@abloatai/ablo 0.34.1 → 0.35.0

package/dist/client/createModelProxy.js

@@ -3,29 +3,56 @@
  * `ablo.<model>`.
  *
  * Each schema model gets one {@link ModelOperations}: the async server reads
- * `retrieve` and `list`, the synchronous local-graph snapshots `get`, `getAll`,
- * and `getCount`, the writes `create`, `update`, and `delete`, the coordination
+ * `retrieve` and `list`, the same verbs restricted to the local graph under
+ * `local`, the writes `create`, `update`, and `delete`, the coordination
  * namespace `claim` (callable as `claim({ id })`, plus `claim.state`,
  * `claim.queue`, `claim.release`, and `claim.reorder`), `join`, and `onChange`.
  * The factory returns a plain object; the client assembles the `ablo.<model>`
  * lookup table from one of these per model.
  */
 import { autorun } from 'mobx';
-import { AbloClaimedError, AbloStaleContextError, AbloValidationError, formatClaimedErrorMessage, toAbloError, } from '../errors.js';
-import { reconcileFunctionalUpdate, } from './functionalUpdate.js';
+import { AbloClaimedError, AbloValidationError, formatClaimedErrorMessage, toAbloError, } from '../transaction/errors.js';
+import { reconcileFunctionalUpdate, } from '../transaction/resources/functionalUpdate.js';
+import { claimDescription, } from '../transaction/coordination/schema.js';
 import { Model, modelAsRow } from '../Model.js';
-import { toMs } from '../utils/duration.js';
-import { LEASE_TTL_MS } from '../wire/protocol.js';
-import { heartbeatCadenceMs, resolveHeartbeatOptions, startClaimHeartbeatLoop, } from './claimHeartbeatLoop.js';
-import { assertWriteOptions } from './writeOptionsSchema.js';
-import { ModelScope } from '../types/index.js';
+import { toMs } from '../transaction/utils/duration.js';
+import { LEASE_TTL_MS } from '../transaction/wire/protocol.js';
+import { heartbeatCadenceMs, resolveHeartbeatOptions, startClaimHeartbeatLoop, } from '../transaction/coordination/claimHeartbeatLoop.js';
+import { assertWriteOptions } from '../transaction/resources/writeOptionsSchema.js';
+import { modelTarget, subTarget } from '../transaction/coordination/index.js';
+import { ModelScope } from '../transaction/types/index.js';
 const modelClientMeta = new WeakMap();
 export function getModelClientMeta(modelClient) {
     if (typeof modelClient !== 'object' || modelClient === null)
         return undefined;
     return modelClientMeta.get(modelClient);
 }
-export function createModelProxy(schemaKey, registeredModelName, objectPool, syncClient, registry, hydration, collaboration) {
+export function createModelProxy(schemaKey, registeredModelName, objectPool, syncClient, registry, hydration, collaboration, 
+/** The client-wide `wait` default; a per-call `wait` still wins over it. */
+defaultWait) {
+    /**
+     * Resolve a row **this** resource owns.
+     *
+     * The pool is one id space, so `objectPool.get(id)` happily returns another
+     * model's row. Every write path below addresses rows by bare id, so without
+     * this an id from a sibling model resolves and gets written — silently
+     * corrupting a row the caller never named.
+     *
+     * `undefined` means genuinely absent. A row belonging to another model throws:
+     * unlike a read, a cross-model *write* is never a legitimate outcome, and
+     * naming both models turns a silent corruption into a one-line diagnosis.
+     */
+    const ownRowOrThrow = (id) => {
+        const own = objectPool.getOfType(id, registeredModelName);
+        if (own)
+            return own;
+        const foreign = objectPool.get(id);
+        if (!foreign)
+            return undefined;
+        const owner = foreign.getModelName();
+        throw new AbloValidationError(`No ${registeredModelName} with id ${id} — that id belongs to a ${owner}. ` +
+            `Read or write it through ${owner}.`, { code: 'entity_not_found' });
+    };
     const ModelClass = registry.getModelByName(registeredModelName);
     if (!ModelClass) {
         throw new AbloValidationError(`Ablo: schema model "${schemaKey}" resolved to "${registeredModelName}", ` +
@@ -66,7 +93,11 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         return rows;
     };
     const waitForMutation = async (model, options) => {
-        if (options?.wait !== 'confirmed')
+        // A per-call `wait` wins; otherwise the client-wide default decides. This
+        // is the single point that turns "confirmed" into actually waiting, so a
+        // client configured that way rejects on a refused write everywhere rather
+        // than in the one place a caller remembered to ask.
+        if ((options?.wait ?? defaultWait) !== 'confirmed')
             return;
         await syncClient.syncNow();
         await syncClient.waitForConfirmation(model.getModelName(), model.id);
@@ -93,7 +124,6 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         value.object === 'claim' &&
         typeof value.id === 'string' &&
         typeof value.release === 'function';
-    const claimMeta = (options) => options?.meta;
     const claimContextFromClaim = (claim) => {
         return {
             id: claim.id,
@@ -104,12 +134,8 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             status: claim.status,
             expiresAt: claim.expiresAt,
             target: {
-                model: claim.target.type,
-                id: claim.target.id,
-                path: claim.target.path,
-                range: claim.target.range,
-                field: claim.target.field,
-                meta: claim.target.meta,
+                ...modelTarget(claim.target),
+                ...subTarget(claim.target),
             },
         };
     };
@@ -155,10 +181,10 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             }), { code: 'entity_claimed', claims: [claim] });
         }
         // Ensure the row exists locally before claiming.
-        let model = objectPool.get(id);
+        let model = ownRowOrThrow(id);
         if (!model) {
             await load({ where: [['id', id]] });
-            model = objectPool.get(id);
+            model = ownRowOrThrow(id);
         }
         if (!model) {
             throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
@@ -180,12 +206,12 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             target: {
                 model: wireModel,
                 id,
-                ...(options.field ? { field: options.field } : {}),
-                ...(options.path ? { path: options.path } : {}),
-                ...(options.range ? { range: options.range } : {}),
-                ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+                // The whole sub-entity locator in one move — listing its members here
+                // is what let `fields` die between the caller and the lease, so the
+                // claim covered the whole row while the caller believed it named parts.
+                ...subTarget(options),
             },
-            description: options.description ?? 'editing',
+            description: claimDescription(options),
             ttl: options.ttl,
             queue: !failFast,
             maxQueueDepth: options.maxQueueDepth,
@@ -205,20 +231,17 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             // holder's final write may not have fanned out yet — the exact
             // stale-snapshot race this re-read closes.
             await load({ where: [['id', id]], type: 'complete' });
-            model = objectPool.get(id) ?? model;
+            model = ownRowOrThrow(id) ?? model;
         }
         const snapshot = collaboration.createSnapshot(schemaKey, id);
-        const description = options.description ?? 'editing';
+        const description = claimDescription(options);
         // The self-claim's `ClaimTarget` mirrors what a peer's `claim.state` would
         // report (`state` maps `held.target.model` to `type`), so a holder and a
         // peer see the same `target.type` for one row — the wire model token.
         const selfTarget = {
             type: wireModel,
             id,
-            ...(options.field ? { field: options.field } : {}),
-            ...(options.path ? { path: options.path } : {}),
-            ...(options.range ? { range: options.range } : {}),
-            ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+            ...subTarget(options),
         };
         const ttlMs = options.ttl !== undefined ? toMs(options.ttl) : DEFAULT_LEASE_TTL_MS;
         const expiresAt = Date.now() + ttlMs;
@@ -232,10 +255,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         const target = {
             type: schemaKey,
             id,
-            ...(options.field ? { field: options.field } : {}),
-            ...(options.path ? { path: options.path } : {}),
-            ...(options.range ? { range: options.range } : {}),
-            ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+            ...subTarget(options),
         };
         // A beat resolves with the server's extended expiry; keep the local
         // self-claim estimate in step so `claim.state` renders the real window,
@@ -329,12 +349,12 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             target: {
                 model: wireModel,
                 id,
-                ...(options.field ? { field: options.field } : {}),
-                ...(options.path ? { path: options.path } : {}),
-                ...(options.range ? { range: options.range } : {}),
-                ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+                // The whole sub-entity locator in one move — listing its members here
+                // is what let `fields` die between the caller and the lease, so the
+                // claim covered the whole row while the caller believed it named parts.
+                ...subTarget(options),
             },
-            description: options.description ?? 'editing',
+            description: claimDescription(options),
             ttl: options.ttl,
             queue: !failFast,
             maxQueueDepth: options.maxQueueDepth,
@@ -344,14 +364,11 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         // empty). It costs nothing extra and gives a write taken under this lease a
         // real `readAt` to guard against changes since the lease was acquired.
         const snapshot = collaboration.createSnapshot(schemaKey, id);
-        const description = options.description ?? 'editing';
+        const description = claimDescription(options);
         const selfTarget = {
             type: wireModel,
             id,
-            ...(options.field ? { field: options.field } : {}),
-            ...(options.path ? { path: options.path } : {}),
-            ...(options.range ? { range: options.range } : {}),
-            ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+            ...subTarget(options),
         };
         const ttlMs = options.ttl !== undefined ? toMs(options.ttl) : DEFAULT_LEASE_TTL_MS;
         const expiresAt = Date.now() + ttlMs;
@@ -365,10 +382,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         const target = {
             type: schemaKey,
             id,
-            ...(options.field ? { field: options.field } : {}),
-            ...(options.path ? { path: options.path } : {}),
-            ...(options.range ? { range: options.range } : {}),
-            ...(claimMeta(options) ? { meta: claimMeta(options) } : {}),
+            ...subTarget(options),
         };
         // A beat resolves with the server's extended expiry; keep the local
         // self-claim estimate in step so `claim.state` renders the real window.
@@ -434,7 +448,14 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
     // members to read/steer the coordination plane. Attach the readers to the
     // callable so `ablo.<model>.claim(...)` and `ablo.<model>.claim.state(...)`
     // are the same object.
-    const claimApi = Object.assign(claim, {
+    // `state` and `queue` take a caller-named `meta` shape. The runtime cannot
+    // check it and is not meant to: `target.meta` is application data the
+    // protocol carries verbatim and never interprets, so naming its type is the
+    // caller asserting what it put there — the same bargain as parsing your own
+    // JSON into an interface. These read as `Claim` here, and the one assertion
+    // that applies the caller's parameter is on the assignment below, in one
+    // place rather than at every call site.
+    const claimReaders = {
         state(params) {
             // Read interest: a passive observer of a row's claim state must enter that
             // row's entity scope, or it sits only on broader `org:`/`user:` groups and
@@ -470,28 +491,17 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             collaboration?.reorder({ model: wireModel, id: params.id }, params.order);
         },
         release: guard((params) => releaseClaim(isClaimHandle(params) ? params.target.id : params.id)),
-    });
-    const operations = {
-        retrieve: guard(async (params) => {
-            // Read-interest enrolment: reading a row enters its entity scope, so a
-            // client lands in the same group the holder's claim presence fans out
-            // on and `claim.state`/`claim.queue` report peers. Best-effort and
-            // fire-and-forget — it never makes the read reject or run slower.
-            void collaboration?.enterScope?.({ [schemaKey]: params.id });
-            const rows = await load({
-                ...params,
-                where: [['id', params.id]],
-                limit: 1,
-            });
-            return rows[0];
-        }),
-        // No automatic scope enrolment on bulk `list`/`getAll`: that would subscribe
-        // to an unbounded set of rows' entity groups.
-        list: guard(load),
-        get(id) {
-            return objectPool.get(id);
+    };
+    // The one place the caller's `meta` parameter is applied — see the note on
+    // `claimReaders`. Everything else about this object is checked structurally.
+    const claimApi = Object.assign(claim, claimReaders);
+    const local = {
+        retrieve(id) {
+            // Scoped to this model: an id belonging to a sibling model reads as
+            // absent rather than being handed back as if it were a `T`.
+            return objectPool.getOfType(id, registeredModelName);
         },
-        getAll(options) {
+        list(options) {
             const all = objectPool.getByType(ModelClass, (options?.state ?? ModelScope.live));
             let result = all;
             if (options?.where) {
@@ -525,9 +535,28 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                 result = result.slice(0, options.limit);
             return result;
         },
-        getCount(options) {
-            return this.getAll(options).length;
+        count(options) {
+            return local.list(options).length;
         },
+    };
+    const operations = {
+        local,
+        retrieve: guard(async (params) => {
+            // Read-interest enrolment: reading a row enters its entity scope, so a
+            // client lands in the same group the holder's claim presence fans out
+            // on and `claim.state`/`claim.queue` report peers. Best-effort and
+            // fire-and-forget — it never makes the read reject or run slower.
+            void collaboration?.enterScope?.({ [schemaKey]: params.id });
+            const rows = await load({
+                ...params,
+                where: [['id', params.id]],
+                limit: 1,
+            });
+            return rows[0];
+        }),
+        // No automatic scope enrolment on bulk `list`: that would subscribe to an
+        // unbounded set of rows' entity groups.
+        list: guard(load),
         create: guard(async (params) => {
             const id = params.id ?? Model.generateId();
             const opts = mutationOptions(params);
@@ -547,12 +576,9 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                     target: {
                         model: wireModel,
                         id,
-                        ...(claim.field ? { field: claim.field } : {}),
-                        ...(claim.path ? { path: claim.path } : {}),
-                        ...(claim.range ? { range: claim.range } : {}),
-                        ...(claimMeta(claim) ? { meta: claimMeta(claim) } : {}),
+                        ...subTarget(claim),
                     },
-                    description: claim.description ?? 'creating',
+                    description: claimDescription(claim, 'creating'),
                     ttl: claim.ttl,
                     queue: claim.queue !== false,
                     maxQueueDepth: claim.maxQueueDepth,
@@ -615,7 +641,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                             // `type: 'complete'` forces the round-trip — the hydration ledger
                             // would otherwise serve a possibly-stale local row for a hydrated id.
                             await load({ where: [['id', id]], type: 'complete' });
-                            const fresh = objectPool.get(id);
+                            const fresh = ownRowOrThrow(id);
                             const snapshot = collaboration.createSnapshot(schemaKey, id);
                             return {
                                 data: fresh ? modelAsRow(fresh) : undefined,
@@ -623,7 +649,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                             };
                         },
                         writeNext: async (patch, readAt) => {
-                            const model = objectPool.get(id);
+                            const model = ownRowOrThrow(id);
                             if (!model) {
                                 throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
                             }
@@ -651,7 +677,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                     }
                 }
                 const { id } = params;
-                const model = objectPool.get(id);
+                const model = ownRowOrThrow(id);
                 if (!model)
                     throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
                 // If we hold a claim on this row, guard the write with its snapshot
@@ -711,7 +737,10 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
                 return;
             }
             const { id } = params;
-            const model = objectPool.get(id);
+            // Scoped: "ensure absent" stays idempotent for an id this model simply
+            // doesn't hold, but an id owned by a sibling model throws rather than
+            // deleting a row the caller never addressed.
+            const model = ownRowOrThrow(id);
             // Idempotent delete: "ensure absent". A row that isn't in this client's
             // replicated view is already gone from its perspective, so a delete is a
             // no-op success rather than an `entity_not_found` error. This matches the
@@ -758,13 +787,13 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
             };
             // A track carries no write, so it rides the commit lane as a zero-operation
             // commit: the queue tolerates disconnects and de-dupes replays, and the
-            // server's track-only path registers the dependency and reports anything
+            // server's track-only path registers the premise and reports anything
             // that already fired. Reuse the same lane the batch `commits.create` door
             // uses rather than opening a bespoke transport.
             const clientTxId = typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
                 ? crypto.randomUUID()
                 : `tx_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-            const queue = syncClient.getTransactionQueue();
+            const queue = syncClient.getMutationQueue();
             await queue.enqueueCommit(clientTxId, [], { track: [dep] });
             const { notifications } = await queue.waitForCommitReceipt(clientTxId);
             return notifications && notifications.length > 0 ? { notifications } : {};
@@ -777,8 +806,7 @@ export function createModelProxy(schemaKey, registeredModelName, objectPool, syn
         }),
         onChange(callback, options) {
             return autorun(() => {
-                const entities = this.getAll(options);
-                callback(entities);
+                callback(local.list(options));
             });
         },
     };

package/dist/client/humans.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `humans()` — the reactive materialiser, declared as a capability (ADR 0016).
+ *
+ * The bare client is the coordination layer: commit, read, observe, claim.
+ * Add `humans()` when people are watching — it declares the local, watchable
+ * copy: the offline store, live queries, presence, and the framework
+ * bindings. There is no `agents()` counterpart, and the absence is the
+ * message: agents are the default caller, not a special one.
+ *
+ * Transitional shape: the contract fields do real configuration work
+ * (`requires.duplex` rejects it on a request-response client at construction
+ * time; `materialises` is the five-second membership test as a checkable
+ * property), and `init` constructs what the widened context already carries
+ * enough to build — the presence stream, attached to the connection the
+ * context carries (the host built it before resolving the plugin list). The
+ * rest of the materialiser (store, bootstrap, delta pipeline, framework
+ * bindings) still lives in the composition root and migrates here as the
+ * context grows to carry what it needs.
+ */
+import type { PluginContext } from '../transaction/plugin.js';
+import { type AttachablePresenceStream } from '../sync/createPresenceStream.js';
+/**
+ * What `humans()` contributes to the client — exactly the members that merge
+ * onto it, nothing else. Whether a plugin materialises is declared on the
+ * plugin itself, never restated on its surface.
+ */
+export interface HumansSurface {
+    /**
+     * Who is here and what they are doing. Attached to the connection at
+     * construction; calls before the socket opens mutate local state and skip
+     * the wire send, and the stream re-announces on every connect.
+     */
+    readonly presence: AttachablePresenceStream;
+}
+/**
+ * The reactive materialiser. Installed by default when `Ablo({ ... })` is
+ * constructed over the socket with no `plugins` list; listed explicitly, it
+ * reads as what it is — this client renders for people.
+ */
+export declare function humans(): {
+    readonly id: "humans";
+    readonly requires: {
+        readonly duplex: true;
+    };
+    readonly materialises: true;
+    readonly stage: "apply";
+    readonly init: (context: PluginContext) => HumansSurface;
+};

package/dist/client/humans.js

@@ -0,0 +1,52 @@
+/**
+ * `humans()` — the reactive materialiser, declared as a capability (ADR 0016).
+ *
+ * The bare client is the coordination layer: commit, read, observe, claim.
+ * Add `humans()` when people are watching — it declares the local, watchable
+ * copy: the offline store, live queries, presence, and the framework
+ * bindings. There is no `agents()` counterpart, and the absence is the
+ * message: agents are the default caller, not a special one.
+ *
+ * Transitional shape: the contract fields do real configuration work
+ * (`requires.duplex` rejects it on a request-response client at construction
+ * time; `materialises` is the five-second membership test as a checkable
+ * property), and `init` constructs what the widened context already carries
+ * enough to build — the presence stream, attached to the connection the
+ * context carries (the host built it before resolving the plugin list). The
+ * rest of the materialiser (store, bootstrap, delta pipeline, framework
+ * bindings) still lives in the composition root and migrates here as the
+ * context grows to carry what it needs.
+ */
+import { createPresenceStream, } from '../sync/createPresenceStream.js';
+/**
+ * The reactive materialiser. Installed by default when `Ablo({ ... })` is
+ * constructed over the socket with no `plugins` list; listed explicitly, it
+ * reads as what it is — this client renders for people.
+ */
+export function humans() {
+    return {
+        id: 'humans',
+        // Live queries, presence, and claim push are server-initiated frames, so
+        // a request-response client rejects this plugin while it is being
+        // configured — a typed error, not a subscription that never delivers.
+        requires: { duplex: true },
+        // The point of the plugin: it keeps a local copy of rows. A stateless
+        // caller can assert its own list is uniformly false.
+        materialises: true,
+        // Deltas land in the materialised in-memory graph at `apply`.
+        stage: 'apply',
+        init: (context) => ({
+            presence: createPresenceStream({
+                participantId: context.participant?.id ?? '',
+                syncGroups: [...(context.syncGroups ?? [])],
+                // Peers' kinds are server-stamped; only the local `self` entry is ours.
+                isAgent: context.participant?.kind === 'agent',
+            }, 
+            // The host built the connection before resolving the plugin list, so
+            // the stream attaches now and starts the moment the feed opens.
+            context.transport ?? null),
+        }),
+        // `satisfies` rather than a return annotation, so `id` keeps its literal
+        // type and a plugin list's surface can be keyed by id at the type level.
+    };
+}

package/dist/client/modelRegistration.d.ts

@@ -5,6 +5,6 @@
  * and opt-in field-level reactivity) and registers the model's properties,
  * relations, and any local-database indexes.
  */
-import type { Schema } from '../schema/schema.js';
+import type { Schema } from '../transaction/schema/schema.js';
 import type { ModelRegistry } from '../ModelRegistry.js';
 export declare function registerModelsFromSchema(schema: Schema, registry: ModelRegistry): void;

package/dist/client/modelRegistration.js

@@ -6,9 +6,9 @@
  * relations, and any local-database indexes.
  */
 import { z } from 'zod';
-import { baseFieldsSchema } from '../schema/schema.js';
+import { baseFieldsSchema } from '../transaction/schema/schema.js';
 import { Model } from '../Model.js';
-import { LoadStrategy, PropertyType } from '../types/index.js';
+import { PropertyType } from '../transaction/types/index.js';
 // ── Auto model registration from schema ───────────────────────────────────
 export function registerModelsFromSchema(schema, registry) {
     registry.startBatch();
@@ -50,10 +50,10 @@ export function registerModelsFromSchema(schema, registry) {
         ];
         const computed = modelDef.computed;
         const DynamicModel = createDynamicModelClass(modelName, jsonSubFields, fieldNames, computed, isLazy);
-        // Respect the schema's load strategy so lazy models skip IDB hydration + bootstrap
-        const loadStrategy = modelDef.load === 'lazy' || modelDef.load === 'manual'
-            ? LoadStrategy.lazy
-            : LoadStrategy.instant;
+        // The schema's strategy carries straight through — authoring and runtime
+        // name the same set, so there is nothing here to translate and nothing to
+        // fall out of step. Lazy models skip IDB hydration and bootstrap.
+        const loadStrategy = modelDef.load;
         registry.registerModel(modelName, DynamicModel, {
             loadStrategy,
             fields: modelDef.fields,
@@ -70,14 +70,14 @@ export function registerModelsFromSchema(schema, registry) {
         // id, and indexing every scalar is worse still.
         const indexedFields = new Set();
         for (const relDef of Object.values(modelDef.relations)) {
-            if (relDef.type === 'belongsTo' && relDef.foreignKey && relDef.options?.index === true) {
+            if (relDef.type === 'belongsTo' && relDef.foreignKey && relDef.options.index === true) {
                 indexedFields.add(relDef.foreignKey);
             }
         }
         // Register fields as properties (from Zod shape).
         for (const [fieldName, rawZodType] of Object.entries(modelDef.shape)) {
             const zodType = rawZodType;
-            const isOptional = zodType.isOptional?.() ?? false;
+            const isOptional = zodType.isOptional();
             // A field is indexed if it is the foreign key of a
             // `belongsTo({ index: true })` relation. A `description === 'indexed'` tag
             // also works, for consumers using the `field.*().indexed()` builder.
@@ -87,7 +87,7 @@ export function registerModelsFromSchema(schema, registry) {
             // would walk every nested property and create an atom per leaf, producing a
             // storm of updates on each commit or streaming change. Reference tracking
             // watches only reassignment, which is how blob consumers actually use them.
-            const wireType = modelDef.fields?.[fieldName]?.type;
+            const wireType = modelDef.fields[fieldName]?.type;
             const observability = wireType === 'json' ? 'ref' : undefined;
             registry.registerProperty(modelName, fieldName, {
                 type: PropertyType.property,