@abloatai/ablo 0.25.0 → 0.26.0

package/AGENTS.md

@@ -6,16 +6,18 @@ Claims don't lock. If another writer holds the row, `claim` waits for them and r
 
 ## Start here — scaffold with `ablo init`
 
-Don't hand-write the integration. Run the CLI; it generates the current-API schema, client, Data Source endpoint, and (for Next.js) the browser provider + session route:
+Don't hand-write the integration. Run the CLI; it generates the current-API schema, client, the database connection (logical replication by default, or a signed Data Source endpoint as the fallback), and (for Next.js) the browser provider + session route:
 
 - **Scaffold:** `npx ablo init --yes` — flag-driven, never prompts. Override defaults with `--framework <nextjs|vite|remix|vanilla>`, `--auth <apikey|…>`, `--no-agent`, `--no-pull`, `--no-install`, `--no-login`. (Plain `ablo init` needs a TTY and will **HANG** in an agent/CI run — always pass `--yes`.)
 - **Auth:** set `ABLO_API_KEY` in the environment. Do **NOT** run `ablo login` — it opens a browser device flow and blocks an agent.
-- **Provision your DB (Data Source mode):** `npx ablo migrate` creates the tables for your Ablo models plus the adapter's bookkeeping tables (`ablo_outbox`, `ablo_idempotency`). It does **not** touch your other tables — keep your own migrations (drizzle-kit / prisma migrate) for auth and anything not in the Ablo schema.
+- **Connect your database — logical replication (the primary path):** `npx ablo connect` prints the setup SQL (`wal_level=logical`, a publication, a `REPLICATION` role); `npx ablo connect --register` registers the source with Ablo in one step. Ablo **consumes your Postgres' logical-replication stream** — it never runs DDL on, writes to, owns, or migrates your database, and your application keeps the write path. Registration **is** the enable; there is no tier or flag to pick. (Ablo hosts only the transaction log + coordination, never your rows.)
+- **Fallback — signed Data Source endpoint** (DB can't grant a `REPLICATION` role): the generated `ablo/data-source.ts` exposes one route; Ablo sends signed requests and your app touches its own DB. **Only in this mode** does `npx ablo migrate` provision the adapter's bookkeeping tables (`ablo_outbox`, `ablo_idempotency`) plus your Ablo models — it does **not** touch your other tables. Keep your own migrations (drizzle-kit / prisma migrate) for auth and anything outside the Ablo schema.
+- **No database yet?** A sandbox `sk_test` key holds throwaway **test data** (Stripe-test-mode style) so you can try Ablo before connecting your own Postgres. Test-mode only — in production every row lives in your database.
 - **Adopt an existing DB schema:** `npx ablo pull prisma [path]` / `pull drizzle <module>` (lossless) or `pull` (live DB, lossy). Writes `ablo/schema.ts`.
 - **Push your schema — REQUIRED before any write works.** The server keeps its OWN copy of the schema. After you create or edit `ablo/schema.ts`, run `npx ablo push` (one-shot) — or `npx ablo dev --no-watch`. **Skip this and every write to a new or changed model fails with `server_execute_unknown_model`.** (Plain `ablo dev` watches forever — never run it bare in an agent.)
 - **Other long-running:** `npx ablo logs --no-follow` (default tails forever). `npx ablo mode test|live` ALWAYS pass the argument. `status`, `push`, `pull`, `check`, `generate` are one-shot — safe as-is.
 
-The generated `ablo/data-source.ts` is the whole Data Source endpoint and needs no hand-editing: `dataSourceNext({ schema, apiKey, adapter: prismaDataSource(prisma, schema) })` (or `drizzleDataSource(db, schema)`). The adapter owns commit / idempotency / outbox.
+When you use the signed-endpoint fallback, the generated `ablo/data-source.ts` is the whole endpoint and needs no hand-editing: `dataSourceNext({ schema, apiKey, adapter: prismaDataSource(prisma, schema) })` (or `drizzleDataSource(db, schema)`). The adapter owns commit / idempotency / outbox.
 
 ## Rule
 

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.26.0
+
+### Minor Changes
+
+- **`ablo connect --register` works against any deployment.** Registering your database as an Ablo data source over logical replication is now a first-class path everywhere — the gate that could refuse a new connection-string registration is gone. Point `ablo connect --register` at your Postgres and Ablo begins consuming its replication stream while your application keeps owning the write path; registering the source _is_ the enable, with no tier or flag to choose. The signed `dataSource()` endpoint remains the explicit fallback for databases that can't grant replication.
+
+- **More engine failures surface as typed errors you can branch on**, instead of opaque `500`s. New `AbloError` codes: `schema_provisioning_forbidden` (`403` — a push tried to create tables in a database where the engine isn't permitted to run DDL), `request_too_large` (`413` — a query or commit body exceeded the size limit), `commit_operation_invalid` (`400` — a malformed commit operation), and `upload_not_configured` (`503` — an upload was attempted with no blob store wired).
+
+- **`@abloatai/ablo/wire` now exports the protocol schemas.** `commitOperationSchema`, `commitPayloadSchema`, and the frame schemas let tooling and tests validate client↔engine frames against the same contract the engine enforces.
+
+- **Protocol version negotiation is surfaced.** `@abloatai/ablo/wire` exports `PROTOCOL_VERSION`, `MIN_SUPPORTED_PROTOCOL_VERSION`, `WS_CLOSE_PROTOCOL_VERSION`, `PROTOCOL_VERSION_HEADER`, `protocolVersionProblem`, and `ERROR_CONTRACT_VERSION` — the single integer the client and server compare on connect to detect an incompatible peer and fail with a clear reason instead of a cryptic wire error.
+
+- **`@abloatai/ablo/coordination` exposes the conflict-policy vocabulary** — `defaultPolicy`, `capabilityPreemptPolicy`, and `interpretConflictAxis` — for server-side consumers building on the claim model. `@abloatai/ablo/schema` gains the role primitives (`identityRole`, `entityRole`, and their types and schemas) for declaring identity- and entity-scoped roles.
+
+- **Removed unused API surface.** Dropped the `@abloatai/ablo/server/next` subpath export and the unused `MutationDispatcher` interface (plus its `MockMutationDispatcher` test double) and the offline-mutation-queue internals behind them — none had documented consumers. Every supported entry point (`@abloatai/ablo`, `/ai-sdk`, `/react`, `/source`, `/coordination`, `/schema`, `/keys`, `/auth`, `/wire`, …) is unchanged.
+
+- **Internal:** the SDK's largest modules — the `Ablo` client, the data-source runtime, the transaction queue, and the WebSocket sync loop — were decomposed into cohesive leaf modules. No public runtime API or import path changed.
+
+- **CLI & docs.** `ablo push` prints a calmer, information-first deploy banner (a production push still requires typing the project name to confirm). The README and `AGENTS.md` now lead with the one-path logical-replication model and clarify that sandbox is test-mode only — in production your rows stay in your database and Ablo holds only the transaction log.
+
 ## 0.25.0
 
 ### Minor Changes

package/README.md

@@ -322,10 +322,10 @@ import Ablo from '@abloatai/ablo';
 import { AbloProvider, useAblo } from '@abloatai/ablo/react';
 import { schema } from './ablo/schema';
 
-// Build the client once — it authenticates via your session route, no key in the browser.
+// Build the client once — authEndpoint is your session route; no key in the browser.
 const ablo = Ablo({
   schema,
-  apiKey: () => fetch('/api/ablo-session').then((r) => r.text()),
+  authEndpoint: '/api/ablo-session',
 });
 
 function App() {
@@ -381,7 +381,7 @@ to sync-group strings.
 // team membership is asserted server-side when the session route mints the token.
 const ablo = Ablo({
   schema,
-  apiKey: () => fetch('/api/ablo-session').then((r) => r.text()),
+  authEndpoint: '/api/ablo-session',
 });
 
 <AbloProvider client={ablo} userId={user.id}>

package/dist/BaseSyncedStore.d.ts

@@ -11,6 +11,7 @@
  * implementation stays in the app's SyncedStore.ts until we incrementally
  * pull generic methods into this base class.
  */
+import type { RecoveryClass } from './errorCodes.js';
 import { ConnectionManager } from './sync/ConnectionManager.js';
 import { AreaOfInterestManager } from './sync/AreaOfInterestManager.js';
 import { type ParticipantScope } from './sync/participants.js';
@@ -18,19 +19,22 @@ import type { SyncClient } from './SyncClient.js';
 import type { Database, BootstrapResult } from './Database.js';
 import type { ObjectPool } from './ObjectPool.js';
 import { ModelRegistry } from './ModelRegistry.js';
-import { SyncWebSocket, type SyncDelta, type SyncGroupChangePayload, type GroupAddedPayload, type GroupRemovedPayload, type VersionVector, type BootstrapHint, type BootstrapDataEvent, type PresenceUpdateEvent, type EventMap, type DefaultCollaborationEvents } from './sync/SyncWebSocket.js';
+import { SyncWebSocket, type SyncDelta, type SyncGroupChangePayload, type GroupAddedPayload, type GroupRemovedPayload, type BootstrapHint, type BootstrapDataEvent, type PresenceUpdateEvent, type EventMap, type DefaultCollaborationEvents } from './sync/SyncWebSocket.js';
 import { QueryProcessor } from './core/QueryProcessor.js';
 import { Model } from './Model.js';
 import { ModelScope } from './ObjectPool.js';
 import type { Schema } from './schema/schema.js';
-import type { LocalMutation } from './react/context.js';
+import type { SyncStatus, LocalMutation } from './core/storeContract.js';
 import type { AuthCredentialSource } from './auth/credentialSource.js';
+import type { ModelData } from './types/modelData.js';
+import type { EnrichmentPlanEntry, ForeignKeyIndexSpec } from './sync/syncPlan.js';
+import { type CredentialRefresher } from './sync/credentialLifecycle.js';
+import type { RehydrationStats } from './sync/bootstrapApply.js';
 /** Constructor type for Model subclasses (accepts abstract classes) */
 export type ModelConstructor<T extends Model> = abstract new (...args: never[]) => T;
 /** Concrete constructor type for instantiation */
 export type ConcreteModelConstructor<T extends Model> = new (data?: any) => T;
-/** Generic record type for model data */
-export type ModelData = Record<string, unknown>;
+export type { ModelData } from './types/modelData.js';
 /** Query result interface */
 export interface QueryResult<T extends Model> {
     data: T[];
@@ -38,55 +42,12 @@ export interface QueryResult<T extends Model> {
     hasMore: boolean;
     fromCache?: boolean;
 }
-/** A foreign-key index to register on the ObjectPool at construction time. */
-export interface ForeignKeyIndexSpec {
-    /**
-     * The child model name (where the FK field lives) — this is the type
-     * that will be passed to `pool.registerForeignKey(modelName, fieldName)`
-     * and later to `pool.getByForeignKey(modelName, fieldName, value)`.
-     *
-     * Use the wire `__typename` casing (e.g., `'SlideLayer'`, not
-     * `'slideLayer'`) — that's the value `createFromData` stamps onto
-     * models and the pool indexes by.
-     */
-    readonly modelName: string;
-    /** The FK field name on the child model, e.g. `'slideId'`. */
-    readonly fieldName: string;
-}
-/**
- * A declarative enrichment rule for the delta-apply path.
- *
- * When a delta for `modelName` arrives, after the model is constructed
- * the base store reads `data[foreignKey]` from the payload, looks up
- * the matching parent in the ObjectPool, and attaches it as
- * `data[relationKey]`. Best-effort: if the parent isn't yet in the
- * pool (e.g., arrived later in the same bootstrap batch), enrichment
- * silently no-ops.
- *
- * Replaces the previous pattern of overriding `enrichRelations` on a
- * subclass to hardcode per-model enrichment logic.
- */
-export interface EnrichmentPlanEntry {
-    /** The child model whose incoming deltas should be enriched. */
-    readonly modelName: string;
-    /** The FK field on the child that points at the parent's id. */
-    readonly foreignKey: string;
-    /** The property name under which to attach the parent model. */
-    readonly relationKey: string;
-}
+export type { ForeignKeyIndexSpec, EnrichmentPlanEntry } from './sync/syncPlan.js';
 /** Configuration for SyncedStore behavior */
 export interface SyncedStoreConfig {
     enableOffline?: boolean;
     enableCache?: boolean;
     enableTelemetry?: boolean;
-    /**
-     * Initial version vector keys, each seeded to 0. Merged with the
-     * schema-derived set (if a schema is provided to the constructor) —
-     * explicit keys here layer on top of derived ones. Replaces the
-     * subclass pattern of hardcoding `this.versionVector = { tasks: 0, ... }`
-     * in the constructor.
-     */
-    versionVectorKeys?: readonly string[];
     /**
      * Declarative enrichment plan consumed by `enrichRelations`. Replaces
      * the subclass override of `enrichRelations` for per-model parent
@@ -104,17 +65,7 @@ export interface SyncedStoreConfig {
      */
     foreignKeyIndexes?: readonly ForeignKeyIndexSpec[];
 }
-/** Sync status for UI binding */
-export interface SyncStatus {
-    state: 'idle' | 'syncing' | 'error' | 'offline' | 'reconnecting';
-    progress: number;
-    error?: Error;
-    /** When true, the error is a session/auth error requiring re-authentication. */
-    isSessionError: boolean;
-    lastSyncAt?: Date;
-    pendingChanges: number;
-    offlineSince?: Date;
-}
+export type { SyncStatus } from './core/storeContract.js';
 /** User context for initialization */
 export interface UserContext {
     userId: string;
@@ -157,15 +108,7 @@ export interface SmartSyncOptions {
     batchingDelay?: number;
     maxBatchSize?: number;
 }
-/** Rehydration statistics from bootstrap */
-export interface RehydrationStats {
-    added: number;
-    updated: number;
-    removed: number;
-    skipped: number;
-    healed: number;
-    elapsedMs: number;
-}
+export type { RehydrationStats } from './sync/bootstrapApply.js';
 /** Bootstrap timeout configuration */
 export declare const BOOTSTRAP_CONFIG: {
     readonly OVERALL_TIMEOUT_MS: 15000;
@@ -173,7 +116,8 @@ export declare const BOOTSTRAP_CONFIG: {
     readonly RETRY_DELAY_MS: 500;
 };
 export { ModelScope };
-export type { SyncDelta, SyncGroupChangePayload, GroupAddedPayload, GroupRemovedPayload, VersionVector, BootstrapHint, BootstrapDataEvent, PresenceUpdateEvent, };
+export type { SyncDelta, SyncGroupChangePayload, GroupAddedPayload, GroupRemovedPayload, BootstrapHint, BootstrapDataEvent, PresenceUpdateEvent, };
+export { deriveSyncPlanFromSchema } from './sync/syncPlan.js';
 /**
  * BaseSyncedStore — abstract base for app-specific sync stores.
  *
@@ -202,30 +146,6 @@ export type { SyncDelta, SyncGroupChangePayload, GroupAddedPayload, GroupRemoved
  *     }
  *   }
  */
-/**
- * Walk a schema and derive the three sync-plan arrays consumed by
- * `BaseSyncedStore`'s constructor: version-vector keys, FK indexes to
- * register on the pool, and the enrichment plan.
- *
- * Version vector keys are derived from each model's `typename` (lowercased
- * to match the server's event-type convention — `'Task'` → `'task'`,
- * `'SlideLayer'` → `'slidelayer'`). A fallback to the schema key applies
- * when `typename` is unset, though `defineSchema()` now always resolves
- * it during assembly so the fallback is defensive-only.
- *
- * FK indexes and enrichment entries are pulled from each `belongsTo`
- * relation where `options.index` / `options.enrich` is set. Relations
- * without those options are skipped — this is an opt-in mechanism so
- * adding a `belongsTo` never silently changes delta or lookup semantics.
- *
- * Pure function: takes a Schema, returns three arrays. No side effects,
- * no class state. Called once at construction time from `BaseSyncedStore`.
- */
-export declare function deriveSyncPlanFromSchema(schema: Schema): {
-    versionVectorKeys: string[];
-    enrichmentPlan: EnrichmentPlanEntry[];
-    foreignKeyIndexes: ForeignKeyIndexSpec[];
-};
 export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaboration> = DefaultCollaborationEvents, TSchema extends Schema = Schema> {
     syncStatus: SyncStatus;
     protected readonly syncClient: SyncClient;
@@ -291,18 +211,16 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
     unpinScope(scope: ParticipantScope): Promise<void>;
     protected readonly queryProcessor: QueryProcessor;
     /**
-     * Runtime behavior flags only — the three schema/config arrays
-     * (`versionVectorKeys`, `enrichmentPlan`, `foreignKeyIndexes`) are
-     * consumed at construction time and stored on the instance as
-     * `versionVector`, `enrichmentPlan`, and pool-registered indexes.
-     * They don't need to persist on `this.config`.
+     * Runtime behavior flags only — the schema/config arrays
+     * (`enrichmentPlan`, `foreignKeyIndexes`) are consumed at construction
+     * time and stored on the instance as `enrichmentPlan` and
+     * pool-registered indexes. They don't need to persist on `this.config`.
      */
     protected readonly config: Required<Pick<SyncedStoreConfig, 'enableOffline' | 'enableCache' | 'enableTelemetry'>>;
-    protected disposers: Array<() => void>;
+    protected disposers: (() => void)[];
     protected initialized: boolean;
     protected dataReady: boolean;
     protected userContext: UserContext | null;
-    protected versionVector: VersionVector;
     /**
      * Declarative enrichment plan: "for model X, when a delta arrives,
      * read data[foreignKey] and attach the matching parent from the pool
@@ -332,11 +250,11 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
         modelRegistry: ModelRegistry;
         /**
          * Optional schema. When provided, `deriveSyncPlanFromSchema` walks
-         * the schema's models + relations to auto-populate version vector
-         * keys, FK indexes, and the enrichment plan from declarative
-         * annotations. Class-based subclass users (like Ablo's legacy
-         * SyncedStore) typically pass explicit `config.versionVectorKeys`
-         * / `config.foreignKeyIndexes` / `config.enrichmentPlan` instead.
+         * the schema's models + relations to auto-populate FK indexes and
+         * the enrichment plan from declarative annotations. Class-based
+         * subclass users (like Ablo's legacy SyncedStore) typically pass
+         * explicit `config.foreignKeyIndexes` / `config.enrichmentPlan`
+         * instead.
          */
         schema?: TSchema;
         /** Sync server URL for WebSocket connection. Converted to wss:// automatically. */
@@ -391,23 +309,15 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
      */
     protected connectionManager: import('./sync/ConnectionManager.js').ConnectionManager | null;
     /**
-     * Re-mint hook for the short-lived access credential (the Stripe-style
-     * `ek_`/`rk_`). Wired by the React provider from its `getToken`/`authEndpoint`
-     * — the engine owns WHEN to refresh (a stale-credential probe / an external
-     * nudge), the integrator owns HOW to mint. Mirrors the `getToken` contract:
-     * resolves a token string on success, `null` when the long-lived login is
-     * gone (terminal), and THROWS on a transient/offline failure. Used by
-     * {@link performCredentialRefresh}. Absent ⇒ no silent re-mint (e.g. a static
-     * `apiKey` deployment whose credential source refreshes out-of-band).
-     */
-    private credentialRefresher;
-    /** Single-flight guard so a wake nudge + an in-flight request + a probe don't
-     *  all mint at once (the classic "token thrash → random logout" bug). */
-    private inFlightCredentialRefresh;
-    /** Teardown for the proactive credential lifecycle (refresh timer + wake/
-     *  online/focus listeners) installed by {@link startCredentialLifecycle};
-     *  cleared on {@link disconnect}. Null when no resolver is wired. */
-    private credentialLifecycleTeardown;
+     * Access-credential re-mint + proactive pre-roll — extracted to
+     * sync/credentialLifecycle.ts. Owns the refresher hook, the single-flight
+     * guard, and the browser-only refresh timer / wake listener; talks back
+     * through three lazily-resolved callbacks (the ConnectionManager doesn't
+     * exist until `setupWebSocketSync`). The `setCredentialRefresher` /
+     * `performCredentialRefresh` / `startCredentialLifecycle` methods below
+     * are thin delegates so the store's public surface is unchanged.
+     */
+    private readonly credentialLifecycle;
     /**
      * Listeners registered via `subscribeSessionError()`. Fired when the
      * WebSocket closes with a session-invalid code (1008/4001/4003) or a
@@ -448,7 +358,7 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
     waitForConfirmation(modelName: string, modelId: string): Promise<void>;
     /**
      * Observe the LOCAL mutation stream for undo recording (see
-     * {@link import('./react/context.js').LocalMutation}). Taps the
+     * {@link import('./core/storeContract.js').LocalMutation}). Taps the
      * TransactionQueue's `transaction:created` event — fired once per local
      * create/update/delete/archive with `previousData` already captured.
      * Remote/collaborator deltas apply via `applyDeltaBatchToPool` and never
@@ -469,28 +379,24 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
     /**
      * Register the access-credential re-mint hook. Called by the React provider
      * with a thunk that mints a fresh `ek_`/`rk_` (typically its `getToken`).
-     * See {@link credentialRefresher}.
+     * See {@link CredentialLifecycle.setRefresher}.
      */
-    setCredentialRefresher(refresher: (() => Promise<string | null>) | null): void;
+    setCredentialRefresher(refresher: CredentialRefresher | null): void;
     /**
      * Re-mint the short-lived access credential and push it into the credential
      * source, reporting a tri-state outcome the {@link ConnectionManager} maps to
-     * its FSM. The contract mirrors `getToken` (and PowerSync's `fetchCredentials`
-     * / Liveblocks' `authEndpoint`, but made explicit instead of overloading
-     * return/throw):
-     *   - token string  → `'refreshed'`     (fresh key in place; re-probe & reconnect)
-     *   - `null`        → `'session_error'` (login itself is gone → terminal, sign out)
-     *   - throw         → `'network_error'` (couldn't reach the mint endpoint → transient)
-     *
-     * SINGLE-FLIGHT: concurrent callers (a wake nudge, an in-flight request, the
-     * probe) share one in-flight promise so we never double-mint — the canonical
-     * fix for the "every 401 mints a token → thrash → spurious logout" anti-pattern.
-     *
-     * No refresher wired ⇒ `'refreshed'` (a no-op re-probe): a static-`apiKey`
-     * deployment has no session to re-mint from; its credential source refreshes
-     * out-of-band, so we just re-probe with whatever it currently holds.
+     * its FSM. Single-flight; no refresher wired ⇒ `'refreshed'` (a no-op
+     * re-probe). Full contract on {@link CredentialLifecycle.refresh}.
      */
     performCredentialRefresh(): Promise<'refreshed' | 'session_error' | 'network_error'>;
+    /**
+     * THE auth-recovery backbone for HTTP transports (lazy query lane etc.):
+     * classify-driven single-flight re-mint with the same FSM outcome routing
+     * the WS probe and proactive pre-roll use. `'retry'` ⇒ a fresh credential
+     * is in the credential source, replay the request ONCE. Full contract on
+     * {@link CredentialLifecycle.recoverFromAuthRejection}.
+     */
+    recoverFromAuthRejection(recovery: RecoveryClass): Promise<'retry' | 'stop'>;
     /**
      * Nudge the connection FSM to re-probe with the current credential. Idempotent
      * and safe in any state (ignored while `connected`). Call after pushing a
@@ -500,72 +406,39 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
      */
     nudgeReconnect(): void;
     /**
-     * Install the access-credential lifecycle the CLIENT owns (this used to live
-     * in the React provider — wrong layer). Two parts:
-     *   1. REACTIVE — register `getToken` as the re-mint hook the FSM calls when a
-     *      probe finds the key stale (`credential_stale`) or on a nudge.
-     *   2. PROACTIVE — keep the short-lived key fresh ahead of trouble: a refresh
-     *      timer inside the TTL, plus re-mint on OS wake. The ENTIRE proactive
-     *      block is browser-gated (`typeof window`): server/SSR has no socket to
-     *      keep warm and the resolver is browser-oriented, so arming it in Node
-     *      would fire a relative-URL fetch and throw. (Agents pass a static
-     *      `apiKey` with no resolver, so this method is never called for them.)
-     *
-     * Config-driven and invisible, like Supabase's `autoRefreshToken` — consumers
-     * never call a refresh method. Idempotent (a second call replaces the first);
-     * torn down on {@link disconnect}.
+     * Install the access-credential lifecycle the CLIENT owns: register
+     * `getToken` as the reactive re-mint hook AND arm the browser-only
+     * proactive pre-roll (refresh timer + OS-wake re-mint). Idempotent
+     * (a second call replaces the first); torn down on {@link disconnect}.
+     * Full rationale on {@link CredentialLifecycle.start}.
      */
-    startCredentialLifecycle(getToken: () => Promise<string | null>): void;
+    startCredentialLifecycle(getToken: CredentialRefresher, opts?: {
+        proactiveInNode?: boolean;
+    }): void;
     /** Tear down the proactive credential lifecycle (idempotent). */
     private stopCredentialLifecycle;
+    /** Narrow context the group-change leaf talks back through. */
+    private groupChangeContext;
     /**
-     * Handle an actionType 'G' delta.
-     *
-     * The server emits 'G' via two distinct pathways, distinguished by payload
-     * shape:
-     *
-     *   Incremental (EmitGroupAdded):   { group, userId }
-     *     - The recipient was added to a single sync group.
-     *     - Subsequent 'C' (Covering) deltas deliver each newly-visible entity.
-     *     - No re-bootstrap — entities arrive via the normal insert path.
-     *
-     *   Legacy (EmitGroupChange):       { addedGroups, removedGroups }
-     *     - Single delta carrying the full group membership diff.
-     *     - Forces a full re-bootstrap (disconnect + reconnect + fetch all).
-     *     - Deprecated on the server; kept here for wire-level backward compat.
+     * Handle an actionType 'G' delta — incremental `{ group, userId }` or
+     * legacy `{ addedGroups, removedGroups }` payloads. Full pathway doc on
+     * {@link groupChange.handleSyncGroupChange}.
      */
     protected handleSyncGroupChange(delta: SyncDelta): Promise<void>;
     /**
-     * Handle an incremental GroupAdded delta.
-     *
-     * Adds the new group to the subscription metadata without triggering a
-     * re-bootstrap. The server will follow up with 'C' (Covering) deltas for
-     * each newly-visible entity, which flow through the normal insert path.
+     * Handle an incremental GroupAdded delta — metadata only, no re-bootstrap
+     * (covering deltas bring the entities). See {@link groupChange.handleGroupAdded}.
      */
     protected handleGroupAdded(payload: GroupAddedPayload, syncId: number): Promise<void>;
     /**
-     * Handle an actionType 'S' (GroupRemoved) delta.
-     *
-     * Signals that the recipient has lost access to a sync group. Because
-     * the client does not track per-entity group membership, we can't
-     * selectively purge entities belonging to that group. The safe fallback
-     * is the legacy behavior: clear local state and force a re-bootstrap
-     * with the updated group list.
-     *
-     * Future optimization: track group membership in the ObjectPool so 'S'
-     * can do a targeted purge instead of a full re-bootstrap.
+     * Handle an actionType 'S' (GroupRemoved) delta — SECURITY clear of local
+     * state + full re-bootstrap. See {@link groupChange.handleGroupRemoved}.
      */
     protected handleGroupRemoved(delta: SyncDelta): Promise<void>;
     /** Compute new sync groups after applying additions and removals */
     protected computeUpdatedSyncGroups(payload: SyncGroupChangePayload): string[];
-    /** Force a full re-bootstrap via connection lifecycle event.
-     *
-     * No-op for `bootstrapMode: 'none'` participants — they never pull
-     * baseline state, so a "force re-bootstrap" trigger (sync-group
-     * shrink, scope revocation) instead just flushes the local pool and
-     * relies on covering deltas to repopulate the data they actually
-     * subscribe to.
-     */
+    /** Force a full re-bootstrap via connection lifecycle event (no-op for
+     *  `bootstrapMode: 'none'` participants — see {@link groupChange.forceFullRebootstrap}). */
     protected forceFullRebootstrap(): void;
     /**
      * Single source of truth for the sync-group list this session is
@@ -578,6 +451,8 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
     protected resolveSyncGroups(context: UserContext): readonly string[];
     /** Check if sync groups shrank since last session — force full bootstrap if so */
     protected checkSyncGroupShrinkage(): Promise<void>;
+    /** Narrow context the bootstrap-apply leaf talks back through. */
+    private poolContext;
     /** Apply bootstrap data to the ObjectPool with ghost removal */
     /** Apply bootstrap data to the ObjectPool. Delegates pool writes to SyncClient. */
     protected applyBootstrapToPool(bootstrapResult: BootstrapResult, protectedIds?: ReadonlySet<string>): RehydrationStats;
@@ -595,7 +470,7 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
     protected withDeltaQueuing<T>(fn: () => Promise<T>): Promise<T>;
     /** Collect IDs that must survive ghost removal (added by deltas during bootstrap) */
     protected collectDeltaProtectedIds(preBootstrapIds: ReadonlySet<string>): Set<string>;
-    /** Replay deltas queued during bootstrap */
+    /** Replay deltas queued during bootstrap (atomically, via `applyDeltaFrame`). */
     protected replayQueuedDeltas(): void;
     /**
      * Factory for the internal `ConnectionManager`. Override to return
@@ -664,11 +539,13 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
      */
     protected waitForWebSocketConnected(timeoutMs: number): Promise<boolean>;
     protected setupWebSocketSync(context: UserContext, lastSyncId: number): void;
-    /** State signature for delta deduplication */
-    private extractStateSignature;
+    /** Memoized pipeline context — `enqueueDelta` runs once per delta, so the
+     *  accessor object is built once and reused (the get/set accessors always
+     *  read the live host fields). */
+    private _deltaPipelineContext;
+    private get deltaPipelineContext();
     /** Get fields that represent meaningful state for deduplication. Override for model-specific fields. */
     protected getStateFields(_modelName: string): string[];
-    private isSameState;
     /** Deduplicate deltas to the same entity — keep meaningful state transitions only */
     protected deduplicateDeltas(deltas: SyncDelta[]): SyncDelta[];
     /** Process incoming delta with smart batching */