@abloatai/ablo 0.34.1 → 0.35.0

package/dist/transaction/wire/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The wire contract for the sync protocol: the HTTP envelope shapes and the
+ * write-path frames, with no dependency on the client runtime. A server — a
+ * route handler, an edge function — can import the envelope producers here
+ * without pulling in the full sync client.
+ *
+ * It has two halves, used across every endpoint:
+ *   - Error responses — {@link errorEnvelope}, {@link ErrorEnvelope}, and
+ *     {@link statusForType} turn any thrown value into the uniform
+ *     `{ type, code, param, message, doc_url, request_id }` body.
+ *   - List responses — {@link listEnvelope} and {@link ListEnvelope} stamp the
+ *     uniform `{ object: 'list', data, has_more, next_cursor }` collection.
+ *
+ * The {@link AbloError} hierarchy, {@link docUrlForCode}, and the wire-parsing
+ * helpers are re-exported too, so a single import lets a route throw the right
+ * typed error and serialize it back out.
+ */
+export { errorEnvelopeSchema, errorEnvelope, statusForType, INTERNAL_ERROR_PUBLIC_MESSAGE, } from './errorEnvelope.js';
+export type { ErrorEnvelope } from './errorEnvelope.js';
+export { listEnvelopeSchema, listEnvelope } from './listEnvelope.js';
+export type { ListEnvelope } from './listEnvelope.js';
+export { claimEventSchema } from './claimEvent.js';
+export type { ClaimEvent } from './claimEvent.js';
+export { feedEventSchema, logListResponseSchema } from './feedEvent.js';
+export type { FeedEvent, LogListResponse } from './feedEvent.js';
+export { feedCursorSchema, parseFeedCursor, formatFeedCursor, feedCursorAdvanced, FEED_CURSOR_START, FEED_CURSOR_FORMAT, FEED_CURSOR_EXAMPLE, } from './feedCursor.js';
+export type { FeedCursor } from './feedCursor.js';
+export { bootstrapReasonSchema } from './bootstrapReason.js';
+export type { BootstrapReason } from './bootstrapReason.js';
+export { commitOperationSchema, wireCommitOperationSchema, commitPayloadSchema, commitMessageSchema, } from './frames.js';
+export { PROTOCOL_VERSION, MIN_SUPPORTED_PROTOCOL_VERSION, DEFAULT_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, WS_CLOSE_PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER, protocolVersionProblem, resolveProtocolVersion, } from './protocolVersion.js';
+export type { SupportedProtocolVersion, ProtocolVersionProblem, } from './protocolVersion.js';
+export type { CommitOperation, WireCommitOperation, CommitMessage, MutationResultMessage, } from './frames.js';
+export { COMMIT_CORRELATION_ID_MAX_LENGTH, correlationIdSchema, commitStatusSchema, commitWaitSchema, commitSettlementSchema, commitReceiptSchema, rejectedCommitReceiptSchema, mutationResultPayloadSchema, mutationResultMessageSchema, commitAckSchema, mutationCommitResultSchema, commitOperationControlShape, commitOperationBodySchema, commitRequestSchema, } from './commit.js';
+export type { CommitOperationBody, CommitRequest, CorrelationId, CommitStatus, CommitWait, CommitSettlement, CommitReceiptWire, RejectedCommitReceiptWire, MutationResultPayload, MutationResultMessageWire, CommitAck, MutationCommitResultInput, MutationCommitResult, } from './commit.js';
+export { participantKindSchema, confirmationStateSchema, syncDeltaActionSchema, wireDeltaDataSchema, participantRefSchema, syncDeltaWireCoreSchema, clientSyncDeltaSchema, serverSyncDeltaSchema, deltaSchema, } from './delta.js';
+export type { ParticipantKind, ConfirmationState, SyncDeltaAction, WireDeltaData, ParticipantRef, SyncDeltaWireCore, ClientSyncDelta, ServerSyncDelta, Delta, } from './delta.js';
+export { AbloError, AbloAuthenticationError, AbloPermissionError, AbloValidationError, AbloRateLimitError, AbloIdempotencyError, AbloConnectionError, AbloNotFoundError, AbloServerError, AbloStaleContextError, AbloContentionError, AbloClaimedError, CapabilityError, AbloSessionError, SyncSessionError, docUrlForCode, translateHttpError, errorFromWire, toAbloError, ERROR_CONTRACT_VERSION, errorCodeSpec, } from '../errors.js';
+export type { ErrorCode, WireErrorCode, RequiredCapability } from '../errors.js';
+export { PING_INTERVAL_MS, LEASE_TTL_MS, WS_BEARER_SUBPROTOCOL_PREFIX, WS_SYNC_SUBPROTOCOL, } from './protocol.js';
+export { claimTargetSchema, claimRequestSchema, claimHeartbeatRequestSchema, listQuerySchema, claimListQuerySchema, claimStateSchema, claimAcquiredResponseSchema, claimQueuedResponseSchema, claimAcquireResponseSchema, claimHeartbeatReplySchema, claimHeartbeatBatchReplySchema, claimListResponseSchema, } from './claims.js';
+export type { ClaimTargetBody, ClaimRequest, ClaimHeartbeatRequest, ListQuery, ClaimListQuery, ClaimState, ClaimAcquiredResponse, ClaimQueuedResponse, ClaimAcquireResponse, ClaimHeartbeatReply, ClaimHeartbeatBatchReply, ClaimListResponse, } from './claims.js';
+export { modelReadResponseSchema, modelListResponseSchema, } from './modelResponses.js';
+export type { ModelReadResponse, ModelListResponse } from './modelResponses.js';
+export { projectResponseSchema, projectListResponseSchema, provisionedKeySchema, provisionKeyResponseSchema, conflictAxisWireSchema, schemaModelResponseSchema, schemaReadResponseSchema, logOpSchema, LOG_OP_BY_ACTION, logEventSchema, usageBucketSchema, usageReportResponseSchema, controlKeySchema, controlKeyListResponseSchema, keyMintedResponseSchema, keyRevokedResponseSchema, } from './accountResponses.js';
+export type { ProjectResponse, ProjectListResponse, ProvisionedKey, ProvisionKeyResponse, SchemaModelResponse, SchemaReadResponse, LogOp, LogEvent, UsageBucket, UsageReportResponse, ControlKey, ControlKeyListResponse, KeyMintedResponse, KeyRevokedResponse, } from './accountResponses.js';
+export { WS_INBOUND_FRAMES, wsInboundEnvelopeSchema, isKnownInboundFrame, isSchemaValidatedFrame, } from './inboundFrames.js';
+export type { InboundFrameContract, InboundFrameType, InboundFramePayload, SchemaValidatedFrameType, WsInboundEnvelope, } from './inboundFrames.js';
+export { ephemeralKeyUserSchema, ephemeralKeyRequestSchema, capabilityRequestSchema, } from './auth.js';
+export type { EphemeralKeyUser, EphemeralKeyRequest, CapabilityRequest, } from './auth.js';

package/dist/transaction/wire/index.js

@@ -0,0 +1,74 @@
+/**
+ * The wire contract for the sync protocol: the HTTP envelope shapes and the
+ * write-path frames, with no dependency on the client runtime. A server — a
+ * route handler, an edge function — can import the envelope producers here
+ * without pulling in the full sync client.
+ *
+ * It has two halves, used across every endpoint:
+ *   - Error responses — {@link errorEnvelope}, {@link ErrorEnvelope}, and
+ *     {@link statusForType} turn any thrown value into the uniform
+ *     `{ type, code, param, message, doc_url, request_id }` body.
+ *   - List responses — {@link listEnvelope} and {@link ListEnvelope} stamp the
+ *     uniform `{ object: 'list', data, has_more, next_cursor }` collection.
+ *
+ * The {@link AbloError} hierarchy, {@link docUrlForCode}, and the wire-parsing
+ * helpers are re-exported too, so a single import lets a route throw the right
+ * typed error and serialize it back out.
+ */
+export { errorEnvelopeSchema, errorEnvelope, statusForType, INTERNAL_ERROR_PUBLIC_MESSAGE, } from './errorEnvelope.js';
+export { listEnvelopeSchema, listEnvelope } from './listEnvelope.js';
+// The `GET /v1/logs` feed — the two arms, their envelope, and the cursor that
+// carries a position in each.
+export { claimEventSchema } from './claimEvent.js';
+export { feedEventSchema, logListResponseSchema } from './feedEvent.js';
+export { feedCursorSchema, parseFeedCursor, formatFeedCursor, feedCursorAdvanced, FEED_CURSOR_START, FEED_CURSOR_FORMAT, FEED_CURSOR_EXAMPLE, } from './feedCursor.js';
+export { bootstrapReasonSchema } from './bootstrapReason.js';
+// The write-path frame contract: the message shapes shared by the client and
+// the server. The runtime Zod validators sit beside the interfaces and are
+// pinned to them, and they gate every operation and payload on both commit
+// transports.
+export { commitOperationSchema, wireCommitOperationSchema, commitPayloadSchema, commitMessageSchema, } from './frames.js';
+// Protocol versioning: the single integer the client and server compare to
+// confirm they can speak to each other, plus the WebSocket close code used to
+// reject a mismatch. See protocolVersion.ts for the changelog and deploy rules.
+export { PROTOCOL_VERSION, MIN_SUPPORTED_PROTOCOL_VERSION, DEFAULT_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, WS_CLOSE_PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER, protocolVersionProblem, resolveProtocolVersion, } from './protocolVersion.js';
+// Commit settlement backbone. The transport receipt, server execution cache,
+// and normalized client acknowledgement are different envelopes composed from
+// this one discriminated settlement vocabulary.
+export { COMMIT_CORRELATION_ID_MAX_LENGTH, correlationIdSchema, commitStatusSchema, commitWaitSchema, commitSettlementSchema, commitReceiptSchema, rejectedCommitReceiptSchema, mutationResultPayloadSchema, mutationResultMessageSchema, commitAckSchema, mutationCommitResultSchema, 
+// The request side of the same boundary — one definition, which the published
+// OpenAPI reference derives from rather than describing separately.
+commitOperationControlShape, commitOperationBodySchema, commitRequestSchema, } from './commit.js';
+// The read-path delta contract: the shape the server broadcasts to clients as the
+// payload of a `delta` or `sync_response` frame, together with the shared
+// participant vocabulary it carries. Both ends derive their delta type from these
+// schemas, so the client and server cannot drift apart.
+export { participantKindSchema, confirmationStateSchema, syncDeltaActionSchema, wireDeltaDataSchema, participantRefSchema, syncDeltaWireCoreSchema, clientSyncDeltaSchema, serverSyncDeltaSchema, deltaSchema, } from './delta.js';
+// The error surface a wire consumer needs to throw, classify, and serialize.
+export { AbloError, AbloAuthenticationError, AbloPermissionError, AbloValidationError, AbloRateLimitError, AbloIdempotencyError, AbloConnectionError, AbloNotFoundError, AbloServerError, AbloStaleContextError, AbloContentionError, AbloClaimedError, CapabilityError, AbloSessionError, SyncSessionError, docUrlForCode, translateHttpError, errorFromWire, toAbloError, ERROR_CONTRACT_VERSION, 
+// The table mapping each error code to its HTTP status and retryable flag —
+// plain data a server can use to resolve a code's canonical status the same
+// way the client's error serializer does.
+errorCodeSpec, } from '../errors.js';
+// Protocol timing constants — the 30-second ping cadence and the lease window
+// derived from it, shared by the client heartbeat and the server keepalive,
+// claim leasing, and presence expiry (see protocol.ts) — plus the WebSocket
+// subprotocols used during the authenticated handshake.
+export { PING_INTERVAL_MS, LEASE_TTL_MS, WS_BEARER_SUBPROTOCOL_PREFIX, WS_SYNC_SUBPROTOCOL, } from './protocol.js';
+// The claim routes' half of the boundary — requests and responses both, beside
+// the commit body for the same reason: the server answers in these shapes, the
+// client reads them back through the same schemas, and the OpenAPI reference
+// derives from them rather than describing them from memory.
+export { claimTargetSchema, claimRequestSchema, claimHeartbeatRequestSchema, listQuerySchema, claimListQuerySchema, claimStateSchema, claimAcquiredResponseSchema, claimQueuedResponseSchema, claimAcquireResponseSchema, claimHeartbeatReplySchema, claimHeartbeatBatchReplySchema, claimListResponseSchema, } from './claims.js';
+// The model read routes' responses — the envelope around a row, which is
+// protocol, around `data`, which is the caller's schema.
+export { modelReadResponseSchema, modelListResponseSchema, } from './modelResponses.js';
+// The account routes' responses — projects, the deployed schema, the commit
+// log, usage. What the server, the CLI, and the MCP server agree on.
+export { projectResponseSchema, projectListResponseSchema, provisionedKeySchema, provisionKeyResponseSchema, conflictAxisWireSchema, schemaModelResponseSchema, schemaReadResponseSchema, logOpSchema, LOG_OP_BY_ACTION, logEventSchema, usageBucketSchema, usageReportResponseSchema, controlKeySchema, controlKeyListResponseSchema, keyMintedResponseSchema, keyRevokedResponseSchema, } from './accountResponses.js';
+// The inbound socket surface: every frame the server can send, and how each
+// one's payload is validated.
+export { WS_INBOUND_FRAMES, wsInboundEnvelopeSchema, isKnownInboundFrame, isSchemaValidatedFrame, } from './inboundFrames.js';
+// Credential minting — the first call any caller makes, so the contract cannot
+// omit it. Response side lives in `auth/schemas.ts`.
+export { ephemeralKeyUserSchema, ephemeralKeyRequestSchema, capabilityRequestSchema, } from './auth.js';

package/dist/{wire → transaction/wire}/listEnvelope.d.ts

@@ -8,20 +8,19 @@
  * produces it, so every list across the API reads from one definition. The
  * generic type parameter carries the row type of `data`.
  */
-export interface ListEnvelope<T> {
-    /** Always the literal `'list'`. Lets a generic client recognize a collection
-     *  response without special-casing each endpoint. */
-    readonly object: 'list';
-    /** The page of results. Always present (an empty array when there are none),
-     *  never omitted, so `body.data` is a stable access path. */
-    readonly data: readonly T[];
-    /** Whether more results exist past this page. Drive "load more" off this,
-     *  not off `data.length === limit` (ambiguous on an exact-multiple page). */
-    readonly has_more: boolean;
-    /** Opaque cursor to pass back as `?starting_after=` for the next page, or
-     *  `null` when {@link has_more} is `false`. */
-    readonly next_cursor: string | null;
-}
+import { z } from 'zod';
+/**
+ * Builds the authoritative list-envelope schema for a row schema. Keeping the
+ * item validator generic lets every endpoint share the same envelope contract
+ * without weakening `data` to `unknown[]`.
+ */
+export declare function listEnvelopeSchema<T>(itemSchema: z.ZodType<T>): z.ZodObject<{
+    object: z.ZodLiteral<"list">;
+    data: z.ZodReadonly<z.ZodArray<z.ZodType<T, unknown, z.core.$ZodTypeInternals<T, unknown>>>>;
+    has_more: z.ZodBoolean;
+    next_cursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ListEnvelope<T> = Readonly<z.infer<ReturnType<typeof listEnvelopeSchema<T>>>>;
 /**
  * Wraps an already-fetched page of rows in the uniform {@link ListEnvelope}.
  *

package/dist/transaction/wire/listEnvelope.js

@@ -0,0 +1,42 @@
+/**
+ * The envelope every endpoint that returns a collection wraps its results in.
+ * Because the shape is always the same — `{ object: 'list', data, has_more,
+ * next_cursor }` — a consumer can detect and paginate any list the same way,
+ * instead of learning a different payload key for each endpoint.
+ *
+ * The list endpoints emit this shape and the {@link listEnvelope} helper
+ * produces it, so every list across the API reads from one definition. The
+ * generic type parameter carries the row type of `data`.
+ */
+import { z } from 'zod';
+/**
+ * Builds the authoritative list-envelope schema for a row schema. Keeping the
+ * item validator generic lets every endpoint share the same envelope contract
+ * without weakening `data` to `unknown[]`.
+ */
+export function listEnvelopeSchema(itemSchema) {
+    return z.object({
+        object: z.literal('list'),
+        data: z.array(itemSchema).readonly(),
+        has_more: z.boolean(),
+        next_cursor: z.string().nullable(),
+    });
+}
+/**
+ * Wraps an already-fetched page of rows in the uniform {@link ListEnvelope}.
+ *
+ * Pagination stays the caller's job — fetch one more row than the limit to
+ * decide `hasMore`, and derive the cursor from the last row's sort key. This
+ * helper only applies the envelope so no endpoint has to build the shape by
+ * hand. The defaults describe a small, unpaginated collection
+ * (`has_more: false`, `next_cursor: null`); a paginated endpoint passes both
+ * explicitly.
+ */
+export function listEnvelope(data, opts = {}) {
+    return {
+        object: 'list',
+        data,
+        has_more: opts.hasMore ?? false,
+        next_cursor: opts.nextCursor ?? null,
+    };
+}

package/dist/transaction/wire/modelResponses.d.ts

@@ -0,0 +1,85 @@
+/**
+ * What the model read routes answer with — `GET /v1/models/{model}/{id}` and
+ * `GET /v1/models/{model}`.
+ *
+ * `data` is `unknown` here on purpose. The transport that reads these responses
+ * is schema-agnostic: it moves rows for whatever schema the caller declared, so
+ * it validates the envelope around a row and leaves the row itself to the typed
+ * surface above it. Everything outside `data` — the watermark, the claims, the
+ * pagination — is protocol, and protocol is validated here.
+ */
+import { z } from 'zod';
+/**
+ * `GET /v1/models/{model}/{id}`.
+ *
+ * `stamp` is the row's watermark: the log position the read reflects. A write
+ * that guards on this premise (`readAt`) is rejected if the row moved on in
+ * between, which is what makes a read→decide→write sequence safe without a
+ * lock. A missing row answers 404, so `data` is always present here.
+ */
+export declare const modelReadResponseSchema: z.ZodObject<{
+    object: z.ZodLiteral<"model">;
+    model: z.ZodString;
+    id: z.ZodString;
+    data: z.ZodUnknown;
+    stamp: z.ZodNumber;
+    claims: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+        id: z.ZodString;
+        actor: z.ZodString;
+        participantKind: z.ZodPreprocess<z.ZodEnum<{
+            user: "user";
+            agent: "agent";
+            system: "system";
+        }>>;
+        onBehalfOfId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        onBehalfOfKind: z.ZodOptional<z.ZodNullable<z.ZodPreprocess<z.ZodEnum<{
+            user: "user";
+            agent: "agent";
+            system: "system";
+        }>>>>;
+        capabilityId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        description: z.ZodOptional<z.ZodString>;
+        status: z.ZodOptional<z.ZodEnum<{
+            active: "active";
+            queued: "queued";
+        }>>;
+        position: z.ZodOptional<z.ZodNumber>;
+        expiresAt: z.ZodNumber;
+        fenceToken: z.ZodOptional<z.ZodNumber>;
+        target: z.ZodReadonly<z.ZodObject<{
+            model: z.ZodString;
+            id: z.ZodString;
+            path: z.ZodOptional<z.ZodString>;
+            range: z.ZodOptional<z.ZodObject<{
+                startLine: z.ZodNumber;
+                endLine: z.ZodNumber;
+                startColumn: z.ZodOptional<z.ZodNumber>;
+                endColumn: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+            field: z.ZodOptional<z.ZodString>;
+            fields: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+            meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>;
+        meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        field: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>;
+export type ModelReadResponse = z.infer<typeof modelReadResponseSchema>;
+/**
+ * `GET /v1/models/{model}` — the list envelope, with the two fields the model
+ * routes add to it: the model's name and the org-wide watermark the page was
+ * read at.
+ *
+ * The envelope is derived, not restated. A schema-agnostic row is `z.unknown()`,
+ * which the generic helper accepts like any other item schema, so there is no
+ * layer at which the shared fields have to be spelled a second time.
+ */
+export declare const modelListResponseSchema: z.ZodObject<{
+    object: z.ZodLiteral<"list">;
+    data: z.ZodReadonly<z.ZodArray<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+    has_more: z.ZodBoolean;
+    next_cursor: z.ZodNullable<z.ZodString>;
+    model: z.ZodString;
+    stamp: z.ZodNumber;
+}, z.core.$strip>;
+export type ModelListResponse = z.infer<typeof modelListResponseSchema>;

package/dist/transaction/wire/modelResponses.js

@@ -0,0 +1,43 @@
+/**
+ * What the model read routes answer with — `GET /v1/models/{model}/{id}` and
+ * `GET /v1/models/{model}`.
+ *
+ * `data` is `unknown` here on purpose. The transport that reads these responses
+ * is schema-agnostic: it moves rows for whatever schema the caller declared, so
+ * it validates the envelope around a row and leaves the row itself to the typed
+ * surface above it. Everything outside `data` — the watermark, the claims, the
+ * pagination — is protocol, and protocol is validated here.
+ */
+import { z } from 'zod';
+import { modelClaimSchema } from '../coordination/schema.js';
+import { listEnvelopeSchema } from './listEnvelope.js';
+/**
+ * `GET /v1/models/{model}/{id}`.
+ *
+ * `stamp` is the row's watermark: the log position the read reflects. A write
+ * that guards on this premise (`readAt`) is rejected if the row moved on in
+ * between, which is what makes a read→decide→write sequence safe without a
+ * lock. A missing row answers 404, so `data` is always present here.
+ */
+export const modelReadResponseSchema = z.object({
+    object: z.literal('model'),
+    model: z.string(),
+    id: z.string(),
+    data: z.unknown(),
+    stamp: z.number(),
+    /** Who holds this row right now — empty when no claim store is configured. */
+    claims: z.array(modelClaimSchema).readonly(),
+});
+/**
+ * `GET /v1/models/{model}` — the list envelope, with the two fields the model
+ * routes add to it: the model's name and the org-wide watermark the page was
+ * read at.
+ *
+ * The envelope is derived, not restated. A schema-agnostic row is `z.unknown()`,
+ * which the generic helper accepts like any other item schema, so there is no
+ * layer at which the shared fields have to be spelled a second time.
+ */
+export const modelListResponseSchema = listEnvelopeSchema(z.unknown()).extend({
+    model: z.string(),
+    stamp: z.number(),
+});

package/dist/transactions/{TransactionQueue.d.ts → mutations/MutationQueue.d.ts}

@@ -1,5 +1,5 @@
 /**
- * TransactionQueue manages the lifecycle of local writes on their way to the
+ * MutationQueue manages the lifecycle of local writes on their way to the
  * server: it applies each change optimistically, batches the writes made in one
  * event-loop tick into a single commit, retries transient failures, and rolls
  * back on permanent rejection.
@@ -12,18 +12,18 @@
  * - A dependency-injected executor, so several queues can coexist.
  */
 import { EventEmitter } from 'events';
-import type { Database } from '../Database.js';
-import { Model } from '../Model.js';
-import { SyncPosition } from '../sync/syncPosition.js';
-import type { WriteOptions } from '../interfaces/index.js';
-import type { StaleNotification, ReadDependency, TrackDependency } from '../coordination/schema.js';
-import { type MutationInput, type Transaction, type UserContext } from './commitPayload.js';
-import { type DurableCommitEnvelope, type DurableCommitOperation, type CommitOutboxScope } from './commitEnvelope.js';
+import type { Database } from '../../Database.js';
+import { Model } from '../../Model.js';
+import { LogPosition } from '../../transaction/logPosition.js';
+import type { WriteOptions } from '../../interfaces/index.js';
+import type { OnStaleMode, StaleNotification, ReadDependency, TrackDependency } from '../../transaction/coordination/schema.js';
+import { type MutationInput, type QueuedMutation, type UserContext } from './commitPayload.js';
+import { type DurableCommitEnvelope, type DurableCommitOperation, type CommitOutboxScope } from '../../transaction/transactions/settlement/commitEnvelope.js';
 import type { DurableWriteStore } from './durableWriteStore.js';
-export type { Transaction, UserContext } from './commitPayload.js';
+export type { QueuedMutation, UserContext } from './commitPayload.js';
 /**
  * A pre-built, multi-operation commit submitted through
- * `ablo.commits.create()`. Unlike the per-model {@link Transaction} (see
+ * `ablo.commits.create()`. Unlike the per-model {@link QueuedMutation} (see
  * `./commitPayload.js`), the caller supplies the operations and the whole
  * envelope commits atomically: the queue does not coalesce it, reorder its
  * operations for foreign keys, or apply it optimistically. It runs through the
@@ -40,16 +40,22 @@ interface CommitTransaction {
         input?: Record<string, unknown>;
         transactionId?: string;
         readAt?: number | null;
-        onStale?: 'reject' | 'overwrite' | 'notify' | null;
+        onStale?: OnStaleMode | null;
     }[];
-    causedByTaskId?: string | null;
-    /** Read dependencies for the whole batch, forwarded to the executor so the server can detect stale-context writes. */
+    /** The premise for the whole batch, forwarded to the executor so the server can detect stale-context writes. */
     reads?: ReadDependency[] | null;
-    /** Durable read-dependencies (`track`) to register for the batch's participant, forwarded to the executor. */
+    /** Durable premises (`track`) to register for the batch's participant, forwarded to the executor. */
     track?: TrackDependency[] | null;
     status: 'pending' | 'executing' | 'awaiting_delta' | 'completed' | 'failed';
     createdAt: number;
     attempts: number;
+    /**
+     * Transient failures that were NOT the transport being down. Waiting out a
+     * dropped connection is unbounded on purpose — that is what lets a commit
+     * survive a reconnect — so connection errors are deliberately not counted
+     * here, and only a server that keeps rejecting can exhaust the lane.
+     */
+    transientAttempts?: number;
     lastSyncId?: number;
     /** Opaque customer-side batch ledger key returned by a queued receipt. */
     correlationId?: string;
@@ -65,9 +71,9 @@ interface ConflictResolution {
     strategy: 'last-write-wins' | 'merge' | 'reject' | 'custom';
     resolver?: (local: MutationInput | undefined, remote: MutationInput) => MutationInput;
 }
-interface TransactionQueueConfig {
-    /** Shared client position (see sync/syncPosition.ts). One per client. */
-    position?: SyncPosition;
+interface MutationQueueConfig {
+    /** Shared client position (see logPosition.ts). One per client. */
+    position?: LogPosition;
     maxBatchSize: number;
     batchDelay: number;
     maxRetries: number;
@@ -99,8 +105,20 @@ interface TransactionQueueConfig {
      * forever if the connection died while a commit was in flight.
      */
     commitOfflineGraceMs: number;
+    /**
+     * How long, in milliseconds, to wait for the transport to acknowledge a
+     * dispatched commit before treating the silence as a retryable no-receipt
+     * failure. A transport that never answers — a half-open socket, a dropped
+     * response frame — would otherwise hold the commit in flight forever, and
+     * with it the client's staged-batch lock: every later write in the session
+     * queues silently behind the unanswered one. The envelope's idempotency key
+     * is stable across retries, so a commit the server DID apply before the
+     * timeout is deduplicated on the retry rather than double-applied.
+     * Defaults to 30 seconds. Set `0` to disable the bound.
+     */
+    commitDispatchTimeoutMs: number;
 }
-export declare class TransactionQueue extends EventEmitter {
+export declare class MutationQueue extends EventEmitter {
     private static readonly DURABLE_REPLAY_WINDOW_MS;
     private store;
     private lastPermanentErrorSig?;
@@ -177,9 +195,9 @@ export declare class TransactionQueue extends EventEmitter {
      * shared: the client injects one, and a standalone queue creates its own. The
      * queue advances the `acked` cursor as commit responses arrive, the store
      * advances `applied` and `persisted`, and snapshots and claims read
-     * `readFloor`. See `../sync/syncPosition.js` for the full contract.
+     * `readFloor`. See `../logPosition.js` for the full contract.
      */
-    readonly position: SyncPosition;
+    readonly position: LogPosition;
     /** Applied-cursor alias, kept so the many internal read sites stay legible. */
     private get lastSeenSyncId();
     private noteAck;
@@ -213,6 +231,18 @@ export declare class TransactionQueue extends EventEmitter {
     private persistDurableCommitAcceptance;
     /** Parse an untrusted/custom executor receipt without making ambiguity fatal. */
     private parseMutationCommitResult;
+    /**
+     * Dispatch a sealed envelope to the transport, bounded by
+     * `commitDispatchTimeoutMs`. Every executor call site routes through here:
+     * a transport that never answers must become a retryable no-receipt failure
+     * (the same class as a malformed receipt) instead of an eternally in-flight
+     * commit, because an unanswered commit holds the staged-batch lock and
+     * silently stalls every later write in the session. The abandoned commit's
+     * eventual result, if it ever arrives, is discarded; the retry re-sends the
+     * identical idempotency key, so the server deduplicates an already-applied
+     * write.
+     */
+    private dispatchCommitBounded;
     private clearReplicationLagState;
     /**
      * Bounds the public `wait: 'confirmed'` promise without changing the
@@ -237,11 +267,11 @@ export declare class TransactionQueue extends EventEmitter {
      * Resolvers for per-transaction `confirmation` promises. Populated in
      * `attachConfirmation` at staging time, consumed by the constructor-time
      * listeners on `transaction:completed` / `transaction:failed`. Kept off
-     * the Transaction row so the store's iteration order stays plain-data
+     * the QueuedMutation row so the store's iteration order stays plain-data
      * and serialization-friendly.
      */
     private confirmationResolvers;
-    constructor(config?: Partial<TransactionQueueConfig>);
+    constructor(config?: Partial<MutationQueueConfig>);
     /**
      * Returns the in-flight confirmation promise for a given model and id. When
      * several transactions match, it returns the most recent one's promise; when
@@ -252,7 +282,7 @@ export declare class TransactionQueue extends EventEmitter {
      * be rolled back — `pending`, `executing`, and `awaiting_delta` — and ignores
      * `completed` (already settled) and `failed`/`rolled_back` (already
      * rejected). This complements the `confirmation` promise carried on a known
-     * {@link Transaction}: use this method at call sites that hold a model
+     * {@link QueuedMutation}: use this method at call sites that hold a model
      * returned by `ablo.<model>.create()` but never see the underlying
      * transaction.
      */
@@ -297,7 +327,7 @@ export declare class TransactionQueue extends EventEmitter {
      * through this instance's connection even when several client instances exist
      * in the same process.
      */
-    setMutationExecutor(executor: import('../interfaces/index.js').MutationExecutor): void;
+    setMutationExecutor(executor: import('../../interfaces/index.js').MutationExecutor): void;
     /**
      * Stages a transaction for commit. Transactions staged within the same
      * event-loop tick are committed together.
@@ -321,24 +351,24 @@ export declare class TransactionQueue extends EventEmitter {
     flushOfflineQueue(): Promise<void>;
     /**
      * Records a create and applies it optimistically, then stages it for the next
-     * batched commit. Returns the {@link Transaction}, whose `confirmation`
+     * batched commit. Returns the {@link QueuedMutation}, whose `confirmation`
      * promise settles once the server confirms the write.
      */
-    create(model: Model, context: UserContext, writeOptions?: WriteOptions, sourceMutationId?: string): Promise<Transaction>;
+    create(model: Model, context: UserContext, writeOptions?: WriteOptions, sourceMutationId?: string): Promise<QueuedMutation>;
     /**
      * Records an update and applies it optimistically, then stages it for the next
      * batched commit. Rapid updates to the same entity coalesce into a single wire
      * operation.
      * @param precomputedChanges - Optional pre-captured changes, used instead of re-reading them from the model.
      */
-    update(model: Model, context: UserContext, precomputedChanges?: Record<string, unknown>, writeOptions?: WriteOptions, sourceMutationId?: string): Promise<Transaction>;
+    update(model: Model, context: UserContext, precomputedChanges?: Record<string, unknown>, writeOptions?: WriteOptions, sourceMutationId?: string): Promise<QueuedMutation>;
     /**
      * Records a delete and applies it optimistically. If the row's own create has
      * not yet been sent, both are cancelled locally rather than sending a create
      * followed by a delete; if the create is already in flight, the delete waits
      * until it settles so the server never sees a delete before the create.
      */
-    delete(model: Model, context: UserContext, writeOptions?: WriteOptions, sourceMutationId?: string): Promise<Transaction>;
+    delete(model: Model, context: UserContext, writeOptions?: WriteOptions, sourceMutationId?: string): Promise<QueuedMutation>;
     /**
      * Uploads a single attachment, delegating to the mutation executor.
      */
@@ -362,12 +392,12 @@ export declare class TransactionQueue extends EventEmitter {
      * Records an archive and applies it optimistically, then stages it for the
      * next batched commit.
      */
-    archive(model: Model, context: UserContext, writeOptions?: WriteOptions, sourceMutationId?: string): Promise<Transaction>;
+    archive(model: Model, context: UserContext, writeOptions?: WriteOptions, sourceMutationId?: string): Promise<QueuedMutation>;
     /**
      * Records an unarchive and applies it optimistically, then stages it for the
      * next batched commit.
      */
-    unarchive(model: Model, context: UserContext): Promise<Transaction>;
+    unarchive(model: Model, context: UserContext): Promise<QueuedMutation>;
     /**
      * Places a transaction on the execution queue, coalescing it into an existing
      * same-entity update where possible so redundant writes collapse.
@@ -410,7 +440,6 @@ export declare class TransactionQueue extends EventEmitter {
      * `mutation_log` still prevents a second logical write.
      */
     enqueueCommit(clientTxId: string, operations: CommitTransaction['operations'], options?: {
-        causedByTaskId?: string | null;
         reads?: ReadDependency[] | null;
         track?: TrackDependency[] | null;
     }): Promise<void>;
@@ -464,7 +493,7 @@ export declare class TransactionQueue extends EventEmitter {
      * last-write-wins rolls the local change back, merge and reject re-enqueue it,
      * and custom applies the caller's resolver.
      */
-    handleConflict(transaction: Transaction, serverData: MutationInput): Promise<void>;
+    handleConflict(transaction: QueuedMutation, serverData: MutationInput): Promise<void>;
     /**
      * Optimistic updates. The apply and rollback rules live in `./optimisticApply.js`;
      * these methods bind them to the queue's own tracking map and event emitter.
@@ -497,14 +526,14 @@ export declare class TransactionQueue extends EventEmitter {
      * optionally limited to one operation type, rolling back their optimistic
      * state. Returns the cancelled transactions.
      */
-    cancelTransactionsForModel(modelId: string, transactionType?: string): Transaction[];
+    cancelTransactionsForModel(modelId: string, transactionType?: string): QueuedMutation[];
     /**
      * Cancels pending transactions for child rows that reference a deleted parent,
      * used to cascade a parent deletion. The caller supplies the foreign-key
      * relationship; this method performs the cancellation.
      *
-     * @param childModelName - The child model type (for example 'SlideLayer').
-     * @param foreignKey - The foreign-key property name (for example 'slideId').
+     * @param childModelName - The child model type (for example 'Block').
+     * @param foreignKey - The foreign-key property name (for example 'sectionId').
      * @param parentId - The deleted parent's id.
      * @returns The number of transactions cancelled.
      */
@@ -530,8 +559,8 @@ export declare class TransactionQueue extends EventEmitter {
         totalTransactions: number;
         batchIndex: number;
         config: {
-            /** Shared client position (see sync/syncPosition.ts). One per client. */
-            position?: SyncPosition;
+            /** Shared client position (see logPosition.ts). One per client. */
+            position?: LogPosition;
             maxBatchSize: number;
             batchDelay: number;
             maxRetries: number;
@@ -563,6 +592,18 @@ export declare class TransactionQueue extends EventEmitter {
              * forever if the connection died while a commit was in flight.
              */
             commitOfflineGraceMs: number;
+            /**
+             * How long, in milliseconds, to wait for the transport to acknowledge a
+             * dispatched commit before treating the silence as a retryable no-receipt
+             * failure. A transport that never answers — a half-open socket, a dropped
+             * response frame — would otherwise hold the commit in flight forever, and
+             * with it the client's staged-batch lock: every later write in the session
+             * queues silently behind the unanswered one. The envelope's idempotency key
+             * is stable across retries, so a commit the server DID apply before the
+             * timeout is deduplicated on the retry rather than double-applied.
+             * Defaults to 30 seconds. Set `0` to disable the bound.
+             */
+            commitDispatchTimeoutMs: number;
         };
     };
     /**
@@ -595,7 +636,7 @@ export declare class TransactionQueue extends EventEmitter {
         }[];
     };
     /** Merges the given options into the queue's configuration. */
-    setConfig(config: Partial<TransactionQueueConfig>): void;
+    setConfig(config: Partial<MutationQueueConfig>): void;
     /**
      * Re-emits an incoming sync delta on the `sync:delta` event for the store to
      * apply. Because rows use stable ids, no id reconciliation is needed here.