@korajs/server 1.0.0-beta.5 → 1.0.0-beta.7

package/dist/index.cjs

@@ -395,6 +395,9 @@ function serializeFieldValue(value, descriptor) {
   if (value === null || value === void 0) return null;
   switch (descriptor.kind) {
     case "array":
+    case "object":
+    case "json":
+    case "blob":
       return typeof value === "string" ? value : JSON.stringify(value);
     case "boolean":
       return value ? 1 : 0;
@@ -408,6 +411,9 @@ function deserializeFieldValue(value, descriptor) {
   if (value === null || value === void 0) return null;
   switch (descriptor.kind) {
     case "array":
+    case "object":
+    case "json":
+    case "blob":
       return typeof value === "string" ? JSON.parse(value) : value;
     case "boolean":
       return value === 1 || value === true;
@@ -2734,6 +2740,20 @@ function warnIfMultiTenantWithoutScopes(auth, resolvedScopes, schema) {
     "[kora] An authenticated session resolved to no sync scopes, so every user will sync every other user's data. Return per-user sync scopes from your auth provider (for example KoraAuthProvider's resolveScopes) to isolate tenants. Note: declaring sync rules in your schema is not enough on its own \u2014 the per-user values come from the auth provider. (This warning is expected for single-tenant apps where all authenticated users are meant to share the same data.)"
   );
 }
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    const entries = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function sameScopeMap(a, b) {
+  return stableStringify(a ?? null) === stableStringify(b ?? null);
+}
 var ClientSession = class _ClientSession {
   state = "connected";
   clientNodeId = null;
@@ -2775,6 +2795,7 @@ var ClientSession = class _ClientSession {
   auth;
   serializer;
   emitter;
+  logger;
   batchSize;
   schemaVersion;
   supportedSchemaVersions;
@@ -2799,6 +2820,7 @@ var ClientSession = class _ClientSession {
     this.auth = options.auth ?? null;
     this.serializer = options.serializer ?? new import_sync3.NegotiatedMessageSerializer("json");
     this.emitter = options.emitter ?? null;
+    this.logger = options.logger ?? null;
     this.batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
     this.schemaVersion = options.schemaVersion ?? DEFAULT_SCHEMA_VERSION;
     const supported = options.supportedSchemaVersions;
@@ -3033,6 +3055,18 @@ var ClientSession = class _ClientSession {
   }
   handleMessageFailure(error) {
     const reason = error instanceof Error ? error.message : "Message handling failed";
+    this.logger?.log({
+      timestamp: Date.now(),
+      level: "error",
+      event: "session.message_failed",
+      sessionId: this.sessionId,
+      nodeId: this.clientNodeId ?? void 0,
+      error: reason,
+      details: {
+        state: this.state,
+        errorName: error instanceof Error ? error.name : typeof error
+      }
+    });
     this.sendError("SYNC_ERROR", reason, true);
     this.close(reason);
   }
@@ -3072,6 +3106,9 @@ var ClientSession = class _ClientSession {
     }
     this.resumeDeltaCursor = msg.deltaCursor ? (0, import_sync3.decodeDeltaCursor)(msg.deltaCursor) : null;
     this.clientDeliveryWatermark = msg.lastDeliverySequence ?? null;
+    if (this.clientDeliveryWatermark !== null && !sameScopeMap(msg.syncScope, this.authContext?.scopes)) {
+      this.clientDeliveryWatermark = 0;
+    }
     const clientUsesWatermark = this.clientDeliveryWatermark !== null;
     let serverMaxDelivery = 0;
     if (clientUsesWatermark) {
@@ -3199,20 +3236,17 @@ var ClientSession = class _ClientSession {
           continue;
         }
       }
-      try {
-        const applyResult = await applyServerOperation(this.store, op);
-        if (applyResult.rejection) {
-          this.sendError(
-            applyResult.rejection.code,
-            applyResult.rejection.message,
-            applyResult.rejection.retriable
-          );
-          continue;
-        }
-        if (applyResult.result === "applied") {
-          applied.push(...applyResult.appliedOperations);
-        }
-      } catch {
+      const applyResult = await applyServerOperation(this.store, op);
+      if (applyResult.rejection) {
+        this.sendError(
+          applyResult.rejection.code,
+          applyResult.rejection.message,
+          applyResult.rejection.retriable
+        );
+        continue;
+      }
+      if (applyResult.result === "applied") {
+        applied.push(...applyResult.appliedOperations);
       }
     }
     if (rejected.length > 0) {
@@ -4608,6 +4642,7 @@ var KoraSyncServer = class _KoraSyncServer {
       auth: this.auth ?? void 0,
       serializer: this.serializer,
       emitter: sessionEmitter,
+      logger: this.logger,
       batchSize: this.batchSize,
       schemaVersion: this.schemaVersion,
       supportedSchemaVersions: this.supportedSchemaVersions,
@@ -4936,6 +4971,7 @@ function createProductionServer(config) {
   const port = config.port ?? (Number(process.env.PORT) || 3001);
   const staticDir = config.staticDir ?? "./dist";
   const syncPath = config.syncPath ?? "/kora-sync";
+  const crossOriginEmbedderPolicy = config.crossOriginEmbedderPolicy ?? "credentialless";
   const syncServer = new KoraSyncServer({
     store: config.store,
     enableDashboard: true,
@@ -5106,7 +5142,7 @@ function createProductionServer(config) {
       });
       async function handleRequest(req, res) {
         res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
-        res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
+        res.setHeader("Cross-Origin-Embedder-Policy", crossOriginEmbedderPolicy);
         const url = new URL(req.url || "/", `http://${req.headers.host}`);
         if (url.pathname === "/health") {
           const status = await syncServer.getStatus();