@syncular/tauri 0.30.13 → 0.30.15

package/README.md

@@ -153,7 +153,8 @@ quarantine, or crash-resumed cleanup must finish before clinical data is
 available. The native database opens and migrates, but query/snapshot, mutation,
 subscription, sync, realtime, presence, blob, and automatic retry work fails
 with `client.security_preflight_required`. Status, local revision, lifecycle,
-and `purgeLocalData` remain available.
+and `purgeLocalData` remain available. A creation-time `defineAuthorityReads`
+policy also enables the read-only `authoritySnapshot()` described below.
 
 ```ts
 const client = await createTauriSyncClient({
@@ -180,6 +181,76 @@ with `setHeaders()` only after successful activation. Closed clients reject data
 and control calls with `client.closed` before testing preflight; listener
 registration and local progress reads throw that code. `close()` is idempotent.
 
+## Authority evidence before activation
+
+Declare authority reads at client creation with `defineAuthorityReads` from
+`@syncular/client`. Each table declares plain columns, including its primary
+key and scope columns, and concrete scope selectors. These selectors remain
+fixed for that client. A declaration cannot include encrypted, bytes, blob,
+CRDT or internal columns. Choose only authority fields; clinical fields and
+credentials do not belong in this policy.
+
+```ts
+import { defineAuthorityReads } from '@syncular/client';
+
+const client = await createTauriSyncClient({
+  schema,
+  securityPreflight: true,
+  transportEnabled: false,
+  authorityReads: defineAuthorityReads([{
+    table: 'memberships',
+    columns: ['id', 'user_id', 'facility_id', 'status', 'version'],
+    scopes: { membership_id: acceptedMembershipIds },
+  }]),
+});
+const evidence = await client.authoritySnapshot();
+```
+
+The native application must also set an independent ceiling at plugin creation:
+
+```rust
+let config = SyncularConfig {
+    authority_columns: [("memberships".into(), vec![
+        "id".into(), "user_id".into(), "facility_id".into(),
+        "status".into(), "version".into(),
+    ])].into(),
+    ..Default::default()
+};
+```
+
+Rust rejects any webview declaration outside that ceiling. It also validates
+columns against the schema. `authoritySnapshot()` accepts zero arguments;
+forged IPC carrying SQL, replacement tables or columns fails with
+`client.authority_read_forbidden`. Ordinary `query`, `querySnapshot` and writes
+still fail with `client.security_preflight_required`.
+
+The result contains `revision: bigint`, `complete`, and `tables`. Every table
+contains accepted `rows` (`values`, server `version`, `hasLocalIntent`), scoped
+`localIntentRowIds`, the declared `scopes`, `coverage`, and sanitized
+`persisted` subscription evidence (`requestedScopes`, `effectiveScopes`,
+`cursor`, `status`, `complete`). It exposes no intended values, bootstrap
+tokens, subscription parameters or keys. Both cores read rows, revision and
+coverage in one SQLite snapshot. The native authority read runs on the mutable
+owner; it does not use the ordinary query sidecar or its latency contract.
+
+`coverage` is `complete`, `pending` or `missing`. Complete coverage requires
+completed unfiltered subscriptions for every requested scope tuple. Several
+subscriptions can cover the selection together. Scope loss and an unfinished
+bootstrap invalidate completeness. Completed empty coverage has an empty row
+set. The application must reject admission when an expected authority row is
+absent, even when the set is complete.
+
+Accepted bases remain separate from pending, failed and protected ACK intent.
+A local-only creation appears only in `localIntentRowIds`. The application
+validates the complete chain against independently accepted authority evidence,
+actor/device identity, signed lease and trusted time before installing keys.
+The SDK does not authorize the application. The read changes no lifecycle,
+transport, keyring, subscriptions or rows.
+
+The direct Bun/SQLite client and worker handle expose the same policy and
+snapshot shape. Importing the policy is opt-in; ordinary clients do not ship
+its reader. Update npm packages and native crates together and rebuild the app.
+
 ## Privacy-safe diagnostics
 
 `diagnosticsSnapshot({ expectedSubscriptions })` and `onDiagnostics(listener)`

package/dist/index.d.ts

@@ -28,7 +28,7 @@ import type { ClientSnapshotMethods, PromiseMethods } from '@syncular/client';
  * `invoke`/`listen` either from its ESM entry points, from the ambient
  * `window.__TAURI__`, or via injected doubles (tests).
  */
-import type { ClientChangeListener, ClientDiagnosticsListener, ClientDiagnosticsRequest, ClientDiagnosticsSnapshot, CommitOutcome, CommitOutcomeQuery, ConflictRecord, EncryptionKeyringConfig, InvalidationListener, LocalDataPurgeInput, LocalDataPurgeResult, LocalDataRebootstrapInput, LocalDataRebootstrapResult, MutationInput, PresencePeer, PreviousVersionAudit, PreviousVersionReadSpec, PreviousVersionSnapshot, QueryReadSpec, QuerySnapshot, RejectionRecord, ResolveCommitOutcomeInput, SecurityLifecycle, SqlRow, SqlValue, SyncClientConfig, SyncStatusSnapshot, WindowBase, WindowState } from '@syncular/client';
+import type { AuthorityReadPolicy, AuthoritySnapshot, ClientChangeListener, ClientDiagnosticsListener, ClientDiagnosticsRequest, ClientDiagnosticsSnapshot, CommitOutcome, CommitOutcomeQuery, ConflictRecord, EncryptionKeyringConfig, InvalidationListener, LocalDataPurgeInput, LocalDataPurgeResult, LocalDataRebootstrapInput, LocalDataRebootstrapResult, MutationInput, PresencePeer, PreviousVersionAudit, PreviousVersionReadSpec, PreviousVersionSnapshot, QueryReadSpec, QuerySnapshot, RejectionRecord, ResolveCommitOutcomeInput, SecurityLifecycle, SqlRow, SqlValue, SyncClientConfig, SyncStatusSnapshot, WindowBase, WindowState } from '@syncular/client';
 /** One event pushed on `syncular://event` (the derived client-observable set). */
 interface SyncularEvent {
     readonly type: string;
@@ -74,6 +74,8 @@ export interface TauriSyncClientConfig {
      * encoded into the native command envelope and never sent to the server.
      */
     readonly encryption?: EncryptionKeyringConfig;
+    /** Fixed plain authority reads permitted before security activation. */
+    readonly authorityReads?: AuthorityReadPolicy;
     /** Open the native replica behind the fail-closed security gate. */
     readonly securityPreflight?: boolean;
     /** Open local storage with network transport closed until explicitly resumed. */
@@ -126,6 +128,7 @@ export declare class TauriSyncClient implements PromiseMethods<ClientSnapshotMet
     onDiagnostics(listener: ClientDiagnosticsListener): () => void;
     onPresence(listener: (scopeKey: string) => void): () => void;
     query(sql: string, params?: readonly SqlValue[]): Promise<SqlRow[]>;
+    authoritySnapshot(): Promise<AuthoritySnapshot>;
     querySnapshot<Row = SqlRow>(spec: QueryReadSpec): Promise<QuerySnapshot<Row>>;
     localRevision(): Promise<bigint>;
     statusSnapshot(): Promise<SyncStatusSnapshot>;

package/dist/index.js

@@ -163,6 +163,7 @@ export class TauriSyncClient {
         this.#requireOpen();
         if (this.#securityLifecycle === 'preflight' &&
             ![
+                'authoritySnapshot',
                 'securityLifecycle',
                 'beginSecurityPreflight',
                 'activateSecurity',
@@ -364,6 +365,24 @@ export class TauriSyncClient {
         const rows = reply.result.rows ?? [];
         return rows.map((r) => decodeRow(r));
     }
+    async authoritySnapshot() {
+        this.#requireOpen();
+        if (arguments.length)
+            throw new TauriSyncError('client.authority_read_forbidden', 'authoritySnapshot accepts no arguments');
+        const result = (await this.#command('authoritySnapshot', {}));
+        this.#requireOpen();
+        return {
+            ...result,
+            revision: BigInt(result.revision),
+            tables: result.tables.map((table) => ({
+                ...table,
+                rows: table.rows.map((row) => ({
+                    ...row,
+                    values: decodeRow(row.values),
+                })),
+            })),
+        };
+    }
     async querySnapshot(spec) {
         this.#requireActive();
         const reply = await this.#tauri.invoke(`${PLUGIN}syncular_query_snapshot`, {
@@ -578,19 +597,20 @@ export class TauriSyncClient {
     async close() {
         if (this.#closed)
             return;
+        const shutdown = this.#command('shutdown', {});
+        this.#closed = true;
         try {
-            await this.#command('shutdown', {});
+            await shutdown;
         }
         finally {
-            this.#closed = true;
+            this.#unlisten?.();
+            this.#unlisten = undefined;
+            this.#invalidationListeners.clear();
+            this.#progress.clear();
+            this.#changeListeners.clear();
+            this.#diagnosticsListeners.clear();
+            this.#presenceListeners.clear();
         }
-        this.#unlisten?.();
-        this.#unlisten = undefined;
-        this.#invalidationListeners.clear();
-        this.#progress.clear();
-        this.#changeListeners.clear();
-        this.#diagnosticsListeners.clear();
-        this.#presenceListeners.clear();
     }
 }
 function decodeDiagnosticsSnapshot(value, kind) {
@@ -743,6 +763,9 @@ export async function createTauriSyncClient(config) {
                 ...(config.transportEnabled !== undefined
                     ? { transportEnabled: config.transportEnabled }
                     : {}),
+                ...(config.authorityReads !== undefined
+                    ? { authorityReads: config.authorityReads.declarations }
+                    : {}),
                 ...(config.securityPreflight !== undefined
                     ? { securityPreflight: config.securityPreflight }
                     : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/tauri",
-  "version": "0.30.13",
+  "version": "0.30.15",
   "description": "Tauri integration for the Syncular client",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -48,13 +48,13 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@syncular/client": "0.30.13"
+    "@syncular/client": "0.30.15"
   },
   "peerDependencies": {
     "@tauri-apps/api": ">=2.0.0"
   },
   "devDependencies": {
-    "@syncular/react": "0.30.13",
-    "@syncular/server": "0.30.13"
+    "@syncular/react": "0.30.15",
+    "@syncular/server": "0.30.15"
   }
 }

package/src/index.ts

@@ -34,6 +34,8 @@ import type { ClientSnapshotMethods, PromiseMethods } from '@syncular/client';
  */
 
 import type {
+  AuthorityReadPolicy,
+  AuthoritySnapshot,
   ClientChangeBatch,
   ClientChangeListener,
   ClientDiagnosticsListener,
@@ -139,6 +141,8 @@ export interface TauriSyncClientConfig {
    * encoded into the native command envelope and never sent to the server.
    */
   readonly encryption?: EncryptionKeyringConfig;
+  /** Fixed plain authority reads permitted before security activation. */
+  readonly authorityReads?: AuthorityReadPolicy;
   /** Open the native replica behind the fail-closed security gate. */
   readonly securityPreflight?: boolean;
   /** Open local storage with network transport closed until explicitly resumed. */
@@ -346,6 +350,7 @@ export class TauriSyncClient implements PromiseMethods<ClientSnapshotMethods> {
     if (
       this.#securityLifecycle === 'preflight' &&
       ![
+        'authoritySnapshot',
         'securityLifecycle',
         'beginSecurityPreflight',
         'activateSecurity',
@@ -588,6 +593,31 @@ export class TauriSyncClient implements PromiseMethods<ClientSnapshotMethods> {
     return rows.map((r) => decodeRow(r as Record<string, unknown>));
   }
 
+  async authoritySnapshot(): Promise<AuthoritySnapshot> {
+    this.#requireOpen();
+    if (arguments.length)
+      throw new TauriSyncError(
+        'client.authority_read_forbidden',
+        'authoritySnapshot accepts no arguments',
+      );
+    const result = (await this.#command('authoritySnapshot', {})) as Omit<
+      AuthoritySnapshot,
+      'revision'
+    > & { revision: string };
+    this.#requireOpen();
+    return {
+      ...result,
+      revision: BigInt(result.revision),
+      tables: result.tables.map((table) => ({
+        ...table,
+        rows: table.rows.map((row) => ({
+          ...row,
+          values: decodeRow(row.values),
+        })),
+      })),
+    };
+  }
+
   async querySnapshot<Row = SqlRow>(
     spec: QueryReadSpec,
   ): Promise<QuerySnapshot<Row>> {
@@ -932,18 +962,19 @@ export class TauriSyncClient implements PromiseMethods<ClientSnapshotMethods> {
   /** Shut down the native core, release its keyring, then detach listeners. */
   async close(): Promise<void> {
     if (this.#closed) return;
+    const shutdown = this.#command('shutdown', {});
+    this.#closed = true;
     try {
-      await this.#command('shutdown', {});
+      await shutdown;
     } finally {
-      this.#closed = true;
+      this.#unlisten?.();
+      this.#unlisten = undefined;
+      this.#invalidationListeners.clear();
+      this.#progress.clear();
+      this.#changeListeners.clear();
+      this.#diagnosticsListeners.clear();
+      this.#presenceListeners.clear();
     }
-    this.#unlisten?.();
-    this.#unlisten = undefined;
-    this.#invalidationListeners.clear();
-    this.#progress.clear();
-    this.#changeListeners.clear();
-    this.#diagnosticsListeners.clear();
-    this.#presenceListeners.clear();
   }
 }
 
@@ -1119,6 +1150,9 @@ export async function createTauriSyncClient(
         ...(config.transportEnabled !== undefined
           ? { transportEnabled: config.transportEnabled }
           : {}),
+        ...(config.authorityReads !== undefined
+          ? { authorityReads: config.authorityReads.declarations }
+          : {}),
         ...(config.securityPreflight !== undefined
           ? { securityPreflight: config.securityPreflight }
           : {}),