@abloatai/ablo 0.10.1 → 0.11.1

package/dist/cli.cjs

@@ -212180,11 +212180,11 @@ var require_commonjs2 = __commonJS({
               if (pad) {
                 const need = width - c.length;
                 if (need > 0) {
-                  const z4 = new Array(need + 1).join("0");
+                  const z6 = new Array(need + 1).join("0");
                   if (i < 0) {
-                    c = "-" + z4 + c.slice(1);
+                    c = "-" + z6 + c.slice(1);
                   } else {
-                    c = z4 + c;
+                    c = z6 + c;
                   }
                 }
               }
@@ -276682,8 +276682,8 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
       if (i) process.stdout.write(`${I2}  ${l2}...`);
       else if (t === "timer") process.stdout.write(`${I2}  ${l2} ${O2(g2)}`);
       else {
-        const z4 = ".".repeat(Math.floor(w2)).slice(0, 3);
-        process.stdout.write(`${I2}  ${l2}${z4}`);
+        const z6 = ".".repeat(Math.floor(w2)).slice(0, 3);
+        process.stdout.write(`${I2}  ${l2}${z6}`);
       }
       h2 = h2 + 1 < n.length ? h2 + 1 : 0, w2 = w2 < n.length ? w2 + 0.125 : 0;
     }, r2);
@@ -276710,7 +276710,7 @@ init_cjs_shims();
 
 // src/errors.ts
 init_cjs_shims();
-var import_zod2 = require("zod");
+var import_zod4 = require("zod");
 
 // src/errorCodes.ts
 init_cjs_shims();
@@ -276786,7 +276786,7 @@ var ERROR_CODES = {
   byo_role_unreadable: wire("permission", 403, false, "The direct Postgres connector role could not be introspected."),
   byo_tenant_tables_unforced_rls: wire("permission", 403, false, "Tenant tables do not have RLS forced under the direct Postgres connector role."),
   byo_host_not_allowed: wire("permission", 403, false, "The direct Postgres connector host resolves to a private, loopback, or link-local address and cannot be used."),
-  // ── claim / intent conflict (409) ──────────────────────────────────
+  // ── claim / claim conflict (409) ──────────────────────────────────
   // Held-claim rejections are NOT queue-retryable (gRPC FAILED_PRECONDITION /
   // ABORTED semantics; Replicache/Zero SETTLE a rejected mutation — reject the
   // caller, roll back the optimistic effect — instead of resending it).
@@ -276799,17 +276799,17 @@ var ERROR_CODES = {
   claim_conflict: wire("claim", 409, false, "The target entity is claimed by another participant."),
   claim_lost: wire("claim", 409, false, "A previously held claim was lost before the write applied."),
   entity_claimed: wire("claim", 409, false, "The target entity is currently claimed; write was blocked."),
-  intent_conflict: wire("claim", 409, false, "An intent on the target conflicts with an active intent (server-internal alias of claim_conflict)."),
   malformed_claim: wire("claim", 400, false, "The claim payload was malformed."),
+  malformed_subscription: wire("validation", 400, false, "The update_subscription payload was malformed; expected { syncGroups: string[] }."),
   model_claimed: wire("claim", 409, false, "The model instance is claimed by another participant."),
   model_claimed_timeout: wire("claim", 409, false, "Timed out waiting for a model claim to clear."),
-  model_claim_not_configured: client("claim", "Claiming was requested on a model that has no claim configuration."),
+  model_claim_not_configured: client("claim", "Claiming requires the collaboration runtime, which the standard Ablo({ schema, apiKey }) client wires up for every model automatically \u2014 there is no per-model claim configuration to add. This appears only when a model proxy is constructed directly without that runtime (an internal/advanced path)."),
   // ── stale context / idempotency (409) ──────────────────────────────
   stale_context: wire("conflict", 409, true, "The write carried a readAt watermark that is now stale; re-read and retry."),
   idempotency_conflict: wire("conflict", 409, false, "The same Idempotency-Key was reused with a different request body."),
   idempotency_key_too_long: wire("validation", 400, false, "The supplied Idempotency-Key exceeds the maximum length."),
   // ── validation (400 / 422) ─────────────────────────────────────────
-  write_options_invalid: client("validation", "The write options (`idempotencyKey` / `label` / `wait` / `readAt` / `onStale` / `intent`) failed validation against the write-options schema."),
+  write_options_invalid: client("validation", "The write options (`idempotencyKey` / `label` / `wait` / `readAt` / `onStale` / `claim`) failed validation against the write-options schema."),
   source_operation_id_required: client("validation", "A data-source operation arrived without the entity `id` it targets."),
   source_adapter_misconfigured: client("validation", "The data-source ORM adapter could not map a schema model onto the backing client (missing delegate or model)."),
   source_event_invalid: client("validation", "A data-source outbox event could not be built \u2014 the operation carries no entity id and none was supplied."),
@@ -276867,15 +276867,15 @@ var ERROR_CODES = {
   required_field_added: client("schema", "Migration adds a new required field."),
   enum_value_removed: client("schema", "Migration removes an enum value (destructive classification)."),
   risky_cast: client("schema", "Migration would perform a risky column type cast."),
-  // ── intent / lease (409 / transport) ───────────────────────────────
-  intent_lease_unavailable: wire("intent", 503, true, "The intent-lease coordination subsystem is unavailable; retry."),
-  intent_not_wired: client("intent", "Intent support was used but is not wired in this runtime."),
-  intent_queued: wire("intent", 409, true, "The intent was queued behind an active lease holder."),
-  intent_wait_aborted: wire("intent", 409, true, "Waiting for the intent lease was aborted."),
-  intent_wait_poll_interval_required: client("intent", "A poll interval is required when waiting on an intent."),
-  grant_timeout: wire("intent", 504, true, "Timed out waiting for a capability grant."),
-  slide_intent_missing_deck_id: wire("intent", 400, false, "A slide intent was missing its deck id."),
-  slide_intent_unknown_sibling: wire("intent", 400, false, "A slide intent referenced an unknown sibling slide."),
+  // ── claim / lease (409 / transport) ───────────────────────────────
+  claim_lease_unavailable: wire("claim", 503, true, "The claim-lease coordination subsystem is unavailable; retry."),
+  claim_not_wired: client("claim", "Claim support was used but is not wired in this runtime."),
+  claim_queued: wire("claim", 409, true, "The claim was queued behind an active lease holder."),
+  claim_wait_aborted: wire("claim", 409, true, "Waiting for the claim lease was aborted."),
+  claim_wait_poll_interval_required: client("claim", "A poll interval is required when waiting on an claim."),
+  grant_timeout: wire("claim", 504, true, "Timed out waiting for a capability grant."),
+  slide_intent_missing_deck_id: wire("claim", 400, false, "A slide claim was missing its deck id."),
+  slide_intent_unknown_sibling: wire("claim", 400, false, "A slide claim referenced an unknown sibling slide."),
   // ── bootstrap (transport) ──────────────────────────────────────────
   bootstrap_fetch_timeout: wire("bootstrap", 504, true, "The bootstrap fetch timed out."),
   bootstrap_offline: wire("bootstrap", 503, true, "Bootstrap could not run because the client is offline."),
@@ -276978,7 +276978,7 @@ var ERROR_CODES = {
   upload_items_required: wire("validation", 400, false, "The request must include a non-empty items array."),
   presigned_url_failed: wire("server", 500, true, "Failed to generate a presigned upload URL."),
   task_id_required: wire("validation", 400, false, "A task id is required for this request."),
-  intent_id_required: wire("validation", 400, false, "An intent id is required for this request."),
+  claim_id_required: wire("validation", 400, false, "An claim id is required for this request."),
   commit_operation_action_required: wire("validation", 400, false, "A commit operation is missing its `action`."),
   commit_operation_unsupported: wire("validation", 400, false, "A commit operation used an unsupported `action`."),
   usage_invalid: wire("validation", 400, false, "The usage request was invalid."),
@@ -276993,12 +276993,210 @@ var ERROR_CODES = {
   parent_turn_foreign_agent: wire("permission", 403, false, "The parent turn belongs to a different agent."),
   turn_not_found: wire("not_found", 404, false, "The referenced turn does not exist."),
   turn_foreign_agent: wire("permission", 403, false, "The turn belongs to a different agent."),
-  invalid_intent: wire("validation", 400, false, "The intent request was invalid."),
+  invalid_intent: wire("validation", 400, false, "The claim request was invalid."),
   schema_too_large: wire("validation", 413, false, "The submitted schema exceeds the maximum size."),
   invalid_schema: wire("validation", 400, false, "The submitted schema could not be parsed."),
   incompatible_change: wire("conflict", 409, false, "The schema change is incompatible with the current schema.")
 };
 
+// src/coordination/schema.ts
+init_cjs_shims();
+var import_zod3 = require("zod");
+
+// src/schema/roles.ts
+init_cjs_shims();
+var import_zod2 = require("zod");
+var syncGroupSchema = import_zod2.z.templateLiteral([import_zod2.z.string().regex(/^[a-z][a-z0-9_]*$/), ":", import_zod2.z.string().min(1)]).brand();
+var syncGroupInputSchema = import_zod2.z.union([import_zod2.z.literal("default"), syncGroupSchema]);
+var roleSourceSchema = import_zod2.z.object({
+  /** The context field to read, e.g. `'organizationId'`, `'id'`, `'deckId'`. */
+  field: import_zod2.z.string().regex(/^[a-zA-Z_][a-zA-Z0-9_]*$/, "source must be a valid identifier"),
+  /**
+   * When `true`, `field` holds an array; every non-empty string element yields
+   * one group. When `false` (default), `field` is a scalar; truthy → one group.
+   */
+  multi: import_zod2.z.boolean()
+});
+var roleSchema = import_zod2.z.object({
+  kind: import_zod2.z.string().regex(/^[a-z][a-z0-9_]*$/, 'kind must be a lowercase identifier, e.g. "deck"'),
+  source: roleSourceSchema
+});
+var scopeSchema = import_zod2.z.union([
+  import_zod2.z.boolean(),
+  import_zod2.z.string().regex(/^[a-z][a-z0-9_]*$/, 'scope kind must be a lowercase identifier, e.g. "dataroom"')
+]);
+var grantsRefSchema = import_zod2.z.object({
+  subject: import_zod2.z.string().regex(/^[a-zA-Z_][a-zA-Z0-9_]*$/, "grants.subject must name a relation"),
+  scope: import_zod2.z.string().regex(/^[a-zA-Z_][a-zA-Z0-9_]*$/, "grants.scope must name a relation")
+});
+
+// src/coordination/schema.ts
+var targetRangeSchema = import_zod3.z.object({
+  startLine: import_zod3.z.number(),
+  endLine: import_zod3.z.number(),
+  startColumn: import_zod3.z.number().optional(),
+  endColumn: import_zod3.z.number().optional()
+});
+var participantKindSchema = import_zod3.z.enum(["user", "agent", "system"]);
+var wireParticipantKindSchema = import_zod3.z.preprocess(
+  (value) => value === "human" ? "user" : value,
+  participantKindSchema
+);
+var targetRefSchema = import_zod3.z.object({
+  entityType: import_zod3.z.string(),
+  entityId: import_zod3.z.string(),
+  path: import_zod3.z.string().optional(),
+  range: targetRangeSchema.optional(),
+  field: import_zod3.z.string().optional(),
+  meta: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional()
+});
+var onStaleModeSchema = import_zod3.z.enum(["reject", "force", "flag", "merge"]);
+var writeGuardSchema = import_zod3.z.object({
+  readAt: import_zod3.z.number().nullish(),
+  onStale: onStaleModeSchema.nullish(),
+  bypass: import_zod3.z.boolean().optional()
+});
+var claimStatusSchema = import_zod3.z.enum([
+  "active",
+  "committed",
+  "expired",
+  "canceled"
+]);
+var wireClaimBaseSchema = targetRefSchema.extend({
+  claimId: import_zod3.z.string(),
+  /** Verb the agent expects: 'update' | 'create' | 'editing' | 'reviewing' … */
+  action: import_zod3.z.string(),
+  /** Server-stamped declaration time (epoch ms). */
+  declaredAt: import_zod3.z.number(),
+  /** Server-computed TTL deadline (epoch ms). Readers treat as advisory. */
+  expiresAt: import_zod3.z.number(),
+  status: claimStatusSchema.optional()
+});
+var wireClaimSummarySchema = wireClaimBaseSchema.pick({
+  claimId: true,
+  action: true,
+  declaredAt: true,
+  expiresAt: true,
+  entityType: true,
+  entityId: true,
+  field: true,
+  meta: true
+});
+var claimErrorSchema = import_zod3.z.object({
+  code: import_zod3.z.string(),
+  message: import_zod3.z.string().optional(),
+  /** Participant already holding the target (conflict rejections). */
+  heldBy: import_zod3.z.string().optional(),
+  heldByClaimId: import_zod3.z.string().optional(),
+  heldByExpiresAt: import_zod3.z.number().optional(),
+  /** Rich holder context for conflict rejections. Additive: older frames omit it. */
+  heldByClaim: wireClaimSummarySchema.optional(),
+  /** Optional conflict-policy explanation. Additive: older frames omit it. */
+  policyReason: import_zod3.z.string().optional()
+});
+var wireClaimSchema = wireClaimBaseSchema.extend({
+  error: claimErrorSchema.optional()
+});
+var claimRejectionSchema = import_zod3.z.object({
+  claimId: import_zod3.z.string(),
+  reason: import_zod3.z.string(),
+  target: targetRefSchema.optional(),
+  heldBy: import_zod3.z.string().optional(),
+  heldByClaimId: import_zod3.z.string().optional(),
+  heldByExpiresAt: import_zod3.z.number().optional(),
+  heldByClaim: wireClaimSummarySchema.optional(),
+  policyReason: import_zod3.z.string().optional()
+});
+var modelTargetSchema = import_zod3.z.object({
+  model: import_zod3.z.string(),
+  id: import_zod3.z.string(),
+  path: import_zod3.z.string().optional(),
+  range: targetRangeSchema.optional(),
+  field: import_zod3.z.string().optional(),
+  meta: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional()
+}).readonly();
+var modelClaimSchema = import_zod3.z.object({
+  id: import_zod3.z.string(),
+  actor: import_zod3.z.string(),
+  participantKind: wireParticipantKindSchema,
+  action: import_zod3.z.string(),
+  description: import_zod3.z.string().optional(),
+  field: import_zod3.z.string().optional(),
+  status: import_zod3.z.enum(["active", "queued"]).optional(),
+  position: import_zod3.z.number().optional(),
+  expiresAt: import_zod3.z.number(),
+  target: modelTargetSchema
+}).readonly();
+var claimBeginPayloadSchema = targetRefSchema.extend({
+  claimId: import_zod3.z.string(),
+  action: import_zod3.z.string(),
+  /** Hint for `expiresAt`; the server caps it. */
+  estimatedMs: import_zod3.z.number().optional(),
+  /**
+   * Opt into the fair wait queue: when the target is already held, the server
+   * enqueues this claim (FIFO) and replies `claim_queued` → later
+   * `claim_granted`, instead of `claim_rejected`. Clients that set this MUST
+   * handle the grant.
+   */
+  queue: import_zod3.z.boolean().optional()
+});
+var claimAbandonPayloadSchema = import_zod3.z.object({
+  claimId: import_zod3.z.string(),
+  entityType: import_zod3.z.string().optional(),
+  entityId: import_zod3.z.string().optional()
+});
+var claimReorderPayloadSchema = import_zod3.z.object({
+  entityType: import_zod3.z.string(),
+  entityId: import_zod3.z.string(),
+  order: import_zod3.z.array(import_zod3.z.object({ heldBy: import_zod3.z.string(), claimId: import_zod3.z.string() }))
+});
+var updateSubscriptionPayloadSchema = import_zod3.z.object({
+  syncGroups: import_zod3.z.array(syncGroupInputSchema)
+});
+var subscriptionAckPayloadSchema = import_zod3.z.object({
+  success: import_zod3.z.boolean(),
+  syncGroups: import_zod3.z.array(import_zod3.z.string()),
+  error: import_zod3.z.object({ code: import_zod3.z.string(), message: import_zod3.z.string() }).optional()
+});
+var commitOperationTypeSchema = import_zod3.z.enum([
+  "CREATE",
+  "UPDATE",
+  "DELETE",
+  "ARCHIVE",
+  "UNARCHIVE"
+]);
+var commitOperationSchema = writeGuardSchema.extend({
+  type: commitOperationTypeSchema,
+  model: import_zod3.z.string(),
+  id: import_zod3.z.string().nullish(),
+  input: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).nullish(),
+  /** Per-op client tx id, echoed on the broadcast delta. */
+  transactionId: import_zod3.z.string().nullish()
+});
+var presenceKindSchema = import_zod3.z.enum(["enter", "update", "leave"]);
+var presenceActivitySchema = targetRefSchema.extend({
+  action: import_zod3.z.string(),
+  detail: import_zod3.z.string().optional()
+});
+var presenceUpdateFrameSchema = import_zod3.z.object({
+  kind: presenceKindSchema,
+  userId: import_zod3.z.string().optional(),
+  syncGroups: import_zod3.z.array(import_zod3.z.string()).optional(),
+  timestamp: import_zod3.z.number().optional(),
+  status: import_zod3.z.string(),
+  timezone: import_zod3.z.string().optional(),
+  customStatus: import_zod3.z.string().optional(),
+  activity: presenceActivitySchema.optional(),
+  isAgent: import_zod3.z.boolean().optional(),
+  /**
+   * Server-stamped canonical kind. Additive — older servers omit it and
+   * readers fall back to `isAgent` (see {@link participantKindFromWire}).
+   */
+  participantKind: wireParticipantKindSchema.optional(),
+  activeClaims: import_zod3.z.array(wireClaimSchema).optional(),
+  delegatedFrom: import_zod3.z.string().nullish()
+});
+
 // src/errors.ts
 var AbloError = class extends Error {
   /** Discriminator string — matches the class name. Lets consumers
@@ -277068,35 +277266,43 @@ function docUrlForCode(code) {
 var AbloValidationError = class extends AbloError {
   type = "AbloValidationError";
 };
-var OptionalWireStringSchema = import_zod2.z.preprocess(
+var OptionalWireStringSchema = import_zod4.z.preprocess(
   (value) => typeof value === "string" ? value : void 0,
-  import_zod2.z.string().optional()
+  import_zod4.z.string().optional()
 );
-var RequiredCapabilityWireSchema = import_zod2.z.object({
-  scope: import_zod2.z.string(),
-  constraints: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.union([import_zod2.z.array(import_zod2.z.string()), import_zod2.z.string()])).optional(),
+var RequiredCapabilityWireSchema = import_zod4.z.object({
+  scope: import_zod4.z.string(),
+  constraints: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.union([import_zod4.z.array(import_zod4.z.string()), import_zod4.z.string()])).optional(),
   issuer: OptionalWireStringSchema,
-  ttlSeconds: import_zod2.z.preprocess((value) => typeof value === "number" ? value : void 0, import_zod2.z.number().optional()),
+  ttlSeconds: import_zod4.z.preprocess((value) => typeof value === "number" ? value : void 0, import_zod4.z.number().optional()),
   nonce: OptionalWireStringSchema
 }).passthrough();
-var NestedErrorShapeSchema = import_zod2.z.object({
+var NestedErrorShapeSchema = import_zod4.z.object({
   code: OptionalWireStringSchema,
   message: OptionalWireStringSchema,
   field: OptionalWireStringSchema,
-  requiredCapability: RequiredCapabilityWireSchema.optional().catch(void 0)
+  requiredCapability: RequiredCapabilityWireSchema.optional().catch(void 0),
+  heldBy: OptionalWireStringSchema,
+  policyReason: OptionalWireStringSchema,
+  heldByClaim: wireClaimSummarySchema.optional().catch(void 0),
+  claims: import_zod4.z.array(wireClaimSummarySchema).optional().catch(void 0)
 }).passthrough();
-var ErrorFieldSchema = import_zod2.z.preprocess(
+var ErrorFieldSchema = import_zod4.z.preprocess(
   (value) => typeof value === "string" || typeof value === "object" && value !== null ? value : void 0,
-  import_zod2.z.union([import_zod2.z.string(), NestedErrorShapeSchema]).optional()
+  import_zod4.z.union([import_zod4.z.string(), NestedErrorShapeSchema]).optional()
 ).catch(void 0);
-var ErrorBodyShapeSchema = import_zod2.z.object({
+var ErrorBodyShapeSchema = import_zod4.z.object({
   /** Legacy: `error` was a flat code string on older endpoints. Newer
    *  endpoints (CommitReceipt) carry `error` as a nested object. */
   error: ErrorFieldSchema,
   code: OptionalWireStringSchema,
   reason: OptionalWireStringSchema,
   message: OptionalWireStringSchema,
-  requiredCapability: RequiredCapabilityWireSchema.optional().catch(void 0)
+  requiredCapability: RequiredCapabilityWireSchema.optional().catch(void 0),
+  heldBy: OptionalWireStringSchema,
+  policyReason: OptionalWireStringSchema,
+  heldByClaim: wireClaimSummarySchema.optional().catch(void 0),
+  claims: import_zod4.z.array(wireClaimSummarySchema).optional().catch(void 0)
 }).passthrough();
 
 // src/cli/migrate.ts
@@ -279404,7 +279610,7 @@ function readProjectDatabaseUrl(cwd = process.cwd()) {
 }
 
 // src/cli/migrate.ts
-var import_schema2 = require("@abloatai/ablo/schema");
+var import_schema3 = require("@abloatai/ablo/schema");
 var import_source = require("@abloatai/ablo/source");
 
 // src/cli/push.ts
@@ -279412,7 +279618,7 @@ init_cjs_shims();
 var import_picocolors3 = __toESM(require_picocolors(), 1);
 var import_fs4 = require("fs");
 var import_path3 = require("path");
-var import_schema = require("@abloatai/ablo/schema");
+var import_schema2 = require("@abloatai/ablo/schema");
 
 // src/cli/config.ts
 init_cjs_shims();
@@ -279577,7 +279783,7 @@ function fmtSignal(s) {
   return `    \u2022 ${import_picocolors3.default.bold(where ?? "?")} \u2014 ${sig.detail ?? ""}`;
 }
 async function pushSchema(schema, args) {
-  const schemaJson = JSON.parse((0, import_schema.serializeSchema)(schema));
+  const schemaJson = JSON.parse((0, import_schema2.serializeSchema)(schema));
   const res = await fetch(`${args.url}/api/schema`, {
     method: "POST",
     headers: {
@@ -279690,7 +279896,7 @@ async function push(argv) {
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
-  const hash = (0, import_schema.schemaHash)(schema);
+  const hash = (0, import_schema2.schemaHash)(schema);
   console.log(
     `  Pushing ${import_picocolors3.default.bold(args.schemaPath)} ${import_picocolors3.default.dim(`(${Object.keys(schema.models).length} models, hash ${hash})`)} \u2192 ${import_picocolors3.default.dim(args.url)}`
   );
@@ -279736,6 +279942,14 @@ async function push(argv) {
 }
 
 // src/cli/migrate.ts
+var MIGRATE_USAGE = `  ablo migrate \u2014 provision your schema's tables in your own Postgres (DATABASE_URL)
+
+  Usage:
+    npx ablo migrate                      Create the synced-model tables (with row-level security)
+    npx ablo migrate --dry-run            Print the SQL without executing it
+    npx ablo migrate --output schema.sql  Write the SQL to a file instead of applying
+    npx ablo migrate --schema <path>      Use a schema file other than ablo/schema.ts
+    npx ablo migrate --export <name>      Use a named export other than \`schema\``;
 var DEFAULT_SCHEMA_PATH2 = "ablo/schema.ts";
 var DEFAULT_EXPORT2 = "schema";
 function parseMigrateArgs(argv) {
@@ -279769,8 +279983,8 @@ function parseMigrateArgs(argv) {
   return { schemaPath, exportName, targetSchema, dryRun, outputFile };
 }
 function planFor(schema, targetSchema = "public") {
-  const schemaJson = JSON.parse((0, import_schema2.serializeSchema)(schema));
-  const plan = (0, import_schema2.generateProvisionPlan)(schemaJson, targetSchema, {
+  const schemaJson = JSON.parse((0, import_schema3.serializeSchema)(schema));
+  const plan = (0, import_schema3.generateProvisionPlan)(schemaJson, targetSchema, {
     foreignKeys: targetSchema === "public"
   });
   const adapterTables = (0, import_source.adapterTableMigrations)().map((m2) => m2.up);
@@ -279895,7 +280109,7 @@ init_cjs_shims();
 var import_fs6 = require("fs");
 var import_path4 = require("path");
 var import_picocolors5 = __toESM(require_picocolors(), 1);
-var import_schema3 = require("@abloatai/ablo/schema");
+var import_schema4 = require("@abloatai/ablo/schema");
 var DEFAULT_SCHEMA_PATH3 = "ablo/schema.ts";
 var DEFAULT_EXPORT3 = "schema";
 var DEFAULT_OUT = "ablo/generated.ts";
@@ -279932,8 +280146,8 @@ async function generate(argv) {
   let source;
   try {
     const schema = await loadSchema(args.schemaPath, args.exportName);
-    const schemaJson = JSON.parse((0, import_schema3.serializeSchema)(schema));
-    source = (0, import_schema3.generateTypes)(schemaJson);
+    const schemaJson = JSON.parse((0, import_schema4.serializeSchema)(schema));
+    source = (0, import_schema4.generateTypes)(schemaJson);
   } catch (err) {
     console.error(import_picocolors5.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     process.exit(1);
@@ -279949,7 +280163,7 @@ init_cjs_shims();
 var import_picocolors6 = __toESM(require_picocolors(), 1);
 var import_fs7 = require("fs");
 var import_path5 = require("path");
-var import_schema4 = require("@abloatai/ablo/schema");
+var import_schema5 = require("@abloatai/ablo/schema");
 
 // src/cli/theme.ts
 init_cjs_shims();
@@ -280115,7 +280329,7 @@ async function dev(argv) {
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const modelCount = Object.keys(schema.models).length;
   console.log(
-    `  ${import_picocolors6.default.dim("schema")}  ${import_picocolors6.default.bold(args.schemaPath)} ${import_picocolors6.default.dim(`(${modelCount} models, hash ${(0, import_schema4.schemaHash)(schema)})`)}`
+    `  ${import_picocolors6.default.dim("schema")}  ${import_picocolors6.default.bold(args.schemaPath)} ${import_picocolors6.default.dim(`(${modelCount} models, hash ${(0, import_schema5.schemaHash)(schema)})`)}`
   );
   console.log(`  ${import_picocolors6.default.dim("key")}     ${args.apiKey.slice(0, 12)}\u2026`);
   console.log(`  ${import_picocolors6.default.dim("api")}     ${args.url}
@@ -280272,7 +280486,10 @@ ${import_picocolors7.default.dim(url)}`, "Approve in your browser");
   s.message("Provisioning a sandbox key\u2026");
   const provRes = await fetch(`${AUTH_URL}/api/cli/provision-key`, {
     method: "POST",
-    headers: { authorization: `Bearer ${accessToken}` }
+    headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
+    // Pass the device_code so the server can scope the minted keys to the
+    // project the user picked at /cli (login project picker). Harmless if none.
+    body: JSON.stringify({ device_code: code.device_code })
   }).catch(() => null);
   if (!provRes || !provRes.ok) {
     s.stop("Could not provision a key.");
@@ -280500,6 +280717,39 @@ async function projects(argv) {
     );
     return;
   }
+  if (sub === "rename") {
+    const ref = argv[1];
+    const name = argv.slice(2).join(" ").trim();
+    if (!ref || ref.startsWith("-") || !name) {
+      console.error(import_picocolors9.default.red("  usage: ablo projects rename <slug|id> <new name>"));
+      process.exit(1);
+    }
+    const all = await fetchProjects();
+    const target = all.find((p2) => p2.slug === ref || p2.id === ref);
+    if (!target) {
+      console.error(import_picocolors9.default.red(`  No project "${ref}".`) + import_picocolors9.default.dim(" Run ablo projects list."));
+      process.exit(1);
+    }
+    if (target.default) {
+      console.error(import_picocolors9.default.red("  The default project cannot be renamed."));
+      process.exit(1);
+    }
+    const { status: status2, body } = await request(`/api/v1/projects/${target.id}`, requireKey(), {
+      method: "PATCH",
+      body: { name }
+    });
+    if (status2 !== 200) {
+      console.error(
+        import_picocolors9.default.red(`  Rename failed (${status2}): ${String(body.message ?? body.code ?? "")}`)
+      );
+      process.exit(1);
+    }
+    const updated = body;
+    console.log(
+      `  ${import_picocolors9.default.green("\u2713")} Renamed ${import_picocolors9.default.bold(updated.slug)} \u2192 ${import_picocolors9.default.bold(updated.name ?? updated.slug)} ${import_picocolors9.default.dim(`(${updated.id})`)}`
+    );
+    return;
+  }
   if (sub === "use") {
     const ref = argv[1];
     if (!ref) {
@@ -280527,7 +280777,9 @@ async function projects(argv) {
     return;
   }
   console.error(
-    import_picocolors9.default.red(`  unknown subcommand: ${sub}`) + import_picocolors9.default.dim(` (expected ${import_picocolors9.default.bold("list")}, ${import_picocolors9.default.bold("create")}, or ${import_picocolors9.default.bold("use")})`)
+    import_picocolors9.default.red(`  unknown subcommand: ${sub}`) + import_picocolors9.default.dim(
+      ` (expected ${import_picocolors9.default.bold("list")}, ${import_picocolors9.default.bold("create")}, ${import_picocolors9.default.bold("rename")}, or ${import_picocolors9.default.bold("use")})`
+    )
   );
   process.exit(1);
 }
@@ -280937,7 +281189,7 @@ async function webhooks(argv) {
 // src/cli/check.ts
 init_cjs_shims();
 var import_picocolors13 = __toESM(require_picocolors(), 1);
-var import_schema5 = require("@abloatai/ablo/schema");
+var import_schema6 = require("@abloatai/ablo/schema");
 var DEFAULT_SCHEMA_PATH4 = "ablo/schema.ts";
 var DEFAULT_EXPORT4 = "schema";
 var BASE_COLUMNS = /* @__PURE__ */ new Set(["id", "organization_id", "created_by", "created_at", "updated_at"]);
@@ -280982,7 +281234,7 @@ async function check(argv) {
     process.exit(1);
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
-  const schemaJson = JSON.parse((0, import_schema5.serializeSchema)(schema));
+  const schemaJson = JSON.parse((0, import_schema6.serializeSchema)(schema));
   const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
   } });
   let rows;
@@ -281024,7 +281276,7 @@ async function check(argv) {
     const problems = [];
     const warns = [];
     if (!present.has("id")) problems.push('missing primary key "id"');
-    const orgCol = (0, import_schema5.tenancyColumn)((0, import_schema5.resolveTenancy)(model));
+    const orgCol = (0, import_schema6.tenancyColumn)((0, import_schema6.resolveTenancy)(model));
     if (orgCol && !present.has(orgCol)) {
       problems.push(
         `missing "${orgCol}" \u2014 Ablo isolates tenants (RLS) and routes realtime by it, so a table without it has no safe boundary. Add the column, or use a Data Source endpoint.`
@@ -281202,8 +281454,8 @@ async function upgrade(argv) {
       if (t === "drizzleDataSource" && call.getArguments().length === 2 && !import_ts_morph.Node.isIdentifier(call.getArguments()[1])) {
         flag2(call, "drizzleDataSource(db, tables)", "now `drizzleDataSource(db, schema)` \u2014 pass your Ablo schema, drop the tables map.");
       }
-      if (/\.intents\b/.test(t) && /^(ablo|sync)\b/.test(t)) {
-        flag2(call, "ablo.intents.*", "use `ablo.<model>.claim` (claim.state / claim.queue / `await using claim = await \u2026claim({ id })`).");
+      if (/\.claims\b/.test(t) && /^(ablo|sync)\b/.test(t)) {
+        flag2(call, "ablo.claims.*", "use `ablo.<model>.claim` (claim.state / claim.queue / `await using claim = await \u2026claim({ id })`).");
       }
     }
     for (const jsx of sf.getDescendantsOfKind(import_ts_morph.SyntaxKind.JsxOpeningElement)) {
@@ -281924,8 +282176,18 @@ async function drizzlePull(argv) {
 var LOGO = `
   ${brand("ablo")} ${import_picocolors18.default.dim("sync engine")}
 `;
+var SUBCOMMAND_USAGE = {
+  migrate: MIGRATE_USAGE
+};
 async function main() {
-  const command = process.argv[2];
+  let command = process.argv[2];
+  if (command && process.argv.slice(3).some((a) => a === "--help" || a === "-h")) {
+    if (SUBCOMMAND_USAGE[command]) {
+      console.log(SUBCOMMAND_USAGE[command]);
+      return;
+    }
+    command = void 0;
+  }
   if (command === "init") {
     await init(process.argv.slice(3));
   } else if (command === "login") {
@@ -281943,8 +282205,14 @@ async function main() {
   } else if (command === "webhooks") {
     await webhooks(process.argv.slice(3));
   } else if (command === "dev") {
-    console.log(import_picocolors18.default.dim("  `ablo dev` is now `ablo push --watch` \u2014 running that."));
-    await dev([...process.argv.slice(3), "--watch"]);
+    const devArgs = process.argv.slice(3);
+    const oneShot = devArgs.includes("--no-watch");
+    console.log(
+      import_picocolors18.default.dim(
+        oneShot ? "  `ablo dev --no-watch` is `ablo push` (push once, no watcher) \u2014 running that." : "  `ablo dev` is now `ablo push --watch` \u2014 running that."
+      )
+    );
+    await dev(oneShot ? devArgs : [...devArgs, "--watch"]);
   } else if (command === "check") {
     await check(process.argv.slice(3));
   } else if (command === "pull") {
@@ -282002,6 +282270,8 @@ async function main() {
     console.log(`    npx ablo pull prisma [path]            Generate schema.ts from a Prisma schema (keeps enums + relations)`);
     console.log(`    npx ablo pull drizzle <module>         Generate schema.ts from a Drizzle schema (keeps enums + relations)`);
     console.log(`    npx ablo check                         Check your existing database fits the schema (read-only, creates no tables)`);
+    console.log(`    npx ablo migrate                       Provision your synced-model tables in your own Postgres (DATABASE_URL)`);
+    console.log(`    npx ablo migrate --dry-run             Print the SQL without executing (preview)`);
     console.log(`    npx ablo push                          Upload your schema definition to Ablo (metadata only \u2014 rows stay in your DB)`);
     console.log(`    npx ablo push --force                  Allow destructive/unexecutable changes`);
     console.log(`    npx ablo push --rename a:b             Treat model "a" as renamed to "b"`);
@@ -282079,6 +282349,10 @@ function detectOrm(override) {
   }
   return "none";
 }
+function detectNextLayout() {
+  const useSrc = (0, import_fs12.existsSync)((0, import_path7.join)("src", "app")) || !(0, import_fs12.existsSync)("app") && (0, import_fs12.existsSync)("src");
+  return useSrc ? { appBase: (0, import_path7.join)("src", "app"), aliasBase: "src" } : { appBase: "app", aliasBase: "." };
+}
 async function chooseOption(name, flagValue, fallback, allowed, interactive, prompt) {
   if (flagValue !== void 0) {
     if (!allowed.includes(flagValue)) {
@@ -282178,7 +282452,8 @@ async function init(args = []) {
       "Non-interactive (no TTY / --yes)"
     );
   }
-  const abloDir = "ablo";
+  const layout = framework === "nextjs" ? detectNextLayout() : { appBase: "app", aliasBase: "." };
+  const abloDir = (0, import_path7.join)(layout.aliasBase, "ablo");
   (0, import_fs12.mkdirSync)(abloDir, { recursive: true });
   const created = [];
   let schemaSource = generateSchema();
@@ -282209,41 +282484,51 @@ async function init(args = []) {
   created.push(`${abloDir}/schema.ts${schemaNote}`);
   (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "index.ts"), generateSyncConfig(auth, storage));
   created.push(`${abloDir}/index.ts`);
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "register.ts"), generateRegister());
+  created.push(`${abloDir}/register.ts`);
   const orm = detectOrm(opts.orm);
   if (storage === "endpoint") {
     (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "data-source.ts"), generateDataSource(orm));
     created.push(`${abloDir}/data-source.ts${orm === "drizzle" ? " (Drizzle)" : " (Prisma)"}`);
   }
   const envFile = framework === "nextjs" ? ".env.local" : ".env";
+  const resolvedKey = process.env.ABLO_API_KEY ? void 0 : resolveApiKey("sandbox");
+  const wireRealKey = envFile === ".env.local" && Boolean(resolvedKey);
+  const envBody = generateEnv(storage, { includeApiKey: !wireRealKey });
   if (!(0, import_fs12.existsSync)(envFile)) {
-    (0, import_fs12.writeFileSync)(envFile, generateEnv(storage));
+    (0, import_fs12.writeFileSync)(envFile, envBody);
     created.push(envFile);
   } else {
     const existing = (0, import_fs12.readFileSync)(envFile, "utf-8");
     if (!existing.includes("ABLO_")) {
-      (0, import_fs12.writeFileSync)(envFile, existing + "\n" + generateEnv(storage));
+      (0, import_fs12.writeFileSync)(envFile, existing + "\n" + envBody);
       created.push(`${envFile} ${import_picocolors18.default.dim("(appended)")}`);
     } else {
       created.push(`${envFile} ${import_picocolors18.default.dim("(already configured)")}`);
     }
   }
+  if (wireRealKey && resolvedKey) {
+    wireEnvLocal(resolvedKey);
+    created.push(`.env.local ${import_picocolors18.default.dim("(ABLO_API_KEY set from your login)")}`);
+  }
   if (agent) {
     (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "agent.ts"), generateAgent());
     created.push(`${abloDir}/agent.ts`);
   }
   if (framework === "nextjs") {
     if (storage === "endpoint") {
-      const webhookDir = (0, import_path7.join)("app", "api", "ablo", "webhooks");
+      const webhookDir = (0, import_path7.join)(layout.appBase, "api", "ablo", "webhooks");
       (0, import_fs12.mkdirSync)(webhookDir, { recursive: true });
       (0, import_fs12.writeFileSync)((0, import_path7.join)(webhookDir, "route.ts"), generateWebhookRoute(orm));
       created.push(`${webhookDir}/route.ts${orm === "prisma" ? " (Prisma mirror)" : " (add your database write)"}`);
     }
-    (0, import_fs12.writeFileSync)((0, import_path7.join)("app", "providers.tsx"), generateProviders());
-    created.push(`app/providers.tsx ${import_picocolors18.default.dim("(wrap app/layout.tsx in <Providers>)")}`);
-    const sessionDir = (0, import_path7.join)("app", "api", "ablo-session");
+    const providersPath = (0, import_path7.join)(layout.appBase, "providers.tsx");
+    (0, import_fs12.writeFileSync)(providersPath, generateProviders());
+    created.push(`${providersPath} ${import_picocolors18.default.dim(`(wrap ${(0, import_path7.join)(layout.appBase, "layout.tsx")} in <Providers>)`)}`);
+    const sessionDir = (0, import_path7.join)(layout.appBase, "api", "ablo-session");
     (0, import_fs12.mkdirSync)(sessionDir, { recursive: true });
     (0, import_fs12.writeFileSync)((0, import_path7.join)(sessionDir, "route.ts"), generateSessionRoute());
-    created.push(`app/api/ablo-session/route.ts ${import_picocolors18.default.dim("(wire your auth)")}`);
+    created.push(`${(0, import_path7.join)(sessionDir, "route.ts")} ${import_picocolors18.default.dim("(wire your auth)")}`);
   }
   if (framework !== "vanilla") {
     (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "TaskList.tsx"), generateComponent());
@@ -282272,7 +282557,7 @@ async function init(args = []) {
       `Provision your DB: ${import_picocolors18.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors18.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors18.default.bold("/api/ablo/source")}`
     ],
     ...framework === "nextjs" ? [
-      `Wrap ${import_picocolors18.default.bold("app/layout.tsx")} in ${import_picocolors18.default.bold("<Providers>")} (app/providers.tsx) and add your auth to ${import_picocolors18.default.bold("app/api/ablo-session/route.ts")}`
+      `Wrap ${import_picocolors18.default.bold((0, import_path7.join)(layout.appBase, "layout.tsx"))} in ${import_picocolors18.default.bold("<Providers>")} (${(0, import_path7.join)(layout.appBase, "providers.tsx")}) and add your auth to ${import_picocolors18.default.bold((0, import_path7.join)(layout.appBase, "api", "ablo-session", "route.ts"))}`
     ] : [],
     `Run ${import_picocolors18.default.bold(`${pm} run dev`)} and open two browser tabs \u2014 changes sync in real-time`,
     ...agent ? [
@@ -282351,14 +282636,31 @@ export const sync = Ablo({
   apiKey: process.env.ABLO_API_KEY,${databaseLine}${authLine}
   schema,
 });
+
+// Name the client's type off the constructed value \u2014 the overload resolves at
+// this call site, so this carries the full typed surface. (Like tRPC's
+// \`typeof appRouter\`, Drizzle's \`typeof db\`.) Prefer this over \`ReturnType<typeof Ablo>\`.
+export type Sync = typeof sync;
+`;
+}
+function generateRegister() {
+  return `import type { schema } from './schema';
+
+declare module '@abloatai/ablo' {
+  interface Register {
+    Schema: typeof schema;
+  }
+}
+
+export {};
 `;
 }
-function generateEnv(storage) {
+function generateEnv(storage, opts = {}) {
+  const { includeApiKey = true } = opts;
   const databaseBlock = storage === "direct" ? "# Your Postgres \u2014 the system of record. The client registers this connection\n# (sent once over TLS, stored sealed) and every row lives HERE, never with Ablo.\n# Use a dedicated non-superuser role; the browser never sees this value.\nDATABASE_URL=postgres://user:password@host:5432/db\n" : "# Used by ablo/data-source.ts (your DB endpoint) + `ablo migrate` \u2014 NOT the client.\n# Ablo never sees it; the browser never sees it. Your DB stays in your app.\nDATABASE_URL=postgres://user:password@host:5432/db\n";
   const webhookBlock = storage === "endpoint" ? "# Signing secret for the webhook receiver (app/api/ablo/webhooks/route.ts).\n# Ablo mints this when you register the endpoint's URL (POST /v1/webhook_endpoints\n# or the dashboard) and returns it once \u2014 paste it here.\nABLO_WEBHOOK_SECRET=whsec_your_endpoint_secret_here\n" : "";
-  return `# Ablo Sync Engine \u2014 use a sk_test_ key for local dev (\`npx ablo dev\`)
-ABLO_API_KEY=sk_test_your_key_here
-${webhookBlock}${databaseBlock}`;
+  const apiKeyBlock = includeApiKey ? "# Ablo Sync Engine \u2014 use a sk_test_ key for local dev (`npx ablo push`)\nABLO_API_KEY=sk_test_your_key_here\n" : "";
+  return `${apiKeyBlock}${webhookBlock}${databaseBlock}`;
 }
 function generateDataSource(orm) {
   return orm === "drizzle" ? drizzleDataSourceScaffold() : prismaDataSourceScaffold();