@abloatai/ablo 0.28.0 → 0.29.1

package/dist/schema/select.js

@@ -29,7 +29,7 @@ export function selectModels(schema, keys) {
     for (const key of keys) {
         const def = schema.models[key];
         if (!def) {
-            throw new AbloValidationError(`selectModels: "${String(key)}" is not a model in the source schema`, { code: 'invalid_schema', param: String(key) });
+            throw new AbloValidationError(`selectModels: "${key}" is not a model in the source schema`, { code: 'invalid_schema', param: key });
         }
         // Prune relations whose target isn't in the selected set. A pruned
         // `parent` edge is a routing error, not a silent drop.
@@ -40,8 +40,8 @@ export function selectModels(schema, keys) {
                 continue;
             }
             if (rel.options?.parent) {
-                throw new AbloValidationError(`selectModels: model "${String(key)}" has a parent relation "${relName}" → "${rel.target}", ` +
-                    `which is not in the selected set. Include "${rel.target}" so scope inheritance still routes.`, { code: 'invalid_schema', param: `${String(key)}.${relName}` });
+                throw new AbloValidationError(`selectModels: model "${key}" has a parent relation "${relName}" → "${rel.target}", ` +
+                    `which is not in the selected set. Include "${rel.target}" so scope inheritance still routes.`, { code: 'invalid_schema', param: `${key}.${relName}` });
             }
         }
         models[key] = { ...def, relations };
@@ -53,3 +53,27 @@ export function selectModels(schema, keys) {
         identityRoles: schema.identityRoles,
     };
 }
+/**
+ * `omitModels` is `selectModels` from the other side: keep every model EXCEPT
+ * the named ones. Use it when an app is the general case and a separate app
+ * owns the omitted models — the suite shell drops a specialized store that the
+ * standalone app selects for itself:
+ *
+ * ```ts
+ * export const schema = omitModels(full, ['reports', 'reportSections']);
+ * ```
+ *
+ * Same validation as `selectModels`: relations into the omitted set are
+ * dropped, and a dropped `parent` edge throws — so a model whose scope routes
+ * through an omitted parent cannot be silently kept.
+ */
+export function omitModels(schema, keys) {
+    const drop = new Set(keys);
+    for (const key of keys) {
+        if (!schema.models[key]) {
+            throw new AbloValidationError(`omitModels: "${key}" is not a model in the source schema`, { code: 'invalid_schema', param: key });
+        }
+    }
+    const kept = Object.keys(schema.models).filter((k) => !drop.has(k));
+    return selectModels(schema, kept);
+}

package/dist/source/connector.d.ts

@@ -62,9 +62,9 @@ export interface SourceConnectorOptions {
      */
     readonly apiKey: string;
     /**
-     * The Data Source handler to serve, as returned by `dataSource(options)` or
-     * `abloSource(options)`. The connector feeds it each request and relays the
-     * response back untouched; it never inspects or alters either one.
+     * The Data Source handler to serve, as returned by `dataSource(options)`.
+     * The connector feeds it each request and relays the response back untouched;
+     * it never inspects or alters either one.
      */
     readonly handler: (request: Request) => Promise<Response>;
     /** The Ablo base URL to dial. Defaults to `https://api.abloatai.com`. */

package/dist/source/factory.d.ts

@@ -1,6 +1,6 @@
 /**
- * Builds the Data Source request handler returned by `abloSource()` and its alias
- * `dataSource()`. Given your options — the schema, the API key, and either
+ * Builds the request handler returned by `dataSource()`. Given your options —
+ * the schema, the API key, and either
  * per-model handlers or an ORM adapter — the handler verifies each signed request,
  * enforces the per-key scopes, and routes the four wire operations (`load`,
  * `list`, `commit`, and `events`) to whichever handlers you configured.
@@ -13,7 +13,7 @@ type SourceModels<S extends SchemaRecord, TAuth> = Partial<{
         readonly id: string;
     } & Record<string, unknown>, InferCreate<Schema<S>, K>, TAuth>;
 }>;
-export type AbloSourceOptions<S extends SchemaRecord, TAuth = unknown> = {
+export type DataSourceOptions<S extends SchemaRecord, TAuth = unknown> = {
     readonly schema: Schema<S>;
     /**
      * Your Ablo project credential. Ablo signs each Data Source call with the same
@@ -66,7 +66,7 @@ export type AbloSourceOptions<S extends SchemaRecord, TAuth = unknown> = {
     readonly events?: SourceEventsHandler<TAuth>;
     /**
      * Groups per-model handlers under a `models` key. The spread form below is
-     * usually shorter — `abloSource({ schema, files: { load, list, commit } })` —
+     * usually shorter — `dataSource({ schema, files: { load, list, commit } })` —
      * but this explicit form is available when you prefer it.
      */
     readonly models?: SourceModels<S, TAuth>;
@@ -88,7 +88,5 @@ export type AbloSourceOptions<S extends SchemaRecord, TAuth = unknown> = {
  * canonical rows in your database: Ablo calls a narrow, signed endpoint you
  * control rather than holding your database credentials.
  */
-export declare function abloSource<const S extends SchemaRecord, TAuth = unknown>(options: AbloSourceOptions<S, TAuth>): (request: Request) => Promise<Response>;
-export type DataSourceOptions<S extends SchemaRecord, TAuth = unknown> = AbloSourceOptions<S, TAuth>;
 export declare function dataSource<const S extends SchemaRecord, TAuth = unknown>(options: DataSourceOptions<S, TAuth>): (request: Request) => Promise<Response>;
 export {};

package/dist/source/factory.js

@@ -1,6 +1,6 @@
 /**
- * Builds the Data Source request handler returned by `abloSource()` and its alias
- * `dataSource()`. Given your options — the schema, the API key, and either
+ * Builds the request handler returned by `dataSource()`. Given your options —
+ * the schema, the API key, and either
  * per-model handlers or an ORM adapter — the handler verifies each signed request,
  * enforces the per-key scopes, and routes the four wire operations (`load`,
  * `list`, `commit`, and `events`) to whichever handlers you configured.
@@ -131,8 +131,8 @@ function sameModel(operations) {
  * canonical rows in your database: Ablo calls a narrow, signed endpoint you
  * control rather than holding your database credentials.
  */
-export function abloSource(options) {
-    return async function handleAbloSource(request) {
+export function dataSource(options) {
+    return async function handleDataSource(request) {
         if (request.method !== 'POST') {
             return json({ error: 'method_not_allowed' }, 405);
         }
@@ -263,6 +263,3 @@ export function abloSource(options) {
         return json({ error: 'unknown_source_request' }, 400);
     };
 }
-export function dataSource(options) {
-    return abloSource(options);
-}

package/dist/source/index.d.ts

@@ -4,13 +4,13 @@
  *
  *   - `types.ts`   — the shared wire and handler types, plus `sourceEventForOperation`
  *   - `signing.ts` — request signing and verification
- *   - `factory.ts` — the `abloSource()` / `dataSource()` endpoint factory
+ *   - `factory.ts` — the `dataSource()` endpoint factory
  *
  * Import from here; the sibling modules import one another directly.
  */
-export { sourceEventForOperation, type SourcePrimitive, type SourceWhere, type SourceListQuery, type SourceListPage, type SourceListResult, type SourceRequestContext, type SourceOperation, type SourceDelta, type SourceEvent, type SourceEventForOperationOptions, type SourceCommitResult, type SourceCommitParams, type SourceScope, type SourceEventsResult, type SourceEventsHandler, type SourceAuthorizeContext, type SourceHandlerContext, type SourceModelHandlers, type SourceCommitHandler, type SourceApiKey, type SourceLoadRequest, type SourceListRequest, type SourceCommitRequest, type SourceEventsRequest, type SourceRequest, type SourceResponse, type DataSourcePrimitive, type DataSourceWhere, type DataSourceListQuery, type DataSourceListPage, type DataSourceListResult, type DataSourceRequestContext, type DataSourceOperation, type DataSourceDelta, type DataSourceEvent, type DataSourceEventForOperationOptions, type DataSourceCommitResult, type DataSourceCommitParams, type DataSourceScope, type DataSourceEventsResult, type DataSourceEventsHandler, type DataSourceAuthorizeContext, type DataSourceHandlerContext, type DataSourceModelHandlers, type DataSourceCommitHandler, type DataSourceApiKey, type DataSourceLoadRequest, type DataSourceListRequest, type DataSourceCommitRequest, type DataSourceEventsRequest, type DataSourceRequest, type DataSourceResponse, } from './types.js';
-export { ABLO_SOURCE_HEADERS, SourceSignatureError, signAbloSourceRequest, verifyAbloSourceRequest, type SourceSignatureOptions, type SourceSignatureVerificationOptions, type SourceSignatureVerificationResult, type DataSourceSignatureOptions, type DataSourceSignatureVerificationOptions, type DataSourceSignatureVerificationResult, } from './signing.js';
-export { abloSource, dataSource, type AbloSourceOptions, type DataSourceOptions, } from './factory.js';
+export { sourceEventForOperation, type SourcePrimitive, type SourceWhere, type SourceListQuery, type SourceListPage, type SourceListResult, type SourceRequestContext, type SourceOperation, type SourceDelta, type SourceEvent, type SourceEventForOperationOptions, type SourceCommitResult, type SourceCommitParams, type SourceScope, type SourceEventsResult, type SourceEventsHandler, type SourceAuthorizeContext, type SourceHandlerContext, type SourceModelHandlers, type SourceCommitHandler, type SourceApiKey, type SourceLoadRequest, type SourceListRequest, type SourceCommitRequest, type SourceEventsRequest, type SourceRequest, type SourceResponse, } from './types.js';
+export { ABLO_SOURCE_HEADERS, SourceSignatureError, signAbloSourceRequest, verifyAbloSourceRequest, type SourceSignatureOptions, type SourceSignatureVerificationOptions, type SourceSignatureVerificationResult, } from './signing.js';
+export { dataSource, type DataSourceOptions, } from './factory.js';
 export { createPushQueue, InMemoryPushQueueStorage, STANDARD_WEBHOOKS_RETRY_SCHEDULE, type PushQueue, type PushQueueItem, type PushQueueOptions, type PushQueueStorage, } from './pushQueue.js';
 export { createSourceConnector, DEFAULT_RECONNECT_SCHEDULE, type SourceConnector, type SourceConnectorOptions, type ConnectorWebSocket, type ConnectorWebSocketFactory, type ConnectorStatus, } from './connector.js';
 export { SOURCE_CONNECTOR_PROTOCOL_VERSION, SOURCE_CONNECTOR_WS_PATH, WS_SOURCE_SUBPROTOCOL, sourceConnectorSubprotocols, encodeFrame, decodeFrame, ConnectorProtocolError, connectorFrameSchema, type ConnectorFrame, type RegisterFrame, type ReadyFrame, type RequestFrame, type ResponseFrame, type ErrorFrame, } from './connectorProtocol.js';

package/dist/source/index.js

@@ -4,13 +4,13 @@
  *
  *   - `types.ts`   — the shared wire and handler types, plus `sourceEventForOperation`
  *   - `signing.ts` — request signing and verification
- *   - `factory.ts` — the `abloSource()` / `dataSource()` endpoint factory
+ *   - `factory.ts` — the `dataSource()` endpoint factory
  *
  * Import from here; the sibling modules import one another directly.
  */
 export { sourceEventForOperation, } from './types.js';
 export { ABLO_SOURCE_HEADERS, SourceSignatureError, signAbloSourceRequest, verifyAbloSourceRequest, } from './signing.js';
-export { abloSource, dataSource, } from './factory.js';
+export { dataSource, } from './factory.js';
 export { createPushQueue, InMemoryPushQueueStorage, STANDARD_WEBHOOKS_RETRY_SCHEDULE, } from './pushQueue.js';
 // The reverse-channel connector — an outbound transport for the load, list, and
 // commit leg, and the dial-out counterpart to `createPushQueue`. It lets you serve

package/dist/source/signing.d.ts

@@ -83,6 +83,3 @@ export declare function signAbloSourceRequest(options: SourceSignatureOptions):
  * id and signing time. This is the counterpart to {@link signAbloSourceRequest}.
  */
 export declare function verifyAbloSourceRequest(options: SourceSignatureVerificationOptions): Promise<SourceSignatureVerificationResult>;
-export type DataSourceSignatureOptions = SourceSignatureOptions;
-export type DataSourceSignatureVerificationOptions = SourceSignatureVerificationOptions;
-export type DataSourceSignatureVerificationResult = SourceSignatureVerificationResult;

package/dist/source/types.d.ts

@@ -323,29 +323,3 @@ export type SourceResponse<Row = Record<string, unknown>> = {
     readonly rows?: readonly Row[];
     readonly deltas?: readonly SourceDelta[];
 };
-export type DataSourcePrimitive = SourcePrimitive;
-export type DataSourceWhere = SourceWhere;
-export type DataSourceListQuery = SourceListQuery;
-export type DataSourceListPage<Row> = SourceListPage<Row>;
-export type DataSourceListResult<Row> = SourceListResult<Row>;
-export type DataSourceRequestContext = SourceRequestContext;
-export type DataSourceOperation = SourceOperation;
-export type DataSourceDelta = SourceDelta;
-export type DataSourceEvent = SourceEvent;
-export type DataSourceEventForOperationOptions = SourceEventForOperationOptions;
-export type DataSourceCommitResult<Row = Record<string, unknown>> = SourceCommitResult<Row>;
-export type DataSourceCommitParams<TAuth = unknown> = SourceCommitParams<TAuth>;
-export type DataSourceScope = SourceScope;
-export type DataSourceEventsResult = SourceEventsResult;
-export type DataSourceEventsHandler<TAuth = unknown> = SourceEventsHandler<TAuth>;
-export type DataSourceAuthorizeContext = SourceAuthorizeContext;
-export type DataSourceHandlerContext<TAuth = unknown> = SourceHandlerContext<TAuth>;
-export type DataSourceModelHandlers<Row, CreateInput, TAuth = unknown> = SourceModelHandlers<Row, CreateInput, TAuth>;
-export type DataSourceCommitHandler<TAuth = unknown> = SourceCommitHandler<TAuth>;
-export type DataSourceApiKey = SourceApiKey;
-export type DataSourceLoadRequest = SourceLoadRequest;
-export type DataSourceListRequest = SourceListRequest;
-export type DataSourceCommitRequest = SourceCommitRequest;
-export type DataSourceEventsRequest = SourceEventsRequest;
-export type DataSourceRequest = SourceRequest;
-export type DataSourceResponse<Row = Record<string, unknown>> = SourceResponse<Row>;

package/dist/stores/ObjectStore.js

@@ -41,8 +41,8 @@ export class ObjectStore {
                 const store = tx.objectStore(this.storeName);
                 const request = store.add(data);
                 tx.oncomplete = () => { resolve(); };
-                tx.onerror = () => { reject(tx.error || new Error('IndexedDB transaction error')); };
-                request.onerror = () => { reject(request.error || new Error('IndexedDB request error')); };
+                tx.onerror = () => { reject(tx.error ?? new Error('IndexedDB transaction error')); };
+                request.onerror = () => { reject(request.error ?? new Error('IndexedDB request error')); };
             }
             catch (error) {
                 reject(error instanceof Error ? error : new Error(String(error)));
@@ -93,8 +93,8 @@ export class ObjectStore {
                 const store = tx.objectStore(this.storeName);
                 const request = store.put(data);
                 tx.oncomplete = () => { resolve(); };
-                tx.onerror = () => { reject(tx.error || new Error('IndexedDB transaction error')); };
-                request.onerror = () => { reject(request.error || new Error('IndexedDB request error')); };
+                tx.onerror = () => { reject(tx.error ?? new Error('IndexedDB transaction error')); };
+                request.onerror = () => { reject(request.error ?? new Error('IndexedDB request error')); };
             }
             catch (error) {
                 // Propagate failure so callers do not continue with inconsistent state
@@ -197,8 +197,8 @@ export class ObjectStore {
                 const store = tx.objectStore(this.storeName);
                 const request = store.delete(id);
                 tx.oncomplete = () => { resolve(); };
-                tx.onerror = () => { reject(tx.error || new Error('IndexedDB transaction error')); };
-                request.onerror = () => { reject(request.error || new Error('IndexedDB request error')); };
+                tx.onerror = () => { reject(tx.error ?? new Error('IndexedDB transaction error')); };
+                request.onerror = () => { reject(request.error ?? new Error('IndexedDB request error')); };
             }
             catch (error) {
                 reject(error instanceof Error ? error : new Error(String(error)));
@@ -233,8 +233,8 @@ export class ObjectStore {
                 const store = tx.objectStore(this.storeName);
                 const request = store.clear();
                 tx.oncomplete = () => { resolve(); };
-                tx.onerror = () => { reject(tx.error || new Error('IndexedDB transaction error')); };
-                request.onerror = () => { reject(request.error || new Error('IndexedDB request error')); };
+                tx.onerror = () => { reject(tx.error ?? new Error('IndexedDB transaction error')); };
+                request.onerror = () => { reject(request.error ?? new Error('IndexedDB request error')); };
             }
             catch (error) {
                 reject(error instanceof Error ? error : new Error(String(error)));

package/dist/surface.d.ts

@@ -30,7 +30,7 @@ export declare const PUBLIC_LIST_OPTION_KEYS: readonly ["where", "filter", "orde
  * The keys of the client constructor options, {@link AbloOptions}. Only
  * `schema` is required; every other key is optional.
  */
-export declare const PUBLIC_ABLO_OPTION_KEYS: readonly ["schema", "apiKey", "authEndpoint", "databaseUrl", "persistence", "commitOutbox", "commitOutboxScope", "transport", "debug", "logLevel", "authToken", "baseURL", "fetch", "defaultHeaders", "defaultQuery", "dangerouslyAllowBrowser"];
+export declare const PUBLIC_ABLO_OPTION_KEYS: readonly ["schema", "apiKey", "authEndpoint", "databaseUrl", "persistence", "durableWrites", "commitOutbox", "commitOutboxScope", "transport", "debug", "logLevel", "authToken", "baseURL", "fetch", "defaultHeaders", "defaultQuery", "dangerouslyAllowBrowser"];
 export type ModelVerb = (typeof PUBLIC_MODEL_VERBS)[number];
 export type ListOptionKey = (typeof PUBLIC_LIST_OPTION_KEYS)[number];
 export type AbloOptionKey = (typeof PUBLIC_ABLO_OPTION_KEYS)[number];

package/dist/surface.js

@@ -58,6 +58,7 @@ export const PUBLIC_ABLO_OPTION_KEYS = [
     'authEndpoint',
     'databaseUrl',
     'persistence',
+    'durableWrites',
     'commitOutbox',
     'commitOutboxScope',
     'transport',

package/dist/sync/BootstrapFetcher.d.ts

@@ -88,6 +88,16 @@ export declare class BootstrapFetcher {
      * means the app's schema and the deployed schema have diverged — reads/writes
      * relying on undeployed changes will later fail with an opaque DB constraint
      * error. Warn once, actionably; never throws or blocks the bootstrap.
+     *
+     * The message names the SERVER it connected to, and spans all three real
+     * causes rather than assuming "you forgot to push". Drift most often means the
+     * schema was pushed to a different server, project, or environment than this
+     * client points at (a bare `ablo push` targets the hosted default; a local app
+     * usually reads a local server) — so the first, load-bearing pointer is `ablo
+     * status`, which names the exact org/project/environment the key resolves to
+     * and the deployed hash, turning "which of these is it?" into one glance. The
+     * older "Run `ablo push`" copy sent everyone down one path and confused the
+     * common wrong-target and version-skew cases.
      */
     private warnOnSchemaDrift;
     constructor(options: BootstrapOptions);

package/dist/sync/BootstrapFetcher.js

@@ -25,6 +25,16 @@ export class BootstrapFetcher {
      * means the app's schema and the deployed schema have diverged — reads/writes
      * relying on undeployed changes will later fail with an opaque DB constraint
      * error. Warn once, actionably; never throws or blocks the bootstrap.
+     *
+     * The message names the SERVER it connected to, and spans all three real
+     * causes rather than assuming "you forgot to push". Drift most often means the
+     * schema was pushed to a different server, project, or environment than this
+     * client points at (a bare `ablo push` targets the hosted default; a local app
+     * usually reads a local server) — so the first, load-bearing pointer is `ablo
+     * status`, which names the exact org/project/environment the key resolves to
+     * and the deployed hash, turning "which of these is it?" into one glance. The
+     * older "Run `ablo push`" copy sent everyone down one path and confused the
+     * common wrong-target and version-skew cases.
      */
     warnOnSchemaDrift(serverHash) {
         if (this.schemaDriftWarned || !serverHash)
@@ -33,14 +43,27 @@ export class BootstrapFetcher {
         if (!clientHash || clientHash === serverHash)
             return;
         this.schemaDriftWarned = true;
+        const org = this.options.organizationId;
+        const where = org ? `${this.baseUrl} (org ${org})` : this.baseUrl;
         // Self-brand the message ("Ablo:") rather than rely on the default logger's
         // `[Ablo]` namespace — consumers wiring their own logger (pino, etc.) lose
         // that prefix, and a drift warning that reads like the app's own log is
         // worse than none. The brand tells them at a glance who is talking.
-        getContext().logger.warn(`Ablo: Schema drift detected — this app was built against schema ${clientHash}, ` +
-            `but the deployed schema is ${serverHash}. Operations that depend on schema ` +
-            `changes not yet deployed will fail later with an opaque database error. Run ` +
-            `\`ablo push\` to deploy your schema (or update this app to match the deployed one).`, { clientSchemaHash: clientHash, serverSchemaHash: serverHash });
+        getContext().logger.warn(`Ablo: Schema drift — the schema this client was built with (${clientHash}) is not the ` +
+            `one active on the server it connected to (${serverHash} at ${where}). Until they match, ` +
+            `operations that depend on the difference will fail later with an opaque database error. ` +
+            `This is usually one of three things. The schema may have been pushed to a different ` +
+            `server, project, or environment than this client points at — run \`ablo status\` to see ` +
+            `the exact org, project, and environment your key resolves to, alongside the deployed ` +
+            `hash, and confirm they match here. Your local schema may simply not be pushed to this ` +
+            `server yet — run \`ablo push\` against it. Or this client and the server may have been ` +
+            `built with different Ablo versions, which can hash an identical schema differently — ` +
+            `align the versions. This check is advisory and never blocks the connection.`, {
+            clientSchemaHash: clientHash,
+            serverSchemaHash: serverHash,
+            serverUrl: this.baseUrl,
+            ...(org ? { organizationId: org } : {}),
+        });
     }
     constructor(options) {
         // Defaults are spread first; the explicit `baseUrl` then takes precedence,

package/dist/sync/createClaimStream.d.ts

@@ -23,6 +23,15 @@
  */
 import type { SyncWebSocket } from './SyncWebSocket.js';
 import type { ClaimOptions, Claim, ClaimStream, PresenceTarget } from '../types/streams.js';
+/**
+ * The wire capability the claim stream actually uses: subscribe to typed
+ * inbound frames, check liveness, and send outbound frames. `SyncWebSocket`
+ * satisfies it, so production wiring is unchanged — but depending on the port
+ * rather than the whole socket class lets a test drive it with a plain object,
+ * no cast. `Pick` carries the exact (generic, typed-payload) `subscribe`
+ * signature, so every handler stays fully typed.
+ */
+export type ClaimTransport = Pick<SyncWebSocket, 'subscribe' | 'isConnected' | 'send'>;
 export interface ClaimStreamConfig {
     /** Identity used to filter our own active claims out of `others`. */
     participantId: string;
@@ -36,7 +45,7 @@ export interface AttachableClaimStream extends ClaimStream {
      * `ablo.<model>.claim({ id })`, which is built on this.
      */
     claim(target: PresenceTarget, opts?: ClaimOptions): Claim;
-    attach(transport: SyncWebSocket): void;
+    attach(transport: ClaimTransport): void;
     dispose(): void;
 }
-export declare function createClaimStream(config: ClaimStreamConfig, transport?: SyncWebSocket | null): AttachableClaimStream;
+export declare function createClaimStream(config: ClaimStreamConfig, transport?: ClaimTransport | null): AttachableClaimStream;

package/dist/sync/createClaimStream.js

@@ -23,7 +23,7 @@
  */
 import { asyncIteratorFrom } from '../utils/asyncIterator.js';
 import { toMs } from '../utils/duration.js';
-import { claimHeartbeatAckPayloadSchema, descriptionFromMeta, participantKindFromWire, } from '../coordination/schema.js';
+import { claimHeartbeatAckPayloadSchema, claimLostSchema, descriptionFromMeta, participantKindFromWire, } from '../coordination/schema.js';
 import { AbloClaimedError, AbloConnectionError } from '../errors.js';
 import { resolveHeartbeatOptions } from '../client/claimHeartbeatLoop.js';
 import { getContext } from '../context.js';
@@ -173,9 +173,10 @@ export function createClaimStream(config, transport = null) {
         //      (preempted or expired). Distinct from a rejection, which is a claim
         //      the server refused.
         unsubs.push(t.subscribe('claim_lost', (payload) => {
-            const lost = payload;
-            if (!lost.claimId)
+            const parsed = claimLostSchema.safeParse(payload);
+            if (!parsed.success)
                 return;
+            const lost = parsed.data;
             if (ownClaims.has(lost.claimId)) {
                 const c = ownClaims.get(lost.claimId);
                 getContext().logger.info(`claim: lost ${c ? claimLabel(c.entityType, c.entityId, c.field) : lost.claimId} (preempted or expired)`, { claimId: lost.claimId });

package/dist/testing/mocks/FakeDatabase.d.ts

@@ -2,7 +2,7 @@ import type { Database } from '../../Database.js';
 /**
  * Overrides for {@link fakeDatabase}. Everything is typechecked against
  * Database's public surface except `getPersistedTransactions`, which widens to
- * `unknown[]`: persisted rows are untrusted input (the CommitOutboxStore port
+ * `unknown[]`: persisted rows are untrusted input (the DurableWriteStore port
  * documents this), and restore-path tests feed deliberately corrupt rows.
  */
 export type FakeDatabaseOverrides = Omit<Partial<Database>, 'getPersistedTransactions'> & {

package/dist/transactions/TransactionQueue.d.ts

@@ -19,7 +19,7 @@ import type { WriteOptions } from '../interfaces/index.js';
 import type { StaleNotification, ReadDependency } from '../coordination/schema.js';
 import { type MutationInput, type Transaction, type UserContext } from './commitPayload.js';
 import { type DurableCommitEnvelope, type DurableCommitOperation, type CommitOutboxScope } from './commitEnvelope.js';
-import type { CommitOutboxStore } from './commitOutboxStore.js';
+import type { DurableWriteStore } from './durableWriteStore.js';
 export type { Transaction, UserContext } from './commitPayload.js';
 /**
  * A pre-built, multi-operation commit submitted through
@@ -161,7 +161,7 @@ export declare class TransactionQueue extends EventEmitter {
      */
     private ensureCommitEnvelope;
     /** Bind the strict local outbox used before any mutation reaches the wire. */
-    setCommitOutbox(outbox: CommitOutboxStore): void;
+    setCommitOutbox(outbox: DurableWriteStore): void;
     setCommitOutboxScope(scope: CommitOutboxScope): void;
     private sourceMutationIdsFor;
     /**

package/dist/transactions/TransactionQueue.js

@@ -350,7 +350,7 @@ export class TransactionQueue extends EventEmitter {
             catch (cause) {
                 if (cause instanceof AbloError)
                     throw cause;
-                throw new AbloConnectionError('Could not seal the commit outbox before dispatch', {
+                throw new AbloConnectionError('Could not persist the durable write before dispatch', {
                     code: 'db_not_opened',
                     cause,
                 });
@@ -370,7 +370,7 @@ export class TransactionQueue extends EventEmitter {
             await this.commitOutbox.remove(commitEnvelopeRecordId(idempotencyKey));
         }
         catch (error) {
-            getContext().logger.debug('[TransactionQueue] Commit outbox cleanup deferred', {
+            getContext().logger.debug('[TransactionQueue] Durable-write cleanup deferred', {
                 idempotencyKey,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -2086,7 +2086,7 @@ export class TransactionQueue extends EventEmitter {
                 void this.processCommitLane();
         }
         catch (error) {
-            getContext().logger.debug('[TransactionQueue] Failed to restore commit outbox', {
+            getContext().logger.debug('[TransactionQueue] Failed to restore durable writes', {
                 error: error instanceof Error ? error.message : String(error),
             });
             getContext().observability.captureTransactionFailure({

package/dist/transactions/commitEnvelope.d.ts

@@ -18,7 +18,7 @@ export declare const commitEnvelopeMemberSchema: z.ZodObject<{
     sequence: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export type CommitEnvelopeMember = z.infer<typeof commitEnvelopeMemberSchema>;
-/** The legacy mutation operation shape sent by the current commit transport. */
+/** One operation stored exactly as the current commit transport sends it. */
 export declare const durableCommitOperationSchema: z.ZodObject<{
     type: z.ZodEnum<{
         CREATE: "CREATE";

package/dist/transactions/commitEnvelope.js

@@ -7,9 +7,9 @@
  * operations, and the source mutations it supersedes.
  */
 import { z } from 'zod';
-import { idempotencyKeySchema } from '../commit/contract.js';
 import { readDependencySchema } from '../coordination/schema.js';
 import { commitOperationSchema } from '../wire/frames.js';
+import { idempotencyKeySchema } from './idempotencyKey.js';
 export const COMMIT_ENVELOPE_VERSION = 1;
 export const COMMIT_ENVELOPE_RECORD_PREFIX = 'commit-envelope:';
 /** One transaction's position in a commit; this is not the envelope itself. */
@@ -22,7 +22,7 @@ export const commitEnvelopeMemberSchema = z
     sequence: z.number().int().nonnegative().optional(),
 })
     .refine(({ operationIndex, operationCount }) => operationIndex < operationCount, { message: 'operationIndex must be smaller than operationCount' });
-/** The legacy mutation operation shape sent by the current commit transport. */
+/** One operation stored exactly as the current commit transport sends it. */
 export const durableCommitOperationSchema = commitOperationSchema
     .pick({
     type: true,

package/dist/transactions/commitOutboxStore.d.ts

@@ -5,28 +5,28 @@
  * inject a workflow-, SQLite-, or filesystem-backed implementation without
  * coupling TransactionQueue to the browser database/cache implementation.
  */
-import type { Database } from '../Database.js';
-import type { DurableCommitEnvelope } from './commitEnvelope.js';
-import type { DurableHttpCommitEnvelope } from './httpCommitEnvelope.js';
-export type CommitOutboxRecord = DurableCommitEnvelope | DurableHttpCommitEnvelope;
-export interface CommitOutboxStore {
-    /**
-     * Atomically reserve an envelope and consume the staged records it owns.
-     * Implementations must be scoped to one logical participant + server plane,
-     * reject same-id/different-request seals, and let only one envelope claim a
-     * staged record.
-     */
-    seal(envelope: CommitOutboxRecord, consumedRecordIds: readonly string[]): Promise<void>;
-    /** Load unacknowledged records. Implementations may return untrusted data. */
-    list(): Promise<readonly unknown[]>;
-    /** Remove one definitively settled envelope. */
-    remove(envelopeRecordId: string): Promise<void>;
+import type { DurableWriteStore, PendingWrite } from './durableWriteStore.js';
+/** @deprecated Use {@link PendingWrite}. */
+export type CommitOutboxRecord = PendingWrite;
+/** @deprecated Use {@link DurableWriteStore}. */
+export type CommitOutboxStore = DurableWriteStore;
+/**
+ * The exact subset of the browser `Database` that {@link DatabaseCommitOutboxStore}
+ * drives. Typing the adapter to this narrow port instead of importing the
+ * concrete `Database` class keeps the outbox store off the
+ * `Database → DatabaseManager → ModelRegistry → BaseSyncedStore` import cycle;
+ * the real `Database` still satisfies it structurally, so callers are unchanged.
+ */
+export interface CommitOutboxDatabase {
+    sealTransactionRecord(record: PendingWrite, consumedRecordIds: readonly string[]): Promise<unknown>;
+    getPersistedTransactions(): Promise<readonly unknown[]>;
+    removeTransaction(id: string): Promise<void>;
 }
 /** Strict IndexedDB adapter backed by Database's `__transactions` store. */
-export declare class DatabaseCommitOutboxStore implements CommitOutboxStore {
+export declare class DatabaseCommitOutboxStore implements DurableWriteStore {
     private readonly database;
-    constructor(database: Database);
-    seal(envelope: CommitOutboxRecord, consumedRecordIds: readonly string[]): Promise<void>;
+    constructor(database: CommitOutboxDatabase);
+    seal(envelope: PendingWrite, consumedRecordIds: readonly string[]): Promise<void>;
     list(): Promise<readonly unknown[]>;
     remove(envelopeRecordId: string): Promise<void>;
 }