@syncular/client 0.1.2 → 0.2.0

package/dist/multi-tab.js

@@ -0,0 +1,399 @@
+/**
+ * Multi-tab followers (TODO 3.2, REVISE B3): one core per origin, N tabs.
+ *
+ * The leader tab holds the Web Locks lease and runs the worker core (the
+ * existing worker-host path, unchanged). Every OTHER tab is a FOLLOWER: it
+ * loses the lock election and, instead of a dead not-leader handle, opens a
+ * BroadcastChannel to the leader and proxies the whole logical API over it —
+ * one sync loop, one WebSocket, one DB, N tabs.
+ *
+ * Wire (all messages structured-clone-safe; `Set`/`Uint8Array`/`ArrayBuffer`
+ * survive `postMessage` on a BroadcastChannel):
+ *
+ *   follower → leader
+ *     hello  {t,epoch?,fromId}                — "who's the leader?" on join
+ *     req    {t,epoch,fromId,reqId,method,args}
+ *     bye    {t,fromId}                        — follower leaving (best effort)
+ *   leader → all
+ *     announce {t,epoch,clientId}             — "I am the leader, this epoch"
+ *     res      {t,epoch,reqId,ok,value|error} — reply to one req
+ *     event    {t,epoch,event}                — fan-out (invalidate/presence/…)
+ *
+ * Epoch (leader generation token): a monotonic counter carried in a shared
+ * BroadcastChannel and bumped by every promotion. Followers stamp requests
+ * with the epoch they last heard in an `announce`; a leader ignores requests
+ * from a stale epoch, and a follower discards any `res`/`event` that does not
+ * match its current epoch — so a late reply from a tab that has since died
+ * (or a duplicate from a previous leader) can never be mistaken for a live
+ * one. Epoch is derived deterministically from a per-origin clock: each
+ * promoter reads the highest epoch it has seen and adds one, so successive
+ * leaders always strictly increase it even across the lock-handover gap.
+ *
+ * Presence identity: all tabs share the leader's one connection, so a device
+ * is exactly ONE presence peer collectively — `(actorId, leaderClientId)`.
+ * A follower's `setPresence` forwards to the leader's single publisher; there
+ * is no per-tab presence peer (documented in the web-client README).
+ */
+import { ClientSyncError } from './errors.js';
+import { WORKER_FAILED_CODE } from './worker-protocol.js';
+/** Client-local: a follower call could not reach a leader before its deadline. */
+export const FOLLOWER_TIMEOUT_CODE = 'client.follower_timeout';
+/** Default deadline for a follower request (covers a leader-handover gap). */
+export const DEFAULT_FOLLOWER_CALL_TIMEOUT_MS = 10_000;
+/** Max follower calls queued across a handover before we fail loudly. */
+export const DEFAULT_FOLLOWER_QUEUE_LIMIT = 256;
+/** Default channel factory: a real `BroadcastChannel` named per lock. */
+export function broadcastChannelFactory() {
+    return (name) => new BroadcastChannel(name);
+}
+/** The channel name a leader and its followers rendezvous on. */
+export function multiTabChannelName(lockName) {
+    return `syncular-mt:${lockName}`;
+}
+let uniqueCounter = 0;
+/** A per-tab identity for addressing (not a presence identity). */
+export function newTabId() {
+    const rand = typeof crypto !== 'undefined' && crypto.randomUUID !== undefined
+        ? crypto.randomUUID()
+        : `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+    return `tab-${rand}-${(uniqueCounter++).toString(36)}`;
+}
+// ---------------------------------------------------------------------------
+// Leader side: bridge follower requests into the worker, fan-out events
+// ---------------------------------------------------------------------------
+/**
+ * Runs on the leader tab. Announces leadership, answers follower `req`s by
+ * invoking the (already-running) worker via `invoke`, and rebroadcasts every
+ * worker event to followers. Owns nothing about the worker lifecycle — the
+ * worker-host stays the single core owner; this is a relay.
+ */
+export class LeaderBridge {
+    #channel;
+    #epoch;
+    #clientId;
+    #invoke;
+    #onMessage;
+    #closed = false;
+    constructor(options) {
+        this.#channel = options.channel;
+        this.#epoch = options.epoch;
+        this.#clientId = options.clientId;
+        this.#invoke = options.invoke;
+        this.#onMessage = (event) => this.#handle(event.data);
+        this.#channel.addEventListener('message', this.#onMessage);
+        this.announce();
+    }
+    /** Re-announce leadership (on promotion and on a follower `hello`). */
+    announce() {
+        if (this.#closed)
+            return;
+        this.#channel.postMessage({
+            t: 'announce',
+            epoch: this.#epoch,
+            clientId: this.#clientId,
+        });
+    }
+    /** Fan a worker event out to all followers on the current epoch. */
+    broadcastEvent(event) {
+        if (this.#closed)
+            return;
+        this.#channel.postMessage({ t: 'event', epoch: this.#epoch, event });
+    }
+    #handle(message) {
+        if (this.#closed)
+            return;
+        if (message.t === 'hello') {
+            // A follower joined (or is contesting) — tell it who leads.
+            this.announce();
+            return;
+        }
+        if (message.t !== 'req')
+            return;
+        // Ignore requests stamped for a different (dead/older) leader; that
+        // follower will re-stamp once it sees our announce.
+        if (message.epoch !== this.#epoch)
+            return;
+        const { reqId, method, args } = message;
+        this.#invoke(method, args).then((value) => {
+            this.#channel.postMessage({
+                t: 'res',
+                epoch: this.#epoch,
+                reqId,
+                ok: true,
+                value,
+            });
+        }, (error) => {
+            const shape = error instanceof ClientSyncError
+                ? {
+                    code: error.code,
+                    message: error.message,
+                    retryable: error.retryable,
+                }
+                : {
+                    code: WORKER_FAILED_CODE,
+                    message: error instanceof Error ? error.message : 'unknown error',
+                    retryable: false,
+                };
+            this.#channel.postMessage({
+                t: 'res',
+                epoch: this.#epoch,
+                reqId,
+                ok: false,
+                error: shape,
+            });
+        });
+    }
+    close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#channel.removeEventListener('message', this.#onMessage);
+    }
+}
+/**
+ * Runs on a follower tab. Sends `req`s to the leader and settles them on the
+ * matching `res`; queues calls (bounded, timed) while no leader is bound (the
+ * handover gap) and flushes them once an `announce` binds a new leader.
+ * Feeds fanned-out events to `onEvent`. Learns leadership changes and hands
+ * the resolved leader `clientId` back through `onLeaderChange`.
+ */
+export class FollowerLink {
+    #channel;
+    #fromId;
+    #onEvent;
+    #onLeaderChange;
+    #callTimeoutMs;
+    #queueLimit;
+    #onMessage;
+    /** -1 until the first `announce` binds us to a leader. */
+    #epoch = -1;
+    /** Highest epoch ever seen (survives a leader gap for monotonic promotion). */
+    #maxEpochSeen = -1;
+    #leaderClientId = '';
+    #nextReqId = 1;
+    #inFlight = new Map();
+    #queue = [];
+    #closed = false;
+    /** Resolvers waiting for the first `announce` to bind a leader. */
+    #bindWaiters = [];
+    constructor(options) {
+        this.#channel = options.channel;
+        this.#fromId = options.fromId;
+        this.#onEvent = options.onEvent;
+        this.#onLeaderChange = options.onLeaderChange;
+        this.#callTimeoutMs =
+            options.callTimeoutMs ?? DEFAULT_FOLLOWER_CALL_TIMEOUT_MS;
+        this.#queueLimit = options.queueLimit ?? DEFAULT_FOLLOWER_QUEUE_LIMIT;
+        this.#onMessage = (event) => this.#handle(event.data);
+        this.#channel.addEventListener('message', this.#onMessage);
+        // Ask the current leader to announce itself.
+        this.#channel.postMessage({ t: 'hello', fromId: this.#fromId });
+    }
+    get epoch() {
+        return this.#epoch;
+    }
+    get maxEpochSeen() {
+        return this.#maxEpochSeen;
+    }
+    get leaderClientId() {
+        return this.#leaderClientId;
+    }
+    /** Whether a leader is currently bound (an announce has been heard). */
+    get bound() {
+        return this.#epoch >= 0;
+    }
+    /**
+     * Resolve once the link is bound to a leader (the first `announce` arrived),
+     * or reject if `timeoutMs` elapses first. A caller awaits this before
+     * treating the follower as ready: until an announce is processed the link's
+     * epoch is -1, so any fanned-out `event` in that window is dropped (an
+     * unbound follower cannot match the leader's epoch). Awaiting binding closes
+     * that gap — a just-opened follower tab never misses an invalidation emitted
+     * between its `hello` and the leader's `announce`. Resolves synchronously
+     * when already bound.
+     */
+    waitUntilBound(timeoutMs = this.#callTimeoutMs) {
+        if (this.#epoch >= 0)
+            return Promise.resolve();
+        if (this.#closed) {
+            return Promise.reject(new ClientSyncError(WORKER_FAILED_CODE, 'the follower link is closed'));
+        }
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.#dropBindWaiter(settle);
+                reject(new ClientSyncError(FOLLOWER_TIMEOUT_CODE, 'no leader announced within the follower bind timeout'));
+            }, timeoutMs);
+            const settle = () => {
+                clearTimeout(timer);
+                resolve();
+            };
+            this.#bindWaiters.push(settle);
+        });
+    }
+    #dropBindWaiter(waiter) {
+        const index = this.#bindWaiters.indexOf(waiter);
+        if (index >= 0)
+            this.#bindWaiters.splice(index, 1);
+    }
+    #resolveBindWaiters() {
+        if (this.#bindWaiters.length === 0)
+            return;
+        const waiters = this.#bindWaiters;
+        this.#bindWaiters = [];
+        for (const settle of waiters)
+            settle();
+    }
+    /** Forward one logical API call to the leader (queued if unbound). */
+    call(method, args) {
+        if (this.#closed) {
+            return Promise.reject(new ClientSyncError(WORKER_FAILED_CODE, 'the follower link is closed'));
+        }
+        return new Promise((resolve, reject) => {
+            const queued = {
+                method,
+                args,
+                resolve,
+                reject,
+                timer: undefined,
+            };
+            if (this.#epoch < 0) {
+                // No leader bound yet — queue with a deadline so we never hang.
+                if (this.#queue.length >= this.#queueLimit) {
+                    reject(new ClientSyncError(FOLLOWER_TIMEOUT_CODE, 'follower call queue overflow while awaiting a leader'));
+                    return;
+                }
+                queued.timer = setTimeout(() => {
+                    this.#dropQueued(queued);
+                    reject(new ClientSyncError(FOLLOWER_TIMEOUT_CODE, 'no leader answered within the follower call timeout'));
+                }, this.#callTimeoutMs);
+                this.#queue.push(queued);
+                return;
+            }
+            this.#send(queued);
+        });
+    }
+    #send(queued) {
+        const reqId = this.#nextReqId++;
+        const inflight = {
+            resolve: queued.resolve,
+            reject: queued.reject,
+            timer: setTimeout(() => {
+                this.#inFlight.delete(reqId);
+                queued.reject(new ClientSyncError(FOLLOWER_TIMEOUT_CODE, 'the leader did not answer within the follower call timeout'));
+            }, this.#callTimeoutMs),
+        };
+        this.#inFlight.set(reqId, inflight);
+        this.#channel.postMessage({
+            t: 'req',
+            epoch: this.#epoch,
+            fromId: this.#fromId,
+            reqId,
+            method: queued.method,
+            args: queued.args,
+        });
+    }
+    #dropQueued(queued) {
+        const index = this.#queue.indexOf(queued);
+        if (index >= 0)
+            this.#queue.splice(index, 1);
+    }
+    #handle(message) {
+        if (this.#closed)
+            return;
+        if (message.t === 'announce') {
+            if (message.epoch > this.#maxEpochSeen) {
+                this.#maxEpochSeen = message.epoch;
+            }
+            // Ignore a stale announce (older than the leader we already track).
+            if (message.epoch < this.#epoch)
+                return;
+            const changed = message.epoch !== this.#epoch ||
+                message.clientId !== this.#leaderClientId;
+            this.#epoch = message.epoch;
+            this.#leaderClientId = message.clientId;
+            if (changed)
+                this.#onLeaderChange(message.clientId);
+            this.#resolveBindWaiters();
+            this.#flushQueue();
+            return;
+        }
+        if (message.t === 'res') {
+            // Discard a reply for a stale epoch — the leader that produced it is
+            // gone; the request (if still pending) is being retried elsewhere.
+            if (message.epoch !== this.#epoch)
+                return;
+            const inflight = this.#inFlight.get(message.reqId);
+            if (inflight === undefined)
+                return;
+            this.#inFlight.delete(message.reqId);
+            if (inflight.timer !== undefined)
+                clearTimeout(inflight.timer);
+            if (message.ok) {
+                inflight.resolve(message.value);
+            }
+            else {
+                const err = message.error;
+                inflight.reject(new ClientSyncError(err?.code ?? WORKER_FAILED_CODE, err?.message ?? 'follower request failed', err?.retryable ?? false));
+            }
+            return;
+        }
+        if (message.t === 'event') {
+            if (message.epoch !== this.#epoch)
+                return;
+            this.#onEvent(message.event);
+            return;
+        }
+    }
+    /** A new leader bound: re-send everything that was waiting for one. */
+    #flushQueue() {
+        const pending = this.#queue;
+        this.#queue = [];
+        for (const queued of pending) {
+            if (queued.timer !== undefined)
+                clearTimeout(queued.timer);
+            queued.timer = undefined;
+            this.#send(queued);
+        }
+    }
+    /**
+     * The leader we were bound to went away (its lock released). Un-bind so new
+     * calls queue again; re-request an announce so the next leader finds us.
+     * In-flight calls stay pending — their per-call timeout is the backstop,
+     * and the winner's announce will flush any that were queued.
+     */
+    unbind() {
+        if (this.#closed)
+            return;
+        this.#epoch = -1;
+        this.#leaderClientId = '';
+        this.#channel.postMessage({
+            t: 'hello',
+            fromId: this.#fromId,
+            epoch: this.#maxEpochSeen,
+        });
+    }
+    close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#channel.removeEventListener('message', this.#onMessage);
+        this.#channel.postMessage({ t: 'bye', fromId: this.#fromId });
+        const closedError = new ClientSyncError(WORKER_FAILED_CODE, 'the follower link was closed');
+        for (const inflight of this.#inFlight.values()) {
+            if (inflight.timer !== undefined)
+                clearTimeout(inflight.timer);
+            inflight.reject(closedError);
+        }
+        this.#inFlight.clear();
+        for (const queued of this.#queue) {
+            if (queued.timer !== undefined)
+                clearTimeout(queued.timer);
+            queued.reject(closedError);
+        }
+        this.#queue = [];
+        // Bind waiters carry their own timeout timers; resolving them here lets an
+        // awaiting boot path settle promptly instead of hanging until that timeout.
+        this.#resolveBindWaiters();
+        this.#channel.close();
+    }
+}

package/dist/node-database.d.ts

@@ -0,0 +1,41 @@
+import { type ClientDatabase, type SqlRow, type SqlValue } from './database.js';
+/**
+ * Structural view of the tiny better-sqlite3 surface this binding uses. We
+ * type it locally (rather than importing `better-sqlite3`'s types) so the
+ * package typechecks without the optional peer installed.
+ */
+interface BetterSqliteStatement {
+    run(...params: NodeParam[]): unknown;
+    all(...params: NodeParam[]): unknown[];
+}
+interface BetterSqliteDatabase {
+    readonly inTransaction: boolean;
+    prepare(sql: string): BetterSqliteStatement;
+    exec(sql: string): unknown;
+    close(): void;
+}
+/**
+ * better-sqlite3 accepts string / number / bigint / null / Buffer|Uint8Array
+ * bind values, but NOT booleans (it throws "TypeError: can only bind …"). We
+ * coerce booleans to 0/1 exactly like the bun adapter so callers see one
+ * uniform bind contract across every backend.
+ */
+type NodeParam = string | number | bigint | Uint8Array | null;
+export declare class NodeClientDatabase implements ClientDatabase {
+    #private;
+    readonly db: BetterSqliteDatabase;
+    constructor(path?: string);
+    exec(sql: string, params?: readonly SqlValue[]): void;
+    query(sql: string, params?: readonly SqlValue[]): SqlRow[];
+    transaction<T>(fn: () => T): T;
+    /**
+     * §5.3 image import: better-sqlite3 (like bun:sqlite) attaches files, not
+     * buffers, so the image lands in a private temp file for the duration of
+     * the ATTACH. Must be called outside any open transaction (SQLite cannot
+     * ATTACH inside one).
+     */
+    withSqliteImage<T>(bytes: Uint8Array, alias: string, fn: () => T): T;
+    close(): void;
+}
+export declare function openNodeDatabase(path?: string): ClientDatabase;
+export {};

package/dist/node-database.js

@@ -0,0 +1,133 @@
+/**
+ * `ClientDatabase` on better-sqlite3 — the Electron-main / plain-Node
+ * backend (TODO 2: Node ClientDatabase). Semantics mirror `./bun-database`
+ * exactly (synchronous exec/query/transaction with the shared savepoint
+ * helper, and the same §5.3 sqlite-image ATTACH path), so the core behaves
+ * identically whether it runs on bun:sqlite (tests), sqlite-wasm (browser)
+ * or better-sqlite3 (Node/Electron-main).
+ *
+ * better-sqlite3 is an OPTIONAL peer dependency, not a hard one: the package
+ * installs cleanly without it and this module errors helpfully only when a
+ * host actually calls `openNodeDatabase()` without having installed the peer.
+ * Not exported from the package root, so browser/bun entries never resolve
+ * the native module. Subpath export: `@syncular/client/node`.
+ *
+ * bun CANNOT dlopen better-sqlite3 (ERR_DLOPEN_FAILED, oven-sh/bun#4290), so
+ * this adapter is verified under real Node — see the README "Electron-main /
+ * plain-Node" section for the one-command recipe and `test/node-database`.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { assertImageAlias, runTransaction, } from './database.js';
+function coerceParams(params) {
+    return params.map((value) => {
+        if (typeof value === 'boolean')
+            return value ? 1 : 0;
+        return value;
+    });
+}
+/**
+ * better-sqlite3 returns BLOB columns as Node `Buffer`s. A Buffer IS a
+ * Uint8Array subclass, but it can be a view onto a shared pool buffer, so we
+ * normalize to a standalone Uint8Array — matching what bun:sqlite hands back
+ * and keeping the buffer-ownership assumptions elsewhere (worker transfer,
+ * structured clone) honest.
+ */
+function normalizeRow(row) {
+    const out = {};
+    for (const key in row) {
+        const value = row[key];
+        if (Buffer.isBuffer(value)) {
+            out[key] = new Uint8Array(value); // copies out of the pool
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+/**
+ * Load the optional peer AND open the database in one guarded step, so BOTH
+ * failure modes are turned into a clear, actionable error rather than a raw
+ * one:
+ *
+ *  - `require('better-sqlite3')` throwing MODULE_NOT_FOUND — the peer is not
+ *    installed (the common browser-only-host case), and
+ *  - `new Database()` throwing ERR_DLOPEN_FAILED — the module resolves but the
+ *    native addon cannot load, which is exactly what bun does for
+ *    better-sqlite3 (oven-sh/bun#4290); the addon only dlopens at construction.
+ */
+function openBetterSqlite(path) {
+    const require = createRequire(import.meta.url);
+    try {
+        const mod = require('better-sqlite3');
+        const Database = mod.default ??
+            mod;
+        return new Database(path);
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code === 'ERR_DLOPEN_FAILED') {
+            throw new Error("openNodeDatabase() requires the 'better-sqlite3' native module, but " +
+                'it failed to load. This most commonly means you are running under ' +
+                'bun, which cannot dlopen better-sqlite3 (oven-sh/bun#4290) — use ' +
+                "the bun:sqlite backend ('@syncular/client/bun') under bun, " +
+                "and reserve '@syncular/client/node' for Node/Electron-main. " +
+                `Underlying error: ${String(error)}`);
+        }
+        throw new Error('openNodeDatabase() requires the optional peer dependency ' +
+            "'better-sqlite3', which is not installed. Add it to your app " +
+            '(`npm install better-sqlite3` / `bun add better-sqlite3`) — it is ' +
+            'kept optional so @syncular/client installs without a native ' +
+            `build for browser-only hosts. Underlying error: ${String(error)}`);
+    }
+}
+export class NodeClientDatabase {
+    db;
+    #tx = { depth: 0 };
+    constructor(path = ':memory:') {
+        this.db = openBetterSqlite(path);
+    }
+    exec(sql, params = []) {
+        this.db.prepare(sql).run(...coerceParams(params));
+    }
+    query(sql, params = []) {
+        const rows = this.db.prepare(sql).all(...coerceParams(params));
+        return rows.map(normalizeRow);
+    }
+    transaction(fn) {
+        return runTransaction(this.#tx, (sql) => this.db.exec(sql), fn);
+    }
+    /**
+     * §5.3 image import: better-sqlite3 (like bun:sqlite) attaches files, not
+     * buffers, so the image lands in a private temp file for the duration of
+     * the ATTACH. Must be called outside any open transaction (SQLite cannot
+     * ATTACH inside one).
+     */
+    withSqliteImage(bytes, alias, fn) {
+        assertImageAlias(alias);
+        const dir = mkdtempSync(join(tmpdir(), 'syncular-image-'));
+        const path = join(dir, 'segment.db');
+        try {
+            writeFileSync(path, bytes);
+            this.db.prepare(`ATTACH DATABASE ? AS ${alias}`).run(path);
+            try {
+                return fn();
+            }
+            finally {
+                this.db.prepare(`DETACH DATABASE ${alias}`).run();
+            }
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }
+    close() {
+        this.db.close();
+    }
+}
+export function openNodeDatabase(path = ':memory:') {
+    return new NodeClientDatabase(path);
+}

package/dist/outbox.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The durable outbox (SPEC.md §7.1) with encode-at-send (the §0 binary-push
+ * outbox rule): local mutations are persisted in a schema-agnostic JSON
+ * form and encoded with the *current* generated row codec only when a push
+ * request is built — a commit recorded under schema N replays after an
+ * upgrade to N+1 by re-encoding.
+ */
+import { type PushCommitFrame, type ScopeMap } from '@syncular/core';
+import type { ClientDatabase } from './database.js';
+import type { EncryptionConfig } from './encryption.js';
+import { ClientSyncError } from './errors.js';
+import { type CompiledClientSchema, type CompiledClientTable, type JsonRowValue } from './schema.js';
+export interface OutboxOperation {
+    readonly table: string;
+    readonly rowId: string;
+    readonly op: 'upsert' | 'delete';
+    /** Optimistic-concurrency token (§6.2); absent = last-write-wins. */
+    readonly baseVersion?: number;
+    /** Full-row values keyed by column name; present iff `op` is `upsert`. */
+    readonly values?: Readonly<Record<string, JsonRowValue>>;
+}
+export interface OutboxCommit {
+    readonly seq: number;
+    readonly clientCommitId: string;
+    readonly createdAtMs: number;
+    readonly operations: readonly OutboxOperation[];
+}
+export declare function appendOutboxCommit(db: ClientDatabase, clientCommitId: string, operations: readonly OutboxOperation[], nowMs: number): void;
+/** Pending commits in FIFO creation order (§7.1). */
+export declare function listOutbox(db: ClientDatabase): OutboxCommit[];
+export declare function deleteOutboxCommit(db: ClientDatabase, clientCommitId: string): void;
+/**
+ * §7.4.4: after a schema bump, a persisted upsert may name a column the new
+ * schema no longer has. The value has nowhere to go and there is no
+ * migration — surface it as `sync.outbox_incompatible` (client-local, §10.3)
+ * so the caller can drop the commit through the rejection channel.
+ */
+export declare class OutboxEncodeError extends ClientSyncError {
+    constructor(message: string);
+}
+/**
+ * Encode one outbox commit as a `PUSH_COMMIT` frame with the current
+ * schema's row codec (§6.1). When `encryption` is configured, encrypted
+ * columns (§5.11) are encrypted here — the encode-at-send seam — before the
+ * row codec serializes them as ciphertext-envelope `bytes`. Async because
+ * WebCrypto is async.
+ */
+export declare function encodeOutboxCommit(schema: CompiledClientSchema, commit: OutboxCommit, encryption?: EncryptionConfig): Promise<PushCommitFrame>;
+/**
+ * §3.3: drop pending commits that write into a revoked scope instead of
+ * replaying them into guaranteed rejections. A whole commit is dropped when
+ * any of its upserts provably lands in the revoked effective scopes —
+ * commits are atomic and their content is pinned by the idempotency key,
+ * so ops are never removed individually. Returns dropped commit ids.
+ */
+export declare function dropOutboxCommitsInScope(db: ClientDatabase, table: CompiledClientTable, effective: ScopeMap): string[];