@abloatai/ablo 0.28.0 → 0.29.1

package/dist/client/Ablo.d.ts

@@ -26,12 +26,11 @@ import type { SyncStoreContract } from '../react/context.js';
 import type { SyncWebSocket } from '../sync/SyncWebSocket.js';
 import { type SyncStatus } from '../BaseSyncedStore.js';
 import type { PresenceStream, Snapshot } from '../types/streams.js';
-import { type AbloApi, type AbloApiClientOptions, type AbloApiClaims } from './ApiClient.js';
 import { type AbloHttpClient, type AbloHttpClientOptions } from './httpClient.js';
 import type { AbloOptions } from './options.js';
-import type { AbloSession, CommitResource, CreateAgentClientParams, CreateSessionParams, ModelClient } from './resourceTypes.js';
+import type { AbloSession, CommitResource, CreateAgentClientParams, CreateSessionParams } from './resourceTypes.js';
 export type { ApiKeySetter, AbloOptions, InternalAbloOptions } from './options.js';
-export type { LocalCountOptions, LocalReadOptions, ModelListScope, ServerReadOptions, ModelRetrieveParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, ClaimOptions, ClaimParams, ClaimLookupParams, ClaimReorderParams, Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, ModelOperations, ModelOperationAction, CommitWait, ModelRead, IfClaimedPolicy, ClaimedOptions, ClaimWaitOptions, ModelReadOptions, ClaimCreateOptions, CommitOperationInput, CommitCreateOptions, CommitReceipt, CommitResource, ClaimResource, ModelMutationOptions, HttpClaimApi, ModelClient, SessionOperation, CreateUserSessionParams, CreateAgentSessionParams, CreateSessionParams, CreateAgentClientParams, AbloSession, } from './resourceTypes.js';
+export type { LocalCountOptions, LocalReadOptions, ModelListScope, ServerReadOptions, ModelRetrieveParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, ClaimOptions, ClaimParams, ClaimLookupParams, ClaimReorderParams, Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, ModelOperations, ModelOperationAction, CommitWait, IfClaimedPolicy, ClaimedOptions, ClaimWaitOptions, ModelReadOptions, ClaimCreateOptions, CommitOperationInput, CommitCreateOptions, CommitReceipt, CommitResource, ClaimResource, ModelMutationOptions, HttpClaimApi, SessionOperation, CreateUserSessionParams, CreateAgentSessionParams, CreateSessionParams, CreateAgentClientParams, AbloSession, } from './resourceTypes.js';
 export { computeFKDepthPriority } from './schemaConfig.js';
 import type { ModelOperations } from './createModelProxy.js';
 /**
@@ -272,12 +271,6 @@ export type Ablo<S extends SchemaRecord> = {
      * down to `commits.create(...)`.
      */
     readonly commits: CommitResource;
-    /**
-     * Canonical untyped model API. This is the portable API shape that maps
-     * cleanly to HTTP/Python/Ruby/Go clients. Typed `ablo.<model>` properties
-     * are schema-powered sugar over the same model write/read path.
-     */
-    model<T = Record<string, unknown>>(name: string): ModelClient<T>;
     /**
      * Capture a context-staleness watermark over a set of entities.
      * Returns a flat snapshot with `stamp` (thread into writes as
@@ -337,7 +330,6 @@ export declare function Ablo<const S extends SchemaRecord>(options: AbloHttpClie
     transport: 'http';
 }): AbloHttpClient<S>;
 export declare function Ablo<const S extends SchemaRecord>(options: AbloOptions<S>): Ablo<S>;
-export declare function Ablo(options: AbloApiClientOptions): AbloApi;
 import type * as _Streams from '../types/streams.js';
 import type * as _Participants from '../sync/participants.js';
 import type * as _Policy from '../policy/types.js';
@@ -345,6 +337,7 @@ import type * as _Mutators from '../mutators/defineMutators.js';
 import type * as _Tx from '../mutators/Transaction.js';
 import type * as _Undo from '../mutators/UndoManager.js';
 import type * as _SchemaTypes from '../schema/schema.js';
+import type * as _Global from '../types/global.js';
 /**
  * The canonical type namespace.
  *
@@ -368,15 +361,6 @@ export declare namespace Ablo {
      * typed as reactive rows (data fields + computeds, no relation accessors).
      */
     type Reads<S extends SchemaRecord = SchemaRecord> = AbloReads<S>;
-    type Api = AbloApi;
-    type ApiClaims = AbloApiClaims;
-    type Capability = import('./ApiClient.js').Capability;
-    type CapabilityCreateOptions = import('./ApiClient.js').CapabilityCreateOptions;
-    type CapabilityRecord = import('./ApiClient.js').CapabilityRecord;
-    type CapabilityResource = import('./ApiClient.js').CapabilityResource;
-    type CapabilityRevocation = import('./ApiClient.js').CapabilityRevocation;
-    type CapabilityRotateOptions = import('./ApiClient.js').CapabilityRotateOptions;
-    type RotatedCapability = import('./ApiClient.js').RotatedCapability;
     type IfClaimedPolicy = import('./resourceTypes.js').IfClaimedPolicy;
     type ClaimedOptions = import('./resourceTypes.js').ClaimedOptions;
     type ClaimTarget = _Streams.ClaimTarget;
@@ -404,6 +388,25 @@ export declare namespace Ablo {
         type JoinOptions = _Participants.ParticipantJoinOptions;
     }
     type Schema<S extends _SchemaTypes.SchemaRecord = _SchemaTypes.SchemaRecord> = _SchemaTypes.Schema<S>;
+    /**
+     * The schema this program has registered via `interface Register { Schema }`
+     * (falls back to a loose shape when unregistered). Use it where shared code
+     * needs "this app's schema" without importing a specific one —
+     * `Ablo<Ablo.ResolveSchema['models']>` resolves to whatever the consuming
+     * app registered, so one component types correctly across apps that bind
+     * different schemas.
+     */
+    type ResolveSchema = _Global.ResolveSchema;
+    /**
+     * `ResolveSchema` guaranteed to satisfy the `Schema` bound. `ResolveSchema`
+     * falls back to a loose `{ models }` shape when nothing is registered, which
+     * doesn't extend the branded `Schema` type — so generics bounded by `Schema`
+     * (mutator anchors, `Transaction<S>`) can't take `ResolveSchema` directly.
+     * `RegisteredSchema` collapses that fallback to `Schema`, so shared mutator
+     * code can anchor "this app's schema" and stay assignable at the consumer,
+     * which reads the same `Register`. Both resolve in lockstep per app.
+     */
+    type RegisteredSchema = _Global.ResolveSchema extends _SchemaTypes.Schema ? _Global.ResolveSchema : _SchemaTypes.Schema;
     namespace Schema {
         type InferModel<S extends _SchemaTypes.Schema, K extends keyof S['models']> = _SchemaTypes.InferModel<S, K>;
         type InferCreate<S extends _SchemaTypes.Schema, K extends keyof S['models']> = _SchemaTypes.InferCreate<S, K>;
@@ -433,6 +436,7 @@ export declare namespace Ablo {
     }
     namespace Claim {
         type Handle = import('./resourceTypes.js').Claim;
+        type Held<T = Record<string, unknown>> = import('../types/streams.js').HeldClaim<T>;
         type CreateOptions = import('./resourceTypes.js').ClaimCreateOptions;
         type WaitOptions = import('./resourceTypes.js').ClaimWaitOptions;
         type Client = import('./resourceTypes.js').ClaimResource;
@@ -440,9 +444,11 @@ export declare namespace Ablo {
     namespace Model {
         type Target = import('./resourceTypes.js').ModelTarget;
         type Claim = import('./resourceTypes.js').ModelClaim;
-        type Read<T = Record<string, unknown>> = import('./resourceTypes.js').ModelRead<T>;
-        type Client<T = Record<string, unknown>> = import('./resourceTypes.js').ModelClient<T>;
-        type ReadOptions = import('./resourceTypes.js').ModelReadOptions;
+        type Operations<T, CreateInput = T> = import('./createModelProxy.js').ModelOperations<T, CreateInput>;
+        type ClaimOptions<T = Record<string, unknown>> = import('./createModelProxy.js').ClaimOptions<T>;
+        type ClaimParams<T = Record<string, unknown>> = import('./createModelProxy.js').ClaimParams<T>;
+        type ClaimLookupParams<T = Record<string, unknown>> = import('./createModelProxy.js').ClaimLookupParams<T>;
+        type ClaimReorderParams<T = Record<string, unknown>> = import('./createModelProxy.js').ClaimReorderParams<T>;
         type MutationOptions = import('./resourceTypes.js').ModelMutationOptions;
     }
     namespace Source {
@@ -452,7 +458,7 @@ export declare namespace Ablo {
         type EventsResult = import('../source/index.js').SourceEventsResult;
         type Scope = import('../source/index.js').SourceScope;
         type ApiKey = import('../source/index.js').SourceApiKey;
-        type Options<S extends _SchemaTypes.SchemaRecord = _SchemaTypes.SchemaRecord, TAuth = unknown> = import('../source/index.js').AbloSourceOptions<S, TAuth>;
+        type Options<S extends _SchemaTypes.SchemaRecord = _SchemaTypes.SchemaRecord, TAuth = unknown> = import('../source/index.js').DataSourceOptions<S, TAuth>;
         type ModelHandlers<Row, CreateInput, TAuth = unknown> = import('../source/index.js').SourceModelHandlers<Row, CreateInput, TAuth>;
         type SignatureVerificationResult = import('../source/index.js').SourceSignatureVerificationResult;
         namespace Commit {

package/dist/client/Ablo.js

@@ -19,7 +19,7 @@
  *   await sync.reports.delete({ id: reportId });
  */
 import { durableCommitOperationSchema, } from '../transactions/commitEnvelope.js';
-import { AbloAuthenticationError, AbloConnectionError, AbloValidationError, AbloNotFoundError, translateHttpError, toAbloError, claimedError } from '../errors.js';
+import { AbloAuthenticationError, AbloConnectionError, AbloValidationError, toAbloError, claimedError } from '../errors.js';
 import { descriptionFromMeta } from '../coordination/schema.js';
 import { initSyncEngine } from '../context.js';
 import { noopObservability, browserOnlineStatus, defaultSessionErrorDetector, noopAnalytics, } from '../SyncEngineContext.js';
@@ -36,10 +36,8 @@ import { createPresenceStream } from '../sync/createPresenceStream.js';
 import { createClaimStream } from '../sync/createClaimStream.js';
 import { awaitClaimGrant } from '../sync/awaitClaimGrant.js';
 import { createSnapshot } from '../sync/createSnapshot.js';
-import { reconcileFunctionalUpdate } from './functionalUpdate.js';
 import { createParticipantManager } from '../sync/participants.js';
-import { createProtocolClient, } from './ApiClient.js';
-// Value import is cycle-safe: httpClient.js and ApiClient.js take the client
+// Value import is cycle-safe: httpClient.js and httpTransport.js take the client
 // types from the `options`/`resourceTypes` leaves, never from this module.
 import { createAbloHttpClient, } from './httpClient.js';
 import { assertBrowserSafety, readProcessEnv, resolveApiKey, resolveApiKeyValue, resolveAuthToken, resolveBaseURL, resolveBootstrapBaseUrl, resolveDatabaseUrl, warnIfCliKeyMismatch, warnIfDatabaseUrlEnvIgnored, warnIfDatabaseUrlDeprecated, } from './auth.js';
@@ -75,11 +73,6 @@ function resolveCredentialResolver(apiKey) {
     return null;
 }
 export function Ablo(options) {
-    if (options.schema == null) {
-        // The protocol client IS the stateless HTTP plane (string-keyed models),
-        // so `transport: 'http'` needs no special-casing here.
-        return createProtocolClient(options);
-    }
     if (options.transport === 'http') {
         return createAbloHttpClient(options);
     }
@@ -490,10 +483,6 @@ export function Ablo(options) {
             await new Promise((resolve) => setTimeout(resolve, 50));
         }
     }
-    const fetchImpl = options.fetch ?? globalThis.fetch;
-    function authHeaders() {
-        return authCredentials.withAuthHeaders({ 'Content-Type': 'application/json' });
-    }
     function createClientTxId(idempotencyKey) {
         if (idempotencyKey && idempotencyKey.length > 0)
             return idempotencyKey;
@@ -501,32 +490,12 @@ export function Ablo(options) {
             ? crypto.randomUUID()
             : `tx_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
     }
-    function createModelId() {
-        return typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
-            ? crypto.randomUUID()
-            : `id_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-    }
-    function normalizeClaimId(claim) {
-        if (typeof claim === 'string')
-            return claim;
-        return claim?.id;
-    }
-    function isClaimHandleValue(value) {
-        return (typeof value === 'object' &&
-            value !== null &&
-            value.object === 'claim' &&
-            typeof value.id === 'string');
-    }
     function normalizeCommitOperation(op, defaults) {
-        const model = op.model ?? op.target?.model;
-        if (!model) {
-            throw new AbloValidationError('Commit operation requires `model` or `target.model`.', { code: 'commit_operation_model_required' });
-        }
         const type = op.action.toUpperCase();
-        const id = op.id ?? op.target?.id ?? '';
+        const id = op.id ?? '';
         return durableCommitOperationSchema.parse({
             type,
-            model: model.toLowerCase(),
+            model: op.model.toLowerCase(),
             id,
             input: op.data ?? undefined,
             transactionId: op.transactionId ?? undefined,
@@ -535,16 +504,10 @@ export function Ablo(options) {
         });
     }
     function normalizeCommitOperations(commitOptions) {
-        if (commitOptions.operation && commitOptions.operations) {
-            throw new AbloValidationError('Pass either `operation` or `operations`, not both.', { code: 'commit_operations_ambiguous' });
+        if (commitOptions.operations.length === 0) {
+            throw new AbloValidationError('Commit requires a non-empty `operations` array.', { code: 'commit_operation_required' });
         }
-        const inputOperations = commitOptions.operation
-            ? [commitOptions.operation]
-            : commitOptions.operations ?? [];
-        if (inputOperations.length === 0) {
-            throw new AbloValidationError('Commit requires at least one operation.', { code: 'commit_operation_required' });
-        }
-        return inputOperations.map((op) => normalizeCommitOperation(op, commitOptions));
+        return commitOptions.operations.map((op) => normalizeCommitOperation(op, commitOptions));
     }
     function modelClaimFromActive(claim) {
         const description = descriptionFromMeta(claim.target.meta);
@@ -632,16 +595,6 @@ export function Ablo(options) {
             }
         });
     }
-    async function applyClaimedPolicy(target, options) {
-        const policy = options?.ifClaimed ?? 'return';
-        if (policy === 'return')
-            return;
-        const current = listModelClaims(target);
-        if (current.length === 0)
-            return;
-        // policy === 'fail' — gate the read only when the caller opts in.
-        throw claimedError(target, current, 'model_claimed');
-    }
     function wrapClaimHandle(claim, waited = false) {
         const release = async () => {
             claim.revoke?.();
@@ -806,8 +759,6 @@ export function Ablo(options) {
                 onStale: commitOptions.onStale ?? (claim?.readAt !== undefined ? 'reject' : null),
             });
             const wait = commitOptions.wait ?? 'confirmed';
-            const claimId = normalizeClaimId(commitOptions.claimRef) ?? claim?.id;
-            void claimId; // The current wire clears claims by entity after commit.
             // Route through the TransactionQueue's commit lane so the call
             // tolerates WS disconnects: the envelope stays in memory until
             // reconnect, mutationExecutor.commit() owns transport-level
@@ -833,144 +784,6 @@ export function Ablo(options) {
             };
         },
     };
-    async function retrieveModel(modelName, id, options) {
-        await applyClaimedPolicy({ model: modelName, id }, options);
-        await ready();
-        const res = await fetchImpl(`${bootstrapHelper.baseUrl}/sync/query`, {
-            method: 'POST',
-            headers: authHeaders(),
-            body: JSON.stringify({
-                queries: [
-                    {
-                        model: modelName,
-                        where: [['id', '=', id]],
-                        limit: 1,
-                    },
-                ],
-            }),
-        });
-        const bodyText = await res.text();
-        let body = bodyText;
-        if (bodyText.length > 0) {
-            try {
-                body = JSON.parse(bodyText);
-            }
-            catch {
-                // Keep raw body text.
-            }
-        }
-        if (!res.ok) {
-            throw translateHttpError(res.status, body || `Model retrieve failed: ${res.status} ${res.statusText}`, res.headers.get('x-request-id') ?? undefined);
-        }
-        const parsed = body;
-        const slot = parsed.results?.[0];
-        const rows = Array.isArray(slot) ? slot : [];
-        const data = rows[0];
-        if (!data) {
-            throw new AbloValidationError(`Model row not found: ${modelName}/${id}`, { code: 'model_not_found' });
-        }
-        const stamp = typeof parsed.lastSyncId === 'number'
-            ? parsed.lastSyncId
-            : store.getSyncWebSocket()?.getLastSyncId() ?? store.lastSyncId ?? 0;
-        return {
-            data,
-            stamp,
-            claims: listModelClaims({ model: modelName, id }),
-        };
-    }
-    function model(name) {
-        function updateModel(arg, updater, contention) {
-            if (typeof arg === 'string') {
-                const id = arg;
-                if (typeof updater !== 'function') {
-                    throw new AbloValidationError(`${name}.update('${id}', updater): the second argument must be an updater ` +
-                        `function (current) => next. To write a fixed value, use update({ id, data }).`, { code: 'write_options_invalid' });
-                }
-                return reconcileFunctionalUpdate(updater, contention, {
-                    model: name,
-                    id,
-                    readFresh: async () => {
-                        const read = await retrieveModel(name, id, {});
-                        return { data: read.data, stamp: read.stamp };
-                    },
-                    writeNext: (patch, readAt) => commits.create({
-                        readAt,
-                        onStale: 'reject',
-                        wait: 'confirmed',
-                        operations: [
-                            { action: 'update', model: name, id, data: patch },
-                        ],
-                    }),
-                });
-            }
-            const params = arg;
-            return (async () => {
-                await applyClaimedPolicy({ model: name, id: params.id }, params);
-                return commits.create({
-                    claimRef: params.claimRef,
-                    idempotencyKey: params.idempotencyKey,
-                    readAt: params.readAt,
-                    onStale: params.onStale,
-                    ...(isClaimHandleValue(params.claim) ? { claim: params.claim } : {}),
-                    wait: params.wait,
-                    operations: [
-                        { action: 'update', model: name, id: params.id, data: params.data },
-                    ],
-                });
-            })();
-        }
-        return {
-            retrieve(params) {
-                return retrieveModel(name, params.id, params);
-            },
-            async create(params) {
-                const id = params.id ?? createModelId();
-                await applyClaimedPolicy({ model: name, id }, params);
-                // Confirm, then return the authoritative row (with framework defaults;
-                // the existing row on an idempotent re-create) — mirrors the WebSocket client.
-                await commits.create({
-                    claimRef: params.claimRef,
-                    idempotencyKey: params.idempotencyKey,
-                    readAt: params.readAt,
-                    onStale: params.onStale,
-                    ...(isClaimHandleValue(params.claim) ? { claim: params.claim } : {}),
-                    wait: params.wait ?? 'confirmed',
-                    operations: [
-                        {
-                            action: 'create',
-                            model: name,
-                            id,
-                            data: params.data,
-                        },
-                    ],
-                });
-                const { data } = await retrieveModel(name, id, {});
-                if (data === undefined) {
-                    throw new AbloNotFoundError(`create ${name}/${id} did not yield a readable row (the write did not confirm).`, [id]);
-                }
-                return data;
-            },
-            update: updateModel,
-            async delete(params) {
-                await applyClaimedPolicy({ model: name, id: params.id }, params);
-                return commits.create({
-                    claimRef: params.claimRef,
-                    idempotencyKey: params.idempotencyKey,
-                    readAt: params.readAt,
-                    onStale: params.onStale,
-                    ...(isClaimHandleValue(params.claim) ? { claim: params.claim } : {}),
-                    wait: params.wait,
-                    operations: [
-                        {
-                            action: 'delete',
-                            model: name,
-                            id: params.id,
-                        },
-                    ],
-                });
-            },
-        };
-    }
     /**
      * The control-plane credential: always the original configured secret key.
      * Never reads `authCredentials` — that holds the exchanged sync credential
@@ -1072,7 +885,7 @@ export function Ablo(options) {
             },
         },
         // Mint a scoped agent identity and hand back a connected client bound to it —
-        // `sessions.create({ agent })` plus `Ablo({ apiKey })` fused into one call,
+        // `sessions.create({ agent })` plus a typed `Ablo({ schema, apiKey })` client,
         // for agents that run in this (secret-key-holding) process. Omitting `id`
         // yields a fresh uuid per call, so concurrent agents are distinct participants
         // that queue behind each other (even when they share a `name`). Humans don't
@@ -1178,7 +991,6 @@ export function Ablo(options) {
         /** Claim livestream — same socket. Stable reference. */
         claims: publicClaims,
         commits,
-        model,
         /** Context-staleness snapshot — see `engine.snapshot(...)` JSDoc. */
         snapshot(entities) {
             return createSnapshot({

package/dist/client/claimHeartbeatLoop.d.ts

@@ -1,7 +1,7 @@
 /**
  * The auto-heartbeat loop behind `claim({ id, heartbeat: true })` — one
  * implementation shared by both transports (the WebSocket claim stream and the
- * HTTP `ApiClient`), so the cadence and failure semantics cannot drift.
+ * private HTTP transport), so the cadence and failure semantics cannot drift.
  *
  * A beat is the "still working" signal that keeps a lease alive for the
  * duration of real work. The loop's failure handling follows the lease-system

package/dist/client/claimHeartbeatLoop.js

@@ -1,7 +1,7 @@
 /**
  * The auto-heartbeat loop behind `claim({ id, heartbeat: true })` — one
  * implementation shared by both transports (the WebSocket claim stream and the
- * HTTP `ApiClient`), so the cadence and failure semantics cannot drift.
+ * private HTTP transport), so the cadence and failure semantics cannot drift.
  *
  * A beat is the "still working" signal that keeps a lease alive for the
  * duration of real work. The loop's failure handling follows the lease-system

package/dist/client/createInternalComponents.d.ts

@@ -16,7 +16,7 @@ import { BootstrapFetcher } from '../sync/BootstrapFetcher.js';
 import type { AuthCredentialSource } from '../auth/credentialSource.js';
 import type { Schema, SchemaRecord } from '../schema/schema.js';
 import { type AbloPersistence } from './persistence.js';
-import type { CommitOutboxStore } from '../transactions/commitOutboxStore.js';
+import type { DurableWriteStore, DurableWritesConfig } from '../transactions/durableWriteStore.js';
 export interface InternalComponentsInput<S extends SchemaRecord> {
     readonly schema: Schema<S>;
     /** The WebSocket URL. Used to derive the bootstrap HTTP base URL when the
@@ -29,7 +29,9 @@ export interface InternalComponentsInput<S extends SchemaRecord> {
         readonly persistence?: AbloPersistence;
         readonly offline?: boolean;
         readonly inMemory?: boolean;
-        readonly commitOutbox?: CommitOutboxStore;
+        readonly durableWrites?: DurableWritesConfig;
+        /** @deprecated Use `durableWrites`. */
+        readonly commitOutbox?: DurableWriteStore;
     };
     readonly auth?: AuthCredentialSource;
 }

package/dist/client/createInternalComponents.js

@@ -15,6 +15,7 @@ import { OnDemandLoader } from '../sync/OnDemandLoader.js';
 import { BootstrapFetcher } from '../sync/BootstrapFetcher.js';
 import { resolveBootstrapBaseUrl } from './auth.js';
 import { shouldUseInMemoryPersistence } from './persistence.js';
+import { resolveDurableWrites } from './durableWrites.js';
 export function createInternalComponents(input) {
     const { schema, url, options, auth } = input;
     // The registry is created here, but model registration happens in the caller,
@@ -41,7 +42,8 @@ export function createInternalComponents(input) {
         // IndexedDB is unavailable there.
         inMemory: shouldUseInMemoryPersistence(options),
     });
-    const syncClient = new SyncClient(objectPool, database, options.commitOutbox, url);
+    const durableWrites = resolveDurableWrites(options);
+    const syncClient = new SyncClient(objectPool, database, durableWrites.store, durableWrites.namespace ?? url);
     // Lazy-load lane: hydrates the object pool and IndexedDB on demand for
     // entities not in scope at bootstrap (`load: 'lazy'` models, or an entity
     // reached by deep link before the pool warmed up). Single-flight, with

package/dist/client/durableWrites.d.ts

@@ -0,0 +1,21 @@
+/** Normalize the product-facing durable-write option and its legacy aliases. */
+import type { CommitOutboxScope } from '../transactions/commitEnvelope.js';
+import { type DurableWriteStore, type DurableWritesConfig } from '../transactions/durableWriteStore.js';
+interface DurableWriteOptionInput {
+    readonly durableWrites?: DurableWritesConfig;
+    /** Compatibility input for pre-`durableWrites` clients. */
+    readonly commitOutbox?: DurableWriteStore;
+    /** Compatibility input and internal child-client identity seam. */
+    readonly commitOutboxScope?: CommitOutboxScope;
+}
+export interface ResolvedDurableWrites {
+    readonly store?: DurableWriteStore;
+    readonly namespace?: string;
+}
+/**
+ * Resolves one canonical store configuration for both HTTP and WebSocket
+ * clients. Mixed old/new configuration fails loudly so Ablo never persists to
+ * one adapter while the caller believes another adapter is authoritative.
+ */
+export declare function resolveDurableWrites(options: DurableWriteOptionInput): ResolvedDurableWrites;
+export {};

package/dist/client/durableWrites.js

@@ -0,0 +1,46 @@
+/** Normalize the product-facing durable-write option and its legacy aliases. */
+import { AbloValidationError } from '../errors.js';
+import { durableWritesConfigSchema, durableWriteStoreSchema, } from '../transactions/durableWriteStore.js';
+function invalidDurableWrites(message) {
+    return new AbloValidationError(`Ablo: invalid \`durableWrites\` option — ${message}.`, {
+        code: 'invalid_options',
+        param: 'durableWrites',
+    });
+}
+/**
+ * Resolves one canonical store configuration for both HTTP and WebSocket
+ * clients. Mixed old/new configuration fails loudly so Ablo never persists to
+ * one adapter while the caller believes another adapter is authoritative.
+ */
+export function resolveDurableWrites(options) {
+    if (options.durableWrites !== undefined && options.commitOutbox !== undefined) {
+        throw invalidDurableWrites('pass `durableWrites` or the deprecated `commitOutbox`, not both');
+    }
+    if (options.durableWrites !== undefined) {
+        const parsed = durableWritesConfigSchema.safeParse(options.durableWrites);
+        if (!parsed.success) {
+            throw invalidDurableWrites(parsed.error.issues.map((issue) => issue.message).join('; '));
+        }
+        return {
+            store: parsed.data.store,
+            ...(parsed.data.namespace !== undefined
+                ? { namespace: parsed.data.namespace }
+                : options.commitOutboxScope?.namespace !== undefined
+                    ? { namespace: options.commitOutboxScope.namespace }
+                    : {}),
+        };
+    }
+    if (options.commitOutbox !== undefined) {
+        const parsed = durableWriteStoreSchema.safeParse(options.commitOutbox);
+        if (!parsed.success) {
+            throw invalidDurableWrites(parsed.error.issues.map((issue) => issue.message).join('; '));
+        }
+        return {
+            store: parsed.data,
+            ...(options.commitOutboxScope?.namespace !== undefined
+                ? { namespace: options.commitOutboxScope.namespace }
+                : {}),
+        };
+    }
+    return {};
+}

package/dist/client/httpClient.d.ts

@@ -1,32 +1,15 @@
-/**
- * Creates a stateless, typed HTTP client for server-side actors — agents,
- * workers, and serverless handlers. It talks to Ablo over plain request/response
- * HTTP, uses the bearer credential as its identity, and holds no WebSocket and no
- * connection state.
- *
- * This is the counterpart to the stateful {@link Ablo} client. The stateful
- * client is for interactive participants: it opens a WebSocket, learns its
- * identity (user id and organization id) during the connect-and-bootstrap step,
- * and routes writes through a queue that waits for that identity. A server-side
- * actor has no socket, so instead of reusing that machinery it uses this client,
- * where the credential itself carries identity and the server resolves it on
- * every request.
- *
- * Under the hood this wraps the schema-agnostic protocol client that
- * {@link createProtocolClient} returns in a typed proxy. The protocol client
- * commits over `POST /v1/commits` and reads over HTTP, authenticating with the
- * bearer token each time; its model access is string-keyed (`api.model('slides')`).
- * The proxy gives server code the same typed `client.<model>` surface the
- * stateful client offers, over stateless transport.
- */
-import { type AbloApiClientOptions } from './ApiClient.js';
-import type { CommitReceipt, CommitResource, HttpClaimApi, ModelRead, ModelReadOptions, CreateSessionParams, AbloSession } from './resourceTypes.js';
+import type { AbloOptions } from './options.js';
+import type { CommitResource, HttpClaimApi, ModelReadOptions, CreateSessionParams, AbloSession } from './resourceTypes.js';
 import type { ModelCreateParams, ModelDeleteParams, ServerReadOptions, ModelRetrieveParams, ModelUpdateParams } from './createModelProxy.js';
 import type { Schema, SchemaRecord, InferModel, InferCreate } from '../schema/schema.js';
 import type { ModelUpdater, ContentionOptions } from './functionalUpdate.js';
-export interface AbloHttpClientOptions<S extends SchemaRecord> extends Omit<AbloApiClientOptions, 'schema'> {
-    /** The schema. Used only to type the model proxies; it is never sent over the wire or read at runtime. */
-    readonly schema: Schema<S>;
+export interface AbloHttpClientOptions<S extends SchemaRecord> extends AbloOptions<S> {
+    /**
+     * Per-request deadline. A black-holed HTTP request otherwise has no platform
+     * timeout and can stall a headless worker forever. Pass `0` to disable it.
+     * @default 30_000
+     */
+    readonly timeoutMs?: number;
 }
 /**
  * The per-model surface of the stateless HTTP client — everything reachable over
@@ -37,14 +20,14 @@ export interface AbloHttpClientOptions<S extends SchemaRecord> extends Omit<Ablo
  * need a persistent socket; those are absent from the type, so reaching for one
  * is a compile error rather than a runtime gap.
  *
- * The read shapes differ on purpose. `retrieve` returns a {@link ModelRead}
- * envelope of `{ data, stamp, claims }`, because a stateless client keeps no local
- * copy of the data: the watermark (`stamp`) and any active claims must travel
- * inline on the read so a caller can follow it with a stale-guarded write. `list`
- * returns a plain array.
+ * The typed model contract is transport-independent: `retrieve` returns one row,
+ * `list` returns rows, `create`/`update` return the resulting row, and `delete`
+ * returns nothing. The low-level protocol client keeps its read watermark and
+ * commit receipt envelopes internally; callers should not have to change data
+ * access syntax when they switch transport.
  */
 export interface HttpModelClient<T, C = T> {
-    retrieve(params: ModelRetrieveParams & ModelReadOptions): Promise<ModelRead<T>>;
+    retrieve(params: ModelRetrieveParams & ModelReadOptions): Promise<T | undefined>;
     list(options?: ServerReadOptions<T>): Promise<T[]>;
     /**
      * Creates a row and returns the confirmed server row, including any
@@ -52,7 +35,7 @@ export interface HttpModelClient<T, C = T> {
      * id that already exists is idempotent: the existing row is returned unchanged.
      */
     create(params: ModelCreateParams<T, C>): Promise<T>;
-    update(params: ModelUpdateParams<C>): Promise<CommitReceipt>;
+    update(params: ModelUpdateParams<T>): Promise<T>;
     /**
      * Updates a row with a function of its latest value — `update(id, current =>
      * next)`, the data-layer equivalent of a `setState(prev => next)` reducer. The
@@ -62,8 +45,8 @@ export interface HttpModelClient<T, C = T> {
      * lands or throws `AbloContentionError` once its retry budget is spent. Return
      * `null` or `undefined` from the updater to skip the write.
      */
-    update(id: string, updater: ModelUpdater<T>, options?: ContentionOptions): Promise<CommitReceipt | undefined>;
-    delete(params: ModelDeleteParams<T>): Promise<CommitReceipt>;
+    update(id: string, updater: ModelUpdater<T>, options?: ContentionOptions): Promise<T | undefined>;
+    delete(params: ModelDeleteParams<T>): Promise<void>;
     claim: HttpClaimApi<T>;
 }
 /**
@@ -90,17 +73,8 @@ export type AbloHttpClient<S extends SchemaRecord> = {
      * request, so it is available here even though the local-cache reads are not.
      * Pass `{ user }` to mint an end-user key (`ek_`) or `{ agent, can }` to mint a
      * scoped agent key (`rk_`). See {@link CreateSessionParams}.
-     */
+    */
     readonly sessions: {
         create(params: CreateSessionParams<S>): Promise<AbloSession>;
     };
-    /** Looks up a model client by name, for when the model name is only known at runtime. */
-    model<T = Record<string, unknown>>(name: string): HttpModelClient<T>;
 };
-/**
- * Builds the stateless, typed HTTP client. Each `client.<model>` resolves to the
- * protocol client's model accessor, while `commits`, `dispose`, and the other
- * protocol members pass through unchanged. No socket is ever opened; the bearer
- * credential is the identity.
- */
-export declare function createAbloHttpClient<S extends SchemaRecord>(options: AbloHttpClientOptions<S>): AbloHttpClient<S>;