@syncular/tauri 0.15.7 → 0.15.9

package/dist/index.d.ts

@@ -26,7 +26,7 @@
  * `invoke`/`listen` either from its ESM entry points, from the ambient
  * `window.__TAURI__`, or via injected doubles (tests).
  */
-import type { ClientChangeListener, CommitOutcome, CommitOutcomeQuery, ConflictRecord, InvalidationListener, LeaseState, MutationInput, PresencePeer, QueryReadSpec, QuerySnapshot, RejectionRecord, ResolveCommitOutcomeInput, SchemaFloor, SqlRow, SqlValue, SyncStatusSnapshot, WindowBase, WindowState } from '@syncular/client';
+import type { ClientChangeListener, CommitOutcome, CommitOutcomeQuery, ConflictRecord, EncryptionKeyringConfig, InvalidationListener, LeaseState, MutationInput, PresencePeer, QueryReadSpec, QuerySnapshot, RejectionRecord, ResolveCommitOutcomeInput, SchemaFloor, SqlRow, SqlValue, SyncStatusSnapshot, WindowBase, WindowState } from '@syncular/client';
 /** One event pushed on `syncular://event` (the derived client-observable set). */
 interface SyncularEvent {
     readonly type: string;
@@ -53,6 +53,11 @@ export interface TauriSyncClientConfig {
     readonly clientId?: string;
     /** §4.2 client limits, forwarded to the native `create`. */
     readonly limits?: Record<string, unknown>;
+    /**
+     * Portable E2EE keys and declarative per-row key-id columns. Raw keys are
+     * encoded into the native command envelope and never sent to the server.
+     */
+    readonly encryption?: EncryptionKeyringConfig;
     /**
      * The Tauri primitives. Omit in a real Tauri webview to auto-resolve from
      * `@tauri-apps/api` (peer dep) or the ambient `window.__TAURI__`; inject in

package/dist/index.js

@@ -78,6 +78,17 @@ function encodeJsonValue(value) {
     }
     return value;
 }
+function encodeEncryption(config) {
+    return {
+        keys: Object.fromEntries(Object.entries(config.keys).map(([keyId, key]) => [
+            keyId,
+            { $bytes: bytesToHex(key) },
+        ])),
+        ...(config.keyIdColumns !== undefined
+            ? { keyIdColumns: config.keyIdColumns }
+            : {}),
+    };
+}
 /** Decode one query-result cell back to an `SqlValue` (`{$bytes}` → bytes). */
 function decodeCell(value) {
     if (isBytesEnvelope(value))
@@ -539,6 +550,9 @@ export async function createTauriSyncClient(config) {
                 ...(config.clientId !== undefined ? { clientId: config.clientId } : {}),
                 schema: config.schema,
                 ...(config.limits !== undefined ? { limits: config.limits } : {}),
+                ...(config.encryption !== undefined
+                    ? { encryption: encodeEncryption(config.encryption) }
+                    : {}),
             },
         },
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/tauri",
-  "version": "0.15.7",
+  "version": "0.15.9",
   "description": "Tauri integration for the Syncular client",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -48,12 +48,12 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@syncular/client": "0.15.7"
+    "@syncular/client": "0.15.9"
   },
   "peerDependencies": {
     "@tauri-apps/api": ">=2.0.0"
   },
   "devDependencies": {
-    "@syncular/react": "0.15.7"
+    "@syncular/react": "0.15.9"
   }
 }

package/src/index.ts

@@ -36,6 +36,7 @@ import type {
   CommitOutcome,
   CommitOutcomeQuery,
   ConflictRecord,
+  EncryptionKeyringConfig,
   InvalidationEvent,
   InvalidationListener,
   LeaseState,
@@ -91,6 +92,11 @@ export interface TauriSyncClientConfig {
   readonly clientId?: string;
   /** §4.2 client limits, forwarded to the native `create`. */
   readonly limits?: Record<string, unknown>;
+  /**
+   * Portable E2EE keys and declarative per-row key-id columns. Raw keys are
+   * encoded into the native command envelope and never sent to the server.
+   */
+  readonly encryption?: EncryptionKeyringConfig;
   /**
    * The Tauri primitives. Omit in a real Tauri webview to auto-resolve from
    * `@tauri-apps/api` (peer dep) or the ambient `window.__TAURI__`; inject in
@@ -157,6 +163,20 @@ function encodeJsonValue(value: unknown): unknown {
   return value;
 }
 
+function encodeEncryption(config: EncryptionKeyringConfig): unknown {
+  return {
+    keys: Object.fromEntries(
+      Object.entries(config.keys).map(([keyId, key]) => [
+        keyId,
+        { $bytes: bytesToHex(key) },
+      ]),
+    ),
+    ...(config.keyIdColumns !== undefined
+      ? { keyIdColumns: config.keyIdColumns }
+      : {}),
+  };
+}
+
 /** Decode one query-result cell back to an `SqlValue` (`{$bytes}` → bytes). */
 function decodeCell(value: unknown): SqlValue {
   if (isBytesEnvelope(value)) return hexToBytes(value.$bytes);
@@ -752,6 +772,9 @@ export async function createTauriSyncClient(
         ...(config.clientId !== undefined ? { clientId: config.clientId } : {}),
         schema: config.schema,
         ...(config.limits !== undefined ? { limits: config.limits } : {}),
+        ...(config.encryption !== undefined
+          ? { encryption: encodeEncryption(config.encryption) }
+          : {}),
       },
     },
   });