@korajs/sync 1.0.0-beta.11 → 1.0.0-beta.12

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { S as SyncScopeMap, D as DeltaCursor, a as SyncMessage, b as SerializedOperation, W as WireFormat, c as SyncTransport, T as TransportOptions, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, B as BlobChunkRequestMessage, g as BlobChunkResponseMessage, h as BlobChunkPushMessage, i as SyncEncryptionConfig, V as VersionedKey, Y as YjsDocUpdateMessage, Q as QueueStorage, j as SyncState, k as SyncStatusInfo, l as SyncConfig, R as RejectedOperationStorage, m as SyncStatePersistence, n as SyncQuerySubset, o as RejectedOperation } from './transport-iXX0KA_W.cjs';
-export { A as AcknowledgmentMessage, p as ActiveApplyFailure, q as AwarenessStateWire, r as AwarenessUpdateMessage, E as EncryptedPayload, s as ErrorMessage, H as HandshakeMessage, t as HandshakeResponseMessage, I as InvalidScopeError, M as MemoryRejectedOperationStorage, O as OperationBatchMessage, u as OperationRejectedMessage, v as SYNC_STATES, w as SYNC_STATUSES, x as ScopeViolationError, y as SyncEncryptionAlgorithm, z as SyncPhase, C as SyncScopeContext, F as SyncSettlementOptions, G as SyncSettlementResult, J as SyncStatus, K as dedupeQuerySubsets, L as isAcknowledgmentMessage, N as isAwarenessUpdateMessage, P as isBlobChunkPushMessage, U as isBlobChunkRequestMessage, X as isBlobChunkResponseMessage, Z as isErrorMessage, _ as isHandshakeMessage, $ as isHandshakeResponseMessage, a0 as isOperationBatchMessage, a1 as isOperationRejectedMessage, a2 as isSyncMessage, a3 as isYjsDocUpdateMessage, a4 as operationMatchesQuerySubsets, a5 as querySubsetContains } from './transport-iXX0KA_W.cjs';
+import { S as SyncScopeMap, D as DeltaCursor, a as SyncMessage, b as SerializedOperation, W as WireFormat, c as SyncTransport, T as TransportOptions, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, B as BlobChunkRequestMessage, g as BlobChunkResponseMessage, h as BlobChunkPushMessage, i as SyncEncryptionConfig, V as VersionedKey, Y as YjsDocUpdateMessage, Q as QueueStorage, j as SyncState, k as SyncStatusInfo, l as SyncConfig, R as RejectedOperationStorage, m as SyncStatePersistence, n as SyncQuerySubset, o as RejectedOperation } from './transport-CJvRO5ix.cjs';
+export { A as AcknowledgmentMessage, p as ActiveApplyFailure, q as AwarenessStateWire, r as AwarenessUpdateMessage, E as EncryptedPayload, s as ErrorMessage, H as HandshakeMessage, t as HandshakeResponseMessage, I as InvalidScopeError, M as MemoryRejectedOperationStorage, O as OperationBatchMessage, u as OperationRejectedMessage, v as SYNC_STATES, w as SYNC_STATUSES, x as ScopeViolationError, y as SyncEncryptionAlgorithm, z as SyncPhase, C as SyncScopeContext, F as SyncSettlementOptions, G as SyncSettlementResult, J as SyncStatus, K as dedupeQuerySubsets, L as isAcknowledgmentMessage, N as isAwarenessUpdateMessage, P as isBlobChunkPushMessage, U as isBlobChunkRequestMessage, X as isBlobChunkResponseMessage, Z as isErrorMessage, _ as isHandshakeMessage, $ as isHandshakeResponseMessage, a0 as isOperationBatchMessage, a1 as isOperationRejectedMessage, a2 as isSyncMessage, a3 as isYjsDocUpdateMessage, a4 as operationMatchesQuerySubsets, a5 as querySubsetContains } from './transport-CJvRO5ix.cjs';
 import * as _korajs_core from '@korajs/core';
 import { Operation, VersionVector, ApplyResult, KoraEventEmitter, TimeSource, SyncError, ConnectionQuality } from '@korajs/core';
 export { ApplyFailureReason, ApplyResult } from '@korajs/core';
@@ -106,6 +106,16 @@ interface SyncStore {
      * @returns the record's fields, or null when it cannot be read.
      */
     readRecordFields?(collection: string, recordId: string): Promise<Record<string, unknown> | null>;
+    /**
+     * Remove a record from this client's materialized authorization view without
+     * writing a domain delete to the replicated operation log.
+     */
+    applyScopeRetraction?(collection: string, recordId: string): Promise<void>;
+    /** Retract every currently materialized row outside a newly accepted scope. */
+    applyScopeNarrowing?(scopes: Record<string, Record<string, unknown>>): Promise<Array<{
+        collection: string;
+        recordId: string;
+    }>>;
 }
 
 /** Prefix for handshake rejection when client schema version is unsupported. */
@@ -879,6 +889,8 @@ declare class OutboundQueue {
      * or null if it was not present (already acknowledged and removed).
      */
     reject(opId: string): Promise<Operation | null>;
+    /** Remove every pending/in-flight operation for a record so authorization loss cannot upload it. */
+    rejectRecord(collection: string, recordId: string): Promise<Operation[]>;
     /**
      * Remove operations by id from queue and persistent storage.
      * Used when ops were already sent during handshake delta exchange.
@@ -956,6 +968,8 @@ declare class SyncEngine {
     private readonly rejectedStorage;
     private readonly batchSize;
     private readonly outboundAckTimeoutMs;
+    private readonly outboundRetryBaseDelayMs;
+    private readonly outboundRetryMaxDelayMs;
     private readonly encryptor;
     private readonly awarenessManager;
     private readonly richtextDocChannel;
@@ -971,6 +985,9 @@ declare class SyncEngine {
     private conflictCount;
     private currentBatch;
     private currentBatchRequiresPartialAck;
+    private currentBatchRequiresRetryBackoff;
+    private outboundRetryAttempt;
+    private outboundRetryTimer;
     private reconnecting;
     private schemaBlocked;
     private clockBlocked;
@@ -998,6 +1015,9 @@ declare class SyncEngine {
      * with the server-accepted scope (server is authoritative).
      */
     private activeScope;
+    /** Server-authoritative upload authorization, separate from the downloaded view. */
+    private activeUplinkScope;
+    private hasDirectionalScopes;
     /** Live query subsets registered from reactive subscriptions */
     private querySubsets;
     private staticQuerySubsets;
@@ -1169,6 +1189,8 @@ declare class SyncEngine {
      * Get the currently active scope map. Returns undefined if no scope is configured.
      */
     getActiveScope(): SyncScopeMap | undefined;
+    /** Get the server-accepted upload authorization scope. */
+    getActiveUplinkScope(): SyncScopeMap | undefined;
     /**
      * Register a live query subset that narrows synced data for a collection.
      * Takes effect on the next connection; reconnects when already connected.
@@ -1242,6 +1264,7 @@ declare class SyncEngine {
      * the app can reconcile. Unlike {@link handleError}, this is a normal per-op
      * signal, so the connection stays up.
      */
+    private applyScopeRetraction;
     private handleOperationRejected;
     /**
      * Every operation the server rejected that has not yet been reconciled. The app
@@ -1276,6 +1299,8 @@ declare class SyncEngine {
     private flushQueue;
     private startOutboundAckTimer;
     private clearOutboundAckTimer;
+    private scheduleOutboundRetry;
+    private clearOutboundRetryTimer;
     private handleOutboundAckTimeout;
     private handleAwarenessUpdate;
     private handleTransportClose;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as SyncScopeMap, D as DeltaCursor, a as SyncMessage, b as SerializedOperation, W as WireFormat, c as SyncTransport, T as TransportOptions, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, B as BlobChunkRequestMessage, g as BlobChunkResponseMessage, h as BlobChunkPushMessage, i as SyncEncryptionConfig, V as VersionedKey, Y as YjsDocUpdateMessage, Q as QueueStorage, j as SyncState, k as SyncStatusInfo, l as SyncConfig, R as RejectedOperationStorage, m as SyncStatePersistence, n as SyncQuerySubset, o as RejectedOperation } from './transport-iXX0KA_W.js';
-export { A as AcknowledgmentMessage, p as ActiveApplyFailure, q as AwarenessStateWire, r as AwarenessUpdateMessage, E as EncryptedPayload, s as ErrorMessage, H as HandshakeMessage, t as HandshakeResponseMessage, I as InvalidScopeError, M as MemoryRejectedOperationStorage, O as OperationBatchMessage, u as OperationRejectedMessage, v as SYNC_STATES, w as SYNC_STATUSES, x as ScopeViolationError, y as SyncEncryptionAlgorithm, z as SyncPhase, C as SyncScopeContext, F as SyncSettlementOptions, G as SyncSettlementResult, J as SyncStatus, K as dedupeQuerySubsets, L as isAcknowledgmentMessage, N as isAwarenessUpdateMessage, P as isBlobChunkPushMessage, U as isBlobChunkRequestMessage, X as isBlobChunkResponseMessage, Z as isErrorMessage, _ as isHandshakeMessage, $ as isHandshakeResponseMessage, a0 as isOperationBatchMessage, a1 as isOperationRejectedMessage, a2 as isSyncMessage, a3 as isYjsDocUpdateMessage, a4 as operationMatchesQuerySubsets, a5 as querySubsetContains } from './transport-iXX0KA_W.js';
+import { S as SyncScopeMap, D as DeltaCursor, a as SyncMessage, b as SerializedOperation, W as WireFormat, c as SyncTransport, T as TransportOptions, d as TransportMessageHandler, e as TransportCloseHandler, f as TransportErrorHandler, B as BlobChunkRequestMessage, g as BlobChunkResponseMessage, h as BlobChunkPushMessage, i as SyncEncryptionConfig, V as VersionedKey, Y as YjsDocUpdateMessage, Q as QueueStorage, j as SyncState, k as SyncStatusInfo, l as SyncConfig, R as RejectedOperationStorage, m as SyncStatePersistence, n as SyncQuerySubset, o as RejectedOperation } from './transport-CJvRO5ix.js';
+export { A as AcknowledgmentMessage, p as ActiveApplyFailure, q as AwarenessStateWire, r as AwarenessUpdateMessage, E as EncryptedPayload, s as ErrorMessage, H as HandshakeMessage, t as HandshakeResponseMessage, I as InvalidScopeError, M as MemoryRejectedOperationStorage, O as OperationBatchMessage, u as OperationRejectedMessage, v as SYNC_STATES, w as SYNC_STATUSES, x as ScopeViolationError, y as SyncEncryptionAlgorithm, z as SyncPhase, C as SyncScopeContext, F as SyncSettlementOptions, G as SyncSettlementResult, J as SyncStatus, K as dedupeQuerySubsets, L as isAcknowledgmentMessage, N as isAwarenessUpdateMessage, P as isBlobChunkPushMessage, U as isBlobChunkRequestMessage, X as isBlobChunkResponseMessage, Z as isErrorMessage, _ as isHandshakeMessage, $ as isHandshakeResponseMessage, a0 as isOperationBatchMessage, a1 as isOperationRejectedMessage, a2 as isSyncMessage, a3 as isYjsDocUpdateMessage, a4 as operationMatchesQuerySubsets, a5 as querySubsetContains } from './transport-CJvRO5ix.js';
 import * as _korajs_core from '@korajs/core';
 import { Operation, VersionVector, ApplyResult, KoraEventEmitter, TimeSource, SyncError, ConnectionQuality } from '@korajs/core';
 export { ApplyFailureReason, ApplyResult } from '@korajs/core';
@@ -106,6 +106,16 @@ interface SyncStore {
      * @returns the record's fields, or null when it cannot be read.
      */
     readRecordFields?(collection: string, recordId: string): Promise<Record<string, unknown> | null>;
+    /**
+     * Remove a record from this client's materialized authorization view without
+     * writing a domain delete to the replicated operation log.
+     */
+    applyScopeRetraction?(collection: string, recordId: string): Promise<void>;
+    /** Retract every currently materialized row outside a newly accepted scope. */
+    applyScopeNarrowing?(scopes: Record<string, Record<string, unknown>>): Promise<Array<{
+        collection: string;
+        recordId: string;
+    }>>;
 }
 
 /** Prefix for handshake rejection when client schema version is unsupported. */
@@ -879,6 +889,8 @@ declare class OutboundQueue {
      * or null if it was not present (already acknowledged and removed).
      */
     reject(opId: string): Promise<Operation | null>;
+    /** Remove every pending/in-flight operation for a record so authorization loss cannot upload it. */
+    rejectRecord(collection: string, recordId: string): Promise<Operation[]>;
     /**
      * Remove operations by id from queue and persistent storage.
      * Used when ops were already sent during handshake delta exchange.
@@ -956,6 +968,8 @@ declare class SyncEngine {
     private readonly rejectedStorage;
     private readonly batchSize;
     private readonly outboundAckTimeoutMs;
+    private readonly outboundRetryBaseDelayMs;
+    private readonly outboundRetryMaxDelayMs;
     private readonly encryptor;
     private readonly awarenessManager;
     private readonly richtextDocChannel;
@@ -971,6 +985,9 @@ declare class SyncEngine {
     private conflictCount;
     private currentBatch;
     private currentBatchRequiresPartialAck;
+    private currentBatchRequiresRetryBackoff;
+    private outboundRetryAttempt;
+    private outboundRetryTimer;
     private reconnecting;
     private schemaBlocked;
     private clockBlocked;
@@ -998,6 +1015,9 @@ declare class SyncEngine {
      * with the server-accepted scope (server is authoritative).
      */
     private activeScope;
+    /** Server-authoritative upload authorization, separate from the downloaded view. */
+    private activeUplinkScope;
+    private hasDirectionalScopes;
     /** Live query subsets registered from reactive subscriptions */
     private querySubsets;
     private staticQuerySubsets;
@@ -1169,6 +1189,8 @@ declare class SyncEngine {
      * Get the currently active scope map. Returns undefined if no scope is configured.
      */
     getActiveScope(): SyncScopeMap | undefined;
+    /** Get the server-accepted upload authorization scope. */
+    getActiveUplinkScope(): SyncScopeMap | undefined;
     /**
      * Register a live query subset that narrows synced data for a collection.
      * Takes effect on the next connection; reconnects when already connected.
@@ -1242,6 +1264,7 @@ declare class SyncEngine {
      * the app can reconcile. Unlike {@link handleError}, this is a normal per-op
      * signal, so the connection stays up.
      */
+    private applyScopeRetraction;
     private handleOperationRejected;
     /**
      * Every operation the server rejected that has not yet been reconciled. The app
@@ -1276,6 +1299,8 @@ declare class SyncEngine {
     private flushQueue;
     private startOutboundAckTimer;
     private clearOutboundAckTimer;
+    private scheduleOutboundRetry;
+    private clearOutboundRetryTimer;
     private handleOutboundAckTimeout;
     private handleAwarenessUpdate;
     private handleTransportClose;

package/dist/index.js

@@ -591,7 +591,8 @@ function toProtoEnvelope(message) {
         schemaVersion: message.schemaVersion,
         authToken: message.authToken,
         supportedWireFormats: message.supportedWireFormats,
-        ...message.lastDeliverySequence !== void 0 ? { lastDeliverySequence: message.lastDeliverySequence } : {}
+        ...message.lastDeliverySequence !== void 0 ? { lastDeliverySequence: message.lastDeliverySequence } : {},
+        scopeExitPolicy: message.scopeExitPolicy
       };
     case "handshake-response":
       return {
@@ -608,7 +609,10 @@ function toProtoEnvelope(message) {
         selectedWireFormat: message.selectedWireFormat,
         serverTime: message.serverTime,
         blobStorageEnabled: message.blobStorageEnabled,
-        ...message.serverMaxDeliverySequence !== void 0 ? { serverMaxDeliverySequence: message.serverMaxDeliverySequence } : {}
+        ...message.serverMaxDeliverySequence !== void 0 ? { serverMaxDeliverySequence: message.serverMaxDeliverySequence } : {},
+        acceptedScopeJson: message.acceptedScope ? JSON.stringify(message.acceptedScope) : void 0,
+        acceptedDownlinkScopesJson: message.acceptedDownlinkScopes ? JSON.stringify(message.acceptedDownlinkScopes) : void 0,
+        acceptedUplinkScopesJson: message.acceptedUplinkScopes ? JSON.stringify(message.acceptedUplinkScopes) : void 0
       };
     case "operation-batch":
       return {
@@ -618,7 +622,8 @@ function toProtoEnvelope(message) {
         isFinal: message.isFinal,
         batchIndex: message.batchIndex,
         ...message.baseDeliverySequence !== void 0 ? { baseDeliverySequence: message.baseDeliverySequence } : {},
-        ...message.maxDeliverySequence !== void 0 ? { maxDeliverySequence: message.maxDeliverySequence } : {}
+        ...message.maxDeliverySequence !== void 0 ? { maxDeliverySequence: message.maxDeliverySequence } : {},
+        retractionsJson: message.retractions ? JSON.stringify(message.retractions) : void 0
       };
     case "acknowledgment":
       return {
@@ -692,7 +697,8 @@ function fromProtoEnvelope(envelope) {
         supportedWireFormats: envelope.supportedWireFormats?.filter(
           (format) => format === "json" || format === "protobuf"
         ),
-        ...envelope.lastDeliverySequence !== void 0 ? { lastDeliverySequence: envelope.lastDeliverySequence } : {}
+        ...envelope.lastDeliverySequence !== void 0 ? { lastDeliverySequence: envelope.lastDeliverySequence } : {},
+        ...envelope.scopeExitPolicy === "retain" || envelope.scopeExitPolicy === "retract" ? { scopeExitPolicy: envelope.scopeExitPolicy } : {}
       };
     case "handshake-response":
       return {
@@ -710,7 +716,10 @@ function fromProtoEnvelope(envelope) {
         // automatic timestamp rebase work over the protobuf wire, not just JSON.
         ...envelope.serverTime !== void 0 ? { serverTime: envelope.serverTime } : {},
         ...envelope.blobStorageEnabled !== void 0 ? { blobStorageEnabled: envelope.blobStorageEnabled } : {},
-        ...envelope.serverMaxDeliverySequence !== void 0 ? { serverMaxDeliverySequence: envelope.serverMaxDeliverySequence } : {}
+        ...envelope.serverMaxDeliverySequence !== void 0 ? { serverMaxDeliverySequence: envelope.serverMaxDeliverySequence } : {},
+        ...envelope.acceptedScopeJson ? { acceptedScope: JSON.parse(envelope.acceptedScopeJson) } : {},
+        ...envelope.acceptedDownlinkScopesJson ? { acceptedDownlinkScopes: JSON.parse(envelope.acceptedDownlinkScopesJson) } : {},
+        ...envelope.acceptedUplinkScopesJson ? { acceptedUplinkScopes: JSON.parse(envelope.acceptedUplinkScopesJson) } : {}
       };
     case "operation-batch":
       return {
@@ -720,7 +729,8 @@ function fromProtoEnvelope(envelope) {
         isFinal: envelope.isFinal ?? false,
         batchIndex: envelope.batchIndex ?? 0,
         ...envelope.baseDeliverySequence !== void 0 ? { baseDeliverySequence: envelope.baseDeliverySequence } : {},
-        ...envelope.maxDeliverySequence !== void 0 ? { maxDeliverySequence: envelope.maxDeliverySequence } : {}
+        ...envelope.maxDeliverySequence !== void 0 ? { maxDeliverySequence: envelope.maxDeliverySequence } : {},
+        ...envelope.retractionsJson ? { retractions: JSON.parse(envelope.retractionsJson) } : {}
       };
     case "acknowledgment":
       return {
@@ -938,6 +948,13 @@ function encodeEnvelope(envelope) {
   if (envelope.deliverySequence !== void 0) writer.uint32(256).int64(envelope.deliverySequence);
   if (envelope.serverMaxDeliverySequence !== void 0)
     writer.uint32(264).int64(envelope.serverMaxDeliverySequence);
+  if (envelope.acceptedScopeJson) writer.uint32(274).string(envelope.acceptedScopeJson);
+  if (envelope.acceptedDownlinkScopesJson)
+    writer.uint32(282).string(envelope.acceptedDownlinkScopesJson);
+  if (envelope.acceptedUplinkScopesJson)
+    writer.uint32(290).string(envelope.acceptedUplinkScopesJson);
+  if (envelope.retractionsJson) writer.uint32(298).string(envelope.retractionsJson);
+  if (envelope.scopeExitPolicy) writer.uint32(306).string(envelope.scopeExitPolicy);
   return writer.finish();
 }
 function decodeEnvelope(bytes) {
@@ -1048,6 +1065,21 @@ function decodeEnvelope(bytes) {
       case 33:
         envelope.serverMaxDeliverySequence = longToNumber(reader.int64());
         break;
+      case 34:
+        envelope.acceptedScopeJson = reader.string();
+        break;
+      case 35:
+        envelope.acceptedDownlinkScopesJson = reader.string();
+        break;
+      case 36:
+        envelope.acceptedUplinkScopesJson = reader.string();
+        break;
+      case 37:
+        envelope.retractionsJson = reader.string();
+        break;
+      case 38:
+        envelope.scopeExitPolicy = reader.string();
+        break;
       default:
         reader.skipType(tag & 7);
     }
@@ -2701,6 +2733,18 @@ var OutboundQueue = class {
     await this.storage.dequeue([opId]);
     return removed;
   }
+  /** Remove every pending/in-flight operation for a record so authorization loss cannot upload it. */
+  async rejectRecord(collection, recordId) {
+    const matching = [...this.queue, ...[...this.inFlight.values()].flat()].filter(
+      (op) => op.collection === collection && op.recordId === recordId
+    );
+    const removed = [];
+    for (const operation of matching) {
+      const rejected = await this.reject(operation.id);
+      if (rejected) removed.push(rejected);
+    }
+    return removed;
+  }
   /**
    * Remove operations by id from queue and persistent storage.
    * Used when ops were already sent during handshake delta exchange.
@@ -2720,6 +2764,8 @@ var OutboundQueue = class {
 var DEFAULT_BATCH_SIZE = 100;
 var DEFAULT_SCHEMA_VERSION = 1;
 var DEFAULT_OUTBOUND_ACK_TIMEOUT_MS = 3e4;
+var DEFAULT_OUTBOUND_RETRY_BASE_DELAY_MS = 250;
+var DEFAULT_OUTBOUND_RETRY_MAX_DELAY_MS = 3e4;
 var VALID_TRANSITIONS = {
   disconnected: ["connecting"],
   connecting: ["handshaking", "error", "disconnected"],
@@ -2755,6 +2801,8 @@ var SyncEngine = class {
   rejectedStorage;
   batchSize;
   outboundAckTimeoutMs;
+  outboundRetryBaseDelayMs;
+  outboundRetryMaxDelayMs;
   encryptor;
   awarenessManager;
   richtextDocChannel;
@@ -2770,6 +2818,9 @@ var SyncEngine = class {
   conflictCount = 0;
   currentBatch = null;
   currentBatchRequiresPartialAck = false;
+  currentBatchRequiresRetryBackoff = false;
+  outboundRetryAttempt = 0;
+  outboundRetryTimer = null;
   reconnecting = false;
   schemaBlocked = false;
   clockBlocked = false;
@@ -2798,6 +2849,9 @@ var SyncEngine = class {
    * with the server-accepted scope (server is authoritative).
    */
   activeScope;
+  /** Server-authoritative upload authorization, separate from the downloaded view. */
+  activeUplinkScope;
+  hasDirectionalScopes = false;
   /** Live query subsets registered from reactive subscriptions */
   querySubsets = /* @__PURE__ */ new Map();
   staticQuerySubsets = [];
@@ -2834,9 +2888,18 @@ var SyncEngine = class {
     this.emitter = options.emitter ?? null;
     this.batchSize = options.config.batchSize ?? DEFAULT_BATCH_SIZE;
     this.outboundAckTimeoutMs = options.config.outboundAckTimeoutMs ?? DEFAULT_OUTBOUND_ACK_TIMEOUT_MS;
+    this.outboundRetryBaseDelayMs = Math.max(
+      0,
+      options.config.outboundRetryBaseDelayMs ?? DEFAULT_OUTBOUND_RETRY_BASE_DELAY_MS
+    );
+    this.outboundRetryMaxDelayMs = Math.max(
+      this.outboundRetryBaseDelayMs,
+      options.config.outboundRetryMaxDelayMs ?? DEFAULT_OUTBOUND_RETRY_MAX_DELAY_MS
+    );
     this.encryptor = options.encryptor ?? null;
     this.syncState = options.syncState ?? null;
     this.activeScope = options.config.scopeMap;
+    this.activeUplinkScope = options.config.scopeMap;
     const queueStorage = options.queueStorage ?? new MemoryQueueStorage();
     this.outboundQueue = new OutboundQueue(queueStorage);
     this.rejectedStorage = options.rejectedStorage ?? new MemoryRejectedOperationStorage();
@@ -2959,6 +3022,7 @@ var SyncEngine = class {
         authToken,
         supportedWireFormats: ["json", "protobuf"],
         ...this.config.scopeMap ? { syncScope: this.config.scopeMap } : {},
+        ...this.config.scopeExit ? { scopeExitPolicy: this.config.scopeExit } : {},
         ...activeQuerySubsets.length > 0 ? { syncQueries: activeQuerySubsets } : {},
         ...this.resumeDeltaCursor ? { deltaCursor: encodeDeltaCursor(this.resumeDeltaCursor) } : {},
         // Resume the server's gap-free delivery stream from our watermark. A server
@@ -2983,13 +3047,15 @@ var SyncEngine = class {
     return this.stopPromise;
   }
   async stopInternal() {
-    if (this.state === "disconnected") return;
     this.clearOutboundAckTimer();
+    this.clearOutboundRetryTimer();
+    if (this.state === "disconnected") return;
     this.awarenessManager.stopCleanupTimer();
     if (this.currentBatch) {
       this.outboundQueue.returnBatch(this.currentBatch.batchId);
       this.currentBatch = null;
       this.currentBatchRequiresPartialAck = false;
+      this.currentBatchRequiresRetryBackoff = false;
     }
     try {
       await this.transport.disconnect();
@@ -3272,6 +3338,8 @@ var SyncEngine = class {
   updateScope(scopeMap) {
     const previousSignature = this.deliverySignature();
     this.activeScope = scopeMap;
+    this.activeUplinkScope = scopeMap;
+    this.hasDirectionalScopes = false;
     this.config.scopeMap = scopeMap;
     this.switchDeliveryView(previousSignature);
   }
@@ -3355,6 +3423,10 @@ var SyncEngine = class {
   getActiveScope() {
     return this.activeScope;
   }
+  /** Get the server-accepted upload authorization scope. */
+  getActiveUplinkScope() {
+    return this.activeUplinkScope;
+  }
   /**
    * Register a live query subset that narrows synced data for a collection.
    * Takes effect on the next connection; reconnects when already connected.
@@ -3557,8 +3629,17 @@ var SyncEngine = class {
     if (msg.selectedWireFormat) {
       this.setSerializerWireFormat(msg.selectedWireFormat);
     }
-    if (msg.acceptedScope) {
-      this.activeScope = msg.acceptedScope;
+    if (msg.acceptedDownlinkScopes ?? msg.acceptedScope) {
+      this.activeScope = msg.acceptedDownlinkScopes ?? msg.acceptedScope;
+    }
+    this.hasDirectionalScopes = msg.acceptedUplinkScopes !== void 0;
+    this.activeUplinkScope = msg.acceptedUplinkScopes ?? msg.acceptedScope ?? this.activeScope;
+    if (this.config.scopeExit === "retract" && this.activeScope && this.store.applyScopeNarrowing) {
+      const narrowed = await this.store.applyScopeNarrowing(this.activeScope);
+      for (const retraction of narrowed) {
+        await this.applyScopeRetraction(retraction, false);
+      }
+      await this.refreshPendingCount();
     }
     this.emitter?.emit({ type: "sync:connected", nodeId: this.store.getNodeId() });
     this.metricsCollector.recordConnected();
@@ -3723,6 +3804,14 @@ var SyncEngine = class {
     const targetSchemaVersion = this.config.schemaVersion ?? DEFAULT_SCHEMA_VERSION;
     const transforms = this.config.operationTransforms ?? [];
     let fullyApplied = true;
+    for (const retraction of msg.retractions ?? []) {
+      try {
+        await this.applyScopeRetraction(retraction, true);
+      } catch {
+        fullyApplied = false;
+      }
+    }
+    await this.refreshPendingCount();
     for (const op of inScopeOps) {
       const transformed = transforms.length > 0 ? applyOperationTransforms(op, targetSchemaVersion, transforms) : op;
       if (transformed === null) {
@@ -3830,6 +3919,7 @@ var SyncEngine = class {
   }
   async handleAcknowledgment(msg) {
     this.clearOutboundAckTimer();
+    const requiresRetryBackoff = this.currentBatchRequiresRetryBackoff;
     if (this.state === "syncing" && this.config.strictHandshake) {
       this.pendingDeltaBatchAcks.delete(msg.acknowledgedMessageId);
       this.markDeltaSendCompleteIfReady();
@@ -3845,6 +3935,7 @@ var SyncEngine = class {
       }
       this.currentBatch = null;
       this.currentBatchRequiresPartialAck = false;
+      this.currentBatchRequiresRetryBackoff = false;
       const now = Date.now();
       this.lastSyncedAt = now;
       this.lastSuccessfulPush = now;
@@ -3852,7 +3943,14 @@ var SyncEngine = class {
     await this.advanceLastAckedForLocalNode(msg.lastSequenceNumber);
     await this.refreshPendingCount();
     if (this.state === "streaming" && this.outboundQueue.hasOperations) {
-      this.flushQueue();
+      if (requiresRetryBackoff) {
+        this.scheduleOutboundRetry();
+      } else {
+        this.outboundRetryAttempt = 0;
+        this.flushQueue();
+      }
+    } else if (!requiresRetryBackoff) {
+      this.outboundRetryAttempt = 0;
     }
   }
   handleError(msg) {
@@ -3861,6 +3959,7 @@ var SyncEngine = class {
       this.outboundQueue.returnBatch(this.currentBatch.batchId);
       this.currentBatch = null;
       this.currentBatchRequiresPartialAck = false;
+      this.currentBatchRequiresRetryBackoff = false;
     }
     this.transitionTo("error");
     if (msg.code === "AUTH_FAILED" || msg.code === "DEVICE_REVOKED") {
@@ -3890,9 +3989,39 @@ var SyncEngine = class {
    * the app can reconcile. Unlike {@link handleError}, this is a normal per-op
    * signal, so the connection stays up.
    */
+  async applyScopeRetraction(retraction, applyToStore) {
+    if (applyToStore) {
+      if (!this.store.applyScopeRetraction) {
+        throw new Error("The configured sync store does not support scope retractions");
+      }
+      await this.store.applyScopeRetraction(retraction.collection, retraction.recordId);
+    }
+    const quarantined = await this.outboundQueue.rejectRecord(
+      retraction.collection,
+      retraction.recordId
+    );
+    for (const operation of quarantined) {
+      await this.rejectedStorage.record({
+        operationId: operation.id,
+        collection: operation.collection,
+        recordId: operation.recordId,
+        code: "SCOPE_RETRACTED",
+        message: "Authorization changed before this operation could be uploaded.",
+        retriable: false,
+        rejectedAt: Date.now()
+      });
+    }
+    this.emitter?.emit({
+      type: "sync:scope-retracted",
+      collection: retraction.collection,
+      recordId: retraction.recordId,
+      quarantinedOperationIds: quarantined.map((operation) => operation.id)
+    });
+  }
   async handleOperationRejected(msg) {
     if (msg.retriable) {
       this.currentBatchRequiresPartialAck = true;
+      this.currentBatchRequiresRetryBackoff = true;
       await this.refreshPendingCount();
       this.emitter?.emit({
         type: "sync:operation-rejected",
@@ -4046,11 +4175,13 @@ var SyncEngine = class {
   }
   flushQueue() {
     if (this.currentBatch) return;
+    if (this.outboundRetryTimer) return;
     if (!this.outboundQueue.hasOperations) return;
     const batch = this.outboundQueue.takeBatch(this.batchSize);
     if (!batch) return;
     this.currentBatch = batch;
     this.currentBatchRequiresPartialAck = false;
+    this.currentBatchRequiresRetryBackoff = false;
     if (this.encryptor) {
       this.encryptor.encryptBatch(batch.operations).then(
         (encrypted) => {
@@ -4074,6 +4205,7 @@ var SyncEngine = class {
           this.outboundQueue.returnBatch(batch.batchId);
           this.currentBatch = null;
           this.currentBatchRequiresPartialAck = false;
+          this.currentBatchRequiresRetryBackoff = false;
           this.emitter?.emit({
             type: "sync:disconnected",
             reason: err instanceof Error ? err.message : "Encryption failed"
@@ -4110,11 +4242,29 @@ var SyncEngine = class {
     clearTimeout(this.outboundAckTimer);
     this.outboundAckTimer = null;
   }
+  scheduleOutboundRetry() {
+    if (this.outboundRetryTimer || !this.outboundQueue.hasOperations) return;
+    const delay = Math.min(
+      this.outboundRetryMaxDelayMs,
+      this.outboundRetryBaseDelayMs * 2 ** this.outboundRetryAttempt
+    );
+    this.outboundRetryAttempt += 1;
+    this.outboundRetryTimer = setTimeout(() => {
+      this.outboundRetryTimer = null;
+      if (this.state === "streaming") this.flushQueue();
+    }, delay);
+  }
+  clearOutboundRetryTimer() {
+    if (!this.outboundRetryTimer) return;
+    clearTimeout(this.outboundRetryTimer);
+    this.outboundRetryTimer = null;
+  }
   async handleOutboundAckTimeout(batchId) {
     if (!this.currentBatch || this.currentBatch.batchId !== batchId) return;
     this.outboundQueue.returnBatch(batchId);
     this.currentBatch = null;
     this.currentBatchRequiresPartialAck = false;
+    this.currentBatchRequiresRetryBackoff = false;
     this.clearOutboundAckTimer();
     await this.refreshPendingCount();
     if (this.state === "disconnected") return;
@@ -4136,10 +4286,12 @@ var SyncEngine = class {
   }
   handleTransportClose(reason) {
     this.clearOutboundAckTimer();
+    this.clearOutboundRetryTimer();
     if (this.currentBatch) {
       this.outboundQueue.returnBatch(this.currentBatch.batchId);
       this.currentBatch = null;
       this.currentBatchRequiresPartialAck = false;
+      this.currentBatchRequiresRetryBackoff = false;
     }
     if (this.schemaBlocked) {
       return;
@@ -4182,10 +4334,10 @@ var SyncEngine = class {
     return this.matchesScopeAndSubsets(op, fullRecord);
   }
   matchesScopeAndSubsets(op, fullRecord) {
-    if (!operationMatchesScope(op, this.activeScope, fullRecord)) {
+    if (!operationMatchesScope(op, this.activeUplinkScope, fullRecord)) {
       return false;
     }
-    return operationMatchesQuerySubsets(op, this.getActiveQuerySubsets(), fullRecord);
+    return this.hasDirectionalScopes || operationMatchesQuerySubsets(op, this.getActiveQuerySubsets(), fullRecord);
   }
   async readRecordForBackfill(op) {
     if (!this.store.readRecordFields) {