@abloatai/ablo 0.34.0 → 0.35.0

package/dist/client/resourceTypes.d.ts

@@ -1,253 +1,12 @@
 /**
- * Shared resource types for the typed clients and private HTTP transport.
- * the commit and claim shapes, the session-mint params and resource, and the
- * {@link HttpClaimApi} derivation. This module holds only types and has no runtime
- * imports.
- */
-import type { ReadDependency, TrackDependency } from '../coordination/schema.js';
-import type { ClientCommitReceipt, CommitStatus } from '../wire/commit.js';
-import type { ModelTarget, ModelClaim } from '../coordination/schema.js';
-export type { ModelTarget, ModelClaim };
-import type { SchemaRecord } from '../schema/schema.js';
-import type { SyncGroupInput } from '../schema/roles.js';
-import type { Claim, ClaimStream, ClaimWaitOptions, Duration, HeldClaim } from '../types/streams.js';
-import type { ClaimOptions, ClaimParams, ClaimReadApi, AwaitedClaimMethod } from './createModelProxy.js';
-/**
- * The operations available on each model in the sync engine:
- *   `retrieve({ id })` — an async single-row server read
- *   `list({ where })` — an async collection server read
- *   `get(id)` / `getAll(...)` / `getCount(...)` — synchronous local-cache reads
- *   `create({ data })` / `update({ id, data })` / `delete({ id })` — writes
- *   `claim({ id })` — a durable claim handle for coordinated writes
- */
-export type { LocalCountOptions, LocalReadOptions, ModelListScope, ServerReadOptions, ModelRetrieveParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, ClaimOptions, ClaimParams, ClaimLookupParams, ClaimReorderParams, Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease, ModelOperations, } from './createModelProxy.js';
-export type ModelOperationAction = 'create' | 'update' | 'delete' | 'archive' | 'unarchive';
-export type CommitWait = CommitStatus;
-export type IfClaimedPolicy = 'return' | 'fail';
-export interface ClaimedOptions {
-    /**
-     * What to do when another participant has claimed the target: `return` lets
-     * the read proceed; `fail` throws `AbloClaimedError`. Inspect claim state via
-     * `ablo.<model>.claim.state({ id })`. Waiting is a claim-side concern — take
-     * `ablo.<model>.claim({ id })` (it queues fairly); reads never block.
-     */
-    readonly ifClaimed?: IfClaimedPolicy;
-}
-export type { ClaimWaitOptions } from '../types/streams.js';
-export interface ModelReadOptions extends ClaimedOptions {
-}
-export interface ClaimCreateOptions {
-    readonly target: ModelTarget;
-    /** Peer-visible description of the work — the same field on every claim
-     *  surface. Defaults to `'editing'` when omitted. */
-    readonly description?: string;
-    readonly ttl?: Duration;
-    /**
-     * Join the server's fair FIFO queue when the target is already claimed,
-     * rather than failing immediately. `create` then resolves only once the
-     * lease is actually ours (the server pushes `claim_acquired` if the target
-     * was free, or `claim_granted` when we reach the head of the line). Without
-     * this, a contended claim throws. Used by `ablo.<model>.claim` so writers
-     * serialize instead of racing.
-     */
-    readonly queue?: boolean;
-    /** Cap on how long to wait for a queued grant before rejecting. */
-    readonly waitTimeoutMs?: number;
-    /**
-     * Backpressure: reject with `AbloClaimedError('queue_too_deep')` instead of
-     * waiting if the queue is already `>= maxQueueDepth` when we join.
-     */
-    readonly maxQueueDepth?: number;
-}
-export interface CommitOperationInput {
-    readonly action: ModelOperationAction;
-    /** The model name — matches `ablo.<model>` and the schema's `model()`. */
-    readonly model: string;
-    readonly id?: string | null;
-    readonly data?: Record<string, unknown> | null;
-    readonly transactionId?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: 'reject' | 'overwrite' | 'notify' | null;
-    /** Fencing token (Option B) from the batch's claim handle; server-validated. */
-    readonly fenceToken?: number | null;
-}
-export interface CommitCreateOptions {
-    readonly idempotencyKey?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: 'reject' | 'overwrite' | 'notify' | null;
-    /**
-     * A claim handle from `ablo.<model>.claim({ id })` (or the HTTP claim
-     * surface). Same vocabulary as the per-model writes: the handle's
-     * snapshot watermark becomes the batch `readAt` default and `onStale`
-     * defaults to `'reject'`, so a commit that follows a claim is guarded
-     * against concurrent edits without re-stating the watermark by hand.
-     * Explicit `readAt`/`onStale` on the options win.
-     */
-    readonly claim?: Claim | null;
-    /** One atomic batch. Use a one-element array for a single operation. */
-    readonly operations: readonly CommitOperationInput[];
-    readonly wait?: CommitWait;
-    /**
-     * Batch-level read dependencies — the "did anything I looked at change?" guard.
-     * Declare the rows (`{ model, id, readAt, fields? }`) or sync groups
-     * (`{ group, readAt }`, for example `deck:abc`) this batch was premised on; the
-     * server checks that none moved since `readAt` and fires the entry's `onStale`
-     * over the batch. This is distinct from the write-target `readAt`: it guards what
-     * you read, not what you write.
-     */
-    readonly reads?: readonly ReadDependency[] | null;
-    /**
-     * Durable read-dependencies to register as part of this batch — the persisted
-     * sibling of `reads`. Where `reads` guards only this commit, a `track` entry
-     * (`{ model, id, readAt? }` for a row or `{ group, readAt? }` for a sync group)
-     * lives on past it: a later matching change rides back on a future receipt's
-     * `notifications`. A track-only batch (just `track`, an empty `operations`) is
-     * the batch form of `ablo.<model>.track()`.
-     */
-    readonly track?: readonly TrackDependency[] | null;
-}
-/** Public projection inferred from the canonical runtime schema. */
-export type CommitReceipt = ClientCommitReceipt;
-export interface CommitResource {
-    create(options: CommitCreateOptions): Promise<CommitReceipt>;
-}
-export interface ClaimResource extends ClaimStream {
-    create(options: ClaimCreateOptions): Promise<Claim>;
-    list(target?: Partial<ModelTarget>): readonly ModelClaim[];
-    waitFor(target: Partial<ModelTarget>, options?: ClaimWaitOptions): Promise<void>;
-}
-export interface ModelMutationOptions extends ClaimedOptions {
-    readonly claimRef?: string | {
-        readonly id: string;
-    } | null;
-    readonly idempotencyKey?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: 'reject' | 'overwrite' | 'notify' | null;
-    readonly wait?: CommitWait;
-    readonly claim?: Claim | ClaimOptions | null;
-    /** Fencing token (Option B) from the claim; server-validated at commit. */
-    readonly fenceToken?: number | null;
-}
-/**
- * The stateless HTTP claim surface. Most code puts a `claim` directly on the write
- * (`update({ id, data, claim })`) and lets the SDK release it; reach for this
- * namespace for multi-step handles and coordination screens.
- *
- * It is the same surface as the reactive claim API, but because every read is a
- * server round-trip, `state`, `queue`, and `reorder` are awaited here. The
- * WebSocket client resolves those synchronously from its local cache, which is what
- * lets it read a claim's state inside a React render; a stateless client has no
- * cache to read, so the promise is unavoidable.
+ * The public resource-type surface.
  *
- * It is derived from `ClaimReadApi` through {@link AwaitedClaimMethod} so the two
- * transports cannot drift: the only difference is the promise wrapper that
- * statelessness forces. `claim({ id })` is identical on both (already async);
- * `state`, `queue`, `reorder`, and `release` are the awaited form.
+ * The transport-facing half of these types moved down into the settlement core
+ * (ADR 0016). This module keeps the
+ * consumer-facing import path intact and rejoins it with the model-proxy types
+ * that stay here — `ModelOperations` chief among them, because it returns the
+ * live participant handle.
  */
-export type HttpClaimApi<T = Record<string, unknown>> = ((params: ClaimParams<T>) => Promise<HeldClaim<T>>) & {
-    [K in keyof ClaimReadApi<T>]: AwaitedClaimMethod<ClaimReadApi<T>[K]>;
-};
-/** A single data operation a scoped **agent** session may perform on a model. */
-export type SessionOperation = 'read' | 'create' | 'update' | 'delete';
-/** Parameters for minting an end-user session — full data authority within the
- *  organization. Mints an `ek_` token. `user.id` is your end user's id from your
- *  own identity provider and becomes the session's `participantId`; Ablo does not
- *  model your users, so it is treated as an opaque string at the trust boundary. */
-export interface CreateUserSessionParams {
-    /** Your end user. `id` becomes the token's `participantId`. */
-    user: {
-        id: string;
-    };
-    /** Mint the session into this organization instead of the key's own — for a
-     *  platform that serves many tenants from one backend. Requires the `sk_` key to
-     *  carry the `ephemeral:mint-any-org` scope; omit it for the normal
-     *  single-tenant case. */
-    organizationId?: string;
-    /** Sync groups this session may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`; build with `syncGroup(kind, id)` from
-     *  `@abloatai/ablo/schema`). Omit for the server default:
-     *  `[org:<your org>, user:<user.id>]`. */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes). */
-    ttlSeconds?: number;
-    /** Opaque identity blob echoed back to the client as `ablo.user`. */
-    userMeta?: Record<string, unknown>;
-    agent?: never;
-    can?: never;
-}
-/** Mint params for a scoped **agent** session — mints a restricted `rk_` token
- *  gated to exactly the operations named in `can`. `can` is typed off your
- *  schema (no magic `'task.update'` strings): `{ Task: ['update'], Deck: ['read'] }`
- *  — the SDK serializes each entry to the wire allowlist (`task.update`). */
-export interface CreateAgentSessionParams<S extends SchemaRecord> {
-    /** Your agent. `id` becomes the token's `participantId`. */
-    agent: {
-        id: string;
-    };
-    /** Per-model operation allowlist, typed against the schema's model names. */
-    can: Partial<Record<keyof S & string, readonly SessionOperation[]>>;
-    /** Sync groups this session may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`; build with `syncGroup(kind, id)` from
-     *  `@abloatai/ablo/schema`). Omit for the server default: the org
-     *  anchor (`org:<your org>`) + the agent's own anchor. */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes). */
-    ttlSeconds?: number;
-    /** Opaque identity blob echoed back to the client as `ablo.agent`. */
-    userMeta?: Record<string, unknown>;
-    user?: never;
-}
-/** Params for {@link Ablo.sessions}.create — a discriminated union: pass
- *  `{ user }` for a full-authority end-user session (`ek_`) or `{ agent, can }`
- *  for a scoped agent session (`rk_`). */
-export type CreateSessionParams<S extends SchemaRecord> = CreateUserSessionParams | CreateAgentSessionParams<S>;
-/** Params for {@link Ablo.agents}.create — a flattened agent descriptor (no
- *  `{ agent }` discriminator: `agents.create` only ever mints an agent). Unlike
- *  {@link CreateSessionParams} it resolves to a connected, scoped {@link Ablo}
- *  client rather than a raw token. */
-export interface CreateAgentClientParams<S extends SchemaRecord> {
-    /** The wire participant identity (`agent:<id>`) that claim exclusion and the
-     *  FIFO queue gate on. Omit it to get a fresh random id — a distinct, independent
-     *  participant, which is the default and what you want for concurrent agents.
-     *  Pass a stable string only when one logical agent must re-attach to its own
-     *  held claims across reconnects or restarts. */
-    id?: string;
-    /** A human-readable label for logs and attribution (carried in `userMeta.name`).
-     *  It is independent of `id`: two agents that share a `name` still receive
-     *  distinct ids and coordinate as separate participants — `name` never derives or
-     *  collapses identity. */
-    name?: string;
-    /** Per-model operation allowlist, typed against the schema's model names. */
-    can: Partial<Record<keyof S & string, readonly SessionOperation[]>>;
-    /** Sync groups this agent may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`). Omit for the server default (org anchor + the
-     *  agent's own anchor). */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes); the returned client
-     *  re-mints before expiry, so a long-running agent never handles rotation
-     *  itself. */
-    ttlSeconds?: number;
-    /** Extra opaque identity blob echoed on the session scope. Merged with
-     *  `name` (the `name` param wins if you also set `userMeta.name`). */
-    userMeta?: Record<string, unknown>;
-}
-/** A minted session. `token` is the secret the holder presents as its bearer. */
-export interface AbloSession {
-    object: 'session';
-    /** Stable id of the minted credential (for revocation). */
-    id: string;
-    /** The short-lived session token — `ek_` for a `{ user }` session, `rk_`
-     *  for an `{ agent }` session. Hand this to the participant's runtime. */
-    token: string;
-    /** ISO-8601 expiry. */
-    expiresAt: string;
-    organizationId: string;
-    scope: {
-        organizationId: string;
-        syncGroups: readonly string[];
-        operations: readonly string[];
-        participantKind: 'user' | 'agent' | 'system';
-        participantId: string;
-    };
-    userMeta: Record<string, unknown>;
-}
+export * from '../transaction/resources/httpResources.js';
+export type { LocalCountOptions, LocalReadOptions, ModelListScope, ServerReadOptions, ModelRetrieveParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, ClaimOptions, ClaimParams, ClaimLookupParams, ClaimReorderParams, Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease, } from '../transaction/resources/modelOperations.js';
+export type { ModelOperations } from './createModelProxy.js';

package/dist/client/resourceTypes.js

@@ -1,7 +1,10 @@
 /**
- * Shared resource types for the typed clients and private HTTP transport.
- * the commit and claim shapes, the session-mint params and resource, and the
- * {@link HttpClaimApi} derivation. This module holds only types and has no runtime
- * imports.
+ * The public resource-type surface.
+ *
+ * The transport-facing half of these types moved down into the settlement core
+ * (ADR 0016). This module keeps the
+ * consumer-facing import path intact and rejoins it with the model-proxy types
+ * that stay here — `ModelOperations` chief among them, because it returns the
+ * live participant handle.
  */
-export {};
+export * from '../transaction/resources/httpResources.js';

package/dist/client/schemaConfig.d.ts

@@ -3,11 +3,11 @@
  * functions: {@link computeFKDepthPriority} works out a safe row-insertion
  * order from the schema's foreign-key relations, and
  * {@link deriveConfigFromSchema} packages that ordering, together with a few
- * defaults, into the {@link SyncEngineConfig} a client uses at startup. Both
+ * defaults, into the {@link RuntimeConfig} a client uses at startup. Both
  * are deterministic transforms of the schema and hold no engine state.
  */
-import type { Schema } from '../schema/schema.js';
-import type { SyncEngineConfig } from '../interfaces/index.js';
+import type { Schema } from '../transaction/schema/schema.js';
+import type { RuntimeConfig } from '../interfaces/index.js';
 /**
  * Computes a create-priority map that gives the engine a safe order for
  * inserting rows, so a child row is never written before the parent its
@@ -41,4 +41,4 @@ import type { SyncEngineConfig } from '../interfaces/index.js';
  * algorithms."
  */
 export declare function computeFKDepthPriority(schema: Schema): ReadonlyMap<string, number>;
-export declare function deriveConfigFromSchema(schema: Schema): SyncEngineConfig;
+export declare function deriveConfigFromSchema(schema: Schema): RuntimeConfig;

package/dist/client/schemaConfig.js

@@ -3,10 +3,10 @@
  * functions: {@link computeFKDepthPriority} works out a safe row-insertion
  * order from the schema's foreign-key relations, and
  * {@link deriveConfigFromSchema} packages that ordering, together with a few
- * defaults, into the {@link SyncEngineConfig} a client uses at startup. Both
+ * defaults, into the {@link RuntimeConfig} a client uses at startup. Both
  * are deterministic transforms of the schema and hold no engine state.
  */
-import { schemaHash } from '../schema/serialize.js';
+import { schemaHash, modelHash, toSchemaJSON } from '../schema/serialize.js';
 // ── Config derivation from schema ─────────────────────────────────────────
 /**
  * Computes a create-priority map that gives the engine a safe order for
@@ -172,6 +172,10 @@ export function deriveConfigFromSchema(schema) {
         // schema the server currently has active. The server and the `ablo push`
         // command compute this same hash.
         expectedSchemaHash: schemaHash(schema),
+        // Per-model hashes for the SEMANTIC drift check: on a whole-hash mismatch
+        // the client compares only the models it declares, so an additive server
+        // change stays silent and a real divergence names the exact models.
+        expectedModelHashes: Object.fromEntries(Object.entries(toSchemaJSON(schema).models).map(([key, model]) => [key, modelHash(model)])),
         // For a projection (`selectModels`/`omitModels`), also carry the full source
         // schema's hash. The drift check accepts a server match on either hash, so a
         // subset client stays quiet against a server running its full source schema.

package/dist/client/validateAbloOptions.d.ts

@@ -9,7 +9,8 @@
  * problem, because the identity error messages mention the URL and would
  * mislead if the URL were the thing actually missing.
  */
-import { AbloError } from '../errors.js';
+import { AbloError } from '../transaction/errors.js';
+import type { ParticipantKind } from '../transaction/types/participant.js';
 /**
  * The subset of client options this validator reads. It is declared as its own
  * interface, structurally compatible with the full options type, so a real
@@ -20,7 +21,7 @@ export interface ValidatableAbloOptions {
     readonly schema?: {
         readonly models?: Record<string, unknown>;
     } | null;
-    readonly kind?: 'user' | 'agent' | 'system';
+    readonly kind?: ParticipantKind;
     readonly user?: {
         readonly id?: string;
     } | undefined;

package/dist/client/validateAbloOptions.js

@@ -9,7 +9,7 @@
  * problem, because the identity error messages mention the URL and would
  * mislead if the URL were the thing actually missing.
  */
-import { AbloError, AbloValidationError } from '../errors.js';
+import { AbloError, AbloValidationError } from '../transaction/errors.js';
 export function validateAbloOptions(input) {
     const { options, url, configuredApiKey, configuredAuthToken } = input;
     const kind = options.kind ?? 'user';

package/dist/client/wsMutationExecutor.d.ts

@@ -4,7 +4,7 @@
  * commit time because it does not exist yet when the executor is created. A
  * client wires this up automatically unless you supply your own executor.
  */
-import type { ReadDependency, TrackDependency } from '../coordination/schema.js';
+import type { ReadDependency, TrackDependency } from '../transaction/coordination/schema.js';
 import type { MutationExecutor, MutationOperation } from '../interfaces/index.js';
 import type { CommitAck } from '../sync/commitFrames.js';
 /**
@@ -18,10 +18,10 @@ import type { CommitAck } from '../sync/commitFrames.js';
  * the ready socket.
  *
  * When set, `options.idempotencyKey` is sent as the wire-level `clientTxId`, so
- * retrying a call with the same key is safe. TransactionQueue always supplies
+ * retrying a call with the same key is safe. MutationQueue always supplies
  * this key before its first attempt and owns reuse across retries. The fallback
  * generation below exists only for direct, one-shot executor consumers.
  */
 export declare function createDefaultMutationExecutor(getWs: () => {
-    sendCommit?: (operations: readonly MutationOperation[], clientTxId: string, timeoutMs?: number, causedByTaskId?: string | null, reads?: readonly ReadDependency[] | null, track?: readonly TrackDependency[] | null) => Promise<CommitAck>;
+    sendCommit?: (operations: readonly MutationOperation[], clientTxId: string, timeoutMs?: number, reads?: readonly ReadDependency[] | null, track?: readonly TrackDependency[] | null) => Promise<CommitAck>;
 } | null): MutationExecutor;

package/dist/client/wsMutationExecutor.js

@@ -4,7 +4,7 @@
  * commit time because it does not exist yet when the executor is created. A
  * client wires this up automatically unless you supply your own executor.
  */
-import { AbloError, AbloConnectionError } from '../errors.js';
+import { AbloError, AbloConnectionError } from '../transaction/errors.js';
 // ── Default mutation executor (wire: `commit` frame over WebSocket) ──────
 /**
  * Creates the default mutation executor, which sends each change as a `commit`
@@ -17,7 +17,7 @@ import { AbloError, AbloConnectionError } from '../errors.js';
  * the ready socket.
  *
  * When set, `options.idempotencyKey` is sent as the wire-level `clientTxId`, so
- * retrying a call with the same key is safe. TransactionQueue always supplies
+ * retrying a call with the same key is safe. MutationQueue always supplies
  * this key before its first attempt and owns reuse across retries. The fallback
  * generation below exists only for direct, one-shot executor consumers.
  */
@@ -34,7 +34,7 @@ export function createDefaultMutationExecutor(getWs) {
                 : `tx_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`);
         try {
             return await ws.sendCommit(operations, clientTxId, undefined, // use sendCommit's built-in 15s default; no per-call override
-            options?.causedByTaskId, options?.reads, options?.track);
+            options?.reads, options?.track);
         }
         catch (err) {
             // Wrap transport-level failures as connection errors so the transaction

package/dist/context.d.ts

@@ -1,29 +1,29 @@
 /**
- * Module-level accessor for the sync engine's shared context.
+ * Module-level accessor for the sync engine's runtime context.
  *
- * The context is set once, during initialization, by {@link initSyncEngine}.
+ * The context is set once, during initialization, by {@link initRuntime}.
  * Code throughout the package reaches its shared dependencies — logger,
  * observability, online-status detector, configuration, and the mutation
  * executor — through {@link getContext} instead of receiving them through every
  * constructor.
  */
-import type { SyncEngineContext } from './SyncEngineContext.js';
+import type { RuntimeContext } from './RuntimeContext.js';
 /**
- * Initialize the sync engine with application-provided dependencies.
- * Must be called before any sync engine operations.
+ * Install the caller-provided runtime dependencies. Must be called before any
+ * operation that reaches {@link getContext}.
  */
-export declare function initSyncEngine(context: SyncEngineContext): void;
+export declare function initRuntime(context: RuntimeContext): void;
 /**
  * Get the current sync engine context.
  * Returns a safe fallback with no-op implementations if not yet initialized,
  * so SDK files can import at module load time without crashing.
  */
-export declare function getContext(): SyncEngineContext;
+export declare function getContext(): RuntimeContext;
 /**
  * Check if the sync engine has been initialized.
  */
-export declare function isSyncEngineInitialized(): boolean;
+export declare function isRuntimeInitialized(): boolean;
 /**
  * Reset context (for testing or cleanup).
  */
-export declare function resetSyncEngine(): void;
+export declare function resetRuntime(): void;

package/dist/context.js

@@ -1,19 +1,19 @@
 /**
- * Module-level accessor for the sync engine's shared context.
+ * Module-level accessor for the sync engine's runtime context.
  *
- * The context is set once, during initialization, by {@link initSyncEngine}.
+ * The context is set once, during initialization, by {@link initRuntime}.
  * Code throughout the package reaches its shared dependencies — logger,
  * observability, online-status detector, configuration, and the mutation
  * executor — through {@link getContext} instead of receiving them through every
  * constructor.
  */
-import { noopLogger, noopObservability, browserOnlineStatus, defaultSessionErrorDetector, emptyConfig, } from './SyncEngineContext.js';
+import { noopLogger, noopObservability, browserOnlineStatus, defaultSessionErrorDetector, emptyConfig, } from './RuntimeContext.js';
 let _context = null;
 /**
- * Initialize the sync engine with application-provided dependencies.
- * Must be called before any sync engine operations.
+ * Install the caller-provided runtime dependencies. Must be called before any
+ * operation that reaches {@link getContext}.
  */
-export function initSyncEngine(context) {
+export function initRuntime(context) {
     _context = context;
 }
 /**
@@ -30,13 +30,13 @@ export function getContext() {
 /**
  * Check if the sync engine has been initialized.
  */
-export function isSyncEngineInitialized() {
+export function isRuntimeInitialized() {
     return _context !== null;
 }
 /**
  * Reset context (for testing or cleanup).
  */
-export function resetSyncEngine() {
+export function resetRuntime() {
     _context = null;
 }
 /** Fallback context with no-op implementations */
@@ -46,8 +46,9 @@ const _fallback = {
     onlineStatus: browserOnlineStatus,
     sessionErrorDetector: defaultSessionErrorDetector,
     config: emptyConfig,
+    getModelMetadata: () => undefined,
     mutationExecutor: {
-        commit: () => Promise.resolve({ lastSyncId: 0 }),
+        commit: () => Promise.resolve({ lastSyncId: 0, status: 'confirmed' }),
         executeCreate: () => Promise.resolve(),
         executeUpdate: () => Promise.resolve(null),
         executeDelete: () => Promise.resolve(),

package/dist/coordination/ClaimLog.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Sync-engine compatibility adapter for the transaction layer's narrow claim
+ * log. The core log knows only claim/conflict events; this subclass supplies
+ * inert implementations for the client lifecycle hooks required by
+ * `ObservabilityProvider`, preserving `Ablo({ observability: new ClaimLog() })`
+ * without leaking bootstrap, storage, or WebSocket vocabulary into the core.
+ */
+import { ClaimLog as CoordinationClaimLog } from '../transaction/coordination/trace.js';
+import type { ObservabilityProvider } from '../interfaces/index.js';
+export { formatClaim, formatConflict } from '../transaction/coordination/trace.js';
+export type { ClaimLogEntry } from '../transaction/coordination/trace.js';
+export declare class ClaimLog extends CoordinationClaimLog implements ObservabilityProvider {
+    setContext(): void;
+    setConnectionState(): void;
+    breadcrumb(): void;
+    captureRollback(): void;
+    captureMutationFailure(): void;
+    captureBootstrapFailure(): void;
+    captureReconciliation(): void;
+    captureDeltaRetryExhausted(): void;
+    captureWebSocketError(): void;
+    captureSelfHealing(): void;
+    captureCommitZeroSyncId(): void;
+    startSpan<T>(_name: string, _op: string, fn: () => T): T;
+    startSpanAsync<T>(_name: string, _op: string, fn: () => Promise<T>): Promise<T>;
+}

package/dist/coordination/ClaimLog.js

@@ -0,0 +1,32 @@
+/**
+ * Sync-engine compatibility adapter for the transaction layer's narrow claim
+ * log. The core log knows only claim/conflict events; this subclass supplies
+ * inert implementations for the client lifecycle hooks required by
+ * `ObservabilityProvider`, preserving `Ablo({ observability: new ClaimLog() })`
+ * without leaking bootstrap, storage, or WebSocket vocabulary into the core.
+ */
+import { ClaimLog as CoordinationClaimLog } from '../transaction/coordination/trace.js';
+export { formatClaim, formatConflict } from '../transaction/coordination/trace.js';
+export class ClaimLog extends CoordinationClaimLog {
+    // Client-lifecycle hooks the claim log has no notion of. Every body below is
+    // deliberately inert: the log records claims and conflicts, nothing else.
+    setContext() { }
+    setConnectionState() { }
+    breadcrumb() { }
+    captureRollback() { }
+    captureMutationFailure() { }
+    captureBootstrapFailure() { }
+    captureReconciliation() { }
+    captureDeltaRetryExhausted() { }
+    captureWebSocketError() { }
+    captureSelfHealing() { }
+    captureCommitZeroSyncId() { }
+    // Spans run their body untimed; the trailing `attributes` argument callers
+    // pass has nowhere to go here, so it is left off the signature.
+    startSpan(_name, _op, fn) {
+        return fn();
+    }
+    startSpanAsync(_name, _op, fn) {
+        return fn();
+    }
+}

package/dist/coordination/index.d.ts

@@ -1,15 +1 @@
-/**
- * The `@abloatai/ablo/coordination` entry point. It re-exports the wire
- * schemas and inferred types for the three coordination layers: presence (who
- * is currently active), claims (taking exclusive hold of a target before
- * writing it), and stale-context guards (rejecting a write that was based on an
- * out-of-date read). The definitions themselves live in the sibling schema
- * module.
- *
- * Exports are listed by name rather than re-exported wholesale, so every symbol
- * that becomes part of this package's public API is a deliberate choice.
- */
-export { targetRangeSchema, participantKindSchema, wireParticipantKindSchema, participantKindFromWire, descriptionFromMeta, targetRefSchema, onStaleModeSchema, writeGuardSchema, staleNotificationSchema, readDependencySchema, trackDependencySchema, claimStatusSchema, wireClaimSummarySchema, claimErrorSchema, wireClaimSchema, claimRejectionSchema, modelTargetSchema, modelClaimSchema, claimBeginPayloadSchema, claimAbandonPayloadSchema, claimReorderPayloadSchema, claimHeartbeatPayloadSchema, claimHeartbeatAckPayloadSchema, claimHeartbeatBatchPayloadSchema, claimHeartbeatBatchAckPayloadSchema, updateSubscriptionPayloadSchema, subscriptionAckPayloadSchema, commitOperationTypeSchema, commitOperationSchema, presenceKindSchema, presenceActivitySchema, presenceUpdateFrameSchema, } from './schema.js';
-export { defaultPolicy, capabilityPreemptPolicy, interpretConflictAxis } from '../policy/types.js';
-export type { Conflict, ConflictAxis, ConflictDecision, ConflictKind, ConflictOperation, ConflictPolicy, StaleContextConflict, ClaimHeldConflict, } from '../policy/types.js';
-export type { TargetRange, ParticipantKind, TargetRef, OnStaleMode, WriteGuard, StaleNotification, ReadDependency, TrackDependency, ClaimStatus, WireClaimSummary, ClaimError, WireClaim, ClaimRejection, ModelTarget, ModelClaim, ClaimBeginPayload, ClaimAbandonPayload, ClaimReorderPayload, ClaimHeartbeatPayload, ClaimHeartbeatAckPayload, ClaimHeartbeatBatchPayload, ClaimHeartbeatBatchAckPayload, UpdateSubscriptionPayload, SubscriptionAckPayload, CommitOperationType, CommitOperation, AnyCommitOperation, PresenceKind, PresenceActivity, PresenceUpdateFrame, } from './schema.js';
+export * from '../transaction/coordination/index.js';

package/dist/coordination/index.js

@@ -1,31 +1,8 @@
-/**
- * The `@abloatai/ablo/coordination` entry point. It re-exports the wire
- * schemas and inferred types for the three coordination layers: presence (who
- * is currently active), claims (taking exclusive hold of a target before
- * writing it), and stale-context guards (rejecting a write that was based on an
- * out-of-date read). The definitions themselves live in the sibling schema
- * module.
- *
- * Exports are listed by name rather than re-exported wholesale, so every symbol
- * that becomes part of this package's public API is a deliberate choice.
- */
-// Runtime schemas + helpers.
-export { 
-// Shared primitives
-targetRangeSchema, participantKindSchema, wireParticipantKindSchema, participantKindFromWire, descriptionFromMeta, targetRefSchema, 
-// Layer 3 — optimistic stale-context
-onStaleModeSchema, writeGuardSchema, staleNotificationSchema, readDependencySchema, trackDependencySchema, 
-// Layer 2 — pessimistic claim / claim-lease
-claimStatusSchema, wireClaimSummarySchema, claimErrorSchema, wireClaimSchema, claimRejectionSchema, modelTargetSchema, modelClaimSchema, claimBeginPayloadSchema, claimAbandonPayloadSchema, claimReorderPayloadSchema, claimHeartbeatPayloadSchema, claimHeartbeatAckPayloadSchema, claimHeartbeatBatchPayloadSchema, claimHeartbeatBatchAckPayloadSchema, 
-// Read interest — area-of-interest navigation
-updateSubscriptionPayloadSchema, subscriptionAckPayloadSchema, 
-// Commit operation — carries the optimistic write-guard
-commitOperationTypeSchema, commitOperationSchema, 
-// Layer 1 — presence
-presenceKindSchema, presenceActivitySchema, presenceUpdateFrameSchema, } from './schema.js';
-// Conflict-policy runtime — the engine detects a conflict, and the policy
-// decides what to do about it. These are re-exported here so that server-side
-// code can reach both the coordination vocabulary and its default conflict
-// resolution from this one subpath, without importing the full client from the
-// package root.
-export { defaultPolicy, capabilityPreemptPolicy, interpretConflictAxis } from '../policy/types.js';
+// Moved to @ablo/transaction (ADR 0013 — the settlement core extraction).
+// This shim re-exports it at the original path so in-package importers of
+// `coordination/index.js` keep working; rewire to `@ablo/transaction/coordination`
+// and delete this shim once the core package is fully wired.
+//
+// Line comments on purpose: tsc copies a leading JSDoc block into the
+// published `.d.ts`, and this note names a package npm has never heard of.
+export * from '../transaction/coordination/index.js';

package/dist/core/DatabaseManager.js

@@ -7,7 +7,7 @@
  */
 import { getContext } from '../context.js';
 import { openIDBWithTimeout, deleteIDBWithTimeout, IDBOpenTimeoutError, } from './openIDBWithTimeout.js';
-import { AbloConnectionError } from '../errors.js';
+import { AbloConnectionError } from '../transaction/errors.js';
 import { getActiveRegistry, hasActiveRegistry } from '../ModelRegistry.js';
 /**
  * DatabaseManager - Manages Ablo's two-tier database architecture

package/dist/core/QueryView.d.ts

@@ -10,7 +10,7 @@
  */
 import { type IObservableArray } from 'mobx';
 import { type Model } from '../Model.js';
-import { ModelScope } from '../types/index.js';
+import { ModelScope } from '../transaction/types/index.js';
 import type { ViewRegistry } from './ViewRegistry.js';
 import type { IncrementalView } from './queryUtils.js';
 /**