Module api 

Driver-facing API shapes (JSON-able), mirroring the conformance ClientInstance contract: sync reports, conflicts, rejections, row states, subscription states. Serialized as camelCase to cross the shim boundary unchanged.

Structs

AuthorityReadDeclaration

Static read policy; never accepted as snapshot parameters.

ClientChangeBatch

JSON bindings carry the u64 revision as a decimal string (§7.5).

ClientDiagnosticsHost

ClientDiagnosticsLease

ClientDiagnosticsReplica

ClientDiagnosticsRequest

ClientDiagnosticsSchema

ClientDiagnosticsSnapshot

ClientDiagnosticsStorage

ClientError

A structured failure from a local authoring API (mutate/patch). code is always a stable client.*/sync.* identity, message is static text with no table/row/column values, details carries SQLite classification evidence or the preserved legacy cause, and retryable is true only for transient storage contention. Callers read these fields instead of parsing a "<code>: " prefix.

ClientLimits

Client limits (§4.2 request knobs).

CommandEffects

CommitOperation

Schema-agnostic local operation retained with a failed final outcome.

CommitOutcome

CommitOutcomeQuery

ConflictRecord

CoverageSnapshot

DiagnosticLastChange

DiagnosticLastRound

DiagnosticQueryFailure

§7.6: the latest owned snapshot read of one query id failed.

DiagnosticRoundCounters

DiagnosticSubscription

ExpectedDiagnosticSubscription

FetchedBlob

An owned blob body returned by the Rust client without driver encoding.

LeaseState

§7.3.5: the client’s opaque auth-lease state — leaseId/expiresAtMs from the last LEASE frame, and errorCode once a round was rejected with a request-level lease code (stop-and-surface; no data purge).

LocalDataPurgeInput

Durable local idempotency key plus exact routing targets. The host owns directive authenticity and subscription gating; the client owns SQLite.

LocalDataPurgeResult

Privacy-safe local purge acknowledgement; row ids never cross the bridge.

LocalDataPurgeTarget

One AND-combined application-authorized local purge target. Targets in one input are OR-combined. Selector columns must compile to plaintext strings; values are bounded code-like routing identifiers.

LocalDataRebootstrapInput

Durable application repair id. Reusing the id is an exact no-op.

LocalDataRebootstrapResult

Privacy-safe acknowledgement for a replicated-projection recovery.

PresencePeer

§8.6 a peer’s ephemeral presence document on a scope key.

PreviousVersionStatus

RFC 0005 A2: presence of the previous-version container file.

QueryOwner

§7.5: the query that owns a snapshot read. The id is application-owned, stable, and PHI-free; generated named queries pass their ID and TABLES.

QueryReadFailure

§7.5: a failed snapshot read or a failed local authoring write. code is client.storage_corrupt, client.storage_io, client.storage_full, or client.storage_busy when SQLite reported that condition, and None for every other failure, which keeps its existing message.

QuerySnapshot

RejectionDetails

Bounded code-like metadata explicitly declared safe for authorized client recovery UI. Diagnostic prose remains in RejectionRecord.message.

RejectionRecord

ResolveCommitOutcomeInput

RetainedCommitRow

RetainedUniqueConflict

RowState

SchemaFloor

SnapshotRead

§7.5: the result of one atomic snapshot read over a single SQLite read transaction: one revision, every requested read-only statement’s rows, requested window coverage, requested subscription catch-up states, and requested commit deliveries.

SubscriptionStateView

SyncReport

SyncStatusSnapshot

TableChange

WindowBase

§4.8 window base: one table, the scope variable whose values are the window units, any fixed scopes shared by every unit, and host-opaque params carried onto each unit’s subscription.

WindowChange

WindowCoverage

WindowState

§4.8 completeness oracle (I3): the windowed-in units for a base, plus the subset whose bootstrap has not yet completed. Registration alone is not completeness — a pending unit’s local replica may be empty or partial (its subscription still has cursor: -1 or holds a resume token), and MUST NOT be rendered as complete. A unit with zero server rows still completes once its bootstrap round finishes.

WindowUnitRef

Enums

CommitDelivery

§7.5: delivery status for one client commit id. A commit still in the outbox is pending; a drained commit carries its persisted retained outcome; an id the client never held, or whose outcome was pruned by retention, is unknown. The outcome preserves every operation result, rejection code, and conflict. This is the persisted-journal view in both cores: it omits the owner-derived retained_rows images that SyncClient::commit_outcome attaches from its in-memory failed-commit cache.

CommitOperationOutcome

CommitOutcomeResolution

CommitOutcomeStatus

Mutation

One local mutation (§6.1 shapes, schema-agnostic local form per §0).

RealtimePolicy

§8.8: how this client treats the realtime binding for sync rounds.

RealtimeState

§8.8: the explicit availability state of the realtime binding. The TypeScript host adds unsupported (no connector configured) and unknown (a wrapper without evidence); the Rust core reaches neither because a transport always carries a connect path.

SubscriptionCatchup

§7.5: the catch-up state of one subscription, read from the persisted subscription record inside the snapshot transaction (never the mutable owner cache). Unknown means the client does not currently hold the subscription (it was never registered, or it was forgotten or removed); it carries no fabricated table or cursor. A known state carries the persisted status (active, revoked, or failed), the cursor, and whether a resume token is held. A reset subscription stays active with cursor < 0; it is not a fourth status.

SyncIntent

SyncOutcome

sync() never panics or errors out-of-band: transport and protocol failures come back as Failed (the driver’s { ok: false }).

TimeBucketUnit

Constants

CLIENT_DIAGNOSTICS_VERSION

MAX_DIAGNOSTIC_EXPECTED_SUBSCRIPTIONS

MAX_DIAGNOSTIC_QUERY_FAILURES

REALTIME_LOST_CODE

§8.8 client-local code: a connected socket ended without a deliberate disconnect and the round reported no transport code. Never a wire code.

REALTIME_UNAVAILABLE_CODE

§8.8 client-local code: the required policy refused a sync round because the realtime socket is not connected. Never a wire code (§10.3).

Functions

creation_time_bucket

Derive the immutable UTC scope value stored when a row is created.

last

Return a rolling UTC month window ordered from oldest to newest.

Type Aliases

QueryRow

One dynamic query result row, keyed by QueryIR runtime projection name.

QueryValue

Stable dynamic value boundary used by generated named queries.