@abloatai/ablo 0.3.0

package/dist/client/auth.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Auth + URL resolution for `Ablo()`.
+ *
+ * Mirrors the small, focused helpers Anthropic ships in `client.ts`
+ * (`apiKeyAuth`, `bearerAuth`, `validateHeaders`). Each function does
+ * one thing — resolve a value with the right precedence, or fail
+ * with an actionable message — so the constructor reads as a
+ * sequence of named decisions rather than a stream of `??`-chains.
+ *
+ * Precedence for every resolver: explicit option → environment
+ * variable → built-in default. The same shape Anthropic, OpenAI,
+ * and Stripe SDKs use.
+ */
+/**
+ * Async callable that resolves to a fresh API key. Mirrors the shape
+ * Anthropic / OpenAI / Stripe ship — used for credential rotation
+ * (e.g. AWS STS, GCP IAM, Vault). Re-exported from `./Ablo` so
+ * existing import paths work; defined here so this module has no
+ * circular dependency back to `Ablo.ts`.
+ */
+export type ApiKeySetter = () => Promise<string>;
+export interface AuthResolveInput {
+    /**
+     * The full options bag the caller passed to `Ablo()`. Resolvers
+     * read only the fields they care about; the wide shape avoids
+     * passing N parameters into each helper.
+     */
+    readonly options: {
+        readonly apiKey?: string | ApiKeySetter | null;
+        readonly authToken?: string | null;
+        readonly baseURL?: string | null;
+        readonly dangerouslyAllowBrowser?: boolean;
+    };
+    readonly env: Record<string, string | undefined>;
+}
+/**
+ * Read `process.env` defensively. Works in browser (where `process`
+ * is undefined), Node, and edge runtimes that expose a partial
+ * process polyfill.
+ */
+export declare function readProcessEnv(): Record<string, string | undefined>;
+export declare function resolveApiKey(input: AuthResolveInput): string | ApiKeySetter | null;
+export declare function resolveAuthToken(input: AuthResolveInput): string | null;
+export declare const ABLO_DEFAULT_BASE_URL = "wss://mesh.ablo.finance";
+export declare function resolveBaseURL(input: AuthResolveInput): string;
+/**
+ * Browser guard — apiKey is server-side-only by default. Same check
+ * Anthropic, OpenAI, and Stripe ship: shipping `sk_live_...` to a
+ * browser exposes it in every visitor's network tab. Consumers opt
+ * in explicitly when they have a publishable key or a server proxy.
+ */
+export declare function assertBrowserSafety(input: {
+    apiKey: string | ApiKeySetter | null;
+    dangerouslyAllowBrowser: boolean | undefined;
+}): void;
+/**
+ * Resolve an `ApiKeySetter` callable to its current string value.
+ * Used at request time so a rotating credential picks up rotations
+ * between requests. Returns `null` when no key was configured.
+ *
+ * Mirrors Anthropic's pattern of supporting both a static string and
+ * a callable for credential rotation.
+ */
+export declare function resolveApiKeyValue(apiKey: string | ApiKeySetter | null): Promise<string | null>;
+/**
+ * Translate a sync-engine WebSocket URL to the matching HTTP API
+ * base URL, defaulting to `${url}/api` when the caller hasn't
+ * overridden `bootstrapBaseUrl`. Used by `BootstrapHelper`,
+ * `HydrationCoordinator`, the apiKey-exchange flow, and the
+ * self-derived identity flow — same derivation in all four spots,
+ * so it lives here as a single source of truth.
+ *
+ * Note: when both `wss://` and `https://` are valid, `replace(/^ws/, 'http')`
+ * preserves the protocol family (ws → http, wss → https).
+ */
+export declare function resolveBootstrapBaseUrl(input: {
+    readonly url: string;
+    readonly bootstrapBaseUrl?: string;
+}): string;

package/dist/client/auth.js

@@ -0,0 +1,81 @@
+/**
+ * Auth + URL resolution for `Ablo()`.
+ *
+ * Mirrors the small, focused helpers Anthropic ships in `client.ts`
+ * (`apiKeyAuth`, `bearerAuth`, `validateHeaders`). Each function does
+ * one thing — resolve a value with the right precedence, or fail
+ * with an actionable message — so the constructor reads as a
+ * sequence of named decisions rather than a stream of `??`-chains.
+ *
+ * Precedence for every resolver: explicit option → environment
+ * variable → built-in default. The same shape Anthropic, OpenAI,
+ * and Stripe SDKs use.
+ */
+import { AbloAuthenticationError } from '../errors.js';
+/**
+ * Read `process.env` defensively. Works in browser (where `process`
+ * is undefined), Node, and edge runtimes that expose a partial
+ * process polyfill.
+ */
+export function readProcessEnv() {
+    const maybeGlobal = globalThis;
+    return maybeGlobal.process?.env ?? {};
+}
+export function resolveApiKey(input) {
+    return input.options.apiKey ?? input.env.ABLO_API_KEY ?? null;
+}
+export function resolveAuthToken(input) {
+    return input.options.authToken ?? input.env.ABLO_AUTH_TOKEN ?? null;
+}
+export const ABLO_DEFAULT_BASE_URL = 'wss://mesh.ablo.finance';
+export function resolveBaseURL(input) {
+    return (input.options.baseURL ?? input.env.ABLO_BASE_URL ?? ABLO_DEFAULT_BASE_URL);
+}
+/**
+ * Browser guard — apiKey is server-side-only by default. Same check
+ * Anthropic, OpenAI, and Stripe ship: shipping `sk_live_...` to a
+ * browser exposes it in every visitor's network tab. Consumers opt
+ * in explicitly when they have a publishable key or a server proxy.
+ */
+export function assertBrowserSafety(input) {
+    if (!input.dangerouslyAllowBrowser &&
+        typeof window !== 'undefined' &&
+        typeof input.apiKey === 'string' &&
+        input.apiKey.startsWith('sk_')) {
+        throw new AbloAuthenticationError("It looks like you're running in a browser-like environment.\n\n" +
+            'This is disabled by default — your secret API key would be ' +
+            "exposed to every visitor's network tab. If you understand the risks " +
+            'and have appropriate mitigations in place, you can set the ' +
+            '`dangerouslyAllowBrowser` option to `true`, e.g.,\n\n' +
+            '    Ablo({ schema, apiKey, dangerouslyAllowBrowser: true });\n', { code: 'browser_apikey_blocked' });
+    }
+}
+/**
+ * Resolve an `ApiKeySetter` callable to its current string value.
+ * Used at request time so a rotating credential picks up rotations
+ * between requests. Returns `null` when no key was configured.
+ *
+ * Mirrors Anthropic's pattern of supporting both a static string and
+ * a callable for credential rotation.
+ */
+export async function resolveApiKeyValue(apiKey) {
+    if (apiKey == null)
+        return null;
+    if (typeof apiKey === 'function')
+        return apiKey();
+    return apiKey;
+}
+/**
+ * Translate a sync-engine WebSocket URL to the matching HTTP API
+ * base URL, defaulting to `${url}/api` when the caller hasn't
+ * overridden `bootstrapBaseUrl`. Used by `BootstrapHelper`,
+ * `HydrationCoordinator`, the apiKey-exchange flow, and the
+ * self-derived identity flow — same derivation in all four spots,
+ * so it lives here as a single source of truth.
+ *
+ * Note: when both `wss://` and `https://` are valid, `replace(/^ws/, 'http')`
+ * preserves the protocol family (ws → http, wss → https).
+ */
+export function resolveBootstrapBaseUrl(input) {
+    return input.bootstrapBaseUrl ?? `${input.url.replace(/^ws/, 'http')}/api`;
+}

package/dist/client/createInternalComponents.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Internal component construction for `Ablo()`.
+ *
+ * Builds the full sync-engine component graph from options + schema:
+ * `ModelRegistry`, `ObjectPool`, `BootstrapHelper`, `Database`,
+ * `SyncClient`, `HydrationCoordinator`. Each component depends on
+ * the previous one, so the construction order matters; isolating it
+ * here means `Ablo.ts` doesn't need to know the dependency order.
+ *
+ * Mirrors the pattern Anthropic uses: their client constructor
+ * imports each `Resource` class and wires it. Ours wires the
+ * sync-engine components instead.
+ */
+import { Database } from '../Database.js';
+import { ModelRegistry } from '../ModelRegistry.js';
+import { ObjectPool } from '../ObjectPool.js';
+import { SyncClient } from '../SyncClient.js';
+import { HydrationCoordinator } from '../sync/HydrationCoordinator.js';
+import { BootstrapHelper } from '../sync/BootstrapHelper.js';
+import type { Schema, SchemaRecord } from '../schema/schema.js';
+import { type AbloPersistence } from './persistence.js';
+export interface InternalComponentsInput<S extends SchemaRecord> {
+    readonly schema: Schema<S>;
+    /** WebSocket URL — used to derive bootstrap HTTP base when the
+     * caller didn't override `bootstrapBaseUrl`. */
+    readonly url: string;
+    readonly options: {
+        readonly maxPoolSize?: number;
+        readonly bootstrapBaseUrl?: string;
+        readonly syncGroups?: string[];
+        readonly persistence?: AbloPersistence;
+        readonly offline?: boolean;
+        readonly inMemory?: boolean;
+    };
+}
+export interface InternalComponents {
+    readonly modelRegistry: ModelRegistry;
+    readonly objectPool: ObjectPool;
+    readonly bootstrapHelper: BootstrapHelper;
+    readonly database: Database;
+    readonly syncClient: SyncClient;
+    readonly hydration: HydrationCoordinator;
+}
+export declare function createInternalComponents<S extends SchemaRecord>(input: InternalComponentsInput<S>): InternalComponents;

package/dist/client/createInternalComponents.js

@@ -0,0 +1,88 @@
+/**
+ * Internal component construction for `Ablo()`.
+ *
+ * Builds the full sync-engine component graph from options + schema:
+ * `ModelRegistry`, `ObjectPool`, `BootstrapHelper`, `Database`,
+ * `SyncClient`, `HydrationCoordinator`. Each component depends on
+ * the previous one, so the construction order matters; isolating it
+ * here means `Ablo.ts` doesn't need to know the dependency order.
+ *
+ * Mirrors the pattern Anthropic uses: their client constructor
+ * imports each `Resource` class and wires it. Ours wires the
+ * sync-engine components instead.
+ */
+import { Database } from '../Database.js';
+import { ModelRegistry, setActiveRegistry } from '../ModelRegistry.js';
+import { ObjectPool } from '../ObjectPool.js';
+import { SyncClient } from '../SyncClient.js';
+import { HydrationCoordinator } from '../sync/HydrationCoordinator.js';
+import { BootstrapHelper } from '../sync/BootstrapHelper.js';
+import { resolveBootstrapBaseUrl } from './auth.js';
+import { shouldUseInMemoryPersistence } from './persistence.js';
+export function createInternalComponents(input) {
+    const { schema, url, options } = input;
+    // The registry is created here but model registration happens in
+    // the caller (Ablo.ts owns `registerModelsFromSchema` since the
+    // schema-to-class translation depends on private helpers there).
+    const modelRegistry = new ModelRegistry({
+        validateOnRegister: false,
+        allowLateReferences: true,
+    });
+    setActiveRegistry(modelRegistry);
+    const objectPool = new ObjectPool({ maxSize: options.maxPoolSize ?? 10000 }, modelRegistry);
+    const bootstrapBaseUrl = resolveBootstrapBaseUrl({
+        url,
+        bootstrapBaseUrl: options.bootstrapBaseUrl,
+    });
+    const bootstrapHelper = new BootstrapHelper({
+        baseUrl: bootstrapBaseUrl,
+        syncGroups: options.syncGroups,
+        instantModels: deriveInstantModels(schema),
+    });
+    const database = new Database(modelRegistry, bootstrapHelper, {
+        // Point-solution default: no browser-local durable store unless the
+        // caller explicitly asks for it. Node/edge runtimes always use the
+        // volatile store because IndexedDB is unavailable there.
+        inMemory: shouldUseInMemoryPersistence(options),
+    });
+    const syncClient = new SyncClient(objectPool, database);
+    // Lazy-load lane: hydrates pool/IDB on `ablo.<model>.load(...)` for
+    // entities not in scope at bootstrap (`load: 'lazy'` models, or
+    // entities accessed via deep-link before the pool warmed up).
+    // Single-flight + IDB write-through.
+    const hydration = new HydrationCoordinator({
+        objectPool,
+        database,
+        registry: modelRegistry,
+        schema,
+        baseUrl: bootstrapBaseUrl,
+    });
+    return {
+        modelRegistry,
+        objectPool,
+        bootstrapHelper,
+        database,
+        syncClient,
+        hydration,
+    };
+}
+/**
+ * Derive instant-bootstrap model names from schema load strategies.
+ * Models with `load: 'lazy'` or `'manual'` are excluded from the
+ * initial bootstrap request — they're fetched on demand by the
+ * `ensure*` loaders or (Phase 6) by the `ObjectPool` auto-fetch
+ * mechanism. Default load strategy is `'instant'`.
+ */
+function deriveInstantModels(schema) {
+    const schemaModels = schema.models ?? schema;
+    return Object.entries(schemaModels).flatMap(([key, def]) => {
+        if (!def || typeof def !== 'object' || !('load' in def)) {
+            return [key]; // no load → instant
+        }
+        const load = def.load;
+        if (!load || load === 'instant') {
+            return [def.typename ?? key];
+        }
+        return []; // lazy or manual → skip
+    });
+}

package/dist/client/createModelProxy.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Per-model resource factory.
+ *
+ * Mirrors Anthropic SDK's `resources/messages.ts` / `resources/models.ts`
+ * pattern: each resource has its own file, the client just instantiates
+ * one per model. Extracted from `Ablo.ts` so the proxy logic is
+ * testable in isolation and the constructor doesn't carry it.
+ *
+ * Each schema model gets one `ModelOperations<T, CreateInput>` —
+ * exposes `retrieve`, `list`, `count`, `create`, `update`, `delete`,
+ * `edit`,
+ * `subscribe`, and `load`. The factory returns a plain object; the
+ * client assembles `ablo.<model>` lookup table from these.
+ */
+import type { MutationOptions } from '../interfaces/index.js';
+import type { ModelRegistry } from '../ModelRegistry.js';
+import type { ObjectPool } from '../ObjectPool.js';
+import type { SyncClient } from '../SyncClient.js';
+import type { HydrationCoordinator } from '../sync/HydrationCoordinator.js';
+import type { LoadWhere } from '../query/types.js';
+import { ModelScope } from '../types/index.js';
+import type { Duration, Snapshot } from '../types/streams.js';
+export interface ModelResourceMeta {
+    readonly key: string;
+    readonly typename: string;
+}
+export declare function getModelResourceMeta(resource: unknown): ModelResourceMeta | undefined;
+export type ModelListScope = ModelScope | 'live' | 'archived' | 'all';
+export interface ModelListOptions<T> {
+    where?: Partial<T>;
+    /** Arbitrary local predicate. Applied after `where`. */
+    filter?: (entity: T) => boolean;
+    orderBy?: {
+        [K in keyof T]?: 'asc' | 'desc';
+    };
+    limit?: number;
+    offset?: number;
+    /** Lifecycle scope. Defaults to live rows. */
+    scope?: ModelListScope;
+}
+export type ModelCountOptions<T> = Pick<ModelListOptions<T>, 'where' | 'filter' | 'scope'>;
+export interface ModelLoadOptions<T> {
+    /**
+     * Filter for the lookup. Accepts:
+     *   - object form: `{ name: 'foo' }` (equality, array values → `IN`)
+     *   - tuple form: `[['name', 'ILIKE', '%Goldman%']]` for operators
+     *
+     * See `LoadWhere<T>` in `query/types.ts`. For OR semantics, run two
+     * `load()` calls and union — the wire protocol is AND-only.
+     */
+    where?: LoadWhere<T>;
+    orderBy?: {
+        [K in keyof T]?: 'asc' | 'desc';
+    };
+    limit?: number;
+    /**
+     * `complete` waits for the server. `unknown` returns whatever is local
+     * immediately and refreshes in the background.
+     */
+    type?: 'complete' | 'unknown';
+    /**
+     * Schema-declared relation names to hydrate alongside the primary
+     * rows. The server's compiler resolves each name via the schema's
+     * relation metadata (`relation.belongsTo` / `relation.hasMany`)
+     * and emits the JOIN.
+     */
+    expand?: readonly string[];
+}
+export interface ModelEditOptions<T = Record<string, unknown>> {
+    /**
+     * Human-readable activity shown to other participants while this handle
+     * is open. Examples: `editing`, `summarizing`, `rewriting`, `reviewing`.
+     */
+    activity?: string;
+    /** Optional field-level target for UI affordances such as busy badges. */
+    field?: keyof T & string;
+    /** Lease duration for the visible activity. Runtime death is cleaned up by TTL. */
+    ttl?: Duration;
+    /** Default wait mode for `handle.update(...)`. Defaults to `confirmed`. */
+    wait?: MutationOptions['wait'];
+}
+export interface ModelEditHandle<T> extends AsyncDisposable {
+    readonly id: string;
+    readonly intentId: string;
+    readonly activity: string;
+    readonly current: T;
+    readonly signal: AbortSignal;
+    update(data: Partial<T>, options?: MutationOptions): Promise<T>;
+    release(): Promise<void>;
+    revoke(): void;
+}
+export interface ModelIntentHandle {
+    readonly id: string;
+    release(): Promise<void>;
+    revoke(): void;
+}
+export interface ModelCollaboration<T> {
+    createIntent(options: {
+        target: {
+            resource: string;
+            id: string;
+            field?: string;
+        };
+        action: string;
+        ttl?: Duration;
+    }): Promise<ModelIntentHandle>;
+    createSnapshot(modelKey: string, id: string): Snapshot;
+}
+export interface ModelOperations<T, CreateInput> {
+    /**
+     * Retrieve a single entity by id from the local pool. Synchronous.
+     * Returns `undefined` when the entity isn't loaded yet — use
+     * `load({where: {id}})` if you want to lazy-hydrate from storage/network.
+     *
+     * Mirrors `stripe.customers.retrieve(id)`.
+     */
+    retrieve(id: string): T | undefined;
+    /**
+     * List entities matching a filter from the local pool. Synchronous.
+     * No network round-trip — use `load()` for hydration.
+     *
+     * Mirrors `stripe.customers.list({...})`.
+     */
+    list(options?: ModelListOptions<T>): T[];
+    /** Count entities matching a filter (synchronous, from local pool). */
+    count(options?: ModelCountOptions<T>): number;
+    /**
+     * Create a new entity — **optimistic, offline-first**. Resolves once
+     * the mutation is queued locally, not when the server confirms.
+     * Server rejection rolls back automatically; watch `sync.syncStatus`.
+     */
+    create(data: CreateInput, options?: MutationOptions): Promise<T>;
+    /** Update an entity by id — optimistic, offline-first (see `create`). */
+    update(id: string, data: Partial<T>, options?: MutationOptions): Promise<T>;
+    /** Delete an entity by id — optimistic, offline-first (see `create`). */
+    delete(id: string, options?: MutationOptions): Promise<void>;
+    /**
+     * Start a model-scoped activity lease for long-running AI or background work.
+     * Other participants can see the activity until `update`, `release`, or TTL.
+     */
+    edit(id: string, options?: ModelEditOptions<T>): Promise<ModelEditHandle<T>>;
+    /** Subscribe to changes (callback called on every change). */
+    subscribe(callback: (entities: T[]) => void, options?: ModelListOptions<T>): () => void;
+    /**
+     * Load matching rows into the local graph if they are not already
+     * present. Single-flight: concurrent calls with the same args share
+     * one in-flight request. Default `type: 'complete'` waits for the
+     * server; `type: 'unknown'` returns local + refreshes async.
+     */
+    load(options?: ModelLoadOptions<T>): Promise<T[]>;
+}
+export declare function createModelProxy<T, C>(schemaKey: string, registeredModelName: string, objectPool: ObjectPool, syncClient: SyncClient, registry: ModelRegistry, hydration: HydrationCoordinator, collaboration?: ModelCollaboration<T>): ModelOperations<T, C>;

package/dist/client/createModelProxy.js

@@ -0,0 +1,199 @@
+/**
+ * Per-model resource factory.
+ *
+ * Mirrors Anthropic SDK's `resources/messages.ts` / `resources/models.ts`
+ * pattern: each resource has its own file, the client just instantiates
+ * one per model. Extracted from `Ablo.ts` so the proxy logic is
+ * testable in isolation and the constructor doesn't carry it.
+ *
+ * Each schema model gets one `ModelOperations<T, CreateInput>` —
+ * exposes `retrieve`, `list`, `count`, `create`, `update`, `delete`,
+ * `edit`,
+ * `subscribe`, and `load`. The factory returns a plain object; the
+ * client assembles `ablo.<model>` lookup table from these.
+ */
+import { autorun } from 'mobx';
+import { AbloStaleContextError, AbloValidationError } from '../errors.js';
+import { Model, modelAsRow } from '../Model.js';
+import { ModelScope } from '../types/index.js';
+const modelResourceMeta = new WeakMap();
+export function getModelResourceMeta(resource) {
+    if (typeof resource !== 'object' || resource === null)
+        return undefined;
+    return modelResourceMeta.get(resource);
+}
+export function createModelProxy(schemaKey, registeredModelName, objectPool, syncClient, registry, hydration, collaboration) {
+    const ModelClass = registry.getModelByName(registeredModelName);
+    if (!ModelClass) {
+        throw new AbloValidationError(`Ablo: schema model "${schemaKey}" resolved to "${registeredModelName}", ` +
+            'but no matching constructor was registered.', { code: 'model_not_registered' });
+    }
+    const load = async (options) => {
+        const rows = await hydration.fetch(schemaKey, options);
+        // The coordinator returns Model instances. ModelOperations is
+        // typed against the schema-inferred row shape (`T`), which is
+        // structurally what the model exposes through its property
+        // accessors — cast at the boundary.
+        return rows;
+    };
+    const waitForMutation = async (model, options) => {
+        if (options?.wait !== 'confirmed')
+            return;
+        await syncClient.syncNow();
+        await syncClient.waitForConfirmation(model.getModelName(), model.id);
+    };
+    const operations = {
+        retrieve(id) {
+            return objectPool.get(id);
+        },
+        list(options) {
+            const all = objectPool.getByType(ModelClass, (options?.scope ?? ModelScope.live));
+            let result = all;
+            if (options?.where) {
+                const where = options.where;
+                result = result.filter((item) => {
+                    for (const [key, value] of Object.entries(where)) {
+                        if (item[key] !== value)
+                            return false;
+                    }
+                    return true;
+                });
+            }
+            if (options?.filter) {
+                result = result.filter(options.filter);
+            }
+            if (options?.orderBy) {
+                const [field, dir] = Object.entries(options.orderBy)[0];
+                result = [...result].sort((a, b) => {
+                    const av = a[field];
+                    const bv = b[field];
+                    if (av == null || bv == null)
+                        return 0;
+                    const cmp = av < bv ? -1 : av > bv ? 1 : 0;
+                    return dir === 'desc' ? -cmp : cmp;
+                });
+            }
+            if (options?.offset)
+                result = result.slice(options.offset);
+            if (options?.limit)
+                result = result.slice(0, options.limit);
+            return result;
+        },
+        count(options) {
+            return this.list(options).length;
+        },
+        async create(data, options) {
+            // TODO(options-persistence): stash `options` alongside the
+            // queued transaction so idempotencyKey survives offline flush.
+            const model = new ModelClass({
+                id: Model.generateId(),
+                ...data,
+                createdAt: new Date(),
+                updatedAt: new Date(),
+            });
+            syncClient.add(model, options);
+            await waitForMutation(model, options);
+            return modelAsRow(model);
+        },
+        async update(id, data, options) {
+            const model = objectPool.get(id);
+            if (!model)
+                throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
+            model.updateFromData(data);
+            syncClient.update(model, options);
+            await waitForMutation(model, options);
+            return modelAsRow(model);
+        },
+        async delete(id, options) {
+            const model = objectPool.get(id);
+            if (!model)
+                throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
+            syncClient.delete(model, options);
+            await waitForMutation(model, options);
+        },
+        async edit(id, options) {
+            if (!collaboration) {
+                throw new AbloValidationError(`Model "${schemaKey}" cannot start edit activity without collaboration wiring.`, { code: 'model_edit_not_configured' });
+            }
+            let model = objectPool.get(id);
+            if (!model) {
+                await load({ where: { id } });
+                model = objectPool.get(id);
+            }
+            if (!model) {
+                throw new AbloValidationError(`Entity not found: ${registeredModelName}/${id}`, { code: 'entity_not_found' });
+            }
+            const activity = options?.activity ?? 'editing';
+            const snapshot = collaboration.createSnapshot(schemaKey, id);
+            const intent = await collaboration.createIntent({
+                target: {
+                    resource: schemaKey,
+                    id,
+                    ...(options?.field ? { field: options.field } : {}),
+                },
+                action: activity,
+                ttl: options?.ttl,
+            });
+            let released = false;
+            const revoke = () => {
+                if (released)
+                    return;
+                released = true;
+                snapshot.signal.removeEventListener('abort', revoke);
+                intent.revoke();
+            };
+            const release = async () => {
+                if (released)
+                    return;
+                released = true;
+                snapshot.signal.removeEventListener('abort', revoke);
+                await intent.release();
+            };
+            snapshot.signal.addEventListener('abort', revoke, { once: true });
+            const handle = {
+                id,
+                intentId: intent.id,
+                activity,
+                current: modelAsRow(model),
+                signal: snapshot.signal,
+                async update(data, updateOptions) {
+                    if (snapshot.signal.aborted) {
+                        throw new AbloStaleContextError(`Edit context is stale for ${schemaKey}/${id}. Re-read the row and retry.`, {
+                            code: 'edit_context_stale',
+                            readAt: snapshot.stamp,
+                            cause: snapshot.signal.reason,
+                        });
+                    }
+                    try {
+                        return await operations.update(id, data, {
+                            wait: options?.wait ?? 'confirmed',
+                            readAt: snapshot.stamp,
+                            onStale: 'reject',
+                            ...updateOptions,
+                            intent,
+                        });
+                    }
+                    finally {
+                        await release();
+                    }
+                },
+                release,
+                revoke,
+                [Symbol.asyncDispose]: release,
+            };
+            return handle;
+        },
+        subscribe(callback, options) {
+            return autorun(() => {
+                const entities = this.list(options);
+                callback(entities);
+            });
+        },
+        load,
+    };
+    modelResourceMeta.set(operations, {
+        key: schemaKey,
+        typename: registeredModelName,
+    });
+    return operations;
+}