@syncular/tauri 0.15.42 → 0.15.43

package/dist/index.d.ts

@@ -84,8 +84,16 @@ export declare class TauriSyncClient {
     __dispatchEvent(event: SyncularEvent): void;
     securityLifecycle(): Promise<SecurityLifecycle>;
     beginSecurityPreflight(): Promise<void>;
+    /**
+     * Complete the security preflight. `headers` optionally carries a fresh
+     * FULL transport header set that the native host applies atomically with
+     * the activation, before the startup sync it enqueues — so a preflight
+     * that outlives the boot token starts its first round with valid
+     * credentials (the direct `setHeaders` path stays refused while gated).
+     */
     activateSecurity(options?: {
         readonly encryption?: EncryptionKeyringConfig;
+        readonly headers?: Readonly<Record<string, string>>;
     }): Promise<void>;
     onInvalidate(listener: InvalidationListener): () => void;
     onChange(listener: ClientChangeListener): () => void;

package/dist/index.js

@@ -158,6 +158,7 @@ export class TauriSyncClient {
     #closed = false;
     #securityLifecycle;
     #preflightBarrier;
+    #diagnosticsEnabled = false;
     /** @internal — use {@link createTauriSyncClient}. */
     constructor(tauri, unlisten, securityLifecycle = 'active') {
         this.#tauri = tauri;
@@ -277,6 +278,13 @@ export class TauriSyncClient {
         });
         return barrier;
     }
+    /**
+     * Complete the security preflight. `headers` optionally carries a fresh
+     * FULL transport header set that the native host applies atomically with
+     * the activation, before the startup sync it enqueues — so a preflight
+     * that outlives the boot token starts its first round with valid
+     * credentials (the direct `setHeaders` path stays refused while gated).
+     */
     async activateSecurity(options = {}) {
         if (this.#securityLifecycle === 'active') {
             throw new TauriSyncError('sync.invalid_request', 'activateSecurity requires the client to be in security preflight');
@@ -286,6 +294,7 @@ export class TauriSyncClient {
             ...(options.encryption !== undefined
                 ? { encryption: encodeEncryption(options.encryption) }
                 : {}),
+            ...(options.headers !== undefined ? { headers: options.headers } : {}),
         });
         this.#securityLifecycle = 'active';
     }
@@ -299,8 +308,32 @@ export class TauriSyncClient {
     }
     onDiagnostics(listener) {
         this.#diagnosticsListeners.add(listener);
+        this.#enableDiagnosticsPush();
         return () => this.#diagnosticsListeners.delete(listener);
     }
+    /**
+     * Host-local push registration: the native core emits pushed diagnostics
+     * snapshots only once a consumer is known (a `diagnosticsSnapshot` pull, or
+     * this explicit `enableDiagnostics` signal). Fired once, on the first
+     * registered listener, fire-and-forget. The invoke deliberately bypasses
+     * the bridge's preflight gate — the command is a pure observability
+     * registration handled before dispatch, and the native side stays silent
+     * until activation anyway. Errors are tolerated: an older native core
+     * rejects the unknown command, and the mount-time snapshot pull path keeps
+     * `useDiagnostics` working there.
+     */
+    #enableDiagnosticsPush() {
+        if (this.#diagnosticsEnabled || this.#closed)
+            return;
+        this.#diagnosticsEnabled = true;
+        void this.#tauri
+            .invoke(`${PLUGIN}syncular_command`, {
+            command: { method: 'enableDiagnostics', params: {} },
+        })
+            .catch(() => {
+            /* fire-and-forget; an error reply is equally ignored above */
+        });
+    }
     onPresence(listener) {
         this.#presenceListeners.add(listener);
         return () => this.#presenceListeners.delete(listener);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/tauri",
-  "version": "0.15.42",
+  "version": "0.15.43",
   "description": "Tauri integration for the Syncular client",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -48,12 +48,12 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@syncular/client": "0.15.42"
+    "@syncular/client": "0.15.43"
   },
   "peerDependencies": {
     "@tauri-apps/api": ">=2.0.0"
   },
   "devDependencies": {
-    "@syncular/react": "0.15.42"
+    "@syncular/react": "0.15.43"
   }
 }

package/src/index.ts

@@ -265,6 +265,7 @@ export class TauriSyncClient {
   #closed = false;
   #securityLifecycle: SecurityLifecycle;
   #preflightBarrier: Promise<void> | undefined;
+  #diagnosticsEnabled = false;
 
   /** @internal — use {@link createTauriSyncClient}. */
   constructor(
@@ -408,8 +409,18 @@ export class TauriSyncClient {
     return barrier;
   }
 
+  /**
+   * Complete the security preflight. `headers` optionally carries a fresh
+   * FULL transport header set that the native host applies atomically with
+   * the activation, before the startup sync it enqueues — so a preflight
+   * that outlives the boot token starts its first round with valid
+   * credentials (the direct `setHeaders` path stays refused while gated).
+   */
   async activateSecurity(
-    options: { readonly encryption?: EncryptionKeyringConfig } = {},
+    options: {
+      readonly encryption?: EncryptionKeyringConfig;
+      readonly headers?: Readonly<Record<string, string>>;
+    } = {},
   ): Promise<void> {
     if (this.#securityLifecycle === 'active') {
       throw new TauriSyncError(
@@ -422,6 +433,7 @@ export class TauriSyncClient {
       ...(options.encryption !== undefined
         ? { encryption: encodeEncryption(options.encryption) }
         : {}),
+      ...(options.headers !== undefined ? { headers: options.headers } : {}),
     });
     this.#securityLifecycle = 'active';
   }
@@ -438,9 +450,33 @@ export class TauriSyncClient {
 
   onDiagnostics(listener: ClientDiagnosticsListener): () => void {
     this.#diagnosticsListeners.add(listener);
+    this.#enableDiagnosticsPush();
     return () => this.#diagnosticsListeners.delete(listener);
   }
 
+  /**
+   * Host-local push registration: the native core emits pushed diagnostics
+   * snapshots only once a consumer is known (a `diagnosticsSnapshot` pull, or
+   * this explicit `enableDiagnostics` signal). Fired once, on the first
+   * registered listener, fire-and-forget. The invoke deliberately bypasses
+   * the bridge's preflight gate — the command is a pure observability
+   * registration handled before dispatch, and the native side stays silent
+   * until activation anyway. Errors are tolerated: an older native core
+   * rejects the unknown command, and the mount-time snapshot pull path keeps
+   * `useDiagnostics` working there.
+   */
+  #enableDiagnosticsPush(): void {
+    if (this.#diagnosticsEnabled || this.#closed) return;
+    this.#diagnosticsEnabled = true;
+    void this.#tauri
+      .invoke<CommandReply>(`${PLUGIN}syncular_command`, {
+        command: { method: 'enableDiagnostics', params: {} },
+      })
+      .catch(() => {
+        /* fire-and-forget; an error reply is equally ignored above */
+      });
+  }
+
   onPresence(listener: (scopeKey: string) => void): () => void {
     this.#presenceListeners.add(listener);
     return () => this.#presenceListeners.delete(listener);