@syncular/server 0.30.5 → 0.30.7

package/README.md

@@ -1232,3 +1232,13 @@ maxima, preserve registration fields, and require a matching actor and current
 partition log epoch. Leave missing records unchanged. SQLite, Postgres, and D1
 perform one update without reading or serializing the subscription list. HTTP
 registration keeps its existing cursor and subscription replacement rules.
+
+## Reviewed schema windows
+
+Pass `schemaWindow: [compileSchema(schema), compileSchema(previousSchema)]` to
+serve the prior codec through the current storage and validation rules. Entries
+are newest first, with the compiled current schema first. Added tables and
+appended nullable columns are supported. Removed/renamed columns, changed codecs,
+primary keys, references or scopes reject the window before serving. Hosts must
+exclude semantically incompatible prior versions. The [schema upgrade guide](https://syncular.dev/concepts-schema-upgrades/#serving-a-compatibility-window)
+owns the pull, segment, push and realtime contract.

package/dist/context.d.ts

@@ -11,7 +11,7 @@ import type { SyncularErrorHandler } from './errors.js';
 import type { SyncularServerEvents } from './events.js';
 import type { LeaseStore } from './lease-store.js';
 import type { AnyReactionPlanner } from './reactions.js';
-import type { ServerSchema } from './schema.js';
+import type { ServerSchema, CompiledSchema } from './schema.js';
 import type { SegmentStore } from './segment-store.js';
 import type { BlobPresignConfig, BlobUploadPresignConfig, SegmentUrlConfig } from './signed-url.js';
 import type { SqliteImageBuilder } from './sqlite-image.js';
@@ -72,6 +72,8 @@ export interface RealtimeNotifier {
 }
 export interface SyncServerConfig {
     readonly schema: ServerSchema;
+    /** Current compiled schema followed by the supported previous versions, newest first. */
+    readonly schemaWindow?: readonly CompiledSchema[];
     readonly storage: ServerStorage;
     /**
      * RFC 0007: the backfill checkpoints this host installs. Every readiness

package/dist/handler.js

@@ -18,6 +18,7 @@ import { ACCEPT_EXTERNAL_ROWS, ACCEPT_INLINE_ROWS, clampPullLimits, prepareSecti
 import { processPushCommitWithTrace } from './push.js';
 import { serveNotReadyError } from './readiness.js';
 import { compileSchema } from './schema.js';
+import { schemaWindowOf, projectRowPayload } from './schema-window.js';
 import { computeEffective } from './scopes.js';
 import { StorageQueryError } from './storage-errors.js';
 import { serveGateRefusal, serveGateTokenChanged, } from './storage.js';
@@ -195,7 +196,7 @@ async function planRequest(request, ctx, schema, registry) {
         }
         validated.push({ frame, table: frame.table });
     }
-    const { resolved, leaseToEmit } = await resolveOnce(ctx, header.clientId, schema);
+    const { resolved, leaseToEmit } = await resolveOnce(ctx, header.clientId, compileSchema(ctx.schema));
     const subscriptions = validated.map(({ frame }) => {
         const table = schema.tables.get(frame.table);
         if (table === undefined)
@@ -291,8 +292,8 @@ async function* streamResponse(plan, ctx, schema, report) {
             report.outcome = 'schema_floor';
         yield encodeResponseFrame({
             type: 'RESP_HEADER',
-            requiredSchemaVersion: schema.version,
-            latestSchemaVersion: schema.version,
+            requiredSchemaVersion: schemaWindowOf(ctx.schema, ctx.schemaWindow).at(-1).version,
+            latestSchemaVersion: ctx.schema.version,
             ...(plan.wireVersion >= 2
                 ? { logEpoch: plan.logEpoch, resetRequired: plan.epochReset }
                 : {}),
@@ -302,7 +303,7 @@ async function* streamResponse(plan, ctx, schema, report) {
     }
     yield encodeResponseFrame({
         type: 'RESP_HEADER',
-        latestSchemaVersion: schema.version,
+        latestSchemaVersion: ctx.schema.version,
         ...(plan.wireVersion >= 2
             ? { logEpoch: plan.logEpoch, resetRequired: plan.epochReset }
             : {}),
@@ -335,8 +336,27 @@ async function* streamResponse(plan, ctx, schema, report) {
     try {
         // Push half (§6): one PUSH_RESULT per PUSH_COMMIT, in request order.
         for (const push of plan.pushes) {
-            const processed = await processPushCommitWithTrace(ctx, schema, plan.resolved, plan.header.clientId, push);
-            const { frame } = processed;
+            const processed = await processPushCommitWithTrace(ctx, compileSchema(ctx.schema), plan.resolved, plan.header.clientId, push, schema);
+            const frame = {
+                ...processed.frame,
+                results: processed.frame.results.map((result) => {
+                    if (result.status !== 'conflict')
+                        return result;
+                    const operation = push.operations[result.opIndex];
+                    const target = schema.tables.get(operation.table);
+                    const current = compileSchema(ctx.schema).tables.get(operation.table);
+                    return {
+                        ...result,
+                        serverRow: projectRowPayload(current, target, result.serverRow),
+                        conflictColumns: result.conflictColumns
+                            .slice(0, Math.ceil(target.columns.length / 8))
+                            .map((byte, i) => i === Math.ceil(target.columns.length / 8) - 1 &&
+                            target.columns.length % 8 !== 0
+                            ? byte & ((1 << (target.columns.length % 8)) - 1)
+                            : byte),
+                    };
+                }),
+            };
             if (events !== undefined) {
                 emitPushEvent(events, ctx, plan.header.clientId, push, processed);
             }
@@ -419,6 +439,7 @@ async function* streamResponse(plan, ctx, schema, report) {
                 id: s.frame.id,
                 table: s.frame.table,
                 scopes: s.frame.scopes,
+                schemaVersion: schema.version,
             }))
             : [...(previous?.subscriptions ?? [])];
         const cursor = cursors.length > 0 ? Math.min(...cursors) : (previous?.cursor ?? -1);
@@ -529,7 +550,12 @@ async function createStreamCore(bytes, ctx, events, startedAtMs = 0) {
     const refusal = serveGateRefusal(gate, schema.version, ctx.checkpoints);
     if (refusal !== undefined)
         throw serveNotReadyError(refusal);
-    const plan = await planRequest(request, ctx, schema, registry);
+    const window = schemaWindowOf(ctx.schema, ctx.schemaWindow);
+    const header = request.frames[0];
+    const selected = window.find((candidate) => header?.type === 'REQ_HEADER' &&
+        candidate.version === header.schemaVersion);
+    const served = selected ?? schema;
+    const plan = await planRequest(request, ctx, served, registry);
     const report = { outcome: 'ok' };
     // RFC 0007 read-verify-refuse for the streamed read path: the generator
     // builds the whole response (its data reads) before yielding the first
@@ -541,7 +567,7 @@ async function createStreamCore(bytes, ctx, events, startedAtMs = 0) {
     // key, so refusing the request is safe (proved in the serve-gate lane).
     const verified = async function* () {
         const buffered = [];
-        for await (const chunk of streamResponse(plan, ctx, schema, report)) {
+        for await (const chunk of streamResponse(plan, ctx, served, report)) {
             buffered.push(chunk);
         }
         const after = await ctx.storage.readServeGate(ctx.partition, schema.version);

package/dist/index.d.ts

@@ -52,3 +52,4 @@ export * from './sqlite-storage.js';
 export * from './storage.js';
 export { StorageQueryError, type StorageQueryErrorCode, } from './storage-errors.js';
 export * from './validate.js';
+export { schemaWindowOf } from './schema-window.js';

package/dist/index.js

@@ -56,3 +56,4 @@ export * from './sqlite-storage.js';
 export * from './storage.js';
 export { StorageQueryError, } from './storage-errors.js';
 export * from './validate.js';
+export { schemaWindowOf } from './schema-window.js';

package/dist/pg-executor-pglite.js

@@ -1,3 +1,4 @@
+import { retainRollbackFailure } from './storage-errors.js';
 function queryable(db) {
     return {
         async query(text, params) {
@@ -32,7 +33,12 @@ export function pgliteExecutor(db) {
                     return result;
                 }
                 catch (error) {
-                    await like.exec('ROLLBACK');
+                    try {
+                        await like.exec('ROLLBACK');
+                    }
+                    catch (rollbackError) {
+                        retainRollbackFailure(error, rollbackError);
+                    }
                     throw error;
                 }
             }

package/dist/pull.js

@@ -2,11 +2,12 @@
  * Pull: incremental commit delivery, cursors, bootstrap segments
  * (SPEC.md §4, §5).
  */
-import { decodeRow, encodeRowsSegment, } from '@syncular/core';
+import { encodeRowsSegment, } from '@syncular/core';
 import { clockOf, limitsOf } from './context.js';
 import { compileSchema, } from './schema.js';
 import { scopeDigest } from './scopes.js';
 import { issueSegmentUrl } from './signed-url.js';
+import { projectRowPayload, projectRowValues } from './schema-window.js';
 // One artifact build per owning storage pair and complete immutable identity.
 const imageBuilds = new WeakMap();
 /**
@@ -69,7 +70,7 @@ function parseBootstrapToken(raw, table) {
         return undefined;
     }
 }
-function commitFrame(table, commit) {
+function commitFrame(table, commit, current, target) {
     const changes = commit.changes.map((change) => ({
         tableIndex: 0,
         rowId: change.rowId,
@@ -78,7 +79,9 @@ function commitFrame(table, commit) {
             ? { rowVersion: change.rowVersion }
             : {}),
         scopes: change.scopes,
-        ...(change.payload !== undefined ? { row: change.payload } : {}),
+        ...(change.payload !== undefined
+            ? { row: projectRowPayload(current, target, change.payload) }
+            : {}),
     }));
     return {
         type: 'COMMIT',
@@ -220,7 +223,10 @@ async function* sqliteImageSegment(ctx, schema, limits, plan, asOf, digest, trac
                 scopeDigest: digest,
                 rowBatches: (async function* () {
                     rowCount += probe.length;
-                    yield probe;
+                    yield probe.map((row) => ({
+                        ...row,
+                        payload: projectRowPayload(compileSchema(ctx.schema).tables.get(plan.table.name), plan.table, row.payload),
+                    }));
                     let afterRowId = probe[probe.length - 1].rowId;
                     for (;;) {
                         const rows = await storage.scanRows(partition, {
@@ -230,7 +236,10 @@ async function* sqliteImageSegment(ctx, schema, limits, plan, asOf, digest, trac
                             limit: 5_000,
                         });
                         rowCount += rows.length;
-                        yield rows;
+                        yield rows.map((row) => ({
+                            ...row,
+                            payload: projectRowPayload(compileSchema(ctx.schema).tables.get(plan.table.name), plan.table, row.payload),
+                        }));
                         const last = rows[rows.length - 1];
                         if (rows.length < 5_000 || last === undefined)
                             break;
@@ -285,7 +294,7 @@ async function* bootstrapSegments(ctx, schema, limits, plan, asOf, startRowCurso
         // §5.2: every row record carries the row's current server_version.
         const decoded = pageRows.map((row) => ({
             serverVersion: row.serverVersion,
-            values: decodeRow(plan.table.columns, row.payload),
+            values: projectRowValues(compileSchema(ctx.schema).tables.get(plan.table.name), plan.table, row.payload),
         }));
         const bytes = encodeRowsSegment({
             table: plan.table.name,
@@ -525,7 +534,7 @@ export async function* preparedSection(ctx, schema, limits, plan, maxSeq, prepar
             delivered + commit.changes.length > limits.limitCommits) {
             break;
         }
-        yield commitFrame(sub.table, commit);
+        yield commitFrame(sub.table, commit, compileSchema(ctx.schema).tables.get(sub.table), plan.table);
         delivered += commit.changes.length;
         deliveredCommits += 1;
         lastDeliveredSeq = commit.commitSeq;

package/dist/push.d.ts

@@ -42,10 +42,10 @@ export declare function processPushCommit(ctx: SyncRequestContext, schema: Compi
  * rejected replays as `status: rejected`; this companion result preserves the
  * cache provenance needed by structured events and server helpers.
  */
-export declare function processPushCommitWithTrace(ctx: SyncRequestContext, schema: CompiledSchema, resolved: ResolvedScopes, clientId: string, frame: PushCommitFrame): Promise<ProcessedPushCommit>;
+export declare function processPushCommitWithTrace(ctx: SyncRequestContext, schema: CompiledSchema, resolved: ResolvedScopes, clientId: string, frame: PushCommitFrame, wireSchema?: CompiledSchema): Promise<ProcessedPushCommit>;
 /**
  * Shared serialized apply path for SSP2 commits and authoritative commands.
  * The builder runs after the partition lock and idempotency re-check, so its
  * reads and the returned operations share the transaction that is committed.
  */
-export declare function processPushOperationsWithTrace(ctx: SyncRequestContext, schema: CompiledSchema, resolved: ResolvedScopes, clientId: string, clientCommitId: string, buildOperations: (tx: StorageTransaction) => Promise<readonly PushOperation[]>): Promise<ProcessedPushCommit>;
+export declare function processPushOperationsWithTrace(ctx: SyncRequestContext, schema: CompiledSchema, resolved: ResolvedScopes, clientId: string, clientCommitId: string, buildOperations: (tx: StorageTransaction) => Promise<readonly PushOperation[]>, wireSchema?: CompiledSchema): Promise<ProcessedPushCommit>;

package/dist/push.js

@@ -1,3 +1,4 @@
+import { retainRollbackFailure } from './storage-errors.js';
 /**
  * Push apply (SPEC.md §6) with §3.4 write-path authorization.
  *
@@ -161,9 +162,10 @@ async function mergeCrdtColumns(table, values, storedValues, present, opIndex, m
     }
     return { changed };
 }
-async function applyOperation(tx, schema, resolved, op, opIndex, blobCtx, crdtMergers, validators, partition, actorId) {
+async function applyOperation(tx, schema, wireSchema, resolved, op, opIndex, blobCtx, crdtMergers, validators, partition, actorId) {
     const table = schema.tables.get(op.table);
-    if (table === undefined) {
+    const wireTable = wireSchema.tables.get(op.table);
+    if (table === undefined || wireTable === undefined) {
         return errorRecord(opIndex, 'sync.unknown_table', `table ${JSON.stringify(op.table)} is not handled by this server`);
     }
     if (!resolved.ok) {
@@ -237,7 +239,9 @@ async function applyOperation(tx, schema, resolved, op, opIndex, blobCtx, crdtMe
     }
     let sparse;
     try {
-        sparse = decodeSparseRow(table.columns, table.primaryKeyIndex, payload);
+        sparse = decodeSparseRow(wireTable.columns, wireTable.primaryKeyIndex, payload);
+        while (sparse.length < table.columns.length)
+            sparse.push(stored === undefined ? null : undefined);
     }
     catch (error) {
         return errorRecord(opIndex, 'sync.invalid_request', `row payload failed row-codec decode (§1.7): ${error instanceof Error ? error.message : String(error)}`);
@@ -830,15 +834,15 @@ export async function processPushCommit(ctx, schema, resolved, clientId, frame)
  * rejected replays as `status: rejected`; this companion result preserves the
  * cache provenance needed by structured events and server helpers.
  */
-export async function processPushCommitWithTrace(ctx, schema, resolved, clientId, frame) {
-    return processPushOperationsWithTrace(ctx, schema, resolved, clientId, frame.clientCommitId, async () => frame.operations);
+export async function processPushCommitWithTrace(ctx, schema, resolved, clientId, frame, wireSchema = schema) {
+    return processPushOperationsWithTrace(ctx, schema, resolved, clientId, frame.clientCommitId, async () => frame.operations, wireSchema);
 }
 /**
  * Shared serialized apply path for SSP2 commits and authoritative commands.
  * The builder runs after the partition lock and idempotency re-check, so its
  * reads and the returned operations share the transaction that is committed.
  */
-export async function processPushOperationsWithTrace(ctx, schema, resolved, clientId, clientCommitId, buildOperations) {
+export async function processPushOperationsWithTrace(ctx, schema, resolved, clientId, clientCommitId, buildOperations, wireSchema = schema) {
     const { storage, partition } = ctx;
     let persisted;
     try {
@@ -936,7 +940,7 @@ export async function processPushOperationsWithTrace(ctx, schema, resolved, clie
             const op = operations[opIndex];
             if (op === undefined)
                 continue;
-            const outcome = await applyOperation(tx, schema, resolved, op, opIndex, blobCtx, crdtMergers, validators, partition, ctx.actorId);
+            const outcome = await applyOperation(tx, schema, wireSchema, resolved, op, opIndex, blobCtx, crdtMergers, validators, partition, ctx.actorId);
             if (outcome.kind === 'terminate') {
                 terminated = outcome.record;
                 break;
@@ -1099,14 +1103,18 @@ export async function processPushOperationsWithTrace(ctx, schema, resolved, clie
                 try {
                     await tx.rollback();
                 }
-                catch {
-                    // Surface the finalization failure; a rollback failure would
-                    // otherwise mask it.
+                catch (rollbackError) {
+                    retainRollbackFailure(finalizationError, rollbackError);
                 }
                 throw finalizationError;
             }
         }
-        await tx.rollback();
+        try {
+            await tx.rollback();
+        }
+        catch (rollbackError) {
+            retainRollbackFailure(error, rollbackError);
+        }
         throw error;
     }
 }

package/dist/readiness.d.ts

@@ -29,7 +29,7 @@ export declare class SyncServerReadinessError extends Error {
  * exposes only a stable code, phase, and schema version; operators can inspect
  * `cause` locally for the table/column or storage diagnostic.
  */
-export declare function ensureSyncServerReady(config: Pick<SyncServerConfig, 'schema' | 'storage' | 'checkpoints'>): Promise<void>;
+export declare function ensureSyncServerReady(config: Pick<SyncServerConfig, 'schema' | 'schemaWindow' | 'storage' | 'checkpoints'>): Promise<void>;
 /**
  * RFC 0007: refuse a serve path that observed a closed gate. The projection
  * name travels in structured details, never in the message.

package/dist/readiness.js

@@ -1,5 +1,6 @@
 import { syncError } from './errors.js';
 import { compileSchema } from './schema.js';
+import { schemaWindowOf } from './schema-window.js';
 export const SYNC_SERVER_READINESS_ERROR_CODE = 'sync.schema_not_ready';
 export class SyncServerReadinessError extends Error {
     name = 'SyncServerReadinessError';
@@ -23,6 +24,7 @@ export async function ensureSyncServerReady(config) {
     let compiled;
     try {
         compiled = compileSchema(config.schema);
+        schemaWindowOf(config.schema, config.schemaWindow);
     }
     catch (cause) {
         throw new SyncServerReadinessError({

package/dist/realtime.d.ts

@@ -20,6 +20,7 @@ import { type PresenceKind, type ScopeMap, type WakeReason } from '@syncular/cor
 import type { SyncRequestContext, SyncServerConfig } from './context.js';
 import { type SyncularErrorHandler } from './errors.js';
 import { type SyncularServerEvents } from './events.js';
+import { type CompiledTable } from './schema.js';
 import type { ServerStorage, StoredCommit } from './storage.js';
 /**
  * Realtime adds fanout/presence tuning to the canonical sync-server config;
@@ -62,6 +63,7 @@ export interface RealtimeConnectOptions {
     readonly closeSocket?: () => void;
 }
 interface Registration {
+    readonly codec: CompiledTable;
     readonly id: string;
     readonly table: string;
     readonly effective: ScopeMap;
@@ -172,6 +174,7 @@ export declare class RealtimeHub {
     /** §8.6 presence registry — ephemeral, in-memory, never persisted. */
     readonly presence: PresenceRegistry;
     constructor(config: RealtimeHubConfig);
+    projectPayload(registration: Registration, payload: Uint8Array): Uint8Array;
     get sessionCount(): number;
     /** §8.6.2 published-document size cap (bytes). */
     get maxPresenceBytes(): number;

package/dist/realtime.js

@@ -21,7 +21,8 @@ import { REMOTE_COMMAND_CLIENT_ID_PREFIX, RESOLVER_OUTAGE, touchAuthenticatedPar
 import { adapterSyncError, reportError, SyncError, syncError, } from './errors.js';
 import { emitEvent } from './events.js';
 import { createSyncResponseStream } from './handler.js';
-import { compileSchema } from './schema.js';
+import { compileSchema, } from './schema.js';
+import { schemaWindowOf, projectRowPayload } from './schema-window.js';
 import { computeEffective, matchesEffective, } from './scopes.js';
 const DEFAULT_MAX_DELTA_BYTES = 1024 * 1024;
 const DEFAULT_MAX_PRESENCE_BYTES = 16 * 1024;
@@ -608,7 +609,9 @@ export class RealtimeSession {
                     ? { rowVersion: change.rowVersion }
                     : {}),
                 scopes: change.scopes,
-                ...(change.payload !== undefined ? { row: change.payload } : {}),
+                ...(change.payload !== undefined
+                    ? { row: this.#hub.projectPayload(registration, change.payload) }
+                    : {}),
             }));
             if (changes.length > 0)
                 sections.push({ registration, changes });
@@ -706,6 +709,10 @@ export class RealtimeHub {
     constructor(config) {
         this.#config = config;
         this.#schema = compileSchema(config.schema);
+        schemaWindowOf(config.schema, config.schemaWindow);
+    }
+    projectPayload(registration, payload) {
+        return projectRowPayload(this.#schema.tables.get(registration.table), registration.codec, payload);
     }
     get sessionCount() {
         return this.#sessions.size;
@@ -775,7 +782,12 @@ export class RealtimeHub {
         }
         const registrations = [];
         for (const subscription of record?.subscriptions ?? []) {
-            const table = this.#schema.tables.get(subscription.table);
+            const window = schemaWindowOf(this.#config.schema, this.#config.schemaWindow);
+            const selected = subscription.schemaVersion === undefined &&
+                this.#config.schemaWindow === undefined
+                ? this.#schema
+                : window.find((schema) => schema.version === subscription.schemaVersion);
+            const table = selected?.tables.get(subscription.table);
             if (table === undefined)
                 continue;
             const keysValid = Object.keys(subscription.scopes).every((key) => table.declaredVariables.has(key));
@@ -786,6 +798,7 @@ export class RealtimeHub {
                 continue;
             registrations.push({
                 id: subscription.id,
+                codec: table,
                 table: subscription.table,
                 effective: outcome.effective,
             });
@@ -808,6 +821,9 @@ export class RealtimeHub {
             partition: identity.partition,
             actorId: identity.actorId,
             schema: this.#config.schema,
+            ...(this.#config.schemaWindow !== undefined
+                ? { schemaWindow: this.#config.schemaWindow }
+                : {}),
             storage: this.#config.storage,
             segments,
             resolveScopes: this.#config.resolveScopes,
@@ -896,7 +912,10 @@ export class RealtimeHub {
                 clientId: options.clientId,
                 cursor,
                 latestCursor: latestSeq,
-                requiresSync: record === undefined || cursor < latestSeq,
+                requiresSync: record === undefined ||
+                    cursor < latestSeq ||
+                    (this.#config.schemaWindow !== undefined &&
+                        record.subscriptions.some((subscription) => !schemaWindowOf(this.#config.schema, this.#config.schemaWindow).some((schema) => schema.version === subscription.schemaVersion))),
                 timestamp: clock(),
             },
         }));

package/dist/schema-window.d.ts

@@ -0,0 +1,7 @@
+import { type RowValue } from '@syncular/core';
+import { type CompiledSchema, type CompiledTable, type ServerSchema } from './schema.js';
+/** A host-reviewed newest-first window. Storage and validation always use current. */
+export declare function schemaWindowOf(current: ServerSchema, configured?: readonly CompiledSchema[]): readonly CompiledSchema[];
+/** Canonical stored bytes never leave the server under another version's codec. */
+export declare function projectRowValues(current: CompiledTable, target: CompiledTable, payload: Uint8Array): RowValue[];
+export declare function projectRowPayload(current: CompiledTable, target: CompiledTable, payload: Uint8Array): Uint8Array;

package/dist/schema-window.js

@@ -0,0 +1,46 @@
+import { decodeRow, encodeRow } from '@syncular/core';
+import { compileSchema, } from './schema.js';
+const validatedWindows = new WeakMap();
+/** A host-reviewed newest-first window. Storage and validation always use current. */
+export function schemaWindowOf(current, configured) {
+    const head = compileSchema(current);
+    if (configured === undefined)
+        return [head];
+    if (validatedWindows.get(configured) === head)
+        return configured;
+    if (configured.length === 0 || configured[0] !== head)
+        throw new Error('sync.schema_window.invalid_head');
+    let previous = head.version + 1;
+    for (const schema of configured) {
+        if (schema.version >= previous)
+            throw new Error('sync.schema_window.invalid_order');
+        previous = schema.version;
+        for (const table of schema.tables.values()) {
+            const next = head.tables.get(table.name);
+            if (next === undefined ||
+                table.columns.length > next.columns.length ||
+                table.columns.some((column, i) => JSON.stringify(column) !== JSON.stringify(next.columns[i])) ||
+                next.columns
+                    .slice(table.columns.length)
+                    .some((column) => !column.nullable) ||
+                table.primaryKeyIndex !== next.primaryKeyIndex ||
+                JSON.stringify(table.scopePatterns) !==
+                    JSON.stringify(next.scopePatterns) ||
+                JSON.stringify(table.references) !== JSON.stringify(next.references)) {
+                throw new Error('sync.schema_window.incompatible_schema');
+            }
+        }
+    }
+    validatedWindows.set(configured, head);
+    return configured;
+}
+/** Canonical stored bytes never leave the server under another version's codec. */
+export function projectRowValues(current, target, payload) {
+    const values = decodeRow(current.columns, payload);
+    return values.slice(0, target.columns.length);
+}
+export function projectRowPayload(current, target, payload) {
+    return current === target
+        ? payload
+        : encodeRow(target.columns, projectRowValues(current, target, payload));
+}

package/dist/segment-download.js

@@ -2,6 +2,7 @@ import { clockOf, RESOLVER_OUTAGE, touchAuthenticatedPartition, } from './contex
 import { SyncError, syncError } from './errors.js';
 import { emitEvent } from './events.js';
 import { compileSchema } from './schema.js';
+import { schemaWindowOf } from './schema-window.js';
 import { computeEffective, scopeDigest } from './scopes.js';
 import { bytesStream, publicationRecord, } from './segment-store.js';
 function parseScopesHeader(header) {
@@ -184,7 +185,8 @@ async function authorizePublication(ctx, request, logEpoch, stored) {
     // earlier valid publication of the same bytes exists.
     const schema = compileSchema(ctx.schema);
     const candidates = live.filter((publication) => {
-        const table = schema.tables.get(publication.table);
+        const served = schemaWindowOf(ctx.schema, ctx.schemaWindow).find((candidate) => candidate.version === publication.schemaVersion);
+        const table = served?.tables.get(publication.table);
         return (table !== undefined &&
             Object.entries(requested).every(([key, values]) => table.declaredVariables.has(key) && !values.includes('*')));
     });

package/dist/sqlite-image.js

@@ -1,3 +1,4 @@
+import { rollbackAfterError } from './storage-errors.js';
 /**
  * SQLite-image segment generation (SPEC.md §5.3): a complete SQLite
  * database file carrying one table's whole effective-scope snapshot at
@@ -79,7 +80,8 @@ export async function writeSqliteImage(db, input) {
         db.exec('COMMIT');
     }
     catch (error) {
-        db.exec('ROLLBACK');
-        throw error;
+        rollbackAfterError(() => {
+            db.exec('ROLLBACK');
+        }, error);
     }
 }

package/dist/sqlite-segment-store.js

@@ -1,3 +1,4 @@
+import { rollbackAfterError } from './storage-errors.js';
 /**
  * SQLite-backed segment store over the shared synchronous driver.
  */
@@ -137,8 +138,9 @@ export class SqliteSegmentStore {
             this.db.exec('COMMIT');
         }
         catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
+            rollbackAfterError(() => {
+                this.db.exec('ROLLBACK');
+            }, error);
         }
         return record;
     }

package/dist/sqlite-storage.js

@@ -1,3 +1,4 @@
+import { retainRollbackFailure, rollbackAfterError } from './storage-errors.js';
 import { validateCommitPruneQuery } from './prune.js';
 import { StorageQueryError } from './storage-errors.js';
 import { serveGateRefusal } from './storage.js';
@@ -229,9 +230,8 @@ class SqliteTransaction {
             try {
                 this.#storage.db.exec('ROLLBACK');
             }
-            catch {
-                // Surface the COMMIT failure; a rollback failure would otherwise
-                // mask it.
+            catch (rollbackError) {
+                retainRollbackFailure(error, rollbackError);
             }
             throw error;
         }
@@ -433,8 +433,9 @@ END`);
                     this.db.exec('COMMIT');
                 }
                 catch (error) {
-                    this.db.exec('ROLLBACK');
-                    throw error;
+                    rollbackAfterError(() => {
+                        this.db.exec('ROLLBACK');
+                    }, error);
                 }
             });
         }
@@ -486,8 +487,9 @@ END`);
                 this.db.exec('COMMIT');
             }
             catch (error) {
-                this.db.exec('ROLLBACK');
-                throw error;
+                rollbackAfterError(() => {
+                    this.db.exec('ROLLBACK');
+                }, error);
             }
             return {
                 partition,
@@ -624,9 +626,10 @@ END`);
             return result;
         }
         catch (error) {
-            if (open)
-                this.db.exec('ROLLBACK');
-            throw error;
+            rollbackAfterError(() => {
+                if (open)
+                    this.db.exec('ROLLBACK');
+            }, error);
         }
         finally {
             release();
@@ -690,8 +693,9 @@ END`);
                 };
             }
             catch (error) {
-                this.db.exec('ROLLBACK');
-                throw error;
+                rollbackAfterError(() => {
+                    this.db.exec('ROLLBACK');
+                }, error);
             }
         });
     }
@@ -771,8 +775,9 @@ END`);
                 return toStoredCheckpoint(row);
             }
             catch (error) {
-                this.db.exec('ROLLBACK');
-                throw error;
+                rollbackAfterError(() => {
+                    this.db.exec('ROLLBACK');
+                }, error);
             }
         });
     }
@@ -810,8 +815,9 @@ END`);
                 return Number(updated.changes) === 1 ? 'activated' : 'stale';
             }
             catch (error) {
-                this.db.exec('ROLLBACK');
-                throw error;
+                rollbackAfterError(() => {
+                    this.db.exec('ROLLBACK');
+                }, error);
             }
         });
     }