@korajs/server 1.0.0-beta.4 → 1.0.0-beta.5

package/dist/index.cjs

@@ -12,11 +12,11 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
+var __copyProps = (to, from, except, desc2) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
       if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc2 = __getOwnPropDesc(from, key)) || desc2.enumerable });
   }
   return to;
 };
@@ -345,30 +345,6 @@ function generateAllCollectionDDL(schema, dialect) {
   }
   return statements;
 }
-function replayOperationsForRecord(ops) {
-  let record = null;
-  let deleted = false;
-  for (const op of ops) {
-    switch (op.type) {
-      case "insert":
-        if (op.data) {
-          record = { ...op.data };
-          deleted = false;
-        }
-        break;
-      case "update":
-        if (op.data) {
-          record = { ...record ?? {}, ...op.data };
-          deleted = false;
-        }
-        break;
-      case "delete":
-        deleted = true;
-        break;
-    }
-  }
-  return deleted ? null : record;
-}
 var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 var BASE64_REVERSE = new Map(
   Array.from(BASE64_ALPHABET, (char, index3) => [char, index3])
@@ -464,6 +440,14 @@ var MemoryServerStore = class {
   operations = [];
   operationIndex = /* @__PURE__ */ new Map();
   versionVector = /* @__PURE__ */ new Map();
+  /**
+   * Server-assigned delivery sequence per operation id. Single-process, so a plain
+   * counter incremented at insert time gives commit-order delivery sequence with no
+   * gaps. `operations` is kept in insertion (== delivery) order, so a delivery scan
+   * is a forward walk.
+   */
+  deliverySeqByOpId = /* @__PURE__ */ new Map();
+  deliverySeqCounter = 0;
   schema = null;
   /** Materialized records: collection -> recordId -> record data */
   materializedRecords = /* @__PURE__ */ new Map();
@@ -497,6 +481,8 @@ var MemoryServerStore = class {
     }
     this.operations.push(op);
     this.operationIndex.set(op.id, op);
+    this.deliverySeqCounter += 1;
+    this.deliverySeqByOpId.set(op.id, this.deliverySeqCounter);
     const currentSeq = this.versionVector.get(op.nodeId) ?? 0;
     if (op.sequenceNumber > currentSeq) {
       this.versionVector.set(op.nodeId, op.sequenceNumber);
@@ -516,6 +502,23 @@ var MemoryServerStore = class {
     this.assertOpen();
     return this.operations.length;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    return this.deliverySeqCounter;
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    const result = [];
+    if (limit <= 0) return result;
+    for (const op of this.operations) {
+      const deliverySequence = this.deliverySeqByOpId.get(op.id) ?? 0;
+      if (deliverySequence > afterDeliverySequence) {
+        result.push({ operation: op, deliverySequence });
+        if (result.length >= limit) break;
+      }
+    }
+    return result;
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     if (this.schema?.collections[collection]) {
@@ -660,12 +663,16 @@ var MemoryServerStore = class {
     this.operations.length = 0;
     this.operationIndex.clear();
     this.versionVector.clear();
+    this.deliverySeqByOpId.clear();
+    this.deliverySeqCounter = 0;
     for (const [nid, seq] of versionVector) {
       this.versionVector.set(nid, seq);
     }
     for (const op of operations2) {
       this.operations.push(op);
       this.operationIndex.set(op.id, op);
+      this.deliverySeqCounter += 1;
+      this.deliverySeqByOpId.set(op.id, this.deliverySeqCounter);
       if (this.schema?.collections[op.collection]) {
         this.rebuildMaterializedRecord(op.collection, op.recordId);
       }
@@ -695,13 +702,14 @@ var MemoryServerStore = class {
         return a.timestamp.wallTime - b.timestamp.wallTime;
       if (a.timestamp.logical !== b.timestamp.logical)
         return a.timestamp.logical - b.timestamp.logical;
-      return a.sequenceNumber - b.sequenceNumber;
+      return a.timestamp.nodeId < b.timestamp.nodeId ? -1 : a.timestamp.nodeId > b.timestamp.nodeId ? 1 : 0;
     });
     const parsedOps = recordOps.map((op) => ({
       type: op.type,
-      data: op.data
+      data: op.data,
+      atomicOps: op.atomicOps ?? null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     if (recordData) {
       const createdAt = recordOps.length > 0 ? recordOps[0].timestamp.wallTime : Date.now();
       const updatedAt = recordOps.length > 0 ? recordOps[recordOps.length - 1].timestamp.wallTime : Date.now();
@@ -824,6 +832,8 @@ var pgOperations = (0, import_pg_core.pgTable)(
     // JSON-serialized, null for deletes
     previousData: (0, import_pg_core.text)("previous_data"),
     // JSON-serialized, null for insert/delete
+    atomicOps: (0, import_pg_core.text)("atomic_ops"),
+    // JSON-serialized Record<field, AtomicOp>, null when none
     wallTime: (0, import_pg_core.bigint)("wall_time", { mode: "number" }).notNull(),
     logical: (0, import_pg_core.integer)("logical").notNull(),
     timestampNodeId: (0, import_pg_core.text)("timestamp_node_id").notNull(),
@@ -831,12 +841,18 @@ var pgOperations = (0, import_pg_core.pgTable)(
     causalDeps: (0, import_pg_core.text)("causal_deps").notNull().default("[]"),
     // JSON array of op IDs
     schemaVersion: (0, import_pg_core.integer)("schema_version").notNull(),
-    receivedAt: (0, import_pg_core.bigint)("received_at", { mode: "number" }).notNull()
+    receivedAt: (0, import_pg_core.bigint)("received_at", { mode: "number" }).notNull(),
+    // Server-assigned monotonic delivery sequence, ordered by commit (assigned from
+    // a counter row locked inside the append transaction, so delivery order equals
+    // visibility order even across instances). Drives the gap-free server->client
+    // delivery watermark. Nullable only for pre-column rows, backfilled on startup.
+    deliverySeq: (0, import_pg_core.bigint)("delivery_seq", { mode: "number" })
   },
   (table) => ({
     nodeSeqIdx: (0, import_pg_core.index)("idx_pg_node_seq").on(table.nodeId, table.sequenceNumber),
     collectionIdx: (0, import_pg_core.index)("idx_pg_collection").on(table.collection),
-    receivedIdx: (0, import_pg_core.index)("idx_pg_received").on(table.receivedAt)
+    receivedIdx: (0, import_pg_core.index)("idx_pg_received").on(table.receivedAt),
+    deliveryIdx: (0, import_pg_core.index)("idx_pg_delivery_seq").on(table.deliverySeq)
   })
 );
 var pgSyncState = (0, import_pg_core.pgTable)("sync_state", {
@@ -853,15 +869,43 @@ var PostgresServerStore = class {
   ready;
   schema = null;
   closed = false;
-  constructor(db, nodeId) {
+  /**
+   * Monotonic counter for this node's server-originated sequence numbers. Lazily
+   * seeded from the persisted version vector on first use, then advanced in memory
+   * (a synchronous `++`, atomic on the single JS thread) so concurrent conditional
+   * applies never receive the same number. Null means "not yet seeded"; reset to
+   * null after a backup import so it re-seeds from the restored version vector.
+   */
+  sequenceCounter = null;
+  /**
+   * Time source for HLC timestamps on server-originated operations. Injectable so a
+   * test can freeze wall-clock time and prove the conditional-apply ordering holds
+   * under same-millisecond commits (the case the advisory lock and clock advance
+   * exist to make correct). Defaults to the system clock in production.
+   */
+  timeSource;
+  constructor(db, nodeId, timeSource) {
     this.db = db;
     this.nodeId = nodeId ?? (0, import_core3.generateUUIDv7)();
+    this.timeSource = timeSource ?? { now: () => Date.now() };
     this.ready = this.initialize();
   }
   getVersionVector() {
     this.assertOpen();
     return new Map(this.versionVector);
   }
+  /**
+   * Atomically reserve this node's next server-operation sequence number. The
+   * synchronous increment cannot interleave on the single JS thread, so two
+   * concurrent conditional applies are always handed distinct numbers.
+   */
+  reserveSequenceNumber() {
+    if (this.sequenceCounter === null) {
+      this.sequenceCounter = this.versionVector.get(this.nodeId) ?? 0;
+    }
+    this.sequenceCounter += 1;
+    return this.sequenceCounter;
+  }
   getNodeId() {
     return this.nodeId;
   }
@@ -899,8 +943,9 @@ var PostgresServerStore = class {
       return "duplicate";
     }
     const now = Date.now();
-    const row = this.serializeOperation(op, now);
     await this.db.transaction(async (tx) => {
+      const deliverySeq = await this.nextDeliverySeq(tx);
+      const row = this.serializeOperation(op, now, deliverySeq);
       await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
       await tx.insert(pgSyncState).values({
         nodeId: op.nodeId,
@@ -923,6 +968,73 @@ var PostgresServerStore = class {
     }
     return "applied";
   }
+  /**
+   * Conditionally apply operations atomically, serialized across server instances
+   * on the target record via a transaction-scoped advisory lock. The lock makes
+   * the read-decide-write cycle atomic against concurrent instances, so a cap
+   * check like `responseCount < max` cannot be passed by two admissions at once.
+   */
+  async applyConditional(input) {
+    this.assertOpen();
+    await this.ready;
+    this.assertSchema();
+    this.assertCollection(input.target.collection);
+    const schema = this.schema;
+    const collectionDef = schema.collections[input.target.collection];
+    const lockKey = `kora:${input.target.collection}:${input.target.id}`;
+    const result = await this.db.transaction(async (tx) => {
+      await tx.execute(import_drizzle_orm.sql`SELECT pg_advisory_xact_lock(hashtextextended(${lockKey}, 0))`);
+      if (input.idempotencyKey) {
+        const existing = await tx.execute(
+          import_drizzle_orm.sql`SELECT 1 FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(input.idempotencyKey.collection))} WHERE id = ${input.idempotencyKey.id} AND _deleted = 0 LIMIT 1`
+        );
+        if (existing.length > 0) {
+          return { admitted: true, idempotent: true, applied: [] };
+        }
+      }
+      const rows = await tx.execute(
+        import_drizzle_orm.sql`SELECT * FROM ${import_drizzle_orm.sql.raw((0, import_core3.quoteIdent)(input.target.collection))} WHERE id = ${input.target.id} AND _deleted = 0`
+      );
+      const current = rows.length > 0 ? this.deserializeRow(rows[0], collectionDef) : null;
+      if (!input.admit(current)) {
+        return { admitted: false, idempotent: false, applied: [] };
+      }
+      const clock = new import_core3.HybridLogicalClock(this.nodeId, this.timeSource);
+      const latest = await this.latestOperationTimestamp(
+        tx,
+        input.target.collection,
+        input.target.id
+      );
+      if (latest) {
+        clock.advanceTo(latest);
+      }
+      const ops = await input.buildOperations(current, { clock });
+      const now = Date.now();
+      for (const op of ops) {
+        const deliverySeq = await this.nextDeliverySeq(tx);
+        const row = this.serializeOperation(op, now, deliverySeq);
+        await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
+        await tx.insert(pgSyncState).values({ nodeId: op.nodeId, maxSequenceNumber: op.sequenceNumber, lastSeenAt: now }).onConflictDoUpdate({
+          target: pgSyncState.nodeId,
+          set: {
+            maxSequenceNumber: import_drizzle_orm.sql`GREATEST(${pgSyncState.maxSequenceNumber}, ${op.sequenceNumber})`,
+            lastSeenAt: import_drizzle_orm.sql`${now}`
+          }
+        });
+        if (this.schema?.collections[op.collection]) {
+          await this.rebuildMaterializedRecord(tx, op.collection, op.recordId);
+        }
+      }
+      return { admitted: true, idempotent: false, applied: ops };
+    });
+    for (const op of result.applied) {
+      const currentMax = this.versionVector.get(op.nodeId) ?? 0;
+      if (op.sequenceNumber > currentMax) {
+        this.versionVector.set(op.nodeId, op.sequenceNumber);
+      }
+    }
+    return result;
+  }
   async getOperationRange(nodeId, fromSeq, toSeq) {
     this.assertOpen();
     await this.ready;
@@ -937,6 +1049,23 @@ var PostgresServerStore = class {
     const result = await this.db.select({ value: (0, import_drizzle_orm.count)() }).from(pgOperations);
     return result[0]?.value ?? 0;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    await this.ready;
+    const rows = await this.db.execute(
+      import_drizzle_orm.sql`SELECT COALESCE(MAX(delivery_seq), 0) AS m FROM operations`
+    );
+    return Number(rows[0]?.m ?? 0);
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    await this.ready;
+    const rows = await this.db.select().from(pgOperations).where((0, import_drizzle_orm.gt)(pgOperations.deliverySeq, afterDeliverySequence)).orderBy((0, import_drizzle_orm.asc)(pgOperations.deliverySeq)).limit(limit);
+    return rows.map((row) => ({
+      operation: this.deserializeOperation(row),
+      deliverySequence: row.deliverySeq ?? 0
+    }));
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     await this.ready;
@@ -1000,7 +1129,7 @@ var PostgresServerStore = class {
     this.assertOpen();
     await this.ready;
     const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
-    const rows = await this.db.select().from(pgOperations).orderBy((0, import_drizzle_orm.asc)(pgOperations.sequenceNumber));
+    const rows = await this.db.select().from(pgOperations).orderBy((0, import_drizzle_orm.asc)(pgOperations.deliverySeq));
     const operations2 = rows.map((row) => this.deserializeOperation(row));
     return buildServerBackup2(this.nodeId, operations2, this.versionVector);
   }
@@ -1015,6 +1144,7 @@ var PostgresServerStore = class {
         const result = await this.applyRemoteOperation(op);
         if (result === "applied") restored++;
       }
+      this.sequenceCounter = null;
       return { operationsRestored: restored, success: true };
     }
     const now = Date.now();
@@ -1024,20 +1154,49 @@ var PostgresServerStore = class {
       for (const [nid, seq] of versionVector) {
         await tx.insert(pgSyncState).values({ nodeId: nid, maxSequenceNumber: seq, lastSeenAt: now }).onConflictDoNothing({ target: pgSyncState.nodeId });
       }
+      let deliverySeq = 0;
       for (const op of operations2) {
-        const row = this.serializeOperation(op, now);
+        deliverySeq += 1;
+        const row = this.serializeOperation(op, now, deliverySeq);
         await tx.insert(pgOperations).values(row).onConflictDoNothing({ target: pgOperations.id });
       }
+      await tx.execute(
+        import_drizzle_orm.sql`INSERT INTO delivery_counter (id, value) VALUES (1, ${deliverySeq})
+					ON CONFLICT (id) DO UPDATE SET value = ${deliverySeq}`
+      );
     });
     this.versionVector.clear();
     for (const [nid, seq] of versionVector) {
       this.versionVector.set(nid, seq);
     }
+    this.sequenceCounter = null;
     return { operationsRestored: operations2.length, success: true };
   }
   // ---------------------------------------------------------------------------
   // Materialization internals
   // ---------------------------------------------------------------------------
+  /**
+   * The HLC timestamp of the most recent operation on a record, by total order
+   * (wallTime, logical, nodeId), or null when the record has no operations. Used
+   * by {@link applyConditional} to advance its clock past the record's latest
+   * write so newly built operations sort strictly after it.
+   */
+  async latestOperationTimestamp(txOrDb, collection, recordId) {
+    const rows = await txOrDb.select({
+      wallTime: pgOperations.wallTime,
+      logical: pgOperations.logical,
+      timestampNodeId: pgOperations.timestampNodeId
+    }).from(pgOperations).where((0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(pgOperations.collection, collection), (0, import_drizzle_orm.eq)(pgOperations.recordId, recordId))).orderBy(
+      (0, import_drizzle_orm.desc)(pgOperations.wallTime),
+      (0, import_drizzle_orm.desc)(pgOperations.logical),
+      (0, import_drizzle_orm.desc)(pgOperations.timestampNodeId)
+    ).limit(1);
+    const row = rows[0];
+    if (!row) {
+      return null;
+    }
+    return { wallTime: row.wallTime, logical: row.logical, nodeId: row.timestampNodeId };
+  }
   /**
    * Rebuild a single record in the materialized collection table by replaying
    * all operations for that record.
@@ -1048,17 +1207,19 @@ var PostgresServerStore = class {
     const ops = await txOrDb.select({
       type: pgOperations.type,
       data: pgOperations.data,
+      atomicOps: pgOperations.atomicOps,
       wallTime: pgOperations.wallTime
     }).from(pgOperations).where((0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(pgOperations.collection, collection), (0, import_drizzle_orm.eq)(pgOperations.recordId, recordId))).orderBy(
       (0, import_drizzle_orm.asc)(pgOperations.wallTime),
       (0, import_drizzle_orm.asc)(pgOperations.logical),
-      (0, import_drizzle_orm.asc)(pgOperations.sequenceNumber)
+      (0, import_drizzle_orm.asc)(pgOperations.timestampNodeId)
     );
     const parsedOps = ops.map((op) => ({
       type: op.type,
-      data: op.data !== null ? JSON.parse(op.data) : null
+      data: op.data !== null ? JSON.parse(op.data) : null,
+      atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     const fieldNames = Object.keys(collectionDef.fields);
     if (recordData) {
       const createdAt = ops.length > 0 ? ops[0].wallTime : Date.now();
@@ -1125,11 +1286,12 @@ var PostgresServerStore = class {
       recordId: pgOperations.recordId,
       type: pgOperations.type,
       data: pgOperations.data,
+      atomicOps: pgOperations.atomicOps,
       wallTime: pgOperations.wallTime
     }).from(pgOperations).where((0, import_drizzle_orm.eq)(pgOperations.collection, collectionName)).orderBy(
       (0, import_drizzle_orm.asc)(pgOperations.wallTime),
       (0, import_drizzle_orm.asc)(pgOperations.logical),
-      (0, import_drizzle_orm.asc)(pgOperations.sequenceNumber)
+      (0, import_drizzle_orm.asc)(pgOperations.timestampNodeId)
     );
     if (allOps.length === 0) return;
     const grouped = /* @__PURE__ */ new Map();
@@ -1145,9 +1307,10 @@ var PostgresServerStore = class {
     for (const [recordId, recordOps] of grouped) {
       const parsedOps = recordOps.map((op) => ({
         type: op.type,
-        data: op.data !== null ? JSON.parse(op.data) : null
+        data: op.data !== null ? JSON.parse(op.data) : null,
+        atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
       }));
-      const recordData = replayOperationsForRecord(parsedOps);
+      const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
       if (recordData) {
         const createdAt = recordOps[0].wallTime;
         const updatedAt = recordOps[recordOps.length - 1].wallTime;
@@ -1270,44 +1433,92 @@ var PostgresServerStore = class {
     }
   }
   async ensureTables() {
-    await this.db.execute(import_drizzle_orm.sql`
-			CREATE TABLE IF NOT EXISTS operations (
-				id TEXT PRIMARY KEY,
-				node_id TEXT NOT NULL,
-				type TEXT NOT NULL,
-				collection TEXT NOT NULL,
-				record_id TEXT NOT NULL,
-				data TEXT,
-				previous_data TEXT,
-				wall_time BIGINT NOT NULL,
-				logical INTEGER NOT NULL,
-				timestamp_node_id TEXT NOT NULL,
-				sequence_number INTEGER NOT NULL,
-				causal_deps TEXT NOT NULL DEFAULT '[]',
-				schema_version INTEGER NOT NULL,
-				received_at BIGINT NOT NULL
-			)
-		`);
-    await this.db.execute(
-      import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)`
-    );
-    await this.db.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)`);
-    await this.db.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_received ON operations (received_at)`);
-    await this.db.execute(
-      import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection_record ON operations (collection, record_id)`
+    await this.db.transaction(async (tx) => {
+      await tx.execute(import_drizzle_orm.sql`SELECT pg_advisory_xact_lock(hashtextextended('kora:ensure-tables', 0))`);
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS operations (
+					id TEXT PRIMARY KEY,
+					node_id TEXT NOT NULL,
+					type TEXT NOT NULL,
+					collection TEXT NOT NULL,
+					record_id TEXT NOT NULL,
+					data TEXT,
+					previous_data TEXT,
+					atomic_ops TEXT,
+					wall_time BIGINT NOT NULL,
+					logical INTEGER NOT NULL,
+					timestamp_node_id TEXT NOT NULL,
+					sequence_number INTEGER NOT NULL,
+					causal_deps TEXT NOT NULL DEFAULT '[]',
+					schema_version INTEGER NOT NULL,
+					received_at BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`ALTER TABLE operations ADD COLUMN IF NOT EXISTS atomic_ops TEXT`);
+      await tx.execute(import_drizzle_orm.sql`ALTER TABLE operations ADD COLUMN IF NOT EXISTS delivery_seq BIGINT`);
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)`
+      );
+      await tx.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)`);
+      await tx.execute(import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_received ON operations (received_at)`);
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_delivery_seq ON operations (delivery_seq)`
+      );
+      await tx.execute(
+        import_drizzle_orm.sql`CREATE INDEX IF NOT EXISTS idx_collection_record ON operations (collection, record_id)`
+      );
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS sync_state (
+					node_id TEXT PRIMARY KEY,
+					max_sequence_number INTEGER NOT NULL,
+					last_seen_at BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				CREATE TABLE IF NOT EXISTS delivery_counter (
+					id INTEGER PRIMARY KEY,
+					value BIGINT NOT NULL
+				)
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				WITH ordered AS (
+					SELECT id, ROW_NUMBER() OVER (
+						ORDER BY received_at ASC, sequence_number ASC, id ASC
+					) + COALESCE((SELECT MAX(delivery_seq) FROM operations), 0) AS rn
+					FROM operations WHERE delivery_seq IS NULL
+				)
+				UPDATE operations o SET delivery_seq = ordered.rn
+				FROM ordered WHERE o.id = ordered.id
+			`);
+      await tx.execute(import_drizzle_orm.sql`
+				INSERT INTO delivery_counter (id, value)
+				VALUES (1, COALESCE((SELECT MAX(delivery_seq) FROM operations), 0))
+				ON CONFLICT (id) DO UPDATE
+					SET value = GREATEST(delivery_counter.value, EXCLUDED.value)
+			`);
+    });
+  }
+  /**
+   * Reserve the next delivery sequence inside an open append transaction. The
+   * `UPDATE ... RETURNING` locks the counter row until this transaction commits,
+   * serializing assignment into commit order (see the counter table comment).
+   */
+  async nextDeliverySeq(tx) {
+    const rows = await tx.execute(
+      import_drizzle_orm.sql`UPDATE delivery_counter SET value = value + 1 WHERE id = 1 RETURNING value`
     );
-    await this.db.execute(import_drizzle_orm.sql`
-			CREATE TABLE IF NOT EXISTS sync_state (
-				node_id TEXT PRIMARY KEY,
-				max_sequence_number INTEGER NOT NULL,
-				last_seen_at BIGINT NOT NULL
-			)
-		`);
+    const value = rows[0]?.value;
+    if (value === void 0 || value === null) {
+      throw new Error(
+        "delivery_counter row (id=1) is missing; the operations log cannot assign delivery sequences"
+      );
+    }
+    return Number(value);
   }
   // ---------------------------------------------------------------------------
   // Operation serialization
   // ---------------------------------------------------------------------------
-  serializeOperation(op, receivedAt) {
+  serializeOperation(op, receivedAt, deliverySeq) {
     return {
       id: op.id,
       nodeId: op.nodeId,
@@ -1316,16 +1527,19 @@ var PostgresServerStore = class {
       recordId: op.recordId,
       data: op.data !== null ? JSON.stringify(op.data) : null,
       previousData: op.previousData !== null ? JSON.stringify(op.previousData) : null,
+      atomicOps: op.atomicOps && Object.keys(op.atomicOps).length > 0 ? JSON.stringify(op.atomicOps) : null,
       wallTime: op.timestamp.wallTime,
       logical: op.timestamp.logical,
       timestampNodeId: op.timestamp.nodeId,
       sequenceNumber: op.sequenceNumber,
       causalDeps: JSON.stringify(op.causalDeps),
       schemaVersion: op.schemaVersion,
-      receivedAt
+      receivedAt,
+      deliverySeq
     };
   }
   deserializeOperation(row) {
+    const atomicOps = row.atomicOps != null ? JSON.parse(row.atomicOps) : void 0;
     return {
       id: row.id,
       nodeId: row.nodeId,
@@ -1341,7 +1555,8 @@ var PostgresServerStore = class {
       },
       sequenceNumber: row.sequenceNumber,
       causalDeps: JSON.parse(row.causalDeps),
-      schemaVersion: row.schemaVersion
+      schemaVersion: row.schemaVersion,
+      ...atomicOps ? { atomicOps } : {}
     };
   }
   // ---------------------------------------------------------------------------
@@ -1411,6 +1626,8 @@ var operations = (0, import_sqlite_core.sqliteTable)(
     // JSON-serialized, null for deletes
     previousData: (0, import_sqlite_core.text)("previous_data"),
     // JSON-serialized, null for insert/delete
+    atomicOps: (0, import_sqlite_core.text)("atomic_ops"),
+    // JSON-serialized Record<field, AtomicOp>, null when none
     wallTime: (0, import_sqlite_core.integer)("wall_time").notNull(),
     logical: (0, import_sqlite_core.integer)("logical").notNull(),
     timestampNodeId: (0, import_sqlite_core.text)("timestamp_node_id").notNull(),
@@ -1418,12 +1635,17 @@ var operations = (0, import_sqlite_core.sqliteTable)(
     causalDeps: (0, import_sqlite_core.text)("causal_deps").notNull().default("[]"),
     // JSON array of op IDs
     schemaVersion: (0, import_sqlite_core.integer)("schema_version").notNull(),
-    receivedAt: (0, import_sqlite_core.integer)("received_at").notNull()
+    receivedAt: (0, import_sqlite_core.integer)("received_at").notNull(),
+    // Server-assigned monotonic delivery sequence, ordered by commit. Drives the
+    // gap-free server->client delivery watermark. Nullable only for rows written
+    // before the column existed; those are backfilled on startup.
+    deliverySeq: (0, import_sqlite_core.integer)("delivery_seq")
   },
   (table) => ({
     nodeSeqIdx: (0, import_sqlite_core.index)("idx_node_seq").on(table.nodeId, table.sequenceNumber),
     collectionIdx: (0, import_sqlite_core.index)("idx_collection").on(table.collection),
-    receivedIdx: (0, import_sqlite_core.index)("idx_received").on(table.receivedAt)
+    receivedIdx: (0, import_sqlite_core.index)("idx_received").on(table.receivedAt),
+    deliveryIdx: (0, import_sqlite_core.index)("idx_delivery_seq").on(table.deliverySeq)
   })
 );
 var syncState = (0, import_sqlite_core.sqliteTable)("sync_state", {
@@ -1439,6 +1661,12 @@ var SqliteServerStore = class {
   db;
   schema = null;
   closed = false;
+  /**
+   * Next delivery sequence to assign. Single-writer (better-sqlite3 is synchronous),
+   * so a plain in-memory counter, seeded from MAX(delivery_seq) at startup, gives
+   * commit-order delivery sequence. Assigned inside the append transaction.
+   */
+  deliverySeqCounter = 0;
   constructor(db, nodeId) {
     this.db = db;
     this.nodeId = nodeId ?? (0, import_core4.generateUUIDv7)();
@@ -1484,12 +1712,16 @@ var SqliteServerStore = class {
   async applyRemoteOperation(op) {
     this.assertOpen();
     const now = Date.now();
-    const row = this.serializeOperation(op, now);
     const result = this.db.transaction((tx) => {
-      const insertResult = tx.insert(operations).values(row).onConflictDoNothing({ target: operations.id }).run();
-      if (insertResult.changes === 0) {
+      const existing = tx.all(
+        import_drizzle_orm2.sql`SELECT id FROM operations WHERE id = ${op.id} LIMIT 1`
+      );
+      if (existing.length > 0) {
         return "duplicate";
       }
+      this.deliverySeqCounter += 1;
+      const row = this.serializeOperation(op, now, this.deliverySeqCounter);
+      tx.insert(operations).values(row).run();
       tx.insert(syncState).values({
         nodeId: op.nodeId,
         maxSequenceNumber: op.sequenceNumber,
@@ -1518,6 +1750,21 @@ var SqliteServerStore = class {
     const result = this.db.select({ value: (0, import_drizzle_orm2.count)() }).from(operations).all();
     return result[0]?.value ?? 0;
   }
+  async getMaxDeliverySequence() {
+    this.assertOpen();
+    const rows = this.db.all(
+      import_drizzle_orm2.sql`SELECT MAX(delivery_seq) AS m FROM operations`
+    );
+    return rows[0]?.m ?? 0;
+  }
+  async getOperationsAfterDelivery(afterDeliverySequence, limit) {
+    this.assertOpen();
+    const rows = this.db.select().from(operations).where((0, import_drizzle_orm2.gt)(operations.deliverySeq, afterDeliverySequence)).orderBy((0, import_drizzle_orm2.asc)(operations.deliverySeq)).limit(limit).all();
+    return rows.map((row) => ({
+      operation: this.deserializeOperation(row),
+      deliverySequence: row.deliverySeq ?? 0
+    }));
+  }
   async materializeCollection(collection) {
     this.assertOpen();
     if (this.schema?.collections[collection]) {
@@ -1575,7 +1822,7 @@ var SqliteServerStore = class {
   async exportBackup() {
     this.assertOpen();
     const { buildServerBackup: buildServerBackup2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
-    const rows = this.db.select().from(operations).all();
+    const rows = this.db.select().from(operations).orderBy((0, import_drizzle_orm2.asc)(operations.deliverySeq)).all();
     const deserialized = rows.map((row) => this.deserializeOperation(row));
     const vv = this.getVersionVector();
     return buildServerBackup2(this.nodeId, deserialized, vv);
@@ -1598,10 +1845,13 @@ var SqliteServerStore = class {
       for (const [nid, seq] of versionVector) {
         tx.insert(syncState).values({ nodeId: nid, maxSequenceNumber: seq, lastSeenAt: Date.now() }).run();
       }
+      let deliverySeq = 0;
       for (const op of ops) {
-        const row = this.serializeOperation(op, Date.now());
+        deliverySeq += 1;
+        const row = this.serializeOperation(op, Date.now(), deliverySeq);
         tx.insert(operations).values(row).run();
       }
+      this.deliverySeqCounter = deliverySeq;
     });
     return { operationsRestored: ops.length, success: true };
   }
@@ -1619,13 +1869,15 @@ var SqliteServerStore = class {
     const ops = txOrDb.select({
       type: operations.type,
       data: operations.data,
+      atomicOps: operations.atomicOps,
       wallTime: operations.wallTime
-    }).from(operations).where((0, import_drizzle_orm2.and)((0, import_drizzle_orm2.eq)(operations.collection, collection), (0, import_drizzle_orm2.eq)(operations.recordId, recordId))).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.sequenceNumber)).all();
+    }).from(operations).where((0, import_drizzle_orm2.and)((0, import_drizzle_orm2.eq)(operations.collection, collection), (0, import_drizzle_orm2.eq)(operations.recordId, recordId))).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.timestampNodeId)).all();
     const parsedOps = ops.map((op) => ({
       type: op.type,
-      data: op.data !== null ? JSON.parse(op.data) : null
+      data: op.data !== null ? JSON.parse(op.data) : null,
+      atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
     }));
-    const recordData = replayOperationsForRecord(parsedOps);
+    const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
     const fieldNames = Object.keys(collectionDef.fields);
     if (recordData) {
       const createdAt = ops.length > 0 ? ops[0].wallTime : Date.now();
@@ -1695,8 +1947,9 @@ var SqliteServerStore = class {
       recordId: operations.recordId,
       type: operations.type,
       data: operations.data,
+      atomicOps: operations.atomicOps,
       wallTime: operations.wallTime
-    }).from(operations).where((0, import_drizzle_orm2.eq)(operations.collection, collectionName)).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.sequenceNumber)).all();
+    }).from(operations).where((0, import_drizzle_orm2.eq)(operations.collection, collectionName)).orderBy((0, import_drizzle_orm2.asc)(operations.wallTime), (0, import_drizzle_orm2.asc)(operations.logical), (0, import_drizzle_orm2.asc)(operations.timestampNodeId)).all();
     if (allOps.length === 0) return;
     const grouped = /* @__PURE__ */ new Map();
     for (const op of allOps) {
@@ -1712,9 +1965,10 @@ var SqliteServerStore = class {
       for (const [recordId, recordOps] of grouped) {
         const parsedOps = recordOps.map((op) => ({
           type: op.type,
-          data: op.data !== null ? JSON.parse(op.data) : null
+          data: op.data !== null ? JSON.parse(op.data) : null,
+          atomicOps: op.atomicOps != null ? JSON.parse(op.atomicOps) : null
         }));
-        const recordData = replayOperationsForRecord(parsedOps);
+        const recordData = (0, import_core.replayOperationsForRecord)(parsedOps);
         if (recordData) {
           const createdAt = recordOps[0].wallTime;
           const updatedAt = recordOps[recordOps.length - 1].wallTime;
@@ -1836,6 +2090,7 @@ var SqliteServerStore = class {
 				record_id TEXT NOT NULL,
 				data TEXT,
 				previous_data TEXT,
+				atomic_ops TEXT,
 				wall_time INTEGER NOT NULL,
 				logical INTEGER NOT NULL,
 				timestamp_node_id TEXT NOT NULL,
@@ -1845,9 +2100,30 @@ var SqliteServerStore = class {
 				received_at INTEGER NOT NULL
 			)
 		`);
+    try {
+      this.db.run(import_drizzle_orm2.sql`ALTER TABLE operations ADD COLUMN atomic_ops TEXT`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : "";
+      const causeMsg = e instanceof Error && e.cause instanceof Error ? e.cause.message : "";
+      if (!msg.includes("duplicate column") && !causeMsg.includes("duplicate column")) {
+        throw e;
+      }
+    }
+    try {
+      this.db.run(import_drizzle_orm2.sql`ALTER TABLE operations ADD COLUMN delivery_seq INTEGER`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : "";
+      const causeMsg = e instanceof Error && e.cause instanceof Error ? e.cause.message : "";
+      if (!msg.includes("duplicate column") && !causeMsg.includes("duplicate column")) {
+        throw e;
+      }
+    }
     this.db.run(import_drizzle_orm2.sql`
 			CREATE INDEX IF NOT EXISTS idx_node_seq ON operations (node_id, sequence_number)
 		`);
+    this.db.run(import_drizzle_orm2.sql`
+			CREATE INDEX IF NOT EXISTS idx_delivery_seq ON operations (delivery_seq)
+		`);
     this.db.run(import_drizzle_orm2.sql`
 			CREATE INDEX IF NOT EXISTS idx_collection ON operations (collection)
 		`);
@@ -1864,11 +2140,34 @@ var SqliteServerStore = class {
 				last_seen_at INTEGER NOT NULL
 			)
 		`);
+    this.backfillDeliverySequence();
+  }
+  /**
+   * Assign delivery sequences to any operations written before the column existed,
+   * then seed the in-memory counter from the current max. Ordered by
+   * (received_at, sequence_number, id) so the backfill is deterministic and stable
+   * across restarts. A one-time migration: after it runs, all rows have a value.
+   */
+  backfillDeliverySequence() {
+    this.db.transaction((tx) => {
+      const maxRow = tx.all(
+        import_drizzle_orm2.sql`SELECT MAX(delivery_seq) AS m FROM operations`
+      );
+      let next = maxRow[0]?.m ?? 0;
+      const nullRows = tx.all(
+        import_drizzle_orm2.sql`SELECT id FROM operations WHERE delivery_seq IS NULL ORDER BY received_at ASC, sequence_number ASC, id ASC`
+      );
+      for (const row of nullRows) {
+        next += 1;
+        tx.run(import_drizzle_orm2.sql`UPDATE operations SET delivery_seq = ${next} WHERE id = ${row.id}`);
+      }
+      this.deliverySeqCounter = next;
+    });
   }
   // ---------------------------------------------------------------------------
   // Operation serialization
   // ---------------------------------------------------------------------------
-  serializeOperation(op, receivedAt) {
+  serializeOperation(op, receivedAt, deliverySeq) {
     return {
       id: op.id,
       nodeId: op.nodeId,
@@ -1877,16 +2176,19 @@ var SqliteServerStore = class {
       recordId: op.recordId,
       data: op.data !== null ? JSON.stringify(op.data) : null,
       previousData: op.previousData !== null ? JSON.stringify(op.previousData) : null,
+      atomicOps: op.atomicOps && Object.keys(op.atomicOps).length > 0 ? JSON.stringify(op.atomicOps) : null,
       wallTime: op.timestamp.wallTime,
       logical: op.timestamp.logical,
       timestampNodeId: op.timestamp.nodeId,
       sequenceNumber: op.sequenceNumber,
       causalDeps: JSON.stringify(op.causalDeps),
       schemaVersion: op.schemaVersion,
-      receivedAt
+      receivedAt,
+      deliverySeq
     };
   }
   deserializeOperation(row) {
+    const atomicOps = row.atomicOps != null ? JSON.parse(row.atomicOps) : void 0;
     return {
       id: row.id,
       nodeId: row.nodeId,
@@ -1902,7 +2204,8 @@ var SqliteServerStore = class {
       },
       sequenceNumber: row.sequenceNumber,
       causalDeps: JSON.parse(row.causalDeps),
-      schemaVersion: row.schemaVersion
+      schemaVersion: row.schemaVersion,
+      ...atomicOps ? { atomicOps } : {}
     };
   }
   // ---------------------------------------------------------------------------
@@ -2201,6 +2504,9 @@ async function createServerSideEffectOperation(store, parentOp, effect, schemaVe
   );
 }
 function nextServerSequenceNumber(store) {
+  if (store.reserveSequenceNumber) {
+    return store.reserveSequenceNumber();
+  }
   const nodeId = store.getNodeId();
   const current = store.getVersionVector().get(nodeId) ?? 0;
   return current + 1;
@@ -2242,16 +2548,14 @@ async function applyServerOperation(store, op, relationLookup) {
       return { result: primaryResult, appliedOperations: [] };
     }
     const appliedOperations = [op];
-    let serverSeq = nextServerSequenceNumber(store);
     for (const effect of referential.sideEffectOps) {
       const sideOp = await createServerSideEffectOperation(
         store,
         op,
         effect,
         op.schemaVersion,
-        serverSeq
+        nextServerSequenceNumber(store)
       );
-      serverSeq += 1;
       const sideResult = await store.applyRemoteOperation(sideOp);
       if (sideResult === "applied") {
         appliedOperations.push(sideOp);
@@ -2312,11 +2616,11 @@ function mergeScopeMaps(base, overlay, source) {
 
 // src/scopes/server-scope-filter.ts
 init_cjs_shims();
-function operationMatchesScopes(op, scopes) {
+function operationMatchesScopes(op, scopes, fullRecord) {
   if (!scopes) return true;
   const collectionScope = scopes[op.collection];
   if (!collectionScope) return false;
-  const snapshot = buildSnapshot(op);
+  const snapshot = buildSnapshot(op, fullRecord);
   if (!snapshot) return false;
   for (const [field, expected] of Object.entries(collectionScope)) {
     if (snapshot[field] !== expected) {
@@ -2325,11 +2629,19 @@ function operationMatchesScopes(op, scopes) {
   }
   return true;
 }
-function buildSnapshot(op) {
+function missingScopeFields(op, scopes) {
+  if (!scopes) return [];
+  const collectionScope = scopes[op.collection];
+  if (!collectionScope) return [];
+  const snapshot = buildSnapshot(op);
+  return Object.keys(collectionScope).filter((field) => !snapshot || !(field in snapshot));
+}
+function buildSnapshot(op, fullRecord) {
   const previous = asRecord(op.previousData);
   const next = asRecord(op.data);
-  if (!previous && !next) return null;
+  if (!previous && !next && !fullRecord) return null;
   return {
+    ...fullRecord ?? {},
     ...previous ?? {},
     ...next ?? {}
   };
@@ -2422,12 +2734,41 @@ function warnIfMultiTenantWithoutScopes(auth, resolvedScopes, schema) {
     "[kora] An authenticated session resolved to no sync scopes, so every user will sync every other user's data. Return per-user sync scopes from your auth provider (for example KoraAuthProvider's resolveScopes) to isolate tenants. Note: declaring sync rules in your schema is not enough on its own \u2014 the per-user values come from the auth provider. (This warning is expected for single-tenant apps where all authenticated users are meant to share the same data.)"
   );
 }
-var ClientSession = class {
+var ClientSession = class _ClientSession {
   state = "connected";
   clientNodeId = null;
   authContext = null;
   syncQuerySubsets = [];
   resumeDeltaCursor = null;
+  /**
+   * The delivery watermark the client reported at handshake, or null when the client
+   * does not use the delivery watermark (old client, or no watermark yet). When set,
+   * the server drives the gap-free server->client stream from delivery sequences
+   * instead of the version-vector delta.
+   */
+  clientDeliveryWatermark = null;
+  /**
+   * The highest delivery sequence this client has ACKNOWLEDGED (its confirmed
+   * watermark, as reported in acks). Incremental streaming pushes resume from here, not
+   * from the highest sequence sent, so a dropped or unapplied batch is always
+   * re-included by the next push (which re-scans from the acknowledged position). This
+   * is what makes streaming recovery independent of any bounded retransmit buffer: there
+   * is no sent-but-unacked window that a buffer eviction could strand. Seeded from the
+   * client's reported watermark at handshake.
+   */
+  lastAckedDeliverySeq = 0;
+  /** Serializes incremental delivery pushes so their batches never interleave. */
+  deliveryPushChain = Promise.resolve();
+  /**
+   * Relay batches sent to this client but not yet acknowledged, keyed by messageId.
+   * The client acks every operation-batch it applies; on ack the entry is cleared.
+   * {@link retransmitPendingRelays} re-sends anything still unacked, so a relay
+   * dropped by a lossy transport is redelivered instead of leaving the client with a
+   * permanent version-vector gap (a lost operation) that delta sync cannot recover.
+   * Bounded so a silent client cannot grow it without limit.
+   */
+  pendingRelays = /* @__PURE__ */ new Map();
+  static MAX_PENDING_RELAYS = 1e3;
   sessionId;
   transport;
   store;
@@ -2444,6 +2785,8 @@ var ClientSession = class {
   onBlobChunkResponse;
   persistBlobChunk;
   onClose;
+  onOrphanedRelays;
+  takeOrphanedRelays;
   maxOperationBytes;
   maxOpsPerMinute;
   rateLimiter;
@@ -2470,6 +2813,8 @@ var ClientSession = class {
     this.onBlobChunkResponse = options.onBlobChunkResponse ?? null;
     this.persistBlobChunk = options.persistBlobChunk ?? null;
     this.onClose = options.onClose ?? null;
+    this.onOrphanedRelays = options.onOrphanedRelays ?? null;
+    this.takeOrphanedRelays = options.takeOrphanedRelays ?? null;
     this.maxOperationBytes = options.maxOperationBytes ?? DEFAULT_MAX_OPERATION_BYTES;
     this.maxOpsPerMinute = options.maxOpsPerMinute ?? DEFAULT_MAX_OPS_PER_MINUTE;
     this.rateLimiter = new SessionRateLimiter(this.maxOpsPerMinute);
@@ -2494,9 +2839,40 @@ var ClientSession = class {
    */
   relayOperations(operations2) {
     if (this.state !== "streaming" || !this.transport.isConnected()) return;
+    if (this.clientDeliveryWatermark !== null) {
+      this.pushDeliveryStream();
+      return;
+    }
     if (operations2.length === 0) return;
-    const visibleOperations = operations2.filter((op) => this.operationVisibleToClient(op));
+    void this.relayVisibleOperations(operations2);
+  }
+  /**
+   * Push newly-available in-scope operations to a delivery-watermark client, resuming
+   * from the highest delivery sequence already sent. Pushes are serialized so their
+   * batches never interleave (which would break the base/max chain).
+   */
+  pushDeliveryStream() {
+    this.deliveryPushChain = this.deliveryPushChain.then(async () => {
+      if (this.state !== "streaming" || !this.transport.isConnected()) return;
+      try {
+        await this.sendDeliveryStream(
+          this.lastAckedDeliverySeq,
+          false,
+          this.clientNodeId ?? void 0
+        );
+      } catch {
+      }
+    });
+  }
+  async relayVisibleOperations(operations2) {
+    const visibleOperations = [];
+    for (const op of operations2) {
+      if (await this.operationVisibleToClient(op)) {
+        visibleOperations.push(op);
+      }
+    }
     if (visibleOperations.length === 0) return;
+    if (this.state !== "streaming" || !this.transport.isConnected()) return;
     const serializedOps = visibleOperations.map((op) => this.serializer.encodeOperation(op));
     const msg = {
       type: "operation-batch",
@@ -2505,14 +2881,62 @@ var ClientSession = class {
       isFinal: true,
       batchIndex: 0
     };
+    this.trackPendingRelay(msg, visibleOperations);
     this.sendToClient(msg);
   }
+  /** Record a relay batch as awaiting acknowledgment, evicting the oldest if full. */
+  trackPendingRelay(msg, ops) {
+    if (this.pendingRelays.size >= _ClientSession.MAX_PENDING_RELAYS) {
+      const oldest = this.pendingRelays.keys().next().value;
+      if (oldest !== void 0) {
+        this.pendingRelays.delete(oldest);
+      }
+    }
+    this.pendingRelays.set(msg.messageId, { message: msg, ops, sentAtMs: Date.now() });
+  }
+  /**
+   * Retransmit relay batches this client has not acknowledged within `staleMs`.
+   * Called on a periodic tick by the server (and directly by tests). Redelivering an
+   * already-applied op is harmless: the client dedups by content-addressed id.
+   */
+  retransmitPendingRelays(staleMs = 0) {
+    if (this.state !== "streaming" || !this.transport.isConnected()) return;
+    if (this.clientDeliveryWatermark !== null) {
+      this.pushDeliveryStream();
+      return;
+    }
+    if (this.pendingRelays.size === 0) return;
+    const cutoff = Date.now() - staleMs;
+    for (const { message, sentAtMs } of this.pendingRelays.values()) {
+      if (sentAtMs <= cutoff) {
+        this.sendToClient(message);
+      }
+    }
+  }
   /**
    * Close this session.
    */
+  /**
+   * Hand any unacknowledged relays to the server so they survive this session and are
+   * redelivered when this client reconnects (per-node buffer), then clear them. Called
+   * from every session-teardown path (explicit close and transport close).
+   */
+  flushOrphanedRelays() {
+    if (this.onOrphanedRelays && this.clientNodeId && this.pendingRelays.size > 0) {
+      const ops = [];
+      for (const entry of this.pendingRelays.values()) {
+        ops.push(...entry.ops);
+      }
+      if (ops.length > 0) {
+        this.onOrphanedRelays(this.clientNodeId, ops);
+      }
+    }
+    this.pendingRelays.clear();
+  }
   close(reason) {
     if (this.state === "closed") return;
     this.state = "closed";
+    this.flushOrphanedRelays();
     if (this.transport.isConnected()) {
       this.transport.close(1e3, reason ?? "session closed");
     }
@@ -2567,6 +2991,10 @@ var ClientSession = class {
         await this.handleOperationBatch(message);
         break;
       case "acknowledgment":
+        this.pendingRelays.delete(message.acknowledgedMessageId);
+        if (message.deliverySequence !== void 0) {
+          this.lastAckedDeliverySeq = Math.max(this.lastAckedDeliverySeq, message.deliverySequence);
+        }
         break;
       case "error":
         break;
@@ -2643,6 +3071,15 @@ var ClientSession = class {
       this.syncQuerySubsets = [];
     }
     this.resumeDeltaCursor = msg.deltaCursor ? (0, import_sync3.decodeDeltaCursor)(msg.deltaCursor) : null;
+    this.clientDeliveryWatermark = msg.lastDeliverySequence ?? null;
+    const clientUsesWatermark = this.clientDeliveryWatermark !== null;
+    let serverMaxDelivery = 0;
+    if (clientUsesWatermark) {
+      serverMaxDelivery = await this.store.getMaxDeliverySequence();
+      if (this.clientDeliveryWatermark !== null && this.clientDeliveryWatermark > serverMaxDelivery) {
+        this.clientDeliveryWatermark = 0;
+      }
+    }
     const serverVector = this.store.getVersionVector();
     const selectedWireFormat = selectWireFormat(msg.supportedWireFormats);
     this.setSerializerWireFormat(selectedWireFormat);
@@ -2673,6 +3110,10 @@ var ClientSession = class {
       accepted: true,
       selectedWireFormat,
       serverTime: Date.now(),
+      // The server's highest delivery sequence, so a client whose persisted watermark
+      // is ahead of it (server rolled back) can reset to a full resync. Sent only to
+      // watermark-using clients.
+      ...clientUsesWatermark ? { serverMaxDeliverySequence: serverMaxDelivery } : {},
       // Advertise central blob storage so the client uploads the bytes behind
       // its blob fields, keeping them available after the author goes offline.
       ...this.persistBlobChunk ? { blobStorageEnabled: true } : {},
@@ -2683,16 +3124,28 @@ var ClientSession = class {
     this.sendToClient(response);
     this.emitter?.emit({ type: "sync:connected", nodeId: msg.nodeId });
     this.state = "syncing";
-    const clientVector = (0, import_sync3.wireToVersionVector)(msg.versionVector);
-    await this.sendDelta(clientVector);
+    if (this.clientDeliveryWatermark !== null) {
+      this.lastAckedDeliverySeq = this.clientDeliveryWatermark;
+      const excludeOwn = this.clientDeliveryWatermark > 0 ? this.clientNodeId ?? void 0 : void 0;
+      await this.sendDeliveryStream(this.clientDeliveryWatermark, true, excludeOwn);
+    } else {
+      const clientVector = (0, import_sync3.wireToVersionVector)(msg.versionVector);
+      await this.sendDelta(clientVector);
+    }
     this.state = "streaming";
+    if (this.takeOrphanedRelays && this.clientNodeId) {
+      const buffered = this.takeOrphanedRelays(this.clientNodeId);
+      if (buffered.length > 0) {
+        this.relayOperations(buffered);
+      }
+    }
   }
   async handleOperationBatch(msg) {
     const operations2 = msg.operations.map((s) => this.serializer.decodeOperation(s));
     const applied = [];
     const rejected = [];
     for (const op of operations2) {
-      if (!this.operationVisibleToClient(op)) {
+      if (!await this.operationVisibleToClient(op)) {
         rejected.push(op);
         continue;
       }
@@ -2797,8 +3250,11 @@ var ClientSession = class {
       const clientSeq = clientVector.get(nodeId) ?? 0;
       if (serverSeq > clientSeq) {
         const ops = await this.store.getOperationRange(nodeId, clientSeq + 1, serverSeq);
-        const visible = ops.filter((op) => this.operationVisibleToClient(op));
-        missing.push(...visible);
+        for (const op of ops) {
+          if (await this.operationVisibleToClient(op)) {
+            missing.push(op);
+          }
+        }
       }
     }
     if (missing.length === 0) {
@@ -2850,11 +3306,111 @@ var ClientSession = class {
       });
     }
   }
-  operationVisibleToClient(op) {
-    if (!operationMatchesScopes(op, this.authContext?.scopes)) {
+  /**
+   * Send the gap-free server->client delivery stream, resuming just after
+   * `fromDeliverySeq`. Operations are scanned in server delivery-sequence order
+   * (commit order), scope-filtered for this session, and sent in batches that chain:
+   * each batch's `baseDeliverySequence` equals the previous batch's
+   * `maxDeliverySequence` (the first batch bases on `fromDeliverySeq`). The client
+   * applies a batch only when its watermark equals the base and advances the
+   * watermark to the max, so a dropped batch stalls the watermark and is recovered by
+   * the next handshake resend. Because delivery-sequence order respects causal order
+   * (a dependency is always committed, and thus sequenced, before its dependent), no
+   * topological sort is needed and the client never defers on a missing dependency
+   * that is itself in this stream.
+   *
+   * The final batch advances the watermark to the highest delivery sequence scanned,
+   * not merely the last in-scope one, so an out-of-scope tail is not re-scanned on the
+   * next reconnect. Returns the number of operations actually sent.
+   */
+  async sendDeliveryStream(fromDeliverySeq, finalizeWhenEmpty, excludeNodeId) {
+    const scanChunk = Math.max(this.batchSize, 1) * 5;
+    let scanCursor = fromDeliverySeq;
+    let maxScanned = fromDeliverySeq;
+    const visible = [];
+    while (true) {
+      const chunk = await this.store.getOperationsAfterDelivery(scanCursor, scanChunk);
+      const last = chunk[chunk.length - 1];
+      if (last === void 0) break;
+      scanCursor = last.deliverySequence;
+      maxScanned = scanCursor;
+      for (const delivered of chunk) {
+        if (excludeNodeId !== void 0 && delivered.operation.nodeId === excludeNodeId) {
+          continue;
+        }
+        if (await this.operationVisibleToClient(delivered.operation)) {
+          visible.push(delivered);
+        }
+      }
+      if (chunk.length < scanChunk) break;
+    }
+    if (visible.length === 0) {
+      if (finalizeWhenEmpty) {
+        this.sendDeliveryBatch([], fromDeliverySeq, maxScanned, 0, true);
+      }
+      return 0;
+    }
+    const totalBatches = Math.ceil(visible.length / this.batchSize);
+    let base = fromDeliverySeq;
+    for (let i = 0; i < totalBatches; i++) {
+      const slice = visible.slice(i * this.batchSize, (i + 1) * this.batchSize);
+      const lastInSlice = slice[slice.length - 1];
+      if (lastInSlice === void 0) continue;
+      const isFinal = i === totalBatches - 1;
+      const lastSeq = lastInSlice.deliverySequence;
+      const max = isFinal ? Math.max(maxScanned, lastSeq) : lastSeq;
+      this.sendDeliveryBatch(slice, base, max, i, isFinal);
+      base = max;
+    }
+    return visible.length;
+  }
+  /** Build, track, and send one chained delivery-stream batch. */
+  sendDeliveryBatch(slice, base, max, batchIndex, isFinal) {
+    const batchMsg = {
+      type: "operation-batch",
+      messageId: (0, import_core10.generateUUIDv7)(),
+      operations: slice.map((delivered) => this.serializer.encodeOperation(delivered.operation)),
+      isFinal,
+      batchIndex,
+      baseDeliverySequence: base,
+      maxDeliverySequence: max
+    };
+    this.sendToClient(batchMsg);
+    if (slice.length > 0) {
+      this.emitter?.emit({
+        type: "sync:sent",
+        operations: slice.map((delivered) => delivered.operation),
+        batchSize: slice.length
+      });
+    }
+  }
+  async operationVisibleToClient(op) {
+    const scopes = this.authContext?.scopes;
+    const subsets = this.syncQuerySubsets;
+    const needsBackfill = missingScopeFields(op, scopes).length > 0 || subsets !== void 0 && subsets.length > 0;
+    const fullRecord = needsBackfill ? await this.lookupRecordFields(op.collection, op.recordId) : void 0;
+    if (!operationMatchesScopes(op, scopes, fullRecord)) {
       return false;
     }
-    return (0, import_sync3.operationMatchesQuerySubsets)(op, this.syncQuerySubsets);
+    return (0, import_sync3.operationMatchesQuerySubsets)(op, subsets, fullRecord);
+  }
+  /**
+   * Read a record's current field values from the materialized store for scope /
+   * query-subset backfill. Includes soft-deleted rows so a relayed delete (whose op
+   * carries no fields) is still judged against the record's actual scope. Returns
+   * undefined when the record cannot be read (never materialized, or no schema).
+   */
+  async lookupRecordFields(collection, recordId) {
+    try {
+      const rows = await this.store.queryCollection(collection, {
+        where: { id: recordId },
+        includeDeleted: true,
+        limit: 1
+      });
+      return rows[0];
+    } catch {
+      return void 0;
+    }
   }
   handleAwarenessUpdate(msg) {
     this.onAwarenessUpdate?.(this.sessionId, msg);
@@ -2899,6 +3455,7 @@ var ClientSession = class {
   handleTransportClose() {
     if (this.state === "closed") return;
     this.state = "closed";
+    this.flushOrphanedRelays();
     this.emitter?.emit({ type: "sync:disconnected", reason: "transport closed" });
     this.onClose?.(this.sessionId);
   }
@@ -3349,9 +3906,9 @@ function pickFields(record, keys) {
   }
   return picked;
 }
-async function buildRouteOperation(store, mutation) {
+async function buildRouteOperation(store, mutation, currentOverride, clockOverride) {
   const nodeId = store.getNodeId();
-  const clock = new import_core12.HybridLogicalClock(nodeId);
+  const clock = clockOverride ?? new import_core12.HybridLogicalClock(nodeId);
   const schemaVersion = store.getSchema()?.version ?? 1;
   const sequenceNumber = nextServerSequenceNumber(store);
   if (mutation.type === "insert") {
@@ -3376,7 +3933,7 @@ async function buildRouteOperation(store, mutation) {
       `A ${mutation.type} mutation on "${mutation.collection}" requires a recordId.`
     );
   }
-  const current = await store.findRecord(mutation.collection, mutation.recordId);
+  const current = currentOverride ? currentOverride.record : await store.findRecord(mutation.collection, mutation.recordId);
   if (mutation.type === "update") {
     const rawData = mutation.data ?? {};
     const data = {};
@@ -3493,11 +4050,88 @@ function createRouteContext(server, store) {
     }
     return commitOperation(prepared.op, mutation.collection);
   }
+  async function runConditionalViaStore(storeApplyConditional, spec, options) {
+    const scope = options?.scope;
+    const mutations = [];
+    const hasTargetUpdate = spec.update !== void 0 && spec.update !== null;
+    if (hasTargetUpdate) {
+      mutations.push({
+        collection: spec.collection,
+        type: "update",
+        recordId: spec.id,
+        data: spec.update
+      });
+    }
+    if (spec.also) {
+      mutations.push(...spec.also);
+    }
+    let result;
+    try {
+      result = await storeApplyConditional({
+        target: { collection: spec.collection, id: spec.id },
+        ...spec.idempotencyKey ? { idempotencyKey: spec.idempotencyKey } : {},
+        admit: (current) => spec.if && Object.keys(spec.if).length > 0 ? evaluateRoutePredicate(current, spec.if) : true,
+        buildOperations: async (current, context) => {
+          const ops = [];
+          for (let i = 0; i < mutations.length; i++) {
+            const mutation = mutations[i];
+            const useLockedCurrent = i === 0 && hasTargetUpdate;
+            const op = await buildRouteOperation(
+              store,
+              mutation,
+              useLockedCurrent ? { record: current } : void 0,
+              context.clock
+            );
+            if (scope && !operationMatchesScopes(op, scope)) {
+              throw new RouteMutationError(
+                "SCOPE_VIOLATION",
+                `Mutation on "${mutation.collection}" is outside the provided scope.`
+              );
+            }
+            ops.push(op);
+          }
+          return ops;
+        }
+      });
+    } catch (error) {
+      if (error instanceof RouteMutationError) {
+        return {
+          ok: false,
+          code: error.code,
+          message: error.message,
+          retriable: isRetriableRejection(error.code)
+        };
+      }
+      throw error;
+    }
+    if (!result.admitted) {
+      return {
+        ok: false,
+        code: spec.reject?.code ?? "CONDITION_NOT_MET",
+        message: spec.reject?.message ?? `Admission condition not met on "${spec.collection}" record "${spec.id}".`,
+        retriable: false
+      };
+    }
+    if (result.idempotent) {
+      const records2 = spec.idempotencyKey ? [await store.findRecord(spec.idempotencyKey.collection, spec.idempotencyKey.id)] : [];
+      return { ok: true, idempotent: true, operations: [], records: records2 };
+    }
+    server.relayServerOperations(result.applied);
+    const records = [];
+    for (const op of result.applied) {
+      records.push(await store.findRecord(op.collection, op.recordId));
+    }
+    return { ok: true, idempotent: false, operations: result.applied, records };
+  }
   return {
     apply(mutation, options) {
       return serialize(() => rawApply(mutation, options?.scope));
     },
     applyConditional(spec, options) {
+      const storeApplyConditional = store.applyConditional;
+      if (storeApplyConditional) {
+        return runConditionalViaStore(storeApplyConditional.bind(store), spec, options);
+      }
       return serialize(async () => {
         if (spec.idempotencyKey) {
           const existing = await store.findRecord(
@@ -3585,7 +4219,8 @@ var DEFAULT_BATCH_SIZE2 = 100;
 var DEFAULT_SCHEMA_VERSION2 = 1;
 var DEFAULT_HOST = "0.0.0.0";
 var DEFAULT_PATH = "/";
-var KoraSyncServer = class {
+var RELAY_RETRANSMIT_INTERVAL_MS = 2e3;
+var KoraSyncServer = class _KoraSyncServer {
   store;
   auth;
   serializer;
@@ -3615,6 +4250,20 @@ var KoraSyncServer = class {
   serverVersion = "1.0.0-beta.0";
   wsServer = null;
   running = false;
+  /**
+   * Periodic tick that retransmits relay batches connected clients have not
+   * acknowledged, so a relay dropped by a lossy transport is redelivered instead of
+   * leaving that client with a permanent version-vector gap (a lost operation).
+   */
+  relayRetransmitTimer = null;
+  /**
+   * Relay operations a client never acknowledged before it disconnected, buffered by
+   * client node id so they can be redelivered on its next connection. Bounded per
+   * node and expired by age so a client that never returns cannot grow this forever.
+   */
+  orphanedRelaysByNode = /* @__PURE__ */ new Map();
+  static MAX_ORPHANED_RELAY_OPS_PER_NODE = 5e3;
+  static ORPHANED_RELAY_TTL_MS = 5 * 6e4;
   constructor(config) {
     this.store = config.store;
     this.auth = config.auth ?? null;
@@ -3642,6 +4291,57 @@ var KoraSyncServer = class {
     if (!this.emitter) {
       this.emitter = new import_internal2.SimpleEventEmitter();
     }
+    this.relayRetransmitTimer = setInterval(() => {
+      this.retransmitPendingRelays(RELAY_RETRANSMIT_INTERVAL_MS);
+    }, RELAY_RETRANSMIT_INTERVAL_MS);
+    this.relayRetransmitTimer.unref?.();
+  }
+  /**
+   * Retransmit relay batches that connected clients have not acknowledged within
+   * `staleMs`. Called on a periodic tick and directly by tests. Redelivering an
+   * already-applied operation is harmless (clients dedup by content-addressed id).
+   */
+  retransmitPendingRelays(staleMs = 0) {
+    for (const session of this.sessions.values()) {
+      session.retransmitPendingRelays(staleMs);
+    }
+    this.expireOrphanedRelays();
+  }
+  /**
+   * Buffer relay operations a disconnected client never acknowledged, keyed by its
+   * node id, deduped by operation id and bounded by count. Redelivered when the
+   * client reconnects (see {@link takeOrphanedRelays}).
+   */
+  bufferOrphanedRelays(nodeId, ops) {
+    if (ops.length === 0) return;
+    const existing = this.orphanedRelaysByNode.get(nodeId);
+    const merged = existing ? existing.ops : [];
+    const seen = new Set(merged.map((op) => op.id));
+    for (const op of ops) {
+      if (!seen.has(op.id)) {
+        merged.push(op);
+        seen.add(op.id);
+      }
+    }
+    const bounded = merged.length > _KoraSyncServer.MAX_ORPHANED_RELAY_OPS_PER_NODE ? merged.slice(merged.length - _KoraSyncServer.MAX_ORPHANED_RELAY_OPS_PER_NODE) : merged;
+    this.orphanedRelaysByNode.set(nodeId, { ops: bounded, bufferedAtMs: Date.now() });
+  }
+  /** Remove and return a node's buffered orphaned relay operations, if any. */
+  takeOrphanedRelays(nodeId) {
+    const entry = this.orphanedRelaysByNode.get(nodeId);
+    if (!entry) return [];
+    this.orphanedRelaysByNode.delete(nodeId);
+    return entry.ops;
+  }
+  /** Drop buffered orphaned relays older than the TTL (client never returned). */
+  expireOrphanedRelays() {
+    if (this.orphanedRelaysByNode.size === 0) return;
+    const cutoff = Date.now() - _KoraSyncServer.ORPHANED_RELAY_TTL_MS;
+    for (const [nodeId, entry] of this.orphanedRelaysByNode) {
+      if (entry.bufferedAtMs <= cutoff) {
+        this.orphanedRelaysByNode.delete(nodeId);
+      }
+    }
   }
   /**
    * The trusted, scoped data-plane context (`apply` / `query` / `findById`).
@@ -3768,6 +4468,11 @@ var KoraSyncServer = class {
       event: "server.stopping",
       details: { connectedClients: this.sessions.size }
     });
+    if (this.relayRetransmitTimer) {
+      clearInterval(this.relayRetransmitTimer);
+      this.relayRetransmitTimer = null;
+    }
+    this.orphanedRelaysByNode.clear();
     this.awarenessRelay.clear();
     this.yjsDocRelay.clear();
     this.blobChunkRelay.clear();
@@ -3929,7 +4634,11 @@ var KoraSyncServer = class {
       ...this.validateOperation ? { validateOperation: this.validateOperation, koraContext: this.koraContext } : {},
       onClose: (sid) => {
         this.handleSessionClose(sid);
-      }
+      },
+      onOrphanedRelays: (nodeId, ops) => {
+        this.bufferOrphanedRelays(nodeId, ops);
+      },
+      takeOrphanedRelays: (nodeId) => this.takeOrphanedRelays(nodeId)
     });
     this.sessions.set(sessionId, session);
     this.yjsDocRelay.addClient(sessionId, transport);
@@ -3989,6 +4698,22 @@ var KoraSyncServer = class {
     }
     return result;
   }
+  /**
+   * Relay already-applied, server-originated operations to every connected client.
+   * Used by the conditional route apply, which commits its operations atomically
+   * through the store (bypassing {@link applyLocalOperation}) and then fans them
+   * out. Each session still enforces its own per-scope visibility filter.
+   *
+   * @param operations - Operations that have already been committed to the store
+   */
+  relayServerOperations(operations2) {
+    if (operations2.length === 0) {
+      return;
+    }
+    for (const session of this.sessions.values()) {
+      session.relayOperations(operations2);
+    }
+  }
   /**
    * Collect every blob reference still reachable from live records on the server.
    *