@syncular/tauri 0.15.15 → 0.15.16

package/README.md

@@ -54,6 +54,11 @@ detaching listeners, so disposing a resource does not leave a key-bearing core
 behind. The Rust core overwrites owned key buffers on replacement/drop; the app
 still owns OS secure-store deletion and any key buffers it supplied.
 
+Runtime `setHeaders()` is an active-session operation and is rejected during
+preflight at both the JavaScript and native command boundaries. Supply bootstrap
+headers through trusted plugin configuration; rotate them only after successful
+activation.
+
 ## React availability guard
 
 The Tauri bridge carries `currentSchemaVersion`, `schemaFloor`, and migration

package/dist/index.js

@@ -348,6 +348,7 @@ export class TauriSyncClient {
      * the realtime socket applies it on its next (re)connect.
      */
     async setHeaders(headers) {
+        this.#requireActive();
         const reply = await this.#tauri.invoke(`${PLUGIN}syncular_set_headers`, { headers });
         if (reply.error !== undefined) {
             throw new TauriSyncError(reply.error.code, reply.error.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/tauri",
-  "version": "0.15.15",
+  "version": "0.15.16",
   "description": "Tauri integration for the Syncular client",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -48,12 +48,12 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@syncular/client": "0.15.15"
+    "@syncular/client": "0.15.16"
   },
   "peerDependencies": {
     "@tauri-apps/api": ">=2.0.0"
   },
   "devDependencies": {
-    "@syncular/react": "0.15.15"
+    "@syncular/react": "0.15.16"
   }
 }

package/src/index.ts

@@ -509,6 +509,7 @@ export class TauriSyncClient {
    * the realtime socket applies it on its next (re)connect.
    */
   async setHeaders(headers: Readonly<Record<string, string>>): Promise<void> {
+    this.#requireActive();
     const reply = await this.#tauri.invoke<CommandReply>(
       `${PLUGIN}syncular_set_headers`,
       { headers },