@korajs/server 1.0.0-beta.13 → 1.0.0-beta.14

package/dist/index.cjs

@@ -71,14 +71,14 @@ function reportLegacyPair(op, decision, options) {
     legacyWriter: decision.legacyWriter
   });
 }
-var import_core6, SEQUENCE_CONFLICT_CODE, SequenceConflictError, UNSTORABLE_VALUE_CODE, UnstorableValueError, SEQUENCE_ENFORCEMENT_EPOCH_KEY, SEQUENCE_PAIRS_BACKFILLED_KEY, NODE_SEQ_UNIQUE_INDEX, SUPERSEDED_NODE_SEQ_UNIQUE_INDEXES, MAX_RESOLUTION_MESSAGE_LENGTH, RELEASED_NODE_OWNER, MAX_SCOPE_SNAPSHOT_STRING_LENGTH;
+var import_core7, SEQUENCE_CONFLICT_CODE, SequenceConflictError, UNSTORABLE_VALUE_CODE, UnstorableValueError, SEQUENCE_ENFORCEMENT_EPOCH_KEY, SEQUENCE_PAIRS_BACKFILLED_KEY, NODE_SEQ_UNIQUE_INDEX, SUPERSEDED_NODE_SEQ_UNIQUE_INDEXES, MAX_RESOLUTION_MESSAGE_LENGTH, RELEASED_NODE_OWNER, MAX_SCOPE_SNAPSHOT_STRING_LENGTH;
 var init_server_store = __esm({
   "src/store/server-store.ts"() {
     "use strict";
     init_cjs_shims();
-    import_core6 = require("@korajs/core");
+    import_core7 = require("@korajs/core");
     SEQUENCE_CONFLICT_CODE = "SEQUENCE_CONFLICT";
-    SequenceConflictError = class extends import_core6.KoraError {
+    SequenceConflictError = class extends import_core7.KoraError {
       constructor(operation, existingOperationId) {
         super(
           `Operation "${operation.id}" claims sequence ${String(operation.sequenceNumber)} of node "${operation.nodeId}", which operation "${existingOperationId}" already holds. A node may never reuse a sequence number for different content.`,
@@ -98,7 +98,7 @@ var init_server_store = __esm({
       existingOperationId;
     };
     UNSTORABLE_VALUE_CODE = "UNSTORABLE_VALUE";
-    UnstorableValueError = class extends import_core6.KoraError {
+    UnstorableValueError = class extends import_core7.KoraError {
       constructor(operation, detail) {
         super(
           `Operation "${operation.id}" on ${operation.collection}/${operation.recordId} holds a value this server's database cannot store (${detail}). It is refused; nothing was written.`,
@@ -129,17 +129,17 @@ function isOperationTimestampValid(op, now = Date.now()) {
   if (!Number.isInteger(wallTime) || wallTime < 0) {
     return false;
   }
-  if (!Number.isInteger(logical) || logical < 0 || logical > import_core7.MAX_LOGICAL) {
+  if (!Number.isInteger(logical) || logical < 0 || logical > import_core8.MAX_LOGICAL) {
     return false;
   }
   return wallTime <= now + SERVER_MAX_TIMESTAMP_FUTURE_MS;
 }
-var import_core7, SERVER_MAX_TIMESTAMP_FUTURE_MS;
+var import_core8, SERVER_MAX_TIMESTAMP_FUTURE_MS;
 var init_operation_validation = __esm({
   "src/session/operation-validation.ts"() {
     "use strict";
     init_cjs_shims();
-    import_core7 = require("@korajs/core");
+    import_core8 = require("@korajs/core");
     SERVER_MAX_TIMESTAMP_FUTURE_MS = 6e4;
   }
 });
@@ -191,19 +191,19 @@ function assertBackupOperationsIngestible(operations2, now = Date.now()) {
   }
   if (invalid.length > 0) throw new BackupValidationError(invalid, operations2.length);
 }
-var import_core8, INVALID_TIMESTAMP_CODE, INVALID_SEQUENCE_NUMBER_CODE, INVALID_IDENTIFIER_CODE, UNSTORABLE_IDENTIFIER, BackupValidationError;
+var import_core9, INVALID_TIMESTAMP_CODE, INVALID_SEQUENCE_NUMBER_CODE, INVALID_IDENTIFIER_CODE, UNSTORABLE_IDENTIFIER, BackupValidationError;
 var init_ingest_validation = __esm({
   "src/apply/ingest-validation.ts"() {
     "use strict";
     init_cjs_shims();
-    import_core8 = require("@korajs/core");
+    import_core9 = require("@korajs/core");
     init_operation_validation();
     INVALID_TIMESTAMP_CODE = "INVALID_TIMESTAMP";
     INVALID_SEQUENCE_NUMBER_CODE = "INVALID_SEQUENCE_NUMBER";
     INVALID_IDENTIFIER_CODE = "INVALID_IDENTIFIER";
     UNSTORABLE_IDENTIFIER = // biome-ignore lint/suspicious/noControlCharactersInRegex: U+0000 is exactly what identifiers may not hold (RT-65)
     /\u0000|[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
-    BackupValidationError = class extends import_core8.KoraError {
+    BackupValidationError = class extends import_core9.KoraError {
       constructor(invalidOperations, totalOperations) {
         super(
           `Backup rejected: ${String(invalidOperations.length)} of ${String(totalOperations)} operations failed ingest validation (first: "${invalidOperations[0]?.operationId ?? ""}", ${invalidOperations[0]?.code ?? ""}). A far-future timestamp usually means the exporting server's clock was wrong; fix the clock and re-export, or repair the operations before restoring.`,
@@ -350,7 +350,7 @@ function parseServerBackup(data) {
 function parseKeyRecords(value) {
   if (value === null || value === void 0) return [];
   const refuse = (reason) => {
-    throw new import_core9.KoraError(
+    throw new import_core10.KoraError(
       `Backup rejected: its encryption key records are malformed (${reason}).`,
       "BACKUP_INVALID_KEY_RECORD",
       { reason }
@@ -464,12 +464,12 @@ async function mergeBackupOperations(operations2, apply) {
   }
   return { operationsRestored: restored, success: conflicts.length === 0 };
 }
-var import_core9, import_sync, BACKUP_VERSION, KEY_RESTORE_ATTEMPTS;
+var import_core10, import_sync, BACKUP_VERSION, KEY_RESTORE_ATTEMPTS;
 var init_server_backup = __esm({
   "src/store/server-backup.ts"() {
     "use strict";
     init_cjs_shims();
-    import_core9 = require("@korajs/core");
+    import_core10 = require("@korajs/core");
     import_sync = require("@korajs/sync");
     init_ingest_validation();
     init_server_store();
@@ -485,6 +485,7 @@ __export(index_exports, {
   ClientSession: () => ClientSession,
   DEFAULT_MAX_SCOPE_PREDICATE_VALUES: () => DEFAULT_MAX_SCOPE_PREDICATE_VALUES,
   HttpServerTransport: () => HttpServerTransport,
+  InvalidDiagnosticOptionsError: () => InvalidDiagnosticOptionsError,
   InvalidScopePredicateError: () => InvalidScopePredicateError,
   KoraAuthProvider: () => KoraAuthProvider,
   KoraSyncServer: () => KoraSyncServer,
@@ -493,7 +494,7 @@ __export(index_exports, {
   NoAuthProvider: () => NoAuthProvider,
   PostgresServerStore: () => PostgresServerStore,
   RETRIABLE_REJECTION_CODES: () => RETRIABLE_REJECTION_CODES,
-  SCOPE_CLAIMS_KEY: () => import_core37.SCOPE_CLAIMS_KEY,
+  SCOPE_CLAIMS_KEY: () => import_core38.SCOPE_CLAIMS_KEY,
   SERVER_NODE_PREFIX: () => SERVER_NODE_PREFIX,
   ScopePredicateLimitError: () => ScopePredicateLimitError,
   ScopeRequiredError: () => ScopeRequiredError,
@@ -504,7 +505,7 @@ __export(index_exports, {
   UplinkAuthorizationError: () => UplinkAuthorizationError,
   WsServerTransport: () => WsServerTransport,
   authorizeUplinkWrite: () => authorizeUplinkWrite,
-  claimScopes: () => import_core37.claimScopes,
+  claimScopes: () => import_core38.claimScopes,
   createDefaultLogger: () => createDefaultLogger,
   createJsonLogger: () => createJsonLogger,
   createKoraServer: () => createKoraServer,
@@ -513,6 +514,7 @@ __export(index_exports, {
   createProductionServer: () => createProductionServer,
   createSilentLogger: () => createSilentLogger,
   createSqliteServerStore: () => createSqliteServerStore,
+  findJsonStringValues: () => findJsonStringValues,
   isRetriableRejection: () => isRetriableRejection,
   isServerNodeId: () => isServerNodeId,
   normalizeScopeMap: () => normalizeScopeMap,
@@ -523,6 +525,72 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 init_cjs_shims();
 
+// src/diagnostics/json-string-values.ts
+init_cjs_shims();
+var import_core = require("@korajs/core");
+var InvalidDiagnosticOptionsError = class extends import_core.KoraError {
+  constructor(option, value) {
+    super(
+      `findJsonStringValues: ${option} must be a ${option === "pageSize" ? "positive" : "non-negative"} integer, got ${String(value)}.`,
+      "INVALID_DIAGNOSTIC_OPTIONS",
+      { option, value }
+    );
+    this.name = "InvalidDiagnosticOptionsError";
+  }
+};
+async function findJsonStringValues(store, options = {}) {
+  const schema = store.getSchema();
+  if (!schema) return [];
+  const sampleSize = options.sampleSize ?? 10;
+  const pageSize = options.pageSize ?? 1e3;
+  if (!Number.isInteger(pageSize) || pageSize < 1) {
+    throw new InvalidDiagnosticOptionsError("pageSize", pageSize);
+  }
+  if (!Number.isInteger(sampleSize) || sampleSize < 0) {
+    throw new InvalidDiagnosticOptionsError("sampleSize", sampleSize);
+  }
+  const reports = [];
+  for (const [collection, definition] of Object.entries(schema.collections)) {
+    const fields = Object.entries(definition.fields).filter(([, descriptor]) => descriptor.kind === "json" || descriptor.kind === "object").map(([name]) => name);
+    if (fields.length === 0) continue;
+    const found = /* @__PURE__ */ new Map();
+    for (let offset = 0; ; offset += pageSize) {
+      const rows = await store.queryCollection(collection, {
+        orderBy: "id",
+        limit: pageSize,
+        offset
+      });
+      for (const row of rows) {
+        for (const field of fields) {
+          if (!isEncodedJson(row[field])) continue;
+          let report = found.get(field);
+          if (!report) {
+            report = { collection, field, count: 0, sampleIds: [] };
+            found.set(field, report);
+          }
+          report.count += 1;
+          if (report.sampleIds.length < sampleSize) report.sampleIds.push(String(row.id));
+        }
+      }
+      if (rows.length < pageSize) break;
+    }
+    reports.push(...found.values());
+  }
+  return reports;
+}
+function isEncodedJson(value) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  const first = trimmed[0];
+  if (first !== "{" && first !== "[" && first !== '"') return false;
+  try {
+    JSON.parse(trimmed);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/logging/structured-logger.ts
 init_cjs_shims();
 function defaultJsonSerializer(entry) {
@@ -589,17 +657,17 @@ function isRetriableRejection(code) {
 
 // src/store/memory-server-store.ts
 init_cjs_shims();
-var import_core10 = require("@korajs/core");
+var import_core11 = require("@korajs/core");
 
 // src/scopes/server-scope-filter.ts
 init_cjs_shims();
-var import_core2 = require("@korajs/core");
+var import_core3 = require("@korajs/core");
 var import_internal = require("@korajs/sync/internal");
 
 // src/scopes/scope-predicate-errors.ts
 init_cjs_shims();
-var import_core = require("@korajs/core");
-var InvalidScopePredicateError = class extends import_core.KoraError {
+var import_core2 = require("@korajs/core");
+var InvalidScopePredicateError = class extends import_core2.KoraError {
   constructor(collection, field) {
     super(
       `Sync scope predicate for "${collection}.${field}" is undefined or null. A missing value would match every record without "${field}", so the grant is refused.`,
@@ -617,7 +685,7 @@ var InvalidScopePredicateError = class extends import_core.KoraError {
   collection;
   field;
 };
-var ScopePredicateLimitError = class extends import_core.KoraError {
+var ScopePredicateLimitError = class extends import_core2.KoraError {
   constructor(message, context) {
     super(message, "SCOPE_PREDICATE_LIMIT", context);
     this.name = "ScopePredicateLimitError";
@@ -656,14 +724,18 @@ function normalizeScopeMap(scopes, maxValues = DEFAULT_MAX_SCOPE_PREDICATE_VALUE
             collection,
             field
           });
-        const unique = [...new Map(values.map((value) => [stableValueKey(value), value])).values()];
+        const unique = [...new Map(values.map((value) => [stableValueKey(value), value])).entries()];
         if (unique.length > maxValues)
           throw new ScopePredicateLimitError(
             `Scope predicate for ${collection}.${field} exceeds the ${maxValues}-value limit`,
             { collection, field, maxValues }
           );
         predicate[field] = {
-          $in: unique.sort((a, b) => stableValueKey(a).localeCompare(stableValueKey(b)))
+          // Frozen: matchers may cache a set of a large list (F17), which is only
+          // sound for a list that cannot change.
+          $in: Object.freeze(
+            unique.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, value]) => value)
+          )
         };
       } else predicate[field] = expected;
     }
@@ -734,7 +806,7 @@ function missingScopeFields(op, scopes) {
   const snapshot = (0, import_internal.buildScopeSnapshot)(op);
   return Object.keys(collectionScope).filter((field) => !(field in snapshot));
 }
-var UplinkAuthorizationError = class extends import_core2.KoraError {
+var UplinkAuthorizationError = class extends import_core3.KoraError {
   constructor(rejectionCode, message, context) {
     super(message, rejectionCode, context);
     this.rejectionCode = rejectionCode;
@@ -816,7 +888,7 @@ function authorizeRecordWrite(collection, recordId, storedRow, scopes) {
 
 // src/store/materialization.ts
 init_cjs_shims();
-var import_core3 = require("@korajs/core");
+var import_core4 = require("@korajs/core");
 var import_internal2 = require("@korajs/core/internal");
 function fieldTypeToSql(descriptor, dialect) {
   switch (descriptor.kind) {
@@ -849,7 +921,7 @@ function generateCollectionDDL(name, collection, dialect) {
   const columns = ["id TEXT PRIMARY KEY NOT NULL"];
   for (const [fieldName, descriptor] of Object.entries(collection.fields)) {
     const sqlType = fieldTypeToSql(descriptor, dialect);
-    let colDef = `${(0, import_core3.quoteIdent)(fieldName)} ${sqlType}`;
+    let colDef = `${(0, import_core4.quoteIdent)(fieldName)} ${sqlType}`;
     if (descriptor.defaultValue !== void 0) {
       colDef += ` DEFAULT ${(0, import_internal2.sqlDefaultLiteral)(descriptor.defaultValue)}`;
     }
@@ -859,25 +931,25 @@ function generateCollectionDDL(name, collection, dialect) {
   columns.push(`_created_at ${tsType} NOT NULL DEFAULT 0`);
   columns.push(`_updated_at ${tsType} NOT NULL DEFAULT 0`);
   columns.push("_deleted INTEGER NOT NULL DEFAULT 0");
-  statements.push(`CREATE TABLE IF NOT EXISTS ${(0, import_core3.quoteIdent)(name)} (
+  statements.push(`CREATE TABLE IF NOT EXISTS ${(0, import_core4.quoteIdent)(name)} (
   ${columns.join(",\n  ")}
 )`);
   for (const [fieldName, descriptor] of Object.entries(collection.fields)) {
     const sqlType = fieldTypeToSql(descriptor, dialect);
-    let colDef = `${(0, import_core3.quoteIdent)(fieldName)} ${sqlType}`;
+    let colDef = `${(0, import_core4.quoteIdent)(fieldName)} ${sqlType}`;
     if (descriptor.defaultValue !== void 0) {
       colDef += ` DEFAULT ${(0, import_internal2.sqlDefaultLiteral)(descriptor.defaultValue)}`;
     }
     statements.push(`--kora:safe-alter
-ALTER TABLE ${(0, import_core3.quoteIdent)(name)} ADD COLUMN ${colDef}`);
+ALTER TABLE ${(0, import_core4.quoteIdent)(name)} ADD COLUMN ${colDef}`);
   }
   for (const indexField of collection.indexes) {
     statements.push(
-      `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${(0, import_core3.quoteIdent)(name)} (${(0, import_core3.quoteIdent)(indexField)})`
+      `CREATE INDEX IF NOT EXISTS idx_${name}_${indexField} ON ${(0, import_core4.quoteIdent)(name)} (${(0, import_core4.quoteIdent)(indexField)})`
     );
   }
   statements.push(
-    `CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${(0, import_core3.quoteIdent)(name)} (_deleted)`
+    `CREATE INDEX IF NOT EXISTS idx_${name}__deleted ON ${(0, import_core4.quoteIdent)(name)} (_deleted)`
   );
   return statements;
 }
@@ -901,7 +973,7 @@ function base64ToBytes(base64) {
   for (const char of cleaned) {
     const value = BASE64_REVERSE.get(char);
     if (value === void 0) {
-      throw new import_core3.StorageError(`Invalid base64 character "${char}" in tagged richtext value`, {
+      throw new import_core4.StorageError(`Invalid base64 character "${char}" in tagged richtext value`, {
         char
       });
     }
@@ -996,12 +1068,12 @@ function validateFieldName(collectionName, fieldName, schema) {
 
 // src/store/record-fold.ts
 init_cjs_shims();
-var import_core5 = require("@korajs/core");
+var import_core6 = require("@korajs/core");
 var import_merge = require("@korajs/merge");
 
 // src/store/server-identity.ts
 init_cjs_shims();
-var import_core4 = require("@korajs/core");
+var import_core5 = require("@korajs/core");
 var SERVER_NODE_PREFIX = "kora:server:";
 var RESERVED_NODE_PREFIX = "kora:";
 var SERVER_DEPLOYMENT_ID_KEY = "server_deployment_id";
@@ -1014,7 +1086,7 @@ var SERVER_REVOKED_AUTHORITY_KEY = "server_revoked_authoritative_node_ids";
 var SERVER_LEGACY_SCAN_KEY = "server_legacy_authority_scan_v1";
 var INSTANCE_ID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
 var SERVER_DERIVED_DOMAIN = "kora/server-derived/v1";
-var ServerIdentityError = class extends import_core4.KoraError {
+var ServerIdentityError = class extends import_core5.KoraError {
   constructor(message, context) {
     super(message, "INVALID_SERVER_IDENTITY", context);
     this.name = "ServerIdentityError";
@@ -1120,7 +1192,7 @@ function isServerNodeId(nodeId) {
   return nodeId.startsWith(SERVER_NODE_PREFIX);
 }
 function generateDeploymentId() {
-  return (0, import_core4.generateUUIDv7)();
+  return (0, import_core5.generateUUIDv7)();
 }
 function generateDerivationSecret() {
   const bytes = new Uint8Array(32);
@@ -1280,19 +1352,19 @@ function serverFoldOptions(explicitAuthorities, transforms = []) {
 function serverOperationView(store, op) {
   const schema = store.getSchema();
   if (schema === null) return op;
-  return (0, import_core5.operationSchemaView)(op, schema.version, store.getOperationTransforms?.());
+  return (0, import_core6.operationSchemaView)(op, schema.version, store.getOperationTransforms?.());
 }
 function serverFoldPlanFingerprint(schema, explicitAuthorities, transforms = []) {
   const explicit = normalizeLegacyAuthorities(explicitAuthorities);
-  return `${(0, import_core5.foldPlanFingerprint)(schema, transforms)}|auth:${SERVER_NODE_PREFIX}*${explicit.length > 0 ? `,${explicit.join(",")}` : ""}`;
+  return `${(0, import_core6.foldPlanFingerprint)(schema, transforms)}|auth:${SERVER_NODE_PREFIX}*${explicit.length > 0 ? `,${explicit.join(",")}` : ""}`;
 }
 function parseStoredFoldState(json, collection, recordId) {
   if (typeof json !== "string" || json.length === 0) return null;
   try {
-    const state = (0, import_core5.deserializeFoldState)(json);
+    const state = (0, import_core6.deserializeFoldState)(json);
     return state.c === collection && state.r === recordId ? state : null;
   } catch (error) {
-    if (error instanceof import_core5.FoldStateError) return null;
+    if (error instanceof import_core6.FoldStateError) return null;
     throw error;
   }
 }
@@ -1301,23 +1373,23 @@ function mergeIntoFoldState(state, ops, schema, options) {
   const first = ops[0];
   if (first === void 0) return state;
   try {
-    let next = state ?? (0, import_core5.createFoldState)(first.collection, first.recordId);
-    for (const op of ops) next = (0, import_core5.mergeOp)(next, op, schema, options).state;
+    let next = state ?? (0, import_core6.createFoldState)(first.collection, first.recordId);
+    for (const op of ops) next = (0, import_core6.mergeOp)(next, op, schema, options).state;
     return next;
   } catch (error) {
-    if (error instanceof import_core5.FoldStateError) return REFOLD_REQUIRED;
+    if (error instanceof import_core6.FoldStateError) return REFOLD_REQUIRED;
     throw error;
   }
 }
 function refoldRecord(ops, schema, options) {
-  return (0, import_core5.foldRecord)(ops, schema, options).state;
+  return (0, import_core6.foldRecord)(ops, schema, options).state;
 }
 function projectFoldState(state, options) {
   if (state.cr === null) return null;
-  const live = (0, import_core5.isFoldStateLive)(state);
-  const values = (0, import_core5.materialize)(live ? state : { ...state, d: null }, options) ?? {};
-  const createdAt = import_core5.HybridLogicalClock.deserialize(state.cr.t).wallTime;
-  const updatedAt = state.u ? import_core5.HybridLogicalClock.deserialize(state.u.t).wallTime : createdAt;
+  const live = (0, import_core6.isFoldStateLive)(state);
+  const values = (0, import_core6.materialize)(live ? state : { ...state, d: null }, options) ?? {};
+  const createdAt = import_core6.HybridLogicalClock.deserialize(state.cr.t).wallTime;
+  const updatedAt = state.u ? import_core6.HybridLogicalClock.deserialize(state.u.t).wallTime : createdAt;
   return { values, createdAt, updatedAt, deleted: !live };
 }
 function materializedFieldValue(values, field, descriptor) {
@@ -1326,7 +1398,7 @@ function materializedFieldValue(values, field, descriptor) {
 }
 function foldFieldVersions(state) {
   if (!state) return null;
-  return (0, import_core5.getFoldFieldVersions)(state);
+  return (0, import_core6.getFoldFieldVersions)(state);
 }
 function filterFoldStateFields(state, fields) {
   const keep = new Set(fields);
@@ -1337,7 +1409,7 @@ function filterFoldStateFields(state, fields) {
   return { ...state, f: filtered };
 }
 function serializeServerFoldState(state) {
-  return (0, import_core5.serializeFoldState)(state);
+  return (0, import_core6.serializeFoldState)(state);
 }
 
 // src/store/scope-snapshot.ts
@@ -1516,7 +1588,7 @@ var MemoryServerStore = class {
   }
   async setSchema(schema, options = {}) {
     this.assertOpen();
-    (0, import_core10.assertOperationTransformCoverage)(
+    (0, import_core11.assertOperationTransformCoverage)(
       this.operations.map((op) => op.schemaVersion),
       schema.version,
       options.operationTransforms ?? this.operationTransforms,
@@ -1546,7 +1618,7 @@ var MemoryServerStore = class {
   async setOperationTransforms(transforms) {
     this.assertOpen();
     if (this.schema) {
-      (0, import_core10.assertOperationTransformCoverage)(
+      (0, import_core11.assertOperationTransformCoverage)(
         this.operations.map((op) => op.schemaVersion),
         this.schema.version,
         transforms,
@@ -1684,7 +1756,7 @@ var MemoryServerStore = class {
     this.assertOpen();
     let latest = null;
     for (const op of this.recordOps.get(recordKey(collection, recordId)) ?? []) {
-      if (latest === null || import_core10.HybridLogicalClock.compare(op.timestamp, latest) > 0) {
+      if (latest === null || import_core11.HybridLogicalClock.compare(op.timestamp, latest) > 0) {
         latest = op.timestamp;
       }
     }
@@ -1999,6 +2071,16 @@ var MemoryServerStore = class {
     }
     return owner === userId;
   }
+  async claimUnownedNode(nodeId, userId) {
+    this.assertOpen();
+    if (userId === RELEASED_NODE_OWNER) return false;
+    const owner = this.nodeOwners.get(nodeId);
+    if (owner === void 0 || owner === RELEASED_NODE_OWNER) {
+      this.nodeOwners.set(nodeId, userId);
+      return true;
+    }
+    return owner === userId;
+  }
   async getNodeClaimOwner(nodeId) {
     this.assertOpen();
     return this.nodeOwners.get(nodeId) ?? null;
@@ -2218,7 +2300,7 @@ function keyRecordKey(owner, keyring) {
 
 // src/store/postgres-server-store.ts
 init_cjs_shims();
-var import_core14 = require("@korajs/core");
+var import_core15 = require("@korajs/core");
 var import_internal3 = require("@korajs/core/internal");
 var import_drizzle_orm = require("drizzle-orm");
 
@@ -2309,14 +2391,14 @@ var KEY_ID_SAMPLE_ROWS = 512;
 
 // src/store/legacy-bodies.ts
 init_cjs_shims();
-var import_core11 = require("@korajs/core");
+var import_core12 = require("@korajs/core");
 var LEGACY_BODIES_META_KEY = "legacy_bodies_canonical";
 async function provenLegacyClears(stored) {
   const changed = [];
   for (const op of stored) {
     if (op.type !== "update" || op.hashVersion !== void 0 || op.encrypted !== void 0) continue;
-    if ((0, import_core11.canonicalizeLegacyOperation)(op) === op) continue;
-    const canonical = await (0, import_core11.canonicalizeProvenLegacyClear)(op);
+    if ((0, import_core12.canonicalizeLegacyOperation)(op) === op) continue;
+    const canonical = await (0, import_core12.canonicalizeProvenLegacyClear)(op);
     if (canonical !== op) changed.push(canonical);
   }
   return changed;
@@ -2401,7 +2483,7 @@ function isJsonStringArray(value) {
 
 // src/store/quarantine-base.ts
 init_cjs_shims();
-var import_core12 = require("@korajs/core");
+var import_core13 = require("@korajs/core");
 function quarantineKey(collection, recordId) {
   return JSON.stringify([collection, recordId]);
 }
@@ -2442,7 +2524,7 @@ function buildQuarantineScope(rowJsons) {
         nodeId: typeof row.timestamp_node_id === "string" ? row.timestamp_node_id : ""
       };
       const prior = scope.latest.get(key);
-      if (!prior || import_core12.HybridLogicalClock.compare(ts, prior) > 0) scope.latest.set(key, ts);
+      if (!prior || import_core13.HybridLogicalClock.compare(ts, prior) > 0) scope.latest.set(key, ts);
     }
   }
   return scope;
@@ -2454,12 +2536,12 @@ function rebuildFromSnapshot(input, schema, options) {
   }
   if (!input.row) return input.ops.length > 0 ? refoldRecord(input.ops, schema, options) : null;
   const fromLog = input.ops.length > 0 ? refoldRecord(input.ops, schema, options) : null;
-  const versions = fromLog ? (0, import_core12.getFoldFieldVersions)(fromLog) : null;
+  const versions = fromLog ? (0, import_core13.getFoldFieldVersions)(fromLog) : null;
   const floor = input.quarantinedLatest;
   const atLeast = (ts) => {
     if (!ts) return floor;
     if (!floor) return ts;
-    return import_core12.HybridLogicalClock.compare(ts, floor) >= 0 ? ts : floor;
+    return import_core13.HybridLogicalClock.compare(ts, floor) >= 0 ? ts : floor;
   };
   const rowWall = (wall) => ({ wallTime: wall, logical: 0, nodeId: "" });
   const latest = atLeast(versions?.latest) ?? rowWall(Math.max(input.row.updatedAt, input.row.createdAt));
@@ -2467,7 +2549,7 @@ function rebuildFromSnapshot(input, schema, options) {
   for (const field of Object.keys(input.row.values)) {
     fieldVersions[field] = atLeast(versions?.fields[field]) ?? latest;
   }
-  const base = (0, import_core12.createSnapshotState)(
+  const base = (0, import_core13.createSnapshotState)(
     {
       collection: input.collection,
       recordId: input.recordId,
@@ -2488,12 +2570,12 @@ init_server_store();
 
 // src/store/text-codec.ts
 init_cjs_shims();
-var import_core13 = require("@korajs/core");
+var import_core14 = require("@korajs/core");
 var PG_TEXT_CODEC_MIGRATION_KEY = "pg_text_codec_v1:";
-var encodePgText = import_core13.encodeStoredText;
-var decodePgText = import_core13.decodeStoredText;
-var encodePgJsonValue = import_core13.encodeStoredJsonValue;
-var decodePgJsonValue = import_core13.decodeStoredJsonValue;
+var encodePgText = import_core14.encodeStoredText;
+var decodePgText = import_core14.decodeStoredText;
+var encodePgJsonValue = import_core14.encodeStoredJsonValue;
+var decodePgJsonValue = import_core14.decodeStoredJsonValue;
 function pgTextCodecMigrationSql(table, textColumns, jsonbColumns) {
   const esc = "U&'\\FFFF'";
   const statements = [];
@@ -2856,14 +2938,14 @@ var PostgresServerStore = class {
    * log has no transform path to `version` (RT-103): those operations would fold as
    * absent, silently erasing them from their records.
    */
-  async assertTransformCoverage(version, transforms) {
+  async assertTransformCoverage(version2, transforms) {
     if (transforms.length === 0) return;
     const rows = await this.db.execute(
       import_drizzle_orm.sql`SELECT DISTINCT schema_version AS v FROM operations`
     );
-    (0, import_core14.assertOperationTransformCoverage)(
+    (0, import_core15.assertOperationTransformCoverage)(
       rows.map((row) => Number(row.v)),
-      version,
+      version2,
       transforms,
       "Postgres server store"
     );
@@ -2945,9 +3027,9 @@ var PostgresServerStore = class {
         if (done.length > 0) return;
         const fields = Object.entries(collection.fields);
         const statements = pgTextCodecMigrationSql(
-          (0, import_core14.quoteIdent)(name),
-          fields.filter(([, d]) => isPgRawTextKind(d.kind)).map(([f]) => (0, import_core14.quoteIdent)(f)),
-          fields.filter(([, d]) => isPgJsonbKind(d.kind)).map(([f]) => (0, import_core14.quoteIdent)(f))
+          (0, import_core15.quoteIdent)(name),
+          fields.filter(([, d]) => isPgRawTextKind(d.kind)).map(([f]) => (0, import_core15.quoteIdent)(f)),
+          fields.filter(([, d]) => isPgJsonbKind(d.kind)).map(([f]) => (0, import_core15.quoteIdent)(f))
         );
         for (const statement of statements) await tx.execute(import_drizzle_orm.sql.raw(statement));
         await tx.execute(
@@ -3094,20 +3176,20 @@ var PostgresServerStore = class {
       await tx.execute(import_drizzle_orm.sql`SELECT value FROM delivery_counter WHERE id = 1 FOR UPDATE`);
       if (input.idempotencyKey) {
         const existing = await tx.execute(
-          import_drizzle_orm.sql`SELECT 1 FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(input.idempotencyKey.collection))} WHERE id = ${input.idempotencyKey.id} AND _deleted = 0 LIMIT 1`
+          import_drizzle_orm.sql`SELECT 1 FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(input.idempotencyKey.collection))} WHERE id = ${input.idempotencyKey.id} AND _deleted = 0 LIMIT 1`
         );
         if (existing.length > 0) {
           return { admitted: true, idempotent: true, applied: [] };
         }
       }
       const rows = await tx.execute(
-        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(input.target.collection))} WHERE id = ${input.target.id} AND _deleted = 0`
+        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(input.target.collection))} WHERE id = ${input.target.id} AND _deleted = 0`
       );
       const current = rows.length > 0 ? this.deserializeRow(rows[0], collectionDef) : null;
       if (!input.admit(current)) {
         return { admitted: false, idempotent: false, applied: [] };
       }
-      const clock = new import_core14.HybridLogicalClock(this.nodeId, this.timeSource);
+      const clock = new import_core15.HybridLogicalClock(this.nodeId, this.timeSource);
       const latest = await this.latestOperationTimestamp(
         tx,
         input.target.collection,
@@ -3295,7 +3377,7 @@ var PostgresServerStore = class {
     const collectionDef = this.schema?.collections[collection];
     if (!collectionDef) return null;
     const rows = await txOrDb.execute(
-      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
+      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
     );
     const row = rows[0];
     if (!row) return null;
@@ -3484,7 +3566,7 @@ var PostgresServerStore = class {
       const chunk = ids.slice(i, i + 1e3);
       if (chunk.length === 0) continue;
       const rows = await this.db.execute(
-        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} WHERE id IN (${import_drizzle_orm.sql.join(
+        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id IN (${import_drizzle_orm.sql.join(
           chunk.map((id) => import_drizzle_orm.sql`${id}`),
           import_drizzle_orm.sql.raw(", ")
         )})`
@@ -3522,7 +3604,7 @@ var PostgresServerStore = class {
     this.assertCollection(collection);
     const schema = this.schema;
     const collectionDef = schema.collections[collection];
-    const query = import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} WHERE id = ${id} AND _deleted = 0`;
+    const query = import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id = ${id} AND _deleted = 0`;
     const rows = await this.db.execute(query);
     if (rows.length === 0) return null;
     return this.deserializeRow(rows[0], collectionDef);
@@ -3539,7 +3621,7 @@ var PostgresServerStore = class {
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false, schema.collections[collection]);
-    const query = import_drizzle_orm.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} WHERE ${whereClause}`;
+    const query = import_drizzle_orm.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE ${whereClause}`;
     const rows = await this.db.execute(query);
     const cnt = rows[0]?.cnt;
     return typeof cnt === "string" ? Number.parseInt(cnt, 10) : cnt ?? 0;
@@ -3601,7 +3683,7 @@ var PostgresServerStore = class {
     await this.db.transaction(async (tx) => {
       await tx.execute(import_drizzle_orm.sql`DELETE FROM kora_fold_state`);
       for (const collection of Object.keys(this.schema?.collections ?? {})) {
-        await tx.execute(import_drizzle_orm.sql.raw(`DELETE FROM ${(0, import_core14.quoteIdent)(collection)}`));
+        await tx.execute(import_drizzle_orm.sql.raw(`DELETE FROM ${(0, import_core15.quoteIdent)(collection)}`));
       }
     });
     if (this.schema) this.foldMigration = await this.rematerialize();
@@ -3711,6 +3793,21 @@ var PostgresServerStore = class {
     );
     return rows[0]?.user_id === userId;
   }
+  async claimUnownedNode(nodeId, userId) {
+    this.assertOpen();
+    await this.ready;
+    if (userId === RELEASED_NODE_OWNER) return false;
+    await this.db.execute(
+      import_drizzle_orm.sql`INSERT INTO node_claims (node_id, user_id, claimed_at)
+				VALUES (${nodeId}, ${userId}, ${Date.now()})
+				ON CONFLICT (node_id) DO UPDATE SET user_id = EXCLUDED.user_id, claimed_at = EXCLUDED.claimed_at
+				WHERE node_claims.user_id = ${RELEASED_NODE_OWNER}`
+    );
+    const rows = await this.db.execute(
+      import_drizzle_orm.sql`SELECT user_id FROM node_claims WHERE node_id = ${nodeId} LIMIT 1`
+    );
+    return rows[0]?.user_id === userId;
+  }
   async getNodeClaimOwner(nodeId) {
     this.assertOpen();
     await this.ready;
@@ -3752,7 +3849,7 @@ var PostgresServerStore = class {
     const collectionDef = this.schema?.collections[collection];
     if (collectionDef) {
       const rows = await txOrDb.execute(
-        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
+        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
       );
       const row = rows[0];
       return row ? this.deserializeRow(row, collectionDef) : null;
@@ -3830,7 +3927,7 @@ var PostgresServerStore = class {
     const schema = this.schema ?? EMPTY_FOLD_SCHEMA;
     const collectionDef = schema.collections[collection];
     const raw = collectionDef ? (await txOrDb.execute(
-      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
+      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
     ))[0] : void 0;
     let row = null;
     if (raw && collectionDef) {
@@ -3928,7 +4025,7 @@ var PostgresServerStore = class {
     const row = state ? projectFoldState(state, this.foldOptions) : null;
     if (!row) {
       await txOrDb.execute(
-        import_drizzle_orm.sql`UPDATE ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} SET _deleted = 1 WHERE id = ${recordId}`
+        import_drizzle_orm.sql`UPDATE ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} SET _deleted = 1 WHERE id = ${recordId}`
       );
       return;
     }
@@ -3959,16 +4056,16 @@ var PostgresServerStore = class {
       updatedAt,
       deleted ? 1 : 0
     ];
-    const columnsSql = import_drizzle_orm.sql.raw(allColumns.map((c) => (0, import_core14.quoteIdent)(c)).join(", "));
+    const columnsSql = import_drizzle_orm.sql.raw(allColumns.map((c) => (0, import_core15.quoteIdent)(c)).join(", "));
     const valuesSql = import_drizzle_orm.sql.join(
       values.map((v) => import_drizzle_orm.sql`${v}`),
       import_drizzle_orm.sql.raw(", ")
     );
     const updateSet = import_drizzle_orm.sql.raw(
-      allColumns.slice(1).map((c) => `${(0, import_core14.quoteIdent)(c)} = excluded.${(0, import_core14.quoteIdent)(c)}`).join(", ")
+      allColumns.slice(1).map((c) => `${(0, import_core15.quoteIdent)(c)} = excluded.${(0, import_core15.quoteIdent)(c)}`).join(", ")
     );
     await txOrDb.execute(
-      import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+      import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
     );
   }
   /**
@@ -4024,9 +4121,9 @@ var PostgresServerStore = class {
       ]);
     }
     const perStatement = Math.max(1, Math.floor(3e4 / columns.length));
-    const columnsSql = import_drizzle_orm.sql.raw(columns.map((c) => (0, import_core14.quoteIdent)(c)).join(", "));
+    const columnsSql = import_drizzle_orm.sql.raw(columns.map((c) => (0, import_core15.quoteIdent)(c)).join(", "));
     const updateSet = import_drizzle_orm.sql.raw(
-      columns.slice(1).map((c) => `${(0, import_core14.quoteIdent)(c)} = excluded.${(0, import_core14.quoteIdent)(c)}`).join(", ")
+      columns.slice(1).map((c) => `${(0, import_core15.quoteIdent)(c)} = excluded.${(0, import_core15.quoteIdent)(c)}`).join(", ")
     );
     for (let i = 0; i < rows.length; i += perStatement) {
       const tuples = rows.slice(i, i + perStatement).map(
@@ -4036,12 +4133,12 @@ var PostgresServerStore = class {
         )})`
       );
       await tx.execute(
-        import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} (${columnsSql}) VALUES ${import_drizzle_orm.sql.join(tuples, import_drizzle_orm.sql.raw(", "))} ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+        import_drizzle_orm.sql`INSERT INTO ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} (${columnsSql}) VALUES ${import_drizzle_orm.sql.join(tuples, import_drizzle_orm.sql.raw(", "))} ON CONFLICT (id) DO UPDATE SET ${updateSet}`
       );
     }
     if (hidden.length > 0) {
       await tx.execute(
-        import_drizzle_orm.sql`UPDATE ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} SET _deleted = 1 WHERE id IN (${import_drizzle_orm.sql.join(
+        import_drizzle_orm.sql`UPDATE ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} SET _deleted = 1 WHERE id IN (${import_drizzle_orm.sql.join(
           hidden.map((id) => import_drizzle_orm.sql`${id}`),
           import_drizzle_orm.sql.raw(", ")
         )})`
@@ -4133,7 +4230,7 @@ var PostgresServerStore = class {
 						GROUP BY record_id ORDER BY record_id LIMIT ${FOLD_MIGRATION_BATCH}
 					)
 					SELECT r.record_id, r.max_seq, f.covered_seq AS covered,
-						EXISTS (SELECT 1 FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} c WHERE c.id = r.record_id) AS has_row,
+						EXISTS (SELECT 1 FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} c WHERE c.id = r.record_id) AS has_row,
 						EXISTS (
 							SELECT 1 FROM operations x
 							WHERE x.id = f.covered_op_id AND x.delivery_seq = f.covered_seq
@@ -4205,7 +4302,7 @@ var PostgresServerStore = class {
         await this.db.transaction(async (tx) => {
           await tx.execute(import_drizzle_orm.sql`SELECT value FROM delivery_counter WHERE id = 1 FOR UPDATE`);
           const orphans = await tx.execute(
-            import_drizzle_orm.sql`SELECT c.id AS id FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} c
+            import_drizzle_orm.sql`SELECT c.id AS id FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} c
 							WHERE NOT EXISTS (SELECT 1 FROM kora_fold_state f WHERE f.collection = ${collection} AND f.record_id = c.id)
 							AND NOT EXISTS (SELECT 1 FROM operations o WHERE o.collection = ${collection} AND o.record_id = c.id)`
           );
@@ -4239,11 +4336,11 @@ var PostgresServerStore = class {
       this.schema?.collections[collection]
     );
     const parts = [
-      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(collection))} WHERE ${whereClause}`
+      import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE ${whereClause}`
     ];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
-      parts.push(import_drizzle_orm.sql.raw(` ORDER BY ${(0, import_core14.quoteIdent)(options.orderBy)} ${dir}`));
+      parts.push(import_drizzle_orm.sql.raw(` ORDER BY ${(0, import_core15.quoteIdent)(options.orderBy)} ${dir}`));
     }
     if (options?.limit !== void 0) {
       parts.push(import_drizzle_orm.sql` LIMIT ${options.limit}`);
@@ -4261,7 +4358,7 @@ var PostgresServerStore = class {
     for (const [key, value] of Object.entries(where)) {
       const kind = collectionDef?.fields[key]?.kind;
       const param = kind && isPgRawTextKind(kind) && typeof value === "string" ? encodePgText(value) : value;
-      conditions.push(import_drizzle_orm.sql`${import_drizzle_orm.sql.raw((0, import_core14.quoteIdent)(key))} = ${param}`);
+      conditions.push(import_drizzle_orm.sql`${import_drizzle_orm.sql.raw((0, import_core15.quoteIdent)(key))} = ${param}`);
     }
     if (conditions.length === 0) {
       return import_drizzle_orm.sql.raw("1 = 1");
@@ -4486,7 +4583,7 @@ var PostgresServerStore = class {
       for (const column of narrowColumns) {
         await tx.execute(
           import_drizzle_orm.sql.raw(
-            `ALTER TABLE ${(0, import_core14.quoteIdent)(column.table_name)} ALTER COLUMN ${(0, import_core14.quoteIdent)(column.column_name)} TYPE BIGINT`
+            `ALTER TABLE ${(0, import_core15.quoteIdent)(column.table_name)} ALTER COLUMN ${(0, import_core15.quoteIdent)(column.column_name)} TYPE BIGINT`
           )
         );
       }
@@ -4695,7 +4792,7 @@ async function createPostgresServerStore(options) {
   }
   return store;
 }
-var ServerStoreUnavailableError = class extends import_core14.KoraError {
+var ServerStoreUnavailableError = class extends import_core15.KoraError {
   constructor(connectionString, cause) {
     const reason = cause instanceof Error ? cause.message : String(cause);
     super(
@@ -4753,8 +4850,10 @@ var POSTGRES_DRIVER_SPECIFIERS = [
 
 // src/store/sqlite-server-store.ts
 init_cjs_shims();
+var import_node_fs = require("fs");
 var import_node_module = require("module");
-var import_core15 = require("@korajs/core");
+var import_node_path = require("path");
+var import_core16 = require("@korajs/core");
 var import_internal4 = require("@korajs/core/internal");
 var import_drizzle_orm2 = require("drizzle-orm");
 
@@ -5096,14 +5195,14 @@ var SqliteServerStore = class {
    * log has no transform path to `version` (RT-103): those operations would fold as
    * absent, silently erasing them from their records.
    */
-  assertTransformCoverage(version, transforms) {
+  assertTransformCoverage(version2, transforms) {
     if (transforms.length === 0) return;
     const rows = this.db.all(
       import_drizzle_orm2.sql`SELECT DISTINCT schema_version AS v FROM operations`
     );
-    (0, import_core15.assertOperationTransformCoverage)(
+    (0, import_core16.assertOperationTransformCoverage)(
       rows.map((row) => Number(row.v)),
-      version,
+      version2,
       transforms,
       "SQLite server store"
     );
@@ -5329,7 +5428,7 @@ var SqliteServerStore = class {
     const collectionDef = this.schema?.collections[collection];
     if (!collectionDef) return null;
     const rows = txOrDb.all(
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
     );
     const row = rows[0];
     if (!row) return null;
@@ -5467,7 +5566,7 @@ var SqliteServerStore = class {
       const chunk = ids.slice(i, i + 500);
       if (chunk.length === 0) continue;
       const rows = this.db.all(
-        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id IN (${import_drizzle_orm2.sql.join(
+        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} WHERE id IN (${import_drizzle_orm2.sql.join(
           chunk.map((id) => import_drizzle_orm2.sql`${id}`),
           import_drizzle_orm2.sql.raw(", ")
         )})`
@@ -5503,7 +5602,7 @@ var SqliteServerStore = class {
     this.assertCollection(collection);
     const schema = this.schema;
     const collectionDef = schema.collections[collection];
-    const query = import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id = ${id} AND _deleted = 0`;
+    const query = import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} WHERE id = ${id} AND _deleted = 0`;
     const rows = this.db.all(query);
     if (rows.length === 0) return null;
     return this.deserializeRow(rows[0], collectionDef);
@@ -5519,7 +5618,7 @@ var SqliteServerStore = class {
       }
     }
     const whereClause = this.buildWhereClause(where ?? {}, false, schema.collections[collection]);
-    const query = import_drizzle_orm2.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE ${whereClause}`;
+    const query = import_drizzle_orm2.sql`SELECT COUNT(*) as cnt FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} WHERE ${whereClause}`;
     const rows = this.db.all(query);
     return rows[0]?.cnt ?? 0;
   }
@@ -5591,6 +5690,20 @@ var SqliteServerStore = class {
     );
     return rows[0]?.user_id === userId;
   }
+  async claimUnownedNode(nodeId, userId) {
+    this.assertOpen();
+    if (userId === RELEASED_NODE_OWNER) return false;
+    this.db.run(
+      import_drizzle_orm2.sql`INSERT INTO node_claims (node_id, user_id, claimed_at)
+				VALUES (${nodeId}, ${userId}, ${Date.now()})
+				ON CONFLICT (node_id) DO UPDATE SET user_id = excluded.user_id, claimed_at = excluded.claimed_at
+				WHERE node_claims.user_id = ${RELEASED_NODE_OWNER}`
+    );
+    const rows = this.db.all(
+      import_drizzle_orm2.sql`SELECT user_id FROM node_claims WHERE node_id = ${nodeId} LIMIT 1`
+    );
+    return rows[0]?.user_id === userId;
+  }
   async getNodeClaimOwner(nodeId) {
     this.assertOpen();
     const rows = this.db.all(
@@ -5629,7 +5742,7 @@ var SqliteServerStore = class {
     const collectionDef = this.schema?.collections[collection];
     if (collectionDef) {
       const rows = txOrDb.all(
-        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
+        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
       );
       const row = rows[0];
       return row ? this.deserializeRow(row, collectionDef) : null;
@@ -5649,7 +5762,7 @@ var SqliteServerStore = class {
     const schema = this.schema ?? EMPTY_FOLD_SCHEMA;
     const collectionDef = schema.collections[collection];
     const raw = collectionDef ? txOrDb.all(
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} WHERE id = ${recordId} LIMIT 1`
     )[0] : void 0;
     let row = null;
     if (raw && collectionDef) {
@@ -5720,7 +5833,7 @@ var SqliteServerStore = class {
     this.db.transaction((tx) => {
       tx.run(import_drizzle_orm2.sql.raw("DELETE FROM kora_fold_state"));
       for (const collection of Object.keys(this.schema?.collections ?? {})) {
-        tx.run(import_drizzle_orm2.sql.raw(`DELETE FROM ${(0, import_core15.quoteIdent)(collection)}`));
+        tx.run(import_drizzle_orm2.sql.raw(`DELETE FROM ${(0, import_core16.quoteIdent)(collection)}`));
       }
     });
     if (this.schema) this.foldMigration = this.rematerialize();
@@ -5842,7 +5955,7 @@ var SqliteServerStore = class {
     const row = state ? projectFoldState(state, this.foldOptions) : null;
     if (!row) {
       txOrDb.run(
-        import_drizzle_orm2.sql`UPDATE ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} SET _deleted = 1 WHERE id = ${recordId}`
+        import_drizzle_orm2.sql`UPDATE ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} SET _deleted = 1 WHERE id = ${recordId}`
       );
       return;
     }
@@ -5874,16 +5987,16 @@ var SqliteServerStore = class {
       updatedAt,
       deleted ? 1 : 0
     ];
-    const columnsSql = import_drizzle_orm2.sql.raw(allColumns.map((c) => (0, import_core15.quoteIdent)(c)).join(", "));
+    const columnsSql = import_drizzle_orm2.sql.raw(allColumns.map((c) => (0, import_core16.quoteIdent)(c)).join(", "));
     const valuesSql = import_drizzle_orm2.sql.join(
       values.map((v) => import_drizzle_orm2.sql`${v}`),
       import_drizzle_orm2.sql.raw(", ")
     );
     const updateSet = import_drizzle_orm2.sql.raw(
-      allColumns.slice(1).map((c) => `${(0, import_core15.quoteIdent)(c)} = excluded.${(0, import_core15.quoteIdent)(c)}`).join(", ")
+      allColumns.slice(1).map((c) => `${(0, import_core16.quoteIdent)(c)} = excluded.${(0, import_core16.quoteIdent)(c)}`).join(", ")
     );
     txOrDb.run(
-      import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
+      import_drizzle_orm2.sql`INSERT INTO ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(tableName))} (${columnsSql}) VALUES (${valuesSql}) ON CONFLICT (id) DO UPDATE SET ${updateSet}`
     );
   }
   /**
@@ -5914,8 +6027,8 @@ var SqliteServerStore = class {
       const key = `${PG_TEXT_CODEC_MIGRATION_KEY}${name}`;
       this.db.transaction((tx) => {
         if (tx.all(import_drizzle_orm2.sql`SELECT 1 AS one FROM kora_server_meta WHERE key = ${key}`).length > 0) return;
-        const textColumns = Object.entries(collection.fields).filter(([, descriptor]) => isPgRawTextKind(descriptor.kind)).map(([field]) => (0, import_core15.quoteIdent)(field));
-        for (const statement of sqliteTextCodecMigrationSql((0, import_core15.quoteIdent)(name), textColumns)) {
+        const textColumns = Object.entries(collection.fields).filter(([, descriptor]) => isPgRawTextKind(descriptor.kind)).map(([field]) => (0, import_core16.quoteIdent)(field));
+        for (const statement of sqliteTextCodecMigrationSql((0, import_core16.quoteIdent)(name), textColumns)) {
           tx.run(import_drizzle_orm2.sql.raw(statement));
         }
         tx.run(
@@ -5987,7 +6100,7 @@ var SqliteServerStore = class {
           import_drizzle_orm2.sql`SELECT o.record_id AS record_id, MAX(o.delivery_seq) AS max_seq,
 						(SELECT f.covered_seq FROM kora_fold_state f WHERE f.collection = o.collection AND f.record_id = o.record_id) AS covered,
 						(SELECT f.covered_op_id FROM kora_fold_state f WHERE f.collection = o.collection AND f.record_id = o.record_id) AS covered_op_id,
-						EXISTS (SELECT 1 FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} c WHERE c.id = o.record_id) AS has_row
+						EXISTS (SELECT 1 FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} c WHERE c.id = o.record_id) AS has_row
 					FROM operations o
 					WHERE o.collection = ${collection} AND o.record_id > ${cursor}
 					GROUP BY o.record_id
@@ -6053,7 +6166,7 @@ var SqliteServerStore = class {
       if (!clean) {
         this.db.transaction((tx) => {
           const orphans = tx.all(
-            import_drizzle_orm2.sql`SELECT c.id AS id FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} c
+            import_drizzle_orm2.sql`SELECT c.id AS id FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} c
 							WHERE NOT EXISTS (SELECT 1 FROM kora_fold_state f WHERE f.collection = ${collection} AND f.record_id = c.id)
 							AND NOT EXISTS (SELECT 1 FROM operations o WHERE o.collection = ${collection} AND o.record_id = c.id)`
           );
@@ -6085,11 +6198,11 @@ var SqliteServerStore = class {
       this.schema?.collections[collection]
     );
     const parts = [
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(collection))} WHERE ${whereClause}`
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(collection))} WHERE ${whereClause}`
     ];
     if (options?.orderBy) {
       const dir = options.orderDirection === "desc" ? "DESC" : "ASC";
-      parts.push(import_drizzle_orm2.sql.raw(` ORDER BY ${(0, import_core15.quoteIdent)(options.orderBy)} ${dir}`));
+      parts.push(import_drizzle_orm2.sql.raw(` ORDER BY ${(0, import_core16.quoteIdent)(options.orderBy)} ${dir}`));
     }
     if (options?.limit !== void 0) {
       parts.push(import_drizzle_orm2.sql` LIMIT ${options.limit}`);
@@ -6107,7 +6220,7 @@ var SqliteServerStore = class {
     for (const [key, value] of Object.entries(where)) {
       const kind = collectionDef?.fields[key]?.kind;
       const param = kind && isPgRawTextKind(kind) && typeof value === "string" ? encodePgText(value) : value;
-      conditions.push(import_drizzle_orm2.sql`${import_drizzle_orm2.sql.raw((0, import_core15.quoteIdent)(key))} = ${param}`);
+      conditions.push(import_drizzle_orm2.sql`${import_drizzle_orm2.sql.raw((0, import_core16.quoteIdent)(key))} = ${param}`);
     }
     if (conditions.length === 0) {
       return import_drizzle_orm2.sql.raw("1 = 1");
@@ -6593,6 +6706,7 @@ function createSqliteServerStore(options) {
   const Database = esmRequire("better-sqlite3");
   const { drizzle } = esmRequire("drizzle-orm/better-sqlite3");
   const filename = options.filename ?? ":memory:";
+  ensureDatabaseDirectory(filename);
   const sqlite = new Database(filename);
   sqlite.pragma("journal_mode = WAL");
   const db = drizzle(sqlite);
@@ -6602,10 +6716,14 @@ function createSqliteServerStore(options) {
     ...options.instanceId !== void 0 ? { instanceId: options.instanceId } : {}
   });
 }
+function ensureDatabaseDirectory(filename) {
+  if (filename === "" || filename === ":memory:" || filename.startsWith("file:")) return;
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(filename), { recursive: true });
+}
 
 // src/transport/http-server-transport.ts
 init_cjs_shims();
-var import_core16 = require("@korajs/core");
+var import_core17 = require("@korajs/core");
 var DEFAULT_HTTP_MAX_QUEUED_BYTES = 32 * 1024 * 1024;
 var HttpServerTransport = class {
   serializer;
@@ -6677,7 +6795,7 @@ var HttpServerTransport = class {
   }
   receive(payload) {
     if (!this.connected) {
-      throw new import_core16.SyncError("HTTP server transport is closed");
+      throw new import_core17.SyncError("HTTP server transport is closed");
     }
     try {
       const message = this.serializer.decode(payload);
@@ -6718,7 +6836,7 @@ var HttpServerTransport = class {
 
 // src/transport/ws-server-transport.ts
 init_cjs_shims();
-var import_core17 = require("@korajs/core");
+var import_core18 = require("@korajs/core");
 var import_sync2 = require("@korajs/sync");
 var WS_OPEN = 1;
 var DEFAULT_WS_HEARTBEAT_INTERVAL_MS = 25e3;
@@ -6746,7 +6864,7 @@ var WsServerTransport = class {
   }
   send(message) {
     if (this.ws.readyState !== WS_OPEN) {
-      throw new import_core17.SyncError("Cannot send message: WebSocket is not open", {
+      throw new import_core18.SyncError("Cannot send message: WebSocket is not open", {
         readyState: this.ws.readyState,
         messageType: message.type
       });
@@ -6825,7 +6943,7 @@ var WsServerTransport = class {
       this.missedPongs = 0;
       try {
         if (typeof data !== "string" && !(data instanceof Uint8Array) && !(data instanceof ArrayBuffer)) {
-          throw new import_core17.SyncError("Unsupported WebSocket payload type", {
+          throw new import_core18.SyncError("Unsupported WebSocket payload type", {
             payloadType: typeof data
           });
         }
@@ -6850,8 +6968,8 @@ var WsServerTransport = class {
 
 // src/session/client-session.ts
 init_cjs_shims();
-var import_core29 = require("@korajs/core");
 var import_core30 = require("@korajs/core");
+var import_core31 = require("@korajs/core");
 var import_internal7 = require("@korajs/core/internal");
 var import_sync4 = require("@korajs/sync");
 var import_sync5 = require("@korajs/sync");
@@ -6859,22 +6977,22 @@ var import_internal8 = require("@korajs/sync/internal");
 
 // src/apply/apply-server-operation.ts
 init_cjs_shims();
-var import_core21 = require("@korajs/core");
+var import_core22 = require("@korajs/core");
 var import_merge4 = require("@korajs/merge");
 
 // src/constraints/constraint-authority.ts
 init_cjs_shims();
-var import_core19 = require("@korajs/core");
+var import_core20 = require("@korajs/core");
 var import_merge2 = require("@korajs/merge");
 
 // src/apply/derive-server-op-id.ts
 init_cjs_shims();
-var import_core18 = require("@korajs/core");
+var import_core19 = require("@korajs/core");
 async function deriveServerOpId(store, parentOpId, ruleId, targetRecordId) {
   if (store.deriveServerOperationId) {
     return store.deriveServerOperationId(parentOpId, ruleId, targetRecordId);
   }
-  return (0, import_core18.deriveSideEffectOpId)(parentOpId, ruleId, targetRecordId);
+  return (0, import_core19.deriveSideEffectOpId)(parentOpId, ruleId, targetRecordId);
 }
 
 // src/constraints/server-constraint-context.ts
@@ -6920,12 +7038,12 @@ async function buildCorrection(store, spec, schemaVersion, nextSequence) {
   };
 }
 function stampTimestamp(stamp) {
-  return stamp ? import_core19.HybridLogicalClock.deserialize(stamp.t) : null;
+  return stamp ? import_core20.HybridLogicalClock.deserialize(stamp.t) : null;
 }
 function maxTimestamp(values) {
   let best = null;
   for (const value of values) {
-    if (value && (best === null || import_core19.HybridLogicalClock.compare(value, best) > 0)) best = value;
+    if (value && (best === null || import_core20.HybridLogicalClock.compare(value, best) > 0)) best = value;
   }
   return best;
 }
@@ -6939,7 +7057,7 @@ function comparePriority(a, b) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 function chooseWinner(members, constraint) {
-  const byStamp = (a, b) => import_core19.HybridLogicalClock.compare(a.key, b.key) || (a.row.id < b.row.id ? -1 : 1);
+  const byStamp = (a, b) => import_core20.HybridLogicalClock.compare(a.key, b.key) || (a.row.id < b.row.id ? -1 : 1);
   const sorted = [...members].sort(byStamp);
   if (constraint.onConflict === "last-write-wins") return sorted[sorted.length - 1];
   if (constraint.onConflict === "priority-field" && constraint.priorityField) {
@@ -6952,8 +7070,11 @@ function chooseWinner(members, constraint) {
   }
   return sorted[0];
 }
+function groupKeys(constraint) {
+  return [.../* @__PURE__ */ new Set([...constraint.fields, ...Object.keys(constraint.where ?? {})])];
+}
 function groupWhere(constraint, row) {
-  const where = constraint.type === "capacity" ? { ...constraint.where } : {};
+  const where = { ...constraint.where ?? {} };
   for (const field of constraint.fields) {
     const value = row[field];
     if (value === null || value === void 0) return null;
@@ -6962,22 +7083,25 @@ function groupWhere(constraint, row) {
   return where;
 }
 async function undoConstrainedWrite(store, schema, collection, constraintIndex, constraint, loser, winner) {
+  const keys = groupKeys(constraint);
   const ops = await store.getRecordOperations?.(collection, loser.row.id) ?? [];
   const state = await store.getRecordFoldState?.(collection, loser.row.id);
   const newest = stampTimestamp(state?.u ?? null) ?? loser.key;
-  const parent = `hlc:${import_core19.HybridLogicalClock.serialize(loser.key)}`;
+  const parent = `hlc:${import_core20.HybridLogicalClock.serialize(loser.key)}`;
   const rule = `constraint:${collection}:${constraintIndex}:${constraint.type}`;
   const transforms = store.getOperationTransforms?.() ?? [];
   const losing = new Set(
     ops.filter((stored) => {
-      if (import_core19.HybridLogicalClock.compare(stored.timestamp, loser.key) !== 0) return false;
-      const op = (0, import_core19.operationSchemaView)(stored, schema.version, transforms);
-      return op !== null && op.data !== null && constraint.fields.some((field) => op.data !== null && field in op.data);
+      if (import_core20.HybridLogicalClock.compare(stored.timestamp, loser.key) !== 0) return false;
+      const op = (0, import_core20.operationSchemaView)(stored, schema.version, transforms);
+      return op !== null && op.data !== null && keys.some((field) => op.data !== null && field in op.data);
     }).map((op) => op.id)
   );
-  const without = (0, import_core19.foldRecord)(ops, schema, { exclude: losing, transforms }).state;
-  const previous = without && (0, import_core19.isFoldStateLive)(without) ? (0, import_core19.materialize)(without) : null;
-  const collides = previous !== null && constraint.fields.every((field) => sameValue(previous[field], winner.row[field]));
+  const without = (0, import_core20.foldRecord)(ops, schema, { exclude: losing, transforms }).state;
+  const previous = without && (0, import_core20.isFoldStateLive)(without) ? (0, import_core20.materialize)(without) : null;
+  const collides = previous !== null && constraint.fields.every((field) => sameValue(previous[field], winner.row[field])) && Object.entries(constraint.where ?? {}).every(
+    ([field, value]) => sameValue(previous[field], value)
+  );
   if (previous === null || collides) {
     return {
       parent,
@@ -6992,10 +7116,17 @@ async function undoConstrainedWrite(store, schema, collection, constraintIndex,
   }
   const data = {};
   const previousData = {};
-  for (const field of constraint.fields) {
+  for (const field of keys) {
+    if (sameValue(previous[field], loser.row[field])) continue;
     data[field] = previous[field] ?? null;
     previousData[field] = loser.row[field] ?? null;
   }
+  if (Object.keys(data).length === 0) {
+    for (const field of constraint.fields) {
+      data[field] = previous[field] ?? null;
+      previousData[field] = loser.row[field] ?? null;
+    }
+  }
   return {
     parent,
     rule,
@@ -7014,7 +7145,7 @@ async function uniqueAndCapacityCorrections(store, schema, op) {
   const definition = schema.collections[op.collection];
   if (!definition || op.type === "delete") return [];
   const crossRecord = definition.constraints.filter(
-    (constraint) => (constraint.type === "unique" || constraint.type === "capacity") && (op.type === "insert" || constraint.fields.some((field) => op.data !== null && field in op.data))
+    (constraint) => (constraint.type === "unique" || constraint.type === "capacity") && (op.type === "insert" || groupKeys(constraint).some((field) => op.data !== null && field in op.data))
   );
   if (crossRecord.length === 0 || !store.getRecordFieldVersions) return [];
   const row = await store.findRecord(op.collection, op.recordId);
@@ -7040,7 +7171,7 @@ async function uniqueAndCapacityCorrections(store, schema, op) {
       members.push({
         row: candidate,
         versions,
-        key: constrainedVersion(versions, constraint.fields)
+        key: constrainedVersion(versions, groupKeys(constraint))
       });
     }
     if (members.length < 2) continue;
@@ -7074,7 +7205,7 @@ async function referentialCorrections(store, schema, op) {
         const parentId = child[relation.field];
         if (typeof parentId !== "string" || parentId.length === 0) continue;
         const parent = await store.getRecordFoldState(relation.to, parentId);
-        if (!parent || parent.cr === null || (0, import_core19.isFoldStateLive)(parent)) continue;
+        if (!parent || parent.cr === null || (0, import_core20.isFoldStateLive)(parent)) continue;
         const deletedAt = stampTimestamp(parent.d);
         const childState = await store.getRecordFoldState(op.collection, op.recordId);
         const after = maxTimestamp([deletedAt, stampTimestamp(childState?.u ?? null)]);
@@ -7121,7 +7252,7 @@ async function referentialCorrections(store, schema, op) {
     return specs;
   }
   const deleted = await store.getRecordFoldState(op.collection, op.recordId);
-  if (!deleted || deleted.cr === null || (0, import_core19.isFoldStateLive)(deleted) || !deleted.d) return specs;
+  if (!deleted || deleted.cr === null || (0, import_core20.isFoldStateLive)(deleted) || !deleted.d) return specs;
   for (const [name, relation] of relations) {
     if (relation.to !== op.collection || relation.onDelete !== "restrict") continue;
     const children = await store.queryCollection(relation.from, {
@@ -7243,7 +7374,7 @@ init_ingest_validation();
 
 // src/apply/server-side-effect-operation.ts
 init_cjs_shims();
-var import_core20 = require("@korajs/core");
+var import_core21 = require("@korajs/core");
 async function createServerSideEffectOperation(store, parentOp, effect, schemaVersion, sequenceNumber) {
   const nodeId = store.getNodeId();
   const policy = effect.type === "delete" ? "cascade" : "set-null";
@@ -7282,7 +7413,7 @@ var serverClocks = /* @__PURE__ */ new WeakMap();
 function serverClock(store, after) {
   let clock = serverClocks.get(store);
   if (!clock) {
-    clock = new import_core20.HybridLogicalClock(store.getNodeId());
+    clock = new import_core21.HybridLogicalClock(store.getNodeId());
     serverClocks.set(store, clock);
   }
   if (after) clock.advanceTo(after);
@@ -7565,7 +7696,7 @@ function validateOperationShape(op, schema) {
     for (const [field, value] of Object.entries(op.data)) {
       const descriptor = collection.fields[field];
       if (!descriptor) continue;
-      const violation2 = (0, import_core21.operationValueViolation)(descriptor, value);
+      const violation2 = (0, import_core22.operationValueViolation)(descriptor, value);
       if (violation2 !== null) {
         return {
           valid: false,
@@ -7614,9 +7745,152 @@ var NoAuthProvider = class {
   }
 };
 
+// src/awareness/presence-records.ts
+init_cjs_shims();
+var CACHE_TTL_MS = 1e3;
+var MAX_TRACKED_RECORDS = 1e4;
+var MAX_CONCURRENT_READS = 16;
+var PresenceRecords = class {
+  constructor(store, now = Date.now) {
+    this.store = store;
+    this.now = now;
+  }
+  store;
+  now;
+  clock = 0;
+  /** The clock value of each tracked record's last touch, oldest first. */
+  lastTouch = /* @__PURE__ */ new Map();
+  /** Touches forgotten to bound memory count as having happened at this clock. */
+  forgottenTouchesAt = 0;
+  inFlight = /* @__PURE__ */ new Map();
+  cache = /* @__PURE__ */ new Map();
+  running = 0;
+  waiting = [];
+  /**
+   * Record that writes to these records committed: reads that began before are no
+   * longer current. Null means any record may have changed.
+   *
+   * @param keys - Record keys from {@link presenceRecordKey}, or null for every record
+   */
+  touch(keys) {
+    this.clock += 1;
+    if (keys === null) {
+      this.forgottenTouchesAt = this.clock;
+      this.lastTouch.clear();
+      this.cache.clear();
+      return;
+    }
+    for (const key of keys) {
+      this.lastTouch.delete(key);
+      this.lastTouch.set(key, this.clock);
+      this.cache.delete(key);
+    }
+    this.forget(this.lastTouch, (value) => {
+      this.forgottenTouchesAt = Math.max(this.forgottenTouchesAt, value);
+    });
+  }
+  /**
+   * True when a write touched the record after a read that began at `asOf`.
+   *
+   * @param key - Record key from {@link presenceRecordKey}
+   * @param asOf - The read's {@link PresenceRecordRead.asOf}
+   */
+  touchedSince(key, asOf) {
+    return (this.lastTouch.get(key) ?? this.forgottenTouchesAt) > asOf;
+  }
+  /**
+   * A current read of the record that is still fresh enough to reuse, without a store
+   * read; undefined when the record must be read.
+   *
+   * @param collection - The record's collection
+   * @param recordId - The record's id
+   */
+  peek(collection, recordId) {
+    const key = presenceRecordKey(collection, recordId);
+    const cached = this.cache.get(key);
+    if (!cached) return void 0;
+    if (this.now() - cached.atMs >= CACHE_TTL_MS || this.touchedSince(key, cached.startedAt)) {
+      this.cache.delete(key);
+      return void 0;
+    }
+    return { stored: cached.stored, asOf: cached.startedAt };
+  }
+  /**
+   * Read the record from the store, joining a read of it already running when no
+   * write touched the record since that read began. Rejects when the store read fails.
+   *
+   * @param collection - The record's collection
+   * @param recordId - The record's id
+   */
+  async read(collection, recordId) {
+    const key = presenceRecordKey(collection, recordId);
+    let entry = this.inFlight.get(key);
+    if (!entry || this.touchedSince(key, entry.startedAt)) {
+      const startedAt = this.clock;
+      const created = {
+        startedAt,
+        promise: this.readStore(collection, recordId)
+      };
+      entry = created;
+      this.inFlight.set(key, created);
+      void created.promise.then(
+        (stored2) => {
+          if (this.inFlight.get(key) === created) this.inFlight.delete(key);
+          if (this.touchedSince(key, startedAt)) return;
+          this.cache.delete(key);
+          this.cache.set(key, { stored: stored2, startedAt, atMs: this.now() });
+          this.forget(this.cache, () => {
+          });
+        },
+        () => {
+          if (this.inFlight.get(key) === created) this.inFlight.delete(key);
+        }
+      );
+    }
+    const stored = await entry.promise;
+    return { stored, asOf: entry.startedAt };
+  }
+  /** Forget every read and touch (the server stopped). */
+  clear() {
+    this.touch(null);
+    this.inFlight.clear();
+  }
+  async readStore(collection, recordId) {
+    if (this.running < MAX_CONCURRENT_READS) {
+      this.running += 1;
+    } else {
+      await new Promise((resolve2) => this.waiting.push(resolve2));
+    }
+    try {
+      const rows = await this.store.queryCollection(collection, {
+        where: { id: recordId },
+        includeDeleted: true,
+        limit: 1
+      });
+      return rows[0] ?? null;
+    } finally {
+      const next = this.waiting.shift();
+      if (next) next();
+      else this.running -= 1;
+    }
+  }
+  forget(map, onForget) {
+    while (map.size > MAX_TRACKED_RECORDS) {
+      const oldest = map.keys().next();
+      if (oldest.done) return;
+      const value = map.get(oldest.value);
+      map.delete(oldest.value);
+      if (value !== void 0) onForget(value);
+    }
+  }
+};
+function presenceRecordKey(collection, recordId) {
+  return `${collection}\0${recordId}`;
+}
+
 // src/encryption/key-record-service.ts
 init_cjs_shims();
-var import_core22 = require("@korajs/core");
+var import_core23 = require("@korajs/core");
 var import_sync3 = require("@korajs/sync");
 var ANONYMOUS_KEY_OWNER = "*";
 function userKeyOwner(userId) {
@@ -7646,7 +7920,7 @@ var EncryptionKeyService = class {
     const reply = (status, record, text3) => ({
       response: {
         type: "encryption-key-response",
-        messageId: (0, import_core22.generateUUIDv7)(),
+        messageId: (0, import_core23.generateUUIDv7)(),
         requestId: message.requestId,
         keyring: message.keyring,
         status,
@@ -7756,7 +8030,7 @@ init_cjs_shims();
 
 // src/richtext/blob-access-index.ts
 init_cjs_shims();
-var import_core23 = require("@korajs/core");
+var import_core24 = require("@korajs/core");
 var DEFAULT_BLOB_ACCESS_CACHE_TTL_MS = 5e3;
 var MAX_KNOWN_MANIFESTS = 1e4;
 var MAX_MEMORY_BLOB_OWNERS = 1e5;
@@ -7970,7 +8244,7 @@ var BlobAccessIndex = class {
         bytes = null;
       }
       if (bytes === null) continue;
-      if (await (0, import_core23.hashBlob)(bytes) !== manifestHash) continue;
+      if (await (0, import_core24.hashBlob)(bytes) !== manifestHash) continue;
       this.observeVerifiedBytes(manifestHash, bytes);
     }
   }
@@ -8050,7 +8324,7 @@ function asBlobRef(value) {
       return null;
     }
   }
-  return (0, import_core23.isBlobRef)(candidate) ? candidate : null;
+  return (0, import_core24.isBlobRef)(candidate) ? candidate : null;
 }
 function parseManifestChunks(bytes) {
   if (bytes.byteLength > 4 * 1024 * 1024) return null;
@@ -8151,8 +8425,8 @@ function asRecord2(value) {
 
 // src/scopes/resolve-session-scopes.ts
 init_cjs_shims();
-var import_core24 = require("@korajs/core");
-var ScopeRequiredError = class extends import_core24.KoraError {
+var import_core25 = require("@korajs/core");
+var ScopeRequiredError = class extends import_core25.KoraError {
   constructor(denied) {
     super(
       `Sync scope required: ${denied.map((d) => `"${d.collection}" needs ${d.missingKeys.map((k) => `"${k}"`).join(", ")}`).join("; ")}. The server could not derive these values from the verified token.`,
@@ -8176,7 +8450,7 @@ function resolveSessionScopeGrant(schema, options) {
   const denied = [];
   let grant;
   if (authScopes !== void 0 || scopeValues !== void 0) {
-    const claims = mergeClaims((0, import_core24.getScopeClaims)(authScopes), scopeValues);
+    const claims = mergeClaims((0, import_core25.getScopeClaims)(authScopes), scopeValues);
     const explicit = withoutReservedKeys(authScopes ?? {});
     assertScopeValuesDefined(explicit);
     if (!schema && claims && Object.keys(explicit).length === 0) {
@@ -8212,10 +8486,10 @@ function resolveSessionScopeGrant(schema, options) {
 }
 function bindClaimsToSchema(schema, claims, denied) {
   const result = {};
-  const partialSync = (0, import_core24.hasSchemaSyncRules)(schema);
+  const partialSync = (0, import_core25.hasSchemaSyncRules)(schema);
   for (const collection of Object.keys(schema.collections)) {
-    if (partialSync && !(0, import_core24.isCollectionSyncScoped)(schema, collection)) continue;
-    const bindings = (0, import_core24.getCollectionScopeBindings)(schema, collection);
+    if (partialSync && !(0, import_core25.isCollectionSyncScoped)(schema, collection)) continue;
+    const bindings = (0, import_core25.getCollectionScopeBindings)(schema, collection);
     if (!bindings) {
       result[collection] = {};
       continue;
@@ -8271,7 +8545,7 @@ function mergeClaims(fromGrant, scopeValues) {
 function withoutReservedKeys(scopes) {
   const result = {};
   for (const [collection, predicate] of Object.entries(scopes)) {
-    if (collection === import_core24.SCOPE_CLAIMS_KEY) continue;
+    if (collection === import_core25.SCOPE_CLAIMS_KEY) continue;
     result[collection] = { ...predicate ?? {} };
   }
   return result;
@@ -8301,7 +8575,7 @@ init_server_store();
 
 // src/session/duplicate-identity.ts
 init_cjs_shims();
-var import_core25 = require("@korajs/core");
+var import_core26 = require("@korajs/core");
 var import_internal5 = require("@korajs/core/internal");
 var import_internal6 = require("@korajs/sync/internal");
 var FORGED_DUPLICATE_CODE = "FORGED_DUPLICATE";
@@ -8313,11 +8587,11 @@ function isSameStoredOperation(upload, stored) {
   const b = contentKey(stored, storedVersion);
   return a !== null && a === b;
 }
-function contentKey(op, version) {
+function contentKey(op, version2) {
   let body;
   try {
-    body = (0, import_core25.canonicalizeOperationBody)(
-      version === 1 ? (0, import_core25.canonicalizeLegacyOperation)({ ...op, hashVersion: void 0 }) : op
+    body = (0, import_core26.canonicalizeOperationBody)(
+      version2 === 1 ? (0, import_core26.canonicalizeLegacyOperation)({ ...op, hashVersion: void 0 }) : op
     );
   } catch {
     return null;
@@ -8328,12 +8602,12 @@ function contentKey(op, version) {
     collection: op.collection,
     recordId: op.recordId,
     data: body.data,
-    timestamp: import_core25.HybridLogicalClock.serialize(op.timestamp),
+    timestamp: import_core26.HybridLogicalClock.serialize(op.timestamp),
     nodeId: op.nodeId,
     atomicOps,
     sealed: op.encrypted !== void 0
   };
-  if (version === 2) {
+  if (version2 === 2) {
     key.previousData = body.previousData;
     key.sequenceNumber = op.sequenceNumber;
     key.causalDeps = [...op.causalDeps].sort();
@@ -8354,7 +8628,7 @@ async function isRewrittenEcho(upload, stored, schema) {
   return !await (0, import_internal6.operationIdMatches)(upload, schema);
 }
 function sameHeader(a, b) {
-  return a.nodeId === b.nodeId && a.type === b.type && a.collection === b.collection && a.recordId === b.recordId && import_core25.HybridLogicalClock.serialize(a.timestamp) === import_core25.HybridLogicalClock.serialize(b.timestamp);
+  return a.nodeId === b.nodeId && a.type === b.type && a.collection === b.collection && a.recordId === b.recordId && import_core26.HybridLogicalClock.serialize(a.timestamp) === import_core26.HybridLogicalClock.serialize(b.timestamp);
 }
 
 // src/session/client-session.ts
@@ -8362,14 +8636,14 @@ init_operation_validation();
 
 // src/session/scope-entry.ts
 init_cjs_shims();
-var import_core26 = require("@korajs/core");
+var import_core27 = require("@korajs/core");
 var SCOPE_ENTRY_NODE_ID = "kora:scope-entry";
 async function buildScopeEntryOperation(input) {
   const { trigger, row, schema } = input;
   const definition = schema.collections[trigger.collection];
   const data = {};
   const foldState = input.foldState ?? null;
-  const versioned = input.fieldVersions ?? (foldState ? (0, import_core26.getFoldFieldVersions)(foldState) : null) ?? null;
+  const versioned = input.fieldVersions ?? (foldState ? (0, import_core27.getFoldFieldVersions)(foldState) : null) ?? null;
   const fieldVersions = {};
   for (const field of Object.keys(definition?.fields ?? {})) {
     if (!(field in row)) continue;
@@ -8380,7 +8654,7 @@ async function buildScopeEntryOperation(input) {
       fieldVersions[field] = { ...versioned.fields[field] ?? versioned.created };
     }
   }
-  const id = await (0, import_core26.hashBlob)(
+  const id = await (0, import_core27.hashBlob)(
     new TextEncoder().encode(
       `scope-entry\0${trigger.collection}\0${trigger.recordId}\0${trigger.id}`
     )
@@ -8413,15 +8687,15 @@ function toWireValue(value) {
 
 // src/session/session-operation-limits.ts
 init_cjs_shims();
-var import_core27 = require("@korajs/core");
 var import_core28 = require("@korajs/core");
-var DEFAULT_MAX_OPERATION_BYTES = import_core27.DEFAULT_MAX_OPERATION_BYTES;
+var import_core29 = require("@korajs/core");
+var DEFAULT_MAX_OPERATION_BYTES = import_core28.DEFAULT_MAX_OPERATION_BYTES;
 var DEFAULT_MAX_OPS_PER_MINUTE = 600;
 var DEFAULT_MAX_BLOB_REQUESTS_PER_MINUTE = 6e3;
 var BATCH_LOOKUP_RATE_COST = 1;
 var DEFAULT_MAX_OPS_PER_BATCH = 1e3;
 function measureOperationBytes(op) {
-  return (0, import_core28.measureOperationBytes)(op);
+  return (0, import_core29.measureOperationBytes)(op);
 }
 function validateOperationSize(op, maxBytes = DEFAULT_MAX_OPERATION_BYTES) {
   const bytes = measureOperationBytes(op);
@@ -8542,7 +8816,7 @@ function generateNodeToken() {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 async function nodeTokenHash(nodeToken) {
-  return (0, import_core30.hashBlob)(new TextEncoder().encode(nodeToken));
+  return (0, import_core31.hashBlob)(new TextEncoder().encode(nodeToken));
 }
 function samePrincipal(a, b) {
   if (a.anonymous === true || b.anonymous === true)
@@ -8558,24 +8832,24 @@ function revocationMatches(principal, filter) {
   return true;
 }
 var warnedUnscopedProviders = /* @__PURE__ */ new WeakSet();
-function warnIfMultiTenantWithoutScopes(auth, resolvedScopes, schema) {
-  if (!auth || auth instanceof NoAuthProvider) {
-    return;
-  }
-  if (resolvedScopes) {
-    return;
-  }
-  if (!schema || Object.keys(schema.collections).length === 0) {
-    return;
-  }
+function warnIfMultiTenantWithoutScopes(auth) {
   if (warnedUnscopedProviders.has(auth)) {
     return;
   }
   warnedUnscopedProviders.add(auth);
   console.warn(
-    "[kora] An authenticated session resolved to no sync scopes, so every user will sync every other user's data. Return per-user sync scopes from your auth provider (for example KoraAuthProvider's resolveScopes) to isolate tenants. Note: declaring sync rules in your schema is not enough on its own \u2014 the per-user values come from the auth provider. (This warning is expected for single-tenant apps where all authenticated users are meant to share the same data.)"
+    "[kora] An authenticated session resolved to no sync scopes: its grant restricts no collection, so every user will sync every other user's data. Return per-user sync scopes from your auth provider (for example KoraAuthProvider's resolveScopes or scopeValues) and declare schema sync rules that bind them, to isolate tenants. If all signed-in users are meant to share the same data, set unscopedSharing: 'allow' in the sync server options to silence this; 'refuse' turns it into a handshake refusal."
   );
 }
+function sharesEveryUsersData(auth, principal, downlink, schema) {
+  if (downlink === null) return false;
+  if (!auth || auth instanceof NoAuthProvider) return false;
+  if (!principal || principal.anonymous === true) return false;
+  if (!schema || Object.keys(schema.collections).length === 0) return false;
+  if (downlink === void 0) return true;
+  const collections = Object.values(downlink);
+  return collections.length > 0 && collections.every((predicate) => Object.keys(predicate).length === 0);
+}
 function stableStringify(value) {
   if (Array.isArray(value)) {
     return `[${value.map((item) => stableStringify(item)).join(",")}]`;
@@ -8587,10 +8861,16 @@ function stableStringify(value) {
   }
   return JSON.stringify(value);
 }
-function sameScopeMap(a, b) {
-  const normalize = (value) => value && typeof value === "object" ? normalizeScopeMap(value) : value;
+function sameNormalizedScopeMap(a, b) {
+  if (a === b) return true;
+  return stableStringify(a ?? null) === stableStringify(b ?? null);
+}
+function sameScopeMap(a, b, maxValues) {
+  const normalize = (value) => value && typeof value === "object" ? normalizeScopeMap(value, maxValues) : value;
   return stableStringify(normalize(a) ?? null) === stableStringify(normalize(b) ?? null);
 }
+var MAX_PRESENCE_LOOKUPS_PER_MINUTE = 1200;
+var MAX_PRESENCE_REREADS = 2;
 var DEFAULT_MAX_BLOB_CHUNK_BYTES = 1024 * 1024;
 var DEFAULT_MAX_BLOB_BYTES_PER_SESSION = 256 * 1024 * 1024;
 var ClientSession = class _ClientSession {
@@ -8614,6 +8894,8 @@ var ClientSession = class _ClientSession {
   /** A provisional anonymous claim awaiting the device's confirmation (RT-21). */
   pendingNodeClaim = null;
   allowLegacyAnonymousClaims;
+  deviceNodeHandover;
+  unscopedSharing;
   anonymousClaimTtlMs;
   isNodeLive;
   /** The credential presented at handshake, kept to re-validate the session (RT-18). */
@@ -8686,7 +8968,6 @@ var ClientSession = class _ClientSession {
    * `collection\u0000id`; null marks a record known to be absent. Only set while a
    * chunk is filtered.
    */
-  recordLookupCache = null;
   deliveryHighWaterBytes;
   handshakeTimeoutMs;
   handshakeTimer = null;
@@ -8737,6 +9018,15 @@ var ClientSession = class _ClientSession {
   maxOperationBytes;
   maxOpsPerMinute;
   maxOpsPerBatch;
+  maxScopePredicateValues;
+  /** {@link getScopePartitionKey}, cached for the scope map it was computed from. */
+  scopePartitionKeyCache = null;
+  /** Store reads for presence cursors (F16), per minute. */
+  presenceLookupLimiter = new SessionRateLimiter(MAX_PRESENCE_LOOKUPS_PER_MINUTE);
+  /** Reads the records presence cursors name (shared by the server's sessions). */
+  presenceRecords;
+  /** A {@link refreshScopes} request arrived during the handshake: re-check once streaming. */
+  scopeRefreshPending = false;
   rateLimiter;
   /** Separate budget for blob chunk requests (RT-24). */
   blobRateLimiter;
@@ -8789,6 +9079,7 @@ var ClientSession = class _ClientSession {
     this.operationTransforms = options.operationTransforms ?? [];
     this.onRelay = options.onRelay ?? null;
     this.onAwarenessUpdate = options.onAwarenessUpdate ?? null;
+    this.presenceRecords = options.presenceRecords ?? new PresenceRecords(options.store);
     this.onYjsDocUpdate = options.onYjsDocUpdate ?? null;
     this.onBlobChunkRequest = options.onBlobChunkRequest ?? null;
     this.onBlobChunkResponse = options.onBlobChunkResponse ?? null;
@@ -8815,10 +9106,13 @@ var ClientSession = class _ClientSession {
       options.blobRequestWindowMs ?? 6e4
     );
     this.maxOpsPerBatch = options.maxOpsPerBatch ?? DEFAULT_MAX_OPS_PER_BATCH;
+    this.maxScopePredicateValues = options.maxScopePredicateValues ?? DEFAULT_MAX_SCOPE_PREDICATE_VALUES;
     this.validateOperation = options.validateOperation ?? null;
     this.koraContext = options.koraContext ?? null;
     this.blobAccess = options.blobAccess ?? null;
     this.allowLegacyAnonymousClaims = options.allowLegacyAnonymousClaims ?? true;
+    this.deviceNodeHandover = options.deviceNodeHandover ?? true;
+    this.unscopedSharing = options.unscopedSharing ?? "warn";
     this.anonymousClaimTtlMs = options.anonymousClaimTtlMs ?? DEFAULT_ANONYMOUS_CLAIM_TTL_MS;
     this.isNodeLive = options.isNodeLive ?? null;
     this.deliveryHighWaterBytes = options.deliveryHighWaterBytes ?? DEFAULT_DELIVERY_HIGH_WATER_BYTES;
@@ -8919,7 +9213,7 @@ var ClientSession = class _ClientSession {
     const serializedOps = visibleOperations.map((op) => this.serializer.encodeOperation(op));
     const msg = {
       type: "operation-batch",
-      messageId: (0, import_core30.generateUUIDv7)(),
+      messageId: (0, import_core31.generateUUIDv7)(),
       operations: serializedOps,
       ...retractions.length > 0 ? { retractions } : {},
       isFinal: true,
@@ -9218,6 +9512,44 @@ var ClientSession = class _ClientSession {
     this.terminate(expired ? "AUTH_EXPIRED" : "AUTH_REVOKED");
     return "terminated";
   }
+  /**
+   * Re-resolve this session's grant on request (`KoraSyncServer.refreshScopes`), for
+   * the user named. A streaming session whose principal is that user re-authenticates
+   * now and ends with a retriable `SCOPE_CHANGED` when its grant changed (or
+   * `AUTH_REVOKED` when the credential is no longer accepted). A session still in its
+   * handshake may have resolved its grant from membership read before the change, so
+   * it re-checks as soon as it reaches streaming; a session whose principal is not
+   * known yet does the same (the re-check is a no-op for a grant that did not change).
+   *
+   * @param userId - The user whose grant changed
+   * @returns The revalidation outcome, `'deferred'` when the check waits for the
+   *   handshake, or `'skipped'` for another user's (or a closed) session
+   */
+  async refreshScopes(userId) {
+    if (this.state === "closed") return "skipped";
+    const principal = this.principal;
+    if (principal && principal.userId !== userId) return "skipped";
+    if (!principal || this.state !== "streaming" && this.state !== "syncing") {
+      this.scopeRefreshPending = true;
+      return "deferred";
+    }
+    return this.revalidateCredential();
+  }
+  /** Run a re-check deferred by {@link refreshScopes} once the session streams. */
+  runDeferredScopeRefresh() {
+    if (!this.scopeRefreshPending) return;
+    this.scopeRefreshPending = false;
+    void this.revalidateCredential().then((outcome) => {
+      if (outcome !== "error") return;
+      this.logger?.log({
+        timestamp: Date.now(),
+        level: "warn",
+        event: "session.revalidation_failed",
+        sessionId: this.sessionId,
+        details: { reason: "deferred scope refresh" }
+      });
+    });
+  }
   /**
    * True when `context` (a fresh authentication of this session's principal)
    * resolves to download or upload scopes other than the ones this session holds.
@@ -9227,7 +9559,7 @@ var ClientSession = class _ClientSession {
     if (this.state !== "streaming" && this.state !== "syncing") return false;
     const resolution = this.computeSessionScopes(context, this.handshakeScope);
     if (!resolution.ok) return true;
-    return !sameScopeMap(resolution.downlink, this.authContext?.downlinkScopes) || !sameScopeMap(resolution.uplink, this.authContext?.uplinkScopes);
+    return !sameNormalizedScopeMap(resolution.downlink, this.authContext?.downlinkScopes) || !sameNormalizedScopeMap(resolution.uplink, this.authContext?.uplinkScopes);
   }
   /**
    * End this session because an admin released its node id (RT-5). Retriable: a
@@ -9277,7 +9609,7 @@ var ClientSession = class _ClientSession {
     this.appHeartbeatTimer = setInterval(() => {
       if (this.state === "closed") return;
       if (Date.now() - this.lastClientSendAtMs < interval / 2) return;
-      this.sendToClient({ type: "heartbeat", messageId: (0, import_core30.generateUUIDv7)() });
+      this.sendToClient({ type: "heartbeat", messageId: (0, import_core31.generateUUIDv7)() });
     }, interval);
     this.appHeartbeatTimer.unref?.();
   }
@@ -9370,18 +9702,35 @@ var ClientSession = class _ClientSession {
     const scopes = this.authContext?.downlinkScopes ?? this.authContext?.scopes;
     return recordMatchesScopes(collection, { ...storedRecord ?? {}, id: recordId }, scopes);
   }
-  /**
-   * A stable key for this session's download scope. Presence (awareness) is only
-   * relayed between sessions that share exactly the same key, so it never crosses a
-   * tenant boundary. Unscoped sessions share the key `"*"`.
-   */
   /** This session's download scope, or undefined when it is unscoped. */
   getDownlinkScopes() {
     return this.authContext?.downlinkScopes ?? this.authContext?.scopes;
   }
+  /**
+   * A stable key for this session's download scope: sessions with the same key see
+   * exactly the same data. Unscoped sessions share the key `"*"`. Cached per scope
+   * map, since a large `$in` grant makes the key costly and the relays read it often.
+   */
   getScopePartitionKey() {
     const scopes = this.authContext?.downlinkScopes ?? this.authContext?.scopes;
-    return scopes ? stableStringify(normalizeScopeMap(scopes)) : "*";
+    if (!scopes) return "*";
+    if (this.scopePartitionKeyCache?.scopes !== scopes) {
+      this.scopePartitionKeyCache = {
+        scopes,
+        key: stableStringify(normalizeScopeMap(scopes, this.maxScopePredicateValues))
+      };
+    }
+    return this.scopePartitionKeyCache.key;
+  }
+  /**
+   * Partition for presence without a cursor (a "who is online" state that names no
+   * record): only sessions with the same key see each other's. Signed-in sessions
+   * use their download scope key; every anonymous session is its own partition,
+   * because sessions holding the same anonymous grant are unrelated people.
+   */
+  getPresencePartitionKey() {
+    const key = this.getScopePartitionKey();
+    return this.principal?.anonymous === true ? `anonymous:${this.sessionId}|${key}` : key;
   }
   /**
    * Get the transport for this session.
@@ -9446,7 +9795,7 @@ var ClientSession = class _ClientSession {
       case "heartbeat":
         break;
       case "awareness-update":
-        this.handleAwarenessUpdate(message);
+        await this.handleAwarenessUpdate(message);
         break;
       case "yjs-doc-update":
         await this.handleYjsDocUpdate(message);
@@ -9497,7 +9846,7 @@ var ClientSession = class _ClientSession {
     if (this.state !== "syncing" && this.state !== "streaming") return;
     this.sendToClient({
       type: "encryption-key-response",
-      messageId: (0, import_core30.generateUUIDv7)(),
+      messageId: (0, import_core31.generateUUIDv7)(),
       keyring,
       status: "ok",
       record
@@ -9507,7 +9856,7 @@ var ClientSession = class _ClientSession {
     const refuse = (status, text3) => {
       this.sendToClient({
         type: "encryption-key-response",
-        messageId: (0, import_core30.generateUUIDv7)(),
+        messageId: (0, import_core31.generateUUIDv7)(),
         requestId: message.requestId,
         keyring: message.keyring,
         status,
@@ -9557,7 +9906,7 @@ var ClientSession = class _ClientSession {
       );
       return;
     }
-    const actual = await (0, import_core30.hashBlob)(bytes);
+    const actual = await (0, import_core31.hashBlob)(bytes);
     if (actual !== message.hash) {
       return;
     }
@@ -9622,10 +9971,15 @@ var ClientSession = class _ClientSession {
     if (!store.getNodeClaimOwner || !store.replaceNodeClaim) return { ok: false };
     const current = await store.getNodeClaimOwner(nodeId);
     if (current === null) {
-      if (!this.allowLegacyAnonymousClaims || !store.releaseNodeClaim) return { ok: false };
+      if (!this.allowLegacyAnonymousClaims) return { ok: false };
       if (this.isNodeLive?.(nodeId, this.sessionId) === true) return { ok: false };
-      if (!await store.releaseNodeClaim(nodeId)) return { ok: false };
-      if (!await store.claimNode(nodeId, owner)) return { ok: false };
+      if (store.claimUnownedNode) {
+        if (!await store.claimUnownedNode(nodeId, owner)) return { ok: false };
+      } else {
+        if (!store.releaseNodeClaim) return { ok: false };
+        if (!await store.releaseNodeClaim(nodeId)) return { ok: false };
+        if (!await store.claimNode(nodeId, owner)) return { ok: false };
+      }
       this.warnLegacyAnonymousClaim(nodeId);
       return issued;
     }
@@ -9647,6 +10001,68 @@ var ClientSession = class _ClientSession {
     if (legacy) this.warnLegacyAnonymousClaim(nodeId);
     return issued;
   }
+  /**
+   * Automatic device handover after an upgrade from beta.12 (F1). A node with
+   * history but no owner (written before node claims existed) or released by an
+   * admin is claimed for the signed-in user when the node id IS the device id the
+   * auth provider verified for this credential (`metadata.deviceId`; the built-in
+   * provider takes it from the token's `dev` claim, which names a device registered
+   * to that user). `@korajs/auth` clients use that device id as their node id and
+   * cannot change it, so without this they stay refused until an operator binds the
+   * node. The claim is one atomic store step; a node another principal owns is never
+   * taken, and another user presenting the node id is still refused.
+   *
+   * The claim decides ownership from now on only. History written under the node on
+   * beta.12 may include operations another user forged (beta.12 did not verify node
+   * ids); the operation log integrity scan is the tool for auditing it.
+   */
+  async handOverDeviceNode(nodeId, context) {
+    if (!this.deviceNodeHandover || context.anonymous === true) return false;
+    if (!this.store.claimUnownedNode) return false;
+    const deviceId = context.metadata?.deviceId;
+    if (typeof deviceId !== "string" || deviceId.length === 0 || deviceId !== nodeId) return false;
+    const previousOwner = await this.store.getNodeClaimOwner?.(nodeId) ?? null;
+    if (previousOwner !== null && previousOwner !== RELEASED_NODE_OWNER) return false;
+    if (!await this.store.claimUnownedNode(nodeId, context.userId)) return false;
+    this.logger?.log({
+      timestamp: Date.now(),
+      level: "info",
+      event: "node_claim.handover",
+      sessionId: this.sessionId,
+      nodeId,
+      details: {
+        userId: context.userId,
+        previousOwner: previousOwner === null ? "none (pre-claims history)" : "released",
+        message: "A signed-in device took over its own node id, which had history but no owner (a database upgraded from beta.12, or a node an administrator released). The node id equals the device id the auth provider verified for this user."
+      }
+    });
+    return true;
+  }
+  /**
+   * The download grant the server itself gives this session, before the client's
+   * handshake scope narrows it (F4). A client may narrow its own view, but that does
+   * not isolate tenants: another client of the same user set can ask for everything.
+   * `null` when the grant cannot be resolved here (the handshake already refused or
+   * accepted it on the full path); then nothing is judged.
+   */
+  grantWithoutHandshakeNarrowing(downlinkAuthScopes, authenticated) {
+    try {
+      return resolveSessionScopes(this.store.getSchema(), {
+        handshakeScope: void 0,
+        authScopes: downlinkAuthScopes,
+        authenticated,
+        onUnresolved: "deny"
+      });
+    } catch {
+      return null;
+    }
+  }
+  /** Who holds a refused node id, as `NODE_ID_CLAIMED` reports it (F9). */
+  async nodeOwnershipOf(nodeId) {
+    if (!this.store.getNodeClaimOwner) return void 0;
+    const owner = await this.store.getNodeClaimOwner(nodeId);
+    return owner === null || owner === RELEASED_NODE_OWNER ? "unowned" : "other-principal";
+  }
   /** The deprecation warning for an anonymous device adopted under a legacy claim (RT-21, RT-91). */
   warnLegacyAnonymousClaim(nodeId) {
     this.logger?.log({
@@ -9656,7 +10072,7 @@ var ClientSession = class _ClientSession {
       sessionId: this.sessionId,
       nodeId,
       details: {
-        message: "An anonymous device re-claimed a node id under a legacy claim (no confirmed node token, or history from before node claims). Upgrade the client; allowLegacyAnonymousClaims will default to false in the next release."
+        message: "An anonymous device re-claimed a node id under a legacy claim (no confirmed node token, or history from before node claims). Upgrade the client; allowLegacyAnonymousClaims will default to false in a later release, announced in its release notes."
       }
     });
   }
@@ -9800,14 +10216,19 @@ var ClientSession = class _ClientSession {
         } else {
           this.nodeOwnerKey = context.userId;
           claimed = await this.store.claimNode(msg.nodeId, context.userId);
+          if (!claimed) claimed = await this.handOverDeviceNode(msg.nodeId, context);
         }
         if (!claimed) {
           this.issuedNodeToken = null;
-          this.sendError(
-            "NODE_ID_CLAIMED",
-            `Node id "${msg.nodeId}" belongs to another principal, or has operation history with no recorded owner (an administrator can release it with KoraSyncServer.releaseNodeClaim). Use a fresh node id per signed-in user.`,
-            false
-          );
+          const nodeOwnership = context.anonymous === true ? void 0 : await this.nodeOwnershipOf(msg.nodeId);
+          this.sendToClient({
+            type: "error",
+            messageId: (0, import_core31.generateUUIDv7)(),
+            code: "NODE_ID_CLAIMED",
+            message: `Node id "${msg.nodeId}" belongs to another principal, or has operation history with no recorded owner (an administrator can release it with KoraSyncServer.releaseNodeClaim). Use a fresh node id per signed-in user.`,
+            retriable: false,
+            ...nodeOwnership ? { nodeOwnership } : {}
+          });
           this.close("node id claimed by another user");
           return;
         }
@@ -9873,11 +10294,23 @@ var ClientSession = class _ClientSession {
       } = this.authContext;
       this.authContext = rest;
     }
-    warnIfMultiTenantWithoutScopes(
+    if (this.unscopedSharing !== "allow" && this.auth && sharesEveryUsersData(
       this.auth,
-      authenticated ? downlinkAuthScopes : resolvedDownlinkScopes,
+      this.principal,
+      this.grantWithoutHandshakeNarrowing(downlinkAuthScopes, authenticated),
       this.store.getSchema()
-    );
+    )) {
+      if (this.unscopedSharing === "refuse") {
+        this.sendError(
+          "UNSCOPED_SHARING_REFUSED",
+          "This server refuses signed-in sessions whose grant restricts no collection (unscopedSharing: 'refuse'). Return per-user sync scopes from the auth provider.",
+          false
+        );
+        this.close("unscoped sharing refused");
+        return;
+      }
+      warnIfMultiTenantWithoutScopes(this.auth);
+    }
     if (msg.syncQueries && msg.syncQueries.length > 0) {
       this.syncQuerySubsets = (0, import_sync5.dedupeQuerySubsets)(msg.syncQueries);
     } else {
@@ -9885,7 +10318,7 @@ var ClientSession = class _ClientSession {
     }
     this.resumeDeltaCursor = msg.deltaCursor ? (0, import_sync5.decodeDeltaCursor)(msg.deltaCursor) : null;
     this.clientDeliveryWatermark = msg.lastDeliverySequence ?? null;
-    if (this.clientDeliveryWatermark !== null && !sameScopeMap(msg.syncScope, this.authContext?.downlinkScopes)) {
+    if (this.clientDeliveryWatermark !== null && !sameScopeMap(msg.syncScope, this.authContext?.downlinkScopes, this.maxScopePredicateValues)) {
       const acceptedWatermark = msg.acceptedScopeWatermark;
       const resumable = typeof msg.acceptedScopeKey === "string" && typeof acceptedWatermark === "number" && Number.isSafeInteger(acceptedWatermark) && acceptedWatermark >= 0 && msg.acceptedScopeKey === (0, import_internal8.scopeViewKey)(this.authContext?.downlinkScopes);
       this.clientDeliveryWatermark = resumable ? acceptedWatermark : 0;
@@ -9911,7 +10344,7 @@ var ClientSession = class _ClientSession {
       });
       const response2 = {
         type: "handshake-response",
-        messageId: (0, import_core30.generateUUIDv7)(),
+        messageId: (0, import_core31.generateUUIDv7)(),
         nodeId: this.store.getNodeId(),
         versionVector: {},
         schemaVersion: this.schemaVersion,
@@ -9952,7 +10385,7 @@ var ClientSession = class _ClientSession {
     const heartbeat = msg.supportsHeartbeat === true && this.appHeartbeatIntervalMs > 0;
     const response = {
       type: "handshake-response",
-      messageId: (0, import_core30.generateUUIDv7)(),
+      messageId: (0, import_core31.generateUUIDv7)(),
       nodeId: this.store.getNodeId(),
       versionVector: (0, import_sync5.versionVectorToWire)(visibleServerVector),
       schemaVersion: this.schemaVersion,
@@ -10009,6 +10442,7 @@ var ClientSession = class _ClientSession {
     }
     this.onReady?.(this.sessionId);
     if (heartbeat) this.startAppHeartbeat();
+    this.runDeferredScopeRefresh();
     if (this.takeOrphanedRelays && this.clientNodeId) {
       const buffered = this.takeOrphanedRelays(this.clientNodeId);
       if (buffered.length > 0) {
@@ -10115,8 +10549,8 @@ var ClientSession = class _ClientSession {
       };
     }
     try {
-      const downlink = rawDownlink ? normalizeScopeMap(rawDownlink) : directionalScopesConfigured ? {} : void 0;
-      const uplink = rawUplink ? normalizeScopeMap(rawUplink) : directionalScopesConfigured ? {} : void 0;
+      const downlink = rawDownlink ? normalizeScopeMap(rawDownlink, this.maxScopePredicateValues) : directionalScopesConfigured ? {} : void 0;
+      const uplink = rawUplink !== void 0 && rawUplink === rawDownlink ? downlink : rawUplink ? normalizeScopeMap(rawUplink, this.maxScopePredicateValues) : directionalScopesConfigured ? {} : void 0;
       return { ok: true, downlink, uplink, downlinkAuthScopes, authenticated };
     } catch (error) {
       return {
@@ -10410,7 +10844,7 @@ var ClientSession = class _ClientSession {
     const lastOp = operations2[operations2.length - 1];
     const ack = {
       type: "acknowledgment",
-      messageId: (0, import_core30.generateUUIDv7)(),
+      messageId: (0, import_core31.generateUUIDv7)(),
       acknowledgedMessageId: msg.messageId,
       lastSequenceNumber: lastOp ? Math.min(acknowledgedThrough, lastOp.sequenceNumber) : 0
     };
@@ -10510,7 +10944,7 @@ var ClientSession = class _ClientSession {
   schemaView(op) {
     let view;
     try {
-      view = (0, import_core29.operationSchemaView)(op, this.schemaVersion, this.operationTransforms);
+      view = (0, import_core30.operationSchemaView)(op, this.schemaVersion, this.operationTransforms);
     } catch (error) {
       return {
         ok: false,
@@ -10571,7 +11005,7 @@ var ClientSession = class _ClientSession {
       if (integrity.ok && integrity.restoredData !== void 0) {
         this.restoredLegacyData.set(op, integrity.restoredData);
       }
-      if (integrity.ok && declared === void 0 && integrity.restoredData === void 0 && (0, import_core29.canonicalizeLegacyOperation)(op) !== op) {
+      if (integrity.ok && declared === void 0 && integrity.restoredData === void 0 && (0, import_core30.canonicalizeLegacyOperation)(op) !== op) {
         return {
           code: import_sync5.INVALID_OPERATION_ID,
           message: `Operation "${op.id}" is a version-1 update whose previousData names fields its data lacks, but its id does not cover clearing them. No Kora client writes this shape; it is refused and never stored or relayed.`
@@ -10659,12 +11093,12 @@ var ClientSession = class _ClientSession {
   /** The handshake's explicit revocations (RT-81), when the deployment has any. */
   advertisedRevocations() {
     const revoked = (this.store.getRevokedAuthoritativeNodeIds?.() ?? []).filter(
-      (id) => !(0, import_core29.isServerNodeId)(id)
+      (id) => !(0, import_core30.isServerNodeId)(id)
     );
     return revoked.length > 0 ? { revokedAuthoritativeNodeIds: revoked } : {};
   }
   advertisedAuthoritativeNodeIds() {
-    return [...new Set(this.serverAuthoritativeNodeIds())].filter((id) => !(0, import_core29.isServerNodeId)(id));
+    return [...new Set(this.serverAuthoritativeNodeIds())].filter((id) => !(0, import_core30.isServerNodeId)(id));
   }
   /** Node ids this server authors operations under (protocol v2 handshake response). */
   serverAuthoritativeNodeIds() {
@@ -10677,7 +11111,7 @@ var ClientSession = class _ClientSession {
    * payloads have no envelope binding.
    */
   warnLegacyProtocol(nodeId) {
-    const message = `Client node "${nodeId}" speaks sync protocol ${String(this.clientProtocolVersion)}; this server speaks ${String(import_sync5.SYNC_PROTOCOL_VERSION)}. Protocol 1 clients (Kora <= beta.12) are accepted in beta.13 only and will be refused by the next release. Upgrade the client.`;
+    const message = `Client node "${nodeId}" speaks sync protocol ${String(this.clientProtocolVersion)}; this server speaks ${String(import_sync5.SYNC_PROTOCOL_VERSION)}. Protocol 1 clients (Kora <= beta.12) are deprecated and will be refused by a later release, announced in its release notes. Upgrade the client.`;
     this.logger?.log({
       timestamp: Date.now(),
       level: "warn",
@@ -10727,7 +11161,7 @@ var ClientSession = class _ClientSession {
     if (missing.length === 0) {
       const emptyBatch = {
         type: "operation-batch",
-        messageId: (0, import_core30.generateUUIDv7)(),
+        messageId: (0, import_core31.generateUUIDv7)(),
         operations: [],
         isFinal: true,
         batchIndex: 0,
@@ -10742,7 +11176,7 @@ var ClientSession = class _ClientSession {
     if (afterCursor.length === 0) {
       const emptyBatch = {
         type: "operation-batch",
-        messageId: (0, import_core30.generateUUIDv7)(),
+        messageId: (0, import_core31.generateUUIDv7)(),
         operations: [],
         isFinal: true,
         batchIndex: this.resumeDeltaCursor?.batchIndex ?? 0,
@@ -10758,7 +11192,7 @@ var ClientSession = class _ClientSession {
       const batchCursor = (0, import_sync5.createDeltaCursorFromBatch)(batchOps, i);
       const batchMsg = {
         type: "operation-batch",
-        messageId: (0, import_core30.generateUUIDv7)(),
+        messageId: (0, import_core31.generateUUIDv7)(),
         operations: serializedOps,
         isFinal: i === totalBatches - 1,
         batchIndex: i,
@@ -10868,26 +11302,22 @@ var ClientSession = class _ClientSession {
         !(clientNodeId !== null && delivered.operation.nodeId === clientNodeId && delivered.deliverySequence > this.ownOperationsIncludedThrough)
       )
     );
-    this.recordLookupCache = await this.prefetchRecordsFor(candidates);
-    try {
-      for (const delivered of candidates) {
-        const snapshot = delivered.scopeSnapshot ?? null;
-        if (await this.operationVisibleToClient(delivered.operation, snapshot)) {
-          const entry = await this.scopeEntryFor(delivered.operation, snapshot);
-          if (entry) {
-            deliverable.push({
-              operation: entry,
-              deliverySequence: delivered.deliverySequence,
-              scopeEntry: true
-            });
-          }
-          deliverable.push(delivered);
-        } else if (await this.scopeRetractionFor(delivered.operation, snapshot)) {
-          deliverable.push({ ...delivered, retraction: true });
+    const rows = await this.prefetchRecordsFor(candidates);
+    for (const delivered of candidates) {
+      const snapshot = delivered.scopeSnapshot ?? null;
+      if (await this.operationVisibleToClient(delivered.operation, snapshot, rows)) {
+        const entry = await this.scopeEntryFor(delivered.operation, snapshot, rows);
+        if (entry) {
+          deliverable.push({
+            operation: entry,
+            deliverySequence: delivered.deliverySequence,
+            scopeEntry: true
+          });
         }
+        deliverable.push(delivered);
+      } else if (await this.scopeRetractionFor(delivered.operation, snapshot, rows)) {
+        deliverable.push({ ...delivered, retraction: true });
       }
-    } finally {
-      this.recordLookupCache = null;
     }
     return deliverable;
   }
@@ -10930,7 +11360,7 @@ var ClientSession = class _ClientSession {
   sendDeliveryBatch(slice, base, max, batchIndex, isFinal) {
     const batchMsg = {
       type: "operation-batch",
-      messageId: (0, import_core30.generateUUIDv7)(),
+      messageId: (0, import_core31.generateUUIDv7)(),
       operations: slice.filter((delivered) => !delivered.retraction).map((delivered) => this.serializer.encodeOperation(delivered.operation)),
       ...slice.some((delivered) => delivered.retraction) ? {
         retractions: slice.filter((delivered) => delivered.retraction).map((delivered) => ({
@@ -10972,7 +11402,7 @@ var ClientSession = class _ClientSession {
    * row. Operations without a snapshot (legacy rows, custom stores) fall back to the
    * current row plus `op.data`.
    */
-  async operationVisibleToClient(stored, snapshot = null) {
+  async operationVisibleToClient(stored, snapshot = null, rows = null) {
     const judged = this.schemaView(stored);
     const op = judged.ok ? judged.op : stored;
     const scopes = this.authContext?.downlinkScopes ?? this.authContext?.scopes;
@@ -10981,18 +11411,18 @@ var ClientSession = class _ClientSession {
       let current;
       let post = snapshot.post;
       if (snapshotLacksScopeFields(op.collection, { pre: null, post }, scopes)) {
-        current = await this.lookupRecordFields(op.collection, op.recordId);
+        current = await this.lookupRecordFields(op.collection, op.recordId, rows);
         post = snapshotValuesWithFallback(op.collection, post, scopes, current);
       }
       if (!post || !recordMatchesScopes(op.collection, { ...post, id: op.recordId }, scopes)) {
         return false;
       }
       if (subsets.length === 0) return true;
-      current ??= await this.lookupRecordFields(op.collection, op.recordId);
+      current ??= await this.lookupRecordFields(op.collection, op.recordId, rows);
       return (0, import_sync5.operationMatchesQuerySubsets)(op, subsets, current);
     }
     const needsBackfill = missingScopeFields(op, scopes).length > 0 || subsets !== void 0 && subsets.length > 0;
-    const fullRecord = needsBackfill ? await this.lookupRecordFields(op.collection, op.recordId) : void 0;
+    const fullRecord = needsBackfill ? await this.lookupRecordFields(op.collection, op.recordId, rows) : void 0;
     if (!operationMatchesScopes(op, scopes, fullRecord)) {
       return false;
     }
@@ -11218,11 +11648,11 @@ var ClientSession = class _ClientSession {
    * operation without a snapshot never produces a retraction (fail quiet: the
    * client keeps what it already had, and no other tenant's record id leaks).
    */
-  async scopeRetractionFor(op, snapshot = null) {
+  async scopeRetractionFor(op, snapshot = null, rows = null) {
     if (this.scopeExitPolicy !== "retract") return false;
     const scopes = this.authContext?.downlinkScopes ?? this.authContext?.scopes;
     if (!scopes || !snapshot) return false;
-    const current = snapshotLacksScopeFields(op.collection, snapshot, scopes) ? await this.lookupRecordFields(op.collection, op.recordId) : void 0;
+    const current = snapshotLacksScopeFields(op.collection, snapshot, scopes) ? await this.lookupRecordFields(op.collection, op.recordId, rows) : void 0;
     return snapshotExitsScopes(op, snapshot, scopes, current);
   }
   /**
@@ -11233,14 +11663,14 @@ var ClientSession = class _ClientSession {
    * deleted, gets no entry: its later operations retract or delete it anyway).
    * Operations without a snapshot (legacy rows, custom stores) never produce one.
    */
-  async scopeEntryFor(op, snapshot) {
+  async scopeEntryFor(op, snapshot, rows = null) {
     const scopes = this.authContext?.downlinkScopes ?? this.authContext?.scopes;
     const schema = this.store.getSchema();
     if (!scopes || !snapshot || !schema || op.type !== "update") return null;
     if (!snapshotLacksScopeFields(op.collection, snapshot, scopes) && !snapshotEntersScopes(op, snapshot, scopes)) {
       return null;
     }
-    const current = await this.lookupRecordFields(op.collection, op.recordId);
+    const current = await this.lookupRecordFields(op.collection, op.recordId, rows);
     if (!current || current._deleted === 1 || current._deleted === true) return null;
     if (!snapshotEntersScopes(op, snapshot, scopes, current)) return null;
     if (!recordMatchesScopes(op.collection, { ...current, id: op.recordId }, scopes)) return null;
@@ -11274,23 +11704,65 @@ var ClientSession = class _ClientSession {
    * query-subset backfill. Includes soft-deleted rows so a relayed delete (whose op
    * carries no fields) is still judged against the record's actual scope. Returns
    * undefined when the record cannot be read (never materialized, or no schema).
+   * `rows` are the rows one delivery pass prefetched for its own decisions.
    */
-  async lookupRecordFields(collection, recordId) {
-    const cached = this.recordLookupCache?.get(recordCacheKey(collection, recordId));
+  async lookupRecordFields(collection, recordId, rows = null) {
+    const cached = rows?.get(recordCacheKey(collection, recordId));
     if (cached !== void 0) return cached ?? void 0;
     try {
-      const rows = await this.store.queryCollection(collection, {
+      const rows2 = await this.store.queryCollection(collection, {
         where: { id: recordId },
         includeDeleted: true,
         limit: 1
       });
-      return rows[0];
+      return rows2[0];
     } catch {
       return void 0;
     }
   }
-  handleAwarenessUpdate(msg) {
-    this.onAwarenessUpdate?.(this.sessionId, msg);
+  /**
+   * Hand an awareness update to the server's relay, with the record its cursor
+   * names, read from the store, so the relay can deliver it only to sessions whose
+   * download scope contains that record (the rule of the Yjs doc channel).
+   * Awareness is purely ephemeral: nothing is persisted.
+   */
+  async handleAwarenessUpdate(msg) {
+    if (!this.onAwarenessUpdate) return;
+    const state = msg.states[String(msg.clientId)];
+    const cursor = state ? state.cursor : void 0;
+    if (cursor === void 0 || cursor === null) {
+      this.onAwarenessUpdate(this.sessionId, msg);
+      return;
+    }
+    const collection = cursor.collection;
+    const recordId = cursor.recordId;
+    if (typeof cursor !== "object" || typeof collection !== "string" || typeof recordId !== "string" || !isStorableIdentifier(collection) || !isStorableIdentifier(recordId)) {
+      this.onAwarenessUpdate(this.sessionId, msg, { invalid: true });
+      return;
+    }
+    let read = this.presenceRecords.peek(collection, recordId);
+    if (read === void 0) {
+      if (!this.presenceLookupLimiter.allow(1)) {
+        this.onAwarenessUpdate(this.sessionId, msg, { invalid: true });
+        return;
+      }
+      try {
+        read = await this.presenceRecords.read(collection, recordId);
+        const key = presenceRecordKey(collection, recordId);
+        for (let attempt = 0; attempt < MAX_PRESENCE_REREADS && this.presenceRecords.touchedSince(key, read.asOf); attempt++) {
+          read = await this.presenceRecords.read(collection, recordId);
+        }
+      } catch {
+        this.onAwarenessUpdate(this.sessionId, msg, { invalid: true });
+        return;
+      }
+    }
+    this.onAwarenessUpdate(this.sessionId, msg, {
+      collection,
+      recordId,
+      stored: read.stored,
+      asOf: read.asOf
+    });
   }
   /**
    * A Yjs doc-channel update is a write to a richtext field: the sender must be
@@ -11336,7 +11808,7 @@ var ClientSession = class _ClientSession {
   sendError(code, message, retriable) {
     const errorMsg = {
       type: "error",
-      messageId: (0, import_core30.generateUUIDv7)(),
+      messageId: (0, import_core31.generateUUIDv7)(),
       code,
       message,
       retriable
@@ -11352,7 +11824,7 @@ var ClientSession = class _ClientSession {
   sendOperationRejected(op, code, message, retriable) {
     const rejectedMsg = {
       type: "operation-rejected",
-      messageId: (0, import_core30.generateUUIDv7)(),
+      messageId: (0, import_core31.generateUUIDv7)(),
       operationId: op.id,
       collection: op.collection,
       recordId: op.recordId,
@@ -11385,13 +11857,16 @@ function operationIdentifiersStorable(op) {
 
 // src/server/kora-sync-server.ts
 init_cjs_shims();
-var import_core34 = require("@korajs/core");
+var import_core35 = require("@korajs/core");
 var import_internal9 = require("@korajs/core/internal");
 var import_sync7 = require("@korajs/sync");
 
+// package.json
+var version = "1.0.0-beta.14";
+
 // src/awareness/awareness-relay.ts
 init_cjs_shims();
-var import_core31 = require("@korajs/core");
+var import_core32 = require("@korajs/core");
 var DEFAULT_PARTITION = "*";
 var AwarenessRelay = class {
   clients = /* @__PURE__ */ new Map();
@@ -11400,34 +11875,41 @@ var AwarenessRelay = class {
    * calls for an already-registered session are ignored, so a client cannot rebind
    * itself to another client's id.
    *
+   * The new client is sent every existing state it may see (catch-up): a state with
+   * an audience when the audience admits the new session, otherwise a state of the
+   * same partition.
+   *
    * @param sessionId - Unique session identifier
    * @param clientId - Client-assigned awareness ID
    * @param transport - Transport for sending messages to this client
-   * @param partition - Presence partition (clients only see their own partition)
+   * @param partition - Presence partition for states relayed without an audience
    */
   addClient(sessionId, clientId, transport, partition = DEFAULT_PARTITION) {
     if (this.clients.has(sessionId)) return;
-    this.clients.set(sessionId, {
+    const joining = {
       sessionId,
       clientId,
       transport,
       state: null,
-      partition
-    });
+      partition,
+      audience: null,
+      deliveredTo: /* @__PURE__ */ new Set()
+    };
+    this.clients.set(sessionId, joining);
     const existingStates = {};
     let hasStates = false;
     for (const [, client] of this.clients) {
       if (client.sessionId === sessionId) continue;
-      if (client.partition !== partition) continue;
-      if (client.state) {
-        existingStates[String(client.clientId)] = client.state;
-        hasStates = true;
-      }
+      if (!client.state) continue;
+      if (!this.mayReceive(client, joining)) continue;
+      existingStates[String(client.clientId)] = client.state;
+      client.deliveredTo.add(sessionId);
+      hasStates = true;
     }
     if (hasStates) {
       const catchUpMsg = {
         type: "awareness-update",
-        messageId: (0, import_core31.generateUUIDv7)(),
+        messageId: (0, import_core32.generateUUIDv7)(),
         clientId: 0,
         // Server-sourced
         states: existingStates
@@ -11444,7 +11926,7 @@ var AwarenessRelay = class {
     return this.clients.has(sessionId);
   }
   /**
-   * Remove a client and broadcast its removal to the remaining clients in its partition.
+   * Remove a client and send its removal to every client that was shown its state.
    *
    * @param sessionId - Session ID of the disconnecting client
    */
@@ -11452,17 +11934,26 @@ var AwarenessRelay = class {
     const client = this.clients.get(sessionId);
     if (!client) return;
     this.clients.delete(sessionId);
-    if (client.state === null) return;
-    const removalStates = {
-      [String(client.clientId)]: null
-    };
-    const msg = {
-      type: "awareness-update",
-      messageId: (0, import_core31.generateUUIDv7)(),
-      clientId: client.clientId,
-      states: removalStates
-    };
-    this.broadcastExcept(sessionId, client.partition, msg);
+    for (const [, other] of this.clients) other.deliveredTo.delete(sessionId);
+    if (client.deliveredTo.size === 0) return;
+    const msg = this.removalMessage(client);
+    for (const targetId of client.deliveredTo) {
+      const target = this.clients.get(targetId);
+      if (target?.transport.isConnected()) target.transport.send(msg);
+    }
+    client.deliveredTo.clear();
+  }
+  /**
+   * True when {@link handleUpdate} would take this update: the session is registered,
+   * the update is stamped with its bound `clientId` and carries that client's entry.
+   *
+   * @param sessionId - Session ID of the sending client
+   * @param message - The awareness update message
+   */
+  accepts(sessionId, message) {
+    const sender = this.clients.get(sessionId);
+    if (!sender || message.clientId !== sender.clientId) return false;
+    return String(sender.clientId) in message.states;
   }
   /**
    * Handle an incoming awareness update from a registered client.
@@ -11470,12 +11961,17 @@ var AwarenessRelay = class {
    * Only the sender's own entry is accepted: the message must be stamped with the
    * sender's bound `clientId`, and only `states[clientId]` is stored and relayed.
    * Entries for other clients are dropped, so a sender cannot overwrite or remove
-   * anyone else's presence. The sanitized update reaches only the sender's partition.
+   * anyone else's presence.
+   *
+   * The state is sent to every other client the audience admits (without an
+   * audience: every client of the sender's partition). A client that was shown an
+   * earlier state of the sender but is not admitted now receives a removal.
    *
    * @param sessionId - Session ID of the sending client
    * @param message - The awareness update message
+   * @param audience - Who may see this state; omitted means the sender's partition
    */
-  handleUpdate(sessionId, message) {
+  handleUpdate(sessionId, message, audience) {
     const sender = this.clients.get(sessionId);
     if (!sender) return;
     if (message.clientId !== sender.clientId) return;
@@ -11483,13 +11979,66 @@ var AwarenessRelay = class {
     if (!(key in message.states)) return;
     const senderState = message.states[key] ?? null;
     sender.state = senderState;
+    sender.audience = audience ?? null;
     const sanitized = {
       type: "awareness-update",
       messageId: message.messageId,
       clientId: sender.clientId,
       states: { [key]: senderState }
     };
-    this.broadcastExcept(sessionId, sender.partition, sanitized);
+    let removal = null;
+    for (const [, client] of this.clients) {
+      if (client.sessionId === sessionId) continue;
+      const visible = senderState !== null && this.mayReceive(sender, client);
+      if (visible) {
+        if (!client.transport.isConnected()) continue;
+        client.transport.send(sanitized);
+        sender.deliveredTo.add(client.sessionId);
+      } else if (sender.deliveredTo.delete(client.sessionId)) {
+        if (!client.transport.isConnected()) continue;
+        removal ??= senderState === null ? sanitized : this.removalMessage(sender);
+        client.transport.send(removal);
+      }
+    }
+  }
+  /**
+   * Re-decide who may see a client's current state after the record its cursor names
+   * changed (F16): it moved into or out of a session's grant. Sessions that may no
+   * longer see the state get a removal; sessions that may see it now and were not
+   * shown it get the state. Later catch-ups use the new audience.
+   *
+   * @param sessionId - The client whose audience changed
+   * @param audience - The new audience
+   */
+  updateAudience(sessionId, audience) {
+    const sender = this.clients.get(sessionId);
+    if (!sender) return;
+    sender.audience = audience;
+    if (sender.state === null) return;
+    const key = String(sender.clientId);
+    let current = null;
+    let removal = null;
+    for (const [, client] of this.clients) {
+      if (client.sessionId === sessionId) continue;
+      const visible = this.mayReceive(sender, client);
+      const shown = sender.deliveredTo.has(client.sessionId);
+      if (visible && !shown) {
+        if (!client.transport.isConnected()) continue;
+        current ??= {
+          type: "awareness-update",
+          messageId: (0, import_core32.generateUUIDv7)(),
+          clientId: sender.clientId,
+          states: { [key]: sender.state }
+        };
+        client.transport.send(current);
+        sender.deliveredTo.add(client.sessionId);
+      } else if (!visible && shown) {
+        sender.deliveredTo.delete(client.sessionId);
+        if (!client.transport.isConnected()) continue;
+        removal ??= this.removalMessage(sender);
+        client.transport.send(removal);
+      }
+    }
   }
   /**
    * Get the number of registered awareness clients.
@@ -11504,14 +12053,23 @@ var AwarenessRelay = class {
     this.clients.clear();
   }
   // --- Private ---
-  broadcastExcept(excludeSessionId, partition, message) {
-    for (const [, client] of this.clients) {
-      if (client.sessionId === excludeSessionId) continue;
-      if (client.partition !== partition) continue;
-      if (!client.transport.isConnected()) continue;
-      client.transport.send(message);
+  /** True when `target` may see `source`'s current state. Fails closed. */
+  mayReceive(source, target) {
+    if (source.audience === null) return source.partition === target.partition;
+    try {
+      return source.audience(target.sessionId);
+    } catch {
+      return false;
     }
   }
+  removalMessage(client) {
+    return {
+      type: "awareness-update",
+      messageId: (0, import_core32.generateUUIDv7)(),
+      clientId: client.clientId,
+      states: { [String(client.clientId)]: null }
+    };
+  }
 };
 
 // src/diagnostics/server-metrics-collector.ts
@@ -11626,8 +12184,8 @@ var ServerMetricsCollector = class {
     this.errorCount++;
   }
   /** Set the schema version. */
-  setSchemaVersion(version) {
-    this.schemaVersion = version;
+  setSchemaVersion(version2) {
+    this.schemaVersion = version2;
   }
   /** Return a full snapshot of current metrics. */
   getSnapshot(totalOperations) {
@@ -11675,7 +12233,7 @@ var ServerMetricsCollector = class {
 
 // src/richtext/blob-chunk-relay.ts
 init_cjs_shims();
-var import_core32 = require("@korajs/core");
+var import_core33 = require("@korajs/core");
 var import_sync6 = require("@korajs/sync");
 var DEFAULT_MAX_PENDING_BLOB_REQUESTS_PER_SESSION = 256;
 var DEFAULT_BLOB_REQUEST_TTL_MS = 6e4;
@@ -11766,7 +12324,7 @@ var BlobChunkRelay = class {
     } catch {
       return;
     }
-    if (await (0, import_core32.hashBlob)(decoded) !== entry.hash) {
+    if (await (0, import_core33.hashBlob)(decoded) !== entry.hash) {
       return;
     }
     if (this.pending.get(message.requestId) !== entry) {
@@ -11904,7 +12462,7 @@ var YjsDocRelay = class {
 
 // src/server/route-context.ts
 init_cjs_shims();
-var import_core33 = require("@korajs/core");
+var import_core34 = require("@korajs/core");
 init_ingest_validation();
 
 // src/apply/route-predicate.ts
@@ -11990,12 +12548,12 @@ async function buildRouteOperation(store, mutation, currentOverride, clockOverri
   const schemaVersion = store.getSchema()?.version ?? 1;
   const sequenceNumber = nextServerSequenceNumber(store);
   if (mutation.type === "insert") {
-    return (0, import_core33.createOperation)(
+    return (0, import_core34.createOperation)(
       {
         nodeId,
         type: "insert",
         collection: mutation.collection,
-        recordId: mutation.recordId ?? (0, import_core33.generateUUIDv7)(),
+        recordId: mutation.recordId ?? (0, import_core34.generateUUIDv7)(),
         data: mutation.data ?? {},
         previousData: null,
         sequenceNumber,
@@ -12018,14 +12576,14 @@ async function buildRouteOperation(store, mutation, currentOverride, clockOverri
     const atomicOps = {};
     for (const key of Object.keys(rawData)) {
       const value = rawData[key];
-      if ((0, import_core33.isAtomicOp)(value)) {
-        data[key] = (0, import_core33.resolveAtomicOp)(current ? current[key] : void 0, value);
-        atomicOps[key] = (0, import_core33.toAtomicOp)(value);
+      if ((0, import_core34.isAtomicOp)(value)) {
+        data[key] = (0, import_core34.resolveAtomicOp)(current ? current[key] : void 0, value);
+        atomicOps[key] = (0, import_core34.toAtomicOp)(value);
       } else {
         data[key] = value;
       }
     }
-    return (0, import_core33.createOperation)(
+    return (0, import_core34.createOperation)(
       {
         nodeId,
         type: "update",
@@ -12041,7 +12599,7 @@ async function buildRouteOperation(store, mutation, currentOverride, clockOverri
       clock
     );
   }
-  return (0, import_core33.createOperation)(
+  return (0, import_core34.createOperation)(
     {
       nodeId,
       type: "delete",
@@ -12411,7 +12969,7 @@ function resolvePerMessageDeflate(option) {
 }
 function validateIntervalOption(name, value) {
   if (!Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
-    throw new import_core34.SyncError(`${name} must be a non-negative integer number of milliseconds`, {
+    throw new import_core35.SyncError(`${name} must be a non-negative integer number of milliseconds`, {
       [name]: value
     });
   }
@@ -12437,6 +12995,18 @@ var KoraSyncServer = class _KoraSyncServer {
   logger;
   metrics;
   awarenessRelay = new AwarenessRelay();
+  /** Reads the records presence cursors name, for every session (F16). */
+  presenceRecords;
+  /** The record each session's current presence cursor names (F16). */
+  presenceTargets = /* @__PURE__ */ new Map();
+  /** The sessions whose presence cursor names each record, by record key. */
+  presenceTargetsByKey = /* @__PURE__ */ new Map();
+  /**
+   * Audience re-decisions running, one per record: a write while one runs marks it
+   * dirty, so it reads again and the last decision applied is always from a read that
+   * began after the last write (never an older read finishing late).
+   */
+  presenceRefreshes = /* @__PURE__ */ new Map();
   yjsDocRelay = new YjsDocRelay();
   blobChunkRelay;
   /** Wrapped encryption key records (ENC-1, D4b), persisted in the server store. */
@@ -12449,8 +13019,11 @@ var KoraSyncServer = class _KoraSyncServer {
   /** Per-principal ingest budget per minute; 0 when disabled. */
   maxOpsPerMinutePerUser;
   allowLegacyAnonymousClaims;
+  deviceNodeHandover;
+  unscopedSharing;
   anonymousClaimTtlMs;
   maxOpsPerBatch;
+  maxScopePredicateValues;
   maxMessageBytes;
   heartbeatIntervalMs;
   appHeartbeatIntervalMs;
@@ -12482,9 +13055,10 @@ var KoraSyncServer = class _KoraSyncServer {
   /** Internal ClientSession id -> HTTP session id, for cleanup on close. */
   httpSessionIdBySession = /* @__PURE__ */ new Map();
   httpSessionIdleTimeoutMs;
-  // Informational value reported by getStatus(). Keep in sync with the
-  // @korajs/server package version on release; it is not used for protocol negotiation.
-  serverVersion = "1.0.0-beta.0";
+  // The @korajs/server package version, reported by getStatus() and /health so
+  // operators can tell which release is deployed. Read from package.json (inlined by
+  // the build), never hand-maintained. Not used for protocol negotiation.
+  serverVersion = version;
   wsServer = null;
   running = false;
   /**
@@ -12517,9 +13091,10 @@ var KoraSyncServer = class _KoraSyncServer {
   static ORPHANED_RELAY_TTL_MS = 5 * 6e4;
   constructor(config) {
     this.store = config.store;
+    this.presenceRecords = new PresenceRecords(config.store);
     const storeSchemaVersion = this.store.getSchema()?.version;
     if (config.schemaVersion !== void 0 && storeSchemaVersion !== void 0 && config.schemaVersion !== storeSchemaVersion) {
-      throw new import_core34.SyncError("Sync schema version does not match the configured store schema.", {
+      throw new import_core35.SyncError("Sync schema version does not match the configured store schema.", {
         syncSchemaVersion: config.schemaVersion,
         storeSchemaVersion
       });
@@ -12610,13 +13185,21 @@ var KoraSyncServer = class _KoraSyncServer {
     }
     this.maxOpsPerMinutePerUser = config.maxOpsPerMinutePerUser ?? (config.maxOpsPerMinute ?? DEFAULT_MAX_OPS_PER_MINUTE) * DEFAULT_USER_BUDGET_MULTIPLIER;
     this.allowLegacyAnonymousClaims = config.allowLegacyAnonymousClaims;
+    this.deviceNodeHandover = config.deviceNodeHandover;
+    this.unscopedSharing = config.unscopedSharing;
     this.anonymousClaimTtlMs = config.anonymousClaimTtlMs;
     if (config.maxOpsPerBatch !== void 0 && (!Number.isInteger(config.maxOpsPerBatch) || config.maxOpsPerBatch < 1)) {
-      throw new import_core34.SyncError("maxOpsPerBatch must be a positive integer", {
+      throw new import_core35.SyncError("maxOpsPerBatch must be a positive integer", {
         maxOpsPerBatch: config.maxOpsPerBatch
       });
     }
     this.maxOpsPerBatch = config.maxOpsPerBatch;
+    if (config.maxScopePredicateValues !== void 0 && (!Number.isInteger(config.maxScopePredicateValues) || config.maxScopePredicateValues < 1)) {
+      throw new import_core35.SyncError("maxScopePredicateValues must be a positive integer", {
+        maxScopePredicateValues: config.maxScopePredicateValues
+      });
+    }
+    this.maxScopePredicateValues = config.maxScopePredicateValues;
     this.validateOperation = config.validateOperation;
     this.koraContext = createRouteContext(this, this.store);
     if (!this.emitter) {
@@ -12661,7 +13244,7 @@ var KoraSyncServer = class _KoraSyncServer {
    */
   terminateSessions(filter) {
     if (filter.userId === void 0 && filter.deviceId === void 0) {
-      throw new import_core34.KoraError(
+      throw new import_core35.KoraError(
         "terminateSessions needs a userId or a deviceId; refusing to end every session.",
         "INVALID_TERMINATE_FILTER",
         { fix: "Pass { userId } to end a user, or { userId, deviceId } to end one device." }
@@ -12799,6 +13382,65 @@ var KoraSyncServer = class _KoraSyncServer {
     });
     return run;
   }
+  /**
+   * Re-resolve one user's grant on every live session of that user now, instead of
+   * waiting for the next revalidation pass (`sessionRevalidationIntervalMs`). Call it
+   * after a membership change the auth provider's grant depends on: an invitation
+   * accepted, a collaborator removed, a role changed.
+   *
+   * Each of the user's sessions re-authenticates its credential with the provider. A
+   * session whose resolved download or upload scope changed ends with a retriable
+   * `SCOPE_CHANGED`; its client reconnects at once and receives the new grant. A
+   * narrowed grant applies the client's `scopeExit` policy at that handshake
+   * (`'retract'` hides the rows that left the scope), and the device's unsynced writes
+   * outside the new upload scope are refused. A session still in its handshake
+   * re-checks as soon as it is established, so a grant read before the change never
+   * outlives this call. Sessions whose grant did not change are kept.
+   *
+   * Only this process's sessions are refreshed. Other instances apply the change at
+   * their next revalidation pass, or call this too (for example from a pub/sub
+   * message).
+   *
+   * @param userId - The user whose grant changed (the auth provider's `userId`)
+   * @returns The number of sessions this call ended
+   *
+   * @example
+   * ```typescript
+   * await removeCollaborator(documentId, bobId)
+   * await server.refreshScopes(bobId)
+   * ```
+   */
+  async refreshScopes(userId) {
+    if (typeof userId !== "string" || userId.length === 0) {
+      throw new import_core35.KoraError(
+        "refreshScopes needs the user id whose grant changed.",
+        "INVALID_REFRESH_SCOPES_USER",
+        { fix: "Pass the userId your auth provider returns for that user." }
+      );
+    }
+    let terminated = 0;
+    for (const session of [...this.sessions.values()]) {
+      const outcome = await session.refreshScopes(userId);
+      if (outcome === "terminated") terminated++;
+      if (outcome === "error") {
+        this.logger.log({
+          timestamp: Date.now(),
+          level: "warn",
+          event: "session.revalidation_failed",
+          sessionId: session.getSessionId(),
+          details: { reason: "refreshScopes", userId }
+        });
+      }
+    }
+    this.logger.log({
+      timestamp: Date.now(),
+      level: "info",
+      event: "sessions.scopes_refreshed",
+      count: terminated,
+      details: { userId }
+    });
+    return terminated;
+  }
   /** Run {@link revalidateSessions} from the delivery poll tick once the interval elapsed. */
   maybeRevalidateSessions(now = Date.now()) {
     if (this.sessionRevalidationIntervalMs <= 0) return;
@@ -12904,13 +13546,17 @@ var KoraSyncServer = class _KoraSyncServer {
     const MAX_SCANNED = 1e3;
     if (to - from > MAX_SCANNED) {
       this.blobAccess.invalidate();
+      this.refreshPresence(null);
       return;
     }
     try {
       const delivered = await this.store.getOperationsAfterDelivery(from, MAX_SCANNED);
-      this.blobAccess.invalidate(collectionsOf(delivered.map((d) => d.operation)));
+      const operations2 = delivered.map((d) => d.operation);
+      this.blobAccess.invalidate(collectionsOf(operations2));
+      this.refreshPresence(operations2);
     } catch {
       this.blobAccess.invalidate();
+      this.refreshPresence(null);
     }
   }
   /**
@@ -13057,11 +13703,11 @@ var KoraSyncServer = class _KoraSyncServer {
    */
   async start(wsServerImpl) {
     if (this.running) {
-      throw new import_core34.SyncError("Server is already running", { port: this.port });
+      throw new import_core35.SyncError("Server is already running", { port: this.port });
     }
     await this.storeTransformsReady;
     if (!wsServerImpl && this.port === void 0) {
-      throw new import_core34.SyncError(
+      throw new import_core35.SyncError(
         "Port is required for standalone mode. Provide port in config or use handleConnection() for attach mode.",
         {}
       );
@@ -13126,6 +13772,10 @@ var KoraSyncServer = class _KoraSyncServer {
     this.revocationUnsubscribe?.();
     this.revocationUnsubscribe = null;
     this.awarenessRelay.clear();
+    this.presenceTargets.clear();
+    this.presenceTargetsByKey.clear();
+    this.presenceRefreshes.clear();
+    this.presenceRecords.clear();
     this.yjsDocRelay.clear();
     this.blobChunkRelay.clear();
     for (const session of this.sessions.values()) {
@@ -13271,7 +13921,7 @@ var KoraSyncServer = class _KoraSyncServer {
     if (this.maxConnections > 0 && this.sessions.size >= this.maxConnections) {
       transport.send({
         type: "error",
-        messageId: (0, import_core34.generateUUIDv7)(),
+        messageId: (0, import_core35.generateUUIDv7)(),
         code: "MAX_CONNECTIONS",
         message: `Server has reached maximum connections (${this.maxConnections})`,
         retriable: true
@@ -13284,13 +13934,13 @@ var KoraSyncServer = class _KoraSyncServer {
         event: "connection.rejected",
         details: { reason: "max_connections", max: this.maxConnections }
       });
-      throw new import_core34.SyncError("Maximum connections reached", {
+      throw new import_core35.SyncError("Maximum connections reached", {
         current: this.sessions.size,
         max: this.maxConnections
       });
     }
     this.ensureBackgroundTimersStarted();
-    const sessionId = (0, import_core34.generateUUIDv7)();
+    const sessionId = (0, import_core35.generateUUIDv7)();
     this.metrics.recordConnection(sessionId);
     const sessionEmitter = new import_internal9.SimpleEventEmitter();
     sessionEmitter.on("sync:connected", (event) => {
@@ -13390,9 +14040,10 @@ var KoraSyncServer = class _KoraSyncServer {
       onRelay: (sourceSessionId, operations2) => {
         this.handleRelay(sourceSessionId, operations2);
       },
-      onAwarenessUpdate: (sourceSessionId, message) => {
-        this.handleAwarenessRelay(sourceSessionId, message);
+      onAwarenessUpdate: (sourceSessionId, message, cursorTarget) => {
+        this.handleAwarenessRelay(sourceSessionId, message, cursorTarget);
       },
+      presenceRecords: this.presenceRecords,
       onYjsDocUpdate: (sourceSessionId, message, storedRecord) => {
         this.handleYjsDocRelay(sourceSessionId, message, storedRecord);
       },
@@ -13425,8 +14076,11 @@ var KoraSyncServer = class _KoraSyncServer {
       ...this.maxOpsPerMinute !== void 0 ? { maxOpsPerMinute: this.maxOpsPerMinute } : {},
       ...this.blobLimits.maxRequestsPerMinute !== void 0 ? { maxBlobRequestsPerMinute: this.blobLimits.maxRequestsPerMinute } : {},
       ...this.maxOpsPerBatch !== void 0 ? { maxOpsPerBatch: this.maxOpsPerBatch } : {},
+      ...this.maxScopePredicateValues !== void 0 ? { maxScopePredicateValues: this.maxScopePredicateValues } : {},
       ...this.validateOperation ? { validateOperation: this.validateOperation, koraContext: this.koraContext } : {},
       blobAccess: this.blobAccess,
+      ...this.deviceNodeHandover !== void 0 ? { deviceNodeHandover: this.deviceNodeHandover } : {},
+      ...this.unscopedSharing !== void 0 ? { unscopedSharing: this.unscopedSharing } : {},
       ...this.allowLegacyAnonymousClaims !== void 0 ? { allowLegacyAnonymousClaims: this.allowLegacyAnonymousClaims } : {},
       ...this.anonymousClaimTtlMs !== void 0 ? { anonymousClaimTtlMs: this.anonymousClaimTtlMs } : {},
       isNodeLive: (nodeId, exceptSessionId) => this.isNodeLive(nodeId, exceptSessionId),
@@ -13496,6 +14150,7 @@ var KoraSyncServer = class _KoraSyncServer {
     const result = await applyServerOperation(this.store, op, void 0, options);
     if (result.result === "applied" && result.appliedOperations.length > 0) {
       this.blobAccess.invalidate(collectionsOf(result.appliedOperations));
+      this.refreshPresence(result.appliedOperations);
       for (const session of this.sessions.values()) {
         session.relayOperations(result.appliedOperations);
       }
@@ -13515,6 +14170,7 @@ var KoraSyncServer = class _KoraSyncServer {
       return;
     }
     this.blobAccess.invalidate(collectionsOf(operations2));
+    this.refreshPresence(operations2);
     for (const session of this.sessions.values()) {
       session.relayOperations(operations2);
     }
@@ -13543,7 +14199,7 @@ var KoraSyncServer = class _KoraSyncServer {
       const records = await this.store.materializeCollection(name);
       for (const record of records) {
         for (const value of Object.values(record)) {
-          if ((0, import_core34.isBlobRef)(value)) {
+          if ((0, import_core35.isBlobRef)(value)) {
             refs.push(value);
           }
         }
@@ -13611,6 +14267,7 @@ var KoraSyncServer = class _KoraSyncServer {
   }
   handleRelay(sourceSessionId, operations2) {
     this.blobAccess.invalidate(collectionsOf(operations2));
+    this.refreshPresence(operations2);
     const targetCount = this.sessions.size - 1;
     const byteSize = estimateOperationByteSize(operations2);
     this.metrics.recordSent(
@@ -13635,6 +14292,7 @@ var KoraSyncServer = class _KoraSyncServer {
   handleSessionClose(sessionId) {
     this.metrics.recordDisconnection(sessionId);
     this.awarenessRelay.removeClient(sessionId);
+    this.setPresenceTarget(sessionId, null);
     this.yjsDocRelay.removeClient(sessionId);
     this.blobChunkRelay.removeClient(sessionId);
     this.sessions.delete(sessionId);
@@ -13646,7 +14304,7 @@ var KoraSyncServer = class _KoraSyncServer {
       }
     }
   }
-  handleAwarenessRelay(sourceSessionId, message) {
+  handleAwarenessRelay(sourceSessionId, message, cursorTarget) {
     const session = this.sessions.get(sourceSessionId);
     if (!session || !session.isStreaming()) return;
     if (!this.awarenessRelay.hasClient(sourceSessionId)) {
@@ -13654,10 +14312,143 @@ var KoraSyncServer = class _KoraSyncServer {
         sourceSessionId,
         message.clientId,
         session.getTransport(),
-        session.getScopePartitionKey()
+        session.getPresencePartitionKey()
       );
     }
-    this.awarenessRelay.handleUpdate(sourceSessionId, message);
+    if (!this.awarenessRelay.accepts(sourceSessionId, message)) return;
+    let audience = this.awarenessAudience(session, cursorTarget);
+    if (cursorTarget !== void 0 && cursorTarget.invalid !== true) {
+      const key = presenceRecordKey(cursorTarget.collection, cursorTarget.recordId);
+      this.setPresenceTarget(sourceSessionId, {
+        collection: cursorTarget.collection,
+        recordId: cursorTarget.recordId,
+        key
+      });
+      if (cursorTarget.asOf !== void 0 && this.presenceRecords.touchedSince(key, cursorTarget.asOf)) {
+        audience = () => false;
+        this.schedulePresenceRefresh(key);
+      }
+    } else {
+      this.setPresenceTarget(sourceSessionId, null);
+    }
+    this.awarenessRelay.handleUpdate(sourceSessionId, message, audience);
+  }
+  /** Point a session's presence at a record (or at none), keeping the index in step. */
+  setPresenceTarget(sessionId, target) {
+    const previous = this.presenceTargets.get(sessionId);
+    if (previous) {
+      const sessions2 = this.presenceTargetsByKey.get(previous.key);
+      sessions2?.delete(sessionId);
+      if (sessions2?.size === 0) this.presenceTargetsByKey.delete(previous.key);
+    }
+    if (target === null) {
+      this.presenceTargets.delete(sessionId);
+      return;
+    }
+    this.presenceTargets.set(sessionId, target);
+    let sessions = this.presenceTargetsByKey.get(target.key);
+    if (!sessions) {
+      sessions = /* @__PURE__ */ new Set();
+      this.presenceTargetsByKey.set(target.key, sessions);
+    }
+    sessions.add(sessionId);
+  }
+  /**
+   * Records changed (`operations`, or anything when null): re-decide the audience of
+   * every presence cursor on one of them (F16). A record that moved out of a session's
+   * grant takes the presence on it out of that session, and one that moved in brings
+   * it, without waiting for the sender's next update; catch-ups use the new audience.
+   * Every write is noted first, so a presence read that began before it is never
+   * taken as current.
+   */
+  refreshPresence(operations2) {
+    if (operations2 === null) {
+      this.presenceRecords.touch(null);
+      for (const key of this.presenceTargetsByKey.keys()) this.schedulePresenceRefresh(key);
+      return;
+    }
+    const keys = new Set(operations2.map((op) => presenceRecordKey(op.collection, op.recordId)));
+    this.presenceRecords.touch(keys);
+    for (const key of keys) {
+      if (this.presenceTargetsByKey.has(key)) this.schedulePresenceRefresh(key);
+    }
+  }
+  /** Re-decide the presence on one record, coalesced with a re-decision already running. */
+  schedulePresenceRefresh(key) {
+    const running = this.presenceRefreshes.get(key);
+    if (running) {
+      running.dirty = true;
+      return;
+    }
+    const state = { dirty: true };
+    this.presenceRefreshes.set(key, state);
+    void this.runPresenceRefresh(key, state);
+  }
+  async runPresenceRefresh(key, state) {
+    let staleReads = 0;
+    try {
+      while (state.dirty) {
+        state.dirty = false;
+        const sessions = this.presenceTargetsByKey.get(key);
+        const first = sessions?.values().next();
+        const target = first && !first.done ? this.presenceTargets.get(first.value) : void 0;
+        if (!target) return;
+        let stored;
+        try {
+          const read = await this.presenceRecords.read(target.collection, target.recordId);
+          if (this.presenceRecords.touchedSince(key, read.asOf)) {
+            state.dirty = true;
+            if (staleReads < 2) {
+              staleReads += 1;
+              continue;
+            }
+            stored = void 0;
+          } else {
+            stored = read.stored;
+          }
+        } catch {
+          stored = void 0;
+        }
+        staleReads = 0;
+        for (const sessionId of this.presenceTargetsByKey.get(key) ?? []) {
+          const session = this.sessions.get(sessionId);
+          if (!session) continue;
+          this.awarenessRelay.updateAudience(
+            sessionId,
+            stored === void 0 ? () => false : this.awarenessAudience(session, {
+              collection: target.collection,
+              recordId: target.recordId,
+              stored
+            })
+          );
+        }
+      }
+    } finally {
+      if (this.presenceRefreshes.get(key) === state) this.presenceRefreshes.delete(key);
+    }
+  }
+  /**
+   * Who may see a presence state (F16). A state whose cursor names a record reaches
+   * exactly the sessions whose download scope contains that record, the rule of the
+   * Yjs doc channel, and only when the sender may read the record too: collaborators
+   * with different grants see each other on the documents they share, and nobody
+   * sees presence on a record outside their grant. A malformed cursor reaches
+   * nobody. A state without a cursor names no record: it reaches only sessions of
+   * the same presence partition (identical download scope; anonymous sessions are
+   * each their own partition).
+   */
+  awarenessAudience(source, cursorTarget) {
+    if (cursorTarget === void 0) {
+      const partition = source.getPresencePartitionKey();
+      return (targetSessionId) => {
+        const target = this.sessions.get(targetSessionId);
+        return target?.isStreaming() === true && target.getPresencePartitionKey() === partition;
+      };
+    }
+    if (cursorTarget.invalid === true) return () => false;
+    const { collection, recordId, stored } = cursorTarget;
+    if (!source.canReceiveRecord(collection, recordId, stored)) return () => false;
+    return (targetSessionId) => this.sessions.get(targetSessionId)?.canReceiveRecord(collection, recordId, stored) ?? false;
   }
   handleYjsDocRelay(sourceSessionId, message, storedRecord) {
     if (!this.sessions.has(sourceSessionId)) {
@@ -13733,7 +14524,7 @@ function normalizeHttpBody(body, contentType) {
 
 // src/auth/token-auth.ts
 init_cjs_shims();
-var import_core35 = require("@korajs/core");
+var import_core36 = require("@korajs/core");
 var TokenAuthProvider = class {
   validate;
   constructor(options) {
@@ -13743,7 +14534,7 @@ var TokenAuthProvider = class {
     const context = await this.validate(token);
     if (!context) return null;
     if (context.scopes === void 0 && context.downlinkScopes === void 0 && context.uplinkScopes === void 0) {
-      return { ...context, scopes: (0, import_core35.claimScopes)({ userId: context.userId }) };
+      return { ...context, scopes: (0, import_core36.claimScopes)({ userId: context.userId }) };
     }
     return context;
   }
@@ -13751,7 +14542,7 @@ var TokenAuthProvider = class {
 
 // src/auth/kora-auth-provider.ts
 init_cjs_shims();
-var import_core36 = require("@korajs/core");
+var import_core37 = require("@korajs/core");
 var KoraAuthProvider = class {
   tokenValidator;
   userLookup;
@@ -13778,7 +14569,7 @@ var KoraAuthProvider = class {
     if (this.deviceTracker) {
       await this.deviceTracker.touchDevice(payload.dev);
     }
-    const scopes = this.resolveScopes ? await this.resolveScopes(payload.sub) : (0, import_core36.claimScopes)({ userId: payload.sub });
+    const scopes = this.resolveScopes ? await this.resolveScopes(payload.sub) : (0, import_core37.claimScopes)({ userId: payload.sub });
     return {
       userId: payload.sub,
       scopes,
@@ -13833,7 +14624,7 @@ var MixedAuthProvider = class {
 };
 
 // src/index.ts
-var import_core37 = require("@korajs/core");
+var import_core38 = require("@korajs/core");
 
 // src/server/create-server.ts
 init_cjs_shims();
@@ -13848,9 +14639,9 @@ init_ingest_validation();
 // src/server/static-files.ts
 init_cjs_shims();
 var import_node_crypto = require("crypto");
-var import_node_fs = require("fs");
+var import_node_fs2 = require("fs");
 var import_promises = require("fs/promises");
-var import_node_path = require("path");
+var import_node_path2 = require("path");
 var import_node_zlib = require("zlib");
 var STATIC_MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -13906,7 +14697,7 @@ var ASSET_PREFIX = "/assets/";
 var IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
 var REVALIDATE_CACHE_CONTROL = "no-cache";
 function isContentHashedFileName(fileName) {
-  const ext = (0, import_node_path.extname)(fileName);
+  const ext = (0, import_node_path2.extname)(fileName);
   const stem = ext ? fileName.slice(0, -ext.length) : fileName;
   const match = /[.-]([A-Za-z0-9_]{8,})$/.exec(stem);
   if (!match) return false;
@@ -13942,19 +14733,25 @@ function fileVersionKey(stats) {
   return `${stats.dev}:${stats.ino}:${stats.size}:${stats.mtimeMs}:${stats.ctimeMs}`;
 }
 var DIGEST_CACHE_MAX_ENTRIES = 4096;
-function createStaticFileHandler(staticDir) {
-  const root = (0, import_node_path.resolve)(staticDir);
+function createStaticFileHandler(staticDir, options = {}) {
+  const root = (0, import_node_path2.resolve)(staticDir);
+  const spaFallback = options.spaFallback ?? "navigation";
+  const servesShell = (req, pathname) => {
+    if (pathname.startsWith(ASSET_PREFIX)) return false;
+    if (isNavigation(req)) return true;
+    return spaFallback === "extensionless" && (0, import_node_path2.extname)(pathname) === "";
+  };
   const compressed = /* @__PURE__ */ new Map();
   let compressedBytes = 0;
   const digests = /* @__PURE__ */ new Map();
   const verifiedSiblings = /* @__PURE__ */ new Map();
   async function contentDigest(path, stats) {
-    const version = fileVersionKey(stats);
+    const version2 = fileVersionKey(stats);
     const cached = digests.get(path);
-    if (cached && cached.version === version) return cached.digest;
+    if (cached && cached.version === version2) return cached.digest;
     const hash = (0, import_node_crypto.createHash)("sha256");
     await new Promise((done, fail) => {
-      const stream = (0, import_node_fs.createReadStream)(path);
+      const stream = (0, import_node_fs2.createReadStream)(path);
       stream.on("data", (chunk) => hash.update(chunk));
       stream.on("end", () => done());
       stream.on("error", fail);
@@ -13965,7 +14762,7 @@ function createStaticFileHandler(staticDir) {
       const oldest = digests.keys().next().value;
       if (oldest !== void 0) digests.delete(oldest);
     }
-    digests.set(path, { version, digest });
+    digests.set(path, { version: version2, digest });
     return digest;
   }
   function remember(key, body) {
@@ -13993,14 +14790,14 @@ function createStaticFileHandler(staticDir) {
       return null;
     }
     if (decoded.includes("\0")) return null;
-    const candidate = (0, import_node_path.resolve)((0, import_node_path.join)(root, decoded));
-    if (candidate !== root && !candidate.startsWith(root + import_node_path.sep)) return null;
+    const candidate = (0, import_node_path2.resolve)((0, import_node_path2.join)(root, decoded));
+    if (candidate !== root && !candidate.startsWith(root + import_node_path2.sep)) return null;
     return candidate;
   }
   async function containedRealPath(path) {
     try {
       const [realRoot, real] = await Promise.all([(0, import_promises.realpath)(root), (0, import_promises.realpath)(path)]);
-      return real === realRoot || real.startsWith(realRoot + import_node_path.sep) ? real : null;
+      return real === realRoot || real.startsWith(realRoot + import_node_path2.sep) ? real : null;
     } catch {
       return null;
     }
@@ -14013,12 +14810,12 @@ function createStaticFileHandler(staticDir) {
     const stats = await fileStat(real);
     if (stats?.isFile()) return { path: real, name: filePath, stats };
     if (stats?.isDirectory()) {
-      const index3 = (0, import_node_path.join)(real, "index.html");
+      const index3 = (0, import_node_path2.join)(real, "index.html");
       const realIndex = await containedRealPath(index3);
       if (realIndex === null) return null;
       const indexStats = await fileStat(realIndex);
       if (indexStats?.isFile()) {
-        return { path: realIndex, name: (0, import_node_path.join)(filePath, "index.html"), stats: indexStats };
+        return { path: realIndex, name: (0, import_node_path2.join)(filePath, "index.html"), stats: indexStats };
       }
     }
     return null;
@@ -14031,7 +14828,7 @@ function createStaticFileHandler(staticDir) {
       return;
     }
     let found = await locate(pathname);
-    if (!found && isNavigation(req) && !pathname.startsWith(ASSET_PREFIX)) {
+    if (!found && servesShell(req, pathname)) {
       found = await locate("/index.html");
     }
     if (!found) {
@@ -14043,8 +14840,8 @@ function createStaticFileHandler(staticDir) {
       return;
     }
     const { path, name, stats } = found;
-    const ext = (0, import_node_path.extname)(name).toLowerCase();
-    const fileName = (0, import_node_path.basename)(name);
+    const ext = (0, import_node_path2.extname)(name).toLowerCase();
+    const fileName = (0, import_node_path2.basename)(name);
     const cacheControl = cacheControlFor(fileName);
     const revalidated = cacheControl === REVALIDATE_CACHE_CONTROL;
     const headers = {
@@ -14088,7 +14885,7 @@ function createStaticFileHandler(staticDir) {
       res.end();
       return;
     }
-    (0, import_node_fs.createReadStream)(path).pipe(res);
+    (0, import_node_fs2.createReadStream)(path).pipe(res);
   };
   async function compressedBody(path, name, digest, encoding) {
     const sibling = await containedRealPath(`${name}${encoding === "br" ? ".br" : ".gz"}`);
@@ -14248,6 +15045,11 @@ function parseIpv6(address) {
 
 // src/server/production-server.ts
 var DEFAULT_MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+var OPERATIONAL_PATHS = {
+  admin: "/__kora, /__kora/status, /__kora/events",
+  metrics: "/__kora/metrics",
+  backup: "/__kora/backup/*"
+};
 var DEFAULT_MAX_BACKUP_BYTES = 256 * 1024 * 1024;
 function createProductionServer(config) {
   const port = config.port ?? (Number(process.env.PORT) || 3001);
@@ -14283,10 +15085,27 @@ function createProductionServer(config) {
     }
     return null;
   }
-  function isOperationalRequestAllowed(req, kind) {
+  const production = process.env.NODE_ENV === "production";
+  const allowPublic = config.operationalAuth?.allowPublic === true;
+  const OPERATIONAL_GROUPS = ["admin", "metrics", "backup"];
+  const unprotectedGroups = OPERATIONAL_GROUPS.filter((kind) => !getOperationalToken(kind));
+  function isOperationalRequestAllowed(req, res, kind) {
     const expected = getOperationalToken(kind);
-    if (!expected) return true;
-    return extractRequestToken(req) === expected;
+    if (!expected) {
+      if (!production || allowPublic) return true;
+      res.writeHead(403, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          error: `This operational endpoint is disabled: no ${kind === "admin" ? "adminToken" : `${kind}Token or adminToken`} is configured and NODE_ENV is production.`,
+          code: "OPERATIONAL_ENDPOINT_DISABLED",
+          fix: "Set operationalAuth tokens in createProductionServer, or operationalAuth.allowPublic: true to serve it without one."
+        })
+      );
+      return false;
+    }
+    if (extractRequestToken(req) === expected) return true;
+    rejectUnauthorized(res);
+    return false;
   }
   function rejectUnauthorized(res) {
     res.writeHead(401, {
@@ -14445,10 +15264,31 @@ function createProductionServer(config) {
     getLiveBlobRefs() {
       return syncServer.getLiveBlobRefs();
     },
+    refreshScopes(userId) {
+      return syncServer.refreshScopes(userId);
+    },
+    revalidateSessions() {
+      return syncServer.revalidateSessions();
+    },
     async start() {
+      if (unprotectedGroups.length > 0) {
+        const paths = unprotectedGroups.map((kind) => OPERATIONAL_PATHS[kind]).join(", ");
+        syncServer.getLogger().log({
+          timestamp: Date.now(),
+          level: "warn",
+          event: "server.operational_endpoints_unprotected",
+          details: {
+            groups: unprotectedGroups,
+            disabled: production && !allowPublic,
+            message: production && !allowPublic ? `Operational endpoints without a token are disabled (${paths}). Set operationalAuth.adminToken and backupToken to use them.` : `Operational endpoints without a token are PUBLIC (${paths}). Set operationalAuth.adminToken and backupToken before exposing this server.`
+          }
+        });
+      }
       const { createServer } = await import("http");
       const { WebSocketServer } = await import("ws");
-      const serveStatic = createStaticFileHandler(staticDir);
+      const serveStatic = createStaticFileHandler(staticDir, {
+        ...config.spaFallback ? { spaFallback: config.spaFallback } : {}
+      });
       httpServer = createServer(async (req, res) => {
         try {
           await handleRequest(req, res);
@@ -14482,29 +15322,20 @@ function createProductionServer(config) {
           return;
         }
         if (url.pathname === "/__kora/status") {
-          if (!isOperationalRequestAllowed(req, "admin")) {
-            rejectUnauthorized(res);
-            return;
-          }
+          if (!isOperationalRequestAllowed(req, res, "admin")) return;
           const status = await syncServer.getStatus();
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify(status, null, 2));
           return;
         }
         if (url.pathname === "/__kora/metrics") {
-          if (!isOperationalRequestAllowed(req, "metrics")) {
-            rejectUnauthorized(res);
-            return;
-          }
+          if (!isOperationalRequestAllowed(req, res, "metrics")) return;
           res.writeHead(200, { "Content-Type": "text/plain; version=0.0.4" });
           res.end(formatPrometheusMetrics());
           return;
         }
         if (url.pathname === "/__kora/events") {
-          if (!isOperationalRequestAllowed(req, "admin")) {
-            rejectUnauthorized(res);
-            return;
-          }
+          if (!isOperationalRequestAllowed(req, res, "admin")) return;
           res.writeHead(200, {
             "Content-Type": "text/event-stream",
             "Cache-Control": "no-cache",
@@ -14532,20 +15363,14 @@ data: ${JSON.stringify(s)}
           return;
         }
         if (url.pathname === "/__kora" || url.pathname === "/__kora/") {
-          if (!isOperationalRequestAllowed(req, "admin")) {
-            rejectUnauthorized(res);
-            return;
-          }
+          if (!isOperationalRequestAllowed(req, res, "admin")) return;
           const status = await syncServer.getStatus();
           res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
           res.end(renderDashboardHtml(status));
           return;
         }
         if (url.pathname === "/__kora/backup/export" && req.method === "POST") {
-          if (!isOperationalRequestAllowed(req, "backup")) {
-            rejectUnauthorized(res);
-            return;
-          }
+          if (!isOperationalRequestAllowed(req, res, "backup")) return;
           try {
             const backup = await config.store.exportBackup();
             res.writeHead(200, {
@@ -14561,10 +15386,7 @@ data: ${JSON.stringify(s)}
           return;
         }
         if (url.pathname === "/__kora/backup/import" && req.method === "POST") {
-          if (!isOperationalRequestAllowed(req, "backup")) {
-            rejectUnauthorized(res);
-            return;
-          }
+          if (!isOperationalRequestAllowed(req, res, "backup")) return;
           try {
             const body = await readBodyBuffer(req, maxBackupBytes);
             if (body === null) {
@@ -14657,7 +15479,7 @@ data: ${JSON.stringify(s)}
   };
 }
 function renderDashboardHtml(status) {
-  const version = status.version;
+  const version2 = status.version;
   const uptime = formatUptime(status.uptime);
   return `<!DOCTYPE html>
 <html lang="en">
@@ -14688,7 +15510,7 @@ function renderDashboardHtml(status) {
 </head>
 <body>
 <h1>Kora Sync Server</h1>
-<p class="subtitle">v${version} &middot; <span class="status-dot running"></span>Running</p>
+<p class="subtitle">v${version2} &middot; <span class="status-dot running"></span>Running</p>
 <div class="grid">
   <div class="card"><div class="label">Uptime</div><div class="value">${uptime}</div></div>
   <div class="card"><div class="label">Connected Clients</div><div class="value" id="connectedClients">${status.connectedClients}</div></div>
@@ -14738,6 +15560,7 @@ function formatUptime(ms) {
   ClientSession,
   DEFAULT_MAX_SCOPE_PREDICATE_VALUES,
   HttpServerTransport,
+  InvalidDiagnosticOptionsError,
   InvalidScopePredicateError,
   KoraAuthProvider,
   KoraSyncServer,
@@ -14766,6 +15589,7 @@ function formatUptime(ms) {
   createProductionServer,
   createSilentLogger,
   createSqliteServerStore,
+  findJsonStringValues,
   isRetriableRejection,
   isServerNodeId,
   normalizeScopeMap,