reflectdb 0.1.0

package/dist/server/index.d.ts

@@ -0,0 +1,1988 @@
+type OpType = "insert" | "update" | "delete";
+/**
+* Server-side conflict policy for concurrent writes to the same row.
+*
+* Scope note for `"merge"`: the server resolves per column using the **client
+* op HLCs** recorded in reflectdb's mirror, so two clients editing different
+* fields both land. The per-column clocks the client sees on a broadcast are a
+* different domain — a diff-driven broadcast can't attribute a column to the
+* op that produced it, so every column changed in one broadcast carries that
+* broadcast's HLC. Client-side merge therefore orders *broadcasts* against each
+* other and against local optimistic state; it does not reconstruct per-column
+* causality between clients. Column-level convergence is a server guarantee.
+*/
+type ConflictPolicy = "lww" | "merge" | "server" | CustomConflictPolicy;
+interface CustomConflictPolicy {
+	policy: "custom";
+	resolve: ConflictResolver;
+}
+interface ConflictResolver {
+	(incoming: {
+		op: OpType;
+		payload: Record<string, unknown> | null;
+		hlc: string;
+	}, existing: {
+		row: Record<string, unknown>;
+		colClocks: Record<string, string>;
+	}, meta: {
+		table: string;
+		rowId: string;
+		userId: string;
+	}): {
+		row: Record<string, unknown>;
+	};
+}
+type ErrorReason = "outside_shape" | "readonly_query" | "rate_limited" | "buffer_full" | "server_conflict" | "custom_conflict" | "merge_stale" | "clock_drift" | "replay" | "batch_too_large" | "schema_outdated" | "auth_revoked" | "compacted" | "mutation_rejected" | "server_error" | "unknown_query";
+interface HelloMessage {
+	type: "hello";
+	/** Highest protocol version the client prefers. Retained for back-compat. */
+	protocolVersion: number;
+	/** All versions the client can speak. Omit for legacy single-version clients. */
+	supportedVersions?: readonly number[];
+	clientId: string;
+	token: string;
+}
+interface BootstrapMessage {
+	type: "bootstrap";
+	syncParams?: Record<string, Record<string, unknown>>;
+}
+interface ResumeMessage {
+	type: "resume";
+	since: string;
+}
+interface OpsMessage {
+	type: "ops";
+	ops: ClientOp[];
+	token: string;
+}
+interface ClientOp {
+	id: string;
+	table: string;
+	op: OpType;
+	rowId: string;
+	payload: Record<string, unknown> | null;
+	hlc: string;
+	batchId?: string;
+	batchSize?: number;
+	batchSeq?: number;
+}
+interface SyncDeclareMessage {
+	type: "sync_declare";
+	table: string;
+	params?: Record<string, unknown>;
+	window?: number;
+}
+interface LoadMoreMessage {
+	type: "load_more";
+	table: string;
+	count: number;
+}
+interface UnsyncMessage {
+	type: "unsync";
+	table: string;
+}
+interface AuthMessage {
+	type: "auth";
+	token: string;
+}
+interface EphemeralMessage {
+	type: "ephemeral";
+	key: string;
+	userId: string;
+	data: Record<string, unknown>;
+	ttlMs?: number;
+}
+interface HelloAckMessage {
+	type: "hello_ack";
+	protocolVersion: number;
+	serverId: string;
+}
+interface HelloRejectMessage {
+	type: "hello_reject";
+	reason: string;
+	supported: number[];
+}
+interface SnapshotMessage {
+	type: "snapshot";
+	table: string;
+	rows: Record<string, unknown>[];
+	colClocks: Record<string, Record<string, string>>;
+	append?: boolean;
+	totalCount?: number;
+	/**
+	* Primary key column name for this table. Self-contained per message so the
+	* client doesn't depend on `bootstrap_complete.tableMeta` arriving first.
+	* When omitted (older servers), the client falls back to tableMeta, then "id".
+	*/
+	pk?: string;
+}
+interface BootstrapCompleteMessage {
+	type: "bootstrap_complete";
+	serverHlc: string;
+	tableMeta: Record<string, TableMeta>;
+}
+interface TableMeta {
+	serverSet: string[];
+	readonly: string[];
+	broadcast: "consistent" | "eager" | "eager-durable";
+	/** Primary key column name. Defaults to "id" when omitted (older servers). */
+	pk?: string;
+}
+interface DeltaMessage {
+	type: "delta";
+	table: string;
+	op: OpType;
+	rowId: string;
+	payload: Record<string, unknown> | null;
+	hlc: string;
+	colClocks?: Record<string, string>;
+}
+interface AckMessage {
+	type: "ack";
+	opIds: string[];
+}
+interface RejectMessage {
+	type: "reject";
+	opId?: string;
+	batchId?: string;
+	reason: ErrorReason;
+	serverRow?: Record<string, unknown>;
+}
+interface ResumeCompleteMessage {
+	type: "resume_complete";
+	serverHlc: string;
+}
+interface ResumeRejectedMessage {
+	type: "resume_rejected";
+	reason: string;
+	serverHlc: string;
+}
+interface ShapeChangedMessage {
+	type: "shape_changed";
+	table: string;
+	reason: "auth_changed" | "params_changed" | "server_policy";
+}
+interface DisconnectMessage {
+	type: "disconnect";
+	reason: string;
+}
+interface ReauthMessage {
+	type: "reauth";
+}
+interface CountChangedMessage {
+	type: "count_changed";
+	table: string;
+	totalCount: number;
+}
+interface EphemeralEvent {
+	type: "ephemeral";
+	key: string;
+	clientId: string;
+	userId: string;
+	data: Record<string, unknown>;
+	ttlMs?: number;
+}
+type ClientMessage = HelloMessage | BootstrapMessage | ResumeMessage | OpsMessage | SyncDeclareMessage | LoadMoreMessage | UnsyncMessage | AuthMessage | EphemeralMessage;
+type ServerMessage = HelloAckMessage | HelloRejectMessage | SnapshotMessage | BootstrapCompleteMessage | DeltaMessage | AckMessage | RejectMessage | ResumeCompleteMessage | ResumeRejectedMessage | ShapeChangedMessage | DisconnectMessage | ReauthMessage | EphemeralEvent | CountChangedMessage;
+interface ServerTransport {
+	/**
+	* Deliver a message to one client.
+	*
+	* MUST reject (ideally with `TransportSendError`) when the frame could not
+	* be handed to the peer — unknown/closed socket, full outbound queue, or a
+	* throw from the underlying socket. Resolving on a dropped frame makes the
+	* broadcast engine commit result-cache state the client never received.
+	*/
+	send(clientId: string, message: ServerMessage): Promise<void>;
+	broadcast(roomId: string, message: ServerMessage, exclude?: string): Promise<void>;
+	onMessage(handler: (clientId: string, message: ClientMessage) => void): void;
+	onConnect(handler: (clientId: string, req: Request) => void): void;
+	onDisconnect(handler: (clientId: string) => void): void;
+	close(): Promise<void>;
+	/**
+	* Force-disconnect a single client. Optional — if absent, the handler relies
+	* on the client honoring a `disconnect` server-message. Required for any
+	* transport that carries authentication state, since an adversarial client
+	* can otherwise ignore the message and continue using a revoked session.
+	*/
+	disconnect?(clientId: string): Promise<void> | void;
+}
+interface RateLimitConfig {
+	opsPerSecond?: number;
+	opsPerMinute?: number;
+	batchesPerMinute?: number;
+	/**
+	* Per-table overrides. Applied in addition to the global limit: a write
+	* must pass both. Tables missing from this map inherit only the global
+	* bucket. Use to tighten write pressure on hot tables (e.g. ephemeral
+	* chat) without punishing cold ones.
+	*/
+	perTable?: Record<string, {
+		opsPerSecond?: number;
+		opsPerMinute?: number;
+	}>;
+	/**
+	* Ceiling on ephemeral (presence/cursor) messages per client per second.
+	* Metered separately from writes so presence traffic and the write budget
+	* don't starve each other. Defaults to 60; 0 disables metering entirely
+	* (each ephemeral message fans out to every room subscriber, so an
+	* unmetered channel is an amplification vector).
+	*/
+	ephemeralPerSecond?: number;
+}
+interface CompactionConfig {
+	clientInactivityTimeout: string;
+	interval: string;
+	minOpAge: string;
+}
+interface AuthContext {
+	userId: string;
+	[key: string]: unknown;
+}
+declare class MutationError extends Error {
+	reason: ErrorReason;
+	constructor(reason: ErrorReason, message?: string);
+}
+interface DrizzleTableLike {
+	$inferSelect: Record<string, unknown>;
+	$inferInsert: Record<string, unknown>;
+}
+/**
+* Value supplied per serverSet field in the schema's object form.
+* Either a static value or a function that receives the request context.
+*/
+type ServerSetSchemaValue = unknown | ((ctx: {
+	auth: unknown;
+	params: unknown;
+}) => unknown);
+/**
+* Schema-side `serverSet` declaration. Two shapes:
+*  - `string[]` — keys only; values are supplied at `implement(...)` time.
+*  - `Record<string, ServerSetSchemaValue>` — keys + values collocated in schema.
+*/
+type SchemaServerSet = readonly string[] | Readonly<Record<string, ServerSetSchemaValue>>;
+interface SyncQueryDef {
+	/** Drizzle table — row type derived from $inferSelect */
+	table?: DrizzleTableLike;
+	/** Phantom row type for non-drizzle usage: `{} as MyRow` */
+	row?: Record<string, unknown>;
+	/** Database tables for change detection. Falls back to query key name. */
+	tables?: string[];
+	/** Phantom value for params type: `{} as { orgId: string }` */
+	params?: Record<string, unknown>;
+	/** Primary key column name. Defaults to "id". Single-column only. */
+	pk?: string;
+	conflict?: ConflictPolicy;
+	readonly?: readonly string[];
+	serverSet?: SchemaServerSet;
+	countHints?: boolean;
+}
+/**
+* Read-only computed query. Compiles down to `server.query(...)` with a
+* throwing mutate so the type system blocks `useSync(...).insert/update/remove`
+* and the runtime rejects any direct write attempt.
+*/
+interface SyncViewDef {
+	__view: true;
+	row?: Record<string, unknown>;
+	params?: Record<string, unknown>;
+	tables?: string[];
+	/** Tables to watch for change-detection. Defaults to `tables` or query key. */
+	deps?: string[];
+}
+/**
+* Typed ephemeral channel. Sugar over the runtime `useEphemeral` hook —
+* derives a stable key from the schema name + serialized params and gives
+* `peers`/`set` a typed `state`.
+*/
+interface SyncPresenceDef {
+	__presence: true;
+	state?: Record<string, unknown>;
+	params?: Record<string, unknown>;
+	ttlMs?: number;
+}
+type SyncQueryEntry = SyncQueryDef | SyncViewDef | SyncPresenceDef;
+type SyncQueryMap = Record<string, SyncQueryEntry>;
+/** Row type: from `table.$inferSelect` if drizzle, otherwise from `row` phantom */
+type InferRow<
+	TQueries extends SyncQueryMap,
+	K extends keyof TQueries
+> = TQueries[K] extends {
+	table: DrizzleTableLike;
+} ? TQueries[K]["table"]["$inferSelect"] : TQueries[K] extends {
+	row: infer R extends Record<string, unknown>;
+} ? R : Record<string, unknown>;
+/** Extract serverSet field names from either array form or object form. */
+type InferServerSetKeys<TDef> = TDef extends {
+	serverSet: readonly (infer S extends string)[];
+} ? S : TDef extends {
+	serverSet: infer O extends Readonly<Record<string, unknown>>;
+} ? keyof O & string : never;
+/**
+* Adapter contract for `server.tx({ atomic: true })` — pluggable so non-drizzle
+* data layers (kysely, prisma, raw SQL) can wrap their own BEGIN/COMMIT/ROLLBACK
+* without reflectdb hard-coding a drizzle dependency.
+*
+* Pass an adapter via:
+* - `server.tx({ atomic: <adapter> }, fn)` — per-call override.
+* - `ServerConfig.txAtomic` — server-wide default for `atomic: true`.
+*
+* If neither is supplied and `atomic: true` is requested, reflectdb falls back to
+* the bundled drizzle adapter via dynamic import (no top-level dep). When
+* drizzle isn't installed the fallback throws a clear error directing users to
+* supply a `txAtomic` adapter.
+*/
+interface TxAtomicAdapter {
+	/** Begin a transaction on the given db handle. */
+	begin(db: unknown): Promise<void>;
+	/** Commit the in-flight transaction. */
+	commit(db: unknown): Promise<void>;
+	/** Roll back the in-flight transaction. */
+	rollback(db: unknown): Promise<void>;
+}
+interface ConflictInput {
+	op: OpType;
+	payload: Record<string, unknown> | null;
+	hlc: string;
+	rowId: string;
+	tableName: string;
+	userId: string;
+}
+interface ExistingRow {
+	row: Record<string, unknown> | null;
+	rowHlc: string | null;
+	colClocks: Record<string, string>;
+}
+interface ConflictResult {
+	accepted: boolean;
+	resolvedRow: Record<string, unknown> | null;
+	updatedColClocks: Record<string, string>;
+	reason?: string;
+}
+declare function resolveConflict(policy: ConflictPolicy, incoming: ConflictInput, existing: ExistingRow): ConflictResult;
+interface EnforcementResult {
+	ok: boolean;
+	reason?: ErrorReason;
+	op?: ClientOp;
+}
+interface EnforcementContext {
+	userId: string;
+	nodeId: string;
+}
+declare function enforceClockDrift(hlc: string): EnforcementResult;
+declare function enforceReadonly(op: ClientOp, options: QueryOptions): ClientOp;
+declare function enforceServerSet(op: ClientOp, options: QueryOptions): ClientOp;
+declare function enforceBatchSize(batchSize: number | undefined, maxBatchSize: number): EnforcementResult;
+interface RateLimiter {
+	check(userId: string, clientId: string, table?: string): EnforcementResult;
+	record(userId: string, clientId: string, table?: string): void;
+}
+declare function createRateLimiter(config: {
+	opsPerSecond?: number;
+	opsPerMinute?: number;
+	perTable?: Record<string, {
+		opsPerSecond?: number;
+		opsPerMinute?: number;
+	}>;
+}): RateLimiter;
+interface ClientSession<TAuth extends AuthContext = AuthContext> {
+	clientId: string;
+	auth: TAuth | null;
+	subscriptions: Map<string, QuerySubscription>;
+	watermark: string | null;
+	connectedAt: number;
+}
+interface QuerySubscription {
+	queryName: string;
+	params: Record<string, unknown>;
+	options: QueryOptions;
+	roomKey: string | null;
+	/** Window the client asked for at subscribe time. Null = unwindowed. */
+	windowSize: number | null;
+	/**
+	* How many rows the client is currently entitled to: `windowSize` plus every
+	* `load_more` since. Distinct from `loadedCount`, which is how many rows it
+	* actually holds — a client whose query matched 3 rows for a window of 50 is
+	* still entitled to 50, so the next 47 inserts must reach it.
+	*/
+	windowLimit: number;
+	loadedCount: number;
+	lastTotalCount: number | null;
+	bootstrapped: boolean;
+}
+declare class SessionManager<TAuth extends AuthContext = AuthContext> {
+	private sessions;
+	private querySubscribers;
+	private userSessions;
+	connect(clientId: string): ClientSession<TAuth>;
+	disconnect(clientId: string): void;
+	/** Count of active sessions for a given userId. */
+	countForUser(userId: string): number;
+	/** Oldest (by connectedAt) session for a given userId. */
+	oldestForUser(userId: string): ClientSession<TAuth> | null;
+	get(clientId: string): ClientSession<TAuth> | undefined;
+	setAuth(clientId: string, auth: TAuth): void;
+	subscribe(clientId: string, queryName: string, params: Record<string, unknown>, options: QueryOptions, roomKey?: string | null, windowSize?: number | null): void;
+	unsubscribe(clientId: string, queryName: string): void;
+	updateWatermark(clientId: string, hlc: string): void;
+	/**
+	* Get all subscribers for a specific query name.
+	* Uses reverse index for O(subscribers) lookup instead of O(all sessions).
+	*/
+	getSubscribersForQuery(queryName: string, roomKey?: string | null): ClientSession<TAuth>[];
+	/**
+	* Get all subscribers that have a query depending on a given table.
+	* Uses reverse index for efficient lookup.
+	*/
+	getSubscribersForTableDependency(tableDependencyIndex: Map<string, Set<string>>, tableName: string): Array<{
+		session: ClientSession<TAuth>;
+		queryName: string;
+	}>;
+	getAll(): ClientSession<TAuth>[];
+	size(): number;
+}
+interface DiffResult {
+	inserted: Array<{
+		rowId: string;
+		data: Record<string, unknown>;
+	}>;
+	updated: Array<{
+		rowId: string;
+		changed: Record<string, unknown>;
+	}>;
+	deleted: string[];
+}
+declare class ResultCache {
+	private cache;
+	/**
+	* Update the cached result set and return the diff.
+	* @param idField - The field name used as the row identifier (default: "id")
+	*/
+	set(clientId: string, queryName: string, rows: Record<string, unknown>[], idField?: string): DiffResult;
+	get(clientId: string, queryName: string): Map<string, Record<string, unknown>>;
+	/**
+	* Compute the diff WITHOUT committing the new rows to the cache. Use when
+	* the broadcast may fail and we need to defer the cache update until sends
+	* succeed — otherwise a dropped send leaves the cache claiming the client
+	* already has rows it never received.
+	*/
+	diffOnly(clientId: string, queryName: string, rows: Record<string, unknown>[], idField?: string): DiffResult;
+	clear(clientId: string, queryName: string): void;
+	clearClient(clientId: string): void;
+	private getOrCreateClientCache;
+	private diff;
+	/**
+	* Returns only the changed fields, or null if nothing changed.
+	*/
+	private fieldDiff;
+}
+interface EagerBufferConfig {
+	flushInterval?: number;
+	maxBufferSize?: number;
+	/**
+	* Called when an op fails to persist. Distinct from console.error so the
+	* application can surface flush failures (DLQ, alerting, metrics) instead
+	* of relying on log scraping. The op stays re-queued at the buffer head
+	* for retry; this hook fires per failed attempt.
+	*/
+	onFlushError?: (err: unknown, op: BufferedOp) => void;
+}
+interface BufferedOp {
+	entry: OpLogEntry;
+	/**
+	* Resolved row state to write to the row store. May differ from
+	* entry.payload when the op is an UPDATE: payload carries the delta
+	* for the oplog, but row carries the merged result so putRow doesn't
+	* clobber untouched columns. If undefined, defaults to entry.payload.
+	*/
+	row?: Record<string, unknown> | null;
+}
+declare class EagerBuffer {
+	private buffers;
+	private flushInterval;
+	private maxBufferSize;
+	private timer;
+	private storage;
+	private flushPromise;
+	private onFlushError;
+	constructor(config?: EagerBufferConfig);
+	setOnFlushError(handler: ((err: unknown, op: BufferedOp) => void) | null): void;
+	setStorage(storage: StorageAdapter): void;
+	start(interval?: number): void;
+	/**
+	* Check if the buffer has capacity for one more op.
+	*/
+	hasCapacity(queryName: string, maxSize?: number): boolean;
+	/**
+	* Push an op into the buffer. Returns false if the buffer is full (backpressure).
+	* Synchronous — the periodic flush timer handles draining.
+	*/
+	push(queryName: string, op: BufferedOp, maxSize?: number): boolean;
+	/**
+	* Flush all buffered ops to storage.
+	* If a flush is already in progress, waits for it to complete.
+	*/
+	flush(): Promise<number>;
+	private doFlush;
+	/** Number of buffered ops across all queries. */
+	get pendingCount(): number;
+	/** Number of buffered ops for a specific query. */
+	queryPendingCount(queryName: string): number;
+	close(): Promise<void>;
+}
+interface HandlerConfig {
+	transport: ServerTransport;
+	serverId: string;
+	db?: unknown;
+	onEvent?: (event: SyncEvent) => void;
+	/**
+	* Max concurrent sessions for a single userId. Beyond the cap the
+	* oldest session is evicted so a misbehaving client can't exhaust
+	* server memory by opening unbounded connections.
+	*/
+	maxConnectionsPerUser?: number;
+	/**
+	* Accept connections when no `auth()` callback is registered, assigning each
+	* session a synthetic `anon:<clientId>` identity. Without this opt-in, a
+	* server with no auth callback rejects the handshake instead of acking
+	* `hello` and then failing every later message as unauthenticated.
+	*/
+	allowAnonymous?: boolean;
+	/**
+	* Abort a query execution that exceeds this many ms during broadcast. One
+	* slow query would otherwise stall fanout to every subscriber. 0 disables.
+	* Default: 0 (disabled).
+	*/
+	queryTimeoutMs?: number;
+	/** Max subscriber groups whose queries run concurrently per broadcast. Default: 8. */
+	maxBroadcastConcurrency?: number;
+}
+interface QueryRegistration {
+	name: string;
+	callback: QueryCallback;
+	tableDependencies: Set<string>;
+	options: QueryOptions;
+}
+interface RoomRegistration {
+	pattern: string;
+	regex: RegExp;
+	paramNames: string[];
+	callback: RoomCallback;
+}
+interface OpLogEntry {
+	table: string;
+	op: string;
+	rowId: string;
+	payload: Record<string, unknown> | null;
+	hlc: string;
+	colClocks: Record<string, string>;
+}
+interface StorageAdapter {
+	getRow(table: string, rowId: string): Promise<ExistingRow>;
+	/**
+	* Read many rows of one table in a single round trip, keyed by rowId.
+	* Missing rows are simply absent from the result.
+	*
+	* A 100-op batch otherwise issues 100 sequential `getRow` calls before it
+	* can even start writing. Optional — the handler falls back to `getRow`.
+	*/
+	getRowsByIds?(table: string, rowIds: string[]): Promise<Record<string, ExistingRow>>;
+	putRow(table: string, rowId: string, row: Record<string, unknown> | null, colClocks: Record<string, string>, hlc: string): Promise<void>;
+	getRows(table: string, filter?: Record<string, unknown>): Promise<{
+		rows: Record<string, unknown>[];
+		colClocks: Record<string, Record<string, string>>;
+	}>;
+	appendOp(entry: OpLogEntry): Promise<void>;
+	/**
+	* Atomic write: putRow + appendOp in a single transaction.
+	* Prevents divergence between the row store and op log on crash.
+	* Optional — handler falls back to sequential putRow+appendOp if absent.
+	*/
+	applyOp?(table: string, rowId: string, row: Record<string, unknown> | null, colClocks: Record<string, string>, hlc: string, opType: string, payload: Record<string, unknown> | null): Promise<void>;
+	getOpsSince(since: string, tables: string[]): Promise<OpLogEntry[]>;
+	/**
+	* Distinct table names with ops newer than `since`, restricted to `tables`.
+	*
+	* Resume only needs the set of changed tables — it re-executes each affected
+	* query and sends a snapshot rather than replaying ops. Without this,
+	* resume loads every op row since the watermark into memory just to collect
+	* distinct names, which is unbounded for a long-offline client.
+	*
+	* Optional — the handler falls back to `getOpsSince` when absent.
+	*/
+	getChangedTablesSince?(since: string, tables: string[]): Promise<string[]>;
+	/**
+	* Highest op-log HLC across `tables`, or null when the log is empty.
+	*
+	* HA polling uses it as a cheap "did anything change at all" probe: without
+	* it, every poll tick re-executes every query for every subscriber group
+	* even when there were zero writes. Optional.
+	*/
+	getOplogHead?(tables: string[]): Promise<string | null>;
+	deleteOpsBefore(hlc: string): Promise<number>;
+	/**
+	* Atomic reserve-or-detect-replay: returns true if this opId was fresh
+	* (inserted), false if it was already reserved. MUST be implemented as a
+	* single atomic operation (e.g. INSERT ... ON CONFLICT DO NOTHING) — a
+	* non-atomic check-then-write race-conditions in HA setups where multiple
+	* instances share storage and double-applies the op.
+	*/
+	reserveOp(opId: string): Promise<boolean>;
+	/**
+	* Batch form of `reserveOp`: returns the subset of `opIds` that were fresh.
+	* Must be atomic per id, like `reserveOp`. Optional — the handler falls
+	* back to one `reserveOp` per op.
+	*/
+	reserveOps?(opIds: string[]): Promise<string[]>;
+	getMeta(key: string): Promise<string | null>;
+	setMeta(key: string, value: string): Promise<void>;
+	/**
+	* Acquire a cross-instance lock (e.g. Postgres pg_advisory_lock).
+	* Returns true if acquired, false if another instance holds it.
+	* Optional — handler runs best-effort if absent.
+	*/
+	tryLock?(key: string): Promise<boolean>;
+	unlock?(key: string): Promise<void>;
+}
+declare class MessageHandler<TAuth extends AuthContext = AuthContext> {
+	private transport;
+	private serverId;
+	private db;
+	private clock;
+	private sessions;
+	private authCallback;
+	private queries;
+	private rooms;
+	private rateLimiter;
+	private maxBatchSize;
+	private storage;
+	private minSchemaVersion;
+	private messageQueues;
+	private resultCache;
+	private broadcast;
+	private ops;
+	private ephemeralManager;
+	private ephemeralCleanupTimer;
+	private eagerBuffer;
+	private replay;
+	private static readonly MAX_EPHEMERAL_TTL_MS;
+	private static readonly AUTH_CACHE_TTL_MS;
+	private authCache;
+	private compaction;
+	private messageQueueDepths;
+	private static readonly MAX_QUEUE_DEPTH;
+	private static eagerWarned;
+	private static missingAuthWarned;
+	/** Highest op-log HLC observed by the HA poll loop. */
+	private pollWatermark;
+	private onEvent;
+	private maxConnectionsPerUser;
+	private allowAnonymous;
+	private queryTimeoutMs;
+	private ephemeralPerSecond;
+	private ephemeralBuckets;
+	private tableDependencyIndex;
+	private emit;
+	/**
+	* Send that never throws. Transports now REPORT delivery failure (so the
+	* broadcast engine can withhold its result-cache commit), which means every
+	* send site that must keep running afterwards — disconnect handshakes, acks,
+	* per-client fanout — has to opt out of the throw explicitly.
+	*
+	* Returns false when the frame did not reach the client.
+	*/
+	private trySend;
+	constructor(config: HandlerConfig);
+	setAuth(callback: AuthCallback): void;
+	setQuery(name: string, registration: QueryRegistration): void;
+	setRoom(registration: RoomRegistration): void;
+	setRateLimiter(limiter: RateLimiter): void;
+	/** Per-client ephemeral message ceiling per second. 0 disables metering. */
+	setEphemeralRateLimit(perSecond: number): void;
+	setMaxBatchSize(size: number): void;
+	setMaxEphemeralEntries(max: number): void;
+	setMinSchemaVersion(version: number): void;
+	setMaxConnectionsPerUser(max: number | null): void;
+	private enforceConnectionCap;
+	setStorage(adapter: StorageAdapter): void;
+	/**
+	* Re-read the shared HLC watermark and merge it into this instance's clock.
+	* The HA poll loop calls this each tick; expose it so deployments driving
+	* their own loop can keep instances converged too.
+	*/
+	syncClockWatermark(): Promise<void>;
+	getSessions(): SessionManager<TAuth>;
+	getResultCache(): ResultCache;
+	private handleMessage;
+	private handleHello;
+	private handleAuth;
+	private handleBootstrap;
+	/**
+	* Execute a query registration's callback for a given client session.
+	* Falls back to storage when no application DB is configured.
+	*
+	* @param limit — max rows the caller needs. Passed to the callback as
+	*   `ctx.limit` so it can push the cap into SQL (`.limit(ctx.limit)`), and
+	*   ALSO applied as a JS slice afterwards. The slice is the safety net for
+	*   callbacks that ignore `ctx.limit` — without it, the server would have
+	*   to choose between clobbering a user-defined `.limit()`/`.offset()` and
+	*   returning more rows than the window holds.
+	*/
+	private executeQuery;
+	/**
+	* Total row count for count hints, using the query's `count` callback.
+	* Returns null when the query has none — callers then fall back to the
+	* length of a full result set.
+	*/
+	private countQuery;
+	/**
+	* Fetch one window of a query plus the total row count.
+	*
+	* With a `count` callback the fetch is capped at the window size and the
+	* total comes from `count` — a 50-row window over a million-row table reads
+	* 50 rows. Without one, the server must materialize the full result set to
+	* know the total, so windowing only saves bytes on the wire.
+	*/
+	private fetchWindow;
+	private handleResume;
+	private handleOps;
+	/**
+	* After a write to a table, find all queries that depend on that table,
+	* re-execute them per subscriber group, and send deltas for any changes.
+	* See `BroadcastEngine` for grouping, locking and windowing behavior.
+	*/
+	private broadcastChanges;
+	private handleSyncDeclare;
+	private handleLoadMore;
+	private handleUnsync;
+	/**
+	* Fixed-window bucket for ephemeral traffic, keyed per client. Separate from
+	* the op-path limiter so presence and writes don't starve each other.
+	*/
+	private allowEphemeral;
+	private handleEphemeral;
+	/** Public reserve-or-replay gate for REST idempotency. Returns true when fresh. */
+	reserveOpId(opId: string): Promise<boolean>;
+	runCompaction(minOpAge: number): Promise<number>;
+	getEagerBuffer(): EagerBuffer;
+	/**
+	* Returns all table names that have registered query dependencies.
+	* Used by the poll feature to know which tables to check for remote changes.
+	*/
+	getTrackedTables(): string[];
+	/**
+	* One HA poll tick: pick up writes made by other instances sharing storage.
+	*
+	* On an adapter that can report the op-log head, an idle tick costs a single
+	* `MAX(hlc)` query and broadcasts nothing. Re-running every query for every
+	* subscriber group on every tick — the naive version — is ~5k queries/sec at
+	* idle for 500 clients on a 100ms poll.
+	*
+	* Also re-merges the shared clock watermark, so an instance whose wall clock
+	* lags its peers stops stamping writes below HLCs clients have already seen.
+	*/
+	pollRemoteChanges(): Promise<void>;
+	/** Broadcast several tables, isolating per-table failures from each other. */
+	private notifyAll;
+	/**
+	* Notify that a table changed from an external source (e.g. REST).
+	* Triggers delta broadcasting to connected sync clients.
+	*
+	* @param roomKey — restrict broadcast to subscribers in this room. Pass
+	*   null to broadcast cross-room (the default; legacy behavior). For
+	*   multi-tenant apps, pass the tenant's room key to avoid leaking
+	*   row-level changes across tenants.
+	*/
+	notifyChange(tableName: string, roomKey?: string | null): Promise<void>;
+	/**
+	* Apply a server-originated write (e.g. REST endpoint) through the same
+	* HLC stamping + op log + broadcast path as sync ops. Previously REST
+	* wrote with `hlc: ""`, bypassing the op log entirely — resume would
+	* miss the write and divergence would accumulate.
+	*
+	* Ordering matches the sync-consistent pipeline: stamp HLC, run user
+	* authorize/mutate (via `execute`), then atomic sync-storage write and
+	* broadcast. If `execute` throws, sync storage is untouched.
+	*/
+	applyServerOp(op: {
+		type: OpType;
+		table: string;
+		rowId: string;
+		payload: Record<string, unknown> | null;
+	}, execute?: (stamped: {
+		type: OpType;
+		table: string;
+		rowId: string;
+		payload: Record<string, unknown> | null;
+		hlc: string;
+	}) => Promise<void>, options?: {
+		/**
+		* Restrict change broadcast to subscribers in this room. Without
+		* this, the broadcast goes to ALL subscribers of the affected
+		* query — leaking writes across tenant boundaries. Pass null to
+		* intentionally broadcast cross-room (legacy behavior).
+		*/
+		roomKey?: string | null;
+	}): Promise<{
+		hlc: string;
+		resolvedRow: Record<string, unknown> | null;
+	}>;
+	close(): Promise<void>;
+}
+type SyncEvent = {
+	type: "client_connected";
+	clientId: string;
+} | {
+	type: "client_disconnected";
+	clientId: string;
+} | {
+	type: "auth_failed";
+	clientId: string;
+	error: unknown;
+} | {
+	type: "message_invalid";
+	clientId: string;
+	error: string;
+} | {
+	type: "ops_processed";
+	clientId: string;
+	accepted: number;
+	rejected: number;
+} | {
+	type: "bootstrap";
+	clientId: string;
+	queries: number;
+} | {
+	type: "resume";
+	clientId: string;
+	queries: number;
+	tablesChanged: number;
+} | {
+	type: "compaction";
+	deletedOps: number;
+} | {
+	type: "ephemeral_full";
+	currentSize: number;
+} | {
+	type: "ephemeral_rate_limited";
+	clientId: string;
+} | {
+	type: "query_error";
+	clientId: string;
+	queryName: string;
+	phase: string;
+	error: unknown;
+} | {
+	type: "queue_overflow";
+	clientId: string;
+	depth: number;
+} | {
+	type: "eager_flush_failed";
+	table: string;
+	rowId: string;
+	error: unknown;
+};
+interface ServerConfig<TDb = unknown> {
+	db?: TDb;
+	transport: ServerTransport;
+	serverId?: string;
+	storage?: StorageAdapter;
+	onEvent?: (event: SyncEvent) => void;
+	/** Poll interval in ms for detecting changes from other server instances sharing the same storage. Enables HA mode. 0 or undefined to disable. */
+	poll?: number;
+	/** Max concurrent sessions per userId. Oldest is evicted on overflow. */
+	maxConnectionsPerUser?: number;
+	/**
+	* Serve connections without an `auth()` callback, giving each session an
+	* `anon:<clientId>` identity. Without it a server that never calls `auth()`
+	* rejects the handshake rather than acking `hello` and then failing every
+	* subsequent message as unauthenticated.
+	*/
+	allowAnonymous?: boolean;
+	/**
+	* Abort a broadcast query that runs longer than this many ms, so one slow
+	* query can't stall fanout to every other subscriber. 0 disables.
+	* Note: this abandons the promise, it does not cancel the underlying
+	* database work.
+	*/
+	queryTimeoutMs?: number;
+	/** Max subscriber groups whose queries run concurrently per broadcast. Default: 8. */
+	maxBroadcastConcurrency?: number;
+	/**
+	* Adapter that wraps `server.tx({ atomic: true })` writes in a transaction.
+	* Required when using `atomic: true` against a non-drizzle handle (kysely,
+	* prisma, raw SQL). Drizzle handles auto-fall-back via dynamic import when
+	* this is absent. See `TxAtomicAdapter`.
+	*/
+	txAtomic?: TxAtomicAdapter;
+}
+interface QueryContext<TAuth extends AuthContext = AuthContext> {
+	auth: TAuth;
+	params: Record<string, unknown>;
+	/**
+	* Row cap the server needs for this execution, or undefined for "all rows".
+	*
+	* Set for windowed subscriptions. Applying it as `.limit(ctx.limit)` pushes
+	* windowing into SQL; ignore it and the server still slices in JS, which is
+	* correct but fetches the whole table on every broadcast. Pair with
+	* `QueryOptions.count` so count hints don't force a full fetch either.
+	*/
+	limit?: number;
+}
+interface ResolvedOp {
+	type: OpType;
+	table: string;
+	rowId: string;
+	payload: Record<string, unknown> | null;
+	hlc: string;
+}
+interface MutateResult {
+	affected?: string[];
+}
+interface MutationContext<TAuth extends AuthContext = AuthContext> {
+	auth: TAuth;
+	params: Record<string, unknown>;
+}
+type AuthorizeAction = {
+	type: "read";
+	table: string;
+	params: Record<string, unknown>;
+} | {
+	type: "write";
+	table: string;
+	op: ResolvedOp;
+};
+interface QueryOptions<
+	TAuth extends AuthContext = AuthContext,
+	TDb = unknown
+> {
+	tables: string[];
+	/** Primary key column name. Defaults to "id". Single-column only. */
+	pk?: string;
+	/**
+	* How concurrent writes to the same row are resolved.
+	*
+	* Resolution compares the incoming op against **reflectdb's mirror** (the
+	* JSONB row store + per-column clocks it maintains), not against your
+	* database. The two agree as long as every write to the table goes through
+	* reflectdb and `mutate` persists the resolved payload verbatim. They diverge
+	* when `mutate` transforms the payload, when database defaults/triggers
+	* rewrite it, or when something writes the table out of band — and then
+	* conflicts are decided against state clients never observed, because
+	* snapshots and deltas are read from your database.
+	*
+	* Ignored by both `eager` broadcast modes.
+	*/
+	conflict?: ConflictPolicy;
+	serverSet?: Record<string, unknown>;
+	readonly?: string[];
+	countHints?: boolean;
+	/**
+	* Require this query's subscriptions to resolve the named room pattern
+	* (e.g. `"org/:orgId"`). A `sync_declare` whose params don't produce a
+	* valid key for it is rejected instead of falling back to an unscoped,
+	* cross-room subscription. Use for any query carrying tenant data.
+	*/
+	room?: string;
+	/**
+	* Total row count for `countHints`, independent of the window.
+	*
+	* Without it, count hints force the broadcast engine to fetch every row of
+	* every windowed query on every write just to call `.length` on the result.
+	* Implement it as a `SELECT count(*)` and windowing becomes a real limit.
+	*/
+	count?: (ctx: QueryContext<TAuth>, db: TDb) => Promise<number> | number;
+	/**
+	* Collapse subscribers into a shared query execution.
+	*
+	* By default the broadcast engine groups subscribers by their full auth
+	* context, so a write costs one query execution per connected client. When
+	* a query's results depend only on a coarser key — a tenant id, a room, or
+	* nothing at all — return that key here and every client sharing it is
+	* served by ONE execution and one diff.
+	*
+	* Return a key that captures every input the query reads from `auth`. Two
+	* clients sharing a key MUST be entitled to byte-identical rows; collapsing
+	* clients that aren't leaks rows across the boundary.
+	*
+	* ```ts
+	* // Query filters only on orgId — all members of an org share a result set.
+	* groupBy: ({ auth }) => String(auth.orgId)
+	* ```
+	*/
+	groupBy?: (ctx: {
+		auth: TAuth;
+		params: Record<string, unknown>;
+	}) => string;
+	/**
+	* Broadcast strategy.
+	*
+	* - "consistent" (default): run the conflict pipeline, persist, then
+	*   broadcast by diffing each subscriber's re-executed query result.
+	* - "eager-durable": skip conflict resolution, persist to reflectdb's mirror
+	*   atomically, then broadcast the delta directly. Low latency, and the
+	*   mirror write can't be lost to a crash after the broadcast.
+	* - "eager": broadcast immediately, batch-persist to the mirror in the
+	*   background. AT-MOST-ONCE for the mirror across a crash: subscribers
+	*   may hold deltas the server forgets after restart. Only safe when
+	*   \`mutate\` is durable to your own database (the mirror becomes a
+	*   delivery hint, not a source of truth) AND clients tolerate
+	*   resume-via-snapshot. Prefer "eager-durable" unless you have measured
+	*   persistence latency as a real bottleneck.
+	*
+	* Both eager modes DO enforce \`readonly\`, \`serverSet\`, clock drift, the
+	* batch cap and rate limits. What they skip is conflict resolution: a
+	* declared \`conflict\` policy does not apply and writes land last-writer-wins.
+	*
+	* Durability caveat that applies to EVERY mode: \`mutate\` writes your
+	* database and reflectdb writes its own mirror + op log in a separate commit.
+	* "Atomic" here means the mirror row and its op-log entry commit together,
+	* not that they commit with your database write. A crash between the two
+	* leaves your database ahead of the mirror.
+	*/
+	broadcast?: "consistent" | "eager" | "eager-durable";
+	/** Flush interval in ms for eager broadcast buffer. Default: 200. */
+	flushInterval?: number;
+	/** Max buffered ops per query before forcing a flush. Default: 1000. */
+	maxBufferSize?: number;
+	authorize?: (action: AuthorizeAction, ctx: MutationContext<TAuth>, db: TDb) => Promise<void>;
+	mutate?: (op: ResolvedOp, ctx: MutationContext<TAuth>, db: TDb) => Promise<void | MutateResult>;
+}
+type QueryCallback<
+	TAuth extends AuthContext = AuthContext,
+	TDb = unknown
+> = (ctx: QueryContext<TAuth>, db: TDb) => unknown;
+type AuthCallback = (req: Request) => Promise<AuthContext>;
+/**
+* Proxy passed to `server.tx(fn)`. Forwards all calls through to the
+* underlying db handle; for drizzle handles, `insert/update/delete` are
+* intercepted to auto-record touched tables. `select` is NOT a touch.
+*
+* Non-drizzle data layers (kysely, prisma, raw SQL) call `tx.touch(name)`
+* after each write to flag the table for the trailing `notifyChange` pass.
+* Drizzle users may also call `tx.touch` to add a table the proxy didn't
+* detect (e.g. raw SQL escape hatch through `tx.run(...)`).
+*
+* Typed loosely as the underlying handle to avoid coupling to a specific
+* dialect; `touch` is appended explicitly for IDE discoverability.
+*/
+type TxProxy = any & {
+	touch(table: string): void;
+};
+type TxFn<T> = (tx: TxProxy) => Promise<T>;
+interface TxOptions {
+	/**
+	* Wrap the work in BEGIN/COMMIT for SQL atomicity. Defaults to `true` —
+	* partial writes on throw are usually a footgun, so opt OUT explicitly
+	* (`atomic: false`) only when you've measured it as a perf bottleneck.
+	* Either way, notifies fire only on full success.
+	*
+	* Three accepted forms:
+	* - `true` (default): use `ServerConfig.txAtomic` if set, otherwise fall
+	*   back to the bundled drizzle adapter (lazy-loaded — no top-level
+	*   `drizzle-orm` dep). Throws if drizzle isn't installed and no adapter
+	*   is configured.
+	* - `false`: skip BEGIN/COMMIT entirely. Notifies still fire only on
+	*   full success.
+	* - `<TxAtomicAdapter>`: per-call override — use this adapter for the
+	*   one-off write, ignoring `ServerConfig.txAtomic`.
+	*
+	* Note: with multi-connection adapters (postgres pool) atomicity requires
+	* that BEGIN/COMMIT and the writes share a connection. Pass a single-connection
+	* handle when atomicity is load-bearing.
+	*/
+	atomic?: boolean | TxAtomicAdapter;
+}
+interface RoomCallbackResult {
+	ok: boolean;
+	reason?: string;
+}
+interface RoomCallback<TAuth extends AuthContext = AuthContext> {
+	(ctx: {
+		params: Record<string, string>;
+		auth: TAuth;
+	}): void | RoomCallbackResult | Promise<void | RoomCallbackResult>;
+}
+interface SyncServer<
+	TAuth extends AuthContext = AuthContext,
+	TDb = unknown
+> {
+	auth(callback: AuthCallback): void;
+	query(name: string, callback: QueryCallback<TAuth, TDb>, options: QueryOptions<TAuth, TDb>): void;
+	room(pattern: string, callback: RoomCallback<TAuth>): void;
+	rateLimit(config: RateLimitConfig): void;
+	compaction(config: CompactionConfig): void;
+	minSchemaVersion(version: number): void;
+	runCompaction(): Promise<void>;
+	notifyChange(tableName: string, roomKey?: string | null): Promise<void>;
+	/**
+	* Idempotency gate — returns true if this opId is fresh. Callers use
+	* this to dedupe REST retries (e.g. Idempotency-Key header).
+	*/
+	reserveOpId(opId: string): Promise<boolean>;
+	/**
+	* Route a server-originated op (e.g. REST write) through the sync
+	* pipeline: assign server HLC, persist atomically, broadcast.
+	* Call after authorize + mutate to keep the op log consistent.
+	*
+	* Pass `options.roomKey` to scope the broadcast to a tenant/room. Without
+	* it the broadcast goes to all subscribers of the affected query —
+	* leaking writes across tenants in multi-tenant apps.
+	*/
+	applyServerOp(op: {
+		type: OpType;
+		table: string;
+		rowId: string;
+		payload: Record<string, unknown> | null;
+	}, execute?: (stamped: {
+		type: OpType;
+		table: string;
+		rowId: string;
+		payload: Record<string, unknown> | null;
+		hlc: string;
+	}) => Promise<void>, options?: {
+		roomKey?: string | null;
+	}): Promise<{
+		hlc: string;
+		resolvedRow: Record<string, unknown> | null;
+	}>;
+	/**
+	* Server-origin row write. Sugar over `applyServerOp` — generates rowId
+	* (uses `payload.id` if present, else uuid), routes through HLC + op log
+	* + broadcast pipeline. Does not apply schema serverSet/readonly stripping;
+	* server is the trusted writer.
+	*/
+	emit(table: string, payload: Record<string, unknown>, options?: {
+		rowId?: string;
+		type?: OpType;
+		roomKey?: string | null;
+	}): Promise<{
+		hlc: string;
+		rowId: string;
+	}>;
+	/**
+	* Atomic-ish write group with auto-notify. Wraps the server's underlying
+	* drizzle `db` in a proxy that tracks tables touched by
+	* `insert/update/delete`; on success, fires one `notifyChange` per touched
+	* table. With `atomic: true`, runs inside `db.transaction(...)`; without
+	* it, writes are not transactional but notifies are still skipped on
+	* throw. Throws if the server has no `db` configured.
+	*/
+	tx<T>(fn: TxFn<T>): Promise<T>;
+	tx<T>(opts: TxOptions, fn: TxFn<T>): Promise<T>;
+	lock<T>(key: string, fn: () => Promise<T>): Promise<T>;
+	tryLock<T>(key: string, fn: () => Promise<T>): Promise<T | null>;
+	/**
+	* `setInterval` wrapper that auto-disposes on `bun --hot` reload and on
+	* `server.close()`. Errors from `fn` are logged, not thrown.
+	*/
+	interval(ms: number, fn: () => void | Promise<void>): {
+		clear(): void;
+	};
+	/**
+	* `setTimeout` wrapper that auto-disposes on `bun --hot` reload and on
+	* `server.close()`. Errors from `fn` are logged, not thrown.
+	*/
+	timeout(ms: number, fn: () => void | Promise<void>): {
+		clear(): void;
+	};
+	close(): Promise<void>;
+}
+type Ctx<
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = {
+	auth: TAuth;
+	params: TParams;
+};
+/**
+* Function-form scope returns an adapter-interpreted SQL fragment (e.g. a
+* drizzle `SQL`, a kysely `Expression<boolean>`, or a raw string). The generic
+* factory treats it as opaque (`unknown`) — ORM-specific helpers like
+* `drizzleTable` narrow the return type at their call site.
+*/
+type ScopeFn<
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = (ctx: Ctx<TAuth, TParams>) => unknown;
+type ScopeOpt<
+	TRowKey extends string,
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = TRowKey | {
+	auth: keyof TAuth & string;
+	column: TRowKey;
+} | ScopeFn<TAuth, TParams>;
+type StampSource<
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = "auth.userId" | "auth.name" | string | ((ctx: Ctx<TAuth, TParams>) => unknown);
+type ServerSetSource<
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = unknown | ((ctx: Ctx<TAuth, TParams>) => unknown);
+type FieldPolicy<
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = "server-only" | "insert-only" | {
+	write: (input: {
+		ctx: Ctx<TAuth, TParams>;
+		existing?: Record<string, unknown> | null;
+		payload: Record<string, unknown>;
+	}) => boolean | Promise<boolean>;
+};
+/**
+* Built-in scope shorthand resolves to one of these. Function-form scope
+* (returning raw SQL) bypasses the adapter — it must be paired with an
+* `opts.query` override since the adapter has no SQL fragment to consume.
+*/
+interface ScopeFilter {
+	kind: "params" | "auth";
+	column: string;
+	value: unknown;
+}
+/**
+* Minimal contract a data layer must implement to plug into `defineTable`.
+* Per-row I/O only — bulk paths intentionally absent so adapters stay short.
+*/
+interface TableAdapter<TRow extends Record<string, unknown> = Record<string, unknown>> {
+	/** Logical table name — used for op log + change detection. */
+	name: string;
+	/** Primary key column. Default "id". */
+	pk?: string;
+	/**
+	* Fetch rows, optionally narrowed by a scope filter the factory passes
+	* for built-in scope shorthand. Implement using the adapter's native
+	* query builder. Return rows or a thenable resolving to rows.
+	*/
+	list(input: {
+		db: any;
+		scope?: ScopeFilter;
+	}): Promise<TRow[]> | TRow[];
+	/** Fetch a single row by pk. Return null if absent. */
+	find(input: {
+		db: any;
+		rowId: string;
+	}): Promise<TRow | null> | TRow | null;
+	/** Insert (or upsert) a row. payload does NOT include the pk; rowId is authoritative. */
+	insert(input: {
+		db: any;
+		rowId: string;
+		payload: Record<string, unknown>;
+	}): Promise<void> | void;
+	/** Update an existing row. payload may be partial. */
+	update(input: {
+		db: any;
+		rowId: string;
+		payload: Record<string, unknown>;
+	}): Promise<void> | void;
+	/** Delete a row by pk. */
+	delete(input: {
+		db: any;
+		rowId: string;
+	}): Promise<void> | void;
+}
+interface DefineTableOpts<
+	TRow extends Record<string, unknown> = Record<string, unknown>,
+	TAuth extends AuthContext = AuthContext,
+	TParams extends Record<string, unknown> = Record<string, unknown>
+> {
+	scope?: ScopeOpt<keyof TRow & string, TAuth, TParams>;
+	rowId?: string;
+	ownerStamp?: Partial<Record<keyof TRow & string, StampSource<TAuth, TParams>>>;
+	serverSet?: Partial<Record<keyof TRow & string, ServerSetSource<TAuth, TParams>>>;
+	policy?: {
+		read?: (input: {
+			ctx: Ctx<TAuth, TParams>;
+			existing?: Record<string, unknown> | null;
+		}) => boolean | Promise<boolean>;
+		insert?: (input: {
+			ctx: Ctx<TAuth, TParams>;
+			payload: Record<string, unknown>;
+		}) => boolean | Promise<boolean>;
+		update?: (input: {
+			ctx: Ctx<TAuth, TParams>;
+			existing: Record<string, unknown>;
+			payload: Record<string, unknown>;
+		}) => boolean | Promise<boolean>;
+		delete?: (input: {
+			ctx: Ctx<TAuth, TParams>;
+			existing: Record<string, unknown>;
+		}) => boolean | Promise<boolean>;
+		fields?: Partial<Record<keyof TRow & string, FieldPolicy<TAuth, TParams>>>;
+	};
+	hooks?: {
+		beforeInsert?: (input: {
+			payload: Record<string, unknown>;
+			ctx: Ctx<TAuth, TParams>;
+			db: any;
+		}) => Promise<void> | void;
+		afterInsert?: (input: {
+			row: Record<string, unknown>;
+			ctx: Ctx<TAuth, TParams>;
+			db: any;
+		}) => Promise<void> | void;
+		beforeUpdate?: (input: {
+			payload: Record<string, unknown>;
+			existing: Record<string, unknown>;
+			ctx: Ctx<TAuth, TParams>;
+			db: any;
+		}) => Promise<void> | void;
+		afterUpdate?: (input: {
+			row: Record<string, unknown>;
+			previous: Record<string, unknown>;
+			ctx: Ctx<TAuth, TParams>;
+			db: any;
+		}) => Promise<void> | void;
+		beforeDelete?: (input: {
+			existing: Record<string, unknown>;
+			ctx: Ctx<TAuth, TParams>;
+			db: any;
+		}) => Promise<void> | void;
+		afterDelete?: (input: {
+			rowId: string;
+			ctx: Ctx<TAuth, TParams>;
+			db: any;
+		}) => Promise<void> | void;
+	};
+	query?: (ctx: Ctx<TAuth, TParams>, db: any) => unknown;
+	insert?: (input: {
+		payload: Record<string, unknown>;
+		existing?: Record<string, unknown> | null;
+		ctx: Ctx<TAuth, TParams>;
+		db: any;
+	}) => Promise<void> | void;
+	update?: (input: {
+		payload: Record<string, unknown>;
+		existing: Record<string, unknown>;
+		ctx: Ctx<TAuth, TParams>;
+		db: any;
+	}) => Promise<void> | void;
+	delete?: (input: {
+		rowId: string;
+		existing: Record<string, unknown> | null;
+		ctx: Ctx<TAuth, TParams>;
+		db: any;
+	}) => Promise<void> | void;
+	pk?: keyof TRow & string;
+}
+declare function defineTable<
+	TRow extends Record<string, unknown> = Record<string, unknown>,
+	TAuth extends AuthContext = AuthContext,
+	TParams extends Record<string, unknown> = Record<string, unknown>
+>(adapter: TableAdapter<TRow>, opts?: DefineTableOpts<TRow, TAuth, TParams>): {
+	query: (ctx: Ctx<TAuth, TParams>, db: any) => unknown;
+	mutate: (op: ResolvedOp, ctx: MutationContext<TAuth>, db: any) => Promise<void>;
+	authorize: (action: AuthorizeAction, ctx: MutationContext<TAuth>, db: any) => Promise<void>;
+};
+import { SQL as SQL_1rji } from "drizzle-orm";
+type SQL = SQL_1rji;
+type Ctx2<
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = {
+	auth: TAuth;
+	params: TParams;
+};
+type DrizzleScopeFn<
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = (ctx: Ctx2<TAuth, TParams>) => SQL;
+type DrizzleScopeOpt<
+	TRowKey extends string,
+	TAuth extends AuthContext,
+	TParams extends Record<string, unknown>
+> = TRowKey | {
+	auth: keyof TAuth & string;
+	column: TRowKey;
+} | DrizzleScopeFn<TAuth, TParams>;
+/**
+* Drizzle-flavored options. Identical surface to `DefineTableOpts` except the
+* row type is derived from `$inferSelect` and function-form scope returns
+* drizzle's `SQL` (vs. the generic factory's `unknown`). Kept for backward
+* compat with the existing public `drizzleTable<TTable, ...>(opts)` call shape.
+*/
+interface DrizzleTableOpts<
+	TTable extends DrizzleTableLike,
+	TAuth extends AuthContext = AuthContext,
+	TParams extends Record<string, unknown> = Record<string, unknown>
+> extends Omit<DefineTableOpts<TTable["$inferSelect"], TAuth, TParams>, "scope"> {
+	scope?: DrizzleScopeOpt<keyof TTable["$inferSelect"] & string, TAuth, TParams>;
+}
+declare function drizzleTable<
+	TTable extends DrizzleTableLike,
+	TAuth extends AuthContext = AuthContext,
+	TParams extends Record<string, unknown> = Record<string, unknown>
+>(table: TTable, opts?: DrizzleTableOpts<TTable, TAuth, TParams>): {
+	query: (ctx: Ctx2<TAuth, TParams>, db: any) => unknown;
+	mutate: (op: ResolvedOp, ctx: MutationContext<TAuth>, db: any) => Promise<void>;
+	authorize: (action: AuthorizeAction, ctx: MutationContext<TAuth>, db: any) => Promise<void>;
+};
+/**
+* `TxAtomicAdapter` for drizzle handles. Uses raw SQL via `db.run(sql\`BEGIN\`)`
+* — drizzle's async `db.transaction(...)` is unsafe on the bun-sqlite dialect
+* (sync transaction commits before the async body finishes), so we route
+* through `db.run(...)` which is portable across sqlite and postgres adapters.
+*
+* Exported so users can pass it explicitly to `tx({ atomic: drizzleTxAtomic })`
+* or to `ServerConfig.txAtomic` — and so the server's lazy-loaded fallback
+* has a single source of truth.
+*/
+declare const drizzleTxAtomic: TxAtomicAdapter;
+declare function createServer<
+	TDb = unknown,
+	TAuth extends AuthContext = AuthContext
+>(config: ServerConfig<TDb>): SyncServer<TAuth, TDb>;
+interface PipelineContext {
+	userId: string;
+	nodeId: string;
+	options: QueryOptions;
+	conflict: ConflictPolicy;
+	rateLimiter?: RateLimiter;
+	maxBatchSize?: number;
+}
+interface PipelineResult {
+	accepted: boolean;
+	op: ClientOp;
+	resolvedRow: Record<string, unknown> | null;
+	updatedColClocks: Record<string, string>;
+	reason?: ErrorReason;
+}
+declare function processOp(op: ClientOp, existing: ExistingRow, ctx: PipelineContext): PipelineResult;
+/**
+* Structural stand-in for `bun:sqlite`'s `Database`, covering only the surface
+* this adapter uses. A real `bun:sqlite` Database satisfies it structurally.
+*
+* Deliberately NOT `import("bun:sqlite").Database`: that type reference survives
+* into the emitted `dist/server/index.d.ts`, and the specifier does not resolve
+* for consumers who type-check under Node without `@types/bun` — every such
+* consumer gets "Cannot find module 'bun:sqlite'" from a declaration file they
+* never asked for. `bun run verify:exports` guards the regression.
+*/
+type SqlValue = string | number | bigint | boolean | null | Uint8Array;
+/**
+* Bind parameters stay `SqlValue[]` rather than a per-statement tuple: bun's own
+* `Statement` takes a union of tuple shapes, and a generic tuple here makes a
+* real `Database` fail to satisfy `BunDatabase` — which would break every Bun
+* caller passing `{ db }`. Row types, the part worth keeping, are still exact.
+*/
+interface BunStatement<Row> {
+	all(...params: SqlValue[]): Row[];
+	get(...params: SqlValue[]): Row | null;
+	run(...params: SqlValue[]): {
+		changes: number;
+	};
+}
+interface BunDatabase {
+	run(sql: string, ...params: SqlValue[][]): {
+		changes: number;
+	};
+	prepare<Row = unknown>(sql: string): BunStatement<Row>;
+	transaction<T>(fn: () => T): () => T;
+	close(): void;
+}
+type Database = BunDatabase;
+interface SqliteStorageConfig {
+	/** Path to SQLite database file, or ":memory:" for in-memory */
+	path?: string;
+	/** Existing Database instance to use instead of creating one */
+	db?: Database;
+}
+declare function createSqliteStorage(config?: SqliteStorageConfig): StorageAdapter & {
+	close(): void;
+};
+/**
+* Minimal Postgres client interface.
+* Compatible with pg.Pool, pg.Client, @neondatabase/serverless, etc.
+*/
+interface PostgresClient {
+	query<T extends Record<string, unknown> = Record<string, unknown>>(text: string, values?: unknown[]): Promise<{
+		rows: T[];
+	}>;
+}
+interface PostgresStorageConfig {
+	/** Postgres client or pool implementing the query interface */
+	client: PostgresClient;
+	/** Table name prefix. Default: "_reflectdb" */
+	tablePrefix?: string;
+}
+declare function createPostgresStorage(clientOrConfig: PostgresClient | PostgresStorageConfig): StorageAdapter & {
+	close(): void;
+	ensureSchema(): Promise<void>;
+};
+/**
+* Deterministic JSON: object keys are emitted in sorted order at every depth.
+*
+* `JSON.stringify` is insertion-order sensitive, so two auth contexts holding
+* the same fields in a different order would hash to different group keys and
+* the broadcast engine would execute the identical query twice.
+*/
+declare function stableStringify(value: unknown): string;
+interface BroadcastEngineDeps<TAuth extends AuthContext> {
+	sessions: SessionManager<TAuth>;
+	queries: Map<string, QueryRegistration>;
+	tableDependencyIndex: Map<string, Set<string>>;
+	resultCache: ResultCache;
+	/** Raw transport send — MUST reject when the frame did not reach the client. */
+	send(clientId: string, message: ServerMessage): Promise<void>;
+	/** Execute a query for a session, optionally capped to `limit` rows. */
+	executeQuery(reg: QueryRegistration, session: ClientSession<TAuth>, limit?: number): Promise<Record<string, unknown>[]>;
+	/** Total row count for count hints, or null when the query has no `count` callback. */
+	countQuery(reg: QueryRegistration, session: ClientSession<TAuth>): Promise<number | null>;
+	/** Bump and pack the server HLC. One call per broadcast tick. */
+	nextHlc(): string;
+	emit(event: SyncEvent): void;
+	/** Reject a query execution that exceeds this many ms. 0 disables. */
+	queryTimeoutMs: number;
+	/** Max query groups executed concurrently within one broadcast. */
+	maxGroupConcurrency: number;
+}
+/**
+* Turns "table X changed" into per-subscriber deltas.
+*
+* Subscribers are grouped by everything that can change query results
+* (auth + params + roomKey, or a query-supplied `groupBy`), the query runs once
+* per group, and each client's result cache is diffed against the shared result.
+*
+* Scaling note: one write still costs one query execution per distinct group.
+* Because `auth` is part of the default group key, groups collapse to roughly
+* one per connected client. Queries whose results depend only on a tenant/room
+* rather than the full auth object should set `groupBy` to collapse those
+* clients into a single execution.
+*/
+declare class BroadcastEngine<TAuth extends AuthContext = AuthContext> {
+	private deps;
+	/**
+	* Per-(client, query) critical section. Inbound messages are serialized per
+	* client, but broadcasts are not: two concurrent writers would otherwise
+	* both diff against the same stale cache, both send, and both commit — last
+	* commit wins, and any row only the loser knew about never gets its delete
+	* emitted again. The client would keep a phantom row until reconnect.
+	*/
+	private locks;
+	constructor(deps: BroadcastEngineDeps<TAuth>);
+	private withLock;
+	private executeWithTimeout;
+	/**
+	* After a write to `tableName`, re-run every dependent query and send each
+	* subscriber the rows that changed for them.
+	*
+	* @param excludeClientId — the writer, who already applied optimistically.
+	*   Pass "" for server-originated writes with no client to exclude.
+	* @param overrideRoomKey — restrict fanout to one room. `undefined` falls
+	*   back to the writer's own room; `null` broadcasts cross-room.
+	*/
+	broadcastChanges(tableName: string, excludeClientId: string, overrideRoomKey?: string | null): Promise<void>;
+	private buildGroups;
+	private groupKeyFor;
+	/**
+	* Row cap this group actually needs.
+	*
+	* Windowed subscribers only render up to their window, so fetching beyond
+	* the largest window in the group is pure waste. Returns undefined when the
+	* full result set is required — a non-windowed subscriber, or count hints
+	* without a `count` callback to compute the total cheaply.
+	*/
+	private limitFor;
+	private broadcastGroup;
+	private sendToSubscriber;
+	/**
+	* Commit a client's cached result set — unless it disconnected, or
+	* reconnected under the same clientId, while the sends were in flight.
+	* Writing then would resurrect the cache entry that `onDisconnect` just
+	* dropped, permanently (no further disconnect event arrives for that
+	* session), and would describe the old connection's state to a new one.
+	*/
+	private commit;
+	/** Run `fn` over items with at most `maxGroupConcurrency` in flight. */
+	private runBounded;
+}
+/**
+* Atomic replay-detection gate. With storage, delegates to `storage.reserveOp`
+* (HA-safe). Without storage, uses a TTL-bounded in-memory map (single-instance).
+*
+* Returns true when the opId is fresh (first sighting), false on replay.
+*/
+declare class ReplayDetector {
+	private storage;
+	private static readonly TTL_MS;
+	private static readonly MAX_ENTRIES;
+	private inMemory;
+	constructor(storage: StorageAdapter | null);
+	setStorage(storage: StorageAdapter): void;
+	reserve(opId: string): Promise<boolean>;
+}
+/**
+* Per-`ops`-message state shared by every op in the batch: which op ids were
+* fresh (one replay reservation for the whole batch) and the rows those ops
+* touch (one read per table). Kept write-through so an op later in the batch
+* still sees the state an earlier op in the same batch wrote.
+*/
+interface BatchContext {
+	freshOpIds: Set<string>;
+	rows: Map<string, ExistingRow>;
+}
+interface OpResult {
+	accepted: boolean;
+	reason?: ErrorReason;
+	serverRow?: Record<string, unknown> | null;
+}
+/**
+* Collaborators the op pipeline needs from the handler. Mutable settings are
+* read through getters because `setStorage`/`setRateLimiter`/`setMaxBatchSize`
+* can land after the processor is constructed.
+*/
+interface OpProcessorDeps<TAuth extends AuthContext> {
+	db: unknown;
+	queries: Map<string, QueryRegistration>;
+	sessions: SessionManager<TAuth>;
+	eagerBuffer: EagerBuffer;
+	replay: ReplayDetector;
+	getStorage(): StorageAdapter | null;
+	getRateLimiter(): RateLimiter | null;
+	getMaxBatchSize(): number;
+	/** Bump the server clock and return the packed HLC. */
+	stampHlc(): string;
+	/** Advance the server clock past an accepted client op's HLC. */
+	receiveClientHlc(hlc: string): void;
+	send(clientId: string, message: ServerMessage): Promise<void>;
+	broadcastChanges(tableName: string, excludeClientId: string): Promise<void>;
+}
+/**
+* Applies client ops: replay reservation, enforcement, conflict resolution,
+* persistence and the eager-path delta fanout.
+*
+* Two pipelines live here. The **consistent** path runs the full conflict
+* pipeline, persists, then lets the broadcast engine diff each subscriber's
+* query result. The **eager** paths skip conflict resolution and send the delta
+* straight to subscribers — they still run every enforcement gate.
+*/
+declare class OpProcessor<TAuth extends AuthContext = AuthContext> {
+	private deps;
+	constructor(deps: OpProcessorDeps<TAuth>);
+	private get storage();
+	private get rateLimiter();
+	private get maxBatchSize();
+	private get db();
+	private get queries();
+	private get sessions();
+	private get eagerBuffer();
+	private get replay();
+	private static rowKey;
+	/**
+	* Reserve every op id and read every touched row in as few round trips as
+	* the adapter allows. Falls back to per-op calls on adapters without the
+	* batch methods, in which case the returned context only carries the
+	* reservation result.
+	*/
+	prefetchBatch(ops: ClientOp[]): Promise<BatchContext>;
+	/** Read a row, preferring the batch prefetch cache. */
+	private readRow;
+	/**
+	* Write-through the batch cache after a successful apply, so a later op in
+	* the same batch touching the same row conflict-resolves against what was
+	* just written rather than the pre-batch snapshot.
+	*/
+	private recordBatchWrite;
+	processClientOp(op: ClientOp, session: ClientSession<TAuth>, deferredBroadcastTables?: Set<string>, batchCtx?: BatchContext): Promise<OpResult>;
+	private processEagerOp;
+	private processConsistentOp;
+}
+interface HLC {
+	ms: number;
+	counter: number;
+	nodeId: string;
+}
+/**
+* Meta key holding the highest server HLC this deployment has stamped.
+* Shared across instances that share storage.
+*/
+declare const SERVER_HLC_META_KEY = "serverHlcWatermark";
+/**
+* The server's hybrid logical clock, made durable.
+*
+* An in-memory-only clock resets to zero on restart and recovers only via
+* `Date.now()`. A backwards NTP step then makes broadcast HLCs regress and
+* clients drop legitimate deltas; across instances, one lagging wall clock does
+* the same thing continuously. This persists a watermark (throttled, with a
+* lease ahead of now) and merges it on boot — and on demand, so HA deployments
+* can converge peers that drift apart.
+*/
+declare class ServerClock {
+	private hlc;
+	private storage;
+	private load;
+	private persistTimer;
+	private persistPending;
+	constructor(nodeId: string);
+	setStorage(storage: StorageAdapter): void;
+	/** Current clock value. Read-only snapshot — use `stamp`/`receive` to advance. */
+	current(): HLC;
+	/** Merge the persisted watermark into this instance's clock, once. */
+	ensureLoaded(): Promise<void>;
+	/**
+	* Re-read the shared watermark and merge it in. Multi-instance deployments
+	* call this periodically (the HA poll loop does) so a lagging instance can't
+	* stamp writes below what its peers already broadcast.
+	*/
+	refresh(): Promise<void>;
+	/** Bump the clock, schedule a watermark write, return the packed HLC. */
+	stamp(): string;
+	/** Peek at the next HLC without advancing the stored clock. */
+	peekNext(): string;
+	/** Current clock, packed. */
+	packed(): string;
+	/**
+	* Advance past a remote HLC (an accepted client op, or a row written by
+	* another instance). Malformed input is ignored — callers reject it through
+	* their own clock-drift gate.
+	*/
+	receive(packedRemote: string): void;
+	/** Flush any pending watermark write and stop the timer. */
+	close(): Promise<void>;
+	private schedulePersist;
+	private flush;
+}
+/** Outcome of mapping subscription params onto a registered room pattern. */
+type RoomResolution = {
+	ok: true;
+	roomKey: string | null;
+} | {
+	ok: false;
+	reason: string;
+};
+/**
+* Map subscription params onto a registered room pattern.
+*
+* FAIL CLOSED. Room keys come from client-supplied params, so silently
+* returning `null` for a half-resolved or malformed key hands the client a
+* room-ACL bypass: no room callback runs, and the broadcast falls back to
+* cross-room fanout. Two shapes are rejected outright:
+*
+*  - a pattern is partly addressed (`org/:orgId/team/:teamId` with `orgId`
+*    but no `teamId`) — omitting a param must not widen the scope;
+*  - every param is present but the substituted key fails the pattern
+*    (e.g. a value containing `/`, which breaks the `([^/]+)` capture).
+*
+* A subscription that addresses no room pattern at all is still fine —
+* that's a legitimately global query. Set `QueryOptions.room` to require a
+* specific pattern for a query.
+*/
+declare function resolveRoomKey(rooms: readonly RoomRegistration[], params: Record<string, unknown>, requiredPattern?: string): RoomResolution;
+interface TypedServerConfig<
+	TQueries extends SyncQueryMap,
+	TDb = unknown
+> {
+	queries: TQueries;
+	db?: TDb;
+	transport: ServerTransport;
+	serverId?: string;
+	storage?: StorageAdapter;
+	onEvent?: (event: SyncEvent) => void;
+	/** Poll interval in ms for detecting changes from other server instances sharing the same storage. Enables HA mode. 0 or undefined to disable. */
+	poll?: number;
+	maxConnectionsPerUser?: number;
+	/**
+	* Serve connections without an `auth()` callback, giving each session an
+	* `anon:<clientId>` identity. Without it a server that never calls `auth()`
+	* rejects the handshake instead of acking `hello` and then failing every
+	* later message as unauthenticated.
+	*/
+	allowAnonymous?: boolean;
+	/** Abort a broadcast query that runs longer than this many ms. 0 disables. */
+	queryTimeoutMs?: number;
+	/** Max subscriber groups whose queries run concurrently per broadcast. Default: 8. */
+	maxBroadcastConcurrency?: number;
+	/** Adapter that wraps `server.tx({ atomic: true })` writes in a transaction. */
+	txAtomic?: TxAtomicAdapter;
+}
+type ImplementParams<
+	TQueries extends SyncQueryMap,
+	K extends keyof TQueries
+> = TQueries[K] extends {
+	params: infer P extends Record<string, unknown>;
+} ? P : Record<string, unknown>;
+/** Keys whose value is a `SyncViewDef` (read-only computed query). */
+type ViewKeys<TQueries extends SyncQueryMap> = { [K in keyof TQueries] : TQueries[K] extends SyncViewDef ? K : never }[keyof TQueries];
+/** Keys whose value is a regular query (not view, not presence). */
+type RegularKeys<TQueries extends SyncQueryMap> = { [K in keyof TQueries] : TQueries[K] extends SyncViewDef | SyncPresenceDef ? never : K }[keyof TQueries];
+type ServerSetKeys<
+	TQueries extends SyncQueryMap,
+	K extends keyof TQueries
+> = InferServerSetKeys<TQueries[K]>;
+/** True when schema's `serverSet` is the array form (keys only) */
+type IsServerSetArrayForm<
+	TQueries extends SyncQueryMap,
+	K extends keyof TQueries
+> = TQueries[K] extends {
+	serverSet: readonly string[];
+} ? true : false;
+/** Value: static or a function receiving auth/params context */
+type ServerSetValue<
+	TAuth extends AuthContext,
+	TQueries extends SyncQueryMap,
+	K extends keyof TQueries
+> = unknown | ((ctx: {
+	auth: TAuth;
+	params: ImplementParams<TQueries, K>;
+}) => unknown);
+/**
+* `serverSet` shape on `implement(...)`:
+*  - schema declares no `serverSet` → field disallowed.
+*  - schema declares array form → field REQUIRED (values must be supplied).
+*  - schema declares object form → field OPTIONAL (overrides only).
+*/
+type ServerSetOption<
+	TQueries extends SyncQueryMap,
+	K extends keyof TQueries,
+	TAuth extends AuthContext
+> = [ServerSetKeys<TQueries, K>] extends [never] ? {
+	serverSet?: undefined;
+} : IsServerSetArrayForm<TQueries, K> extends true ? {
+	serverSet: { [F in ServerSetKeys<TQueries, K>] : ServerSetValue<TAuth, TQueries, K> };
+} : {
+	serverSet?: Partial<{ [F in ServerSetKeys<TQueries, K>] : ServerSetValue<TAuth, TQueries, K> }>;
+};
+/**
+* Options for `server.implement(...)`. Collapses to `never` for view/presence
+* entries — those have dedicated `server.view(...)` / `usePresence(...)` paths
+* and aren't writable through the implement surface.
+*/
+type ImplementOptions<
+	TQueries extends SyncQueryMap,
+	K extends keyof TQueries,
+	TAuth extends AuthContext,
+	TDb
+> = TQueries[K] extends SyncViewDef | SyncPresenceDef ? never : {
+	query: (ctx: {
+		auth: TAuth;
+		params: ImplementParams<TQueries, K>;
+	}, db: TDb) => unknown;
+	mutate?: (op: ResolvedOp, ctx: {
+		auth: TAuth;
+		params: ImplementParams<TQueries, K>;
+	}, db: TDb) => Promise<void | MutateResult>;
+	authorize?: (action: AuthorizeAction, ctx: {
+		auth: TAuth;
+		params: ImplementParams<TQueries, K>;
+	}, db: TDb) => Promise<void>;
+	broadcast?: "consistent" | "eager" | "eager-durable";
+	flushInterval?: number;
+	maxBufferSize?: number;
+	/** Override change-detection tables (defaults to schema.tables or query key name) */
+	tables?: string[];
+	/**
+	* Total row count for `countHints`, independent of the window. Without
+	* it every broadcast fetches the full result set just to count it.
+	*/
+	count?: (ctx: {
+		auth: TAuth;
+		params: ImplementParams<TQueries, K>;
+	}, db: TDb) => Promise<number> | number;
+	/**
+	* Collapse subscribers whose results are identical into one query
+	* execution per broadcast. See `QueryOptions.groupBy`.
+	*/
+	groupBy?: (ctx: {
+		auth: TAuth;
+		params: ImplementParams<TQueries, K>;
+	}) => string;
+	/**
+	* Require subscriptions to resolve this room pattern (e.g.
+	* `"org/:orgId"`). Subscriptions that don't are rejected instead of
+	* silently becoming unscoped. See `QueryOptions.room`.
+	*/
+	room?: string;
+} & ServerSetOption<TQueries, K, TAuth>;
+/** Function signature for a view's read-only query callback. */
+type ViewFn<
+	TQueries extends SyncQueryMap,
+	K extends keyof TQueries,
+	TAuth extends AuthContext,
+	TDb
+> = (ctx: {
+	auth: TAuth;
+	params: ImplementParams<TQueries, K>;
+}, db: TDb) => Promise<InferRow<TQueries, K>[]> | InferRow<TQueries, K>[];
+interface RestConfig {
+	/** URL prefix (default: "/api") */
+	prefix?: string;
+}
+interface TypedSyncServer<
+	TQueries extends SyncQueryMap,
+	TAuth extends AuthContext = AuthContext,
+	TDb = unknown
+> {
+	auth(callback: AuthCallback): void;
+	implement<K extends RegularKeys<TQueries> & string>(name: K, options: ImplementOptions<TQueries, K, TAuth, TDb>): void;
+	/**
+	* Register a read-only computed query. Compiles to `server.query(...)` with a
+	* mutate that throws `readonly_query`, so direct writes are blocked at runtime
+	* and `useSync(...).insert/update/remove` is blocked at the type level.
+	*/
+	view<K extends ViewKeys<TQueries> & string>(name: K, fn: ViewFn<TQueries, K, TAuth, TDb>): void;
+	room(pattern: string, callback: RoomCallback<TAuth>): void;
+	rateLimit(config: RateLimitConfig): void;
+	compaction(config: CompactionConfig): void;
+	minSchemaVersion(version: number): void;
+	runCompaction(): Promise<void>;
+	notifyChange(tableName: string, roomKey?: string | null): Promise<void>;
+	reserveOpId(opId: string): Promise<boolean>;
+	applyServerOp(op: {
+		type: OpType;
+		table: string;
+		rowId: string;
+		payload: Record<string, unknown> | null;
+	}, execute?: (stamped: {
+		type: OpType;
+		table: string;
+		rowId: string;
+		payload: Record<string, unknown> | null;
+		hlc: string;
+	}) => Promise<void>, options?: {
+		roomKey?: string | null;
+	}): Promise<{
+		hlc: string;
+		resolvedRow: Record<string, unknown> | null;
+	}>;
+	/**
+	* Server-origin row write. Sugar over `applyServerOp` — generates rowId,
+	* routes through HLC + op log + broadcast pipeline.
+	*/
+	emit(table: string, payload: Record<string, unknown>, options?: {
+		rowId?: string;
+		type?: OpType;
+		roomKey?: string | null;
+	}): Promise<{
+		hlc: string;
+		rowId: string;
+	}>;
+	/**
+	* Atomic-ish write group with auto-notify. Tracks tables touched by drizzle
+	* `insert/update/delete` calls inside `fn` and fires one batched
+	* `notifyChange` per table on success. With `atomic: true` the work runs
+	* inside `db.transaction(...)` and rolls back on throw; without it, writes
+	* are not transactional but notifies are still skipped on throw.
+	*/
+	tx<T>(fn: TxFn<T>): Promise<T>;
+	tx<T>(opts: TxOptions, fn: TxFn<T>): Promise<T>;
+	lock<T>(key: string, fn: () => Promise<T>): Promise<T>;
+	tryLock<T>(key: string, fn: () => Promise<T>): Promise<T | null>;
+	/** `setInterval` wrapper — auto-disposes on `bun --hot` reload and on `close()`. */
+	interval(ms: number, fn: () => void | Promise<void>): {
+		clear(): void;
+	};
+	/** `setTimeout` wrapper — auto-disposes on `bun --hot` reload and on `close()`. */
+	timeout(ms: number, fn: () => void | Promise<void>): {
+		clear(): void;
+	};
+	close(): Promise<void>;
+	/** Generate a REST fetch handler from registered implementations */
+	rest(config?: RestConfig): (req: Request) => Promise<Response>;
+}
+declare function createSyncServer<
+	TQueries extends SyncQueryMap,
+	TDb = unknown,
+	TAuth extends AuthContext = AuthContext
+>(config: TypedServerConfig<TQueries, TDb>): TypedSyncServer<TQueries, TAuth, TDb>;
+export { stableStringify, resolveRoomKey, resolveConflict, processOp, enforceServerSet, enforceReadonly, enforceClockDrift, enforceBatchSize, drizzleTxAtomic, drizzleTable, defineTable, createSyncServer, createSqliteStorage, createServer, createRateLimiter, createPostgresStorage, TypedSyncServer, TypedServerConfig, TxProxy, TxOptions, TxFn, TxAtomicAdapter, TableAdapter, SyncServer, SyncEvent, StorageAdapter, SqliteStorageConfig, SessionManager, ServerConfig, ServerClock, ScopeFilter, SERVER_HLC_META_KEY, RoomResolution, RoomCallback, ResultCache, RestConfig, ResolvedOp, RateLimiter, QuerySubscription, QueryRegistration, QueryOptions, QueryContext, QueryCallback, PostgresStorageConfig, PostgresClient, PipelineResult, PipelineContext, OpResult, OpProcessorDeps, OpProcessor, OpLogEntry, MutationError, MutationContext, MutateResult, MessageHandler, ImplementOptions, HandlerConfig, ExistingRow, EnforcementResult, EnforcementContext, DrizzleTableOpts, DiffResult, DefineTableOpts, ConflictResult, ConflictInput, ClientSession, BroadcastEngineDeps, BroadcastEngine, BatchContext, AuthorizeAction, AuthCallback };