@syncular/server 0.15.23 → 0.15.25

package/README.md

@@ -19,7 +19,7 @@ The supported set, and what deliberately does **not** get an adapter:
 | Runtime | Adapter | Transport | Storage | Status |
 | --- | --- | --- | --- | --- |
 | **Bun / Node** | `@syncular/server-hono` | HTTP (`POST /sync`, segments, blobs) **+ WS realtime** (§8, host-driven upgrade) | any: `SqliteServerStorage`, `PostgresServerStorage`, memory | **Supported now** — the reference deployment; runs the full conformance catalog on both bindings. |
-| **Cloudflare Workers** | `@syncular/server-workers` | HTTP binding via Hono (Workers-native) **+ WS realtime** (§8, Durable Object host with hibernation) | `D1ServerStorage` (D1); R2-as-S3 for segments/blobs (§5.4 delegated presign) | **Supported now** — this rung. Realtime rides a **Durable Object** (`SyncularRealtimeDO`), opt-in; HTTP-only is also fully conformant (below). |
+| **Cloudflare Workers** | `@syncular/server-workers` | HTTP binding via Hono (Workers-native) **+ optional WS realtime** (§8) | `D1ServerStorage` behind one per-partition Durable Object queue; R2-as-S3 for segments/blobs | **Supported now** — D1 sync writes always traverse the DO; WebSocket upgrades remain optional. |
 | Raw Deno / edge-misc | — | — | — | **Not adapted** (policy below). |
 
 **The policy for "not adapted".** Untested ≠ unsupported forever. The core
@@ -30,23 +30,20 @@ HTTP via the fetch-handler round-trip tests), and we do not claim runtimes we
 do not test. Deno is a plausible future adapter the day someone runs the
 catalog on it; until then it is neutral-core-friendly, not supported.
 
-**Workers realtime — the Durable Object.** SPEC §1.1's two bindings are two
-framings of one handler; an **HTTP-only deployment is fully conformant**
-(clients that cannot open the socket sync over `POST /sync`, identical
-semantics — a smaller complete deployment, not a degraded one), so realtime on
-Workers is opt-in. When enabled it rides a **Durable Object**
-(`SyncularRealtimeDO`): one DO per partition hosting the `RealtimeHub` (the DO
-id derived from the partition, so a partition's sockets and its commit fan-out
-are co-located and single-threaded — also the natural per-partition write
-serialization point the D1 storage wants); WebSocket **hibernation** so idle
-sockets don't bill wall time (the existing `RealtimeSession` is the
+**Workers coordination and realtime — the Durable Object.** HTTP-only is fully
+conformant at the protocol level, but D1 still requires a per-partition Durable
+Object queue for every `/sync` round that may push. WebSocket upgrades are
+optional; the write coordinator is not. `SyncularRealtimeDO` hosts that FIFO
+and, when realtime is enabled, the `RealtimeHub`. The DO id derives from the
+partition, so unrelated partitions remain concurrent. WebSocket
+**hibernation** keeps idle sockets from billing wall time (the existing
+`RealtimeSession` is the
 per-connection state machine, driven from the hibernation callbacks and
 rehydrated from a minimal socket attachment + the D1 client record on wake);
 storage via the same **D1** binding so realtime rounds and `POST /sync` rounds
 share one commit log and one segment store; commit fan-out (§8.2) runs in-DO
-(no LISTEN/NOTIFY needed — writes and sockets are co-located), and an HTTP push
-landing in a plain isolate wakes the partition's DO (the in-platform
-LISTEN/NOTIFY analogue). Full shape, wiring, hibernation semantics, and the
+(no LISTEN/NOTIFY needed — writes and sockets are co-located). Full shape,
+wiring, hibernation semantics, and the
 manual real-workerd smoke recipe in `@syncular/server-workers/README.md`.
 
 **No relay (decision).** There is deliberately no *relay* — no bridge that
@@ -162,12 +159,13 @@ re-checks idempotency after taking that lock and persists a rejected outcome
 while the lock is retained, so overlapping duplicate deliveries cannot rerun
 the callback.
 
-SQLite and PostgreSQL provide that serialization directly. D1 does not expose
-an interactive lock: `D1ServerStorage` fails closed unless it is constructed
-inside an external per-partition coordinator with
-`{ commitValidationSerialized: true }` (normally one Durable Object per
-partition). Do not set that assertion on a stateless Worker. Custom storages
-must implement both the transaction lock and candidate scan seam.
+SQLite and PostgreSQL provide that serialization directly for every push. D1
+does not expose an interactive lock: `D1ServerStorage` fails closed unless it
+is constructed inside an explicit per-partition coordinator with
+`{ pushApplySerialized: true }` (normally the packaged Durable Object FIFO).
+Do not set that assertion on a stateless Worker. Custom storages must implement
+the pre-operation partition lock, locked idempotency re-check, atomic rejection
+finalization, and—when `commitValidator` is used—candidate scans.
 
 Whole-commit validation checks a client-proposed commit; it does not grant
 authority. Privileged operations such as connecting facilities still belong in

package/dist/d1-storage.d.ts

@@ -16,9 +16,15 @@ export interface D1Database {
 export interface D1ServerStorageOptions {
     /**
      * Assert that all writes for a partition reach this storage serially.
-     * Required for §6.8 because D1 exposes no interactive transaction lock.
-     * Set this only inside a per-partition Durable Object or equivalent
-     * coordinator; the default fails closed when a commit validator is used.
+     * Required for every push because D1 exposes no interactive transaction
+     * lock. Set this only inside an explicit per-partition request queue,
+     * Durable Object, or equivalent coordinator; the default fails closed.
+     */
+    readonly pushApplySerialized?: boolean;
+    /**
+     * @deprecated Use `pushApplySerialized`. This alias remains valid only
+     * because the old assertion already promised that every partition write,
+     * not merely validator callbacks, was externally serialized.
      */
     readonly commitValidationSerialized?: boolean;
 }

package/dist/d1-storage.js

@@ -32,11 +32,11 @@ var _a;
  * reading `max_commit_seq` live and buffering the `+1` write. Under a single
  * Worker request this is exact. Two concurrent pushes to one partition need an
  * external serialization point (normally a per-partition Durable Object); a
- * realtime notifier alone does not serialize HTTP writes. A stateless
- * HTTP-only deployment SHOULD front same-partition writes with a coordinating
- * primitive (a DO or a Queue). For §6.8 whole-commit validation this becomes
- * mandatory and fail-closed: the coordinator must explicitly set
- * `commitValidationSerialized`, because D1 cannot provide the required lock.
+ * realtime notifier alone does not serialize HTTP writes. Every deployment
+ * that accepts D1 pushes MUST front same-partition sync rounds with a
+ * coordinating primitive (a DO or a Queue). The adapter fails closed unless
+ * that coordinator explicitly sets `pushApplySerialized`, because D1 cannot
+ * provide the required pre-operation lock.
  * This mirrors PostgreSQL's per-partition row lock, achieved by placement
  * rather than a lock D1 does not expose.
  */
@@ -58,12 +58,12 @@ class D1Transaction {
     #db;
     #partition;
     #resolveTable;
-    #commitValidationSerialized;
+    #pushApplySerialized;
     #buffer = [];
     #open = true;
     /** Live snapshot of `max_commit_seq`, advanced within this transaction. */
     #maxCommitSeq;
-    #commitValidationCheckpoint;
+    #pushApplyCheckpoint;
     #lastApplicationOpIndex;
     /**
      * Read-your-own-writes overlay (§6.2 needs `getRow` to see buffered writes
@@ -71,11 +71,11 @@ class D1Transaction {
      * `tbl\u0000rowId` → the pending state, consulted by `getRow` before D1.
      */
     #pending = new Map();
-    constructor(db, partition, resolveTable, commitValidationSerialized) {
+    constructor(db, partition, resolveTable, pushApplySerialized) {
         this.#db = db;
         this.#partition = partition;
         this.#resolveTable = resolveTable;
-        this.#commitValidationSerialized = commitValidationSerialized;
+        this.#pushApplySerialized = pushApplySerialized;
     }
     #assertOpen() {
         if (!this.#open)
@@ -188,20 +188,20 @@ class D1Transaction {
             .sort((left, right) => left.rowId.localeCompare(right.rowId))
             .slice(0, query.limit);
     }
-    async lockPartitionForCommitValidation() {
+    async lockPartitionForPush() {
         this.#assertOpen();
-        if (!this.#commitValidationSerialized) {
-            throw new Error('D1 whole-commit validation requires externally serialized partition writes');
+        if (!this.#pushApplySerialized) {
+            throw new Error('D1 push apply requires externally serialized partition writes');
         }
         // D1 has no interactive lock. The caller explicitly asserted that every
         // write for this partition is already serialized (normally by its DO).
-        this.#commitValidationCheckpoint = this.#buffer.length;
+        this.#pushApplyCheckpoint = this.#buffer.length;
     }
     async commitRejectedPushResult(clientId, clientCommitId, result) {
         this.#assertOpen();
-        const checkpoint = this.#commitValidationCheckpoint;
+        const checkpoint = this.#pushApplyCheckpoint;
         if (checkpoint === undefined) {
-            throw new Error('whole-commit rejection requires its validation checkpoint');
+            throw new Error('push rejection requires its apply checkpoint');
         }
         this.#buffer.length = checkpoint;
         this.#pending.clear();
@@ -352,16 +352,21 @@ class D1Transaction {
     }
     async commit() {
         this.#assertOpen();
-        this.#open = false;
-        if (this.#buffer.length === 0)
+        if (this.#buffer.length === 0) {
+            this.#open = false;
             return;
+        }
         const statements = this.#buffer.map((entry) => this.#db.prepare(entry.sql).bind(...entry.params));
         // One atomic D1 batch — the §6.4 all-or-nothing commit.
         try {
             await this.#db.batch(statements);
+            this.#open = false;
         }
         catch (error) {
             if (isD1ConstraintError(error)) {
+                // D1 batches are atomic. Keep this logical transaction open so the
+                // push layer can discard its buffered candidates and persist the
+                // terminal rejection while the external partition queue is retained.
                 throw new StorageConstraintError(error, this.#lastApplicationOpIndex);
             }
             throw error;
@@ -382,14 +387,15 @@ _a = D1Transaction;
 const D1_MAX_BIND_PARAMS = 100;
 export class D1ServerStorage {
     #db;
-    #commitValidationSerialized;
+    #pushApplySerialized;
     /** Set by `ensureSchema`: app-table lookup for the relational row store. */
     #tables;
     #schemaVersion;
     constructor(db, options = {}) {
         this.#db = db;
-        this.#commitValidationSerialized =
-            options.commitValidationSerialized === true;
+        this.#pushApplySerialized =
+            options.pushApplySerialized === true ||
+                options.commitValidationSerialized === true;
     }
     /** Apply the schema DDL (idempotent). Call once before use. */
     async migrate() {
@@ -512,7 +518,7 @@ export class D1ServerStorage {
         }
     }
     async begin(partition) {
-        return new D1Transaction(this.#db, partition, (name) => this.table(name), this.#commitValidationSerialized);
+        return new D1Transaction(this.#db, partition, (name) => this.table(name), this.#pushApplySerialized);
     }
     async getMaxCommitSeq(partition) {
         const row = await this.#db

package/dist/postgres-storage.js

@@ -245,7 +245,7 @@ class PostgresTransaction {
     #partition;
     #resolveTable;
     #open = true;
-    #commitValidationSavepoint = false;
+    #pushApplySavepoint = false;
     /** Resolves/rejects the `transaction(fn)` wrapper (see `begin`). */
     #resolve;
     #reject;
@@ -309,22 +309,22 @@ class PostgresTransaction {
         this.#assertOpen();
         return scanRowsByIndexOn(this.#client, this.#resolveTable(query.table), this.#partition, query);
     }
-    async lockPartitionForCommitValidation() {
+    async lockPartitionForPush() {
         this.#assertOpen();
         await this.#client.query(`INSERT INTO sync_partitions(partition, max_commit_seq) VALUES ($1, 0)
        ON CONFLICT (partition) DO NOTHING`, [this.#partition]);
         await this.#client.query('SELECT max_commit_seq FROM sync_partitions WHERE partition=$1 FOR UPDATE', [this.#partition]);
-        await this.#client.query('SAVEPOINT syncular_commit_validation_candidate');
-        this.#commitValidationSavepoint = true;
+        await this.#client.query('SAVEPOINT syncular_push_candidate');
+        this.#pushApplySavepoint = true;
     }
     async commitRejectedPushResult(clientId, clientCommitId, result) {
         this.#assertOpen();
-        if (!this.#commitValidationSavepoint) {
-            throw new Error('whole-commit rejection requires its validation savepoint');
+        if (!this.#pushApplySavepoint) {
+            throw new Error('push rejection requires its apply savepoint');
         }
-        await this.#client.query('ROLLBACK TO SAVEPOINT syncular_commit_validation_candidate');
-        await this.#client.query('RELEASE SAVEPOINT syncular_commit_validation_candidate');
-        this.#commitValidationSavepoint = false;
+        await this.#client.query('ROLLBACK TO SAVEPOINT syncular_push_candidate');
+        await this.#client.query('RELEASE SAVEPOINT syncular_push_candidate');
+        this.#pushApplySavepoint = false;
         await this.putPushResult(clientId, clientCommitId, result);
         await this.commit();
     }

package/dist/push.js

@@ -501,25 +501,6 @@ function idempotencyCacheMissFrame(clientCommitId, error) {
         ],
     };
 }
-async function persistRejectedPushResult(storage, partition, clientId, clientCommitId, stored) {
-    const rejectionTx = await storage.begin(partition);
-    try {
-        await rejectionTx.putPushResult(clientId, clientCommitId, stored);
-        await rejectionTx.commit();
-    }
-    catch (error) {
-        await rejectionTx.rollback();
-        throw error;
-    }
-    const canonical = await storage.getPushResult(partition, clientId, clientCommitId);
-    if (canonical === undefined) {
-        throw new Error('push rejection finalization did not persist an outcome');
-    }
-    return {
-        stored: canonical,
-        replayed: canonical.cacheIdentity !== stored.cacheIdentity,
-    };
-}
 /**
  * Process one `PUSH_COMMIT` frame: idempotency replay (§2.3), sequential
  * atomic apply (§6.4), realtime notification for applied commits.
@@ -559,35 +540,35 @@ export async function processPushCommitWithTrace(ctx, schema, resolved, clientId
     const validators = ctx.validators;
     const commitValidator = ctx.commitValidator;
     const tx = await storage.begin(partition);
+    const lockPartitionForPush = tx.lockPartitionForPush?.bind(tx) ??
+        tx.lockPartitionForCommitValidation?.bind(tx);
     const commitRejectedPushResult = tx.commitRejectedPushResult?.bind(tx);
     try {
-        if (commitValidator !== undefined) {
-            if (tx.lockPartitionForCommitValidation === undefined ||
-                commitRejectedPushResult === undefined) {
-                throw new Error('storage transaction does not support atomic whole-commit validation finalization');
-            }
-            await tx.lockPartitionForCommitValidation();
-            // The optimistic lookup above may have raced another request for the
-            // same idempotency key. Re-check after acquiring partition serialization
-            // so a concurrent duplicate never reruns the aggregate validator.
-            try {
-                const serializedPersisted = await storage.getPushResult(partition, clientId, frame.clientCommitId);
-                if (serializedPersisted !== undefined) {
-                    await tx.rollback();
-                    return processedPushCommit(frame.clientCommitId, serializedPersisted, true);
-                }
+        if (lockPartitionForPush === undefined ||
+            commitRejectedPushResult === undefined) {
+            throw new Error('storage transaction does not support serialized push apply and atomic rejection finalization');
+        }
+        await lockPartitionForPush();
+        // The optimistic lookup above may have raced another delivery. Re-check
+        // only after acquiring partition serialization and before any operation
+        // read, validation, merge, or staged write.
+        try {
+            const serializedPersisted = await storage.getPushResult(partition, clientId, frame.clientCommitId);
+            if (serializedPersisted !== undefined) {
+                await tx.rollback();
+                return processedPushCommit(frame.clientCommitId, serializedPersisted, true);
             }
-            catch (error) {
-                if (error instanceof SyncError &&
-                    error.code === 'sync.idempotency_cache_miss') {
-                    await tx.rollback();
-                    return {
-                        frame: idempotencyCacheMissFrame(frame.clientCommitId, error),
-                        replayed: false,
-                    };
-                }
-                throw error;
+        }
+        catch (error) {
+            if (error instanceof SyncError &&
+                error.code === 'sync.idempotency_cache_miss') {
+                await tx.rollback();
+                return {
+                    frame: idempotencyCacheMissFrame(frame.clientCommitId, error),
+                    replayed: false,
+                };
             }
+            throw error;
         }
         const results = [];
         const changes = [];
@@ -620,21 +601,14 @@ export async function processPushCommitWithTrace(ctx, schema, resolved, clientId
                 status: 'rejected',
                 results: [terminated],
             });
-            if (commitValidator !== undefined) {
-                // Discard candidate rows and persist the rejection while retaining the
-                // same partition lock. This closes the duplicate-request race between
-                // rollback and the durable idempotency outcome.
-                if (commitRejectedPushResult === undefined) {
-                    throw new Error('storage transaction lost whole-commit rejection finalization support');
-                }
-                await commitRejectedPushResult(clientId, frame.clientCommitId, stored);
-            }
-            else {
-                await tx.rollback();
-                const canonical = await persistRejectedPushResult(storage, partition, clientId, frame.clientCommitId, stored);
-                return processedPushCommit(frame.clientCommitId, canonical.stored, canonical.replayed);
+            // Discard candidates and persist the rejection while retaining the same
+            // partition lock. There is no unlock gap in which a duplicate can rerun.
+            await commitRejectedPushResult(clientId, frame.clientCommitId, stored);
+            const canonical = await storage.getPushResult(partition, clientId, frame.clientCommitId);
+            if (canonical === undefined) {
+                throw new Error('push rejection finalization did not persist an outcome');
             }
-            return processedPushCommit(frame.clientCommitId, stored, false);
+            return processedPushCommit(frame.clientCommitId, canonical, canonical.cacheIdentity !== stored.cacheIdentity);
         }
         const commitSeq = await tx.appendCommit({
             clientId,
@@ -661,7 +635,6 @@ export async function processPushCommitWithTrace(ctx, schema, resolved, clientId
         return processedPushCommit(frame.clientCommitId, stored, false);
     }
     catch (error) {
-        await tx.rollback();
         if (error instanceof StorageConstraintError) {
             const stored = newStoredPushResult(createdAtMs, {
                 status: 'rejected',
@@ -675,9 +648,18 @@ export async function processPushCommitWithTrace(ctx, schema, resolved, clientId
                     },
                 ],
             });
-            const canonical = await persistRejectedPushResult(storage, partition, clientId, frame.clientCommitId, stored);
-            return processedPushCommit(frame.clientCommitId, canonical.stored, canonical.replayed);
+            if (commitRejectedPushResult === undefined) {
+                await tx.rollback();
+                throw new Error('storage transaction lost atomic push rejection finalization support');
+            }
+            await commitRejectedPushResult(clientId, frame.clientCommitId, stored);
+            const canonical = await storage.getPushResult(partition, clientId, frame.clientCommitId);
+            if (canonical === undefined) {
+                throw new Error('push rejection finalization did not persist an outcome');
+            }
+            return processedPushCommit(frame.clientCommitId, canonical, canonical.cacheIdentity !== stored.cacheIdentity);
         }
+        await tx.rollback();
         throw error;
     }
 }

package/dist/realtime.d.ts

@@ -14,38 +14,16 @@
  * the `sync` wake-up (§8.3).
  */
 import { type PresenceKind, type ScopeMap, type WakeReason } from '@syncular/core';
-import type { LeaseConfig, ResolveScopes, ServerLimits, SyncRequestContext } from './context.js';
+import type { SyncRequestContext, SyncServerConfig } from './context.js';
 import { type SyncularServerEvents } from './events.js';
-import type { ServerSchema } from './schema.js';
-import type { SegmentStore } from './segment-store.js';
-import type { SegmentUrlConfig } from './signed-url.js';
 import type { ServerStorage, StoredCommit } from './storage.js';
-import type { CommitValidator, ValidatorRegistry } from './validate.js';
-export interface RealtimeHubConfig {
-    readonly schema: ServerSchema;
-    readonly storage: ServerStorage;
-    readonly resolveScopes: ResolveScopes;
-    /** §6.7 validators used by sync rounds carried over this socket. */
-    readonly validators?: ValidatorRegistry;
-    /** §6.8 whole-commit validator shared with HTTP sync rounds. */
-    readonly commitValidator?: CommitValidator;
-    readonly clock?: () => number;
+/**
+ * Realtime adds fanout/presence tuning to the canonical sync-server config;
+ * socket rounds must never have a narrower push/pull capability set than HTTP.
+ */
+export interface RealtimeHubConfig extends Omit<SyncServerConfig, 'realtime'> {
     /** Deltas larger than this become `delta-too-large` wake-ups (§8.2). */
     readonly maxDeltaBytes?: number;
-    /** Optional structured-events sink (`realtime.*` events). */
-    readonly events?: SyncularServerEvents;
-    /**
-     * Segment store for sync rounds over the socket (§8.7). Without it a
-     * socket round fails loudly with an in-band ERROR — provide the same
-     * store the HTTP binding uses (one handler, two framings).
-     */
-    readonly segments?: SegmentStore;
-    /** Request limits for socket rounds; defaults match the HTTP binding. */
-    readonly limits?: Partial<ServerLimits>;
-    readonly signedUrls?: SegmentUrlConfig;
-    /** §7.3 auth leases for socket sync rounds (§8.7) — same config the
-     * HTTP binding uses, so rounds over the socket are lease-aware too. */
-    readonly leases?: LeaseConfig;
     /**
      * §8.6 presence: cap on the serialized size (bytes) of a published
      * presence document. An over-cap publish is rejected loudly to the
@@ -149,9 +127,11 @@ export declare class RealtimeSession {
      * round's request byte stream (§8.7). Synchronous entry — assembly and
      * violation detection happen inline so a pipelined chunk arriving
      * while a response streams is caught deterministically; the round
-     * itself runs async once the request is complete.
+     * itself runs async once the request is complete. The returned promise, when
+     * present, resolves only after response streaming and registration refresh;
+     * coordinated hosts await it to retain their partition FIFO through commit.
      */
-    handleBinary(bytes: Uint8Array): void;
+    handleBinary(bytes: Uint8Array): Promise<void> | undefined;
     sendHeartbeat(): void;
     sendWake(reason: WakeReason): void;
     /** Called by the hub for every applied commit, in commitSeq order. */
@@ -186,6 +166,10 @@ export declare class RealtimeHub {
      * the same shape the HTTP adapter builds, so the round drives the
      * SAME handler with zero semantic divergence.
      */
+    requestContextFor(identity: {
+        readonly partition: string;
+        readonly actorId: string;
+    }): SyncRequestContext;
     requestContext(session: RealtimeSession): SyncRequestContext;
     /**
      * Register a connected socket (§8.1): load the client's last pull's

package/dist/realtime.js

@@ -327,7 +327,9 @@ export class RealtimeSession {
      * round's request byte stream (§8.7). Synchronous entry — assembly and
      * violation detection happen inline so a pipelined chunk arriving
      * while a response streams is caught deterministically; the round
-     * itself runs async once the request is complete.
+     * itself runs async once the request is complete. The returned promise, when
+     * present, resolves only after response streaming and registration refresh;
+     * coordinated hosts await it to retain their partition FIFO through commit.
      */
     handleBinary(bytes) {
         if (bytes.length === 0)
@@ -365,7 +367,7 @@ export class RealtimeSession {
         }
         const token = Symbol('round');
         this.#activeRound = token;
-        void this.#runRound(done.message.slice(), token);
+        return this.#runRound(done.message.slice(), token);
     }
     /** Drive the shared handler and stream the response back (§8.7). */
     async #runRound(requestBytes, token) {
@@ -702,7 +704,7 @@ export class RealtimeHub {
      * the same shape the HTTP adapter builds, so the round drives the
      * SAME handler with zero semantic divergence.
      */
-    requestContext(session) {
+    requestContextFor(identity) {
         const segments = this.#config.segments;
         if (segments === undefined) {
             // Fail loud (§8.7): a hub serving socket rounds needs the same
@@ -710,12 +712,21 @@ export class RealtimeHub {
             throw syncError('sync.invalid_request', 'socket sync rounds require a segment store on the realtime hub (§8.7)');
         }
         return {
-            partition: session.partition,
-            actorId: session.actorId,
+            partition: identity.partition,
+            actorId: identity.actorId,
             schema: this.#config.schema,
             storage: this.#config.storage,
             segments,
             resolveScopes: this.#config.resolveScopes,
+            ...(this.#config.blobs !== undefined
+                ? { blobs: this.#config.blobs }
+                : {}),
+            ...(this.#config.maxBlobBytes !== undefined
+                ? { maxBlobBytes: this.#config.maxBlobBytes }
+                : {}),
+            ...(this.#config.crdtMergers !== undefined
+                ? { crdtMergers: this.#config.crdtMergers }
+                : {}),
             ...(this.#config.validators !== undefined
                 ? { validators: this.#config.validators }
                 : {}),
@@ -731,6 +742,15 @@ export class RealtimeHub {
             ...(this.#config.signedUrls !== undefined
                 ? { signedUrls: this.#config.signedUrls }
                 : {}),
+            ...(this.#config.blobSignedUrls !== undefined
+                ? { blobSignedUrls: this.#config.blobSignedUrls }
+                : {}),
+            ...(this.#config.blobUploadUrls !== undefined
+                ? { blobUploadUrls: this.#config.blobUploadUrls }
+                : {}),
+            ...(this.#config.sqliteImageBuilder !== undefined
+                ? { sqliteImageBuilder: this.#config.sqliteImageBuilder }
+                : {}),
             ...(this.#config.leases !== undefined
                 ? { leases: this.#config.leases }
                 : {}),
@@ -740,6 +760,9 @@ export class RealtimeHub {
             realtime: this,
         };
     }
+    requestContext(session) {
+        return this.requestContextFor(session);
+    }
     /**
      * Register a connected socket (§8.1): load the client's last pull's
      * subscription list, resolve + intersect scopes, send `hello`.

package/dist/sqlite-storage.js

@@ -17,10 +17,12 @@ class SqliteTransaction {
     #storage;
     #partition;
     #open = true;
-    #commitValidationSavepoint = false;
-    constructor(storage, partition) {
+    #pushApplySavepoint = false;
+    #release;
+    constructor(storage, partition, release) {
         this.#storage = storage;
         this.#partition = partition;
+        this.#release = release;
         storage.db.exec('BEGIN IMMEDIATE');
     }
     #assertOpen() {
@@ -39,20 +41,20 @@ class SqliteTransaction {
         this.#assertOpen();
         return this.#storage.scanRowsByIndex(this.#partition, query);
     }
-    async lockPartitionForCommitValidation() {
+    async lockPartitionForPush() {
         this.#assertOpen();
         // BEGIN IMMEDIATE in the constructor already owns SQLite's writer lock.
-        this.#storage.db.exec('SAVEPOINT syncular_commit_validation_candidate');
-        this.#commitValidationSavepoint = true;
+        this.#storage.db.exec('SAVEPOINT syncular_push_candidate');
+        this.#pushApplySavepoint = true;
     }
     async commitRejectedPushResult(clientId, clientCommitId, result) {
         this.#assertOpen();
-        if (!this.#commitValidationSavepoint) {
-            throw new Error('whole-commit rejection requires its validation savepoint');
+        if (!this.#pushApplySavepoint) {
+            throw new Error('push rejection requires its apply savepoint');
         }
-        this.#storage.db.exec('ROLLBACK TO SAVEPOINT syncular_commit_validation_candidate');
-        this.#storage.db.exec('RELEASE SAVEPOINT syncular_commit_validation_candidate');
-        this.#commitValidationSavepoint = false;
+        this.#storage.db.exec('ROLLBACK TO SAVEPOINT syncular_push_candidate');
+        this.#storage.db.exec('RELEASE SAVEPOINT syncular_push_candidate');
+        this.#pushApplySavepoint = false;
         await this.putPushResult(clientId, clientCommitId, result);
         await this.commit();
     }
@@ -113,17 +115,29 @@ class SqliteTransaction {
     async commit() {
         this.#assertOpen();
         this.#open = false;
-        this.#storage.db.exec('COMMIT');
+        try {
+            this.#storage.db.exec('COMMIT');
+        }
+        finally {
+            this.#release();
+        }
     }
     async rollback() {
         if (!this.#open)
             return;
         this.#open = false;
-        this.#storage.db.exec('ROLLBACK');
+        try {
+            this.#storage.db.exec('ROLLBACK');
+        }
+        finally {
+            this.#release();
+        }
     }
 }
 export class SqliteServerStorage {
     db;
+    /** One bun:sqlite connection can own only one transaction at a time. */
+    #transactionTail = Promise.resolve();
     /** Set by `ensureSchema`: app-table lookup for the relational row store. */
     #tables;
     #schemaVersion;
@@ -237,7 +251,19 @@ export class SqliteServerStorage {
         }
     }
     async begin(partition) {
-        return new SqliteTransaction(this, partition);
+        const previous = this.#transactionTail;
+        let release;
+        this.#transactionTail = new Promise((resolve) => {
+            release = resolve;
+        });
+        await previous;
+        try {
+            return new SqliteTransaction(this, partition, release);
+        }
+        catch (error) {
+            release();
+            throw error;
+        }
     }
     /** Internal: write a row + refresh its scope-index entries. */
     writeRow(partition, table, row) {