@abloatai/ablo 0.25.0 → 0.26.0

package/dist/SyncClient.js

@@ -8,7 +8,8 @@
  * - Handle conflict resolution for local changes
  */
 import { runInAction } from 'mobx';
-import { ModelScope } from './ObjectPool.js';
+import { ObjectPool, ModelScope } from './ObjectPool.js';
+import { Model } from './Model.js';
 // ModelRegistry instance accessed via this.objectPool.registry
 import { LoadStrategy } from './types/index.js';
 import { getContext } from './context.js';
@@ -16,6 +17,7 @@ import { AbloAuthenticationError, AbloError, AbloValidationError } from './error
 import { EventEmitter } from 'events';
 import { NetworkMonitor } from './NetworkMonitor.js';
 import { TransactionQueue } from './transactions/TransactionQueue.js';
+import { persistedMutationSchema } from './transactions/persistedReplay.js';
 import { OptimisticEchoTracker, } from './transactions/OptimisticEchoTracker.js';
 import { SyncPosition } from './sync/syncPosition.js';
 /**
@@ -43,6 +45,22 @@ function rawRecordIsNewer(data, existing) {
         return true;
     return inMs > exMs;
 }
+/**
+ * Narrow an untyped server `updatedAt` (ISO string / epoch / Date, off a
+ * `Record<string, unknown>` row) to epoch ms for LWW comparison. Falsy /
+ * non-date values → 0, matching the conflict resolver's historical
+ * "no timestamp = epoch" behavior.
+ */
+function toEpochMs(value) {
+    if (!value)
+        return 0;
+    if (value instanceof Date)
+        return value.getTime();
+    if (typeof value === 'string' || typeof value === 'number') {
+        return new Date(value).getTime();
+    }
+    return 0;
+}
 export class SyncClient extends EventEmitter {
     objectPool;
     database;
@@ -122,8 +140,25 @@ export class SyncClient extends EventEmitter {
      * Setup network monitoring handlers
      */
     setupNetworkMonitoring() {
-        this.networkMonitor.on('online', () => this.handleReconnection());
-        this.networkMonitor.on('offline', () => this.handleDisconnection());
+        // Both handlers emit to external listeners (which can throw) before/around
+        // their own try/catch — route rejections into observability rather than
+        // losing a failed reconnect flush silently.
+        this.networkMonitor.on('online', () => {
+            void this.handleReconnection().catch((error) => {
+                getContext().observability.captureTransactionFailure({
+                    context: 'network-online-reconnection',
+                    error: error instanceof Error ? error : new Error(String(error)),
+                });
+            });
+        });
+        this.networkMonitor.on('offline', () => {
+            void this.handleDisconnection().catch((error) => {
+                getContext().observability.captureTransactionFailure({
+                    context: 'network-offline-handler',
+                    error: error instanceof Error ? error : new Error(String(error)),
+                });
+            });
+        });
     }
     /**
      * Handle transaction rollback. Two distinct shapes flow through this
@@ -281,46 +316,14 @@ export class SyncClient extends EventEmitter {
      * will deliver the missing deltas and naturally confirm the transaction.
      */
     setupAwaitingTransactionPersistence() {
-        this.transactionQueue.on('transaction:persist_awaiting', async (event) => {
-            if (!this.database)
-                return;
-            try {
-                await this.database.saveTransaction({
-                    id: `awaiting_${event.txId}`,
-                    type: 'awaiting_delta',
-                    timestamp: Date.now(),
-                    awaitingDelta: {
-                        syncIdNeeded: event.syncIdNeeded ?? 0,
-                        modelName: event.model,
-                        modelId: event.modelId,
-                        operationType: event.operationType,
-                    },
-                });
-                getContext().observability.breadcrumb('Persisted unconfirmed transaction to IDB', 'sync.transaction', 'info', {
-                    txId: event.txId,
-                    model: event.model,
-                    modelId: event.modelId,
-                });
-            }
-            catch (error) {
-                getContext().observability.captureTransactionFailure({
-                    context: 'persist-awaiting-transaction',
-                    modelName: event.model,
-                    modelId: event.modelId,
-                    error: error instanceof Error ? error : new Error(String(error)),
-                });
-            }
+        this.transactionQueue.on('transaction:persist_awaiting', (event) => {
+            // void is safe: the handler's body is fully try/catch'd.
+            void this.persistAwaitingTransaction(event);
         });
         // Clean up persisted awaiting transactions when they're finally confirmed
-        this.transactionQueue.on('transaction:completed', async (tx) => {
-            if (!this.database)
-                return;
-            try {
-                await this.database.removeTransaction(`awaiting_${tx.id}`);
-            }
-            catch {
-                // Ignore — might not have been persisted
-            }
+        this.transactionQueue.on('transaction:completed', (tx) => {
+            // void is safe: the handler's body is fully try/catch'd.
+            void this.removeAwaitingTransaction(tx.id);
         });
         // Echo detection bridge. When the queue stages a transaction, the
         // client has already optimistically applied the change to the
@@ -338,6 +341,48 @@ export class SyncClient extends EventEmitter {
             this.echoTracker.drainOnRollback(event.transaction.id);
         });
     }
+    /** Persist an unconfirmed transaction to IDB (never rejects — failures are captured). */
+    async persistAwaitingTransaction(event) {
+        if (!this.database)
+            return;
+        try {
+            await this.database.saveTransaction({
+                id: `awaiting_${event.txId}`,
+                type: 'awaiting_delta',
+                timestamp: Date.now(),
+                awaitingDelta: {
+                    syncIdNeeded: event.syncIdNeeded ?? 0,
+                    modelName: event.model,
+                    modelId: event.modelId,
+                    operationType: event.operationType,
+                },
+            });
+            getContext().observability.breadcrumb('Persisted unconfirmed transaction to IDB', 'sync.transaction', 'info', {
+                txId: event.txId,
+                model: event.model,
+                modelId: event.modelId,
+            });
+        }
+        catch (error) {
+            getContext().observability.captureTransactionFailure({
+                context: 'persist-awaiting-transaction',
+                modelName: event.model,
+                modelId: event.modelId,
+                error: error instanceof Error ? error : new Error(String(error)),
+            });
+        }
+    }
+    /** Drop the persisted awaiting-row once confirmed (never rejects). */
+    async removeAwaitingTransaction(txId) {
+        if (!this.database)
+            return;
+        try {
+            await this.database.removeTransaction(`awaiting_${txId}`);
+        }
+        catch {
+            // Ignore — might not have been persisted
+        }
+    }
     /**
      * Initialize sync client with authentication
      */
@@ -483,8 +528,9 @@ export class SyncClient extends EventEmitter {
                 // Persist healed records back to IndexedDB (fire-and-forget, non-blocking)
                 if (recordsToHeal.length > 0 && this.database) {
                     getContext().logger.info(`[SyncClient.hydrate] Persisting ${recordsToHeal.length} healed ${modelType} records to IndexedDB`);
-                    // Use fire-and-forget to not block hydration
-                    Promise.resolve().then(async () => {
+                    // Use fire-and-forget to not block hydration.
+                    // void is safe: the handler's body is fully try/catch'd.
+                    void Promise.resolve().then(async () => {
                         try {
                             for (const { id, data } of recordsToHeal) {
                                 await this.database.putRecord(modelType, id, data);
@@ -501,13 +547,6 @@ export class SyncClient extends EventEmitter {
                     });
                 }
                 const typeEnd = typeof performance !== 'undefined' ? performance.now() : Date.now();
-                // Dev-only hydration summary
-                if (modelType === 'InboxItem' && process.env.NODE_ENV !== 'production') {
-                    getContext().logger.debug('[SyncClient] InboxItem hydration summary', {
-                        fetched: rawData.length,
-                        added: modelsForType.length,
-                    });
-                }
                 perTypePerfLogs.push({
                     type: modelType,
                     fetched: rawData.length,
@@ -600,7 +639,8 @@ export class SyncClient extends EventEmitter {
                         if (this.database) {
                             const id = healResult.data.id;
                             const healedData = healResult.data;
-                            Promise.resolve().then(async () => {
+                            // void is safe: the handler's body is fully try/catch'd.
+                            void Promise.resolve().then(async () => {
                                 try {
                                     await this.database.putRecord(modelType, id, healedData);
                                 }
@@ -755,11 +795,11 @@ export class SyncClient extends EventEmitter {
     }
     /** Add new model (CREATE) - works offline */
     add(model, options) {
-        this.mutate('create', model, () => this.objectPool.add(model, ModelScope.live), options);
+        this.mutate('create', model, () => { this.objectPool.add(model, ModelScope.live); }, options);
     }
     /** Update existing model (UPDATE) - works offline */
     update(model, options) {
-        this.mutate('update', model, () => this.objectPool.upsert(model, ModelScope.live), options);
+        this.mutate('update', model, () => { this.objectPool.upsert(model, ModelScope.live); }, options);
     }
     /**
      * Update existing model with pre-computed changes.
@@ -912,7 +952,7 @@ export class SyncClient extends EventEmitter {
     }
     /** Archive model (ARCHIVE) - works offline */
     archive(model) {
-        this.mutate('archive', model, () => this.objectPool.updateScope(model.id, ModelScope.archived));
+        this.mutate('archive', model, () => { this.objectPool.updateScope(model.id, ModelScope.archived); });
     }
     /**
      * Append a mutation and schedule its sync work.
@@ -969,10 +1009,21 @@ export class SyncClient extends EventEmitter {
                 timestamp: Date.now(),
             });
         }
-        catch (error) { }
+        catch (error) {
+            // Best-effort persistence — the in-memory queue still processes; only
+            // a tab close before reconnect loses these. Forensic → debug.
+            getContext().logger.debug('[SyncClient] Failed to persist offline mutation queue', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
     }
     /**
-     * Restore mutation queue from IndexedDB
+     * Restore mutation queue from IndexedDB.
+     *
+     * The persisted record was written by a PREVIOUS session (possibly an older
+     * SDK build), so each entry is validated at this replay boundary (T1.8):
+     * corrupt entries are dropped + logged at debug, and a failure never
+     * vanishes into an empty catch — offline write survival must be observable.
      */
     async restoreMutationQueue() {
         if (!this.database || !this.userId)
@@ -982,19 +1033,39 @@ export class SyncClient extends EventEmitter {
             const queue = stored.find((t) => t.id === 'mutation-queue');
             if (queue?.mutations) {
                 for (const mutation of queue.mutations) {
-                    const model = this.objectPool.createFromData(mutation.modelData);
+                    const parsed = persistedMutationSchema.safeParse(mutation);
+                    if (!parsed.success) {
+                        getContext().logger.debug('[SyncClient] Dropping malformed persisted mutation', {
+                            issues: parsed.error.issues.map((i) => i.path.join('.')).join(', '),
+                        });
+                        continue;
+                    }
+                    const model = this.objectPool.createFromData(parsed.data.modelData);
                     if (model) {
                         this.pendingMutations.push({
-                            type: mutation.type,
+                            type: parsed.data.type,
                             model,
-                            timestamp: new Date(mutation.timestamp),
-                            writeOptions: mutation.writeOptions,
+                            timestamp: new Date(parsed.data.timestamp),
+                            ...(parsed.data.writeOptions !== undefined
+                                ? { writeOptions: parsed.data.writeOptions }
+                                : {}),
                         });
                     }
                 }
             }
         }
-        catch (error) { }
+        catch (error) {
+            // A restore failure means queued offline writes did NOT rehydrate.
+            // Self-healing is impossible here (the record may be unreadable), but
+            // the failure must be visible for diagnosis instead of silent loss.
+            getContext().logger.debug('[SyncClient] Failed to restore offline mutation queue', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            getContext().observability.captureTransactionFailure({
+                context: 'restore-mutation-queue',
+                error: error instanceof Error ? error : String(error),
+            });
+        }
     }
     /**
      * Process pending mutations - can be called by SyncedStore when online
@@ -1055,12 +1126,26 @@ export class SyncClient extends EventEmitter {
         if (!this.userId || !this.organizationId)
             return;
         const ctx = { userId: this.userId, organizationId: this.organizationId };
+        // Settlement is delivered via transaction.confirmation, not this promise —
+        // it only rejects when staging itself throws (change extraction, optimistic
+        // apply, store add). That means the write never entered the queue, so
+        // capture it instead of dropping it silently.
+        const captureStagingFailure = (error) => {
+            getContext().observability.captureTransactionFailure({
+                context: `stage-mutation-${mutation.type}`,
+                modelName: mutation.model.getModelName(),
+                modelId: mutation.model.id,
+                error: error instanceof Error ? error : new Error(String(error)),
+            });
+        };
         if (mutation.type === 'update') {
-            this.transactionQueue.update(mutation.model, ctx, mutation.capturedChanges, mutation.writeOptions);
+            this.transactionQueue
+                .update(mutation.model, ctx, mutation.capturedChanges, mutation.writeOptions)
+                .catch(captureStagingFailure);
         }
         else {
             const handler = this.transactionQueue[mutation.type].bind(this.transactionQueue);
-            handler(mutation.model, ctx, mutation.writeOptions);
+            handler(mutation.model, ctx, mutation.writeOptions).catch(captureStagingFailure);
         }
     }
     /**
@@ -1078,7 +1163,7 @@ export class SyncClient extends EventEmitter {
                 ? localModel.updatedAt.getTime()
                 : new Date(localModel.updatedAt).getTime()
             : 0;
-        const serverUpdatedAt = serverData?.updatedAt ? new Date(serverData.updatedAt).getTime() : 0;
+        const serverUpdatedAt = toEpochMs(serverData.updatedAt);
         getContext().logger.debug('Conflict resolution', {
             modelId: localModel.id,
             modelType: localModel.getModelName(),
@@ -1114,7 +1199,7 @@ export class SyncClient extends EventEmitter {
             // Merge: server baseline + local dirty fields win
             const merged = { ...serverData, ...(localChanges || {}) };
             // Preserve the most recent updatedAt without clearing dirty flags
-            if (serverData?.updatedAt || localModel.updatedAt) {
+            if (serverData.updatedAt || localModel.updatedAt) {
                 const mergedUpdatedAt = new Date(Math.max(localUpdatedAt, serverUpdatedAt));
                 // updateFromData accepts Date or ISO string for dates
                 merged.updatedAt = mergedUpdatedAt;
@@ -1134,7 +1219,8 @@ export class SyncClient extends EventEmitter {
     }
     /**
      * Extract critical state fields from server data
-     * These are states that must always be respected, even with local changes
+     * These are states that must always be respected, even with local changes.
+     * The conflict brain reads exactly these known fields — nothing else.
      */
     extractCriticalState(serverData) {
         const critical = {};

package/dist/SyncEngineContext.d.ts

@@ -4,7 +4,7 @@
  * All SDK classes receive this context at construction time.
  * It bundles every injectable dependency so constructors stay clean.
  */
-import type { SyncLogger, SyncObservabilityProvider, SyncAnalytics, SessionErrorDetector, OnlineStatusProvider, ModelDebugLoggerContract, MutationExecutor, MutationDispatcher, SyncEngineConfig } from './interfaces/index.js';
+import type { SyncLogger, SyncObservabilityProvider, SyncAnalytics, SessionErrorDetector, OnlineStatusProvider, ModelDebugLoggerContract, MutationExecutor, SyncEngineConfig } from './interfaces/index.js';
 export interface SyncEngineContext {
     /** Structured logger */
     logger: SyncLogger;
@@ -20,8 +20,6 @@ export interface SyncEngineContext {
     modelDebugLogger?: ModelDebugLoggerContract;
     /** Backend mutation transport (GraphQL, REST, etc.) */
     mutationExecutor: MutationExecutor;
-    /** Offline mutation replay dispatcher */
-    mutationDispatcher: MutationDispatcher;
     /** Application-specific sync configuration */
     config: SyncEngineConfig;
 }

package/dist/SyncEngineContext.js

@@ -26,7 +26,6 @@ export const noopObservability = {
     captureReconciliation() { },
     captureDeltaRetryExhausted() { },
     captureWebSocketError() { },
-    captureOfflineFlushFailure() { },
     captureSelfHealing() { },
     captureClaim() { },
     captureConflict() { },
@@ -57,7 +56,7 @@ export const browserOnlineStatus = {
 export const defaultSessionErrorDetector = {
     isSessionError(error) {
         if (error && typeof error === 'object' && 'isSessionError' in error) {
-            return error.isSessionError === true;
+            return error.isSessionError;
         }
         return false;
     },

package/dist/agent/Agent.d.ts

@@ -141,14 +141,14 @@ export interface AgentMessage {
 /** Subset of AI SDK's prepareStep context. */
 export interface PrepareStepContext<M extends AgentMessage = AgentMessage> {
     stepNumber: number;
-    steps: ReadonlyArray<{
-        toolCalls?: ReadonlyArray<{
+    steps: readonly {
+        toolCalls?: readonly {
             toolName: string;
             input?: unknown;
             args?: unknown;
-        }>;
-        toolResults?: ReadonlyArray<unknown>;
-    }>;
+        }[];
+        toolResults?: readonly unknown[];
+    }[];
     messages: M[];
     model?: unknown;
 }
@@ -164,12 +164,12 @@ export interface StepFinishContext {
     stepType?: 'initial' | 'continue' | 'tool-result';
     finishReason?: string;
     text?: string;
-    toolCalls?: ReadonlyArray<{
+    toolCalls?: readonly {
         toolName: string;
         input?: unknown;
         args?: unknown;
-    }>;
-    toolResults?: ReadonlyArray<unknown>;
+    }[];
+    toolResults?: readonly unknown[];
     usage?: {
         inputTokens?: number;
         outputTokens?: number;
@@ -230,6 +230,19 @@ export interface WrapToolOptions<TArgs> {
      */
     announceOnExecute?: boolean;
 }
+/**
+ * Console-backed default logger — the SAME gated factory the `Ablo()` client
+ * uses (`createConsoleLogger`, threshold from `ABLO_LOG_LEVEL`, default
+ * `warn`), tagged `[agent]` so agent-runtime lines are distinguishable. The
+ * previous hand-rolled shim ignored the level gate entirely and printed
+ * `[perception]` engine internals at debug/info by default. Level is resolved
+ * per construction (not at module load) so `ABLO_LOG_LEVEL` set by the host
+ * process before building an Agent is honored.
+ *
+ * Exported for the unit test that pins the gating; consumers pass their own
+ * `logger` option instead.
+ */
+export declare function defaultAgentLogger(): SyncLogger;
 export declare class Agent implements PresenceAnnouncer {
     private readonly opts;
     constructor(options: AgentOptions);

package/dist/agent/Agent.js

@@ -40,17 +40,30 @@
  * for custom integrations outside the AI SDK.
  */
 import { createAgentSession } from './session.js';
+import { createConsoleLogger, resolveLogLevel } from '../client/consoleLogger.js';
 import { AbloValidationError } from '../errors.js';
 // ── Agent ───────────────────────────────────────────────────────
-// Console-backed default logger. Local to this module so the agent
-// SDK doesn't take a transitive dependency on `getContext()` (which
-// belongs to the web-app context, not standalone agent workers).
-const consoleLogger = {
-    debug: (msg, ...args) => console.debug('[agent]', msg, ...args),
-    info: (msg, ...args) => console.info('[agent]', msg, ...args),
-    warn: (msg, ...args) => console.warn('[agent]', msg, ...args),
-    error: (msg, ...args) => console.error('[agent]', msg, ...args),
-};
+/**
+ * Console-backed default logger — the SAME gated factory the `Ablo()` client
+ * uses (`createConsoleLogger`, threshold from `ABLO_LOG_LEVEL`, default
+ * `warn`), tagged `[agent]` so agent-runtime lines are distinguishable. The
+ * previous hand-rolled shim ignored the level gate entirely and printed
+ * `[perception]` engine internals at debug/info by default. Level is resolved
+ * per construction (not at module load) so `ABLO_LOG_LEVEL` set by the host
+ * process before building an Agent is honored.
+ *
+ * Exported for the unit test that pins the gating; consumers pass their own
+ * `logger` option instead.
+ */
+export function defaultAgentLogger() {
+    const gated = createConsoleLogger(resolveLogLevel());
+    return {
+        debug: (msg, ...args) => { gated.debug('[agent]', msg, ...args); },
+        info: (msg, ...args) => { gated.info('[agent]', msg, ...args); },
+        warn: (msg, ...args) => { gated.warn('[agent]', msg, ...args); },
+        error: (msg, ...args) => { gated.error('[agent]', msg, ...args); },
+    };
+}
 export class Agent {
     opts;
     constructor(options) {
@@ -63,7 +76,7 @@ export class Agent {
             syncGroups: options.syncGroups,
             fetch: options.fetch ?? globalThis.fetch.bind(globalThis),
             timeoutMs: options.timeoutMs ?? 5_000,
-            logger: options.logger ?? consoleLogger,
+            logger: options.logger ?? defaultAgentLogger(),
         };
     }
     /**
@@ -222,9 +235,10 @@ export class Agent {
                     pendingClaims,
                 };
             }
-            const body = (await res.json());
+            const body = (await (res).json());
             const rows = body.results?.[0];
-            if (!rows || rows.length === 0) {
+            const entity = rows?.[0];
+            if (!entity) {
                 return {
                     stale: true,
                     reason: 'not_found',
@@ -232,7 +246,6 @@ export class Agent {
                     pendingClaims,
                 };
             }
-            const entity = rows[0];
             const updatedAtRaw = entity.updated_at ?? entity.updatedAt;
             const lastModifiedBy = entity.updated_by ??
                 entity.updatedBy ??

package/dist/ai-sdk/coordination-context.js

@@ -38,7 +38,13 @@ export function coordinationContextMiddleware(options) {
                 return params;
             // Read peer claims on the same target. Synchronous lookup
             // against the engine's reactive claims.others array — no I/O.
-            const peerClaims = agent.claims.others.filter((claim) => claim.target.type === target.type &&
+            // Type compares case-insensitively: observed claims carry the WIRE
+            // dialect (lowercased typename, `slidedeck`), while callers naturally
+            // write the schema typename (`SlideDeck`) — the same normalization the
+            // commit plane applies (`modelMap` lookups lowercase, and
+            // `targetsOverlap` below already lowercases field/path).
+            const wantedType = target.type.toLowerCase();
+            const peerClaims = agent.claims.others.filter((claim) => claim.target.type.toLowerCase() === wantedType &&
                 claim.target.id === target.id &&
                 targetsOverlap(claim.target, target) &&
                 !excludeClaimIds.has(claim.id));
@@ -78,8 +84,8 @@ function targetsOverlap(claimTarget, target) {
  */
 function formatCoordinationNote(claims, target) {
     const entityLabel = target.type.toLowerCase();
-    if (claims.length === 1) {
-        const c = claims[0];
+    const c = claims.length === 1 ? claims[0] : undefined;
+    if (c) {
         const details = c.description ? `Declared work: ${c.description}. ` : '';
         return (`<multiplayer_context>\n` +
             `Another participant is currently editing this ${entityLabel}. ` +

package/dist/ai-sdk/wrap.d.ts

@@ -13,7 +13,7 @@
  * const wrapped = wrapWithMultiplayer({
  *   model: anthropic('claude-opus-4-7'),
  *   agent,
- *   target: { entityType: 'SlideDeck', entityId: 'deck-abc' },
+ *   target: { type: 'SlideDeck', id: 'deck-abc' },
  * });
  *
  * const result = streamText({

package/dist/ai-sdk/wrap.js

@@ -13,7 +13,7 @@
  * const wrapped = wrapWithMultiplayer({
  *   model: anthropic('claude-opus-4-7'),
  *   agent,
- *   target: { entityType: 'SlideDeck', entityId: 'deck-abc' },
+ *   target: { type: 'SlideDeck', id: 'deck-abc' },
  * });
  *
  * const result = streamText({

package/dist/auth/credentialPolicy.d.ts

@@ -22,7 +22,14 @@
  * prefix lookup so it can ship in the client bundle.
  */
 import type { exchangeApiKey, mintUserSessionKey, resolveIdentity } from './index.js';
-import type { resolveApiKeyValue } from '../client/auth.js';
+/**
+ * Structural signature of `client/auth.ts`'s `resolveApiKeyValue` — declared
+ * locally (not `typeof`-imported) because `client/auth.ts` runtime-imports
+ * {@link classifyCredentialKind} from THIS module; a back-edge here was the
+ * SDK's last auth-layer import cycle. The setter shape matches `ApiKeySetter`.
+ * `identity.ts` passes the real function; structural typing keeps them bound.
+ */
+type ResolveApiKeyValueFn = (apiKey: string | (() => Promise<string | null>) | null) => Promise<string | null>;
 /**
  * The four Ablo API-key kinds (Stripe-style). Prefix contract — kept in lockstep
  * with `keys/index.ts` `API_KEY_KINDS` / `KIND_BY_PREFIX`, but declared locally
@@ -52,7 +59,7 @@ export interface CredentialPrimitives {
     readonly exchangeApiKey: typeof exchangeApiKey;
     readonly mintUserSessionKey: typeof mintUserSessionKey;
     readonly resolveIdentity: typeof resolveIdentity;
-    readonly resolveApiKeyValue: typeof resolveApiKeyValue;
+    readonly resolveApiKeyValue: ResolveApiKeyValueFn;
 }
 export interface ResolveCredentialContext {
     readonly primitives: CredentialPrimitives;
@@ -143,3 +150,4 @@ export type ResolvedCredential =
  *   3. otherwise (identity known) → `explicit` (legacy self-hosted, no round-trip).
  */
 export declare function resolveCredential(input: ResolveCredentialInput, ctx: ResolveCredentialContext): Promise<ResolvedCredential>;
+export {};

package/dist/auth/credentialSource.d.ts

@@ -6,19 +6,7 @@
  * auth. Token refresh writes here once; consumers observe the new value
  * through their getter without being manually patched one by one.
  */
-/**
- * WebSocket subprotocols used to carry the bearer credential OUT of the URL.
- *
- * Browsers cannot set an `Authorization` header on a WebSocket, so the SDK
- * offers the token as a `Sec-WebSocket-Protocol` value — `ablo.bearer.<token>` —
- * alongside the real `ablo.sync.v1` protocol the server selects. This keeps the
- * credential out of the query string, which ALB access logs, proxies, and
- * browser history capture. The server reads the token from the subprotocol and
- * echoes back ONLY `ablo.sync.v1`, never the token-bearing value. Shared with
- * the sync-server so client and server can never drift on the wire format.
- */
-export declare const WS_BEARER_SUBPROTOCOL_PREFIX = "ablo.bearer.";
-export declare const WS_SYNC_SUBPROTOCOL = "ablo.sync.v1";
+export { WS_BEARER_SUBPROTOCOL_PREFIX, WS_SYNC_SUBPROTOCOL } from '../wire/protocol.js';
 export interface AuthCredentialSource {
     getAuthToken(): string | null;
     setAuthToken(token: string | null | undefined): void;

package/dist/auth/credentialSource.js

@@ -6,19 +6,12 @@
  * auth. Token refresh writes here once; consumers observe the new value
  * through their getter without being manually patched one by one.
  */
-/**
- * WebSocket subprotocols used to carry the bearer credential OUT of the URL.
- *
- * Browsers cannot set an `Authorization` header on a WebSocket, so the SDK
- * offers the token as a `Sec-WebSocket-Protocol` value — `ablo.bearer.<token>` —
- * alongside the real `ablo.sync.v1` protocol the server selects. This keeps the
- * credential out of the query string, which ALB access logs, proxies, and
- * browser history capture. The server reads the token from the subprotocol and
- * echoes back ONLY `ablo.sync.v1`, never the token-bearing value. Shared with
- * the sync-server so client and server can never drift on the wire format.
- */
-export const WS_BEARER_SUBPROTOCOL_PREFIX = 'ablo.bearer.';
-export const WS_SYNC_SUBPROTOCOL = 'ablo.sync.v1';
+// The WS bearer-subprotocol constants moved to `../wire/protocol.js` — they are
+// the wire contract shared with the sync-server (which imports them via
+// `@abloatai/ablo/wire`, never the root barrel). Re-exported here so
+// existing SDK-side importers (`SyncWebSocket`, `source/connector-protocol`)
+// keep their import path.
+export { WS_BEARER_SUBPROTOCOL_PREFIX, WS_SYNC_SUBPROTOCOL } from '../wire/protocol.js';
 export function createAuthCredentialSource(initialToken) {
     let authToken = normalizeToken(initialToken);
     return {