Validate sync keys and reconcile local data

src/store/slices/syncSlice.ts

@@ -68,15 +68,47 @@ export const syncFromFlaskBulk = createAsyncThunk(
   async (_, { rejectWithValue }) => {
     try {
       const data = await fetchAllFromFlask()
-      
+      const allowedStoreNames = new Set(['files', 'models', 'components', 'workflows'])
+      const serverIdsByStore = {
+        files: new Set<string>(),
+        models: new Set<string>(),
+        components: new Set<string>(),
+        workflows: new Set<string>(),
+      }
+
       for (const [key, value] of Object.entries(data)) {
-        const [storeName, id] = key.split(':')
-        
-        if (storeName === 'files' || 
-            storeName === 'models' || 
-            storeName === 'components' || 
-            storeName === 'workflows') {
-          await db.put(storeName as any, value)
+        if (typeof key !== 'string') {
+          continue
+        }
+
+        const parts = key.split(':')
+        if (parts.length !== 2) {
+          continue
+        }
+
+        const [storeName, id] = parts
+        if (!storeName || !id) {
+          continue
+        }
+
+        if (!allowedStoreNames.has(storeName)) {
+          continue
+        }
+
+        serverIdsByStore[storeName as keyof typeof serverIdsByStore].add(id)
+        await db.put(storeName as any, value)
+      }
+
+      // Explicit merge strategy: server is source of truth; delete local records missing from server response.
+      const storeNames = Array.from(allowedStoreNames)
+      for (const storeName of storeNames) {
+        const localRecords = await db.getAll(storeName as any)
+        for (const record of localRecords) {
+          const recordId = record?.id
+          const recordIdString = recordId == null ? '' : String(recordId)
+          if (!serverIdsByStore[storeName as keyof typeof serverIdsByStore].has(recordIdString)) {
+            await db.delete(storeName as any, recordId)
+          }
         }
       }