@syncular/server 0.15.46 → 0.15.48

package/dist/sqlite-segment-store.js

@@ -1,23 +1,21 @@
 /**
- * SQLite-backed segment store via `bun:sqlite` (dev/bench convenience,
- * dependency-free). Bun-specific by design: it imports `bun:sqlite` at the
- * top level, so it lives in its own module — importing it opts into the Bun
- * runtime. The runtime-neutral `SegmentStore` interface, `MemorySegmentStore`,
- * and `segmentIdFor` stay in `segment-store.ts` so the Workers/edge core can
- * import them without pulling in `bun:sqlite` (runtime neutrality is enforced
- * by `test/runtime-neutrality.test.ts`).
+ * SQLite-backed segment store over the shared synchronous driver.
  */
-import { Database } from 'bun:sqlite';
 import { DEFAULT_SEGMENT_TTL_MS, segmentIdFor, } from './segment-store.js';
+import { SqliteAdapterRequiredError, } from './sqlite-driver.js';
 export class SqliteSegmentStore {
     db;
     #ttlMs;
     constructor(db = ':memory:', options) {
-        this.db = typeof db === 'string' ? new Database(db) : db;
+        if (typeof db === 'string') {
+            throw new SqliteAdapterRequiredError();
+        }
+        this.db = db;
         this.#ttlMs = options?.ttlMs ?? DEFAULT_SEGMENT_TTL_MS;
         this.db.exec(`
       CREATE TABLE IF NOT EXISTS sync_segments(
         segment_id TEXT PRIMARY KEY, partition TEXT NOT NULL,
+        log_epoch TEXT NOT NULL,
         tbl TEXT NOT NULL, schema_version INTEGER NOT NULL,
         media_type TEXT NOT NULL, scope_digest TEXT NOT NULL,
         as_of_commit_seq INTEGER NOT NULL, row_count INTEGER NOT NULL,
@@ -26,6 +24,12 @@ export class SqliteSegmentStore {
         expires_at_ms INTEGER NOT NULL, bytes BLOB NOT NULL
       );
     `);
+        const columns = this.db
+            .query('PRAGMA table_info(sync_segments)')
+            .all();
+        if (!columns.some((column) => column.name === 'log_epoch')) {
+            this.db.exec("ALTER TABLE sync_segments ADD COLUMN log_epoch TEXT NOT NULL DEFAULT ''");
+        }
     }
     async put(metadata, bytes, nowMs) {
         const segmentId = await segmentIdFor(bytes);
@@ -38,11 +42,11 @@ export class SqliteSegmentStore {
         };
         this.db
             .query(`INSERT OR REPLACE INTO sync_segments(
-          segment_id, partition, tbl, schema_version, media_type,
+          segment_id, partition, log_epoch, tbl, schema_version, media_type,
           scope_digest, as_of_commit_seq, row_count, row_cursor,
           next_row_cursor, byte_length, created_at_ms, expires_at_ms, bytes
-        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
-            .run(record.segmentId, record.partition, record.table, record.schemaVersion, record.mediaType, record.scopeDigest, record.asOfCommitSeq, record.rowCount, record.rowCursor, record.nextRowCursor, record.byteLength, record.createdAtMs, record.expiresAtMs, bytes);
+        ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+            .run(record.segmentId, record.partition, record.logEpoch, record.table, record.schemaVersion, record.mediaType, record.scopeDigest, record.asOfCommitSeq, record.rowCount, record.rowCursor, record.nextRowCursor, record.byteLength, record.createdAtMs, record.expiresAtMs, bytes);
         return record;
     }
     async get(segmentId) {
@@ -55,6 +59,7 @@ export class SqliteSegmentStore {
             record: {
                 segmentId: row.segment_id,
                 partition: row.partition,
+                logEpoch: row.log_epoch,
                 table: row.tbl,
                 schemaVersion: row.schema_version,
                 mediaType: row.media_type === 'sqlite' ? 'sqlite' : 'rows',
@@ -75,16 +80,17 @@ export class SqliteSegmentStore {
             .query(`SELECT segment_id, row_count, next_row_cursor, byte_length,
                 created_at_ms, expires_at_ms
          FROM sync_segments
-         WHERE partition=? AND tbl=? AND schema_version=? AND media_type=?
+         WHERE partition=? AND log_epoch=? AND tbl=? AND schema_version=? AND media_type=?
            AND scope_digest=? AND as_of_commit_seq=? AND row_cursor IS NULL
            AND expires_at_ms > ?
          LIMIT 1`)
-            .get(key.partition, key.table, key.schemaVersion, key.mediaType, key.scopeDigest, key.asOfCommitSeq, nowMs);
+            .get(key.partition, key.logEpoch, key.table, key.schemaVersion, key.mediaType, key.scopeDigest, key.asOfCommitSeq, nowMs);
         if (row === null)
             return undefined;
         return {
             segmentId: row.segment_id,
             partition: key.partition,
+            logEpoch: key.logEpoch,
             table: key.table,
             schemaVersion: key.schemaVersion,
             mediaType: key.mediaType,

package/dist/sqlite-storage.d.ts

@@ -1,21 +1,16 @@
-/**
- * SQLite storage via `bun:sqlite` (dev-speed, dependency-free).
- *
- * Scope fanout is index-first: both the commit log and the
- * current-row table carry a (table, variable, value) inverted index; reads
- * select candidates from the index and verify the full multi-variable
- * match against the stored scope map — never a log scan.
- */
-import { Database } from 'bun:sqlite';
 import type { CompiledSchema, CompiledTable } from './schema.js';
-import type { AuthoritativeQueryRequest, AuthoritativeQueryResult, ClientCursorInfo, ClientRecord, CommitMetadata, CommitMetadataQuery, CommitWindowQuery, IndexRowScanQuery, PrunedReactionCounts, ReactionClaimQuery, ReactionFailureUpdate, ReactionListQuery, ReactionPruneQuery, RowScanQuery, ScopeActivityQuery, ScopeCommitActivity, ServerStorage, StorageTransaction, StoredCommit, StoredPushResult, StoredReaction, StoredRow } from './storage.js';
+import { type SqliteDatabase } from './sqlite-driver.js';
+import type { AuthoritativeQueryRequest, AuthoritativeQueryResult, ClientCursorInfo, ClientRecord, CommitMetadata, CommitMetadataQuery, CommitWindowQuery, IndexRowScanQuery, PartitionRegistryEntry, PrunedReactionCounts, ReactionClaimQuery, ReactionFailureUpdate, ReactionListQuery, ReactionPruneQuery, RowScanQuery, ScopeActivityQuery, ScopeCommitActivity, ServerStorage, StorageTransaction, StoredCommit, StoredPushResult, StoredReaction, StoredRow } from './storage.js';
 export declare class SqliteServerStorage implements ServerStorage {
     #private;
-    readonly db: Database;
-    constructor(db?: Database | string);
+    readonly db: SqliteDatabase;
+    constructor(db?: SqliteDatabase | string);
     /** Resolve a table's compiled schema; row operations require `ensureSchema`. */
     table(name: string): CompiledTable;
     ensureSchema(schema: CompiledSchema): Promise<void>;
+    touchPartition(partition: string, authenticatedAtMs: number, initialLogEpoch: string): Promise<PartitionRegistryEntry>;
+    rotatePartitionLogEpoch(partition: string, logEpoch: string, authenticatedAtMs: number): Promise<PartitionRegistryEntry>;
+    listPartitionRegistry(): Promise<PartitionRegistryEntry[]>;
     begin(partition: string): Promise<StorageTransaction>;
     /** Internal: write a row + refresh its scope-index entries. */
     writeRow(partition: string, table: string, row: StoredRow): void;

package/dist/sqlite-storage.js

@@ -1,17 +1,17 @@
 /**
- * SQLite storage via `bun:sqlite` (dev-speed, dependency-free).
+ * SQLite server storage over the shared synchronous driver.
  *
  * Scope fanout is index-first: both the commit log and the
  * current-row table carry a (table, variable, value) inverted index; reads
  * select candidates from the index and verify the full multi-variable
  * match against the stored scope map — never a log scan.
  */
-import { Database } from 'bun:sqlite';
 import { bindAuthoritativePartition, prepareAuthoritativeQuery, } from './authoritative-query.js';
 import { syncError } from './errors.js';
 import { commitWindowPageSql, deleteRowSql, dropTableDdl, indexRowPageStatement, layoutsOf, migratePayload, parseLayouts, retiredTableNames, rewritePlan, rewriteRowSql, rewriteValues, SCHEMA_META_DDL_SQLITE, scanRowPageSql, schemaDdl, selectRowScopesSql, selectRowSql, selectRowsForRewriteSql, upsertSql, upsertValues, } from './relational-rows.js';
 import { matchesEffective } from './scopes.js';
 import { collectCommitWindowPage, deserializePushResult, SQLITE_DDL, serializePushResult, toStoredRow, } from './sqlite-dialect.js';
+import { SqliteAdapterRequiredError, } from './sqlite-driver.js';
 import { isSqliteConstraintError, StorageConstraintError, } from './storage-errors.js';
 import { assertScopeIndexedScan, resolveIndexRowScan } from './storage-query.js';
 function toStoredReaction(record) {
@@ -62,7 +62,7 @@ class SqliteTransaction {
     }
     getPushResult(clientId, clientCommitId) {
         this.#assertOpen();
-        // One shared bun:sqlite connection — this read runs inside this
+        // One shared SQLite connection: this read runs inside this
         // transaction's BEGIN IMMEDIATE.
         return this.#storage.getPushResult(this.#partition, clientId, clientCommitId);
     }
@@ -194,7 +194,7 @@ class SqliteTransaction {
 }
 export class SqliteServerStorage {
     db;
-    /** One bun:sqlite connection can own only one transaction at a time. */
+    /** One SQLite connection can own only one transaction at a time. */
     #transactionTail = Promise.resolve();
     /** Set by `ensureSchema`: app-table lookup for the relational row store. */
     #tables;
@@ -214,8 +214,17 @@ export class SqliteServerStorage {
         }
     }
     constructor(db = ':memory:') {
-        this.db = typeof db === 'string' ? new Database(db) : db;
+        if (typeof db === 'string') {
+            throw new SqliteAdapterRequiredError();
+        }
+        this.db = db;
         this.db.exec(SQLITE_DDL);
+        const clientColumns = this.db
+            .query('PRAGMA table_info("sync_clients")')
+            .all();
+        if (!clientColumns.some((column) => column.name === 'wire_version')) {
+            this.db.exec('ALTER TABLE sync_clients ADD COLUMN wire_version INTEGER NOT NULL DEFAULT 1');
+        }
     }
     /** Resolve a table's compiled schema; row operations require `ensureSchema`. */
     table(name) {
@@ -291,6 +300,74 @@ export class SqliteServerStorage {
         this.#tables = schema.tables;
         this.#schemaVersion = schema.version;
     }
+    async touchPartition(partition, authenticatedAtMs, initialLogEpoch) {
+        if (initialLogEpoch.length === 0) {
+            throw new Error('initial log epoch must be non-empty');
+        }
+        this.db
+            .query(`INSERT INTO sync_partition_registry(
+           partition, log_epoch, last_authenticated_at_ms
+         ) VALUES (?,?,?)
+         ON CONFLICT(partition) DO UPDATE SET
+           last_authenticated_at_ms=excluded.last_authenticated_at_ms`)
+            .run(partition, initialLogEpoch, authenticatedAtMs);
+        const row = this.db
+            .query(`SELECT log_epoch, epoch_required, last_authenticated_at_ms
+           FROM sync_partition_registry WHERE partition=?`)
+            .get(partition);
+        if (row === null)
+            throw new Error('partition registry write did not persist');
+        return {
+            partition,
+            logEpoch: row.log_epoch,
+            epochRequired: row.epoch_required === 1,
+            lastAuthenticatedAtMs: row.last_authenticated_at_ms,
+        };
+    }
+    async rotatePartitionLogEpoch(partition, logEpoch, authenticatedAtMs) {
+        if (logEpoch.length === 0)
+            throw new Error('log epoch must be non-empty');
+        return this.#serializeReactionWrite(() => {
+            this.db.exec('BEGIN IMMEDIATE');
+            try {
+                this.db
+                    .query(`INSERT INTO sync_partition_registry(
+               partition, log_epoch, epoch_required, last_authenticated_at_ms
+             ) VALUES (?,?,1,?)
+             ON CONFLICT(partition) DO UPDATE SET
+               log_epoch=excluded.log_epoch,
+               epoch_required=1,
+               last_authenticated_at_ms=excluded.last_authenticated_at_ms`)
+                    .run(partition, logEpoch, authenticatedAtMs);
+                this.db
+                    .query('DELETE FROM sync_clients WHERE partition=?')
+                    .run(partition);
+                this.db.exec('COMMIT');
+            }
+            catch (error) {
+                this.db.exec('ROLLBACK');
+                throw error;
+            }
+            return {
+                partition,
+                logEpoch,
+                epochRequired: true,
+                lastAuthenticatedAtMs: authenticatedAtMs,
+            };
+        });
+    }
+    async listPartitionRegistry() {
+        return this.db
+            .query(`SELECT partition, log_epoch, epoch_required, last_authenticated_at_ms
+           FROM sync_partition_registry ORDER BY partition`)
+            .all()
+            .map((row) => ({
+            partition: row.partition,
+            logEpoch: row.log_epoch,
+            epochRequired: row.epoch_required === 1,
+            lastAuthenticatedAtMs: row.last_authenticated_at_ms,
+        }));
+    }
     /**
      * Migration rewrite: keyset-paged walk of a row table. When `oldLayout` is
      * given every payload re-encodes under
@@ -656,13 +733,14 @@ export class SqliteServerStorage {
     }
     async getClientRecord(partition, clientId) {
         const record = this.db
-            .query('SELECT client_id, actor_id, cursor, subscriptions, updated_at_ms FROM sync_clients WHERE partition=? AND client_id=?')
+            .query('SELECT client_id, actor_id, wire_version, cursor, subscriptions, updated_at_ms FROM sync_clients WHERE partition=? AND client_id=?')
             .get(partition, clientId);
         if (record === null)
             return undefined;
         return {
             clientId: record.client_id,
             actorId: record.actor_id,
+            wireVersion: record.wire_version,
             cursor: record.cursor,
             updatedAtMs: record.updated_at_ms,
             subscriptions: JSON.parse(record.subscriptions),
@@ -670,8 +748,8 @@ export class SqliteServerStorage {
     }
     async putClientRecord(partition, record) {
         this.db
-            .query('INSERT OR REPLACE INTO sync_clients(partition, client_id, actor_id, cursor, subscriptions, updated_at_ms) VALUES (?,?,?,?,?,?)')
-            .run(partition, record.clientId, record.actorId, record.cursor, JSON.stringify(record.subscriptions), record.updatedAtMs);
+            .query('INSERT OR REPLACE INTO sync_clients(partition, client_id, actor_id, wire_version, cursor, subscriptions, updated_at_ms) VALUES (?,?,?,?,?,?,?)')
+            .run(partition, record.clientId, record.actorId, record.wireVersion, record.cursor, JSON.stringify(record.subscriptions), record.updatedAtMs);
     }
     async listClientCursors(partition) {
         const records = this.db
@@ -716,11 +794,12 @@ export class SqliteServerStorage {
     // -- admin/console read surface --------------------------------------------
     async listClientRecords(partition) {
         const records = this.db
-            .query('SELECT client_id, actor_id, cursor, subscriptions, updated_at_ms FROM sync_clients WHERE partition=? ORDER BY updated_at_ms DESC')
+            .query('SELECT client_id, actor_id, wire_version, cursor, subscriptions, updated_at_ms FROM sync_clients WHERE partition=? ORDER BY updated_at_ms DESC')
             .all(partition);
         return records.map((record) => ({
             clientId: record.client_id,
             actorId: record.actor_id,
+            wireVersion: record.wire_version,
             cursor: record.cursor,
             updatedAtMs: record.updated_at_ms,
             subscriptions: JSON.parse(record.subscriptions),
@@ -797,12 +876,6 @@ export class SqliteServerStorage {
         };
     }
     async listPartitions() {
-        // Union: the registry row appears on first commit, the client row on
-        // first pull — a partition with only one of the two still shows up.
-        const rows = this.db
-            .query(`SELECT partition FROM sync_partitions
-         UNION SELECT partition FROM sync_clients ORDER BY partition`)
-            .all();
-        return rows.map((r) => r.partition);
+        return (await this.listPartitionRegistry()).map((entry) => entry.partition);
     }
 }

package/dist/storage-errors.js

@@ -44,7 +44,10 @@ export function isSqliteConstraintError(error) {
         return true;
     }
     const errno = candidate?.errno;
-    return typeof errno === 'number' && (errno & 0xff) === 19;
+    if (typeof errno === 'number' && (errno & 0xff) === 19)
+        return true;
+    const errcode = candidate?.errcode;
+    return typeof errcode === 'number' && (errcode & 0xff) === 19;
 }
 /** PostgreSQL SQLSTATE class 23: integrity constraint violation. */
 export function isPostgresConstraintError(error) {

package/dist/storage.d.ts

@@ -144,6 +144,8 @@ export interface ClientSubscription {
 export interface ClientRecord {
     readonly clientId: string;
     readonly actorId: string;
+    /** SSP2 version last accepted from this client; selects realtime deltas. */
+    readonly wireVersion: number;
     /** Minimum `nextCursor` across the last pull's active subscriptions. */
     readonly cursor: number;
     readonly updatedAtMs: number;
@@ -195,6 +197,13 @@ export interface ClientCursorInfo {
     readonly cursor: number;
     readonly updatedAtMs: number;
 }
+/** Durable partition identity refreshed after host authentication (§2.1). */
+export interface PartitionRegistryEntry {
+    readonly partition: string;
+    readonly logEpoch: string;
+    readonly epochRequired: boolean;
+    readonly lastAuthenticatedAtMs: number;
+}
 /**
  * Commit-log metadata (no change payloads) for the admin/console read
  * surface. `changeCount` is the number of changes the commit carries;
@@ -340,6 +349,12 @@ export interface ServerStorage {
      * lazily as a defensive backstop.
      */
     ensureSchema(schema: CompiledSchema): Promise<void>;
+    /** Create or refresh the authenticated partition registry row (§2.1). */
+    touchPartition(partition: string, authenticatedAtMs: number, initialLogEpoch: string): Promise<PartitionRegistryEntry>;
+    /** Rotate log continuity after restore and discard stale cursor records. */
+    rotatePartitionLogEpoch(partition: string, logEpoch: string, authenticatedAtMs: number): Promise<PartitionRegistryEntry>;
+    /** Registry entries ordered by partition for maintenance loops. */
+    listPartitionRegistry(): Promise<PartitionRegistryEntry[]>;
     begin(partition: string): Promise<StorageTransaction>;
     getMaxCommitSeq(partition: string): Promise<number>;
     getHorizonSeq(partition: string): Promise<number>;
@@ -427,10 +442,8 @@ export interface ServerStorage {
      * change scope index (never a log scan).
      * `getRowScopes`: the (table, rowId) row's current server_version and
      * stored scopes without decoding its payload — the row inspector.
-     * `listPartitions`: every partition this storage holds state for — the
-     * union of the partition registry (commit log counters) and client
-     * records, sorted. Powers the console's fleet view / partition picker;
-     * deliberately NOT partition-scoped (the one cross-partition read).
+     * `listPartitions`: the partition-only compatibility view of
+     * `listPartitionRegistry`, sorted.
      */
     listClientRecords?(partition: string): Promise<ClientRecord[]>;
     listCommitMetadata?(partition: string, query: CommitMetadataQuery): Promise<CommitMetadata[]>;
@@ -439,7 +452,7 @@ export interface ServerStorage {
         serverVersion: number;
         scopes: Record<string, string>;
     } | undefined>;
-    listPartitions?(): Promise<string[]>;
+    listPartitions(): Promise<string[]>;
 }
 /** A row referencing a blob, with the scopes needed to authorize download. */
 export interface BlobReferencingRow {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/server",
-  "version": "0.15.46",
+  "version": "0.15.48",
   "description": "Syncular server: handleSyncRequest + storage/auth interfaces for the sync protocol",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -27,13 +27,25 @@
   },
   "exports": {
     ".": {
-      "bun": "./src/index.ts",
+      "bun": "./src/index-bun.ts",
+      "node": {
+        "types": "./dist/index-node.d.ts",
+        "default": "./dist/index-node.js"
+      },
       "browser": "./dist/index.js",
       "import": {
         "types": "./dist/index.d.ts",
         "default": "./dist/index.js"
       }
     },
+    "./sqlite": {
+      "bun": "./src/sqlite-bun.ts",
+      "node": {
+        "types": "./dist/sqlite-node.d.ts",
+        "default": "./dist/sqlite-node.js"
+      },
+      "types": "./dist/sqlite-node.d.ts"
+    },
     "./pglite": {
       "bun": "./src/pg-executor-pglite.ts",
       "browser": "./dist/pg-executor-pglite.js",
@@ -52,8 +64,11 @@
     "!dist/**/*.test.js",
     "!dist/**/*.test.d.ts"
   ],
+  "scripts": {
+    "verify:node": "cd ../.. && bun build ./packages/server/test/sqlite-runtime/verify-node.mjs --target=node --conditions=bun --outfile=./packages/server/.verify-node.built.mjs && node ./packages/server/.verify-node.built.mjs"
+  },
   "dependencies": {
-    "@syncular/core": "0.15.46"
+    "@syncular/core": "0.15.48"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.4"

package/src/admin.ts

@@ -520,17 +520,11 @@ export class SyncularAdmin {
     };
   }
 
-  /**
-   * Every partition the storage knows (commit log + client records) — the
-   * fleet-view backing and the console's partition picker. Fails loud when
-   * the backend omits the optional `listPartitions`.
-   */
+  /** Every authenticated partition in the storage-backed registry. */
   async listPartitions(): Promise<string[]> {
-    const list = required(
-      this.#storage.listPartitions?.bind(this.#storage),
-      'storage',
+    return (await this.#storage.listPartitionRegistry()).map(
+      (entry) => entry.partition,
     );
-    return list();
   }
 
   /**

package/src/blob-handlers.ts

@@ -8,7 +8,11 @@
  */
 import { blobIdFor, isBlobId } from './blob-store';
 import type { SyncRequestContext } from './context';
-import { clockOf, RESOLVER_OUTAGE } from './context';
+import {
+  clockOf,
+  RESOLVER_OUTAGE,
+  touchAuthenticatedPartition,
+} from './context';
 import { SyncError, syncError } from './errors';
 import { emitEvent } from './events';
 import { compileSchema } from './schema';
@@ -72,6 +76,7 @@ export async function handleBlobUpload(
   ctx: SyncRequestContext,
   request: BlobUploadRequest,
 ): Promise<void> {
+  await touchAuthenticatedPartition(ctx);
   const store = ctx.blobs;
   if (store === undefined) {
     throw syncError('blob.not_found', 'this server has no blob store (§5.9)');
@@ -125,6 +130,7 @@ export async function handleBlobDownload(
   ctx: SyncRequestContext,
   blobId: string,
 ): Promise<BlobDownloadResult> {
+  await touchAuthenticatedPartition(ctx);
   const events = ctx.events;
   if (events === undefined) return downloadBlob(ctx, blobId);
   const clock = clockOf(ctx);
@@ -301,6 +307,7 @@ export async function handleBlobUploadGrant(
   ctx: SyncRequestContext,
   request: BlobUploadGrantRequest,
 ): Promise<BlobUploadGrantResult> {
+  await touchAuthenticatedPartition(ctx);
   const store = ctx.blobs;
   if (store === undefined) {
     throw syncError('blob.not_found', 'this server has no blob store (§5.9)');

package/src/context.ts

@@ -18,7 +18,11 @@ import type {
   SegmentUrlConfig,
 } from './signed-url';
 import type { SqliteImageBuilder } from './sqlite-image';
-import type { ServerStorage, StoredCommit } from './storage';
+import type {
+  PartitionRegistryEntry,
+  ServerStorage,
+  StoredCommit,
+} from './storage';
 import type { CommitValidator, ValidatorRegistry } from './validate';
 
 /** SSP2 body content type (§1.1). */
@@ -167,7 +171,8 @@ export interface SyncServerConfig {
    * §5.3 sqlite-image builder, injected so the pull path never
    * statically imports `bun:sqlite`. Absent ⇒ the sqlite-image lane is off
    * (bit-2 clients are served the rows lane) — the Workers/edge posture. A
-   * Bun/Node host wires `buildSqliteImage` from `@syncular/server`.
+   * Bun or Node host wires `buildSqliteImage` from
+   * `@syncular/server/sqlite`.
    */
   readonly sqliteImageBuilder?: SqliteImageBuilder;
   readonly realtime?: RealtimeNotifier;
@@ -191,3 +196,14 @@ export function clockOf(ctx: SyncServerConfig): () => number {
 export function limitsOf(ctx: SyncServerConfig): ServerLimits {
   return { ...DEFAULT_LIMITS, ...ctx.limits };
 }
+
+/** Refresh the registry after host authentication and return log continuity. */
+export function touchAuthenticatedPartition(
+  ctx: SyncRequestContext,
+): Promise<PartitionRegistryEntry> {
+  return ctx.storage.touchPartition(
+    ctx.partition,
+    clockOf(ctx)(),
+    crypto.randomUUID(),
+  );
+}