@abloatai/ablo 0.16.1 → 0.16.2

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.16.2
+
+### Patch Changes
+
+- **`mintUserSessionKey`: name the shared-schema binding around the project.** The
+  two flat options added in 0.16.0 (`schemaOwnerOrgId` + `schemaProjectId`) are
+  replaced by one project-centric option — `schemaProject: { organizationId, projectId }` —
+  naming "the project that owns the schema" as a single concept. The wire format
+  is unchanged (the SDK still sends the same keys), so no server redeploy is
+  needed. Released as a patch: the replaced options shipped in 0.16.0 and have no
+  external consumers yet.
+
+  ```ts
+  // before
+  mintUserSessionKey({ organizationId, schemaOwnerOrgId, schemaProjectId, ... });
+  // after
+  mintUserSessionKey({
+    organizationId,                                  // data org
+    schemaProject: { organizationId, projectId },    // the project that owns the schema
+    ...
+  });
+  ```
+
 ## 0.16.1
 
 ### Patch Changes
@@ -10,7 +33,7 @@
   `ABLO_AUTH_URL`), while the human approval page (`/cli`), sign-up, and the
   key-handoff route (`/api/cli/provision-key`) go to the dashboard host
   (`www.abloatai.com`, new override `ABLO_DASHBOARD_URL`). Previously every step
-  ran against `www`, where the Better Auth device endpoints no longer resolve —
+  ran against `www`, where the device endpoints no longer resolve —
   producing "Couldn't start login… Is the dashboard reachable?". The CLI now also
   builds the approval URL itself rather than trusting the server's
   `verification_uri`, which (being a relative `/cli`) resolved against the auth

package/dist/auth/index.d.ts

@@ -38,13 +38,18 @@ export interface MintUserSessionRequest {
      *  `Stripe-Account` analogue. Requires the `sk_` to carry
      *  `ephemeral:mint-any-org`; omit to mint into the key's own org. */
     readonly organizationId?: string;
-    /** FIRST-PARTY SHARED SCHEMA: bind the minted `ek_` to a schema owner-org +
-     *  project so SCHEMA resolves org-independently (one schema for all the
-     *  integrator's end-user orgs), while DATA stays scoped to `organizationId`.
-     *  Requires the `sk_` to carry `ephemeral:mint-any-org`. Omit for the normal
-     *  per-org behaviour (every external BYO customer). */
-    readonly schemaProjectId?: string;
-    readonly schemaOwnerOrgId?: string;
+    /** SHARED SCHEMA — point this session's SCHEMA at the project that owns it,
+     *  while its DATA stays scoped to `organizationId`. Use this for org-per-customer
+     *  isolation: keep one schema project, and every customer's session resolves its
+     *  schema from it instead of re-pushing the schema into each customer's org.
+     *  Requires the `sk_` to carry `ephemeral:mint-any-org`. Omit for the default
+     *  (the session resolves its schema from its own org). */
+    readonly schemaProject?: {
+        /** The org that owns the schema project. */
+        readonly organizationId: string;
+        /** The project the schema was pushed under. */
+        readonly projectId: string;
+    };
     readonly syncGroups?: readonly string[];
     readonly ttlSeconds: number;
     readonly label?: string;

package/dist/auth/index.js

@@ -108,8 +108,14 @@ export async function mintUserSessionKey(options) {
             body: JSON.stringify({
                 user: { id: options.userId },
                 ...(options.organizationId ? { organizationId: options.organizationId } : {}),
-                ...(options.schemaProjectId ? { schemaProjectId: options.schemaProjectId } : {}),
-                ...(options.schemaOwnerOrgId ? { schemaOwnerOrgId: options.schemaOwnerOrgId } : {}),
+                // Flattened to the existing wire keys — the public param is project-centric,
+                // the transport contract is unchanged (no coordinated server deploy needed).
+                ...(options.schemaProject
+                    ? {
+                        schemaProjectId: options.schemaProject.projectId,
+                        schemaOwnerOrgId: options.schemaProject.organizationId,
+                    }
+                    : {}),
                 ...(options.syncGroups ? { syncGroups: options.syncGroups } : {}),
                 ttlSeconds: options.ttlSeconds,
                 ...(options.label ? { label: options.label } : {}),

package/dist/cli.cjs

@@ -280564,7 +280564,8 @@ function parseProjectFlag(argv) {
   const eq = argv.find((a) => a.startsWith("--project="));
   return eq ? eq.slice("--project=".length) || void 0 : void 0;
 }
-async function deviceLogin(argv) {
+async function deviceLogin(argv, deps = {}) {
+  const openUrl = deps.openUrl ?? openBrowser;
   Ie(`${brand("ablo")} login`);
   const requested = parseProjectFlag(argv) ?? getActiveProject()?.slug;
   const targetProject = requested === DEFAULT_PROFILE ? void 0 : requested;
@@ -280599,7 +280600,7 @@ async function deviceLogin(argv) {
   Me(`${import_picocolors7.default.bold(code.user_code)}
 
 ${import_picocolors7.default.dim(url)}`, "Approve in your browser");
-  openBrowser(url);
+  openUrl(url);
   const s = Y2();
   s.start("Waiting for approval\u2026");
   let pollMs = (code.interval ?? 5) * 1e3;
@@ -280690,8 +280691,8 @@ ${import_picocolors7.default.dim(url)}`, "Approve in your browser");
     `${import_picocolors7.default.green("\u2713")} Logged in ${import_picocolors7.default.dim("(sandbox)")}${where}. Run ${import_picocolors7.default.bold("npx ablo push")} to push your schema.`
   );
 }
-async function login(argv = []) {
-  await deviceLogin(argv);
+async function login(argv = [], deps = {}) {
+  await deviceLogin(argv, deps);
 }
 function logout() {
   const removed = clearCredential();

package/docs/coordination.md

@@ -67,6 +67,73 @@ anything extra.
 
 ---
 
+## Declaring conflict behaviour in the schema (Axis 3)
+
+The two enforcement layers above are decided **per write** (claim a row, or pass
+`readAt` + `onStale`). You can also declare a model's **default** conflict
+disposition once, in the schema, so every commit to that model is governed
+without per-call wiring. This is the third coordination axis — orthogonal to
+`policy` (who may read a row) and `groups` (which delta channels it fans into).
+
+Add a `conflict` map to `model(...)`, keyed by the **committer's** participant
+kind (`user` / `agent` / `system`), with the same `onStale` vocabulary as values:
+
+| value | meaning |
+|---|---|
+| `'overwrite'` | the write wins; that committer is never blocked. |
+| `'reject'` | the write is refused; that committer yields to a held claim / stale snapshot. |
+| `'notify'` | hold the write and hand back the current value so the committer re-reads and re-applies (stale writes only). |
+
+```ts
+import { model, field } from '@abloatai/ablo/schema';
+
+export const card = model('card', {
+  title: field.string(),
+}, {
+  // "a human's edit always wins (never blocked); an agent yields"
+  conflict: { user: 'overwrite', agent: 'reject' },
+});
+```
+
+### Composable helpers
+
+For the same map with an authoring surface that reads like the rest of the DSL,
+use the disposition helpers and the `coordination(...)` combinator (a `cn`/`cx`
+for conflict policy — later rules win on key collisions):
+
+```ts
+import { model, field, coordination, humansOverwrite, agentsReject } from '@abloatai/ablo/schema';
+
+export const card = model('card', {
+  title: field.string(),
+}, {
+  conflict: coordination(humansOverwrite(), agentsReject()),
+  // → { user: 'overwrite', agent: 'reject' }
+});
+```
+
+Helpers, one per disposition: `humansOverwrite` / `humansReject` / `humansNotify`,
+`agentsOverwrite` / `agentsReject` / `agentsNotify`,
+`systemOverwrite` / `systemReject` / `systemNotify`.
+
+### How it relates to per-write coordination
+
+- The `conflict` map is **pure, serializable data**: it ships in your pushed
+  schema (`npx ablo push`) and the engine interprets it at the commit
+  chokepoint — there is no per-model code on the server.
+- An **omitted committer kind falls through to the engine default**: reject, and
+  honor a per-write `onStale: 'notify'`. Declaring `conflict` is purely
+  additive — existing schemas behave exactly as before.
+- It sets the **default** disposition; a per-write `onStale` and a held `claim`
+  still apply on top as described above. Think of `conflict` as "the house rule
+  for this model," and `claim` / `onStale` as what an individual write does
+  within it.
+
+The `ConflictAxis` type (also available as `Ablo.Conflict.Axis`) and the
+`interpretConflictAxis` interpreter are exported for composing custom policies.
+
+---
+
 ## The claim state object
 
 The claim state object is the live record that a participant is coordinating work on

package/docs/identity.md

@@ -156,6 +156,40 @@ The identity is a **participant** — and a participant is either a human
 [Agents are participants too](#agents-are-participants-too) below. Everything in
 the next two sections applies to both.
 
+## Your schema lives in a project; your users commit to it
+
+The default is simple: your schema lives in a **project**, you push it once, and
+every session you mint resolves against it. Your end-users **don't have Ablo
+accounts** — your server's `sk_` mints an `ek_` per user, and by default that
+session lands in your project's own org. All your users share one schema, one
+data tenant, isolated from each other by sync-groups. That's the whole story for
+most apps.
+
+**Add-on — org-per-customer isolation.** If you need each customer to be its own
+hard tenant (separate row-level isolation, optionally a separate database) you'd
+otherwise have to re-push your schema into every customer's org. Instead, keep one
+project as the home of your schema and point each customer's session's *schema*
+at it while its *data* stays in the customer's org:
+
+```ts
+await mintUserSessionKey({
+  apiKey: platformKey,   // sk_ with the `ephemeral:mint-any-org` scope
+  userId,
+  organizationId,                  // DATA → this customer's org (RLS-isolated tenant)
+  schemaProject: {                 // SCHEMA → the project that owns your schema
+    organizationId: schemaOwnerOrgId,
+    projectId: schemaProjectId,
+  },
+  ttlSeconds: 3600,
+});
+```
+
+Server-side, the model **shape** loads from your schema project but column
+enrichment and the tenant connection still target `organizationId` — so the
+shared schema only *describes* the shape; the data plane stays the customer's and
+can't cross-leak. Omit these fields for the default above. Requires a platform
+`sk_` with `ephemeral:mint-any-org`.
+
 ## The two halves of scoping
 
 Scoping is two declarations that meet in the middle. One describes the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/ablo",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "description": "The Collaboration Layer For AI Agents",
   "license": "Apache-2.0",
   "type": "module",