hours.
+     */
+    anonymousClaimTtlMs?: number;
+    /**
+     * How often every live session's credential is re-validated with the auth
+     * provider, in milliseconds (RT-18). A revocation persisted by another server
+     * instance ends the session here within this interval. Defaults to 30 seconds; 0
+     * disables it (sessions then end only through this process's `onRevoke` feed,
+     * `terminateSessions`, or credential expiry).
+     */
+    sessionRevalidationIntervalMs?: number;
+    /**
+     * How long an HTTP long-poll session may go without any request before the server
+     * closes it, in milliseconds. Defaults to 2 minutes; 0 disables expiry.
+     */
+    httpSessionIdleTimeoutMs?: number;
     /**
      * Adjudicate untrusted client operations before they become authoritative.
      *
@@ -937,12 +2098,25 @@ interface KoraSyncServerConfig {
 }
 /**
  * Request envelope for the server-side HTTP sync endpoint.
+ *
+ * Map it from your HTTP framework: `sessionId` from the `x-kora-session` header and
+ * `authorization` from the `Authorization` header, on every request.
  */
 interface HttpSyncRequest {
-    /** Stable client identifier for binding HTTP requests to a server session */
-    clientId: string;
     /** HTTP method */
     method: 'GET' | 'POST';
+    /**
+     * The server-issued session id (`x-kora-session` request header). Absent only on
+     * the POST that opens a session (the handshake); the response to that POST
+     * carries the new id in its `x-kora-session` header. Never chosen by the client.
+     */
+    sessionId?: string;
+    /**
+     * The raw `Authorization` header (`Bearer <token>`). With an auth provider
+     * configured, EVERY request is authenticated and must resolve to the same
+     * principal and device as the session it names (RT-2).
+     */
+    authorization?: string;
     /** Optional raw request payload for POST */
     body?: string | Uint8Array;
     /** Value of the Content-Type header for POST payloads */
@@ -955,7 +2129,7 @@ interface HttpSyncRequest {
  */
 interface HttpSyncResponse {
     /** HTTP status code */
-    status: 200 | 202 | 204 | 304 | 400 | 405 | 410;
+    status: 200 | 202 | 204 | 304 | 400 | 401 | 403 | 404 | 405 | 410;
     /** Optional raw response payload */
     body?: string | Uint8Array;
     /** Optional response headers */
@@ -1002,6 +2176,20 @@ interface ServerStatus {
     errorCount: number;
 }
 
+/**
+ * Which reverse proxies in front of the server are trusted to report the client
+ * address in `X-Forwarded-For`.
+ *
+ * - `number`: trust that many hops, counting the socket peer as the first. `1` means
+ *   "one proxy (for example a load balancer) sits directly in front of the server".
+ * - `string[]`: trust peers whose address is in one of these IPs or CIDR ranges
+ *   (IPv4 and IPv6, for example `['10.0.0.0/8', '::1']`).
+ *
+ * When unset, `X-Forwarded-For` is ignored and the socket address is the client
+ * address, so a directly connected client cannot choose its own address.
+ */
+type TrustProxySetting = number | string[];
+
 interface HttpPollResponse {
     status: 200 | 204 | 304 | 410;
     body?: string | Uint8Array;
@@ -1021,56 +2209,176 @@ declare class HttpServerTransport implements ServerTransport {
     private connected;
     private nextSequence;
     private readonly queue;
-    constructor(serializer: MessageSerializer);
+    private queuedBytes;
+    private readonly maxQueuedBytes;
+    /**
+     * @param serializer - Message serializer
+     * @param options - `maxQueuedBytes`: close the session once this many bytes wait
+     *   unpolled (default 32 MiB; 0 disables the ceiling)
+     */
+    constructor(serializer: MessageSerializer, options?: {
+        maxQueuedBytes?: number;
+    });
     send(message: _korajs_sync.SyncMessage): void;
+    /** Bytes queued for the client and not yet polled (delivery-stream backpressure). */
+    bufferedAmount(): number;
     onMessage(handler: ServerMessageHandler): void;
     onClose(handler: ServerCloseHandler): void;
     onError(handler: ServerErrorHandler): void;
     isConnected(): boolean;
+    /**
+     * Close the session. Messages already queued (typically the final error that
+     * explains the close, for example a refused handshake) stay pollable, so a
+     * long-polling client learns why, exactly as a WebSocket client receives the error
+     * frame before the close; once drained, polls answer 410.
+     */
     close(code?: number, reason?: string): void;
+    /** True while messages queued before the close are still waiting to be polled. */
+    hasPending(): boolean;
     receive(payload: string | Uint8Array): void;
     poll(ifNoneMatch?: string): HttpPollResponse;
     private makeEtag;
 }
 
-/**
- * Minimal interface for a ws.WebSocket instance.
- * Allows dependency injection for testing without importing ws directly.
- */
-interface WsWebSocket {
-    readyState: number;
-    send(data: string | Uint8Array, callback?: (err?: Error) => void): void;
-    close(code?: number, reason?: string): void;
-    on(event: string, listener: (...args: unknown[]) => void): void;
-    removeAllListeners(): void;
+/** One read of a record for a presence decision. */
+interface PresenceRecordRead {
+    /** The stored row (soft-deleted rows included), or null when the server holds none */
+    stored: MaterializedRecord | null;
+    /**
+     * The reader's clock when the read began. A write that touched the record after
+     * it ({@link PresenceRecords.touchedSince}) means the row may predate that write.
+     */
+    asOf: number;
 }
 /**
- * Options for WsServerTransport.
+ * Reads the records presence cursors name, for every session of one sync server (F16).
+ *
+ * Presence decides who may see a cursor from the record it names, so the row must be
+ * the store's latest, never a copy another code path holds (a session's delivery
+ * pass caches rows for the whole chunk it filters). Every write the server commits
+ * {@link touch}es the records it wrote; a read is current when no touch of its record
+ * came after it began. Reads of one record are shared while current (many cursors on
+ * one busy document cost one read per write burst, not one per cursor per write), a
+ * read is never shared across a touch, and reads are bounded in number at once.
+ *
+ * Presence is ephemeral and nothing here is persisted.
  */
-interface WsServerTransportOptions {
-    /** Message serializer. Defaults to JsonMessageSerializer. */
-    serializer?: MessageSerializer;
+declare class PresenceRecords {
+    private readonly store;
+    private readonly now;
+    private clock;
+    /** The clock value of each tracked record's last touch, oldest first. */
+    private readonly lastTouch;
+    /** Touches forgotten to bound memory count as having happened at this clock. */
+    private forgottenTouchesAt;
+    private readonly inFlight;
+    private readonly cache;
+    private running;
+    private readonly waiting;
+    constructor(store: ServerStore, now?: () => number);
+    /**
+     * Record that writes to these records committed: reads that began before are no
+     * longer current. Null means any record may have changed.
+     *
+     * @param keys - Record keys from {@link presenceRecordKey}, or null for every record
+     */
+    touch(keys: Iterable<string> | null): void;
+    /**
+     * True when a write touched the record after a read that began at `asOf`.
+     *
+     * @param key - Record key from {@link presenceRecordKey}
+     * @param asOf - The read's {@link PresenceRecordRead.asOf}
+     */
+    touchedSince(key: string, asOf: number): boolean;
+    /**
+     * A current read of the record that is still fresh enough to reuse, without a store
+     * read; undefined when the record must be read.
+     *
+     * @param collection - The record's collection
+     * @param recordId - The record's id
+     */
+    peek(collection: string, recordId: string): PresenceRecordRead | undefined;
+    /**
+     * Read the record from the store, joining a read of it already running when no
+     * write touched the record since that read began. Rejects when the store read fails.
+     *
+     * @param collection - The record's collection
+     * @param recordId - The record's id
+     */
+    read(collection: string, recordId: string): Promise<PresenceRecordRead>;
+    /** Forget every read and touch (the server stopped). */
+    clear(): void;
+    private readStore;
+    private forget;
+}
+
+/** Outcome of one key-service message. */
+interface KeyServiceOutcome {
+    response: EncryptionKeyResponseMessage;
+    /** The record written, when the message was a successful write (to push to siblings). */
+    written: WrappedKeyRecord | null;
 }
 /**
- * Server-side transport wrapping a ws.WebSocket connection.
- * Created for each incoming client connection.
+ * The sync server's key service (ENC-1, decision D4b). Stores each owner's wrapped key
+ * record and serves it back. It never sees a passphrase or a data key: a record is
+ * salt, KDF parameters, AES-GCM-wrapped data keys, key ids and versions.
+ *
+ * Rules it enforces:
+ * - **Owner from the session only.** The owner is the session's authenticated
+ *   principal (or the shared anonymous owner on a server without auth); a message
+ *   cannot name a user, so no session reads or writes another user's record.
+ * - **Compare-and-set.** A write names the revision it replaces; a concurrent write
+ *   loses with `conflict` and the current record, so two devices that both create a
+ *   first key converge on one.
+ * - **History is append-only.** A write must raise the revision, keep the ring id and
+ *   every key version (same key id), so no device can make old operations unreadable
+ *   for the others. A first write (or a re-upload after the record was lost) keeps the
+ *   revision it carries, since devices refuse revisions below the one they accepted.
+ * - **Lost records are visible.** A fetch with no record reports key ids of the owner's
+ *   stored encrypted operations, so a new device waits for one holding the ring.
+ *
+ * It cannot check the record MAC or that wraps open (only a holder of the ring's master
+ * key can): devices authenticate every record themselves and act on nothing else. A
+ * principal can still overwrite its own record with garbage; devices refuse it and
+ * keep their keys.
  */
-declare class WsServerTransport implements ServerTransport {
-    private readonly ws;
-    private readonly serializer;
-    private messageHandler;
-    private closeHandler;
-    private errorHandler;
-    constructor(ws: WsWebSocket, options?: WsServerTransportOptions);
-    send(message: SyncMessage): void;
-    onMessage(handler: ServerMessageHandler): void;
-    onClose(handler: ServerCloseHandler): void;
-    onError(handler: ServerErrorHandler): void;
-    isConnected(): boolean;
-    close(code?: number, reason?: string): void;
-    private setupListeners;
+declare class EncryptionKeyService {
+    private readonly store;
+    constructor(store: ServerStore);
+    /** Whether the store can persist key records (all built-in stores can). */
+    isSupported(): boolean;
+    /**
+     * Answer one key-service message for `owner`.
+     *
+     * @param owner - The session's owner key, or null when the session may not hold keys
+     * @param message - A request or a write
+     */
+    handle(owner: string | null, message: EncryptionKeyRequestMessage | EncryptionKeyPutMessage): Promise<KeyServiceOutcome>;
+    /**
+     * Key ids of the owner's stored encrypted operations (a sample). Reported only while
+     * no record exists: then non-empty means the record was lost, and a new device must
+     * wait for one that holds the ring instead of starting another (RT-104).
+     */
+    private knownKeyIds;
+    private read;
+}
+
+/** What a session charges uploaded operations to. */
+interface IngestRateLimiter {
+    /** Units allowed per window (the tightest applicable budget). */
+    readonly limit: number;
+    /** Charge `count` units; false when a budget is exceeded (the units are refused). */
+    allow(count?: number): boolean;
+    /** Milliseconds until a refused unit may be retried. */
+    retryAfterMs(): number;
 }
 
+/**
+ * Session-ending error codes, all retriable. `AUTH_REVOKED` / `AUTH_EXPIRED`: the
+ * client refreshes its credential and re-handshakes. `SCOPE_CHANGED` (RT-26): the
+ * principal's grant changed; the client simply reconnects and gets the new scope.
+ */
+type SessionTerminationCode = 'AUTH_REVOKED' | 'AUTH_EXPIRED' | 'SCOPE_CHANGED';
 /**
  * Possible states for a client session.
  */
@@ -1082,11 +2390,27 @@ type RelayCallback = (sourceSessionId: string, operations: Operation[]) => void;
 /**
  * Callback invoked when a session receives an awareness update to relay to other sessions.
  */
-type AwarenessRelayCallback = (sourceSessionId: string, message: AwarenessUpdateMessage) => void;
+type AwarenessRelayCallback = (sourceSessionId: string, message: AwarenessUpdateMessage, cursorTarget?: AwarenessCursorTarget) => void;
+/**
+ * The record an awareness state's cursor names, as the sending session resolved it
+ * from the store. `stored` is null for a record the server does not hold. A cursor
+ * that is not a `{ collection, recordId }` pair of strings is `{ invalid: true }`;
+ * a state without a cursor has no target.
+ */
+type AwarenessCursorTarget = {
+    invalid?: false;
+    collection: string;
+    recordId: string;
+    stored: MaterializedRecord | null;
+    /** When the read of `stored` began, on the server's presence reader clock. */
+    asOf?: number;
+} | {
+    invalid: true;
+};
 /**
  * Callback invoked when a session receives a Yjs doc channel update to relay.
  */
-type YjsDocRelayCallback = (sourceSessionId: string, message: YjsDocUpdateMessage) => void;
+type YjsDocRelayCallback = (sourceSessionId: string, message: YjsDocUpdateMessage, storedRecord: MaterializedRecord | null) => void;
 /**
  * Callback invoked when a session receives a blob chunk request to route.
  */
@@ -1128,20 +2452,41 @@ interface ClientSessionOptions {
         min: number;
         max: number;
     };
-    /** Transform accepted legacy operations into the server schema before validation. */
+    /** Schema transforms: judged views of older operations (transforms at fold time, RT-84). */
     operationTransforms?: OperationTransform[];
     /** Called when this session has operations to relay to other sessions */
     onRelay?: RelayCallback;
     /** Called when this session receives an awareness update to broadcast */
     onAwarenessUpdate?: AwarenessRelayCallback;
+    /**
+     * The reader of the records presence cursors name, shared by the server's sessions
+     * (F16). Defaults to one of this session's own.
+     */
+    presenceRecords?: PresenceRecords;
     /** Called when this session receives a Yjs doc channel update to broadcast */
     onYjsDocUpdate?: YjsDocRelayCallback;
     /** Called when this session receives a blob chunk request to route */
     onBlobChunkRequest?: BlobChunkRequestCallback;
     /** Called when this session receives a blob chunk response to route back */
     onBlobChunkResponse?: BlobChunkResponseCallback;
+    /** The key service storing wrapped encryption key records (ENC-1). */
+    encryptionKeys?: EncryptionKeyService;
+    /** Called after this session wrote a key record, to push it to the owner's other sessions. */
+    onEncryptionKeyWritten?: (sessionId: string, owner: string, keyring: string, record: WrappedKeyRecord) => void;
+    /** Key-service messages allowed per session per minute. Defaults to 60. */
+    maxKeyRequestsPerMinute?: number;
     /** Persist a client-uploaded blob chunk centrally (keyed by content hash) */
     persistBlobChunk?: PersistBlobChunk;
+    /**
+     * Called once the session completes an accepted handshake and reaches streaming.
+     * Side channels (Yjs doc, blob and awareness relays) register the session here,
+     * never at connect time, so an unauthenticated connection is never on a relay.
+     */
+    onReady?: (sessionId: string) => void;
+    /** Largest single blob chunk this session may push. Defaults to 1 MiB. */
+    maxBlobChunkBytes?: number;
+    /** Total blob bytes this session may push. Defaults to 256 MiB. */
+    maxBlobBytesPerSession?: number;
     /** Called when this session closes */
     onClose?: (sessionId: string) => void;
     /**
@@ -1161,6 +2506,24 @@ interface ClientSessionOptions {
     maxOperationBytes?: number;
     /** Maximum operations accepted per minute for this session. Defaults to 600. */
     maxOpsPerMinute?: number;
+    /**
+     * Blob chunk requests accepted per minute, separate from the operation budget
+     * (RT-24). Defaults to 6000.
+     */
+    maxBlobRequestsPerMinute?: number;
+    /** Length of the blob request window in ms. One minute; shorter only in tests. */
+    blobRequestWindowMs?: number;
+    /**
+     * Largest operation batch accepted in one message. A larger batch is refused whole
+     * (`BATCH_TOO_LARGE`) before it is decoded or the store is read. Defaults to 1000.
+     */
+    maxOpsPerBatch?: number;
+    /**
+     * Most values one `$in` scope predicate may hold. A grant over the limit is
+     * refused at handshake (`SCOPE_PREDICATE_LIMIT`). Defaults to
+     * {@link DEFAULT_MAX_SCOPE_PREDICATE_VALUES} (100).
+     */
+    maxScopePredicateValues?: number;
     /**
      * Adjudicate untrusted client operations before materialization. When present,
      * each incoming operation is passed to this validator; a `reject` decision
@@ -1169,6 +2532,71 @@ interface ClientSessionOptions {
     validateOperation?: OperationValidator;
     /** Trusted data-plane context handed to the validator (read state, author derived ops). */
     koraContext?: ProductionHttpRouteContext;
+    /**
+     * Blob reference authority (RT-11): decides which content hashes this session may
+     * reference in blob fields and records the bytes it pushes. Without it, blob
+     * references are not checked at ingest.
+     */
+    blobAccess?: BlobAccessIndex;
+    /** See `KoraSyncServerConfig.allowLegacyAnonymousClaims` (RT-21). Defaults to true. */
+    allowLegacyAnonymousClaims?: boolean;
+    /** See `KoraSyncServerConfig.deviceNodeHandover` (F1). Defaults to true. */
+    deviceNodeHandover?: boolean;
+    /** See `KoraSyncServerConfig.unscopedSharing` (F4). Defaults to `'warn'`. */
+    unscopedSharing?: 'warn' | 'allow' | 'refuse';
+    /** See `KoraSyncServerConfig.anonymousClaimTtlMs` (RT-21). Defaults to 24 hours. */
+    anonymousClaimTtlMs?: number;
+    /**
+     * True when another live session (not `exceptSessionId`) is connected as `nodeId`.
+     * A provisional anonymous claim is never re-issued away from a connected device.
+     */
+    isNodeLive?: (nodeId: string, exceptSessionId: string) => boolean;
+    /**
+     * Time a new connection has to deliver its handshake, in ms (SRV-6). A connection
+     * that sends none is closed with `HANDSHAKE_TIMEOUT`. Defaults to 10 seconds; 0
+     * disables the deadline.
+     */
+    handshakeTimeoutMs?: number;
+    /**
+     * Queued outbound bytes above which the delivery stream pauses until the client
+     * drains its socket (transports that report `bufferedAmount`). Defaults to 1 MiB.
+     */
+    deliveryHighWaterBytes?: number;
+    /**
+     * The ingest rate limiter for a node, shared across that node's sessions so a
+     * reconnect does not reset it (SRV-6). Called once the handshake binds the node,
+     * with the authenticated principal's user id (null for anonymous and
+     * unauthenticated sessions) so a per-user budget can be layered on top: a user
+     * minting node ids must not multiply the per-node budget.
+     * Without it the session keeps a private limiter.
+     */
+    rateLimiterFor?: (nodeId: string, principal: string | null) => IngestRateLimiter;
+    /**
+     * Interval of the application-level heartbeat sent to clients that advertised
+     * support for it, in ms (LMS #12). The handshake response tells the client the
+     * interval so it can declare the connection dead after missing two. 0 disables it.
+     */
+    appHeartbeatIntervalMs?: number;
+    /**
+     * Node ids whose operations this server authors (protocol v2). Sent to clients in
+     * the handshake response (`authoritativeNodeIds`); only operations from these nodes
+     * may carry server-authored metadata (`fieldVersions`, `foldState`). Defaults to the
+     * ids the store folds with (`ServerStore.getAuthoritativeNodeIds`), which is what
+     * `KoraSyncServer` always passes. Scope-entry operations (`kora:scope-entry`) are not
+     * listed: they carry the server's fold state and are joined, never folded as writes.
+     */
+    authoritativeNodeIds?: readonly string[];
+    /**
+     * End-to-end encryption policy (protocol v2, ENC-3). With `required`, every uploaded
+     * data-bearing operation must carry the encryption envelope; a plaintext one is
+     * refused non-retriably (`PLAINTEXT_REJECTED`), unless `allowPlaintextMigration` is
+     * set for a migration window. Without it, the server stores whatever it receives
+     * (envelope operations always opaquely).
+     */
+    encryption?: {
+        required: boolean;
+        allowPlaintextMigration?: boolean;
+    };
 }
 /**
  * Handles the sync protocol for a single connected client.
@@ -1188,6 +2616,31 @@ declare class ClientSession {
     private state;
     private clientNodeId;
     private authContext;
+    /**
+     * The context the auth provider returned, kept apart from {@link authContext}
+     * (which an unauthenticated session also gets, keyed by node id) so revocation
+     * only ever matches a verified principal.
+     */
+    private principal;
+    /** Closes the session when its credential expires (AUTH-11). */
+    private expiryTimer;
+    /** Revocations that arrived while the handshake was still authenticating. */
+    private readonly pendingRevocations;
+    /** Node token issued by this handshake's first anonymous claim, sent once in the response (RT-12). */
+    private issuedNodeToken;
+    /** The node-claim owner this session holds its node id under (userId, or an anonymous device key). */
+    private nodeOwnerKey;
+    /** A provisional anonymous claim awaiting the device's confirmation (RT-21). */
+    private pendingNodeClaim;
+    private readonly allowLegacyAnonymousClaims;
+    private readonly deviceNodeHandover;
+    private readonly unscopedSharing;
+    private readonly anonymousClaimTtlMs;
+    private readonly isNodeLive;
+    /** The credential presented at handshake, kept to re-validate the session (RT-18). */
+    private credential;
+    /** The scope the client asked for at handshake, kept to re-resolve scopes (RT-26). */
+    private handshakeScope;
     private syncQuerySubsets;
     private scopeExitPolicy;
     private resumeDeltaCursor;
@@ -1200,23 +2653,69 @@ declare class ClientSession {
     private clientDeliveryWatermark;
     /**
      * The highest delivery sequence this client has ACKNOWLEDGED (its confirmed
-     * watermark, as reported in acks). Incremental streaming pushes resume from here, not
-     * from the highest sequence sent, so a dropped or unapplied batch is always
-     * re-included by the next push (which re-scans from the acknowledged position). This
-     * is what makes streaming recovery independent of any bounded retransmit buffer: there
-     * is no sent-but-unacked window that a buffer eviction could strand. Seeded from the
-     * client's reported watermark at handshake.
+     * watermark, as reported in acks). A retransmission rewinds the send cursor to here,
+     * so a dropped or unapplied batch is always re-included by a re-scan from the
+     * acknowledged position: recovery never depends on a bounded retransmit buffer.
+     * Seeded from the client's reported watermark at handshake.
      */
     private lastAckedDeliverySeq;
     /**
-     * Timestamp of the last delivery-stream send attempt. Periodic retransmission uses
-     * this as its stale window so a slow client does not receive duplicate full-stream
-     * batches every server tick while the first batch is still being applied.
+     * The delivery send cursor (SRV-3): the max of the last batch sent. Live pushes
+     * chain from it (base = lastSent), so each operation goes out once per retransmit
+     * epoch instead of the whole unacknowledged backlog on every write. Invariant:
+     * lastAcked <= lastSent. It rewinds to lastAcked only when the outstanding delivery
+     * went unacknowledged for the (backed-off) stale window.
+     */
+    private lastSentDeliverySeq;
+    /** The highest batch max ever sent to this client (acks are capped by it). */
+    private highestSentDeliverySeq;
+    /**
+     * Own-node operations at or below this delivery sequence are streamed to this
+     * client; above it they are skipped (it uploaded them itself). Set at handshake: a
+     * full resync (watermark 0) recovers the client's own history up to the frontier
+     * at that moment; a resume excludes all of them.
      */
-    private lastDeliveryPushAttemptAtMs;
-    private outstandingDelivery;
-    /** Serializes incremental delivery pushes so their batches never interleave. */
+    private ownOperationsIncludedThrough;
+    /** When the delivery last made progress (an ack advanced, or a fresh send/rewind). */
+    private lastDeliveryProgressAtMs;
+    /** Consecutive rewinds without acknowledgment progress (drives the backoff, LMS #12). */
+    private deliveryRewinds;
+    /**
+     * Sent, not yet acknowledged delivery batches in send order (their max and send
+     * time), for round-trip samples. `resent` marks a re-sent range, which yields no
+     * sample (Karn's rule: its ack cannot be matched to one transmission).
+     */
+    private readonly unackedBatches;
+    private smoothedRttMs;
+    private rttVarianceMs;
+    /**
+     * Retransmit timeout of the delivery stream (RFC 6298 style: smoothed round trip
+     * plus four deviations, floored). An outstanding delivery with no acknowledgment
+     * progress for this long (doubled per consecutive re-send) is re-sent from the
+     * acknowledged position. Round trips include the client's apply time, so a slow
+     * device earns a longer timeout instead of spurious re-sends.
+     */
+    private retransmitTimeoutMs;
+    private retransmitTimer;
+    /** A delivery push is queued but not started: further wake-ups coalesce into it. */
+    private deliveryPushQueued;
+    /** Serializes delivery pushes so their batches never interleave. */
     private deliveryPushChain;
+    /**
+     * Records prefetched for the delivery chunk being filtered (LMS #11: one batched
+     * lookup per collection per chunk instead of one query per operation). Keyed
+     * `collection\u0000id`; null marks a record known to be absent. Only set while a
+     * chunk is filtered.
+     */
+    private readonly deliveryHighWaterBytes;
+    private readonly handshakeTimeoutMs;
+    private handshakeTimer;
+    private handshakeReceived;
+    private readonly rateLimiterFor;
+    private readonly appHeartbeatIntervalMs;
+    private appHeartbeatTimer;
+    /** Last time anything was sent to the client (a heartbeat is skipped when recent). */
+    private lastClientSendAtMs;
     /**
      * Relay batches sent to this client but not yet acknowledged, keyed by messageId.
      * The client acks every operation-batch it applies; on ack the entry is cleared.
@@ -1243,15 +2742,64 @@ declare class ClientSession {
     private readonly onYjsDocUpdate;
     private readonly onBlobChunkRequest;
     private readonly onBlobChunkResponse;
+    private readonly encryptionKeys;
+    private readonly onEncryptionKeyWritten;
+    /** Budget of key-service messages (each may cost a store read and write). */
+    private readonly keyRateLimiter;
     private readonly persistBlobChunk;
     private readonly onClose;
+    private readonly onReady;
+    private readonly maxBlobChunkBytes;
+    private readonly maxBlobBytesPerSession;
+    private blobBytesPushed;
     private readonly onOrphanedRelays;
     private readonly takeOrphanedRelays;
     private readonly maxOperationBytes;
     private readonly maxOpsPerMinute;
-    private readonly rateLimiter;
+    private readonly maxOpsPerBatch;
+    private readonly maxScopePredicateValues;
+    /** {@link getScopePartitionKey}, cached for the scope map it was computed from. */
+    private scopePartitionKeyCache;
+    /** Store reads for presence cursors (F16), per minute. */
+    private readonly presenceLookupLimiter;
+    /** Reads the records presence cursors name (shared by the server's sessions). */
+    private readonly presenceRecords;
+    /** A {@link refreshScopes} request arrived during the handshake: re-check once streaming. */
+    private scopeRefreshPending;
+    private rateLimiter;
+    /** Separate budget for blob chunk requests (RT-24). */
+    private readonly blobRateLimiter;
+    /** Operations refused by the rate limiter (RT-6), for diagnostics. */
+    private rateLimitedOperations;
+    /** Batches refused whole for exceeding {@link maxOpsPerBatch} (RT-6). */
+    private rejectedBatches;
+    /** Blob chunk requests answered "not held" because the session was over budget (RT-17). */
+    private rateLimitedBlobRequests;
+    /**
+     * The client advertised the `sequenceReservation` handshake capability (RT-37): it
+     * reserves sequence numbers in-transaction, so a second operation under a held
+     * (node, sequence) is refused with SEQUENCE_CONFLICT. False for a legacy client
+     * (Kora <= beta.12), whose duplicate pairs are stored instead.
+     */
+    private sequenceReservation;
+    /** Legacy duplicate pairs this session stored (RT-37), for diagnostics. */
+    private legacySequencePairs;
+    /** Protocol version the client declared in its handshake (1 when absent). */
+    private clientProtocolVersion;
+    private readonly authoritativeNodeIds;
+    /** Hash version an undeclared uploaded id was verified as (RT-64), by operation object. */
+    private readonly matchedHashVersions;
+    /** Uploads whose data is stored as the beta.12 writer held it (RT-71). */
+    private readonly restoredLegacyData;
+    /** Operations accepted with an unverified legacy (beta.12) id (RT-71). */
+    private unverifiedLegacyOperations;
+    private forgedDuplicates;
+    private readonly encryptionPolicy;
+    /** Uploaded operations refused because their id is not their content hash (CORE-1). */
+    private invalidOperationIds;
     private readonly validateOperation;
     private readonly koraContext;
+    private readonly blobAccess;
     constructor(options: ClientSessionOptions);
     /**
      * Start handling messages from the client transport.
@@ -1263,9 +2811,13 @@ declare class ClientSession {
      */
     relayOperations(operations: Operation[]): void;
     /**
-     * Push newly-available in-scope operations to a delivery-watermark client, resuming
-     * from the highest delivery sequence already sent. Pushes are serialized so their
-     * batches never interleave (which would break the base/max chain).
+     * Push newly-available in-scope operations to a delivery-watermark client, chained
+     * from the send cursor (SRV-3): only what was not sent yet goes out. `rewind`
+     * first moves the cursor back to the acknowledged position (a retransmission), and
+     * `initial` is the handshake stream (it always ends in a final batch, even an empty
+     * one, so the client completes initial sync). Pushes are serialized so their batches
+     * never interleave (which would break the base/max chain); wake-ups that arrive
+     * while one is queued coalesce into it.
      */
     private pushDeliveryStream;
     private relayVisibleOperations;
@@ -1275,18 +2827,63 @@ declare class ClientSession {
      * Retransmit relay batches this client has not acknowledged within `staleMs`.
      * Called on a periodic tick by the server (and directly by tests). Redelivering an
      * already-applied op is harmless: the client dedups by content-addressed id.
+     *
+     * For a delivery-watermark client it re-sends an outstanding (sent, unacknowledged)
+     * delivery from the acknowledged position, under the same backed-off window as the
+     * retransmit timer; `staleMs` 0 re-sends at once (a deterministic trigger for tests).
      */
     retransmitPendingRelays(staleMs?: number): void;
     /**
      * Wake the durable delivery stream for clients that negotiated delivery
-     * watermarks. This is used both for dropped watermark batches and for operations
-     * appended by another server/store instance: the session always scans from its
-     * own acknowledged cursor and applies its visibility filter before sending.
+     * watermarks: for operations appended by another server/store instance (sent from
+     * the send cursor), and for a delivery that went unacknowledged (re-sent from the
+     * acknowledged position once it made no progress for `staleMs`, backed off while it
+     * stays stuck). `staleMs` 0 re-sends at once.
+     *
+     * @param staleMs - Base stale window before an unacknowledged delivery is re-sent
+     * @param options - `serverFrontier`: the store's max delivery sequence, when known;
+     *   `trackStall`: emit `sync:delivery-stalled` after repeated re-sends
      */
     pushDeliveryStreamIfSupported(staleMs?: number, options?: {
         trackStall?: boolean;
         serverFrontier?: number;
     }): void;
+    /** Book-keeping for one sent delivery batch ending at `max`. */
+    private recordDeliverySent;
+    /**
+     * A delivery acknowledgment: advance the confirmed watermark (a retransmission
+     * rewinds to it), take a round-trip sample, and reset the backoff. The watermark
+     * never passes what was sent: a client cannot acknowledge what it never received.
+     */
+    private noteDeliveryAcked;
+    /** Fold one round-trip sample into the retransmit timeout (RFC 6298). */
+    private recordRoundTrip;
+    /**
+     * The current retransmit window: the timeout, which each re-send doubled (up to
+     * five minutes) and which only a fresh round-trip sample brings back down.
+     */
+    private retransmitWindowMs;
+    /**
+     * (Re)arm the retransmit timer for the outstanding delivery: it fires once no
+     * acknowledgment progress was made for the retransmit window.
+     */
+    private armRetransmitTimer;
+    /**
+     * No acknowledgment progress for the retransmit window: re-send from the
+     * acknowledged position (the batch was dropped, or the client could not apply it),
+     * unless the socket is still draining what was sent.
+     */
+    private onRetransmitTimeout;
+    /** Re-send the outstanding delivery from the acknowledged position. */
+    private rewindDelivery;
+    /** Bytes queued on the transport and not yet written to the network (0 if unknown). */
+    private transportBufferedAmount;
+    /**
+     * Wait until the transport's queued bytes drop to the high-water mark (SRV-5
+     * backpressure), so a slow client never makes the server buffer the whole stream
+     * in socket memory. Resolves early when the session closes.
+     */
+    private waitForSendWindow;
     /**
      * Close this session.
      */
@@ -1297,11 +2894,118 @@ declare class ClientSession {
      */
     private flushOrphanedRelays;
     close(reason?: string): void;
+    /**
+     * End this session if its verified principal matches a credential revocation
+     * (AUTH-11): send a retriable `code` error so the client refreshes and
+     * re-handshakes, then close. A session still authenticating remembers the
+     * revocation and applies it as soon as its principal is known.
+     *
+     * @returns True when the session was closed by this call
+     */
+    terminateIfMatches(filter: SessionRevocation, code: SessionTerminationCode): boolean;
+    /**
+     * Re-authenticate the credential that opened this session (RT-18). The session is
+     * ended with a retriable `AUTH_REVOKED` (`AUTH_EXPIRED` once past its expiry) when
+     * the provider now refuses the credential or resolves it to another principal, for
+     * example after a revocation persisted by another server instance.
+     *
+     * @returns `'terminated'` when this call ended the session, `'error'` when the
+     *   provider threw (nothing is ended; the caller retries later), else `'valid'`
+     */
+    revalidateCredential(): Promise<'valid' | 'terminated' | 'error'>;
+    /**
+     * Re-resolve this session's grant on request (`KoraSyncServer.refreshScopes`), for
+     * the user named. A streaming session whose principal is that user re-authenticates
+     * now and ends with a retriable `SCOPE_CHANGED` when its grant changed (or
+     * `AUTH_REVOKED` when the credential is no longer accepted). A session still in its
+     * handshake may have resolved its grant from membership read before the change, so
+     * it re-checks as soon as it reaches streaming; a session whose principal is not
+     * known yet does the same (the re-check is a no-op for a grant that did not change).
+     *
+     * @param userId - The user whose grant changed
+     * @returns The revalidation outcome, `'deferred'` when the check waits for the
+     *   handshake, or `'skipped'` for another user's (or a closed) session
+     */
+    refreshScopes(userId: string): Promise<'valid' | 'terminated' | 'error' | 'deferred' | 'skipped'>;
+    /** Run a re-check deferred by {@link refreshScopes} once the session streams. */
+    private runDeferredScopeRefresh;
+    /**
+     * True when `context` (a fresh authentication of this session's principal)
+     * resolves to download or upload scopes other than the ones this session holds.
+     * A grant that no longer resolves at all counts as changed.
+     */
+    private scopesChangedFor;
+    /**
+     * End this session because an admin released its node id (RT-5). Retriable: a
+     * client that still owns the node simply reconnects and claims it again.
+     */
+    endForNodeRelease(): void;
+    private terminate;
+    /** Clear every timer this session owns (expiry, handshake deadline, heartbeat). */
+    private clearSessionTimers;
+    /**
+     * Start the application-level heartbeat for a client that advertised support for it
+     * (LMS #12): a `heartbeat` message whenever nothing else was sent for an interval,
+     * so the client can detect a dead connection it cannot see (browsers never surface
+     * WebSocket pings).
+     */
+    private startAppHeartbeat;
+    /**
+     * Arm the expiry timer from `AuthContext.expiresAt`. Returns false when the
+     * credential has already expired (the caller refuses the handshake).
+     */
+    private armExpiryTimer;
+    private clearExpiryTimer;
     getState(): SessionState;
     getSessionId(): string;
     getClientNodeId(): string | null;
     getAuthContext(): AuthContext | null;
+    /**
+     * The principal the auth provider verified at handshake, or null before (or
+     * without) authentication. Unlike {@link getAuthContext}, never a context
+     * synthesized for an unauthenticated session.
+     */
+    getPrincipal(): AuthContext | null;
     isStreaming(): boolean;
+    /**
+     * Ingest refusals that happen before any store work (RT-6): operations refused by
+     * the per-minute rate limiter and batches refused for exceeding the per-batch cap.
+     */
+    getIngestLimitCounts(): {
+        rateLimitedOperations: number;
+        rejectedBatches: number;
+        rateLimitedBlobRequests: number;
+    };
+    /**
+     * True when the client did not advertise the `sequenceReservation` capability
+     * (RT-37): a legacy client (Kora <= beta.12) that may give two operations one
+     * sequence number. Such a pair is stored and delivered, never refused with
+     * SEQUENCE_CONFLICT. Meaningful once the handshake was accepted.
+     */
+    isLegacySequenceClient(): boolean;
+    /** Legacy duplicate (node, sequence) pairs this session stored (RT-37). */
+    getLegacySequencePairCount(): number;
+    /**
+     * True when a stored record is inside this session's download scope, so a side
+     * channel (for example a Yjs doc update) about it may be delivered here. A record
+     * not stored yet is judged by its id alone.
+     */
+    canReceiveRecord(collection: string, recordId: string, storedRecord: Record<string, unknown> | null): boolean;
+    /** This session's download scope, or undefined when it is unscoped. */
+    getDownlinkScopes(): ScopeMap | undefined;
+    /**
+     * A stable key for this session's download scope: sessions with the same key see
+     * exactly the same data. Unscoped sessions share the key `"*"`. Cached per scope
+     * map, since a large `$in` grant makes the key costly and the relays read it often.
+     */
+    getScopePartitionKey(): string;
+    /**
+     * Partition for presence without a cursor (a "who is online" state that names no
+     * record): only sessions with the same key see each other's. Signed-in sessions
+     * use their download scope key; every anonymous session is its own partition,
+     * because sessions holding the same anonymous grant are unrelated people.
+     */
+    getPresencePartitionKey(): string;
     /**
      * Get the transport for this session.
      * Used by the awareness relay to send messages to this client.
@@ -1312,50 +3016,371 @@ declare class ClientSession {
     private sendToClient;
     private enqueueMessage;
     private handleMessageAsync;
+    /**
+     * The owner of this session's encryption key records (ENC-1), or null when it may
+     * hold none: the authenticated user, or on a server without auth the one shared
+     * anonymous owner. An anonymous principal of a mixed provider has no stable
+     * identity, so it holds no keys.
+     */
+    getEncryptionKeyOwner(): string | null;
+    /** Push a key record another session of the same owner wrote (rotation, new passphrase). */
+    pushEncryptionKeyRecord(keyring: string, record: WrappedKeyRecord): void;
+    private handleEncryptionKeyMessage;
     /**
      * Persist a client-uploaded blob chunk (or manifest) centrally. The bytes are
      * verified to hash to the declared hash before storing, so a corrupt or
      * mislabeled upload is rejected rather than served later as trusted content.
      */
-    private handleBlobChunkPush;
-    private handleMessageFailure;
-    private handleHandshake;
-    private handleOperationBatch;
-    private transformForServerSchema;
-    private sendDelta;
+    private handleBlobChunkPush;
+    /**
+     * Claim (or re-claim) a node id for an anonymous device (RT-12, RT-21).
+     *
+     * A device presenting a token holds the node when the claim is (or can become)
+     * `kora:anon-node:<hash(token)>`: its confirmed claim, a fresh claim, or its own
+     * provisional claim, which presenting the token confirms.
+     *
+     * A device presenting no token gets a fresh token and a PROVISIONAL claim, which it
+     * confirms by acknowledging the response with the token once saved (or by
+     * presenting it next time). Until then the claim may be re-issued to a device that
+     * again presents no token (the response was lost in transit), but only while no
+     * session is connected as that node and before the claim expires. Legacy claims
+     * (expired provisional ones, and nodes of the pre-release shared anonymous owner)
+     * are re-issued only with `allowLegacyAnonymousClaims`, with a deprecation warning.
+     */
+    private claimAnonymousNode;
+    /**
+     * Automatic device handover after an upgrade from beta.12 (F1). A node with
+     * history but no owner (written before node claims existed) or released by an
+     * admin is claimed for the signed-in user when the node id IS the device id the
+     * auth provider verified for this credential (`metadata.deviceId`; the built-in
+     * provider takes it from the token's `dev` claim, which names a device registered
+     * to that user). `@korajs/auth` clients use that device id as their node id and
+     * cannot change it, so without this they stay refused until an operator binds the
+     * node. The claim is one atomic store step; a node another principal owns is never
+     * taken, and another user presenting the node id is still refused.
+     *
+     * The claim decides ownership from now on only. History written under the node on
+     * beta.12 may include operations another user forged (beta.12 did not verify node
+     * ids); the operation log integrity scan is the tool for auditing it.
+     */
+    private handOverDeviceNode;
+    /**
+     * The download grant the server itself gives this session, before the client's
+     * handshake scope narrows it (F4). A client may narrow its own view, but that does
+     * not isolate tenants: another client of the same user set can ask for everything.
+     * `null` when the grant cannot be resolved here (the handshake already refused or
+     * accepted it on the full path); then nothing is judged.
+     */
+    private grantWithoutHandshakeNarrowing;
+    /** Who holds a refused node id, as `NODE_ID_CLAIMED` reports it (F9). */
+    private nodeOwnershipOf;
+    /** The deprecation warning for an anonymous device adopted under a legacy claim (RT-21, RT-91). */
+    private warnLegacyAnonymousClaim;
+    /**
+     * The device proved it saved the node token issued by this handshake: make the
+     * provisional claim permanent (RT-21). A mismatched token is ignored.
+     */
+    private confirmNodeClaim;
+    /**
+     * The download scope references are authorized against (RT-11, RT-13), or
+     * undefined when they are not checked: without a real auth provider there is no
+     * tenant boundary to protect.
+     */
+    private referenceScopes;
+    /**
+     * Stable blob-ownership key of this session's principal: the user id, or for an
+     * anonymous device its node-claim owner (never shared by two anonymous devices).
+     */
+    getBlobOwnerKey(): string;
+    /**
+     * Partition key for peer-to-peer blob forwarding. Sessions with the same download
+     * scope share a tenant view, except anonymous devices: every anonymous session has
+     * the same grant but they are unrelated people, so each is its own partition.
+     */
+    getBlobPartitionKey(): string;
+    /** Authorize foreign-key targets and blob references of an untrusted write. */
+    private authorizeReferences;
+    private handleMessageFailure;
+    private handleHandshake;
+    /**
+     * The nodes whose operations after `fromDeliverySeq` this scoped session will
+     * receive, for the handshake vector (RT-7). Scans the delivery log without holding
+     * it (memory is O(nodes)), and judges each node only until one of its operations is
+     * visible, so most operations cost one scope comparison and no record read.
+     */
+    private collectVisibleNodeIds;
+    /**
+     * The version vector as committed in the store (SRV-4). A store shared by several
+     * instances reads it fresh; others serve their own (complete) vector.
+     */
+    private readServerVector;
+    /**
+     * Resolve this session's download and upload scopes from an auth context and the
+     * scope the client asked for at handshake. Side-effect free, so revalidation can
+     * recompute it and compare (RT-26). The legacy `scopes` contract remains shorthand
+     * for both directions.
+     */
+    private computeSessionScopes;
+    private handleOperationBatch;
+    /**
+     * For each delete of this session's node in an upload batch, the batch's later
+     * operations of the same node that name it as a causal parent: candidates for the
+     * author's own copies of its cascades and set-nulls (RT-69). Indexed by the delete's
+     * id, in the server's schema (field names as the server derives effects).
+     */
+    private indexAuthoredSideEffectCopies;
+    /**
+     * The referential effects of a delete that arrived again as a stored duplicate and
+     * are still undone (RT-73): effects the author covers later in this batch are
+     * deferred like a fresh delete's (derived after the batch unless a copy is stored);
+     * the rest are derived now. Derived ids are deterministic, so a concurrent retry or
+     * another instance stores the same operations.
+     *
+     * @returns The derived operations (to relay)
+     */
+    private resumeStoredDeleteEffects;
+    /**
+     * Derive the server's copy of each deferred side effect unless one of the author's
+     * copies is stored (applied or already held). A store with the batch lookup is asked
+     * again, so a copy stored by a concurrent session counts too.
+     */
+    private deriveUncoveredSideEffects;
+    /** {@link ServerStore.findStoredOperations} by id; empty without it or on a failed read. */
+    private findStoredOperationIds;
+    /**
+     * The operation as the server schema reads it (transforms at fold time, RT-84): the
+     * view authorization, validators, constraint checks and scope filters judge, and the
+     * one the server stores fold (core `operationSchemaView`, same transforms). Never
+     * stored: the store keeps the operation as uploaded. An envelope operation is opaque
+     * to the server (NEW-ENC-1) and judged as is; devices transform after decryption.
+     */
+    private schemaView;
+    /**
+     * Integrity checks on an uploaded operation before anything else judges it:
+     * - a version-2 plaintext id must be the content hash (`INVALID_OPERATION_ID`);
+     * - an unknown declared hash version is refused the same way;
+     * - with required encryption, a data-bearing plaintext operation is refused
+     *   (`PLAINTEXT_REJECTED`) unless the plaintext migration window is open.
+     *
+     * @returns null when the operation passes, or the refusal
+     */
+    private checkUploadIntegrity;
+    /**
+     * Whether an undeclared version-1 id that does not verify is accepted unverified
+     * (RT-71): only from a protocol-1 session (Kora <= beta.12), and only for the
+     * session's own node.
+     */
+    private acceptsUnverifiedLegacyId;
+    /** Log, count and emit an operation accepted with an unverified legacy id (RT-71). */
+    private reportUnverifiedLegacyOperation;
+    /** Operations this session accepted with an unverified legacy id (RT-71). */
+    getUnverifiedLegacyOperationCount(): number;
+    /**
+     * The operation as the server stores it: an undeclared plaintext id this server
+     * verified declares the version it matched (1, or 2 when the declaration was lost),
+     * so receivers verify it too (RT-64). An absent version is left only on ids nobody
+     * could verify (protocol-1 encrypted payloads, server-side transforms).
+     */
+    private declareVerifiedHashVersion;
+    /**
+     * True for a node id that is (or was) the server's own: the `kora:` namespace, the
+     * store's node id, and every id the server advertises or folds as authoritative
+     * (other instances, legacy server node ids, configured extras). No device may use one
+     * (RT-61), whether or not it has history yet.
+     */
+    private isServerAuthorNodeId;
+    /**
+     * The authoritative ids a handshake advertises (RT-75): only explicit ones (legacy
+     * server node ids, configured extras). Every `kora:server:` id is authoritative by
+     * prefix on every replica, and listing instance ids would make the list differ per
+     * instance and per start, which devices would have to treat as news.
+     */
+    /** The handshake's explicit revocations (RT-81), when the deployment has any. */
+    private advertisedRevocations;
+    private advertisedAuthoritativeNodeIds;
+    /** Node ids this server authors operations under (protocol v2 handshake response). */
+    private serverAuthoritativeNodeIds;
+    /**
+     * A protocol-1 client (Kora <= beta.12) is served for one release (beta.13) with a
+     * deprecation warning: its operation ids are version-1 hashes and its encrypted
+     * payloads have no envelope binding.
+     */
+    private warnLegacyProtocol;
+    /** The in-scope operations a version-vector client is missing (not yet sent). */
+    private collectDeltaOperations;
+    /** Send a collected version-vector delta in paginated, cursor-carrying batches. */
+    private sendCollectedDelta;
     /**
-     * Send the gap-free server->client delivery stream, resuming just after
+     * Stream the gap-free server->client delivery stream, resuming just after
      * `fromDeliverySeq`. Operations are scanned in server delivery-sequence order
      * (commit order), scope-filtered for this session, and sent in batches that chain:
      * each batch's `baseDeliverySequence` equals the previous batch's
      * `maxDeliverySequence` (the first batch bases on `fromDeliverySeq`). The client
      * applies a batch only when its watermark equals the base and advances the
      * watermark to the max, so a dropped batch stalls the watermark and is recovered by
-     * the next handshake resend. Because delivery-sequence order respects causal order
-     * (a dependency is always committed, and thus sequenced, before its dependent), no
-     * topological sort is needed and the client never defers on a missing dependency
-     * that is itself in this stream.
+     * a re-send from the acknowledged position. Because delivery-sequence order respects
+     * causal order (a dependency is always committed, and thus sequenced, before its
+     * dependent), no topological sort is needed.
+     *
+     * Batches go out as each scan chunk is filtered (SRV-5): the server holds at most
+     * one scan chunk plus two batches per stream, never the whole backlog, and the
+     * first batch reaches the client after one chunk. One full batch is held back so
+     * the stream's last batch can be marked `isFinal` (one-batch lookahead). The final
+     * batch carries the highest sequence scanned, not merely the last in-scope one, so
+     * an out-of-scope tail is not re-scanned. Every sent batch advances the send cursor
+     * ({@link lastSentDeliverySeq}). Between batches the stream waits for the client to
+     * drain its socket (backpressure).
      *
-     * The final batch advances the watermark to the highest delivery sequence scanned,
-     * not merely the last in-scope one, so an out-of-scope tail is not re-scanned on the
-     * next reconnect. Returns the number of operations actually sent.
+     * @param fromDeliverySeq - The chain base: the client's watermark or the send cursor
+     * @param finalizeWhenEmpty - Send an empty final batch even when nothing new was
+     *   scanned (the handshake stream, so the client completes initial sync)
+     */
+    private streamDelivery;
+    /**
+     * Filter one scan chunk of the delivery log down to what this session receives:
+     * visible operations (each preceded by its scope-entry insert, RT-19) and
+     * retractions. The records the decisions need are fetched for the whole chunk at
+     * once (LMS #11), one batched read per collection instead of one query per op.
      */
-    private sendDeliveryStream;
+    private filterDeliveryChunk;
+    /**
+     * Read, in one batched query per collection, every record the visibility decisions
+     * for these operations may look up, when the store supports batched reads. Returns
+     * null (per-operation lookups) otherwise. Over-fetching is harmless: the chunk
+     * bounds it.
+     */
+    private prefetchRecordsFor;
     /** Build, track, and send one chained delivery-stream batch. */
     private sendDeliveryBatch;
+    /** The scope snapshots of these operations, when the store keeps them (RT-14). */
+    private scopeSnapshotsFor;
+    /**
+     * Download visibility of one operation. With a scope snapshot (RT-14) the
+     * operation is judged on the record's scope values right after it was applied, so
+     * history written while a record belonged to someone else stays hidden after an
+     * ownership transfer, and a previous owner still receives its own history. Query
+     * subsets (a client-chosen narrowing, not an authorization) keep using the current
+     * row. Operations without a snapshot (legacy rows, custom stores) fall back to the
+     * current row plus `op.data`.
+     */
     private operationVisibleToClient;
-    /** Upload authorization is independent from the client's downloaded/query view. */
-    private operationAllowedFromClient;
+    /**
+     * Where the store already holds each of `operations` (by id), in one store read.
+     * Null when the store cannot answer by id (a custom store without
+     * `findStoredOperations`, or the read failed): callers then fall back to a
+     * per-operation (node, sequence) lookup and the store's own dedup at apply.
+     */
+    private findStoredOperations;
+    /**
+     * True when the batch lookup alone shows `op` is already stored and may be
+     * acknowledged as a duplicate with no further store work (RT-31, RT-39): this
+     * device's own operation stored under its node (its sequence repair may have
+     * renumbered it, keeping the id), or any other operation stored under exactly its
+     * (node, sequence, id), such as one the server itself delivered and the client
+     * echoed back. Never true for a store without the batch lookup.
+     */
+    private isStoredDuplicate;
+    /**
+     * The operation the store holds under `op`'s id (at the node and sequence the batch
+     * lookup found), or null when it cannot be read (the upload is then judged like any
+     * other: verified, validated, charged, and deduplicated by the store at apply).
+     */
+    private loadStoredOperation;
+    /**
+     * Refuse an upload that reuses a stored operation's id with different content (RT-77):
+     * terminal, nothing recorded or derived, logged and emitted as tampering. An honest
+     * client never does this (ids are content hashes), so the rejection only reaches a
+     * forger. No resolution is recorded: the id belongs to the stored operation.
+     */
+    private refuseForgedDuplicate;
+    /** Uploads refused for reusing a stored id with other content (RT-77). */
+    getForgedDuplicateCount(): number;
+    /**
+     * The recorded resolutions of the batch's own-node operations that the lookup did
+     * not find stored (RT-43, RT-47). Asked only for this session's own node, so the
+     * answer never reveals another device's (or tenant's) refusals.
+     */
+    private findResolutions;
+    /** The highest resolved sequence of `nodeId` (0 without the store method or on error). */
+    private resolvedThrough;
+    /**
+     * Durably record how this session's own operation was resolved without being stored
+     * under its sequence. Awaited before the answer is sent: a failure propagates (the
+     * batch fails and is not acknowledged), so the client never acts on a resolution the
+     * server could forget.
+     */
+    private recordResolution;
+    /**
+     * Refuse an operation for good (non-retriable): remember the refusal (RT-47), then
+     * tell the client. A resubmission of the same id is answered with this rejection
+     * without being judged again.
+     */
+    private refuseTerminally;
+    /**
+     * An own operation acknowledged as a duplicate of the copy stored under ANOTHER
+     * sequence (the client's sequence repair renumbered it, keeping its id): record the
+     * submitted sequence as resolved, so the handshake does not read it as lost (RT-43).
+     */
+    private noteStoredElsewhere;
+    /** Refuse the rest of a batch for the per-minute ingest budget (retriable). */
+    private sendRateLimited;
+    /**
+     * True when the store already holds exactly this operation (same node, sequence and
+     * id). Answered from the batch lookup when the store supports it.
+     */
+    private isStoredOperation;
+    /**
+     * The scopes this session may write under. Fails closed: with auth configured but
+     * no accepted authentication, the session may write nothing (an empty scope map),
+     * never everything.
+     */
+    private uplinkScopes;
+    /**
+     * Upload authorization, independent from the client's downloaded/query view. The
+     * stored row (including a soft-deleted one) is always loaded when scopes apply and
+     * is authoritative; client-supplied previousData is never consulted.
+     */
+    private authorizeClientOperation;
+    /**
+     * True when this update moved the record out of the session's scope, judged on the
+     * store's own before/after values (RT-15), never on the writer's previousData. An
+     * operation without a snapshot never produces a retraction (fail quiet: the
+     * client keeps what it already had, and no other tenant's record id leaks).
+     */
     private scopeRetractionFor;
+    /**
+     * The scope-entry operation to send before `op` when `op` moved an existing record
+     * into this session's download scope (RT-19), or null. Judged on the store's own
+     * pre/post snapshot; built from the record's CURRENT row, and only while that row
+     * is live and still inside the scope (a record that has since left again, or was
+     * deleted, gets no entry: its later operations retract or delete it anyway).
+     * Operations without a snapshot (legacy rows, custom stores) never produce one.
+     */
+    private scopeEntryFor;
     /**
      * Read a record's current field values from the materialized store for scope /
      * query-subset backfill. Includes soft-deleted rows so a relayed delete (whose op
      * carries no fields) is still judged against the record's actual scope. Returns
      * undefined when the record cannot be read (never materialized, or no schema).
+     * `rows` are the rows one delivery pass prefetched for its own decisions.
      */
     private lookupRecordFields;
+    /**
+     * Hand an awareness update to the server's relay, with the record its cursor
+     * names, read from the store, so the relay can deliver it only to sessions whose
+     * download scope contains that record (the rule of the Yjs doc channel).
+     * Awareness is purely ephemeral: nothing is persisted.
+     */
     private handleAwarenessUpdate;
+    /**
+     * A Yjs doc-channel update is a write to a richtext field: the sender must be
+     * allowed to write the stored record (same rule as operation uploads). The stored
+     * row is handed to the relay so delivery can be limited to sessions whose download
+     * scope contains the record.
+     */
     private handleYjsDocUpdate;
+    /** A legacy client's duplicate pair was stored (RT-37): count it and log it. */
+    private recordLegacySequencePair;
     private sendError;
     /**
      * Reject one specific client operation, tied to its id, so the submitter can
@@ -1364,10 +3389,57 @@ declare class ClientSession {
      * replica ever sees it.
      */
     private sendOperationRejected;
-    private setSerializerWireFormat;
     private handleTransportClose;
 }
 
+/** {@link findJsonStringValues} was given a page or sample size it cannot use. */
+declare class InvalidDiagnosticOptionsError extends KoraError {
+    constructor(option: string, value: unknown);
+}
+/** Rows of one json/object field whose stored value is a string that itself holds JSON. */
+interface JsonStringValueReport {
+    collection: string;
+    field: string;
+    /** How many live rows hold such a string. */
+    count: number;
+    /** Ids of the first such rows, to inspect. */
+    sampleIds: string[];
+}
+/** Options for {@link findJsonStringValues}. */
+interface FindJsonStringValuesOptions {
+    /** Ids reported per field. Defaults to 10. */
+    sampleSize?: number;
+    /** Rows read per page. Defaults to 1,000. */
+    pageSize?: number;
+}
+/**
+ * Find `t.json()` / `t.object()` fields whose stored value is a JSON-encoded string
+ * (`'{"a":1}'` instead of `{ a: 1 }`), after an upgrade from a server older than
+ * 1.0.0-beta.13 (F14).
+ *
+ * Servers before beta.13 decoded one JSON-string layer of such values when they built
+ * rows; since beta.13 the rows hold exactly what the operations wrote. A client that
+ * wrote a json field as a string (or double-encoded it) therefore reads back a string
+ * where the old server returned an object. Kora does not rewrite these values: a string
+ * is also a legitimate json value, so no rule can tell a real string from an encoded
+ * object. Fix them with server-authored updates (`server.kora.apply`) once you know
+ * which shape your app expects.
+ *
+ * @param store - The server store, with its schema set
+ * @param options - Sample and page sizes
+ * @returns One report per field that holds at least one such value
+ * @throws {InvalidDiagnosticOptionsError} When `pageSize` is not a positive integer or
+ *   `sampleSize` not a non-negative one
+ *
+ * @example
+ * ```typescript
+ * for (const report of await findJsonStringValues(store)) {
+ *   console.warn(`${report.collection}.${report.field}: ${report.count} rows`, report.sampleIds)
+ * }
+ * ```
+ */
+declare function findJsonStringValues(store: ServerStore, options?: FindJsonStringValuesOptions): Promise<JsonStringValueReport[]>;
+
 /**
  * Configuration for the production server that serves both
  * static files and WebSocket sync on a single port.
@@ -1406,6 +3478,32 @@ interface ProductionServerConfig {
      * backupToken.
      */
     operationalAuth?: ProductionOperationalAuth;
+    /**
+     * Reverse proxies trusted to report the client address in `X-Forwarded-For`,
+     * which becomes `request.ip` (the key `@korajs/auth` rate-limits sign-in by).
+     * A hop count (`1` for a single load balancer in front) or a list of trusted
+     * proxy IPs / CIDR ranges. When unset, the header is ignored and `request.ip`
+     * is the socket address, so a client cannot pick its own rate-limit bucket.
+     */
+    trustProxy?: TrustProxySetting;
+    /**
+     * Largest request body a custom HTTP route (`httpRoutes`) accepts, in bytes. A
+     * larger body is refused with 413 before it is buffered (SRV-6), so an
+     * unauthenticated client cannot make the server hold arbitrary amounts of memory.
+     * Defaults to 1 MiB.
+     */
+    maxRequestBodyBytes?: number;
+    /**
+     * Largest backup accepted by `/__kora/backup/import`, in bytes. Defaults to 256 MiB.
+     */
+    maxBackupBytes?: number;
+    /**
+     * Which requests for a missing path get the app shell (`index.html`). `'navigation'`
+     * (default): browser navigations only, so a missing API path is a real 404.
+     * `'extensionless'`: also any path without a file extension, for a service worker
+     * that warms app routes with a plain `fetch(url)`. Never under `/assets/`.
+     */
+    spaFallback?: 'navigation' | 'extensionless';
 }
 interface ProductionOperationalAuth {
     /** Protects /__kora, /__kora/status, and /__kora/events. */
@@ -1414,6 +3512,14 @@ interface ProductionOperationalAuth {
     metricsToken?: string;
     /** Protects /__kora/backup/*. Falls back to adminToken when omitted. */
     backupToken?: string;
+    /**
+     * With `NODE_ENV=production`, an endpoint group whose token is unset is disabled
+     * (`403 OPERATIONAL_ENDPOINT_DISABLED`): backups export or replace every user's data,
+     * and the dashboard lists connected devices. Set this to `true` to serve such groups
+     * without a token anyway (for example behind a network you control). Outside
+     * production, groups without a token stay public, with a startup warning.
+     */
+    allowPublic?: boolean;
 }
 interface ProductionHttpRouteRequest {
     method: string;
@@ -1444,7 +3550,10 @@ interface ProductionHttpRoute {
  * A production server handle returned by createProductionServer.
  */
 interface ProductionServer {
-    /** Start listening. Returns the URL the server is available at. */
+    /**
+     * Start listening. Returns the URL the server is available at, with the port it
+     * actually bound (pass `port: 0` to let the OS pick a free one).
+     */
     start(): Promise<string>;
     /** Stop the server gracefully. */
     stop(): Promise<void>;
@@ -1471,6 +3580,25 @@ interface ProductionServer {
      * @returns Every live blob reference the server can currently see.
      */
     getLiveBlobRefs(): Promise<BlobRef[]>;
+    /**
+     * Re-resolve one user's grant on their live sync sessions now. Call it after a
+     * membership change (an invitation accepted, a collaborator removed): a session
+     * whose scope changed ends with a retriable `SCOPE_CHANGED` and its client
+     * reconnects with the new grant, applying its `scopeExit` policy. See
+     * `KoraSyncServer.refreshScopes`.
+     *
+     * @param userId - The user whose grant changed
+     * @returns The number of sessions ended
+     */
+    refreshScopes(userId: string): Promise<number>;
+    /**
+     * Re-validate every live sync session's credential and grant now (the pass that
+     * otherwise runs every `sessionRevalidationIntervalMs`). See
+     * `KoraSyncServer.revalidateSessions`.
+     *
+     * @returns The number of sessions ended
+     */
+    revalidateSessions(): Promise<number>;
 }
 /**
  * Creates a production server that serves both static files and WebSocket sync
@@ -1496,6 +3624,10 @@ interface TokenAuthProviderOptions {
     /**
      * Validate a token and return an AuthContext if valid, or null if rejected.
      * This is where you implement your auth logic (JWT verification, database lookup, etc.).
+     *
+     * Return `scopes` to grant sync access explicitly. When the returned context
+     * has no scopes, schema-scoped collections are bound to `{ userId }` and any
+     * collection scoped by another key is denied.
      */
     validate: (token: string) => Promise<AuthContext | null>;
 }
@@ -1528,11 +3660,13 @@ interface TokenValidator {
         sub: string;
         dev: string;
         type: string;
+        exp?: number;
     } | null;
     validateTokenWithRevocation?(token: string): Promise<{
         sub: string;
         dev: string;
         type: string;
+        exp?: number;
     } | null>;
 }
 /**
@@ -1575,8 +3709,15 @@ interface KoraAuthProviderOptions {
      */
     deviceTracker?: DeviceToucher;
     /**
-     * Optional scope resolver. Called with the user ID to determine
-     * which collections/records the user can sync.
+     * Optional scope resolver. Called with the verified user ID to determine
+     * which collections/records the user can sync. Its result is the complete
+     * server grant: a collection it omits is not visible, and the client
+     * handshake can only narrow it. Use `claimScopes({ userId, orgId })` from
+     * `@korajs/core` to bind every schema-scoped collection from verified values.
+     *
+     * When omitted, the grant binds every schema-scoped collection from
+     * `{ userId: <verified sub> }`; collections scoped by any other key are denied
+     * until you supply it.
      */
     resolveScopes?: (userId: string) => Promise<Record<string, Record<string, unknown>>>;
 }
@@ -1630,7 +3771,9 @@ interface MixedAuthProviderOptions {
      */
     primary: AuthProvider;
     /**
-     * Scopes to apply to anonymous connections.
+     * Scopes to apply to anonymous connections. This is the complete anonymous
+     * grant: anonymous sessions can sync exactly these collections, and the
+     * client handshake can only narrow them, never add one.
      * Each key is a collection name; the value is a filter object
      * (use `{}` for unrestricted access to that collection).
      *
@@ -1654,10 +3797,10 @@ interface MixedAuthProviderOptions {
 /**
  * Auth provider that supports both authenticated and anonymous connections.
  *
- * When a client connects with a valid token, the primary auth provider
- * handles authentication normally. When a client connects without a token
- * (or with an invalid one), the connection is accepted as anonymous with
- * restricted sync scopes.
+ * When a client connects with a token, the primary auth provider decides:
+ * a valid token authenticates normally and an invalid, expired or revoked one
+ * is rejected (the client refreshes and reconnects). Only a client that sends
+ * no token at all is accepted as anonymous, with exactly `anonymousScopes`.
  *
  * This is the recommended pattern for apps that need public data access
  * alongside authenticated users — for example, a form builder where
@@ -1698,9 +3841,24 @@ declare class MixedAuthProvider implements AuthProvider {
     private readonly anonymousPrefix;
     private anonymousCounter;
     constructor(options: MixedAuthProviderOptions);
-    authenticate(token: string): Promise<AuthContext>;
+    /** The primary provider's revocation feed, when it has one. */
+    onRevoke?: AuthProvider['onRevoke'];
+    authenticate(token: string): Promise<AuthContext | null>;
 }
 
+/** Options for {@link MemoryServerStore}. */
+interface MemoryServerStoreOptions {
+    /**
+     * Node ids, besides this store's own, whose operations win
+     * `merge('server-authoritative')` fields (legacy server node ids). Every
+     * `kora:server:` node id is authoritative without being listed.
+     */
+    authoritativeNodeIds?: string[];
+    /** Revoked explicit authorities (see `ServerIdentityOptions.revokedAuthoritativeNodeIds`). */
+    revokedAuthoritativeNodeIds?: string[];
+    /** Instance id within the deployment (see `ServerIdentityOptions.instanceId`). */
+    instanceId?: string;
+}
 /**
  * In-memory server store for testing and quick prototyping.
  * Not suitable for production — data does not survive process restart.
@@ -1712,6 +3870,13 @@ declare class MemoryServerStore implements ServerStore {
     private readonly nodeId;
     private readonly operations;
     private readonly operationIndex;
+    /** (nodeId, sequenceNumber) -> the id of the operation holding it (W3 step 4). */
+    /** (node, sequence) -> ids holding it, in store order (several only for a legacy pair). */
+    private readonly operationIdsBySequence;
+    /** Node -> sequences held by more than one operation (legacy pairs, RT-48). */
+    private readonly pairSequencesByNode;
+    /** Operation id -> how it was resolved without being stored (RT-43, RT-47). */
+    private readonly resolutions;
     private readonly versionVector;
     /**
      * Server-assigned delivery sequence per operation id. Single-process, so a plain
@@ -1722,24 +3887,118 @@ declare class MemoryServerStore implements ServerStore {
     private readonly deliverySeqByOpId;
     private deliverySeqCounter;
     private schema;
+    /** Node id -> the authenticated principal that claimed it (see claimNode). */
+    private readonly nodeOwners;
+    /** Operation id -> scope snapshot captured at apply time (RT-14). */
+    private readonly scopeSnapshots;
+    /** Fields the current snapshots were captured with (RT-20). */
+    private snapshotFingerprint;
+    /** Blob content hash -> owners that pushed or first claimed it (RT-11). */
+    private readonly blobOwners;
+    /** Wrapped encryption key records (ENC-1): owner + keyring -> record JSON and revision. */
+    private readonly encryptionKeyRecords;
     /** Materialized records: collection -> recordId -> record data */
     private readonly materializedRecords;
+    /** Fold state per materialized record (W7): rows are projected from it. */
+    private readonly foldStates;
+    /** Every operation of a record, in store (delivery) order. */
+    private readonly recordOps;
+    private readonly authoritativeNodeIds;
+    /** Legacy and configured authorities (the `kora:server:` prefix needs no listing). */
+    private readonly explicitAuthorities;
+    /** Explicit authority over time: revoked and ever-held ids (RT-81). */
+    private readonly authorityHistory;
+    private foldOptions;
+    /** Schema transforms the fold applies (transforms at fold time, RT-84). */
+    private operationTransforms;
     private closed;
-    constructor(nodeId?: string);
+    /**
+     * Sequence-enforcement epoch (see SEQUENCE_ENFORCEMENT_EPOCH_KEY). A memory store
+     * starts empty under this release, so 0: every holder was stored under enforcement.
+     * A replace-mode backup import moves it to the restored log's end.
+     */
+    private sequenceEpoch;
+    /** Derivation secret of server-derived ids (RT-64). Per process: nothing persists. */
+    private readonly derivationSecret;
+    /**
+     * @param nodeId - Deprecated: a plain id is recorded as a legacy authoritative id; a
+     *   `kora:server:` id is used verbatim. Leave unset: the store authors under
+     *   `kora:server:<deployment>:<instance>` (a fresh deployment per process, since a
+     *   memory store persists nothing).
+     * @param options - Extra authoritative ids and the instance id
+     */
+    constructor(nodeId?: string, options?: MemoryServerStoreOptions);
+    deriveServerOperationId(parentOpId: string, ruleId: string, targetRecordId: string): Promise<string>;
+    getAuthoritativeNodeIds(): string[];
+    /** Explicit authoritative ids the deployment revoked (RT-81), advertised at handshake. */
+    getRevokedAuthoritativeNodeIds(): string[];
+    /**
+     * Every explicit id the deployment ever held authoritative, revoked ones included
+     * (RT-81): never accepted as a device node id.
+     */
+    getEverAuthoritativeNodeIds(): string[];
     getVersionVector(): VersionVector;
     getNodeId(): string;
     getSchema(): SchemaDefinition | null;
-    setSchema(schema: SchemaDefinition): Promise<void>;
-    applyRemoteOperation(op: Operation): Promise<ApplyResult>;
+    setSchema(schema: SchemaDefinition, options?: ServerSchemaOptions): Promise<void>;
+    getOperationTransforms(): readonly OperationTransform[];
+    setOperationTransforms(transforms: readonly OperationTransform[]): Promise<void>;
+    applyRemoteOperation(op: Operation, options?: ApplyRemoteOptions): Promise<ApplyResult>;
+    private addSequenceHolder;
+    getSequencePairOperations(nodeId: string, throughSequence: number): Promise<Operation[]>;
+    recordOperationResolution(resolution: OperationResolution): Promise<void>;
+    findOperationResolutions(nodeId: string, ids: string[]): Promise<Map<string, OperationResolution>>;
+    deleteOperationResolution(nodeId: string, operationId: string): Promise<void>;
+    getResolvedThrough(nodeId: string): Promise<number>;
+    findStoredOperations(ids: string[]): Promise<Map<string, StoredOperationKey>>;
+    getOperationScopeSnapshots(operationIds: string[]): Promise<Map<string, OperationScopeSnapshot>>;
+    getRecordLatestTimestamp(collection: string, recordId: string): Promise<HLCTimestamp | null>;
+    getRecordFieldVersions(collection: string, recordId: string): Promise<RecordFieldVersions | null>;
+    getRecordFoldState(collection: string, recordId: string): Promise<FoldState | null>;
+    getRecordOperations(collection: string, recordId: string): Promise<Operation[]>;
+    previewOperation(op: Operation): Promise<MaterializedRecord | null>;
+    /**
+     * The record's fold state: the stored one for a materialized collection, else
+     * folded from the record's operations (a collection outside the schema).
+     */
+    private readFoldState;
+    private addRecordOp;
+    recordBlobOwner(hash: string, owner: string): Promise<void>;
+    getBlobOwners(hashes: string[]): Promise<Map<string, string[]>>;
+    claimBlobIfUnowned(hash: string, owner: string): Promise<boolean>;
+    /** Scope values of a live record before a write; null when absent or deleted. */
+    private scopeValuesBefore;
+    /**
+     * Rebuild missing scope snapshots from the log (migration from a store without
+     * them, or a replace-mode backup import), replaying each record in commit order.
+     */
+    private backfillScopeSnapshots;
     getOperationRange(nodeId: string, fromSeq: number, toSeq: number): Promise<Operation[]>;
     getOperationCount(): Promise<number>;
     getMaxDeliverySequence(): Promise<number>;
     getOperationsAfterDelivery(afterDeliverySequence: number, limit: number): Promise<DeliveredOperation[]>;
     materializeCollection(collection: string): Promise<MaterializedRecord[]>;
+    getNodeIdsAfterDelivery(afterDeliverySequence: number): Promise<string[]>;
+    findRecordsByIds(collection: string, ids: string[]): Promise<Map<string, MaterializedRecord>>;
     queryCollection(collection: string, options?: CollectionQueryOptions): Promise<MaterializedRecord[]>;
     findRecord(collection: string, id: string): Promise<MaterializedRecord | null>;
     countCollection(collection: string, where?: Record<string, unknown>): Promise<number>;
     close(): Promise<void>;
+    getEncryptionKeyRecord(owner: string, keyring: string): Promise<string | null>;
+    putEncryptionKeyRecord(owner: string, keyring: string, record: string, revision: number, expectedRevision: number): Promise<boolean>;
+    listEncryptionKeyRecords(owner?: string): Promise<EncryptionKeyRecordRow[]>;
+    getEncryptedKeyIds(nodeOwner: string | null, limit: number): Promise<string[]>;
+    claimNode(nodeId: string, userId: string): Promise<boolean>;
+    claimUnownedNode(nodeId: string, userId: string): Promise<boolean>;
+    getNodeClaimOwner(nodeId: string): Promise<string | null>;
+    replaceNodeClaim(nodeId: string, expectedOwner: string, newOwner: string): Promise<boolean>;
+    releaseNodeClaim(nodeId: string): Promise<boolean>;
+    /**
+     * The record as currently stored, including a soft-deleted one (whose last field
+     * values are kept), or null when it was never written. Without a materialized
+     * table, the last known values are replayed from the operation log.
+     */
+    private readStoredRow;
     /**
      * Wipes all in-memory state. For tests and E2E isolation only.
      */
@@ -1753,7 +4012,16 @@ declare class MemoryServerStore implements ServerStore {
      * Get all stored operations (for test assertions).
      */
     getAllOperations(): Operation[];
-    private rebuildMaterializedRecord;
+    /**
+     * Merge one just-appended operation into its record's fold state and project the
+     * row: O(fields the operation touches), independent of the record's history
+     * (SRV-7). Falls back to a full re-fold only when the stored state cannot take the
+     * operation (a field's fold kind changed with the schema).
+     */
+    private mergeIntoRecord;
+    /** Persist a record's fold state and project it onto its materialized row. */
+    private writeRecord;
+    /** Re-fold every record of every materialized collection (schema set, backup restore). */
     private backfillAllCollections;
     private materializeFromOps;
     private assertOpen;
@@ -1761,6 +4029,123 @@ declare class MemoryServerStore implements ServerStore {
     private assertCollection;
 }
 
+/**
+ * Server materialization through the one deterministic fold (W7 Stage B2).
+ *
+ * Every server store (memory, SQLite, Postgres) keeps, per materialized record, the
+ * record's serialized {@link FoldState} next to its collection row. Applying an
+ * operation is "append, then `mergeOp`": O(fields the operation touches), never a
+ * replay of the record's history (SRV-7). The collection row is a pure projection of
+ * the fold state ({@link projectFoldState}), so the server's rows are exactly what a
+ * client that holds the same operations materializes (SRV-1).
+ *
+ * The fold is pure JavaScript: ordering uses HLC stamps compared in JS, never a
+ * database collation (the Phase 1 COLLATE "C" concern disappears for materialization).
+ *
+ * Old helpers (`replayOperationsForRecord`, `mergeArraySet`) are no longer used to
+ * materialize; they stay exported from core for legacy comparison only.
+ */
+
+/** What a store's startup re-materialization did (W7 step 7). */
+interface FoldMigrationReport {
+    /** False when no schema was set (nothing is materialized). */
+    ran: boolean;
+    /** Records re-folded and rewritten. */
+    records: number;
+    /**
+     * Records that own quarantined operations (see `ServerLogIntegrityReport`): their log
+     * is incomplete, so their pre-fold rows were kept as a snapshot base with the
+     * remaining operations folded onto it (RT-70), never re-folded from the log alone.
+     */
+    skippedUnclean: number;
+    /** True when the fold plan (field kinds, strategies, resolvers) changed: every record was re-folded. */
+    fullRefold: boolean;
+}
+
+/** A row the scan quarantined. */
+interface ServerLogIntegrityRow {
+    operationId: string;
+    problem: string;
+    detail: string;
+}
+/** Result of the server scan. */
+interface ServerLogIntegrityReport {
+    /** Rows checked by this scan (0 when it already ran on this database). */
+    checkedRows: number;
+    /** Rows this scan moved to the quarantine table. */
+    quarantined: ServerLogIntegrityRow[];
+    /** False when the one-time scan had already run (only the quarantine is reported). */
+    ran: boolean;
+    /** Every row in the quarantine table. */
+    totalQuarantined: number;
+}
+
+/**
+ * Stable server identity (RT-61, RT-62, RT-64).
+ *
+ * Every operation the server authors (route writes, cascades, set-nulls, constraint
+ * corrections) is authored by a node id in the reserved namespace
+ * `kora:server:<deploymentId>:<instanceId>`:
+ *
+ * - `deploymentId` is generated once per database and persisted in `kora_server_meta`,
+ *   so every instance that shares the database (and every restart) belongs to one
+ *   deployment.
+ * - `instanceId` is distinct per running instance, so two instances never author the
+ *   same `(nodeId, sequenceNumber)`: SQLite persists one (a SQLite database has one
+ *   writer process), Postgres allocates a fresh one from a counter in the database on
+ *   every start unless the operator configures a stable `instanceId` per instance.
+ *
+ * Authority (`merge('server-authoritative')`) is the prefix rule: any operation whose
+ * node id starts with {@link SERVER_NODE_PREFIX} is authoritative, on the server and on
+ * every device. Devices can never use a `kora:` node id (the session refuses it at
+ * handshake). Server node ids written before this release (random per-process ids, or
+ * an id the operator configured) are recorded once, at the first start of this release,
+ * in a persisted list of legacy authoritative ids that the handshake keeps advertising,
+ * so earlier server decisions keep winning everywhere.
+ *
+ * Server-derived operation ids (cascades, corrections) are keyed with a persisted,
+ * deployment-wide secret (HMAC-SHA-256), so a writer cannot predict them and occupy one
+ * first; every instance of the deployment derives the same id for the same effect.
+ */
+
+/** Prefix of every node id the server authors under. */
+declare const SERVER_NODE_PREFIX = "kora:server:";
+/** Thrown for an invalid server identity configuration. */
+declare class ServerIdentityError extends KoraError {
+    constructor(message: string, context?: Record<string, unknown>);
+}
+/** Identity options every server store accepts. */
+interface ServerIdentityOptions {
+    /**
+     * Deprecated. A plain id (for example one set before beta.13) is no longer the id the
+     * server authors under: it is recorded as a legacy authoritative id, so operations
+     * already stored under it keep their authority, and no device may use it. An id in
+     * the `kora:server:` namespace is used verbatim (it must then be unique per instance).
+     */
+    nodeId?: string;
+    /**
+     * Stable id of this instance within the deployment (`[A-Za-z0-9._-]`, at most 64
+     * characters). Must be distinct per running instance. SQLite persists one on its own;
+     * Postgres allocates a new one per start when it is not configured.
+     */
+    instanceId?: string;
+    /**
+     * Extra node ids whose operations win `merge('server-authoritative')` fields. Every id
+     * listed here once stays authoritative (devices keep it too) until it is revoked with
+     * {@link revokedAuthoritativeNodeIds}: removing it from this list does not revoke it.
+     */
+    authoritativeNodeIds?: string[];
+    /**
+     * Explicit authoritative node ids to revoke (RT-81): they stop being authoritative on
+     * the server, the handshake tells every device to drop them (devices re-fold), and they
+     * are still never accepted as device node ids. Revocation is permanent (persisted); an
+     * id may not be both listed in `authoritativeNodeIds` and revoked.
+     */
+    revokedAuthoritativeNodeIds?: string[];
+}
+/** True for a node id the server authors under (current or any instance of any deployment). */
+declare function isServerNodeId(nodeId: string): boolean;
+
 /**
  * PostgreSQL-backed server store using Drizzle ORM.
  * All reads and writes go through Drizzle's typed query builder.
@@ -1769,7 +4154,18 @@ declare class MemoryServerStore implements ServerStore {
  * collection tables for efficient indexed queries (dual-write).
  */
 declare class PostgresServerStore implements ServerStore {
-    private readonly nodeId;
+    /** This instance's server node id; loaded from the database during startup (RT-62). */
+    private loadedNodeId;
+    private readonly configuredIdentity;
+    /** Derivation secret of server-derived ids, shared by the deployment (RT-64). */
+    private derivationSecret;
+    /** Legacy and configured authorities (the `kora:server:` prefix needs no listing). */
+    private explicitAuthorities;
+    /** Explicit authority over time: revoked and ever-held ids (RT-81). */
+    private authorityHistory;
+    /** Other `kora:server:` nodes with stored operations (advertised for older clients). */
+    /** Records owning quarantined operations: folded onto their kept rows (RT-70). */
+    private quarantine;
     private readonly db;
     private readonly versionVector;
     private readonly ready;
@@ -1783,6 +4179,9 @@ declare class PostgresServerStore implements ServerStore {
      * null after a backup import so it re-seeds from the restored version vector.
      */
     private sequenceCounter;
+    /** See {@link SEQUENCE_ENFORCEMENT_EPOCH_KEY}; fixed per database at first start. */
+    private sequenceEpoch;
+    private logIntegrity;
     /**
      * Time source for HLC timestamps on server-originated operations. Injectable so a
      * test can freeze wall-clock time and prove the conditional-apply ordering holds
@@ -1790,7 +4189,54 @@ declare class PostgresServerStore implements ServerStore {
      * exist to make correct). Defaults to the system clock in production.
      */
     private readonly timeSource;
-    constructor(db: PostgresJsDatabase, nodeId?: string, timeSource?: TimeSource);
+    private foldOptions;
+    /** Schema transforms the fold applies (transforms at fold time, RT-84). */
+    private operationTransforms;
+    private foldMigration;
+    /**
+     * @param db - The Drizzle database
+     * @param nodeId - Deprecated: a plain id is recorded as a legacy authoritative id; a
+     *   `kora:server:` id is used verbatim (it must then be unique per instance). Leave
+     *   unset: the store authors under `kora:server:<deployment>:<instance>`, with the
+     *   deployment persisted in the database and a distinct instance per process (RT-62).
+     * @param timeSource - Clock for server-originated operations (tests)
+     * @param options - Extra authoritative ids and a stable instance id
+     */
+    constructor(db: PostgresJsDatabase, nodeId?: string, timeSource?: TimeSource, options?: Omit<ServerIdentityOptions, 'nodeId'>);
+    /** Resolves once the store's tables and identity are loaded. */
+    whenReady(): Promise<void>;
+    /**
+     * This store's node id and the legacy and configured ids (explicit authorities).
+     * Other `kora:server:` instances are not listed: the prefix rule makes every one of
+     * them authoritative, and a list that grew by one instance id per start would make
+     * every device re-fold after each deploy (RT-75). Handshakes advertise only the
+     * explicit (non-prefixed) ids.
+     */
+    getAuthoritativeNodeIds(): string[];
+    /** Legacy and configured authorities (beside the `kora:server:` namespace). */
+    getLegacyAuthoritativeNodeIds(): string[];
+    /** Explicit authoritative ids the deployment revoked (RT-81), advertised at handshake. */
+    getRevokedAuthoritativeNodeIds(): string[];
+    /**
+     * Every explicit id the deployment ever held authoritative, revoked ones included
+     * (RT-81): never accepted as a device node id.
+     */
+    getEverAuthoritativeNodeIds(): string[];
+    deriveServerOperationId(parentOpId: string, ruleId: string, targetRecordId: string): Promise<string>;
+    private get nodeId();
+    /** Remember another `kora:server:` node that authored stored operations. */
+    /**
+     * Load (creating on first start) the persisted server identity under an advisory
+     * lock: the deployment id and derivation secret (one per database, shared by every
+     * instance), a fresh instance id from the database counter (unless configured), and
+     * the legacy authoritative ids. At the first start of this release, every node id
+     * whose operations hold an authority class in a stored fold state (a server decision
+     * folded under an earlier, per-process server node id) is recorded as a legacy
+     * authority, before any re-fold could drop that class.
+     */
+    private loadIdentity;
+    /** What the last startup re-materialization did (W7 step 7). */
+    getFoldMigrationReport(): FoldMigrationReport;
     getVersionVector(): VersionVector;
     /**
      * Atomically reserve this node's next server-operation sequence number. The
@@ -1800,8 +4246,51 @@ declare class PostgresServerStore implements ServerStore {
     reserveSequenceNumber(): number;
     getNodeId(): string;
     getSchema(): SchemaDefinition | null;
-    setSchema(schema: SchemaDefinition): Promise<void>;
-    applyRemoteOperation(op: Operation): Promise<ApplyResult>;
+    /**
+     * One-time migration (RT-101): drop the enum `CHECK` constraints (and any `NOT NULL`
+     * on a schema field) that beta.12 and earlier DDL put on collection tables, in one
+     * transaction. A check is dropped when it parses as an enum check (one column against
+     * string literals, in every form Postgres normalizes `IN (...)` to, the single-value
+     * `col = 'x'` included, RT-108) on an enum field of the schema, or as the multi-value
+     * `= ANY (ARRAY[...])` shape on another non-internal column; checks added by hand are
+     * kept. Idempotent and resumable: a later start finds nothing to drop.
+     */
+    private relaxValueDomainConstraints;
+    /**
+     * Throws {@link OperationTransformCoverageError} when a schema version in the stored
+     * log has no transform path to `version` (RT-103): those operations would fold as
+     * absent, silently erasing them from their records.
+     */
+    private assertTransformCoverage;
+    getOperationTransforms(): readonly OperationTransform[];
+    setOperationTransforms(transforms: readonly OperationTransform[]): Promise<void>;
+    setSchema(schema: SchemaDefinition, options?: ServerSchemaOptions): Promise<void>;
+    /**
+     * One-time migration of each collection table to the lossless text encoding (RT-65):
+     * rows written before it that contain U+FFFF (the escape introducer) are re-encoded,
+     * so the decoder returns them unchanged. Per table, under an advisory lock, recorded
+     * in `kora_server_meta`.
+     */
+    private migrateTextCodec;
+    applyRemoteOperation(op: Operation, options?: ApplyRemoteOptions): Promise<ApplyResult>;
+    /**
+     * The version vector as committed in `sync_state`, shared by every instance
+     * (SRV-4). Also refreshes this instance's cache, which `getVersionVector()` serves.
+     */
+    readVersionVector(): Promise<VersionVector>;
+    /**
+     * Insert one operation row inside an append transaction that already holds the
+     * delivery-counter lock. Returns `'duplicate'` (writing nothing) when an operation
+     * with the same id is stored; throws {@link SequenceConflictError} when a DIFFERENT
+     * operation stored after the sequence-enforcement epoch holds its (node, sequence)
+     * and the writer reserves its sequences (W3 step 4); a legacy holder or a legacy
+     * writer (RT-37) is accepted and the row is stored unflagged. Otherwise returns the
+     * verdict the row was stored under. The partial unique index over sole-holder rows
+     * backs the check against a writer that bypasses the counter lock.
+     */
+    private insertOperationRow;
+    /** Advance `sync_state` (the persisted version vector) for an appended operation. */
+    private advanceSyncState;
     /**
      * Conditionally apply operations atomically, serialized across server instances
      * on the target record via a transaction-scoped advisory lock. The lock makes
@@ -1813,7 +4302,37 @@ declare class PostgresServerStore implements ServerStore {
     getOperationCount(): Promise<number>;
     getMaxDeliverySequence(): Promise<number>;
     getOperationsAfterDelivery(afterDeliverySequence: number, limit: number): Promise<DeliveredOperation[]>;
+    getOperationScopeSnapshots(operationIds: string[]): Promise<Map<string, OperationScopeSnapshot>>;
+    getRecordLatestTimestamp(collection: string, recordId: string): Promise<HLCTimestamp | null>;
+    getRecordFieldVersions(collection: string, recordId: string): Promise<RecordFieldVersions | null>;
+    getRecordFoldState(collection: string, recordId: string): Promise<FoldState | null>;
+    getRecordOperations(collection: string, recordId: string): Promise<Operation[]>;
+    previewOperation(op: Operation): Promise<MaterializedRecord | null>;
+    recordBlobOwner(hash: string, owner: string): Promise<void>;
+    getBlobOwners(hashes: string[]): Promise<Map<string, string[]>>;
+    claimBlobIfUnowned(hash: string, owner: string): Promise<boolean>;
+    /**
+     * Scope values of a record as stored, for an operation's scope snapshot. With
+     * `includeDeleted` false a soft-deleted row counts as absent; with true it keeps
+     * its last values (a delete's post-image).
+     */
+    private readScopeValues;
+    /** Persist the scope snapshot of a just-applied operation (RT-14). */
+    private writeScopeSnapshot;
+    /**
+     * Rebuild missing scope snapshots from the log (migration from a database written
+     * before snapshots existed), replaying each affected record in commit order.
+     */
+    private backfillScopeSnapshots;
     materializeCollection(collection: string): Promise<MaterializedRecord[]>;
+    getNodeIdsAfterDelivery(afterDeliverySequence: number): Promise<string[]>;
+    getSequencePairOperations(nodeId: string, throughSequence: number): Promise<Operation[]>;
+    recordOperationResolution(resolution: OperationResolution): Promise<void>;
+    findOperationResolutions(nodeId: string, ids: string[]): Promise<Map<string, OperationResolution>>;
+    deleteOperationResolution(nodeId: string, operationId: string): Promise<void>;
+    getResolvedThrough(nodeId: string): Promise<number>;
+    findStoredOperations(ids: string[]): Promise<Map<string, StoredOperationKey>>;
+    findRecordsByIds(collection: string, ids: string[]): Promise<Map<string, MaterializedRecord>>;
     queryCollection(collection: string, options?: CollectionQueryOptions): Promise<MaterializedRecord[]>;
     findRecord(collection: string, id: string): Promise<MaterializedRecord | null>;
     countCollection(collection: string, where?: Record<string, unknown>): Promise<number>;
@@ -1830,28 +4349,106 @@ declare class PostgresServerStore implements ServerStore {
      * write so newly built operations sort strictly after it.
      */
     private latestOperationTimestamp;
+    getEncryptionKeyRecord(owner: string, keyring: string): Promise<string | null>;
+    putEncryptionKeyRecord(owner: string, keyring: string, record: string, revision: number, expectedRevision: number): Promise<boolean>;
+    listEncryptionKeyRecords(owner?: string): Promise<EncryptionKeyRecordRow[]>;
+    getEncryptedKeyIds(nodeOwner: string | null, limit: number): Promise<string[]>;
+    claimNode(nodeId: string, userId: string): Promise<boolean>;
+    claimUnownedNode(nodeId: string, userId: string): Promise<boolean>;
+    getNodeClaimOwner(nodeId: string): Promise<string | null>;
+    replaceNodeClaim(nodeId: string, expectedOwner: string, newOwner: string): Promise<boolean>;
+    releaseNodeClaim(nodeId: string): Promise<boolean>;
+    /**
+     * The record as currently stored, including a soft-deleted one (whose last field
+     * values are kept), or null when it was never written. Without a materialized
+     * table, the last known values are replayed from the operation log.
+     */
+    private readStoredRow;
+    /**
+     * Merge a just-appended operation (stored under `deliverySeq`) into its record's
+     * fold state and project the row, inside the append transaction. O(fields the
+     * operation touches): the state is read by primary key and the freshness check is
+     * one index probe (SRV-7).
+     *
+     * Concurrency: every append on every instance holds the delivery-counter row lock
+     * until commit (see nextDeliverySeq), and applyConditional takes its per-record
+     * advisory lock before it, so this read-merge-write of one record's state is
+     * serialized across instances; the `FOR UPDATE` on the state row is defense in
+     * depth. A record whose log grew without this state (an older release during a
+     * rolling upgrade) has its missing tail merged first; an unreadable, newer-than-log
+     * or plan-incompatible state is re-folded from the log.
+     */
+    private mergeIntoRecord;
+    /**
+     * The fold state of a record that owns quarantined operations (RT-70): its stored
+     * state, or its kept row as a snapshot base, with every remaining operation of the
+     * record merged on top (`rebuildFromSnapshot`). Nothing is written.
+     */
+    private rebuildAffected;
+    /** True when the record's operation at delivery sequence `seq` has id `opId`. */
+    private coversStoredOperation;
+    /**
+     * The record's current fold state for a read: the stored one when it covers the
+     * record's whole log, else folded from the log (nothing is written).
+     */
+    private readFoldState;
+    /** A record's operations stored after `afterDeliverySeq`, in delivery order. */
+    private readRecordOperations;
     /**
-     * Rebuild a single record in the materialized collection table by replaying
-     * all operations for that record.
+     * Persist a record's fold state (covering the log up to `coveredSeq`) and project
+     * it onto the materialized row.
      */
-    private rebuildMaterializedRecord;
+    private writeFoldedRecord;
     /**
      * UPSERT a record into the materialized collection table.
      */
     private upsertMaterializedRecord;
     /**
-     * Backfill all materialized collection tables from the existing operation log.
+     * {@link writeFoldedRecord} for a batch of records of one collection, in a handful
+     * of multi-row statements (the migration's write path). Rows are chunked so a
+     * statement never nears the 65,535 bind-parameter limit, however wide the collection.
+     */
+    private writeFoldedRecords;
+    /**
+     * Re-materialization migration (W7 step 7), run by setSchema and after a
+     * replace-mode restore: every record whose fold state is missing, stale or built
+     * under a different fold plan is re-folded from its log; nothing else is touched.
+     * See the SQLite store's `rematerialize` for the rules (a record owning quarantined
+     * operations folds onto its kept row, RT-70; idempotent; resumable).
+     *
+     * Postgres specifics: records are paged in batches of
+     * {@link FOLD_MIGRATION_BATCH} through the (collection, record_id, delivery_seq)
+     * index, and every batch is one transaction that first takes the delivery-counter
+     * row lock. Appends on every instance take that lock too, so a batch reads each
+     * record's complete log and writes its state while no append to it can commit: a
+     * live write on another instance during a rolling deploy is never overwritten by a
+     * stale re-fold (NEW-SRV-5), it either committed before the batch (and is folded)
+     * or commits after it (and is merged into the batch's state).
      */
-    private backfillAllCollections;
     /**
-     * Backfill a single collection's materialized table from operations.
+     * Write the beta.12 clears the ids prove into the stored bodies, once per database
+     * (RT-85, see `provenLegacyClears`), and mark their records' fold states stale.
+     * Idempotent: concurrent first starts write the same bodies.
      */
-    private backfillCollection;
+    private canonicalizeLegacyBodies;
+    private rematerialize;
     private buildSelectQuery;
     private buildWhereClause;
     private deserializeRow;
     private materializeFromOpsLog;
     private initialize;
+    /**
+     * The startup log-integrity scan's result (W8 step 0): rows that could not be read
+     * back into an operation are moved to `operations_quarantine` once per database,
+     * before any fold reads them.
+     */
+    getLogIntegrityReport(): Promise<ServerLogIntegrityReport>;
+    /**
+     * One-time scan under the setup advisory lock (concurrent starts run it once). Keyset
+     * pages by id, so a large log is read in bounded chunks; like the delivery-sequence
+     * backfill it runs on the first start of this release only.
+     */
+    private scanLogIntegrityOnce;
     private ensureTables;
     /**
      * Reserve the next delivery sequence inside an open append transaction. The
@@ -1859,6 +4456,11 @@ declare class PostgresServerStore implements ServerStore {
      * serializing assignment into commit order (see the counter table comment).
      */
     private nextDeliverySeq;
+    /**
+     * @param soleHolder - Nothing else held the (node, sequence) at insert: the row is
+     *   flagged `seq_unique` and covered by {@link NODE_SEQ_UNIQUE_INDEX}. False for a
+     *   legacy pair's second operation and for restored backup rows.
+     */
     private serializeOperation;
     private deserializeOperation;
     private assertOpen;
@@ -1870,8 +4472,14 @@ declare class PostgresServerStore implements ServerStore {
  */
 declare function createPostgresServerStore(options: {
     connectionString: string;
-    nodeId?: string;
-}): Promise<PostgresServerStore>;
+} & ServerIdentityOptions): Promise<PostgresServerStore>;
+/**
+ * The Postgres server store could not start: the database is unreachable, refused the
+ * credentials, or its tables could not be created. `cause` is the driver's error.
+ */
+declare class ServerStoreUnavailableError extends KoraError {
+    constructor(connectionString: string, cause: unknown);
+}
 
 /**
  * SQLite-backed server store using Drizzle ORM.
@@ -1886,46 +4494,207 @@ declare class SqliteServerStore implements ServerStore {
     private readonly db;
     private schema;
     private closed;
-    constructor(db: BetterSQLite3Database, nodeId?: string);
+    /** See {@link SEQUENCE_ENFORCEMENT_EPOCH_KEY}; fixed per database at first start. */
+    private sequenceEpoch;
+    private logIntegrity;
+    /** Derivation secret of server-derived ids, shared by the deployment (RT-64). */
+    private readonly derivationSecret;
+    /** Legacy and configured authorities (the `kora:server:` prefix needs no listing). */
+    private readonly explicitAuthorities;
+    /** Explicit authority over time: revoked and ever-held ids (RT-81). */
+    private readonly authorityHistory;
+    /** Other `kora:server:` nodes with stored operations (advertised for older clients). */
+    /** Records owning quarantined operations: folded onto their kept rows (RT-70). */
+    private quarantine;
+    private foldOptions;
+    /** Schema transforms the fold applies (transforms at fold time, RT-84). */
+    private operationTransforms;
+    private foldMigration;
+    /**
+     * @param db - The Drizzle database
+     * @param nodeId - Deprecated: a plain id is recorded as a legacy authoritative id; a
+     *   `kora:server:` id is used verbatim. Leave unset: the store authors under
+     *   `kora:server:<deployment>:<instance>`, both persisted in the database (RT-62).
+     * @param options - Extra authoritative ids and the instance id
+     */
+    constructor(db: BetterSQLite3Database, nodeId?: string, options?: Omit<ServerIdentityOptions, 'nodeId'>);
+    /**
+     * This store's node id and the legacy and configured ids (explicit authorities).
+     * Other `kora:server:` instances are not listed: the prefix rule makes every one of
+     * them authoritative, and a list that grew by one instance id per start would make
+     * every device re-fold after each deploy (RT-75). Handshakes advertise only the
+     * explicit (non-prefixed) ids.
+     */
+    getAuthoritativeNodeIds(): string[];
+    /** Legacy and configured authorities (beside the `kora:server:` namespace). */
+    getLegacyAuthoritativeNodeIds(): string[];
+    /** Explicit authoritative ids the deployment revoked (RT-81), advertised at handshake. */
+    getRevokedAuthoritativeNodeIds(): string[];
+    /**
+     * Every explicit id the deployment ever held authoritative, revoked ones included
+     * (RT-81): never accepted as a device node id.
+     */
+    getEverAuthoritativeNodeIds(): string[];
+    deriveServerOperationId(parentOpId: string, ruleId: string, targetRecordId: string): Promise<string>;
+    /** Remember another `kora:server:` node that authored stored operations. */
+    /**
+     * Load (creating on first start) the persisted server identity: the deployment id,
+     * the derivation secret, this database's instance id and the legacy authoritative
+     * ids. At the first start of this release, every node id whose operations hold an
+     * authority class in a stored fold state (a server decision folded under an earlier,
+     * per-process server node id) is recorded as a legacy authority, before any re-fold
+     * could drop that class.
+     */
+    private loadIdentity;
+    /** What the last startup re-materialization did (W7 step 7). */
+    getFoldMigrationReport(): FoldMigrationReport;
     getVersionVector(): VersionVector;
     getNodeId(): string;
     getSchema(): SchemaDefinition | null;
-    setSchema(schema: SchemaDefinition): Promise<void>;
-    applyRemoteOperation(op: Operation): Promise<ApplyResult>;
+    setSchema(schema: SchemaDefinition, options?: ServerSchemaOptions): Promise<void>;
+    /**
+     * One-time migration (RT-101): rebuild collection tables that still carry an enum
+     * `CHECK` (or `NOT NULL` on a schema field), in one transaction, keeping rows, indexes
+     * and triggers. Idempotent (a relaxed table is left alone) and resumable (an
+     * interrupted rebuild rolls back and runs again at the next start).
+     */
+    private relaxValueDomainConstraints;
+    /**
+     * Throws {@link OperationTransformCoverageError} when a schema version in the stored
+     * log has no transform path to `version` (RT-103): those operations would fold as
+     * absent, silently erasing them from their records.
+     */
+    private assertTransformCoverage;
+    getOperationTransforms(): readonly OperationTransform[];
+    setOperationTransforms(transforms: readonly OperationTransform[]): Promise<void>;
+    applyRemoteOperation(op: Operation, options?: ApplyRemoteOptions): Promise<ApplyResult>;
+    private applyInTransaction;
     getOperationRange(nodeId: string, fromSeq: number, toSeq: number): Promise<Operation[]>;
     getOperationCount(): Promise<number>;
     getMaxDeliverySequence(): Promise<number>;
     getOperationsAfterDelivery(afterDeliverySequence: number, limit: number): Promise<DeliveredOperation[]>;
+    getOperationScopeSnapshots(operationIds: string[]): Promise<Map<string, OperationScopeSnapshot>>;
+    getRecordLatestTimestamp(collection: string, recordId: string): Promise<HLCTimestamp | null>;
+    getRecordFieldVersions(collection: string, recordId: string): Promise<RecordFieldVersions | null>;
+    getRecordFoldState(collection: string, recordId: string): Promise<FoldState | null>;
+    getRecordOperations(collection: string, recordId: string): Promise<Operation[]>;
+    previewOperation(op: Operation): Promise<MaterializedRecord | null>;
+    recordBlobOwner(hash: string, owner: string): Promise<void>;
+    getBlobOwners(hashes: string[]): Promise<Map<string, string[]>>;
+    claimBlobIfUnowned(hash: string, owner: string): Promise<boolean>;
+    /**
+     * Scope values of a record as stored, for an operation's scope snapshot. With
+     * `includeDeleted` false a soft-deleted row counts as absent (the pre-image of a
+     * write to a deleted record); with true it keeps its last values (a delete's
+     * post-image).
+     */
+    private readScopeValues;
+    /**
+     * Rebuild missing scope snapshots from the log (migration from a database written
+     * before snapshots existed), replaying each affected record in commit order.
+     */
+    private backfillScopeSnapshots;
     materializeCollection(collection: string): Promise<MaterializedRecord[]>;
+    getNodeIdsAfterDelivery(afterDeliverySequence: number): Promise<string[]>;
+    getSequencePairOperations(nodeId: string, throughSequence: number): Promise<Operation[]>;
+    recordOperationResolution(resolution: OperationResolution): Promise<void>;
+    findOperationResolutions(nodeId: string, ids: string[]): Promise<Map<string, OperationResolution>>;
+    deleteOperationResolution(nodeId: string, operationId: string): Promise<void>;
+    getResolvedThrough(nodeId: string): Promise<number>;
+    findStoredOperations(ids: string[]): Promise<Map<string, StoredOperationKey>>;
+    findRecordsByIds(collection: string, ids: string[]): Promise<Map<string, MaterializedRecord>>;
     queryCollection(collection: string, options?: CollectionQueryOptions): Promise<MaterializedRecord[]>;
     findRecord(collection: string, id: string): Promise<MaterializedRecord | null>;
     countCollection(collection: string, where?: Record<string, unknown>): Promise<number>;
     close(): Promise<void>;
+    getEncryptionKeyRecord(owner: string, keyring: string): Promise<string | null>;
+    putEncryptionKeyRecord(owner: string, keyring: string, record: string, revision: number, expectedRevision: number): Promise<boolean>;
+    listEncryptionKeyRecords(owner?: string): Promise<EncryptionKeyRecordRow[]>;
+    getEncryptedKeyIds(nodeOwner: string | null, limit: number): Promise<string[]>;
+    claimNode(nodeId: string, userId: string): Promise<boolean>;
+    claimUnownedNode(nodeId: string, userId: string): Promise<boolean>;
+    getNodeClaimOwner(nodeId: string): Promise<string | null>;
+    replaceNodeClaim(nodeId: string, expectedOwner: string, newOwner: string): Promise<boolean>;
+    releaseNodeClaim(nodeId: string): Promise<boolean>;
+    /**
+     * The record as currently stored, including a soft-deleted one (whose last field
+     * values are kept), or null when it was never written. Without a materialized
+     * table, the last known values are replayed from the operation log.
+     */
+    private readStoredRow;
+    /**
+     * The fold state of a record that owns quarantined operations (RT-70): its stored
+     * state, or its kept row as a snapshot base, with every remaining operation of the
+     * record merged on top (`rebuildFromSnapshot`). Nothing is written.
+     */
+    private rebuildAffected;
     exportBackup(): Promise<Uint8Array>;
     importBackup(data: Uint8Array, merge?: boolean): Promise<{
         operationsRestored: number;
         success: boolean;
     }>;
     /**
-     * Rebuild a single record in the materialized collection table by replaying
-     * all operations for that record. Called within the applyRemoteOperation
-     * transaction for atomic dual-write.
+     * Merge a just-appended operation (stored under `deliverySeq`) into its record's
+     * fold state and project the row, inside the append transaction. O(fields the
+     * operation touches): the stored state is read by primary key and the freshness
+     * check is one index probe, never a scan of the record's history (SRV-7).
+     *
+     * The stored state records the highest delivery sequence it covers. If another
+     * writer appended operations to this record without folding them (an older release
+     * during a rolling upgrade), the missing tail is merged first; if the stored state
+     * is unreadable, newer than the log, or built under an incompatible field kind,
+     * the record is re-folded from its log.
+     */
+    private mergeIntoRecord;
+    /** True when the record's operation at delivery sequence `seq` has id `opId`. */
+    private coversStoredOperation;
+    /**
+     * The record's current fold state for a read: the stored one when it covers the
+     * record's whole log, else folded from the log (nothing is written).
+     */
+    private readFoldState;
+    /** A record's operations stored after `afterDeliverySeq`, in delivery order. */
+    private readRecordOperations;
+    /**
+     * Persist a record's fold state (covering the log up to `coveredSeq`) and project
+     * it onto the materialized row.
      */
-    private rebuildMaterializedRecord;
+    private writeFoldedRecord;
     /**
      * UPSERT a record into the materialized collection table.
      * Uses INSERT ... ON CONFLICT (id) DO UPDATE SET for atomic upsert.
      */
     private upsertMaterializedRecord;
     /**
-     * Backfill all materialized collection tables from the existing operation log.
-     * Called when setSchema() is invoked and operations already exist.
+     * Re-materialization migration (W7 step 7), run by setSchema and after a
+     * replace-mode restore. Every record whose fold state is missing, stale (it covers
+     * less, or more, of the log than is stored) or built under a different fold plan
+     * (field kind, merge strategy, resolver) is re-folded from its log and its row
+     * rewritten; nothing else is touched, so a restart on an up-to-date database does
+     * one aggregate read.
+     *
+     * - Runs only on a log the W8b integrity scan reports clean. With quarantined rows,
+     *   rows materialized before the fold existed are kept as they are (re-folding a
+     *   log that lost operations would bake the loss in) and the skip is logged loudly;
+     *   such a record is folded from its remaining log on its next write. Records with
+     *   no row yet, and fold states this release already wrote, are still processed.
+     * - Idempotent and resumable: each batch commits on its own, and staleness is
+     *   re-derived from the tables at every start, so a crash resumes where it stopped.
+     *   A plan change first marks every stored state stale (one statement), then
+     *   records the new fingerprint, so it is resumable too.
      */
-    private backfillAllCollections;
     /**
-     * Backfill a single collection's materialized table from operations.
+     * One-time migration of each collection table to the lossless text encoding (RT-65):
+     * rows written before it whose raw-string columns contain U+FFFF (the escape
+     * introducer) are re-encoded, so the decoder returns them unchanged.
+     */
+    private migrateTextCodec;
+    /**
+     * Write the beta.12 clears the ids prove into the stored bodies, once per database
+     * (RT-85, see `provenLegacyClears`), and mark their records' fold states stale.
      */
-    private backfillCollection;
+    private canonicalizeLegacyBodies;
+    private rematerialize;
     private buildSelectQuery;
     private buildWhereClause;
     private deserializeRow;
@@ -1934,6 +4703,29 @@ declare class SqliteServerStore implements ServerStore {
      * Create the operations and sync_state tables if they don't exist.
      */
     private ensureTables;
+    /**
+     * The startup log-integrity scan's result (W8 step 0): rows that could not be read
+     * back into an operation are moved to `operations_quarantine` once per database,
+     * before any fold reads them.
+     */
+    getLogIntegrityReport(): ServerLogIntegrityReport;
+    private scanLogIntegrityOnce;
+    /**
+     * Index the legacy pairs already in the log once (history written before the
+     * `sequence_pairs` table existed); appends maintain it from then on.
+     */
+    private backfillSequencePairs;
+    /**
+     * Record the sequence-enforcement epoch on the first start of this release (the log's
+     * highest delivery sequence then; see {@link SEQUENCE_ENFORCEMENT_EPOCH_KEY}) and
+     * back the append check with the partial unique index over sole-holder rows
+     * ({@link NODE_SEQ_UNIQUE_INDEX}), which therefore always exists: a legacy duplicate
+     * pair is stored unflagged. Replaces the earlier indexes (a full one, created only
+     * when the log had no duplicates, and one over the rows past the epoch, which a
+     * legacy client's pair would violate). Runs in one write transaction, so stores
+     * sharing a file agree on the epoch.
+     */
+    private ensureSequenceEnforcement;
     /**
      * Assign delivery sequences to any operations written before the column existed,
      * then seed the durable counter from the current max. Ordered by
@@ -1947,6 +4739,11 @@ declare class SqliteServerStore implements ServerStore {
      * allocation shared by every SqliteServerStore instance using the same file.
      */
     private nextDeliverySeq;
+    /**
+     * @param soleHolder - Nothing else held the (node, sequence) at insert: the row is
+     *   flagged `seq_unique` and covered by {@link NODE_SEQ_UNIQUE_INDEX}. False for a
+     *   legacy pair's second operation and for restored backup rows.
+     */
     private serializeOperation;
     private deserializeOperation;
     private assertOpen;
@@ -1959,7 +4756,9 @@ declare class SqliteServerStore implements ServerStore {
  *
  * @param options - Configuration options
  * @param options.filename - Path to SQLite database file. Defaults to ':memory:' for testing.
- * @param options.nodeId - Server node ID. Auto-generated if not provided.
+ * @param options.nodeId - Deprecated (a plain id becomes a legacy authoritative id). Leave
+ *   unset: the server authors under the persisted `kora:server:<deployment>:<instance>`.
+ * @param options.instanceId - Optional stable instance id
  * @returns A ready-to-use SqliteServerStore
  *
  * @example
@@ -1976,8 +4775,7 @@ declare class SqliteServerStore implements ServerStore {
  */
 declare function createSqliteServerStore(options: {
     filename?: string;
-    nodeId?: string;
-}): SqliteServerStore;
+} & ServerIdentityOptions): SqliteServerStore;
 
 /**
  * Auth provider that accepts all connections.
@@ -1988,38 +4786,187 @@ declare class NoAuthProvider implements AuthProvider {
     authenticate(_token: string): Promise<AuthContext>;
 }
 
+/**
+ * Thrown when a sync scope predicate value is `undefined` or `null` (also inside a
+ * `$in` list). Such a value matches every record that lacks the field, so a grant
+ * built from a failed lookup (for example `{ orgId: user.orgId }` with no org)
+ * would expose every unowned record. Kora refuses it instead (fail closed).
+ */
+declare class InvalidScopePredicateError extends KoraError {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string);
+}
+/** Thrown when a `$in` scope predicate is malformed or larger than the configured limit. */
+declare class ScopePredicateLimitError extends KoraError {
+    constructor(message: string, context: Record<string, unknown>);
+}
+
+interface ResolveSessionScopesOptions {
+    /** Scope map sent by the client during handshake. It can only NARROW the grant. */
+    handshakeScope?: ScopeMap$1;
+    /**
+     * The server grant from the auth provider. Its collection set is authoritative:
+     * a collection it does not list is not visible, whatever the handshake asks for.
+     * It may carry verified claim values under `$claims` (see `claimScopes` in
+     * `@korajs/core`), which are bound to every schema-scoped collection.
+     */
+    authScopes?: ScopeMap$1;
+    /**
+     * Verified, server-derived scope values (for example `{ userId: sub }`). Treated
+     * exactly like `$claims` in `authScopes`. Never pass client-supplied values here.
+     */
+    scopeValues?: Record<string, unknown>;
+    /**
+     * True when an auth provider authenticated this session. An authenticated
+     * session whose provider returned no grant at all is denied every
+     * schema-scoped collection instead of trusting the client handshake.
+     *
+     * Leave it false only for servers without an auth provider (or with
+     * `NoAuthProvider`), where the handshake is a client-side filter, not a grant.
+     * @default false
+     */
+    authenticated?: boolean;
+    /**
+     * What to do when a schema-scoped collection's bindings cannot all be resolved
+     * from the verified claims. `'deny'` hides the collection (fail closed);
+     * `'throw'` raises {@link ScopeRequiredError} so the caller can reject the
+     * handshake with `SCOPE_REQUIRED`.
+     * @default 'deny'
+     */
+    onUnresolved?: 'deny' | 'throw';
+}
+/** A schema-scoped collection the session was denied because a binding was unresolved. */
+interface DeniedScopeCollection {
+    collection: string;
+    /** Scope binding keys (for example `orgId`) that had no verified value. */
+    missingKeys: string[];
+}
+/** Detailed result of {@link resolveSessionScopeGrant}. */
+interface ResolvedSessionScopeGrant {
+    /**
+     * Effective scope map. `undefined` means "no scoping" and is only ever returned
+     * for unauthenticated servers without a grant. An empty object means "nothing
+     * visible".
+     */
+    scopes: ScopeMap$1 | undefined;
+    /** Collections denied because their scope bindings could not be resolved. */
+    denied: DeniedScopeCollection[];
+}
+/**
+ * Thrown (with `onUnresolved: 'throw'`) when an authenticated session cannot be
+ * bound to a schema-scoped collection because the server grant lacks a value.
+ */
+declare class ScopeRequiredError extends KoraError {
+    readonly denied: DeniedScopeCollection[];
+    constructor(denied: DeniedScopeCollection[]);
+}
+/**
+ * Resolve the effective per-session sync scope map.
+ *
+ * The result is the INTERSECTION of the server grant and the client handshake:
+ * - The collection set is the grant's collection set. A handshake can never add
+ *   a collection.
+ * - Per collection, handshake predicates only narrow: grant fields win, a
+ *   handshake field on an unconstrained field is added, and for an `$in` grant a
+ *   handshake value is used only when it is a subset of the granted values.
+ * - Schema-scoped collections bound from verified claims fail closed: an
+ *   unresolved binding denies the collection instead of producing `{}`.
+ *
+ * Invariant: the effective scope is a subset of the server grant, and no
+ * schema-scoped collection resolves to `{}` from claims for an authenticated
+ * principal.
+ *
+ * @returns The effective scope map; `undefined` only for unauthenticated servers
+ *   with neither a grant nor a handshake scope
+ */
+declare function resolveSessionScopes(schema: SchemaDefinition | null, options: ResolveSessionScopesOptions): ScopeMap$1 | undefined;
+/**
+ * Same as {@link resolveSessionScopes}, but also reports which collections were
+ * denied for unresolved bindings, so a caller can surface `SCOPE_REQUIRED`.
+ */
+declare function resolveSessionScopeGrant(schema: SchemaDefinition | null, options: ResolveSessionScopesOptions): ResolvedSessionScopeGrant;
+
+/**
+ * Decides whether one client's current awareness state may reach another session.
+ * Called with the receiving session's id; returning false keeps the state from it.
+ * The sync server builds one per update from the record named in the state's cursor.
+ */
+type AwarenessAudience = (targetSessionId: string) => boolean;
 /**
  * Server-side awareness relay. Broadcasts ephemeral awareness states
  * (cursor positions, user presence) between connected clients.
  *
- * Awareness data is never persisted. The relay simply forwards awareness
- * updates from one client to all other connected clients, and broadcasts
- * removal notifications when a client disconnects.
+ * Awareness data is never persisted. Each session's awareness `clientId` is bound on
+ * registration: a session may only publish (or clear) its own state, never another
+ * client's. A state reaches exactly the sessions its audience admits (the sync server
+ * admits sessions whose download scope contains the record named in the cursor), or,
+ * for an update without an audience, the clients of the same partition.
  */
 declare class AwarenessRelay {
     private readonly clients;
     /**
-     * Register a client for awareness broadcasting.
+     * Register a client for awareness broadcasting. A session registers once; later
+     * calls for an already-registered session are ignored, so a client cannot rebind
+     * itself to another client's id.
+     *
+     * The new client is sent every existing state it may see (catch-up): a state with
+     * an audience when the audience admits the new session, otherwise a state of the
+     * same partition.
      *
      * @param sessionId - Unique session identifier
      * @param clientId - Client-assigned awareness ID
      * @param transport - Transport for sending messages to this client
+     * @param partition - Presence partition for states relayed without an audience
+     */
+    addClient(sessionId: string, clientId: number, transport: ServerTransport, partition?: string): void;
+    /**
+     * True when the session is registered with the relay.
+     *
+     * @param sessionId - Session to check
      */
-    addClient(sessionId: string, clientId: number, transport: ServerTransport): void;
+    hasClient(sessionId: string): boolean;
     /**
-     * Remove a client and broadcast its removal to all remaining clients.
+     * Remove a client and send its removal to every client that was shown its state.
      *
      * @param sessionId - Session ID of the disconnecting client
      */
     removeClient(sessionId: string): void;
     /**
-     * Handle an incoming awareness update from a client.
-     * Stores the state and relays to all other connected clients.
+     * True when {@link handleUpdate} would take this update: the session is registered,
+     * the update is stamped with its bound `clientId` and carries that client's entry.
+     *
+     * @param sessionId - Session ID of the sending client
+     * @param message - The awareness update message
+     */
+    accepts(sessionId: string, message: AwarenessUpdateMessage): boolean;
+    /**
+     * Handle an incoming awareness update from a registered client.
+     *
+     * Only the sender's own entry is accepted: the message must be stamped with the
+     * sender's bound `clientId`, and only `states[clientId]` is stored and relayed.
+     * Entries for other clients are dropped, so a sender cannot overwrite or remove
+     * anyone else's presence.
+     *
+     * The state is sent to every other client the audience admits (without an
+     * audience: every client of the sender's partition). A client that was shown an
+     * earlier state of the sender but is not admitted now receives a removal.
      *
      * @param sessionId - Session ID of the sending client
      * @param message - The awareness update message
+     * @param audience - Who may see this state; omitted means the sender's partition
+     */
+    handleUpdate(sessionId: string, message: AwarenessUpdateMessage, audience?: AwarenessAudience): void;
+    /**
+     * Re-decide who may see a client's current state after the record its cursor names
+     * changed (F16): it moved into or out of a session's grant. Sessions that may no
+     * longer see the state get a removal; sessions that may see it now and were not
+     * shown it get the state. Later catch-ups use the new audience.
+     *
+     * @param sessionId - The client whose audience changed
+     * @param audience - The new audience
      */
-    handleUpdate(sessionId: string, message: AwarenessUpdateMessage): void;
+    updateAudience(sessionId: string, audience: AwarenessAudience): void;
     /**
      * Get the number of registered awareness clients.
      */
@@ -2028,7 +4975,9 @@ declare class AwarenessRelay {
      * Remove all clients and clear all state.
      */
     clear(): void;
-    private broadcastExcept;
+    /** True when `target` may see `source`'s current state. Fails closed. */
+    private mayReceive;
+    private removalMessage;
 }
 
 /**
@@ -2048,4 +4997,4 @@ declare class AwarenessRelay {
  */
 declare function createKoraServer(config: KoraSyncServerConfig): KoraSyncServer;
 
-export { type AuthContext, type AuthProvider, AwarenessRelay, type AwarenessRelayCallback, type ClientMetrics, ClientSession, type ClientSessionOptions, type CollectionQueryOptions, DEFAULT_MAX_SCOPE_PREDICATE_VALUES, type HttpPollResponse, HttpServerTransport, type HttpSyncRequest, type HttpSyncResponse, KoraAuthProvider, type KoraAuthProviderOptions, KoraSyncServer, type KoraSyncServerConfig, type LogEntry, type LogLevel, type Logger, type MaterializedRecord, MemoryServerStore, MixedAuthProvider, type MixedAuthProviderOptions, NoAuthProvider, type OperationDecision, type OperationRejection, type OperationValidationContext, type OperationValidator, PostgresServerStore, type ProductionHttpRoute, type ProductionHttpRouteContext, type ProductionHttpRouteRequest, type ProductionHttpRouteResponse, type ProductionServer, type ProductionServerConfig, RETRIABLE_REJECTION_CODES, type RelayCallback, type RouteApplyResult, type RouteConditionalApply, type RouteConditionalResult, type RouteMutation, type RoutePredicate, type RoutePredicateOperators, type RouteScopeOptions, ServerCloseHandler, ServerErrorHandler, ServerMessageHandler, ServerMetricsCollector, type ServerMetricsSnapshot, type ServerStatus, type ServerStore, ServerTransport, type SessionState, SqliteServerStore, TokenAuthProvider, type TokenAuthProviderOptions, type WsServerConstructor, type WsServerLike, WsServerTransport, type WsServerTransportOptions, type WsWebSocket, createDefaultLogger, createJsonLogger, createKoraServer, createPostgresServerStore, createPrettyLogger, createProductionServer, createSilentLogger, createSqliteServerStore, isRetriableRejection, normalizeScopeMap, operationMatchesScopes };
+export { type ApplyRemoteOptions, type AuthContext, type AuthProvider, type AwarenessAudience, type AwarenessCursorTarget, AwarenessRelay, type AwarenessRelayCallback, type ClientMetrics, ClientSession, type ClientSessionOptions, type CollectionQueryOptions, DEFAULT_MAX_SCOPE_PREDICATE_VALUES, type DeniedScopeCollection, type FindJsonStringValuesOptions, type FoldMigrationReport, type HttpPollResponse, HttpServerTransport, type HttpSyncRequest, type HttpSyncResponse, InvalidDiagnosticOptionsError, InvalidScopePredicateError, type JsonStringValueReport, KoraAuthProvider, type KoraAuthProviderOptions, KoraSyncServer, type KoraSyncServerConfig, type LogEntry, type LogLevel, type Logger, type MaterializedRecord, MemoryServerStore, type MemoryServerStoreOptions, MixedAuthProvider, type MixedAuthProviderOptions, NoAuthProvider, type OperationDecision, type OperationRejection, type OperationValidationContext, type OperationValidator, PostgresServerStore, type ProductionHttpRoute, type ProductionHttpRouteContext, type ProductionHttpRouteRequest, type ProductionHttpRouteResponse, type ProductionServer, type ProductionServerConfig, RETRIABLE_REJECTION_CODES, type RelayCallback, type ResolveSessionScopesOptions, type ResolvedSessionScopeGrant, type RouteApplyResult, type RouteConditionalApply, type RouteConditionalResult, type RouteMutation, type RoutePredicate, type RoutePredicateOperators, type RouteScopeOptions, SERVER_NODE_PREFIX, ScopePredicateLimitError, ScopeRequiredError, ServerCloseHandler, ServerErrorHandler, ServerIdentityError, type ServerIdentityOptions, ServerMessageHandler, ServerMetricsCollector, type ServerMetricsSnapshot, type ServerSchemaOptions, type ServerStatus, type ServerStore, ServerStoreUnavailableError, ServerTransport, type SessionRevocation, type SessionState, type SessionTerminationCode, SqliteServerStore, type StoredOperationKey, type TerminateSessionsFilter, TokenAuthProvider, type TokenAuthProviderOptions, type TrustProxySetting, type UplinkAuthorizationCode, UplinkAuthorizationError, type UplinkAuthorizationResult, type WsServerConstructor, type WsServerLike, WsServerTransport, type WsServerTransportOptions, type WsWebSocket, authorizeUplinkWrite, createDefaultLogger, createJsonLogger, createKoraServer, createPostgresServerStore, createPrettyLogger, createProductionServer, createSilentLogger, createSqliteServerStore, findJsonStringValues, isRetriableRejection, isServerNodeId, normalizeScopeMap, operationMatchesScopes, resolveSessionScopeGrant, resolveSessionScopes };