@syncular/server-hono 0.0.6-159 → 0.0.6-165

package/dist/routes.js

@@ -6,12 +6,13 @@
  * - GET  /snapshot-chunks/:chunkId (download encoded snapshot chunks)
  * - GET  /realtime (optional WebSocket "wake up" notifications)
  */
-import { captureSyncException, countSyncMetric, createSyncTimer, distributionSyncMetric, ErrorResponseSchema, logSyncEvent, SyncCombinedRequestSchema, SyncCombinedResponseSchema, SyncPushRequestSchema, } from '@syncular/core';
-import { createServerHandlerCollection, InvalidSubscriptionScopeError, maybeCompactChanges, maybePruneSync, pull, pushCommit, readSnapshotChunk, recordClientCursor, } from '@syncular/server';
+import { captureSyncException, countSyncMetric, createSyncTimer, distributionSyncMetric, ErrorResponseSchema, logSyncEvent, ScopeValuesSchema, SyncCombinedRequestSchema, SyncCombinedResponseSchema, SyncPushRequestSchema, } from '@syncular/core';
+import { createServerHandlerCollection, InvalidSubscriptionScopeError, maybeCompactChanges, maybePruneSync, parseJsonValue, pull, pushCommit, readSnapshotChunk, recordClientCursor, resolveEffectiveScopesForSubscriptions, scopesToSnapshotChunkScopeKey, } from '@syncular/server';
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator as zValidator } from 'hono-openapi';
 import { sql, } from 'kysely';
 import { z } from 'zod';
+import { isBenignConsoleSchemaError } from './console/schema-errors.js';
 import { createRateLimiter, DEFAULT_SYNC_RATE_LIMITS, } from './rate-limit.js';
 import { createWebSocketConnection, WebSocketConnectionManager, } from './ws.js';
 /**
@@ -25,6 +26,9 @@ const realtimeUnsubscribeMap = new WeakMap();
 const snapshotChunkParamsSchema = z.object({
     chunkId: z.string().min(1),
 });
+const snapshotChunkQuerySchema = z.object({
+    scopes: z.string().optional(),
+});
 const auditCommitListQuerySchema = z.object({
     limit: z.coerce.number().int().min(1).max(200).optional(),
     beforeCommitSeq: z.coerce.number().int().min(1).optional(),
@@ -65,6 +69,7 @@ const auditCommitDetailResponseSchema = z.object({
     changes: z.array(auditChangeSchema),
 });
 const DEFAULT_REQUEST_PAYLOAD_SNAPSHOT_MAX_BYTES = 128 * 1024;
+const SNAPSHOT_SCOPES_HEADER = 'x-syncular-snapshot-scopes';
 function createOpaqueId(prefix) {
     const randomPart = typeof crypto !== 'undefined' && 'randomUUID' in crypto
         ? crypto.randomUUID()
@@ -218,6 +223,16 @@ function countPullRows(response) {
         return totalRows + commitRows + snapshotRows;
     }, 0);
 }
+function readSnapshotScopeValues(c, queryScopes) {
+    const rawValue = queryScopes ?? c.req.header(SNAPSHOT_SCOPES_HEADER);
+    if (!rawValue)
+        return null;
+    const parsed = parseJsonValue(rawValue);
+    const validated = ScopeValuesSchema.safeParse(parsed);
+    if (!validated.success)
+        return null;
+    return validated.data;
+}
 function encodePayloadSnapshot(value, maxBytes) {
     try {
         const serialized = JSON.stringify(value);
@@ -282,6 +297,9 @@ export function createSyncRoutes(options) {
             Promise.resolve())
         : Promise.resolve();
     const consoleSchemaReady = consoleSchemaReadyBase.catch((error) => {
+        if (isBenignConsoleSchemaError(error)) {
+            return;
+        }
         logSyncEvent({
             event: 'sync.console_schema_ready_failed',
             error: error instanceof Error ? error.message : String(error),
@@ -469,6 +487,133 @@ export function createSyncRoutes(options) {
             });
         });
     };
+    async function executePushCommitWithSideEffects(ctx, pushBody, execOptions = {}) {
+        const timer = createSyncTimer();
+        const pushOps = pushBody.operations ?? [];
+        const pushed = await pushCommit({
+            db: options.db,
+            dialect: options.dialect,
+            handlers: handlerRegistry,
+            plugins: options.plugins,
+            auth: ctx.auth,
+            request: {
+                clientId: ctx.clientId,
+                clientCommitId: pushBody.clientCommitId,
+                operations: pushBody.operations,
+                schemaVersion: pushBody.schemaVersion,
+            },
+        });
+        const pushDurationMs = timer();
+        logSyncEvent({
+            event: 'sync.push',
+            userId: ctx.auth.actorId,
+            durationMs: pushDurationMs,
+            operationCount: pushOps.length,
+            status: pushed.response.status,
+            commitSeq: pushed.response.commitSeq,
+        });
+        recordRequestEventInBackground(() => ({
+            partitionId: ctx.partitionId,
+            requestId: ctx.requestId,
+            traceId: ctx.traceContext.traceId,
+            spanId: ctx.traceContext.spanId,
+            eventType: 'push',
+            syncPath: ctx.syncPath,
+            actorId: ctx.auth.actorId,
+            clientId: ctx.clientId,
+            transportPath: ctx.transportPath,
+            statusCode: 200,
+            outcome: pushed.response.status,
+            responseStatus: normalizeResponseStatus(200, pushed.response.status),
+            durationMs: pushDurationMs,
+            errorCode: firstPushErrorCode(pushed.response.results),
+            commitSeq: pushed.response.commitSeq,
+            operationCount: pushOps.length,
+            tables: pushed.affectedTables,
+            payloadSnapshot: shouldCaptureRequestPayloadSnapshots
+                ? {
+                    request: {
+                        clientId: ctx.clientId,
+                        clientCommitId: pushBody.clientCommitId,
+                        schemaVersion: pushBody.schemaVersion,
+                        operations: pushBody.operations,
+                    },
+                    response: pushed.response,
+                }
+                : null,
+        }));
+        emitConsoleLiveEvent(consoleLiveEmitter, 'push', () => ({
+            partitionId: ctx.partitionId,
+            requestId: ctx.requestId,
+            traceId: ctx.traceContext.traceId,
+            spanId: ctx.traceContext.spanId,
+            actorId: ctx.auth.actorId,
+            clientId: ctx.clientId,
+            transportPath: ctx.transportPath,
+            syncPath: ctx.syncPath,
+            outcome: pushed.response.status,
+            statusCode: 200,
+            durationMs: pushDurationMs,
+            commitSeq: pushed.response.commitSeq ?? null,
+            operationCount: pushOps.length,
+            tables: pushed.affectedTables,
+        }));
+        if (execOptions.countConflictsMetric === true) {
+            const detectedConflicts = pushed.response.results.reduce((count, result) => count + (result.status === 'conflict' ? 1 : 0), 0);
+            if (detectedConflicts > 0) {
+                countSyncMetric('sync.conflicts.detected', detectedConflicts, {
+                    attributes: {
+                        syncPath: ctx.syncPath,
+                        transportPath: ctx.transportPath,
+                    },
+                });
+            }
+        }
+        if (wsConnectionManager &&
+            pushed.response.ok === true &&
+            pushed.response.status === 'applied' &&
+            typeof pushed.response.commitSeq === 'number') {
+            const scopeKeys = applyPartitionToScopeKeys(ctx.partitionId, pushed.scopeKeys);
+            if (scopeKeys.length > 0) {
+                wsConnectionManager.notifyScopeKeys(scopeKeys, pushed.response.commitSeq, {
+                    excludeClientIds: [ctx.clientId],
+                    changes: pushed.emittedChanges,
+                    actorId: pushed.commitActorId ?? ctx.auth.actorId,
+                    createdAt: pushed.commitCreatedAt ?? new Date().toISOString(),
+                });
+                if (realtimeBroadcaster) {
+                    realtimeBroadcaster
+                        .publish({
+                        type: 'commit',
+                        commitSeq: pushed.response.commitSeq,
+                        partitionId: ctx.partitionId,
+                        scopeKeys,
+                        sourceInstanceId: instanceId,
+                    })
+                        .catch((error) => {
+                        logAsyncFailureOnce('sync.realtime.broadcast_publish_failed', {
+                            event: 'sync.realtime.broadcast_publish_failed',
+                            userId: ctx.auth.actorId,
+                            clientId: ctx.clientId,
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                    });
+                }
+            }
+        }
+        if (pushed.response.ok === true &&
+            pushed.response.status === 'applied' &&
+            typeof pushed.response.commitSeq === 'number') {
+            emitConsoleLiveEvent(consoleLiveEmitter, 'commit', () => ({
+                partitionId: ctx.partitionId,
+                commitSeq: pushed.response.commitSeq,
+                actorId: ctx.auth.actorId,
+                clientId: ctx.clientId,
+                affectedTables: pushed.affectedTables,
+            }));
+        }
+        return pushed;
+    }
     const authCache = new WeakMap();
     const getAuth = (c) => {
         const cached = authCache.get(c);
@@ -713,8 +858,8 @@ export function createSyncRoutes(options) {
                 rowId: change.row_id,
                 op: change.op,
                 rowVersion: change.row_version === null ? null : Number(change.row_version),
-                rowJson: parseJsonColumn(change.row_json),
-                scopes: parseJsonColumn(change.scopes),
+                rowJson: parseJsonValue(change.row_json),
+                scopes: parseJsonValue(change.scopes),
             })),
         }, 200);
     });
@@ -752,6 +897,7 @@ export function createSyncRoutes(options) {
         if (!auth)
             return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const partitionId = auth.partitionId ?? 'default';
+        const transportPath = readTransportPath(c);
         const body = c.req.valid('json');
         const clientId = body.clientId;
         const requestId = readRequestId(c);
@@ -768,119 +914,15 @@ export function createSyncRoutes(options) {
                     message: `Maximum ${maxOperationsPerPush} operations per push`,
                 }, 400);
             }
-            const timer = createSyncTimer();
-            const pushed = await pushCommit({
-                db: options.db,
-                dialect: options.dialect,
-                handlers: handlerRegistry,
-                plugins: options.plugins,
+            const pushed = await executePushCommitWithSideEffects({
                 auth,
-                request: {
-                    clientId,
-                    clientCommitId: pushBody.clientCommitId,
-                    operations: pushBody.operations,
-                    schemaVersion: pushBody.schemaVersion,
-                },
-            });
-            const pushDurationMs = timer();
-            logSyncEvent({
-                event: 'sync.push',
-                userId: auth.actorId,
-                durationMs: pushDurationMs,
-                operationCount: pushOps.length,
-                status: pushed.response.status,
-                commitSeq: pushed.response.commitSeq,
-            });
-            recordRequestEventInBackground(() => ({
-                partitionId,
-                requestId,
-                traceId: traceContext.traceId,
-                spanId: traceContext.spanId,
-                eventType: 'push',
-                syncPath: 'http-combined',
-                actorId: auth.actorId,
                 clientId,
-                transportPath: readTransportPath(c),
-                statusCode: 200,
-                outcome: pushed.response.status,
-                responseStatus: normalizeResponseStatus(200, pushed.response.status),
-                durationMs: pushDurationMs,
-                errorCode: firstPushErrorCode(pushed.response.results),
-                commitSeq: pushed.response.commitSeq,
-                operationCount: pushOps.length,
-                tables: pushed.affectedTables,
-                payloadSnapshot: shouldCaptureRequestPayloadSnapshots
-                    ? {
-                        request: {
-                            clientId,
-                            clientCommitId: pushBody.clientCommitId,
-                            schemaVersion: pushBody.schemaVersion,
-                            operations: pushBody.operations,
-                        },
-                        response: pushed.response,
-                    }
-                    : null,
-            }));
-            emitConsoleLiveEvent(consoleLiveEmitter, 'push', () => ({
                 partitionId,
                 requestId,
-                traceId: traceContext.traceId,
-                spanId: traceContext.spanId,
-                actorId: auth.actorId,
-                clientId,
-                transportPath: readTransportPath(c),
+                traceContext,
+                transportPath,
                 syncPath: 'http-combined',
-                outcome: pushed.response.status,
-                statusCode: 200,
-                durationMs: pushDurationMs,
-                commitSeq: pushed.response.commitSeq ?? null,
-                operationCount: pushOps.length,
-                tables: pushed.affectedTables,
-            }));
-            // WS notifications
-            if (wsConnectionManager &&
-                pushed.response.ok === true &&
-                pushed.response.status === 'applied' &&
-                typeof pushed.response.commitSeq === 'number') {
-                const scopeKeys = applyPartitionToScopeKeys(partitionId, pushed.scopeKeys);
-                if (scopeKeys.length > 0) {
-                    wsConnectionManager.notifyScopeKeys(scopeKeys, pushed.response.commitSeq, {
-                        excludeClientIds: [clientId],
-                        changes: pushed.emittedChanges,
-                        actorId: pushed.commitActorId ?? auth.actorId,
-                        createdAt: pushed.commitCreatedAt ?? new Date().toISOString(),
-                    });
-                    if (realtimeBroadcaster) {
-                        realtimeBroadcaster
-                            .publish({
-                            type: 'commit',
-                            commitSeq: pushed.response.commitSeq,
-                            partitionId,
-                            scopeKeys,
-                            sourceInstanceId: instanceId,
-                        })
-                            .catch((error) => {
-                            logAsyncFailureOnce('sync.realtime.broadcast_publish_failed', {
-                                event: 'sync.realtime.broadcast_publish_failed',
-                                userId: auth.actorId,
-                                clientId,
-                                error: error instanceof Error ? error.message : String(error),
-                            });
-                        });
-                    }
-                }
-            }
-            if (pushed.response.ok === true &&
-                pushed.response.status === 'applied' &&
-                typeof pushed.response.commitSeq === 'number') {
-                emitConsoleLiveEvent(consoleLiveEmitter, 'commit', () => ({
-                    partitionId,
-                    commitSeq: pushed.response.commitSeq,
-                    actorId: auth.actorId,
-                    clientId,
-                    affectedTables: pushed.affectedTables,
-                }));
-            }
+            }, pushBody);
             pushResponse = pushed.response;
         }
         // --- Pull phase ---
@@ -1005,7 +1047,7 @@ export function createSyncRoutes(options) {
                     syncPath: 'http-combined',
                     actorId: auth.actorId,
                     clientId,
-                    transportPath: readTransportPath(c),
+                    transportPath,
                     statusCode: 200,
                     outcome: 'applied',
                     responseStatus: normalizeResponseStatus(200, 'applied'),
@@ -1027,7 +1069,7 @@ export function createSyncRoutes(options) {
                     spanId: traceContext.spanId,
                     actorId: auth.actorId,
                     clientId,
-                    transportPath: readTransportPath(c),
+                    transportPath,
                     syncPath: 'http-combined',
                     outcome: 'applied',
                     statusCode: 200,
@@ -1088,11 +1130,13 @@ export function createSyncRoutes(options) {
                 },
             },
         },
-    }), zValidator('param', snapshotChunkParamsSchema), async (c) => {
+    }), zValidator('param', snapshotChunkParamsSchema), zValidator('query', snapshotChunkQuerySchema), async (c) => {
         const auth = await getAuth(c);
         if (!auth)
             return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const partitionId = auth.partitionId ?? 'default';
+        const query = c.req.valid('query');
+        const requestedChunkScopes = readSnapshotScopeValues(c, query.scopes);
         const { chunkId } = c.req.valid('param');
         const chunk = await readSnapshotChunk(options.db, chunkId, {
             chunkStorage: options.chunkStorage,
@@ -1106,9 +1150,38 @@ export function createSyncRoutes(options) {
         if (chunk.expiresAt <= nowIso) {
             return c.json({ error: 'NOT_FOUND' }, 404);
         }
-        // Note: Snapshot chunks are created during authorized pull requests
-        // and have opaque IDs that expire. Additional authorization is handled
-        // at the pull layer via table-level resolveScopes.
+        if (requestedChunkScopes) {
+            try {
+                const resolved = await resolveEffectiveScopesForSubscriptions({
+                    db: options.db,
+                    auth,
+                    subscriptions: [
+                        {
+                            id: 'snapshot-chunk-authz',
+                            table: chunk.scope,
+                            scopes: requestedChunkScopes,
+                            cursor: 0,
+                        },
+                    ],
+                    handlers: handlerRegistry,
+                    scopeCache: options.scopeCache,
+                });
+                const scopeAuth = resolved[0];
+                if (!scopeAuth || scopeAuth.status !== 'active') {
+                    return c.json({ error: 'FORBIDDEN' }, 403);
+                }
+                const scopeKey = `${partitionId}:${await scopesToSnapshotChunkScopeKey(scopeAuth.scopes)}`;
+                if (scopeKey !== chunk.scopeKey) {
+                    return c.json({ error: 'FORBIDDEN' }, 403);
+                }
+            }
+            catch (error) {
+                if (error instanceof InvalidSubscriptionScopeError) {
+                    return c.json({ error: 'FORBIDDEN' }, 403);
+                }
+                throw error;
+            }
+        }
         const etag = `"sha256:${chunk.sha256}"`;
         const ifNoneMatch = c.req.header('if-none-match');
         if (ifNoneMatch && ifNoneMatch === etag) {
@@ -1145,6 +1218,9 @@ export function createSyncRoutes(options) {
             const auth = await getAuth(c);
             if (!auth)
                 return c.json({ error: 'UNAUTHENTICATED' }, 401);
+            if (!isWebSocketOriginAllowed(c, websocketConfig.allowedOrigins)) {
+                return c.json({ error: 'FORBIDDEN_ORIGIN' }, 403);
+            }
             const partitionId = auth.partitionId ?? 'default';
             const clientId = c.req.query('clientId');
             if (!clientId || typeof clientId !== 'string') {
@@ -1184,6 +1260,11 @@ export function createSyncRoutes(options) {
             }
             const maxConnectionsTotal = websocketConfig.maxConnectionsTotal ?? 5000;
             const maxConnectionsPerClient = websocketConfig.maxConnectionsPerClient ?? 3;
+            const maxMessageBytes = websocketConfig.maxMessageBytes ?? 1024 * 1024;
+            const maxMessagesPerWindow = websocketConfig.maxMessagesPerWindow ?? 120;
+            const messageRateWindowMs = websocketConfig.messageRateWindowMs ?? 10000;
+            let messageRateWindowStartedAtMs = Date.now();
+            let messageRateWindowCount = 0;
             if (maxConnectionsTotal > 0 &&
                 wsConnectionManager.getTotalConnections() >= maxConnectionsTotal) {
                 logSyncEvent({
@@ -1231,6 +1312,30 @@ export function createSyncRoutes(options) {
                     },
                 });
             };
+            const teardownRealtimeConnection = (args) => {
+                unregister?.();
+                unregister = null;
+                connRef = null;
+                finishRealtimeSession(args.reason);
+                logSyncEvent({
+                    event: 'sync.realtime.disconnect',
+                    userId: auth.actorId,
+                });
+                emitConsoleLiveEvent(consoleLiveEmitter, 'client_update', () => ({
+                    action: args.action,
+                    actorId: auth.actorId,
+                    clientId,
+                    partitionId,
+                }));
+            };
+            const logPresenceRejected = (scopeKey) => {
+                logSyncEvent({
+                    event: 'sync.realtime.presence.rejected',
+                    userId: auth.actorId,
+                    reason: 'scope_not_authorized',
+                    scopeKey,
+                });
+            };
             const upgradeWebSocket = websocketConfig.upgradeWebSocket;
             if (!upgradeWebSocket) {
                 return c.json({ error: 'WEBSOCKET_NOT_CONFIGURED' }, 500);
@@ -1269,41 +1374,38 @@ export function createSyncRoutes(options) {
                     }));
                 },
                 onClose(_evt, _ws) {
-                    unregister?.();
-                    unregister = null;
-                    connRef = null;
-                    finishRealtimeSession('closed');
-                    logSyncEvent({
-                        event: 'sync.realtime.disconnect',
-                        userId: auth.actorId,
-                    });
-                    emitConsoleLiveEvent(consoleLiveEmitter, 'client_update', () => ({
+                    teardownRealtimeConnection({
+                        reason: 'closed',
                         action: 'realtime_disconnected',
-                        actorId: auth.actorId,
-                        clientId,
-                        partitionId,
-                    }));
+                    });
                 },
                 onError(_evt, _ws) {
-                    unregister?.();
-                    unregister = null;
-                    connRef = null;
-                    finishRealtimeSession('error');
-                    logSyncEvent({
-                        event: 'sync.realtime.disconnect',
-                        userId: auth.actorId,
-                    });
-                    emitConsoleLiveEvent(consoleLiveEmitter, 'client_update', () => ({
+                    teardownRealtimeConnection({
+                        reason: 'error',
                         action: 'realtime_error',
-                        actorId: auth.actorId,
-                        clientId,
-                        partitionId,
-                    }));
+                    });
                 },
                 onMessage(evt, _ws) {
                     if (!connRef)
                         return;
                     try {
+                        const messageBytes = measureWebSocketMessageBytes(evt.data);
+                        if (messageBytes > maxMessageBytes) {
+                            connRef.sendError(`WebSocket message exceeds max size (${maxMessageBytes} bytes)`);
+                            return;
+                        }
+                        if (maxMessagesPerWindow > 0 && messageRateWindowMs > 0) {
+                            const nowMs = Date.now();
+                            if (nowMs - messageRateWindowStartedAtMs >= messageRateWindowMs) {
+                                messageRateWindowStartedAtMs = nowMs;
+                                messageRateWindowCount = 0;
+                            }
+                            messageRateWindowCount += 1;
+                            if (messageRateWindowCount > maxMessagesPerWindow) {
+                                connRef.sendError(`WebSocket message rate exceeded (${maxMessagesPerWindow}/${messageRateWindowMs}ms)`);
+                                return;
+                            }
+                        }
                         const raw = typeof evt.data === 'string' ? evt.data : String(evt.data);
                         const msg = JSON.parse(raw);
                         if (!msg || typeof msg !== 'object')
@@ -1320,12 +1422,7 @@ export function createSyncRoutes(options) {
                         switch (msg.action) {
                             case 'join':
                                 if (!wsConnectionManager.joinPresence(clientId, scopeKey, msg.metadata)) {
-                                    logSyncEvent({
-                                        event: 'sync.realtime.presence.rejected',
-                                        userId: auth.actorId,
-                                        reason: 'scope_not_authorized',
-                                        scopeKey,
-                                    });
+                                    logPresenceRejected(scopeKey);
                                     return;
                                 }
                                 // Send presence snapshot back to the joining client
@@ -1344,12 +1441,7 @@ export function createSyncRoutes(options) {
                             case 'update':
                                 if (!wsConnectionManager.updatePresenceMetadata(clientId, scopeKey, msg.metadata ?? {}) &&
                                     !wsConnectionManager.isClientSubscribedToScopeKey(clientId, scopeKey)) {
-                                    logSyncEvent({
-                                        event: 'sync.realtime.presence.rejected',
-                                        userId: auth.actorId,
-                                        reason: 'scope_not_authorized',
-                                        scopeKey,
-                                    });
+                                    logPresenceRejected(scopeKey);
                                 }
                                 break;
                         }
@@ -1361,7 +1453,6 @@ export function createSyncRoutes(options) {
             });
         });
     }
-    return routes;
     async function handleRealtimeEvent(event) {
         if (!wsConnectionManager)
             return;
@@ -1378,6 +1469,42 @@ export function createSyncRoutes(options) {
             return;
         wsConnectionManager.notifyScopeKeys(scopeKeys, commitSeq);
     }
+    const recordWsPushFailure = (args) => {
+        recordRequestEventInBackground(() => ({
+            partitionId: args.partitionId,
+            requestId: args.requestId,
+            traceId: args.traceContext.traceId,
+            spanId: args.traceContext.spanId,
+            eventType: 'push',
+            syncPath: 'ws-push',
+            actorId: args.actorId,
+            clientId: args.clientId,
+            transportPath: args.transportPath,
+            statusCode: args.statusCode,
+            outcome: args.outcome,
+            responseStatus: normalizeResponseStatus(args.statusCode, args.outcome),
+            durationMs: args.durationMs,
+            errorCode: args.errorCode,
+            errorMessage: args.errorMessage,
+            operationCount: args.operationCount ?? null,
+            payloadSnapshot: args.payloadSnapshot ?? null,
+        }));
+        emitConsoleLiveEvent(consoleLiveEmitter, 'push', () => ({
+            partitionId: args.partitionId,
+            requestId: args.requestId,
+            traceId: args.traceContext.traceId,
+            spanId: args.traceContext.spanId,
+            actorId: args.actorId,
+            clientId: args.clientId,
+            transportPath: args.transportPath,
+            syncPath: 'ws-push',
+            outcome: args.outcome,
+            statusCode: args.statusCode,
+            durationMs: args.durationMs,
+            operationCount: args.operationCount ?? null,
+            errorCode: args.errorCode,
+        }));
+    };
     async function handleWsPush(msg, conn, auth, clientId) {
         const actorId = auth.actorId;
         const partitionId = auth.partitionId ?? 'default';
@@ -1391,30 +1518,25 @@ export function createSyncRoutes(options) {
             const parsed = SyncPushRequestSchema.omit({ clientId: true }).safeParse(msg);
             if (!parsed.success) {
                 const invalidDurationMs = timer();
+                const errorMessage = 'Invalid push payload';
                 conn.sendPushResponse({
                     requestId,
                     ok: false,
                     status: 'rejected',
-                    results: [
-                        { opIndex: 0, status: 'error', error: 'Invalid push payload' },
-                    ],
+                    results: [{ opIndex: 0, status: 'error', error: errorMessage }],
                 });
-                recordRequestEventInBackground(() => ({
+                recordWsPushFailure({
                     partitionId,
                     requestId,
-                    traceId: traceContext.traceId,
-                    spanId: traceContext.spanId,
-                    eventType: 'push',
-                    syncPath: 'ws-push',
                     actorId,
                     clientId,
                     transportPath: conn.transportPath,
                     statusCode: 400,
                     outcome: 'rejected',
-                    responseStatus: normalizeResponseStatus(400, 'rejected'),
                     durationMs: invalidDurationMs,
                     errorCode: 'INVALID_PUSH_PAYLOAD',
-                    errorMessage: 'Invalid push payload',
+                    errorMessage,
+                    traceContext,
                     payloadSnapshot: shouldCaptureRequestPayloadSnapshots
                         ? {
                             request: msg,
@@ -1425,26 +1547,13 @@ export function createSyncRoutes(options) {
                             },
                         }
                         : null,
-                }));
-                emitConsoleLiveEvent(consoleLiveEmitter, 'push', () => ({
-                    partitionId,
-                    requestId,
-                    traceId: traceContext.traceId,
-                    spanId: traceContext.spanId,
-                    actorId,
-                    clientId,
-                    transportPath: conn.transportPath,
-                    syncPath: 'ws-push',
-                    outcome: 'rejected',
-                    statusCode: 400,
-                    durationMs: invalidDurationMs,
-                    errorCode: 'INVALID_PUSH_PAYLOAD',
-                }));
+                });
                 return;
             }
             const pushOps = parsed.data.operations ?? [];
             if (pushOps.length > maxOperationsPerPush) {
                 const rejectedDurationMs = timer();
+                const errorMessage = `Maximum ${maxOperationsPerPush} operations per push`;
                 conn.sendPushResponse({
                     requestId,
                     ok: false,
@@ -1453,26 +1562,22 @@ export function createSyncRoutes(options) {
                         {
                             opIndex: 0,
                             status: 'error',
-                            error: `Maximum ${maxOperationsPerPush} operations per push`,
+                            error: errorMessage,
                         },
                     ],
                 });
-                recordRequestEventInBackground(() => ({
+                recordWsPushFailure({
                     partitionId,
                     requestId,
-                    traceId: traceContext.traceId,
-                    spanId: traceContext.spanId,
-                    eventType: 'push',
-                    syncPath: 'ws-push',
                     actorId,
                     clientId,
                     transportPath: conn.transportPath,
                     statusCode: 400,
                     outcome: 'rejected',
-                    responseStatus: normalizeResponseStatus(400, 'rejected'),
                     durationMs: rejectedDurationMs,
                     errorCode: 'MAX_OPERATIONS_EXCEEDED',
-                    errorMessage: `Maximum ${maxOperationsPerPush} operations per push`,
+                    errorMessage,
+                    traceContext,
                     operationCount: pushOps.length,
                     payloadSnapshot: shouldCaptureRequestPayloadSnapshots
                         ? {
@@ -1489,145 +1594,22 @@ export function createSyncRoutes(options) {
                             },
                         }
                         : null,
-                }));
-                emitConsoleLiveEvent(consoleLiveEmitter, 'push', () => ({
-                    partitionId,
-                    requestId,
-                    traceId: traceContext.traceId,
-                    spanId: traceContext.spanId,
-                    actorId,
-                    clientId,
-                    transportPath: conn.transportPath,
-                    syncPath: 'ws-push',
-                    outcome: 'rejected',
-                    statusCode: 400,
-                    durationMs: rejectedDurationMs,
-                    operationCount: pushOps.length,
-                    errorCode: 'MAX_OPERATIONS_EXCEEDED',
-                }));
+                });
                 return;
             }
-            const pushed = await pushCommit({
-                db: options.db,
-                dialect: options.dialect,
-                handlers: handlerRegistry,
-                plugins: options.plugins,
+            const pushed = await executePushCommitWithSideEffects({
                 auth,
-                request: {
-                    clientId,
-                    clientCommitId: parsed.data.clientCommitId,
-                    operations: parsed.data.operations,
-                    schemaVersion: parsed.data.schemaVersion,
-                },
-            });
-            const pushDurationMs = timer();
-            logSyncEvent({
-                event: 'sync.push',
-                userId: actorId,
-                durationMs: pushDurationMs,
-                operationCount: pushOps.length,
-                status: pushed.response.status,
-                commitSeq: pushed.response.commitSeq,
-            });
-            recordRequestEventInBackground(() => ({
-                partitionId,
-                requestId,
-                traceId: traceContext.traceId,
-                spanId: traceContext.spanId,
-                eventType: 'push',
-                syncPath: 'ws-push',
-                actorId,
                 clientId,
-                transportPath: conn.transportPath,
-                statusCode: 200,
-                outcome: pushed.response.status,
-                responseStatus: normalizeResponseStatus(200, pushed.response.status),
-                durationMs: pushDurationMs,
-                errorCode: firstPushErrorCode(pushed.response.results),
-                commitSeq: pushed.response.commitSeq,
-                operationCount: pushOps.length,
-                tables: pushed.affectedTables,
-                payloadSnapshot: shouldCaptureRequestPayloadSnapshots
-                    ? {
-                        request: {
-                            clientId,
-                            clientCommitId: parsed.data.clientCommitId,
-                            schemaVersion: parsed.data.schemaVersion,
-                            operations: parsed.data.operations,
-                        },
-                        response: pushed.response,
-                    }
-                    : null,
-            }));
-            emitConsoleLiveEvent(consoleLiveEmitter, 'push', () => ({
                 partitionId,
                 requestId,
-                traceId: traceContext.traceId,
-                spanId: traceContext.spanId,
-                actorId,
-                clientId,
+                traceContext,
                 transportPath: conn.transportPath,
                 syncPath: 'ws-push',
-                outcome: pushed.response.status,
-                statusCode: 200,
-                durationMs: pushDurationMs,
-                commitSeq: pushed.response.commitSeq ?? null,
-                operationCount: pushOps.length,
-                tables: pushed.affectedTables,
-            }));
-            const detectedConflicts = pushed.response.results.reduce((count, result) => count + (result.status === 'conflict' ? 1 : 0), 0);
-            if (detectedConflicts > 0) {
-                countSyncMetric('sync.conflicts.detected', detectedConflicts, {
-                    attributes: {
-                        syncPath: 'ws-push',
-                        transportPath: conn.transportPath,
-                    },
-                });
-            }
-            // WS notifications to other clients
-            if (wsConnectionManager &&
-                pushed.response.ok === true &&
-                pushed.response.status === 'applied' &&
-                typeof pushed.response.commitSeq === 'number') {
-                const scopeKeys = applyPartitionToScopeKeys(partitionId, pushed.scopeKeys);
-                if (scopeKeys.length > 0) {
-                    wsConnectionManager.notifyScopeKeys(scopeKeys, pushed.response.commitSeq, {
-                        excludeClientIds: [clientId],
-                        changes: pushed.emittedChanges,
-                        actorId: pushed.commitActorId ?? actorId,
-                        createdAt: pushed.commitCreatedAt ?? new Date().toISOString(),
-                    });
-                    if (realtimeBroadcaster) {
-                        realtimeBroadcaster
-                            .publish({
-                            type: 'commit',
-                            commitSeq: pushed.response.commitSeq,
-                            partitionId,
-                            scopeKeys,
-                            sourceInstanceId: instanceId,
-                        })
-                            .catch((error) => {
-                            logAsyncFailureOnce('sync.realtime.broadcast_publish_failed', {
-                                event: 'sync.realtime.broadcast_publish_failed',
-                                userId: actorId,
-                                clientId,
-                                error: error instanceof Error ? error.message : String(error),
-                            });
-                        });
-                    }
-                }
-            }
-            if (pushed.response.ok === true &&
-                pushed.response.status === 'applied' &&
-                typeof pushed.response.commitSeq === 'number') {
-                emitConsoleLiveEvent(consoleLiveEmitter, 'commit', () => ({
-                    partitionId,
-                    commitSeq: pushed.response.commitSeq,
-                    actorId,
-                    clientId,
-                    affectedTables: pushed.affectedTables,
-                }));
-            }
+            }, {
+                clientCommitId: parsed.data.clientCommitId,
+                operations: parsed.data.operations,
+                schemaVersion: parsed.data.schemaVersion,
+            }, { countConflictsMetric: true });
             triggerAutoMaintenance({
                 actorId,
                 clientId,
@@ -1651,22 +1633,18 @@ export function createSyncRoutes(options) {
                 partitionId,
             });
             const message = err instanceof Error ? err.message : 'Internal server error';
-            recordRequestEventInBackground(() => ({
+            recordWsPushFailure({
                 partitionId,
                 requestId,
-                traceId: traceContext.traceId,
-                spanId: traceContext.spanId,
-                eventType: 'push',
-                syncPath: 'ws-push',
                 actorId,
                 clientId,
                 transportPath: conn.transportPath,
                 statusCode: 500,
                 outcome: 'error',
-                responseStatus: normalizeResponseStatus(500, 'error'),
                 durationMs: failedDurationMs,
                 errorCode: 'INTERNAL_SERVER_ERROR',
                 errorMessage: message,
+                traceContext,
                 payloadSnapshot: shouldCaptureRequestPayloadSnapshots
                     ? {
                         request: msg,
@@ -1678,21 +1656,7 @@ export function createSyncRoutes(options) {
                         },
                     }
                     : null,
-            }));
-            emitConsoleLiveEvent(consoleLiveEmitter, 'push', () => ({
-                partitionId,
-                requestId,
-                traceId: traceContext.traceId,
-                spanId: traceContext.spanId,
-                actorId,
-                clientId,
-                transportPath: conn.transportPath,
-                syncPath: 'ws-push',
-                outcome: 'error',
-                statusCode: 500,
-                durationMs: failedDurationMs,
-                errorCode: 'INTERNAL_SERVER_ERROR',
-            }));
+            });
             conn.sendPushResponse({
                 requestId,
                 ok: false,
@@ -1701,6 +1665,7 @@ export function createSyncRoutes(options) {
             });
         }
     }
+    return routes;
 }
 export function getSyncWebSocketConnectionManager(routes) {
     return wsConnectionManagerMap.get(routes);
@@ -1711,6 +1676,37 @@ export function getSyncRealtimeUnsubscribe(routes) {
 function clampInt(value, min, max) {
     return Math.max(min, Math.min(max, value));
 }
+function isWebSocketOriginAllowed(c, allowedOrigins) {
+    if (!allowedOrigins)
+        return true;
+    if (allowedOrigins === '*')
+        return true;
+    const origin = c.req.header('origin');
+    if (!origin)
+        return false;
+    try {
+        const normalizedOrigin = new URL(origin).origin;
+        return allowedOrigins.includes(normalizedOrigin);
+    }
+    catch {
+        return false;
+    }
+}
+function measureWebSocketMessageBytes(data) {
+    if (typeof data === 'string') {
+        return new TextEncoder().encode(data).byteLength;
+    }
+    if (data instanceof ArrayBuffer) {
+        return data.byteLength;
+    }
+    if (ArrayBuffer.isView(data)) {
+        return data.byteLength;
+    }
+    if (typeof Blob !== 'undefined' && data instanceof Blob) {
+        return data.size;
+    }
+    return new TextEncoder().encode(String(data)).byteLength;
+}
 function readTransportPath(c, queryValue) {
     if (queryValue === 'relay' || queryValue === 'direct') {
         return queryValue;
@@ -1721,16 +1717,6 @@ function readTransportPath(c, queryValue) {
     }
     return 'direct';
 }
-function parseJsonColumn(value) {
-    if (typeof value !== 'string')
-        return value;
-    try {
-        return JSON.parse(value);
-    }
-    catch {
-        return value;
-    }
-}
 function scopeValuesToScopeKeys(scopes) {
     if (!scopes || typeof scopes !== 'object')
         return [];