@abloatai/ablo 0.24.0 → 0.26.0

package/dist/errors.d.ts

@@ -162,22 +162,22 @@ export declare class AbloStaleContextError extends AbloError {
     /** Sync id at the caller's `readAt` when the write was attempted. */
     readonly readAt?: number;
     /** Entities that received deltas between `readAt` and the write. */
-    readonly conflicts?: ReadonlyArray<{
+    readonly conflicts?: readonly {
         readonly model: string;
         readonly id: string;
         readonly observedSyncId: number;
-    }>;
+    }[];
     constructor(message: string, options?: {
         code?: ErrorCode;
         httpStatus?: number;
         requestId?: string;
         cause?: unknown;
         readAt?: number;
-        conflicts?: ReadonlyArray<{
+        conflicts?: readonly {
             readonly model: string;
             readonly id: string;
             readonly observedSyncId: number;
-        }>;
+        }[];
     });
 }
 /**
@@ -240,13 +240,13 @@ export declare function formatClaimedErrorMessage(args: {
  */
 export declare class AbloClaimedError extends AbloError {
     readonly type: "AbloClaimedError";
-    readonly claims?: ReadonlyArray<ClaimErrorClaim>;
+    readonly claims?: readonly ClaimErrorClaim[];
     constructor(message: string, options?: {
         code?: ErrorCode;
         httpStatus?: number;
         requestId?: string;
         cause?: unknown;
-        claims?: ReadonlyArray<ClaimErrorClaim>;
+        claims?: readonly ClaimErrorClaim[];
     });
 }
 /**
@@ -373,6 +373,17 @@ export declare class SyncSessionError extends AbloAuthenticationError {
      */
     static isSessionErrorResponse(status: number, body?: string): boolean;
 }
+/**
+ * WS-close analog of {@link SyncSessionError.isSessionErrorResponse}'s
+ * access-vs-session split: `true` for close reasons that mean the SHORT-LIVED
+ * access credential (`ek_`/`rk_`) passed its expiry — the hub's keepalive
+ * reaper closes such sockets with `4001 'credential_expired'`. Re-mintable
+ * from the still-valid login, so the connection layer silently re-mints and
+ * reconnects; never a sign-out, never a local-data clear. Every OTHER session
+ * close reason (key revocation, genuine login loss) stays terminal — a
+ * revoked credential must not be silently re-minted around.
+ */
+export declare function isAccessCredentialExpiryCloseReason(reason: string): boolean;
 /**
  * Coerce ANY thrown value into an {@link AbloError} — the last-line guarantee
  * that an SDK consumer never catches an untagged error. An already-typed
@@ -405,7 +416,7 @@ export declare function errorFromWire(message: string, opts?: {
     httpStatus?: number;
     requestId?: string;
     requiredCapability?: RequiredCapability;
-    claims?: ReadonlyArray<ClaimErrorClaim>;
+    claims?: readonly ClaimErrorClaim[];
 }): AbloError;
 /**
  * Translate an HTTP response into the appropriate typed error.

package/dist/errors.js

@@ -368,7 +368,7 @@ export class SyncSessionError extends AbloAuthenticationError {
             return true;
         }
         if (error && typeof error === 'object' && 'isSessionError' in error) {
-            return error.isSessionError === true;
+            return error.isSessionError;
         }
         return false;
     }
@@ -399,6 +399,19 @@ export class SyncSessionError extends AbloAuthenticationError {
         return status === 401;
     }
 }
+/**
+ * WS-close analog of {@link SyncSessionError.isSessionErrorResponse}'s
+ * access-vs-session split: `true` for close reasons that mean the SHORT-LIVED
+ * access credential (`ek_`/`rk_`) passed its expiry — the hub's keepalive
+ * reaper closes such sockets with `4001 'credential_expired'`. Re-mintable
+ * from the still-valid login, so the connection layer silently re-mints and
+ * reconnects; never a sign-out, never a local-data clear. Every OTHER session
+ * close reason (key revocation, genuine login loss) stays terminal — a
+ * revoked credential must not be silently re-minted around.
+ */
+export function isAccessCredentialExpiryCloseReason(reason) {
+    return reason === 'credential_expired' || classifyRecovery(reason) === 'access_credential_expiry';
+}
 // ── HTTP → class mapping ──────────────────────────────────────────────
 const OptionalWireStringSchema = z.preprocess((value) => (typeof value === 'string' ? value : undefined), z.string().optional());
 const RequiredCapabilityWireSchema = z

package/dist/index.js

@@ -56,6 +56,11 @@
 // `import { Ablo }` also compiles.
 export { Ablo } from './client/Ablo.js';
 export { DEFAULT_CONTENTION_RETRIES } from './client/functionalUpdate.js';
+// The stateless HTTP client is constructed ONLY via `Ablo({ transport: 'http' })`
+// (one factory, explicit transport). The `createAbloHttpClient` function stays
+// internal — the factory calls it — but is NOT a public export. Consumers still
+// annotate with the `AbloHttpClient` type (the narrowed return of `transport:'http'`).
+export {} from './client/httpClient.js';
 export { ABLO_DEFAULT_BASE_URL, ABLO_HOSTED_API_DOMAIN, ABLO_HOSTED_HTTP_BASE_URL, normalizeAbloHostedBaseUrl, } from './client/auth.js';
 // Participant types live under `Ablo.Participant.*` —
 // `Ablo.Participant.Joined`, `Ablo.Participant.Manager`,

package/dist/interfaces/index.d.ts

@@ -68,9 +68,6 @@ export interface CommitZeroSyncIdDetails {
     operationCount: number;
     operations: string[];
 }
-export interface OfflineFlushFailureDetails {
-    error: string;
-}
 /**
  * One thing that happened to a claim. `phase` is the past-tense state it just
  * entered — the trail you follow to see WHY two participants collided on a row:
@@ -103,17 +100,15 @@ export interface ConflictEvent {
     /** The client idempotency key whose write was notified. */
     clientTxId: string;
     /** The conflicted rows + the fields that collided. */
-    rows: ReadonlyArray<{
+    rows: readonly {
         model: string;
         id: string;
         fields: readonly string[];
         writtenBy?: ParticipantKind;
-    }>;
+    }[];
 }
 /** Span attributes for performance monitoring */
-export interface SpanAttributes {
-    [key: string]: string | number | boolean | undefined;
-}
+export type SpanAttributes = Record<string, string | number | boolean | undefined>;
 /**
  * Observability provider — replaces direct Sentry dependency.
  * SDK ships a no-op default; consumers provide their own (e.g., Sentry, Datadog, OpenTelemetry).
@@ -137,8 +132,6 @@ export interface SyncObservabilityProvider {
     captureDeltaRetryExhausted(details: DeltaRetryExhaustedDetails): void;
     /** Capture WebSocket error */
     captureWebSocketError(details: WebSocketErrorDetails): void;
-    /** Capture offline flush failure */
-    captureOfflineFlushFailure(details: OfflineFlushFailureDetails): void;
     /** Capture self-healing event */
     captureSelfHealing(details: SelfHealingDetails): void;
     /** Capture a claim state change (acquired / queued / granted / lost / rejected / expired) */
@@ -313,13 +306,13 @@ export interface MutationExecutor {
         url: string;
     }>;
     /** Batch upload attachments (optional) */
-    batchUploadAttachments?(items: Array<{
+    batchUploadAttachments?(items: {
         id: string;
         input: Record<string, unknown>;
-    }>): Promise<Array<{
+    }[]): Promise<{
         id: string;
         url: string;
-    }>>;
+    }[]>;
     /** Delete a subscription entity */
     deleteSubscription?(entityType: string, entityId: string, txId: string): Promise<void>;
     /** Delete a favorite entity */
@@ -327,13 +320,6 @@ export interface MutationExecutor {
     /** Register a callback for session expiry detection */
     onSessionExpired?(callback: () => void): void;
 }
-/**
- * Dispatches queued offline mutations on reconnect.
- * Replaces the massive switch statement in OfflineFlush.ts.
- */
-export interface MutationDispatcher {
-    dispatch(operationName: string, variables: Record<string, unknown>): Promise<void>;
-}
 /**
  * Application-specific configuration for the sync engine.
  * Replaces the 6 hardcoded config maps that were previously

package/dist/keys/index.js

@@ -69,7 +69,8 @@ const CRC32_TABLE = (() => {
 function crc32(s) {
     let c = 0xffffffff;
     for (let i = 0; i < s.length; i++) {
-        c = (CRC32_TABLE[(c ^ s.charCodeAt(i)) & 0xff] ^ (c >>> 8)) >>> 0;
+        // `& 0xff` bounds the index to the 256-entry table — the ?? 0 is unreachable.
+        c = ((CRC32_TABLE[(c ^ s.charCodeAt(i)) & 0xff] ?? 0) ^ (c >>> 8)) >>> 0;
     }
     return (c ^ 0xffffffff) >>> 0;
 }
@@ -78,7 +79,7 @@ function checksum6(payload) {
     let n = crc32(payload);
     let out = '';
     for (let i = 0; i < CHECKSUM_LEN; i++) {
-        out = BASE62[n % 62] + out;
+        out = BASE62.charAt(n % 62) + out;
         n = Math.floor(n / 62);
     }
     return out;
@@ -89,7 +90,7 @@ function randomBase62(len) {
     while (out.length < len) {
         for (const b of randomBytes(len * 2)) {
             if (b < 248) {
-                out += BASE62[b % 62];
+                out += BASE62.charAt(b % 62);
                 if (out.length === len)
                     break;
             }
@@ -113,6 +114,14 @@ export const apiKeySchema = z.string().transform((raw, ctx) => {
         return z.NEVER;
     }
     const [, prefix, env, body] = m;
+    const kind = prefix === undefined ? undefined : KIND_BY_PREFIX[prefix];
+    // Unreachable on a KEY_RE match (all three groups are non-optional and the
+    // prefix alternation is exactly the KIND_BY_PREFIX key set) — narrows the
+    // regex-group lookups for the checks below.
+    if (kind === undefined || env === undefined || body === undefined) {
+        ctx.addIssue({ code: 'custom', message: 'not a valid Ablo API key format' });
+        return z.NEVER;
+    }
     const checksummed = bodyIsChecksummed(body);
     if (checksummed && checksum6(raw.slice(0, -CHECKSUM_LEN)) !== body.slice(KEY_BODY_LEN)) {
         ctx.addIssue({ code: 'custom', message: 'API key checksum mismatch' });
@@ -120,7 +129,7 @@ export const apiKeySchema = z.string().transform((raw, ctx) => {
     }
     return {
         raw,
-        kind: KIND_BY_PREFIX[prefix],
+        kind,
         env: environmentFromKeyPrefix(env),
         body,
         checksummed,
@@ -134,15 +143,15 @@ export function parseApiKey(raw) {
 }
 /** True when the key uses the new checksummed format (regardless of validity). */
 export function isChecksummedKey(raw) {
-    const m = KEY_RE.exec(raw);
-    return m !== null && bodyIsChecksummed(m[3]);
+    const body = KEY_RE.exec(raw)?.[3];
+    return body !== undefined && bodyIsChecksummed(body);
 }
 /** Verify the embedded checksum. Meaningful only for checksummed-format keys. */
 export function keyChecksumMatches(raw) {
-    const m = KEY_RE.exec(raw);
-    if (!m || !bodyIsChecksummed(m[3]))
+    const body = KEY_RE.exec(raw)?.[3];
+    if (body === undefined || !bodyIsChecksummed(body))
         return false;
-    return checksum6(raw.slice(0, -CHECKSUM_LEN)) === m[3].slice(KEY_BODY_LEN);
+    return checksum6(raw.slice(0, -CHECKSUM_LEN)) === body.slice(KEY_BODY_LEN);
 }
 // ── Mint + hash (node:crypto) ───────────────────────────────────────────
 /**

package/dist/mutators/UndoManager.js

@@ -146,7 +146,7 @@ export class UndoScope {
         // doubles can omit it (undo then records nothing).
         this.unsubscribe =
             options.recordFromStream && this.store.subscribeLocalMutations
-                ? this.store.subscribeLocalMutations((m) => this.onLocalMutation(m))
+                ? this.store.subscribeLocalMutations((m) => { this.onLocalMutation(m); })
                 : () => { };
     }
     /**
@@ -608,6 +608,11 @@ async function applyOps(tx, ops) {
     const mutateAny = tx.mutations;
     for (const op of ops) {
         const m = mutateAny[op.modelKey];
+        if (!m) {
+            // A persisted inverse op referencing a model the schema no longer has —
+            // previously this surfaced as an opaque TypeError on `m.create`.
+            throw new Error(`Cannot undo: model "${op.modelKey}" is not part of the current schema.`);
+        }
         switch (op.kind) {
             case 'create':
                 await m.create(op.data);

package/dist/mutators/defineMutators.d.ts

@@ -39,9 +39,7 @@ export type MutatorFn<S extends Schema, TArgs, TResult = void> = (options: {
  * ends up seeing.
  */
 export type MutatorDefs<S extends Schema> = {
-    [K in keyof S['models']]?: {
-        [mutatorName: string]: MutatorFn<S, never, unknown>;
-    };
+    [K in keyof S['models']]?: Record<string, MutatorFn<S, never, unknown>>;
 };
 /**
  * Identity function that forwards the mutators object while constraining its

package/dist/policy/types.d.ts

@@ -6,7 +6,7 @@
  * (a participant claims a target someone else is already claiming).
  * Adding new shapes is additive on the discriminated union.
  */
-import type { ParticipantRef } from '../types/streams.js';
+import type { ParticipantRef } from '../types/participant.js';
 import type { OnStaleMode } from '../coordination/schema.js';
 export type ConflictKind = 'stale_context' | 'claim_held';
 /** Fields shared by every conflict shape. */

package/dist/query/client.d.ts

@@ -12,6 +12,7 @@
  * without duplicating the fetch boilerplate.
  */
 import type { QueryBatch, QueryBatchResult } from './types.js';
+import { type RecoveryClass } from '../errorCodes.js';
 import { type AuthTokenGetter } from '../auth/credentialSource.js';
 export interface PostQueryOptions {
     /**
@@ -33,6 +34,16 @@ export interface PostQueryOptions {
      * New SDK internals should pass `getAuthToken`.
      */
     capabilityToken?: string;
+    /**
+     * THE auth-recovery backbone (the store's single-flight re-mint with FSM
+     * outcome routing — see `CredentialLifecycle.recoverFromAuthRejection`).
+     * When a query is rejected with a 401, the failure's `RecoveryClass` is
+     * passed here; `'retry'` means a fresh credential landed in the credential
+     * source and the request is replayed ONCE (the PowerSync/axios-interceptor
+     * pattern: invalidate on 401, single-flight refresh, one-shot replay —
+     * never a retry loop). Absent ⇒ the pre-backbone behavior: log + empty.
+     */
+    recoverCredential?: (recovery: RecoveryClass) => Promise<'retry' | 'stop'>;
 }
 /**
  * POST a batch of queries to /sync/query. Returns the parsed

package/dist/query/client.js

@@ -13,6 +13,7 @@
  */
 import { z } from 'zod';
 import { translateHttpError } from '../errors.js';
+import { classifyRecovery } from '../errorCodes.js';
 import { withAuthHeaders } from '../auth/credentialSource.js';
 import { getContext } from '../context.js';
 // ── Response validation ─────────────────────────────────────────────────
@@ -46,61 +47,89 @@ const QueryBatchResultSchema = z
 export async function postQuery(options, batch) {
     const url = `${options.baseUrl}/sync/query`;
     const timeout = options.fetchTimeout ?? 30_000;
-    // Race the fetch against a timeout so hung requests don't block
-    // the calling helper indefinitely.
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeout);
-    try {
-        const headers = withAuthHeaders(options.getAuthToken, { 'Content-Type': 'application/json' }, options.capabilityToken);
-        const response = await fetch(url, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify(batch),
-            signal: controller.signal,
-        });
-        if (!response.ok) {
-            // Build the typed AbloError for this HTTP failure (same code→class
-            // map the throwing paths use) so the log is tagged + carries a
-            // registry `code` (e.g. AbloAuthenticationError/session_expired on a
-            // 401) instead of a bare status. We deliberately DON'T throw —
-            // fire-and-forget callers would kill the Next.js router on an
-            // unhandled rejection — and still return empty slots, but the failure
-            // is now legible as an Ablo error. Routed through the gated logger so it
-            // obeys ABLO_LOG_LEVEL like everything else: a consumer-register `warn`
-            // (their models + the typed message + a wire `code`) with the forensics on
-            // a `debug` companion. Actionable and not self-healing — the read returns
-            // empty until the underlying cause (auth, network) is resolved.
-            let body = null;
-            try {
-                body = await response.clone().json();
+    // At most TWO attempts: the original request, plus ONE replay after a
+    // successful credential recovery (see `recoverCredential`). Bounded by
+    // construction — a second auth rejection falls through to the log+empty
+    // path, so a wedged credential can never retry-loop.
+    for (let attempt = 0;; attempt++) {
+        // Race the fetch against a timeout so hung requests don't block
+        // the calling helper indefinitely. Fresh controller per attempt.
+        const controller = new AbortController();
+        const timer = setTimeout(() => { controller.abort(); }, timeout);
+        try {
+            // Recomputed per attempt: `withAuthHeaders` reads the live credential
+            // source, so a replay after recovery carries the freshly-minted key.
+            const headers = withAuthHeaders(options.getAuthToken, { 'Content-Type': 'application/json' }, options.capabilityToken);
+            const response = await fetch(url, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(batch),
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                // Build the typed AbloError for this HTTP failure (same code→class
+                // map the throwing paths use) so the log is tagged + carries a
+                // registry `code` (e.g. AbloAuthenticationError/session_expired on a
+                // 401) instead of a bare status. We deliberately DON'T throw —
+                // fire-and-forget callers would kill the Next.js router on an
+                // unhandled rejection — and still return empty slots, but the failure
+                // is now legible as an Ablo error.
+                let body = null;
+                try {
+                    body = await response.clone().json();
+                }
+                catch {
+                    // non-JSON error page — translateHttpError falls back to status text
+                }
+                const err = translateHttpError(response.status, body);
+                // 401 → hand the failure to the auth-recovery backbone, ONCE. The
+                // class routes the decision: `access_credential_expiry` re-mints
+                // silently and replays; `session_expiry` reports terminal session
+                // loss (sign-out is the FSM's call, not ours); everything else stops.
+                // A bare 401 with no readable code is classified as an expired access
+                // key — the NetworkProbe precedent: the only terminal path is the
+                // re-mint itself resolving null, never an ambiguous status.
+                if (attempt === 0 && response.status === 401 && options.recoverCredential) {
+                    const recovery = typeof err.code === 'string'
+                        ? classifyRecovery(err.code)
+                        : 'access_credential_expiry';
+                    const outcome = await options.recoverCredential(recovery);
+                    if (outcome === 'retry') {
+                        getContext().logger.debug('[postQuery] credential recovered — replaying query once', {
+                            code: err.code ?? response.status,
+                        });
+                        continue;
+                    }
+                }
+                // Routed through the gated logger so it obeys ABLO_LOG_LEVEL like
+                // everything else: a consumer-register `warn` (their models + the
+                // typed message + a wire `code`) with the forensics on a `debug`
+                // companion. Actionable and not self-healing — the read returns
+                // empty until the underlying cause (auth, network) is resolved.
+                const models = batch.queries.map((q) => q.model).join(', ');
+                getContext().logger.warn(`Could not load ${models} — ${err.message} (code: ${err.code ?? response.status}). No results were returned.`);
+                getContext().logger.debug('[postQuery.error] query http failure', {
+                    type: err.type,
+                    code: err.code ?? response.status,
+                    models,
+                    message: err.message,
+                });
+                return { results: batch.queries.map(() => []) };
             }
-            catch {
-                // non-JSON error page — translateHttpError falls back to status text
+            const raw = await response.json();
+            const parsed = QueryBatchResultSchema.safeParse(raw);
+            if (!parsed.success) {
+                // A malformed server response isn't something the consumer can act on
+                // (server/protocol issue) → debug, gated like everything else.
+                getContext().logger.debug('[postQuery.error] malformed response', {
+                    issues: parsed.error.issues,
+                });
+                return { results: batch.queries.map(() => []) };
             }
-            const err = translateHttpError(response.status, body);
-            const models = batch.queries.map((q) => q.model).join(', ');
-            getContext().logger.warn(`Could not load ${models} — ${err.message} (code: ${err.code ?? response.status}). No results were returned.`);
-            getContext().logger.debug('[postQuery.error] query http failure', {
-                type: err.type,
-                code: err.code ?? response.status,
-                models,
-                message: err.message,
-            });
-            return { results: batch.queries.map(() => []) };
+            return parsed.data;
         }
-        const raw = await response.json();
-        const parsed = QueryBatchResultSchema.safeParse(raw);
-        if (!parsed.success) {
-            // A malformed server response isn't something the consumer can act on
-            // (server/protocol issue) → debug, gated like everything else.
-            getContext().logger.debug('[postQuery.error] malformed response', {
-                issues: parsed.error.issues,
-            });
-            return { results: batch.queries.map(() => []) };
+        finally {
+            clearTimeout(timer);
         }
-        return parsed.data;
-    }
-    finally {
-        clearTimeout(timer);
     }
 }

package/dist/react/AbloProvider.d.ts

@@ -34,13 +34,9 @@ import { type SyncStoreContract } from './context.js';
  *
  * ```tsx
  * // Build once at module scope — a new instance per render tears down the socket.
- * const ablo = Ablo({
- *   schema,
- *   apiKey: () =>
- *     fetch('/api/ablo-session', { method: 'POST' })
- *       .then((r) => r.json())
- *       .then((d) => d.token),
- * });
+ * // The endpoint string points at your session-mint route (`ablo init`
+ * // scaffolds it); the SDK fetches it and keeps the token fresh.
+ * const ablo = Ablo({ schema, authEndpoint: '/api/ablo-session' });
  *
  * <AbloProvider client={ablo}>
  *   <App />
@@ -152,9 +148,9 @@ export type MeshParticipantStatus = ParticipantStatus;
 export interface UseWatchReturn {
     readonly participant: EngineParticipant | null;
     /** Everyone else on the engine's sync groups (`participant.presence.others`), bridged to React. */
-    readonly peers: ReadonlyArray<Peer>;
+    readonly peers: readonly Peer[];
     /** Active claim claims by peers (`participant.claims.others`), bridged to React. */
-    readonly claims: ReadonlyArray<Claim>;
+    readonly claims: readonly Claim[];
     readonly status: ParticipantStatus;
     readonly error: Error | null;
 }
@@ -196,7 +192,7 @@ export declare function useWatch(opts: UseWatchOptions): UseWatchReturn;
  * const alone = !peers.some((p) => p.participantKind === 'user');
  * ```
  */
-export declare function usePeers(scope?: ParticipantScope): ReadonlyArray<Peer>;
+export declare function usePeers(scope?: ParticipantScope): readonly Peer[];
 /**
  * Returns the raw `SyncEngine` proxy. Typically you want the typed
  * hooks (`useQuery`, `useOne`, `useMutate`) — this is for rare cases

package/dist/react/AbloProvider.js

@@ -1,6 +1,7 @@
 'use client';
 import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
-import { useContext, useEffect, useMemo, useRef, useState, } from 'react';
+import { useCallback, useContext, useEffect, useMemo, useRef, useState, createContext, } from 'react';
+import { Ablo } from '../client/Ablo.js';
 import { createParticipantClaimId, parseParticipantTtlSeconds, resolveParticipantSyncGroups, } from '../sync/participants.js';
 import { SyncContext } from './context.js';
 import { AbloInternalContext } from './internalContext.js';
@@ -77,18 +78,24 @@ export function AbloProvider(props) {
     // It does NOT dispose the client (consumer-owned) and does NOT touch auth.
     useEffect(() => {
         let stale = false;
-        const unsubscribeSession = engine.onSessionError(async (err) => {
+        const unsubscribeSession = engine.onSessionError((err) => {
             errorEmitter.emit(err);
-            try {
-                await engine.purge();
-            }
-            catch { }
-            try {
-                await onSessionExpiredRef.current?.();
-            }
-            catch (hookErr) {
-                errorEmitter.emit(hookErr);
-            }
+            void (async () => {
+                try {
+                    await engine.purge();
+                }
+                catch { }
+                try {
+                    await onSessionExpiredRef.current?.();
+                }
+                catch (hookErr) {
+                    errorEmitter.emit(hookErr);
+                }
+            })().catch(() => {
+                // Only a throwing errorEmitter subscriber can land here — it was
+                // already the error-reporting path, so swallow rather than surface
+                // an unhandled rejection loop.
+            });
         });
         engine
             .ready()
@@ -122,7 +129,7 @@ export function AbloProvider(props) {
             }
         };
         window.addEventListener('beforeunload', handler);
-        return () => window.removeEventListener('beforeunload', handler);
+        return () => { window.removeEventListener('beforeunload', handler); };
     }, [engine, preventUnsavedChanges]);
     // ── SyncContext value (for useQuery/useOne/useMutate hooks) ──────
     //
@@ -389,7 +396,7 @@ export function usePeers(scope) {
         // rarely; a frame of stale presence is harmless (same rationale as
         // useWatch's peers bridge).
         setPeers(compute());
-        return presence.onChange(() => setPeers(compute()));
+        return presence.onChange(() => { setPeers(compute()); });
     }, [engine, scopeKey]);
     return peers;
 }
@@ -442,7 +449,7 @@ export function useSync() {
  */
 export function useSyncStore() {
     const sync = useContext(SyncContext);
-    if (!sync || !sync.store) {
+    if (!sync?.store) {
         throw new AbloValidationError('useSyncStore: the sync engine has not yet initialized. Wrap ' +
             'consumers in <ClientSideSuspense> or guard on useSyncStatus().', { code: 'sync_not_ready' });
     }