Refactor VPN proxy client implementation

test/web/harbor-state.test.js

@@ -5,7 +5,9 @@ import {
   classifySyncError,
   harborReducer,
   initialHarborState,
-} from '../../src/web/state/harborReducer.js';
+} from '../../.test-dist/src/web/state/harborReducer.js';
+import { parseHarborState } from '../../.test-dist/src/web/api/harborClient.js';
+import { createStateSnapshot } from '../../.test-dist/src/shared/contracts/state.js';
 
 const snapshot = (revision, desiredServerId = '', serverIds = ['one', 'two']) => ({
   apiVersion: 1,
@@ -26,6 +28,40 @@ function deferred() {
   return { promise, resolve };
 }
 
+test('typed Harbor client validates unknown state and isolates wire compatibility fields', () => {
+  const snapshot = createStateSnapshot({
+    storedState: {},
+    runtime: { running: false },
+    gatewayAuto: null,
+    appMode: 'client',
+    configExists: false,
+    subscriptionHost: '',
+    now: new Date('2026-07-11T12:00:00.000Z'),
+  });
+  const parsed = parseHarborState({
+    ...snapshot,
+    proxyPort: 9082,
+    configExists: true,
+    gatewayAuto: { available: true },
+  });
+
+  assert.deepEqual(parsed.clientRuntime, {
+    proxyPort: 9082,
+    configured: true,
+    gatewayAvailable: true,
+  });
+  assert.equal(Object.hasOwn(parsed, 'proxyPort'), false);
+  let incompatible;
+  try {
+    parseHarborState({ ...snapshot, revision: -1 });
+  } catch (error) {
+    incompatible = error;
+  }
+  assert.equal(incompatible.code, 'INCOMPATIBLE_API');
+  const failed = harborReducer(initialHarborState, { type: 'sync-failed', error: incompatible });
+  assert.equal(failed.transport.bootStatus, 'incompatible-api');
+});
+
 test('data invariant: an older polling promise cannot replace a newer mutation snapshot', async () => {
   let state = receive(initialHarborState, snapshot(1, 'one'));
   const poll = deferred();