@syncular/client 0.30.14 → 0.30.16

package/README.md

@@ -818,3 +818,29 @@ See [windowing](https://syncular.dev/concepts-windowing/) and
 Custom database adapters implementing `withSqliteImage` must return a promise and
 await their callback before detaching the image. The callback can await between
 committed import chunks; no write transaction spans that await.
+
+## Preflight authority reads
+
+Import `defineAuthorityReads` from `@syncular/client/authority`. Pass
+`authorityReads: defineAuthorityReads([{ table, columns, scopes }])` at
+creation to enable the zero-argument `authoritySnapshot()`. It reads approved
+plain authority columns and accepted bases with revision and persisted scope
+coverage from one SQLite snapshot, including during security preflight.
+Unaccepted local intent remains separate. The read changes no keys, transport,
+subscriptions or lifecycle. See the [authority contract](../../docs/SPEC.md)
+and [native configuration](../tauri/README.md#authority-evidence-before-activation).
+
+Workers must opt in in their entry script:
+
+```ts
+import { defineAuthorityReads } from '@syncular/client/authority';
+import { startSyncWorker } from '@syncular/client/worker';
+
+startSyncWorker({ createAuthorityReads: defineAuthorityReads });
+```
+
+Pass the policy to `createSyncClientHandle({ authorityReads, ...config })` on
+the main thread. Declarations without the injected worker factory fail with
+`client.authority_read_forbidden` before opening storage. Ordinary workers
+keep `startSyncWorker()` and bundle no authority reader. No dynamic import
+changes the declared capability.

package/dist/authority.d.ts

@@ -0,0 +1,43 @@
+import type { ClientDatabase, SqlRow } from './database.js';
+import type { CompiledClientSchema } from './schema.js';
+/** Frozen at client creation. Scope selectors use the schema's variables. */
+export interface AuthorityReadDeclaration {
+    readonly table: string;
+    readonly columns: readonly string[];
+    readonly scopes: Readonly<Record<string, readonly string[]>>;
+}
+export interface AuthoritySnapshot {
+    readonly revision: bigint;
+    readonly complete: boolean;
+    readonly tables: readonly {
+        readonly table: string;
+        readonly rows: readonly {
+            readonly values: SqlRow;
+            readonly version: number;
+            readonly hasLocalIntent: boolean;
+        }[];
+        /** Includes local-only creations; no intended values are disclosed. */
+        readonly localIntentRowIds: readonly string[];
+        readonly coverage: 'complete' | 'pending' | 'missing';
+        readonly scopes: AuthorityReadDeclaration['scopes'];
+        readonly persisted: readonly {
+            readonly requestedScopes: AuthorityReadDeclaration['scopes'];
+            readonly status: string;
+            readonly cursor: number;
+            readonly effectiveScopes: AuthorityReadDeclaration['scopes'] | null;
+            readonly complete: boolean;
+        }[];
+    }[];
+}
+/** Opt-in policy module; ordinary clients ship no authority reader. */
+export declare class AuthorityReadPolicy {
+    #private;
+    get declarations(): readonly AuthorityReadDeclaration[];
+    constructor(declarations: readonly AuthorityReadDeclaration[]);
+    /** @internal */
+    validate(schema: CompiledClientSchema): void;
+    /** @internal */
+    snapshot(db: ClientDatabase, schema: CompiledClientSchema): AuthoritySnapshot;
+}
+/** Declare authority tables, plain columns and scope selectors at creation. */
+export declare function defineAuthorityReads(declarations: readonly AuthorityReadDeclaration[]): AuthorityReadPolicy;

package/dist/authority.js

@@ -0,0 +1,257 @@
+import { ClientSyncError } from './errors.js';
+import { listOutbox, listOutboxBeforeImages } from './outbox.js';
+import { RETAINED_ROWS } from './failed-overlay.js';
+import { getLocalRevision, getMeta, loadSubscriptions } from './state.js';
+import { fromSqlValue, quoteIdent, SYNC_VERSION_COLUMN } from './schema.js';
+function validateAuthorityReads(schema, declarations) {
+    if (!Array.isArray(declarations))
+        throw new ClientSyncError('client.authority_read_forbidden', 'authorityReads must be a list');
+    const seen = new Set();
+    for (const read of declarations) {
+        if (!read ||
+            typeof read !== 'object' ||
+            !Array.isArray(read.columns) ||
+            !read.scopes ||
+            typeof read.scopes !== 'object' ||
+            Array.isArray(read.scopes))
+            throw new ClientSyncError('client.authority_read_forbidden', 'invalid authority declaration');
+        const table = schema.tables.get(read.table);
+        const plain = (name) => table?.columns.some((c) => c.name === name &&
+            name !== 'authority_version' &&
+            !name.startsWith('_sync') &&
+            !c.encrypted &&
+            ['string', 'integer', 'float', 'boolean', 'json'].includes(c.type));
+        if (Object.keys(read).sort().join() !== 'columns,scopes,table' ||
+            !table ||
+            seen.has(read.table) ||
+            !read.columns.length ||
+            new Set(read.columns).size !== read.columns.length ||
+            !read.columns.includes(table.primaryKey) ||
+            !read.columns.every(plain) ||
+            !Object.keys(read.scopes).length ||
+            !Object.entries(read.scopes).every(([variable, values]) => read.columns.includes(table.scopeColumnByVariable.get(variable) ?? '') &&
+                plain(table.scopeColumnByVariable.get(variable) ?? '') &&
+                Array.isArray(values) &&
+                values.length > 0 &&
+                values.every((v) => typeof v === 'string' && v.length > 0 && v !== '*'))) {
+            throw new ClientSyncError('client.authority_read_forbidden', 'authority reads require declared tables, plain columns, a primary key and nonempty plain scope selectors');
+        }
+        Object.freeze(read.columns);
+        for (const values of Object.values(read.scopes))
+            Object.freeze(values);
+        Object.freeze(read.scopes);
+        Object.freeze(read);
+        seen.add(read.table);
+    }
+}
+/** Read accepted bases without restoring or replaying the visible projection. */
+function readAuthoritySnapshot(db, schema, declarations) {
+    if (!declarations.length)
+        throw new ClientSyncError('client.authority_read_forbidden', 'no authority reads were declared at client creation');
+    return db.transaction(() => {
+        const raw = getMeta(db, 'localRevision');
+        if (raw === undefined ||
+            !/^(0|[1-9][0-9]*)$/.test(raw) ||
+            BigInt(raw) > 18446744073709551615n)
+            throw new ClientSyncError('sync.local_corrupt', 'authority revision is missing or invalid');
+        const revision = getLocalRevision(db);
+        const subscriptions = loadSubscriptions(db);
+        const tables = declarations.map((read) => {
+            const table = schema.tables.get(read.table);
+            const columns = [
+                ...new Set([
+                    ...read.columns,
+                    ...Object.keys(read.scopes).map((v) => table.scopeColumnByVariable.get(v)),
+                ]),
+            ];
+            const scalar = (column, value) => {
+                if (value === null || typeof value === 'object')
+                    throw new ClientSyncError('sync.local_corrupt', 'authority scalar is missing or invalid');
+                return String(fromSqlValue(table.columns[table.columnIndex.get(column)], value));
+            };
+            const matches = (values) => Object.entries(read.scopes).every(([v, held]) => {
+                const column = table.scopeColumnByVariable.get(v);
+                return (values[column] !== null &&
+                    values[column] !== undefined &&
+                    held.includes(scalar(column, values[column])));
+            });
+            const bases = new Map();
+            const intent = new Set();
+            const relevantIntent = new Set();
+            // FIFO before-images precede the earliest still-pending intent.
+            for (const commit of listOutbox(db)) {
+                const images = listOutboxBeforeImages(db, commit.clientCommitId);
+                for (const [idx, op] of commit.operations.entries())
+                    if (op.table === read.table) {
+                        intent.add(op.rowId);
+                        if (op.values && matches(op.values))
+                            relevantIntent.add(op.rowId);
+                        if (bases.has(op.rowId))
+                            continue;
+                        const image = images.find((i) => i.opIndex === idx);
+                        if (!image ||
+                            (image.existed &&
+                                (image.values === undefined || image.syncVersion === undefined)))
+                            throw new ClientSyncError('sync.local_corrupt', 'authority intent before-image is missing');
+                        bases.set(op.rowId, {
+                            values: image.values ?? null,
+                            version: image.syncVersion ?? -1,
+                        });
+                    }
+            }
+            // A retained/ACK base precedes pending edits stacked over that intent.
+            const retained = new Set();
+            for (const row of db.query(`SELECT id,base,version,intent FROM ${RETAINED_ROWS} WHERE tbl=? ORDER BY commit_seq,at,commit_id,idx`, [read.table])) {
+                const id = String(row.id);
+                if (row.base !== null && row.version === null)
+                    throw new ClientSyncError('sync.local_corrupt', 'authority base version is missing');
+                intent.add(id);
+                if (row.intent !== null && matches(JSON.parse(String(row.intent))))
+                    relevantIntent.add(id);
+                if (!retained.has(id))
+                    bases.set(id, {
+                        values: row.base === null ? null : JSON.parse(String(row.base)),
+                        version: Number(row.version ?? -1),
+                    });
+                retained.add(id);
+            }
+            const visible = db.query(`SELECT ${columns.map(quoteIdent).join(',')},${SYNC_VERSION_COLUMN} FROM ${quoteIdent(read.table)}`);
+            for (const row of visible) {
+                const id = scalar(table.primaryKey, row[table.primaryKey]);
+                if (!bases.has(id))
+                    bases.set(id, {
+                        values: row,
+                        version: Number(row[SYNC_VERSION_COLUMN]),
+                    });
+            }
+            const rows = [...bases]
+                .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+                .flatMap(([id, base]) => {
+                if (!Number.isSafeInteger(base.version) ||
+                    base.version < -1 ||
+                    (base.values &&
+                        base.version >= 0 &&
+                        !read.columns.every((c) => Object.hasOwn(base.values, c))))
+                    throw new ClientSyncError('sync.local_corrupt', 'authority base evidence is incomplete');
+                if (!base.values || base.version < 0 || !matches(base.values))
+                    return [];
+                return [
+                    {
+                        values: Object.fromEntries(read.columns.map((c) => [
+                            c,
+                            typeof base.values[c] === 'boolean'
+                                ? base.values[c]
+                                    ? 1
+                                    : 0
+                                : (base.values[c] ?? null),
+                        ])),
+                        version: base.version,
+                        hasLocalIntent: intent.has(id),
+                    },
+                ];
+            });
+            const persisted = subscriptions
+                .filter((s) => s.table === read.table)
+                .map((s) => {
+                const effective = s.effectiveScopes;
+                const complete = effective !== undefined &&
+                    Object.keys(effective).length === Object.keys(read.scopes).length &&
+                    s.status === 'active' &&
+                    s.cursor >= 0 &&
+                    s.bootstrapState === undefined &&
+                    s.params === undefined;
+                return {
+                    requestedScopes: Object.fromEntries(Object.keys(read.scopes).map((v) => [v, s.scopes[v] ?? []])),
+                    status: s.status,
+                    cursor: s.cursor,
+                    effectiveScopes: effective === undefined
+                        ? null
+                        : Object.fromEntries(Object.keys(read.scopes).map((v) => [
+                            v,
+                            effective[v] ?? [],
+                        ])),
+                    complete,
+                };
+            });
+            const selectors = Object.entries(read.scopes);
+            const covered = (at, candidates) => at === selectors.length
+                ? candidates.length > 0
+                : selectors[at][1].every((value) => covered(at + 1, candidates.filter((p) => p.effectiveScopes?.[selectors[at][0]]?.some((held) => held === value || held === '*'))));
+            const coverage = covered(0, persisted.filter((p) => p.complete))
+                ? 'complete'
+                : persisted.some((p) => p.status === 'active' &&
+                    selectors.every(([v, values]) => values.some((value) => p.requestedScopes[v]?.includes(value))))
+                    ? 'pending'
+                    : 'missing';
+            return {
+                table: read.table,
+                rows,
+                localIntentRowIds: [...intent]
+                    .filter((id) => relevantIntent.has(id) ||
+                    rows.some((row) => scalar(table.primaryKey, row.values[table.primaryKey]) ===
+                        id) ||
+                    visible.some((row) => scalar(table.primaryKey, row[table.primaryKey]) === id &&
+                        matches(row)))
+                    .sort(),
+                scopes: read.scopes,
+                coverage,
+                persisted,
+            };
+        });
+        return {
+            revision,
+            complete: tables.every((t) => t.coverage === 'complete'),
+            tables,
+        };
+    });
+}
+/** Opt-in policy module; ordinary clients ship no authority reader. */
+export class AuthorityReadPolicy {
+    #declarations;
+    get declarations() {
+        return this.#declarations;
+    }
+    constructor(declarations) {
+        if (!Array.isArray(declarations))
+            throw new ClientSyncError('client.authority_read_forbidden', 'authorityReads must be a list');
+        this.#declarations = structuredClone(declarations);
+        for (const read of this.#declarations) {
+            if (!read ||
+                typeof read !== 'object' ||
+                !Array.isArray(read.columns) ||
+                !read.scopes ||
+                typeof read.scopes !== 'object' ||
+                Array.isArray(read.scopes))
+                throw new ClientSyncError('client.authority_read_forbidden', 'invalid authority declaration');
+            Object.freeze(read.columns);
+            for (const values of Object.values(read.scopes))
+                Object.freeze(values);
+            Object.freeze(read.scopes);
+            Object.freeze(read);
+        }
+        Object.freeze(this.#declarations);
+        Object.freeze(this);
+    }
+    /** @internal */
+    validate(schema) {
+        validateAuthorityReads(schema, this.declarations);
+        Object.freeze(this.declarations);
+        Object.freeze(this);
+    }
+    /** @internal */
+    snapshot(db, schema) {
+        validateAuthorityReads(schema, this.declarations);
+        try {
+            return readAuthoritySnapshot(db, schema, this.declarations);
+        }
+        catch (error) {
+            if (error instanceof SyntaxError)
+                throw new ClientSyncError('sync.local_corrupt', 'authority persisted evidence is invalid');
+            throw error;
+        }
+    }
+}
+/** Declare authority tables, plain columns and scope selectors at creation. */
+export function defineAuthorityReads(declarations) {
+    return new AuthorityReadPolicy(declarations);
+}

package/dist/client.d.ts

@@ -1,3 +1,4 @@
+import type { AuthorityReadPolicy, AuthoritySnapshot } from './authority.js';
 import { type SyncProgress, type SyncProgressListener } from './progress.js';
 /**
  * SyncClient implements the client side of SPEC.md §§3–8.
@@ -174,6 +175,7 @@ export interface SyncClientConfig {
      * hosts must not materialize key bytes before their preflight has passed.
      */
     readonly securityPreflight?: boolean;
+    readonly authorityReads?: AuthorityReadPolicy;
     /**
      * RFC 0005 previous-version context. A feature flag, default off: when
      * absent or `enabled: false`, a schema bump behaves exactly as 0.22.0 did
@@ -326,6 +328,8 @@ export declare class SyncClient {
     query(sql: string, params?: readonly SqlValue[]): SqlRow[];
     /** Current durable local observer revision (SPEC §7.5). */
     get localRevision(): LocalRevision;
+    /** Read the creation-time plain authority policy, including preflight. */
+    authoritySnapshot(): AuthoritySnapshot;
     /**
      * Read rows, window answerability, and revision from one SQLite snapshot.
      * Reactive integrations use this instead of composing `query()` and

package/dist/client.js

@@ -130,6 +130,7 @@ function realtimeErrorCode(error) {
 }
 export class SyncClient {
     #config;
+    #authorityReads;
     #db;
     #schema;
     /** §5.11 client-side encryption config; undefined ⇒ E2EE off. */
@@ -237,6 +238,8 @@ export class SyncClient {
         this.#retainFailedCommits = config.retainFailedCommits === true;
         this.#db = config.database;
         this.#schema = compileClientSchema(config.schema);
+        this.#authorityReads = config.authorityReads;
+        this.#authorityReads?.validate(this.#schema);
         const realtimePolicy = config.realtimePolicy ?? 'optional';
         if (realtimePolicy !== 'required' &&
             realtimePolicy !== 'optional' &&
@@ -541,6 +544,7 @@ export class SyncClient {
         });
     }
     async close() {
+        this.#started = false;
         this.#emitSyncIntent({ kind: 'none' });
         this.#devtoolsUnregister?.();
         this.#devtoolsUnregister = undefined;
@@ -548,7 +552,6 @@ export class SyncClient {
         this.#abortPendingRound('client closed mid-round');
         await this.#lease?.release();
         this.#lease = undefined;
-        this.#started = false;
         this.#progress.clear();
         this.#syncNeededListeners.clear();
         this.#syncIntentListeners.clear();
@@ -696,6 +699,13 @@ export class SyncClient {
         this.#requireStarted();
         return getLocalRevision(this.#db);
     }
+    /** Read the creation-time plain authority policy, including preflight. */
+    authoritySnapshot() {
+        this.#requireStarted();
+        if (!this.#authorityReads || arguments.length)
+            throw new ClientSyncError('client.authority_read_forbidden', 'authority read denied');
+        return this.#authorityReads.snapshot(this.#db, this.#schema);
+    }
     /**
      * Read rows, window answerability, and revision from one SQLite snapshot.
      * Reactive integrations use this instead of composing `query()` and
@@ -714,24 +724,13 @@ export class SyncClient {
                 const missing = [];
                 for (const requested of spec.coverage ?? []) {
                     const baseKey = windowBaseKey(requested.base);
-                    const live = new Map(loadWindowUnits(this.#db, baseKey).map((entry) => [
-                        entry.unit,
-                        entry.subId,
-                    ]));
+                    const state = this.windowState(requested.base);
                     for (const unit of new Set(requested.units)) {
-                        const subId = live.get(unit);
                         const ref = { baseKey, unit };
-                        if (subId === undefined) {
+                        if (!state.units.includes(unit))
                             missing.push(ref);
-                            continue;
-                        }
-                        const sub = getSubscription(this.#db, subId);
-                        if (sub === undefined ||
-                            sub.status !== 'active' ||
-                            sub.cursor < 0 ||
-                            sub.bootstrapState !== undefined) {
+                        else if (state.pending.includes(unit))
                             pending.push(ref);
-                        }
                     }
                 }
                 return {
@@ -1044,7 +1043,7 @@ export class SyncClient {
                 item.id.length === 0 ||
                 typeof item.table !== 'string' ||
                 item.table.length === 0) {
-                throw invalidRequest('diagnosticsSnapshot expected subscriptions require non-empty id and table strings');
+                throw invalidRequest('diagnosticsSnapshot needs subscription id and table');
             }
             const registeredSubscription = subscriptions.get(item.id);
             if (registeredSubscription !== undefined &&
@@ -2154,7 +2153,7 @@ export class SyncClient {
             };
         }
         if (this.#schemaFloor !== undefined) {
-            throw invalidRequest('local rebootstrap cannot bypass an active schema-floor stop; update the application first');
+            throw invalidRequest('local rebootstrap needs a schema-floor update');
         }
         const pending = listOutbox(this.#db);
         const resetSubscriptions = loadSubscriptions(this.#db).length;
@@ -3843,13 +3842,13 @@ export class SyncClient {
     }
     #requireStarted() {
         if (!this.#started) {
-            throw invalidRequest('call SyncClient.start() first');
+            throw invalidRequest('call start() first');
         }
     }
     #requireActive() {
         this.#requireStarted();
         if (this.#securityLifecycle === 'preflight') {
-            throw new ClientSyncError(SECURITY_PREFLIGHT_REQUIRED_CODE, 'security preflight must complete before accessing protected data; call activateSecurity');
+            throw new ClientSyncError(SECURITY_PREFLIGHT_REQUIRED_CODE, 'protected reads require activateSecurity');
         }
     }
 }

package/dist/index.d.ts

@@ -8,6 +8,7 @@
  * (`worker-host`) and the RPC protocol types are root exports — they
  * import no SQLite.
  */
+export type { AuthorityReadPolicy, AuthorityReadDeclaration, AuthoritySnapshot, } from './authority.js';
 export * from './apply.js';
 export * from './availability.js';
 export * from './blob.js';

package/dist/index.js

@@ -1,13 +1,3 @@
-/**
- * @syncular/client is the TypeScript client protocol core.
- * SPEC.md is normative.
- *
- * Browser-safe root: database backends live behind subpath exports
- * (`./sqlite` for Node or Bun, `./wasm` for sqlite-wasm + OPFS); the
- * worker-side bootstrap lives behind `./worker`. The main-thread handle
- * (`worker-host`) and the RPC protocol types are root exports — they
- * import no SQLite.
- */
 export * from './apply.js';
 export * from './availability.js';
 export * from './blob.js';

package/dist/worker-entry.d.ts

@@ -1,7 +1,25 @@
+/**
+ * Worker-side bootstrap: constructs the WHOLE
+ * client core — SyncClient + transports + realtime + SQLite — inside the
+ * worker and serves the `worker-protocol` RPC over postMessage.
+ *
+ * Browsers get the defaults: opfs-sahpool persistence and the fetch/WS
+ * transports from `./http`, wired from `WorkerInitConfig.endpoints`.
+ * Tests inject a database factory (bun:sqlite) through `overrides` — the
+ * same bootstrap, the same RPC, a different SQLite.
+ *
+ * The §8.4 host loop lives HERE: wake-ups (hello/`sync` events, delta
+ * drops) coalesce into one intent-driven `syncUntilIdle` round in the worker;
+ * RPC-driven and auto-driven sync rounds serialize on one queue because
+ * the core owns exactly one loop.
+ */
+import type { defineAuthorityReads } from './authority.js';
 import type { ClientDatabase } from './database.js';
 import type { RealtimeConnector, SegmentDownloader, SyncTransport } from './transport.js';
 import { type WorkerInitConfig } from './worker-protocol.js';
 export interface SyncWorkerOverrides {
+    /** Explicit authority reader factory. Required when init declares authorityReads. */
+    readonly createAuthorityReads?: typeof defineAuthorityReads;
     /** Database factory indirection: tests inject bun:sqlite here. */
     readonly openDatabase?: (config: WorkerInitConfig) => Promise<ClientDatabase> | ClientDatabase;
     /** Retry deadline indirection for deterministic worker-host tests. */

package/dist/worker-entry.js

@@ -1,18 +1,3 @@
-/**
- * Worker-side bootstrap: constructs the WHOLE
- * client core — SyncClient + transports + realtime + SQLite — inside the
- * worker and serves the `worker-protocol` RPC over postMessage.
- *
- * Browsers get the defaults: opfs-sahpool persistence and the fetch/WS
- * transports from `./http`, wired from `WorkerInitConfig.endpoints`.
- * Tests inject a database factory (bun:sqlite) through `overrides` — the
- * same bootstrap, the same RPC, a different SQLite.
- *
- * The §8.4 host loop lives HERE: wake-ups (hello/`sync` events, delta
- * drops) coalesce into one intent-driven `syncUntilIdle` round in the worker;
- * RPC-driven and auto-driven sync rounds serialize on one queue because
- * the core owns exactly one loop.
- */
 import { SyncClient } from './client.js';
 import { withClientDiagnosticsHost, } from './diagnostics.js';
 import { encryptionConfigFromKeyring } from './encryption.js';
@@ -159,6 +144,8 @@ export function startSyncWorker(overrides = {}) {
         return client;
     }
     async function init(config) {
+        if (config.authorityReads !== undefined && !overrides.createAuthorityReads)
+            throw new ClientSyncError('client.authority_read_forbidden', 'authorityReads requires startSyncWorker({ createAuthorityReads })');
         if (client !== undefined) {
             throw new ClientSyncError(WORKER_FAILED_CODE, 'the worker is already initialized');
         }
@@ -233,6 +220,11 @@ export function startSyncWorker(overrides = {}) {
             ...(config.encryption !== undefined
                 ? { encryption: encryptionConfigFromKeyring(config.encryption) }
                 : {}),
+            ...(config.authorityReads !== undefined
+                ? {
+                    authorityReads: overrides.createAuthorityReads(config.authorityReads),
+                }
+                : {}),
             ...(config.securityPreflight !== undefined
                 ? { securityPreflight: config.securityPreflight }
                 : {}),
@@ -296,8 +288,44 @@ export function startSyncWorker(overrides = {}) {
             consumeSyncIntent({ kind: 'interactive' });
         return { clientId: started.clientId };
     }
+    // Forward every argument to core methods, including authority's zero-argument check.
+    const coreMethods = [
+        'securityLifecycle',
+        'subscribe',
+        'unsubscribe',
+        'windowState',
+        'purgeLocalData',
+        'rebootstrapLocalData',
+        'previousVersionSnapshot',
+        'previousVersionAudit',
+        'previousVersionDiscard',
+        'query',
+        'authoritySnapshot',
+        'querySnapshot',
+        'statusSnapshot',
+        'conflicts',
+        'rejections',
+        'commitOutcome',
+        'commitOutcomes',
+        'resolveCommitOutcome',
+        'pendingCommits',
+        'subscriptions',
+        'subscription',
+        'connectRealtime',
+        'disconnectRealtime',
+        'setPresence',
+        'presence',
+        'uploadBlob',
+        'fetchBlob',
+    ];
     const api = {
-        securityLifecycle: () => requireClient().securityLifecycle(),
+        ...Object.fromEntries(coreMethods.map((method) => [
+            method,
+            (...args) => {
+                const running = requireClient();
+                return Reflect.apply(running[method], running, args);
+            },
+        ])),
         beginSecurityPreflight: async () => {
             if (backgroundTimer !== undefined)
                 clearTimeout(backgroundTimer);
@@ -313,12 +341,9 @@ export function startSyncWorker(overrides = {}) {
                     : {}),
             });
         },
-        subscribe: (input) => requireClient().subscribe(input),
-        unsubscribe: (id) => requireClient().unsubscribe(id),
         setWindow: async (base, units) => {
             await requireClient().setWindowCommand(base, units);
         },
-        windowState: (base) => requireClient().windowState(base),
         mutate: (mutations) => {
             return requireClient().mutateCommand(mutations).value;
         },
@@ -328,11 +353,6 @@ export function startSyncWorker(overrides = {}) {
             const result = requireClient().patchCommand(table, rowId, partial, options);
             return result.value;
         },
-        purgeLocalData: (input) => requireClient().purgeLocalData(input),
-        rebootstrapLocalData: (input) => requireClient().rebootstrapLocalData(input),
-        previousVersionSnapshot: (spec) => requireClient().previousVersionSnapshot(spec),
-        previousVersionAudit: () => requireClient().previousVersionAudit(),
-        previousVersionDiscard: () => requireClient().previousVersionDiscard(),
         sync: () => {
             const running = requireClient();
             return serializedSync(() => running.sync());
@@ -341,10 +361,7 @@ export function startSyncWorker(overrides = {}) {
             const running = requireClient();
             return serializedSync(() => running.syncUntilIdle(maxRounds));
         },
-        query: (sql, params) => requireClient().query(sql, params),
-        querySnapshot: (spec) => requireClient().querySnapshot(spec),
         localRevision: () => requireClient().localRevision,
-        statusSnapshot: () => requireClient().statusSnapshot(),
         diagnosticsSnapshot: (request) => {
             const snapshot = requireClient().diagnosticsSnapshot(request);
             return withClientDiagnosticsHost(snapshot, {
@@ -354,20 +371,6 @@ export function startSyncWorker(overrides = {}) {
                 realtime: snapshot.host.realtime,
             });
         },
-        conflicts: () => requireClient().conflicts(),
-        rejections: () => requireClient().rejections(),
-        commitOutcome: (clientCommitId) => requireClient().commitOutcome(clientCommitId),
-        commitOutcomes: (query) => requireClient().commitOutcomes(query),
-        resolveCommitOutcome: (input) => requireClient().resolveCommitOutcome(input),
-        pendingCommits: () => requireClient().pendingCommits(),
-        subscriptions: () => requireClient().subscriptions(),
-        subscription: (id) => requireClient().subscription(id),
-        connectRealtime: () => requireClient().connectRealtime(),
-        disconnectRealtime: () => requireClient().disconnectRealtime(),
-        setPresence: (scopeKey, doc) => requireClient().setPresence(scopeKey, doc),
-        presence: (scopeKey) => requireClient().presence(scopeKey),
-        uploadBlob: (bytes, options) => requireClient().uploadBlob(bytes, options),
-        fetchBlob: (blobIdOrRef) => requireClient().fetchBlob(blobIdOrRef),
         setHeaders: (next) => {
             headers = next;
         },

package/dist/worker-host.d.ts

@@ -83,6 +83,8 @@ export interface SyncClientHandleConfig {
     readonly headers?: Readonly<Record<string, string>>;
     /** Structured-clone-safe E2EE keyring installed only in the leader worker. */
     readonly encryption?: EncryptionKeyringConfig;
+    /** Fixed plain authority reads permitted before security activation. */
+    readonly authorityReads?: import('./authority.js').AuthorityReadPolicy;
     /** Open the worker-owned replica behind the fail-closed security gate. */
     readonly securityPreflight?: boolean;
     readonly transportEnabled?: boolean;
@@ -244,6 +246,7 @@ export declare class SyncClientHandle implements PromiseMethods<WorkerApi> {
     sync(): Promise<SyncSummary>;
     syncUntilIdle(maxRounds?: number): Promise<SyncSummary>;
     query(sql: string, params?: readonly SqlValue[]): Promise<SqlRow[]>;
+    authoritySnapshot(): Promise<import('./authority.js').AuthoritySnapshot>;
     querySnapshot<Row = SqlRow>(spec: QueryReadSpec): Promise<QuerySnapshot<Row>>;
     localRevision(): Promise<LocalRevision>;
     statusSnapshot(): Promise<SyncStatusSnapshot>;