@korajs/server 1.0.0-beta.5 → 1.0.0-beta.7

package/dist/index.d.cts

@@ -1051,6 +1051,8 @@ interface ClientSessionOptions {
     serializer?: MessageSerializer;
     /** Event emitter for DevTools integration */
     emitter?: KoraEventEmitter;
+    /** Structured logger used for protocol and persistence failures */
+    logger?: Logger;
     /** Max operations per sync batch */
     batchSize?: number;
     /** Schema version the server expects */
@@ -1155,6 +1157,7 @@ declare class ClientSession {
     private readonly auth;
     private readonly serializer;
     private readonly emitter;
+    private readonly logger;
     private readonly batchSize;
     private readonly schemaVersion;
     private readonly supportedSchemaVersions;
@@ -1289,6 +1292,13 @@ interface ProductionServerConfig {
     syncPath?: string;
     /** Additional KoraSyncServer options */
     syncOptions?: Omit<KoraSyncServerConfig, 'store' | 'port' | 'host' | 'path'>;
+    /**
+     * Cross-Origin-Embedder-Policy for static and route responses. Defaults to
+     * `credentialless`, which keeps third-party embeds usable while allowing
+     * capable browsers to enable cross-origin isolation. Use `require-corp` only
+     * when every embedded resource explicitly opts in with CORP/CORS headers.
+     */
+    crossOriginEmbedderPolicy?: 'credentialless' | 'require-corp' | 'unsafe-none';
     /**
      * Optional HTTP route handlers mounted before static file serving.
      *

package/dist/index.d.ts

@@ -1051,6 +1051,8 @@ interface ClientSessionOptions {
     serializer?: MessageSerializer;
     /** Event emitter for DevTools integration */
     emitter?: KoraEventEmitter;
+    /** Structured logger used for protocol and persistence failures */
+    logger?: Logger;
     /** Max operations per sync batch */
     batchSize?: number;
     /** Schema version the server expects */
@@ -1155,6 +1157,7 @@ declare class ClientSession {
     private readonly auth;
     private readonly serializer;
     private readonly emitter;
+    private readonly logger;
     private readonly batchSize;
     private readonly schemaVersion;
     private readonly supportedSchemaVersions;
@@ -1289,6 +1292,13 @@ interface ProductionServerConfig {
     syncPath?: string;
     /** Additional KoraSyncServer options */
     syncOptions?: Omit<KoraSyncServerConfig, 'store' | 'port' | 'host' | 'path'>;
+    /**
+     * Cross-Origin-Embedder-Policy for static and route responses. Defaults to
+     * `credentialless`, which keeps third-party embeds usable while allowing
+     * capable browsers to enable cross-origin isolation. Use `require-corp` only
+     * when every embedded resource explicitly opts in with CORP/CORS headers.
+     */
+    crossOriginEmbedderPolicy?: 'credentialless' | 'require-corp' | 'unsafe-none';
     /**
      * Optional HTTP route handlers mounted before static file serving.
      *

package/dist/index.js

@@ -196,6 +196,9 @@ function serializeFieldValue(value, descriptor) {
   if (value === null || value === void 0) return null;
   switch (descriptor.kind) {
     case "array":
+    case "object":
+    case "json":
+    case "blob":
       return typeof value === "string" ? value : JSON.stringify(value);
     case "boolean":
       return value ? 1 : 0;
@@ -209,6 +212,9 @@ function deserializeFieldValue(value, descriptor) {
   if (value === null || value === void 0) return null;
   switch (descriptor.kind) {
     case "array":
+    case "object":
+    case "json":
+    case "blob":
       return typeof value === "string" ? JSON.parse(value) : value;
     case "boolean":
       return value === 1 || value === true;
@@ -2530,6 +2536,20 @@ function warnIfMultiTenantWithoutScopes(auth, resolvedScopes, schema) {
     "[kora] An authenticated session resolved to no sync scopes, so every user will sync every other user's data. Return per-user sync scopes from your auth provider (for example KoraAuthProvider's resolveScopes) to isolate tenants. Note: declaring sync rules in your schema is not enough on its own \u2014 the per-user values come from the auth provider. (This warning is expected for single-tenant apps where all authenticated users are meant to share the same data.)"
   );
 }
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    const entries = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function sameScopeMap(a, b) {
+  return stableStringify(a ?? null) === stableStringify(b ?? null);
+}
 var ClientSession = class _ClientSession {
   state = "connected";
   clientNodeId = null;
@@ -2571,6 +2591,7 @@ var ClientSession = class _ClientSession {
   auth;
   serializer;
   emitter;
+  logger;
   batchSize;
   schemaVersion;
   supportedSchemaVersions;
@@ -2595,6 +2616,7 @@ var ClientSession = class _ClientSession {
     this.auth = options.auth ?? null;
     this.serializer = options.serializer ?? new NegotiatedMessageSerializer("json");
     this.emitter = options.emitter ?? null;
+    this.logger = options.logger ?? null;
     this.batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
     this.schemaVersion = options.schemaVersion ?? DEFAULT_SCHEMA_VERSION;
     const supported = options.supportedSchemaVersions;
@@ -2829,6 +2851,18 @@ var ClientSession = class _ClientSession {
   }
   handleMessageFailure(error) {
     const reason = error instanceof Error ? error.message : "Message handling failed";
+    this.logger?.log({
+      timestamp: Date.now(),
+      level: "error",
+      event: "session.message_failed",
+      sessionId: this.sessionId,
+      nodeId: this.clientNodeId ?? void 0,
+      error: reason,
+      details: {
+        state: this.state,
+        errorName: error instanceof Error ? error.name : typeof error
+      }
+    });
     this.sendError("SYNC_ERROR", reason, true);
     this.close(reason);
   }
@@ -2868,6 +2902,9 @@ var ClientSession = class _ClientSession {
     }
     this.resumeDeltaCursor = msg.deltaCursor ? decodeDeltaCursor(msg.deltaCursor) : null;
     this.clientDeliveryWatermark = msg.lastDeliverySequence ?? null;
+    if (this.clientDeliveryWatermark !== null && !sameScopeMap(msg.syncScope, this.authContext?.scopes)) {
+      this.clientDeliveryWatermark = 0;
+    }
     const clientUsesWatermark = this.clientDeliveryWatermark !== null;
     let serverMaxDelivery = 0;
     if (clientUsesWatermark) {
@@ -2995,20 +3032,17 @@ var ClientSession = class _ClientSession {
           continue;
         }
       }
-      try {
-        const applyResult = await applyServerOperation(this.store, op);
-        if (applyResult.rejection) {
-          this.sendError(
-            applyResult.rejection.code,
-            applyResult.rejection.message,
-            applyResult.rejection.retriable
-          );
-          continue;
-        }
-        if (applyResult.result === "applied") {
-          applied.push(...applyResult.appliedOperations);
-        }
-      } catch {
+      const applyResult = await applyServerOperation(this.store, op);
+      if (applyResult.rejection) {
+        this.sendError(
+          applyResult.rejection.code,
+          applyResult.rejection.message,
+          applyResult.rejection.retriable
+        );
+        continue;
+      }
+      if (applyResult.result === "applied") {
+        applied.push(...applyResult.appliedOperations);
       }
     }
     if (rejected.length > 0) {
@@ -4406,6 +4440,7 @@ var KoraSyncServer = class _KoraSyncServer {
       auth: this.auth ?? void 0,
       serializer: this.serializer,
       emitter: sessionEmitter,
+      logger: this.logger,
       batchSize: this.batchSize,
       schemaVersion: this.schemaVersion,
       supportedSchemaVersions: this.supportedSchemaVersions,
@@ -4729,6 +4764,7 @@ function createProductionServer(config) {
   const port = config.port ?? (Number(process.env.PORT) || 3001);
   const staticDir = config.staticDir ?? "./dist";
   const syncPath = config.syncPath ?? "/kora-sync";
+  const crossOriginEmbedderPolicy = config.crossOriginEmbedderPolicy ?? "credentialless";
   const syncServer = new KoraSyncServer({
     store: config.store,
     enableDashboard: true,
@@ -4899,7 +4935,7 @@ function createProductionServer(config) {
       });
       async function handleRequest(req, res) {
         res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
-        res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
+        res.setHeader("Cross-Origin-Embedder-Policy", crossOriginEmbedderPolicy);
         const url = new URL(req.url || "/", `http://${req.headers.host}`);
         if (url.pathname === "/health") {
           const status = await syncServer.getStatus();