@syncular/client 0.30.13 → 0.30.15

package/README.md

@@ -818,3 +818,13 @@ See [windowing](https://syncular.dev/concepts-windowing/) and
 Custom database adapters implementing `withSqliteImage` must return a promise and
 await their callback before detaching the image. The callback can await between
 committed import chunks; no write transaction spans that await.
+
+## Preflight authority reads
+
+Pass `authorityReads: defineAuthorityReads([{ table, columns, scopes }])` at
+creation to enable the zero-argument `authoritySnapshot()`. It reads approved
+plain authority columns and accepted bases with revision and persisted scope
+coverage from one SQLite snapshot, including during security preflight.
+Unaccepted local intent remains separate. The read changes no keys, transport,
+subscriptions or lifecycle. See the [authority contract](../../docs/SPEC.md)
+and [native configuration](../tauri/README.md#authority-evidence-before-activation).

package/dist/apply.d.ts

@@ -1,3 +1,4 @@
+import { type OverlayScope } from './failed-overlay.js';
 /**
  * Local application of server data: `COMMIT` frames (§4.5), rows segments
  * (§5.2, §5.6), and the scope-matched delete shared by the §3.3 purge
@@ -8,7 +9,7 @@ import type { ClientDatabase } from './database.js';
 import type { EncryptionConfig } from './encryption.js';
 import { type CompiledClientSchema, type CompiledClientTable } from './schema.js';
 /** Lets the client wrap the physical write in its revision transaction. */
-export type ApplyTransaction = <T>(fn: () => T) => T;
+export type ApplyTransaction = (fn: () => OverlayScope) => unknown;
 export declare function upsertLocalRow(db: ClientDatabase, table: CompiledClientTable, values: readonly RowValue[], syncVersion: number, serverWrite?: boolean): void;
 export declare function deleteLocalRow(db: ClientDatabase, table: CompiledClientTable, rowId: string, serverWrite?: boolean): void;
 /**
@@ -23,7 +24,7 @@ export declare function deleteLocalRow(db: ClientDatabase, table: CompiledClient
  * (`client.decrypt_failed`) aborts before any local write, so the commit
  * never half-applies.
  */
-export declare function applyCommitFrame(db: ClientDatabase, schema: CompiledClientSchema, frame: CommitFrame, encryption?: EncryptionConfig, transaction?: (fn: () => readonly string[] | undefined) => unknown): Promise<void>;
+export declare function applyCommitFrame(db: ClientDatabase, schema: CompiledClientSchema, frame: CommitFrame, encryption?: EncryptionConfig, transaction?: (fn: () => OverlayScope) => unknown): Promise<void>;
 /**
  * §5.2: the segment's column table must match the generated schema for
  * (table, schemaVersion) — order, names, types, nullability. A mismatch is

package/dist/apply.js

@@ -1,3 +1,5 @@
+import { hasUniqueIndex } from './schema.js';
+import { OUTBOX_TABLE, OUTBOX_IMAGES, countOutbox } from './outbox.js';
 import { RETAINED_ROWS } from './failed-overlay.js';
 import { retainedBaseWrite, restoreFailedBases } from './failed-overlay.js';
 /**
@@ -76,13 +78,13 @@ export async function applyCommitFrame(db, schema, frame, encryption, transactio
         });
     }
     transaction(() => {
-        const rowKeys = frame.tables.some((name) => schema.tables.get(name)?.indexes.some((index) => index.unique))
-            ? undefined
-            : frame.changes.map((change) => JSON.stringify([frame.tables[change.tableIndex], change.rowId]));
-        restoreFailedBases(db, schema, false, rowKeys);
+        const scope = resolved.map((change, index) => JSON.stringify(hasUniqueIndex(change.table)
+            ? [change.table.name]
+            : [change.table.name, frame.changes[index].rowId]));
+        restoreFailedBases(db, schema, scope);
         for (const [index, change] of resolved.entries()) {
             const rowId = frame.changes[index].rowId;
-            db.exec("UPDATE _syncular_outbox_before_images SET delivery_seq=MAX(COALESCE(delivery_seq,0),?) WHERE (client_commit_id,op_index) IN(SELECT client_commit_id,json_each.key FROM _syncular_outbox,json_each(operations) WHERE json_extract(value,'$.table')=? AND json_extract(value,'$.rowId')=?)", [frame.commitSeq, change.table.name, rowId]);
+            db.exec(`UPDATE ${OUTBOX_IMAGES} SET delivery_seq=MAX(COALESCE(delivery_seq,0),?) WHERE (client_commit_id,op_index) IN(SELECT client_commit_id,json_each.key FROM ${OUTBOX_TABLE},json_each(operations) WHERE json_extract(value,'$.table')=? AND json_extract(value,'$.rowId')=?)`, [frame.commitSeq, change.table.name, rowId]);
             db.exec(`DELETE FROM ${RETAINED_ROWS} WHERE tbl=? AND id=? AND commit_seq<=?`, [change.table.name, rowId, frame.commitSeq]);
             if (change.op === 'delete') {
                 deleteLocalRow(db, change.table, change.rowId);
@@ -91,7 +93,7 @@ export async function applyCommitFrame(db, schema, frame, encryption, transactio
                 upsertLocalRow(db, change.table, change.values, change.rowVersion);
             }
         }
-        return rowKeys;
+        return scope;
     });
 }
 /**
@@ -147,12 +149,27 @@ export function localScopePredicate(table, effective) {
         .join(' AND ');
     return { sql, params };
 }
+function scopedRows(db, table, scope) {
+    return scope
+        ? db.query(`SELECT ${quoteIdent(table.primaryKey)} AS id FROM ${quoteIdent(table.name)} WHERE ${scope.sql}`, scope.params)
+        : [];
+}
+function bootstrapScope(db, table, effective) {
+    const rows = scopedRows(db, table, localScopePredicate(table, effective));
+    rows.push(...db
+        .query(`SELECT id,base,intent FROM ${RETAINED_ROWS} WHERE tbl=?`, [
+        table.name,
+    ])
+        .filter((row) => [row.base, row.intent].some((json) => json !== null &&
+        matchesLocalScopes(table, effective, JSON.parse(json)))));
+    return rows.map((row) => JSON.stringify([table.name, String(row.id)]));
+}
 export function deleteScopedRows(db, table, effective) {
     const scope = localScopePredicate(table, effective);
     if (!scope)
         return;
     const { sql, params } = scope;
-    for (const row of db.query(`SELECT ${quoteIdent(table.primaryKey)} AS id FROM ${quoteIdent(table.name)} WHERE ${sql}`, params)) {
+    for (const row of scopedRows(db, table, scope)) {
         retainedBaseWrite(db, table, String(row.id));
     }
     db.exec(`DELETE FROM ${quoteIdent(table.name)} WHERE ${sql}`, params);
@@ -287,18 +304,37 @@ export async function applySqliteSegment(db, schema, table, bytes, descriptor, o
                 predicates.push(`${primaryKey} <= ?`);
                 params.push(boundary);
             }
+            const replay = countOutbox(db) ||
+                db.query(`SELECT 1 FROM ${RETAINED_ROWS} WHERE tbl=? LIMIT 1`, [
+                    table.name,
+                ]).length;
+            const rows = replay
+                ? db.query(`SELECT * FROM ${source} WHERE ${predicates.join(' AND ') || 'true'}`, params)
+                : [];
             (options.transaction ?? ((fn) => db.transaction(fn)))(() => {
-                restoreFailedBases(db, schema);
+                const scope = !replay
+                    ? []
+                    : hasUniqueIndex(table)
+                        ? [JSON.stringify([table.name])]
+                        : [
+                            ...(after === undefined && options.clearFirst
+                                ? bootstrapScope(db, table, options.effective)
+                                : []),
+                            ...rows.map((row) => JSON.stringify([table.name, String(row[table.primaryKey])])),
+                        ];
+                const protectedRows = restoreFailedBases(db, schema, scope);
                 if (after === undefined && options.clearFirst)
                     deleteScopedRows(db, table, options.effective);
                 db.exec(`INSERT INTO ${quoteIdent(table.name)}(${insertNames.join(', ')})SELECT ${[...names, quoteIdent('_syncular_version')].join(', ')} FROM ${source} WHERE ${predicates.join(' AND ') || 'true'} ON CONFLICT(${primaryKey})DO UPDATE SET ${updates}`, params);
                 applied += Number(db.query('SELECT changes()AS n')[0]?.n ?? 0);
-                for (const row of db.query(`SELECT * FROM ${source} WHERE ${predicates.join(' AND ') || 'true'}`, params)) {
-                    retainedBaseWrite(db, table, String(row[table.primaryKey]), Object.fromEntries(table.columns.map((column) => [
-                        column.name,
-                        rowValueToJson(row[column.name]),
-                    ])), Number(row._syncular_version));
-                }
+                if (protectedRows)
+                    for (const row of rows) {
+                        retainedBaseWrite(db, table, String(row[table.primaryKey]), Object.fromEntries(table.columns.map((column) => [
+                            column.name,
+                            rowValueToJson(row[column.name]),
+                        ])), Number(row._syncular_version));
+                    }
+                return scope;
             });
             options.onProgress?.(applied);
             await yieldToHost();
@@ -347,7 +383,18 @@ export async function applyRowsSegment(db, schema, table, segment, options, encr
         if (!clearThisBlock && rows.length === 0)
             continue;
         (options.transaction ?? ((fn) => db.transaction(fn)))(() => {
-            const protectedRows = restoreFailedBases(db, schema);
+            const scope = hasUniqueIndex(table)
+                ? [JSON.stringify([table.name])]
+                : [
+                    ...(clearThisBlock
+                        ? bootstrapScope(db, table, options.effective)
+                        : []),
+                    ...rows.map((row) => JSON.stringify([
+                        table.name,
+                        String(row.values[table.primaryKeyIndex]),
+                    ])),
+                ];
+            const protectedRows = restoreFailedBases(db, schema, scope);
             if (clearThisBlock) {
                 deleteScopedRows(db, table, options.effective);
             }
@@ -357,6 +404,7 @@ export async function applyRowsSegment(db, schema, table, segment, options, encr
                 if (applied % 1024 === 0)
                     options.onProgress?.(applied);
             }
+            return scope;
         });
         options.onProgress?.(applied);
         await yieldToHost();

package/dist/authority.d.ts

@@ -0,0 +1,43 @@
+import type { ClientDatabase, SqlRow } from './database.js';
+import type { CompiledClientSchema } from './schema.js';
+/** Frozen at client creation. Scope selectors use the schema's variables. */
+export interface AuthorityReadDeclaration {
+    readonly table: string;
+    readonly columns: readonly string[];
+    readonly scopes: Readonly<Record<string, readonly string[]>>;
+}
+export interface AuthoritySnapshot {
+    readonly revision: bigint;
+    readonly complete: boolean;
+    readonly tables: readonly {
+        readonly table: string;
+        readonly rows: readonly {
+            readonly values: SqlRow;
+            readonly version: number;
+            readonly hasLocalIntent: boolean;
+        }[];
+        /** Includes local-only creations; no intended values are disclosed. */
+        readonly localIntentRowIds: readonly string[];
+        readonly coverage: 'complete' | 'pending' | 'missing';
+        readonly scopes: AuthorityReadDeclaration['scopes'];
+        readonly persisted: readonly {
+            readonly requestedScopes: AuthorityReadDeclaration['scopes'];
+            readonly status: string;
+            readonly cursor: number;
+            readonly effectiveScopes: AuthorityReadDeclaration['scopes'] | null;
+            readonly complete: boolean;
+        }[];
+    }[];
+}
+/** Opt-in policy module; ordinary clients ship no authority reader. */
+export declare class AuthorityReadPolicy {
+    #private;
+    get declarations(): readonly AuthorityReadDeclaration[];
+    constructor(declarations: readonly AuthorityReadDeclaration[]);
+    /** @internal */
+    validate(schema: CompiledClientSchema): void;
+    /** @internal */
+    snapshot(db: ClientDatabase, schema: CompiledClientSchema): AuthoritySnapshot;
+}
+/** Declare authority tables, plain columns and scope selectors at creation. */
+export declare function defineAuthorityReads(declarations: readonly AuthorityReadDeclaration[]): AuthorityReadPolicy;

package/dist/authority.js

@@ -0,0 +1,257 @@
+import { ClientSyncError } from './errors.js';
+import { listOutbox, listOutboxBeforeImages } from './outbox.js';
+import { RETAINED_ROWS } from './failed-overlay.js';
+import { getLocalRevision, getMeta, loadSubscriptions } from './state.js';
+import { fromSqlValue, quoteIdent, SYNC_VERSION_COLUMN } from './schema.js';
+function validateAuthorityReads(schema, declarations) {
+    if (!Array.isArray(declarations))
+        throw new ClientSyncError('client.authority_read_forbidden', 'authorityReads must be a list');
+    const seen = new Set();
+    for (const read of declarations) {
+        if (!read ||
+            typeof read !== 'object' ||
+            !Array.isArray(read.columns) ||
+            !read.scopes ||
+            typeof read.scopes !== 'object' ||
+            Array.isArray(read.scopes))
+            throw new ClientSyncError('client.authority_read_forbidden', 'invalid authority declaration');
+        const table = schema.tables.get(read.table);
+        const plain = (name) => table?.columns.some((c) => c.name === name &&
+            name !== 'authority_version' &&
+            !name.startsWith('_sync') &&
+            !c.encrypted &&
+            ['string', 'integer', 'float', 'boolean', 'json'].includes(c.type));
+        if (Object.keys(read).sort().join() !== 'columns,scopes,table' ||
+            !table ||
+            seen.has(read.table) ||
+            !read.columns.length ||
+            new Set(read.columns).size !== read.columns.length ||
+            !read.columns.includes(table.primaryKey) ||
+            !read.columns.every(plain) ||
+            !Object.keys(read.scopes).length ||
+            !Object.entries(read.scopes).every(([variable, values]) => read.columns.includes(table.scopeColumnByVariable.get(variable) ?? '') &&
+                plain(table.scopeColumnByVariable.get(variable) ?? '') &&
+                Array.isArray(values) &&
+                values.length > 0 &&
+                values.every((v) => typeof v === 'string' && v.length > 0 && v !== '*'))) {
+            throw new ClientSyncError('client.authority_read_forbidden', 'authority reads require declared tables, plain columns, a primary key and nonempty plain scope selectors');
+        }
+        Object.freeze(read.columns);
+        for (const values of Object.values(read.scopes))
+            Object.freeze(values);
+        Object.freeze(read.scopes);
+        Object.freeze(read);
+        seen.add(read.table);
+    }
+}
+/** Read accepted bases without restoring or replaying the visible projection. */
+function readAuthoritySnapshot(db, schema, declarations) {
+    if (!declarations.length)
+        throw new ClientSyncError('client.authority_read_forbidden', 'no authority reads were declared at client creation');
+    return db.transaction(() => {
+        const raw = getMeta(db, 'localRevision');
+        if (raw === undefined ||
+            !/^(0|[1-9][0-9]*)$/.test(raw) ||
+            BigInt(raw) > 18446744073709551615n)
+            throw new ClientSyncError('sync.local_corrupt', 'authority revision is missing or invalid');
+        const revision = getLocalRevision(db);
+        const subscriptions = loadSubscriptions(db);
+        const tables = declarations.map((read) => {
+            const table = schema.tables.get(read.table);
+            const columns = [
+                ...new Set([
+                    ...read.columns,
+                    ...Object.keys(read.scopes).map((v) => table.scopeColumnByVariable.get(v)),
+                ]),
+            ];
+            const scalar = (column, value) => {
+                if (value === null || typeof value === 'object')
+                    throw new ClientSyncError('sync.local_corrupt', 'authority scalar is missing or invalid');
+                return String(fromSqlValue(table.columns[table.columnIndex.get(column)], value));
+            };
+            const matches = (values) => Object.entries(read.scopes).every(([v, held]) => {
+                const column = table.scopeColumnByVariable.get(v);
+                return (values[column] !== null &&
+                    values[column] !== undefined &&
+                    held.includes(scalar(column, values[column])));
+            });
+            const bases = new Map();
+            const intent = new Set();
+            const relevantIntent = new Set();
+            // FIFO before-images precede the earliest still-pending intent.
+            for (const commit of listOutbox(db)) {
+                const images = listOutboxBeforeImages(db, commit.clientCommitId);
+                for (const [idx, op] of commit.operations.entries())
+                    if (op.table === read.table) {
+                        intent.add(op.rowId);
+                        if (op.values && matches(op.values))
+                            relevantIntent.add(op.rowId);
+                        if (bases.has(op.rowId))
+                            continue;
+                        const image = images.find((i) => i.opIndex === idx);
+                        if (!image ||
+                            (image.existed &&
+                                (image.values === undefined || image.syncVersion === undefined)))
+                            throw new ClientSyncError('sync.local_corrupt', 'authority intent before-image is missing');
+                        bases.set(op.rowId, {
+                            values: image.values ?? null,
+                            version: image.syncVersion ?? -1,
+                        });
+                    }
+            }
+            // A retained/ACK base precedes pending edits stacked over that intent.
+            const retained = new Set();
+            for (const row of db.query(`SELECT id,base,version,intent FROM ${RETAINED_ROWS} WHERE tbl=? ORDER BY commit_seq,at,commit_id,idx`, [read.table])) {
+                const id = String(row.id);
+                if (row.base !== null && row.version === null)
+                    throw new ClientSyncError('sync.local_corrupt', 'authority base version is missing');
+                intent.add(id);
+                if (row.intent !== null && matches(JSON.parse(String(row.intent))))
+                    relevantIntent.add(id);
+                if (!retained.has(id))
+                    bases.set(id, {
+                        values: row.base === null ? null : JSON.parse(String(row.base)),
+                        version: Number(row.version ?? -1),
+                    });
+                retained.add(id);
+            }
+            const visible = db.query(`SELECT ${columns.map(quoteIdent).join(',')},${SYNC_VERSION_COLUMN} FROM ${quoteIdent(read.table)}`);
+            for (const row of visible) {
+                const id = scalar(table.primaryKey, row[table.primaryKey]);
+                if (!bases.has(id))
+                    bases.set(id, {
+                        values: row,
+                        version: Number(row[SYNC_VERSION_COLUMN]),
+                    });
+            }
+            const rows = [...bases]
+                .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+                .flatMap(([id, base]) => {
+                if (!Number.isSafeInteger(base.version) ||
+                    base.version < -1 ||
+                    (base.values &&
+                        base.version >= 0 &&
+                        !read.columns.every((c) => Object.hasOwn(base.values, c))))
+                    throw new ClientSyncError('sync.local_corrupt', 'authority base evidence is incomplete');
+                if (!base.values || base.version < 0 || !matches(base.values))
+                    return [];
+                return [
+                    {
+                        values: Object.fromEntries(read.columns.map((c) => [
+                            c,
+                            typeof base.values[c] === 'boolean'
+                                ? base.values[c]
+                                    ? 1
+                                    : 0
+                                : (base.values[c] ?? null),
+                        ])),
+                        version: base.version,
+                        hasLocalIntent: intent.has(id),
+                    },
+                ];
+            });
+            const persisted = subscriptions
+                .filter((s) => s.table === read.table)
+                .map((s) => {
+                const effective = s.effectiveScopes;
+                const complete = effective !== undefined &&
+                    Object.keys(effective).length === Object.keys(read.scopes).length &&
+                    s.status === 'active' &&
+                    s.cursor >= 0 &&
+                    s.bootstrapState === undefined &&
+                    s.params === undefined;
+                return {
+                    requestedScopes: Object.fromEntries(Object.keys(read.scopes).map((v) => [v, s.scopes[v] ?? []])),
+                    status: s.status,
+                    cursor: s.cursor,
+                    effectiveScopes: effective === undefined
+                        ? null
+                        : Object.fromEntries(Object.keys(read.scopes).map((v) => [
+                            v,
+                            effective[v] ?? [],
+                        ])),
+                    complete,
+                };
+            });
+            const selectors = Object.entries(read.scopes);
+            const covered = (at, candidates) => at === selectors.length
+                ? candidates.length > 0
+                : selectors[at][1].every((value) => covered(at + 1, candidates.filter((p) => p.effectiveScopes?.[selectors[at][0]]?.some((held) => held === value || held === '*'))));
+            const coverage = covered(0, persisted.filter((p) => p.complete))
+                ? 'complete'
+                : persisted.some((p) => p.status === 'active' &&
+                    selectors.every(([v, values]) => values.some((value) => p.requestedScopes[v]?.includes(value))))
+                    ? 'pending'
+                    : 'missing';
+            return {
+                table: read.table,
+                rows,
+                localIntentRowIds: [...intent]
+                    .filter((id) => relevantIntent.has(id) ||
+                    rows.some((row) => scalar(table.primaryKey, row.values[table.primaryKey]) ===
+                        id) ||
+                    visible.some((row) => scalar(table.primaryKey, row[table.primaryKey]) === id &&
+                        matches(row)))
+                    .sort(),
+                scopes: read.scopes,
+                coverage,
+                persisted,
+            };
+        });
+        return {
+            revision,
+            complete: tables.every((t) => t.coverage === 'complete'),
+            tables,
+        };
+    });
+}
+/** Opt-in policy module; ordinary clients ship no authority reader. */
+export class AuthorityReadPolicy {
+    #declarations;
+    get declarations() {
+        return this.#declarations;
+    }
+    constructor(declarations) {
+        if (!Array.isArray(declarations))
+            throw new ClientSyncError('client.authority_read_forbidden', 'authorityReads must be a list');
+        this.#declarations = structuredClone(declarations);
+        for (const read of this.#declarations) {
+            if (!read ||
+                typeof read !== 'object' ||
+                !Array.isArray(read.columns) ||
+                !read.scopes ||
+                typeof read.scopes !== 'object' ||
+                Array.isArray(read.scopes))
+                throw new ClientSyncError('client.authority_read_forbidden', 'invalid authority declaration');
+            Object.freeze(read.columns);
+            for (const values of Object.values(read.scopes))
+                Object.freeze(values);
+            Object.freeze(read.scopes);
+            Object.freeze(read);
+        }
+        Object.freeze(this.#declarations);
+        Object.freeze(this);
+    }
+    /** @internal */
+    validate(schema) {
+        validateAuthorityReads(schema, this.declarations);
+        Object.freeze(this.declarations);
+        Object.freeze(this);
+    }
+    /** @internal */
+    snapshot(db, schema) {
+        validateAuthorityReads(schema, this.declarations);
+        try {
+            return readAuthoritySnapshot(db, schema, this.declarations);
+        }
+        catch (error) {
+            if (error instanceof SyntaxError)
+                throw new ClientSyncError('sync.local_corrupt', 'authority persisted evidence is invalid');
+            throw error;
+        }
+    }
+}
+/** Declare authority tables, plain columns and scope selectors at creation. */
+export function defineAuthorityReads(declarations) {
+    return new AuthorityReadPolicy(declarations);
+}

package/dist/blob.d.ts

@@ -1,3 +1,4 @@
+export declare const BLOB_COMMIT_REFS = "_syncular_blob_commit_refs";
 /**
  * Client-side blob cache + transport (SPEC.md §5.9.7).
  *

package/dist/blob.js

@@ -1,3 +1,4 @@
+export const BLOB_COMMIT_REFS = '_syncular_blob_commit_refs';
 /**
  * Client-side blob cache + transport (SPEC.md §5.9.7).
  *
@@ -70,7 +71,7 @@ export function enforceBlobCacheCap(db, schema, maxBytes) {
     if (total <= maxBytes)
         return [];
     // Oldest eligible body first, with blob ID as a stable tie.
-    const candidates = db.query(`SELECT blob_id,byte_length FROM _syncular_blobs WHERE blob_id NOT IN(SELECT blob_id FROM _syncular_blob_uploads)AND blob_id NOT IN(SELECT blob_id FROM _syncular_blob_commit_refs)AND blob_id NOT IN(${visibleBlobIdsSql(schema)})ORDER BY created_at_ms ASC,blob_id ASC`);
+    const candidates = db.query(`SELECT blob_id,byte_length FROM _syncular_blobs WHERE blob_id NOT IN(SELECT blob_id FROM _syncular_blob_uploads)AND blob_id NOT IN(SELECT blob_id FROM ${BLOB_COMMIT_REFS})AND blob_id NOT IN(${visibleBlobIdsSql(schema)})ORDER BY created_at_ms ASC,blob_id ASC`);
     const evicted = [];
     db.transaction(() => {
         for (const row of candidates) {
@@ -86,7 +87,7 @@ export function enforceBlobCacheCap(db, schema, maxBytes) {
 }
 export function listPendingUploads(db) {
     return db
-        .query('SELECT blob_id,media_type FROM(SELECT blob_id,media_type,created_at_ms FROM _syncular_blob_uploads UNION ALL SELECT DISTINCT r.blob_id,b.media_type,9223372036854775807 AS created_at_ms FROM _syncular_blob_commit_refs r LEFT JOIN _syncular_blobs b ON b.blob_id=r.blob_id WHERE NOT EXISTS(SELECT 1 FROM _syncular_blob_uploads u WHERE u.blob_id=r.blob_id))ORDER BY created_at_ms,blob_id')
+        .query(`SELECT blob_id,media_type FROM(SELECT blob_id,media_type,created_at_ms FROM _syncular_blob_uploads UNION ALL SELECT DISTINCT r.blob_id,b.media_type,9223372036854775807 AS created_at_ms FROM ${BLOB_COMMIT_REFS} r LEFT JOIN _syncular_blobs b ON b.blob_id=r.blob_id WHERE NOT EXISTS(SELECT 1 FROM _syncular_blob_uploads u WHERE u.blob_id=r.blob_id))ORDER BY created_at_ms,blob_id`)
         .map((row) => {
         if (typeof row.blob_id !== 'string' ||
             (row.media_type !== null && typeof row.media_type !== 'string')) {
@@ -138,6 +139,6 @@ function visibleBlobIdsSql(schema) {
         : selects.join(' UNION ');
 }
 export function deleteUnreferencedCachedBlobs(db, schema) {
-    db.exec(`DELETE FROM _syncular_blobs WHERE blob_id NOT IN(SELECT blob_id FROM _syncular_blob_uploads)AND blob_id NOT IN(SELECT blob_id FROM _syncular_blob_commit_refs)AND blob_id NOT IN(${visibleBlobIdsSql(schema)})`);
+    db.exec(`DELETE FROM _syncular_blobs WHERE blob_id NOT IN(SELECT blob_id FROM _syncular_blob_uploads)AND blob_id NOT IN(SELECT blob_id FROM ${BLOB_COMMIT_REFS})AND blob_id NOT IN(${visibleBlobIdsSql(schema)})`);
 }
 export { parseBlobRef, serializeBlobRef };

package/dist/client.d.ts

@@ -1,3 +1,4 @@
+import type { AuthorityReadPolicy, AuthoritySnapshot } from './authority.js';
 import { type SyncProgress, type SyncProgressListener } from './progress.js';
 /**
  * SyncClient implements the client side of SPEC.md §§3–8.
@@ -174,6 +175,7 @@ export interface SyncClientConfig {
      * hosts must not materialize key bytes before their preflight has passed.
      */
     readonly securityPreflight?: boolean;
+    readonly authorityReads?: AuthorityReadPolicy;
     /**
      * RFC 0005 previous-version context. A feature flag, default off: when
      * absent or `enabled: false`, a schema bump behaves exactly as 0.22.0 did
@@ -326,6 +328,8 @@ export declare class SyncClient {
     query(sql: string, params?: readonly SqlValue[]): SqlRow[];
     /** Current durable local observer revision (SPEC §7.5). */
     get localRevision(): LocalRevision;
+    /** Read the creation-time plain authority policy, including preflight. */
+    authoritySnapshot(): AuthoritySnapshot;
     /**
      * Read rows, window answerability, and revision from one SQLite snapshot.
      * Reactive integrations use this instead of composing `query()` and