@abloatai/ablo 0.34.1 → 0.35.0

package/dist/schema/syncDeltaRow.js

@@ -1,107 +1,6 @@
 /**
- * Zod schemas that describe the `sync_deltas` storage row — the durable record of
- * one committed change. The row is split into three slices by the concern each one
- * serves:
- *
- *   - {@link syncDeltaCoreSchema} — the sync-protocol slice: everything a client
- *     needs to reconstruct the change, plus the tenant key. This is a portable
- *     payload shape; it is not a statement that the row is physically stored in
- *     the customer's database.
- *   - {@link deltaAttributionSchema} — who made the change, and on whose authority.
- *   - {@link deltaProvenanceSchema} — which AI task, if any, produced it.
- *
- * {@link syncDeltaRowSchema} composes all three into the full stored row.
- * {@link DELTA_DATA_CLASSIFICATION} states which slices contain customer data,
- * while {@link DELTA_PHYSICAL_STORAGE} states where the runtime persists them.
- * Keeping those axes separate prevents a portable schema slice from being cited
- * incorrectly as a physical-residency guarantee.
- *
- * This is the stored shape. The delta broadcast to clients is a narrower projection
- * of it — see {@link import('../wire/delta.js').syncDeltaWireCoreSchema} — and
- * the field names here mirror those on that wire delta.
+ * Compatibility entry point for the durable `sync_deltas` row contract, which
+ * is owned by the transaction layer. The schema barrel continues to re-export
+ * this path so existing `@abloatai/ablo/schema` consumers do not change.
  */
-import { z } from 'zod';
-import { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-// ── Enumerations that mirror the corresponding Postgres enum types ────────────
-// `participant_kind` and `confirmation_state` are shared with the wire delta and
-// live at the wire layer (see `../wire/delta.js`); they are re-exported here so
-// code that imports them from `schema` keeps resolving.
-export { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-/** `backfill_provenance` */
-export const backfillProvenanceSchema = z.enum(['exact', 'inferred', 'unknown']);
-/** A delta payload: the full post-mutation row (or null for deletes). */
-const deltaDataSchema = z.record(z.string(), z.unknown()).nullable();
-// ── Core — the sync-protocol slice ────────────────────────────────────────────
-/**
- * Everything a client needs to materialize the change, plus the tenant key. This
- * is the portable shape an authoritative WAL change or endpoint event carries.
- * The runtime persists the resulting full row in Ablo's tenant-scoped ordered
- * sync log; it is not written atomically with a direct application-row mutation.
- * `id`, `createdAt`, and `syncGroups` are assigned when the source change is
- * appended, so they are optional at the ingestion boundary.
- */
-export const syncDeltaCoreSchema = z.object({
-    /** Monotonically increasing sync id, assigned by the server when the delta is appended; absent on an outbox marker. */
-    id: z.union([z.bigint(), z.number()]).optional(),
-    /** The `action_type` column: a single character, `I` (insert), `U` (update), or `D` (delete). */
-    actionType: z.string().min(1).max(1),
-    modelName: z.string().min(1),
-    modelId: z.string().min(1),
-    data: deltaDataSchema,
-    previousData: deltaDataSchema.optional(),
-    /** Routing keys that decide which subscribers receive this delta; computed by the server at append time. */
-    syncGroups: z.array(z.string()).optional(),
-    /** The committing organization id — the coarse-grained tenant-isolation boundary. */
-    organizationId: z.string().nullable(),
-    /** ISO 8601 timestamp, assigned by the server when the delta is appended. */
-    createdAt: z.string().optional(),
-    transactionId: z.string().nullable(),
-    /**
-     * Stable identity of the authoritative WAL row or endpoint event. It is
-     * nullable for hosted/legacy rows and is never exposed as the optimistic
-     * client transaction id.
-     */
-    sourceChangeId: z.string().min(1).nullable().optional(),
-});
-// ── Attribution — who made the change, and on whose authority ─────────────────
-export const deltaAttributionSchema = z.object({
-    /** The acting participant, recorded as a single column for compatibility; the structured pair below is the richer form. */
-    createdBy: z.string().nullable(),
-    actorId: z.string().nullable(),
-    actorKind: participantKindSchema.nullable(),
-    onBehalfOfId: z.string().nullable(),
-    onBehalfOfKind: participantKindSchema.nullable(),
-    capabilityId: z.string().nullable(),
-    delegationChainRootUserId: z.string().nullable().optional(),
-    confirmationState: confirmationStateSchema.nullable(),
-    backfillProvenance: backfillProvenanceSchema.nullable(),
-});
-// ── Provenance — which AI task produced the change ────────────────────────────
-export const deltaProvenanceSchema = z.object({
-    /** Foreign key to the task record for the AI turn that produced this commit; null when no task applies. */
-    causedByTaskId: z.string().nullable(),
-});
-// ── Full stored row, classification, and physical storage ─────────────────────
-/** The complete `sync_deltas` row: core, attribution, and provenance combined. */
-export const syncDeltaRowSchema = syncDeltaCoreSchema
-    .extend(deltaAttributionSchema.shape)
-    .extend(deltaProvenanceSchema.shape);
-/** Which slices contain retained customer row data versus control metadata. */
-export const DELTA_DATA_CLASSIFICATION = {
-    core: 'customer-data',
-    attribution: 'control-metadata',
-    provenance: 'control-metadata',
-};
-/**
- * Where the current runtime physically persists each slice. All three live in
- * Ablo's tenant-scoped `sync_deltas` log. `core` contains full post-change row
- * payloads (and optional previous payloads), so `control` here must not be read
- * as "metadata only."
- */
-export const DELTA_PHYSICAL_STORAGE = {
-    core: 'control',
-    attribution: 'control',
-    provenance: 'control',
-};
-/** @deprecated Use `DELTA_PHYSICAL_STORAGE`; classification is a separate axis. */
-export const DELTA_RESIDENCY = DELTA_PHYSICAL_STORAGE;
+export * from '../transaction/log/syncDeltaRow.js';

package/dist/server/adapter.d.ts

@@ -16,7 +16,7 @@
  * database row that the rest of the engine reads and writes.
  */
 import type { SourceListQuery, SourceOperation, SourceRequestContext } from '../source/index.js';
-import type { ServerSyncDelta } from '../wire/delta.js';
+import type { ServerSyncDelta } from '../transaction/wire/delta.js';
 import type { BootstrapModel } from './readConfig.js';
 import type { CommitContext, CommitResult } from './commit.js';
 import type { StorageMode } from './storageMode.js';
@@ -41,6 +41,12 @@ export type ReadResult = {
     readonly models: Record<string, Row[]>;
     /** Models whose read failed (partial success), if any. */
     readonly failedModels?: string[];
+    /**
+     * Present when a paged read (`ReadRequest.page`) stopped at its row
+     * limit with rows remaining: pass it back as the next page's cursor.
+     * Absent on the final page and on unpaged reads.
+     */
+    readonly nextCursor?: string;
 } | {
     readonly kind: 'query';
     readonly rows: readonly Row[];
@@ -93,6 +99,17 @@ export type ReadRequest = {
     readonly models: readonly BootstrapModel[];
     readonly requestedModels?: readonly string[];
     readonly scope?: SourceRequestContext;
+    /**
+     * Keyset pagination for a SINGLE-model read (`requestedModels` names
+     * exactly one model): return at most `limit` rows, starting after the
+     * row whose id equals `cursor`. The result carries `nextCursor` while
+     * rows remain. Ignored for multi-model reads and by adapters whose
+     * backend pages upstream on its own.
+     */
+    readonly page?: {
+        readonly cursor?: string;
+        readonly limit: number;
+    };
 } | {
     readonly kind: 'query';
     readonly model: string;

package/dist/server/commit.d.ts

@@ -14,10 +14,10 @@
  * rather than being kept in step by hand.
  */
 import type { ParticipantKind, ConfirmationState } from '../schema/syncDeltaRow.js';
-import type { ParticipantRef } from '../wire/delta.js';
-import type { CommitExecutionResultInput } from '../wire/commit.js';
-import type { Environment } from '../environment.js';
-import type { ReadDependency, TrackDependency } from '../coordination/schema.js';
+import type { ParticipantRef } from '../transaction/wire/delta.js';
+import type { CommitExecutionResultInput } from '../transaction/wire/commit.js';
+import type { Environment } from '../transaction/environment.js';
+import type { ReadDependency, TrackDependency } from '../transaction/coordination/schema.js';
 export interface CommitContext {
     participantId: string;
     /**
@@ -45,7 +45,7 @@ export interface CommitContext {
      * The sync groups this participant subscribes to, taken from the connection
      * upgrade or the capability token. Each is appended to every delta's `sync_groups`
      * so that writes fan out to subscribers of entity-level groups (such as
-     * `deck:abc`), not only the default `org:X` and `user:Y` groups. When omitted, the
+     * `report:abc`), not only the default `org:X` and `user:Y` groups. When omitted, the
      * commit fans out to just the organization and user groups.
      */
     syncGroups?: readonly string[];
@@ -84,13 +84,7 @@ export interface CommitContext {
      */
     confirmationState?: ConfirmationState;
     /**
-     * Optional foreign key to the task that caused the change, written to the
-     * `caused_by_task_id` column when present. Validated when set; clients typically
-     * leave it null and let attribution ride on the actor and capability instead.
-     */
-    causedByTaskId?: string | null;
-    /**
-     * Read dependencies for the whole batch. The committer declares the rows or groups
+     * The premise for the whole batch. The committer declares the rows or groups
      * it read to form this batch; the engine checks that none of them changed since
      * each entry's `readAt` timestamp and applies that entry's `onStale` disposition
      * across the batch. This differs from the per-operation `readAt` guard, which
@@ -98,10 +92,10 @@ export interface CommitContext {
      */
     reads?: ReadDependency[] | null;
     /**
-     * Durable read-dependencies to persist for this commit's participant. Each entry
-     * is kept in `track_dependencies` and re-checked against every future delta; a
-     * later match opens a `StaleNotification` delivered out of band. Distinct from
-     * `reads`, which is checked once here and discarded.
+     * Durable premises to persist for this commit's participant. Each entry is
+     * kept in `track_dependencies` and re-checked against every future delta; a
+     * later match opens a `StaleNotification` delivered out of band. Distinct
+     * from `reads`, which is checked once here and discarded.
      */
     track?: TrackDependency[] | null;
 }

package/dist/server/index.d.ts

@@ -9,6 +9,6 @@
  */
 export type { Row, ReadResult, SyncCursor, DataAdapterCapabilities, ProposalResult, ReadRequest, ChangeSet, SyncResult, DataAdapter, ProposableDataAdapter, AdapterResolver, } from './adapter.js';
 export type { CommitContext, CommitResult } from './commit.js';
-export { commitExecutionResultSchema } from '../wire/commit.js';
+export { commitExecutionResultSchema } from '../transaction/wire/commit.js';
 export { storageModeSchema, type StorageMode } from './storageMode.js';
 export type { ColumnOverride, BootstrapModel } from './readConfig.js';

package/dist/server/index.js

@@ -1,2 +1,2 @@
-export { commitExecutionResultSchema } from '../wire/commit.js';
+export { commitExecutionResultSchema } from '../transaction/wire/commit.js';
 export { storageModeSchema } from './storageMode.js';

package/dist/server/readConfig.d.ts

@@ -23,7 +23,7 @@ export interface BootstrapModel {
     /**
      * The schema key used by source endpoints. `name` stays the wire and result model
      * name (usually the typename), while source handlers are keyed by the developer's
-     * schema key, such as `files` or `slideLayers`.
+     * schema key, such as `files` or `blocks`.
      */
     sourceModel?: string;
     table: string;

package/dist/source/adapters/drizzle.d.ts

@@ -35,7 +35,7 @@
  */
 import { type SQL } from 'drizzle-orm';
 import type { DataSourceAdapter, Row } from '../adapter.js';
-import type { Schema, SchemaRecord } from '../../schema/schema.js';
+import type { Schema, SchemaRecord } from '../../transaction/schema/schema.js';
 /** The subset of a Drizzle database/transaction handle the adapter calls. */
 export interface DrizzleLike {
     execute(query: SQL): Promise<DrizzleExecuteResult>;

package/dist/source/adapters/drizzle.js

@@ -33,14 +33,14 @@
  * which keeps the adapter one small, fully typed unit with no per-driver builder
  * generics.
  */
-import { AbloValidationError } from '../../errors.js';
+import { AbloValidationError } from '../../transaction/errors.js';
 import { sql } from 'drizzle-orm';
 import { outboxEventSchema } from '../contract.js';
 import { adapterTableMigrations } from '../migrations.js';
 import { assertSourceIdempotencyIntent, assertSourceIdempotencyRetention, SOURCE_IDEMPOTENCY_RETENTION, sourceChangeIntentHash, } from '../idempotency.js';
 import { toSchemaJSON } from '../../schema/serialize.js';
 import { camelToSnake, snakeToCamel } from '../../schema/ddl.js';
-import { tenancyColumn } from '../../schema/tenancy.js';
+import { tenancyColumn } from '../../transaction/schema/tenancy.js';
 import { ABLO_POSTGRES_COMMIT_ECHO_PREFIX } from '../types.js';
 function rowsOf(result) {
     return Array.isArray(result) ? result : result.rows;

package/dist/source/adapters/kysely.d.ts

@@ -16,7 +16,7 @@
  * If the owner rolls back, the waiter acquires the reservation and performs the
  * mutation. This gives same-key concurrency one database arbiter and one effect.
  */
-import type { Schema, SchemaRecord } from '../../schema/schema.js';
+import type { Schema, SchemaRecord } from '../../transaction/schema/schema.js';
 import type { DataSourceAdapter, MutationAdapter } from '../adapter.js';
 import { type KyselyLike, type KyselyMutationCore } from './kyselyMutationCore.js';
 export { createKyselyMutationCore, kyselyOperationRowId, type KyselyCompiledQuery, type KyselyDeleteBuilder, type KyselyInsertBuilder, type KyselyInsertValuesBuilder, type KyselyLike, type KyselyMutationCore, type KyselyReturningExecutable, type KyselySelectBuilder, type KyselyTransactionBuilder, type KyselyUpdateBuilder, type KyselyUpdateSetBuilder, } from './kyselyMutationCore.js';

package/dist/source/adapters/kysely.js

@@ -16,7 +16,7 @@
  * If the owner rolls back, the waiter acquires the reservation and performs the
  * mutation. This gives same-key concurrency one database arbiter and one effect.
  */
-import { AbloValidationError } from '../../errors.js';
+import { AbloValidationError } from '../../transaction/errors.js';
 import { changeSetSchema, outboxEventSchema, sourceCommitEchoMarkerSchema, } from '../contract.js';
 import { assertSourceIdempotencyIntent, assertSourceIdempotencyRetention, sourceChangeIntentHash, SOURCE_IDEMPOTENCY_RETENTION, } from '../idempotency.js';
 import { adapterTableMigrations, idempotencyLedgerMigrations, } from '../migrations.js';

package/dist/source/adapters/kyselyMutationCore.d.ts

@@ -7,7 +7,7 @@
  * the same `applyOperation` implementation, so direct and endpoint DML cannot
  * drift into separate hand-written mappers.
  */
-import type { Schema, SchemaRecord } from '../../schema/schema.js';
+import type { Schema, SchemaRecord } from '../../transaction/schema/schema.js';
 import type { AdapterReadRequest, Row } from '../adapter.js';
 import type { Operation } from '../contract.js';
 /** The subset of a Kysely instance, or transaction handle, used by the core. */

package/dist/source/adapters/kyselyMutationCore.js

@@ -7,10 +7,10 @@
  * the same `applyOperation` implementation, so direct and endpoint DML cannot
  * drift into separate hand-written mappers.
  */
-import { AbloValidationError } from '../../errors.js';
+import { AbloValidationError } from '../../transaction/errors.js';
 import { toSchemaJSON } from '../../schema/serialize.js';
 import { camelToSnake, snakeToCamel } from '../../schema/ddl.js';
-import { tenancyColumn } from '../../schema/tenancy.js';
+import { tenancyColumn } from '../../transaction/schema/tenancy.js';
 function buildColumnMaps(schema) {
     const json = toSchemaJSON(schema);
     const out = new Map();

package/dist/source/adapters/memory.js

@@ -9,7 +9,7 @@
  * idempotency ledger keyed by scoped correlation, and an append-only outbox with a
  * monotonic cursor.
  */
-import { AbloValidationError } from '../../errors.js';
+import { AbloValidationError } from '../../transaction/errors.js';
 import { assertSourceIdempotencyIntent, sourceChangeIntentHash, } from '../idempotency.js';
 function rowId(op) {
     const id = op.id ?? op.input?.id;

package/dist/source/adapters/prisma.d.ts

@@ -14,7 +14,7 @@
  * call site.
  */
 import type { DataSourceAdapter, Row } from '../adapter.js';
-import type { SchemaRecord, Schema } from '../../schema/schema.js';
+import type { SchemaRecord, Schema } from '../../transaction/schema/schema.js';
 /** A Prisma model delegate — the subset of its methods the adapter calls. */
 export interface PrismaDelegate {
     findUnique(args: {
@@ -47,9 +47,14 @@ export interface PrismaRaw {
     $executeRawUnsafe(query: string, ...values: unknown[]): Promise<number>;
     $queryRawUnsafe<T = unknown>(query: string, ...values: unknown[]): Promise<T>;
 }
-/** A Prisma client, or its interactive-transaction client, as a structural shape that needs no `@prisma/client` import. */
+/**
+ * A Prisma client as a structural shape that needs no `@prisma/client` import.
+ * The interactive-transaction callback receives only {@link PrismaRaw}: Prisma's
+ * own tx client strips `$transaction` (no nesting), so requiring it there made
+ * a real `PrismaClient` unassignable to this shape.
+ */
 export interface PrismaLike extends PrismaRaw {
-    $transaction<T>(fn: (tx: PrismaLike & PrismaRaw) => Promise<T>): Promise<T>;
+    $transaction<T>(fn: (tx: PrismaRaw) => Promise<T>): Promise<T>;
 }
 export interface PrismaDataSourceOptions {
     /** Map a schema model name → its Prisma delegate name. Default: lower-first-letter. */

package/dist/source/adapters/prisma.js

@@ -13,7 +13,7 @@
  * be tested with a fake, while a real `PrismaClient` satisfies the shape at the
  * call site.
  */
-import { AbloValidationError } from '../../errors.js';
+import { AbloValidationError } from '../../transaction/errors.js';
 import { outboxEventSchema } from '../contract.js';
 import { adapterTableMigrations } from '../migrations.js';
 import { assertSourceIdempotencyIntent, assertSourceIdempotencyRetention, SOURCE_IDEMPOTENCY_RETENTION, sourceChangeIntentHash, } from '../idempotency.js';

package/dist/source/connector.js

@@ -24,7 +24,7 @@
  * the trust model does not.
  */
 import { SOURCE_CONNECTOR_PROTOCOL_VERSION, SOURCE_CONNECTOR_WS_PATH, sourceConnectorSubprotocols, encodeFrame, decodeFrame, ConnectorProtocolError, } from './connectorProtocol.js';
-import { ABLO_HOSTED_HTTP_BASE_URL } from '../client/hostedEndpoints.js';
+import { ABLO_HOSTED_HTTP_BASE_URL } from '../transaction/auth/hostedEndpoints.js';
 /**
  * The default Ablo base URL the connector dials, to which it appends
  * `SOURCE_CONNECTOR_WS_PATH`.

package/dist/source/connectorProtocol.d.ts

@@ -64,10 +64,7 @@ export declare const readyFrameSchema: z.ZodObject<{
     protocolVersion: z.ZodNumber;
     sourceId: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
-    environment: z.ZodOptional<z.ZodEnum<{
-        production: "production";
-        sandbox: "sandbox";
-    }>>;
+    environment: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ReadyFrame = z.infer<typeof readyFrameSchema>;
 /**
@@ -120,10 +117,7 @@ export declare const connectorFrameSchema: z.ZodDiscriminatedUnion<[z.ZodObject<
     protocolVersion: z.ZodNumber;
     sourceId: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
-    environment: z.ZodOptional<z.ZodEnum<{
-        production: "production";
-        sandbox: "sandbox";
-    }>>;
+    environment: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"request">;
     id: z.ZodString;

package/dist/source/connectorProtocol.js

@@ -20,7 +20,8 @@
  * sides infer every wire type from one schema so they cannot silently drift.
  */
 import { z } from 'zod';
-import { WS_BEARER_SUBPROTOCOL_PREFIX } from '../auth/credentialSource.js';
+import { environmentSchema } from '../transaction/environment.js';
+import { WS_BEARER_SUBPROTOCOL_PREFIX } from '../transaction/auth/credentialSource.js';
 /**
  * The wire-protocol version. It increases on any breaking change to a frame's
  * shape, so a connector and server on mismatched versions fail fast during
@@ -71,7 +72,7 @@ export const readyFrameSchema = z.object({
     protocolVersion: z.number().int(),
     sourceId: z.string().optional(),
     organizationId: z.string().optional(),
-    environment: z.enum(['production', 'sandbox']).optional(),
+    environment: environmentSchema.optional(),
 });
 /**
  * A single load, list, or commit request the server forwards to the connector.

package/dist/source/contract.d.ts

@@ -6,14 +6,20 @@
  * one schema that validates it.
  *
  * These schemas describe the adapter's own contract: the change set it commits,
- * the outbox row it stores, and the table migrations it ships. They do not
- * redefine the shared `SourceOperation` and `SourceEvent` wire types, which live
- * in `types.ts`; instead `operationSchema` is kept structurally compatible with
- * `SourceOperation`, a compatibility the assertion at the end of this file proves
- * at compile time so the schema and the interface cannot drift apart.
+ * the outbox row it stores, and the table migrations it ships. The operation
+ * vocabulary is not restated here — `operationSchema` is projected from the
+ * core's `commitOperationSchema`, so an action or field added to the commit
+ * contract reaches a data source by construction. The assertion at the end of
+ * this file then pins the published `SourceOperation` interface to that
+ * projection, which is what keeps the interface tied to the core rather than
+ * merely tied to a second local copy of it.
  */
 import { z } from 'zod';
-/** Mirrors `SourceOperation['type']`. */
+/**
+ * Served, not mirrored. The commit vocabulary is declared once in the core; a
+ * data source speaks the same five actions, so it re-exports them rather than
+ * listing them again under a second name.
+ */
 export declare const operationTypeSchema: z.ZodEnum<{
     CREATE: "CREATE";
     UPDATE: "UPDATE";
@@ -23,9 +29,15 @@ export declare const operationTypeSchema: z.ZodEnum<{
 }>;
 export type OperationType = z.infer<typeof operationTypeSchema>;
 /**
- * A single operation within a change set, and the runtime validator for it. It is
- * structurally compatible with the shared `SourceOperation` type, as the assertion
- * at the end of this file confirms.
+ * A single operation within a change set, and the runtime validator for it.
+ *
+ * The field set is projected from `commitOperationSchema` — an operation
+ * reaching a data source is a commit operation minus the two fields the core
+ * settles internally (`bypass`, `fenceToken`). The two `min(1)` overrides are
+ * deliberate and local: this is a customer-implemented boundary, so an empty
+ * model name or row id is rejected here rather than forwarded. Stating them as
+ * an extension keeps the tightening visible as a choice instead of hiding it
+ * inside a second copy of the shape.
  */
 export declare const operationSchema: z.ZodObject<{
     type: z.ZodEnum<{
@@ -35,16 +47,16 @@ export declare const operationSchema: z.ZodObject<{
         ARCHIVE: "ARCHIVE";
         UNARCHIVE: "UNARCHIVE";
     }>;
-    model: z.ZodString;
-    id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    input: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-    transactionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     readAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     onStale: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
         reject: "reject";
         overwrite: "overwrite";
         notify: "notify";
     }>>>;
+    transactionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    model: z.ZodString;
+    id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    input: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
 }, z.core.$strip>;
 export type Operation = z.infer<typeof operationSchema>;
 /** The supported customer-transaction echo mechanism. */
@@ -92,16 +104,16 @@ export declare const changeSetSchema: z.ZodObject<{
             ARCHIVE: "ARCHIVE";
             UNARCHIVE: "UNARCHIVE";
         }>;
-        model: z.ZodString;
-        id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        input: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-        transactionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         readAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         onStale: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             reject: "reject";
             overwrite: "overwrite";
             notify: "notify";
         }>>>;
+        transactionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        model: z.ZodString;
+        id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        input: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     }, z.core.$strip>>;
     correlationId: z.ZodString;
     intentHash: z.ZodOptional<z.ZodString>;

package/dist/source/contract.js

@@ -6,37 +6,42 @@
  * one schema that validates it.
  *
  * These schemas describe the adapter's own contract: the change set it commits,
- * the outbox row it stores, and the table migrations it ships. They do not
- * redefine the shared `SourceOperation` and `SourceEvent` wire types, which live
- * in `types.ts`; instead `operationSchema` is kept structurally compatible with
- * `SourceOperation`, a compatibility the assertion at the end of this file proves
- * at compile time so the schema and the interface cannot drift apart.
+ * the outbox row it stores, and the table migrations it ships. The operation
+ * vocabulary is not restated here — `operationSchema` is projected from the
+ * core's `commitOperationSchema`, so an action or field added to the commit
+ * contract reaches a data source by construction. The assertion at the end of
+ * this file then pins the published `SourceOperation` interface to that
+ * projection, which is what keeps the interface tied to the core rather than
+ * merely tied to a second local copy of it.
  */
 import { z } from 'zod';
-import { correlationIdSchema } from '../wire/commit.js';
+import { correlationIdSchema } from '../transaction/wire/commit.js';
+import { commitOperationSchema, commitOperationTypeSchema, } from '../transaction/coordination/schema.js';
 import { ABLO_SOURCE_CLIENT_TX_ID_MAX_LENGTH, ABLO_SOURCE_ECHO_MAX_OPERATIONS, ABLO_SOURCE_ECHO_MAX_PAYLOAD_BYTES, } from './types.js';
 const jsonObject = z.record(z.string(), z.unknown());
-/** Mirrors `SourceOperation['type']`. */
-export const operationTypeSchema = z.enum([
-    'CREATE',
-    'UPDATE',
-    'DELETE',
-    'ARCHIVE',
-    'UNARCHIVE',
-]);
 /**
- * A single operation within a change set, and the runtime validator for it. It is
- * structurally compatible with the shared `SourceOperation` type, as the assertion
- * at the end of this file confirms.
+ * Served, not mirrored. The commit vocabulary is declared once in the core; a
+ * data source speaks the same five actions, so it re-exports them rather than
+ * listing them again under a second name.
  */
-export const operationSchema = z.object({
-    type: operationTypeSchema,
+export const operationTypeSchema = commitOperationTypeSchema;
+/**
+ * A single operation within a change set, and the runtime validator for it.
+ *
+ * The field set is projected from `commitOperationSchema` — an operation
+ * reaching a data source is a commit operation minus the two fields the core
+ * settles internally (`bypass`, `fenceToken`). The two `min(1)` overrides are
+ * deliberate and local: this is a customer-implemented boundary, so an empty
+ * model name or row id is rejected here rather than forwarded. Stating them as
+ * an extension keeps the tightening visible as a choice instead of hiding it
+ * inside a second copy of the shape.
+ */
+export const operationSchema = commitOperationSchema
+    .omit({ bypass: true, fenceToken: true })
+    .extend({
     model: z.string().min(1),
     id: z.string().min(1).nullish(),
     input: jsonObject.nullish(),
-    transactionId: z.string().nullish(),
-    readAt: z.number().nullish(),
-    onStale: z.enum(['reject', 'overwrite', 'notify']).nullish(),
 });
 /** The supported customer-transaction echo mechanism. */
 export const sourceCommitEchoSchema = z.object({

package/dist/source/factory.d.ts

@@ -5,7 +5,7 @@
  * enforces the per-key scopes, and routes the four wire operations (`load`,
  * `list`, `commit`, and `events`) to whichever handlers you configured.
  */
-import type { Schema, SchemaRecord, InferCreate } from '../schema/schema.js';
+import type { Schema, SchemaRecord, InferCreate } from '../transaction/schema/schema.js';
 import type { DataSourceAdapter } from './adapter.js';
 import type { SourceApiKey, SourceAuthorizeContext, SourceCommitHandler, SourceEventsHandler, SourceModelHandlers, SourceRequest, SourceScope } from './types.js';
 type SourceModels<S extends SchemaRecord, TAuth> = Partial<{