@super-line/server 0.4.0 → 0.5.0

package/dist/index.cjs

@@ -16272,7 +16272,8 @@ __export(index_exports, {
   Conn: () => Conn,
   MemoryBus: () => MemoryBus,
   createInMemoryAdapter: () => createInMemoryAdapter,
-  createSuperLineServer: () => createSuperLineServer
+  createSuperLineServer: () => createSuperLineServer,
+  resolvePrincipal: () => resolvePrincipal
 });
 module.exports = __toCommonJS(index_exports);
 var import_node_crypto = require("crypto");
@@ -16300,6 +16301,8 @@ var Conn = class {
   data = {};
   /** The client↔server transport (wire) this connection was accepted on (set by the server at accept). */
   transport;
+  /** ACL identity for stores: `identify(conn) ?? conn.id`, set by the server at accept (always defined there). */
+  principal;
   /** When this connection was accepted (`Date.now()`). */
   connectedAt = Date.now();
   /** When the server last sent a heartbeat ping to this connection (managed by the server). */
@@ -16332,6 +16335,9 @@ var Conn = class {
     this.raw.terminate();
   }
 };
+function resolvePrincipal(conn, identify) {
+  return identify?.(conn) ?? conn.id;
+}
 
 // src/memory-adapter.ts
 var MemoryBus = class {
@@ -16448,6 +16454,8 @@ var CONN = "c:";
 var USER = "u:";
 var REPLY = "reply:";
 var INSPECT = "i:";
+var STORE = "s:";
+var SERVER_ORIGIN = "server";
 function createSuperLineServer(contract, opts) {
   const c = contract;
   const serializer = opts.serializer ?? import_core2.jsonSerializer;
@@ -16456,6 +16464,7 @@ function createSuperLineServer(contract, opts) {
   const inspectorRedact = new Set(
     opts.inspector && typeof opts.inspector === "object" ? opts.inspector.redact ?? [] : []
   );
+  const storeMap = opts.stores ?? {};
   const conns = /* @__PURE__ */ new Set();
   const inspectorConns = /* @__PURE__ */ new Set();
   const members = /* @__PURE__ */ new Map();
@@ -16465,6 +16474,7 @@ function createSuperLineServer(contract, opts) {
   const replyChannel = REPLY + instanceId;
   let impl = {};
   let closing = false;
+  let relaying = false;
   let nextSReq = 1;
   const originWaiters = /* @__PURE__ */ new Map();
   const ownerRouting = /* @__PURE__ */ new Map();
@@ -16497,6 +16507,10 @@ function createSuperLineServer(contract, opts) {
       handlePersonal(channel, payload);
       return;
     }
+    if (channel.startsWith(STORE)) {
+      handleStoreRelay(channel, payload);
+      return;
+    }
     const set = members.get(channel);
     if (set) for (const conn of set) conn.sendRaw(payload);
     const busSet = busListeners.get(channel);
@@ -16771,6 +16785,7 @@ function createSuperLineServer(contract, opts) {
       inspectorEnabled ? (event, data) => emitInspectorEvent({ type: "msg.event", target: connId, name: event, data: safeSnapshot(data) }) : void 0
     );
     conn.transport = auth.transport;
+    conn.principal = resolvePrincipal(conn, opts.identify);
     raw.onMessage((bytes) => {
       void onMessage(conn, bytes);
     });
@@ -16820,7 +16835,11 @@ function createSuperLineServer(contract, opts) {
     else if (frame.t === "unsub") {
       const ns = topicNamespace(conn.role, frame.c);
       if (ns) leaveChannel(conn, TOPIC + ns + ":" + frame.c);
-    } else if (frame.t === "sres") {
+    } else if (frame.t === "sopen") await handleStoreOpen(conn, frame);
+    else if (frame.t === "srd") await handleStoreRead(conn, frame);
+    else if (frame.t === "swr") await handleStoreWrite(conn, frame);
+    else if (frame.t === "sclose") handleStoreClose(conn, frame);
+    else if (frame.t === "sres") {
       await handleClientReply(conn, frame.i, { ok: true, d: frame.d });
     } else if (frame.t === "serr") {
       await handleClientReply(conn, frame.i, { ok: false, code: frame.code, m: frame.m, d: frame.d });
@@ -16909,6 +16928,100 @@ function createSuperLineServer(contract, opts) {
       conn.send({ t: "res", i: frame.i, d: null });
     });
   }
+  function storeOrErr(conn, id, name) {
+    const store = storeMap[name];
+    if (!store) conn.send({ t: "err", i: id, code: "NOT_FOUND", m: `Unknown store: ${name}` });
+    return store;
+  }
+  async function handleStoreOpen(conn, frame) {
+    const store = storeOrErr(conn, frame.i, frame.n);
+    if (!store) return;
+    await dispatchOp(conn, frame.i, { kind: "subscribe", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
+      const resource = await store.read(frame.id);
+      if (!resource) throw new import_core2.SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+      const principal = conn.principal ?? conn.id;
+      if (!resource.accessRules[principal]?.read)
+        throw new import_core2.SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
+      await joinChannel(conn, STORE + frame.n + ":" + frame.id);
+      if (inspectorEnabled) emitInspectorEvent({ type: "store.subscribe", connId: conn.id, store: frame.n, id: frame.id });
+      conn.send({ t: "res", i: frame.i, d: resource.data });
+    });
+  }
+  async function handleStoreRead(conn, frame) {
+    const store = storeOrErr(conn, frame.i, frame.n);
+    if (!store) return;
+    await dispatchOp(conn, frame.i, { kind: "request", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
+      const resource = await store.read(frame.id);
+      if (!resource) throw new import_core2.SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+      const principal = conn.principal ?? conn.id;
+      if (!resource.accessRules[principal]?.read)
+        throw new import_core2.SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
+      conn.send({ t: "res", i: frame.i, d: resource.data });
+    });
+  }
+  async function handleStoreWrite(conn, frame) {
+    const store = storeOrErr(conn, frame.i, frame.n);
+    if (!store) return;
+    await dispatchOp(conn, frame.i, { kind: "request", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
+      const resource = await store.read(frame.id);
+      if (!resource) throw new import_core2.SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+      const principal = conn.principal ?? conn.id;
+      if (!resource.accessRules[principal]?.write)
+        throw new import_core2.SuperLineError("FORBIDDEN", `Write denied: ${frame.n}/${frame.id}`);
+      await store.apply({ id: frame.id, update: frame.u, origin: frame.o });
+      if (inspectorEnabled)
+        emitInspectorEvent({
+          type: "store.write",
+          store: frame.n,
+          id: frame.id,
+          origin: frame.o,
+          connId: conn.id,
+          data: safeSnapshot(frame.u)
+        });
+      conn.send({ t: "res", i: frame.i, d: null });
+    });
+  }
+  function handleStoreClose(conn, frame) {
+    if (!storeMap[frame.n]) return;
+    leaveChannel(conn, STORE + frame.n + ":" + frame.id);
+    if (inspectorEnabled) emitInspectorEvent({ type: "store.unsubscribe", connId: conn.id, store: frame.n, id: frame.id });
+  }
+  for (const [name, store] of Object.entries(storeMap)) {
+    store.onChange((change) => {
+      if (relaying) return;
+      void adapter.publish(
+        STORE + name + ":" + change.id,
+        serializer.encode({
+          t: "sch",
+          n: name,
+          id: change.id,
+          u: change.update,
+          o: change.origin,
+          nd: instanceId
+        })
+      );
+    });
+  }
+  function handleStoreRelay(channel, payload) {
+    const set = members.get(channel);
+    if (set) for (const conn of set) conn.sendRaw(payload);
+    let frame;
+    try {
+      frame = serializer.decode(payload);
+    } catch {
+      return;
+    }
+    if (frame.nd === instanceId) return;
+    const store = storeMap[frame.n];
+    if (!store || store.clustering !== "relay") return;
+    relaying = true;
+    try {
+      void store.apply({ id: frame.id, update: frame.u, origin: frame.o });
+    } catch {
+    } finally {
+      relaying = false;
+    }
+  }
   function room(name) {
     const channel = ROOM + name;
     return {
@@ -17013,6 +17126,45 @@ function createSuperLineServer(contract, opts) {
       void adapter.publish(CONN + id, serializer.encode(env));
     });
   }
+  const storeApi = {};
+  for (const [name, store] of Object.entries(storeMap)) {
+    const readOrThrow = async (id) => {
+      const r = await store.read(id);
+      if (!r) throw new import_core2.SuperLineError("NOT_FOUND", `No resource: ${name}/${id}`);
+      return r;
+    };
+    storeApi[name] = {
+      async create(id, data, accessRules) {
+        await store.create(id, data, accessRules);
+      },
+      read(id) {
+        return Promise.resolve(store.read(id));
+      },
+      async write(id, data) {
+        await store.apply({ id, update: data, origin: SERVER_ORIGIN });
+        if (inspectorEnabled)
+          emitInspectorEvent({ type: "store.write", store: name, id, origin: SERVER_ORIGIN, data: safeSnapshot(data) });
+      },
+      async grant(id, principal, perms) {
+        const r = await readOrThrow(id);
+        await store.setAccess(id, { ...r.accessRules, [principal]: perms });
+        if (inspectorEnabled) emitInspectorEvent({ type: "store.grant", store: name, id, principal, perms });
+      },
+      async revoke(id, principal) {
+        const r = await readOrThrow(id);
+        const next = { ...r.accessRules };
+        delete next[principal];
+        await store.setAccess(id, next);
+        if (inspectorEnabled) emitInspectorEvent({ type: "store.revoke", store: name, id, principal });
+      },
+      async delete(id) {
+        await store.delete(id);
+      },
+      list() {
+        return Promise.resolve(store.list());
+      }
+    };
+  }
   const api = {
     nodeId: instanceId,
     nodeName,
@@ -17094,6 +17246,11 @@ function createSuperLineServer(contract, opts) {
         }
       };
     },
+    store(name) {
+      const handle = storeApi[name];
+      if (!handle) throw new import_core2.SuperLineError("NOT_FOUND", `Store not configured: ${name}`);
+      return handle;
+    },
     async close() {
       if (closing) return;
       closing = true;
@@ -17112,5 +17269,6 @@ function createSuperLineServer(contract, opts) {
   Conn,
   MemoryBus,
   createInMemoryAdapter,
-  createSuperLineServer
+  createSuperLineServer,
+  resolvePrincipal
 });

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { ServerMessageDef, RawConn, Serializer, ServerFrame, EmitData, ConnDescriptor, Adapter, PresenceStore, Contract, RoleOf, NodeStat, SharedEvents, SharedServerRequests, ClientInput, Output, SharedRequests, ServerInput, AnyData, RoleRequests, Events, DataOf, RoleTopics, SharedTopics, EventData, ServerTransport, Handshake } from '@super-line/core';
+import { ServerMessageDef, RawConn, Serializer, ServerFrame, EmitData, ConnDescriptor, Adapter, PresenceStore, Contract, RoleOf, NodeStat, SharedEvents, SharedServerRequests, ClientInput, Output, SharedRequests, ServerInput, AnyData, RoleRequests, Events, DataOf, RoleTopics, AccessRules, Resource, Perms, SharedTopics, EventData, ServerTransport, Handshake, ServerStore } from '@super-line/core';
 
 /**
  * A single client connection, passed to handlers as the third argument.
@@ -26,6 +26,8 @@ declare class Conn<Ev = Record<string, ServerMessageDef>, Ctx = unknown, Role ex
     data: Data;
     /** The client↔server transport (wire) this connection was accepted on (set by the server at accept). */
     transport?: string;
+    /** ACL identity for stores: `identify(conn) ?? conn.id`, set by the server at accept (always defined there). */
+    principal?: string;
     /** When this connection was accepted (`Date.now()`). */
     readonly connectedAt: number;
     /** When the server last sent a heartbeat ping to this connection (managed by the server). */
@@ -56,6 +58,12 @@ declare class Conn<Ev = Record<string, ServerMessageDef>, Ctx = unknown, Role ex
     /** Hard close with no handshake — used by heartbeat reaping. */
     terminate(): void;
 }
+/**
+ * The ACL principal for a connection: the stable `identify` key when configured, else the
+ * (random, per-connection) `conn.id`. Always returns a string — store access rules never key
+ * on `undefined`. Distinct from `identify`'s raw output (which may be undefined, used for presence).
+ */
+declare function resolvePrincipal(conn: Conn, identify?: (conn: Conn) => string | undefined): string;
 
 /**
  * In-process pub/sub bus. Share one bus across multiple servers to simulate
@@ -210,6 +218,27 @@ interface RoleLens<C extends Contract, R extends RoleOf<C>> {
     /** Publish to a topic in role `R`'s surface (reaches that role's subscribers). */
     publish<T extends keyof RoleTopics<C, R>>(topic: T, data: EmitData<RoleTopics<C, R>[T]>): void;
 }
+/**
+ * Server-side handle for one configured Store, reached via `srv.store.<name>`. The server is
+ * authoritative: it creates Resources, grants/revokes access, and may co-write. `data` is untyped
+ * (stores are off-contract — see ADR-0003); callers assert the shape.
+ */
+interface ServerStoreHandle {
+    /** Create a Resource with initial data + access rules (deny-by-default for everyone unlisted). */
+    create(id: string, data: unknown, accessRules: AccessRules): Promise<void>;
+    /** Read a Resource (data + accessRules), or undefined if absent. */
+    read(id: string): Promise<Resource | undefined>;
+    /** Server co-write: replace the Resource's value (LWW), fanned out to subscribers with a `server` origin. */
+    write(id: string, data: unknown): Promise<void>;
+    /** Grant a principal read/write on a Resource. */
+    grant(id: string, principal: string, perms: Perms): Promise<void>;
+    /** Revoke a principal's access to a Resource entirely. */
+    revoke(id: string, principal: string): Promise<void>;
+    /** Delete a Resource. */
+    delete(id: string): Promise<void>;
+    /** All Resource ids in this store. */
+    list(): Promise<string[]>;
+}
 /** Options for {@link createSuperLineServer}. */
 interface SuperLineServerOptions<C extends Contract, A extends AuthResult<C>> {
     /** Client↔server transports to accept connections on (e.g. `webSocketServerTransport({ server })`). */
@@ -251,6 +280,12 @@ interface SuperLineServerOptions<C extends Contract, A extends AuthResult<C>> {
     inspector?: boolean | {
         redact?: string[];
     };
+    /**
+     * Pluggable persisted-state Stores, keyed by name (`{ scene: crdtStoreServer(), config: memoryStoreServer() }`).
+     * Each is the server half of a Store pair; the client passes the matching client halves. Surfaced as
+     * `srv.store.<name>` and `client.store.<name>`. Stores are off-contract and untyped (ADR-0003).
+     */
+    stores?: Record<string, ServerStore>;
     /** Called once per accepted connection. */
     onConnection?: (conn: Conn, ctx: CtxUnion<A>) => void;
     /** Called when a connection closes, with the WebSocket close `code`. */
@@ -289,6 +324,8 @@ interface SuperLineServer<C extends Contract, A extends AuthResult<C>> {
     subscribe<T extends keyof SharedTopics<C>>(topic: T, handler: (data: EventData<SharedTopics<C>[T]>, meta: BusMeta) => void): () => void;
     /** Lens for role-scoped sends, e.g. forRole('user').publish('feed', data). */
     forRole<R extends RoleOf<C>>(role: R): RoleLens<C, R>;
+    /** Server-authoritative handle for a configured Store (`srv.store('scene').create(...)`). Throws `NOT_FOUND` if the name isn't configured. */
+    store(name: string): ServerStoreHandle;
     close(): Promise<void>;
 }
 /**
@@ -315,4 +352,4 @@ interface SuperLineServer<C extends Contract, A extends AuthResult<C>> {
  */
 declare function createSuperLineServer<C extends Contract, A extends AuthResult<C>>(contract: C, opts: SuperLineServerOptions<C, A>): SuperLineServer<C, A>;
 
-export { type AuthResult, type BusMeta, type ClusterView, Conn, type ConnTarget, type Handlers, type LocalView, MemoryBus, type Middleware, type MiddlewareInfo, type RoleLens, type Room, type SuperLineServer, type SuperLineServerOptions, type UserTarget, createInMemoryAdapter, createSuperLineServer };
+export { type AuthResult, type BusMeta, type ClusterView, Conn, type ConnTarget, type Handlers, type LocalView, MemoryBus, type Middleware, type MiddlewareInfo, type RoleLens, type Room, type ServerStoreHandle, type SuperLineServer, type SuperLineServerOptions, type UserTarget, createInMemoryAdapter, createSuperLineServer, resolvePrincipal };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ServerMessageDef, RawConn, Serializer, ServerFrame, EmitData, ConnDescriptor, Adapter, PresenceStore, Contract, RoleOf, NodeStat, SharedEvents, SharedServerRequests, ClientInput, Output, SharedRequests, ServerInput, AnyData, RoleRequests, Events, DataOf, RoleTopics, SharedTopics, EventData, ServerTransport, Handshake } from '@super-line/core';
+import { ServerMessageDef, RawConn, Serializer, ServerFrame, EmitData, ConnDescriptor, Adapter, PresenceStore, Contract, RoleOf, NodeStat, SharedEvents, SharedServerRequests, ClientInput, Output, SharedRequests, ServerInput, AnyData, RoleRequests, Events, DataOf, RoleTopics, AccessRules, Resource, Perms, SharedTopics, EventData, ServerTransport, Handshake, ServerStore } from '@super-line/core';
 
 /**
  * A single client connection, passed to handlers as the third argument.
@@ -26,6 +26,8 @@ declare class Conn<Ev = Record<string, ServerMessageDef>, Ctx = unknown, Role ex
     data: Data;
     /** The client↔server transport (wire) this connection was accepted on (set by the server at accept). */
     transport?: string;
+    /** ACL identity for stores: `identify(conn) ?? conn.id`, set by the server at accept (always defined there). */
+    principal?: string;
     /** When this connection was accepted (`Date.now()`). */
     readonly connectedAt: number;
     /** When the server last sent a heartbeat ping to this connection (managed by the server). */
@@ -56,6 +58,12 @@ declare class Conn<Ev = Record<string, ServerMessageDef>, Ctx = unknown, Role ex
     /** Hard close with no handshake — used by heartbeat reaping. */
     terminate(): void;
 }
+/**
+ * The ACL principal for a connection: the stable `identify` key when configured, else the
+ * (random, per-connection) `conn.id`. Always returns a string — store access rules never key
+ * on `undefined`. Distinct from `identify`'s raw output (which may be undefined, used for presence).
+ */
+declare function resolvePrincipal(conn: Conn, identify?: (conn: Conn) => string | undefined): string;
 
 /**
  * In-process pub/sub bus. Share one bus across multiple servers to simulate
@@ -210,6 +218,27 @@ interface RoleLens<C extends Contract, R extends RoleOf<C>> {
     /** Publish to a topic in role `R`'s surface (reaches that role's subscribers). */
     publish<T extends keyof RoleTopics<C, R>>(topic: T, data: EmitData<RoleTopics<C, R>[T]>): void;
 }
+/**
+ * Server-side handle for one configured Store, reached via `srv.store.<name>`. The server is
+ * authoritative: it creates Resources, grants/revokes access, and may co-write. `data` is untyped
+ * (stores are off-contract — see ADR-0003); callers assert the shape.
+ */
+interface ServerStoreHandle {
+    /** Create a Resource with initial data + access rules (deny-by-default for everyone unlisted). */
+    create(id: string, data: unknown, accessRules: AccessRules): Promise<void>;
+    /** Read a Resource (data + accessRules), or undefined if absent. */
+    read(id: string): Promise<Resource | undefined>;
+    /** Server co-write: replace the Resource's value (LWW), fanned out to subscribers with a `server` origin. */
+    write(id: string, data: unknown): Promise<void>;
+    /** Grant a principal read/write on a Resource. */
+    grant(id: string, principal: string, perms: Perms): Promise<void>;
+    /** Revoke a principal's access to a Resource entirely. */
+    revoke(id: string, principal: string): Promise<void>;
+    /** Delete a Resource. */
+    delete(id: string): Promise<void>;
+    /** All Resource ids in this store. */
+    list(): Promise<string[]>;
+}
 /** Options for {@link createSuperLineServer}. */
 interface SuperLineServerOptions<C extends Contract, A extends AuthResult<C>> {
     /** Client↔server transports to accept connections on (e.g. `webSocketServerTransport({ server })`). */
@@ -251,6 +280,12 @@ interface SuperLineServerOptions<C extends Contract, A extends AuthResult<C>> {
     inspector?: boolean | {
         redact?: string[];
     };
+    /**
+     * Pluggable persisted-state Stores, keyed by name (`{ scene: crdtStoreServer(), config: memoryStoreServer() }`).
+     * Each is the server half of a Store pair; the client passes the matching client halves. Surfaced as
+     * `srv.store.<name>` and `client.store.<name>`. Stores are off-contract and untyped (ADR-0003).
+     */
+    stores?: Record<string, ServerStore>;
     /** Called once per accepted connection. */
     onConnection?: (conn: Conn, ctx: CtxUnion<A>) => void;
     /** Called when a connection closes, with the WebSocket close `code`. */
@@ -289,6 +324,8 @@ interface SuperLineServer<C extends Contract, A extends AuthResult<C>> {
     subscribe<T extends keyof SharedTopics<C>>(topic: T, handler: (data: EventData<SharedTopics<C>[T]>, meta: BusMeta) => void): () => void;
     /** Lens for role-scoped sends, e.g. forRole('user').publish('feed', data). */
     forRole<R extends RoleOf<C>>(role: R): RoleLens<C, R>;
+    /** Server-authoritative handle for a configured Store (`srv.store('scene').create(...)`). Throws `NOT_FOUND` if the name isn't configured. */
+    store(name: string): ServerStoreHandle;
     close(): Promise<void>;
 }
 /**
@@ -315,4 +352,4 @@ interface SuperLineServer<C extends Contract, A extends AuthResult<C>> {
  */
 declare function createSuperLineServer<C extends Contract, A extends AuthResult<C>>(contract: C, opts: SuperLineServerOptions<C, A>): SuperLineServer<C, A>;
 
-export { type AuthResult, type BusMeta, type ClusterView, Conn, type ConnTarget, type Handlers, type LocalView, MemoryBus, type Middleware, type MiddlewareInfo, type RoleLens, type Room, type SuperLineServer, type SuperLineServerOptions, type UserTarget, createInMemoryAdapter, createSuperLineServer };
+export { type AuthResult, type BusMeta, type ClusterView, Conn, type ConnTarget, type Handlers, type LocalView, MemoryBus, type Middleware, type MiddlewareInfo, type RoleLens, type Room, type ServerStoreHandle, type SuperLineServer, type SuperLineServerOptions, type UserTarget, createInMemoryAdapter, createSuperLineServer, resolvePrincipal };

package/dist/index.js

@@ -32,6 +32,8 @@ var Conn = class {
   data = {};
   /** The client↔server transport (wire) this connection was accepted on (set by the server at accept). */
   transport;
+  /** ACL identity for stores: `identify(conn) ?? conn.id`, set by the server at accept (always defined there). */
+  principal;
   /** When this connection was accepted (`Date.now()`). */
   connectedAt = Date.now();
   /** When the server last sent a heartbeat ping to this connection (managed by the server). */
@@ -64,6 +66,9 @@ var Conn = class {
     this.raw.terminate();
   }
 };
+function resolvePrincipal(conn, identify) {
+  return identify?.(conn) ?? conn.id;
+}
 
 // src/memory-adapter.ts
 var MemoryBus = class {
@@ -180,6 +185,8 @@ var CONN = "c:";
 var USER = "u:";
 var REPLY = "reply:";
 var INSPECT = "i:";
+var STORE = "s:";
+var SERVER_ORIGIN = "server";
 function createSuperLineServer(contract, opts) {
   const c = contract;
   const serializer = opts.serializer ?? jsonSerializer;
@@ -188,6 +195,7 @@ function createSuperLineServer(contract, opts) {
   const inspectorRedact = new Set(
     opts.inspector && typeof opts.inspector === "object" ? opts.inspector.redact ?? [] : []
   );
+  const storeMap = opts.stores ?? {};
   const conns = /* @__PURE__ */ new Set();
   const inspectorConns = /* @__PURE__ */ new Set();
   const members = /* @__PURE__ */ new Map();
@@ -197,6 +205,7 @@ function createSuperLineServer(contract, opts) {
   const replyChannel = REPLY + instanceId;
   let impl = {};
   let closing = false;
+  let relaying = false;
   let nextSReq = 1;
   const originWaiters = /* @__PURE__ */ new Map();
   const ownerRouting = /* @__PURE__ */ new Map();
@@ -229,6 +238,10 @@ function createSuperLineServer(contract, opts) {
       handlePersonal(channel, payload);
       return;
     }
+    if (channel.startsWith(STORE)) {
+      handleStoreRelay(channel, payload);
+      return;
+    }
     const set = members.get(channel);
     if (set) for (const conn of set) conn.sendRaw(payload);
     const busSet = busListeners.get(channel);
@@ -503,6 +516,7 @@ function createSuperLineServer(contract, opts) {
       inspectorEnabled ? (event, data) => emitInspectorEvent({ type: "msg.event", target: connId, name: event, data: safeSnapshot(data) }) : void 0
     );
     conn.transport = auth.transport;
+    conn.principal = resolvePrincipal(conn, opts.identify);
     raw.onMessage((bytes) => {
       void onMessage(conn, bytes);
     });
@@ -552,7 +566,11 @@ function createSuperLineServer(contract, opts) {
     else if (frame.t === "unsub") {
       const ns = topicNamespace(conn.role, frame.c);
       if (ns) leaveChannel(conn, TOPIC + ns + ":" + frame.c);
-    } else if (frame.t === "sres") {
+    } else if (frame.t === "sopen") await handleStoreOpen(conn, frame);
+    else if (frame.t === "srd") await handleStoreRead(conn, frame);
+    else if (frame.t === "swr") await handleStoreWrite(conn, frame);
+    else if (frame.t === "sclose") handleStoreClose(conn, frame);
+    else if (frame.t === "sres") {
       await handleClientReply(conn, frame.i, { ok: true, d: frame.d });
     } else if (frame.t === "serr") {
       await handleClientReply(conn, frame.i, { ok: false, code: frame.code, m: frame.m, d: frame.d });
@@ -641,6 +659,100 @@ function createSuperLineServer(contract, opts) {
       conn.send({ t: "res", i: frame.i, d: null });
     });
   }
+  function storeOrErr(conn, id, name) {
+    const store = storeMap[name];
+    if (!store) conn.send({ t: "err", i: id, code: "NOT_FOUND", m: `Unknown store: ${name}` });
+    return store;
+  }
+  async function handleStoreOpen(conn, frame) {
+    const store = storeOrErr(conn, frame.i, frame.n);
+    if (!store) return;
+    await dispatchOp(conn, frame.i, { kind: "subscribe", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
+      const resource = await store.read(frame.id);
+      if (!resource) throw new SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+      const principal = conn.principal ?? conn.id;
+      if (!resource.accessRules[principal]?.read)
+        throw new SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
+      await joinChannel(conn, STORE + frame.n + ":" + frame.id);
+      if (inspectorEnabled) emitInspectorEvent({ type: "store.subscribe", connId: conn.id, store: frame.n, id: frame.id });
+      conn.send({ t: "res", i: frame.i, d: resource.data });
+    });
+  }
+  async function handleStoreRead(conn, frame) {
+    const store = storeOrErr(conn, frame.i, frame.n);
+    if (!store) return;
+    await dispatchOp(conn, frame.i, { kind: "request", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
+      const resource = await store.read(frame.id);
+      if (!resource) throw new SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+      const principal = conn.principal ?? conn.id;
+      if (!resource.accessRules[principal]?.read)
+        throw new SuperLineError("FORBIDDEN", `Read denied: ${frame.n}/${frame.id}`);
+      conn.send({ t: "res", i: frame.i, d: resource.data });
+    });
+  }
+  async function handleStoreWrite(conn, frame) {
+    const store = storeOrErr(conn, frame.i, frame.n);
+    if (!store) return;
+    await dispatchOp(conn, frame.i, { kind: "request", name: `store:${frame.n}/${frame.id}`, conn }, async () => {
+      const resource = await store.read(frame.id);
+      if (!resource) throw new SuperLineError("NOT_FOUND", `No resource: ${frame.n}/${frame.id}`);
+      const principal = conn.principal ?? conn.id;
+      if (!resource.accessRules[principal]?.write)
+        throw new SuperLineError("FORBIDDEN", `Write denied: ${frame.n}/${frame.id}`);
+      await store.apply({ id: frame.id, update: frame.u, origin: frame.o });
+      if (inspectorEnabled)
+        emitInspectorEvent({
+          type: "store.write",
+          store: frame.n,
+          id: frame.id,
+          origin: frame.o,
+          connId: conn.id,
+          data: safeSnapshot(frame.u)
+        });
+      conn.send({ t: "res", i: frame.i, d: null });
+    });
+  }
+  function handleStoreClose(conn, frame) {
+    if (!storeMap[frame.n]) return;
+    leaveChannel(conn, STORE + frame.n + ":" + frame.id);
+    if (inspectorEnabled) emitInspectorEvent({ type: "store.unsubscribe", connId: conn.id, store: frame.n, id: frame.id });
+  }
+  for (const [name, store] of Object.entries(storeMap)) {
+    store.onChange((change) => {
+      if (relaying) return;
+      void adapter.publish(
+        STORE + name + ":" + change.id,
+        serializer.encode({
+          t: "sch",
+          n: name,
+          id: change.id,
+          u: change.update,
+          o: change.origin,
+          nd: instanceId
+        })
+      );
+    });
+  }
+  function handleStoreRelay(channel, payload) {
+    const set = members.get(channel);
+    if (set) for (const conn of set) conn.sendRaw(payload);
+    let frame;
+    try {
+      frame = serializer.decode(payload);
+    } catch {
+      return;
+    }
+    if (frame.nd === instanceId) return;
+    const store = storeMap[frame.n];
+    if (!store || store.clustering !== "relay") return;
+    relaying = true;
+    try {
+      void store.apply({ id: frame.id, update: frame.u, origin: frame.o });
+    } catch {
+    } finally {
+      relaying = false;
+    }
+  }
   function room(name) {
     const channel = ROOM + name;
     return {
@@ -745,6 +857,45 @@ function createSuperLineServer(contract, opts) {
       void adapter.publish(CONN + id, serializer.encode(env));
     });
   }
+  const storeApi = {};
+  for (const [name, store] of Object.entries(storeMap)) {
+    const readOrThrow = async (id) => {
+      const r = await store.read(id);
+      if (!r) throw new SuperLineError("NOT_FOUND", `No resource: ${name}/${id}`);
+      return r;
+    };
+    storeApi[name] = {
+      async create(id, data, accessRules) {
+        await store.create(id, data, accessRules);
+      },
+      read(id) {
+        return Promise.resolve(store.read(id));
+      },
+      async write(id, data) {
+        await store.apply({ id, update: data, origin: SERVER_ORIGIN });
+        if (inspectorEnabled)
+          emitInspectorEvent({ type: "store.write", store: name, id, origin: SERVER_ORIGIN, data: safeSnapshot(data) });
+      },
+      async grant(id, principal, perms) {
+        const r = await readOrThrow(id);
+        await store.setAccess(id, { ...r.accessRules, [principal]: perms });
+        if (inspectorEnabled) emitInspectorEvent({ type: "store.grant", store: name, id, principal, perms });
+      },
+      async revoke(id, principal) {
+        const r = await readOrThrow(id);
+        const next = { ...r.accessRules };
+        delete next[principal];
+        await store.setAccess(id, next);
+        if (inspectorEnabled) emitInspectorEvent({ type: "store.revoke", store: name, id, principal });
+      },
+      async delete(id) {
+        await store.delete(id);
+      },
+      list() {
+        return Promise.resolve(store.list());
+      }
+    };
+  }
   const api = {
     nodeId: instanceId,
     nodeName,
@@ -826,6 +977,11 @@ function createSuperLineServer(contract, opts) {
         }
       };
     },
+    store(name) {
+      const handle = storeApi[name];
+      if (!handle) throw new SuperLineError("NOT_FOUND", `Store not configured: ${name}`);
+      return handle;
+    },
     async close() {
       if (closing) return;
       closing = true;
@@ -843,5 +999,6 @@ export {
   Conn,
   MemoryBus,
   createInMemoryAdapter,
-  createSuperLineServer
+  createSuperLineServer,
+  resolvePrincipal
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@super-line/server",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "description": "Typesafe WebSocket server for super-line — rooms, topics, middleware, pluggable adapters.",
   "license": "MIT",
@@ -47,7 +47,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@super-line/core": "^0.4.0"
+    "@super-line/core": "^0.5.0"
   },
   "devDependencies": {
     "@chainsafe/libp2p-noise": "^17.0.0",
@@ -68,14 +68,14 @@
     "zeromq": "^6.0.0",
     "zod": "^3.24.1",
     "zod-to-json-schema": "^3.25.2",
-    "@super-line/adapter-zeromq": "0.4.0",
-    "@super-line/adapter-libp2p": "0.4.0",
-    "@super-line/client": "0.4.0",
-    "@super-line/transport-http": "0.4.0",
-    "@super-line/transport-loopback": "0.4.0",
-    "@super-line/transport-websocket": "0.4.0",
-    "@super-line/adapter-rabbitmq": "0.4.0",
-    "@super-line/adapter-redis": "0.4.0"
+    "@super-line/adapter-libp2p": "0.5.0",
+    "@super-line/adapter-zeromq": "0.5.0",
+    "@super-line/adapter-rabbitmq": "0.5.0",
+    "@super-line/transport-http": "0.5.0",
+    "@super-line/transport-loopback": "0.5.0",
+    "@super-line/adapter-redis": "0.5.0",
+    "@super-line/client": "0.5.0",
+    "@super-line/transport-websocket": "0.5.0"
   },
   "optionalDependencies": {
     "@standard-community/standard-json": "^0.3.5"