@syncular/server 0.42.2 → 0.43.0

package/dist/d1-storage.js

@@ -1,7 +1,7 @@
 var _a;
 import { validateCommitPruneQuery } from './prune.js';
 import { StorageQueryError } from './storage-errors.js';
-import { clientRoundState, PARTITION_TOUCH_INTERVAL_MS } from './storage.js';
+import { clientRoundState, PARTITION_TOUCH_INTERVAL_MS, rowsLiveAfterDelete, } from './storage.js';
 /**
  * Cloudflare D1 server storage for Workers deployments.
  *
@@ -480,6 +480,7 @@ class D1Transaction {
             commit.actorId,
             commit.createdAtMs,
         ]);
+        const liveAfterDelete = rowsLiveAfterDelete(commit.changes);
         commit.changes.forEach((change, idx) => {
             this.#buffer_('INSERT INTO sync_changes(partition, commit_seq, idx, tbl, row_id, op, row_version, scopes, payload) VALUES (?,?,?,?,?,?,?,?,?)', [
                 p,
@@ -492,9 +493,11 @@ class D1Transaction {
                 JSON.stringify(change.scopes),
                 change.payload ?? null,
             ]);
-            if (change.op === 'delete') {
+            if (change.op === 'delete' &&
+                !liveAfterDelete.has(`${change.table}\u0000${change.rowId}`)) {
                 // §5 delete precedence: every applied delete leaves a tombstone,
-                // pruned with the commit log (§4.6).
+                // pruned with the commit log (§4.6). A delete that the same commit
+                // follows with an upsert is a §2.2 scope move, not a deletion.
                 this.#buffer_(`INSERT INTO sync_tombstones(partition, tbl, row_id, commit_seq) VALUES (?,?,?,?)
            ON CONFLICT(partition, tbl, row_id) DO UPDATE SET commit_seq=excluded.commit_seq`, [p, change.table, change.rowId, commitSeq]);
             }

package/dist/operations.d.ts

@@ -51,6 +51,11 @@ export type CommandMutation = {
     readonly table: string;
     readonly op: 'upsert';
     readonly values: Readonly<Record<string, RowValue>>;
+} | {
+    readonly table: string;
+    readonly op: 'rescope';
+    /** Full row; only its scope columns may differ from the stored row. */
+    readonly values: Readonly<Record<string, RowValue>>;
 } | {
     readonly table: string;
     readonly op: 'delete';

package/dist/operations.js

@@ -256,23 +256,23 @@ function commandOperations(mutations, schema) {
         const supplied = new Set(Object.keys(mutation.values));
         for (const name of supplied) {
             if (!table.columnIndex.has(name)) {
-                throw syncError('operation.invalid_request', 'command upsert has an unknown column');
+                throw syncError('operation.invalid_request', 'command upsert or rescope has an unknown column');
             }
         }
         const values = table.columns.map((column) => {
             if (!supplied.has(column.name)) {
-                throw syncError('operation.invalid_request', 'command upsert must provide a full row');
+                throw syncError('operation.invalid_request', 'command upsert or rescope must provide a full row');
             }
             return mutation.values[column.name] ?? null;
         });
         const rowId = renderScopeValue(values[table.primaryKeyIndex]);
         if (rowId === undefined) {
-            throw syncError('operation.invalid_request', 'command upsert requires a non-empty primary key');
+            throw syncError('operation.invalid_request', 'command upsert or rescope requires a non-empty primary key');
         }
         return {
             table: table.name,
             rowId,
-            op: 'upsert',
+            op: mutation.op,
             payload: encodeSparseRow(table.columns, table.primaryKeyIndex, values),
         };
     });

package/dist/postgres-storage.js

@@ -1,6 +1,6 @@
 import { validateCommitPruneQuery } from './prune.js';
 import { StorageQueryError } from './storage-errors.js';
-import { clientRoundState, PARTITION_TOUCH_INTERVAL_MS, serveGateRefusal, } from './storage.js';
+import { clientRoundState, PARTITION_TOUCH_INTERVAL_MS, rowsLiveAfterDelete, serveGateRefusal, } from './storage.js';
 import { serveNotReadyError } from './readiness.js';
 import { bindAuthoritativePartition, postgresPlaceholders, prepareAuthoritativeQuery, } from './authoritative-query.js';
 import { syncError } from './errors.js';
@@ -895,6 +895,22 @@ class PostgresTransaction {
          ON CONFLICT (partition, tbl, row_id)
          DO UPDATE SET commit_seq = excluded.commit_seq`, params);
         }
+        // §2.2: a delete whose commit follows it with an upsert is a scope move.
+        // The row is live, so no tombstone may remain for it.
+        const liveAfterDelete = rowsLiveAfterDelete(commit.changes);
+        if (liveAfterDelete.size > 0) {
+            await q.query(`DELETE FROM sync_tombstones existing
+          USING jsonb_to_recordset($2::text::jsonb) AS moved(tbl text, row_id text)
+          WHERE existing.partition=$1
+            AND existing.tbl=moved.tbl
+            AND existing.row_id=moved.row_id`, [
+                p,
+                JSON.stringify([...liveAfterDelete].map((key) => {
+                    const at = key.indexOf('\u0000');
+                    return { tbl: key.slice(0, at), row_id: key.slice(at + 1) };
+                })),
+            ]);
+        }
         return commitSeq;
     }
     async putPushResult(clientId, clientCommitId, result) {

package/dist/push.d.ts

@@ -28,6 +28,20 @@ import type { StorageTransaction, StoredCommit } from './storage.js';
  * row-codec decode (§5.9.1), so `parseBlobRef` here is total.
  */
 export declare function blobIdsInRow(table: CompiledTable, values: readonly RowValue[]): string[];
+/**
+ * A server-authoritative scope move (§2.2). Commands emit it through
+ * `CommandMutation`; it is not an SSP2 wire operation, so a client cannot
+ * request one. Apply rewrites the stored row in place under the new scopes
+ * and emits the delete/upsert change pair in one commit.
+ */
+export interface RescopeOperation {
+    readonly table: string;
+    readonly rowId: string;
+    readonly op: 'rescope';
+    /** Full-row payload (the row's values under the new scopes). */
+    readonly payload: Uint8Array;
+}
+export type ApplyOperation = PushOperation | RescopeOperation;
 export interface ProcessedPushCommit {
     readonly frame: PushResultFrame;
     /** True when this request observed an already-recorded idempotency outcome. */
@@ -54,4 +68,4 @@ export declare function processPushCommitWithTrace(ctx: SyncRequestContext, sche
  * The builder runs after the partition lock and idempotency re-check, so its
  * reads and the returned operations share the transaction that is committed.
  */
-export declare function processPushOperationsWithTrace(ctx: SyncRequestContext, schema: CompiledSchema, resolved: ResolvedScopes, clientId: string, clientCommitId: string, buildOperations: (tx: StorageTransaction) => Promise<readonly PushOperation[]>, wireSchema?: CompiledSchema): Promise<ProcessedPushCommit>;
+export declare function processPushOperationsWithTrace(ctx: SyncRequestContext, schema: CompiledSchema, resolved: ResolvedScopes, clientId: string, clientCommitId: string, buildOperations: (tx: StorageTransaction) => Promise<readonly ApplyOperation[]>, wireSchema?: CompiledSchema): Promise<ProcessedPushCommit>;

package/dist/push.js

@@ -172,20 +172,149 @@ async function applyOperation(tx, schema, wireSchema, resolved, op, opIndex, blo
         return errorRecord(opIndex, 'sync.forbidden', 'scope resolution failed (§3.4 step 4)');
     }
     const stored = await tx.getRow(op.table, op.rowId);
-    if (op.op === 'delete') {
+    if (op.op === 'rescope') {
+        // §2.2 explicit scope move. One stored row changes its scope values;
+        // apply rewrites it in place, keeps `server_version`, and emits the
+        // delete under the old scopes plus the upsert under the new ones.
         if (stored === undefined) {
-            // Deleting an absent row is applied (idempotent, §6.2); no change.
-            return {
-                kind: 'applied',
-                change: undefined,
-                operation: {
+            return errorRecord(opIndex, 'sync.row_missing', 'rescope targets an absent row (§2.2)');
+        }
+        if (!authorizeWrite(table, stored.scopes, resolved)) {
+            return errorRecord(opIndex, 'sync.forbidden', 'rescope denied by scope authorization (§3.4)');
+        }
+        const missing = missingScopeVariable(table, stored.scopes);
+        if (missing !== undefined) {
+            return errorRecord(opIndex, 'sync.missing_scopes', `stored row lacks scope variable ${JSON.stringify(missing)} (§3.1)`);
+        }
+        let sparse;
+        try {
+            sparse = decodeSparseRow(wireTable.columns, wireTable.primaryKeyIndex, op.payload);
+        }
+        catch (error) {
+            return errorRecord(opIndex, 'sync.invalid_request', `rescope payload failed row-codec decode (§1.7): ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (sparse.length < table.columns.length ||
+            sparse.some((value) => value === undefined)) {
+            return errorRecord(opIndex, 'sync.invalid_request', 'rescope requires a full-row payload (§2.2)');
+        }
+        const values = sparse.map((value) => value ?? null);
+        const pkValue = renderScopeValue(values[table.primaryKeyIndex] ?? null);
+        if (pkValue !== op.rowId) {
+            return errorRecord(opIndex, 'sync.invalid_request', 'payload primary key does not match rowId');
+        }
+        const storedValues = decodeRow(table.columns, stored.payload);
+        const scopeIndexes = new Set(table.scopePatterns.map((pattern) => pattern.columnIndex));
+        const sameValue = (left, right) => {
+            if (left instanceof Uint8Array || right instanceof Uint8Array) {
+                return (left instanceof Uint8Array &&
+                    right instanceof Uint8Array &&
+                    left.length === right.length &&
+                    left.every((byte, index) => byte === right[index]));
+            }
+            return left === right;
+        };
+        for (let index = 0; index < table.columns.length; index++) {
+            if (index === table.primaryKeyIndex || scopeIndexes.has(index))
+                continue;
+            if (!sameValue(values[index] ?? null, storedValues[index] ?? null)) {
+                return errorRecord(opIndex, 'sync.invalid_request', 'rescope may change only scope columns (§2.2)');
+            }
+        }
+        const extracted = storedScopesForRow(table, values);
+        if ('missing' in extracted) {
+            return errorRecord(opIndex, 'sync.forbidden', `rescope missing scope column value for ${JSON.stringify(extracted.missing)} (§3.4)`);
+        }
+        if (!authorizeWrite(table, extracted.scopes, resolved)) {
+            return errorRecord(opIndex, 'sync.forbidden', 'rescope denied by scope authorization of the new scopes (§3.4)');
+        }
+        const deleteReject = await runValidator(validators, table, 'delete', op.rowId, undefined, storedValues, opIndex, tx, partition, actorId);
+        if (deleteReject !== undefined)
+            return deleteReject;
+        const upsertReject = await runValidator(validators, table, 'upsert', op.rowId, values, storedValues, opIndex, tx, partition, actorId);
+        if (upsertReject !== undefined)
+            return upsertReject;
+        const blobCheck = await checkAndRecordBlobs(tx, table, op.rowId, values, opIndex, blobCtx);
+        if (blobCheck !== undefined)
+            return blobCheck;
+        const payload = encodeRow(table.columns, values);
+        // The move clears any tombstone from an earlier incarnation: the row is
+        // live at the end of this commit, so the next move must not hit §5.2.
+        await tx.clearTombstone(op.table, op.rowId);
+        await tx.upsertRow(op.table, {
+            rowId: op.rowId,
+            serverVersion: stored.serverVersion,
+            scopes: extracted.scopes,
+            payload,
+            ...(stored.columnVersions !== undefined
+                ? { columnVersions: stored.columnVersions }
+                : {}),
+        }, { opIndex });
+        const storedRow = toValidateRow(table.columns, storedValues);
+        return {
+            kind: 'applied',
+            changes: [
+                {
+                    table: op.table,
+                    rowId: op.rowId,
+                    op: 'delete',
+                    scopes: stored.scopes,
+                },
+                {
+                    table: op.table,
+                    rowId: op.rowId,
+                    op: 'upsert',
+                    rowVersion: stored.serverVersion,
+                    scopes: extracted.scopes,
+                    payload,
+                },
+            ],
+            operations: [
+                {
                     opIndex,
                     op: 'delete',
                     table: table.name,
                     rowId: op.rowId,
                     row: undefined,
-                    stored: undefined,
+                    stored: storedRow,
+                    storedServerVersion: stored.serverVersion,
                 },
+                {
+                    opIndex,
+                    op: 'upsert',
+                    table: table.name,
+                    rowId: op.rowId,
+                    row: toValidateRow(table.columns, values),
+                    stored: storedRow,
+                    storedServerVersion: stored.serverVersion,
+                    nextServerVersion: stored.serverVersion,
+                },
+            ],
+            staged: {
+                table,
+                op: 'upsert',
+                rowId: op.rowId,
+                opIndex,
+                values,
+                stored,
+            },
+        };
+    }
+    if (op.op === 'delete') {
+        if (stored === undefined) {
+            // Deleting an absent row is applied (idempotent, §6.2); no change.
+            return {
+                kind: 'applied',
+                changes: [],
+                operations: [
+                    {
+                        opIndex,
+                        op: 'delete',
+                        table: table.name,
+                        rowId: op.rowId,
+                        row: undefined,
+                        stored: undefined,
+                    },
+                ],
                 staged: {
                     table,
                     op: 'delete',
@@ -212,21 +341,25 @@ async function applyOperation(tx, schema, wireSchema, resolved, op, opIndex, blo
         await tx.deleteRow(op.table, op.rowId);
         return {
             kind: 'applied',
-            change: {
-                table: op.table,
-                rowId: op.rowId,
-                op: 'delete',
-                scopes: stored.scopes,
-            },
-            operation: {
-                opIndex,
-                op: 'delete',
-                table: table.name,
-                rowId: op.rowId,
-                row: undefined,
-                stored: toValidateRow(table.columns, storedValues),
-                storedServerVersion: stored.serverVersion,
-            },
+            changes: [
+                {
+                    table: op.table,
+                    rowId: op.rowId,
+                    op: 'delete',
+                    scopes: stored.scopes,
+                },
+            ],
+            operations: [
+                {
+                    opIndex,
+                    op: 'delete',
+                    table: table.name,
+                    rowId: op.rowId,
+                    row: undefined,
+                    stored: toValidateRow(table.columns, storedValues),
+                    storedServerVersion: stored.serverVersion,
+                },
+            ],
             staged: { table, op: 'delete', rowId: op.rowId, opIndex, stored },
         };
     }
@@ -354,24 +487,28 @@ async function applyOperation(tx, schema, wireSchema, resolved, op, opIndex, blo
         await tx.upsertRow(op.table, newRow, { opIndex });
         return {
             kind: 'applied',
-            change: {
-                table: op.table,
-                rowId: op.rowId,
-                op: 'upsert',
-                rowVersion: newVersion,
-                scopes: stored.scopes,
-                payload: newPayload,
-            },
-            operation: {
-                opIndex,
-                op: 'upsert',
-                table: table.name,
-                rowId: op.rowId,
-                row: toValidateRow(table.columns, values),
-                stored: toValidateRow(table.columns, storedValues),
-                storedServerVersion: stored.serverVersion,
-                nextServerVersion: newVersion,
-            },
+            changes: [
+                {
+                    table: op.table,
+                    rowId: op.rowId,
+                    op: 'upsert',
+                    rowVersion: newVersion,
+                    scopes: stored.scopes,
+                    payload: newPayload,
+                },
+            ],
+            operations: [
+                {
+                    opIndex,
+                    op: 'upsert',
+                    table: table.name,
+                    rowId: op.rowId,
+                    row: toValidateRow(table.columns, values),
+                    stored: toValidateRow(table.columns, storedValues),
+                    storedServerVersion: stored.serverVersion,
+                    nextServerVersion: newVersion,
+                },
+            ],
             staged: { table, op: 'upsert', rowId: op.rowId, opIndex, values, stored },
         };
     }
@@ -440,23 +577,27 @@ async function applyOperation(tx, schema, wireSchema, resolved, op, opIndex, blo
     await tx.upsertRow(op.table, newRow, { opIndex });
     return {
         kind: 'applied',
-        change: {
-            table: op.table,
-            rowId: op.rowId,
-            op: 'upsert',
-            rowVersion: 1,
-            scopes: extracted.scopes,
-            payload: insertPayload,
-        },
-        operation: {
-            opIndex,
-            op: 'upsert',
-            table: table.name,
-            rowId: op.rowId,
-            row: toValidateRow(table.columns, values),
-            stored: undefined,
-            nextServerVersion: 1,
-        },
+        changes: [
+            {
+                table: op.table,
+                rowId: op.rowId,
+                op: 'upsert',
+                rowVersion: 1,
+                scopes: extracted.scopes,
+                payload: insertPayload,
+            },
+        ],
+        operations: [
+            {
+                opIndex,
+                op: 'upsert',
+                table: table.name,
+                rowId: op.rowId,
+                row: toValidateRow(table.columns, values),
+                stored: undefined,
+                nextServerVersion: 1,
+            },
+        ],
         staged: {
             table,
             op: 'upsert',
@@ -967,10 +1108,9 @@ export async function processPushOperationsWithTrace(ctx, schema, resolved, clie
                 break;
             }
             results.push({ opIndex, status: 'applied' });
-            validatedOperations.push(outcome.operation);
+            validatedOperations.push(...outcome.operations);
             stagedWrites.push(outcome.staged);
-            if (outcome.change !== undefined)
-                changes.push(outcome.change);
+            changes.push(...outcome.changes);
         }
         // §6.11: reference enforcement runs after every client operation is
         // staged (so the candidate state is final for the client's own writes)

package/dist/sqlite-storage.js

@@ -1,7 +1,7 @@
 import { retainRollbackFailure, rollbackAfterError } from './storage-errors.js';
 import { validateCommitPruneQuery } from './prune.js';
 import { StorageQueryError } from './storage-errors.js';
-import { clientRoundState, PARTITION_TOUCH_INTERVAL_MS, serveGateRefusal, } from './storage.js';
+import { clientRoundState, PARTITION_TOUCH_INTERVAL_MS, rowsLiveAfterDelete, serveGateRefusal, } from './storage.js';
 import { serveNotReadyError } from './readiness.js';
 /**
  * SQLite server storage over the shared synchronous driver.
@@ -186,11 +186,14 @@ class SqliteTransaction {
         const commitSeq = (row?.max_commit_seq ?? 0) + 1;
         db.query('UPDATE sync_partitions SET max_commit_seq=? WHERE partition=?').run(commitSeq, p);
         db.query('INSERT INTO sync_commits(partition, commit_seq, client_id, client_commit_id, actor_id, created_at_ms, writer_version) VALUES (?,?,?,?,?,?,?)').run(p, commitSeq, commit.clientId, commit.clientCommitId, commit.actorId, commit.createdAtMs, this.#writerVersion);
+        const liveAfterDelete = rowsLiveAfterDelete(commit.changes);
         commit.changes.forEach((change, idx) => {
             db.query('INSERT INTO sync_changes(partition, commit_seq, idx, tbl, row_id, op, row_version, scopes, payload) VALUES (?,?,?,?,?,?,?,?,?)').run(p, commitSeq, idx, change.table, change.rowId, change.op === 'upsert' ? 1 : 2, change.rowVersion ?? null, JSON.stringify(change.scopes), change.payload ?? null);
-            if (change.op === 'delete') {
+            if (change.op === 'delete' &&
+                !liveAfterDelete.has(`${change.table}\u0000${change.rowId}`)) {
                 // §5 delete precedence: every applied delete leaves a tombstone,
-                // pruned with the commit log (§4.6).
+                // pruned with the commit log (§4.6). A delete that the same commit
+                // follows with an upsert is a §2.2 scope move, not a deletion.
                 db.query(`INSERT INTO sync_tombstones(partition, tbl, row_id, commit_seq) VALUES (?,?,?,?)
            ON CONFLICT(partition, tbl, row_id) DO UPDATE SET commit_seq=excluded.commit_seq`).run(p, change.table, change.rowId, commitSeq);
             }

package/dist/storage.d.ts

@@ -128,6 +128,13 @@ export interface NewCommit {
     readonly createdAtMs: number;
     readonly changes: readonly NewChange[];
 }
+/**
+ * §2.2: rows whose final change in this commit is an upsert that followed a
+ * delete. That delete is one half of a scope move, so it MUST NOT leave a
+ * tombstone behind the live row. A row whose final change is a delete keeps
+ * its tombstone.
+ */
+export declare function rowsLiveAfterDelete(changes: readonly NewChange[]): Set<string>;
 export interface StoredChange {
     readonly table: string;
     readonly rowId: string;

package/dist/storage.js

@@ -38,6 +38,32 @@ export function serveGateTokenChanged(before, after) {
     }
     return undefined;
 }
+/**
+ * §2.2: rows whose final change in this commit is an upsert that followed a
+ * delete. That delete is one half of a scope move, so it MUST NOT leave a
+ * tombstone behind the live row. A row whose final change is a delete keeps
+ * its tombstone.
+ */
+export function rowsLiveAfterDelete(changes) {
+    const last = new Map();
+    const deleted = new Set();
+    const live = new Set();
+    for (const change of changes) {
+        const key = `${change.table}\u0000${change.rowId}`;
+        if (change.op === 'delete') {
+            deleted.add(key);
+        }
+        else if (deleted.has(key)) {
+            live.add(key);
+        }
+        last.set(key, change.op);
+    }
+    for (const key of live) {
+        if (last.get(key) !== 'upsert')
+            live.delete(key);
+    }
+    return live;
+}
 /** The round-state fields of a stored `sync_clients` row. */
 export function clientRoundState(lastRoundAtMs, lastErrorCode, consecutiveFailures) {
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/server",
-  "version": "0.42.2",
+  "version": "0.43.0",
   "description": "Syncular server: handleSyncRequest + storage/auth interfaces for the sync protocol",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -68,7 +68,7 @@
     "verify:node": "cd ../.. && bun build ./packages/server/test/sqlite-runtime/verify-node.mjs --target=node --conditions=bun --outfile=./packages/server/.verify-node.built.mjs && node ./packages/server/.verify-node.built.mjs"
   },
   "dependencies": {
-    "@syncular/core": "0.42.2"
+    "@syncular/core": "0.43.0"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.4"

package/src/d1-storage.ts

@@ -1,7 +1,11 @@
 import { validateCommitPruneQuery } from './prune';
 import { StorageQueryError } from './storage-errors';
 import type { CommitPruneQuery, CommitPruneResult } from './storage';
-import { clientRoundState, PARTITION_TOUCH_INTERVAL_MS } from './storage';
+import {
+  clientRoundState,
+  PARTITION_TOUCH_INTERVAL_MS,
+  rowsLiveAfterDelete,
+} from './storage';
 /**
  * Cloudflare D1 server storage for Workers deployments.
  *
@@ -790,6 +794,7 @@ class D1Transaction implements StorageTransaction {
         commit.createdAtMs,
       ],
     );
+    const liveAfterDelete = rowsLiveAfterDelete(commit.changes);
     commit.changes.forEach((change, idx) => {
       this.#buffer_(
         'INSERT INTO sync_changes(partition, commit_seq, idx, tbl, row_id, op, row_version, scopes, payload) VALUES (?,?,?,?,?,?,?,?,?)',
@@ -805,9 +810,13 @@ class D1Transaction implements StorageTransaction {
           change.payload ?? null,
         ],
       );
-      if (change.op === 'delete') {
+      if (
+        change.op === 'delete' &&
+        !liveAfterDelete.has(`${change.table}\u0000${change.rowId}`)
+      ) {
         // §5 delete precedence: every applied delete leaves a tombstone,
-        // pruned with the commit log (§4.6).
+        // pruned with the commit log (§4.6). A delete that the same commit
+        // follows with an upsert is a §2.2 scope move, not a deletion.
         this.#buffer_(
           `INSERT INTO sync_tombstones(partition, tbl, row_id, commit_seq) VALUES (?,?,?,?)
            ON CONFLICT(partition, tbl, row_id) DO UPDATE SET commit_seq=excluded.commit_seq`,

package/src/operations.ts

@@ -7,7 +7,6 @@ import {
   decodeRemoteOperationRequest,
   encodeRemoteOperationResponse,
   encodeSparseRow,
-  type PushOperation,
   type RemoteOperationRequest,
   type RemoteOperationResponse,
   type RowValue,
@@ -20,7 +19,7 @@ import {
   touchAuthenticatedPartition,
 } from './context';
 import { reportError, SyncError, syncError } from './errors';
-import { processPushOperationsWithTrace } from './push';
+import { processPushOperationsWithTrace, type ApplyOperation } from './push';
 import { compileSchema } from './schema';
 import {
   authorizeWrite,
@@ -108,6 +107,12 @@ export type CommandMutation =
       readonly op: 'upsert';
       readonly values: Readonly<Record<string, RowValue>>;
     }
+  | {
+      readonly table: string;
+      readonly op: 'rescope';
+      /** Full row; only its scope columns may differ from the stored row. */
+      readonly values: Readonly<Record<string, RowValue>>;
+    }
   | {
       readonly table: string;
       readonly op: 'delete';
@@ -501,7 +506,7 @@ export function remoteCommand<Input = undefined>(
 function commandOperations(
   mutations: readonly CommandMutation[],
   schema: ReturnType<typeof compileSchema>,
-): PushOperation[] {
+): ApplyOperation[] {
   if (mutations.length === 0) {
     throw syncError(
       'operation.invalid_request',
@@ -530,7 +535,7 @@ function commandOperations(
       if (!table.columnIndex.has(name)) {
         throw syncError(
           'operation.invalid_request',
-          'command upsert has an unknown column',
+          'command upsert or rescope has an unknown column',
         );
       }
     }
@@ -538,7 +543,7 @@ function commandOperations(
       if (!supplied.has(column.name)) {
         throw syncError(
           'operation.invalid_request',
-          'command upsert must provide a full row',
+          'command upsert or rescope must provide a full row',
         );
       }
       return mutation.values[column.name] ?? null;
@@ -547,13 +552,13 @@ function commandOperations(
     if (rowId === undefined) {
       throw syncError(
         'operation.invalid_request',
-        'command upsert requires a non-empty primary key',
+        'command upsert or rescope requires a non-empty primary key',
       );
     }
     return {
       table: table.name,
       rowId,
-      op: 'upsert',
+      op: mutation.op,
       payload: encodeSparseRow(table.columns, table.primaryKeyIndex, values),
     };
   });

package/src/postgres-storage.ts

@@ -4,6 +4,7 @@ import type { CommitPruneQuery, CommitPruneResult } from './storage';
 import {
   clientRoundState,
   PARTITION_TOUCH_INTERVAL_MS,
+  rowsLiveAfterDelete,
   serveGateRefusal,
 } from './storage';
 import { serveNotReadyError } from './readiness';
@@ -1402,6 +1403,27 @@ class PostgresTransaction implements StorageTransaction {
         params,
       );
     }
+    // §2.2: a delete whose commit follows it with an upsert is a scope move.
+    // The row is live, so no tombstone may remain for it.
+    const liveAfterDelete = rowsLiveAfterDelete(commit.changes);
+    if (liveAfterDelete.size > 0) {
+      await q.query(
+        `DELETE FROM sync_tombstones existing
+          USING jsonb_to_recordset($2::text::jsonb) AS moved(tbl text, row_id text)
+          WHERE existing.partition=$1
+            AND existing.tbl=moved.tbl
+            AND existing.row_id=moved.row_id`,
+        [
+          p,
+          JSON.stringify(
+            [...liveAfterDelete].map((key) => {
+              const at = key.indexOf('\u0000');
+              return { tbl: key.slice(0, at), row_id: key.slice(at + 1) };
+            }),
+          ),
+        ],
+      );
+    }
     return commitSeq;
   }
 

package/src/push.ts

@@ -108,12 +108,28 @@ type TerminatingOutcome = {
 type OperationOutcome =
   | {
       readonly kind: 'applied';
-      readonly change: NewChange | undefined;
-      readonly operation: ValidateCommitOperation;
+      readonly changes: readonly NewChange[];
+      readonly operations: readonly ValidateCommitOperation[];
       readonly staged: StagedWrite;
     }
   | TerminatingOutcome;
 
+/**
+ * A server-authoritative scope move (§2.2). Commands emit it through
+ * `CommandMutation`; it is not an SSP2 wire operation, so a client cannot
+ * request one. Apply rewrites the stored row in place under the new scopes
+ * and emits the delete/upsert change pair in one commit.
+ */
+export interface RescopeOperation {
+  readonly table: string;
+  readonly rowId: string;
+  readonly op: 'rescope';
+  /** Full-row payload (the row's values under the new scopes). */
+  readonly payload: Uint8Array;
+}
+
+export type ApplyOperation = PushOperation | RescopeOperation;
+
 function errorRecord(
   opIndex: number,
   code: string,
@@ -296,7 +312,7 @@ async function applyOperation(
   schema: CompiledSchema,
   wireSchema: CompiledSchema,
   resolved: ResolvedScopes,
-  op: PushOperation,
+  op: ApplyOperation,
   opIndex: number,
   blobCtx: BlobApplyContext,
   crdtMergers: CrdtMergerRegistry | undefined,
@@ -322,20 +338,224 @@ async function applyOperation(
   }
   const stored = await tx.getRow(op.table, op.rowId);
 
-  if (op.op === 'delete') {
+  if (op.op === 'rescope') {
+    // §2.2 explicit scope move. One stored row changes its scope values;
+    // apply rewrites it in place, keeps `server_version`, and emits the
+    // delete under the old scopes plus the upsert under the new ones.
     if (stored === undefined) {
-      // Deleting an absent row is applied (idempotent, §6.2); no change.
-      return {
-        kind: 'applied',
-        change: undefined,
-        operation: {
+      return errorRecord(
+        opIndex,
+        'sync.row_missing',
+        'rescope targets an absent row (§2.2)',
+      );
+    }
+    if (!authorizeWrite(table, stored.scopes, resolved)) {
+      return errorRecord(
+        opIndex,
+        'sync.forbidden',
+        'rescope denied by scope authorization (§3.4)',
+      );
+    }
+    const missing = missingScopeVariable(table, stored.scopes);
+    if (missing !== undefined) {
+      return errorRecord(
+        opIndex,
+        'sync.missing_scopes',
+        `stored row lacks scope variable ${JSON.stringify(missing)} (§3.1)`,
+      );
+    }
+    let sparse: SparseRowValue[];
+    try {
+      sparse = decodeSparseRow(
+        wireTable.columns,
+        wireTable.primaryKeyIndex,
+        op.payload,
+      );
+    } catch (error) {
+      return errorRecord(
+        opIndex,
+        'sync.invalid_request',
+        `rescope payload failed row-codec decode (§1.7): ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+    if (
+      sparse.length < table.columns.length ||
+      sparse.some((value) => value === undefined)
+    ) {
+      return errorRecord(
+        opIndex,
+        'sync.invalid_request',
+        'rescope requires a full-row payload (§2.2)',
+      );
+    }
+    const values: RowValue[] = sparse.map((value) => value ?? null);
+    const pkValue = renderScopeValue(values[table.primaryKeyIndex] ?? null);
+    if (pkValue !== op.rowId) {
+      return errorRecord(
+        opIndex,
+        'sync.invalid_request',
+        'payload primary key does not match rowId',
+      );
+    }
+    const storedValues = decodeRow(table.columns, stored.payload);
+    const scopeIndexes = new Set(
+      table.scopePatterns.map((pattern) => pattern.columnIndex),
+    );
+    const sameValue = (left: RowValue, right: RowValue): boolean => {
+      if (left instanceof Uint8Array || right instanceof Uint8Array) {
+        return (
+          left instanceof Uint8Array &&
+          right instanceof Uint8Array &&
+          left.length === right.length &&
+          left.every((byte, index) => byte === right[index])
+        );
+      }
+      return left === right;
+    };
+    for (let index = 0; index < table.columns.length; index++) {
+      if (index === table.primaryKeyIndex || scopeIndexes.has(index)) continue;
+      if (!sameValue(values[index] ?? null, storedValues[index] ?? null)) {
+        return errorRecord(
+          opIndex,
+          'sync.invalid_request',
+          'rescope may change only scope columns (§2.2)',
+        );
+      }
+    }
+    const extracted = storedScopesForRow(table, values);
+    if ('missing' in extracted) {
+      return errorRecord(
+        opIndex,
+        'sync.forbidden',
+        `rescope missing scope column value for ${JSON.stringify(extracted.missing)} (§3.4)`,
+      );
+    }
+    if (!authorizeWrite(table, extracted.scopes, resolved)) {
+      return errorRecord(
+        opIndex,
+        'sync.forbidden',
+        'rescope denied by scope authorization of the new scopes (§3.4)',
+      );
+    }
+    const deleteReject = await runValidator(
+      validators,
+      table,
+      'delete',
+      op.rowId,
+      undefined,
+      storedValues,
+      opIndex,
+      tx,
+      partition,
+      actorId,
+    );
+    if (deleteReject !== undefined) return deleteReject;
+    const upsertReject = await runValidator(
+      validators,
+      table,
+      'upsert',
+      op.rowId,
+      values,
+      storedValues,
+      opIndex,
+      tx,
+      partition,
+      actorId,
+    );
+    if (upsertReject !== undefined) return upsertReject;
+    const blobCheck = await checkAndRecordBlobs(
+      tx,
+      table,
+      op.rowId,
+      values,
+      opIndex,
+      blobCtx,
+    );
+    if (blobCheck !== undefined) return blobCheck;
+    const payload = encodeRow(table.columns, values);
+    // The move clears any tombstone from an earlier incarnation: the row is
+    // live at the end of this commit, so the next move must not hit §5.2.
+    await tx.clearTombstone(op.table, op.rowId);
+    await tx.upsertRow(
+      op.table,
+      {
+        rowId: op.rowId,
+        serverVersion: stored.serverVersion,
+        scopes: extracted.scopes,
+        payload,
+        ...(stored.columnVersions !== undefined
+          ? { columnVersions: stored.columnVersions }
+          : {}),
+      },
+      { opIndex },
+    );
+    const storedRow = toValidateRow(table.columns, storedValues);
+    return {
+      kind: 'applied',
+      changes: [
+        {
+          table: op.table,
+          rowId: op.rowId,
+          op: 'delete',
+          scopes: stored.scopes,
+        },
+        {
+          table: op.table,
+          rowId: op.rowId,
+          op: 'upsert',
+          rowVersion: stored.serverVersion,
+          scopes: extracted.scopes,
+          payload,
+        },
+      ],
+      operations: [
+        {
           opIndex,
           op: 'delete',
           table: table.name,
           rowId: op.rowId,
           row: undefined,
-          stored: undefined,
+          stored: storedRow,
+          storedServerVersion: stored.serverVersion,
+        },
+        {
+          opIndex,
+          op: 'upsert',
+          table: table.name,
+          rowId: op.rowId,
+          row: toValidateRow(table.columns, values),
+          stored: storedRow,
+          storedServerVersion: stored.serverVersion,
+          nextServerVersion: stored.serverVersion,
         },
+      ],
+      staged: {
+        table,
+        op: 'upsert',
+        rowId: op.rowId,
+        opIndex,
+        values,
+        stored,
+      },
+    };
+  }
+
+  if (op.op === 'delete') {
+    if (stored === undefined) {
+      // Deleting an absent row is applied (idempotent, §6.2); no change.
+      return {
+        kind: 'applied',
+        changes: [],
+        operations: [
+          {
+            opIndex,
+            op: 'delete',
+            table: table.name,
+            rowId: op.rowId,
+            row: undefined,
+            stored: undefined,
+          },
+        ],
         staged: {
           table,
           op: 'delete',
@@ -380,21 +600,25 @@ async function applyOperation(
     await tx.deleteRow(op.table, op.rowId);
     return {
       kind: 'applied',
-      change: {
-        table: op.table,
-        rowId: op.rowId,
-        op: 'delete',
-        scopes: stored.scopes,
-      },
-      operation: {
-        opIndex,
-        op: 'delete',
-        table: table.name,
-        rowId: op.rowId,
-        row: undefined,
-        stored: toValidateRow(table.columns, storedValues),
-        storedServerVersion: stored.serverVersion,
-      },
+      changes: [
+        {
+          table: op.table,
+          rowId: op.rowId,
+          op: 'delete',
+          scopes: stored.scopes,
+        },
+      ],
+      operations: [
+        {
+          opIndex,
+          op: 'delete',
+          table: table.name,
+          rowId: op.rowId,
+          row: undefined,
+          stored: toValidateRow(table.columns, storedValues),
+          storedServerVersion: stored.serverVersion,
+        },
+      ],
       staged: { table, op: 'delete', rowId: op.rowId, opIndex, stored },
     };
   }
@@ -586,24 +810,28 @@ async function applyOperation(
     await tx.upsertRow(op.table, newRow, { opIndex });
     return {
       kind: 'applied',
-      change: {
-        table: op.table,
-        rowId: op.rowId,
-        op: 'upsert',
-        rowVersion: newVersion,
-        scopes: stored.scopes,
-        payload: newPayload,
-      },
-      operation: {
-        opIndex,
-        op: 'upsert',
-        table: table.name,
-        rowId: op.rowId,
-        row: toValidateRow(table.columns, values),
-        stored: toValidateRow(table.columns, storedValues),
-        storedServerVersion: stored.serverVersion,
-        nextServerVersion: newVersion,
-      },
+      changes: [
+        {
+          table: op.table,
+          rowId: op.rowId,
+          op: 'upsert',
+          rowVersion: newVersion,
+          scopes: stored.scopes,
+          payload: newPayload,
+        },
+      ],
+      operations: [
+        {
+          opIndex,
+          op: 'upsert',
+          table: table.name,
+          rowId: op.rowId,
+          row: toValidateRow(table.columns, values),
+          stored: toValidateRow(table.columns, storedValues),
+          storedServerVersion: stored.serverVersion,
+          nextServerVersion: newVersion,
+        },
+      ],
       staged: { table, op: 'upsert', rowId: op.rowId, opIndex, values, stored },
     };
   }
@@ -721,23 +949,27 @@ async function applyOperation(
   await tx.upsertRow(op.table, newRow, { opIndex });
   return {
     kind: 'applied',
-    change: {
-      table: op.table,
-      rowId: op.rowId,
-      op: 'upsert',
-      rowVersion: 1,
-      scopes: extracted.scopes,
-      payload: insertPayload,
-    },
-    operation: {
-      opIndex,
-      op: 'upsert',
-      table: table.name,
-      rowId: op.rowId,
-      row: toValidateRow(table.columns, values),
-      stored: undefined,
-      nextServerVersion: 1,
-    },
+    changes: [
+      {
+        table: op.table,
+        rowId: op.rowId,
+        op: 'upsert',
+        rowVersion: 1,
+        scopes: extracted.scopes,
+        payload: insertPayload,
+      },
+    ],
+    operations: [
+      {
+        opIndex,
+        op: 'upsert',
+        table: table.name,
+        rowId: op.rowId,
+        row: toValidateRow(table.columns, values),
+        stored: undefined,
+        nextServerVersion: 1,
+      },
+    ],
     staged: {
       table,
       op: 'upsert',
@@ -1366,7 +1598,7 @@ export async function processPushOperationsWithTrace(
   clientCommitId: string,
   buildOperations: (
     tx: StorageTransaction,
-  ) => Promise<readonly PushOperation[]>,
+  ) => Promise<readonly ApplyOperation[]>,
   wireSchema: CompiledSchema = schema,
 ): Promise<ProcessedPushCommit> {
   const { storage, partition } = ctx;
@@ -1495,9 +1727,9 @@ export async function processPushOperationsWithTrace(
         break;
       }
       results.push({ opIndex, status: 'applied' });
-      validatedOperations.push(outcome.operation);
+      validatedOperations.push(...outcome.operations);
       stagedWrites.push(outcome.staged);
-      if (outcome.change !== undefined) changes.push(outcome.change);
+      changes.push(...outcome.changes);
     }
 
     // §6.11: reference enforcement runs after every client operation is

package/src/sqlite-storage.ts

@@ -5,6 +5,7 @@ import type { CommitPruneQuery, CommitPruneResult } from './storage';
 import {
   clientRoundState,
   PARTITION_TOUCH_INTERVAL_MS,
+  rowsLiveAfterDelete,
   serveGateRefusal,
 } from './storage';
 import { serveNotReadyError } from './readiness';
@@ -414,6 +415,7 @@ class SqliteTransaction implements StorageTransaction {
       commit.createdAtMs,
       this.#writerVersion,
     );
+    const liveAfterDelete = rowsLiveAfterDelete(commit.changes);
     commit.changes.forEach((change, idx) => {
       db.query(
         'INSERT INTO sync_changes(partition, commit_seq, idx, tbl, row_id, op, row_version, scopes, payload) VALUES (?,?,?,?,?,?,?,?,?)',
@@ -428,9 +430,13 @@ class SqliteTransaction implements StorageTransaction {
         JSON.stringify(change.scopes),
         change.payload ?? null,
       );
-      if (change.op === 'delete') {
+      if (
+        change.op === 'delete' &&
+        !liveAfterDelete.has(`${change.table}\u0000${change.rowId}`)
+      ) {
         // §5 delete precedence: every applied delete leaves a tombstone,
-        // pruned with the commit log (§4.6).
+        // pruned with the commit log (§4.6). A delete that the same commit
+        // follows with an upsert is a §2.2 scope move, not a deletion.
         db.query(
           `INSERT INTO sync_tombstones(partition, tbl, row_id, commit_seq) VALUES (?,?,?,?)
            ON CONFLICT(partition, tbl, row_id) DO UPDATE SET commit_seq=excluded.commit_seq`,

package/src/storage.ts

@@ -182,6 +182,33 @@ export interface NewCommit {
   readonly changes: readonly NewChange[];
 }
 
+/**
+ * §2.2: rows whose final change in this commit is an upsert that followed a
+ * delete. That delete is one half of a scope move, so it MUST NOT leave a
+ * tombstone behind the live row. A row whose final change is a delete keeps
+ * its tombstone.
+ */
+export function rowsLiveAfterDelete(
+  changes: readonly NewChange[],
+): Set<string> {
+  const last = new Map<string, NewChange['op']>();
+  const deleted = new Set<string>();
+  const live = new Set<string>();
+  for (const change of changes) {
+    const key = `${change.table}\u0000${change.rowId}`;
+    if (change.op === 'delete') {
+      deleted.add(key);
+    } else if (deleted.has(key)) {
+      live.add(key);
+    }
+    last.set(key, change.op);
+  }
+  for (const key of live) {
+    if (last.get(key) !== 'upsert') live.delete(key);
+  }
+  return live;
+}
+
 export interface StoredChange {
   readonly table: string;
   readonly rowId: string;