@super-line/server 0.10.2 → 0.11.0

package/README.md

@@ -76,7 +76,7 @@ replica.delete('title')           // surgical key delete (the only way to remove
 replica.close()
 ```
 
-`open` requires a store with reactive support (throws `UNSUPPORTED` otherwise). CRDT stores (`store-sync`, `store-sync-libsql`, `store-sync-pglite`) and the LWW stores both back it.
+`open` requires a store with reactive support (throws `UNSUPPORTED` otherwise). CRDT stores (`store-sync`, `store-sync-pglite`) and the LWW stores both back it.
 
 ### Control Center inspector
 

package/dist/index.cjs

@@ -205,27 +205,18 @@ var CONN = "c:";
 var USER = "u:";
 var REPLY = "reply:";
 var PLUGIN = "x:";
-var STORE = "s:";
+var CDOC = "d:";
 var SERVER_ORIGIN = "server";
 function createSuperLineServer(contract, opts) {
   const c = contract;
   const serializer = opts.serializer ?? import_core.jsonSerializer;
   const adapter = opts.adapter ?? createInMemoryAdapter();
-  const storeMap = opts.stores ?? {};
   const plugins = opts.plugins ?? [];
   const pluginNames = /* @__PURE__ */ new Set();
   for (const p of plugins) {
     if (pluginNames.has(p.name)) throw new Error(`Duplicate plugin name: ${p.name}`);
     pluginNames.add(p.name);
   }
-  for (const p of plugins) {
-    if (!p.stores) continue;
-    for (const [name, store] of Object.entries(p.stores)) {
-      if (name in storeMap)
-        throw new Error(`Plugin '${p.name}' store '${name}' collides with an existing store of that name`);
-      storeMap[name] = store;
-    }
-  }
   const collectionStore = opts.collections;
   const collectionDefs = c.collections ?? {};
   const collectionPolicies = { ...opts.policies };
@@ -243,6 +234,11 @@ function createSuperLineServer(contract, opts) {
   }
   const checkReferences = opts.checkReferences ?? false;
   const collIsRelay = collectionStore?.clustering === "relay";
+  const crdtStore = opts.crdtCollections;
+  const crdtDefOf = (n) => {
+    const d = collectionDefs[n];
+    return d && (0, import_core.isCrdtCollection)(d) ? d : void 0;
+  };
   const COLL_CHANNEL = "cbatch";
   const collSubscribers = /* @__PURE__ */ new Map();
   const connColl = /* @__PURE__ */ new Map();
@@ -339,8 +335,8 @@ function createSuperLineServer(contract, opts) {
       handlePersonal(channel, payload);
       return;
     }
-    if (channel.startsWith(STORE)) {
-      handleStoreRelay(channel, payload);
+    if (channel.startsWith(CDOC)) {
+      handleCrdtRelay(channel, payload);
       return;
     }
     if (channel === COLL_CHANNEL) {
@@ -626,13 +622,12 @@ function createSuperLineServer(contract, opts) {
     else if (frame.t === "unsub") {
       const ns = topicNamespace(conn.role, frame.c);
       if (ns) leaveChannel(conn, TOPIC + ns + ":" + frame.c);
-    } else if (frame.t === "sopen") await handleStoreOpen(conn, frame);
-    else if (frame.t === "srd") await handleStoreRead(conn, frame);
-    else if (frame.t === "swr") await handleStoreWrite(conn, frame);
-    else if (frame.t === "sclose") handleStoreClose(conn, frame);
-    else if (frame.t === "csub") await handleCollectionSub(conn, frame);
+    } else if (frame.t === "csub") await handleCollectionSub(conn, frame);
     else if (frame.t === "cuns") handleCollectionUnsub(conn, frame);
     else if (frame.t === "cbat") await handleCollectionBatch(conn, frame);
+    else if (frame.t === "cdopen") await handleCrdtOpen(conn, frame);
+    else if (frame.t === "cdwr") await handleCrdtWrite(conn, frame);
+    else if (frame.t === "cdclose") handleCrdtClose(conn, frame);
     else if (frame.t === "sres") {
       await handleClientReply(conn, frame.i, { ok: true, d: frame.d });
     } else if (frame.t === "serr") {
@@ -725,90 +720,77 @@ function createSuperLineServer(contract, opts) {
       conn.send({ t: "res", i: frame.i, d: null });
     });
   }
-  function storeOrErr(conn, id, name) {
-    const store = storeMap[name];
-    if (!store) conn.send({ t: "err", i: id, code: "NOT_FOUND", m: `Unknown store: ${name}` });
-    return store;
-  }
-  async function handleStoreOpen(conn, frame) {
-    const store = storeOrErr(conn, frame.i, frame.n);
-    if (!store) return;
-    await dispatchOp(conn, frame.i, { kind: "subscribe", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
-      const resource = await store.read(frame.id);
-      if (!resource) throw new import_core.SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+  function crdtMissing(conn, i, n) {
+    if (crdtStore && crdtDefOf(n)) return false;
+    conn.send({ t: "err", i, code: "NOT_FOUND", m: `Unknown CRDT collection: ${n}` });
+    return true;
+  }
+  async function handleCrdtOpen(conn, frame) {
+    if (crdtMissing(conn, frame.i, frame.n)) return;
+    const store = crdtStore;
+    await dispatchOp(conn, frame.i, { kind: "subscribe", name: `collection:${frame.n}/${frame.id}`, conn }, async () => {
+      const state = await store.read(frame.n, frame.id);
+      if (state === void 0) throw new import_core.SuperLineError("NOT_FOUND", `No document: ${frame.n}/${frame.id}`);
       const principal = conn.principal ?? conn.id;
-      if (!resource.accessRules[principal]?.read)
-        throw new import_core.SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
-      await joinChannel(conn, STORE + frame.n + ":" + frame.id);
-      if (taps.length) emitTap({ type: "store.subscribe", connId: conn.id, store: frame.n, id: frame.id });
-      conn.send({ t: "res", i: frame.i, d: resource.data });
-    });
-  }
-  async function handleStoreRead(conn, frame) {
-    const store = storeOrErr(conn, frame.i, frame.n);
-    if (!store) return;
-    await dispatchOp(conn, frame.i, { kind: "request", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
-      const resource = await store.read(frame.id);
-      if (!resource) throw new import_core.SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
-      const principal = conn.principal ?? conn.id;
-      if (!resource.accessRules[principal]?.read)
+      const policy = collectionPolicies[frame.n];
+      if (!policy?.read) throw new import_core.SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
+      const replica = store.open(frame.n, frame.id);
+      const snapshot = replica.getSnapshot();
+      replica.close();
+      if (!await policy.read(principal, frame.id, snapshot, conn.ctx))
         throw new import_core.SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
-      conn.send({ t: "res", i: frame.i, d: resource.data });
+      await joinChannel(conn, CDOC + frame.n + ":" + frame.id);
+      conn.send({ t: "res", i: frame.i, d: state });
     });
   }
-  async function handleStoreWrite(conn, frame) {
-    const store = storeOrErr(conn, frame.i, frame.n);
-    if (!store) return;
-    await dispatchOp(conn, frame.i, { kind: "request", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
-      const resource = await store.read(frame.id);
-      if (!resource) throw new import_core.SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+  async function handleCrdtWrite(conn, frame) {
+    if (crdtMissing(conn, frame.i, frame.n)) return;
+    const store = crdtStore;
+    const def = crdtDefOf(frame.n);
+    await dispatchOp(conn, frame.i, { kind: "request", name: `collection:${frame.n}/${frame.id}`, conn }, async () => {
       const principal = conn.principal ?? conn.id;
-      if (!resource.accessRules[principal]?.write)
+      const policy = collectionPolicies[frame.n];
+      if (!policy?.write) throw new import_core.SuperLineError("FORBIDDEN", `Write denied: ${frame.n}/${frame.id}`);
+      if (!await policy.write(principal, frame.id, conn.ctx))
         throw new import_core.SuperLineError("FORBIDDEN", `Write denied: ${frame.n}/${frame.id}`);
-      await store.apply({ id: frame.id, update: frame.u, origin: frame.o });
-      if (taps.length)
-        emitTap({
-          type: "store.write",
-          store: frame.n,
-          id: frame.id,
-          origin: frame.o,
-          connId: conn.id,
-          data: frame.u
-        });
+      await store.apply(
+        { n: frame.n, id: frame.id, update: frame.u, origin: frame.o },
+        def.crdt,
+        (snapshot) => (0, import_core.validateSync)(def.schema, snapshot)
+      );
       conn.send({ t: "res", i: frame.i, d: null });
     });
   }
-  function handleStoreClose(conn, frame) {
-    if (!storeMap[frame.n]) return;
-    leaveChannel(conn, STORE + frame.n + ":" + frame.id);
-    if (taps.length) emitTap({ type: "store.unsubscribe", connId: conn.id, store: frame.n, id: frame.id });
+  function handleCrdtClose(conn, frame) {
+    if (!crdtDefOf(frame.n)) return;
+    leaveChannel(conn, CDOC + frame.n + ":" + frame.id);
   }
-  for (const [name, store] of Object.entries(storeMap)) {
-    const isSelf = store.clustering === "self";
-    store.onChange((change) => {
-      const channel = STORE + name + ":" + change.id;
+  if (crdtStore) {
+    const isSelf = crdtStore.clustering === "self";
+    crdtStore.onChange((change) => {
+      const channel = CDOC + change.n + ":" + change.id;
       if (isSelf) {
         const set = members.get(channel);
         if (!set) return;
-        const payload = serializer.encode({ t: "sch", n: name, id: change.id, u: change.update, o: change.origin });
+        const payload = serializer.encode({ t: "cdchg", n: change.n, id: change.id, u: change.update, o: change.origin });
         for (const conn of set) conn.sendRaw(payload);
         return;
       }
       if (relaying) return;
       void adapter.publish(
         channel,
-        serializer.encode({ t: "sch", n: name, id: change.id, u: change.update, o: change.origin, nd: instanceId })
+        serializer.encode({ t: "cdchg", n: change.n, id: change.id, u: change.update, o: change.origin, nd: instanceId })
       );
     });
     if (isSelf)
-      store.onDelete?.((id) => {
-        const set = members.get(STORE + name + ":" + id);
+      crdtStore.onDelete?.((n, id) => {
+        const set = members.get(CDOC + n + ":" + id);
         if (!set) return;
-        const payload = serializer.encode({ t: "sdel", n: name, id });
+        const payload = serializer.encode({ t: "cddel", n, id });
         for (const conn of set) conn.sendRaw(payload);
       });
   }
-  function handleStoreRelay(channel, payload) {
+  function handleCrdtRelay(channel, payload) {
     const set = members.get(channel);
     if (set) for (const conn of set) conn.sendRaw(payload);
     let frame;
@@ -818,15 +800,20 @@ function createSuperLineServer(contract, opts) {
       return;
     }
     if (frame.nd === instanceId) return;
-    const store = storeMap[frame.n];
-    if (!store || store.clustering !== "relay") return;
-    if (frame.t === "sdel") {
-      void store.delete(frame.id);
+    if (!crdtStore || crdtStore.clustering !== "relay") return;
+    const def = crdtDefOf(frame.n);
+    if (!def) return;
+    if (frame.t === "cddel") {
+      try {
+        void crdtStore.delete(frame.n, frame.id);
+      } catch {
+      }
       return;
     }
     relaying = true;
     try {
-      void store.apply({ id: frame.id, update: frame.u, origin: frame.o });
+      void crdtStore.apply({ n: frame.n, id: frame.id, update: frame.u, origin: frame.o }, def.crdt, () => {
+      });
     } catch {
     } finally {
       relaying = false;
@@ -882,6 +869,7 @@ function createSuperLineServer(contract, opts) {
     for (const op of ops) {
       const def = collectionDefs[op.n];
       if (!def) throw new import_core.SuperLineError("NOT_FOUND", `Unknown collection: ${op.n}`);
+      if ((0, import_core.isCrdtCollection)(def)) throw new import_core.SuperLineError("NOT_FOUND", `Collection ${op.n} is a CRDT document collection \u2014 use collection(n).open(id), not a row batch`);
       const policy = collectionPolicies[op.n];
       if (!policy?.write) throw new import_core.SuperLineError("FORBIDDEN", `Write denied: ${op.n}`);
       const prev = await store.read(op.n, op.id);
@@ -1103,78 +1091,6 @@ function createSuperLineServer(contract, opts) {
       void adapter.publish(CONN + id, serializer.encode(env));
     });
   }
-  const storeApi = {};
-  for (const [name, store] of Object.entries(storeMap)) {
-    const readOrThrow = async (id) => {
-      const r = await store.read(id);
-      if (!r) throw new import_core.SuperLineError("NOT_FOUND", `No resource: ${name}/${id}`);
-      return r;
-    };
-    storeApi[name] = {
-      async create(id, data, accessRules) {
-        await store.create(id, data, accessRules);
-        if (taps.length) emitTap({ type: "store.create", store: name, id });
-      },
-      read(id) {
-        return Promise.resolve(store.read(id));
-      },
-      async write(id, data, opts2) {
-        const origin = opts2?.origin ?? SERVER_ORIGIN;
-        await store.apply({ id, update: data, origin });
-        if (taps.length) emitTap({ type: "store.write", store: name, id, origin, data });
-      },
-      async grant(id, principal, perms) {
-        const r = await readOrThrow(id);
-        await store.setAccess(id, { ...r.accessRules, [principal]: perms });
-        if (taps.length) emitTap({ type: "store.grant", store: name, id, principal, perms });
-      },
-      async revoke(id, principal) {
-        const r = await readOrThrow(id);
-        const next = { ...r.accessRules };
-        delete next[principal];
-        await store.setAccess(id, next);
-        if (taps.length) emitTap({ type: "store.revoke", store: name, id, principal });
-      },
-      async delete(id) {
-        await store.delete(id);
-        if (store.clustering !== "self")
-          void adapter.publish(
-            STORE + name + ":" + id,
-            serializer.encode({ t: "sdel", n: name, id, nd: instanceId })
-          );
-        if (taps.length) emitTap({ type: "store.delete", store: name, id });
-      },
-      list(opts2) {
-        return Promise.resolve(store.list(opts2));
-      },
-      searchPrincipals(opts2) {
-        return Promise.resolve(store.searchPrincipals(opts2));
-      },
-      open(id, openOpts) {
-        if (!store.open)
-          throw new import_core.SuperLineError("UNSUPPORTED", `Store ${name} does not support reactive open()`);
-        const replica = store.open(id, openOpts);
-        if (!taps.length) return replica;
-        const origin = openOpts?.origin ?? SERVER_ORIGIN;
-        const emit = (data) => emitTap({ type: "store.write", store: name, id, origin, data });
-        return {
-          ...replica,
-          set: (d) => {
-            replica.set(d);
-            emit(d);
-          },
-          update: (p) => {
-            replica.update(p);
-            emit(p);
-          },
-          delete: (path) => {
-            replica.delete(path);
-            emit({ delete: path });
-          }
-        };
-      }
-    };
-  }
   const pluginDisposers = [];
   const pluginHandlers = {};
   const api = {
@@ -1275,15 +1191,40 @@ function createSuperLineServer(contract, opts) {
         }
       };
     },
-    store(name) {
-      const handle = storeApi[name];
-      if (!handle) throw new import_core.SuperLineError("NOT_FOUND", `Store not configured: ${name}`);
-      return handle;
-    },
     collection(name) {
-      if (!collectionStore) throw new import_core.SuperLineError("NOT_FOUND", "No collection backend configured");
       const def = collectionDefs[name];
       if (!def) throw new import_core.SuperLineError("NOT_FOUND", `Collection not declared: ${name}`);
+      if ((0, import_core.isCrdtCollection)(def)) {
+        if (!crdtStore) throw new import_core.SuperLineError("NOT_FOUND", "No CRDT collection backend configured");
+        const cstore = crdtStore;
+        const handle2 = {
+          async create(id, data) {
+            const v = await (0, import_core.validate)(def.schema, data);
+            await cstore.create(name, id, v, def.crdt);
+          },
+          open(id, o) {
+            return cstore.open(name, id, { ...o, doc: def.crdt });
+          },
+          async read(id) {
+            const state = await cstore.read(name, id);
+            if (state === void 0) return void 0;
+            const r = cstore.open(name, id, { doc: def.crdt });
+            const s = r.getSnapshot();
+            r.close();
+            return s;
+          },
+          async delete(id) {
+            await cstore.delete(name, id);
+            if (cstore.clustering !== "self")
+              void adapter.publish(CDOC + name + ":" + id, serializer.encode({ t: "cddel", n: name, id, nd: instanceId }));
+          },
+          list(o) {
+            return Promise.resolve(cstore.list(name, o));
+          }
+        };
+        return handle2;
+      }
+      if (!collectionStore) throw new import_core.SuperLineError("NOT_FOUND", "No collection backend configured");
       const store = collectionStore;
       const resolve = async (row) => {
         const v = await (0, import_core.validate)(def.schema, row);
@@ -1292,7 +1233,7 @@ function createSuperLineServer(contract, opts) {
           throw new import_core.SuperLineError("VALIDATION", `Collection ${name} row is missing string key '${def.key}'`);
         return { id: key, row: v };
       };
-      return {
+      const handle = {
         async insert(row) {
           const { id, row: v } = await resolve(row);
           await commitCollectionBatch([{ op: "insert", n: name, id, row: v }], SERVER_ORIGIN, true);
@@ -1311,6 +1252,7 @@ function createSuperLineServer(contract, opts) {
           return Promise.resolve(store.snapshot(name, query ?? {}));
         }
       };
+      return handle;
     },
     async close() {
       if (closing) return;
@@ -1368,10 +1310,14 @@ function createSuperLineServer(contract, opts) {
           }
         };
       },
-      store: (name) => api.store(name),
-      storeInfos: () => Object.entries(storeMap).map(([name, store]) => ({ name, model: store.model })),
       collection: (name) => api.collection(name),
-      collectionInfos: () => Object.entries(collectionDefs).map(([name, def]) => ({ name, key: def.key, references: def.references ?? {} })),
+      collectionInfos: () => (
+        // CRDT document collections surface with a synthetic `id` key + no references — the inspector's
+        // queryCollection synthesizes doc-rows for them (they're open-by-id, not row-queryable).
+        Object.entries(collectionDefs).map(
+          ([name, def]) => (0, import_core.isCrdtCollection)(def) ? { name, key: "id", references: {} } : { name, key: def.key, references: def.references ?? {} }
+        )
+      ),
       describe: (conn) => buildDescriptor(conn),
       connectionById: (id) => Promise.resolve(presenceOrThrow().get(id)),
       channel: (name) => pluginChannel(pluginName, name)

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { ServerMessageDef, RawConn, Serializer, ServerFrame, EmitData, Expr, CollectionQuery, ConnDescriptor, Adapter, PresenceStore, Contract, RoleOf, NodeStat, SharedEvents, SharedServerRequests, ClientInput, Output, Directional, TapEvent, AccessRules, Resource, Perms, ListOpts, ResourceSummary, SearchOpts, ServerReplica, StoreInfo, CtsOf, ServerInput, ServerStore, Handshake, SharedRequests, AnyData, RoleRequests, Events, DataOf, RoleTopics, SharedTopics, EventData, CollectionName, RowOf, ServerTransport, CollectionStore } from '@super-line/core';
+import { ServerMessageDef, RawConn, Serializer, ServerFrame, EmitData, Expr, CollectionQuery, CrdtServerReplica, DocListOpts, DocSummary, ConnDescriptor, Adapter, PresenceStore, Contract, RoleOf, NodeStat, SharedEvents, SharedServerRequests, ClientInput, Output, Directional, TapEvent, CtsOf, ServerInput, Handshake, SharedRequests, AnyData, RoleRequests, Events, DataOf, RoleTopics, SharedTopics, EventData, CollectionName, CrdtCollectionName, DocOf, RowOf, ServerTransport, CollectionStore, CrdtCollectionStore } from '@super-line/core';
 
 /**
  * A single client connection, passed to handlers as the third argument.
@@ -104,6 +104,36 @@ interface ServerCollectionHandle<Row = unknown> {
     /** Materialize a snapshot (filter/sort/limit); omit the query for the whole collection. Server-side, policy-free. */
     snapshot(query?: CollectionQuery): Promise<Row[]>;
 }
+/**
+ * Access policy for a CRDT document collection (ADR-0007, Q7). Guard-shaped — not the RLS filter shape of
+ * {@link CollectionPolicy}, because CRDT collections are opened by id (no subset to filter). **Deny-by-default**.
+ * Server co-writes via `srv.collection(n)` bypass both.
+ */
+interface CrdtCollectionPolicy<Ctx = unknown, Doc = unknown> {
+    /** May this principal open `id`? Gets the post-merge plaintext `snapshot` (content-based auth like RLS reading a row). */
+    read?: (principal: string, id: string, snapshot: Doc | undefined, ctx: Ctx) => Awaitable$1<boolean>;
+    /** May this principal write to `id`? (Creation is server-authoritative — Q10 — so there is no `create` op here.) */
+    write?: (principal: string, id: string, ctx: Ctx) => Awaitable$1<boolean>;
+}
+/**
+ * Server-authoritative handle for a CRDT document collection (`srv.collection('scenes')`). Creation is
+ * server-only (Q10): `create` validates the initial doc and materializes it; `open` returns a reactive
+ * co-writer whose mutations fan out like a relayed client delta. Policy-free (server is authoritative).
+ */
+interface ServerCrdtCollectionHandle<Doc = unknown> {
+    /** Create a document with pre-validated initial data. Throws `CONFLICT` if the id exists. */
+    create(id: string, data: Doc): Promise<void>;
+    /** Open a reactive co-writer over an existing document. `origin` (default `"server"`) attributes its writes. */
+    open(id: string, opts?: {
+        origin?: string;
+    }): CrdtServerReplica;
+    /** Read the current plaintext snapshot of a document, or undefined if absent. */
+    read(id: string): Promise<Doc | undefined>;
+    /** Delete a document (idempotent), fanning the deletion cluster-wide. */
+    delete(id: string): Promise<void>;
+    /** Enumerate document ids + summaries (no content query). */
+    list(opts?: DocListOpts): Promise<DocSummary[]>;
+}
 
 /**
  * In-process pub/sub bus. Share one bus across multiple servers to simulate
@@ -266,46 +296,6 @@ interface RoleLens<C extends Contract, R extends RoleOf<C>> {
     /** Publish to a topic in role `R`'s surface (reaches that role's subscribers). */
     publish<T extends keyof RoleTopics<C, R>>(topic: T, data: EmitData<RoleTopics<C, R>[T]>): void;
 }
-/**
- * Server-side handle for one configured Store, reached via `srv.store.<name>`. The server is
- * authoritative: it creates Resources, grants/revokes access, and may co-write. `data` is untyped
- * (stores are off-contract — see ADR-0003); callers assert the shape.
- */
-interface ServerStoreHandle {
-    /** Create a Resource with initial data + access rules (deny-by-default for everyone unlisted). */
-    create(id: string, data: unknown, accessRules: AccessRules): Promise<void>;
-    /** Read a Resource (data + accessRules), or undefined if absent. */
-    read(id: string): Promise<Resource | undefined>;
-    /**
-     * Server co-write: replace the Resource's value (LWW), fanned out to subscribers stamped with `origin`
-     * (default `"server"`) for echo-break + inspector attribution — mirrors {@link ServerStore.open}'s origin.
-     */
-    write(id: string, data: unknown, opts?: {
-        origin?: string;
-    }): Promise<void>;
-    /** Grant a principal read/write on a Resource. */
-    grant(id: string, principal: string, perms: Perms): Promise<void>;
-    /** Revoke a principal's access to a Resource entirely. */
-    revoke(id: string, principal: string): Promise<void>;
-    /** Delete a Resource. */
-    delete(id: string): Promise<void>;
-    /**
-     * Summaries of this store's Resources, server-side filtered / sorted / paginated per {@link ListOpts}
-     * (omit `opts` for every Resource, id-ascending). Forwards to {@link ServerStore.list}.
-     */
-    list(opts?: ListOpts): Promise<ResourceSummary[]>;
-    /** Distinct principals granted anywhere in this store (store-global). Forwards to {@link ServerStore.searchPrincipals}. */
-    searchPrincipals(opts: SearchOpts): Promise<string[]>;
-    /**
-     * Open a reactive in-process co-writer over a Resource's canonical state — the server half's mirror of
-     * `client.store(name).open(id)`. Reactive reads, merging `update`, and surgical `delete(path)` (the only
-     * way to remove a key server-side), all server-authoritative and fanned out to subscribers. `origin`
-     * (default `"server"`) tags its Changes for inspector attribution. Throws if the store has no `open`.
-     */
-    open(id: string, opts?: {
-        origin?: string;
-    }): ServerReplica;
-}
 /**
  * Handlers a plugin provides for its paired surface `S` (ADR-0004): one per `clientToServer` key,
  * typed from `S`. `ctx`/`conn` are loose — a plugin is written independently of the host's per-role ctx.
@@ -357,11 +347,6 @@ interface SuperLinePlugin<S extends Directional = {}> {
      * throws at construction.
      */
     handlers?: (ctx: PluginContext) => HandlersFor<S>;
-    /**
-     * Server halves of Store pairs the plugin contributes, merged into the host's `stores` and reachable
-     * via `srv.store(name)`. A name colliding with a host store or another plugin's store throws at construction.
-     */
-    stores?: Record<string, ServerStore>;
     /**
      * Row-security policies for the collections the plugin's contract fragment declares (see {@link CollectionPolicy}).
      * Merged into the host's `policies`; a collection already policied by the host or another plugin throws at
@@ -457,11 +442,7 @@ interface PluginContext {
         readonly size: number;
         readonly connections: readonly Conn[];
     };
-    /** Server-authoritative handle for a configured store (incl. plugin-contributed stores). */
-    store(name: string): ServerStoreHandle;
-    /** Configured stores (host + plugin) and their models. */
-    storeInfos(): StoreInfo[];
-    /** Server-authoritative handle for a contract collection (loosely typed here); throws if none is configured. */
+    /** Server-authoritative handle for a contract collection (loosely typed here as the LWW row handle — the surface plugins/inspector use); throws if none is configured. */
     collection(name: string): ServerCollectionHandle;
     /** Declared collections (name + key + advisory references) for the schema graph. */
     collectionInfos(): {
@@ -511,12 +492,6 @@ interface SuperLineServerOptions<C extends Contract, A extends AuthResult<C>, P
         interval?: number;
         maxMissed?: number;
     } | false;
-    /**
-     * Pluggable persisted-state Stores, keyed by name (`{ scene: crdtStoreServer(), config: memoryStoreServer() }`).
-     * Each is the server half of a Store pair; the client passes the matching client halves. Surfaced as
-     * `srv.store.<name>` and `client.store.<name>`. Stores are off-contract and untyped (ADR-0003).
-     */
-    stores?: Record<string, ServerStore>;
     /**
      * The single {@link CollectionStore} backend serving every collection this contract declares (typed rows;
      * ADR-0006), e.g. `collections: memoryCollections()`. One backend ⇒ one transaction domain, so a
@@ -524,11 +499,18 @@ interface SuperLineServerOptions<C extends Contract, A extends AuthResult<C>, P
      */
     collections?: CollectionStore;
     /**
-     * Row-security policies per collection (see {@link CollectionPolicy}). Deny-by-default: a collection with no
-     * policy is server-only (clients can neither read nor write it). Server co-writes via `srv.collection(n)` bypass them.
+     * The {@link CrdtCollectionStore} backend serving this contract's CRDT document collections (ADR-0007),
+     * e.g. `crdtCollections: crdtMemoryCollections()`. A backend per family: CRDT docs never join a
+     * cross-collection atomic batch, so they get their own backend, separate from `collections`.
+     */
+    crdtCollections?: CrdtCollectionStore;
+    /**
+     * Access policies per collection. Deny-by-default: a collection with no policy is server-only. LWW row
+     * collections take an RLS-style {@link CollectionPolicy} (read → filter); CRDT document collections take a
+     * guard-shaped {@link CrdtCollectionPolicy} (read → bool). Server co-writes via `srv.collection(n)` bypass them.
      */
     policies?: {
-        [N in CollectionName<C>]?: CollectionPolicy<CtxUnion<A>, RowOf<C, N>>;
+        [N in CollectionName<C>]?: N extends CrdtCollectionName<C> ? CrdtCollectionPolicy<CtxUnion<A>, DocOf<C, N>> : CollectionPolicy<CtxUnion<A>, RowOf<C, N>>;
     };
     /**
      * Opt-in advisory foreign-key checks (see ADR-0006, decision 8). When true, an insert/update whose
@@ -575,10 +557,13 @@ interface SuperLineServer<C extends Contract, A extends AuthResult<C>, HK extend
     subscribe<T extends keyof SharedTopics<C>>(topic: T, handler: (data: EventData<SharedTopics<C>[T]>, meta: BusMeta) => void): () => void;
     /** Lens for role-scoped sends, e.g. forRole('user').publish('feed', data). */
     forRole<R extends RoleOf<C>>(role: R): RoleLens<C, R>;
-    /** Server-authoritative handle for a configured Store (`srv.store('scene').create(...)`). Throws `NOT_FOUND` if the name isn't configured. */
-    store(name: string): ServerStoreHandle;
-    /** Server-authoritative handle for a contract collection (`srv.collection('messages').insert(...)`), typed by the contract. Throws `NOT_FOUND` if no collection backend is configured or the name isn't declared. */
-    collection<N extends CollectionName<C>>(name: N): ServerCollectionHandle<RowOf<C, N>>;
+    /**
+     * Server-authoritative handle for a contract collection, typed by the contract: an LWW row collection gives
+     * `ServerCollectionHandle` (`insert`/`update`/`batch`), a CRDT document collection gives
+     * `ServerCrdtCollectionHandle` (`create`/`open`). Throws `NOT_FOUND` if no matching backend is configured
+     * or the name isn't declared.
+     */
+    collection<N extends CollectionName<C>>(name: N): N extends CrdtCollectionName<C> ? ServerCrdtCollectionHandle<DocOf<C, N>> : ServerCollectionHandle<RowOf<C, N>>;
     close(): Promise<void>;
 }
 /**
@@ -605,4 +590,4 @@ interface SuperLineServer<C extends Contract, A extends AuthResult<C>, HK extend
  */
 declare function createSuperLineServer<C extends Contract, A extends AuthResult<C>, const P extends readonly SuperLinePlugin<any>[] = []>(contract: C, opts: SuperLineServerOptions<C, A, P>): SuperLineServer<C, A, HandledKeys<P>>;
 
-export { type AuthResult, type BusMeta, type ClusterView, type CollectionPolicy, Conn, type ConnTarget, type HandledKeys, type Handlers, type HandlersFor, type LocalView, MemoryBus, type Middleware, type MiddlewareInfo, type PluginChannel, type PluginConnection, type PluginContext, type PluginMiddleware, type RoleLens, type Room, type ServerCollectionHandle, type ServerStoreHandle, type SubtractHandlers, type SuperLinePlugin, type SuperLineServer, type SuperLineServerOptions, type UserTarget, type WriteOp, createInMemoryAdapter, createSuperLineServer, resolvePrincipal };
+export { type AuthResult, type BusMeta, type ClusterView, type CollectionPolicy, Conn, type ConnTarget, type CrdtCollectionPolicy, type HandledKeys, type Handlers, type HandlersFor, type LocalView, MemoryBus, type Middleware, type MiddlewareInfo, type PluginChannel, type PluginConnection, type PluginContext, type PluginMiddleware, type RoleLens, type Room, type ServerCollectionHandle, type ServerCrdtCollectionHandle, type SubtractHandlers, type SuperLinePlugin, type SuperLineServer, type SuperLineServerOptions, type UserTarget, type WriteOp, createInMemoryAdapter, createSuperLineServer, resolvePrincipal };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ServerMessageDef, RawConn, Serializer, ServerFrame, EmitData, Expr, CollectionQuery, ConnDescriptor, Adapter, PresenceStore, Contract, RoleOf, NodeStat, SharedEvents, SharedServerRequests, ClientInput, Output, Directional, TapEvent, AccessRules, Resource, Perms, ListOpts, ResourceSummary, SearchOpts, ServerReplica, StoreInfo, CtsOf, ServerInput, ServerStore, Handshake, SharedRequests, AnyData, RoleRequests, Events, DataOf, RoleTopics, SharedTopics, EventData, CollectionName, RowOf, ServerTransport, CollectionStore } from '@super-line/core';
+import { ServerMessageDef, RawConn, Serializer, ServerFrame, EmitData, Expr, CollectionQuery, CrdtServerReplica, DocListOpts, DocSummary, ConnDescriptor, Adapter, PresenceStore, Contract, RoleOf, NodeStat, SharedEvents, SharedServerRequests, ClientInput, Output, Directional, TapEvent, CtsOf, ServerInput, Handshake, SharedRequests, AnyData, RoleRequests, Events, DataOf, RoleTopics, SharedTopics, EventData, CollectionName, CrdtCollectionName, DocOf, RowOf, ServerTransport, CollectionStore, CrdtCollectionStore } from '@super-line/core';
 
 /**
  * A single client connection, passed to handlers as the third argument.
@@ -104,6 +104,36 @@ interface ServerCollectionHandle<Row = unknown> {
     /** Materialize a snapshot (filter/sort/limit); omit the query for the whole collection. Server-side, policy-free. */
     snapshot(query?: CollectionQuery): Promise<Row[]>;
 }
+/**
+ * Access policy for a CRDT document collection (ADR-0007, Q7). Guard-shaped — not the RLS filter shape of
+ * {@link CollectionPolicy}, because CRDT collections are opened by id (no subset to filter). **Deny-by-default**.
+ * Server co-writes via `srv.collection(n)` bypass both.
+ */
+interface CrdtCollectionPolicy<Ctx = unknown, Doc = unknown> {
+    /** May this principal open `id`? Gets the post-merge plaintext `snapshot` (content-based auth like RLS reading a row). */
+    read?: (principal: string, id: string, snapshot: Doc | undefined, ctx: Ctx) => Awaitable$1<boolean>;
+    /** May this principal write to `id`? (Creation is server-authoritative — Q10 — so there is no `create` op here.) */
+    write?: (principal: string, id: string, ctx: Ctx) => Awaitable$1<boolean>;
+}
+/**
+ * Server-authoritative handle for a CRDT document collection (`srv.collection('scenes')`). Creation is
+ * server-only (Q10): `create` validates the initial doc and materializes it; `open` returns a reactive
+ * co-writer whose mutations fan out like a relayed client delta. Policy-free (server is authoritative).
+ */
+interface ServerCrdtCollectionHandle<Doc = unknown> {
+    /** Create a document with pre-validated initial data. Throws `CONFLICT` if the id exists. */
+    create(id: string, data: Doc): Promise<void>;
+    /** Open a reactive co-writer over an existing document. `origin` (default `"server"`) attributes its writes. */
+    open(id: string, opts?: {
+        origin?: string;
+    }): CrdtServerReplica;
+    /** Read the current plaintext snapshot of a document, or undefined if absent. */
+    read(id: string): Promise<Doc | undefined>;
+    /** Delete a document (idempotent), fanning the deletion cluster-wide. */
+    delete(id: string): Promise<void>;
+    /** Enumerate document ids + summaries (no content query). */
+    list(opts?: DocListOpts): Promise<DocSummary[]>;
+}
 
 /**
  * In-process pub/sub bus. Share one bus across multiple servers to simulate
@@ -266,46 +296,6 @@ interface RoleLens<C extends Contract, R extends RoleOf<C>> {
     /** Publish to a topic in role `R`'s surface (reaches that role's subscribers). */
     publish<T extends keyof RoleTopics<C, R>>(topic: T, data: EmitData<RoleTopics<C, R>[T]>): void;
 }
-/**
- * Server-side handle for one configured Store, reached via `srv.store.<name>`. The server is
- * authoritative: it creates Resources, grants/revokes access, and may co-write. `data` is untyped
- * (stores are off-contract — see ADR-0003); callers assert the shape.
- */
-interface ServerStoreHandle {
-    /** Create a Resource with initial data + access rules (deny-by-default for everyone unlisted). */
-    create(id: string, data: unknown, accessRules: AccessRules): Promise<void>;
-    /** Read a Resource (data + accessRules), or undefined if absent. */
-    read(id: string): Promise<Resource | undefined>;
-    /**
-     * Server co-write: replace the Resource's value (LWW), fanned out to subscribers stamped with `origin`
-     * (default `"server"`) for echo-break + inspector attribution — mirrors {@link ServerStore.open}'s origin.
-     */
-    write(id: string, data: unknown, opts?: {
-        origin?: string;
-    }): Promise<void>;
-    /** Grant a principal read/write on a Resource. */
-    grant(id: string, principal: string, perms: Perms): Promise<void>;
-    /** Revoke a principal's access to a Resource entirely. */
-    revoke(id: string, principal: string): Promise<void>;
-    /** Delete a Resource. */
-    delete(id: string): Promise<void>;
-    /**
-     * Summaries of this store's Resources, server-side filtered / sorted / paginated per {@link ListOpts}
-     * (omit `opts` for every Resource, id-ascending). Forwards to {@link ServerStore.list}.
-     */
-    list(opts?: ListOpts): Promise<ResourceSummary[]>;
-    /** Distinct principals granted anywhere in this store (store-global). Forwards to {@link ServerStore.searchPrincipals}. */
-    searchPrincipals(opts: SearchOpts): Promise<string[]>;
-    /**
-     * Open a reactive in-process co-writer over a Resource's canonical state — the server half's mirror of
-     * `client.store(name).open(id)`. Reactive reads, merging `update`, and surgical `delete(path)` (the only
-     * way to remove a key server-side), all server-authoritative and fanned out to subscribers. `origin`
-     * (default `"server"`) tags its Changes for inspector attribution. Throws if the store has no `open`.
-     */
-    open(id: string, opts?: {
-        origin?: string;
-    }): ServerReplica;
-}
 /**
  * Handlers a plugin provides for its paired surface `S` (ADR-0004): one per `clientToServer` key,
  * typed from `S`. `ctx`/`conn` are loose — a plugin is written independently of the host's per-role ctx.
@@ -357,11 +347,6 @@ interface SuperLinePlugin<S extends Directional = {}> {
      * throws at construction.
      */
     handlers?: (ctx: PluginContext) => HandlersFor<S>;
-    /**
-     * Server halves of Store pairs the plugin contributes, merged into the host's `stores` and reachable
-     * via `srv.store(name)`. A name colliding with a host store or another plugin's store throws at construction.
-     */
-    stores?: Record<string, ServerStore>;
     /**
      * Row-security policies for the collections the plugin's contract fragment declares (see {@link CollectionPolicy}).
      * Merged into the host's `policies`; a collection already policied by the host or another plugin throws at
@@ -457,11 +442,7 @@ interface PluginContext {
         readonly size: number;
         readonly connections: readonly Conn[];
     };
-    /** Server-authoritative handle for a configured store (incl. plugin-contributed stores). */
-    store(name: string): ServerStoreHandle;
-    /** Configured stores (host + plugin) and their models. */
-    storeInfos(): StoreInfo[];
-    /** Server-authoritative handle for a contract collection (loosely typed here); throws if none is configured. */
+    /** Server-authoritative handle for a contract collection (loosely typed here as the LWW row handle — the surface plugins/inspector use); throws if none is configured. */
     collection(name: string): ServerCollectionHandle;
     /** Declared collections (name + key + advisory references) for the schema graph. */
     collectionInfos(): {
@@ -511,12 +492,6 @@ interface SuperLineServerOptions<C extends Contract, A extends AuthResult<C>, P
         interval?: number;
         maxMissed?: number;
     } | false;
-    /**
-     * Pluggable persisted-state Stores, keyed by name (`{ scene: crdtStoreServer(), config: memoryStoreServer() }`).
-     * Each is the server half of a Store pair; the client passes the matching client halves. Surfaced as
-     * `srv.store.<name>` and `client.store.<name>`. Stores are off-contract and untyped (ADR-0003).
-     */
-    stores?: Record<string, ServerStore>;
     /**
      * The single {@link CollectionStore} backend serving every collection this contract declares (typed rows;
      * ADR-0006), e.g. `collections: memoryCollections()`. One backend ⇒ one transaction domain, so a
@@ -524,11 +499,18 @@ interface SuperLineServerOptions<C extends Contract, A extends AuthResult<C>, P
      */
     collections?: CollectionStore;
     /**
-     * Row-security policies per collection (see {@link CollectionPolicy}). Deny-by-default: a collection with no
-     * policy is server-only (clients can neither read nor write it). Server co-writes via `srv.collection(n)` bypass them.
+     * The {@link CrdtCollectionStore} backend serving this contract's CRDT document collections (ADR-0007),
+     * e.g. `crdtCollections: crdtMemoryCollections()`. A backend per family: CRDT docs never join a
+     * cross-collection atomic batch, so they get their own backend, separate from `collections`.
+     */
+    crdtCollections?: CrdtCollectionStore;
+    /**
+     * Access policies per collection. Deny-by-default: a collection with no policy is server-only. LWW row
+     * collections take an RLS-style {@link CollectionPolicy} (read → filter); CRDT document collections take a
+     * guard-shaped {@link CrdtCollectionPolicy} (read → bool). Server co-writes via `srv.collection(n)` bypass them.
      */
     policies?: {
-        [N in CollectionName<C>]?: CollectionPolicy<CtxUnion<A>, RowOf<C, N>>;
+        [N in CollectionName<C>]?: N extends CrdtCollectionName<C> ? CrdtCollectionPolicy<CtxUnion<A>, DocOf<C, N>> : CollectionPolicy<CtxUnion<A>, RowOf<C, N>>;
     };
     /**
      * Opt-in advisory foreign-key checks (see ADR-0006, decision 8). When true, an insert/update whose
@@ -575,10 +557,13 @@ interface SuperLineServer<C extends Contract, A extends AuthResult<C>, HK extend
     subscribe<T extends keyof SharedTopics<C>>(topic: T, handler: (data: EventData<SharedTopics<C>[T]>, meta: BusMeta) => void): () => void;
     /** Lens for role-scoped sends, e.g. forRole('user').publish('feed', data). */
     forRole<R extends RoleOf<C>>(role: R): RoleLens<C, R>;
-    /** Server-authoritative handle for a configured Store (`srv.store('scene').create(...)`). Throws `NOT_FOUND` if the name isn't configured. */
-    store(name: string): ServerStoreHandle;
-    /** Server-authoritative handle for a contract collection (`srv.collection('messages').insert(...)`), typed by the contract. Throws `NOT_FOUND` if no collection backend is configured or the name isn't declared. */
-    collection<N extends CollectionName<C>>(name: N): ServerCollectionHandle<RowOf<C, N>>;
+    /**
+     * Server-authoritative handle for a contract collection, typed by the contract: an LWW row collection gives
+     * `ServerCollectionHandle` (`insert`/`update`/`batch`), a CRDT document collection gives
+     * `ServerCrdtCollectionHandle` (`create`/`open`). Throws `NOT_FOUND` if no matching backend is configured
+     * or the name isn't declared.
+     */
+    collection<N extends CollectionName<C>>(name: N): N extends CrdtCollectionName<C> ? ServerCrdtCollectionHandle<DocOf<C, N>> : ServerCollectionHandle<RowOf<C, N>>;
     close(): Promise<void>;
 }
 /**
@@ -605,4 +590,4 @@ interface SuperLineServer<C extends Contract, A extends AuthResult<C>, HK extend
  */
 declare function createSuperLineServer<C extends Contract, A extends AuthResult<C>, const P extends readonly SuperLinePlugin<any>[] = []>(contract: C, opts: SuperLineServerOptions<C, A, P>): SuperLineServer<C, A, HandledKeys<P>>;
 
-export { type AuthResult, type BusMeta, type ClusterView, type CollectionPolicy, Conn, type ConnTarget, type HandledKeys, type Handlers, type HandlersFor, type LocalView, MemoryBus, type Middleware, type MiddlewareInfo, type PluginChannel, type PluginConnection, type PluginContext, type PluginMiddleware, type RoleLens, type Room, type ServerCollectionHandle, type ServerStoreHandle, type SubtractHandlers, type SuperLinePlugin, type SuperLineServer, type SuperLineServerOptions, type UserTarget, type WriteOp, createInMemoryAdapter, createSuperLineServer, resolvePrincipal };
+export { type AuthResult, type BusMeta, type ClusterView, type CollectionPolicy, Conn, type ConnTarget, type CrdtCollectionPolicy, type HandledKeys, type Handlers, type HandlersFor, type LocalView, MemoryBus, type Middleware, type MiddlewareInfo, type PluginChannel, type PluginConnection, type PluginContext, type PluginMiddleware, type RoleLens, type Room, type ServerCollectionHandle, type ServerCrdtCollectionHandle, type SubtractHandlers, type SuperLinePlugin, type SuperLineServer, type SuperLineServerOptions, type UserTarget, type WriteOp, createInMemoryAdapter, createSuperLineServer, resolvePrincipal };

package/dist/index.js

@@ -2,10 +2,12 @@
 import {
   jsonSerializer,
   validate,
+  validateSync,
   SuperLineError,
   andFilters,
   orFilters,
-  matchesFilter
+  matchesFilter,
+  isCrdtCollection
 } from "@super-line/core";
 
 // src/conn.ts
@@ -184,27 +186,18 @@ var CONN = "c:";
 var USER = "u:";
 var REPLY = "reply:";
 var PLUGIN = "x:";
-var STORE = "s:";
+var CDOC = "d:";
 var SERVER_ORIGIN = "server";
 function createSuperLineServer(contract, opts) {
   const c = contract;
   const serializer = opts.serializer ?? jsonSerializer;
   const adapter = opts.adapter ?? createInMemoryAdapter();
-  const storeMap = opts.stores ?? {};
   const plugins = opts.plugins ?? [];
   const pluginNames = /* @__PURE__ */ new Set();
   for (const p of plugins) {
     if (pluginNames.has(p.name)) throw new Error(`Duplicate plugin name: ${p.name}`);
     pluginNames.add(p.name);
   }
-  for (const p of plugins) {
-    if (!p.stores) continue;
-    for (const [name, store] of Object.entries(p.stores)) {
-      if (name in storeMap)
-        throw new Error(`Plugin '${p.name}' store '${name}' collides with an existing store of that name`);
-      storeMap[name] = store;
-    }
-  }
   const collectionStore = opts.collections;
   const collectionDefs = c.collections ?? {};
   const collectionPolicies = { ...opts.policies };
@@ -222,6 +215,11 @@ function createSuperLineServer(contract, opts) {
   }
   const checkReferences = opts.checkReferences ?? false;
   const collIsRelay = collectionStore?.clustering === "relay";
+  const crdtStore = opts.crdtCollections;
+  const crdtDefOf = (n) => {
+    const d = collectionDefs[n];
+    return d && isCrdtCollection(d) ? d : void 0;
+  };
   const COLL_CHANNEL = "cbatch";
   const collSubscribers = /* @__PURE__ */ new Map();
   const connColl = /* @__PURE__ */ new Map();
@@ -318,8 +316,8 @@ function createSuperLineServer(contract, opts) {
       handlePersonal(channel, payload);
       return;
     }
-    if (channel.startsWith(STORE)) {
-      handleStoreRelay(channel, payload);
+    if (channel.startsWith(CDOC)) {
+      handleCrdtRelay(channel, payload);
       return;
     }
     if (channel === COLL_CHANNEL) {
@@ -605,13 +603,12 @@ function createSuperLineServer(contract, opts) {
     else if (frame.t === "unsub") {
       const ns = topicNamespace(conn.role, frame.c);
       if (ns) leaveChannel(conn, TOPIC + ns + ":" + frame.c);
-    } else if (frame.t === "sopen") await handleStoreOpen(conn, frame);
-    else if (frame.t === "srd") await handleStoreRead(conn, frame);
-    else if (frame.t === "swr") await handleStoreWrite(conn, frame);
-    else if (frame.t === "sclose") handleStoreClose(conn, frame);
-    else if (frame.t === "csub") await handleCollectionSub(conn, frame);
+    } else if (frame.t === "csub") await handleCollectionSub(conn, frame);
     else if (frame.t === "cuns") handleCollectionUnsub(conn, frame);
     else if (frame.t === "cbat") await handleCollectionBatch(conn, frame);
+    else if (frame.t === "cdopen") await handleCrdtOpen(conn, frame);
+    else if (frame.t === "cdwr") await handleCrdtWrite(conn, frame);
+    else if (frame.t === "cdclose") handleCrdtClose(conn, frame);
     else if (frame.t === "sres") {
       await handleClientReply(conn, frame.i, { ok: true, d: frame.d });
     } else if (frame.t === "serr") {
@@ -704,90 +701,77 @@ function createSuperLineServer(contract, opts) {
       conn.send({ t: "res", i: frame.i, d: null });
     });
   }
-  function storeOrErr(conn, id, name) {
-    const store = storeMap[name];
-    if (!store) conn.send({ t: "err", i: id, code: "NOT_FOUND", m: `Unknown store: ${name}` });
-    return store;
-  }
-  async function handleStoreOpen(conn, frame) {
-    const store = storeOrErr(conn, frame.i, frame.n);
-    if (!store) return;
-    await dispatchOp(conn, frame.i, { kind: "subscribe", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
-      const resource = await store.read(frame.id);
-      if (!resource) throw new SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+  function crdtMissing(conn, i, n) {
+    if (crdtStore && crdtDefOf(n)) return false;
+    conn.send({ t: "err", i, code: "NOT_FOUND", m: `Unknown CRDT collection: ${n}` });
+    return true;
+  }
+  async function handleCrdtOpen(conn, frame) {
+    if (crdtMissing(conn, frame.i, frame.n)) return;
+    const store = crdtStore;
+    await dispatchOp(conn, frame.i, { kind: "subscribe", name: `collection:${frame.n}/${frame.id}`, conn }, async () => {
+      const state = await store.read(frame.n, frame.id);
+      if (state === void 0) throw new SuperLineError("NOT_FOUND", `No document: ${frame.n}/${frame.id}`);
       const principal = conn.principal ?? conn.id;
-      if (!resource.accessRules[principal]?.read)
-        throw new SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
-      await joinChannel(conn, STORE + frame.n + ":" + frame.id);
-      if (taps.length) emitTap({ type: "store.subscribe", connId: conn.id, store: frame.n, id: frame.id });
-      conn.send({ t: "res", i: frame.i, d: resource.data });
-    });
-  }
-  async function handleStoreRead(conn, frame) {
-    const store = storeOrErr(conn, frame.i, frame.n);
-    if (!store) return;
-    await dispatchOp(conn, frame.i, { kind: "request", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
-      const resource = await store.read(frame.id);
-      if (!resource) throw new SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
-      const principal = conn.principal ?? conn.id;
-      if (!resource.accessRules[principal]?.read)
+      const policy = collectionPolicies[frame.n];
+      if (!policy?.read) throw new SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
+      const replica = store.open(frame.n, frame.id);
+      const snapshot = replica.getSnapshot();
+      replica.close();
+      if (!await policy.read(principal, frame.id, snapshot, conn.ctx))
         throw new SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
-      conn.send({ t: "res", i: frame.i, d: resource.data });
+      await joinChannel(conn, CDOC + frame.n + ":" + frame.id);
+      conn.send({ t: "res", i: frame.i, d: state });
     });
   }
-  async function handleStoreWrite(conn, frame) {
-    const store = storeOrErr(conn, frame.i, frame.n);
-    if (!store) return;
-    await dispatchOp(conn, frame.i, { kind: "request", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
-      const resource = await store.read(frame.id);
-      if (!resource) throw new SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+  async function handleCrdtWrite(conn, frame) {
+    if (crdtMissing(conn, frame.i, frame.n)) return;
+    const store = crdtStore;
+    const def = crdtDefOf(frame.n);
+    await dispatchOp(conn, frame.i, { kind: "request", name: `collection:${frame.n}/${frame.id}`, conn }, async () => {
       const principal = conn.principal ?? conn.id;
-      if (!resource.accessRules[principal]?.write)
+      const policy = collectionPolicies[frame.n];
+      if (!policy?.write) throw new SuperLineError("FORBIDDEN", `Write denied: ${frame.n}/${frame.id}`);
+      if (!await policy.write(principal, frame.id, conn.ctx))
         throw new SuperLineError("FORBIDDEN", `Write denied: ${frame.n}/${frame.id}`);
-      await store.apply({ id: frame.id, update: frame.u, origin: frame.o });
-      if (taps.length)
-        emitTap({
-          type: "store.write",
-          store: frame.n,
-          id: frame.id,
-          origin: frame.o,
-          connId: conn.id,
-          data: frame.u
-        });
+      await store.apply(
+        { n: frame.n, id: frame.id, update: frame.u, origin: frame.o },
+        def.crdt,
+        (snapshot) => validateSync(def.schema, snapshot)
+      );
       conn.send({ t: "res", i: frame.i, d: null });
     });
   }
-  function handleStoreClose(conn, frame) {
-    if (!storeMap[frame.n]) return;
-    leaveChannel(conn, STORE + frame.n + ":" + frame.id);
-    if (taps.length) emitTap({ type: "store.unsubscribe", connId: conn.id, store: frame.n, id: frame.id });
+  function handleCrdtClose(conn, frame) {
+    if (!crdtDefOf(frame.n)) return;
+    leaveChannel(conn, CDOC + frame.n + ":" + frame.id);
   }
-  for (const [name, store] of Object.entries(storeMap)) {
-    const isSelf = store.clustering === "self";
-    store.onChange((change) => {
-      const channel = STORE + name + ":" + change.id;
+  if (crdtStore) {
+    const isSelf = crdtStore.clustering === "self";
+    crdtStore.onChange((change) => {
+      const channel = CDOC + change.n + ":" + change.id;
       if (isSelf) {
         const set = members.get(channel);
         if (!set) return;
-        const payload = serializer.encode({ t: "sch", n: name, id: change.id, u: change.update, o: change.origin });
+        const payload = serializer.encode({ t: "cdchg", n: change.n, id: change.id, u: change.update, o: change.origin });
         for (const conn of set) conn.sendRaw(payload);
         return;
       }
       if (relaying) return;
       void adapter.publish(
         channel,
-        serializer.encode({ t: "sch", n: name, id: change.id, u: change.update, o: change.origin, nd: instanceId })
+        serializer.encode({ t: "cdchg", n: change.n, id: change.id, u: change.update, o: change.origin, nd: instanceId })
       );
     });
     if (isSelf)
-      store.onDelete?.((id) => {
-        const set = members.get(STORE + name + ":" + id);
+      crdtStore.onDelete?.((n, id) => {
+        const set = members.get(CDOC + n + ":" + id);
         if (!set) return;
-        const payload = serializer.encode({ t: "sdel", n: name, id });
+        const payload = serializer.encode({ t: "cddel", n, id });
         for (const conn of set) conn.sendRaw(payload);
       });
   }
-  function handleStoreRelay(channel, payload) {
+  function handleCrdtRelay(channel, payload) {
     const set = members.get(channel);
     if (set) for (const conn of set) conn.sendRaw(payload);
     let frame;
@@ -797,15 +781,20 @@ function createSuperLineServer(contract, opts) {
       return;
     }
     if (frame.nd === instanceId) return;
-    const store = storeMap[frame.n];
-    if (!store || store.clustering !== "relay") return;
-    if (frame.t === "sdel") {
-      void store.delete(frame.id);
+    if (!crdtStore || crdtStore.clustering !== "relay") return;
+    const def = crdtDefOf(frame.n);
+    if (!def) return;
+    if (frame.t === "cddel") {
+      try {
+        void crdtStore.delete(frame.n, frame.id);
+      } catch {
+      }
       return;
     }
     relaying = true;
     try {
-      void store.apply({ id: frame.id, update: frame.u, origin: frame.o });
+      void crdtStore.apply({ n: frame.n, id: frame.id, update: frame.u, origin: frame.o }, def.crdt, () => {
+      });
     } catch {
     } finally {
       relaying = false;
@@ -861,6 +850,7 @@ function createSuperLineServer(contract, opts) {
     for (const op of ops) {
       const def = collectionDefs[op.n];
       if (!def) throw new SuperLineError("NOT_FOUND", `Unknown collection: ${op.n}`);
+      if (isCrdtCollection(def)) throw new SuperLineError("NOT_FOUND", `Collection ${op.n} is a CRDT document collection \u2014 use collection(n).open(id), not a row batch`);
       const policy = collectionPolicies[op.n];
       if (!policy?.write) throw new SuperLineError("FORBIDDEN", `Write denied: ${op.n}`);
       const prev = await store.read(op.n, op.id);
@@ -1082,78 +1072,6 @@ function createSuperLineServer(contract, opts) {
       void adapter.publish(CONN + id, serializer.encode(env));
     });
   }
-  const storeApi = {};
-  for (const [name, store] of Object.entries(storeMap)) {
-    const readOrThrow = async (id) => {
-      const r = await store.read(id);
-      if (!r) throw new SuperLineError("NOT_FOUND", `No resource: ${name}/${id}`);
-      return r;
-    };
-    storeApi[name] = {
-      async create(id, data, accessRules) {
-        await store.create(id, data, accessRules);
-        if (taps.length) emitTap({ type: "store.create", store: name, id });
-      },
-      read(id) {
-        return Promise.resolve(store.read(id));
-      },
-      async write(id, data, opts2) {
-        const origin = opts2?.origin ?? SERVER_ORIGIN;
-        await store.apply({ id, update: data, origin });
-        if (taps.length) emitTap({ type: "store.write", store: name, id, origin, data });
-      },
-      async grant(id, principal, perms) {
-        const r = await readOrThrow(id);
-        await store.setAccess(id, { ...r.accessRules, [principal]: perms });
-        if (taps.length) emitTap({ type: "store.grant", store: name, id, principal, perms });
-      },
-      async revoke(id, principal) {
-        const r = await readOrThrow(id);
-        const next = { ...r.accessRules };
-        delete next[principal];
-        await store.setAccess(id, next);
-        if (taps.length) emitTap({ type: "store.revoke", store: name, id, principal });
-      },
-      async delete(id) {
-        await store.delete(id);
-        if (store.clustering !== "self")
-          void adapter.publish(
-            STORE + name + ":" + id,
-            serializer.encode({ t: "sdel", n: name, id, nd: instanceId })
-          );
-        if (taps.length) emitTap({ type: "store.delete", store: name, id });
-      },
-      list(opts2) {
-        return Promise.resolve(store.list(opts2));
-      },
-      searchPrincipals(opts2) {
-        return Promise.resolve(store.searchPrincipals(opts2));
-      },
-      open(id, openOpts) {
-        if (!store.open)
-          throw new SuperLineError("UNSUPPORTED", `Store ${name} does not support reactive open()`);
-        const replica = store.open(id, openOpts);
-        if (!taps.length) return replica;
-        const origin = openOpts?.origin ?? SERVER_ORIGIN;
-        const emit = (data) => emitTap({ type: "store.write", store: name, id, origin, data });
-        return {
-          ...replica,
-          set: (d) => {
-            replica.set(d);
-            emit(d);
-          },
-          update: (p) => {
-            replica.update(p);
-            emit(p);
-          },
-          delete: (path) => {
-            replica.delete(path);
-            emit({ delete: path });
-          }
-        };
-      }
-    };
-  }
   const pluginDisposers = [];
   const pluginHandlers = {};
   const api = {
@@ -1254,15 +1172,40 @@ function createSuperLineServer(contract, opts) {
         }
       };
     },
-    store(name) {
-      const handle = storeApi[name];
-      if (!handle) throw new SuperLineError("NOT_FOUND", `Store not configured: ${name}`);
-      return handle;
-    },
     collection(name) {
-      if (!collectionStore) throw new SuperLineError("NOT_FOUND", "No collection backend configured");
       const def = collectionDefs[name];
       if (!def) throw new SuperLineError("NOT_FOUND", `Collection not declared: ${name}`);
+      if (isCrdtCollection(def)) {
+        if (!crdtStore) throw new SuperLineError("NOT_FOUND", "No CRDT collection backend configured");
+        const cstore = crdtStore;
+        const handle2 = {
+          async create(id, data) {
+            const v = await validate(def.schema, data);
+            await cstore.create(name, id, v, def.crdt);
+          },
+          open(id, o) {
+            return cstore.open(name, id, { ...o, doc: def.crdt });
+          },
+          async read(id) {
+            const state = await cstore.read(name, id);
+            if (state === void 0) return void 0;
+            const r = cstore.open(name, id, { doc: def.crdt });
+            const s = r.getSnapshot();
+            r.close();
+            return s;
+          },
+          async delete(id) {
+            await cstore.delete(name, id);
+            if (cstore.clustering !== "self")
+              void adapter.publish(CDOC + name + ":" + id, serializer.encode({ t: "cddel", n: name, id, nd: instanceId }));
+          },
+          list(o) {
+            return Promise.resolve(cstore.list(name, o));
+          }
+        };
+        return handle2;
+      }
+      if (!collectionStore) throw new SuperLineError("NOT_FOUND", "No collection backend configured");
       const store = collectionStore;
       const resolve = async (row) => {
         const v = await validate(def.schema, row);
@@ -1271,7 +1214,7 @@ function createSuperLineServer(contract, opts) {
           throw new SuperLineError("VALIDATION", `Collection ${name} row is missing string key '${def.key}'`);
         return { id: key, row: v };
       };
-      return {
+      const handle = {
         async insert(row) {
           const { id, row: v } = await resolve(row);
           await commitCollectionBatch([{ op: "insert", n: name, id, row: v }], SERVER_ORIGIN, true);
@@ -1290,6 +1233,7 @@ function createSuperLineServer(contract, opts) {
           return Promise.resolve(store.snapshot(name, query ?? {}));
         }
       };
+      return handle;
     },
     async close() {
       if (closing) return;
@@ -1347,10 +1291,14 @@ function createSuperLineServer(contract, opts) {
           }
         };
       },
-      store: (name) => api.store(name),
-      storeInfos: () => Object.entries(storeMap).map(([name, store]) => ({ name, model: store.model })),
       collection: (name) => api.collection(name),
-      collectionInfos: () => Object.entries(collectionDefs).map(([name, def]) => ({ name, key: def.key, references: def.references ?? {} })),
+      collectionInfos: () => (
+        // CRDT document collections surface with a synthetic `id` key + no references — the inspector's
+        // queryCollection synthesizes doc-rows for them (they're open-by-id, not row-queryable).
+        Object.entries(collectionDefs).map(
+          ([name, def]) => isCrdtCollection(def) ? { name, key: "id", references: {} } : { name, key: def.key, references: def.references ?? {} }
+        )
+      ),
       describe: (conn) => buildDescriptor(conn),
       connectionById: (id) => Promise.resolve(presenceOrThrow().get(id)),
       channel: (name) => pluginChannel(pluginName, name)

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@super-line/server",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "type": "module",
-  "description": "Realtime data-bus server for super-line — requests, events, rooms, topics, stores, pluggable transports & adapters.",
+  "description": "Realtime data-bus server for super-line — requests, events, rooms, topics, collections, pluggable transports & adapters.",
   "license": "MIT",
   "author": "Mert",
   "keywords": [
@@ -47,7 +47,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@super-line/core": "^0.10.1"
+    "@super-line/core": "^0.11.0"
   },
   "devDependencies": {
     "@chainsafe/libp2p-noise": "^17.0.0",
@@ -68,15 +68,15 @@
     "zeromq": "^6.0.0",
     "zod": "^3.24.1",
     "zod-to-json-schema": "^3.25.2",
-    "@super-line/adapter-libp2p": "0.6.0",
     "@super-line/adapter-zeromq": "0.5.0",
     "@super-line/adapter-redis": "0.5.0",
-    "@super-line/plugin-inspector": "0.1.0",
+    "@super-line/adapter-libp2p": "0.6.0",
+    "@super-line/client": "0.9.0",
+    "@super-line/plugin-inspector": "0.2.0",
     "@super-line/adapter-rabbitmq": "0.5.0",
-    "@super-line/client": "0.8.0",
     "@super-line/transport-loopback": "0.5.0",
-    "@super-line/transport-websocket": "0.6.0",
-    "@super-line/transport-http": "0.5.0"
+    "@super-line/transport-http": "0.5.0",
+    "@super-line/transport-websocket": "0.6.0"
   },
   "optionalDependencies": {
     "@standard-community/standard-json": "^0.3.5"