@abloatai/ablo 0.34.1 → 0.36.0

package/dist/client/createInternalComponents.js

@@ -13,19 +13,23 @@ import { InstanceCache } from '../InstanceCache.js';
 import { SyncClient } from '../SyncClient.js';
 import { OnDemandLoader } from '../sync/OnDemandLoader.js';
 import { BootstrapFetcher } from '../sync/BootstrapFetcher.js';
-import { resolveBootstrapBaseUrl } from './auth.js';
-import { shouldUseInMemoryPersistence } from './persistence.js';
-import { resolveDurableWrites } from './durableWrites.js';
+import { loadsAtBootstrap } from '../transaction/schema/loadStrategy.js';
+import { resolveBootstrapBaseUrl } from '../transaction/auth/apiKey.js';
+import { shouldUseInMemoryPersistence } from '../transaction/persistence.js';
+import { globalRuntime } from '../context.js';
+import { resolveDurableWrites } from '../transaction/durableWrites.js';
 export function createInternalComponents(input) {
     const { schema, url, options, auth } = input;
+    const runtime = input.runtime ?? globalRuntime;
     // The registry is created here, but model registration happens in the caller,
     // which owns the schema-to-class translation.
     const modelRegistry = new ModelRegistry({
         validateOnRegister: false,
         allowLateReferences: true,
+        runtime,
     });
     setActiveRegistry(modelRegistry);
-    const objectPool = new InstanceCache({ maxSize: options.maxPoolSize ?? 10000 }, modelRegistry);
+    const objectPool = new InstanceCache({ maxSize: options.maxPoolSize ?? 10000, runtime }, modelRegistry);
     const bootstrapBaseUrl = resolveBootstrapBaseUrl({
         url,
         bootstrapBaseUrl: options.bootstrapBaseUrl,
@@ -35,15 +39,17 @@ export function createInternalComponents(input) {
         syncGroups: options.syncGroups,
         instantModels: deriveInstantModels(schema),
         getAuthToken: auth?.getAuthToken,
+        runtime,
     });
     const database = new Database(modelRegistry, bootstrapHelper, {
         // By default there is no browser-local durable store unless the caller asks
         // for one. Node and edge runtimes always use the in-memory store because
         // IndexedDB is unavailable there.
         inMemory: shouldUseInMemoryPersistence(options),
+        runtime,
     });
     const durableWrites = resolveDurableWrites(options);
-    const syncClient = new SyncClient(objectPool, database, durableWrites.store, durableWrites.namespace ?? url);
+    const syncClient = new SyncClient(objectPool, database, durableWrites.store, durableWrites.namespace ?? url, runtime);
     // Lazy-load lane: hydrates the object pool and IndexedDB on demand for
     // entities not in scope at bootstrap (`load: 'lazy'` models, or an entity
     // reached by deep link before the pool warmed up). Single-flight, with
@@ -55,6 +61,7 @@ export function createInternalComponents(input) {
         schema,
         baseUrl: bootstrapBaseUrl,
         getAuthToken: auth?.getAuthToken,
+        runtime,
     });
     // Drop the lazy-lane hydration ledger on reconnect. While connected, the
     // WebSocket delta stream keeps hydrated rows fresh so repeat reads serve
@@ -72,20 +79,20 @@ export function createInternalComponents(input) {
 }
 /**
  * Derives the set of models to fetch in the initial bootstrap request from each
- * model's load strategy. Models declared `load: 'lazy'` or `'manual'` are left
- * out of the bootstrap and fetched on demand instead. The default strategy is
+ * model's load strategy. Models declared `load: 'lazy'` are left out of the
+ * bootstrap and fetched on demand instead. The default strategy is
  * `'instant'`, which includes the model.
  */
 function deriveInstantModels(schema) {
     const schemaModels = schema.models ?? schema;
     return Object.entries(schemaModels).flatMap(([key, def]) => {
         if (!def || typeof def !== 'object' || !('load' in def)) {
-            return [key]; // no load → instant
+            return [key]; // no load → the default strategy
         }
         const load = def.load;
-        if (!load || load === 'instant') {
+        if (loadsAtBootstrap(load)) {
             return [def.typename ?? key];
         }
-        return []; // lazy or manual → skip
+        return [];
     });
 }

package/dist/client/createModelProxy.d.ts

@@ -3,113 +3,44 @@
  * `ablo.<model>`.
  *
  * Each schema model gets one {@link ModelOperations}: the async server reads
- * `retrieve` and `list`, the synchronous local-graph snapshots `get`, `getAll`,
- * and `getCount`, the writes `create`, `update`, and `delete`, the coordination
+ * `retrieve` and `list`, the same verbs restricted to the local graph under
+ * `local`, the writes `create`, `update`, and `delete`, the coordination
  * namespace `claim` (callable as `claim({ id })`, plus `claim.state`,
  * `claim.queue`, `claim.release`, and `claim.reorder`), `join`, and `onChange`.
  * The factory returns a plain object; the client assembles the `ablo.<model>`
  * lookup table from one of these per model.
  */
-import { AbloClaimedError } from '../errors.js';
-import { type ModelUpdater, type ContentionOptions } from './functionalUpdate.js';
-import type { MutationOptions } from '../interfaces/index.js';
-import type { StaleNotification } from '../coordination/schema.js';
+import type { ModelTarget } from '../transaction/coordination/schema.js';
 import type { ModelRegistry } from '../ModelRegistry.js';
 import type { InstanceCache } from '../InstanceCache.js';
 import type { SyncClient } from '../SyncClient.js';
 import type { OnDemandLoader } from '../sync/OnDemandLoader.js';
 import type { JoinedParticipant } from '../sync/participants.js';
-import type { LoadWhere } from '../query/types.js';
-import { ModelScope } from '../types/index.js';
-import type { Duration, Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease, ClaimWaitOptions, Snapshot, TargetRange } from '../types/streams.js';
+import type { Duration, Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease, ClaimWaitOptions, Snapshot } from '../transaction/types/streams.js';
+export type { ModelListScope, ModelTrackParams, ModelTrackResult, LocalReadOptions, LocalCountOptions, ServerReadOptions, ServerRetrieveOptions, ClaimTargetOptions, ClaimParams, ClaimLookupParams, ClaimReorderParams, ClaimOptions, ClaimReadApi, AwaitedClaimMethod, ClaimApi, ModelRetrieveParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, JoinOptions, } from '../transaction/resources/modelOperations.js';
+export type { Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease };
+import type { ClaimApi, JoinOptions, LocalCountOptions, LocalReadOptions } from '../transaction/resources/modelOperations.js';
+import type { HttpModelClient } from '../transaction/transport/httpClient.js';
+import type { ParticipantKind } from '../transaction/types/participant.js';
 export interface ModelClientMeta {
     readonly key: string;
     readonly typename: string;
 }
 export declare function getModelClientMeta(modelClient: unknown): ModelClientMeta | undefined;
-export type ModelListScope = ModelScope | 'live' | 'archived' | 'all';
-/** Options for `track({ id })` — register a durable read-dependency on a row. */
-export interface ModelTrackParams {
-    /** The row to keep hearing about, by id. */
-    id: string;
-    /**
-     * The sync watermark this track is premised on. Omit to baseline at the
-     * current head — "tell me about anything from here on". Pass a known
-     * `lastSyncId` (e.g. the one you read the row at) to also catch a change that
-     * already landed between that read and this call.
-     */
-    readAt?: number;
-}
-/** The result of `track({ id })`. */
-export interface ModelTrackResult {
-    /**
-     * Tracks that had ALREADY fired at registration time — a change matching an
-     * open track that landed before this call. Present only when something was
-     * already stale; the ongoing signal arrives on the receipts of later commits.
-     */
-    notifications?: StaleNotification[];
-}
-/** Options for the synchronous local-pool reads `get`, `getAll`, and
- *  `onChange` — a JavaScript `filter`, an equality `where`, and a lifecycle
- *  `state`. This is the local, reactive axis; contrast {@link ServerReadOptions},
- *  the asynchronous server axis. */
-export interface LocalReadOptions<T> {
-    where?: Partial<T>;
-    /** Arbitrary local predicate. Applied after `where`. */
-    filter?: (entity: T) => boolean;
-    orderBy?: {
-        [K in keyof T]?: 'asc' | 'desc';
-    };
-    limit?: number;
-    offset?: number;
-    /** Lifecycle filter — `live` (the default), `archived`, or `all`. Named
-     *  `state` so it does not collide with the sync-group `scope`. */
-    state?: ModelListScope;
-}
-export type LocalCountOptions<T> = Pick<LocalReadOptions<T>, 'where' | 'filter' | 'state'>;
-/** Options for the asynchronous server reads `retrieve` and `list` — the
- *  operator `where` filter, `type`, and `expand`. This is the server axis;
- *  contrast {@link LocalReadOptions}, the local, reactive axis. */
-export interface ServerReadOptions<T> {
-    /**
-     * Filter for the lookup. Accepts two forms:
-     *   - object form — `{ name: 'foo' }`: equality, where an array value means `IN`
-     *   - tuple form — `[['name', 'ILIKE', '%Goldman%']]`: explicit operators
-     *
-     * See {@link LoadWhere} for the full grammar. The wire protocol matches on AND
-     * only; for OR semantics, run two `list()` calls and union the results.
-     */
-    where?: LoadWhere<T>;
-    orderBy?: {
-        [K in keyof T]?: 'asc' | 'desc';
-    };
-    limit?: number;
-    /**
-     * `complete` waits for the server. `unknown` returns whatever is local
-     * immediately and refreshes in the background.
-     */
-    type?: 'complete' | 'unknown';
-    /**
-     * Schema-declared relation names to hydrate alongside the primary
-     * rows. The server's compiler resolves each name via the schema's
-     * relation metadata (`relation.belongsTo` / `relation.hasMany`)
-     * and emits the JOIN.
-     */
-    expand?: readonly string[];
-}
-/** Options for the single-row async server read `retrieve({ id })`. A subset of
- *  {@link ServerReadOptions} — `where`/`limit`/`orderBy` are fixed by the id. */
-export type ServerRetrieveOptions = Pick<ServerReadOptions<unknown>, 'type' | 'expand'>;
-export interface ModelCollaboration<T> {
+/**
+ * The entity a coordination read names, without the sub-entity narrowing —
+ * projected from {@link ModelTarget} so the two members are spelled once.
+ */
+type EntityHalf = Pick<ModelTarget, 'model' | 'id'>;
+export interface ModelCollaboration {
     createClaim(options: {
-        target: {
-            model: string;
-            id: string;
-            field?: string;
-            path?: string;
-            range?: TargetRange;
-            meta?: Record<string, unknown>;
-        };
+        /**
+         * The locator, in the spelling the SDK surface and the HTTP routes use.
+         * The canonical {@link ModelTarget} rather than a shape spelled here: this
+         * boundary is what a claim's narrowing has to cross, and a member missing
+         * from it dies before the socket sees it.
+         */
+        target: ModelTarget;
         /** Peer-visible description of the work (`'rewriting the risk section'`). */
         description?: string;
         ttl?: Duration;
@@ -121,6 +52,10 @@ export interface ModelCollaboration<T> {
         queue?: boolean;
         /** Reject (don't wait) if the queue is already this deep when we join. */
         maxQueueDepth?: number;
+        /** Cap on the queued wait before rejecting with `grant_timeout`. */
+        waitTimeoutMs?: number;
+        /** Abort the queued wait — rejects with `claim_wait_aborted`. */
+        signal?: AbortSignal;
     }): Promise<Claim>;
     createSnapshot(modelKey: string, id: string): Snapshot;
     /**
@@ -135,35 +70,29 @@ export interface ModelCollaboration<T> {
      * difference is this internal contract takes an explicit `{ model, id }`
      * target because it isn't bound to a single model.
      */
-    state(target: {
-        model: string;
-        id: string;
-    }): Claim | null;
+    state(target: EntityHalf): Claim | null;
+    /**
+     * Every active claim on a target, not just one. Sub-row claims on disjoint
+     * parts of a row are all granted, so a row can have several holders at once
+     * and `state` answers with only the first of them.
+     */
+    holders(target: EntityHalf): readonly Claim[];
     /**
      * The reactive wait queue on a target — the FIFO line of queued claims
      * behind the holder. Synchronous snapshot off the synced claim stream.
      */
-    queue(target: {
-        model: string;
-        id: string;
-    }): readonly Claim[];
+    queue(target: EntityHalf): readonly Claim[];
     /**
      * Re-rank the wait queue on a target (privileged — server-gated). `order` is
      * the desired front-of-line ordering, taken from `queue(target)`.
      */
-    reorder(target: {
-        model: string;
-        id: string;
-    }, order: readonly Claim[]): void;
+    reorder(target: EntityHalf, order: readonly Claim[]): void;
     /**
      * Resolve once no participant holds an active claim on the target.
      * The contender's "wait until it's free" — delegates to the claim
      * stream's `waitFor`.
      */
-    waitFor(target: {
-        model: string;
-        id: string;
-    }, options?: ClaimWaitOptions): Promise<void>;
+    waitFor(target: EntityHalf, options?: ClaimWaitOptions): Promise<void>;
     /**
      * The local participant's id. Used to distinguish "I already hold this"
      * from "someone else holds it" in `claimOrWait`.
@@ -175,7 +104,7 @@ export interface ModelCollaboration<T> {
      * holds the lease: server presence frames exclude a holder's own claims, so
      * the holder builds its own view.
      */
-    readonly selfParticipantKind?: 'user' | 'agent' | 'system';
+    readonly selfParticipantKind?: ParticipantKind;
     /**
      * Subscribes the connection to a scope's sync group(s) — read interest. The
      * typed surface calls this on single-entity reads and claim observation so a
@@ -200,261 +129,51 @@ export interface ModelCollaboration<T> {
      */
     createJoin?(modelKey: string, ids: string | readonly string[], options?: JoinOptions): Promise<JoinedParticipant>;
 }
-export interface ClaimTargetOptions<T = Record<string, unknown>> {
-    /** Peer-visible description of the work being performed — the sentence a
-     *  contending participant reads to decide whether to wait, work elsewhere, or
-     *  move on. Defaults to `'editing'`. The same field on every claim surface. */
-    description?: string;
-    /** Field-level target, for fine-grained claimed-state badges. */
-    field?: string;
-    /** Optional path for document/file-like targets. */
-    path?: string;
-    /** Optional range for document/file-like targets. */
-    range?: TargetRange;
-    /** App-defined structured metadata. */
-    meta?: Record<string, unknown>;
-    /** Crash-cleanup TTL — the claim auto-releases if the holder dies. */
-    ttl?: Duration;
-    /**
-     * Behavior under contention. `true` (the default) queues behind the current
-     * holder and resolves once the row is yours. `false` is fail-fast: if another
-     * participant already holds the row, it rejects immediately with
-     * {@link AbloClaimedError} instead of waiting. Use `false` to deduplicate
-     * distributed work ("if someone else has this job, skip it"), where waiting
-     * would mean double-processing.
-     *
-     * The high-level typed claim defaults this on because it serializes writers;
-     * the low-level lease and the HTTP client default it off, since they resolve
-     * immediately and cannot transparently wait for a grant.
-     */
-    queue?: boolean;
-    /**
-     * Backpressure: queue, but not behind too many others. If the server reports a
-     * position at or beyond `maxQueueDepth` when the client joins the line, it
-     * rejects with {@link AbloClaimedError} (`queue_too_deep`) instead of waiting.
-     * Omit to wait however deep the queue is.
-     */
-    maxQueueDepth?: number;
-    /**
-     * Keep the lease alive for the duration of real work by beating on a
-     * cadence — the pattern for background workers whose task outlives the
-     * crash-cleanup TTL. `true` beats every third of the TTL (so two beats can
-     * fail before the lease is at risk, and a crashed worker's lease still
-     * lapses within one beat window); a duration such as `'2m'` sets the
-     * cadence explicitly. The loop stops on release. A beat answered with a
-     * definitive loss stops the loop and calls {@link onHeartbeatLost}; you can
-     * also beat manually with `held.heartbeat()`.
-     */
-    heartbeat?: true | Duration;
-    /**
-     * Called once if the auto-heartbeat learns the lease is no longer yours
-     * (expired and possibly granted onward). The loop has already stopped;
-     * abandon the work or re-claim. Any write attempted under the old lease is
-     * independently rejected by its `readAt` guard.
-     */
-    onHeartbeatLost?: (error: AbloClaimedError) => void;
-    /**
-     * Called after every successful beat (manual or auto) with the server's
-     * answer — chiefly `queueDepth`, the number of participants waiting in
-     * line behind this lease. A worker that can checkpoint may read pressure
-     * here and release early when others wait.
-     */
-    onHeartbeat?(beat: ClaimHeartbeat): void;
-}
-/** Options for `claim({ id, ... })`. */
-export interface ClaimParams<T = Record<string, unknown>> extends ClaimTargetOptions<T> {
-    readonly id: string;
-}
-export interface ClaimLookupParams<T = Record<string, unknown>> {
-    readonly id: string;
-    readonly field?: string;
-}
-export interface ClaimReorderParams<T = Record<string, unknown>> extends ClaimLookupParams<T> {
-    readonly order: readonly Claim[];
-}
 /**
- * A claim handle: the held entity data plus an explicit release hook.
+ * The synchronous, local-only reads — reached as `ablo.<model>.local.*`.
  *
- * ```ts
- * const claim = await ablo.weatherReports.claim({
- *   id: 'report_stockholm',
- *   description: 'Fetching current weather before writing the forecast.',
- * });
- * try {
- *   await ablo.weatherReports.update({
- *     id: claim.target.id,
- *     data: { status: 'ready' },
- *     claim,
- *   });
- * } finally {
- *   await claim.release();
- * }
- * ```
+ * Every verb mirrors its asynchronous sibling on the base surface, and the one
+ * word in front is the whole difference. It is a narrowing, not a claim about
+ * the other side: `retrieve` consults the local graph and then the network,
+ * while `local.retrieve` is restricted to what is already resident — which is
+ * also why it can return a value instead of a promise. There is nothing to
+ * await.
  *
- * `data` is a snapshot taken after the lease is held. Write through the flat
- * `ablo.<model>.update({ id, data, claim })` verb — the handle carries the
- * lease id and snapshot watermark for attribution and stale-write protection.
+ * These reads exist only here. Exposing them at the top level too would undo
+ * the distinction the namespace draws.
  */
-export type { Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease };
-export type ClaimOptions<T = Record<string, unknown>> = ClaimTargetOptions<T>;
-/**
- * The coordination surface for a model, exposed as a callable namespace.
- *
- * Most callers do not need this namespace directly. Put `claim: { ... }` on a
- * write and the SDK acquires/releases around that one mutation:
- *
- * ```ts
- * await ablo.tasks.update({
- *   id,
- *   data: { title },
- *   claim: {
- *     field: 'title',
- *     description: 'Renaming the task to match the project brief.',
- *   },
- * });
- * ```
- *
- * Use `claim({ id, ... })` when a tool spans multiple writes and needs one
- * handle. `state`, `queue`, and `reorder` are coordination reads/scheduler
- * controls for UI and operators.
- */
-/**
- * The coordination reads and scheduler controls on a claim namespace, in their
- * reactive (synchronous) form: `state`, `queue`, and `reorder` resolve against
- * the local pool with no round-trip, which is what lets a reactive selector read
- * coordination state inside a React render.
- *
- * This is the single source of truth for the claim read surface. The stateless
- * HTTP client exposes the awaited projection of exactly these methods (derived
- * via {@link AwaitedClaimMethod}), so the two transports cannot drift — change a
- * signature here and the HTTP surface follows.
- */
-export interface ClaimReadApi<T = Record<string, unknown>> {
-    /**
-     * Current holder for a row, or `null` when free. Use this for UI badges and
-     * preflight checks, not for the normal write path.
-     */
-    state(params: ClaimLookupParams<T>): Claim | null;
+export interface LocalReads<T> {
     /**
-     * FIFO wait line behind the current holder. Advanced: useful for operator
-     * UIs and schedulers.
+     * Snapshot of a single row from the local graph. `undefined` when the row is
+     * not resident — a graph that is still empty, or a `lazy` model not yet
+     * loaded. Pairs with reactive selectors:
+     * `useAblo((ablo) => ablo.<model>.local.retrieve(id))`.
      */
-    queue(params: ClaimLookupParams<T>): {
-        readonly object: 'list';
-        readonly data: readonly Claim[];
-    };
+    retrieve(id: string): T | undefined;
     /**
-     * Re-rank the wait line. Advanced and permission-gated.
+     * Snapshot of a filtered collection from the local graph. Empty until
+     * `retrieve`, `list`, or bootstrap has warmed the graph.
      */
-    reorder(params: ClaimReorderParams<T>): void;
-    /** Release a manual claim handle early. Single-write claims auto-release. */
-    release(params: ClaimLookupParams<T> | Claim<T>): Promise<void>;
+    list(options?: LocalReadOptions<T>): T[];
+    /** Count rows in the local graph. */
+    count(options?: LocalCountOptions<T>): number;
 }
 /**
- * The awaited form of a claim method: a synchronous return becomes a `Promise`,
- * an already-async one (`release`) is left untouched. Used to derive the
- * stateless HTTP claim surface from the reactive {@link ClaimReadApi}.
+ * What a reactive client adds on top of the base per-model surface: a live
+ * graph to read (`local`), the synchronous projection of the claim reads, and
+ * the two subscriptions a persistent socket makes possible.
+ *
+ * `claim` is here rather than inherited because the two transports carry
+ * deliberately different claim types, and the difference is load-bearing: a
+ * stateless client has no local copy, so `state`/`queue`/`reorder` must be
+ * awaited, while a reactive client resolves them synchronously — which is
+ * precisely what lets a React render read claim state inline. The stateless
+ * form is *derived* from this one through {@link AwaitedClaimMethod}, so the
+ * only permitted difference between them is that promise wrapper.
  */
-export type AwaitedClaimMethod<F> = F extends (...args: infer A) => infer R ? R extends Promise<unknown> ? (...args: A) => R : (...args: A) => Promise<R> : F;
-export interface ClaimApi<T> extends ClaimReadApi<T> {
-    /**
-     * Takes a claim and returns an explicit held-work handle — a {@link HeldClaim}.
-     * `data`, `release`, `revoke`, and the async disposer are always present (this
-     * call re-reads the row under the lease), so callers can use `handle.data`
-     * directly and `await using` works without a guard.
-     */
-    (params: ClaimParams<T>): Promise<HeldClaim<T>>;
-    /**
-     * Takes a claim by id alone, for a row that lives only in the customer's own
-     * database — Ablo has never seen it, so there is nothing to re-read. Returns a
-     * {@link HeldLease}: the same lease controls as {@link HeldClaim}
-     * (`release`, `revoke`, `heartbeat`, `await using`) but no `.data`. Locking a
-     * key you know by id is exactly this — serialize writers without first
-     * syncing the row into Ablo.
-     */
-    (id: string, opts?: ClaimOptions<T>): Promise<HeldLease>;
-}
-export interface ModelRetrieveParams extends ServerRetrieveOptions {
-    readonly id: string;
-}
-export interface ModelCreateParams<T, CreateInput> extends MutationOptions {
-    readonly data: CreateInput;
-    readonly id?: string | null;
-    readonly claim?: Claim<T> | ClaimTargetOptions<T> | null;
-}
-export interface ModelUpdateParams<T> extends MutationOptions {
-    readonly id: string;
-    readonly data: Partial<T>;
-    readonly claim?: Claim<T> | ClaimTargetOptions<T> | null;
-}
-export interface ModelDeleteParams<T> extends MutationOptions {
-    readonly id: string;
-    readonly claim?: Claim<T> | ClaimTargetOptions<T> | null;
-}
-/** Options for the WebSocket-only `ablo.<model>.join(ids, options?)`. */
-export interface JoinOptions {
-    /**
-     * Lease TTL for the underlying presence claim — the participant
-     * auto-releases after this if the holder dies. Compact duration string
-     * (`'5m'`) or ms number, mirroring the claim `ttl`.
-     */
-    ttl?: Duration;
-}
-export interface ModelOperations<T, CreateInput> {
-    /**
-     * Reads a single entity by id from the server; asynchronous. Resolves through
-     * a three-tier lookup — local pool, then IndexedDB, then a network
-     * `POST /sync/query` — and lands the row in the local graph. Resolves to
-     * `undefined` when no such row exists.
-     *
-     * This is the default "get me this entity" read, and the one a stateless
-     * client wants, since its local graph starts empty. For a synchronous read of
-     * an already-warm graph (such as a React selector) use `get(id)`.
-     */
-    retrieve(params: ModelRetrieveParams): Promise<T | undefined>;
-    /**
-     * Lists entities matching a filter from the server; asynchronous. Uses the
-     * same three-tier lookup and graph hydration as `retrieve`, deduplicated so
-     * concurrent identical calls share one request. Returns the matched rows. For
-     * a synchronous read of the local graph use `getAll(...)`.
-     */
-    list(options?: ServerReadOptions<T>): Promise<T[]>;
-    /**
-     * Synchronous snapshot of a single entity from the local graph; no network.
-     * Returns `undefined` when the row is not resident (a client whose graph is
-     * still empty, or a `lazy` model not yet loaded). Pairs with reactive
-     * selectors: `useAblo((ablo) => ablo.<model>.get(id))`.
-     */
-    get(id: string): T | undefined;
-    /**
-     * Synchronous snapshot of a filtered collection from the local graph; no
-     * network round-trip. Empty until `retrieve`, `list`, or bootstrap has warmed
-     * the graph.
-     */
-    getAll(options?: LocalReadOptions<T>): T[];
-    /** Count entities in the local graph; synchronous, no network. */
-    getCount(options?: LocalCountOptions<T>): number;
-    /**
-     * Create a new entity — **optimistic, offline-first**. Resolves once
-     * the mutation is queued locally, not when the server confirms.
-     * Server rejection rolls back automatically; watch `sync.syncStatus`.
-     */
-    create(params: ModelCreateParams<T, CreateInput>): Promise<T>;
-    /** Update an entity by id — optimistic, offline-first (see `create`). */
-    update(params: ModelUpdateParams<T>): Promise<T>;
-    /**
-     * Updates under contention with a function of the latest state —
-     * `update(id, current => next)`. The client reads the freshest row, runs your
-     * updater, writes the result as a compare-and-swap, and re-reads and re-runs
-     * on any concurrent write. Nothing about claims, identity, or conflict codes
-     * surfaces: the write either lands or throws {@link AbloContentionError} once
-     * its reconcile budget is spent. Return `null` or `undefined` from the updater
-     * to skip the write. Resolves to the reconciled row, or `undefined` when the
-     * updater opted out.
-     */
-    update(id: string, updater: ModelUpdater<T>, options?: ContentionOptions): Promise<T | undefined>;
-    /** Delete an entity by id — optimistic, offline-first (see `create`). */
-    delete(params: ModelDeleteParams<T>): Promise<void>;
+interface ReactiveModelSurface<T> {
+    /** The synchronous local-graph reads. */
+    local: LocalReads<T>;
     /**
      * Claim a row so other writers wait or are rejected until you're done, and
      * inspect or manage that coordination through the same namespace. Call it to
@@ -482,25 +201,6 @@ export interface ModelOperations<T, CreateInput> {
      * ```
      */
     claim: ClaimApi<T>;
-    /**
-     * Register a durable read-dependency on a row of this model — keep hearing
-     * about it after this call returns. Where the per-write `reads` gate lives for
-     * exactly one commit, a track persists on the server: any change that lands on
-     * the tracked row rides back on the `notifications` of your next commit, so a
-     * long-running actor learns its context went stale without re-reading. A track
-     * you already have is refreshed, not duplicated (it is an idempotent upsert).
-     *
-     * ```ts
-     * await ablo.tasks.track({ id: 'task_42' });
-     * // …minutes of other work later, on your next write…
-     * const res = await ablo.tasks.update({ id: 'task_42', data: { done: true } });
-     * res.notifications; // populated if task_42 changed under you in the meantime
-     * ```
-     *
-     * The returned `notifications` are only the tracks that had ALREADY fired at
-     * registration time; the ongoing signal arrives on later receipts.
-     */
-    track(params: ModelTrackParams): Promise<ModelTrackResult>;
     /**
      * Joins the sync group(s) for one or more rows of this model and returns a
      * live participant handle — presence (`.peers`), the scoped claim stream
@@ -512,7 +212,7 @@ export interface ModelOperations<T, CreateInput> {
      * clients and throws on any non-WebSocket construction.
      *
      * ```ts
-     * await using participant = await ablo.slides.join(slideIds, { ttl: '5m' });
+     * await using participant = await ablo.sections.join(sectionIds, { ttl: '5m' });
      * participant.peers; // who else is here
      * ```
      */
@@ -520,4 +220,29 @@ export interface ModelOperations<T, CreateInput> {
     /** Subscribe to changes; the callback runs on every change. */
     onChange(callback: (entities: T[]) => void, options?: LocalReadOptions<T>): () => void;
 }
-export declare function createModelProxy<T, C>(schemaKey: string, registeredModelName: string, objectPool: InstanceCache, syncClient: SyncClient, registry: ModelRegistry, hydration: OnDemandLoader, collaboration?: ModelCollaboration<T>): ModelOperations<T, C>;
+/**
+ * Everything reachable as `ablo.<model>` on a reactive client.
+ *
+ * The base is not written here — it is the transport-independent per-model
+ * surface, taken whole. A reactive client is that surface plus what a live
+ * graph makes possible, so this type states the relationship instead of
+ * restating the members, and a verb added to the base arrives here on its own.
+ *
+ * `claim` is the one member the base cannot supply directly: the two forms
+ * differ by an awaitedness transform, so it is replaced rather than inherited.
+ * See {@link ReactiveModelSurface}.
+ */
+export type ModelOperations<T, CreateInput> = Omit<HttpModelClient<T, CreateInput>, 'claim'> & ReactiveModelSurface<T>;
+export declare function createModelProxy<T, C>(schemaKey: string, registeredModelName: string, objectPool: InstanceCache, syncClient: SyncClient, registry: ModelRegistry, 
+/**
+ * The one thing this factory asks of the loader: fetch rows for a model.
+ *
+ * Declared as the slice rather than the whole `OnDemandLoader` because the
+ * whole is a class, and a parameter typed as a class can only ever be
+ * satisfied by an instance of it — so every caller that has a narrower
+ * collaborator, a test most of all, is pushed into a cast through `unknown`
+ * to supply the one method that is actually read.
+ */
+hydration: Pick<OnDemandLoader, 'fetch'>, collaboration?: ModelCollaboration, 
+/** The client-wide `wait` default; a per-call `wait` still wins over it. */
+defaultWait?: 'queued' | 'confirmed'): ModelOperations<T, C>;