@korajs/sync 1.0.0-beta.0 → 1.0.0-beta.10

package/dist/internal.d.cts

@@ -1,4 +1,4 @@
-import { c as SyncTransport, T as TransportOptions, a as SyncMessage, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, Q as QueueStorage } from './transport-BMesMB6s.cjs';
+import { c as SyncTransport, T as TransportOptions, a as SyncMessage, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, Q as QueueStorage } from './transport-B2GQerqJ.cjs';
 import { Operation } from '@korajs/core';
 
 /**

package/dist/internal.d.ts

@@ -1,4 +1,4 @@
-import { c as SyncTransport, T as TransportOptions, a as SyncMessage, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, Q as QueueStorage } from './transport-BMesMB6s.js';
+import { c as SyncTransport, T as TransportOptions, a as SyncMessage, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, Q as QueueStorage } from './transport-B2GQerqJ.js';
 import { Operation } from '@korajs/core';
 
 /**

package/dist/{transport-BMesMB6s.d.cts → transport-B2GQerqJ.d.cts}

@@ -93,7 +93,7 @@ type SyncState = (typeof SYNC_STATES)[number];
 /**
  * Developer-facing sync status. Simplified view of the internal state.
  */
-declare const SYNC_STATUSES: readonly ["connected", "syncing", "synced", "offline", "clock-error", "error", "schema-mismatch"];
+declare const SYNC_STATUSES: readonly ["connected", "reconnecting", "syncing", "synced", "offline", "clock-error", "error", "schema-mismatch"];
 type SyncStatus = (typeof SYNC_STATUSES)[number];
 /**
  * Sync status information exposed to developers.
@@ -101,6 +101,8 @@ type SyncStatus = (typeof SYNC_STATUSES)[number];
 interface SyncStatusInfo {
     /** Current developer-facing status */
     status: SyncStatus;
+    /** True when the engine is actively trying to re-establish a transport session. */
+    reconnecting: boolean;
     /** Number of operations waiting to be sent */
     pendingOperations: number;
     /** Timestamp of last successful sync (null if never synced) */
@@ -141,6 +143,13 @@ interface SyncConfig {
     scopeMap?: SyncScopeMap;
     /** Number of operations per batch. Defaults to 100. */
     batchSize?: number;
+    /**
+     * Maximum time to wait for the server to acknowledge an outbound batch before
+     * treating the connection as stalled. The batch is returned to the durable
+     * outbound queue before disconnecting so it can be retried on reconnect.
+     * Defaults to 30000ms. Set to 0 to disable the watchdog.
+     */
+    outboundAckTimeoutMs?: number;
     /** Initial reconnection delay in ms. Defaults to 1000. */
     reconnectInterval?: number;
     /** Maximum reconnection delay in ms. Defaults to 30000. */
@@ -193,6 +202,23 @@ interface SyncStatePersistence {
     /** Resume position for paginated initial sync (optional). */
     loadDeltaCursor?(): Promise<DeltaCursor | null>;
     saveDeltaCursor?(cursor: DeltaCursor | null): Promise<void>;
+    /**
+     * The delivery watermark for a sync view, keyed by an opaque view signature (the auth
+     * scope plus active query subscriptions). Persisted per view so a restarted client
+     * resumes each view's gap-free stream from the right point, and switching views does not
+     * re-sync a view already synced. The empty-string signature is the default, unfiltered
+     * view. Optional: a persistence layer that omits these falls back to re-sync on restart.
+     */
+    loadDeliveryWatermark?(signature: string): Promise<number>;
+    saveDeliveryWatermark?(signature: string, watermark: number): Promise<void>;
+    /** Load every persisted view watermark, keyed by signature. */
+    loadAllDeliveryWatermarks?(): Promise<Record<string, number>>;
+    /**
+     * Delete a persisted view watermark. Used to bound the number of stored view watermarks
+     * (a cold view is evicted from the client's cache and its persisted row removed). Safe:
+     * an evicted view back-fills from 0 (deduplicated) when next visited.
+     */
+    deleteDeliveryWatermark?(signature: string): Promise<void>;
 }
 /**
  * Interface for persisting the outbound operation queue.
@@ -208,6 +234,48 @@ interface QueueStorage {
     /** Return number of operations in storage */
     count(): Promise<number>;
 }
+/**
+ * A record of one outbound operation the server permanently refused. Preserved so
+ * a rejected op is explainable and reconcilable rather than silently lost.
+ */
+interface RejectedOperation {
+    /** Content-addressed id of the rejected operation. */
+    operationId: string;
+    /** Collection the operation targeted. */
+    collection: string;
+    /** Record the operation targeted. */
+    recordId: string;
+    /** Stable, machine-readable reason code from the server. */
+    code: string;
+    /** Human-readable explanation. */
+    message: string;
+    /** Whether resubmitting the identical operation may later succeed. */
+    retriable: boolean;
+    /** Wall-clock time (ms since epoch) the rejection was recorded. Display only. */
+    rejectedAt: number;
+}
+/**
+ * Interface for durably persisting operations the server rejected, so the record
+ * survives a page refresh. Keyed by operation id (idempotent on re-rejection).
+ */
+interface RejectedOperationStorage {
+    /** Record (or overwrite) a rejected operation. */
+    record(rejected: RejectedOperation): Promise<void>;
+    /** List all recorded rejected operations. */
+    list(): Promise<RejectedOperation[]>;
+    /** Remove rejected operations by their operation ids (after the app reconciles them). */
+    remove(operationIds: string[]): Promise<void>;
+}
+/**
+ * In-memory {@link RejectedOperationStorage}. The default when no durable store is
+ * provided; suitable for tests and ephemeral sessions.
+ */
+declare class MemoryRejectedOperationStorage implements RejectedOperationStorage {
+    private readonly rejected;
+    record(rejected: RejectedOperation): Promise<void>;
+    list(): Promise<RejectedOperation[]>;
+    remove(operationIds: string[]): Promise<void>;
+}
 /**
  * Thrown when an operation violates sync scope constraints.
  * This can happen when:
@@ -286,6 +354,14 @@ interface HandshakeMessage {
     deltaCursor?: string;
     /** Live query filters that further narrow synced data within auth/schema scope */
     syncQueries?: SyncQuerySubset[];
+    /**
+     * The client's persisted delivery watermark: the highest server delivery sequence
+     * up to which it has contiguously applied every in-scope operation. Omitted (or 0)
+     * on first sync. When present, the server resumes the gap-free server->client
+     * stream from just after it, superseding the version-vector delta and the resume
+     * cursor for the server->client direction. Optional, so old servers ignore it.
+     */
+    lastDeliverySequence?: number;
 }
 /**
  * Server response to a handshake.
@@ -307,6 +383,19 @@ interface HandshakeResponseMessage {
     acceptedScope?: Record<string, Record<string, unknown>>;
     /** Server wall-clock time (ms since epoch) at response creation. Lets clients measure their own clock skew. */
     serverTime?: number;
+    /**
+     * Whether the server persists blob bytes centrally. When true, a client
+     * automatically uploads the bytes behind its `blob` fields so they remain
+     * available to other devices even after the authoring device goes offline.
+     */
+    blobStorageEnabled?: boolean;
+    /**
+     * The server's highest delivery sequence at handshake time. A client whose
+     * persisted delivery watermark exceeds this (the server's operation log was rolled
+     * back, for example by a backup restore) resets its watermark to 0 so it resyncs
+     * from the beginning instead of sitting above a frontier that no longer exists.
+     */
+    serverMaxDeliverySequence?: number;
 }
 /**
  * Batch of operations sent during delta exchange or streaming.
@@ -323,6 +412,20 @@ interface OperationBatchMessage {
     cursor?: string;
     /** Total batches in this delta exchange (for progress reporting) */
     totalBatches?: number;
+    /**
+     * Delivery-watermark chaining (server->client). `baseDeliverySequence` is the
+     * delivery sequence the client must already hold for this batch to apply in order
+     * (it equals the previous batch's `maxDeliverySequence`, or the client's reported
+     * watermark for the first batch after a handshake). `maxDeliverySequence` is the
+     * highest delivery sequence carried by this batch. The client applies the batch
+     * only when its watermark equals `baseDeliverySequence`, then advances the
+     * watermark to `maxDeliverySequence`. A dropped batch breaks the chain and stalls
+     * the watermark, so the reconnect resend recovers it. Present only on batches the
+     * server sends as part of the delivery stream; absent on legacy version-vector
+     * batches.
+     */
+    baseDeliverySequence?: number;
+    maxDeliverySequence?: number;
 }
 /**
  * Acknowledgment of a received message.
@@ -332,6 +435,12 @@ interface AcknowledgmentMessage {
     messageId: string;
     acknowledgedMessageId: string;
     lastSequenceNumber: number;
+    /**
+     * The acknowledged batch's `maxDeliverySequence`, echoed so the server can advance
+     * this client's durable delivery watermark. Present only when acking a delivery-
+     * stream batch. `lastSequenceNumber` stays for existing per-node behavior.
+     */
+    deliverySequence?: number;
 }
 /**
  * Error message from the server or client.
@@ -343,6 +452,33 @@ interface ErrorMessage {
     message: string;
     retriable: boolean;
 }
+/**
+ * Server-to-client rejection of ONE specific operation the client submitted.
+ *
+ * Unlike {@link ErrorMessage}, which is connection-level, this is tied to an
+ * `operationId` so the client can divert exactly that operation out of its
+ * pending outbound queue and into a durable rejected-operations store — kept and
+ * explainable rather than silently retried forever or lost on the batch ack. The
+ * operation never entered the server's authoritative log, so no other replica
+ * ever sees it; the submitter is told so its optimistic local copy can be
+ * reconciled (rolled back or resubmitted) by the app.
+ */
+interface OperationRejectedMessage {
+    type: 'operation-rejected';
+    messageId: string;
+    /** Content-addressed id of the rejected operation. */
+    operationId: string;
+    /** Collection the rejected operation targeted (for app routing / display). */
+    collection: string;
+    /** Record the rejected operation targeted. */
+    recordId: string;
+    /** Stable, machine-readable reason code. */
+    code: string;
+    /** Human-readable explanation. */
+    message: string;
+    /** Whether resubmitting the identical operation may later succeed. */
+    retriable: boolean;
+}
 /**
  * Awareness state for a single client (cursor position, user info).
  * Wire-format representation for JSON transport.
@@ -387,10 +523,55 @@ interface YjsDocUpdateMessage {
     /** Base64-encoded Yjs update binary */
     update: string;
 }
+/**
+ * Request for a single blob chunk by content hash. Ephemeral side channel for
+ * out-of-band blob transfer over the sync connection; never persisted in the
+ * operation log (durable state is the BlobRef inside a record's fields).
+ *
+ * Possession of a chunk hash is itself the capability to request it: hashes are
+ * only learned from BlobRefs inside records the peer already received through
+ * its (scope-filtered) sync, and SHA-256 preimage resistance makes guessing a
+ * hash infeasible. The server therefore relays chunk requests among peers
+ * without a separate ACL.
+ */
+interface BlobChunkRequestMessage {
+    type: 'blob-chunk-request';
+    messageId: string;
+    /** Correlates the response to this request. */
+    requestId: string;
+    /** SHA-256 hash of the requested chunk. */
+    hash: string;
+}
+/**
+ * Response to a {@link BlobChunkRequestMessage}. Carries the chunk bytes, or
+ * null when the responder does not hold that hash.
+ */
+interface BlobChunkResponseMessage {
+    type: 'blob-chunk-response';
+    messageId: string;
+    /** Echoes the request's `requestId` for correlation. */
+    requestId: string;
+    /** Base64-encoded chunk bytes, or null when the responder does not hold the hash. */
+    bytes: string | null;
+}
+/**
+ * Unsolicited upload of a blob chunk (or a blob manifest) from a client to the
+ * server, so the server can persist it centrally and serve it to other devices
+ * even after the authoring device disconnects. Content-addressed: the receiver
+ * verifies the bytes hash to `hash`.
+ */
+interface BlobChunkPushMessage {
+    type: 'blob-chunk-push';
+    messageId: string;
+    /** SHA-256 hash of the pushed bytes (a chunk hash or a manifest hash). */
+    hash: string;
+    /** Base64-encoded bytes. */
+    bytes: string;
+}
 /**
  * Union of all sync protocol messages.
  */
-type SyncMessage = HandshakeMessage | HandshakeResponseMessage | OperationBatchMessage | AcknowledgmentMessage | ErrorMessage | AwarenessUpdateMessage | YjsDocUpdateMessage;
+type SyncMessage = HandshakeMessage | HandshakeResponseMessage | OperationBatchMessage | AcknowledgmentMessage | ErrorMessage | OperationRejectedMessage | AwarenessUpdateMessage | YjsDocUpdateMessage | BlobChunkRequestMessage | BlobChunkResponseMessage | BlobChunkPushMessage;
 /**
  * Check if an unknown value is a valid SyncMessage.
  */
@@ -415,6 +596,10 @@ declare function isAcknowledgmentMessage(value: unknown): value is Acknowledgmen
  * Check if a value is an ErrorMessage.
  */
 declare function isErrorMessage(value: unknown): value is ErrorMessage;
+/**
+ * Check if a value is an OperationRejectedMessage.
+ */
+declare function isOperationRejectedMessage(value: unknown): value is OperationRejectedMessage;
 /**
  * Check if a value is an AwarenessUpdateMessage.
  */
@@ -423,6 +608,18 @@ declare function isAwarenessUpdateMessage(value: unknown): value is AwarenessUpd
  * Check if a value is a YjsDocUpdateMessage.
  */
 declare function isYjsDocUpdateMessage(value: unknown): value is YjsDocUpdateMessage;
+/**
+ * Check if a value is a BlobChunkRequestMessage.
+ */
+declare function isBlobChunkRequestMessage(value: unknown): value is BlobChunkRequestMessage;
+/**
+ * Check if a value is a BlobChunkResponseMessage.
+ */
+declare function isBlobChunkResponseMessage(value: unknown): value is BlobChunkResponseMessage;
+/**
+ * Check if a value is a BlobChunkPushMessage.
+ */
+declare function isBlobChunkPushMessage(value: unknown): value is BlobChunkPushMessage;
 
 /**
  * Options for transport connection.
@@ -466,4 +663,4 @@ interface SyncTransport {
     isConnected(): boolean;
 }
 
-export { type AcknowledgmentMessage as A, isHandshakeMessage as B, isHandshakeResponseMessage as C, type DeltaCursor as D, type EncryptedPayload as E, isOperationBatchMessage as F, isSyncMessage as G, type HandshakeMessage as H, InvalidScopeError as I, isYjsDocUpdateMessage as J, operationMatchesQuerySubsets as K, type OperationBatchMessage as O, type QueueStorage as Q, type SyncScopeMap as S, type TransportOptions as T, type VersionedKey as V, type WireFormat as W, type YjsDocUpdateMessage as Y, type SyncMessage as a, type SerializedOperation as b, type SyncTransport as c, type TransportMessageHandler as d, type TransportCloseHandler as e, type TransportErrorHandler as f, type SyncEncryptionConfig as g, type SyncState as h, type SyncStatusInfo as i, type SyncConfig as j, type SyncStatePersistence as k, type SyncQuerySubset as l, type AwarenessStateWire as m, type AwarenessUpdateMessage as n, type ErrorMessage as o, type HandshakeResponseMessage as p, SYNC_STATES as q, SYNC_STATUSES as r, ScopeViolationError as s, type SyncEncryptionAlgorithm as t, type SyncScopeContext as u, type SyncStatus as v, dedupeQuerySubsets as w, isAcknowledgmentMessage as x, isAwarenessUpdateMessage as y, isErrorMessage as z };
+export { isYjsDocUpdateMessage as $, type AcknowledgmentMessage as A, type BlobChunkRequestMessage as B, dedupeQuerySubsets as C, type DeltaCursor as D, type EncryptedPayload as E, isAcknowledgmentMessage as F, isAwarenessUpdateMessage as G, type HandshakeMessage as H, InvalidScopeError as I, isBlobChunkPushMessage as J, isBlobChunkRequestMessage as K, isBlobChunkResponseMessage as L, MemoryRejectedOperationStorage as M, isErrorMessage as N, type OperationBatchMessage as O, isHandshakeMessage as P, type QueueStorage as Q, type RejectedOperationStorage as R, type SyncScopeMap as S, type TransportOptions as T, isHandshakeResponseMessage as U, type VersionedKey as V, type WireFormat as W, isOperationBatchMessage as X, type YjsDocUpdateMessage as Y, isOperationRejectedMessage as Z, isSyncMessage as _, type SyncMessage as a, operationMatchesQuerySubsets as a0, type SerializedOperation as b, type SyncTransport as c, type TransportMessageHandler as d, type TransportCloseHandler as e, type TransportErrorHandler as f, type BlobChunkResponseMessage as g, type BlobChunkPushMessage as h, type SyncEncryptionConfig as i, type SyncState as j, type SyncStatusInfo as k, type SyncConfig as l, type SyncStatePersistence as m, type SyncQuerySubset as n, type RejectedOperation as o, type AwarenessStateWire as p, type AwarenessUpdateMessage as q, type ErrorMessage as r, type HandshakeResponseMessage as s, type OperationRejectedMessage as t, SYNC_STATES as u, SYNC_STATUSES as v, ScopeViolationError as w, type SyncEncryptionAlgorithm as x, type SyncScopeContext as y, type SyncStatus as z };

package/dist/{transport-BMesMB6s.d.ts → transport-B2GQerqJ.d.ts}

@@ -93,7 +93,7 @@ type SyncState = (typeof SYNC_STATES)[number];
 /**
  * Developer-facing sync status. Simplified view of the internal state.
  */
-declare const SYNC_STATUSES: readonly ["connected", "syncing", "synced", "offline", "clock-error", "error", "schema-mismatch"];
+declare const SYNC_STATUSES: readonly ["connected", "reconnecting", "syncing", "synced", "offline", "clock-error", "error", "schema-mismatch"];
 type SyncStatus = (typeof SYNC_STATUSES)[number];
 /**
  * Sync status information exposed to developers.
@@ -101,6 +101,8 @@ type SyncStatus = (typeof SYNC_STATUSES)[number];
 interface SyncStatusInfo {
     /** Current developer-facing status */
     status: SyncStatus;
+    /** True when the engine is actively trying to re-establish a transport session. */
+    reconnecting: boolean;
     /** Number of operations waiting to be sent */
     pendingOperations: number;
     /** Timestamp of last successful sync (null if never synced) */
@@ -141,6 +143,13 @@ interface SyncConfig {
     scopeMap?: SyncScopeMap;
     /** Number of operations per batch. Defaults to 100. */
     batchSize?: number;
+    /**
+     * Maximum time to wait for the server to acknowledge an outbound batch before
+     * treating the connection as stalled. The batch is returned to the durable
+     * outbound queue before disconnecting so it can be retried on reconnect.
+     * Defaults to 30000ms. Set to 0 to disable the watchdog.
+     */
+    outboundAckTimeoutMs?: number;
     /** Initial reconnection delay in ms. Defaults to 1000. */
     reconnectInterval?: number;
     /** Maximum reconnection delay in ms. Defaults to 30000. */
@@ -193,6 +202,23 @@ interface SyncStatePersistence {
     /** Resume position for paginated initial sync (optional). */
     loadDeltaCursor?(): Promise<DeltaCursor | null>;
     saveDeltaCursor?(cursor: DeltaCursor | null): Promise<void>;
+    /**
+     * The delivery watermark for a sync view, keyed by an opaque view signature (the auth
+     * scope plus active query subscriptions). Persisted per view so a restarted client
+     * resumes each view's gap-free stream from the right point, and switching views does not
+     * re-sync a view already synced. The empty-string signature is the default, unfiltered
+     * view. Optional: a persistence layer that omits these falls back to re-sync on restart.
+     */
+    loadDeliveryWatermark?(signature: string): Promise<number>;
+    saveDeliveryWatermark?(signature: string, watermark: number): Promise<void>;
+    /** Load every persisted view watermark, keyed by signature. */
+    loadAllDeliveryWatermarks?(): Promise<Record<string, number>>;
+    /**
+     * Delete a persisted view watermark. Used to bound the number of stored view watermarks
+     * (a cold view is evicted from the client's cache and its persisted row removed). Safe:
+     * an evicted view back-fills from 0 (deduplicated) when next visited.
+     */
+    deleteDeliveryWatermark?(signature: string): Promise<void>;
 }
 /**
  * Interface for persisting the outbound operation queue.
@@ -208,6 +234,48 @@ interface QueueStorage {
     /** Return number of operations in storage */
     count(): Promise<number>;
 }
+/**
+ * A record of one outbound operation the server permanently refused. Preserved so
+ * a rejected op is explainable and reconcilable rather than silently lost.
+ */
+interface RejectedOperation {
+    /** Content-addressed id of the rejected operation. */
+    operationId: string;
+    /** Collection the operation targeted. */
+    collection: string;
+    /** Record the operation targeted. */
+    recordId: string;
+    /** Stable, machine-readable reason code from the server. */
+    code: string;
+    /** Human-readable explanation. */
+    message: string;
+    /** Whether resubmitting the identical operation may later succeed. */
+    retriable: boolean;
+    /** Wall-clock time (ms since epoch) the rejection was recorded. Display only. */
+    rejectedAt: number;
+}
+/**
+ * Interface for durably persisting operations the server rejected, so the record
+ * survives a page refresh. Keyed by operation id (idempotent on re-rejection).
+ */
+interface RejectedOperationStorage {
+    /** Record (or overwrite) a rejected operation. */
+    record(rejected: RejectedOperation): Promise<void>;
+    /** List all recorded rejected operations. */
+    list(): Promise<RejectedOperation[]>;
+    /** Remove rejected operations by their operation ids (after the app reconciles them). */
+    remove(operationIds: string[]): Promise<void>;
+}
+/**
+ * In-memory {@link RejectedOperationStorage}. The default when no durable store is
+ * provided; suitable for tests and ephemeral sessions.
+ */
+declare class MemoryRejectedOperationStorage implements RejectedOperationStorage {
+    private readonly rejected;
+    record(rejected: RejectedOperation): Promise<void>;
+    list(): Promise<RejectedOperation[]>;
+    remove(operationIds: string[]): Promise<void>;
+}
 /**
  * Thrown when an operation violates sync scope constraints.
  * This can happen when:
@@ -286,6 +354,14 @@ interface HandshakeMessage {
     deltaCursor?: string;
     /** Live query filters that further narrow synced data within auth/schema scope */
     syncQueries?: SyncQuerySubset[];
+    /**
+     * The client's persisted delivery watermark: the highest server delivery sequence
+     * up to which it has contiguously applied every in-scope operation. Omitted (or 0)
+     * on first sync. When present, the server resumes the gap-free server->client
+     * stream from just after it, superseding the version-vector delta and the resume
+     * cursor for the server->client direction. Optional, so old servers ignore it.
+     */
+    lastDeliverySequence?: number;
 }
 /**
  * Server response to a handshake.
@@ -307,6 +383,19 @@ interface HandshakeResponseMessage {
     acceptedScope?: Record<string, Record<string, unknown>>;
     /** Server wall-clock time (ms since epoch) at response creation. Lets clients measure their own clock skew. */
     serverTime?: number;
+    /**
+     * Whether the server persists blob bytes centrally. When true, a client
+     * automatically uploads the bytes behind its `blob` fields so they remain
+     * available to other devices even after the authoring device goes offline.
+     */
+    blobStorageEnabled?: boolean;
+    /**
+     * The server's highest delivery sequence at handshake time. A client whose
+     * persisted delivery watermark exceeds this (the server's operation log was rolled
+     * back, for example by a backup restore) resets its watermark to 0 so it resyncs
+     * from the beginning instead of sitting above a frontier that no longer exists.
+     */
+    serverMaxDeliverySequence?: number;
 }
 /**
  * Batch of operations sent during delta exchange or streaming.
@@ -323,6 +412,20 @@ interface OperationBatchMessage {
     cursor?: string;
     /** Total batches in this delta exchange (for progress reporting) */
     totalBatches?: number;
+    /**
+     * Delivery-watermark chaining (server->client). `baseDeliverySequence` is the
+     * delivery sequence the client must already hold for this batch to apply in order
+     * (it equals the previous batch's `maxDeliverySequence`, or the client's reported
+     * watermark for the first batch after a handshake). `maxDeliverySequence` is the
+     * highest delivery sequence carried by this batch. The client applies the batch
+     * only when its watermark equals `baseDeliverySequence`, then advances the
+     * watermark to `maxDeliverySequence`. A dropped batch breaks the chain and stalls
+     * the watermark, so the reconnect resend recovers it. Present only on batches the
+     * server sends as part of the delivery stream; absent on legacy version-vector
+     * batches.
+     */
+    baseDeliverySequence?: number;
+    maxDeliverySequence?: number;
 }
 /**
  * Acknowledgment of a received message.
@@ -332,6 +435,12 @@ interface AcknowledgmentMessage {
     messageId: string;
     acknowledgedMessageId: string;
     lastSequenceNumber: number;
+    /**
+     * The acknowledged batch's `maxDeliverySequence`, echoed so the server can advance
+     * this client's durable delivery watermark. Present only when acking a delivery-
+     * stream batch. `lastSequenceNumber` stays for existing per-node behavior.
+     */
+    deliverySequence?: number;
 }
 /**
  * Error message from the server or client.
@@ -343,6 +452,33 @@ interface ErrorMessage {
     message: string;
     retriable: boolean;
 }
+/**
+ * Server-to-client rejection of ONE specific operation the client submitted.
+ *
+ * Unlike {@link ErrorMessage}, which is connection-level, this is tied to an
+ * `operationId` so the client can divert exactly that operation out of its
+ * pending outbound queue and into a durable rejected-operations store — kept and
+ * explainable rather than silently retried forever or lost on the batch ack. The
+ * operation never entered the server's authoritative log, so no other replica
+ * ever sees it; the submitter is told so its optimistic local copy can be
+ * reconciled (rolled back or resubmitted) by the app.
+ */
+interface OperationRejectedMessage {
+    type: 'operation-rejected';
+    messageId: string;
+    /** Content-addressed id of the rejected operation. */
+    operationId: string;
+    /** Collection the rejected operation targeted (for app routing / display). */
+    collection: string;
+    /** Record the rejected operation targeted. */
+    recordId: string;
+    /** Stable, machine-readable reason code. */
+    code: string;
+    /** Human-readable explanation. */
+    message: string;
+    /** Whether resubmitting the identical operation may later succeed. */
+    retriable: boolean;
+}
 /**
  * Awareness state for a single client (cursor position, user info).
  * Wire-format representation for JSON transport.
@@ -387,10 +523,55 @@ interface YjsDocUpdateMessage {
     /** Base64-encoded Yjs update binary */
     update: string;
 }
+/**
+ * Request for a single blob chunk by content hash. Ephemeral side channel for
+ * out-of-band blob transfer over the sync connection; never persisted in the
+ * operation log (durable state is the BlobRef inside a record's fields).
+ *
+ * Possession of a chunk hash is itself the capability to request it: hashes are
+ * only learned from BlobRefs inside records the peer already received through
+ * its (scope-filtered) sync, and SHA-256 preimage resistance makes guessing a
+ * hash infeasible. The server therefore relays chunk requests among peers
+ * without a separate ACL.
+ */
+interface BlobChunkRequestMessage {
+    type: 'blob-chunk-request';
+    messageId: string;
+    /** Correlates the response to this request. */
+    requestId: string;
+    /** SHA-256 hash of the requested chunk. */
+    hash: string;
+}
+/**
+ * Response to a {@link BlobChunkRequestMessage}. Carries the chunk bytes, or
+ * null when the responder does not hold that hash.
+ */
+interface BlobChunkResponseMessage {
+    type: 'blob-chunk-response';
+    messageId: string;
+    /** Echoes the request's `requestId` for correlation. */
+    requestId: string;
+    /** Base64-encoded chunk bytes, or null when the responder does not hold the hash. */
+    bytes: string | null;
+}
+/**
+ * Unsolicited upload of a blob chunk (or a blob manifest) from a client to the
+ * server, so the server can persist it centrally and serve it to other devices
+ * even after the authoring device disconnects. Content-addressed: the receiver
+ * verifies the bytes hash to `hash`.
+ */
+interface BlobChunkPushMessage {
+    type: 'blob-chunk-push';
+    messageId: string;
+    /** SHA-256 hash of the pushed bytes (a chunk hash or a manifest hash). */
+    hash: string;
+    /** Base64-encoded bytes. */
+    bytes: string;
+}
 /**
  * Union of all sync protocol messages.
  */
-type SyncMessage = HandshakeMessage | HandshakeResponseMessage | OperationBatchMessage | AcknowledgmentMessage | ErrorMessage | AwarenessUpdateMessage | YjsDocUpdateMessage;
+type SyncMessage = HandshakeMessage | HandshakeResponseMessage | OperationBatchMessage | AcknowledgmentMessage | ErrorMessage | OperationRejectedMessage | AwarenessUpdateMessage | YjsDocUpdateMessage | BlobChunkRequestMessage | BlobChunkResponseMessage | BlobChunkPushMessage;
 /**
  * Check if an unknown value is a valid SyncMessage.
  */
@@ -415,6 +596,10 @@ declare function isAcknowledgmentMessage(value: unknown): value is Acknowledgmen
  * Check if a value is an ErrorMessage.
  */
 declare function isErrorMessage(value: unknown): value is ErrorMessage;
+/**
+ * Check if a value is an OperationRejectedMessage.
+ */
+declare function isOperationRejectedMessage(value: unknown): value is OperationRejectedMessage;
 /**
  * Check if a value is an AwarenessUpdateMessage.
  */
@@ -423,6 +608,18 @@ declare function isAwarenessUpdateMessage(value: unknown): value is AwarenessUpd
  * Check if a value is a YjsDocUpdateMessage.
  */
 declare function isYjsDocUpdateMessage(value: unknown): value is YjsDocUpdateMessage;
+/**
+ * Check if a value is a BlobChunkRequestMessage.
+ */
+declare function isBlobChunkRequestMessage(value: unknown): value is BlobChunkRequestMessage;
+/**
+ * Check if a value is a BlobChunkResponseMessage.
+ */
+declare function isBlobChunkResponseMessage(value: unknown): value is BlobChunkResponseMessage;
+/**
+ * Check if a value is a BlobChunkPushMessage.
+ */
+declare function isBlobChunkPushMessage(value: unknown): value is BlobChunkPushMessage;
 
 /**
  * Options for transport connection.
@@ -466,4 +663,4 @@ interface SyncTransport {
     isConnected(): boolean;
 }
 
-export { type AcknowledgmentMessage as A, isHandshakeMessage as B, isHandshakeResponseMessage as C, type DeltaCursor as D, type EncryptedPayload as E, isOperationBatchMessage as F, isSyncMessage as G, type HandshakeMessage as H, InvalidScopeError as I, isYjsDocUpdateMessage as J, operationMatchesQuerySubsets as K, type OperationBatchMessage as O, type QueueStorage as Q, type SyncScopeMap as S, type TransportOptions as T, type VersionedKey as V, type WireFormat as W, type YjsDocUpdateMessage as Y, type SyncMessage as a, type SerializedOperation as b, type SyncTransport as c, type TransportMessageHandler as d, type TransportCloseHandler as e, type TransportErrorHandler as f, type SyncEncryptionConfig as g, type SyncState as h, type SyncStatusInfo as i, type SyncConfig as j, type SyncStatePersistence as k, type SyncQuerySubset as l, type AwarenessStateWire as m, type AwarenessUpdateMessage as n, type ErrorMessage as o, type HandshakeResponseMessage as p, SYNC_STATES as q, SYNC_STATUSES as r, ScopeViolationError as s, type SyncEncryptionAlgorithm as t, type SyncScopeContext as u, type SyncStatus as v, dedupeQuerySubsets as w, isAcknowledgmentMessage as x, isAwarenessUpdateMessage as y, isErrorMessage as z };
+export { isYjsDocUpdateMessage as $, type AcknowledgmentMessage as A, type BlobChunkRequestMessage as B, dedupeQuerySubsets as C, type DeltaCursor as D, type EncryptedPayload as E, isAcknowledgmentMessage as F, isAwarenessUpdateMessage as G, type HandshakeMessage as H, InvalidScopeError as I, isBlobChunkPushMessage as J, isBlobChunkRequestMessage as K, isBlobChunkResponseMessage as L, MemoryRejectedOperationStorage as M, isErrorMessage as N, type OperationBatchMessage as O, isHandshakeMessage as P, type QueueStorage as Q, type RejectedOperationStorage as R, type SyncScopeMap as S, type TransportOptions as T, isHandshakeResponseMessage as U, type VersionedKey as V, type WireFormat as W, isOperationBatchMessage as X, type YjsDocUpdateMessage as Y, isOperationRejectedMessage as Z, isSyncMessage as _, type SyncMessage as a, operationMatchesQuerySubsets as a0, type SerializedOperation as b, type SyncTransport as c, type TransportMessageHandler as d, type TransportCloseHandler as e, type TransportErrorHandler as f, type BlobChunkResponseMessage as g, type BlobChunkPushMessage as h, type SyncEncryptionConfig as i, type SyncState as j, type SyncStatusInfo as k, type SyncConfig as l, type SyncStatePersistence as m, type SyncQuerySubset as n, type RejectedOperation as o, type AwarenessStateWire as p, type AwarenessUpdateMessage as q, type ErrorMessage as r, type HandshakeResponseMessage as s, type OperationRejectedMessage as t, SYNC_STATES as u, SYNC_STATUSES as v, ScopeViolationError as w, type SyncEncryptionAlgorithm as x, type SyncScopeContext as y, type SyncStatus as z };

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@korajs/sync",
-  "version": "1.0.0-beta.0",
+  "version": "1.0.0-beta.10",
   "description": "Sync protocol and transports for Kora.js with delta sync, causal ordering, and automatic reconnection",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
+    "./package.json": "./package.json",
     ".": {
       "import": {
         "types": "./dist/index.d.ts",
@@ -33,8 +34,8 @@
   ],
   "dependencies": {
     "protobufjs": "^8.0.1",
-    "@korajs/merge": "1.0.0-beta.0",
-    "@korajs/core": "1.0.0-beta.0"
+    "@korajs/core": "1.0.0-beta.10",
+    "@korajs/merge": "1.0.0-beta.10"
   },
   "devDependencies": {
     "@fast-check/vitest": "0.2.0",