@syncular/client 0.30.14 → 0.30.16

package/src/worker-entry.ts

@@ -13,6 +13,7 @@
  * RPC-driven and auto-driven sync rounds serialize on one queue because
  * the core owns exactly one loop.
  */
+import type { defineAuthorityReads } from './authority';
 import { SyncClient } from './client';
 import type { ClientDatabase } from './database';
 import {
@@ -51,6 +52,8 @@ import {
 } from './worker-protocol';
 
 export interface SyncWorkerOverrides {
+  /** Explicit authority reader factory. Required when init declares authorityReads. */
+  readonly createAuthorityReads?: typeof defineAuthorityReads;
   /** Database factory indirection: tests inject bun:sqlite here. */
   readonly openDatabase?: (
     config: WorkerInitConfig,
@@ -238,6 +241,11 @@ export function startSyncWorker(overrides: SyncWorkerOverrides = {}): void {
   }
 
   async function init(config: WorkerInitConfig): Promise<WorkerInitResult> {
+    if (config.authorityReads !== undefined && !overrides.createAuthorityReads)
+      throw new ClientSyncError(
+        'client.authority_read_forbidden',
+        'authorityReads requires startSyncWorker({ createAuthorityReads })',
+      );
     if (client !== undefined) {
       throw new ClientSyncError(
         WORKER_FAILED_CODE,
@@ -323,6 +331,13 @@ export function startSyncWorker(overrides: SyncWorkerOverrides = {}): void {
       ...(config.encryption !== undefined
         ? { encryption: encryptionConfigFromKeyring(config.encryption) }
         : {}),
+      ...(config.authorityReads !== undefined
+        ? {
+            authorityReads: overrides.createAuthorityReads!(
+              config.authorityReads,
+            ),
+          }
+        : {}),
       ...(config.securityPreflight !== undefined
         ? { securityPreflight: config.securityPreflight }
         : {}),
@@ -389,8 +404,46 @@ export function startSyncWorker(overrides: SyncWorkerOverrides = {}): void {
     return { clientId: started.clientId };
   }
 
+  // Forward every argument to core methods, including authority's zero-argument check.
+  const coreMethods = [
+    'securityLifecycle',
+    'subscribe',
+    'unsubscribe',
+    'windowState',
+    'purgeLocalData',
+    'rebootstrapLocalData',
+    'previousVersionSnapshot',
+    'previousVersionAudit',
+    'previousVersionDiscard',
+    'query',
+    'authoritySnapshot',
+    'querySnapshot',
+    'statusSnapshot',
+    'conflicts',
+    'rejections',
+    'commitOutcome',
+    'commitOutcomes',
+    'resolveCommitOutcome',
+    'pendingCommits',
+    'subscriptions',
+    'subscription',
+    'connectRealtime',
+    'disconnectRealtime',
+    'setPresence',
+    'presence',
+    'uploadBlob',
+    'fetchBlob',
+  ] as const satisfies readonly (keyof WorkerApi & keyof SyncClient)[];
   const api: WorkerApi = {
-    securityLifecycle: () => requireClient().securityLifecycle(),
+    ...(Object.fromEntries(
+      coreMethods.map((method) => [
+        method,
+        (...args: unknown[]) => {
+          const running = requireClient();
+          return Reflect.apply(running[method], running, args);
+        },
+      ]),
+    ) as Pick<WorkerApi, (typeof coreMethods)[number]>),
     beginSecurityPreflight: async () => {
       if (backgroundTimer !== undefined) clearTimeout(backgroundTimer);
       backgroundTimer = undefined;
@@ -405,12 +458,9 @@ export function startSyncWorker(overrides: SyncWorkerOverrides = {}): void {
           : {}),
       });
     },
-    subscribe: (input) => requireClient().subscribe(input),
-    unsubscribe: (id) => requireClient().unsubscribe(id),
     setWindow: async (base, units) => {
       await requireClient().setWindowCommand(base, units);
     },
-    windowState: (base) => requireClient().windowState(base),
     mutate: (mutations) => {
       return requireClient().mutateCommand(mutations).value;
     },
@@ -425,13 +475,6 @@ export function startSyncWorker(overrides: SyncWorkerOverrides = {}): void {
       );
       return result.value;
     },
-    purgeLocalData: (input) => requireClient().purgeLocalData(input),
-    rebootstrapLocalData: (input) =>
-      requireClient().rebootstrapLocalData(input),
-    previousVersionSnapshot: (spec) =>
-      requireClient().previousVersionSnapshot(spec),
-    previousVersionAudit: () => requireClient().previousVersionAudit(),
-    previousVersionDiscard: () => requireClient().previousVersionDiscard(),
     sync: () => {
       const running = requireClient();
       return serializedSync(() => running.sync());
@@ -440,10 +483,7 @@ export function startSyncWorker(overrides: SyncWorkerOverrides = {}): void {
       const running = requireClient();
       return serializedSync(() => running.syncUntilIdle(maxRounds));
     },
-    query: (sql, params) => requireClient().query(sql, params),
-    querySnapshot: (spec) => requireClient().querySnapshot(spec),
     localRevision: () => requireClient().localRevision,
-    statusSnapshot: () => requireClient().statusSnapshot(),
     diagnosticsSnapshot: (request) => {
       const snapshot = requireClient().diagnosticsSnapshot(request);
       return withClientDiagnosticsHost(snapshot, {
@@ -453,22 +493,6 @@ export function startSyncWorker(overrides: SyncWorkerOverrides = {}): void {
         realtime: snapshot.host.realtime,
       });
     },
-    conflicts: () => requireClient().conflicts(),
-    rejections: () => requireClient().rejections(),
-    commitOutcome: (clientCommitId) =>
-      requireClient().commitOutcome(clientCommitId),
-    commitOutcomes: (query) => requireClient().commitOutcomes(query),
-    resolveCommitOutcome: (input) =>
-      requireClient().resolveCommitOutcome(input),
-    pendingCommits: () => requireClient().pendingCommits(),
-    subscriptions: () => requireClient().subscriptions(),
-    subscription: (id) => requireClient().subscription(id),
-    connectRealtime: () => requireClient().connectRealtime(),
-    disconnectRealtime: () => requireClient().disconnectRealtime(),
-    setPresence: (scopeKey, doc) => requireClient().setPresence(scopeKey, doc),
-    presence: (scopeKey) => requireClient().presence(scopeKey),
-    uploadBlob: (bytes, options) => requireClient().uploadBlob(bytes, options),
-    fetchBlob: (blobIdOrRef) => requireClient().fetchBlob(blobIdOrRef),
     setHeaders: (next) => {
       headers = next;
     },

package/src/worker-host.ts

@@ -192,6 +192,8 @@ export interface SyncClientHandleConfig {
   readonly headers?: Readonly<Record<string, string>>;
   /** Structured-clone-safe E2EE keyring installed only in the leader worker. */
   readonly encryption?: EncryptionKeyringConfig;
+  /** Fixed plain authority reads permitted before security activation. */
+  readonly authorityReads?: import('./authority').AuthorityReadPolicy;
   /** Open the worker-owned replica behind the fail-closed security gate. */
   readonly securityPreflight?: boolean;
   readonly transportEnabled?: boolean;
@@ -656,6 +658,15 @@ export class SyncClientHandle implements PromiseMethods<WorkerApi> {
     return this.#call('query', [sql, params]);
   }
 
+  authoritySnapshot(): Promise<import('./authority').AuthoritySnapshot> {
+    if (arguments.length)
+      throw new ClientSyncError(
+        'client.authority_read_forbidden',
+        'authoritySnapshot accepts no arguments',
+      );
+    return this.#call('authoritySnapshot', []);
+  }
+
   querySnapshot<Row = SqlRow>(
     spec: QueryReadSpec,
   ): Promise<QuerySnapshot<Row>> {
@@ -951,6 +962,9 @@ function buildInitConfig(
     ...(config.transportEnabled !== undefined
       ? { transportEnabled: config.transportEnabled }
       : {}),
+    ...(config.authorityReads !== undefined
+      ? { authorityReads: config.authorityReads.declarations }
+      : {}),
     ...(config.securityPreflight !== undefined
       ? { securityPreflight: config.securityPreflight }
       : {}),

package/src/worker-protocol.ts

@@ -111,6 +111,7 @@ export interface WorkerInitConfig {
   /** Portable raw keyring installed inside the worker-owned client core. */
   readonly encryption?: EncryptionKeyringConfig;
   /** Open the worker-owned replica behind the fail-closed security gate. */
+  readonly authorityReads?: readonly import('./authority').AuthorityReadDeclaration[];
   readonly securityPreflight?: boolean;
   readonly transportEnabled?: boolean;
   readonly clientId?: string;
@@ -186,6 +187,7 @@ export interface WorkerApi extends Omit<
   sync(): Promise<SyncSummary>;
   syncUntilIdle(maxRounds?: number): Promise<SyncSummary>;
   query(sql: string, params?: readonly SqlValue[]): SqlRow[];
+  authoritySnapshot(): import('./authority').AuthoritySnapshot;
   querySnapshot(spec: QueryReadSpec): QuerySnapshot;
   localRevision(): LocalRevision;
   pendingCommits(): OutboxCommit[];