@topgunbuild/server 0.3.0 → 0.4.0

package/dist/index.js

@@ -33,20 +33,29 @@ __export(index_exports, {
   BufferPool: () => BufferPool,
   ClusterCoordinator: () => ClusterCoordinator,
   ClusterManager: () => ClusterManager,
+  ConflictResolverHandler: () => ConflictResolverHandler,
+  ConflictResolverService: () => ConflictResolverService,
   ConnectionRateLimiter: () => ConnectionRateLimiter,
   DEFAULT_CLUSTER_COORDINATOR_CONFIG: () => DEFAULT_CLUSTER_COORDINATOR_CONFIG,
+  DEFAULT_CONFLICT_RESOLVER_CONFIG: () => DEFAULT_CONFLICT_RESOLVER_CONFIG,
+  DEFAULT_JOURNAL_SERVICE_CONFIG: () => DEFAULT_JOURNAL_SERVICE_CONFIG,
   DEFAULT_LAG_TRACKER_CONFIG: () => DEFAULT_LAG_TRACKER_CONFIG,
+  DEFAULT_SANDBOX_CONFIG: () => DEFAULT_SANDBOX_CONFIG,
+  EntryProcessorHandler: () => EntryProcessorHandler,
+  EventJournalService: () => EventJournalService,
   FilterTasklet: () => FilterTasklet,
   ForEachTasklet: () => ForEachTasklet,
   IteratorTasklet: () => IteratorTasklet,
   LagTracker: () => LagTracker,
   LockManager: () => LockManager,
   MapTasklet: () => MapTasklet,
+  MapWithResolver: () => MapWithResolver,
   MemoryServerAdapter: () => MemoryServerAdapter,
   MigrationManager: () => MigrationManager,
   ObjectPool: () => ObjectPool,
   PartitionService: () => PartitionService,
   PostgresAdapter: () => PostgresAdapter,
+  ProcessorSandbox: () => ProcessorSandbox,
   RateLimitInterceptor: () => RateLimitInterceptor,
   ReduceTasklet: () => ReduceTasklet,
   ReplicationPipeline: () => ReplicationPipeline,
@@ -82,7 +91,7 @@ var import_http = require("http");
 var import_https = require("https");
 var import_fs2 = require("fs");
 var import_ws3 = require("ws");
-var import_core10 = require("@topgunbuild/core");
+var import_core15 = require("@topgunbuild/core");
 var jwt = __toESM(require("jsonwebtoken"));
 var crypto = __toESM(require("crypto"));
 
@@ -6468,231 +6477,1621 @@ var ReplicationPipeline = class extends import_events8.EventEmitter {
   }
 };
 
-// src/ServerCoordinator.ts
-var GC_INTERVAL_MS = 60 * 60 * 1e3;
-var GC_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
-var CLIENT_HEARTBEAT_TIMEOUT_MS = 2e4;
-var CLIENT_HEARTBEAT_CHECK_INTERVAL_MS = 5e3;
-var ServerCoordinator = class {
-  constructor(config) {
-    this.clients = /* @__PURE__ */ new Map();
-    // Interceptors
-    this.interceptors = [];
-    // In-memory storage (partitioned later)
-    this.maps = /* @__PURE__ */ new Map();
-    this.pendingClusterQueries = /* @__PURE__ */ new Map();
-    // GC Consensus State
-    this.gcReports = /* @__PURE__ */ new Map();
-    // Track map loading state to avoid returning empty results during async load
-    this.mapLoadingPromises = /* @__PURE__ */ new Map();
-    // Track pending batch operations for testing purposes
-    this.pendingBatchOperations = /* @__PURE__ */ new Set();
-    this._actualPort = 0;
-    this._actualClusterPort = 0;
-    this._readyPromise = new Promise((resolve) => {
-      this._readyResolve = resolve;
-    });
-    this.hlc = new import_core10.HLC(config.nodeId);
-    this.storage = config.storage;
-    const rawSecret = config.jwtSecret || process.env.JWT_SECRET || "topgun-secret-dev";
-    this.jwtSecret = rawSecret.replace(/\\n/g, "\n");
-    this.queryRegistry = new QueryRegistry();
-    this.securityManager = new SecurityManager(config.securityPolicies || []);
-    this.interceptors = config.interceptors || [];
-    this.metricsService = new MetricsService();
-    this.eventExecutor = new StripedEventExecutor({
-      stripeCount: config.eventStripeCount ?? 4,
-      queueCapacity: config.eventQueueCapacity ?? 1e4,
-      name: `${config.nodeId}-event-executor`,
-      onReject: (task) => {
-        logger.warn({ nodeId: config.nodeId, key: task.key }, "Event task rejected due to queue capacity");
-        this.metricsService.incEventQueueRejected();
+// src/handlers/CounterHandler.ts
+var import_core10 = require("@topgunbuild/core");
+var CounterHandler = class {
+  // counterName -> Set<clientId>
+  constructor(nodeId = "server") {
+    this.nodeId = nodeId;
+    this.counters = /* @__PURE__ */ new Map();
+    this.subscriptions = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Get or create a counter by name.
+   */
+  getOrCreateCounter(name) {
+    let counter = this.counters.get(name);
+    if (!counter) {
+      counter = new import_core10.PNCounterImpl({ nodeId: this.nodeId });
+      this.counters.set(name, counter);
+      logger.debug({ name }, "Created new counter");
+    }
+    return counter;
+  }
+  /**
+   * Handle COUNTER_REQUEST - client wants initial state.
+   * @returns Response message to send back to client
+   */
+  handleCounterRequest(clientId, name) {
+    const counter = this.getOrCreateCounter(name);
+    this.subscribe(clientId, name);
+    const state = counter.getState();
+    logger.debug({ clientId, name, value: counter.get() }, "Counter request handled");
+    return {
+      type: "COUNTER_RESPONSE",
+      payload: {
+        name,
+        state: this.stateToObject(state)
       }
-    });
-    this.backpressure = new BackpressureRegulator({
-      syncFrequency: config.backpressureSyncFrequency ?? 100,
-      maxPendingOps: config.backpressureMaxPending ?? 1e3,
-      backoffTimeoutMs: config.backpressureBackoffMs ?? 5e3,
-      enabled: config.backpressureEnabled ?? true
-    });
-    this.writeCoalescingEnabled = config.writeCoalescingEnabled ?? true;
-    const preset = coalescingPresets[config.writeCoalescingPreset ?? "highThroughput"];
-    this.writeCoalescingOptions = {
-      maxBatchSize: config.writeCoalescingMaxBatch ?? preset.maxBatchSize,
-      maxDelayMs: config.writeCoalescingMaxDelayMs ?? preset.maxDelayMs,
-      maxBatchBytes: config.writeCoalescingMaxBytes ?? preset.maxBatchBytes
     };
-    this.eventPayloadPool = createEventPayloadPool({
-      maxSize: 4096,
-      initialSize: 128
-    });
-    this.taskletScheduler = new TaskletScheduler({
-      defaultTimeBudgetMs: 5,
-      maxConcurrent: 20
-    });
-    this.writeAckManager = new WriteAckManager({
-      defaultTimeout: config.writeAckTimeout ?? 5e3
-    });
-    this.rateLimitingEnabled = config.rateLimitingEnabled ?? true;
-    this.rateLimiter = new ConnectionRateLimiter({
-      maxConnectionsPerSecond: config.maxConnectionsPerSecond ?? 100,
-      maxPendingConnections: config.maxPendingConnections ?? 1e3,
-      cooldownMs: 1e3
-    });
-    if (config.workerPoolEnabled) {
-      this.workerPool = new WorkerPool({
-        minWorkers: config.workerPoolConfig?.minWorkers ?? 2,
-        maxWorkers: config.workerPoolConfig?.maxWorkers,
-        taskTimeout: config.workerPoolConfig?.taskTimeout ?? 5e3,
-        idleTimeout: config.workerPoolConfig?.idleTimeout ?? 3e4,
-        autoRestart: config.workerPoolConfig?.autoRestart ?? true
-      });
-      this.merkleWorker = new MerkleWorker(this.workerPool);
-      this.crdtMergeWorker = new CRDTMergeWorker(this.workerPool);
-      this.serializationWorker = new SerializationWorker(this.workerPool);
-      logger.info({
-        minWorkers: config.workerPoolConfig?.minWorkers ?? 2,
-        maxWorkers: config.workerPoolConfig?.maxWorkers ?? "auto"
-      }, "Worker pool initialized for CPU-bound operations");
-    }
-    if (config.tls?.enabled) {
-      const tlsOptions = this.buildTLSOptions(config.tls);
-      this.httpServer = (0, import_https.createServer)(tlsOptions, (_req, res) => {
-        res.writeHead(200);
-        res.end("TopGun Server Running (Secure)");
-      });
-      logger.info("TLS enabled for client connections");
-    } else {
-      this.httpServer = (0, import_http.createServer)((_req, res) => {
-        res.writeHead(200);
-        res.end("TopGun Server Running");
-      });
-      if (process.env.NODE_ENV === "production") {
-        logger.warn("\u26A0\uFE0F  TLS is disabled! Client connections are NOT encrypted.");
+  }
+  /**
+   * Handle COUNTER_SYNC - client sends their state to merge.
+   * @returns Merged state and list of clients to broadcast to
+   */
+  handleCounterSync(clientId, name, stateObj) {
+    const counter = this.getOrCreateCounter(name);
+    const incomingState = this.objectToState(stateObj);
+    counter.merge(incomingState);
+    const mergedState = counter.getState();
+    const mergedStateObj = this.stateToObject(mergedState);
+    logger.debug(
+      { clientId, name, value: counter.get() },
+      "Counter sync handled"
+    );
+    this.subscribe(clientId, name);
+    const subscribers = this.subscriptions.get(name) || /* @__PURE__ */ new Set();
+    const broadcastTo = Array.from(subscribers).filter((id) => id !== clientId);
+    return {
+      // Response to the sending client
+      response: {
+        type: "COUNTER_UPDATE",
+        payload: {
+          name,
+          state: mergedStateObj
+        }
+      },
+      // Broadcast to other clients
+      broadcastTo,
+      broadcastMessage: {
+        type: "COUNTER_UPDATE",
+        payload: {
+          name,
+          state: mergedStateObj
+        }
       }
+    };
+  }
+  /**
+   * Subscribe a client to counter updates.
+   */
+  subscribe(clientId, counterName) {
+    if (!this.subscriptions.has(counterName)) {
+      this.subscriptions.set(counterName, /* @__PURE__ */ new Set());
     }
-    const metricsPort = config.metricsPort !== void 0 ? config.metricsPort : 9090;
-    this.metricsServer = (0, import_http.createServer)(async (req, res) => {
-      if (req.url === "/metrics") {
-        try {
-          res.setHeader("Content-Type", this.metricsService.getContentType());
-          res.end(await this.metricsService.getMetrics());
-        } catch (err) {
-          res.statusCode = 500;
-          res.end("Internal Server Error");
-        }
-      } else {
-        res.statusCode = 404;
-        res.end();
+    this.subscriptions.get(counterName).add(clientId);
+    logger.debug({ clientId, counterName }, "Client subscribed to counter");
+  }
+  /**
+   * Unsubscribe a client from counter updates.
+   */
+  unsubscribe(clientId, counterName) {
+    const subs = this.subscriptions.get(counterName);
+    if (subs) {
+      subs.delete(clientId);
+      if (subs.size === 0) {
+        this.subscriptions.delete(counterName);
       }
-    });
-    this.metricsServer.listen(metricsPort, () => {
-      logger.info({ port: metricsPort }, "Metrics server listening");
-    });
-    this.metricsServer.on("error", (err) => {
-      logger.error({ err, port: metricsPort }, "Metrics server failed to start");
-    });
-    this.wss = new import_ws3.WebSocketServer({
-      server: this.httpServer,
-      // Increase backlog for pending connections (default Linux is 128)
-      backlog: config.wsBacklog ?? 511,
-      // Disable per-message deflate by default (CPU overhead)
-      perMessageDeflate: config.wsCompression ?? false,
-      // Max payload size (64MB default)
-      maxPayload: config.wsMaxPayload ?? 64 * 1024 * 1024,
-      // Skip UTF-8 validation for binary messages (performance)
-      skipUTF8Validation: true
-    });
-    this.wss.on("connection", (ws) => this.handleConnection(ws));
-    this.httpServer.maxConnections = config.maxConnections ?? 1e4;
-    this.httpServer.timeout = config.serverTimeout ?? 12e4;
-    this.httpServer.keepAliveTimeout = config.keepAliveTimeout ?? 5e3;
-    this.httpServer.headersTimeout = config.headersTimeout ?? 6e4;
-    this.httpServer.on("connection", (socket) => {
-      socket.setNoDelay(true);
-      socket.setKeepAlive(true, 6e4);
-    });
-    this.httpServer.listen(config.port, () => {
-      const addr = this.httpServer.address();
-      this._actualPort = typeof addr === "object" && addr ? addr.port : config.port;
-      logger.info({ port: this._actualPort }, "Server Coordinator listening");
-      const clusterPort = config.clusterPort ?? 0;
-      const peers = config.resolvePeers ? config.resolvePeers() : config.peers || [];
-      this.cluster = new ClusterManager({
-        nodeId: config.nodeId,
-        host: config.host || "localhost",
-        port: clusterPort,
-        peers,
-        discovery: config.discovery,
-        serviceName: config.serviceName,
-        discoveryInterval: config.discoveryInterval,
-        tls: config.clusterTls
-      });
-      this.partitionService = new PartitionService(this.cluster);
-      if (config.replicationEnabled !== false) {
-        this.replicationPipeline = new ReplicationPipeline(
-          this.cluster,
-          this.partitionService,
-          {
-            ...import_core10.DEFAULT_REPLICATION_CONFIG,
-            defaultConsistency: config.defaultConsistency ?? import_core10.ConsistencyLevel.EVENTUAL,
-            ...config.replicationConfig
-          }
-        );
-        this.replicationPipeline.setOperationApplier(this.applyReplicatedOperation.bind(this));
-        logger.info({ nodeId: config.nodeId }, "ReplicationPipeline initialized");
+    }
+  }
+  /**
+   * Unsubscribe a client from all counters (e.g., on disconnect).
+   */
+  unsubscribeAll(clientId) {
+    for (const [counterName, subs] of this.subscriptions) {
+      subs.delete(clientId);
+      if (subs.size === 0) {
+        this.subscriptions.delete(counterName);
       }
-      this.partitionService.on("rebalanced", (partitionMap, changes) => {
-        this.broadcastPartitionMap(partitionMap);
-      });
-      this.lockManager = new LockManager();
-      this.lockManager.on("lockGranted", (evt) => this.handleLockGranted(evt));
-      this.topicManager = new TopicManager({
-        cluster: this.cluster,
-        sendToClient: (clientId, message) => {
-          const client = this.clients.get(clientId);
-          if (client && client.socket.readyState === import_ws3.WebSocket.OPEN) {
-            client.writer.write(message);
-          }
-        }
-      });
-      this.systemManager = new SystemManager(
-        this.cluster,
-        this.metricsService,
-        (name) => this.getMap(name)
-      );
-      this.setupClusterListeners();
-      this.cluster.start().then((actualClusterPort) => {
-        this._actualClusterPort = actualClusterPort;
-        this.metricsService.setClusterMembers(this.cluster.getMembers().length);
-        logger.info({ clusterPort: this._actualClusterPort }, "Cluster started");
-        this.systemManager.start();
-        this._readyResolve();
-      }).catch((err) => {
-        this._actualClusterPort = clusterPort;
-        this.metricsService.setClusterMembers(this.cluster.getMembers().length);
-        logger.info({ clusterPort: this._actualClusterPort }, "Cluster started (sync)");
-        this.systemManager.start();
-        this._readyResolve();
-      });
-    });
-    if (this.storage) {
-      this.storage.initialize().then(() => {
-        logger.info("Storage adapter initialized");
-      }).catch((err) => {
-        logger.error({ err }, "Failed to initialize storage");
-      });
     }
-    this.startGarbageCollection();
-    this.startHeartbeatCheck();
+    logger.debug({ clientId }, "Client unsubscribed from all counters");
   }
-  /** Wait for server to be fully ready (ports assigned) */
-  ready() {
-    return this._readyPromise;
+  /**
+   * Get current counter value (for monitoring/debugging).
+   */
+  getCounterValue(name) {
+    const counter = this.counters.get(name);
+    return counter ? counter.get() : 0;
   }
   /**
-   * Wait for all pending batch operations to complete.
-   * Useful for tests that need to verify state after OP_BATCH.
+   * Get all counter names.
+   */
+  getCounterNames() {
+    return Array.from(this.counters.keys());
+  }
+  /**
+   * Get number of subscribers for a counter.
+   */
+  getSubscriberCount(name) {
+    return this.subscriptions.get(name)?.size || 0;
+  }
+  /**
+   * Convert Map-based state to plain object for serialization.
+   */
+  stateToObject(state) {
+    return {
+      p: Object.fromEntries(state.positive),
+      n: Object.fromEntries(state.negative)
+    };
+  }
+  /**
+   * Convert plain object to Map-based state.
+   */
+  objectToState(obj) {
+    return {
+      positive: new Map(Object.entries(obj.p || {})),
+      negative: new Map(Object.entries(obj.n || {}))
+    };
+  }
+};
+
+// src/handlers/EntryProcessorHandler.ts
+var import_core12 = require("@topgunbuild/core");
+
+// src/ProcessorSandbox.ts
+var import_core11 = require("@topgunbuild/core");
+var ivm = null;
+try {
+  ivm = require("isolated-vm");
+} catch {
+  const isProduction = process.env.NODE_ENV === "production";
+  if (isProduction) {
+    logger.error(
+      "SECURITY WARNING: isolated-vm not available in production! Entry processors will run in less secure fallback mode. Install isolated-vm for production environments: pnpm add isolated-vm"
+    );
+  } else {
+    logger.warn("isolated-vm not available, falling back to less secure VM");
+  }
+}
+var DEFAULT_SANDBOX_CONFIG = {
+  memoryLimitMb: 8,
+  timeoutMs: 100,
+  maxCachedIsolates: 100,
+  strictValidation: true
+};
+var ProcessorSandbox = class {
+  constructor(config = {}) {
+    this.isolateCache = /* @__PURE__ */ new Map();
+    this.scriptCache = /* @__PURE__ */ new Map();
+    this.fallbackScriptCache = /* @__PURE__ */ new Map();
+    this.disposed = false;
+    this.config = { ...DEFAULT_SANDBOX_CONFIG, ...config };
+  }
+  /**
+   * Execute an entry processor in the sandbox.
+   *
+   * @param processor The processor definition (name, code, args)
+   * @param value The current value for the key (or undefined)
+   * @param key The key being processed
+   * @returns Result containing success status, result, and new value
+   */
+  async execute(processor, value, key) {
+    if (this.disposed) {
+      return {
+        success: false,
+        error: "Sandbox has been disposed"
+      };
+    }
+    if (this.config.strictValidation) {
+      const validation = (0, import_core11.validateProcessorCode)(processor.code);
+      if (!validation.valid) {
+        return {
+          success: false,
+          error: validation.error
+        };
+      }
+    }
+    if (ivm) {
+      return this.executeInIsolate(processor, value, key);
+    } else {
+      return this.executeInFallback(processor, value, key);
+    }
+  }
+  /**
+   * Execute processor in isolated-vm (secure production mode).
+   */
+  async executeInIsolate(processor, value, key) {
+    if (!ivm) {
+      return { success: false, error: "isolated-vm not available" };
+    }
+    const isolate = this.getOrCreateIsolate(processor.name);
+    try {
+      const context = await isolate.createContext();
+      const jail = context.global;
+      await jail.set("global", jail.derefInto());
+      await context.eval(`
+        var value = ${JSON.stringify(value)};
+        var key = ${JSON.stringify(key)};
+        var args = ${JSON.stringify(processor.args)};
+      `);
+      const wrappedCode = `
+        (function() {
+          ${processor.code}
+        })()
+      `;
+      const script = await this.getOrCompileScript(
+        processor.name,
+        wrappedCode,
+        isolate
+      );
+      const result = await script.run(context, {
+        timeout: this.config.timeoutMs
+      });
+      const parsed = result;
+      if (typeof parsed !== "object" || parsed === null) {
+        return {
+          success: false,
+          error: "Processor must return { value, result? } object"
+        };
+      }
+      return {
+        success: true,
+        result: parsed.result,
+        newValue: parsed.value
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("Script execution timed out")) {
+        return {
+          success: false,
+          error: "Processor execution timed out"
+        };
+      }
+      return {
+        success: false,
+        error: message
+      };
+    }
+  }
+  /**
+   * Execute processor in fallback VM (less secure, for development).
+   */
+  async executeInFallback(processor, value, key) {
+    try {
+      const isResolver = processor.name.startsWith("resolver:");
+      let fn = isResolver ? void 0 : this.fallbackScriptCache.get(processor.name);
+      if (!fn) {
+        const wrappedCode = `
+          return (function(value, key, args) {
+            ${processor.code}
+          })
+        `;
+        fn = new Function(wrappedCode)();
+        if (!isResolver) {
+          this.fallbackScriptCache.set(processor.name, fn);
+        }
+      }
+      const timeoutPromise = new Promise((_, reject) => {
+        setTimeout(() => reject(new Error("Processor execution timed out")), this.config.timeoutMs);
+      });
+      const executionPromise = Promise.resolve().then(() => fn(value, key, processor.args));
+      const result = await Promise.race([executionPromise, timeoutPromise]);
+      if (typeof result !== "object" || result === null) {
+        return {
+          success: false,
+          error: "Processor must return { value, result? } object"
+        };
+      }
+      return {
+        success: true,
+        result: result.result,
+        newValue: result.value
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        success: false,
+        error: message
+      };
+    }
+  }
+  /**
+   * Get or create an isolate for a processor.
+   */
+  getOrCreateIsolate(name) {
+    if (!ivm) {
+      throw new Error("isolated-vm not available");
+    }
+    let isolate = this.isolateCache.get(name);
+    if (!isolate || isolate.isDisposed) {
+      if (this.isolateCache.size >= this.config.maxCachedIsolates) {
+        const oldest = this.isolateCache.keys().next().value;
+        if (oldest) {
+          const oldIsolate = this.isolateCache.get(oldest);
+          if (oldIsolate && !oldIsolate.isDisposed) {
+            oldIsolate.dispose();
+          }
+          this.isolateCache.delete(oldest);
+          this.scriptCache.delete(oldest);
+        }
+      }
+      isolate = new ivm.Isolate({
+        memoryLimit: this.config.memoryLimitMb
+      });
+      this.isolateCache.set(name, isolate);
+    }
+    return isolate;
+  }
+  /**
+   * Get or compile a script for a processor.
+   */
+  async getOrCompileScript(name, code, isolate) {
+    let script = this.scriptCache.get(name);
+    if (!script) {
+      script = await isolate.compileScript(code);
+      this.scriptCache.set(name, script);
+    }
+    return script;
+  }
+  /**
+   * Clear script cache for a specific processor (e.g., when code changes).
+   */
+  clearCache(processorName) {
+    if (processorName) {
+      const isolate = this.isolateCache.get(processorName);
+      if (isolate && !isolate.isDisposed) {
+        isolate.dispose();
+      }
+      this.isolateCache.delete(processorName);
+      this.scriptCache.delete(processorName);
+      this.fallbackScriptCache.delete(processorName);
+    } else {
+      for (const isolate of this.isolateCache.values()) {
+        if (!isolate.isDisposed) {
+          isolate.dispose();
+        }
+      }
+      this.isolateCache.clear();
+      this.scriptCache.clear();
+      this.fallbackScriptCache.clear();
+    }
+  }
+  /**
+   * Check if using secure isolated-vm mode.
+   */
+  isSecureMode() {
+    return ivm !== null;
+  }
+  /**
+   * Get current cache sizes.
+   */
+  getCacheStats() {
+    return {
+      isolates: this.isolateCache.size,
+      scripts: this.scriptCache.size,
+      fallbackScripts: this.fallbackScriptCache.size
+    };
+  }
+  /**
+   * Dispose of all isolates and clear caches.
+   */
+  dispose() {
+    if (this.disposed) return;
+    this.disposed = true;
+    this.clearCache();
+    logger.debug("ProcessorSandbox disposed");
+  }
+};
+
+// src/handlers/EntryProcessorHandler.ts
+var EntryProcessorHandler = class {
+  constructor(config) {
+    this.hlc = config.hlc;
+    this.sandbox = new ProcessorSandbox(config.sandboxConfig);
+  }
+  /**
+   * Execute a processor on a single key atomically.
+   *
+   * @param map The LWWMap to operate on
+   * @param key The key to process
+   * @param processorDef The processor definition (will be validated)
+   * @returns Result with success status, processor result, and new value
+   */
+  async executeOnKey(map, key, processorDef) {
+    const parseResult = import_core12.EntryProcessorDefSchema.safeParse(processorDef);
+    if (!parseResult.success) {
+      logger.warn(
+        { key, error: parseResult.error.message },
+        "Invalid processor definition"
+      );
+      return {
+        result: {
+          success: false,
+          error: `Invalid processor: ${parseResult.error.message}`
+        }
+      };
+    }
+    const processor = parseResult.data;
+    const currentValue = map.get(key);
+    logger.debug(
+      { key, processor: processor.name, hasValue: currentValue !== void 0 },
+      "Executing entry processor"
+    );
+    const sandboxResult = await this.sandbox.execute(
+      processor,
+      currentValue,
+      key
+    );
+    if (!sandboxResult.success) {
+      logger.warn(
+        { key, processor: processor.name, error: sandboxResult.error },
+        "Processor execution failed"
+      );
+      return { result: sandboxResult };
+    }
+    let timestamp;
+    if (sandboxResult.newValue !== void 0) {
+      const record = map.set(key, sandboxResult.newValue);
+      timestamp = record.timestamp;
+      logger.debug(
+        { key, processor: processor.name, timestamp },
+        "Processor updated value"
+      );
+    } else if (currentValue !== void 0) {
+      const tombstone = map.remove(key);
+      timestamp = tombstone.timestamp;
+      logger.debug(
+        { key, processor: processor.name, timestamp },
+        "Processor deleted value"
+      );
+    }
+    return {
+      result: sandboxResult,
+      timestamp
+    };
+  }
+  /**
+   * Execute a processor on multiple keys.
+   *
+   * Each key is processed sequentially to ensure atomicity per-key.
+   * For parallel execution across keys, use multiple calls.
+   *
+   * @param map The LWWMap to operate on
+   * @param keys The keys to process
+   * @param processorDef The processor definition
+   * @returns Map of key -> result
+   */
+  async executeOnKeys(map, keys, processorDef) {
+    const results = /* @__PURE__ */ new Map();
+    const timestamps = /* @__PURE__ */ new Map();
+    const parseResult = import_core12.EntryProcessorDefSchema.safeParse(processorDef);
+    if (!parseResult.success) {
+      const errorResult = {
+        success: false,
+        error: `Invalid processor: ${parseResult.error.message}`
+      };
+      for (const key of keys) {
+        results.set(key, errorResult);
+      }
+      return { results, timestamps };
+    }
+    for (const key of keys) {
+      const { result, timestamp } = await this.executeOnKey(
+        map,
+        key,
+        processorDef
+      );
+      results.set(key, result);
+      if (timestamp) {
+        timestamps.set(key, timestamp);
+      }
+    }
+    return { results, timestamps };
+  }
+  /**
+   * Execute a processor on all entries matching a predicate.
+   *
+   * WARNING: This can be expensive for large maps.
+   *
+   * @param map The LWWMap to operate on
+   * @param processorDef The processor definition
+   * @param predicateCode Optional predicate code to filter entries
+   * @returns Map of key -> result for processed entries
+   */
+  async executeOnEntries(map, processorDef, predicateCode) {
+    const results = /* @__PURE__ */ new Map();
+    const timestamps = /* @__PURE__ */ new Map();
+    const parseResult = import_core12.EntryProcessorDefSchema.safeParse(processorDef);
+    if (!parseResult.success) {
+      return { results, timestamps };
+    }
+    const entries = map.entries();
+    for (const [key, value] of entries) {
+      if (predicateCode) {
+        const predicateResult = await this.sandbox.execute(
+          {
+            name: "_predicate",
+            code: `return { value, result: (function() { ${predicateCode} })() };`
+          },
+          value,
+          key
+        );
+        if (!predicateResult.success || !predicateResult.result) {
+          continue;
+        }
+      }
+      const { result, timestamp } = await this.executeOnKey(
+        map,
+        key,
+        processorDef
+      );
+      results.set(key, result);
+      if (timestamp) {
+        timestamps.set(key, timestamp);
+      }
+    }
+    return { results, timestamps };
+  }
+  /**
+   * Check if sandbox is in secure mode (using isolated-vm).
+   */
+  isSecureMode() {
+    return this.sandbox.isSecureMode();
+  }
+  /**
+   * Get sandbox cache statistics.
+   */
+  getCacheStats() {
+    return this.sandbox.getCacheStats();
+  }
+  /**
+   * Clear sandbox cache.
+   */
+  clearCache(processorName) {
+    this.sandbox.clearCache(processorName);
+  }
+  /**
+   * Dispose of the handler and its sandbox.
+   */
+  dispose() {
+    this.sandbox.dispose();
+    logger.debug("EntryProcessorHandler disposed");
+  }
+};
+
+// src/ConflictResolverService.ts
+var import_core13 = require("@topgunbuild/core");
+var DEFAULT_CONFLICT_RESOLVER_CONFIG = {
+  maxResolversPerMap: 100,
+  enableSandboxedResolvers: true,
+  resolverTimeoutMs: 100
+};
+var ConflictResolverService = class {
+  constructor(sandbox, config = {}) {
+    this.resolvers = /* @__PURE__ */ new Map();
+    this.disposed = false;
+    this.sandbox = sandbox;
+    this.config = { ...DEFAULT_CONFLICT_RESOLVER_CONFIG, ...config };
+  }
+  /**
+   * Set callback for merge rejections.
+   */
+  onRejection(callback) {
+    this.onRejectionCallback = callback;
+  }
+  /**
+   * Register a resolver for a map.
+   *
+   * @param mapName The map this resolver applies to
+   * @param resolver The resolver definition
+   * @param registeredBy Optional client ID that registered this resolver
+   */
+  register(mapName, resolver, registeredBy) {
+    if (this.disposed) {
+      throw new Error("ConflictResolverService has been disposed");
+    }
+    if (resolver.code) {
+      const parsed = import_core13.ConflictResolverDefSchema.safeParse({
+        name: resolver.name,
+        code: resolver.code,
+        priority: resolver.priority,
+        keyPattern: resolver.keyPattern
+      });
+      if (!parsed.success) {
+        throw new Error(`Invalid resolver definition: ${parsed.error.message}`);
+      }
+      const validation = (0, import_core13.validateResolverCode)(resolver.code);
+      if (!validation.valid) {
+        throw new Error(`Invalid resolver code: ${validation.error}`);
+      }
+    }
+    const entries = this.resolvers.get(mapName) ?? [];
+    if (entries.length >= this.config.maxResolversPerMap) {
+      throw new Error(
+        `Maximum resolvers per map (${this.config.maxResolversPerMap}) exceeded`
+      );
+    }
+    const filtered = entries.filter((e) => e.resolver.name !== resolver.name);
+    const entry = {
+      resolver,
+      registeredBy
+    };
+    if (resolver.code && !resolver.fn && this.config.enableSandboxedResolvers) {
+      entry.compiledFn = this.compileSandboxed(resolver.name, resolver.code);
+    }
+    filtered.push(entry);
+    filtered.sort(
+      (a, b) => (b.resolver.priority ?? 50) - (a.resolver.priority ?? 50)
+    );
+    this.resolvers.set(mapName, filtered);
+    logger.debug(
+      `Registered resolver '${resolver.name}' for map '${mapName}' with priority ${resolver.priority ?? 50}`
+    );
+  }
+  /**
+   * Unregister a resolver.
+   *
+   * @param mapName The map name
+   * @param resolverName The resolver name to unregister
+   * @param clientId Optional - only unregister if registered by this client
+   */
+  unregister(mapName, resolverName, clientId) {
+    const entries = this.resolvers.get(mapName);
+    if (!entries) return false;
+    const entryIndex = entries.findIndex(
+      (e) => e.resolver.name === resolverName && (!clientId || e.registeredBy === clientId)
+    );
+    if (entryIndex === -1) return false;
+    entries.splice(entryIndex, 1);
+    if (entries.length === 0) {
+      this.resolvers.delete(mapName);
+    }
+    logger.debug(`Unregistered resolver '${resolverName}' from map '${mapName}'`);
+    return true;
+  }
+  /**
+   * Resolve a merge conflict using registered resolvers.
+   *
+   * @param context The merge context
+   * @returns The merge result
+   */
+  async resolve(context) {
+    if (this.disposed) {
+      return { action: "accept", value: context.remoteValue };
+    }
+    const entries = this.resolvers.get(context.mapName) ?? [];
+    const allEntries = [
+      ...entries,
+      { resolver: import_core13.BuiltInResolvers.LWW() }
+    ];
+    for (const entry of allEntries) {
+      const { resolver } = entry;
+      if (resolver.keyPattern && !this.matchKeyPattern(context.key, resolver.keyPattern)) {
+        continue;
+      }
+      try {
+        let result;
+        if (resolver.fn) {
+          const fn = resolver.fn;
+          const maybePromise = fn(context);
+          result = maybePromise instanceof Promise ? await maybePromise : maybePromise;
+        } else if (entry.compiledFn) {
+          const compiledFn = entry.compiledFn;
+          result = await compiledFn(context);
+        } else {
+          continue;
+        }
+        if (result.action !== "local") {
+          if (result.action === "reject") {
+            logger.debug(
+              `Resolver '${resolver.name}' rejected merge for key '${context.key}' in map '${context.mapName}': ${result.reason}`
+            );
+            if (this.onRejectionCallback) {
+              this.onRejectionCallback({
+                mapName: context.mapName,
+                key: context.key,
+                attemptedValue: context.remoteValue,
+                reason: result.reason,
+                timestamp: context.remoteTimestamp,
+                nodeId: context.remoteNodeId
+              });
+            }
+          }
+          return result;
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logger.error(`Resolver '${resolver.name}' threw error: ${message}`);
+      }
+    }
+    return { action: "accept", value: context.remoteValue };
+  }
+  /**
+   * List registered resolvers.
+   *
+   * @param mapName Optional - filter by map name
+   */
+  list(mapName) {
+    const result = [];
+    if (mapName) {
+      const entries = this.resolvers.get(mapName) ?? [];
+      for (const entry of entries) {
+        result.push({
+          mapName,
+          name: entry.resolver.name,
+          priority: entry.resolver.priority,
+          keyPattern: entry.resolver.keyPattern,
+          registeredBy: entry.registeredBy
+        });
+      }
+    } else {
+      for (const [map, entries] of this.resolvers.entries()) {
+        for (const entry of entries) {
+          result.push({
+            mapName: map,
+            name: entry.resolver.name,
+            priority: entry.resolver.priority,
+            keyPattern: entry.resolver.keyPattern,
+            registeredBy: entry.registeredBy
+          });
+        }
+      }
+    }
+    return result;
+  }
+  /**
+   * Check if a map has any registered resolvers.
+   */
+  hasResolvers(mapName) {
+    const entries = this.resolvers.get(mapName);
+    return entries !== void 0 && entries.length > 0;
+  }
+  /**
+   * Get the number of registered resolvers.
+   */
+  get size() {
+    let count = 0;
+    for (const entries of this.resolvers.values()) {
+      count += entries.length;
+    }
+    return count;
+  }
+  /**
+   * Clear all registered resolvers.
+   *
+   * @param mapName Optional - only clear resolvers for specific map
+   */
+  clear(mapName) {
+    if (mapName) {
+      this.resolvers.delete(mapName);
+    } else {
+      this.resolvers.clear();
+    }
+  }
+  /**
+   * Clear resolvers registered by a specific client.
+   */
+  clearByClient(clientId) {
+    let removed = 0;
+    for (const [mapName, entries] of this.resolvers.entries()) {
+      const before = entries.length;
+      const filtered = entries.filter((e) => e.registeredBy !== clientId);
+      removed += before - filtered.length;
+      if (filtered.length === 0) {
+        this.resolvers.delete(mapName);
+      } else if (filtered.length !== before) {
+        this.resolvers.set(mapName, filtered);
+      }
+    }
+    return removed;
+  }
+  /**
+   * Dispose the service.
+   */
+  dispose() {
+    if (this.disposed) return;
+    this.disposed = true;
+    this.resolvers.clear();
+    logger.debug("ConflictResolverService disposed");
+  }
+  /**
+   * Match a key against a glob-like pattern.
+   * Supports * (any chars) and ? (single char).
+   */
+  matchKeyPattern(key, pattern) {
+    const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+    const regex = new RegExp(`^${regexPattern}$`);
+    return regex.test(key);
+  }
+  /**
+   * Compile sandboxed resolver code.
+   */
+  compileSandboxed(name, code) {
+    return async (ctx) => {
+      const wrappedCode = `
+        const context = {
+          mapName: ${JSON.stringify(ctx.mapName)},
+          key: ${JSON.stringify(ctx.key)},
+          localValue: ${JSON.stringify(ctx.localValue)},
+          remoteValue: ${JSON.stringify(ctx.remoteValue)},
+          localTimestamp: ${JSON.stringify(ctx.localTimestamp)},
+          remoteTimestamp: ${JSON.stringify(ctx.remoteTimestamp)},
+          remoteNodeId: ${JSON.stringify(ctx.remoteNodeId)},
+          auth: ${JSON.stringify(ctx.auth)},
+        };
+
+        function resolve(context) {
+          ${code}
+        }
+
+        const result = resolve(context);
+        return { value: result, result };
+      `;
+      const result = await this.sandbox.execute(
+        {
+          name: `resolver:${name}`,
+          code: wrappedCode
+        },
+        null,
+        // value parameter unused for resolvers
+        "resolver"
+      );
+      if (!result.success) {
+        throw new Error(result.error || "Resolver execution failed");
+      }
+      const resolverResult = result.result;
+      if (!resolverResult || typeof resolverResult !== "object") {
+        throw new Error("Resolver must return a result object");
+      }
+      const action = resolverResult.action;
+      if (!["accept", "reject", "merge", "local"].includes(action)) {
+        throw new Error(`Invalid resolver action: ${action}`);
+      }
+      return resolverResult;
+    };
+  }
+};
+
+// src/handlers/ConflictResolverHandler.ts
+var ConflictResolverHandler = class {
+  constructor(config) {
+    this.rejectionListeners = /* @__PURE__ */ new Set();
+    this.nodeId = config.nodeId;
+    this.sandbox = new ProcessorSandbox(config.sandboxConfig);
+    this.resolverService = new ConflictResolverService(
+      this.sandbox,
+      config.resolverConfig
+    );
+    this.resolverService.onRejection((rejection) => {
+      for (const listener of this.rejectionListeners) {
+        try {
+          listener(rejection);
+        } catch (e) {
+          logger.error({ error: e }, "Error in rejection listener");
+        }
+      }
+    });
+  }
+  /**
+   * Register a conflict resolver for a map.
+   *
+   * @param mapName The map name
+   * @param resolver The resolver definition
+   * @param clientId Optional client ID that registered this resolver
+   */
+  registerResolver(mapName, resolver, clientId) {
+    this.resolverService.register(mapName, resolver, clientId);
+    logger.info(
+      {
+        mapName,
+        resolverName: resolver.name,
+        priority: resolver.priority,
+        clientId
+      },
+      "Resolver registered"
+    );
+  }
+  /**
+   * Unregister a conflict resolver.
+   *
+   * @param mapName The map name
+   * @param resolverName The resolver name
+   * @param clientId Optional - only unregister if registered by this client
+   */
+  unregisterResolver(mapName, resolverName, clientId) {
+    const removed = this.resolverService.unregister(
+      mapName,
+      resolverName,
+      clientId
+    );
+    if (removed) {
+      logger.info({ mapName, resolverName, clientId }, "Resolver unregistered");
+    }
+    return removed;
+  }
+  /**
+   * List registered resolvers.
+   *
+   * @param mapName Optional - filter by map name
+   */
+  listResolvers(mapName) {
+    return this.resolverService.list(mapName);
+  }
+  /**
+   * Apply a merge with conflict resolution.
+   *
+   * Deletions (tombstones) are also passed through resolvers to allow
+   * protection via IMMUTABLE, OWNER_ONLY, or similar resolvers.
+   * If no custom resolvers are registered, deletions use standard LWW.
+   *
+   * @param map The LWWMap to merge into
+   * @param mapName The map name (for resolver lookup)
+   * @param key The key being merged
+   * @param record The incoming record
+   * @param remoteNodeId The source node ID
+   * @param auth Optional authentication context
+   */
+  async mergeWithResolver(map, mapName, key, record, remoteNodeId, auth) {
+    const isDeletion = record.value === null;
+    const localRecord = map.getRecord(key);
+    const context = {
+      mapName,
+      key,
+      localValue: localRecord?.value ?? void 0,
+      // For deletions, remoteValue is null - resolvers can check this
+      remoteValue: record.value,
+      localTimestamp: localRecord?.timestamp,
+      remoteTimestamp: record.timestamp,
+      remoteNodeId,
+      auth,
+      readEntry: (k) => map.get(k)
+    };
+    const result = await this.resolverService.resolve(context);
+    switch (result.action) {
+      case "accept":
+      case "merge": {
+        const finalValue = isDeletion ? null : result.value;
+        const finalRecord = {
+          value: finalValue,
+          timestamp: record.timestamp,
+          ttlMs: record.ttlMs
+        };
+        map.merge(key, finalRecord);
+        return { applied: true, result, record: finalRecord };
+      }
+      case "reject": {
+        const rejection = {
+          mapName,
+          key,
+          attemptedValue: record.value,
+          reason: result.reason,
+          timestamp: record.timestamp,
+          nodeId: remoteNodeId
+        };
+        return { applied: false, result, rejection };
+      }
+      case "local":
+      default:
+        return { applied: false, result };
+    }
+  }
+  /**
+   * Check if a map has custom resolvers registered.
+   */
+  hasResolvers(mapName) {
+    return this.resolverService.hasResolvers(mapName);
+  }
+  /**
+   * Add a listener for merge rejections.
+   */
+  onRejection(listener) {
+    this.rejectionListeners.add(listener);
+    return () => this.rejectionListeners.delete(listener);
+  }
+  /**
+   * Clear resolvers registered by a specific client.
+   */
+  clearByClient(clientId) {
+    return this.resolverService.clearByClient(clientId);
+  }
+  /**
+   * Get the number of registered resolvers.
+   */
+  get resolverCount() {
+    return this.resolverService.size;
+  }
+  /**
+   * Check if sandbox is in secure mode.
+   */
+  isSecureMode() {
+    return this.sandbox.isSecureMode();
+  }
+  /**
+   * Dispose of the handler.
+   */
+  dispose() {
+    this.resolverService.dispose();
+    this.sandbox.dispose();
+    this.rejectionListeners.clear();
+    logger.debug("ConflictResolverHandler disposed");
+  }
+};
+
+// src/EventJournalService.ts
+var import_core14 = require("@topgunbuild/core");
+var DEFAULT_JOURNAL_SERVICE_CONFIG = {
+  ...import_core14.DEFAULT_EVENT_JOURNAL_CONFIG,
+  tableName: "event_journal",
+  persistBatchSize: 100,
+  persistIntervalMs: 1e3
+};
+var TABLE_NAME_REGEX = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+function validateTableName(name) {
+  if (!TABLE_NAME_REGEX.test(name)) {
+    throw new Error(
+      `Invalid table name "${name}". Table name must start with a letter or underscore and contain only alphanumeric characters and underscores.`
+    );
+  }
+}
+var EventJournalService = class extends import_core14.EventJournalImpl {
+  constructor(config) {
+    super(config);
+    this.pendingPersist = [];
+    this.isPersisting = false;
+    this.isInitialized = false;
+    this.isLoadingFromStorage = false;
+    this.pool = config.pool;
+    this.tableName = config.tableName ?? DEFAULT_JOURNAL_SERVICE_CONFIG.tableName;
+    this.persistBatchSize = config.persistBatchSize ?? DEFAULT_JOURNAL_SERVICE_CONFIG.persistBatchSize;
+    this.persistIntervalMs = config.persistIntervalMs ?? DEFAULT_JOURNAL_SERVICE_CONFIG.persistIntervalMs;
+    validateTableName(this.tableName);
+    this.subscribe((event) => {
+      if (this.isLoadingFromStorage) return;
+      if (event.sequence >= 0n && this.getConfig().persistent) {
+        this.pendingPersist.push(event);
+        if (this.pendingPersist.length >= this.persistBatchSize) {
+          this.persistToStorage().catch((err) => {
+            logger.error({ err }, "Failed to persist journal events");
+          });
+        }
+      }
+    });
+    this.startPersistTimer();
+  }
+  /**
+   * Initialize the journal service, creating table if needed.
+   */
+  async initialize() {
+    if (this.isInitialized) return;
+    const client = await this.pool.connect();
+    try {
+      await client.query(`
+        CREATE TABLE IF NOT EXISTS ${this.tableName} (
+          sequence BIGINT PRIMARY KEY,
+          type VARCHAR(10) NOT NULL CHECK (type IN ('PUT', 'UPDATE', 'DELETE')),
+          map_name VARCHAR(255) NOT NULL,
+          key VARCHAR(1024) NOT NULL,
+          value JSONB,
+          previous_value JSONB,
+          timestamp JSONB NOT NULL,
+          node_id VARCHAR(64) NOT NULL,
+          metadata JSONB,
+          created_at TIMESTAMPTZ DEFAULT NOW()
+        );
+      `);
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS idx_${this.tableName}_map_name
+        ON ${this.tableName}(map_name);
+      `);
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS idx_${this.tableName}_key
+        ON ${this.tableName}(map_name, key);
+      `);
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS idx_${this.tableName}_created_at
+        ON ${this.tableName}(created_at);
+      `);
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS idx_${this.tableName}_node_id
+        ON ${this.tableName}(node_id);
+      `);
+      this.isInitialized = true;
+      logger.info({ tableName: this.tableName }, "EventJournalService initialized");
+    } finally {
+      client.release();
+    }
+  }
+  /**
+   * Persist pending events to PostgreSQL.
+   */
+  async persistToStorage() {
+    if (this.pendingPersist.length === 0 || this.isPersisting) return;
+    this.isPersisting = true;
+    const batch = this.pendingPersist.splice(0, this.persistBatchSize);
+    try {
+      if (batch.length === 0) return;
+      const values = [];
+      const placeholders = [];
+      batch.forEach((e, i) => {
+        const offset = i * 9;
+        placeholders.push(
+          `($${offset + 1}, $${offset + 2}, $${offset + 3}, $${offset + 4}, $${offset + 5}, $${offset + 6}, $${offset + 7}, $${offset + 8}, $${offset + 9})`
+        );
+        values.push(
+          e.sequence.toString(),
+          e.type,
+          e.mapName,
+          e.key,
+          e.value !== void 0 ? JSON.stringify(e.value) : null,
+          e.previousValue !== void 0 ? JSON.stringify(e.previousValue) : null,
+          JSON.stringify(e.timestamp),
+          e.nodeId,
+          e.metadata ? JSON.stringify(e.metadata) : null
+        );
+      });
+      await this.pool.query(
+        `INSERT INTO ${this.tableName}
+         (sequence, type, map_name, key, value, previous_value, timestamp, node_id, metadata)
+         VALUES ${placeholders.join(", ")}
+         ON CONFLICT (sequence) DO NOTHING`,
+        values
+      );
+      logger.debug({ count: batch.length }, "Persisted journal events");
+    } catch (error) {
+      this.pendingPersist.unshift(...batch);
+      throw error;
+    } finally {
+      this.isPersisting = false;
+    }
+  }
+  /**
+   * Load journal events from PostgreSQL on startup.
+   */
+  async loadFromStorage() {
+    const config = this.getConfig();
+    const result = await this.pool.query(
+      `SELECT sequence, type, map_name, key, value, previous_value, timestamp, node_id, metadata
+       FROM ${this.tableName}
+       ORDER BY sequence DESC
+       LIMIT $1`,
+      [config.capacity]
+    );
+    const events = result.rows.reverse();
+    this.isLoadingFromStorage = true;
+    try {
+      for (const row of events) {
+        this.append({
+          type: row.type,
+          mapName: row.map_name,
+          key: row.key,
+          value: row.value,
+          previousValue: row.previous_value,
+          timestamp: typeof row.timestamp === "string" ? JSON.parse(row.timestamp) : row.timestamp,
+          nodeId: row.node_id,
+          metadata: row.metadata
+        });
+      }
+    } finally {
+      this.isLoadingFromStorage = false;
+    }
+    logger.info({ count: events.length }, "Loaded journal events from storage");
+  }
+  /**
+   * Export events as NDJSON stream.
+   */
+  exportStream(options = {}) {
+    const self = this;
+    return new ReadableStream({
+      start(controller) {
+        const startSeq = options.fromSequence ?? self.getOldestSequence();
+        const endSeq = options.toSequence ?? self.getLatestSequence();
+        for (let seq = startSeq; seq <= endSeq; seq++) {
+          const events = self.readFrom(seq, 1);
+          if (events.length > 0) {
+            const event = events[0];
+            if (options.mapName && event.mapName !== options.mapName) continue;
+            if (options.types && !options.types.includes(event.type)) continue;
+            const serializable = {
+              ...event,
+              sequence: event.sequence.toString()
+            };
+            controller.enqueue(JSON.stringify(serializable) + "\n");
+          }
+        }
+        controller.close();
+      }
+    });
+  }
+  /**
+   * Get events for a specific map.
+   */
+  getMapEvents(mapName, fromSeq) {
+    const events = this.readFrom(fromSeq ?? this.getOldestSequence(), this.getConfig().capacity);
+    return events.filter((e) => e.mapName === mapName);
+  }
+  /**
+   * Query events from PostgreSQL with filters.
+   */
+  async queryFromStorage(options = {}) {
+    const conditions = [];
+    const params = [];
+    let paramIndex = 1;
+    if (options.mapName) {
+      conditions.push(`map_name = $${paramIndex++}`);
+      params.push(options.mapName);
+    }
+    if (options.key) {
+      conditions.push(`key = $${paramIndex++}`);
+      params.push(options.key);
+    }
+    if (options.types && options.types.length > 0) {
+      conditions.push(`type = ANY($${paramIndex++})`);
+      params.push(options.types);
+    }
+    if (options.fromSequence !== void 0) {
+      conditions.push(`sequence >= $${paramIndex++}`);
+      params.push(options.fromSequence.toString());
+    }
+    if (options.toSequence !== void 0) {
+      conditions.push(`sequence <= $${paramIndex++}`);
+      params.push(options.toSequence.toString());
+    }
+    if (options.fromDate) {
+      conditions.push(`created_at >= $${paramIndex++}`);
+      params.push(options.fromDate);
+    }
+    if (options.toDate) {
+      conditions.push(`created_at <= $${paramIndex++}`);
+      params.push(options.toDate);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const limit = options.limit ?? 100;
+    const offset = options.offset ?? 0;
+    const result = await this.pool.query(
+      `SELECT sequence, type, map_name, key, value, previous_value, timestamp, node_id, metadata
+       FROM ${this.tableName}
+       ${whereClause}
+       ORDER BY sequence ASC
+       LIMIT $${paramIndex++} OFFSET $${paramIndex++}`,
+      [...params, limit, offset]
+    );
+    return result.rows.map((row) => ({
+      sequence: BigInt(row.sequence),
+      type: row.type,
+      mapName: row.map_name,
+      key: row.key,
+      value: row.value,
+      previousValue: row.previous_value,
+      timestamp: typeof row.timestamp === "string" ? JSON.parse(row.timestamp) : row.timestamp,
+      nodeId: row.node_id,
+      metadata: row.metadata
+    }));
+  }
+  /**
+   * Count events matching filters.
+   */
+  async countFromStorage(options = {}) {
+    const conditions = [];
+    const params = [];
+    let paramIndex = 1;
+    if (options.mapName) {
+      conditions.push(`map_name = $${paramIndex++}`);
+      params.push(options.mapName);
+    }
+    if (options.types && options.types.length > 0) {
+      conditions.push(`type = ANY($${paramIndex++})`);
+      params.push(options.types);
+    }
+    if (options.fromDate) {
+      conditions.push(`created_at >= $${paramIndex++}`);
+      params.push(options.fromDate);
+    }
+    if (options.toDate) {
+      conditions.push(`created_at <= $${paramIndex++}`);
+      params.push(options.toDate);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = await this.pool.query(
+      `SELECT COUNT(*) as count FROM ${this.tableName} ${whereClause}`,
+      params
+    );
+    return parseInt(result.rows[0].count, 10);
+  }
+  /**
+   * Cleanup old events based on retention policy.
+   */
+  async cleanupOldEvents(retentionDays) {
+    const result = await this.pool.query(
+      `DELETE FROM ${this.tableName}
+       WHERE created_at < NOW() - ($1 || ' days')::INTERVAL
+       RETURNING sequence`,
+      [retentionDays]
+    );
+    const count = result.rowCount ?? 0;
+    if (count > 0) {
+      logger.info({ deletedCount: count, retentionDays }, "Cleaned up old journal events");
+    }
+    return count;
+  }
+  /**
+   * Start the periodic persistence timer.
+   */
+  startPersistTimer() {
+    this.persistTimer = setInterval(() => {
+      if (this.pendingPersist.length > 0) {
+        this.persistToStorage().catch((err) => {
+          logger.error({ err }, "Periodic persist failed");
+        });
+      }
+    }, this.persistIntervalMs);
+  }
+  /**
+   * Stop the periodic persistence timer.
+   */
+  stopPersistTimer() {
+    if (this.persistTimer) {
+      clearInterval(this.persistTimer);
+      this.persistTimer = void 0;
+    }
+  }
+  /**
+   * Dispose resources and persist remaining events.
+   */
+  dispose() {
+    this.stopPersistTimer();
+    if (this.pendingPersist.length > 0) {
+      this.persistToStorage().catch((err) => {
+        logger.error({ err }, "Final persist failed on dispose");
+      });
+    }
+    super.dispose();
+  }
+  /**
+   * Get pending persist count (for monitoring).
+   */
+  getPendingPersistCount() {
+    return this.pendingPersist.length;
+  }
+};
+
+// src/ServerCoordinator.ts
+var GC_INTERVAL_MS = 60 * 60 * 1e3;
+var GC_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+var CLIENT_HEARTBEAT_TIMEOUT_MS = 2e4;
+var CLIENT_HEARTBEAT_CHECK_INTERVAL_MS = 5e3;
+var ServerCoordinator = class {
+  constructor(config) {
+    this.clients = /* @__PURE__ */ new Map();
+    // Interceptors
+    this.interceptors = [];
+    // In-memory storage (partitioned later)
+    this.maps = /* @__PURE__ */ new Map();
+    this.pendingClusterQueries = /* @__PURE__ */ new Map();
+    // GC Consensus State
+    this.gcReports = /* @__PURE__ */ new Map();
+    // Track map loading state to avoid returning empty results during async load
+    this.mapLoadingPromises = /* @__PURE__ */ new Map();
+    // Track pending batch operations for testing purposes
+    this.pendingBatchOperations = /* @__PURE__ */ new Set();
+    this.journalSubscriptions = /* @__PURE__ */ new Map();
+    this._actualPort = 0;
+    this._actualClusterPort = 0;
+    this._readyPromise = new Promise((resolve) => {
+      this._readyResolve = resolve;
+    });
+    this._nodeId = config.nodeId;
+    this.hlc = new import_core15.HLC(config.nodeId);
+    this.storage = config.storage;
+    const rawSecret = config.jwtSecret || process.env.JWT_SECRET || "topgun-secret-dev";
+    this.jwtSecret = rawSecret.replace(/\\n/g, "\n");
+    this.queryRegistry = new QueryRegistry();
+    this.securityManager = new SecurityManager(config.securityPolicies || []);
+    this.interceptors = config.interceptors || [];
+    this.metricsService = new MetricsService();
+    this.eventExecutor = new StripedEventExecutor({
+      stripeCount: config.eventStripeCount ?? 4,
+      queueCapacity: config.eventQueueCapacity ?? 1e4,
+      name: `${config.nodeId}-event-executor`,
+      onReject: (task) => {
+        logger.warn({ nodeId: config.nodeId, key: task.key }, "Event task rejected due to queue capacity");
+        this.metricsService.incEventQueueRejected();
+      }
+    });
+    this.backpressure = new BackpressureRegulator({
+      syncFrequency: config.backpressureSyncFrequency ?? 100,
+      maxPendingOps: config.backpressureMaxPending ?? 1e3,
+      backoffTimeoutMs: config.backpressureBackoffMs ?? 5e3,
+      enabled: config.backpressureEnabled ?? true
+    });
+    this.writeCoalescingEnabled = config.writeCoalescingEnabled ?? true;
+    const preset = coalescingPresets[config.writeCoalescingPreset ?? "highThroughput"];
+    this.writeCoalescingOptions = {
+      maxBatchSize: config.writeCoalescingMaxBatch ?? preset.maxBatchSize,
+      maxDelayMs: config.writeCoalescingMaxDelayMs ?? preset.maxDelayMs,
+      maxBatchBytes: config.writeCoalescingMaxBytes ?? preset.maxBatchBytes
+    };
+    this.eventPayloadPool = createEventPayloadPool({
+      maxSize: 4096,
+      initialSize: 128
+    });
+    this.taskletScheduler = new TaskletScheduler({
+      defaultTimeBudgetMs: 5,
+      maxConcurrent: 20
+    });
+    this.writeAckManager = new WriteAckManager({
+      defaultTimeout: config.writeAckTimeout ?? 5e3
+    });
+    this.rateLimitingEnabled = config.rateLimitingEnabled ?? true;
+    this.rateLimiter = new ConnectionRateLimiter({
+      maxConnectionsPerSecond: config.maxConnectionsPerSecond ?? 100,
+      maxPendingConnections: config.maxPendingConnections ?? 1e3,
+      cooldownMs: 1e3
+    });
+    if (config.workerPoolEnabled) {
+      this.workerPool = new WorkerPool({
+        minWorkers: config.workerPoolConfig?.minWorkers ?? 2,
+        maxWorkers: config.workerPoolConfig?.maxWorkers,
+        taskTimeout: config.workerPoolConfig?.taskTimeout ?? 5e3,
+        idleTimeout: config.workerPoolConfig?.idleTimeout ?? 3e4,
+        autoRestart: config.workerPoolConfig?.autoRestart ?? true
+      });
+      this.merkleWorker = new MerkleWorker(this.workerPool);
+      this.crdtMergeWorker = new CRDTMergeWorker(this.workerPool);
+      this.serializationWorker = new SerializationWorker(this.workerPool);
+      logger.info({
+        minWorkers: config.workerPoolConfig?.minWorkers ?? 2,
+        maxWorkers: config.workerPoolConfig?.maxWorkers ?? "auto"
+      }, "Worker pool initialized for CPU-bound operations");
+    }
+    if (config.tls?.enabled) {
+      const tlsOptions = this.buildTLSOptions(config.tls);
+      this.httpServer = (0, import_https.createServer)(tlsOptions, (_req, res) => {
+        res.writeHead(200);
+        res.end("TopGun Server Running (Secure)");
+      });
+      logger.info("TLS enabled for client connections");
+    } else {
+      this.httpServer = (0, import_http.createServer)((_req, res) => {
+        res.writeHead(200);
+        res.end("TopGun Server Running");
+      });
+      if (process.env.NODE_ENV === "production") {
+        logger.warn("\u26A0\uFE0F  TLS is disabled! Client connections are NOT encrypted.");
+      }
+    }
+    const metricsPort = config.metricsPort !== void 0 ? config.metricsPort : 9090;
+    this.metricsServer = (0, import_http.createServer)(async (req, res) => {
+      if (req.url === "/metrics") {
+        try {
+          res.setHeader("Content-Type", this.metricsService.getContentType());
+          res.end(await this.metricsService.getMetrics());
+        } catch (err) {
+          res.statusCode = 500;
+          res.end("Internal Server Error");
+        }
+      } else {
+        res.statusCode = 404;
+        res.end();
+      }
+    });
+    this.metricsServer.listen(metricsPort, () => {
+      logger.info({ port: metricsPort }, "Metrics server listening");
+    });
+    this.metricsServer.on("error", (err) => {
+      logger.error({ err, port: metricsPort }, "Metrics server failed to start");
+    });
+    this.wss = new import_ws3.WebSocketServer({
+      server: this.httpServer,
+      // Increase backlog for pending connections (default Linux is 128)
+      backlog: config.wsBacklog ?? 511,
+      // Disable per-message deflate by default (CPU overhead)
+      perMessageDeflate: config.wsCompression ?? false,
+      // Max payload size (64MB default)
+      maxPayload: config.wsMaxPayload ?? 64 * 1024 * 1024,
+      // Skip UTF-8 validation for binary messages (performance)
+      skipUTF8Validation: true
+    });
+    this.wss.on("connection", (ws) => this.handleConnection(ws));
+    this.httpServer.maxConnections = config.maxConnections ?? 1e4;
+    this.httpServer.timeout = config.serverTimeout ?? 12e4;
+    this.httpServer.keepAliveTimeout = config.keepAliveTimeout ?? 5e3;
+    this.httpServer.headersTimeout = config.headersTimeout ?? 6e4;
+    this.httpServer.on("connection", (socket) => {
+      socket.setNoDelay(true);
+      socket.setKeepAlive(true, 6e4);
+    });
+    this.httpServer.listen(config.port, () => {
+      const addr = this.httpServer.address();
+      this._actualPort = typeof addr === "object" && addr ? addr.port : config.port;
+      logger.info({ port: this._actualPort }, "Server Coordinator listening");
+      const clusterPort = config.clusterPort ?? 0;
+      const peers = config.resolvePeers ? config.resolvePeers() : config.peers || [];
+      this.cluster = new ClusterManager({
+        nodeId: config.nodeId,
+        host: config.host || "localhost",
+        port: clusterPort,
+        peers,
+        discovery: config.discovery,
+        serviceName: config.serviceName,
+        discoveryInterval: config.discoveryInterval,
+        tls: config.clusterTls
+      });
+      this.partitionService = new PartitionService(this.cluster);
+      if (config.replicationEnabled !== false) {
+        this.replicationPipeline = new ReplicationPipeline(
+          this.cluster,
+          this.partitionService,
+          {
+            ...import_core15.DEFAULT_REPLICATION_CONFIG,
+            defaultConsistency: config.defaultConsistency ?? import_core15.ConsistencyLevel.EVENTUAL,
+            ...config.replicationConfig
+          }
+        );
+        this.replicationPipeline.setOperationApplier(this.applyReplicatedOperation.bind(this));
+        logger.info({ nodeId: config.nodeId }, "ReplicationPipeline initialized");
+      }
+      this.partitionService.on("rebalanced", (partitionMap, changes) => {
+        this.broadcastPartitionMap(partitionMap);
+      });
+      this.lockManager = new LockManager();
+      this.lockManager.on("lockGranted", (evt) => this.handleLockGranted(evt));
+      this.topicManager = new TopicManager({
+        cluster: this.cluster,
+        sendToClient: (clientId, message) => {
+          const client = this.clients.get(clientId);
+          if (client && client.socket.readyState === import_ws3.WebSocket.OPEN) {
+            client.writer.write(message);
+          }
+        }
+      });
+      this.counterHandler = new CounterHandler(this._nodeId);
+      this.entryProcessorHandler = new EntryProcessorHandler({ hlc: this.hlc });
+      this.conflictResolverHandler = new ConflictResolverHandler({ nodeId: this._nodeId });
+      this.conflictResolverHandler.onRejection((rejection) => {
+        this.notifyMergeRejection(rejection);
+      });
+      if (config.eventJournalEnabled && this.storage && "pool" in this.storage) {
+        const pool = this.storage.pool;
+        this.eventJournalService = new EventJournalService({
+          capacity: 1e4,
+          ttlMs: 0,
+          persistent: true,
+          pool,
+          ...config.eventJournalConfig
+        });
+        this.eventJournalService.initialize().then(() => {
+          logger.info("EventJournalService initialized");
+        }).catch((err) => {
+          logger.error({ err }, "Failed to initialize EventJournalService");
+        });
+      }
+      this.systemManager = new SystemManager(
+        this.cluster,
+        this.metricsService,
+        (name) => this.getMap(name)
+      );
+      this.setupClusterListeners();
+      this.cluster.start().then((actualClusterPort) => {
+        this._actualClusterPort = actualClusterPort;
+        this.metricsService.setClusterMembers(this.cluster.getMembers().length);
+        logger.info({ clusterPort: this._actualClusterPort }, "Cluster started");
+        this.systemManager.start();
+        this._readyResolve();
+      }).catch((err) => {
+        this._actualClusterPort = clusterPort;
+        this.metricsService.setClusterMembers(this.cluster.getMembers().length);
+        logger.info({ clusterPort: this._actualClusterPort }, "Cluster started (sync)");
+        this.systemManager.start();
+        this._readyResolve();
+      });
+    });
+    if (this.storage) {
+      this.storage.initialize().then(() => {
+        logger.info("Storage adapter initialized");
+      }).catch((err) => {
+        logger.error({ err }, "Failed to initialize storage");
+      });
+    }
+    this.startGarbageCollection();
+    this.startHeartbeatCheck();
+  }
+  /** Wait for server to be fully ready (ports assigned) */
+  ready() {
+    return this._readyPromise;
+  }
+  /**
+   * Wait for all pending batch operations to complete.
+   * Useful for tests that need to verify state after OP_BATCH.
    */
   async waitForPendingBatches() {
     if (this.pendingBatchOperations.size === 0) return;
@@ -6761,7 +8160,7 @@ var ServerCoordinator = class {
     this.metricsService.destroy();
     this.wss.close();
     logger.info(`Closing ${this.clients.size} client connections...`);
-    const shutdownMsg = (0, import_core10.serialize)({ type: "SHUTDOWN_PENDING", retryAfter: 5e3 });
+    const shutdownMsg = (0, import_core15.serialize)({ type: "SHUTDOWN_PENDING", retryAfter: 5e3 });
     for (const client of this.clients.values()) {
       try {
         if (client.socket.readyState === import_ws3.WebSocket.OPEN) {
@@ -6815,6 +8214,10 @@ var ServerCoordinator = class {
     this.eventPayloadPool.clear();
     this.taskletScheduler.shutdown();
     this.writeAckManager.shutdown();
+    this.entryProcessorHandler.dispose();
+    if (this.eventJournalService) {
+      this.eventJournalService.dispose();
+    }
     logger.info("Server Coordinator shutdown complete.");
   }
   async handleConnection(ws) {
@@ -6882,7 +8285,7 @@ var ServerCoordinator = class {
           buf = Buffer.from(message);
         }
         try {
-          data = (0, import_core10.deserialize)(buf);
+          data = (0, import_core15.deserialize)(buf);
         } catch (e) {
           try {
             const text = Buffer.isBuffer(buf) ? buf.toString() : new TextDecoder().decode(buf);
@@ -6921,6 +8324,7 @@ var ServerCoordinator = class {
       }
       this.lockManager.handleClientDisconnect(clientId);
       this.topicManager.unsubscribeAll(clientId);
+      this.counterHandler.unsubscribeAll(clientId);
       const members = this.cluster.getMembers();
       for (const memberId of members) {
         if (!this.cluster.isLocal(memberId)) {
@@ -6933,10 +8337,10 @@ var ServerCoordinator = class {
       this.clients.delete(clientId);
       this.metricsService.setConnectedClients(this.clients.size);
     });
-    ws.send((0, import_core10.serialize)({ type: "AUTH_REQUIRED" }));
+    ws.send((0, import_core15.serialize)({ type: "AUTH_REQUIRED" }));
   }
   async handleMessage(client, rawMessage) {
-    const parseResult = import_core10.MessageSchema.safeParse(rawMessage);
+    const parseResult = import_core15.MessageSchema.safeParse(rawMessage);
     if (!parseResult.success) {
       logger.error({ clientId: client.id, error: parseResult.error }, "Invalid message format from client");
       client.writer.write({
@@ -7176,7 +8580,7 @@ var ServerCoordinator = class {
         this.metricsService.incOp("GET", message.mapName);
         try {
           const mapForSync = await this.getMapAsync(message.mapName);
-          if (mapForSync instanceof import_core10.LWWMap) {
+          if (mapForSync instanceof import_core15.LWWMap) {
             const tree = mapForSync.getMerkleTree();
             const rootHash = tree.getRootHash();
             client.writer.write({
@@ -7214,7 +8618,7 @@ var ServerCoordinator = class {
         const { mapName, path } = message.payload;
         try {
           const mapForBucket = await this.getMapAsync(mapName);
-          if (mapForBucket instanceof import_core10.LWWMap) {
+          if (mapForBucket instanceof import_core15.LWWMap) {
             const treeForBucket = mapForBucket.getMerkleTree();
             const buckets = treeForBucket.getBuckets(path);
             const node = treeForBucket.getNode(path);
@@ -7343,6 +8747,219 @@ var ServerCoordinator = class {
         }
         break;
       }
+      // ============ Phase 5.2: PN Counter Handlers ============
+      case "COUNTER_REQUEST": {
+        const { name } = message.payload;
+        const response = this.counterHandler.handleCounterRequest(client.id, name);
+        client.writer.write(response);
+        logger.debug({ clientId: client.id, name }, "Counter request handled");
+        break;
+      }
+      case "COUNTER_SYNC": {
+        const { name, state } = message.payload;
+        const result = this.counterHandler.handleCounterSync(client.id, name, state);
+        client.writer.write(result.response);
+        for (const targetClientId of result.broadcastTo) {
+          const targetClient = this.clients.get(targetClientId);
+          if (targetClient && targetClient.socket.readyState === import_ws3.WebSocket.OPEN) {
+            targetClient.writer.write(result.broadcastMessage);
+          }
+        }
+        logger.debug({ clientId: client.id, name, broadcastCount: result.broadcastTo.length }, "Counter sync handled");
+        break;
+      }
+      // ============ Phase 5.03: Entry Processor Handlers ============
+      case "ENTRY_PROCESS": {
+        const { requestId, mapName, key, processor } = message;
+        if (!this.securityManager.checkPermission(client.principal, mapName, "PUT")) {
+          client.writer.write({
+            type: "ENTRY_PROCESS_RESPONSE",
+            requestId,
+            success: false,
+            error: `Access Denied for map ${mapName}`
+          }, true);
+          break;
+        }
+        const entryMap = this.getMap(mapName);
+        const { result, timestamp } = await this.entryProcessorHandler.executeOnKey(
+          entryMap,
+          key,
+          processor
+        );
+        client.writer.write({
+          type: "ENTRY_PROCESS_RESPONSE",
+          requestId,
+          success: result.success,
+          result: result.result,
+          newValue: result.newValue,
+          error: result.error
+        });
+        if (result.success && timestamp) {
+          const record = entryMap.getRecord(key);
+          if (record) {
+            this.queryRegistry.processChange(mapName, entryMap, key, record, void 0);
+          }
+        }
+        logger.debug({
+          clientId: client.id,
+          mapName,
+          key,
+          processor: processor.name,
+          success: result.success
+        }, "Entry processor executed");
+        break;
+      }
+      case "ENTRY_PROCESS_BATCH": {
+        const { requestId, mapName, keys, processor } = message;
+        if (!this.securityManager.checkPermission(client.principal, mapName, "PUT")) {
+          const errorResults = {};
+          for (const key of keys) {
+            errorResults[key] = {
+              success: false,
+              error: `Access Denied for map ${mapName}`
+            };
+          }
+          client.writer.write({
+            type: "ENTRY_PROCESS_BATCH_RESPONSE",
+            requestId,
+            results: errorResults
+          }, true);
+          break;
+        }
+        const batchMap = this.getMap(mapName);
+        const { results, timestamps } = await this.entryProcessorHandler.executeOnKeys(
+          batchMap,
+          keys,
+          processor
+        );
+        const resultsRecord = {};
+        for (const [key, keyResult] of results) {
+          resultsRecord[key] = {
+            success: keyResult.success,
+            result: keyResult.result,
+            newValue: keyResult.newValue,
+            error: keyResult.error
+          };
+        }
+        client.writer.write({
+          type: "ENTRY_PROCESS_BATCH_RESPONSE",
+          requestId,
+          results: resultsRecord
+        });
+        for (const [key] of timestamps) {
+          const record = batchMap.getRecord(key);
+          if (record) {
+            this.queryRegistry.processChange(mapName, batchMap, key, record, void 0);
+          }
+        }
+        logger.debug({
+          clientId: client.id,
+          mapName,
+          keyCount: keys.length,
+          processor: processor.name,
+          successCount: Array.from(results.values()).filter((r) => r.success).length
+        }, "Entry processor batch executed");
+        break;
+      }
+      // ============ Phase 5.05: Conflict Resolver Handlers ============
+      case "REGISTER_RESOLVER": {
+        const { requestId, mapName, resolver } = message;
+        if (!this.securityManager.checkPermission(client.principal, mapName, "PUT")) {
+          client.writer.write({
+            type: "REGISTER_RESOLVER_RESPONSE",
+            requestId,
+            success: false,
+            error: `Access Denied for map ${mapName}`
+          }, true);
+          break;
+        }
+        try {
+          this.conflictResolverHandler.registerResolver(
+            mapName,
+            {
+              name: resolver.name,
+              code: resolver.code,
+              priority: resolver.priority,
+              keyPattern: resolver.keyPattern
+            },
+            client.id
+          );
+          client.writer.write({
+            type: "REGISTER_RESOLVER_RESPONSE",
+            requestId,
+            success: true
+          });
+          logger.info({
+            clientId: client.id,
+            mapName,
+            resolverName: resolver.name,
+            priority: resolver.priority
+          }, "Conflict resolver registered");
+        } catch (err) {
+          const errorMessage = err instanceof Error ? err.message : String(err);
+          client.writer.write({
+            type: "REGISTER_RESOLVER_RESPONSE",
+            requestId,
+            success: false,
+            error: errorMessage
+          }, true);
+          logger.warn({
+            clientId: client.id,
+            mapName,
+            error: errorMessage
+          }, "Failed to register conflict resolver");
+        }
+        break;
+      }
+      case "UNREGISTER_RESOLVER": {
+        const { requestId, mapName, resolverName } = message;
+        if (!this.securityManager.checkPermission(client.principal, mapName, "PUT")) {
+          client.writer.write({
+            type: "UNREGISTER_RESOLVER_RESPONSE",
+            requestId,
+            success: false,
+            error: `Access Denied for map ${mapName}`
+          }, true);
+          break;
+        }
+        const removed = this.conflictResolverHandler.unregisterResolver(
+          mapName,
+          resolverName,
+          client.id
+        );
+        client.writer.write({
+          type: "UNREGISTER_RESOLVER_RESPONSE",
+          requestId,
+          success: removed,
+          error: removed ? void 0 : "Resolver not found or not owned by this client"
+        });
+        if (removed) {
+          logger.info({
+            clientId: client.id,
+            mapName,
+            resolverName
+          }, "Conflict resolver unregistered");
+        }
+        break;
+      }
+      case "LIST_RESOLVERS": {
+        const { requestId, mapName } = message;
+        if (mapName && !this.securityManager.checkPermission(client.principal, mapName, "READ")) {
+          client.writer.write({
+            type: "LIST_RESOLVERS_RESPONSE",
+            requestId,
+            resolvers: []
+          });
+          break;
+        }
+        const resolvers = this.conflictResolverHandler.listResolvers(mapName);
+        client.writer.write({
+          type: "LIST_RESOLVERS_RESPONSE",
+          requestId,
+          resolvers
+        });
+        break;
+      }
       // ============ Phase 4: Partition Map Request Handler ============
       case "PARTITION_MAP_REQUEST": {
         const clientVersion = message.payload?.currentVersion ?? 0;
@@ -7383,7 +9000,7 @@ var ServerCoordinator = class {
         this.metricsService.incOp("GET", message.mapName);
         try {
           const mapForSync = await this.getMapAsync(message.mapName, "OR");
-          if (mapForSync instanceof import_core10.ORMap) {
+          if (mapForSync instanceof import_core15.ORMap) {
             const tree = mapForSync.getMerkleTree();
             const rootHash = tree.getRootHash();
             client.writer.write({
@@ -7420,7 +9037,7 @@ var ServerCoordinator = class {
         const { mapName, path } = message.payload;
         try {
           const mapForBucket = await this.getMapAsync(mapName, "OR");
-          if (mapForBucket instanceof import_core10.ORMap) {
+          if (mapForBucket instanceof import_core15.ORMap) {
             const tree = mapForBucket.getMerkleTree();
             const buckets = tree.getBuckets(path);
             const isLeaf = tree.isLeaf(path);
@@ -7464,7 +9081,7 @@ var ServerCoordinator = class {
         const { mapName: diffMapName, keys } = message.payload;
         try {
           const mapForDiff = await this.getMapAsync(diffMapName, "OR");
-          if (mapForDiff instanceof import_core10.ORMap) {
+          if (mapForDiff instanceof import_core15.ORMap) {
             const entries = [];
             const allTombstones = mapForDiff.getTombstones();
             for (const key of keys) {
@@ -7496,7 +9113,7 @@ var ServerCoordinator = class {
         const { mapName: pushMapName, entries: pushEntries } = message.payload;
         try {
           const mapForPush = await this.getMapAsync(pushMapName, "OR");
-          if (mapForPush instanceof import_core10.ORMap) {
+          if (mapForPush instanceof import_core15.ORMap) {
             let totalAdded = 0;
             let totalUpdated = 0;
             for (const entry of pushEntries) {
@@ -7538,6 +9155,92 @@ var ServerCoordinator = class {
         }
         break;
       }
+      // === Event Journal Messages (Phase 5.04) ===
+      case "JOURNAL_SUBSCRIBE": {
+        if (!this.eventJournalService) {
+          client.writer.write({
+            type: "ERROR",
+            payload: { code: 503, message: "Event journal not enabled" }
+          }, true);
+          break;
+        }
+        const { requestId, fromSequence, mapName, types } = message;
+        const subscriptionId = requestId;
+        this.journalSubscriptions.set(subscriptionId, {
+          clientId: client.id,
+          mapName,
+          types
+        });
+        const unsubscribe = this.eventJournalService.subscribe(
+          (event) => {
+            if (mapName && event.mapName !== mapName) return;
+            if (types && types.length > 0 && !types.includes(event.type)) return;
+            const clientConn = this.clients.get(client.id);
+            if (!clientConn) {
+              unsubscribe();
+              this.journalSubscriptions.delete(subscriptionId);
+              return;
+            }
+            clientConn.writer.write({
+              type: "JOURNAL_EVENT",
+              event: {
+                sequence: event.sequence.toString(),
+                type: event.type,
+                mapName: event.mapName,
+                key: event.key,
+                value: event.value,
+                previousValue: event.previousValue,
+                timestamp: event.timestamp,
+                nodeId: event.nodeId,
+                metadata: event.metadata
+              }
+            });
+          },
+          fromSequence ? BigInt(fromSequence) : void 0
+        );
+        logger.info({ clientId: client.id, subscriptionId, mapName }, "Journal subscription created");
+        break;
+      }
+      case "JOURNAL_UNSUBSCRIBE": {
+        const { subscriptionId } = message;
+        this.journalSubscriptions.delete(subscriptionId);
+        logger.info({ clientId: client.id, subscriptionId }, "Journal subscription removed");
+        break;
+      }
+      case "JOURNAL_READ": {
+        if (!this.eventJournalService) {
+          client.writer.write({
+            type: "ERROR",
+            payload: { code: 503, message: "Event journal not enabled" }
+          }, true);
+          break;
+        }
+        const { requestId: readReqId, fromSequence: readFromSeq, limit, mapName: readMapName } = message;
+        const startSeq = BigInt(readFromSeq);
+        const eventLimit = limit ?? 100;
+        let events = this.eventJournalService.readFrom(startSeq, eventLimit);
+        if (readMapName) {
+          events = events.filter((e) => e.mapName === readMapName);
+        }
+        const serializedEvents = events.map((e) => ({
+          sequence: e.sequence.toString(),
+          type: e.type,
+          mapName: e.mapName,
+          key: e.key,
+          value: e.value,
+          previousValue: e.previousValue,
+          timestamp: e.timestamp,
+          nodeId: e.nodeId,
+          metadata: e.metadata
+        }));
+        client.writer.write({
+          type: "JOURNAL_READ_RESPONSE",
+          requestId: readReqId,
+          events: serializedEvents,
+          hasMore: events.length === eventLimit
+        });
+        break;
+      }
       default:
         logger.warn({ type: message.type }, "Unknown message type");
     }
@@ -7551,7 +9254,7 @@ var ServerCoordinator = class {
       } else if (op.orRecord && op.orRecord.timestamp) {
       } else if (op.orTag) {
         try {
-          ts = import_core10.HLC.parse(op.orTag);
+          ts = import_core15.HLC.parse(op.orTag);
         } catch (e) {
         }
       }
@@ -7585,6 +9288,39 @@ var ServerCoordinator = class {
       clientCount: broadcastCount
     }, "Broadcast partition map to clients");
   }
+  /**
+   * Notify a client about a merge rejection (Phase 5.05).
+   * Finds the client by node ID and sends MERGE_REJECTED message.
+   */
+  notifyMergeRejection(rejection) {
+    for (const [clientId, client] of this.clients) {
+      if (clientId === rejection.nodeId || rejection.nodeId.includes(clientId)) {
+        client.writer.write({
+          type: "MERGE_REJECTED",
+          mapName: rejection.mapName,
+          key: rejection.key,
+          attemptedValue: rejection.attemptedValue,
+          reason: rejection.reason,
+          timestamp: rejection.timestamp
+        }, true);
+        return;
+      }
+    }
+    const subscribedClientIds = this.queryRegistry.getSubscribedClientIds(rejection.mapName);
+    for (const clientId of subscribedClientIds) {
+      const client = this.clients.get(clientId);
+      if (client) {
+        client.writer.write({
+          type: "MERGE_REJECTED",
+          mapName: rejection.mapName,
+          key: rejection.key,
+          attemptedValue: rejection.attemptedValue,
+          reason: rejection.reason,
+          timestamp: rejection.timestamp
+        });
+      }
+    }
+  }
   broadcast(message, excludeClientId) {
     const isServerEvent = message.type === "SERVER_EVENT";
     if (isServerEvent) {
@@ -7615,7 +9351,7 @@ var ServerCoordinator = class {
         client.writer.write({ ...message, payload: newPayload });
       }
     } else {
-      const msgData = (0, import_core10.serialize)(message);
+      const msgData = (0, import_core15.serialize)(message);
       for (const [id, client] of this.clients) {
         if (id !== excludeClientId && client.socket.readyState === 1) {
           client.writer.writeRaw(msgData);
@@ -7693,7 +9429,7 @@ var ServerCoordinator = class {
         payload: { events: filteredEvents },
         timestamp: this.hlc.now()
       };
-      const serializedBatch = (0, import_core10.serialize)(batchMessage);
+      const serializedBatch = (0, import_core15.serialize)(batchMessage);
       for (const client of clients) {
         try {
           client.writer.writeRaw(serializedBatch);
@@ -7778,7 +9514,7 @@ var ServerCoordinator = class {
         payload: { events: filteredEvents },
         timestamp: this.hlc.now()
       };
-      const serializedBatch = (0, import_core10.serialize)(batchMessage);
+      const serializedBatch = (0, import_core15.serialize)(batchMessage);
       for (const client of clients) {
         sendPromises.push(new Promise((resolve, reject) => {
           try {
@@ -7922,14 +9658,14 @@ var ServerCoordinator = class {
   async executeLocalQuery(mapName, query) {
     const map = await this.getMapAsync(mapName);
     const records = /* @__PURE__ */ new Map();
-    if (map instanceof import_core10.LWWMap) {
+    if (map instanceof import_core15.LWWMap) {
       for (const key of map.allKeys()) {
         const rec = map.getRecord(key);
         if (rec && rec.value !== null) {
           records.set(key, rec);
         }
       }
-    } else if (map instanceof import_core10.ORMap) {
+    } else if (map instanceof import_core15.ORMap) {
       const items = map.items;
       for (const key of items.keys()) {
         const values = map.get(key);
@@ -7996,14 +9732,14 @@ var ServerCoordinator = class {
    *
    * @returns Event payload for broadcasting (or null if operation failed)
    */
-  applyOpToMap(op) {
+  async applyOpToMap(op, remoteNodeId) {
     const typeHint = op.opType === "OR_ADD" || op.opType === "OR_REMOVE" ? "OR" : "LWW";
     const map = this.getMap(op.mapName, typeHint);
-    if (typeHint === "OR" && map instanceof import_core10.LWWMap) {
+    if (typeHint === "OR" && map instanceof import_core15.LWWMap) {
       logger.error({ mapName: op.mapName }, "Map type mismatch: LWWMap but received OR op");
       throw new Error("Map type mismatch: LWWMap but received OR op");
     }
-    if (typeHint === "LWW" && map instanceof import_core10.ORMap) {
+    if (typeHint === "LWW" && map instanceof import_core15.ORMap) {
       logger.error({ mapName: op.mapName }, "Map type mismatch: ORMap but received LWW op");
       throw new Error("Map type mismatch: ORMap but received LWW op");
     }
@@ -8014,13 +9750,35 @@ var ServerCoordinator = class {
       mapName: op.mapName,
       key: op.key
     };
-    if (map instanceof import_core10.LWWMap) {
+    if (map instanceof import_core15.LWWMap) {
       oldRecord = map.getRecord(op.key);
-      map.merge(op.key, op.record);
-      recordToStore = op.record;
-      eventPayload.eventType = "UPDATED";
-      eventPayload.record = op.record;
-    } else if (map instanceof import_core10.ORMap) {
+      if (this.conflictResolverHandler.hasResolvers(op.mapName)) {
+        const mergeResult = await this.conflictResolverHandler.mergeWithResolver(
+          map,
+          op.mapName,
+          op.key,
+          op.record,
+          remoteNodeId || this._nodeId
+        );
+        if (!mergeResult.applied) {
+          if (mergeResult.rejection) {
+            logger.debug(
+              { mapName: op.mapName, key: op.key, reason: mergeResult.rejection.reason },
+              "Merge rejected by resolver"
+            );
+          }
+          return { eventPayload: null, oldRecord, rejected: true };
+        }
+        recordToStore = mergeResult.record;
+        eventPayload.eventType = "UPDATED";
+        eventPayload.record = mergeResult.record;
+      } else {
+        map.merge(op.key, op.record);
+        recordToStore = op.record;
+        eventPayload.eventType = "UPDATED";
+        eventPayload.record = op.record;
+      }
+    } else if (map instanceof import_core15.ORMap) {
       oldRecord = map.getRecords(op.key);
       if (op.opType === "OR_ADD") {
         map.apply(op.key, op.orRecord);
@@ -8036,7 +9794,7 @@ var ServerCoordinator = class {
       }
     }
     this.queryRegistry.processChange(op.mapName, map, op.key, op.record || op.orRecord, oldRecord);
-    const mapSize = map instanceof import_core10.ORMap ? map.totalRecords : map.size;
+    const mapSize = map instanceof import_core15.ORMap ? map.totalRecords : map.size;
     this.metricsService.setMapSize(op.mapName, mapSize);
     if (this.storage) {
       if (recordToStore) {
@@ -8050,6 +9808,21 @@ var ServerCoordinator = class {
         });
       }
     }
+    if (this.eventJournalService) {
+      const isDelete = op.opType === "REMOVE" || op.opType === "OR_REMOVE" || op.record && op.record.value === null;
+      const isNew = !oldRecord || Array.isArray(oldRecord) && oldRecord.length === 0;
+      const journalEventType = isDelete ? "DELETE" : isNew ? "PUT" : "UPDATE";
+      const timestamp = op.record?.timestamp || op.orRecord?.timestamp || this.hlc.now();
+      this.eventJournalService.append({
+        type: journalEventType,
+        mapName: op.mapName,
+        key: op.key,
+        value: op.record?.value ?? op.orRecord?.value,
+        previousValue: oldRecord?.value ?? (Array.isArray(oldRecord) ? oldRecord[0]?.value : void 0),
+        timestamp,
+        nodeId: this._nodeId
+      });
+    }
     return { eventPayload, oldRecord };
   }
   /**
@@ -8071,7 +9844,10 @@ var ServerCoordinator = class {
     try {
       const op = operation;
       logger.debug({ sourceNode, opId, mapName: op.mapName, key: op.key }, "Applying replicated operation");
-      const { eventPayload } = this.applyOpToMap(op);
+      const { eventPayload, rejected } = await this.applyOpToMap(op, sourceNode);
+      if (rejected || !eventPayload) {
+        return true;
+      }
       this.broadcast({
         type: "SERVER_EVENT",
         payload: eventPayload,
@@ -8170,7 +9946,10 @@ var ServerCoordinator = class {
       logger.warn({ err, opId: op.id }, "Interceptor rejected op");
       throw err;
     }
-    const { eventPayload } = this.applyOpToMap(op);
+    const { eventPayload, rejected } = await this.applyOpToMap(op, originalSenderId);
+    if (rejected || !eventPayload) {
+      return;
+    }
     if (this.replicationPipeline && !fromCluster) {
       const opId = op.id || `${op.mapName}:${op.key}:${Date.now()}`;
       this.replicationPipeline.replicate(op, opId, op.key).catch((err) => {
@@ -8298,7 +10077,10 @@ var ServerCoordinator = class {
       logger.warn({ err, opId: op.id }, "Interceptor rejected op in batch");
       throw err;
     }
-    const { eventPayload } = this.applyOpToMap(op);
+    const { eventPayload, rejected } = await this.applyOpToMap(op, clientId);
+    if (rejected || !eventPayload) {
+      return;
+    }
     if (this.replicationPipeline) {
       const opId = op.id || `${op.mapName}:${op.key}:${Date.now()}`;
       this.replicationPipeline.replicate(op, opId, op.key).catch((err) => {
@@ -8312,11 +10094,11 @@ var ServerCoordinator = class {
   handleClusterEvent(payload) {
     const { mapName, key, eventType } = payload;
     const map = this.getMap(mapName, eventType === "OR_ADD" || eventType === "OR_REMOVE" ? "OR" : "LWW");
-    const oldRecord = map instanceof import_core10.LWWMap ? map.getRecord(key) : null;
+    const oldRecord = map instanceof import_core15.LWWMap ? map.getRecord(key) : null;
     if (this.partitionService.isRelated(key)) {
-      if (map instanceof import_core10.LWWMap && payload.record) {
+      if (map instanceof import_core15.LWWMap && payload.record) {
         map.merge(key, payload.record);
-      } else if (map instanceof import_core10.ORMap) {
+      } else if (map instanceof import_core15.ORMap) {
         if (eventType === "OR_ADD" && payload.orRecord) {
           map.apply(key, payload.orRecord);
         } else if (eventType === "OR_REMOVE" && payload.orTag) {
@@ -8335,9 +10117,9 @@ var ServerCoordinator = class {
     if (!this.maps.has(name)) {
       let map;
       if (typeHint === "OR") {
-        map = new import_core10.ORMap(this.hlc);
+        map = new import_core15.ORMap(this.hlc);
       } else {
-        map = new import_core10.LWWMap(this.hlc);
+        map = new import_core15.LWWMap(this.hlc);
       }
       this.maps.set(name, map);
       if (this.storage) {
@@ -8360,7 +10142,7 @@ var ServerCoordinator = class {
     this.getMap(name, typeHint);
     const loadingPromise = this.mapLoadingPromises.get(name);
     const map = this.maps.get(name);
-    const mapSize = map instanceof import_core10.LWWMap ? Array.from(map.entries()).length : map instanceof import_core10.ORMap ? map.size : 0;
+    const mapSize = map instanceof import_core15.LWWMap ? Array.from(map.entries()).length : map instanceof import_core15.ORMap ? map.size : 0;
     logger.info({
       mapName: name,
       mapExisted,
@@ -8370,7 +10152,7 @@ var ServerCoordinator = class {
     if (loadingPromise) {
       logger.info({ mapName: name }, "[getMapAsync] Waiting for loadMapFromStorage...");
       await loadingPromise;
-      const newMapSize = map instanceof import_core10.LWWMap ? Array.from(map.entries()).length : map instanceof import_core10.ORMap ? map.size : 0;
+      const newMapSize = map instanceof import_core15.LWWMap ? Array.from(map.entries()).length : map instanceof import_core15.ORMap ? map.size : 0;
       logger.info({ mapName: name, mapSizeAfterLoad: newMapSize }, "[getMapAsync] Load completed");
     }
     return this.maps.get(name);
@@ -8396,16 +10178,16 @@ var ServerCoordinator = class {
       const currentMap = this.maps.get(name);
       if (!currentMap) return;
       let targetMap = currentMap;
-      if (isOR && currentMap instanceof import_core10.LWWMap) {
+      if (isOR && currentMap instanceof import_core15.LWWMap) {
         logger.info({ mapName: name }, "Map auto-detected as ORMap. Switching type.");
-        targetMap = new import_core10.ORMap(this.hlc);
+        targetMap = new import_core15.ORMap(this.hlc);
         this.maps.set(name, targetMap);
-      } else if (!isOR && currentMap instanceof import_core10.ORMap && typeHint !== "OR") {
+      } else if (!isOR && currentMap instanceof import_core15.ORMap && typeHint !== "OR") {
         logger.info({ mapName: name }, "Map auto-detected as LWWMap. Switching type.");
-        targetMap = new import_core10.LWWMap(this.hlc);
+        targetMap = new import_core15.LWWMap(this.hlc);
         this.maps.set(name, targetMap);
       }
-      if (targetMap instanceof import_core10.ORMap) {
+      if (targetMap instanceof import_core15.ORMap) {
         for (const [key, record] of records) {
           if (key === "__tombstones__") {
             const t = record;
@@ -8418,7 +10200,7 @@ var ServerCoordinator = class {
             }
           }
         }
-      } else if (targetMap instanceof import_core10.LWWMap) {
+      } else if (targetMap instanceof import_core15.LWWMap) {
         for (const [key, record] of records) {
           if (!record.type) {
             targetMap.merge(key, record);
@@ -8429,7 +10211,7 @@ var ServerCoordinator = class {
       if (count > 0) {
         logger.info({ mapName: name, count }, "Loaded records for map");
         this.queryRegistry.refreshSubscriptions(name, targetMap);
-        const mapSize = targetMap instanceof import_core10.ORMap ? targetMap.totalRecords : targetMap.size;
+        const mapSize = targetMap instanceof import_core15.ORMap ? targetMap.totalRecords : targetMap.size;
         this.metricsService.setMapSize(name, mapSize);
       }
     } catch (err) {
@@ -8511,7 +10293,7 @@ var ServerCoordinator = class {
   reportLocalHlc() {
     let minHlc = this.hlc.now();
     for (const client of this.clients.values()) {
-      if (import_core10.HLC.compare(client.lastActiveHlc, minHlc) < 0) {
+      if (import_core15.HLC.compare(client.lastActiveHlc, minHlc) < 0) {
         minHlc = client.lastActiveHlc;
       }
     }
@@ -8532,7 +10314,7 @@ var ServerCoordinator = class {
       let globalSafe = this.hlc.now();
       let initialized = false;
       for (const ts of this.gcReports.values()) {
-        if (!initialized || import_core10.HLC.compare(ts, globalSafe) < 0) {
+        if (!initialized || import_core15.HLC.compare(ts, globalSafe) < 0) {
           globalSafe = ts;
           initialized = true;
         }
@@ -8567,7 +10349,7 @@ var ServerCoordinator = class {
     logger.info({ olderThanMillis: olderThan.millis }, "Performing Garbage Collection");
     const now = Date.now();
     for (const [name, map] of this.maps) {
-      if (map instanceof import_core10.LWWMap) {
+      if (map instanceof import_core15.LWWMap) {
         for (const key of map.allKeys()) {
           const record = map.getRecord(key);
           if (record && record.value !== null && record.ttlMs) {
@@ -8619,7 +10401,7 @@ var ServerCoordinator = class {
             });
           }
         }
-      } else if (map instanceof import_core10.ORMap) {
+      } else if (map instanceof import_core15.ORMap) {
         const items = map.items;
         const tombstonesSet = map.tombstones;
         const tagsToExpire = [];
@@ -8722,17 +10504,17 @@ var ServerCoordinator = class {
   stringToWriteConcern(value) {
     switch (value) {
       case "FIRE_AND_FORGET":
-        return import_core10.WriteConcern.FIRE_AND_FORGET;
+        return import_core15.WriteConcern.FIRE_AND_FORGET;
       case "MEMORY":
-        return import_core10.WriteConcern.MEMORY;
+        return import_core15.WriteConcern.MEMORY;
       case "APPLIED":
-        return import_core10.WriteConcern.APPLIED;
+        return import_core15.WriteConcern.APPLIED;
       case "REPLICATED":
-        return import_core10.WriteConcern.REPLICATED;
+        return import_core15.WriteConcern.REPLICATED;
       case "PERSISTED":
-        return import_core10.WriteConcern.PERSISTED;
+        return import_core15.WriteConcern.PERSISTED;
       default:
-        return import_core10.WriteConcern.MEMORY;
+        return import_core15.WriteConcern.MEMORY;
     }
   }
   /**
@@ -8789,7 +10571,7 @@ var ServerCoordinator = class {
             }
           });
           if (op.id) {
-            this.writeAckManager.notifyLevel(op.id, import_core10.WriteConcern.REPLICATED);
+            this.writeAckManager.notifyLevel(op.id, import_core15.WriteConcern.REPLICATED);
           }
         }
       }
@@ -8797,7 +10579,7 @@ var ServerCoordinator = class {
         this.broadcastBatch(batchedEvents, clientId);
         for (const op of ops) {
           if (op.id && this.partitionService.isLocalOwner(op.key)) {
-            this.writeAckManager.notifyLevel(op.id, import_core10.WriteConcern.REPLICATED);
+            this.writeAckManager.notifyLevel(op.id, import_core15.WriteConcern.REPLICATED);
           }
         }
       }
@@ -8825,7 +10607,7 @@ var ServerCoordinator = class {
         const owner = this.partitionService.getOwner(op.key);
         await this.forwardOpAndWait(op, owner);
         if (op.id) {
-          this.writeAckManager.notifyLevel(op.id, import_core10.WriteConcern.REPLICATED);
+          this.writeAckManager.notifyLevel(op.id, import_core15.WriteConcern.REPLICATED);
         }
       }
     }
@@ -8833,7 +10615,7 @@ var ServerCoordinator = class {
       await this.broadcastBatchSync(batchedEvents, clientId);
       for (const op of ops) {
         if (op.id && this.partitionService.isLocalOwner(op.key)) {
-          this.writeAckManager.notifyLevel(op.id, import_core10.WriteConcern.REPLICATED);
+          this.writeAckManager.notifyLevel(op.id, import_core15.WriteConcern.REPLICATED);
         }
       }
     }
@@ -8859,9 +10641,15 @@ var ServerCoordinator = class {
       }
       return;
     }
-    const { eventPayload } = this.applyOpToMap(op);
+    const { eventPayload, rejected } = await this.applyOpToMap(op, clientId);
+    if (rejected) {
+      if (op.id) {
+        this.writeAckManager.failPending(op.id, "Rejected by conflict resolver");
+      }
+      return;
+    }
     if (op.id) {
-      this.writeAckManager.notifyLevel(op.id, import_core10.WriteConcern.APPLIED);
+      this.writeAckManager.notifyLevel(op.id, import_core15.WriteConcern.APPLIED);
     }
     if (eventPayload) {
       batchedEvents.push({
@@ -8875,7 +10663,7 @@ var ServerCoordinator = class {
       try {
         await this.persistOpSync(op);
         if (op.id) {
-          this.writeAckManager.notifyLevel(op.id, import_core10.WriteConcern.PERSISTED);
+          this.writeAckManager.notifyLevel(op.id, import_core15.WriteConcern.PERSISTED);
         }
       } catch (err) {
         logger.error({ opId: op.id, err }, "Persistence failed");
@@ -8941,9 +10729,9 @@ var ServerCoordinator = class {
 // src/storage/PostgresAdapter.ts
 var import_pg = require("pg");
 var DEFAULT_TABLE_NAME = "topgun_maps";
-var TABLE_NAME_REGEX = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-function validateTableName(name) {
-  if (!TABLE_NAME_REGEX.test(name)) {
+var TABLE_NAME_REGEX2 = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+function validateTableName2(name) {
+  if (!TABLE_NAME_REGEX2.test(name)) {
     throw new Error(
       `Invalid table name "${name}". Table name must start with a letter or underscore and contain only alphanumeric characters and underscores.`
     );
@@ -8957,7 +10745,7 @@ var PostgresAdapter = class {
       this.pool = new import_pg.Pool(configOrPool);
     }
     const tableName = options?.tableName ?? DEFAULT_TABLE_NAME;
-    validateTableName(tableName);
+    validateTableName2(tableName);
     this.tableName = tableName;
   }
   async initialize() {
@@ -9218,10 +11006,10 @@ var RateLimitInterceptor = class {
 };
 
 // src/utils/nativeStats.ts
-var import_core11 = require("@topgunbuild/core");
+var import_core16 = require("@topgunbuild/core");
 function getNativeModuleStatus() {
   return {
-    nativeHash: (0, import_core11.isUsingNativeHash)(),
+    nativeHash: (0, import_core16.isUsingNativeHash)(),
     sharedArrayBuffer: SharedMemoryManager.isAvailable()
   };
 }
@@ -9255,11 +11043,11 @@ function logNativeStatus() {
 
 // src/cluster/ClusterCoordinator.ts
 var import_events9 = require("events");
-var import_core12 = require("@topgunbuild/core");
+var import_core17 = require("@topgunbuild/core");
 var DEFAULT_CLUSTER_COORDINATOR_CONFIG = {
   gradualRebalancing: true,
-  migration: import_core12.DEFAULT_MIGRATION_CONFIG,
-  replication: import_core12.DEFAULT_REPLICATION_CONFIG,
+  migration: import_core17.DEFAULT_MIGRATION_CONFIG,
+  replication: import_core17.DEFAULT_REPLICATION_CONFIG,
   replicationEnabled: true
 };
 var ClusterCoordinator = class extends import_events9.EventEmitter {
@@ -9625,25 +11413,224 @@ var ClusterCoordinator = class extends import_events9.EventEmitter {
     }
   }
 };
+
+// src/MapWithResolver.ts
+var import_core18 = require("@topgunbuild/core");
+var MapWithResolver = class {
+  constructor(config) {
+    this.mapName = config.name;
+    this.hlc = new import_core18.HLC(config.nodeId);
+    this.map = new import_core18.LWWMap(this.hlc);
+    this.resolverService = config.resolverService;
+    this.onRejection = config.onRejection;
+  }
+  /**
+   * Get the map name.
+   */
+  get name() {
+    return this.mapName;
+  }
+  /**
+   * Get the underlying LWWMap.
+   */
+  get rawMap() {
+    return this.map;
+  }
+  /**
+   * Get a value by key.
+   */
+  get(key) {
+    return this.map.get(key);
+  }
+  /**
+   * Get the full record for a key.
+   */
+  getRecord(key) {
+    return this.map.getRecord(key);
+  }
+  /**
+   * Get the timestamp for a key.
+   */
+  getTimestamp(key) {
+    return this.map.getRecord(key)?.timestamp;
+  }
+  /**
+   * Set a value locally (no resolver).
+   * Use for server-initiated writes.
+   */
+  set(key, value, ttlMs) {
+    return this.map.set(key, value, ttlMs);
+  }
+  /**
+   * Set a value with conflict resolution.
+   * Use for client-initiated writes.
+   *
+   * @param key The key to set
+   * @param value The new value
+   * @param timestamp The client's timestamp
+   * @param remoteNodeId The client's node ID
+   * @param auth Optional authentication context
+   * @returns Result containing applied status and merge result
+   */
+  async setWithResolver(key, value, timestamp, remoteNodeId, auth) {
+    const context = {
+      mapName: this.mapName,
+      key,
+      localValue: this.map.get(key),
+      remoteValue: value,
+      localTimestamp: this.getTimestamp(key),
+      remoteTimestamp: timestamp,
+      remoteNodeId,
+      auth,
+      readEntry: (k) => this.map.get(k)
+    };
+    const result = await this.resolverService.resolve(context);
+    switch (result.action) {
+      case "accept": {
+        const record2 = {
+          value: result.value,
+          timestamp
+        };
+        this.map.merge(key, record2);
+        return { applied: true, result, record: record2 };
+      }
+      case "merge": {
+        const record2 = {
+          value: result.value,
+          timestamp
+        };
+        this.map.merge(key, record2);
+        return { applied: true, result, record: record2 };
+      }
+      case "reject": {
+        if (this.onRejection) {
+          this.onRejection({
+            mapName: this.mapName,
+            key,
+            attemptedValue: value,
+            reason: result.reason,
+            timestamp,
+            nodeId: remoteNodeId
+          });
+        }
+        return { applied: false, result };
+      }
+      case "local": {
+        return { applied: false, result };
+      }
+      default:
+        const record = {
+          value: result.value ?? value,
+          timestamp
+        };
+        this.map.merge(key, record);
+        return { applied: true, result, record };
+    }
+  }
+  /**
+   * Remove a key.
+   */
+  remove(key) {
+    return this.map.remove(key);
+  }
+  /**
+   * Standard merge without resolver (for sync operations).
+   */
+  merge(key, record) {
+    return this.map.merge(key, record);
+  }
+  /**
+   * Merge with resolver support.
+   * Equivalent to setWithResolver but takes a full record.
+   */
+  async mergeWithResolver(key, record, remoteNodeId, auth) {
+    if (record.value === null) {
+      const applied = this.map.merge(key, record);
+      return {
+        applied,
+        result: applied ? { action: "accept", value: record.value } : { action: "local" },
+        record: applied ? record : void 0
+      };
+    }
+    return this.setWithResolver(
+      key,
+      record.value,
+      record.timestamp,
+      remoteNodeId,
+      auth
+    );
+  }
+  /**
+   * Clear all data.
+   */
+  clear() {
+    this.map.clear();
+  }
+  /**
+   * Get map size.
+   */
+  get size() {
+    return this.map.size;
+  }
+  /**
+   * Iterate over entries.
+   */
+  entries() {
+    return this.map.entries();
+  }
+  /**
+   * Get all keys.
+   */
+  allKeys() {
+    return this.map.allKeys();
+  }
+  /**
+   * Subscribe to changes.
+   */
+  onChange(callback) {
+    return this.map.onChange(callback);
+  }
+  /**
+   * Get MerkleTree for sync.
+   */
+  getMerkleTree() {
+    return this.map.getMerkleTree();
+  }
+  /**
+   * Prune old tombstones.
+   */
+  prune(olderThan) {
+    return this.map.prune(olderThan);
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BufferPool,
   ClusterCoordinator,
   ClusterManager,
+  ConflictResolverHandler,
+  ConflictResolverService,
   ConnectionRateLimiter,
   DEFAULT_CLUSTER_COORDINATOR_CONFIG,
+  DEFAULT_CONFLICT_RESOLVER_CONFIG,
+  DEFAULT_JOURNAL_SERVICE_CONFIG,
   DEFAULT_LAG_TRACKER_CONFIG,
+  DEFAULT_SANDBOX_CONFIG,
+  EntryProcessorHandler,
+  EventJournalService,
   FilterTasklet,
   ForEachTasklet,
   IteratorTasklet,
   LagTracker,
   LockManager,
   MapTasklet,
+  MapWithResolver,
   MemoryServerAdapter,
   MigrationManager,
   ObjectPool,
   PartitionService,
   PostgresAdapter,
+  ProcessorSandbox,
   RateLimitInterceptor,
   ReduceTasklet,
   ReplicationPipeline,