@query-farm/vgi 0.28.0 → 0.29.1

package/src/protocol/handlers/function.ts

@@ -4,7 +4,7 @@
 // implements VgiFunction.bind/globalInit/createStreamHandlers.
 
 import { type VgiSchema, schema, type VgiField, field, type VgiDataType, binary, int64 } from "../../arrow/index.js";
-import { Protocol } from "@query-farm/vgi-rpc";
+import { Protocol, type AuthContext } from "@query-farm/vgi-rpc";
 import type { FunctionRegistry } from "../../functions/registry.js";
 import type { StreamHandlers, HandlerState } from "../../functions/types.js";
 import {
@@ -19,7 +19,17 @@ import type { GlobalInitResponse } from "../types.js";
 import { batchToScalarDict, deserializeBatch, adoptArrowJsShape } from "../../util/arrow/index.js";
 import { toUint8Array } from "../../util/bytes.js";
 import { serializeColumnStatistics } from "../../util/statistics.js";
-import { BindResultSchema, TableFunctionCardinalityResultSchema, TableFunctionDynamicToStringResultSchema } from "../../generated/vgi-protocol-schemas.js";
+import {
+  BindParamsSchema,
+  BindResultSchema,
+  InitParamsSchema,
+  TableFunctionCardinalityParamsSchema,
+  TableFunctionCardinalityResultSchema,
+  TableFunctionDynamicToStringParamsSchema,
+  TableFunctionDynamicToStringResultSchema,
+  TableFunctionPlanParamsSchema,
+  TableFunctionStatisticsParamsSchema,
+} from "../../generated/vgi-protocol-schemas.js";
 import {
   REQUEST_PARAMS_SCHEMA,
   RESULT_BINARY_SCHEMA,
@@ -29,7 +39,25 @@ import {
   overloadContext,
   recoverFinalizeState,
 } from "./shared.js";
+import { GLOBAL_INIT_RESPONSE_SCHEMA } from "../serializers/init.js";
 import { openAttach } from "./catalog/shared.js";
+import { currentRequestAuth } from "../../request-auth.js";
+import { batchFromColumns, serializeBatch } from "../../util/arrow/index.js";
+import {
+  deserializePlanRequest,
+  fingerprintInputs,
+  planResponseRow,
+  scanSplitRow,
+  PLAN_RESPONSE_SCHEMA,
+  SCAN_SPLIT_SCHEMA,
+  type PlanResult,
+} from "../serializers/splits.js";
+import {
+  bindFingerprint,
+  buildSplitToken,
+  openSplitToken,
+  splitAnchor,
+} from "../../split-token.js";
 
 export interface FunctionHandlerConfig {
   registry: FunctionRegistry;
@@ -40,7 +68,134 @@ export interface FunctionHandlerConfig {
    * be scoped when two catalogs declare the same schema and function name.
    * Optional — without it, resolution falls back to (schema, name).
    */
-  catalogInterface?: { catalogNameForAttach(a: Uint8Array): string | null };
+  catalogInterface?: {
+    catalogNameForAttach(a: Uint8Array): string | null;
+    /**
+     * The catalog's current version, which is the consistency anchor every split
+     * token is stamped with AND checked against.
+     *
+     * Both sides read it from here on purpose. Minting from a different value
+     * than redemption compares against is not a subtle bug: it refuses every
+     * token, and the documented response to SPLIT_SNAPSHOT_EXPIRED is "re-run
+     * the query", which re-plans, mints the same mismatch and fails again — a
+     * livelock returning no rows, blaming the data for moving when it has not.
+     */
+    version?(attach: Uint8Array, txn?: Uint8Array): number | Promise<number>;
+  };
+}
+
+/**
+ * The live anchor a split token must still name, or undefined when this worker's
+ * catalog reports no version.
+ *
+ * Undefined means "skip the staleness check" rather than "fail" — a check that
+ * cannot be made must not become a check that always fails, which would refuse
+ * every split token on every unversioned catalog.
+ */
+async function liveSplitAnchor(
+  catalogInterface: FunctionHandlerConfig["catalogInterface"],
+  bindCall: { attach_opaque_data?: Uint8Array | null; transaction_opaque_data?: Uint8Array | null },
+  auth: AuthContext | undefined,
+  signingKey: Uint8Array | undefined,
+): Promise<Uint8Array | undefined> {
+  if (!catalogInterface?.version || bindCall.attach_opaque_data == null) return undefined;
+  const raw = toUint8Array(bindCall.attach_opaque_data);
+  const txn = bindCall.transaction_opaque_data
+    ? toUint8Array(bindCall.transaction_opaque_data)
+    : undefined;
+
+  // The two call sites see the attach envelope at DIFFERENT processing stages —
+  // `plan` receives it with the framework's 16-byte UUID prefix still attached,
+  // `init` receives it already stripped — so neither form alone works for both.
+  // Try each. Getting this wrong is not a degraded check but a total one: if
+  // mint resolves a version and redemption does not (or vice versa) then every
+  // token fails SPLIT_SNAPSHOT_EXPIRED, and the documented response to that is
+  // "re-run the query", which re-plans and reproduces the same mismatch.
+  // Each form is produced LAZILY, inside the try. Built as an array literal —
+  // `[raw, await openAttach(...)]` — the unseal is evaluated before the loop
+  // begins, so it throws from OUTSIDE the try and escapes the function instead
+  // of falling through to the next candidate. `init` hands this function
+  // already-stripped plaintext, which openAttach rejects, so the first form
+  // never got a turn: every split scan died with OpaqueDataRejectedError, on
+  // HTTP only (sealing is a pass-through when there is no signing key, which is
+  // every non-HTTP transport).
+  const forms: Array<() => Promise<Uint8Array>> = [
+    async () => raw,
+    async () => openAttach(raw, auth, signingKey),
+  ];
+  for (const form of forms) {
+    try {
+      return splitAnchor(await catalogInterface.version(await form(), txn));
+    } catch {
+      // try the next form
+    }
+  }
+  // A catalog that cannot report a version means "skip the staleness check",
+  // never "fail it" — a check that cannot be made must not become a check that
+  // always fails, which would refuse every split token on every unversioned
+  // catalog.
+  return undefined;
+}
+
+/**
+ * Open this request's split envelopes into `request.split_payloads`.
+ *
+ * `split_payloads` is DERIVED, not wire state: the tokens ride the request, the
+ * payloads are what falls out of opening them. Only this layer holds the
+ * signing key — a function does not — so redemption happens here and only the
+ * payloads are handed down.
+ *
+ * It must run on continuation turns too. The HTTP exchange path rebuilds the
+ * *wire* request from the cursor, which carries `split_tokens` but of course no
+ * derived field, so a split-capable function used to see `splitPayloads:
+ * undefined` on every turn after the first and could not tell that from "the
+ * planner gave me no splits". Over HTTP that made every split scan fail on its
+ * second turn; subprocess never noticed because it holds the handlers in memory
+ * and never rebuilds anything.
+ *
+ * `checkAnchor` is false on a continuation, deliberately. The consistency
+ * anchor answers "is this plan still redeemable", which is a question about
+ * REDEMPTION — asked once, when the split is admitted. Re-asking it mid-stream
+ * would let a catalog version bump kill an in-flight scan that had already been
+ * accepted, turning a successful query into SPLIT_SNAPSHOT_EXPIRED halfway
+ * through its rows.
+ */
+async function resolveSplitPayloads(
+  request: any,
+  innerParams: any,
+  opts: {
+    auth: any;
+    signingKey: Uint8Array | undefined;
+    catalogInterface: any;
+    checkAnchor: boolean;
+  },
+): Promise<void> {
+  if (!request.split_tokens) return;
+  const fp = fingerprintInputs(toUint8Array(innerParams.bind_call));
+  const expected = await bindFingerprint(
+    fp.schemaPath,
+    fp.functionName,
+    fp.args,
+    fp.settings,
+    new Uint8Array(0),
+  );
+  const currentAnchor = opts.checkAnchor
+    ? await liveSplitAnchor(opts.catalogInterface, request.bind_call as any, opts.auth, opts.signingKey)
+    : undefined;
+  request.split_payloads = [];
+  for (const token of request.split_tokens) {
+    request.split_payloads.push(
+      await openSplitToken(token, {
+        signingKey: opts.signingKey,
+        // Same principal `table_function_plan` sealed under. Omitting it opens
+        // under the anonymous tail, so an authenticated caller's own tokens
+        // fail authentication.
+        auth: opts.auth,
+        expectedFingerprint: expected,
+        currentAnchor,
+      }),
+    );
+  }
 }
 
 export function registerFunctionMethods(protocol: Protocol, config: FunctionHandlerConfig): void {
@@ -50,11 +205,17 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
   // HTTP, plaintext on subprocess). Function bodies — like catalog bodies —
   // must see the catalog's own bytes, so unseal (when keyed) and strip the
   // framework UUID prefix before the user function reads attach_opaque_data.
+  // `ctx` is the CallContext when the dispatcher supplies one (every unary
+  // method) and absent otherwise (stream init); `currentRequestAuth()` is the
+  // ambient per-request fallback the HTTP entry point publishes, so both reach
+  // the same principal. Getting an authenticated caller's identity wrong here
+  // is not a degraded lookup but a hard `OpaqueDataRejectedError`: the envelope
+  // is sealed under `attachAad(auth)`.
   async function stripAttach(attach: any, ctx: any): Promise<Uint8Array | null> {
     if (attach == null) return null;
     const env = toUint8Array(attach);
     if (env.length === 0) return env;
-    return openAttach(env, ctx?.auth, signingKey);
+    return openAttach(env, ctx?.auth ?? currentRequestAuth(), signingKey);
   }
 
   // Build an overload context whose attach has been unsealed, so catalog
@@ -72,11 +233,9 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
     return overloadContext({ ...bindCall, attach_opaque_data: attach }, catalogInterface);
   }
 
-  const initHeaderSchema = schema([
-    field("execution_id", binary(), false),
-    field("opaque_data", binary(), true),
-    field("max_workers", int64(), false),
-  ]);
+  // Shared with the serializer that actually emits the header, so the
+  // advertised shape and the emitted shape cannot drift apart.
+  const initHeaderSchema = GLOBAL_INIT_RESPONSE_SCHEMA;
 
   const emptySchema = schema([]);
 
@@ -92,7 +251,7 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
   // bind (unary)
   // --------------------------------------------------------------------------
   protocol.unary("bind", {
-    params: REQUEST_PARAMS_SCHEMA,
+    params: BindParamsSchema,
     result: RESULT_BINARY_SCHEMA,
     handler: async (params, ctx) => {
       const innerParams = unwrapRequest(params.request);
@@ -109,17 +268,46 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
   // init (streaming) - dynamically produces either producer or exchange streams
   // --------------------------------------------------------------------------
   protocol.exchange("init", {
-    params: REQUEST_PARAMS_SCHEMA,
+    params: InitParamsSchema,
     inputSchema: dummyInputSchema,
     outputSchema: emptySchema,
-    init: async (params) => {
+    init: async (params, ctx?: any) => {
       // Preserve raw request IPC bytes for exchange reconstruction
       const requestIpcBytes = toUint8Array(params.request);
       const innerParams = unwrapRequest(params.request);
       const request = deserializeInitRequest(innerParams);
-      // Exchange init has no ctx; on subprocess (no signing key) openAttach is a
-      // pass-through strip that needs no auth. HTTP carries auth via the bind path.
-      request.bind_call.attach_opaque_data = await stripAttach(request.bind_call.attach_opaque_data, undefined);
+      // The caller's identity, and the load-bearing line of this handler.
+      //
+      // vgi-rpc types stream init as `(params) => state`, so unlike every unary
+      // method there is no CallContext to read `auth` off — `ctx` is only ever
+      // populated by a caller that has one (the in-process client). The HTTP
+      // entry point therefore publishes the dispatching principal on an ambient
+      // per-request scope, the same shape vgi-python's `current_auth()`
+      // ContextVar and vgi-go's `handleInit(callCtx)` give those ports.
+      //
+      // It has to be the REAL principal, not `undefined`: `attach_opaque_data`
+      // is sealed by `catalog_attach` under `attachAad(auth)` and every split
+      // token by `table_function_plan` under `splitTokenAad(body, auth)`, both
+      // of which are unary and so seal under the authenticated caller. Opening
+      // them here under the anonymous tail matches only for an anonymous
+      // caller; an authenticated one got `OpaqueDataRejectedError:
+      // attach_opaque_data not recognized` on its first scan, i.e. this worker
+      // could not serve authenticated traffic at all.
+      const auth = ctx?.auth ?? currentRequestAuth();
+      request.bind_call.attach_opaque_data = await stripAttach(
+        request.bind_call.attach_opaque_data,
+        ctx,
+      );
+
+      // Verify and strip the split envelopes BEFORE any user code runs, so an
+      // unverified token can never be acted on.
+      await resolveSplitPayloads(request, innerParams, {
+        auth,
+        signingKey,
+        catalogInterface,
+        checkAnchor: true,
+      });
+
       const func = registry.get(request.bind_call.function_name, overloadContext(request.bind_call, catalogInterface));
 
       // globalInit is async — table function onInit may touch HTTP-backed
@@ -199,6 +387,28 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
         const initRequestBatch = deserializeBatch(state.initRequestIpc);
         const initRequestDict = batchToScalarDict(initRequestBatch);
         const request = deserializeInitRequest(initRequestDict);
+        // Re-derive the split payloads. The cursor carries the wire request,
+        // which has `split_tokens` but not the opened `split_payloads` — that
+        // field only ever existed in memory on the init turn. Without this a
+        // split-capable function sees `splitPayloads: undefined` from the
+        // second turn onward, indistinguishable from "the planner gave me no
+        // splits at all". checkAnchor is false: redemption was already decided
+        // on the init turn, and re-checking here would let a mid-scan catalog
+        // bump fail a query that had already been admitted.
+        // fingerprintInputs hashes the RAW bind_call bytes, so pass the
+        // pre-deserialization blob from the cursor — handing it the decoded
+        // object hashes a different shape and every token fails as
+        // SPLIT_TOKEN_INVALID "minted for a different bind".
+        await resolveSplitPayloads(request, { bind_call: initRequestDict.bind_call }, {
+          // Same principal the tokens were sealed under. The exchange dispatch
+          // gets no ctx (see stripAttach above), so the request-scoped identity
+          // is the only source — opening under the anonymous tail would fail
+          // authentication for every authenticated caller's own tokens.
+          auth: currentRequestAuth(),
+          signingKey,
+          catalogInterface,
+          checkAnchor: false,
+        });
         const func = registry.get(state.functionName, await strippedContext(request.bind_call));
         const executionId = state.executionId;
         const opaqueData = state.opaqueData ?? null;
@@ -259,7 +469,7 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
   // table_function_cardinality (unary)
   // --------------------------------------------------------------------------
   protocol.unary("table_function_cardinality", {
-    params: REQUEST_PARAMS_SCHEMA,
+    params: TableFunctionCardinalityParamsSchema,
     result: RESULT_BINARY_SCHEMA,
     handler: async (params) => {
       const innerParams = unwrapRequest(params.request);
@@ -275,6 +485,89 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
     },
   });
 
+  // --------------------------------------------------------------------------
+  // table_function_plan (unary)
+  // --------------------------------------------------------------------------
+  // Divide a scan into named, independently redeemable splits, so a distributed
+  // engine can retry a task without re-reading or skipping rows.
+  //
+  // A function that declares no `plan` hook gets the framework default: a SINGLE
+  // empty-payload split, which is what "not split-capable" means — the whole scan
+  // is one unit of work. That keeps every existing worker serving unchanged under
+  // protocol 1.4.0, so splits stay opt-in rather than something every worker must
+  // now implement.
+  protocol.unary("table_function_plan", {
+    params: TableFunctionPlanParamsSchema,
+    result: RESULT_BINARY_SCHEMA,
+    handler: async (params, ctx?: any) => {
+      const innerParams = unwrapRequest(params.request);
+      const request = deserializePlanRequest(innerParams);
+      const func = registry.get(
+        request.bind_call.function_name,
+        await strippedContext(request.bind_call),
+      );
+
+      const plan: PlanResult = func.plan
+        ? await func.plan(request)
+        : { splits: [{ payload: new Uint8Array(0) }] };
+
+      // The framework stamps every token: an author cannot forget the
+      // consistency anchor, cannot mis-bind the fingerprint, and never writes
+      // crypto — and the envelope stays a private implementation detail whose
+      // layout can change without touching worker code in five languages.
+      const fp = fingerprintInputs(toUint8Array(innerParams.bind_call));
+      const fingerprint = await bindFingerprint(
+        fp.schemaPath,
+        fp.functionName,
+        fp.args,
+        fp.settings,
+        // projection_ids is not a bind-call field (it rides the init request),
+        // so it feeds in empty — matching the reference implementation, which
+        // reads it off the bind call and likewise finds nothing.
+        new Uint8Array(0),
+      );
+      // A worker that names its version is taken at its word — it knows which
+      // snapshot it planned against. One that leaves it unset gets the LIVE
+      // version, never 0: minting 0 while redemption compares against the live
+      // counter refuses every token, and is invisible on a catalog whose version
+      // happens to be 0, which is most fixtures.
+      const anchor =
+        plan.catalogVersion != null
+          ? splitAnchor(plan.catalogVersion)
+          : ((await liveSplitAnchor(catalogInterface, request.bind_call as any, ctx?.auth, signingKey)) ??
+            splitAnchor(0));
+
+      const blobs: Uint8Array[] = [];
+      for (const split of plan.splits) {
+        const token = await buildSplitToken({
+          payload: split.payload,
+          fingerprint,
+          anchor,
+          signingKey,
+          // Bind the caller. Without it every token seals under the anonymous
+          // identity, so one tenant's splits are replayable by another — the
+          // exact replay the AAD exists to stop.
+          auth: ctx?.auth,
+        });
+        blobs.push(
+          serializeBatch(
+            batchFromColumns(
+              Object.fromEntries(
+                SCAN_SPLIT_SCHEMA.fields.map((f) => [
+                  f.name,
+                  [scanSplitRow(split, token)[f.name] ?? null],
+                ]),
+              ),
+              SCAN_SPLIT_SCHEMA,
+            ),
+          ),
+        );
+      }
+
+      return wrapResult(planResponseRow(plan, blobs), PLAN_RESPONSE_SCHEMA);
+    },
+  });
+
   // --------------------------------------------------------------------------
   // table_function_statistics (unary)
   // --------------------------------------------------------------------------
@@ -283,7 +576,7 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
   // list, else null. DuckDB uses the bounds for plan-time filter elimination
   // (folds impossible filters to EMPTY_RESULT).
   protocol.unary("table_function_statistics", {
-    params: REQUEST_PARAMS_SCHEMA,
+    params: TableFunctionStatisticsParamsSchema,
     result: RESULT_BINARY_NULLABLE_SCHEMA,
     handler: async (params) => {
       const innerParams = unwrapRequest(params.request);
@@ -306,7 +599,7 @@ export function registerFunctionMethods(protocol: Protocol, config: FunctionHand
   // declare dynamicToString, return empty maps so the C++ side falls back
   // to intrinsics only.
   protocol.unary("table_function_dynamic_to_string", {
-    params: REQUEST_PARAMS_SCHEMA,
+    params: TableFunctionDynamicToStringParamsSchema,
     result: RESULT_BINARY_SCHEMA,
     handler: async (params) => {
       const innerParams = unwrapRequest(params.request);

package/src/protocol/handlers/shared.ts

@@ -7,6 +7,7 @@ import { batchToScalarDict, deserializeBatch, serializeBatch, batchFromColumns }
 import { toUint8Array } from "../../util/bytes.js";
 import { TableInOutPhase } from "../../types.js";
 import type { InitRequest } from "../types.js";
+import { normalizeSchemaPath } from "../../schema-path.js";
 
 // The Python vgi-rpc framework wraps ALL non-void unary results in a single
 // "result" column. For ArrowSerializableDataclass types, the result is serialized
@@ -31,7 +32,15 @@ export const RESULT_BINARY_NULLABLE_SCHEMA = schema([
 export function unwrapRequest(requestBytes: any): Record<string, any> {
   const bytes = toUint8Array(requestBytes);
   const innerBatch = deserializeBatch(bytes);
-  return batchToScalarDict(innerBatch);
+  const params = batchToScalarDict(innerBatch);
+  normalizeRequestSchemaPaths(params);
+  return params;
+}
+
+/** Convert Arrow list scalars at RPC boundaries into ordinary string arrays. */
+export function normalizeRequestSchemaPaths(params: Record<string, any>): void {
+  if (params.path != null) params.path = normalizeSchemaPath(params.path);
+  if (params.schema_path != null) params.schema_path = normalizeSchemaPath(params.schema_path);
 }
 
 /**
@@ -57,7 +66,7 @@ export function overloadContext(
     arguments: any;
     input_schema: any;
     function_type: any;
-    schema_name?: string | null;
+    schema_path?: string[] | null;
     attach_opaque_data?: Uint8Array | null;
   },
   catalogInterface?: { catalogNameForAttach(a: Uint8Array): string | null },
@@ -78,7 +87,7 @@ export function overloadContext(
     isScalar: String(req.function_type).toLowerCase() === "scalar",
     // Scopes resolution when the caller named a schema; a name registered in
     // several schemas is otherwise ambiguous.
-    schemaName: req.schema_name ?? null,
+    schemaPath: req.schema_path ?? null,
     catalogName,
   };
 }

package/src/protocol/handlers/table-buffering.ts

@@ -15,9 +15,12 @@ import type { FunctionRegistry } from "../../functions/registry.js";
 import { toUint8Array } from "../../util/bytes.js";
 import { batchToScalarDict, batchToSecretDict } from "../../util/arrow/index.js";
 import {
-  TableBufferingProcessResultSchema,
+  TableBufferingCombineParamsSchema,
   TableBufferingCombineResultSchema,
+  TableBufferingDestructorParamsSchema,
   TableBufferingDestructorResultSchema,
+  TableBufferingProcessParamsSchema,
+  TableBufferingProcessResultSchema,
 } from "../../generated/vgi-protocol-schemas.js";
 import {
   REQUEST_PARAMS_SCHEMA,
@@ -43,19 +46,19 @@ export function registerTableBufferingMethods(
   registry: FunctionRegistry,
   signingKey?: Uint8Array,
 ): void {
-  // `schemaName` scopes resolution to the schema the caller named. The
+  // `schemaPath` scopes resolution to the schema the caller named. The
   // buffering process/combine RPCs carry it (protocol 1.2.0), so a name
   // declared in two schemas resolves to the one the request names rather than
   // colliding on the flat by-name index. `null` keeps the cross-schema lookup.
   function resolveBuffering(
     name: string,
-    schemaName?: string | null,
+    schemaPath?: string[] | null,
   ): TableBufferingVgiFunction {
     const func = registry.get(name, {
       arguments: new Arguments(),
       inputSchema: null,
       isScalar: false,
-      schemaName: schemaName ?? null,
+      schemaPath: schemaPath ?? null,
     }) as any;
     if (!func || func.kind !== "table_buffering") {
       throw new Error(`Function '${name}' is not a table_buffering function`);
@@ -83,7 +86,7 @@ export function registerTableBufferingMethods(
         : rawAttach;
     const transactionId = inner.transaction_id ? toUint8Array(inner.transaction_id) : null;
 
-    const func = resolveBuffering(functionName, inner.schema_name ?? null);
+    const func = resolveBuffering(functionName, inner.schema_path ?? null);
     const bound = new BoundStorage(defaultStorage, executionId);
     const payload = await bound.stateGet(
       FrameworkNS.BUFFERING_INIT,
@@ -121,7 +124,7 @@ export function registerTableBufferingMethods(
   // table_buffering_process — sink one batch, return state_id (unary)
   // ------------------------------------------------------------------------
   protocol.unary("table_buffering_process", {
-    params: REQUEST_PARAMS_SCHEMA,
+    params: TableBufferingProcessParamsSchema,
     result: RESULT_BINARY_SCHEMA,
     handler: async (rpcParams, ctx?: any) => {
       const inner = unwrapRequest(rpcParams.request);
@@ -145,7 +148,7 @@ export function registerTableBufferingMethods(
   // table_buffering_combine — group/merge state_ids (unary)
   // ------------------------------------------------------------------------
   protocol.unary("table_buffering_combine", {
-    params: REQUEST_PARAMS_SCHEMA,
+    params: TableBufferingCombineParamsSchema,
     result: RESULT_BINARY_SCHEMA,
     handler: async (rpcParams, ctx?: any) => {
       const inner = unwrapRequest(rpcParams.request);
@@ -172,7 +175,7 @@ export function registerTableBufferingMethods(
   // table_buffering_destructor — best-effort end-of-query cleanup (unary)
   // ------------------------------------------------------------------------
   protocol.unary("table_buffering_destructor", {
-    params: REQUEST_PARAMS_SCHEMA,
+    params: TableBufferingDestructorParamsSchema,
     result: RESULT_BINARY_SCHEMA,
     handler: async (rpcParams) => {
       try {