@syncular/server 0.0.6-96 → 0.1.1

package/dist/hono/routes/shared.d.ts

@@ -0,0 +1,689 @@
+/**
+ * Shared private helpers, constants, option types, and zod schemas used by the
+ * sync route modules. Extracted verbatim from routes.ts.
+ */
+import { type ScopeValues, type StoredScopes, type SyncAuthLeaseCapabilities } from '@syncular/core';
+import type { ScopeCacheBackend, ServerSnapshotBinaryMetadata, ServerSyncDialect, ServerTableHandler, SnapshotArtifactStorage, SnapshotChunkStorage, SqlFamily, SyncCoreDb, SyncRealtimeBroadcaster, SyncServerAuth, SyncServerPushPlugin } from '@syncular/server';
+import { type AuthLeaseSigner, type CompactOptions, type PruneOptions, type PullResult } from '@syncular/server';
+import type { Context, Hono } from 'hono';
+import type { UpgradeWebSocket } from 'hono/ws';
+import { type Kysely } from 'kysely';
+import { z } from 'zod';
+import type { SyncRateLimitConfig } from '../rate-limit';
+import type { WebSocketConnectionManager, WebSocketRealtimeSubscription } from '../ws';
+/**
+ * WeakMaps for storing Hono-instance-specific data without augmenting the type.
+ */
+declare const wsConnectionManagerMap: WeakMap<Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">, WebSocketConnectionManager>;
+declare const realtimeUnsubscribeMap: WeakMap<Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">, () => void>;
+export { realtimeUnsubscribeMap, wsConnectionManagerMap };
+export interface SyncAuthResult extends SyncServerAuth {
+}
+/**
+ * WebSocket configuration for realtime sync.
+ */
+export interface SyncWebSocketConfig {
+    enabled?: boolean;
+    /**
+     * Runtime-provided WebSocket upgrader (e.g. from `hono/bun`'s `createBunWebSocket()`).
+     */
+    upgradeWebSocket?: UpgradeWebSocket;
+    heartbeatIntervalMs?: number;
+    /**
+     * Maximum number of concurrent WebSocket connections across the entire process.
+     * Default: 5000
+     */
+    maxConnectionsTotal?: number;
+    /**
+     * Maximum number of concurrent WebSocket connections per clientId.
+     * Default: 3
+     */
+    maxConnectionsPerClient?: number;
+    /**
+     * Maximum inbound websocket message size in bytes.
+     * Default: 1 MiB.
+     */
+    maxMessageBytes?: number;
+    /**
+     * Maximum encoded sync-pack size sent directly over a websocket frame.
+     * Larger payloads fall back to explicit HTTP pull recovery.
+     * Default: 64 KiB.
+     */
+    maxSyncPackBytes?: number;
+    /**
+     * Maximum inbound websocket messages allowed per connection within one window.
+     * Default: 120 messages.
+     * Set to 0 or a negative value to disable rate limiting.
+     */
+    maxMessagesPerWindow?: number;
+    /**
+     * Maximum outbound sync notifications allowed without a newer client ACK.
+     * When exceeded, the server sends cursor-only resync-required frames until
+     * the client ACKs a caught-up cursor. Set to 0 to disable.
+     * Default: 64.
+     */
+    maxInFlightSyncsPerConnection?: number;
+    /**
+     * Recent outbound scope notifications retained for websocket reconnect
+     * replay before falling back to HTTP pull recovery. Set to 0 to disable.
+     * Default: 64.
+     */
+    replayWindowSize?: number;
+    /**
+     * Window size in milliseconds for inbound websocket message rate limiting.
+     * Default: 10000 ms.
+     */
+    messageRateWindowMs?: number;
+    /**
+     * Optional list of allowed websocket origins.
+     * - undefined: allow same-origin browser upgrades and origin-less non-browser clients
+     * - '*': allow all origins
+     * - string[]: exact origin match (scheme + host + port)
+     */
+    allowedOrigins?: string[] | '*';
+}
+export type SyncCorsOriginResolver = (origin: string | undefined, context: Context) => boolean | string | null | undefined | Promise<boolean | string | null | undefined>;
+export type SyncCorsOrigin = string | string[] | '*' | SyncCorsOriginResolver;
+export interface SyncCorsOptions {
+    /**
+     * Hono-style origin config.
+     * - string / string[]: exact or wildcard origin patterns
+     * - '*': allow all origins
+     * - function: dynamic allow/deny decision
+     */
+    origin?: SyncCorsOrigin;
+    /**
+     * Additional request headers to allow. These are appended to the built-in
+     * Syncular transport and tracing headers, not used as a replacement.
+     */
+    allowHeaders?: string[];
+    /**
+     * Additional response headers exposed to the browser.
+     */
+    exposeHeaders?: string[];
+}
+export interface SyncRoutesConfigWithRateLimit {
+    /**
+     * Optional browser CORS handling for sync routes.
+     * When configured, sync route responses and preflights include matching
+     * CORS headers directly from the generated sync app.
+     */
+    cors?: SyncCorsOrigin | SyncCorsOptions;
+    /**
+     * Max commits per pull request.
+     * Default: 100
+     */
+    maxPullLimitCommits?: number;
+    /**
+     * Max subscriptions per pull request.
+     * Default: 200
+     */
+    maxSubscriptionsPerPull?: number;
+    /**
+     * Max snapshot rows per snapshot page.
+     * Default: 5000
+     */
+    maxPullLimitSnapshotRows?: number;
+    /**
+     * Max snapshot pages per subscription per pull response.
+     * Default: 50
+     */
+    maxPullMaxSnapshotPages?: number;
+    /**
+     * Gzip compression level for generated snapshot chunks.
+     *
+     * Default: 1, range: 0-9. Lower values reduce CPU and browser inflate time
+     * but increase response size.
+     */
+    snapshotChunkGzipLevel?: number;
+    /**
+     * Max operations per pushed commit.
+     * Default: 200
+     */
+    maxOperationsPerPush?: number;
+    /**
+     * Maximum JSON request body accepted by POST /.
+     * Default: 4 MiB.
+     */
+    maxSyncRequestJsonBytes?: number;
+    /**
+     * Maximum binary sync-pack response body emitted by POST /.
+     * Default: 16 MiB.
+     */
+    maxSyncBinaryPackBytes?: number;
+    /**
+     * Maximum snapshot chunk body emitted by GET /snapshot-chunks/:chunkId.
+     * Default: 64 MiB.
+     */
+    maxSnapshotChunkResponseBytes?: number;
+    /**
+     * Maximum snapshot artifact body emitted by GET /snapshot-artifacts/:artifactId.
+     * Default: 256 MiB.
+     */
+    maxSnapshotArtifactResponseBytes?: number;
+    /**
+     * Request/response payload snapshots recorded for console inspection.
+     */
+    requestPayloadSnapshots?: {
+        /**
+         * Enable payload snapshot storage in `sync_request_payloads`.
+         * Default: false (opt-in).
+         */
+        enabled?: boolean;
+        /**
+         * Max serialized payload size in bytes per request/response snapshot.
+         * Larger payloads are truncated with metadata.
+         * Default: 128 KiB.
+         */
+        maxBytes?: number;
+    };
+    /**
+     * Minimum Syncular client schema version accepted by this server.
+     * Clients with an older runtime must upgrade before continuing sync.
+     */
+    requiredSchemaVersion?: number;
+    /**
+     * Latest Syncular client schema version known by this server.
+     * Newer values are informational and should not block older compatible
+     * clients.
+     */
+    latestSchemaVersion?: number;
+    /**
+     * Rate limiting configuration.
+     * Set to false to disable all rate limiting.
+     */
+    rateLimit?: SyncRateLimitConfig | false;
+    /**
+     * WebSocket realtime configuration.
+     */
+    websocket?: SyncWebSocketConfig;
+    /**
+     * Optional pruning configuration. When enabled, the server periodically prunes
+     * old commit history based on active client cursors.
+     */
+    prune?: {
+        /** Minimum time between prune runs. Default: 5 minutes. */
+        minIntervalMs?: number;
+        /** Pruning watermark options. */
+        options?: PruneOptions;
+    };
+    /**
+     * Optional compaction configuration. When enabled, the server periodically
+     * compacts older change history to reduce storage.
+     */
+    compact?: {
+        /** Minimum time between compaction runs. Default: 30 minutes. */
+        minIntervalMs?: number;
+        /** Compaction options. */
+        options?: CompactOptions;
+    };
+    /**
+     * Optional multi-instance realtime broadcaster.
+     * When provided, instances publish/subscribe commit wakeups via the broadcaster.
+     */
+    realtime?: {
+        broadcaster: SyncRealtimeBroadcaster;
+        /** Optional stable instance id (useful in tests). */
+        instanceId?: string;
+    };
+}
+export interface SyncAuthLeaseRoutesConfig<Auth extends SyncAuthResult = SyncAuthResult> {
+    /**
+     * Set false to keep route config around without exposing the issue endpoint.
+     * Providing this config enables POST /auth-leases/issue by default.
+     */
+    enabled?: boolean;
+    issuer: string;
+    audience: string;
+    kid: string;
+    signer: AuthLeaseSigner;
+    publicKey: CryptoKey;
+    ttlMs?: number;
+    maxTtlMs?: number;
+    maxClockSkewMs?: number;
+    capabilities?: SyncAuthLeaseCapabilities;
+    nowMs?: () => number;
+    leaseId?: () => string;
+    subject?: (auth: Auth) => Record<string, unknown> | Promise<Record<string, unknown>>;
+}
+export interface CreateSyncRoutesOptions<DB extends SyncCoreDb = SyncCoreDb, Auth extends SyncAuthResult = SyncAuthResult, F extends SqlFamily = SqlFamily> {
+    db: Kysely<DB>;
+    dialect: ServerSyncDialect<F>;
+    handlers: ServerTableHandler<DB, Auth>[];
+    snapshotBinary?: ServerSnapshotBinaryMetadata;
+    plugins?: SyncServerPushPlugin<DB, Auth>[];
+    authenticate: (c: Context) => Promise<Auth | null>;
+    sync?: SyncRoutesConfigWithRateLimit;
+    authLeases?: SyncAuthLeaseRoutesConfig<Auth>;
+    wsConnectionManager?: WebSocketConnectionManager;
+    /**
+     * Optional snapshot chunk storage adapter.
+     * When provided, stores snapshot chunk bodies in external storage
+     * (S3, R2, etc.) instead of inline in the database.
+     */
+    chunkStorage?: SnapshotChunkStorage;
+    /**
+     * Optional scoped snapshot artifact body storage adapter.
+     * Artifact metadata is stored in SQL; bodies are always external.
+     */
+    snapshotArtifactStorage?: SnapshotArtifactStorage;
+    /**
+     * Optional scope cache backend for resolveScopes() results.
+     * Request-local memoization is always applied for every pull.
+     */
+    scopeCache?: ScopeCacheBackend;
+    /**
+     * Optional live emitter for console websocket activity feed.
+     * When provided, sync lifecycle events are published to `/console/events/live`.
+     */
+    consoleLiveEmitter?: {
+        emit(event: {
+            type: 'sync' | 'push' | 'pull' | 'commit' | 'client_update';
+            timestamp: string;
+            data: Record<string, unknown>;
+        }): void;
+    };
+    /**
+     * Optional console schema readiness promise.
+     * When provided, request-event recording waits for this promise before writing.
+     */
+    consoleSchemaReady?: Promise<void>;
+}
+export declare const snapshotChunkParamsSchema: z.ZodObject<{
+    chunkId: z.ZodString;
+}, z.core.$strip>;
+export declare const snapshotArtifactParamsSchema: z.ZodObject<{
+    artifactId: z.ZodString;
+}, z.core.$strip>;
+export declare const snapshotChunkQuerySchema: z.ZodObject<{
+    scopes: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const auditCommitListQuerySchema: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    beforeCommitSeq: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    actorId: z.ZodOptional<z.ZodString>;
+    table: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodString>;
+    to: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const auditCommitParamsSchema: z.ZodObject<{
+    commitSeq: z.ZodCoercedNumber<unknown>;
+}, z.core.$strip>;
+export declare const auditRowHistoryParamsSchema: z.ZodObject<{
+    table: z.ZodString;
+    rowId: z.ZodString;
+}, z.core.$strip>;
+export declare const auditRowHistoryQuerySchema: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    beforeCommitSeq: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    afterCommitSeq: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export declare const auditDebugExportQuerySchema: z.ZodObject<{
+    limitCommits: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    limitEvents: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    from: z.ZodOptional<z.ZodString>;
+    to: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const auditCommitListResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    commits: z.ZodArray<z.ZodObject<{
+        commitSeq: z.ZodNumber;
+        actorId: z.ZodString;
+        clientId: z.ZodString;
+        clientCommitId: z.ZodString;
+        createdAt: z.ZodString;
+        changeCount: z.ZodNumber;
+        affectedTables: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+declare const auditChangeSchema: z.ZodObject<{
+    changeId: z.ZodNumber;
+    table: z.ZodString;
+    rowId: z.ZodString;
+    op: z.ZodEnum<{
+        delete: "delete";
+        upsert: "upsert";
+    }>;
+    rowVersion: z.ZodNullable<z.ZodNumber>;
+    fields: z.ZodArray<z.ZodString>;
+    scopeFields: z.ZodArray<z.ZodString>;
+    changeKind: z.ZodEnum<{
+        app_row: "app_row";
+        blob_reference: "blob_reference";
+        delete: "delete";
+        encrypted_crdt_checkpoint: "encrypted_crdt_checkpoint";
+        encrypted_crdt_update: "encrypted_crdt_update";
+        encrypted_field_envelope: "encrypted_field_envelope";
+    }>;
+    sensitiveFields: z.ZodArray<z.ZodString>;
+    redaction: z.ZodObject<{
+        payload: z.ZodLiteral<"omitted">;
+        reason: z.ZodLiteral<"audit_redacted_by_default">;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const auditCommitDetailResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    commit: z.ZodObject<{
+        commitSeq: z.ZodNumber;
+        actorId: z.ZodString;
+        clientId: z.ZodString;
+        clientCommitId: z.ZodString;
+        createdAt: z.ZodString;
+        changeCount: z.ZodNumber;
+        affectedTables: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    changes: z.ZodArray<z.ZodObject<{
+        changeId: z.ZodNumber;
+        table: z.ZodString;
+        rowId: z.ZodString;
+        op: z.ZodEnum<{
+            delete: "delete";
+            upsert: "upsert";
+        }>;
+        rowVersion: z.ZodNullable<z.ZodNumber>;
+        fields: z.ZodArray<z.ZodString>;
+        scopeFields: z.ZodArray<z.ZodString>;
+        changeKind: z.ZodEnum<{
+            app_row: "app_row";
+            blob_reference: "blob_reference";
+            delete: "delete";
+            encrypted_crdt_checkpoint: "encrypted_crdt_checkpoint";
+            encrypted_crdt_update: "encrypted_crdt_update";
+            encrypted_field_envelope: "encrypted_field_envelope";
+        }>;
+        sensitiveFields: z.ZodArray<z.ZodString>;
+        redaction: z.ZodObject<{
+            payload: z.ZodLiteral<"omitted">;
+            reason: z.ZodLiteral<"audit_redacted_by_default">;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const auditDebugExportEventSchema: z.ZodObject<{
+    eventId: z.ZodNumber;
+    partitionId: z.ZodString;
+    requestId: z.ZodString;
+    traceId: z.ZodNullable<z.ZodString>;
+    spanId: z.ZodNullable<z.ZodString>;
+    eventType: z.ZodEnum<{
+        pull: "pull";
+        push: "push";
+        sync: "sync";
+    }>;
+    syncPath: z.ZodEnum<{
+        "http-combined": "http-combined";
+        "ws-push": "ws-push";
+    }>;
+    transportPath: z.ZodEnum<{
+        direct: "direct";
+        relay: "relay";
+    }>;
+    actorId: z.ZodString;
+    clientId: z.ZodString;
+    statusCode: z.ZodNumber;
+    outcome: z.ZodString;
+    responseStatus: z.ZodString;
+    errorCode: z.ZodNullable<z.ZodString>;
+    durationMs: z.ZodNumber;
+    commitSeq: z.ZodNullable<z.ZodNumber>;
+    operationCount: z.ZodNullable<z.ZodNumber>;
+    rowCount: z.ZodNullable<z.ZodNumber>;
+    subscriptionCount: z.ZodNullable<z.ZodNumber>;
+    scopesSummary: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    tables: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export declare const auditDebugExportResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    generatedAt: z.ZodString;
+    partitionId: z.ZodString;
+    limits: z.ZodObject<{
+        commits: z.ZodNumber;
+        requestEvents: z.ZodNumber;
+    }, z.core.$strip>;
+    truncated: z.ZodObject<{
+        commits: z.ZodBoolean;
+        requestEvents: z.ZodBoolean;
+    }, z.core.$strip>;
+    commits: z.ZodArray<z.ZodObject<{
+        commitSeq: z.ZodNumber;
+        actorId: z.ZodString;
+        clientId: z.ZodString;
+        clientCommitId: z.ZodString;
+        createdAt: z.ZodString;
+        changeCount: z.ZodNumber;
+        affectedTables: z.ZodArray<z.ZodString>;
+        changes: z.ZodArray<z.ZodObject<{
+            changeId: z.ZodNumber;
+            table: z.ZodString;
+            rowId: z.ZodString;
+            op: z.ZodEnum<{
+                delete: "delete";
+                upsert: "upsert";
+            }>;
+            rowVersion: z.ZodNullable<z.ZodNumber>;
+            fields: z.ZodArray<z.ZodString>;
+            scopeFields: z.ZodArray<z.ZodString>;
+            changeKind: z.ZodEnum<{
+                app_row: "app_row";
+                blob_reference: "blob_reference";
+                delete: "delete";
+                encrypted_crdt_checkpoint: "encrypted_crdt_checkpoint";
+                encrypted_crdt_update: "encrypted_crdt_update";
+                encrypted_field_envelope: "encrypted_field_envelope";
+            }>;
+            sensitiveFields: z.ZodArray<z.ZodString>;
+            redaction: z.ZodObject<{
+                payload: z.ZodLiteral<"omitted">;
+                reason: z.ZodLiteral<"audit_redacted_by_default">;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    requestEvents: z.ZodArray<z.ZodObject<{
+        eventId: z.ZodNumber;
+        partitionId: z.ZodString;
+        requestId: z.ZodString;
+        traceId: z.ZodNullable<z.ZodString>;
+        spanId: z.ZodNullable<z.ZodString>;
+        eventType: z.ZodEnum<{
+            pull: "pull";
+            push: "push";
+            sync: "sync";
+        }>;
+        syncPath: z.ZodEnum<{
+            "http-combined": "http-combined";
+            "ws-push": "ws-push";
+        }>;
+        transportPath: z.ZodEnum<{
+            direct: "direct";
+            relay: "relay";
+        }>;
+        actorId: z.ZodString;
+        clientId: z.ZodString;
+        statusCode: z.ZodNumber;
+        outcome: z.ZodString;
+        responseStatus: z.ZodString;
+        errorCode: z.ZodNullable<z.ZodString>;
+        durationMs: z.ZodNumber;
+        commitSeq: z.ZodNullable<z.ZodNumber>;
+        operationCount: z.ZodNullable<z.ZodNumber>;
+        rowCount: z.ZodNullable<z.ZodNumber>;
+        subscriptionCount: z.ZodNullable<z.ZodNumber>;
+        scopesSummary: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+        tables: z.ZodArray<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const auditRowHistoryResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    table: z.ZodString;
+    rowId: z.ZodString;
+    history: z.ZodArray<z.ZodObject<{
+        commitSeq: z.ZodNumber;
+        actorId: z.ZodString;
+        clientId: z.ZodString;
+        clientCommitId: z.ZodString;
+        createdAt: z.ZodString;
+        changeId: z.ZodNumber;
+        table: z.ZodString;
+        rowId: z.ZodString;
+        op: z.ZodEnum<{
+            delete: "delete";
+            upsert: "upsert";
+        }>;
+        rowVersion: z.ZodNullable<z.ZodNumber>;
+        fields: z.ZodArray<z.ZodString>;
+        scopeFields: z.ZodArray<z.ZodString>;
+        changeKind: z.ZodEnum<{
+            app_row: "app_row";
+            blob_reference: "blob_reference";
+            delete: "delete";
+            encrypted_crdt_checkpoint: "encrypted_crdt_checkpoint";
+            encrypted_crdt_update: "encrypted_crdt_update";
+            encrypted_field_envelope: "encrypted_field_envelope";
+        }>;
+        sensitiveFields: z.ZodArray<z.ZodString>;
+        redaction: z.ZodObject<{
+            payload: z.ZodLiteral<"omitted">;
+            reason: z.ZodLiteral<"audit_redacted_by_default">;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+export type AuditChangeResponse = z.infer<typeof auditChangeSchema>;
+export type AuditDebugExportEvent = z.infer<typeof auditDebugExportEventSchema>;
+export declare const DEFAULT_REQUEST_PAYLOAD_SNAPSHOT_MAX_BYTES: number;
+export declare const DEFAULT_MAX_SYNC_REQUEST_JSON_BYTES: number;
+export declare const DEFAULT_MAX_SYNC_BINARY_PACK_BYTES: number;
+export declare const DEFAULT_MAX_SNAPSHOT_CHUNK_RESPONSE_BYTES: number;
+export declare const DEFAULT_MAX_SNAPSHOT_ARTIFACT_RESPONSE_BYTES: number;
+export type TraceContext = {
+    traceId: string | null;
+    spanId: string | null;
+};
+export type NormalizedSyncCorsConfig = {
+    resolveOrigin: (origin: string | undefined, context: Context) => Promise<string | null>;
+    staticAllowedOrigins?: string[] | '*';
+    allowHeaders: string[];
+    exposeHeaders: string[];
+    allowMethods: string[];
+    allowCredentials: boolean;
+    maxAgeSeconds: number;
+};
+export declare function applySyncCorsHeaders(args: {
+    headers: Headers;
+    allowedOrigin: string;
+    allowCredentials: boolean;
+    allowHeaders: string[];
+    exposeHeaders: string[];
+    allowMethods: string[];
+    maxAgeSeconds: number;
+}): void;
+export declare function createSyncCorsOriginDeniedResponse(origin: string): Response;
+export declare function normalizeSyncCorsConfig(config: SyncRoutesConfigWithRateLimit['cors']): NormalizedSyncCorsConfig | null;
+export declare function createOpaqueId(prefix: string): string;
+export declare function readOriginHeader(c: Context): string | undefined;
+export declare function readRequestId(c: Context): string;
+export declare function readClientIdHint(c: Context): string;
+export declare function readPositiveInteger(value: number | undefined, fallback: number): number;
+export declare function readOptionalPositiveInteger(value: number | undefined): number | undefined;
+declare class SyncJsonBodyLimitError extends Error {
+    readonly limit: string;
+    readonly observed: number;
+    readonly max: number;
+    constructor(limit: string, observed: number, max: number);
+}
+export declare function isSyncJsonBodyLimitError(error: unknown): error is SyncJsonBodyLimitError;
+export declare function readRequestContentLength(c: Context): number | null | 'invalid';
+export declare function readRequestBodyBytesWithLimit(request: Request, args: {
+    maxBytes: number;
+    limit: string;
+}): Promise<Uint8Array>;
+export declare function responseBodyOverLimit(c: Context, args: {
+    limit: string;
+    observed: number;
+    max: number;
+    message?: string;
+}): Response | null;
+export declare function syncValidationError(c: Context, target: string, issues: readonly {
+    path?: unknown;
+    message?: unknown;
+}[]): Response;
+export declare function readTraceContext(c: Context): TraceContext;
+export declare function readTraceContextFromMessage(msg: Record<string, unknown>): TraceContext;
+export declare function normalizeResponseStatus(statusCode: number, outcome: string): string;
+export declare function firstPushErrorCode(results: unknown): string | null;
+export declare function summarizeScopeValues(scopes: Record<string, string | string[]>): Record<string, string | string[]> | null;
+export declare function summarizePullResponse(response: PullResult['response']): {
+    subscriptions: Array<{
+        id: string;
+        status: 'active' | 'revoked';
+        bootstrap: boolean;
+        nextCursor: number;
+        commitCount: number;
+        changeCount: number;
+        snapshotCount: number;
+        snapshotRowCount: number;
+    }>;
+};
+export declare function summarizePullResponseForRequestEvent(response: PullResult['response']): {
+    subscriptionCount: number;
+    activeSubscriptionCount: number;
+    revokedSubscriptionCount: number;
+    bootstrapSubscriptionCount: number;
+    commitCount: number;
+    changeCount: number;
+    snapshotPageCount: number;
+    snapshotInlineRowCount: number;
+    snapshotChunkCount: number;
+    snapshotChunkBytes: number;
+    snapshotArtifactCount: number;
+    snapshotArtifactBytes: number;
+};
+export declare function countPullRows(response: PullResult['response']): number;
+export declare function readSnapshotScopeValues(c: Context, queryScopes: string | undefined): Record<string, string | string[]> | null;
+export declare function parseScopesSummary(value: unknown): Record<string, string | string[]> | null;
+export declare function normalizeRequestEventType(value: unknown): 'sync' | 'push' | 'pull';
+export declare function isMissingRequestEventsTableError(error: unknown): boolean;
+export declare function encodePayloadSnapshot(value: unknown, maxBytes: number): string;
+export declare function emitConsoleLiveEvent(emitter: {
+    emit(event: {
+        type: 'sync' | 'push' | 'pull' | 'commit' | 'client_update';
+        timestamp: string;
+        data: Record<string, unknown>;
+    }): void;
+} | undefined, type: 'sync' | 'push' | 'pull' | 'commit' | 'client_update', data: Record<string, unknown> | (() => Record<string, unknown>)): void;
+export declare function isAuthLeaseRefreshRetriable(code: string): boolean;
+export type RequestPayloadSnapshot = {
+    request: unknown;
+    response: unknown;
+};
+export declare function clampInt(value: number, min: number, max: number): number;
+export declare function measureWebSocketMessageBytes(data: unknown): number;
+export declare function readTransportPath(c: Context, queryValue?: string | null): 'direct' | 'relay';
+export declare function scopeValuesToScopeKeys(scopes: unknown): string[];
+export declare function selectRequiredAuditScopes(scopePatterns: readonly string[], allowedScopes: ScopeValues): ScopeValues | null;
+export declare function parseStoredAuditScopes(value: unknown): StoredScopes;
+export declare function applyPartitionToScopeKeys(partitionId: string, scopeKeys: readonly string[]): string[];
+export declare function uniqueScopeKeys(scopeKeys: readonly string[]): string[];
+export declare function parsePersistedRealtimeSubscriptions(value: unknown, partitionId: string): WebSocketRealtimeSubscription[];
+export declare function normalizeScopeKeyForPartition(partitionId: string, scopeKey: string): string;
+export declare function readCommitScopeKeys<DB extends SyncCoreDb>(db: Kysely<DB>, commitSeq: number, partitionId: string): Promise<string[]>;
+export declare function readClientState<DB extends SyncCoreDb>(db: Kysely<DB>, partitionId: string, clientId: string): Promise<{
+    ownerActorId: string | null;
+    effectiveScopes: unknown;
+    realtimeSubscriptions: unknown;
+    cursor: number | null;
+    latestCommitSeq: number;
+    hasConflict: boolean;
+}>;
+export declare function recordRealtimeAck<DB extends SyncCoreDb>(args: {
+    db: Kysely<DB>;
+    dialect: ServerSyncDialect;
+    partitionId: string;
+    actorId: string;
+    clientId: string;
+    cursor: number;
+    realtimeSubscriptions?: unknown;
+}): Promise<void>;
+//# sourceMappingURL=shared.d.ts.map