@powersync/service-core 1.27.2 → 1.28.1

package/src/replication/AbstractReplicator.ts

@@ -1,5 +1,4 @@
 import { container, ErrorCode, logger, ReplicationAbortedError } from '@powersync/lib-services-framework';
-import { DEFAULT_TAG, SqlSyncRules, type SyncConfig } from '@powersync/service-sync-rules';
 import { ReplicationMetric } from '@powersync/service-types';
 import { hrtime } from 'node:process';
 import { setTimeout as sleep } from 'node:timers/promises';
@@ -7,8 +6,8 @@ import winston from 'winston';
 import { MetricsEngine } from '../metrics/MetricsEngine.js';
 import * as storage from '../storage/storage-index.js';
 import { StorageEngine } from '../storage/storage-index.js';
-import { SyncRulesProvider } from '../util/config/sync-rules/sync-rules-provider.js';
-import type { ResolvedPowerSyncConfig } from '../util/config/types.js';
+import { assertAcceptedSyncConfig, SyncConfigEngine, SyncConfigResultStatus } from '../system/SyncConfigEngine.js';
+import { ResolvedPowerSyncConfig } from '../util/config/types.js';
 import { AbstractReplicationJob } from './AbstractReplicationJob.js';
 import { ErrorRateLimiter } from './ErrorRateLimiter.js';
 import { ConnectionTestResult } from './ReplicationModule.js';
@@ -31,11 +30,11 @@ export interface AbstractReplicatorOptions {
   id: string;
   storageEngine: StorageEngine;
   metricsEngine: MetricsEngine;
-  syncRuleProvider: SyncRulesProvider;
+  configuration: Pick<ResolvedPowerSyncConfig, 'sync_rules' | 'connections'>;
   /**
-   * Source connection metadata from the service config, used when parsing filesystem-loaded sync configs.
+   * Context-owned admission engine shared with diagnostics; jobs use storage-owned parsed configs.
    */
-  configuration?: Pick<ResolvedPowerSyncConfig, 'connections'>;
+  syncConfigEngine: SyncConfigEngine;
   /**
    * This limits the effect of retries when there is a persistent issue.
    */
@@ -79,8 +78,6 @@ export abstract class AbstractReplicator<T extends AbstractReplicationJob = Abst
 
   private abortController: AbortController | undefined;
 
-  private assertSourceCapabilities: ((config: SyncConfig) => Promise<void>) | undefined;
-
   protected constructor(private options: AbstractReplicatorOptions) {
     this.logger = logger.child({ name: `Replicator:${options.id}` });
     const heartbeatIntervalSeconds = options.heartbeatIntervalSeconds ?? DEFAULT_HEARTBEAT_INTERVAL_SECONDS;
@@ -109,17 +106,6 @@ export abstract class AbstractReplicator<T extends AbstractReplicationJob = Abst
     return this.options.storageEngine.activeBucketStorage;
   }
 
-  protected get syncRuleProvider() {
-    return this.options.syncRuleProvider;
-  }
-
-  /**
-   * Default schema for startup sync config validation. Source modules with a known default should override this.
-   */
-  protected get defaultSchema(): string {
-    return 'not_applicable';
-  }
-
   protected get rateLimiter() {
     return this.options.rateLimiter;
   }
@@ -132,13 +118,6 @@ export abstract class AbstractReplicator<T extends AbstractReplicationJob = Abst
     return this.abortController?.signal.aborted;
   }
 
-  /**
-   * Register an assertion that blocks unsupported file-loaded sync configs before replication.
-   */
-  public registerSourceCapabilitiesAssertion(assertion: (config: SyncConfig) => Promise<void>): void {
-    this.assertSourceCapabilities = assertion;
-  }
-
   public async start(): Promise<void> {
     this.abortController = new AbortController();
     this.runLoop().catch((e) => {
@@ -174,56 +153,42 @@ export abstract class AbstractReplicator<T extends AbstractReplicationJob = Abst
   }
 
   private async runLoop() {
-    const loadedSyncConfig = await this.syncRuleProvider.get();
-
-    let configuredLock: storage.ReplicationLock | undefined = undefined;
-    if (loadedSyncConfig != null) {
-      const versionLabel = this.syncRuleProvider.versionLabel;
-      this.logger.info(`Loaded sync config${versionLabel == null ? '' : ` ${versionLabel}`}`);
-      try {
-        // Configure new sync config, if they have changed.
-        // In that case, also immediately take out a lock, so that another process doesn't start replication on it.
-        // This upfront lock is mostly superseded by the replicationStreamLoadedSyncConfigMatch() check. However, that doesn't cover old
-        // versions before that check was added, so we keep the lock for now - for where te service version and sync config is updated at
-        // the same time.
-
-        const parsed = SqlSyncRules.fromYaml(loadedSyncConfig, {
-          schema: undefined,
-          defaultSchema: this.defaultSchema,
-          connections:
-            this.options.configuration?.connections &&
-            Object.fromEntries(
-              this.options.configuration.connections.map((connection) => [
-                connection.tag ?? DEFAULT_TAG,
-                { type: connection.type }
-              ])
-            ),
-          throwOnError: this.syncRuleProvider.exitOnError
-        });
-        storage.logSyncConfigErrors(parsed, this.logger);
-        try {
-          await this.assertSourceCapabilities?.(parsed.config);
-        } catch (error) {
-          if (this.syncRuleProvider.exitOnError) throw error;
-          // Persist the config for diagnostics; the job-start check will prevent unsafe replication.
-          this.logger.error('Source capability validation failed for the sync config', error);
+    const settings = this.options.configuration.sync_rules;
+    const result = await this.options.syncConfigEngine.getConfigured();
+    if (result.status === SyncConfigResultStatus.UNAVAILABLE) {
+      throw result.error;
+    }
+    const loadedSyncConfig =
+      result.status === SyncConfigResultStatus.ACCEPTED || result.status === SyncConfigResultStatus.REJECTED
+        ? result.content
+        : undefined;
+    const loadedSyncConfigInvalid = result.status === SyncConfigResultStatus.REJECTED;
+    let configuredLock: storage.ReplicationLock | undefined;
+    if (result.status === SyncConfigResultStatus.ACCEPTED || result.status === SyncConfigResultStatus.REJECTED) {
+      storage.logSyncConfigErrors(result.diagnostics, this.logger);
+      if (result.status === SyncConfigResultStatus.REJECTED) {
+        if (settings.exit_on_error) {
+          assertAcceptedSyncConfig(result);
         }
-        const { lock } = await this.storage.configureSyncRules(
-          storage.updateSyncRulesFromConfig(parsed, {
-            lock: true,
-            version_label: versionLabel
-          })
-        );
-        if (lock) {
-          configuredLock = lock;
+        // A startup submission supersedes pending work even when its replacement is rejected.
+        // Do not repeat this on refresh: a later process startup is a new deployment.
+        await this.storage.stopProcessingSyncConfigs();
+        // Supersession may also have stopped recovery of an already-errored active config.
+        // Reuse the backend recovery path, which rechecks current active/pending work.
+        const active = await this.storage.getActiveSyncConfig();
+        if (active?.replicationStream.state === storage.SyncRuleState.ERRORED) {
+          await this.storage.restartReplication(active.replicationStream.replicationStreamId);
         }
-      } catch (e) {
-        // Log and re-raise to exit.
-        this.logger.error(`Failed to update sync config`, e);
-        throw e;
+      } else {
+        const { lock } = await this.storage.configureSyncRules({
+          config: result.compiled,
+          lock: true,
+          version_label: settings.version_label
+        });
+        configuredLock = lock;
       }
     } else {
-      this.logger.info('No sync config configured - configure via API');
+      this.logger.info('No sync config loaded - using stored deployments');
     }
     let useFastRefresh = true;
     const fastRefreshDeadline = Date.now() + FAST_REFRESH_TIMEOUT_MS;
@@ -233,7 +198,8 @@ export abstract class AbstractReplicator<T extends AbstractReplicationJob = Abst
         const refreshResult = await this.refresh({
           configuredLock,
           loadedSyncConfig,
-          loadedVersionLabel: this.syncRuleProvider.versionLabel
+          loadedSyncConfigInvalid,
+          loadedVersionLabel: settings.version_label
         });
         if (refreshResult.replicationJobStarted || Date.now() >= fastRefreshDeadline) {
           useFastRefresh = false;
@@ -266,6 +232,7 @@ export abstract class AbstractReplicator<T extends AbstractReplicationJob = Abst
   private async refresh(options?: {
     configuredLock?: storage.ReplicationLock;
     loadedSyncConfig?: string;
+    loadedSyncConfigInvalid?: boolean;
     loadedVersionLabel?: string;
   }): Promise<{ replicationJobStarted: boolean }> {
     if (this.stopped) {
@@ -285,7 +252,12 @@ export abstract class AbstractReplicator<T extends AbstractReplicationJob = Abst
       const existingJob = existingJobs.get(jobId);
       const syncConfigMismatchMessage = 'Ignoring replication stream for sync config not loaded by this process';
       if (
-        !this.shouldHandleReplicationStream(replicationStream, options?.loadedSyncConfig, options?.loadedVersionLabel)
+        !(await this.shouldHandleReplicationStream(
+          replicationStream,
+          options?.loadedSyncConfig,
+          options?.loadedVersionLabel,
+          options?.loadedSyncConfigInvalid
+        ))
       ) {
         this.logReplicationStreamInfoOnce(replicationStream, 'sync-config-mismatch', () => {
           replicationStream.logger.info(syncConfigMismatchMessage);
@@ -415,29 +387,59 @@ export abstract class AbstractReplicator<T extends AbstractReplicationJob = Abst
   }
 
   /**
-   * When we load sync config from the filesystem/config source, we ignore any config loaded by other processes.
+   * When we load sync config from the service configuration (file, Base64, or inline content), we ignore any config loaded by other processes.
    * The idea is that if a different process loads updated config, that process should process it, not this one.
    *
    * This specifically helps for cases with rolling deploys.
    *
+   * A rejected configured sync config may still run recovery processing matching the active config.
    * This does not apply when sync config is loaded from the database/API, instead of in the config.
    */
-  private shouldHandleReplicationStream(
+  protected async shouldHandleReplicationStream(
     replicationStream: storage.PersistedReplicationStream,
     loadedSyncRules: string | undefined,
-    loadedVersionLabel: string | undefined
+    loadedVersionLabel: string | undefined,
+    loadedSyncConfigInvalid = false
   ) {
     if (loadedSyncRules == null) {
+      // Without loaded content, handle stored deployments regardless of their source.
       return true;
     }
 
+    // A local config was loaded; check pending deployment ownership below.
     const processingConfig = replicationStream.syncConfigContent.find(
       (syncConfig) => syncConfig.syncConfigState == storage.SyncRuleState.PROCESSING
     );
-    return (
-      processingConfig == null ||
-      (processingConfig.sync_rules_content == loadedSyncRules && processingConfig.version_label == loadedVersionLabel)
-    );
+    if (processingConfig == null) {
+      // There aren't any processing configs here, there may be active configs, so this deployment can handle the stream.
+      return true;
+    }
+
+    // Preserve ownership of matching deployments already stored by an older service, even
+    // if this version rejects their YAML. In incremental storage they may share a stream
+    // with the active config. We block new invalid deployments, not existing processing work.
+    if (
+      processingConfig.sync_rules_content == loadedSyncRules &&
+      processingConfig.version_label == loadedVersionLabel
+    ) {
+      return true;
+    }
+
+    if (loadedSyncConfigInvalid) {
+      // Recovery and manual reprocessing may rebuild the active config while this process has
+      // rejected its configured sync config. Allow that rebuild, but not another instance's unrelated
+      // pending deployment. An ERRORED active config still identifies the content being recovered.
+      // Manual reprocessing can select a newer storage version, so match config identity only.
+      const active = await this.storage.getActiveSyncConfig();
+      return (
+        active != null &&
+        processingConfig.sync_rules_content == active.content.sync_rules_content &&
+        processingConfig.version_label == active.content.version_label
+      );
+    }
+
+    // Leave unrelated pending deployments to a worker that loaded them.
+    return false;
   }
 
   protected createJobId(syncRuleId: number) {

package/src/replication/ReplicationModule.ts

@@ -95,11 +95,6 @@ export abstract class ReplicationModule<TConfig extends types.configFile.DataSou
     context.routerEngine.registerAPI(sourceAPI);
     if (context.replicationEngine) {
       const replicator = this.createReplicator(context);
-      if (sourceAPI.validateSourceCapabilities != null) {
-        // KLUDGE: Reuse the adapter validation for filesystem-loaded configs.
-        // A shared validation interface could replace this registration through the route adapter in the future.
-        replicator.registerSourceCapabilitiesAssertion((config) => api.assertSourceCapabilities(sourceAPI, config));
-      }
       context.replicationEngine.register(replicator);
     }
   }

package/src/routes/configure-fastify.ts

@@ -6,6 +6,7 @@ import {
   registerFastifyRoutes
 } from './route-register.js';
 
+import { recordSyncConnection, SyncCloseReason, SyncTransport } from '../metrics/connection-metrics.js';
 import * as system from '../system/system-index.js';
 
 import { ADMIN_ROUTES } from './endpoints/admin.js';
@@ -123,7 +124,12 @@ export function configureFastifyServer(server: fastify.FastifyInstance, options:
     // Limit the active concurrent requests
     childContext.addHook(
       'onRequest',
-      createRequestQueueHook(routes.sync_stream?.queue_options ?? DEFAULT_ROUTE_OPTIONS.sync_stream.queue_options)
+      createRequestQueueHook(routes.sync_stream?.queue_options ?? DEFAULT_ROUTE_OPTIONS.sync_stream.queue_options, () =>
+        recordSyncConnection(service_context.metricsEngine, {
+          transport: SyncTransport.HttpStream,
+          closeReason: SyncCloseReason.ConcurrencyLimit
+        })
+      )
     );
   });
 }

package/src/routes/endpoints/admin.ts

@@ -1,11 +1,12 @@
 import * as sqlite from 'node:sqlite';
+import { assertAcceptedSyncConfig, assertConfiguredSyncConfigValid } from '../../system/SyncConfigEngine.js';
 
 import { ErrorCode, errors, router, schema } from '@powersync/lib-services-framework';
 import {
   HydratedSyncConfig,
   nodeSqlite,
+  parseSyncConfig,
   SourceSchema,
-  SqlSyncRules,
   StaticSchema
 } from '@powersync/service-sync-rules';
 import { internal_routes, ServiceInfo } from '@powersync/service-types';
@@ -67,11 +68,17 @@ export const diagnostics = routeDefinition({
 
     const apiHandler = service_context.routerEngine.getAPI();
 
+    const rejectedConfig = api.getInvalidLocalSyncConfigStatus(
+      await service_context.syncConfigEngine.getConfigured(),
+      include_content,
+      service_context.configuration.sync_rules.version_label
+    );
     const status = await apiHandler.getConnectionStatus();
     if (!status) {
       return internal_routes.DiagnosticsResponse.encode({
         ...serviceResponse,
-        connections: []
+        connections: [],
+        deploying_sync_rules: rejectedConfig
       });
     }
 
@@ -96,8 +103,12 @@ export const diagnostics = routeDefinition({
       active?.storage
     );
 
+    // Prefer validation errors from this instance's configured content: rejected configs are
+    // never persisted, so stored pending work may belong to an earlier deployment. Fall back
+    // to stored deployment status when there is no rejected config to report.
     const deploying_status =
-      deploying == null
+      rejectedConfig ??
+      (deploying == null
         ? undefined
         : await api.getSyncRulesStatus(
             apiHandler,
@@ -109,7 +120,7 @@ export const diagnostics = routeDefinition({
               active: false
             },
             deploying.storage
-          );
+          ));
 
     return internal_routes.DiagnosticsResponse.encode({
       ...serviceResponse,
@@ -161,6 +172,8 @@ export const reprocess = routeDefinition({
       });
     }
 
+    await assertConfiguredSyncConfigValid(service_context.syncConfigEngine);
+
     const active = await activeBucketStorage.getActiveSyncConfig();
     if (active == null) {
       throw new errors.ServiceError({
@@ -173,23 +186,17 @@ export const reprocess = routeDefinition({
     // 1. This always re-parses the source YAML. If there are changes to the Sync Streams compiler, that can affect the sync plan.
     // 2. If the source does not set the storage version, this will update it do the current version.
     // We can consider tweaking this behavior in the future.
-    const parsed = SqlSyncRules.fromYaml(active.content.sync_rules_content, {
-      ...apiHandler.getParseSyncRulesOptions(),
-      schema: undefined,
-      // This sync config already passed validation. But if the config is not valid anymore due
-      // to a service change, we do want to report the error here.
-      throwOnError: true
-    });
-    storage.logSyncConfigErrors(parsed);
-    await api.assertSourceCapabilities(apiHandler, parsed.config);
-
-    const new_rules = await activeBucketStorage.updateSyncRules(
-      storage.updateSyncRulesFromConfig(parsed, {
-        version_label: active.content.version_label,
-        forceNewReplicationStream: true
-      })
+    const compiled = assertAcceptedSyncConfig(
+      await service_context.syncConfigEngine.validate(active.content.sync_rules_content)
     );
 
+    storage.logSyncConfigErrors(compiled.parsed);
+    const new_rules = await activeBucketStorage.updateSyncRules({
+      config: compiled,
+      version_label: active.content.version_label,
+      forceNewReplicationStream: true
+    });
+
     const baseConfig = await apiHandler.getSourceConfig();
 
     return internal_routes.ReprocessResponse.encode({
@@ -214,7 +221,7 @@ class FakeSyncRulesContentForValidation extends storage.PersistedSyncConfigConte
   }
 
   parsed(options: storage.ParseSyncConfigOptions): storage.ParsedSyncConfigSet {
-    const syncConfig = SqlSyncRules.fromYaml(this.sync_rules_content, {
+    const syncConfig = parseSyncConfig(this.sync_rules_content, {
       ...options,
       schema: this.schema
     });

package/src/routes/endpoints/socket-route.ts

@@ -1,4 +1,4 @@
-import { ErrorCode, errors, schema } from '@powersync/lib-services-framework';
+import { errors, schema } from '@powersync/lib-services-framework';
 
 import * as sync from '../../sync/sync-index.js';
 import * as util from '../../util/util-index.js';
@@ -6,7 +6,14 @@ import { SocketRouteGenerator } from '../router-socket.js';
 import { SyncRoutes } from './sync-stream.js';
 
 import { APIMetric, event_types } from '@powersync/service-types';
+import {
+  recordSyncConnection,
+  SyncCloseReason,
+  syncConnectionCloseReasonLogText,
+  SyncTransport
+} from '../../metrics/connection-metrics.js';
 import { limitParamsForLogging } from '../../util/param-logging.js';
+import { resolveSyncConnectionSetup } from '../sync-connection.js';
 
 export const syncStreamReactive: SocketRouteGenerator = (router) =>
   router.reactiveStream<util.StreamingSyncRequest, any>(SyncRoutes.STREAM, {
@@ -36,18 +43,22 @@ export const syncStreamReactive: SocketRouteGenerator = (router) =>
         connected_at: new Date(streamStart)
       };
 
+      const { bucketStorage, syncRules } = await resolveSyncConnectionSetup(service_context, SyncTransport.RSocket);
+
       // Best effort guess on why the stream was closed.
       // We use the `??=` operator everywhere, so that we catch the first relevant
       // event, which is usually the most specific.
-      let closeReason: string | undefined = undefined;
+      let closeReason: SyncCloseReason | undefined = undefined;
+      let connectionError: unknown;
 
       // Create our own controller that we can abort directly
       const controller = new AbortController();
       upstreamSignal.addEventListener('abort', () => {
-        closeReason ??= 'client closing stream';
+        closeReason ??= SyncCloseReason.ClientClosed;
         controller.abort();
       });
       if (upstreamSignal.aborted) {
+        closeReason ??= SyncCloseReason.ClientClosed;
         controller.abort();
       }
       const signal = controller.signal;
@@ -59,39 +70,8 @@ export const syncStreamReactive: SocketRouteGenerator = (router) =>
         }
       });
 
-      if (routerEngine.closed) {
-        responder.onError(
-          new errors.ServiceError({
-            status: 503,
-            code: ErrorCode.PSYNC_S2003,
-            description: 'Service temporarily unavailable'
-          })
-        );
-        responder.onComplete();
-        return;
-      }
-
-      const {
-        storageEngine: { activeBucketStorage }
-      } = service_context;
-
-      const bucketStorage = (await activeBucketStorage.getActiveSyncConfig())?.storage;
-      if (bucketStorage == null) {
-        responder.onError(
-          new errors.ServiceError({
-            status: 500,
-            code: ErrorCode.PSYNC_S2302,
-            description: 'No sync config available'
-          })
-        );
-        responder.onComplete();
-        return;
-      }
-
-      const syncRules = bucketStorage.getParsedSyncRules(routerEngine.getAPI().getParseSyncRulesOptions());
-
       const removeStopHandler = routerEngine.addStopHandler(() => {
-        closeReason ??= 'process shutdown';
+        closeReason ??= SyncCloseReason.ProcessShutdown;
         controller.abort();
       });
 
@@ -162,14 +142,17 @@ export const syncStreamReactive: SocketRouteGenerator = (router) =>
             });
           }
         }
-        closeReason ??= 'service closing stream';
+        closeReason ??= SyncCloseReason.ServiceClosed;
       } catch (ex) {
         // Convert to our standard form before responding.
         // This ensures the error can be serialized.
         // However, use the original error for the logs, so that we have the stack trace.
         const error = new errors.InternalServerError(ex);
         logger.error('Sync stream error', ex);
-        closeReason ??= 'stream error';
+        if (closeReason == null) {
+          closeReason = SyncCloseReason.StreamError;
+          connectionError = ex;
+        }
         responder.onError(error);
       } finally {
         responder.onComplete();
@@ -190,9 +173,14 @@ export const syncStreamReactive: SocketRouteGenerator = (router) =>
           ...tracker.getLogMeta(),
           app_metadata: formattedAppMetadata,
           stream_ms: Date.now() - streamStart,
-          close_reason: closeReason ?? 'unknown'
+          close_reason: syncConnectionCloseReasonLogText(closeReason)
         });
         metricsEngine.getUpDownCounter(APIMetric.CONCURRENT_CONNECTIONS).add(-1);
+        recordSyncConnection(metricsEngine, {
+          transport: SyncTransport.RSocket,
+          closeReason: closeReason ?? SyncCloseReason.Unknown,
+          error: connectionError
+        });
         service_context.eventsEngine.emit(event_types.EventsEngineEventType.SDK_DISCONNECT_EVENT, {
           ...sdkData,
           disconnected_at: new Date()

package/src/routes/endpoints/sync-rules.ts

@@ -1,11 +1,11 @@
 import { ErrorCode, errors, router, schema } from '@powersync/lib-services-framework';
-import { SqlSyncRules, SyncConfigWithErrors, SyncRulesErrors } from '@powersync/service-sync-rules';
+import { parseSyncConfig, SyncConfigErrors } from '@powersync/service-sync-rules';
 import type { FastifyPluginAsync } from 'fastify';
 import * as t from 'ts-codec';
-import { assertSourceCapabilities } from '../../api/source-capabilities.js';
+import { assertAcceptedSyncConfig, assertConfiguredSyncConfigValid } from '../../system/SyncConfigEngine.js';
 
 import { PatternResult, RouteAPI } from '../../api/RouteAPI.js';
-import { logSyncConfigErrors, updateSyncRulesFromConfig } from '../../storage/BucketStorageFactory.js';
+import { logSyncConfigErrors } from '../../storage/BucketStorageFactory.js';
 import { authApi } from '../auth.js';
 import { routeDefinition } from '../router.js';
 
@@ -53,30 +53,9 @@ export const deploySyncRules = routeDefinition({
       });
     }
     const content = payload.params.content;
-    let syncConfig: SyncConfigWithErrors;
-
-    try {
-      // First ensure the SyncConfig parses correctly
-      const apiHandler = service_context.routerEngine.getAPI();
-      syncConfig = SqlSyncRules.fromYaml(content, {
-        ...apiHandler.getParseSyncRulesOptions(),
-        // We don't do any schema-level validation at this point
-        schema: undefined
-      });
-    } catch (e) {
-      throw new errors.ServiceError({
-        status: 422,
-        code: ErrorCode.PSYNC_R0001,
-        description: 'Sync config parsing failed',
-        details: e.message
-      });
-    }
-
-    logSyncConfigErrors(syncConfig);
-    // Validate if the current sources support the configuration specified in the sync config
-    await assertSourceCapabilities(service_context.routerEngine.getAPI(), syncConfig.config);
-
-    const sync_rules = await storageEngine.activeBucketStorage.updateSyncRules(updateSyncRulesFromConfig(syncConfig));
+    const compiled = assertAcceptedSyncConfig(await service_context.syncConfigEngine.validate(content));
+    logSyncConfigErrors(compiled.parsed);
+    const sync_rules = await storageEngine.activeBucketStorage.updateSyncRules({ config: compiled });
 
     return {
       slot_name: sync_rules.replicationStreamName
@@ -160,9 +139,10 @@ export const reprocessSyncRules = routeDefinition({
   authorize: authApi,
   validator: schema.createTsCodecValidator(ReprocessSyncRulesRequest),
   handler: async (payload) => {
+    const service_context = payload.context.service_context;
     const {
       storageEngine: { activeBucketStorage }
-    } = payload.context.service_context;
+    } = service_context;
     const next = await activeBucketStorage.getDeployingSyncConfig();
     if (next != null) {
       throw new errors.ServiceError({
@@ -172,6 +152,8 @@ export const reprocessSyncRules = routeDefinition({
       });
     }
 
+    await assertConfiguredSyncConfigValid(service_context.syncConfigEngine);
+
     const active = await activeBucketStorage.getActiveSyncConfig();
     if (active == null) {
       throw new errors.ServiceError({
@@ -182,22 +164,16 @@ export const reprocessSyncRules = routeDefinition({
     }
 
     const sync_rules = active.content;
-    const parsed = SqlSyncRules.fromYaml(sync_rules.sync_rules_content, {
-      ...payload.context.service_context.routerEngine.getAPI().getParseSyncRulesOptions(),
-      schema: undefined,
-      // This sync config already passed validation. But if the rules are not valid anymore due
-      // to a service change, we do want to report the error here.
-      throwOnError: true
-    });
-    logSyncConfigErrors(parsed);
-    await assertSourceCapabilities(payload.context.service_context.routerEngine.getAPI(), parsed.config);
-
-    const new_rules = await activeBucketStorage.updateSyncRules(
-      updateSyncRulesFromConfig(parsed, {
-        version_label: sync_rules.version_label,
-        forceNewReplicationStream: true
-      })
+    const compiled = assertAcceptedSyncConfig(
+      await service_context.syncConfigEngine.validate(sync_rules.sync_rules_content)
     );
+
+    logSyncConfigErrors(compiled.parsed);
+    const new_rules = await activeBucketStorage.updateSyncRules({
+      config: compiled,
+      version_label: sync_rules.version_label,
+      forceNewReplicationStream: true
+    });
     return {
       slot_name: new_rules.replicationStreamName
     };
@@ -216,7 +192,7 @@ function replyPrettyJson(payload: any) {
 
 async function debugSyncRules(apiHandler: RouteAPI, sync_rules: string) {
   try {
-    const rules = SqlSyncRules.fromYaml(sync_rules, {
+    const rules = parseSyncConfig(sync_rules, {
       ...apiHandler.getParseSyncRulesOptions(),
       // No schema-based validation at this point
       schema: undefined
@@ -224,7 +200,7 @@ async function debugSyncRules(apiHandler: RouteAPI, sync_rules: string) {
     const errors: string[] = [];
     const warnings = rules.errors.filter((error) => error.type === 'warning').map((error) => error.message);
     const recordError = (error: any) => {
-      errors.push(...(error instanceof SyncRulesErrors ? error.errors.map((e) => e.message) : [error.message]));
+      errors.push(...(error instanceof SyncConfigErrors ? error.errors.map((e) => e.message) : [error.message]));
     };
     try {
       const diagnostics = (await apiHandler.validateSourceCapabilities?.(rules.config)) ?? [];
@@ -251,7 +227,7 @@ async function debugSyncRules(apiHandler: RouteAPI, sync_rules: string) {
       data_tables: rules.config.debugGetOutputTables()
     };
   } catch (e) {
-    if (e instanceof SyncRulesErrors) {
+    if (e instanceof SyncConfigErrors) {
       return {
         valid: false,
         errors: e.errors.map((e) => e.message)