@abloatai/ablo 0.24.0 → 0.26.0

package/dist/source/signing.js

@@ -0,0 +1,142 @@
+/**
+ * Standard Webhooks request signing/verification for Data Source calls.
+ *
+ * Ablo signs every outbound source request with the customer's project API
+ * key; the customer's endpoint verifies before any handler runs. Both halves
+ * live in this leaf so `pushQueue.ts` (customer-side sender) and `factory.ts`
+ * (customer-side receiver) can import them directly without a runtime cycle
+ * through the `index.ts` barrel.
+ */
+/**
+ * HTTP headers used on signed source requests. Conforms to the
+ * Standard Webhooks specification (https://www.standardwebhooks.com/)
+ * so customer code can verify our signatures with any of the official
+ * libraries (svix, standardwebhooks, hookdeck, etc.) — no Ablo-
+ * specific verifier required.
+ */
+export const ABLO_SOURCE_HEADERS = {
+    signature: 'webhook-signature',
+    timestamp: 'webhook-timestamp',
+    id: 'webhook-id',
+    idempotencyKey: 'Idempotency-Key',
+};
+export class SourceSignatureError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'SourceSignatureError';
+        this.code = code;
+    }
+}
+const DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+function getHeader(request, name) {
+    const headers = request.headers;
+    if (!headers)
+        return null;
+    if (typeof headers.get === 'function') {
+        return headers.get(name);
+    }
+    const record = headers;
+    return record[name] ?? record[name.toLowerCase()] ?? null;
+}
+/**
+ * Parse a `webhook-signature` header per the Standard Webhooks spec.
+ * Values are space-delimited `<scheme>,<base64>` pairs (e.g.
+ * `v1,abc== v1,def==` during a key rotation window). Returns the set
+ * of `v1` signatures so the verifier can accept any of them.
+ */
+function parseSignatureHeader(raw) {
+    if (!raw)
+        return [];
+    const out = [];
+    for (const part of raw.split(/\s+/)) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        const commaAt = trimmed.indexOf(',');
+        if (commaAt === -1)
+            continue;
+        const scheme = trimmed.slice(0, commaAt);
+        const value = trimmed.slice(commaAt + 1);
+        if (scheme === 'v1' && value.length > 0) {
+            out.push(value);
+        }
+    }
+    return out;
+}
+function bufferToBase64(buffer) {
+    // Node + browsers both expose `btoa` on the global; we feed it
+    // a binary string built from the byte view.
+    let binary = '';
+    for (const byte of new Uint8Array(buffer)) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+async function hmacSha256Base64(apiKey, payload) {
+    const crypto = globalThis.crypto?.subtle;
+    if (!crypto) {
+        throw new SourceSignatureError('source_signature_invalid', 'WebCrypto HMAC support is unavailable in this runtime');
+    }
+    const encoder = new TextEncoder();
+    const key = await crypto.importKey('raw', encoder.encode(apiKey), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    return bufferToBase64(await crypto.sign('HMAC', key, encoder.encode(payload)));
+}
+/**
+ * Constant-time string equality. Used over `===` so a malicious
+ * signature can't be probed byte-by-byte via timing differences.
+ */
+function timingSafeEqual(expected, actual) {
+    const max = Math.max(expected.length, actual.length);
+    let diff = expected.length ^ actual.length;
+    for (let i = 0; i < max; i++) {
+        diff |= (expected.charCodeAt(i) || 0) ^ (actual.charCodeAt(i) || 0);
+    }
+    return diff === 0;
+}
+export async function signAbloSourceRequest(options) {
+    const signedAt = options.timestamp ?? Math.floor(Date.now() / 1000);
+    // Standard Webhooks signing input: `${msg_id}.${timestamp}.${payload}`
+    const signature = await hmacSha256Base64(options.apiKey, `${options.messageId}.${signedAt}.${options.body}`);
+    return {
+        signedAt,
+        signature,
+        headers: {
+            [ABLO_SOURCE_HEADERS.id]: options.messageId,
+            [ABLO_SOURCE_HEADERS.timestamp]: String(signedAt),
+            [ABLO_SOURCE_HEADERS.signature]: `v1,${signature}`,
+        },
+    };
+}
+export async function verifyAbloSourceRequest(options) {
+    const messageId = getHeader(options.request, ABLO_SOURCE_HEADERS.id);
+    if (!messageId) {
+        throw new SourceSignatureError('source_id_missing', 'Missing webhook-id header');
+    }
+    const rawTimestamp = getHeader(options.request, ABLO_SOURCE_HEADERS.timestamp);
+    if (!rawTimestamp) {
+        throw new SourceSignatureError('source_timestamp_missing', 'Missing webhook-timestamp header');
+    }
+    const signedAt = Number(rawTimestamp);
+    if (!Number.isFinite(signedAt)) {
+        throw new SourceSignatureError('source_timestamp_invalid', 'Invalid webhook-timestamp header');
+    }
+    const toleranceMs = options.toleranceMs ?? DEFAULT_SIGNATURE_TOLERANCE_MS;
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const toleranceSeconds = Math.ceil(toleranceMs / 1000);
+    if (Math.abs(nowSeconds - signedAt) > toleranceSeconds) {
+        throw new SourceSignatureError('source_timestamp_expired', 'webhook-timestamp is outside the allowed clock-skew window');
+    }
+    const presented = parseSignatureHeader(getHeader(options.request, ABLO_SOURCE_HEADERS.signature));
+    if (presented.length === 0) {
+        throw new SourceSignatureError('source_signature_missing', 'Missing webhook-signature header');
+    }
+    const expected = await hmacSha256Base64(options.apiKey, `${messageId}.${signedAt}.${options.body}`);
+    // Accept any presented signature that matches — supports key
+    // rotation per the Standard Webhooks spec.
+    const ok = presented.some((sig) => timingSafeEqual(expected, sig));
+    if (!ok) {
+        throw new SourceSignatureError('source_signature_invalid', 'Invalid webhook-signature');
+    }
+    return { messageId, signedAt };
+}

package/dist/source/types.d.ts

@@ -0,0 +1,334 @@
+/**
+ * Shared Data Source wire + handler types.
+ *
+ * These are the cross-package shapes every source module speaks (operations,
+ * events, list queries, handler contexts, the four wire request types). They
+ * live in this leaf — not the `index.ts` barrel — so `contract.ts`,
+ * `adapter.ts`, `pushQueue.ts` and the ORM adapters can import them directly
+ * without routing a circular dependency through the barrel.
+ *
+ * `sourceEventForOperation` lives here too: it is the pure constructor for the
+ * `SourceEvent` marker shape and has no dependency on the endpoint factory.
+ */
+import type { Environment } from '../environment.js';
+export type SourcePrimitive = string | number | boolean | null;
+export type SourceWhere = readonly [field: string, value: SourcePrimitive] | readonly [
+    field: string,
+    op: '=' | '!=' | '<' | '<=' | '>' | '>=' | 'IN' | 'NOT IN' | 'IS' | 'IS NOT' | 'LIKE' | 'NOT LIKE' | 'ILIKE' | 'NOT ILIKE',
+    value: SourcePrimitive | readonly SourcePrimitive[]
+];
+export interface SourceListQuery {
+    readonly where?: readonly SourceWhere[];
+    readonly limit?: number;
+    readonly orderBy?: string;
+    readonly order?: 'asc' | 'desc';
+    readonly related?: readonly string[];
+    /**
+     * Opaque cursor returned by a previous `list` call. The customer's
+     * `list` handler defines what this encodes (page index, last id,
+     * keyset). Ablo treats it as a black box — round-trips it back to
+     * fetch the next page until the handler returns no `nextCursor`.
+     */
+    readonly cursor?: string;
+}
+/**
+ * Optional structured shape for a `list` handler that supports
+ * pagination. Handlers may keep returning a plain `Row[]` (no
+ * pagination, single-shot) or upgrade to this shape to expose a
+ * cursor that Ablo will round-trip on the next request.
+ */
+export interface SourceListPage<Row> {
+    readonly rows: readonly Row[];
+    readonly nextCursor?: string;
+}
+export type SourceListResult<Row> = readonly Row[] | SourceListPage<Row>;
+/**
+ * Read-side scope context that Ablo attaches to source requests so
+ * the customer's `authorize` / model handlers can refuse calls that
+ * fall outside the participant's permitted syncGroups.
+ *
+ * This is informational — the customer is the only side that can
+ * actually enforce, since the canonical data lives in their store.
+ * Mirrors how Auth0 Custom DB scripts receive the requested scope and
+ * trust the script to honor it.
+ */
+export interface SourceRequestContext {
+    readonly participantId?: string;
+    readonly participantKind?: 'user' | 'agent' | 'system';
+    readonly organizationId?: string;
+    readonly requiredSyncGroups?: readonly string[];
+    /**
+     * Production/sandbox mode for this request. Customers branch their source
+     * handlers on this (`if (mode === 'sandbox') db = sandboxDb`) so sandbox
+     * traffic exercises the same code path against an isolated store.
+     *
+     * Mirrors Stripe's `sk_test_` / `sk_live_` prefixes: same wire
+     * shape, same handler code, different namespace. Ablo's server-side
+     * fan-out does not yet partition deltas by mode — that lands when
+     * `sync_deltas.mode` ships. Until then, isolation is enforced
+     * customer-side via this field, which is the right boundary anyway
+     * (the customer's database is where the canonical data lives).
+     *
+     * Defaults to `'production'` when omitted so callers that don't opt in
+     * keep the existing behavior.
+     */
+    readonly mode?: Environment;
+}
+export interface SourceOperation {
+    readonly type: 'CREATE' | 'UPDATE' | 'DELETE' | 'ARCHIVE' | 'UNARCHIVE';
+    readonly model: string;
+    readonly id?: string | null;
+    readonly input?: Record<string, unknown> | null;
+    readonly transactionId?: string | null;
+    readonly readAt?: number | null;
+    readonly onStale?: 'reject' | 'overwrite' | 'notify' | null;
+}
+export interface SourceDelta {
+    readonly model: string;
+    readonly id: string;
+    readonly type: SourceOperation['type'];
+    readonly data?: Record<string, unknown> | null;
+    readonly transactionId?: string | null;
+}
+/**
+ * A change that happened in the customer's store. The source's
+ * `events` handler returns these so Ablo can append them to
+ * `sync_deltas` and fan them out to connected clients exactly like
+ * SDK-originated commits.
+ *
+ * The events handler can return everything from the outbox unfiltered. Ablo
+ * dedupes stable `event.id` values and uses `clientTxId` to filter SDK-origin
+ * echoes after the direct append has already succeeded. If the direct append
+ * failed, the same outbox event repairs it on poll/push because no matching
+ * `mutation_log` row exists yet.
+ */
+export interface SourceEvent {
+    /**
+     * Globally unique event id from the customer's outbox. Used by Ablo
+     * for replay protection — re-delivering the same id is a no-op.
+     */
+    readonly id: string;
+    readonly model: string;
+    readonly entityId: string;
+    readonly type: SourceOperation['type'];
+    readonly data?: Record<string, unknown> | null;
+    /**
+     * Tenant the event belongs to. Multi-tenant customers populate this
+     * from the row's organization column. Single-tenant deployments may
+     * omit it and let the poller fall back to its configured default.
+     * Drives the sync-group fan-out: clients in `org:${organizationId}`
+     * receive the resulting delta.
+     */
+    readonly organizationId?: string;
+    /**
+     * Originating Ablo SDK commit id, when known. If the customer's
+     * outbox stores the `clientTxId` Ablo passed into the matching
+     * `commit` handler, round-trip it here and Ablo will skip events
+     * whose commit already produced a delta. External-origin events
+     * (cron jobs, batch imports, manual edits) leave this unset.
+     */
+    readonly clientTxId?: string;
+    /**
+     * Wall-clock time the event occurred in the source. Optional; used
+     * only for ordering hints. Ablo trusts the customer's response order
+     * over this field.
+     */
+    readonly occurredAt?: number;
+}
+export interface SourceEventForOperationOptions {
+    /**
+     * Stable id from the customer's outbox table. This is Ablo's replay-
+     * protection key; retries must return the same id.
+     */
+    readonly eventId: string;
+    readonly operation: SourceOperation;
+    /**
+     * Committed row id. Defaults to `operation.id`; pass this for generated-id
+     * CREATEs where the database assigns the id inside the transaction.
+     */
+    readonly entityId?: string;
+    /**
+     * Canonical row payload after the write. Pass `null` for DELETE. When omitted
+     * the event carries no row payload, which is valid but less useful for
+     * realtime hydration.
+     */
+    readonly data?: Record<string, unknown> | null;
+    /**
+     * Batch idempotency key from the Data Source commit request. Round-tripping it
+     * lets Ablo filter SDK-origin echoes after the direct append succeeds, while
+     * still using the outbox event to repair a failed direct append.
+     */
+    readonly clientTxId?: string;
+    readonly organizationId?: string;
+    readonly occurredAt?: number | Date;
+}
+/**
+ * Build the source-event marker customers should write to their outbox table in
+ * the SAME transaction as their app-row mutation.
+ *
+ * This helper does not persist anything. It only standardizes the marker shape
+ * so Prisma/Drizzle/Kysely/raw-SQL adapters all emit the fields Ablo's
+ * reconciler expects.
+ */
+export declare function sourceEventForOperation(options: SourceEventForOperationOptions): SourceEvent;
+export interface SourceCommitResult<Row = Record<string, unknown>> {
+    /**
+     * Canonical rows after the write. Ablo uses these to update hosted
+     * realtime projections and append deltas.
+     */
+    readonly rows?: readonly Row[];
+    /**
+     * Optional explicit deltas when the source already computes them.
+     * Most sources can return rows and let Ablo derive the delta payload.
+     */
+    readonly deltas?: readonly SourceDelta[];
+}
+export interface SourceCommitParams<TAuth = unknown> {
+    readonly operations: readonly SourceOperation[];
+    readonly clientTxId?: string;
+    readonly context: SourceHandlerContext<TAuth>;
+}
+/**
+ * Operation-level permission tag used by `resolveScopes`. Mirrors the
+ * four wire request types: an API key carries the set of operations
+ * it's allowed to invoke. Stripe's restricted-key model at the
+ * operation granularity — model-level scoping is a future addition.
+ */
+export type SourceScope = 'load' | 'list' | 'commit' | 'events';
+export interface SourceEventsResult {
+    readonly events: readonly SourceEvent[];
+    /**
+     * Cursor for the next poll. When omitted Ablo treats the feed as
+     * fully drained for this round and uses the last event's cursor (or
+     * the initial cursor) for the next call.
+     */
+    readonly nextCursor?: string;
+}
+export type SourceEventsHandler<TAuth = unknown> = (params: {
+    /**
+     * Cursor returned by a previous `events` call. Undefined on the
+     * first poll for a freshly-onboarded source. The customer decides
+     * what it encodes (last event id, timestamp, LSN, etc).
+     */
+    readonly cursor?: string;
+    /**
+     * Caller-suggested upper bound on returned events. Customers may
+     * return fewer; returning more risks tripping Ablo's per-poll cap.
+     */
+    readonly limit?: number;
+    readonly context: SourceHandlerContext<TAuth>;
+}) => Promise<SourceEventsResult> | SourceEventsResult;
+export interface SourceAuthorizeContext {
+    readonly request: Request;
+    readonly body: unknown;
+    readonly rawBody: string;
+}
+export interface SourceHandlerContext<TAuth = unknown> {
+    readonly auth: TAuth;
+    readonly request: Request;
+    /**
+     * `webhook-id` from the signed request — globally unique per the
+     * Standard Webhooks spec. Customers should dedupe by this id to
+     * defend against replay (Ablo doesn't dedupe at the source-handler
+     * boundary; commit idempotency is `clientTxId`, and event replay
+     * protection is the outbox event `id`).
+     */
+    readonly messageId?: string;
+    readonly signedAt?: number;
+    /**
+     * Scope context Ablo attached to this request. Present when the
+     * caller (sync-server) opted into scope-aware source mode. Customers
+     * can use it in `authorize` (to reject out-of-scope calls) and in
+     * `list` / `load` (to filter rows the participant is allowed to see).
+     *
+     * Absent for calls made without scope context, such as tests or
+     * single-tenant deployments that do not need scoped fan-out yet.
+     */
+    readonly scope?: SourceRequestContext;
+}
+export interface SourceModelHandlers<Row, CreateInput, TAuth = unknown> {
+    load?(params: {
+        readonly id: string;
+        readonly context: SourceHandlerContext<TAuth>;
+    }): Promise<Row | null> | Row | null;
+    list?(params: {
+        readonly query: SourceListQuery;
+        readonly context: SourceHandlerContext<TAuth>;
+    }): Promise<SourceListResult<Row>> | SourceListResult<Row>;
+    /**
+     * Apply one or more operations for this model in the customer's own
+     * transaction. The source must be idempotent by operation/clientTxId.
+     */
+    commit?(params: {
+        readonly operations: readonly SourceOperation[];
+        readonly clientTxId?: string;
+        readonly context: SourceHandlerContext<TAuth>;
+    }): Promise<SourceCommitResult<Row>> | SourceCommitResult<Row>;
+}
+export type SourceCommitHandler<TAuth = unknown> = (params: SourceCommitParams<TAuth>) => Promise<SourceCommitResult> | SourceCommitResult;
+export type SourceApiKey = string | ((context: SourceAuthorizeContext) => Promise<string> | string);
+export interface SourceLoadRequest {
+    readonly type: 'load';
+    readonly model: string;
+    readonly id: string;
+    readonly scope?: SourceRequestContext;
+}
+export interface SourceListRequest {
+    readonly type: 'list';
+    readonly model: string;
+    readonly query?: SourceListQuery;
+    readonly scope?: SourceRequestContext;
+}
+export interface SourceCommitRequest {
+    readonly type: 'commit';
+    /**
+     * Optional single-model hint. Omit for cross-model commits; top-level
+     * `commit` receives the whole operation array unchanged.
+     */
+    readonly model?: string;
+    readonly operations: readonly SourceOperation[];
+    readonly clientTxId?: string;
+    readonly scope?: SourceRequestContext;
+}
+export interface SourceEventsRequest {
+    readonly type: 'events';
+    readonly cursor?: string;
+    readonly limit?: number;
+    readonly scope?: SourceRequestContext;
+}
+export type SourceRequest = SourceLoadRequest | SourceListRequest | SourceCommitRequest | SourceEventsRequest;
+export type SourceResponse<Row = Record<string, unknown>> = {
+    readonly row: Row | null;
+} | {
+    readonly rows: readonly Row[];
+    readonly nextCursor?: string;
+} | {
+    readonly rows?: readonly Row[];
+    readonly deltas?: readonly SourceDelta[];
+};
+export type DataSourcePrimitive = SourcePrimitive;
+export type DataSourceWhere = SourceWhere;
+export type DataSourceListQuery = SourceListQuery;
+export type DataSourceListPage<Row> = SourceListPage<Row>;
+export type DataSourceListResult<Row> = SourceListResult<Row>;
+export type DataSourceRequestContext = SourceRequestContext;
+export type DataSourceOperation = SourceOperation;
+export type DataSourceDelta = SourceDelta;
+export type DataSourceEvent = SourceEvent;
+export type DataSourceEventForOperationOptions = SourceEventForOperationOptions;
+export type DataSourceCommitResult<Row = Record<string, unknown>> = SourceCommitResult<Row>;
+export type DataSourceCommitParams<TAuth = unknown> = SourceCommitParams<TAuth>;
+export type DataSourceScope = SourceScope;
+export type DataSourceEventsResult = SourceEventsResult;
+export type DataSourceEventsHandler<TAuth = unknown> = SourceEventsHandler<TAuth>;
+export type DataSourceAuthorizeContext = SourceAuthorizeContext;
+export type DataSourceHandlerContext<TAuth = unknown> = SourceHandlerContext<TAuth>;
+export type DataSourceModelHandlers<Row, CreateInput, TAuth = unknown> = SourceModelHandlers<Row, CreateInput, TAuth>;
+export type DataSourceCommitHandler<TAuth = unknown> = SourceCommitHandler<TAuth>;
+export type DataSourceApiKey = SourceApiKey;
+export type DataSourceLoadRequest = SourceLoadRequest;
+export type DataSourceListRequest = SourceListRequest;
+export type DataSourceCommitRequest = SourceCommitRequest;
+export type DataSourceEventsRequest = SourceEventsRequest;
+export type DataSourceRequest = SourceRequest;
+export type DataSourceResponse<Row = Record<string, unknown>> = SourceResponse<Row>;

package/dist/source/types.js

@@ -0,0 +1,44 @@
+/**
+ * Shared Data Source wire + handler types.
+ *
+ * These are the cross-package shapes every source module speaks (operations,
+ * events, list queries, handler contexts, the four wire request types). They
+ * live in this leaf — not the `index.ts` barrel — so `contract.ts`,
+ * `adapter.ts`, `pushQueue.ts` and the ORM adapters can import them directly
+ * without routing a circular dependency through the barrel.
+ *
+ * `sourceEventForOperation` lives here too: it is the pure constructor for the
+ * `SourceEvent` marker shape and has no dependency on the endpoint factory.
+ */
+import { AbloValidationError } from '../errors.js';
+/**
+ * Build the source-event marker customers should write to their outbox table in
+ * the SAME transaction as their app-row mutation.
+ *
+ * This helper does not persist anything. It only standardizes the marker shape
+ * so Prisma/Drizzle/Kysely/raw-SQL adapters all emit the fields Ablo's
+ * reconciler expects.
+ */
+export function sourceEventForOperation(options) {
+    const entityId = options.entityId ?? options.operation.id;
+    if (typeof entityId !== 'string' || entityId.length === 0) {
+        throw new AbloValidationError('sourceEventForOperation requires operation.id or an explicit entityId', { code: 'source_event_invalid' });
+    }
+    const occurredAt = normalizeEventOccurredAt(options.occurredAt);
+    return {
+        id: options.eventId,
+        model: options.operation.model,
+        entityId,
+        type: options.operation.type,
+        ...(options.data !== undefined ? { data: options.data } : {}),
+        ...(options.organizationId ? { organizationId: options.organizationId } : {}),
+        ...(options.clientTxId ? { clientTxId: options.clientTxId } : {}),
+        ...(occurredAt !== undefined ? { occurredAt } : {}),
+    };
+}
+function normalizeEventOccurredAt(value) {
+    if (value === undefined)
+        return undefined;
+    const timestamp = value instanceof Date ? value.getTime() : value;
+    return Number.isFinite(timestamp) ? timestamp : undefined;
+}

package/dist/stores/ObjectStore.d.ts

@@ -5,7 +5,7 @@
  * Provides the interface for storing and retrieving models from IndexedDB.
  * Uses native IndexedDB for maximum performance (no wrapper overhead).
  */
-import { ModelMetadata } from '../types/index.js';
+import type { ModelMetadata } from '../types/index.js';
 import type { ObjectStoreContract } from './ObjectStoreContract.js';
 /**
  * ObjectStore - IDB-backed model storage.

package/dist/stores/ObjectStore.js

@@ -70,9 +70,9 @@ export class ObjectStore {
                 });
                 const store = tx.objectStore(this.storeName);
                 const request = store.put(data);
-                tx.oncomplete = () => resolve();
-                tx.onerror = () => reject(tx.error || new Error('IndexedDB transaction error'));
-                request.onerror = () => reject(request.error || new Error('IndexedDB request error'));
+                tx.oncomplete = () => { resolve(); };
+                tx.onerror = () => { reject(tx.error || new Error('IndexedDB transaction error')); };
+                request.onerror = () => { reject(request.error || new Error('IndexedDB request error')); };
             }
             catch (error) {
                 // Propagate failure so callers do not continue with inconsistent state
@@ -92,8 +92,8 @@ export class ObjectStore {
                 const tx = this.db.transaction([this.storeName], 'readonly');
                 const store = tx.objectStore(this.storeName);
                 const request = store.get(id);
-                request.onsuccess = () => resolve(request.result);
-                request.onerror = () => reject(request.error);
+                request.onsuccess = () => { resolve(request.result); };
+                request.onerror = () => { reject(request.error); };
             }
             catch (error) {
                 resolve(undefined);
@@ -132,7 +132,7 @@ export class ObjectStore {
                         }
                     };
                 }
-                tx.onerror = () => reject(tx.error);
+                tx.onerror = () => { reject(tx.error); };
             }
             catch (error) {
                 resolve(results);
@@ -151,8 +151,8 @@ export class ObjectStore {
                 const tx = this.db.transaction([this.storeName], 'readonly');
                 const store = tx.objectStore(this.storeName);
                 const request = store.getAll();
-                request.onsuccess = () => resolve(request.result || []);
-                request.onerror = () => reject(request.error);
+                request.onsuccess = () => { resolve(request.result || []); };
+                request.onerror = () => { reject(request.error); };
             }
             catch (error) {
                 resolve([]);
@@ -174,9 +174,9 @@ export class ObjectStore {
                 });
                 const store = tx.objectStore(this.storeName);
                 const request = store.delete(id);
-                tx.oncomplete = () => resolve();
-                tx.onerror = () => reject(tx.error || new Error('IndexedDB transaction error'));
-                request.onerror = () => reject(request.error || new Error('IndexedDB request error'));
+                tx.oncomplete = () => { resolve(); };
+                tx.onerror = () => { reject(tx.error || new Error('IndexedDB transaction error')); };
+                request.onerror = () => { reject(request.error || new Error('IndexedDB request error')); };
             }
             catch (error) {
                 reject(error instanceof Error ? error : new Error(String(error)));
@@ -210,9 +210,9 @@ export class ObjectStore {
                 });
                 const store = tx.objectStore(this.storeName);
                 const request = store.clear();
-                tx.oncomplete = () => resolve();
-                tx.onerror = () => reject(tx.error || new Error('IndexedDB transaction error'));
-                request.onerror = () => reject(request.error || new Error('IndexedDB request error'));
+                tx.oncomplete = () => { resolve(); };
+                tx.onerror = () => { reject(tx.error || new Error('IndexedDB transaction error')); };
+                request.onerror = () => { reject(request.error || new Error('IndexedDB request error')); };
             }
             catch (error) {
                 reject(error instanceof Error ? error : new Error(String(error)));
@@ -231,8 +231,8 @@ export class ObjectStore {
                 const tx = this.db.transaction([this.storeName], 'readonly');
                 const store = tx.objectStore(this.storeName);
                 const request = store.count();
-                request.onsuccess = () => resolve(request.result);
-                request.onerror = () => reject(request.error);
+                request.onsuccess = () => { resolve(request.result); };
+                request.onerror = () => { reject(request.error); };
             }
             catch (error) {
                 resolve(0);
@@ -252,8 +252,8 @@ export class ObjectStore {
                 const store = tx.objectStore(this.storeName);
                 const index = store.index(indexName);
                 const request = index.getAll(value);
-                request.onsuccess = () => resolve(request.result);
-                request.onerror = () => reject(request.error);
+                request.onsuccess = () => { resolve(request.result); };
+                request.onerror = () => { reject(request.error); };
             }
             catch (error) {
                 resolve([]);
@@ -292,7 +292,7 @@ export class ObjectStore {
                     });
                     resolve(filtered);
                 };
-                request.onerror = () => reject(request.error);
+                request.onerror = () => { reject(request.error); };
             }
             catch (error) {
                 resolve([]);
@@ -312,8 +312,8 @@ export class ObjectStore {
                 const store = tx.objectStore(this.storeName);
                 const index = store.index(indexName);
                 const request = index.get(value);
-                request.onsuccess = () => resolve(request.result);
-                request.onerror = () => reject(request.error);
+                request.onsuccess = () => { resolve(request.result); };
+                request.onerror = () => { reject(request.error); };
             }
             catch (error) {
                 resolve(undefined);
@@ -333,8 +333,8 @@ export class ObjectStore {
                 const store = tx.objectStore(this.storeName);
                 const index = store.index(indexName);
                 const request = index.count(value);
-                request.onsuccess = () => resolve(request.result);
-                request.onerror = () => reject(request.error);
+                request.onsuccess = () => { resolve(request.result); };
+                request.onerror = () => { reject(request.error); };
             }
             catch (error) {
                 resolve(0);

package/dist/stores/SyncActionStore.d.ts

@@ -4,7 +4,7 @@
  * Stores and manages sync actions received from the server.
  * Critical for delta sync and maintaining sync state consistency.
  */
-import { SyncAction } from '../types/index.js';
+import type { SyncAction } from '../types/index.js';
 /**
  * SyncActionStore - Manages sync actions (deltas)
  *