@abloatai/ablo 0.29.2 → 0.30.0

package/dist/cli.cjs

@@ -276809,15 +276809,12 @@ var ERROR_CODES = {
   jwt_org_membership_denied: wire("auth", 403, false, "The bearer JWT's subject is not an active member of the organization in its `org_id` claim (removed, suspended, or the claim does not match a membership)."),
   file_upload_auth_required: wire("auth", 401, false, "File uploads require an authenticated session. Sign in and retry."),
   browser_apikey_blocked: client("auth", "A raw API key was used from a browser, where anyone can read it. Keep secret keys server-side and hand the browser a short-lived ephemeral key instead."),
-  browser_database_url_blocked: client("auth", "A database connection string was used from a browser context. It carries database credentials, so it must stay server-side."),
-  datasource_registration_failed: client("auth", "The provided `databaseUrl` could not be registered as a data source. Check that the connection string is valid and the database is reachable."),
   datasource_connection_unsupported: wire("validation", 400, false, "This deployment does not accept direct connection-string data sources. Register a signed Data Source endpoint instead."),
-  datasource_direct_deprecated: wire("validation", 410, false, "The direct (connection string) datasource is deprecated. Register a signed Data Source endpoint instead \u2014 your app owns the write and your credentials never leave it."),
   // ── permission / capability (403) ──────────────────────────────────
   capability_scope_denied: wire("capability", 403, false, "This action falls outside the scope granted to the connection, so it was denied."),
   issuer_register_forbidden: wire("permission", 403, false, "Registering a trusted issuer requires a secret (`sk_`) API key. The key presented is not a secret key."),
   capability_invalid: wire("capability", 403, false, "This capability cannot be used \u2014 it is unknown, revoked, or expired. Request a fresh grant."),
-  test_database_not_registered: wire("permission", 403, false, "Test mode requires a registered dev database for this org \u2014 run `npx ablo init`, or construct the client with `databaseUrl` using your test key."),
+  test_database_not_registered: wire("permission", 403, false, "Test mode requires a registered dev database for this org \u2014 run `npx ablo init` to register one for your test key."),
   tenant_routing_failed: wire("server", 500, true, "The org's registered database could not be resolved or dialed. Ablo never falls back to shared storage for a dedicated tenant \u2014 retry, and check the datasource status if it persists."),
   database_role_cannot_enforce_rls: wire("permission", 403, false, "The database role Ablo connects with is a superuser or has `BYPASSRLS`, so Postgres will not enforce row-level security for it. Connect with a role that is subject to RLS."),
   database_role_unreadable: wire("permission", 403, false, "Ablo could not introspect the database role it connects with, so it cannot verify that row-level security is enforced."),
@@ -276837,6 +276834,7 @@ var ERROR_CODES = {
   // behind the holder (`ablo.<model>.claim`), or re-read and rebase.
   claim_conflict: wire("claim", 409, false, "Another participant holds a claim on this row, so the write was rejected. Take a claim with `ablo.<model>.claim` to queue fairly behind the holder, or re-read and rebase."),
   claim_lost: wire("claim", 409, false, "The claim held on this row was lost before the write could apply. Re-acquire the claim and retry."),
+  fence_token_stale: wire("claim", 409, false, "This write carried a fencing token below the row\u2019s current high-water: a later holder claimed the row, wrote, and moved on while this claim was lapsed, so applying the write would silently overwrite their work. The claim is gone \u2014 re-claim the row and retry from the current state."),
   entity_claimed: wire("claim", 409, false, "This row is currently claimed by another participant, so the write was blocked. Queue behind the holder with `ablo.<model>.claim`, or wait for the claim to clear."),
   malformed_claim: wire("claim", 400, false, "The claim payload could not be parsed. A claim must name the model and the entity it targets; check the payload shape and resend."),
   malformed_subscription: wire("validation", 400, false, "The `update_subscription` payload was malformed; expected `{ syncGroups: string[] }`."),
@@ -276857,6 +276855,8 @@ var ERROR_CODES = {
   contention_exhausted: client("conflict", "A functional update kept losing to concurrent writes and exhausted its reconcile budget. Back off and retry, raise `retries`, or move the row to the WebSocket transport."),
   update_aborted: client("conflict", "The functional update was aborted via its `AbortSignal` before the write landed; nothing was written."),
   idempotency_conflict: wire("conflict", 409, false, "This `Idempotency-Key` was already used with a different request body. Reuse a key only to retry an identical request; otherwise generate a new one."),
+  idempotency_key_expired: wire("conflict", 409, false, "This idempotency key belongs to an expired retained source intent and cannot be executed again safely. Use a new key only for a genuinely new write."),
+  source_transport_pinned: wire("conflict", 409, false, "An earlier attempt under this idempotency key was pinned to a different source transport. Restore that route and retry the same key; Ablo will not switch a possibly committed write."),
   idempotency_key_too_long: wire("validation", 400, false, "The supplied `Idempotency-Key` exceeds the maximum length. Use a shorter key \u2014 a UUID works well."),
   // ── validation (400 / 422) ─────────────────────────────────────────
   write_options_invalid: client("validation", "The write options (`idempotencyKey` / `label` / `wait` / `readAt` / `onStale` / `claim`) failed validation against the write-options schema."),
@@ -276946,9 +276946,12 @@ var ERROR_CODES = {
   exchange_malformed_response: wire("transport", 502, true, "The credential exchange returned a response that could not be parsed. Retrying may succeed."),
   exchange_network_error: wire("transport", 503, true, "A network error interrupted the credential exchange. Check connectivity and retry."),
   source_network_error: wire("transport", 503, true, "A network error occurred while talking to the data source. Check connectivity and retry."),
+  source_unreachable: wire("transport", 503, true, "Ablo could not safely reach the registered direct data source before completing the write. The write remains pinned to direct; retry the same idempotency key after connectivity recovers."),
+  data_source_blocked: wire("transport", 503, false, "The plane's data source is not in a verified, resolvable state. Fix its registration, secret, or configuration; Ablo will not fall through to hosted storage."),
   identity_network_error: wire("transport", 503, true, "A network error occurred while resolving your identity. Check connectivity and retry."),
   commit_no_result: wire("transport", 504, true, "The commit was sent, but no result frame arrived, so its outcome is unknown. It is safe to retry."),
   commit_failed: wire("transport", 500, true, "The commit reached the server but failed to apply. Retrying may succeed."),
+  replication_lag_timeout: wire("transport", 504, true, "The data source accepted the write, but its correlated authoritative source delta did not arrive before the confirmation deadline. The write may still materialize; retry with the same idempotency key or wait for source ingestion to recover."),
   commit_offline_grace_expired: wire("transport", 503, false, "The offline grace window expired before this commit could be sent, so it was not applied. Re-apply the change once the connection returns."),
   queue_too_deep: wire("transport", 503, true, "The transaction queue is over its depth limit, so new writes are being rejected until it drains. Retry shortly."),
   flush_timeout: wire("transport", 504, true, "Flushing the transaction queue timed out before every pending write was sent. Retry once connectivity stabilizes."),
@@ -277030,6 +277033,8 @@ var ERROR_CODES = {
   invalid_id: wire("validation", 400, false, "The id in the request is not a valid identifier."),
   unknown_model: wire("tenant", 400, false, "Named a model the server does not know. Run `ablo push` (or keep `ablo dev` running) to upload `ablo/schema.ts` \u2014 the server keeps its own copy of the schema."),
   model_not_tenant_scoped: wire("tenant", 400, false, "This model is not tenant-scoped, so it cannot be queried through the tenant-scoped read path."),
+  source_tenancy_not_enforced: wire("tenant", 400, false, "This model is scoped by its connected data source (`policy: { by: 'source' }`), so its tenant is resolved from the source registration rather than a row column. Enforcing that resolution requires the write-through connect path, which is not enabled on this plane yet \u2014 so the model cannot be served through the tenant-scoped read or bootstrap path without risking a cross-tenant read. If this model lives on a log plane, scope it with `by: 'column'` or `by: 'parent'` instead."),
+  model_not_provisioned: wire("tenant", 409, false, "This model is in the plane's registered schema, but its table has not been provisioned yet. Registering a schema with `ablo push` records the model; a plane's physical tables are created separately, out of band, so a model can appear in the schema before its table exists. Provision the plane's tables, then retry the read."),
   schema_table_invalid: wire("schema", 500, false, "The model's table identifier is invalid."),
   schema_scope_invalid: wire("schema", 500, false, "The model's scope predicate could not be built."),
   entity_fetch_failed: wire("server", 500, true, "The server failed to fetch the requested entity. It is safe to retry."),
@@ -277219,17 +277224,30 @@ var claimStatusSchema = import_zod3.z.enum([
 ]);
 var wireClaimBaseSchema = targetRefSchema.extend({
   claimId: import_zod3.z.string(),
-  /** Human-readable phase: 'editing' | 'reviewing' | 'forecasting' … */
-  reason: import_zod3.z.string(),
+  /**
+   * Peer-visible description of the work being done (`'rewriting the risk
+   * section to match Q3'`). The server stamps a default when a frame carries
+   * none.
+   */
+  description: import_zod3.z.string().optional(),
   /** Server-stamped declaration time (epoch ms). */
   declaredAt: import_zod3.z.number(),
   /** Server-computed TTL deadline (epoch ms). Readers treat as advisory. */
   expiresAt: import_zod3.z.number(),
-  status: claimStatusSchema.optional()
+  status: claimStatusSchema.optional(),
+  /**
+   * The monotonic fencing token the server minted for this grant (Option B).
+   * Strictly increasing per entity across successive grants, so a write that
+   * carries it can be rejected at commit if a later holder already advanced the
+   * entity's high-water. Server-stamped on grant and never client-supplied;
+   * optional so every existing frame stays valid and a token-less write is
+   * simply not fence-checked.
+   */
+  fenceToken: import_zod3.z.number().optional()
 });
 var wireClaimSummarySchema = wireClaimBaseSchema.pick({
   claimId: true,
-  reason: true,
+  description: true,
   declaredAt: true,
   expiresAt: true,
   entityType: true,
@@ -277279,18 +277297,22 @@ var modelClaimSchema = import_zod3.z.object({
   id: import_zod3.z.string(),
   actor: import_zod3.z.string(),
   participantKind: wireParticipantKindSchema,
-  /** Human-readable phase (`'editing'`). */
-  reason: import_zod3.z.string(),
+  /** Peer-visible description of the work (`'rewriting the risk section'`).
+   *  Optional: a claim may be declared without one. */
   description: import_zod3.z.string().optional(),
   field: import_zod3.z.string().optional(),
   status: import_zod3.z.enum(["active", "queued"]).optional(),
   position: import_zod3.z.number().optional(),
   expiresAt: import_zod3.z.number(),
+  /** The grant's fencing token (Option B), present on a claim you hold. */
+  fenceToken: import_zod3.z.number().optional(),
   target: modelTargetSchema
 }).readonly();
 var claimBeginPayloadSchema = targetRefSchema.extend({
   claimId: import_zod3.z.string(),
-  reason: import_zod3.z.string(),
+  /** Peer-visible description of the work. The server stamps `'editing'` when a
+   *  frame carries none. */
+  description: import_zod3.z.string().optional(),
   /** Hint for `expiresAt`; the server caps it. */
   estimatedMs: import_zod3.z.number().optional(),
   /**
@@ -277374,7 +277396,15 @@ var commitOperationSchema = writeGuardSchema.extend({
   id: import_zod3.z.string().nullish(),
   input: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).nullish(),
   /** Per-op client tx id, echoed on the broadcast delta. */
-  transactionId: import_zod3.z.string().nullish()
+  transactionId: import_zod3.z.string().nullish(),
+  /**
+   * The fencing token from the held claim this write belongs to (Option B).
+   * Present only on a write issued under a claim that was granted one; the
+   * server checks it against the entity's persisted high-water and rejects a
+   * stale token. Absent (nullish) on every unclaimed write — those are governed
+   * by version-CAS and the Option A blind-write guard, unchanged.
+   */
+  fenceToken: import_zod3.z.number().nullish()
 });
 var presenceKindSchema = import_zod3.z.enum(["enter", "update", "leave"]);
 var presenceActivitySchema = targetRefSchema.extend({
@@ -279769,10 +279799,18 @@ var import_path = require("path");
 function readProjectDatabaseUrl(cwd = process.cwd()) {
   const fromEnv = process.env.DATABASE_URL ?? process.env.ABLO_DATABASE_URL;
   if (fromEnv) return fromEnv;
-  for (const name of [".env.local", ".env"]) {
-    const path = (0, import_path.resolve)(cwd, name);
+  return readProjectEnvValue("DATABASE_URL", cwd);
+}
+function readProjectWriteDatabaseUrl(cwd = process.cwd()) {
+  const fromEnv = process.env.ABLO_WRITE_DATABASE_URL;
+  if (fromEnv) return fromEnv;
+  return readProjectEnvValue("ABLO_WRITE_DATABASE_URL", cwd);
+}
+function readProjectEnvValue(variable, cwd) {
+  for (const filename of [".env.local", ".env"]) {
+    const path = (0, import_path.resolve)(cwd, filename);
     if (!(0, import_fs2.existsSync)(path)) continue;
-    const match = /^DATABASE_URL=(.+)$/m.exec((0, import_fs2.readFileSync)(path, "utf8"));
+    const match = new RegExp(`^${variable}=(.+)$`, "m").exec((0, import_fs2.readFileSync)(path, "utf8"));
     if (match?.[1]) return match[1].trim().replace(/^["']|["']$/g, "");
   }
   return null;
@@ -280036,27 +280074,10 @@ function clearCredential() {
   return removed;
 }
 function resolveApiKey(modeOverride) {
-  if (process.env.ABLO_API_KEY) return process.env.ABLO_API_KEY;
-  const cfg = readConfig();
-  if (!cfg) return void 0;
-  const entry = cfg.profiles[activeProfileName(cfg)]?.[modeOverride ?? cfg.mode];
-  if (!entry) return void 0;
-  if (entry.expiresAt && Date.parse(entry.expiresAt) <= Date.now()) return void 0;
-  return entry.apiKey;
+  return resolveKey({ purpose: "data", mode: modeOverride }).key;
 }
 function resolveOrgKey(modeOverride) {
-  if (process.env.ABLO_API_KEY) return process.env.ABLO_API_KEY;
-  const cfg = readConfig();
-  if (!cfg) return void 0;
-  const mode2 = modeOverride ?? cfg.mode;
-  const order = [.../* @__PURE__ */ new Set([activeProfileName(cfg), DEFAULT_PROFILE, ...Object.keys(cfg.profiles)])];
-  for (const name of order) {
-    const entry = cfg.profiles[name]?.[mode2];
-    if (!entry) continue;
-    if (entry.expiresAt && Date.parse(entry.expiresAt) <= Date.now()) continue;
-    return entry.apiKey;
-  }
-  return void 0;
+  return resolveKey({ purpose: "org-read", mode: modeOverride }).key;
 }
 function guardActiveProjectKey() {
   if (process.env.ABLO_API_KEY) {
@@ -280068,11 +280089,31 @@ function guardActiveProjectKey() {
   const available = Object.entries(profiles).filter(([, keys]) => hasKey(keys)).map(([name]) => name);
   return { ok: hasKey(profiles[activeProfile]), activeProfile, available };
 }
+function resolveKey(policy) {
+  if (policy.scanEnvFiles) {
+    const fromProject = readProjectApiKey(policy.cwd);
+    if (fromProject) return { key: fromProject.key, source: fromProject.source };
+  } else if (process.env.ABLO_API_KEY) {
+    return { key: process.env.ABLO_API_KEY, source: "env" };
+  }
+  const cfg = readConfig();
+  if (!cfg) return { key: void 0, source: null };
+  const mode2 = policy.mode ?? cfg.mode;
+  const profiles = policy.purpose === "org-read" ? (
+    // Active first (a scoped key is preferred when present), then the
+    // org-default, then any remaining profile — deduplicated, order-preserving.
+    [.../* @__PURE__ */ new Set([activeProfileName(cfg), DEFAULT_PROFILE, ...Object.keys(cfg.profiles)])]
+  ) : [activeProfileName(cfg)];
+  for (const name of profiles) {
+    const entry = cfg.profiles[name]?.[mode2];
+    if (!entry) continue;
+    if (entry.expiresAt && Date.parse(entry.expiresAt) <= Date.now()) continue;
+    return { key: entry.apiKey, source: "stored" };
+  }
+  return { key: void 0, source: null };
+}
 function resolveEffectiveApiKey(modeOverride, cwd) {
-  const fromProject = readProjectApiKey(cwd);
-  if (fromProject) return { key: fromProject.key, source: fromProject.source };
-  const key = resolveApiKey(modeOverride);
-  return key ? { key, source: "stored" } : { key: void 0, source: null };
+  return resolveKey({ purpose: "data", mode: modeOverride, scanEnvFiles: true, cwd });
 }
 function resolvePushPlan() {
   const { key, source } = resolveEffectiveApiKey();
@@ -280889,6 +280930,18 @@ async function push(argv) {
         console.log(import_picocolors4.default.yellow(`  Applied ${body.warnings.length} destructive change(s):`));
         for (const w2 of body.warnings) console.log(import_picocolors4.default.yellow(fmtSignal(w2)));
       }
+      if (body.provisioningDeferred === true) {
+        console.log(
+          import_picocolors4.default.yellow(
+            `  Your schema is registered, but its tables were not created on this plane \u2014 the engine's runtime role does not run DDL here.`
+          )
+        );
+        console.log(
+          import_picocolors4.default.dim(
+            `  New models are recorded as metadata; provision their tables out-of-band before you read or write them.`
+          )
+        );
+      }
     }
     return;
   }
@@ -281145,14 +281198,171 @@ async function migrate(argv) {
 // src/cli/connect.ts
 init_cjs_shims();
 var import_picocolors6 = __toESM(require_picocolors(), 1);
+
+// src/cli/remoteValidation.ts
+init_cjs_shims();
+var DIAL_FAILURE_CODES = /* @__PURE__ */ new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "CONNECT_TIMEOUT"
+]);
+function dialFailureReason(err) {
+  if (err === null || typeof err !== "object") return null;
+  const coded = err;
+  const code = typeof coded.code === "string" ? coded.code : null;
+  if (code && DIAL_FAILURE_CODES.has(code)) {
+    return typeof coded.message === "string" && coded.message.length > 0 ? coded.message : code;
+  }
+  if (Array.isArray(coded.errors)) {
+    for (const member of coded.errors) {
+      const reason = dialFailureReason(member);
+      if (reason) return reason;
+    }
+  }
+  return null;
+}
+function validateEndpoint(baseUrl2) {
+  return `${baseUrl2.replace(/\/+$/, "")}/api/v1/datasources/validate`;
+}
+function describeRemoteFailure(failure) {
+  switch (failure.item) {
+    case "wal_level":
+      return {
+        label: failure.actual ? `wal_level is ${failure.actual} (need logical)` : `wal_level must be logical`,
+        fix: failure.fix
+      };
+    case "publication":
+      return { label: "the Ablo publication does not exist", fix: failure.fix };
+    case "replication_role":
+      return { label: "the DATABASE_URL role lacks the REPLICATION attribute", fix: failure.fix };
+    case "replica_identity":
+      return {
+        label: `published tables cannot replicate UPDATE/DELETE${failure.actual ? ` (${failure.actual})` : ""}`,
+        fix: failure.fix
+      };
+    case "write_role":
+      return { label: "ABLO_WRITE_DATABASE_URL is not a scoped DML role", fix: failure.fix };
+    case "row_security":
+      return { label: "the direct-write role does not enforce row_security", fix: failure.fix };
+    case "schema_privileges":
+      return { label: "the direct-write role has unsafe schema privileges", fix: failure.fix };
+    case "idempotency_ledger":
+      return { label: "ablo_idempotency is missing or has unsafe grants", fix: failure.fix };
+    case "table_privileges":
+      return {
+        label: `the direct-write role lacks application DML${failure.actual ? ` (${failure.actual})` : ""}`,
+        fix: failure.fix
+      };
+    case "logical_marker":
+      return { label: "the direct-write role cannot emit the correlation marker", fix: failure.fix };
+    default:
+      return { label: failure.item, fix: failure.fix };
+  }
+}
+function parseWireFailures(value) {
+  if (!Array.isArray(value)) return [];
+  const failures = [];
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object") continue;
+    const { item, actual, fix } = entry;
+    if (typeof item !== "string" || typeof fix !== "string") continue;
+    failures.push({ item, fix, ...typeof actual === "string" ? { actual } : {} });
+  }
+  return failures;
+}
+async function requestRemoteValidation(input) {
+  const doFetch = input.fetchImpl ?? fetch;
+  let res;
+  try {
+    res = await doFetch(validateEndpoint(input.apiUrl), {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${input.apiKey}` },
+      body: JSON.stringify({
+        connectionString: input.connectionString,
+        ...input.writeConnectionString ? { writeConnectionString: input.writeConnectionString } : {}
+      })
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      status: 0,
+      message: `couldn't reach ${input.apiUrl}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const code = typeof body.code === "string" ? body.code : body.error?.code;
+    const message = typeof body.message === "string" ? body.message : typeof body.error?.message === "string" ? body.error.message : `HTTP ${res.status}`;
+    return {
+      ok: false,
+      status: res.status,
+      message,
+      ...typeof code === "string" ? { code } : {}
+    };
+  }
+  const reachable = body.reachable === true;
+  return {
+    ok: true,
+    reachable,
+    ready: body.ready === true,
+    ...typeof body.reason === "string" ? { reason: body.reason } : {},
+    failures: parseWireFailures(body.failures)
+  };
+}
+
+// src/source/migrations.ts
+init_cjs_shims();
+function idempotencyLedgerMigrations() {
+  return [
+    {
+      name: "ablo_idempotency",
+      up: `CREATE TABLE IF NOT EXISTS ablo_idempotency (
+  client_tx_id TEXT PRIMARY KEY,
+  response     JSONB NOT NULL,
+  request_hash TEXT,
+  expires_at   TIMESTAMPTZ NOT NULL DEFAULT 'infinity',
+  created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);`
+    },
+    {
+      name: "ablo_idempotency_request_hash",
+      // Nullable only for rows created by older adapter versions. New writes
+      // always populate it; replaying a legacy NULL row fails closed because
+      // the adapter cannot prove that the intent matches.
+      up: `ALTER TABLE ablo_idempotency
+  ADD COLUMN IF NOT EXISTS request_hash TEXT;`
+    },
+    {
+      name: "ablo_idempotency_permanent_retention",
+      up: `ALTER TABLE ablo_idempotency
+  ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ NOT NULL DEFAULT 'infinity';`
+    }
+  ];
+}
+
+// src/cli/connect.ts
 var ABLO_PUBLICATION = "ablo_publication";
 var ABLO_REPLICATION_ROLE = "ablo_replicator";
+var ABLO_WRITE_ROLE = "ablo_writer";
+var DIRECT_DATA_SOURCE_ROUTES = [
+  "public-allowlist",
+  "privatelink",
+  "peering",
+  "vpn"
+];
 function parseConnectArgs(argv) {
   let check2 = false;
   let register = false;
   let auditInfra = false;
   let tables = [];
   let role = ABLO_REPLICATION_ROLE;
+  let writeRole = ABLO_WRITE_ROLE;
+  let route = "public-allowlist";
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     switch (arg) {
@@ -281173,19 +281383,41 @@ function parseConnectArgs(argv) {
       case "--role":
         role = argv[++i] ?? role;
         break;
+      case "--write-role":
+        writeRole = argv[++i] ?? writeRole;
+        break;
+      case "--route": {
+        const value = argv[++i] ?? "";
+        if (!DIRECT_DATA_SOURCE_ROUTES.includes(value)) {
+          throw new AbloValidationError(
+            `invalid direct route: ${value || "(missing)"} (expected ${DIRECT_DATA_SOURCE_ROUTES.join(", ")})`,
+            { code: "cli_invalid_arguments" }
+          );
+        }
+        route = value;
+        break;
+      }
       default:
         throw new AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
   }
-  return { check: check2, register, auditInfra, tables, role };
+  if (role === writeRole) {
+    throw new AbloValidationError("replication and write roles must be different", {
+      code: "cli_invalid_arguments"
+    });
+  }
+  return { check: check2, register, auditInfra, tables, role, writeRole, route };
 }
 function quoteIdent(id) {
   return `"${id.replace(/"/g, '""')}"`;
 }
 function connectSetupSql(input) {
   const role = input.role && input.role.length > 0 ? input.role : ABLO_REPLICATION_ROLE;
+  const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : ABLO_WRITE_ROLE;
   const tables = input.tables ?? [];
   const publicationTarget = tables.length > 0 ? `FOR TABLE ${tables.map(quoteIdent).join(", ")}` : "FOR ALL TABLES";
+  const applicationGrant = tables.length > 0 ? `GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE ${tables.map(quoteIdent).join(", ")} TO ${quoteIdent(writeRole)};` : `GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ${quoteIdent(writeRole)};`;
+  const ledger = idempotencyLedgerMigrations().map((migration) => migration.up);
   return [
     // 1. Turn on logical decoding. Requires a restart (it's not reloadable).
     `ALTER SYSTEM SET wal_level = 'logical';`,
@@ -281195,18 +281427,58 @@ function connectSetupSql(input) {
     `CREATE ROLE ${quoteIdent(role)} WITH REPLICATION LOGIN PASSWORD '<password>';`,
     `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${quoteIdent(role)};`,
     // Future tables get SELECT automatically, so the publication doesn't outgrow the grant.
-    `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${quoteIdent(role)};`
+    `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${quoteIdent(role)};`,
+    // 4. A distinct DML role: no replication, role administration, ownership,
+    // schema creation, or DDL. It is subject to RLS on every transaction.
+    `CREATE ROLE ${quoteIdent(writeRole)} WITH LOGIN PASSWORD '<write-password>' NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE NOREPLICATION NOINHERIT;`,
+    `ALTER ROLE ${quoteIdent(writeRole)} SET row_security = on;`,
+    // PUBLIC can carry CREATE on older Postgres clusters. A role-level REVOKE
+    // cannot override that inherited grant, so harden the schema explicitly.
+    `REVOKE CREATE ON SCHEMA public FROM PUBLIC;`,
+    `GRANT USAGE ON SCHEMA public TO ${quoteIdent(writeRole)};`,
+    applicationGrant,
+    `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ${quoteIdent(writeRole)};`,
+    ...tables.length === 0 ? [
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${quoteIdent(writeRole)};`,
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${quoteIdent(writeRole)};`
+    ] : [],
+    // 5. Direct uses the durable replay ledger but deliberately no outbox.
+    ...ledger,
+    `REVOKE ALL ON TABLE public.ablo_idempotency FROM PUBLIC;`,
+    `GRANT SELECT, INSERT, UPDATE ON TABLE public.ablo_idempotency TO ${quoteIdent(writeRole)};`,
+    `REVOKE DELETE ON TABLE public.ablo_idempotency FROM ${quoteIdent(writeRole)};`,
+    // Grant every pg_logical_emit_message variant by lookup instead of one
+    // literal signature: PostgreSQL 17 adds an optional fourth `flush`
+    // parameter, so the historical three-argument form no longer exists there
+    // and a signature-pinned GRANT fails on an otherwise healthy database.
+    `DO $$
+DECLARE fn regprocedure;
+BEGIN
+  FOR fn IN
+    SELECT p.oid::regprocedure
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname = 'pg_catalog' AND p.proname = 'pg_logical_emit_message'
+  LOOP
+    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO ${quoteIdent(writeRole)}', fn);
+  END LOOP;
+END $$;`
   ];
 }
 function printConnectRecipe(args) {
-  const sql = connectSetupSql({ tables: args.tables, role: args.role });
+  const sql = connectSetupSql({
+    tables: args.tables,
+    role: args.role,
+    writeRole: args.writeRole
+  });
   console.log(`
-  ${brand("ablo")} ${import_picocolors6.default.dim("connect")}  ${import_picocolors6.default.dim("logical replication \u2014 the read path (your writes stay on your own backend)")}
+  ${brand("ablo")} ${import_picocolors6.default.dim("connect")}  ${import_picocolors6.default.dim("direct writes + WAL-settled sync")}
 `);
   console.log(
-    `  Ablo consumes your write-ahead log (WAL) via logical replication and ${import_picocolors6.default.bold("never")} runs DDL,
-  owns, hosts, or migrates your schema. Your app continues to own the write path \u2014 Ablo tails
-  the changes and serves them as live shapes. Run this once against your Postgres ${import_picocolors6.default.dim("(as a superuser / DB owner)")}:
+    `  Ablo applies coordinated writes directly to your Postgres with a scoped DML role. WAL
+  observes what committed, orders it with external writes, and confirms it in the sync log.
+  Your database stays authoritative; Ablo never owns or migrates your application tables.
+  Run this once against your Postgres ${import_picocolors6.default.dim("(as a superuser / DB owner)")}:
 `
   );
   console.log(`  ${import_picocolors6.default.bold("1.")} Enable logical decoding ${import_picocolors6.default.dim("(then RESTART Postgres \u2014 wal_level is not reloadable)")}`);
@@ -281224,7 +281496,7 @@ function printConnectRecipe(args) {
     console.log(import_picocolors6.default.dim(`       (Scope it with ${import_picocolors6.default.bold("ablo connect --tables a,b,c")} to publish a subset.)`));
   }
   console.log(`
-  ${import_picocolors6.default.bold("3.")} Create a least-privilege replication role ${import_picocolors6.default.dim("(pick your own password)")}`);
+  ${import_picocolors6.default.bold("3.")} Create the scoped replication role ${import_picocolors6.default.dim("(pick your own replication password)")}`);
   console.log(`       ${import_picocolors6.default.cyan(sql[2])}`);
   console.log(`       ${import_picocolors6.default.cyan(sql[3])}`);
   console.log(`       ${import_picocolors6.default.cyan(sql[4])}`);
@@ -281236,15 +281508,31 @@ function printConnectRecipe(args) {
   );
   console.log(
     `
-  ${import_picocolors6.default.bold("4.")} Put the role's connection string in ${import_picocolors6.default.bold("DATABASE_URL")}, then verify:
+  ${import_picocolors6.default.bold("4.")} Create the separate DML role and permanent idempotency ledger ` + import_picocolors6.default.dim("(pick your own write password)")
+  );
+  for (const statement of sql.slice(5)) {
+    for (const line of statement.split("\n")) console.log(`       ${import_picocolors6.default.cyan(line)}`);
+  }
+  console.log(
+    import_picocolors6.default.dim(
+      `       The writer gets row DML + ledger access only. It has no REPLICATION, schema CREATE,
+       role administration, database creation, ownership, or customer-table DDL. Direct uses
+       ${import_picocolors6.default.bold("ablo_idempotency")} but no outbox; WAL carries the committed row changes.`
+    )
+  );
+  console.log(
+    `
+  ${import_picocolors6.default.bold("5.")} Configure both scoped connections, then verify:
+       ${import_picocolors6.default.bold("DATABASE_URL")}              ${import_picocolors6.default.dim(`\u2192 ${args.role} (replication only)`)}
+       ${import_picocolors6.default.bold("ABLO_WRITE_DATABASE_URL")}   ${import_picocolors6.default.dim(`\u2192 ${args.writeRole} (DML only)`)}
        ${import_picocolors6.default.cyan("npx ablo connect --check")}
 `
   );
   console.log(
     import_picocolors6.default.dim(
-      `  Reminder: this is the READ path \u2014 Ablo tails your WAL and never writes to your database.
-  Your writes keep going through your own backend. (Ablo HOSTING your rows, or dialing in via
-  ${import_picocolors6.default.bold("databaseUrl")}, is the deprecated posture \u2014 see the read-path decision doc.)`
+      `  Reachable databases use this direct path. If no inbound route can be established, use the
+  signed ${import_picocolors6.default.bold("dataSource()")} endpoint fallback; its correlated events confirm writes
+  without an Ablo-side customer database socket.`
     )
   );
   console.log();
@@ -281345,6 +281633,76 @@ On RDS: GRANT rds_replication TO <your_role>;`
   }
   return items;
 }
+async function probeDirectWriteReadiness(sql, opts = {}) {
+  const schema = opts.schema ?? "public";
+  const publication = opts.publication ?? ABLO_PUBLICATION;
+  const items = [];
+  const roleRows = await sql.unsafe(
+    `SELECT rolname, rolsuper, rolbypassrls, rolcreatedb, rolcreaterole, rolreplication
+       FROM pg_roles WHERE rolname = current_user`
+  );
+  const role = roleRows[0];
+  const dangerous = Boolean(
+    !role || role.rolsuper || role.rolbypassrls || role.rolcreatedb || role.rolcreaterole || role.rolreplication
+  );
+  items.push(
+    dangerous ? {
+      ok: false,
+      label: `ABLO_WRITE_DATABASE_URL is not a scoped DML role`,
+      fix: `Use ${ABLO_WRITE_ROLE} from the setup recipe: NOSUPERUSER, NOBYPASSRLS, NOCREATEDB, NOCREATEROLE, NOREPLICATION.`
+    } : { ok: true, label: `write role ${import_picocolors6.default.bold(role?.rolname ?? ABLO_WRITE_ROLE)} is DML-only` }
+  );
+  const schemaRows = await sql.unsafe(
+    `SELECT
+       has_schema_privilege(current_user, $1, 'USAGE') AS usage,
+       has_schema_privilege(current_user, $1, 'CREATE') AS create,
+       current_setting('row_security') AS row_security`,
+    [schema]
+  );
+  const schemaRow = schemaRows[0];
+  items.push(
+    schemaRow?.usage && !schemaRow.create && schemaRow.row_security === "on" ? { ok: true, label: `writer uses ${schema} with RLS on and no schema CREATE` } : {
+      ok: false,
+      label: `writer schema/RLS privileges are not least-privilege`,
+      fix: `REVOKE CREATE ON SCHEMA ${quoteIdent(schema)} FROM PUBLIC; GRANT USAGE ON SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(role?.rolname ?? ABLO_WRITE_ROLE)}; ALTER ROLE ${quoteIdent(role?.rolname ?? ABLO_WRITE_ROLE)} SET row_security = on;`
+    }
+  );
+  const ledgerName = `${quoteIdent(schema)}.${quoteIdent("ablo_idempotency")}`;
+  const ledgerRows = await sql.unsafe(
+    `SELECT
+       to_regclass($1) IS NOT NULL AS present,
+       CASE WHEN to_regclass($1) IS NULL THEN false ELSE has_table_privilege(current_user, $1, 'SELECT,INSERT,UPDATE') END AS writes,
+       CASE WHEN to_regclass($1) IS NULL THEN false ELSE has_table_privilege(current_user, $1, 'DELETE') END AS deletes`,
+    [ledgerName]
+  );
+  const ledger = ledgerRows[0];
+  items.push(
+    ledger?.present && ledger.writes && !ledger.deletes ? { ok: true, label: `${import_picocolors6.default.bold("ablo_idempotency")} is durable and protected from DELETE` } : {
+      ok: false,
+      label: `${import_picocolors6.default.bold("ablo_idempotency")} is missing or has unsafe grants`,
+      fix: `Apply the DML-role and idempotency-ledger statements printed by ${import_picocolors6.default.bold("ablo connect")}.`
+    }
+  );
+  const tableRows = await sql.unsafe(
+    `SELECT format('%I.%I', schemaname, tablename) AS relation
+       FROM pg_publication_tables
+      WHERE pubname = $1 AND schemaname = $2 AND tablename <> 'ablo_idempotency'
+        AND NOT has_table_privilege(
+          current_user,
+          format('%I.%I', schemaname, tablename),
+          'SELECT,INSERT,UPDATE,DELETE'
+        )`,
+    [publication, schema]
+  );
+  items.push(
+    tableRows.length === 0 ? { ok: true, label: `writer can apply DML to every published application table` } : {
+      ok: false,
+      label: `writer lacks DML on ${tableRows.length} published table${tableRows.length === 1 ? "" : "s"}`,
+      fix: `Grant SELECT, INSERT, UPDATE, DELETE on: ${tableRows.map((row) => row.relation).join(", ")}`
+    }
+  );
+  return items;
+}
 async function auditTenantSyncInfra(sql) {
   const artifacts = [];
   for (const name of SYNC_INFRA_RELATIONS) {
@@ -281373,31 +281731,125 @@ function requireDatabaseUrl(verb) {
   }
   return dbUrl;
 }
-async function probeAndReport(dbUrl) {
-  const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
+function requireWriteDatabaseUrl(verb) {
+  const dbUrl = readProjectWriteDatabaseUrl();
+  if (!dbUrl) {
+    console.error(
+      import_picocolors6.default.red("  No ABLO_WRITE_DATABASE_URL found (checked process env, .env.local, .env).") + import_picocolors6.default.dim(
+        ` Set it to the ${ABLO_WRITE_ROLE} connection printed by ${import_picocolors6.default.bold("ablo connect")}, then re-run ${import_picocolors6.default.bold(`ablo connect ${verb}`)}. The replication credential is never reused for DML.`
+      )
+    );
+    process.exit(1);
+  }
+  return dbUrl;
+}
+async function probeAndReport(dbUrl, kind = "replication") {
+  const sql = src_default(dbUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
   } });
   let items;
   try {
-    items = await probeReadiness(sql);
+    items = kind === "replication" ? await probeReadiness(sql) : await probeDirectWriteReadiness(sql);
   } catch (err) {
+    await sql.end({ timeout: 2 }).catch(() => void 0);
+    const dial = dialFailureReason(err);
+    if (dial) return { kind: "no-dial", reason: dial };
     const pg = err ?? {};
     console.error(import_picocolors6.default.red(`  Couldn't read the database: ${pg.message ?? String(err)}`));
-    await sql.end({ timeout: 2 });
     process.exit(1);
   }
   await sql.end({ timeout: 2 });
   for (const item of items) printCheckItem(item);
-  return items.filter((i) => !i.ok).length;
+  return { kind: "probed", failures: items.filter((i) => !i.ok).length };
+}
+async function runRemoteCheck(dbUrl, writeDbUrl, localReason) {
+  console.log(
+    `  This machine can't reach one or both scoped connections (${import_picocolors6.default.dim(localReason)}).
+  That is not the verdict: direct writes and replication run from Ablo's infrastructure.
+  Asking Ablo to check both roles from its side\u2026
+`
+  );
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    console.error(
+      import_picocolors6.default.red(`  The engine-side check needs an API key, and none was found.`) + import_picocolors6.default.dim(
+        ` Run ${import_picocolors6.default.bold("ablo login")} (or set ${import_picocolors6.default.bold("ABLO_API_KEY")}), then re-run ${import_picocolors6.default.bold("ablo connect --check")}.`
+      )
+    );
+    process.exit(1);
+  }
+  const apiUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+  const result = await requestRemoteValidation({
+    apiUrl: apiUrl2,
+    apiKey,
+    connectionString: dbUrl,
+    writeConnectionString: writeDbUrl
+  });
+  if (!result.ok) {
+    console.error(import_picocolors6.default.red(`  The engine-side check failed: ${result.message}`));
+    if (result.code === "forbidden") {
+      console.error(
+        import_picocolors6.default.dim(`  Checking a database from Ablo's side needs a ${import_picocolors6.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors6.default.bold("ablo login")} for one.`)
+      );
+    }
+    console.error();
+    process.exit(1);
+  }
+  if (!result.reachable) {
+    console.error(
+      `  ${import_picocolors6.default.red("\u2717")} Ablo's infrastructure can't reach both direct connections${result.reason ? ` ${import_picocolors6.default.dim(`(${result.reason})`)}` : ""}.`
+    );
+    console.error(
+      import_picocolors6.default.dim(
+        `  Direct needs a route Ablo's servers can dial \u2014 public allowlist, PrivateLink, peering,
+  or VPN. Only when no inbound route can exist, use the signed ${import_picocolors6.default.bold("dataSource()")} endpoint fallback.
+`
+      )
+    );
+    process.exit(1);
+  }
+  for (const failure of result.failures) {
+    const { label, fix } = describeRemoteFailure(failure);
+    printCheckItem({ ok: false, label, fix });
+  }
+  console.log();
+  if (result.ready) {
+    console.log(
+      `  ${import_picocolors6.default.green("\u2713")} Ready \u2014 checked from Ablo's infrastructure. Both direct DML and WAL settlement are available.
+`
+    );
+    process.exit(0);
+  }
+  const count = result.failures.length;
+  console.log(
+    `  ${import_picocolors6.default.red(`${count} item${count === 1 ? "" : "s"} to fix`)} ${import_picocolors6.default.dim(`\u2014 found by Ablo's infrastructure. Apply the fixes above, then re-run ${import_picocolors6.default.bold("ablo connect --check")}.`)}
+`
+  );
+  process.exit(1);
 }
 async function runCheck() {
   const dbUrl = requireDatabaseUrl("--check");
+  const writeDbUrl = requireWriteDatabaseUrl("--check");
+  console.log(`
+  ${brand("ablo")} ${import_picocolors6.default.dim("connect --check")}  ${import_picocolors6.default.dim("direct-write + WAL readiness")}
+`);
+  console.log(`  ${import_picocolors6.default.bold("Replication role")}
+`);
+  const replication = await probeAndReport(dbUrl, "replication");
   console.log(`
-  ${brand("ablo")} ${import_picocolors6.default.dim("connect --check")}  ${import_picocolors6.default.dim("logical-replication readiness")}
+  ${import_picocolors6.default.bold("Direct-write role")}
 `);
-  const failures = await probeAndReport(dbUrl);
+  const write = await probeAndReport(writeDbUrl, "write");
+  if (replication.kind === "no-dial" || write.kind === "no-dial") {
+    const reasons = [
+      replication.kind === "no-dial" ? `replication: ${replication.reason}` : null,
+      write.kind === "no-dial" ? `write: ${write.reason}` : null
+    ].filter((reason) => reason !== null);
+    return runRemoteCheck(dbUrl, writeDbUrl, reasons.join("; "));
+  }
+  const failures = replication.failures + write.failures;
   console.log();
   if (failures === 0) {
-    console.log(`  ${import_picocolors6.default.green("\u2713")} Ready \u2014 Ablo can connect and tail this database's WAL.
+    console.log(`  ${import_picocolors6.default.green("\u2713")} Ready \u2014 Ablo can apply scoped DML and settle it from WAL.
 `);
     process.exit(0);
   }
@@ -281410,8 +281862,9 @@ async function runCheck() {
 function registerEndpoint(baseUrl2) {
   return `${baseUrl2.replace(/\/+$/, "")}/api/v1/datasources`;
 }
-async function runRegister() {
+async function runRegister(args) {
   const dbUrl = requireDatabaseUrl("--register");
+  const writeDbUrl = requireWriteDatabaseUrl("--register");
   const apiKey = resolveApiKey();
   if (!apiKey) {
     console.error(
@@ -281420,13 +281873,32 @@ async function runRegister() {
     process.exit(1);
   }
   console.log(`
-  ${brand("ablo")} ${import_picocolors6.default.dim("connect --register")}  ${import_picocolors6.default.dim("register this database for replication")}
+  ${brand("ablo")} ${import_picocolors6.default.dim("connect --register")}  ${import_picocolors6.default.dim("register a direct DataSource")}
 `);
-  const failures = await probeAndReport(dbUrl);
+  console.log(`  ${import_picocolors6.default.bold("Replication role")}
+`);
+  const replication = await probeAndReport(dbUrl, "replication");
+  console.log(`
+  ${import_picocolors6.default.bold("Direct-write role")}
+`);
+  const write = await probeAndReport(writeDbUrl, "write");
+  const noDial = [
+    replication.kind === "no-dial" ? `replication: ${replication.reason}` : null,
+    write.kind === "no-dial" ? `write: ${write.reason}` : null
+  ].filter((reason) => reason !== null);
+  const failures = (replication.kind === "probed" ? replication.failures : 0) + (write.kind === "probed" ? write.failures : 0);
+  if (noDial.length > 0) {
+    console.log(
+      `  This machine can't reach one or both scoped connections (${import_picocolors6.default.dim(noDial.join("; "))}) \u2014 continuing anyway.
+  Ablo validates both credentials from the infrastructure that will use them and refuses
+  registration unless replication and direct DML are both ready.
+`
+    );
+  }
   if (failures > 0) {
     console.log(
       `
-  ${import_picocolors6.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors6.default.dim("\u2014 a database that isn\u2019t replication-ready can\u2019t stream. Fix the above, then re-run.")}
+  ${import_picocolors6.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors6.default.dim("\u2014 direct registration requires both scoped roles. Fix the above, then re-run.")}
 `
     );
     process.exit(1);
@@ -281437,7 +281909,12 @@ async function runRegister() {
     res = await fetch(registerEndpoint(apiUrl2), {
       method: "POST",
       headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({ connectionString: dbUrl })
+      body: JSON.stringify({
+        connection: "direct",
+        connectionString: dbUrl,
+        writeConnectionString: writeDbUrl,
+        route: args.route
+      })
     });
   } catch (err) {
     console.error(import_picocolors6.default.red(`
@@ -281447,9 +281924,11 @@ async function runRegister() {
   }
   if (res.ok) {
     const body2 = await res.json().catch(() => ({}));
+    const statusNote = body2.status === "active" ? `${args.route}, active` : args.route;
     console.log(
       `
-  ${import_picocolors6.default.green("\u2713")} Registered${body2.host ? ` ${import_picocolors6.default.dim(body2.host)}` : ""}${body2.id ? ` ${import_picocolors6.default.dim(`(${body2.id})`)}` : ""} \u2014 Ablo will replicate this database on the next sync.
+  ${import_picocolors6.default.green("\u2713")} Registered${body2.host ? ` ${import_picocolors6.default.dim(body2.host)}` : ""}${body2.id ? ` ${import_picocolors6.default.dim(`(${body2.id})`)}` : ""} as a direct DataSource (${statusNote}).
+  Customer COMMIT is durable acceptance; correlated WAL promotes queued writes to confirmed.
 `
     );
     process.exit(0);
@@ -281465,20 +281944,20 @@ async function runRegister() {
     console.error(
       import_picocolors6.default.dim(`  This deployment can\u2019t accept connection strings \u2014 use a self-hosted/hosted engine, or the signed endpoint fallback.`)
     );
-  } else if (code === "database_not_replication_ready") {
+  } else if (code === "database_not_replication_ready" || code === "data_source_blocked") {
     for (const f of body.details?.failures ?? []) {
       console.error(`  ${import_picocolors6.default.red("\u2717")} ${import_picocolors6.default.bold(f.item ?? "item")}${f.actual ? import_picocolors6.default.dim(` (${f.actual})`) : ""}`);
       if (f.fix) for (const line of f.fix.split("\n")) console.error(`      ${import_picocolors6.default.red("\u2022")} ${line}`);
     }
     console.error(import_picocolors6.default.dim(`
   Apply the fixes, verify with ${import_picocolors6.default.bold("ablo connect --check")}, then re-run.`));
-  } else if (code === "database_unreachable") {
+  } else if (code === "database_unreachable" || code === "source_unreachable") {
     if (body.details?.reason) console.error(import_picocolors6.default.dim(`  ${body.details.reason}`));
     console.error(
       import_picocolors6.default.dim(
         `  Ablo's servers must be able to reach this database \u2014 a localhost or private-network
-  Postgres can't be replicated by the hosted service. Use a reachable host (or a tunnel),
-  or the signed ${import_picocolors6.default.bold("dataSource()")} endpoint fallback.`
+  Postgres can't use the direct path. Establish an allowlist, PrivateLink, peering, or VPN.
+  Only when no inbound route is possible, register the signed ${import_picocolors6.default.bold("dataSource()")} endpoint fallback.`
       )
     );
   }
@@ -281531,7 +282010,7 @@ async function connect(argv) {
     return;
   }
   if (args.register) {
-    await runRegister();
+    await runRegister(args);
     return;
   }
   if (args.auditInfra) {
@@ -281540,17 +282019,19 @@ async function connect(argv) {
   }
   printConnectRecipe(args);
 }
-var CONNECT_USAGE = `  ablo connect \u2014 connect your database for the read path, via logical replication
+var CONNECT_USAGE = `  ablo connect \u2014 direct writes, settled by logical replication
 
-  The Electric/PowerSync/Zero model: Ablo consumes your WAL via logical replication and
-  never runs DDL, owns, hosts, or migrates your schema. Your app continues to own the write path.
+  Ablo applies coordinated DML with a scoped writer role. WAL observes what committed,
+  orders it with external changes, and confirms it. Your Postgres remains authoritative.
 
   Usage:
     npx ablo connect                      Print the exact setup SQL for your Postgres
     npx ablo connect --tables a,b,c       Publish only these tables (default: all tables)
     npx ablo connect --role <name>        Name the replication role (default: ablo_replicator)
-    npx ablo connect --check              Validate DATABASE_URL is replication-ready
-    npx ablo connect --register           Register DATABASE_URL so Ablo replicates it (one self-service step)
+    npx ablo connect --write-role <name>  Name the DML role (default: ablo_writer)
+    npx ablo connect --route <route>      public-allowlist | privatelink | peering | vpn
+    npx ablo connect --check              Validate DATABASE_URL + ABLO_WRITE_DATABASE_URL
+    npx ablo connect --register           Register both scoped credentials as one direct DataSource
     npx ablo connect --audit-infra        Read-only Stage 5 audit for deprecated Ablo sync tables/types`;
 
 // src/cli/generate.ts
@@ -283815,7 +284296,7 @@ async function main() {
     console.log(`  ${import_picocolors20.default.bold("Usage:")}`);
     console.log(`    npx ablo init                          Scaffold ablo/ directory + starter schema`);
     console.log(`    npx ablo init --yes [--framework nextjs] Non-interactive (agents/CI): no prompts, flag-driven`);
-    console.log(`                  [--auth apikey] [--storage direct|endpoint] [--project <slug>] [--no-project]`);
+    console.log(`                  [--auth apikey] [--storage replication|endpoint] [--project <slug>] [--no-project]`);
     console.log(`                  [--no-agent] [--no-pull] [--no-install] [--no-login]`);
     console.log(`    npx ablo login                         Authorize in your browser (provisions sandbox + production keys)`);
     console.log(`    npx ablo login --project <slug>        Same, scoped to a project (mints its keys, makes it active)`);
@@ -283863,7 +284344,7 @@ function bailIfCancelled(value) {
 }
 var INIT_FRAMEWORKS = ["nextjs", "vite", "remix", "vanilla"];
 var INIT_AUTHS = ["apikey", "firebase", "auth0", "clerk", "supabase", "betterauth", "jwt"];
-var INIT_STORAGES = ["replication", "endpoint", "direct", "datasource"];
+var INIT_STORAGES = ["replication", "endpoint", "datasource"];
 function parseInitArgs(args) {
   const has = (flag2) => args.includes(flag2);
   const val = (flag2) => {
@@ -283995,12 +284476,6 @@ async function init(args = []) {
     () => Promise.resolve("replication")
   );
   const storage = storageChoice === "datasource" ? "endpoint" : storageChoice;
-  if (storage === "direct") {
-    Me(
-      "`--storage direct` uses the deprecated databaseUrl connector. Logical replication\n(`npx ablo connect`) is the supported path; a signed Data Source endpoint is the fallback.",
-      import_picocolors20.default.yellow("Deprecated")
-    );
-  }
   const agent = await chooseBool(
     opts.agent,
     true,
@@ -284049,7 +284524,7 @@ async function init(args = []) {
   }
   (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "schema.ts"), schemaSource);
   created.push(`${abloDir}/schema.ts${schemaNote}`);
-  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "index.ts"), generateSyncConfig(auth, storage));
+  (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "index.ts"), generateSyncConfig(auth));
   created.push(`${abloDir}/index.ts`);
   (0, import_fs12.writeFileSync)((0, import_path7.join)(abloDir, "register.ts"), generateRegister());
   created.push(`${abloDir}/register.ts`);
@@ -284122,8 +284597,6 @@ async function init(args = []) {
       `Connect your database \u2014 ${import_picocolors20.default.bold("npx ablo connect")} prints the one-time logical-replication setup SQL to run on your Postgres`,
       `Verify it \u2014 ${import_picocolors20.default.bold("npx ablo connect --check")} walks wal_level, the publication, the role, and replica identity, with the exact fix for anything missing`,
       `Register it \u2014 ${import_picocolors20.default.bold("npx ablo connect --register")} tells Ablo to start replicating; your app keeps writing through your own backend while Ablo tails the WAL`
-    ] : storage === "direct" ? [
-      `Provision your DB: ${import_picocolors20.default.bold("npx ablo migrate")} (creates your synced-model tables with row-level security; keep your own migrations for everything else)`
     ] : [
       `Provision your DB: ${import_picocolors20.default.bold("npx ablo migrate")} (creates your Ablo-model tables + the adapter tables; keep your own migrations for everything else), then mount ${import_picocolors20.default.bold(`${abloDir}/data-source.ts`)} at ${import_picocolors20.default.bold("/api/ablo/source")}`
     ],
@@ -284181,9 +284654,7 @@ export const schema = defineSchema({
 });
 `;
 }
-function generateSyncConfig(auth, storage) {
-  const databaseLine = storage === "direct" ? `
-  databaseUrl: process.env.DATABASE_URL, // deprecated direct connector` : "";
+function generateSyncConfig(auth) {
   const authLine = auth === "apikey" ? "" : auth === "firebase" ? `
   auth: async () => {
     const { getAuth } = await import('firebase/auth');
@@ -284203,7 +284674,7 @@ import { schema } from './schema';
 // ('use client') component; the browser uses app/providers.tsx, which authenticates
 // via the session route and never touches the key.
 export const sync = Ablo({
-  apiKey: process.env.ABLO_API_KEY,${databaseLine}${authLine}
+  apiKey: process.env.ABLO_API_KEY,${authLine}
   schema,
 });
 
@@ -284227,7 +284698,7 @@ export {};
 }
 function generateEnv(storage, opts = {}) {
   const { includeApiKey = true } = opts;
-  const databaseBlock = storage === "direct" ? "# DEPRECATED direct connector. The client registers this connection (sent once\n# over TLS, stored sealed) so Ablo dials into your Postgres. Prefer logical\n# replication (`npx ablo connect`); to keep the transaction log in your infra too,\n# self-host the engine. Use a dedicated non-superuser role; the browser never sees this.\nDATABASE_URL=postgres://user:password@host:5432/db\n" : storage === "replication" ? "# Used by `npx ablo connect` to set up + register logical replication \u2014 the\n# DIRECT (un-pooled) endpoint. Ablo TAILS your WAL from here; it never writes.\n# The client never sees it; the browser never sees it. Your DB stays yours.\nDATABASE_URL=postgres://user:password@host:5432/db\n" : "# Used by ablo/data-source.ts (your DB endpoint) + `ablo migrate` \u2014 NOT the client.\n# Ablo never sees it; the browser never sees it. Your DB stays in your app.\nDATABASE_URL=postgres://user:password@host:5432/db\n";
+  const databaseBlock = storage === "replication" ? "# Used by `npx ablo connect` to set up + register logical replication \u2014 the\n# DIRECT (un-pooled) endpoint. Ablo TAILS your WAL from here; it never writes.\n# The client never sees it; the browser never sees it. Your DB stays yours.\nDATABASE_URL=postgres://user:password@host:5432/db\n" : "# Used by ablo/data-source.ts (your DB endpoint) + `ablo migrate` \u2014 NOT the client.\n# Ablo never sees it; the browser never sees it. Your DB stays in your app.\nDATABASE_URL=postgres://user:password@host:5432/db\n";
   const webhookBlock = storage === "endpoint" ? "# Signing secret for the webhook receiver (app/api/ablo/webhooks/route.ts).\n# Ablo mints this when you register the endpoint's URL (POST /v1/webhook_endpoints\n# or the dashboard) and returns it once \u2014 paste it here.\nABLO_WEBHOOK_SECRET=whsec_your_endpoint_secret_here\n" : "";
   const apiKeyBlock = includeApiKey ? "# Ablo Sync Engine \u2014 use a sk_test_ key for local dev (`npx ablo push`)\nABLO_API_KEY=sk_test_your_key_here\n" : "";
   return `${apiKeyBlock}${webhookBlock}${databaseBlock}`;