@korajs/sync 1.0.0-beta.1 → 1.0.0-beta.11

package/dist/internal.d.cts

@@ -1,4 +1,4 @@
-import { c as SyncTransport, T as TransportOptions, a as SyncMessage, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, Q as QueueStorage } from './transport-CZLMdZ0k.cjs';
+import { c as SyncTransport, T as TransportOptions, a as SyncMessage, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, Q as QueueStorage } from './transport-iXX0KA_W.cjs';
 import { Operation } from '@korajs/core';
 
 /**

package/dist/internal.d.ts

@@ -1,4 +1,4 @@
-import { c as SyncTransport, T as TransportOptions, a as SyncMessage, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, Q as QueueStorage } from './transport-CZLMdZ0k.js';
+import { c as SyncTransport, T as TransportOptions, a as SyncMessage, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, Q as QueueStorage } from './transport-iXX0KA_W.js';
 import { Operation } from '@korajs/core';
 
 /**

package/dist/{transport-CZLMdZ0k.d.cts → transport-iXX0KA_W.d.cts}

@@ -93,14 +93,29 @@ type SyncState = (typeof SYNC_STATES)[number];
 /**
  * Developer-facing sync status. Simplified view of the internal state.
  */
-declare const SYNC_STATUSES: readonly ["connected", "syncing", "synced", "offline", "clock-error", "error", "schema-mismatch"];
+declare const SYNC_STATUSES: readonly ["connected", "reconnecting", "syncing", "synced", "offline", "clock-error", "error", "schema-mismatch", "auth-required"];
 type SyncStatus = (typeof SYNC_STATUSES)[number];
+type SyncPhase = 'suspended' | 'offline' | 'connecting' | 'authenticating' | 'handshaking' | 'uploading' | 'receiving' | 'applying' | 'streaming' | 'blocked';
+interface ActiveApplyFailure {
+    operationId: string;
+    collection: string;
+    recordId: string;
+    code: string;
+    message: string;
+    retriable: boolean;
+    firstSeenAt: number;
+    retryCount: number;
+}
 /**
  * Sync status information exposed to developers.
  */
 interface SyncStatusInfo {
     /** Current developer-facing status */
     status: SyncStatus;
+    phase?: SyncPhase;
+    reason?: string;
+    /** True when the engine is actively trying to re-establish a transport session. */
+    reconnecting: boolean;
     /** Number of operations waiting to be sent */
     pendingOperations: number;
     /** Timestamp of last successful sync (null if never synced) */
@@ -113,7 +128,47 @@ interface SyncStatusInfo {
     conflicts: number;
     /** serverTime - localTime in ms measured at the last handshake, or null before first connect. Negative = this device's clock is fast. */
     clockSkewMs: number | null;
+    inFlightUploadOperations?: number;
+    hasInFlightDeliveryBatch?: boolean;
+    activeViewId?: string;
+    activeViewComplete?: boolean;
+    initialSync?: {
+        complete: boolean;
+        receivedBatches: number;
+        totalBatches: number | null;
+        progress: number | null;
+    };
+    deliveryWatermark?: number;
+    serverFrontier?: number | null;
+    blockedFailure?: ActiveApplyFailure | null;
 }
+interface SyncSettlementOptions {
+    upload?: boolean;
+    download?: 'active-view' | false;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+type SyncSettlementResult = {
+    outcome: 'settled';
+    status: SyncStatusInfo;
+} | {
+    outcome: 'offline';
+    status: SyncStatusInfo;
+} | {
+    outcome: 'suspended';
+    reason: string;
+    status: SyncStatusInfo;
+} | {
+    outcome: 'blocked';
+    failure: ActiveApplyFailure;
+    status: SyncStatusInfo;
+} | {
+    outcome: 'timeout';
+    status: SyncStatusInfo;
+} | {
+    outcome: 'aborted';
+    status: SyncStatusInfo;
+};
 /**
  * Per-collection sync scope map. Maps collection names to field-value filters.
  * Empty filter `{}` means no restriction (all records visible).
@@ -132,6 +187,14 @@ interface SyncConfig {
     auth?: () => Promise<{
         token: string;
     }>;
+    /** Auth readiness gate. A suspended result prevents transport creation and retries. */
+    authState?: () => Promise<{
+        state: 'loading' | 'signed-out' | 'anonymous' | 'authenticated';
+        mayConnectAnonymously?: boolean;
+    }>;
+    querySubsets?: {
+        mode?: 'reactive' | 'static' | 'disabled';
+    };
     /** Sync scopes per collection. Limits which records sync to this client. */
     scopes?: Record<string, (ctx: SyncScopeContext) => Record<string, unknown>>;
     /**
@@ -141,6 +204,13 @@ interface SyncConfig {
     scopeMap?: SyncScopeMap;
     /** Number of operations per batch. Defaults to 100. */
     batchSize?: number;
+    /**
+     * Maximum time to wait for the server to acknowledge an outbound batch before
+     * treating the connection as stalled. The batch is returned to the durable
+     * outbound queue before disconnecting so it can be retried on reconnect.
+     * Defaults to 30000ms. Set to 0 to disable the watchdog.
+     */
+    outboundAckTimeoutMs?: number;
     /** Initial reconnection delay in ms. Defaults to 1000. */
     reconnectInterval?: number;
     /** Maximum reconnection delay in ms. Defaults to 30000. */
@@ -193,6 +263,23 @@ interface SyncStatePersistence {
     /** Resume position for paginated initial sync (optional). */
     loadDeltaCursor?(): Promise<DeltaCursor | null>;
     saveDeltaCursor?(cursor: DeltaCursor | null): Promise<void>;
+    /**
+     * The delivery watermark for a sync view, keyed by an opaque view signature (the auth
+     * scope plus active query subscriptions). Persisted per view so a restarted client
+     * resumes each view's gap-free stream from the right point, and switching views does not
+     * re-sync a view already synced. The empty-string signature is the default, unfiltered
+     * view. Optional: a persistence layer that omits these falls back to re-sync on restart.
+     */
+    loadDeliveryWatermark?(signature: string): Promise<number>;
+    saveDeliveryWatermark?(signature: string, watermark: number): Promise<void>;
+    /** Load every persisted view watermark, keyed by signature. */
+    loadAllDeliveryWatermarks?(): Promise<Record<string, number>>;
+    /**
+     * Delete a persisted view watermark. Used to bound the number of stored view watermarks
+     * (a cold view is evicted from the client's cache and its persisted row removed). Safe:
+     * an evicted view back-fills from 0 (deduplicated) when next visited.
+     */
+    deleteDeliveryWatermark?(signature: string): Promise<void>;
 }
 /**
  * Interface for persisting the outbound operation queue.
@@ -208,6 +295,48 @@ interface QueueStorage {
     /** Return number of operations in storage */
     count(): Promise<number>;
 }
+/**
+ * A record of one outbound operation the server permanently refused. Preserved so
+ * a rejected op is explainable and reconcilable rather than silently lost.
+ */
+interface RejectedOperation {
+    /** Content-addressed id of the rejected operation. */
+    operationId: string;
+    /** Collection the operation targeted. */
+    collection: string;
+    /** Record the operation targeted. */
+    recordId: string;
+    /** Stable, machine-readable reason code from the server. */
+    code: string;
+    /** Human-readable explanation. */
+    message: string;
+    /** Whether resubmitting the identical operation may later succeed. */
+    retriable: boolean;
+    /** Wall-clock time (ms since epoch) the rejection was recorded. Display only. */
+    rejectedAt: number;
+}
+/**
+ * Interface for durably persisting operations the server rejected, so the record
+ * survives a page refresh. Keyed by operation id (idempotent on re-rejection).
+ */
+interface RejectedOperationStorage {
+    /** Record (or overwrite) a rejected operation. */
+    record(rejected: RejectedOperation): Promise<void>;
+    /** List all recorded rejected operations. */
+    list(): Promise<RejectedOperation[]>;
+    /** Remove rejected operations by their operation ids (after the app reconciles them). */
+    remove(operationIds: string[]): Promise<void>;
+}
+/**
+ * In-memory {@link RejectedOperationStorage}. The default when no durable store is
+ * provided; suitable for tests and ephemeral sessions.
+ */
+declare class MemoryRejectedOperationStorage implements RejectedOperationStorage {
+    private readonly rejected;
+    record(rejected: RejectedOperation): Promise<void>;
+    list(): Promise<RejectedOperation[]>;
+    remove(operationIds: string[]): Promise<void>;
+}
 /**
  * Thrown when an operation violates sync scope constraints.
  * This can happen when:
@@ -239,10 +368,10 @@ interface SyncQuerySubset {
  * for its collection. Collections without query subsets pass through.
  */
 declare function operationMatchesQuerySubsets(op: Operation, subsets: SyncQuerySubset[] | undefined, fullRecord?: Record<string, unknown> | null): boolean;
-/**
- * Deduplicate query subsets by collection + where JSON key.
- */
+/** Canonicalize equality subsets and remove subsets already covered by a broader one. */
 declare function dedupeQuerySubsets(subsets: SyncQuerySubset[]): SyncQuerySubset[];
+/** True when every record selected by `narrow` is also selected by `broad`. */
+declare function querySubsetContains(broad: SyncQuerySubset[], narrow: SyncQuerySubset[]): boolean;
 
 type WireFormat = 'json' | 'protobuf';
 /**
@@ -286,6 +415,14 @@ interface HandshakeMessage {
     deltaCursor?: string;
     /** Live query filters that further narrow synced data within auth/schema scope */
     syncQueries?: SyncQuerySubset[];
+    /**
+     * The client's persisted delivery watermark: the highest server delivery sequence
+     * up to which it has contiguously applied every in-scope operation. Omitted (or 0)
+     * on first sync. When present, the server resumes the gap-free server->client
+     * stream from just after it, superseding the version-vector delta and the resume
+     * cursor for the server->client direction. Optional, so old servers ignore it.
+     */
+    lastDeliverySequence?: number;
 }
 /**
  * Server response to a handshake.
@@ -313,6 +450,13 @@ interface HandshakeResponseMessage {
      * available to other devices even after the authoring device goes offline.
      */
     blobStorageEnabled?: boolean;
+    /**
+     * The server's highest delivery sequence at handshake time. A client whose
+     * persisted delivery watermark exceeds this (the server's operation log was rolled
+     * back, for example by a backup restore) resets its watermark to 0 so it resyncs
+     * from the beginning instead of sitting above a frontier that no longer exists.
+     */
+    serverMaxDeliverySequence?: number;
 }
 /**
  * Batch of operations sent during delta exchange or streaming.
@@ -329,6 +473,20 @@ interface OperationBatchMessage {
     cursor?: string;
     /** Total batches in this delta exchange (for progress reporting) */
     totalBatches?: number;
+    /**
+     * Delivery-watermark chaining (server->client). `baseDeliverySequence` is the
+     * delivery sequence the client must already hold for this batch to apply in order
+     * (it equals the previous batch's `maxDeliverySequence`, or the client's reported
+     * watermark for the first batch after a handshake). `maxDeliverySequence` is the
+     * highest delivery sequence carried by this batch. The client applies the batch
+     * only when its watermark equals `baseDeliverySequence`, then advances the
+     * watermark to `maxDeliverySequence`. A dropped batch breaks the chain and stalls
+     * the watermark, so the reconnect resend recovers it. Present only on batches the
+     * server sends as part of the delivery stream; absent on legacy version-vector
+     * batches.
+     */
+    baseDeliverySequence?: number;
+    maxDeliverySequence?: number;
 }
 /**
  * Acknowledgment of a received message.
@@ -338,6 +496,12 @@ interface AcknowledgmentMessage {
     messageId: string;
     acknowledgedMessageId: string;
     lastSequenceNumber: number;
+    /**
+     * The acknowledged batch's `maxDeliverySequence`, echoed so the server can advance
+     * this client's durable delivery watermark. Present only when acking a delivery-
+     * stream batch. `lastSequenceNumber` stays for existing per-node behavior.
+     */
+    deliverySequence?: number;
 }
 /**
  * Error message from the server or client.
@@ -349,6 +513,33 @@ interface ErrorMessage {
     message: string;
     retriable: boolean;
 }
+/**
+ * Server-to-client rejection of ONE specific operation the client submitted.
+ *
+ * Unlike {@link ErrorMessage}, which is connection-level, this is tied to an
+ * `operationId` so the client can divert exactly that operation out of its
+ * pending outbound queue and into a durable rejected-operations store — kept and
+ * explainable rather than silently retried forever or lost on the batch ack. The
+ * operation never entered the server's authoritative log, so no other replica
+ * ever sees it; the submitter is told so its optimistic local copy can be
+ * reconciled (rolled back or resubmitted) by the app.
+ */
+interface OperationRejectedMessage {
+    type: 'operation-rejected';
+    messageId: string;
+    /** Content-addressed id of the rejected operation. */
+    operationId: string;
+    /** Collection the rejected operation targeted (for app routing / display). */
+    collection: string;
+    /** Record the rejected operation targeted. */
+    recordId: string;
+    /** Stable, machine-readable reason code. */
+    code: string;
+    /** Human-readable explanation. */
+    message: string;
+    /** Whether resubmitting the identical operation may later succeed. */
+    retriable: boolean;
+}
 /**
  * Awareness state for a single client (cursor position, user info).
  * Wire-format representation for JSON transport.
@@ -441,7 +632,7 @@ interface BlobChunkPushMessage {
 /**
  * Union of all sync protocol messages.
  */
-type SyncMessage = HandshakeMessage | HandshakeResponseMessage | OperationBatchMessage | AcknowledgmentMessage | ErrorMessage | AwarenessUpdateMessage | YjsDocUpdateMessage | BlobChunkRequestMessage | BlobChunkResponseMessage | BlobChunkPushMessage;
+type SyncMessage = HandshakeMessage | HandshakeResponseMessage | OperationBatchMessage | AcknowledgmentMessage | ErrorMessage | OperationRejectedMessage | AwarenessUpdateMessage | YjsDocUpdateMessage | BlobChunkRequestMessage | BlobChunkResponseMessage | BlobChunkPushMessage;
 /**
  * Check if an unknown value is a valid SyncMessage.
  */
@@ -466,6 +657,10 @@ declare function isAcknowledgmentMessage(value: unknown): value is Acknowledgmen
  * Check if a value is an ErrorMessage.
  */
 declare function isErrorMessage(value: unknown): value is ErrorMessage;
+/**
+ * Check if a value is an OperationRejectedMessage.
+ */
+declare function isOperationRejectedMessage(value: unknown): value is OperationRejectedMessage;
 /**
  * Check if a value is an AwarenessUpdateMessage.
  */
@@ -529,4 +724,4 @@ interface SyncTransport {
     isConnected(): boolean;
 }
 
-export { type AcknowledgmentMessage as A, type BlobChunkRequestMessage as B, isAwarenessUpdateMessage as C, type DeltaCursor as D, type EncryptedPayload as E, isBlobChunkPushMessage as F, isBlobChunkRequestMessage as G, type HandshakeMessage as H, InvalidScopeError as I, isBlobChunkResponseMessage as J, isErrorMessage as K, isHandshakeMessage as L, isHandshakeResponseMessage as M, isOperationBatchMessage as N, type OperationBatchMessage as O, isSyncMessage as P, type QueueStorage as Q, isYjsDocUpdateMessage as R, type SyncScopeMap as S, type TransportOptions as T, operationMatchesQuerySubsets as U, type VersionedKey as V, type WireFormat as W, type YjsDocUpdateMessage as Y, type SyncMessage as a, type SerializedOperation as b, type SyncTransport as c, type TransportMessageHandler as d, type TransportCloseHandler as e, type TransportErrorHandler as f, type BlobChunkResponseMessage as g, type BlobChunkPushMessage as h, type SyncEncryptionConfig as i, type SyncState as j, type SyncStatusInfo as k, type SyncConfig as l, type SyncStatePersistence as m, type SyncQuerySubset as n, type AwarenessStateWire as o, type AwarenessUpdateMessage as p, type ErrorMessage as q, type HandshakeResponseMessage as r, SYNC_STATES as s, SYNC_STATUSES as t, ScopeViolationError as u, type SyncEncryptionAlgorithm as v, type SyncScopeContext as w, type SyncStatus as x, dedupeQuerySubsets as y, isAcknowledgmentMessage as z };
+export { isHandshakeResponseMessage as $, type AcknowledgmentMessage as A, type BlobChunkRequestMessage as B, type SyncScopeContext as C, type DeltaCursor as D, type EncryptedPayload as E, type SyncSettlementOptions as F, type SyncSettlementResult as G, type HandshakeMessage as H, InvalidScopeError as I, type SyncStatus as J, dedupeQuerySubsets as K, isAcknowledgmentMessage as L, MemoryRejectedOperationStorage as M, isAwarenessUpdateMessage as N, type OperationBatchMessage as O, isBlobChunkPushMessage as P, type QueueStorage as Q, type RejectedOperationStorage as R, type SyncScopeMap as S, type TransportOptions as T, isBlobChunkRequestMessage as U, type VersionedKey as V, type WireFormat as W, isBlobChunkResponseMessage as X, type YjsDocUpdateMessage as Y, isErrorMessage as Z, isHandshakeMessage as _, type SyncMessage as a, isOperationBatchMessage as a0, isOperationRejectedMessage as a1, isSyncMessage as a2, isYjsDocUpdateMessage as a3, operationMatchesQuerySubsets as a4, querySubsetContains as a5, type SerializedOperation as b, type SyncTransport as c, type TransportMessageHandler as d, type TransportCloseHandler as e, type TransportErrorHandler as f, type BlobChunkResponseMessage as g, type BlobChunkPushMessage as h, type SyncEncryptionConfig as i, type SyncState as j, type SyncStatusInfo as k, type SyncConfig as l, type SyncStatePersistence as m, type SyncQuerySubset as n, type RejectedOperation as o, type ActiveApplyFailure as p, type AwarenessStateWire as q, type AwarenessUpdateMessage as r, type ErrorMessage as s, type HandshakeResponseMessage as t, type OperationRejectedMessage as u, SYNC_STATES as v, SYNC_STATUSES as w, ScopeViolationError as x, type SyncEncryptionAlgorithm as y, type SyncPhase as z };

package/dist/{transport-CZLMdZ0k.d.ts → transport-iXX0KA_W.d.ts}

@@ -93,14 +93,29 @@ type SyncState = (typeof SYNC_STATES)[number];
 /**
  * Developer-facing sync status. Simplified view of the internal state.
  */
-declare const SYNC_STATUSES: readonly ["connected", "syncing", "synced", "offline", "clock-error", "error", "schema-mismatch"];
+declare const SYNC_STATUSES: readonly ["connected", "reconnecting", "syncing", "synced", "offline", "clock-error", "error", "schema-mismatch", "auth-required"];
 type SyncStatus = (typeof SYNC_STATUSES)[number];
+type SyncPhase = 'suspended' | 'offline' | 'connecting' | 'authenticating' | 'handshaking' | 'uploading' | 'receiving' | 'applying' | 'streaming' | 'blocked';
+interface ActiveApplyFailure {
+    operationId: string;
+    collection: string;
+    recordId: string;
+    code: string;
+    message: string;
+    retriable: boolean;
+    firstSeenAt: number;
+    retryCount: number;
+}
 /**
  * Sync status information exposed to developers.
  */
 interface SyncStatusInfo {
     /** Current developer-facing status */
     status: SyncStatus;
+    phase?: SyncPhase;
+    reason?: string;
+    /** True when the engine is actively trying to re-establish a transport session. */
+    reconnecting: boolean;
     /** Number of operations waiting to be sent */
     pendingOperations: number;
     /** Timestamp of last successful sync (null if never synced) */
@@ -113,7 +128,47 @@ interface SyncStatusInfo {
     conflicts: number;
     /** serverTime - localTime in ms measured at the last handshake, or null before first connect. Negative = this device's clock is fast. */
     clockSkewMs: number | null;
+    inFlightUploadOperations?: number;
+    hasInFlightDeliveryBatch?: boolean;
+    activeViewId?: string;
+    activeViewComplete?: boolean;
+    initialSync?: {
+        complete: boolean;
+        receivedBatches: number;
+        totalBatches: number | null;
+        progress: number | null;
+    };
+    deliveryWatermark?: number;
+    serverFrontier?: number | null;
+    blockedFailure?: ActiveApplyFailure | null;
 }
+interface SyncSettlementOptions {
+    upload?: boolean;
+    download?: 'active-view' | false;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+type SyncSettlementResult = {
+    outcome: 'settled';
+    status: SyncStatusInfo;
+} | {
+    outcome: 'offline';
+    status: SyncStatusInfo;
+} | {
+    outcome: 'suspended';
+    reason: string;
+    status: SyncStatusInfo;
+} | {
+    outcome: 'blocked';
+    failure: ActiveApplyFailure;
+    status: SyncStatusInfo;
+} | {
+    outcome: 'timeout';
+    status: SyncStatusInfo;
+} | {
+    outcome: 'aborted';
+    status: SyncStatusInfo;
+};
 /**
  * Per-collection sync scope map. Maps collection names to field-value filters.
  * Empty filter `{}` means no restriction (all records visible).
@@ -132,6 +187,14 @@ interface SyncConfig {
     auth?: () => Promise<{
         token: string;
     }>;
+    /** Auth readiness gate. A suspended result prevents transport creation and retries. */
+    authState?: () => Promise<{
+        state: 'loading' | 'signed-out' | 'anonymous' | 'authenticated';
+        mayConnectAnonymously?: boolean;
+    }>;
+    querySubsets?: {
+        mode?: 'reactive' | 'static' | 'disabled';
+    };
     /** Sync scopes per collection. Limits which records sync to this client. */
     scopes?: Record<string, (ctx: SyncScopeContext) => Record<string, unknown>>;
     /**
@@ -141,6 +204,13 @@ interface SyncConfig {
     scopeMap?: SyncScopeMap;
     /** Number of operations per batch. Defaults to 100. */
     batchSize?: number;
+    /**
+     * Maximum time to wait for the server to acknowledge an outbound batch before
+     * treating the connection as stalled. The batch is returned to the durable
+     * outbound queue before disconnecting so it can be retried on reconnect.
+     * Defaults to 30000ms. Set to 0 to disable the watchdog.
+     */
+    outboundAckTimeoutMs?: number;
     /** Initial reconnection delay in ms. Defaults to 1000. */
     reconnectInterval?: number;
     /** Maximum reconnection delay in ms. Defaults to 30000. */
@@ -193,6 +263,23 @@ interface SyncStatePersistence {
     /** Resume position for paginated initial sync (optional). */
     loadDeltaCursor?(): Promise<DeltaCursor | null>;
     saveDeltaCursor?(cursor: DeltaCursor | null): Promise<void>;
+    /**
+     * The delivery watermark for a sync view, keyed by an opaque view signature (the auth
+     * scope plus active query subscriptions). Persisted per view so a restarted client
+     * resumes each view's gap-free stream from the right point, and switching views does not
+     * re-sync a view already synced. The empty-string signature is the default, unfiltered
+     * view. Optional: a persistence layer that omits these falls back to re-sync on restart.
+     */
+    loadDeliveryWatermark?(signature: string): Promise<number>;
+    saveDeliveryWatermark?(signature: string, watermark: number): Promise<void>;
+    /** Load every persisted view watermark, keyed by signature. */
+    loadAllDeliveryWatermarks?(): Promise<Record<string, number>>;
+    /**
+     * Delete a persisted view watermark. Used to bound the number of stored view watermarks
+     * (a cold view is evicted from the client's cache and its persisted row removed). Safe:
+     * an evicted view back-fills from 0 (deduplicated) when next visited.
+     */
+    deleteDeliveryWatermark?(signature: string): Promise<void>;
 }
 /**
  * Interface for persisting the outbound operation queue.
@@ -208,6 +295,48 @@ interface QueueStorage {
     /** Return number of operations in storage */
     count(): Promise<number>;
 }
+/**
+ * A record of one outbound operation the server permanently refused. Preserved so
+ * a rejected op is explainable and reconcilable rather than silently lost.
+ */
+interface RejectedOperation {
+    /** Content-addressed id of the rejected operation. */
+    operationId: string;
+    /** Collection the operation targeted. */
+    collection: string;
+    /** Record the operation targeted. */
+    recordId: string;
+    /** Stable, machine-readable reason code from the server. */
+    code: string;
+    /** Human-readable explanation. */
+    message: string;
+    /** Whether resubmitting the identical operation may later succeed. */
+    retriable: boolean;
+    /** Wall-clock time (ms since epoch) the rejection was recorded. Display only. */
+    rejectedAt: number;
+}
+/**
+ * Interface for durably persisting operations the server rejected, so the record
+ * survives a page refresh. Keyed by operation id (idempotent on re-rejection).
+ */
+interface RejectedOperationStorage {
+    /** Record (or overwrite) a rejected operation. */
+    record(rejected: RejectedOperation): Promise<void>;
+    /** List all recorded rejected operations. */
+    list(): Promise<RejectedOperation[]>;
+    /** Remove rejected operations by their operation ids (after the app reconciles them). */
+    remove(operationIds: string[]): Promise<void>;
+}
+/**
+ * In-memory {@link RejectedOperationStorage}. The default when no durable store is
+ * provided; suitable for tests and ephemeral sessions.
+ */
+declare class MemoryRejectedOperationStorage implements RejectedOperationStorage {
+    private readonly rejected;
+    record(rejected: RejectedOperation): Promise<void>;
+    list(): Promise<RejectedOperation[]>;
+    remove(operationIds: string[]): Promise<void>;
+}
 /**
  * Thrown when an operation violates sync scope constraints.
  * This can happen when:
@@ -239,10 +368,10 @@ interface SyncQuerySubset {
  * for its collection. Collections without query subsets pass through.
  */
 declare function operationMatchesQuerySubsets(op: Operation, subsets: SyncQuerySubset[] | undefined, fullRecord?: Record<string, unknown> | null): boolean;
-/**
- * Deduplicate query subsets by collection + where JSON key.
- */
+/** Canonicalize equality subsets and remove subsets already covered by a broader one. */
 declare function dedupeQuerySubsets(subsets: SyncQuerySubset[]): SyncQuerySubset[];
+/** True when every record selected by `narrow` is also selected by `broad`. */
+declare function querySubsetContains(broad: SyncQuerySubset[], narrow: SyncQuerySubset[]): boolean;
 
 type WireFormat = 'json' | 'protobuf';
 /**
@@ -286,6 +415,14 @@ interface HandshakeMessage {
     deltaCursor?: string;
     /** Live query filters that further narrow synced data within auth/schema scope */
     syncQueries?: SyncQuerySubset[];
+    /**
+     * The client's persisted delivery watermark: the highest server delivery sequence
+     * up to which it has contiguously applied every in-scope operation. Omitted (or 0)
+     * on first sync. When present, the server resumes the gap-free server->client
+     * stream from just after it, superseding the version-vector delta and the resume
+     * cursor for the server->client direction. Optional, so old servers ignore it.
+     */
+    lastDeliverySequence?: number;
 }
 /**
  * Server response to a handshake.
@@ -313,6 +450,13 @@ interface HandshakeResponseMessage {
      * available to other devices even after the authoring device goes offline.
      */
     blobStorageEnabled?: boolean;
+    /**
+     * The server's highest delivery sequence at handshake time. A client whose
+     * persisted delivery watermark exceeds this (the server's operation log was rolled
+     * back, for example by a backup restore) resets its watermark to 0 so it resyncs
+     * from the beginning instead of sitting above a frontier that no longer exists.
+     */
+    serverMaxDeliverySequence?: number;
 }
 /**
  * Batch of operations sent during delta exchange or streaming.
@@ -329,6 +473,20 @@ interface OperationBatchMessage {
     cursor?: string;
     /** Total batches in this delta exchange (for progress reporting) */
     totalBatches?: number;
+    /**
+     * Delivery-watermark chaining (server->client). `baseDeliverySequence` is the
+     * delivery sequence the client must already hold for this batch to apply in order
+     * (it equals the previous batch's `maxDeliverySequence`, or the client's reported
+     * watermark for the first batch after a handshake). `maxDeliverySequence` is the
+     * highest delivery sequence carried by this batch. The client applies the batch
+     * only when its watermark equals `baseDeliverySequence`, then advances the
+     * watermark to `maxDeliverySequence`. A dropped batch breaks the chain and stalls
+     * the watermark, so the reconnect resend recovers it. Present only on batches the
+     * server sends as part of the delivery stream; absent on legacy version-vector
+     * batches.
+     */
+    baseDeliverySequence?: number;
+    maxDeliverySequence?: number;
 }
 /**
  * Acknowledgment of a received message.
@@ -338,6 +496,12 @@ interface AcknowledgmentMessage {
     messageId: string;
     acknowledgedMessageId: string;
     lastSequenceNumber: number;
+    /**
+     * The acknowledged batch's `maxDeliverySequence`, echoed so the server can advance
+     * this client's durable delivery watermark. Present only when acking a delivery-
+     * stream batch. `lastSequenceNumber` stays for existing per-node behavior.
+     */
+    deliverySequence?: number;
 }
 /**
  * Error message from the server or client.
@@ -349,6 +513,33 @@ interface ErrorMessage {
     message: string;
     retriable: boolean;
 }
+/**
+ * Server-to-client rejection of ONE specific operation the client submitted.
+ *
+ * Unlike {@link ErrorMessage}, which is connection-level, this is tied to an
+ * `operationId` so the client can divert exactly that operation out of its
+ * pending outbound queue and into a durable rejected-operations store — kept and
+ * explainable rather than silently retried forever or lost on the batch ack. The
+ * operation never entered the server's authoritative log, so no other replica
+ * ever sees it; the submitter is told so its optimistic local copy can be
+ * reconciled (rolled back or resubmitted) by the app.
+ */
+interface OperationRejectedMessage {
+    type: 'operation-rejected';
+    messageId: string;
+    /** Content-addressed id of the rejected operation. */
+    operationId: string;
+    /** Collection the rejected operation targeted (for app routing / display). */
+    collection: string;
+    /** Record the rejected operation targeted. */
+    recordId: string;
+    /** Stable, machine-readable reason code. */
+    code: string;
+    /** Human-readable explanation. */
+    message: string;
+    /** Whether resubmitting the identical operation may later succeed. */
+    retriable: boolean;
+}
 /**
  * Awareness state for a single client (cursor position, user info).
  * Wire-format representation for JSON transport.
@@ -441,7 +632,7 @@ interface BlobChunkPushMessage {
 /**
  * Union of all sync protocol messages.
  */
-type SyncMessage = HandshakeMessage | HandshakeResponseMessage | OperationBatchMessage | AcknowledgmentMessage | ErrorMessage | AwarenessUpdateMessage | YjsDocUpdateMessage | BlobChunkRequestMessage | BlobChunkResponseMessage | BlobChunkPushMessage;
+type SyncMessage = HandshakeMessage | HandshakeResponseMessage | OperationBatchMessage | AcknowledgmentMessage | ErrorMessage | OperationRejectedMessage | AwarenessUpdateMessage | YjsDocUpdateMessage | BlobChunkRequestMessage | BlobChunkResponseMessage | BlobChunkPushMessage;
 /**
  * Check if an unknown value is a valid SyncMessage.
  */
@@ -466,6 +657,10 @@ declare function isAcknowledgmentMessage(value: unknown): value is Acknowledgmen
  * Check if a value is an ErrorMessage.
  */
 declare function isErrorMessage(value: unknown): value is ErrorMessage;
+/**
+ * Check if a value is an OperationRejectedMessage.
+ */
+declare function isOperationRejectedMessage(value: unknown): value is OperationRejectedMessage;
 /**
  * Check if a value is an AwarenessUpdateMessage.
  */
@@ -529,4 +724,4 @@ interface SyncTransport {
     isConnected(): boolean;
 }
 
-export { type AcknowledgmentMessage as A, type BlobChunkRequestMessage as B, isAwarenessUpdateMessage as C, type DeltaCursor as D, type EncryptedPayload as E, isBlobChunkPushMessage as F, isBlobChunkRequestMessage as G, type HandshakeMessage as H, InvalidScopeError as I, isBlobChunkResponseMessage as J, isErrorMessage as K, isHandshakeMessage as L, isHandshakeResponseMessage as M, isOperationBatchMessage as N, type OperationBatchMessage as O, isSyncMessage as P, type QueueStorage as Q, isYjsDocUpdateMessage as R, type SyncScopeMap as S, type TransportOptions as T, operationMatchesQuerySubsets as U, type VersionedKey as V, type WireFormat as W, type YjsDocUpdateMessage as Y, type SyncMessage as a, type SerializedOperation as b, type SyncTransport as c, type TransportMessageHandler as d, type TransportCloseHandler as e, type TransportErrorHandler as f, type BlobChunkResponseMessage as g, type BlobChunkPushMessage as h, type SyncEncryptionConfig as i, type SyncState as j, type SyncStatusInfo as k, type SyncConfig as l, type SyncStatePersistence as m, type SyncQuerySubset as n, type AwarenessStateWire as o, type AwarenessUpdateMessage as p, type ErrorMessage as q, type HandshakeResponseMessage as r, SYNC_STATES as s, SYNC_STATUSES as t, ScopeViolationError as u, type SyncEncryptionAlgorithm as v, type SyncScopeContext as w, type SyncStatus as x, dedupeQuerySubsets as y, isAcknowledgmentMessage as z };
+export { isHandshakeResponseMessage as $, type AcknowledgmentMessage as A, type BlobChunkRequestMessage as B, type SyncScopeContext as C, type DeltaCursor as D, type EncryptedPayload as E, type SyncSettlementOptions as F, type SyncSettlementResult as G, type HandshakeMessage as H, InvalidScopeError as I, type SyncStatus as J, dedupeQuerySubsets as K, isAcknowledgmentMessage as L, MemoryRejectedOperationStorage as M, isAwarenessUpdateMessage as N, type OperationBatchMessage as O, isBlobChunkPushMessage as P, type QueueStorage as Q, type RejectedOperationStorage as R, type SyncScopeMap as S, type TransportOptions as T, isBlobChunkRequestMessage as U, type VersionedKey as V, type WireFormat as W, isBlobChunkResponseMessage as X, type YjsDocUpdateMessage as Y, isErrorMessage as Z, isHandshakeMessage as _, type SyncMessage as a, isOperationBatchMessage as a0, isOperationRejectedMessage as a1, isSyncMessage as a2, isYjsDocUpdateMessage as a3, operationMatchesQuerySubsets as a4, querySubsetContains as a5, type SerializedOperation as b, type SyncTransport as c, type TransportMessageHandler as d, type TransportCloseHandler as e, type TransportErrorHandler as f, type BlobChunkResponseMessage as g, type BlobChunkPushMessage as h, type SyncEncryptionConfig as i, type SyncState as j, type SyncStatusInfo as k, type SyncConfig as l, type SyncStatePersistence as m, type SyncQuerySubset as n, type RejectedOperation as o, type ActiveApplyFailure as p, type AwarenessStateWire as q, type AwarenessUpdateMessage as r, type ErrorMessage as s, type HandshakeResponseMessage as t, type OperationRejectedMessage as u, SYNC_STATES as v, SYNC_STATUSES as w, ScopeViolationError as x, type SyncEncryptionAlgorithm as y, type SyncPhase as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@korajs/sync",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.11",
   "description": "Sync protocol and transports for Kora.js with delta sync, causal ordering, and automatic reconnection",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -34,8 +34,8 @@
   ],
   "dependencies": {
     "protobufjs": "^8.0.1",
-    "@korajs/core": "1.0.0-beta.1",
-    "@korajs/merge": "1.0.0-beta.1"
+    "@korajs/core": "1.0.0-beta.11",
+    "@korajs/merge": "1.0.0-beta.11"
   },
   "devDependencies": {
     "@fast-check/vitest": "0.2.0",