@lsync/server 0.0.2 → 0.0.3

package/README.md

@@ -8,3 +8,49 @@ pnpm add @lsync/server @lsync/definitions
 
 The package exports the reusable Durable Object, worker handler, collection configuration helpers,
 and the `@lsync/server/client` subpath for server-side clients.
+
+SQLite JSON collections use server-sequence last-write-wins conflict resolution. `previousValue`
+is available to access rules and history consumers, but is not a compare-and-swap precondition.
+Mutation IDs are recorded durably, so retrying the same update is idempotent; reusing an ID with a
+different payload is rejected.
+
+## Safeguards
+
+Each WebSocket may subscribe to at most 100 collection scopes by default. Override or disable the
+cap when building the shard options:
+
+```ts
+const options = CollectionShardDurableObject.from(collections)
+  .limits({ maxSubscriptionsPerWebSocket: 250 }) // or false
+  .build();
+```
+
+Cloudflare's managed Rate Limiting binding can protect WebSocket message handling:
+
+```ts
+import { cloudflareRateLimiter } from "@lsync/server";
+
+const options = CollectionShardDurableObject.from(collections)
+  .rateLimit(
+    cloudflareRateLimiter({
+      key: ({ auth, clientId }) => String(auth.userId ?? clientId),
+    }),
+  )
+  .build();
+```
+
+Configure the matching binding in `wrangler.toml` (the period must be 10 or 60 seconds):
+
+```toml
+[[ratelimits]]
+name = "RATE_LIMITER"
+namespace_id = "1001"
+
+[ratelimits.simple]
+limit = 100
+period = 60
+```
+
+The managed limiter is intentionally permissive, eventually consistent, and local to a Cloudflare
+location. Use it for abuse protection rather than billing or exact accounting. Prefer an
+authenticated user or tenant key; `clientId` is only the fallback.

package/dist/client.d.mts

@@ -1,2 +1,2 @@
-import { A as CollectionSubscriptionInput, B as ReadOrderBy, C as CollectionApiDefinition, E as CollectionConfigs, H as ReadQuery, J as SyncChangesQuery, K as SequencedBatch, L as ReadCursor, M as OperationType, N as PushResult, R as ReadFilter, T as CollectionConfig, U as ReadResult, V as ReadPredicate, X as SyncChangesResult, Y as SyncChangesQueryInput, Z as Update, _ as ApiOutput, b as Batch, d as ApiCallInput, f as ApiContract, g as ApiInput, h as ApiHandlerContext, j as CollectionSubscriptionResult, k as CollectionSubscription, l as ApiCall, m as ApiHandlerArgs, n as Router, p as ApiHandler, q as SequencedUpdate, r as router, t as Context, u as ApiCallArgs, v as ApiPath, w as CollectionApiHandlers, x as Broadcast, y as ApiRoute, z as ReadFilterOperator } from "./router-D_wddPdy.mjs";
+import { A as CollectionSubscriptionInput, B as ReadOrderBy, C as CollectionApiDefinition, E as CollectionConfigs, H as ReadQuery, J as SyncChangesQuery, K as SequencedBatch, L as ReadCursor, M as OperationType, N as PushResult, R as ReadFilter, T as CollectionConfig, U as ReadResult, V as ReadPredicate, X as SyncChangesResult, Y as SyncChangesQueryInput, Z as Update, _ as ApiOutput, b as Batch, d as ApiCallInput, f as ApiContract, g as ApiInput, h as ApiHandlerContext, j as CollectionSubscriptionResult, k as CollectionSubscription, l as ApiCall, m as ApiHandlerArgs, n as Router, p as ApiHandler, q as SequencedUpdate, r as router, t as Context, u as ApiCallArgs, v as ApiPath, w as CollectionApiHandlers, x as Broadcast, y as ApiRoute, z as ReadFilterOperator } from "./router-B9emOwKj.mjs";
 export { type ApiCall, type ApiCallArgs, type ApiCallInput, type ApiContract, type ApiHandler, type ApiHandlerArgs, type ApiHandlerContext, type ApiInput, type ApiOutput, type ApiPath, type ApiRoute, type Batch, type Broadcast, type CollectionApiDefinition, type CollectionApiHandlers, type CollectionConfig, type CollectionConfigs, type CollectionSubscription, type CollectionSubscriptionInput, type CollectionSubscriptionResult, type Context, type OperationType, type PushResult, type ReadCursor, type ReadFilter, type ReadFilterOperator, type ReadOrderBy, type ReadPredicate, type ReadQuery, type ReadResult, type Router, type SequencedBatch, type SequencedUpdate, type SyncChangesQuery, type SyncChangesQueryInput, type SyncChangesResult, type Update, router };

package/dist/client.mjs

@@ -1,2 +1,2 @@
-import { t as router } from "./router-C4eYfMV7.mjs";
+import { t as router } from "./router-CZnnFmXh.mjs";
 export { router };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { A as CollectionSubscriptionInput, B as ReadOrderBy, C as CollectionApiDefinition, D as CollectionInvalidation, E as CollectionConfigs, F as ReadAccessHandler, G as SQLiteJsonStorageConfig, H as ReadQuery, I as ReadAccessResult, J as SyncChangesQuery, K as SequencedBatch$1, L as ReadCursor, M as OperationType, N as PushResult, O as CollectionStorageConfig, P as ReadAccessContext, Q as WebSocketAttachment, R as ReadFilter, S as CollectionAccessConfig, T as CollectionConfig, U as ReadResult, V as ReadPredicate, W as SQLiteJsonIndexConfig, X as SyncChangesResult, Y as SyncChangesQueryInput, Z as Update, _ as ApiOutput, a as AccessReference, b as Batch, c as ApiAccessHandler, d as ApiCallInput, f as ApiContract, g as ApiInput, h as ApiHandlerContext, i as AccessAuth, j as CollectionSubscriptionResult, k as CollectionSubscription, l as ApiCall, m as ApiHandlerArgs, n as Router, o as AccessReferenceResolver, p as ApiHandler, q as SequencedUpdate, r as router, s as ApiAccessContext, t as Context, u as ApiCallArgs, v as ApiPath, w as CollectionApiHandlers, x as Broadcast, y as ApiRoute, z as ReadFilterOperator } from "./router-D_wddPdy.mjs";
+import { A as CollectionSubscriptionInput, B as ReadOrderBy, C as CollectionApiDefinition, D as CollectionInvalidation, E as CollectionConfigs, F as ReadAccessHandler, G as SQLiteJsonStorageConfig, H as ReadQuery, I as ReadAccessResult, J as SyncChangesQuery, K as SequencedBatch$1, L as ReadCursor, M as OperationType, N as PushResult, O as CollectionStorageConfig, P as ReadAccessContext, Q as WebSocketAttachment, R as ReadFilter, S as CollectionAccessConfig, T as CollectionConfig, U as ReadResult, V as ReadPredicate, W as SQLiteJsonIndexConfig, X as SyncChangesResult, Y as SyncChangesQueryInput, Z as Update, _ as ApiOutput, a as AccessReference, b as Batch, c as ApiAccessHandler, d as ApiCallInput, f as ApiContract, g as ApiInput, h as ApiHandlerContext, i as AccessAuth, j as CollectionSubscriptionResult, k as CollectionSubscription, l as ApiCall, m as ApiHandlerArgs, n as Router, o as AccessReferenceResolver, p as ApiHandler, q as SequencedUpdate, r as router, s as ApiAccessContext, t as Context, u as ApiCallArgs, v as ApiPath, w as CollectionApiHandlers, x as Broadcast, y as ApiRoute, z as ReadFilterOperator } from "./router-B9emOwKj.mjs";
 import { FuncExpression, ReadExpression, ReadExpressionField, ReadExpressionInput, ReadExpressionRow, ReadExpressionRow as ReadExpressionRow$1, RefExpression, ValExpression, and, compileReadExpression, eq, field, gt, gte, inArray, lt, lte, matchesReadPredicate, ne, not, or, readExpressionReferences, readExpressionRow, val } from "@lsync/transport";
 import { CollectionAtPath, CollectionDefinitions, CollectionPath, CollectionSet } from "@lsync/definitions";
 
@@ -23,6 +23,7 @@ declare function ensureSQLiteJsonTables(sql: SqlStorageLike, collections?: Colle
 declare function applySQLiteJsonBatch(sql: SqlStorageLike, batch: Batch, collections?: CollectionConfigs): void;
 //#endregion
 //#region src/history.d.ts
+declare const SQLITE_JSON_CONFLICT_POLICY: "server-sequence-last-write-wins";
 interface HistoryOptions {
   maxChanges?: number;
 }
@@ -34,6 +35,15 @@ declare function persistSQLiteJsonBatchWithHistory(sql: SqlStorageLike, batch: B
 declare function readSQLiteJsonChanges(sql: SqlStorageLike, query: SyncChangesQuery, collections?: CollectionConfigs): SyncChangesResult;
 //#endregion
 //#region src/durable-object-types.d.ts
+interface RateLimitContext {
+  auth: AccessAuth;
+  clientId: string;
+  env: Env;
+}
+type RateLimitHandler = (context: RateLimitContext) => boolean | Promise<boolean>;
+interface CollectionShardLimits {
+  maxSubscriptionsPerWebSocket?: number | false;
+}
 interface Env {
   SYNC_SHARDS: DurableObjectNamespace;
 }
@@ -44,6 +54,8 @@ interface CollectionShardOptions {
     request: Request;
   }) => AccessAuth | Promise<AccessAuth>;
   history?: HistoryOptions;
+  limits?: CollectionShardLimits;
+  rateLimit?: RateLimitHandler;
 }
 //#endregion
 //#region src/definition-builder.d.ts
@@ -51,7 +63,10 @@ declare function collectionShardOptionsFrom<TCollections extends CollectionDefin
 declare class CollectionShardDefinitionBuilder<TCollections extends CollectionDefinitions> {
   private readonly definitions;
   private readonly overrides;
-  constructor(definitions: TCollections, overrides: Record<string, ServerCollectionOverride>);
+  private readonly options;
+  constructor(definitions: TCollections, overrides: Record<string, ServerCollectionOverride>, options: Omit<CollectionShardOptions, "collections">);
+  limits(limits: CollectionShardLimits): CollectionShardDefinitionBuilder<TCollections>;
+  rateLimit(rateLimit: RateLimitHandler): CollectionShardDefinitionBuilder<TCollections>;
   collection<TPath extends CollectionPath<TCollections>>(path: TPath, configure: (collection: ServerCollectionBuilder<CollectionAtPath<TCollections, TPath>>) => ServerCollectionBuilder<CollectionAtPath<TCollections, TPath>>): CollectionShardDefinitionBuilder<TCollections>;
   build(): CollectionShardOptions;
 }
@@ -97,7 +112,6 @@ declare class CollectionShardDurableObject implements DurableObject {
   private clientId;
   private updateSubscriptions;
   private subscribedUpdates;
-  private subscribedInvalidations;
   private accessStore;
   private shardId;
 }
@@ -111,6 +125,14 @@ declare function createWorkerHandler(options?: WorkerOptions): {
   fetch(request: Request, env: Env): Promise<Response> | Response;
 };
 //#endregion
+//#region src/safeguards.d.ts
+declare const DEFAULT_MAX_SUBSCRIPTIONS_PER_WEBSOCKET = 100;
+interface CloudflareRateLimiterOptions {
+  binding?: string;
+  key?: (context: RateLimitContext) => string;
+}
+declare function cloudflareRateLimiter(options?: CloudflareRateLimiterOptions): RateLimitHandler;
+//#endregion
 //#region src/collections.d.ts
 interface ResolvedCollection {
   name: string;
@@ -150,5 +172,5 @@ declare function readAccessDecision(collection: string, collections: CollectionC
 //#region src/validation.d.ts
 declare function validateBatch(batch: Batch, collections?: CollectionConfigs): void;
 //#endregion
-export { type AccessAuth, type AccessReference, type AccessReferenceResolver, type AccessStore, type ApiAccessContext, type ApiAccessHandler, type ApiCall, type ApiCallArgs, type ApiCallInput, type ApiContract, type ApiHandler, type ApiHandlerArgs, type ApiHandlerContext, type ApiInput, type ApiOutput, type ApiPath, type ApiRoute, type Batch, type Broadcast, type CollectionAccessConfig, type CollectionApiDefinition, type CollectionApiHandlers, type CollectionConfig, type CollectionConfigs, type CollectionInvalidation, CollectionShardDurableObject, type CollectionShardOptions, type CollectionStorageConfig, type CollectionSubscription, type CollectionSubscriptionInput, type CollectionSubscriptionResult, type Context, type Env, type FuncExpression, type HistoryOptions, type OperationType, type PushResult, type ReadAccessContext, type ReadAccessDecision, type ReadAccessHandler, type ReadAccessResult, type ReadCursor, type ReadExpression, type ReadExpressionField, type ReadExpressionInput, type ReadExpressionRow, type ReadFilter, type ReadFilterOperator, type ReadOrderBy, type ReadPredicate, type ReadQuery, type ReadResult, type RefExpression, type ResolvedCollection, type Router, type SQLiteJsonIndexConfig, type SQLiteJsonStorageConfig, type SQLiteJsonTableOptions, type SequencedBatch, type SequencedUpdate, type SqlStorageCursorLike, type SqlStorageLike, type SqlStorageValue, type SyncChangesQuery, type SyncChangesQueryInput, type SyncChangesResult, type Update, type ValExpression, type WebSocketAttachment, type WorkerOptions, and, applySQLiteJsonBatch, authorizeApiCall, authorizeReadQuery, authorizeWriteBatch, collectionApiHandlers, collectionScope, collectionShardOptionsFrom, compileReadExpression, createWorkerHandler, defaultCollectionApiPath, ensureSQLiteJsonTables, eq, field, gt, gte, inArray, isCollectionPattern, lt, lte, matchesReadPredicate, ne, not, or, persistSQLiteJsonBatchWithHistory, readAccessDecision, readExpressionReferences, readExpressionRow, readSQLiteJsonChanges, readSQLiteJsonRow, readSQLiteJsonRows, resolveCollection, router, sqliteJsonTable, val, validateBatch, visibleUpdateForAuth };
+export { type AccessAuth, type AccessReference, type AccessReferenceResolver, type AccessStore, type ApiAccessContext, type ApiAccessHandler, type ApiCall, type ApiCallArgs, type ApiCallInput, type ApiContract, type ApiHandler, type ApiHandlerArgs, type ApiHandlerContext, type ApiInput, type ApiOutput, type ApiPath, type ApiRoute, type Batch, type Broadcast, type CloudflareRateLimiterOptions, type CollectionAccessConfig, type CollectionApiDefinition, type CollectionApiHandlers, type CollectionConfig, type CollectionConfigs, type CollectionInvalidation, CollectionShardDurableObject, type CollectionShardLimits, type CollectionShardOptions, type CollectionStorageConfig, type CollectionSubscription, type CollectionSubscriptionInput, type CollectionSubscriptionResult, type Context, DEFAULT_MAX_SUBSCRIPTIONS_PER_WEBSOCKET, type Env, type FuncExpression, type HistoryOptions, type OperationType, type PushResult, type RateLimitContext, type RateLimitHandler, type ReadAccessContext, type ReadAccessDecision, type ReadAccessHandler, type ReadAccessResult, type ReadCursor, type ReadExpression, type ReadExpressionField, type ReadExpressionInput, type ReadExpressionRow, type ReadFilter, type ReadFilterOperator, type ReadOrderBy, type ReadPredicate, type ReadQuery, type ReadResult, type RefExpression, type ResolvedCollection, type Router, SQLITE_JSON_CONFLICT_POLICY, type SQLiteJsonIndexConfig, type SQLiteJsonStorageConfig, type SQLiteJsonTableOptions, type SequencedBatch, type SequencedUpdate, type SqlStorageCursorLike, type SqlStorageLike, type SqlStorageValue, type SyncChangesQuery, type SyncChangesQueryInput, type SyncChangesResult, type Update, type ValExpression, type WebSocketAttachment, type WorkerOptions, and, applySQLiteJsonBatch, authorizeApiCall, authorizeReadQuery, authorizeWriteBatch, cloudflareRateLimiter, collectionApiHandlers, collectionScope, collectionShardOptionsFrom, compileReadExpression, createWorkerHandler, defaultCollectionApiPath, ensureSQLiteJsonTables, eq, field, gt, gte, inArray, isCollectionPattern, lt, lte, matchesReadPredicate, ne, not, or, persistSQLiteJsonBatchWithHistory, readAccessDecision, readExpressionReferences, readExpressionRow, readSQLiteJsonChanges, readSQLiteJsonRow, readSQLiteJsonRows, resolveCollection, router, sqliteJsonTable, val, validateBatch, visibleUpdateForAuth };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/sqlite-json-read.ts","../src/storage.ts","../src/history.ts","../src/durable-object-types.ts","../src/definition-builder.ts","../src/durable-object.ts","../src/worker.ts","../src/collections.ts","../src/access-expression.ts","../src/access.ts","../src/validation.ts"],"mappings":";;;;;iBAmBgB,kBAAA,CACd,GAAA,EAAK,cAAA,EACL,KAAA,EAAO,SAAA,EACP,WAAA,GAAa,iBAAA,GACZ,UAAA;AAAA,iBA4Da,iBAAA,CACd,GAAA,EAAK,cAAA,EACL,UAAA,UACA,GAAA,mBACA,WAAA,GAAa,iBAAA,GACZ,MAAA;;;KC3ES,eAAA,GAAkB,WAAW;AAAA,UAExB,oBAAA,WAA+B,MAAA,SAAe,eAAA;EAC7D,OAAA,IAAW,KAAA,CAAM,CAAA;AAAA;AAAA,UAGF,cAAA;EACf,IAAA,WAAe,MAAA,SAAe,eAAA,GAC5B,KAAA,aACG,QAAA,EAAU,KAAA,YACZ,oBAAA,CAAqB,CAAA;AAAA;AAAA,UAGT,sBAAA;EACf,SAAA;EACA,OAAA,GAAU,KAAA,CAAM,KAAA,WAAgB,qBAAA;AAAA;AAAA,iBAGlB,eAAA,CAAgB,OAAA,GAAS,sBAAA,GAA8B,uBAAuB;AAAA,iBAU9E,sBAAA,CACd,GAAA,EAAK,cAAA,EACL,WAAA,GAAa,iBAAsB;AAAA,iBAkDrB,oBAAA,CACd,GAAA,EAAK,cAAA,EACL,KAAA,EAAO,KAAA,EACP,WAAA,GAAa,iBAAA;;;UC/EE,cAAA;EACf,UAAU;AAAA;AAAA,UAGK,cAAA;EACf,OAAA,EAAS,KAAK,CAAC,eAAA;EACf,SAAA;AAAA;AAAA,iBAGc,iCAAA,CACd,GAAA,EAAK,cAAA,EACL,KAAA,EAAO,KAAA,EACP,WAAA,GAAa,iBAAA,EACb,OAAA,GAAS,cAAA,GACR,cAAA;AAAA,iBAaa,qBAAA,CACd,GAAA,EAAK,cAAA,EACL,KAAA,EAAO,gBAAA,EACP,WAAA,GAAa,iBAAA,GACZ,iBAAA;;;UC7Cc,GAAA;EACf,WAAA,EAAa,sBAAsB;AAAA;AAAA,UAGpB,sBAAA;EACf,WAAA,GAAc,iBAAA;EACd,YAAA,IAAgB,IAAA;IAAQ,QAAA;IAAkB,OAAA,EAAS,OAAA;EAAA,MAAc,UAAA,GAAa,OAAA,CAAQ,UAAA;EACtF,OAAA,GAAU,cAAA;AAAA;;;iBCWI,0BAAA,sBAAgD,qBAAA,EAC9D,WAAA,EAAa,aAAA,CAAc,YAAA,IAC1B,gCAAA,CAAiC,YAAA;AAAA,cAIvB,gCAAA,sBAAsD,qBAAA;EAAA,iBAE9C,WAAA;EAAA,iBACA,SAAA;cADA,WAAA,EAAa,YAAA,EACb,SAAA,EAAW,MAAA,SAAe,wBAAA;EAG7C,UAAA,eAAyB,cAAA,CAAe,YAAA,GACtC,IAAA,EAAM,KAAA,EACN,SAAA,GACE,UAAA,EAAY,uBAAA,CAAwB,gBAAA,CAAiB,YAAA,EAAc,KAAA,OAChE,uBAAA,CAAwB,gBAAA,CAAiB,YAAA,EAAc,KAAA,KAC3D,gCAAA,CAAiC,YAAA;EAQpC,KAAA,IAAS,sBAAA;AAAA;AAAA,cAWE,uBAAA;EAAA,iBACkB,QAAA;cAAA,QAAA,EAAU,wBAAA;EAEvC,KAAA,IAAS,MAAA,EAAQ,KAAA,WAAgB,uBAAA,CAAwB,WAAA;EAOzD,WAAA,CAAY,IAAA,EAAM,KAAA,CAAM,MAAA,qBAA2B,uBAAA,CAAwB,WAAA;EAI3E,SAAA,CAAU,IAAA,UAAc,QAAA,EAAU,uBAAA,GAA0B,uBAAA,CAAwB,WAAA;EAUpF,MAAA,CACE,IAAA,EAAM,qBAAA,EACN,OAAA,EAAS,iBAAA,QACR,uBAAA,CAAwB,WAAA;EAC3B,MAAA,CACE,IAAA,mBACA,OAAA,EAAS,gBAAA,QACR,uBAAA,CAAwB,WAAA;EAc3B,GAAA,CAAI,IAAA,UAAc,OAAA,EAAS,UAAA,aAAuB,uBAAA,CAAwB,WAAA;EAU1E,UAAA,IAAc,wBAAA;AAAA;AAAA,KAKX,qBAAA;AAAA,UAEK,wBAAA;EACR,OAAA,GAAU,KAAA,CAAM,KAAA;EAChB,WAAA,GAAc,KAAA,CAAM,MAAA;EACpB,UAAA,GAAa,MAAA,SAAe,uBAAA;EAC5B,MAAA,GAAS,MAAA,SAAe,iBAAA,QAAyB,gBAAA;EACjD,GAAA,GAAM,MAAA,SAAe,UAAA;AAAA;;;cCrFV,4BAAA,YAAwC,aAAA;EAAA,iBAMhC,KAAA;EAAA,iBACA,GAAA;EAAA,iBACA,OAAA;EAAA,OAPZ,IAAA,SAAI,0BAAA;EAAA,iBAEM,WAAA;cAGE,KAAA,EAAO,kBAAA,EACP,GAAA,EAAK,GAAA,EACL,OAAA,GAAS,sBAAA;EAKtB,KAAA,CAAM,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,QAAA;EAwBjC,gBAAA,CAAiB,EAAA,EAAI,SAAA,EAAW,OAAA,EAAS,WAAA,YAAuB,OAAA;EAAA,QAwB9D,OAAA;EAAA,UA6BE,QAAA,CAAS,KAAA,EAAO,KAAA;EAAA,UAIhB,OAAA,CAAQ,KAAA,EAAO,KAAA,GAAQ,gBAAA;EAAA,UAWvB,IAAA,CAAK,KAAA,EAAO,SAAA,EAAW,IAAA,GAAM,UAAA,GAAkB,UAAA;EAAA,UAY/C,WAAA,CAAY,KAAA,EAAO,gBAAA,EAAkB,IAAA,GAAM,UAAA,GAAkB,iBAAA;EAAA,QAoB/D,SAAA;EAAA,QAMA,WAAA;EAAA,QAMM,OAAA;EAAA,QA2BN,MAAA;EAAA,QAQA,QAAA;EAAA,QAIA,mBAAA;EAAA,QAaA,iBAAA;EAAA,QAuBA,uBAAA;EAAA,QAaA,WAAA;EAAA,QAOA,OAAA;AAAA;;;UCzRO,aAAA;EACf,OAAA,SAAgB,GAAA;EAChB,YAAA,GAAe,MAAM;AAAA;AAAA,iBAGP,mBAAA,CAAoB,OAAA,GAAS,aAAA;iBAK1B,OAAA,EAAO,GAAA,EAAO,GAAA,GAAM,OAAA,CAAQ,QAAA,IAAY,QAAA;AAAA;;;UCV1C,kBAAA;EACf,IAAA;EACA,UAAA,EAAY,gBAAA;EACZ,MAAA,EAAQ,MAAM;EACd,KAAA;AAAA;AAAA,iBAYc,iBAAA,CACd,cAAA,UACA,WAAA,GAAa,iBAAA,GACZ,kBAAkB;AAAA,iBA0CL,eAAA,CAAgB,cAAsB;AAAA,iBAKtC,mBAAA,CAAoB,cAAsB;AAAA,iBAI1C,qBAAA,CACd,WAAA,GAAa,iBAAA,GACZ,MAAA,SAAe,UAAA;AAAA,iBAsBF,wBAAA,CAAyB,cAAA,UAAwB,IAAY;;;UCpF5D,mBAAA;EACf,UAAA;EACA,KAAA;EACA,GAAA;EACA,IAAA;AAAA;;;UCAe,WAAA;EACf,IAAA,CAAK,UAAA,UAAoB,GAAA,oBAAuB,MAAM;AAAA;AAAA,UAGvC,kBAAA;EACf,KAAA;EACA,YAAA,EAAc,KAAA,CAAM,mBAAA;EACpB,SAAA,GAAY,aAAA;AAAA;AAAA,iBAGE,kBAAA,CACd,KAAA,EAAO,SAAA,EACP,WAAA,EAAa,iBAAA,cACb,IAAA,EAAM,UAAA,EACN,KAAA,EAAO,WAAA,GACN,SAAA;AAAA,iBASa,oBAAA,CACd,MAAA,EAAQ,MAAA,EACR,WAAA,EAAa,iBAAA,cACb,IAAA,EAAM,UAAA,EACN,KAAA,EAAO,WAAA,GACN,MAAA;AAAA,iBAsBa,mBAAA,CACd,KAAA,EAAO,KAAA,EACP,WAAA,EAAa,iBAAA,cACb,IAAA,EAAM,UAAA,EACN,KAAA,EAAO,WAAA;AAAA,iBAUO,gBAAA,CACd,OAAA,EAAS,gBAAA,cACT,IAAA,UACA,KAAA,WACA,IAAA,EAAM,UAAU;AAAA,iBAeF,kBAAA,CACd,UAAA,UACA,WAAA,EAAa,iBAAA,cACb,IAAA,EAAM,UAAA,EACN,KAAA,EAAO,WAAA,GACN,kBAAA;;;iBCrGa,aAAA,CAAc,KAAA,EAAO,KAAA,EAAO,WAAA,GAAc,iBAAiB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/sqlite-json-read.ts","../src/storage.ts","../src/history.ts","../src/durable-object-types.ts","../src/definition-builder.ts","../src/durable-object.ts","../src/worker.ts","../src/safeguards.ts","../src/collections.ts","../src/access-expression.ts","../src/access.ts","../src/validation.ts"],"mappings":";;;;;iBAmBgB,kBAAA,CACd,GAAA,EAAK,cAAA,EACL,KAAA,EAAO,SAAA,EACP,WAAA,GAAa,iBAAA,GACZ,UAAA;AAAA,iBA4Da,iBAAA,CACd,GAAA,EAAK,cAAA,EACL,UAAA,UACA,GAAA,mBACA,WAAA,GAAa,iBAAA,GACZ,MAAA;;;KC3ES,eAAA,GAAkB,WAAW;AAAA,UAExB,oBAAA,WAA+B,MAAA,SAAe,eAAA;EAC7D,OAAA,IAAW,KAAA,CAAM,CAAA;AAAA;AAAA,UAGF,cAAA;EACf,IAAA,WAAe,MAAA,SAAe,eAAA,GAC5B,KAAA,aACG,QAAA,EAAU,KAAA,YACZ,oBAAA,CAAqB,CAAA;AAAA;AAAA,UAGT,sBAAA;EACf,SAAA;EACA,OAAA,GAAU,KAAA,CAAM,KAAA,WAAgB,qBAAA;AAAA;AAAA,iBAGlB,eAAA,CAAgB,OAAA,GAAS,sBAAA,GAA8B,uBAAuB;AAAA,iBAU9E,sBAAA,CACd,GAAA,EAAK,cAAA,EACL,WAAA,GAAa,iBAAsB;AAAA,iBAkDrB,oBAAA,CACd,GAAA,EAAK,cAAA,EACL,KAAA,EAAO,KAAA,EACP,WAAA,GAAa,iBAAA;;;cC9EF,2BAAA;AAAA,UAEI,cAAA;EACf,UAAU;AAAA;AAAA,UAGK,cAAA;EACf,OAAA,EAAS,KAAK,CAAC,eAAA;EACf,SAAA;AAAA;AAAA,iBAGc,iCAAA,CACd,GAAA,EAAK,cAAA,EACL,KAAA,EAAO,KAAA,EACP,WAAA,GAAa,iBAAA,EACb,OAAA,GAAS,cAAA,GACR,cAAA;AAAA,iBAkBa,qBAAA,CACd,GAAA,EAAK,cAAA,EACL,KAAA,EAAO,gBAAA,EACP,WAAA,GAAa,iBAAA,GACZ,iBAAA;;;UCrDc,gBAAA;EACf,IAAA,EAAM,UAAA;EACN,QAAA;EACA,GAAA,EAAK,GAAG;AAAA;AAAA,KAGE,gBAAA,IAAoB,OAAA,EAAS,gBAAA,eAA+B,OAAO;AAAA,UAE9D,qBAAA;EACf,4BAA4B;AAAA;AAAA,UAGb,GAAA;EACf,WAAA,EAAa,sBAAsB;AAAA;AAAA,UAGpB,sBAAA;EACf,WAAA,GAAc,iBAAA;EACd,YAAA,IAAgB,IAAA;IAAQ,QAAA;IAAkB,OAAA,EAAS,OAAA;EAAA,MAAc,UAAA,GAAa,OAAA,CAAQ,UAAA;EACtF,OAAA,GAAU,cAAA;EACV,MAAA,GAAS,qBAAA;EACT,SAAA,GAAY,gBAAA;AAAA;;;iBCCE,0BAAA,sBAAgD,qBAAA,EAC9D,WAAA,EAAa,aAAA,CAAc,YAAA,IAC1B,gCAAA,CAAiC,YAAA;AAAA,cAIvB,gCAAA,sBAAsD,qBAAA;EAAA,iBAE9C,WAAA;EAAA,iBACA,SAAA;EAAA,iBACA,OAAA;cAFA,WAAA,EAAa,YAAA,EACb,SAAA,EAAW,MAAA,SAAe,wBAAA,GAC1B,OAAA,EAAS,IAAA,CAAK,sBAAA;EAGjC,MAAA,CAAO,MAAA,EAAQ,qBAAA,GAAwB,gCAAA,CAAiC,YAAA;EAOxE,SAAA,CAAU,SAAA,EAAW,gBAAA,GAAmB,gCAAA,CAAiC,YAAA;EAOzE,UAAA,eAAyB,cAAA,CAAe,YAAA,GACtC,IAAA,EAAM,KAAA,EACN,SAAA,GACE,UAAA,EAAY,uBAAA,CAAwB,gBAAA,CAAiB,YAAA,EAAc,KAAA,OAChE,uBAAA,CAAwB,gBAAA,CAAiB,YAAA,EAAc,KAAA,KAC3D,gCAAA,CAAiC,YAAA;EAYpC,KAAA,IAAS,sBAAA;AAAA;AAAA,cAWE,uBAAA;EAAA,iBACkB,QAAA;cAAA,QAAA,EAAU,wBAAA;EAEvC,KAAA,IAAS,MAAA,EAAQ,KAAA,WAAgB,uBAAA,CAAwB,WAAA;EAOzD,WAAA,CAAY,IAAA,EAAM,KAAA,CAAM,MAAA,qBAA2B,uBAAA,CAAwB,WAAA;EAI3E,SAAA,CAAU,IAAA,UAAc,QAAA,EAAU,uBAAA,GAA0B,uBAAA,CAAwB,WAAA;EAUpF,MAAA,CACE,IAAA,EAAM,qBAAA,EACN,OAAA,EAAS,iBAAA,QACR,uBAAA,CAAwB,WAAA;EAC3B,MAAA,CACE,IAAA,mBACA,OAAA,EAAS,gBAAA,QACR,uBAAA,CAAwB,WAAA;EAc3B,GAAA,CAAI,IAAA,UAAc,OAAA,EAAS,UAAA,aAAuB,uBAAA,CAAwB,WAAA;EAU1E,UAAA,IAAc,wBAAA;AAAA;AAAA,KAKX,qBAAA;AAAA,UAEK,wBAAA;EACR,OAAA,GAAU,KAAA,CAAM,KAAA;EAChB,WAAA,GAAc,KAAA,CAAM,MAAA;EACpB,UAAA,GAAa,MAAA,SAAe,uBAAA;EAC5B,MAAA,GAAS,MAAA,SAAe,iBAAA,QAAyB,gBAAA;EACjD,GAAA,GAAM,MAAA,SAAe,UAAA;AAAA;;;cC1GV,4BAAA,YAAwC,aAAA;EAAA,iBAMhC,KAAA;EAAA,iBACA,GAAA;EAAA,iBACA,OAAA;EAAA,OAPZ,IAAA,SAAI,0BAAA;EAAA,iBAEM,WAAA;cAGE,KAAA,EAAO,kBAAA,EACP,GAAA,EAAK,GAAA,EACL,OAAA,GAAS,sBAAA;EAKtB,KAAA,CAAM,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,QAAA;EAwBjC,gBAAA,CAAiB,EAAA,EAAI,SAAA,EAAW,OAAA,EAAS,WAAA,YAAuB,OAAA;EAAA,QAkC9D,OAAA;EAAA,UAkCE,QAAA,CAAS,KAAA,EAAO,KAAA;EAAA,UAIhB,OAAA,CAAQ,KAAA,EAAO,KAAA,GAAQ,gBAAA;EAAA,UAWvB,IAAA,CAAK,KAAA,EAAO,SAAA,EAAW,IAAA,GAAM,UAAA,GAAkB,UAAA;EAAA,UAY/C,WAAA,CAAY,KAAA,EAAO,gBAAA,EAAkB,IAAA,GAAM,UAAA,GAAkB,iBAAA;EAAA,QAoB/D,SAAA;EAAA,QAWA,WAAA;EAAA,QAMM,OAAA;EAAA,QA2BN,MAAA;EAAA,QASA,QAAA;EAAA,QAIA,mBAAA;EAAA,QAaA,iBAAA;EAAA,QAuBA,WAAA;EAAA,QAOA,OAAA;AAAA;;;UCnSO,aAAA;EACf,OAAA,SAAgB,GAAA;EAChB,YAAA,GAAe,MAAM;AAAA;AAAA,iBAGP,mBAAA,CAAoB,OAAA,GAAS,aAAA;iBAK1B,OAAA,EAAO,GAAA,EAAO,GAAA,GAAM,OAAA,CAAQ,QAAA,IAAY,QAAA;AAAA;;;cCJ9C,uCAAA;AAAA,UAqCI,4BAAA;EACf,OAAA;EACA,GAAA,IAAO,OAAA,EAAS,gBAAgB;AAAA;AAAA,iBAOlB,qBAAA,CACd,OAAA,GAAS,4BAAA,GACR,gBAAgB;;;UCtDF,kBAAA;EACf,IAAA;EACA,UAAA,EAAY,gBAAA;EACZ,MAAA,EAAQ,MAAM;EACd,KAAA;AAAA;AAAA,iBAYc,iBAAA,CACd,cAAA,UACA,WAAA,GAAa,iBAAA,GACZ,kBAAkB;AAAA,iBA0CL,eAAA,CAAgB,cAAsB;AAAA,iBAKtC,mBAAA,CAAoB,cAAsB;AAAA,iBAI1C,qBAAA,CACd,WAAA,GAAa,iBAAA,GACZ,MAAA,SAAe,UAAA;AAAA,iBAsBF,wBAAA,CAAyB,cAAA,UAAwB,IAAY;;;UCpF5D,mBAAA;EACf,UAAA;EACA,KAAA;EACA,GAAA;EACA,IAAA;AAAA;;;UCAe,WAAA;EACf,IAAA,CAAK,UAAA,UAAoB,GAAA,oBAAuB,MAAM;AAAA;AAAA,UAGvC,kBAAA;EACf,KAAA;EACA,YAAA,EAAc,KAAA,CAAM,mBAAA;EACpB,SAAA,GAAY,aAAA;AAAA;AAAA,iBAGE,kBAAA,CACd,KAAA,EAAO,SAAA,EACP,WAAA,EAAa,iBAAA,cACb,IAAA,EAAM,UAAA,EACN,KAAA,EAAO,WAAA,GACN,SAAA;AAAA,iBASa,oBAAA,CACd,MAAA,EAAQ,MAAA,EACR,WAAA,EAAa,iBAAA,cACb,IAAA,EAAM,UAAA,EACN,KAAA,EAAO,WAAA,GACN,MAAA;AAAA,iBAsBa,mBAAA,CACd,KAAA,EAAO,KAAA,EACP,WAAA,EAAa,iBAAA,cACb,IAAA,EAAM,UAAA,EACN,KAAA,EAAO,WAAA;AAAA,iBAUO,gBAAA,CACd,OAAA,EAAS,gBAAA,cACT,IAAA,UACA,KAAA,WACA,IAAA,EAAM,UAAU;AAAA,iBAeF,kBAAA,CACd,UAAA,UACA,WAAA,EAAa,iBAAA,cACb,IAAA,EAAM,UAAA,EACN,KAAA,EAAO,WAAA,GACN,kBAAA;;;iBCrGa,aAAA,CAAc,KAAA,EAAO,KAAA,EAAO,WAAA,GAAc,iBAAiB"}

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { n as webSocketAttachmentSchema, t as router } from "./router-C4eYfMV7.mjs";
-import { and, compileReadExpression, compileReadExpression as compileReadExpression$1, eq, field, gt, gte, inArray, lt, lte, matchesReadPredicate, matchesReadPredicate as matchesReadPredicate$1, ne, not, or, parseClientRpcRequest, readExpressionReferences, readExpressionReferences as readExpressionReferences$1, readExpressionRow, readExpressionRow as readExpressionRow$1, readRpcId, sendServerMessage, val } from "@lsync/transport";
+import { n as webSocketAttachmentSchema, t as router } from "./router-CZnnFmXh.mjs";
+import { ProtocolError, and, compileReadExpression, compileReadExpression as compileReadExpression$1, eq, field, gt, gte, inArray, lt, lte, matchesReadPredicate, matchesReadPredicate as matchesReadPredicate$1, ne, not, or, parseClientMessage, protocolErrorCodeSchema, readExpressionReferences, readExpressionReferences as readExpressionReferences$1, readExpressionRow, readExpressionRow as readExpressionRow$1, readMessageId, sendServerMessage, val } from "@lsync/transport";
 import sqlTag, { join, raw } from "sql-template-tag";
 import { z } from "zod";
 //#region src/access-expression.ts
@@ -242,7 +242,7 @@ function authorizeWriteBatch(batch, collections, auth, store) {
 }
 function authorizeApiCall(handler, name, input, auth) {
 	if (!handler) return;
-	const row = asRecord(input) ?? {};
+	const row = asRecord$1(input) ?? {};
 	const decision = reduceAccessExpression(handler({
 		auth,
 		input: readExpressionRow$1()
@@ -345,16 +345,16 @@ function writeAccessHandler(access, type) {
 	return access[type] ?? access.write ?? access.read;
 }
 function writeAccessRow(update, store) {
-	if (update.type === "insert") return asRecord(update.value);
-	const existing = asRecord(update.previousValue) ?? store.read(update.collection, update.key);
+	if (update.type === "insert") return asRecord$1(update.value);
+	const existing = asRecord$1(update.previousValue) ?? store.read(update.collection, update.key);
 	if (update.type === "delete") return existing;
-	const next = asRecord(update.value);
+	const next = asRecord$1(update.value);
 	return existing && next ? {
 		...existing,
 		...next
 	} : next ?? existing;
 }
-function asRecord(value) {
+function asRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 //#endregion
@@ -438,7 +438,7 @@ function selectRows(sql, table, options) {
 	const where = [sqlTag`path = ${options.scope}`];
 	where.push(...options.filters.map((filter) => filterSql(filter)));
 	if (options.predicate) where.push(predicateSql(options.predicate));
-	const order = options.orderBy.length > 0 ? join(options.orderBy.map((item) => orderBySql(item))) : sqlTag`key`;
+	const order = options.orderBy.length > 0 ? sqlTag`${join(options.orderBy.map((item) => orderBySql(item)))}, key` : sqlTag`key`;
 	return execSql(sql, sqlTag`
         SELECT key, value FROM ${identifierSql(table)}
         WHERE ${join(where, " AND ")}
@@ -739,26 +739,43 @@ function singularize(value) {
 //#endregion
 //#region src/definition-builder.ts
 function collectionShardOptionsFrom(definitions) {
-	return new CollectionShardDefinitionBuilder(definitions.collections, {});
+	return new CollectionShardDefinitionBuilder(definitions.collections, {}, {});
 }
 var CollectionShardDefinitionBuilder = class CollectionShardDefinitionBuilder {
 	definitions;
 	overrides;
-	constructor(definitions, overrides) {
+	options;
+	constructor(definitions, overrides, options) {
 		this.definitions = definitions;
 		this.overrides = overrides;
+		this.options = options;
+	}
+	limits(limits) {
+		return new CollectionShardDefinitionBuilder(this.definitions, this.overrides, {
+			...this.options,
+			limits
+		});
+	}
+	rateLimit(rateLimit) {
+		return new CollectionShardDefinitionBuilder(this.definitions, this.overrides, {
+			...this.options,
+			rateLimit
+		});
 	}
 	collection(path, configure) {
 		const override = configure(new ServerCollectionBuilder({})).toOverride();
 		return new CollectionShardDefinitionBuilder(this.definitions, {
 			...this.overrides,
 			[path]: override
-		});
+		}, this.options);
 	}
 	build() {
 		const collections = {};
 		for (const [name, definition] of Object.entries(this.definitions)) addDefinition(collections, definition, name, this.overrides);
-		return { collections };
+		return {
+			...this.options,
+			collections
+		};
 	}
 };
 var ServerCollectionBuilder = class ServerCollectionBuilder {
@@ -844,22 +861,25 @@ function accessConfig(override) {
 }
 //#endregion
 //#region src/durable-object-rpc.ts
-function callRouter(caller, request) {
-	if (request.method === "query" && request.params.path === "read") return caller.read(request.params.input.json);
-	if (request.method === "query" && request.params.path === "changes") return caller.changes(request.params.input.json);
-	if (request.method === "subscribe") return caller.subscribe(request.params.input.json);
-	if (request.method === "unsubscribe") return caller.unsubscribe(request.params.input.json);
-	if (request.method !== "mutation") throw new Error("Unsupported operation");
-	if (request.params.path === "push") return caller.push(request.params.input.json);
-	if (request.params.path === "api") return caller.api(request.params.input.json);
-	throw new Error("Unsupported operation");
+async function callRouter(caller, request) {
+	switch (request.type) {
+		case "read": return caller.read(request.input);
+		case "push": return caller.push(request.input);
+		case "changes": return caller.changes(request.input);
+		case "api": return caller.api(request.input);
+		case "subscribe": return caller.subscribe(request.input);
+		case "unsubscribe": return caller.unsubscribe(request.input);
+	}
+}
+function isResyncRequired(result) {
+	return typeof result === "object" && result !== null && result.type === "resyncRequired";
 }
 //#endregion
 //#region src/history-watermarks.ts
 const COLLECTION_WATERMARKS_TABLE = "_lsync_collection_watermarks";
 function ensureCollectionWatermarkTable(sql) {
 	sql.exec(`
-    CREATE TABLE IF NOT EXISTS ${quoteIdentifier$1(COLLECTION_WATERMARKS_TABLE)} (
+    CREATE TABLE IF NOT EXISTS ${quoteIdentifier$2(COLLECTION_WATERMARKS_TABLE)} (
       scope TEXT PRIMARY KEY,
       collection TEXT NOT NULL,
       latest_sequence INTEGER NOT NULL
@@ -868,7 +888,7 @@ function ensureCollectionWatermarkTable(sql) {
 }
 function recordCollectionWatermark(sql, collection, scope, sequence) {
 	sql.exec(`
-      INSERT INTO ${quoteIdentifier$1(COLLECTION_WATERMARKS_TABLE)}
+      INSERT INTO ${quoteIdentifier$2(COLLECTION_WATERMARKS_TABLE)}
         (scope, collection, latest_sequence)
       VALUES (?, ?, ?)
       ON CONFLICT(scope) DO UPDATE SET
@@ -878,21 +898,66 @@ function recordCollectionWatermark(sql, collection, scope, sequence) {
 }
 function readCollectionWatermark(sql, scope) {
 	return sql.exec(`
-        SELECT latest_sequence FROM ${quoteIdentifier$1(COLLECTION_WATERMARKS_TABLE)}
+        SELECT latest_sequence FROM ${quoteIdentifier$2(COLLECTION_WATERMARKS_TABLE)}
         WHERE scope = ?
       `, scope).toArray()[0]?.latest_sequence ?? 0;
 }
+function quoteIdentifier$2(identifier) {
+	return `"${identifier.replaceAll(`"`, `""`)}"`;
+}
+//#endregion
+//#region src/mutation-dedup.ts
+const APPLIED_UPDATES_TABLE = "_lsync_applied_updates";
+function deduplicateMutations(sql, batch) {
+	ensureAppliedUpdatesTable(sql);
+	const seen = /* @__PURE__ */ new Map();
+	return { updates: batch.updates.filter((update) => {
+		const payload = JSON.stringify(update);
+		const priorPayload = seen.get(update.id) ?? readAppliedPayload(sql, update.id);
+		if (priorPayload === void 0) {
+			seen.set(update.id, payload);
+			return true;
+		}
+		if (priorPayload !== payload) throw new Error(`Mutation id reused with a different payload: ${update.id}`);
+		return false;
+	}) };
+}
+function recordAppliedMutations(sql, updates) {
+	for (const update of updates) {
+		const { sequence, serverCreatedAt, ...original } = update;
+		sql.exec(`INSERT INTO ${quoteIdentifier$1(APPLIED_UPDATES_TABLE)} (update_id, payload, sequence) VALUES (?, ?, ?)`, update.id, JSON.stringify(original), sequence);
+	}
+}
+function ensureAppliedUpdatesTable(sql) {
+	sql.exec(`
+    CREATE TABLE IF NOT EXISTS ${quoteIdentifier$1(APPLIED_UPDATES_TABLE)} (
+      update_id TEXT PRIMARY KEY,
+      payload TEXT NOT NULL,
+      sequence INTEGER NOT NULL
+    )
+  `);
+}
+function readAppliedPayload(sql, updateId) {
+	return sql.exec(`SELECT payload FROM ${quoteIdentifier$1(APPLIED_UPDATES_TABLE)} WHERE update_id = ?`, updateId).toArray()[0]?.payload;
+}
 function quoteIdentifier$1(identifier) {
 	return `"${identifier.replaceAll(`"`, `""`)}"`;
 }
 //#endregion
 //#region src/history.ts
 const CHANGES_TABLE = "_lsync_changes";
+const SQLITE_JSON_CONFLICT_POLICY = "server-sequence-last-write-wins";
 function persistSQLiteJsonBatchWithHistory(sql, batch, collections = {}, options = {}) {
 	ensureSQLiteJsonTables(sql, collections);
 	ensureChangesTable(sql);
-	applySQLiteJsonBatch(sql, batch, collections);
-	const updates = batch.updates.map((update) => appendChange(sql, update, collections));
+	const pending = deduplicateMutations(sql, batch);
+	if (pending.updates.length === 0) return {
+		updates: [],
+		watermark: readWatermark(sql)
+	};
+	applySQLiteJsonBatch(sql, pending, collections);
+	const updates = pending.updates.map((update) => appendChange(sql, update, collections));
+	recordAppliedMutations(sql, updates);
 	const watermark = updates.at(-1)?.sequence ?? readWatermark(sql);
 	pruneChanges(sql, watermark, options.maxChanges ?? 1e4);
 	return {
@@ -922,11 +987,19 @@ function readSQLiteJsonChanges(sql, query, collections = {}) {
 	};
 	const limit = query.limit ?? 1e3;
 	const rows = selectChanges(sql, requested, limit + 1);
+	const page = rows.slice(0, limit);
+	const cursors = Object.fromEntries(requested.map((item) => [item.collection, item.sequence]));
+	for (const row of page) {
+		const item = requested.find((candidate) => candidate.scope === row.scope);
+		if (item) cursors[item.collection] = row.sequence;
+	}
+	if (rows.length <= limit) for (const item of requested) cursors[item.collection] = watermark;
 	return {
 		type: "changes",
-		updates: rows.slice(0, limit).map(rowToUpdate),
+		updates: page.map(rowToUpdate),
 		watermark,
-		hasMore: rows.length > limit
+		hasMore: rows.length > limit,
+		cursors
 	};
 }
 function ensureChangesTable(sql) {
@@ -973,7 +1046,7 @@ function selectChanges(sql, requested, limit) {
 	const bindings = requested.flatMap((item) => [item.scope, item.sequence]);
 	bindings.push(limit);
 	return sql.exec(`
-        SELECT sequence, update_id, collection, "key", type, value, previous_value, client_id,
+        SELECT sequence, update_id, collection, scope, "key", type, value, previous_value, client_id,
                client_created_at, server_created_at
         FROM ${quoteIdentifier(CHANGES_TABLE)}
         WHERE ${requested.map(() => "(scope = ? AND sequence > ?)").join(" OR ")}
@@ -1021,21 +1094,69 @@ function quoteIdentifier(identifier) {
 }
 //#endregion
 //#region src/messages.ts
-function sendRpcResult(ws, id, result) {
+function sendResult(ws, id, payload) {
 	sendServerMessage(ws, {
+		version: 1,
 		id,
-		result: {
-			type: "data",
-			data: { json: result }
-		}
+		type: "result",
+		payload
 	});
 }
-function sendRpcError(ws, id, error) {
+function sendProtocolError(ws, id, error) {
 	sendServerMessage(ws, {
+		version: 1,
 		id,
-		error: { message: error instanceof Error ? error.message : "Unknown error" }
+		type: "error",
+		error: protocolErrorFrom(error)
 	});
 }
+function protocolErrorFrom(error) {
+	if (error instanceof ProtocolError) return {
+		code: error.code,
+		message: error.message,
+		...error.details !== void 0 ? { details: error.details } : {}
+	};
+	if (error instanceof z.ZodError) return {
+		code: "VALIDATION_FAILED",
+		message: "The request failed validation",
+		details: error.issues
+	};
+	const message = error instanceof Error ? error.message : "Unknown protocol error";
+	if (message.toLowerCase().includes("access denied")) return {
+		code: "AUTH_DENIED",
+		message
+	};
+	if (message.toLowerCase().includes("unknown collection")) return {
+		code: "VALIDATION_FAILED",
+		message
+	};
+	if (message.toLowerCase().includes("maximum subscriptions")) return {
+		code: "CONFLICT",
+		message
+	};
+	if (message.toLowerCase().includes("rate limit")) return {
+		code: "RATE_LIMITED",
+		message
+	};
+	if (message.toLowerCase().includes("unknown api path")) return {
+		code: "NOT_FOUND",
+		message
+	};
+	const candidate = asRecord(error);
+	const code = protocolErrorCodeSchema.safeParse(candidate?.code);
+	if (code.success) return {
+		code: code.data,
+		message,
+		...candidate?.details !== void 0 ? { details: candidate.details } : {}
+	};
+	return {
+		code: "INTERNAL_ERROR",
+		message
+	};
+}
+function asRecord(value) {
+	return typeof value === "object" && value !== null ? value : void 0;
+}
 //#endregion
 //#region src/socket-attachment.ts
 function webSocketAttachment(ws) {
@@ -1067,6 +1188,38 @@ function updateSocketSubscriptions(ws, collection, normalize, update) {
 	};
 }
 //#endregion
+//#region src/safeguards.ts
+const DEFAULT_MAX_SUBSCRIPTIONS_PER_WEBSOCKET = 100;
+function assertSubscriptionAllowed(ws, collection, limits) {
+	const attachment = webSocketAttachment(ws);
+	if (!attachment) throw new Error("Missing WebSocket attachment");
+	const maximum = limits?.maxSubscriptionsPerWebSocket ?? 100;
+	if (maximum === false || attachment.subscriptions.includes(collection)) return;
+	assertPositiveInteger(maximum, "maxSubscriptionsPerWebSocket");
+	if (attachment.subscriptions.length >= maximum) throw new Error(`Maximum subscriptions per WebSocket exceeded (${maximum})`);
+}
+async function enforceRateLimit(ws, env, rateLimit) {
+	if (!rateLimit) return;
+	const attachment = webSocketAttachment(ws);
+	if (!await rateLimit({
+		auth: webSocketAuth(ws),
+		clientId: attachment?.clientId ?? "unknown",
+		env
+	})) throw new Error("Rate limit exceeded");
+}
+function cloudflareRateLimiter(options = {}) {
+	const bindingName = options.binding ?? "RATE_LIMITER";
+	return async (context) => {
+		const binding = context.env[bindingName];
+		if (!binding?.limit) throw new Error(`Missing Cloudflare rate limit binding: ${bindingName}`);
+		const key = options.key?.(context) ?? context.clientId;
+		return (await binding.limit({ key })).success;
+	};
+}
+function assertPositiveInteger(value, name) {
+	if (!Number.isInteger(value) || value <= 0) throw new Error(`${name} must be a positive integer or false`);
+}
+//#endregion
 //#region src/access-invalidation.ts
 function invalidatesDependency(update, dependencies) {
 	return dependencies.some((dependency) => {
@@ -1155,7 +1308,8 @@ var CollectionShardDurableObject = class {
 	}
 	async webSocketMessage(ws, message) {
 		try {
-			const request = parseClientRpcRequest(message);
+			await enforceRateLimit(ws, this.env, this.options.rateLimit);
+			const request = parseClientMessage(message);
 			const result = await callRouter(router.createCaller({
 				shardId: this.shardId(),
 				validate: (input) => this.validate(input),
@@ -1168,9 +1322,17 @@ var CollectionShardDurableObject = class {
 				changes: (input) => this.readChanges(input, webSocketAuth(ws)),
 				callApi: (input) => this.callApi(ws, input)
 			}), request);
-			sendRpcResult(ws, request.id, result);
+			if (request.type === "changes" && isResyncRequired(result)) {
+				sendProtocolError(ws, request.id, {
+					code: "RESYNC_REQUIRED",
+					message: "The requested change history is no longer available",
+					details: result
+				});
+				return;
+			}
+			sendResult(ws, request.id, result);
 		} catch (error) {
-			sendRpcError(ws, readRpcId(message), error);
+			sendProtocolError(ws, readMessageId(message), error);
 		}
 	}
 	publish(batch) {
@@ -1182,17 +1344,16 @@ var CollectionShardDurableObject = class {
 		};
 		for (const socket of this.state.getWebSockets()) {
 			const updates = this.subscribedUpdates(socket, batch);
-			const invalidations = this.subscribedInvalidations(socket, batch);
+			const attachment = webSocketAttachment(socket);
+			const invalidations = attachment ? subscribedInvalidations(attachment.subscriptions, batch, this.options.collections, webSocketAuth(socket), this.accessStore()) : [];
 			if (updates.length === 0 && invalidations.length === 0) continue;
 			sendServerMessage(socket, {
-				method: "subscription",
-				params: {
-					path: "updates",
-					input: { json: {
-						...payload,
-						...invalidations.length > 0 ? { invalidations } : {},
-						updates
-					} }
+				version: 1,
+				type: "updates",
+				payload: {
+					...payload,
+					...invalidations.length > 0 ? { invalidations } : {},
+					updates
 				}
 			});
 		}
@@ -1223,6 +1384,7 @@ var CollectionShardDurableObject = class {
 		};
 	}
 	subscribe(ws, input) {
+		assertSubscriptionAllowed(ws, normalizeCollection(input.collection, this.options.collections), this.options.limits);
 		return this.updateSubscriptions(ws, input.collection, (subscriptions, collection) => {
 			subscriptions.add(collection);
 		});
@@ -1254,8 +1416,9 @@ var CollectionShardDurableObject = class {
 		return handler(args);
 	}
 	mutate(batch, auth = {}) {
-		this.validate(batch);
-		authorizeWriteBatch(batch, this.options.collections, auth, this.accessStore());
+		const pending = deduplicateMutations(this.state.storage.sql, batch);
+		this.validate(pending);
+		authorizeWriteBatch(pending, this.options.collections, auth, this.accessStore());
 		const persisted = this.persist(batch);
 		this.publish(persisted);
 		return {
@@ -1284,11 +1447,6 @@ var CollectionShardDurableObject = class {
 			}] : [];
 		});
 	}
-	subscribedInvalidations(ws, batch) {
-		const attachment = webSocketAttachment(ws);
-		if (!attachment || attachment.subscriptions.length === 0) return [];
-		return subscribedInvalidations(attachment.subscriptions, batch, this.options.collections, webSocketAuth(ws), this.accessStore());
-	}
 	accessStore() {
 		return { read: (collection, key) => readSQLiteJsonRow(this.state.storage.sql, collection, key, this.options.collections) };
 	}
@@ -1311,6 +1469,6 @@ function createWorkerHandler(options = {}) {
 	} };
 }
 //#endregion
-export { CollectionShardDurableObject, and, applySQLiteJsonBatch, authorizeApiCall, authorizeReadQuery, authorizeWriteBatch, collectionApiHandlers, collectionScope, collectionShardOptionsFrom, compileReadExpression, createWorkerHandler, defaultCollectionApiPath, ensureSQLiteJsonTables, eq, field, gt, gte, inArray, isCollectionPattern, lt, lte, matchesReadPredicate, ne, not, or, persistSQLiteJsonBatchWithHistory, readAccessDecision, readExpressionReferences, readExpressionRow, readSQLiteJsonChanges, readSQLiteJsonRow, readSQLiteJsonRows, resolveCollection, router, sqliteJsonTable, val, validateBatch, visibleUpdateForAuth };
+export { CollectionShardDurableObject, DEFAULT_MAX_SUBSCRIPTIONS_PER_WEBSOCKET, SQLITE_JSON_CONFLICT_POLICY, and, applySQLiteJsonBatch, authorizeApiCall, authorizeReadQuery, authorizeWriteBatch, cloudflareRateLimiter, collectionApiHandlers, collectionScope, collectionShardOptionsFrom, compileReadExpression, createWorkerHandler, defaultCollectionApiPath, ensureSQLiteJsonTables, eq, field, gt, gte, inArray, isCollectionPattern, lt, lte, matchesReadPredicate, ne, not, or, persistSQLiteJsonBatchWithHistory, readAccessDecision, readExpressionReferences, readExpressionRow, readSQLiteJsonChanges, readSQLiteJsonRow, readSQLiteJsonRows, resolveCollection, router, sqliteJsonTable, val, validateBatch, visibleUpdateForAuth };
 
 //# sourceMappingURL=index.mjs.map