Module api 

Driver-facing API shapes (JSON-able), mirroring the conformance ClientInstance contract: sync reports, conflicts, rejections, row states, unit states. Serialized as camelCase to cross the shim boundary unchanged.

Structs

AppliedServerCommit

JSON bindings carry the u64 revision as a decimal string (§7.5).

AuthorityReadDeclaration

Static read policy; never accepted as snapshot parameters.

ClientChangeBatch

ClientDiagnosticsHost

ClientDiagnosticsLease

ClientDiagnosticsReplica

ClientDiagnosticsSchema

ClientDiagnosticsSnapshot

ClientDiagnosticsStorage

ClientError

A structured failure from a local authoring API (mutate/patch). code is always a stable client.*/sync.* identity, message is static text with no table/row/column values, details carries SQLite classification evidence or the preserved legacy cause, and retryable is true only for transient storage contention. Callers read these fields instead of parsing a "<code>: " prefix.

ClientLimits

Client limits (§4.2 request knobs).

CommandEffects

CommitOperation

Schema-agnostic local operation retained with a failed final outcome.

CommitOutcome

CommitOutcomeQuery

ConflictRecord

CoverageSnapshot

CurrentBaseProof

Result of proving every retained base after a completed pull (§7.2.1).

DiagnosticLastChange

DiagnosticLastRound

DiagnosticQueryFailure

§7.6: the latest owned snapshot read of one query id failed.

DiagnosticRoundCounters

DiagnosticUnits

§7.6: registered units per state; a unit id never enters diagnostics.

EchoRecord

§4.4 one fenced record of a persisted echo: the effective lists the wildcard fence added for a covered table, or its revocation.

FetchedBlob

An owned blob body returned by the Rust client without driver encoding.

LeaseState

§7.3.5: the client’s opaque auth-lease state — leaseId/expiresAtMs from the last LEASE frame, and errorCode once a round was rejected with a request-level lease code (stop-and-surface; no data purge).

LocalDataPurgeInput

Durable local idempotency key plus exact routing targets. The host owns directive authenticity and subscription gating; the client owns SQLite.

LocalDataPurgeResult

Privacy-safe local purge acknowledgement; row ids never cross the bridge.

LocalDataPurgeTarget

One AND-combined application-authorized local purge target. Targets in one input are OR-combined. Selector columns must compile to plaintext strings; values are bounded code-like routing identifiers.

LocalDataRebootstrapInput

Durable application repair id. Reusing the id is an exact no-op.

LocalDataRebootstrapResult

Privacy-safe acknowledgement for a replicated-projection recovery.

PresencePeer

§8.6 a peer’s ephemeral presence document on a scope key.

PreviousVersionStatus

RFC 0005 A2: presence of the previous-version container file.

QueryOwner

§7.5: the query that owns a snapshot read. The id is application-owned, stable, and PHI-free; generated named queries pass their ID and TABLES.

QueryReadFailure

§7.5: a failed snapshot read or a failed local authoring write. code is client.storage_corrupt, client.storage_io, client.storage_full, or client.storage_busy when SQLite reported that condition, and None for every other failure, which keeps its existing message.

QuerySnapshot

RejectionDetails

Bounded code-like metadata explicitly declared safe for authorized client recovery UI. Diagnostic prose remains in RejectionRecord.message.

RejectionRecord

ResolveCommitOutcomeInput

RetainedCommitRow

RetainedUniqueConflict

RowState

SchemaFloor

SnapshotRead

§7.5: the result of one atomic snapshot read over a single SQLite read transaction: one revision, every requested read-only statement’s rows, requested window coverage, requested unit catch-up states, and requested commit deliveries.

SyncReport

SyncStatusSnapshot

TableChange

UnitRecord

§4.1 one registered unit as the client persists it.

WindowBase

§4.8 window base: the selected scope variable plus the fixed scope values every unit of its family shares. A base names no table: each unit covers every table declaring its variables (§4.1).

WindowChange

WindowCoverage

WindowState

§4.8 completeness oracle (I3): the windowed-in units for a base, plus the subset whose bootstrap has not yet completed. Registration alone is not completeness — a pending unit’s local replica may be empty or partial (it still has cursor: -1 or holds a resume token), and MUST NOT be rendered as complete. A unit with zero server rows still completes once its bootstrap round finishes.

WindowUnitRef

Enums

AppliedServerCommitSource

CommitDelivery

§7.5: delivery status for one client commit id. A commit still in the outbox is pending; a drained commit carries its persisted retained outcome; an id the client never held, or whose outcome was pruned by retention, is unknown. The outcome preserves every operation result, rejection code, and conflict. This is the persisted-journal view in both cores: it omits the owner-derived retained_rows images that SyncClient::commit_outcome attaches from its in-memory failed-commit cache.

CommitOperationOutcome

CommitOutcomeResolution

CommitOutcomeStatus

CurrentBaseProofReason

Mutation

One local mutation (§6.1 shapes, schema-agnostic local form per §0).

RealtimePolicy

§8.8: how this client treats the realtime binding for sync rounds.

RealtimeState

§8.8: the explicit availability state of the realtime binding. The TypeScript host adds unsupported (no connector configured) and unknown (a wrapper without evidence); the Rust core reaches neither because a transport always carries a connect path.

SyncIntent

SyncOutcome

sync() never panics or errors out-of-band: transport and protocol failures come back as Failed (the driver’s { ok: false }).

TimeBucketUnit

TransportCauseKind

Bounded transport classification for progress and diagnostics (§1.8).

UnitCatchup

§7.5: the catch-up state of one unit as persisted in the snapshot, never the mutable owner cache. Unknown means the client does not currently hold the unit (never registered, released, or removed).

UnitStatus

§4.1 persisted unit status.

Constants

CLIENT_DIAGNOSTICS_VERSION

LOCAL_AUTHORITY_UNCONFIGURED_CODE

§12 client-local code: a local-authority call or config on a host that has no local authority (the build lacks the local-authority feature, the config names no localAuthorityPath, or attach has no remote server).

MAX_DIAGNOSTIC_QUERY_FAILURES

REALTIME_LOST_CODE

§8.8 client-local code: a connected socket ended without a deliberate disconnect and the round reported no transport code. Never a wire code.

REALTIME_UNAVAILABLE_CODE

§8.8 client-local code: the required policy refused a sync round because the realtime socket is not connected. Never a wire code (§10.3).

Functions

creation_time_bucket

Derive the immutable UTC scope value stored when a row is created.

last

Return a rolling UTC month window ordered from oldest to newest.

Type Aliases

QueryRow

One dynamic query result row, keyed by QueryIR runtime projection name.

QueryValue

Stable dynamic value boundary used by generated named queries.

UnitScopes

§4.1: a unit’s scope map, one value per requested scope variable.