@abloatai/ablo 0.34.0 → 0.35.0

package/dist/schema/index.js

@@ -23,31 +23,27 @@
 // Re-export Zod for convenience (consumers can also import directly)
 export { z } from 'zod';
 // Field helpers (optional convenience wrappers around Zod)
-export { field, indexed, getFieldMeta } from './field.js';
+export { field, indexed, getFieldMeta } from '../transaction/schema/field.js';
 // Relation builders
-export { relation } from './relation.js';
+export { relation } from '../transaction/schema/relation.js';
 // Tenancy — the single source of truth for how a model's rows are tenant-scoped.
-export { tenancySchema, scopedViaRefSchema, policyInputSchema, resolvePolicy, resolveTenancy, tenancyColumn, DEFAULT_ORG_COLUMN, } from './tenancy.js';
+export { tenancySchema, scopedViaRefSchema, policyInputSchema, resolvePolicy, resolveTenancy, tenancyColumn, DEFAULT_ORG_COLUMN, } from '../transaction/schema/tenancy.js';
 // Model residency — which database a model's rows live in (`tenant` can be a
 // customer's own database, `control` is Ablo's). A sibling axis to `tenancy`.
-export { residencySchema, DEFAULT_RESIDENCY, 
-// Deliberate back-compat re-export of the deprecated aliases:
-// eslint-disable-next-line @typescript-eslint/no-deprecated
-planeSchema, 
-// eslint-disable-next-line @typescript-eslint/no-deprecated
-DEFAULT_PLANE, } from './residency.js';
+export { residencySchema, DEFAULT_RESIDENCY, } from '../transaction/schema/residency.js';
 // The stored `sync_deltas` row, described as Zod schemas grouped by subsystem and by
 // which database the columns live in.
-export { syncDeltaCoreSchema, deltaAttributionSchema, deltaProvenanceSchema, syncDeltaRowSchema, participantKindSchema, confirmationStateSchema, backfillProvenanceSchema, DELTA_DATA_CLASSIFICATION, DELTA_PHYSICAL_STORAGE, 
-// Deliberate back-compat re-export; physical storage is the precise name.
-// eslint-disable-next-line @typescript-eslint/no-deprecated
-DELTA_RESIDENCY, } from './syncDeltaRow.js';
+export { syncDeltaCoreSchema, deltaAttributionSchema, syncDeltaRowSchema, participantKindSchema, confirmationStateSchema, backfillProvenanceSchema, DELTA_DATA_CLASSIFICATION, DELTA_PHYSICAL_STORAGE, } from './syncDeltaRow.js';
 // The wire delta contract — the server-to-client projection of the stored row.
 // Both the client SDK and the server derive their `SyncDelta` type from these with
 // `z.infer`, so the two ends cannot drift apart.
-export { syncDeltaActionSchema, wireDeltaDataSchema, participantRefSchema, syncDeltaWireCoreSchema, clientSyncDeltaSchema, serverSyncDeltaSchema, } from '../wire/delta.js';
+export { syncDeltaActionSchema, wireDeltaDataSchema, participantRefSchema, syncDeltaWireCoreSchema, clientSyncDeltaSchema, serverSyncDeltaSchema, } from '../transaction/wire/delta.js';
 // Model builder
-export { model, scopeKindOf, } from './model.js';
+export { model, scopeKindOf, 
+// Both meanings: the value a tool enumerates to learn the strategies, and the
+// type a `load` option is checked against. `loadsAtBootstrap` is the one
+// predicate both the client subscription and the server payload ask.
+LoadStrategy, DEFAULT_LOAD_STRATEGY, loadsAtBootstrap, } from '../transaction/schema/model.js';
 // Coordination authoring helpers for the `conflict` axis — composable disposition
 // functions plus a combinator that merges them.
 export { coordination, humansOverwrite, humansReject, humansNotify, agentsOverwrite, agentsReject, agentsNotify, systemOverwrite, systemReject, systemNotify, } from './coordination.js';
@@ -56,9 +52,9 @@ export { coordination, humansOverwrite, humansReject, humansNotify, agentsOverwr
 // sensible defaults for everything else.
 export { mutable, readOnly } from './sugar.js';
 // Schema definition + type inference
-export { defineSchema, composeIdentitySyncGroups, composeEntitySyncGroups, intersectRequestedWithAllowed, identityRole, entityRole, extractIdentityIds, extractEntityIds, syncGroup, syncGroupSchema, syncGroupInputSchema, isSyncGroupInput, identityRoleSchema, entityRoleSchema, roleSchema, roleSourceSchema, scopeSchema, grantsRefSchema, groupsInputSchema, RESERVED_SESSION_SETTINGS, } from './schema.js';
+export { defineSchema, composeIdentitySyncGroups, composeEntitySyncGroups, intersectRequestedWithAllowed, identityRole, entityRole, extractIdentityIds, extractEntityIds, syncGroup, syncGroupSchema, syncGroupInputSchema, isSyncGroupInput, identityRoleSchema, entityRoleSchema, roleSchema, roleSourceSchema, scopeSchema, grantsRefSchema, groupsInputSchema, RESERVED_SESSION_SETTINGS, } from '../transaction/schema/schema.js';
 // Schema ⇄ JSON — serialize a schema for transport and rebuild it on the far side.
-export { serializeSchema, parseSchema, toSchemaJSON, fromSchemaJSON, schemaHash, } from './serialize.js';
+export { serializeSchema, parseSchema, toSchemaJSON, fromSchemaJSON, schemaHash, modelHash, } from './serialize.js';
 // Schema projection — derive an app's subset from one canonical schema.
 export { selectModels, omitModels } from './select.js';
 // Schema → Postgres DDL — shared by the host implementation and the command-line tools.
@@ -73,4 +69,8 @@ export { diffSchema, classifyMigration, classifyCast, isAutoApplicable, isBlocke
 export { generateTypes } from './generate.js';
 // Query definition DSL + type inference
 export { query, defineQueries, } from './queries.js';
-export { schemaToOpenApi } from './openapi.js';
+// The OpenAPI generator describes the language-agnostic `/v1` surface — the
+// primitive itself, which a Python or Go caller consumes with no TypeScript
+// anywhere — so it lives in the settlement core (ADR 0016). Re-exported here so
+// the `@abloatai/ablo/schema` import path keeps resolving.
+export { abloOpenApi, schemaToOpenApi } from '../transaction/schema/openapi.js';

package/dist/schema/queries.d.ts

@@ -13,27 +13,27 @@
  *   } from '@abloatai/ablo/schema';
  *
  *   const schema = defineSchema({
- *     slideLayer: model(
- *       { slideId: z.string(), type: z.string() },
- *       { slide: relation.belongsTo('slides', 'slideId') },
- *       { load: 'lazy', typename: 'SlideLayer', persist: {} },
+ *     block: model(
+ *       { sectionId: z.string(), type: z.string() },
+ *       { section: relation.belongsTo('sections', 'sectionId') },
+ *       { load: 'lazy', typename: 'Block', persist: {} },
  *     ),
  *   });
  *
  *   const queries = defineQueries(schema, {
- *     slideLayersByDeck: query({
- *       input:   z.object({ deckId: z.string() }),
- *       returns: 'slideLayer',   // ← type-checked against schema.models
+ *     blocksByReport: query({
+ *       input:   z.object({ reportId: z.string() }),
+ *       returns: 'block',   // ← type-checked against schema.models
  *     }),
  *   });
  *
- *   type Input  = InferQueryInput<typeof queries.queries.slideLayersByDeck>;
- *   //    ^? { deckId: string }
+ *   type Input  = InferQueryInput<typeof queries.queries.blocksByReport>;
+ *   //    ^? { reportId: string }
  *   type Result = InferQueryResult<
  *     typeof schema,
- *     typeof queries.queries.slideLayersByDeck
+ *     typeof queries.queries.blocksByReport
  *   >;
- *   //    ^? Array<SlideLayer>
+ *   //    ^? Array<Block>
  *
  * Design notes:
  *
@@ -55,7 +55,7 @@
  *    `schema.models[queryDef.returns]` lookup.
  */
 import { z } from 'zod';
-import type { Schema, InferModel, InferModelNames } from './schema.js';
+import type { Schema, InferModel, InferModelNames } from '../transaction/schema/schema.js';
 /**
  * A single query definition: a zod input shape, the schema key of the
  * model it returns, and (after assembly) the name it was registered
@@ -97,15 +97,15 @@ interface QuerySpec<TInput extends z.ZodType, TReturns extends string> {
  * Define a query.
  *
  * `TReturns` is a `const` generic so TypeScript preserves the literal
- * type of the `returns` value at call time (e.g., `'slideLayer'`
+ * type of the `returns` value at call time (e.g., `'block'`
  * instead of widening to `string`). This is what lets `defineQueries`
  * type-check `returns` against the schema's model keys without
  * requiring the consumer to write `as const` manually.
  *
  * ```ts
- * const slideLayersByDeck = query({
- *   input:   z.object({ deckId: z.string() }),
- *   returns: 'slideLayer',
+ * const blocksByReport = query({
+ *   input:   z.object({ reportId: z.string() }),
+ *   returns: 'block',
  * });
  * ```
  */
@@ -133,8 +133,8 @@ export interface Queries<S extends Schema, Q extends QueryRecord<S>> {
  * Infer the input type of a query from its zod schema.
  *
  * ```ts
- * type Input = InferQueryInput<typeof queries.queries.slideLayersByDeck>;
- * // { deckId: string }
+ * type Input = InferQueryInput<typeof queries.queries.blocksByReport>;
+ * // { reportId: string }
  * ```
  */
 export type InferQueryInput<Q extends QueryDef> = z.infer<Q['input']>;
@@ -151,9 +151,9 @@ export type InferQueryInput<Q extends QueryDef> = z.infer<Q['input']>;
  * ```ts
  * type Result = InferQueryResult<
  *   typeof schema,
- *   typeof queries.queries.slideLayersByDeck
+ *   typeof queries.queries.blocksByReport
  * >;
- * // Array<SlideLayer>
+ * // Array<Block>
  * ```
  */
 export type InferQueryResult<S extends Schema, Q extends QueryDef> = Q extends QueryDef<z.ZodType, infer R> ? R extends InferModelNames<S> ? InferModel<S, R>[] : never : never;
@@ -176,23 +176,23 @@ export type InferQueryResult<S extends Schema, Q extends QueryDef> = Q extends Q
  * exist" error deep inside the loader.
  *
  * Each resolved query gets its `name` populated from the record key:
- * `queries.slideLayersByDeck.name === 'slideLayersByDeck'`. Dispatch and
+ * `queries.blocksByReport.name === 'blocksByReport'`. Dispatch and
  * lookup code read `queryDef.name` directly rather than re-deriving it from
  * the surrounding record.
  *
  * ```ts
  * const schema = defineSchema({
- *   slideLayer: model(
- *     { slideId: z.string() },
+ *   block: model(
+ *     { sectionId: z.string() },
  *     {},
- *     { load: 'lazy', typename: 'SlideLayer', persist: {} },
+ *     { load: 'lazy', typename: 'Block', persist: {} },
  *   ),
  * });
  *
  * const queries = defineQueries(schema, {
- *   slideLayersByDeck: query({
- *     input:   z.object({ deckId: z.string() }),
- *     returns: 'slideLayer',   // ← type-checked
+ *   blocksByReport: query({
+ *     input:   z.object({ reportId: z.string() }),
+ *     returns: 'block',   // ← type-checked
  *   }),
  * });
  * ```

package/dist/schema/queries.js

@@ -13,27 +13,27 @@
  *   } from '@abloatai/ablo/schema';
  *
  *   const schema = defineSchema({
- *     slideLayer: model(
- *       { slideId: z.string(), type: z.string() },
- *       { slide: relation.belongsTo('slides', 'slideId') },
- *       { load: 'lazy', typename: 'SlideLayer', persist: {} },
+ *     block: model(
+ *       { sectionId: z.string(), type: z.string() },
+ *       { section: relation.belongsTo('sections', 'sectionId') },
+ *       { load: 'lazy', typename: 'Block', persist: {} },
  *     ),
  *   });
  *
  *   const queries = defineQueries(schema, {
- *     slideLayersByDeck: query({
- *       input:   z.object({ deckId: z.string() }),
- *       returns: 'slideLayer',   // ← type-checked against schema.models
+ *     blocksByReport: query({
+ *       input:   z.object({ reportId: z.string() }),
+ *       returns: 'block',   // ← type-checked against schema.models
  *     }),
  *   });
  *
- *   type Input  = InferQueryInput<typeof queries.queries.slideLayersByDeck>;
- *   //    ^? { deckId: string }
+ *   type Input  = InferQueryInput<typeof queries.queries.blocksByReport>;
+ *   //    ^? { reportId: string }
  *   type Result = InferQueryResult<
  *     typeof schema,
- *     typeof queries.queries.slideLayersByDeck
+ *     typeof queries.queries.blocksByReport
  *   >;
- *   //    ^? Array<SlideLayer>
+ *   //    ^? Array<Block>
  *
  * Design notes:
  *
@@ -55,21 +55,21 @@
  *    `schema.models[queryDef.returns]` lookup.
  */
 import { z } from 'zod';
-import { AbloValidationError } from '../errors.js';
+import { AbloValidationError } from '../transaction/errors.js';
 // ── query() factory ───────────────────────────────────────────────────────
 /**
  * Define a query.
  *
  * `TReturns` is a `const` generic so TypeScript preserves the literal
- * type of the `returns` value at call time (e.g., `'slideLayer'`
+ * type of the `returns` value at call time (e.g., `'block'`
  * instead of widening to `string`). This is what lets `defineQueries`
  * type-check `returns` against the schema's model keys without
  * requiring the consumer to write `as const` manually.
  *
  * ```ts
- * const slideLayersByDeck = query({
- *   input:   z.object({ deckId: z.string() }),
- *   returns: 'slideLayer',
+ * const blocksByReport = query({
+ *   input:   z.object({ reportId: z.string() }),
+ *   returns: 'block',
  * });
  * ```
  */
@@ -99,23 +99,23 @@ export function query(spec) {
  * exist" error deep inside the loader.
  *
  * Each resolved query gets its `name` populated from the record key:
- * `queries.slideLayersByDeck.name === 'slideLayersByDeck'`. Dispatch and
+ * `queries.blocksByReport.name === 'blocksByReport'`. Dispatch and
  * lookup code read `queryDef.name` directly rather than re-deriving it from
  * the surrounding record.
  *
  * ```ts
  * const schema = defineSchema({
- *   slideLayer: model(
- *     { slideId: z.string() },
+ *   block: model(
+ *     { sectionId: z.string() },
  *     {},
- *     { load: 'lazy', typename: 'SlideLayer', persist: {} },
+ *     { load: 'lazy', typename: 'Block', persist: {} },
  *   ),
  * });
  *
  * const queries = defineQueries(schema, {
- *   slideLayersByDeck: query({
- *     input:   z.object({ deckId: z.string() }),
- *     returns: 'slideLayer',   // ← type-checked
+ *   blocksByReport: query({
+ *     input:   z.object({ reportId: z.string() }),
+ *     returns: 'block',   // ← type-checked
  *   }),
  * });
  * ```

package/dist/schema/select.d.ts

@@ -12,8 +12,8 @@
  * import { schema as full } from './schema';
  * import { selectModels } from '@abloatai/ablo/schema';
  *
- * // Subscribe to identity and dataroom content only.
- * export const schema = selectModels(full, ['users', 'organizations', 'datarooms', 'folders', 'files']);
+ * // Subscribe to identity and document content only.
+ * export const schema = selectModels(full, ['users', 'organizations', 'workspaces', 'folders', 'files']);
  * ```
  *
  * Relations whose target falls outside the selected set are dropped, so the
@@ -21,7 +21,7 @@
  * scope-inheritance throws instead, because silently losing it would mis-route
  * a record's fan-out — the selected set must be closed under `parent` edges.
  */
-import type { Schema, SchemaRecord } from './schema.js';
+import type { Schema, SchemaRecord } from '../transaction/schema/schema.js';
 export declare function selectModels<S extends SchemaRecord, K extends keyof S & string>(schema: Schema<S>, keys: readonly K[]): Schema<Pick<S, K>>;
 /**
  * `omitModels` is `selectModels` from the other side: keep every model EXCEPT

package/dist/schema/select.js

@@ -12,8 +12,8 @@
  * import { schema as full } from './schema';
  * import { selectModels } from '@abloatai/ablo/schema';
  *
- * // Subscribe to identity and dataroom content only.
- * export const schema = selectModels(full, ['users', 'organizations', 'datarooms', 'folders', 'files']);
+ * // Subscribe to identity and document content only.
+ * export const schema = selectModels(full, ['users', 'organizations', 'workspaces', 'folders', 'files']);
  * ```
  *
  * Relations whose target falls outside the selected set are dropped, so the
@@ -21,7 +21,7 @@
  * scope-inheritance throws instead, because silently losing it would mis-route
  * a record's fan-out — the selected set must be closed under `parent` edges.
  */
-import { AbloValidationError } from '../errors.js';
+import { AbloValidationError } from '../transaction/errors.js';
 import { schemaHash } from './serialize.js';
 export function selectModels(schema, keys) {
     const keep = new Set(keys);

package/dist/schema/serialize.d.ts

@@ -26,12 +26,12 @@
  *   - exact Zod refinements, which are rebuilt as permissive validators from
  *     {@link FieldMeta}; the server does no field-shape validation
  */
-import type { FieldMeta } from './field.js';
-import type { Tenancy } from './tenancy.js';
-import type { ModelResidency } from './residency.js';
-import type { GrantsRef, LoadStrategy, PersistOptions, AutoFillRule, ConflictAxis } from './model.js';
-import type { RelationType } from './relation.js';
-import { type Schema, type IdentityRole, type EntityRole, type SessionSettings } from './schema.js';
+import type { FieldMeta } from '../transaction/schema/field.js';
+import type { Tenancy } from '../transaction/schema/tenancy.js';
+import type { ModelResidency } from '../transaction/schema/residency.js';
+import type { GrantsRef, LoadStrategy, PersistOptions, AutoFillRule, ConflictAxis } from '../transaction/schema/model.js';
+import type { RelationType } from '../transaction/schema/relation.js';
+import { type Schema, type IdentityRole, type EntityRole, type SessionSettings } from '../transaction/schema/schema.js';
 /** Current schema-JSON envelope version. Bump this on a breaking change to the
  * JSON shape itself — not to a user's schema. */
 declare const SCHEMA_JSON_VERSION: 3;
@@ -103,4 +103,13 @@ export declare function parseSchema(json: string): Schema;
  * active schema hash. Not a security primitive.
  */
 export declare function schemaHash(schema: Schema): string;
+/**
+ * Content hash of ONE serialized model — the unit of the semantic drift check.
+ * Two schemas agree on a model exactly when these match, which is what lets a
+ * client compare only the models it declares instead of welding itself to the
+ * whole-schema hash (where any additive push reads as drift). Computed over the
+ * model's `SchemaJSON` entry with the same canonicalization and hash as
+ * {@link schemaHash}, on both the client and the server's `GET /api/schema`.
+ */
+export declare function modelHash(modelJson: unknown): string;
 export {};

package/dist/schema/serialize.js

@@ -27,8 +27,8 @@
  *     {@link FieldMeta}; the server does no field-shape validation
  */
 import { z } from 'zod';
-import { AbloValidationError } from '../errors.js';
-import { baseFieldsSchema, } from './schema.js';
+import { AbloValidationError } from '../transaction/errors.js';
+import { baseFieldsSchema, } from '../transaction/schema/schema.js';
 /** Current schema-JSON envelope version. Bump this on a breaking change to the
  * JSON shape itself — not to a user's schema. */
 const SCHEMA_JSON_VERSION = 3;
@@ -227,7 +227,21 @@ export function parseSchema(json) {
  * active schema hash. Not a security primitive.
  */
 export function schemaHash(schema) {
-    const canonical = canonicalJson(toSchemaJSON(schema));
+    return fnv1a(canonicalJson(toSchemaJSON(schema)));
+}
+/**
+ * Content hash of ONE serialized model — the unit of the semantic drift check.
+ * Two schemas agree on a model exactly when these match, which is what lets a
+ * client compare only the models it declares instead of welding itself to the
+ * whole-schema hash (where any additive push reads as drift). Computed over the
+ * model's `SchemaJSON` entry with the same canonicalization and hash as
+ * {@link schemaHash}, on both the client and the server's `GET /api/schema`.
+ */
+export function modelHash(modelJson) {
+    return fnv1a(canonicalJson(modelJson));
+}
+/** FNV-1a over an already-canonical string — shared by both hashes above. */
+function fnv1a(canonical) {
     let h = 0x811c9dc5;
     for (let i = 0; i < canonical.length; i++) {
         h ^= canonical.charCodeAt(i);

package/dist/schema/sugar.d.ts

@@ -23,7 +23,7 @@
  * ```
  */
 import type { z } from 'zod';
-import { type ModelDef, type ModelOptions, type ComputedRecord, type RelationRecord } from './model.js';
+import { type ModelDef, type ModelOptions, type ComputedRecord, type RelationRecord } from '../transaction/schema/model.js';
 /**
  * Options accepted by every sugar verb. A strict subset of
  * {@link ModelOptions} — anything the verb infers (`mutable`, `load`,
@@ -79,13 +79,11 @@ export interface SugarOptions<R extends RelationRecord = RelationRecord, C exten
  * Pick the load suffix by data-access pattern:
  *   - `.instant`  — small, always-needed (Theme, Layout, StatusGroup)
  *   - `.lazy`     — large collections fetched on first query
- *     (SlideLayer, Message, Task)
- *   - `.manual`   — never auto-loaded; explicit queries only
+ *     (Block, Message, Task)
  */
 export declare const mutable: {
     instant: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
     lazy: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
-    manual: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
 };
 /**
  * Server-managed entities. `readOnly.*` means clients subscribe to
@@ -102,9 +100,10 @@ export declare const readOnly: {
     instant: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
     lazy: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
     /**
-     * Internal-only: never auto-loaded, never written by clients. The
-     * strongest safety posture — use for tables the SDK must know about
-     * (for type inference) but that should never flow over the wire.
+     * Internal-only: kept out of bootstrap and never written by clients. The
+     * strongest safety posture — use for tables the SDK must know about (for type
+     * inference) but that no client should be able to write. Rows still reach a
+     * client that reads the model, so this is a write boundary, not a read one.
      */
     internal: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
 };

package/dist/schema/sugar.js

@@ -22,11 +22,10 @@
  * }),
  * ```
  */
-import { model, } from './model.js';
+import { model, } from '../transaction/schema/model.js';
 /** Internal helper — builds a ModelDef with baseline safety+load flags applied. */
 function build(shape, opts, baseline) {
-    return model(shape, (opts?.relations ?? {}), {
-        mutable: baseline.mutable,
+    return model(shape, { relations: (opts?.relations ?? {}), mutable: baseline.mutable,
         load: baseline.load,
         lazyObservable: opts?.lazyObservable ?? baseline.lazyObservable,
         typename: opts?.typename,
@@ -36,8 +35,7 @@ function build(shape, opts, baseline) {
         bootstrapLimit: opts?.bootstrapLimit,
         bootstrapOrderBy: opts?.bootstrapOrderBy,
         persist: opts?.persist,
-        computed: opts?.computed,
-    });
+        computed: opts?.computed, });
 }
 /**
  * Client-writable entities. `mutable.*` is the opt-in signal for wire
@@ -47,8 +45,7 @@ function build(shape, opts, baseline) {
  * Pick the load suffix by data-access pattern:
  *   - `.instant`  — small, always-needed (Theme, Layout, StatusGroup)
  *   - `.lazy`     — large collections fetched on first query
- *     (SlideLayer, Message, Task)
- *   - `.manual`   — never auto-loaded; explicit queries only
+ *     (Block, Message, Task)
  */
 export const mutable = {
     instant: (shape, opts) => 
@@ -56,7 +53,6 @@ export const mutable = {
     // `lazyObservable: false` only for very large read-only list models.
     build(shape, opts, { mutable: true, load: 'instant', lazyObservable: true }),
     lazy: (shape, opts) => build(shape, opts, { mutable: true, load: 'lazy', lazyObservable: true }),
-    manual: (shape, opts) => build(shape, opts, { mutable: true, load: 'manual', lazyObservable: true }),
 };
 /**
  * Server-managed entities. `readOnly.*` means clients subscribe to
@@ -78,9 +74,10 @@ export const readOnly = {
     build(shape, opts, { mutable: false, load: 'instant', lazyObservable: true }),
     lazy: (shape, opts) => build(shape, opts, { mutable: false, load: 'lazy', lazyObservable: true }),
     /**
-     * Internal-only: never auto-loaded, never written by clients. The
-     * strongest safety posture — use for tables the SDK must know about
-     * (for type inference) but that should never flow over the wire.
+     * Internal-only: kept out of bootstrap and never written by clients. The
+     * strongest safety posture — use for tables the SDK must know about (for type
+     * inference) but that no client should be able to write. Rows still reach a
+     * client that reads the model, so this is a write boundary, not a read one.
      */
-    internal: (shape, opts) => build(shape, opts, { mutable: false, load: 'manual', lazyObservable: true }),
+    internal: (shape, opts) => build(shape, opts, { mutable: false, load: 'lazy', lazyObservable: true }),
 };

package/dist/schema/syncDeltaRow.d.ts

@@ -1,154 +1,6 @@
 /**
- * Zod schemas that describe the `sync_deltas` storage row — the durable record of
- * one committed change. The row is split into three slices by the concern each one
- * serves:
- *
- *   - {@link syncDeltaCoreSchema} — the sync-protocol slice: everything a client
- *     needs to reconstruct the change, plus the tenant key. This is a portable
- *     payload shape; it is not a statement that the row is physically stored in
- *     the customer's database.
- *   - {@link deltaAttributionSchema} — who made the change, and on whose authority.
- *   - {@link deltaProvenanceSchema} — which AI task, if any, produced it.
- *
- * {@link syncDeltaRowSchema} composes all three into the full stored row.
- * {@link DELTA_DATA_CLASSIFICATION} states which slices contain customer data,
- * while {@link DELTA_PHYSICAL_STORAGE} states where the runtime persists them.
- * Keeping those axes separate prevents a portable schema slice from being cited
- * incorrectly as a physical-residency guarantee.
- *
- * This is the stored shape. The delta broadcast to clients is a narrower projection
- * of it — see {@link import('../wire/delta.js').syncDeltaWireCoreSchema} — and
- * the field names here mirror those on that wire delta.
+ * Compatibility entry point for the durable `sync_deltas` row contract, which
+ * is owned by the transaction layer. The schema barrel continues to re-export
+ * this path so existing `@abloatai/ablo/schema` consumers do not change.
  */
-import { z } from 'zod';
-export { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-export type { ParticipantKind, ConfirmationState } from '../wire/delta.js';
-/** `backfill_provenance` */
-export declare const backfillProvenanceSchema: z.ZodEnum<{
-    unknown: "unknown";
-    exact: "exact";
-    inferred: "inferred";
-}>;
-export type BackfillProvenance = z.infer<typeof backfillProvenanceSchema>;
-/**
- * Everything a client needs to materialize the change, plus the tenant key. This
- * is the portable shape an authoritative WAL change or endpoint event carries.
- * The runtime persists the resulting full row in Ablo's tenant-scoped ordered
- * sync log; it is not written atomically with a direct application-row mutation.
- * `id`, `createdAt`, and `syncGroups` are assigned when the source change is
- * appended, so they are optional at the ingestion boundary.
- */
-export declare const syncDeltaCoreSchema: z.ZodObject<{
-    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodBigInt, z.ZodNumber]>>;
-    actionType: z.ZodString;
-    modelName: z.ZodString;
-    modelId: z.ZodString;
-    data: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    previousData: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-    syncGroups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    organizationId: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodOptional<z.ZodString>;
-    transactionId: z.ZodNullable<z.ZodString>;
-    sourceChangeId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-}, z.core.$strip>;
-export type SyncDeltaCore = z.infer<typeof syncDeltaCoreSchema>;
-export declare const deltaAttributionSchema: z.ZodObject<{
-    createdBy: z.ZodNullable<z.ZodString>;
-    actorId: z.ZodNullable<z.ZodString>;
-    actorKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    onBehalfOfId: z.ZodNullable<z.ZodString>;
-    onBehalfOfKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    capabilityId: z.ZodNullable<z.ZodString>;
-    delegationChainRootUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    confirmationState: z.ZodNullable<z.ZodEnum<{
-        auto: "auto";
-        previewed: "previewed";
-        approved: "approved";
-        required_human_approval: "required_human_approval";
-        auto_historical: "auto_historical";
-    }>>;
-    backfillProvenance: z.ZodNullable<z.ZodEnum<{
-        unknown: "unknown";
-        exact: "exact";
-        inferred: "inferred";
-    }>>;
-}, z.core.$strip>;
-export type DeltaAttribution = z.infer<typeof deltaAttributionSchema>;
-export declare const deltaProvenanceSchema: z.ZodObject<{
-    causedByTaskId: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-export type DeltaProvenance = z.infer<typeof deltaProvenanceSchema>;
-/** The complete `sync_deltas` row: core, attribution, and provenance combined. */
-export declare const syncDeltaRowSchema: z.ZodObject<{
-    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodBigInt, z.ZodNumber]>>;
-    actionType: z.ZodString;
-    modelName: z.ZodString;
-    modelId: z.ZodString;
-    data: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    previousData: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-    syncGroups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    organizationId: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodOptional<z.ZodString>;
-    transactionId: z.ZodNullable<z.ZodString>;
-    sourceChangeId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    createdBy: z.ZodNullable<z.ZodString>;
-    actorId: z.ZodNullable<z.ZodString>;
-    actorKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    onBehalfOfId: z.ZodNullable<z.ZodString>;
-    onBehalfOfKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    capabilityId: z.ZodNullable<z.ZodString>;
-    delegationChainRootUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    confirmationState: z.ZodNullable<z.ZodEnum<{
-        auto: "auto";
-        previewed: "previewed";
-        approved: "approved";
-        required_human_approval: "required_human_approval";
-        auto_historical: "auto_historical";
-    }>>;
-    backfillProvenance: z.ZodNullable<z.ZodEnum<{
-        unknown: "unknown";
-        exact: "exact";
-        inferred: "inferred";
-    }>>;
-    causedByTaskId: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-export type SyncDeltaRow = z.infer<typeof syncDeltaRowSchema>;
-/** Which slices contain retained customer row data versus control metadata. */
-export declare const DELTA_DATA_CLASSIFICATION: {
-    readonly core: "customer-data";
-    readonly attribution: "control-metadata";
-    readonly provenance: "control-metadata";
-};
-/**
- * Where the current runtime physically persists each slice. All three live in
- * Ablo's tenant-scoped `sync_deltas` log. `core` contains full post-change row
- * payloads (and optional previous payloads), so `control` here must not be read
- * as "metadata only."
- */
-export declare const DELTA_PHYSICAL_STORAGE: {
-    readonly core: "control";
-    readonly attribution: "control";
-    readonly provenance: "control";
-};
-/** @deprecated Use `DELTA_PHYSICAL_STORAGE`; classification is a separate axis. */
-export declare const DELTA_RESIDENCY: {
-    readonly core: "control";
-    readonly attribution: "control";
-    readonly provenance: "control";
-};
+export * from '../transaction/log/syncDeltaRow.js';