@syncular/client 0.15.33 → 0.15.35

package/README.md

@@ -316,6 +316,13 @@ visible. Reusing the same id returns `alreadyApplied: true`. The counts-only
 result reports retained commits and reset subscriptions without exposing ids,
 rows, scopes, or clinical values.
 
+Worker, Tauri, and React Native adapters strictly decode the exact result
+shape before returning it. Missing or additional fields, a non-boolean
+`alreadyApplied`, or counts that are not non-negative safe integers fail with
+`client.invalid_host_response`; raw bridge values and native error prose must
+not be persisted as recovery evidence. `decodeLocalDataRebootstrapResult()` is
+public for custom command hosts that expose the same operation.
+
 This API is not a security erase, sign-out, membership revocation, schema
 upgrade, or draft deletion mechanism. It fails closed during security
 preflight and while a schema-floor stop is active. The application must show a

package/dist/local-rebootstrap.d.ts

@@ -6,6 +6,8 @@
  * lease state, and protected bookkeeping. It only discards server-derived
  * projection state so the registered subscriptions can bootstrap it again.
  */
+/** A non-direct host returned a response that does not match its public API. */
+export declare const INVALID_HOST_RESPONSE_CODE = "client.invalid_host_response";
 /** A durable idempotency key supplied by the application repair coordinator. */
 export interface LocalDataRebootstrapInput {
     readonly rebootstrapId: string;
@@ -16,6 +18,13 @@ export interface LocalDataRebootstrapResult {
     readonly retainedCommits: number;
     readonly resetSubscriptions: number;
 }
+/**
+ * Strictly decode the privacy-safe acknowledgement returned by a Worker or
+ * native command bridge. Compile-time host types are not runtime proof: this
+ * rejects version drift and malformed bridge values before an application can
+ * persist or display them.
+ */
+export declare function decodeLocalDataRebootstrapResult(value: unknown): LocalDataRebootstrapResult;
 /** Validate before entering the recovery transaction. */
 export declare function compileLocalDataRebootstrap(input: LocalDataRebootstrapInput): string;
 export declare function localDataRebootstrapMetaKey(rebootstrapId: string): string;

package/dist/local-rebootstrap.js

@@ -8,6 +8,44 @@
  */
 import { ClientSyncError } from './errors.js';
 const CODE_LIKE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+const RESULT_KEYS = [
+    'alreadyApplied',
+    'resetSubscriptions',
+    'retainedCommits',
+];
+/** A non-direct host returned a response that does not match its public API. */
+export const INVALID_HOST_RESPONSE_CODE = 'client.invalid_host_response';
+function invalidHostResponse() {
+    throw new ClientSyncError(INVALID_HOST_RESPONSE_CODE, 'rebootstrapLocalData returned an invalid host response');
+}
+function isCount(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+}
+/**
+ * Strictly decode the privacy-safe acknowledgement returned by a Worker or
+ * native command bridge. Compile-time host types are not runtime proof: this
+ * rejects version drift and malformed bridge values before an application can
+ * persist or display them.
+ */
+export function decodeLocalDataRebootstrapResult(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return invalidHostResponse();
+    }
+    const source = value;
+    const keys = Object.keys(source).sort();
+    if (keys.length !== RESULT_KEYS.length ||
+        keys.some((key, index) => key !== RESULT_KEYS[index]) ||
+        typeof source.alreadyApplied !== 'boolean' ||
+        !isCount(source.retainedCommits) ||
+        !isCount(source.resetSubscriptions)) {
+        return invalidHostResponse();
+    }
+    return {
+        alreadyApplied: source.alreadyApplied,
+        retainedCommits: source.retainedCommits,
+        resetSubscriptions: source.resetSubscriptions,
+    };
+}
 /** Validate before entering the recovery transaction. */
 export function compileLocalDataRebootstrap(input) {
     if (input.rebootstrapId.length === 0 ||

package/dist/worker-host.d.ts

@@ -31,7 +31,7 @@ import { ClientSyncError } from './errors.js';
 import { ChangeEmitter, type ClientChangeListener, InvalidationEmitter, type InvalidationListener, type LocalRevision, type SyncStatusSnapshot } from './invalidation.js';
 import { type LeaderLease, type LeaderLock } from './leader-lock.js';
 import type { LocalDataPurgeInput, LocalDataPurgeResult } from './local-purge.js';
-import type { LocalDataRebootstrapInput, LocalDataRebootstrapResult } from './local-rebootstrap.js';
+import { type LocalDataRebootstrapInput, type LocalDataRebootstrapResult } from './local-rebootstrap.js';
 import { type CrossTabChannel, FollowerLink, LeaderBridge, type LeadershipState } from './multi-tab.js';
 import type { OutboxCommit } from './outbox.js';
 import type { CommitOutcome, CommitOutcomeQuery, ResolveCommitOutcomeInput } from './outcomes.js';

package/dist/worker-host.js

@@ -3,6 +3,7 @@ import { ClientDiagnosticsEmitter, withClientDiagnosticsHost, } from './diagnost
 import { ClientSyncError } from './errors.js';
 import { ChangeEmitter, InvalidationEmitter, invalidationFromChange, } from './invalidation.js';
 import { singleOwnerLock, webLocksLeaderLock, } from './leader-lock.js';
+import { decodeLocalDataRebootstrapResult, } from './local-rebootstrap.js';
 import { broadcastChannelFactory, FollowerLink, LeaderBridge, multiTabChannelName, newTabId, } from './multi-tab.js';
 import { NOT_LEADER_CODE, WORKER_FAILED_CODE, WORKER_RESTART_REQUIRED_CODE, } from './worker-protocol.js';
 const WORKER_BUNDLE_LOAD_FAILURE = /(?:failed to fetch dynamically imported module|error loading dynamically imported module|importing a module script failed|failed to load module script)/iu;
@@ -255,8 +256,8 @@ export class SyncClientHandle {
     purgeLocalData(input) {
         return this.#call('purgeLocalData', [input]);
     }
-    rebootstrapLocalData(input) {
-        return this.#call('rebootstrapLocalData', [input]);
+    async rebootstrapLocalData(input) {
+        return decodeLocalDataRebootstrapResult(await this.#call('rebootstrapLocalData', [input]));
     }
     sync() {
         return this.#call('sync', []);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/client",
-  "version": "0.15.33",
+  "version": "0.15.35",
   "description": "Syncular TypeScript client core — offline-first sync over SQLite (WASM/OPFS, Bun, Node)",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -81,7 +81,7 @@
   },
   "dependencies": {
     "@sqlite.org/sqlite-wasm": "^3.53.0-build1",
-    "@syncular/core": "0.15.33"
+    "@syncular/core": "0.15.35"
   },
   "peerDependencies": {
     "better-sqlite3": ">=11"
@@ -92,7 +92,7 @@
     }
   },
   "devDependencies": {
-    "@syncular/server": "0.15.33",
+    "@syncular/server": "0.15.35",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.11.1"
   }

package/src/local-rebootstrap.ts

@@ -10,6 +10,14 @@
 import { ClientSyncError } from './errors';
 
 const CODE_LIKE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+const RESULT_KEYS = [
+  'alreadyApplied',
+  'resetSubscriptions',
+  'retainedCommits',
+] as const;
+
+/** A non-direct host returned a response that does not match its public API. */
+export const INVALID_HOST_RESPONSE_CODE = 'client.invalid_host_response';
 
 /** A durable idempotency key supplied by the application repair coordinator. */
 export interface LocalDataRebootstrapInput {
@@ -23,6 +31,47 @@ export interface LocalDataRebootstrapResult {
   readonly resetSubscriptions: number;
 }
 
+function invalidHostResponse(): never {
+  throw new ClientSyncError(
+    INVALID_HOST_RESPONSE_CODE,
+    'rebootstrapLocalData returned an invalid host response',
+  );
+}
+
+function isCount(value: unknown): value is number {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+}
+
+/**
+ * Strictly decode the privacy-safe acknowledgement returned by a Worker or
+ * native command bridge. Compile-time host types are not runtime proof: this
+ * rejects version drift and malformed bridge values before an application can
+ * persist or display them.
+ */
+export function decodeLocalDataRebootstrapResult(
+  value: unknown,
+): LocalDataRebootstrapResult {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    return invalidHostResponse();
+  }
+  const source = value as Record<string, unknown>;
+  const keys = Object.keys(source).sort();
+  if (
+    keys.length !== RESULT_KEYS.length ||
+    keys.some((key, index) => key !== RESULT_KEYS[index]) ||
+    typeof source.alreadyApplied !== 'boolean' ||
+    !isCount(source.retainedCommits) ||
+    !isCount(source.resetSubscriptions)
+  ) {
+    return invalidHostResponse();
+  }
+  return {
+    alreadyApplied: source.alreadyApplied,
+    retainedCommits: source.retainedCommits,
+    resetSubscriptions: source.resetSubscriptions,
+  };
+}
+
 /** Validate before entering the recovery transaction. */
 export function compileLocalDataRebootstrap(
   input: LocalDataRebootstrapInput,

package/src/worker-host.ts

@@ -65,9 +65,10 @@ import {
   webLocksLeaderLock,
 } from './leader-lock';
 import type { LocalDataPurgeInput, LocalDataPurgeResult } from './local-purge';
-import type {
-  LocalDataRebootstrapInput,
-  LocalDataRebootstrapResult,
+import {
+  decodeLocalDataRebootstrapResult,
+  type LocalDataRebootstrapInput,
+  type LocalDataRebootstrapResult,
 } from './local-rebootstrap';
 import {
   broadcastChannelFactory,
@@ -512,10 +513,12 @@ export class SyncClientHandle {
     return this.#call('purgeLocalData', [input]);
   }
 
-  rebootstrapLocalData(
+  async rebootstrapLocalData(
     input: LocalDataRebootstrapInput,
   ): Promise<LocalDataRebootstrapResult> {
-    return this.#call('rebootstrapLocalData', [input]);
+    return decodeLocalDataRebootstrapResult(
+      await this.#call('rebootstrapLocalData', [input]),
+    );
   }
 
   sync(): Promise<SyncSummary> {