@abloatai/ablo 0.34.1 → 0.36.0

package/dist/schema/serialize.d.ts

@@ -26,12 +26,12 @@
  *   - exact Zod refinements, which are rebuilt as permissive validators from
  *     {@link FieldMeta}; the server does no field-shape validation
  */
-import type { FieldMeta } from './field.js';
-import type { Tenancy } from './tenancy.js';
-import type { ModelResidency } from './residency.js';
-import type { GrantsRef, LoadStrategy, PersistOptions, AutoFillRule, ConflictAxis } from './model.js';
-import type { RelationType } from './relation.js';
-import { type Schema, type IdentityRole, type EntityRole, type SessionSettings } from './schema.js';
+import type { FieldMeta } from '../transaction/schema/field.js';
+import type { Tenancy } from '../transaction/schema/tenancy.js';
+import type { ModelResidency } from '../transaction/schema/residency.js';
+import type { GrantsRef, LoadStrategy, PersistOptions, AutoFillRule, ConflictAxis } from '../transaction/schema/model.js';
+import type { RelationType } from '../transaction/schema/relation.js';
+import { type Schema, type IdentityRole, type EntityRole, type SessionSettings } from '../transaction/schema/schema.js';
 /** Current schema-JSON envelope version. Bump this on a breaking change to the
  * JSON shape itself — not to a user's schema. */
 declare const SCHEMA_JSON_VERSION: 3;
@@ -103,4 +103,13 @@ export declare function parseSchema(json: string): Schema;
  * active schema hash. Not a security primitive.
  */
 export declare function schemaHash(schema: Schema): string;
+/**
+ * Content hash of ONE serialized model — the unit of the semantic drift check.
+ * Two schemas agree on a model exactly when these match, which is what lets a
+ * client compare only the models it declares instead of welding itself to the
+ * whole-schema hash (where any additive push reads as drift). Computed over the
+ * model's `SchemaJSON` entry with the same canonicalization and hash as
+ * {@link schemaHash}, on both the client and the server's `GET /api/schema`.
+ */
+export declare function modelHash(modelJson: unknown): string;
 export {};

package/dist/schema/serialize.js

@@ -27,8 +27,9 @@
  *     {@link FieldMeta}; the server does no field-shape validation
  */
 import { z } from 'zod';
-import { AbloValidationError } from '../errors.js';
-import { baseFieldsSchema, } from './schema.js';
+import { AbloValidationError } from '../transaction/errors.js';
+import { buildFieldRefs } from '../transaction/schema/schema.js';
+import { baseFieldsSchema, } from '../transaction/schema/schema.js';
 /** Current schema-JSON envelope version. Bump this on a breaking change to the
  * JSON shape itself — not to a user's schema. */
 const SCHEMA_JSON_VERSION = 3;
@@ -205,6 +206,8 @@ export function fromSchemaJSON(json) {
     }
     return {
         models: models,
+        // A schema rebuilt from JSON carries references too — the shapes are here.
+        fields: buildFieldRefs(models),
         validators: validators,
         identityRoles: json.identityRoles,
         sessionSettings: json.sessionSettings ?? {},
@@ -227,7 +230,21 @@ export function parseSchema(json) {
  * active schema hash. Not a security primitive.
  */
 export function schemaHash(schema) {
-    const canonical = canonicalJson(toSchemaJSON(schema));
+    return fnv1a(canonicalJson(toSchemaJSON(schema)));
+}
+/**
+ * Content hash of ONE serialized model — the unit of the semantic drift check.
+ * Two schemas agree on a model exactly when these match, which is what lets a
+ * client compare only the models it declares instead of welding itself to the
+ * whole-schema hash (where any additive push reads as drift). Computed over the
+ * model's `SchemaJSON` entry with the same canonicalization and hash as
+ * {@link schemaHash}, on both the client and the server's `GET /api/schema`.
+ */
+export function modelHash(modelJson) {
+    return fnv1a(canonicalJson(modelJson));
+}
+/** FNV-1a over an already-canonical string — shared by both hashes above. */
+function fnv1a(canonical) {
     let h = 0x811c9dc5;
     for (let i = 0; i < canonical.length; i++) {
         h ^= canonical.charCodeAt(i);

package/dist/schema/sugar.d.ts

@@ -23,7 +23,7 @@
  * ```
  */
 import type { z } from 'zod';
-import { type ModelDef, type ModelOptions, type ComputedRecord, type RelationRecord } from './model.js';
+import { type ModelDef, type ModelOptions, type ComputedRecord, type RelationRecord } from '../transaction/schema/model.js';
 /**
  * Options accepted by every sugar verb. A strict subset of
  * {@link ModelOptions} — anything the verb infers (`mutable`, `load`,
@@ -79,13 +79,11 @@ export interface SugarOptions<R extends RelationRecord = RelationRecord, C exten
  * Pick the load suffix by data-access pattern:
  *   - `.instant`  — small, always-needed (Theme, Layout, StatusGroup)
  *   - `.lazy`     — large collections fetched on first query
- *     (SlideLayer, Message, Task)
- *   - `.manual`   — never auto-loaded; explicit queries only
+ *     (Block, Message, Task)
  */
 export declare const mutable: {
     instant: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
     lazy: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
-    manual: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
 };
 /**
  * Server-managed entities. `readOnly.*` means clients subscribe to
@@ -102,9 +100,10 @@ export declare const readOnly: {
     instant: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
     lazy: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
     /**
-     * Internal-only: never auto-loaded, never written by clients. The
-     * strongest safety posture — use for tables the SDK must know about
-     * (for type inference) but that should never flow over the wire.
+     * Internal-only: kept out of bootstrap and never written by clients. The
+     * strongest safety posture — use for tables the SDK must know about (for type
+     * inference) but that no client should be able to write. Rows still reach a
+     * client that reads the model, so this is a write boundary, not a read one.
      */
     internal: <Shape extends z.ZodRawShape, R extends RelationRecord = Record<string, never>, C extends ComputedRecord = Record<string, never>>(shape: Shape, opts?: SugarOptions<R, C>) => ModelDef<Shape, R, C>;
 };

package/dist/schema/sugar.js

@@ -22,11 +22,10 @@
  * }),
  * ```
  */
-import { model, } from './model.js';
+import { model, } from '../transaction/schema/model.js';
 /** Internal helper — builds a ModelDef with baseline safety+load flags applied. */
 function build(shape, opts, baseline) {
-    return model(shape, (opts?.relations ?? {}), {
-        mutable: baseline.mutable,
+    return model(shape, { relations: (opts?.relations ?? {}), mutable: baseline.mutable,
         load: baseline.load,
         lazyObservable: opts?.lazyObservable ?? baseline.lazyObservable,
         typename: opts?.typename,
@@ -36,8 +35,7 @@ function build(shape, opts, baseline) {
         bootstrapLimit: opts?.bootstrapLimit,
         bootstrapOrderBy: opts?.bootstrapOrderBy,
         persist: opts?.persist,
-        computed: opts?.computed,
-    });
+        computed: opts?.computed, });
 }
 /**
  * Client-writable entities. `mutable.*` is the opt-in signal for wire
@@ -47,8 +45,7 @@ function build(shape, opts, baseline) {
  * Pick the load suffix by data-access pattern:
  *   - `.instant`  — small, always-needed (Theme, Layout, StatusGroup)
  *   - `.lazy`     — large collections fetched on first query
- *     (SlideLayer, Message, Task)
- *   - `.manual`   — never auto-loaded; explicit queries only
+ *     (Block, Message, Task)
  */
 export const mutable = {
     instant: (shape, opts) => 
@@ -56,7 +53,6 @@ export const mutable = {
     // `lazyObservable: false` only for very large read-only list models.
     build(shape, opts, { mutable: true, load: 'instant', lazyObservable: true }),
     lazy: (shape, opts) => build(shape, opts, { mutable: true, load: 'lazy', lazyObservable: true }),
-    manual: (shape, opts) => build(shape, opts, { mutable: true, load: 'manual', lazyObservable: true }),
 };
 /**
  * Server-managed entities. `readOnly.*` means clients subscribe to
@@ -78,9 +74,10 @@ export const readOnly = {
     build(shape, opts, { mutable: false, load: 'instant', lazyObservable: true }),
     lazy: (shape, opts) => build(shape, opts, { mutable: false, load: 'lazy', lazyObservable: true }),
     /**
-     * Internal-only: never auto-loaded, never written by clients. The
-     * strongest safety posture — use for tables the SDK must know about
-     * (for type inference) but that should never flow over the wire.
+     * Internal-only: kept out of bootstrap and never written by clients. The
+     * strongest safety posture — use for tables the SDK must know about (for type
+     * inference) but that no client should be able to write. Rows still reach a
+     * client that reads the model, so this is a write boundary, not a read one.
      */
-    internal: (shape, opts) => build(shape, opts, { mutable: false, load: 'manual', lazyObservable: true }),
+    internal: (shape, opts) => build(shape, opts, { mutable: false, load: 'lazy', lazyObservable: true }),
 };

package/dist/schema/syncDeltaRow.d.ts

@@ -1,154 +1,6 @@
 /**
- * Zod schemas that describe the `sync_deltas` storage row — the durable record of
- * one committed change. The row is split into three slices by the concern each one
- * serves:
- *
- *   - {@link syncDeltaCoreSchema} — the sync-protocol slice: everything a client
- *     needs to reconstruct the change, plus the tenant key. This is a portable
- *     payload shape; it is not a statement that the row is physically stored in
- *     the customer's database.
- *   - {@link deltaAttributionSchema} — who made the change, and on whose authority.
- *   - {@link deltaProvenanceSchema} — which AI task, if any, produced it.
- *
- * {@link syncDeltaRowSchema} composes all three into the full stored row.
- * {@link DELTA_DATA_CLASSIFICATION} states which slices contain customer data,
- * while {@link DELTA_PHYSICAL_STORAGE} states where the runtime persists them.
- * Keeping those axes separate prevents a portable schema slice from being cited
- * incorrectly as a physical-residency guarantee.
- *
- * This is the stored shape. The delta broadcast to clients is a narrower projection
- * of it — see {@link import('../wire/delta.js').syncDeltaWireCoreSchema} — and
- * the field names here mirror those on that wire delta.
+ * Compatibility entry point for the durable `sync_deltas` row contract, which
+ * is owned by the transaction layer. The schema barrel continues to re-export
+ * this path so existing `@abloatai/ablo/schema` consumers do not change.
  */
-import { z } from 'zod';
-export { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-export type { ParticipantKind, ConfirmationState } from '../wire/delta.js';
-/** `backfill_provenance` */
-export declare const backfillProvenanceSchema: z.ZodEnum<{
-    unknown: "unknown";
-    exact: "exact";
-    inferred: "inferred";
-}>;
-export type BackfillProvenance = z.infer<typeof backfillProvenanceSchema>;
-/**
- * Everything a client needs to materialize the change, plus the tenant key. This
- * is the portable shape an authoritative WAL change or endpoint event carries.
- * The runtime persists the resulting full row in Ablo's tenant-scoped ordered
- * sync log; it is not written atomically with a direct application-row mutation.
- * `id`, `createdAt`, and `syncGroups` are assigned when the source change is
- * appended, so they are optional at the ingestion boundary.
- */
-export declare const syncDeltaCoreSchema: z.ZodObject<{
-    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodBigInt, z.ZodNumber]>>;
-    actionType: z.ZodString;
-    modelName: z.ZodString;
-    modelId: z.ZodString;
-    data: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    previousData: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-    syncGroups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    organizationId: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodOptional<z.ZodString>;
-    transactionId: z.ZodNullable<z.ZodString>;
-    sourceChangeId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-}, z.core.$strip>;
-export type SyncDeltaCore = z.infer<typeof syncDeltaCoreSchema>;
-export declare const deltaAttributionSchema: z.ZodObject<{
-    createdBy: z.ZodNullable<z.ZodString>;
-    actorId: z.ZodNullable<z.ZodString>;
-    actorKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    onBehalfOfId: z.ZodNullable<z.ZodString>;
-    onBehalfOfKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    capabilityId: z.ZodNullable<z.ZodString>;
-    delegationChainRootUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    confirmationState: z.ZodNullable<z.ZodEnum<{
-        auto: "auto";
-        previewed: "previewed";
-        approved: "approved";
-        required_human_approval: "required_human_approval";
-        auto_historical: "auto_historical";
-    }>>;
-    backfillProvenance: z.ZodNullable<z.ZodEnum<{
-        unknown: "unknown";
-        exact: "exact";
-        inferred: "inferred";
-    }>>;
-}, z.core.$strip>;
-export type DeltaAttribution = z.infer<typeof deltaAttributionSchema>;
-export declare const deltaProvenanceSchema: z.ZodObject<{
-    causedByTaskId: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-export type DeltaProvenance = z.infer<typeof deltaProvenanceSchema>;
-/** The complete `sync_deltas` row: core, attribution, and provenance combined. */
-export declare const syncDeltaRowSchema: z.ZodObject<{
-    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodBigInt, z.ZodNumber]>>;
-    actionType: z.ZodString;
-    modelName: z.ZodString;
-    modelId: z.ZodString;
-    data: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    previousData: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-    syncGroups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    organizationId: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodOptional<z.ZodString>;
-    transactionId: z.ZodNullable<z.ZodString>;
-    sourceChangeId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    createdBy: z.ZodNullable<z.ZodString>;
-    actorId: z.ZodNullable<z.ZodString>;
-    actorKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    onBehalfOfId: z.ZodNullable<z.ZodString>;
-    onBehalfOfKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    capabilityId: z.ZodNullable<z.ZodString>;
-    delegationChainRootUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    confirmationState: z.ZodNullable<z.ZodEnum<{
-        auto: "auto";
-        previewed: "previewed";
-        approved: "approved";
-        required_human_approval: "required_human_approval";
-        auto_historical: "auto_historical";
-    }>>;
-    backfillProvenance: z.ZodNullable<z.ZodEnum<{
-        unknown: "unknown";
-        exact: "exact";
-        inferred: "inferred";
-    }>>;
-    causedByTaskId: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-export type SyncDeltaRow = z.infer<typeof syncDeltaRowSchema>;
-/** Which slices contain retained customer row data versus control metadata. */
-export declare const DELTA_DATA_CLASSIFICATION: {
-    readonly core: "customer-data";
-    readonly attribution: "control-metadata";
-    readonly provenance: "control-metadata";
-};
-/**
- * Where the current runtime physically persists each slice. All three live in
- * Ablo's tenant-scoped `sync_deltas` log. `core` contains full post-change row
- * payloads (and optional previous payloads), so `control` here must not be read
- * as "metadata only."
- */
-export declare const DELTA_PHYSICAL_STORAGE: {
-    readonly core: "control";
-    readonly attribution: "control";
-    readonly provenance: "control";
-};
-/** @deprecated Use `DELTA_PHYSICAL_STORAGE`; classification is a separate axis. */
-export declare const DELTA_RESIDENCY: {
-    readonly core: "control";
-    readonly attribution: "control";
-    readonly provenance: "control";
-};
+export * from '../transaction/log/syncDeltaRow.js';

package/dist/schema/syncDeltaRow.js

@@ -1,107 +1,6 @@
 /**
- * Zod schemas that describe the `sync_deltas` storage row — the durable record of
- * one committed change. The row is split into three slices by the concern each one
- * serves:
- *
- *   - {@link syncDeltaCoreSchema} — the sync-protocol slice: everything a client
- *     needs to reconstruct the change, plus the tenant key. This is a portable
- *     payload shape; it is not a statement that the row is physically stored in
- *     the customer's database.
- *   - {@link deltaAttributionSchema} — who made the change, and on whose authority.
- *   - {@link deltaProvenanceSchema} — which AI task, if any, produced it.
- *
- * {@link syncDeltaRowSchema} composes all three into the full stored row.
- * {@link DELTA_DATA_CLASSIFICATION} states which slices contain customer data,
- * while {@link DELTA_PHYSICAL_STORAGE} states where the runtime persists them.
- * Keeping those axes separate prevents a portable schema slice from being cited
- * incorrectly as a physical-residency guarantee.
- *
- * This is the stored shape. The delta broadcast to clients is a narrower projection
- * of it — see {@link import('../wire/delta.js').syncDeltaWireCoreSchema} — and
- * the field names here mirror those on that wire delta.
+ * Compatibility entry point for the durable `sync_deltas` row contract, which
+ * is owned by the transaction layer. The schema barrel continues to re-export
+ * this path so existing `@abloatai/ablo/schema` consumers do not change.
  */
-import { z } from 'zod';
-import { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-// ── Enumerations that mirror the corresponding Postgres enum types ────────────
-// `participant_kind` and `confirmation_state` are shared with the wire delta and
-// live at the wire layer (see `../wire/delta.js`); they are re-exported here so
-// code that imports them from `schema` keeps resolving.
-export { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-/** `backfill_provenance` */
-export const backfillProvenanceSchema = z.enum(['exact', 'inferred', 'unknown']);
-/** A delta payload: the full post-mutation row (or null for deletes). */
-const deltaDataSchema = z.record(z.string(), z.unknown()).nullable();
-// ── Core — the sync-protocol slice ────────────────────────────────────────────
-/**
- * Everything a client needs to materialize the change, plus the tenant key. This
- * is the portable shape an authoritative WAL change or endpoint event carries.
- * The runtime persists the resulting full row in Ablo's tenant-scoped ordered
- * sync log; it is not written atomically with a direct application-row mutation.
- * `id`, `createdAt`, and `syncGroups` are assigned when the source change is
- * appended, so they are optional at the ingestion boundary.
- */
-export const syncDeltaCoreSchema = z.object({
-    /** Monotonically increasing sync id, assigned by the server when the delta is appended; absent on an outbox marker. */
-    id: z.union([z.bigint(), z.number()]).optional(),
-    /** The `action_type` column: a single character, `I` (insert), `U` (update), or `D` (delete). */
-    actionType: z.string().min(1).max(1),
-    modelName: z.string().min(1),
-    modelId: z.string().min(1),
-    data: deltaDataSchema,
-    previousData: deltaDataSchema.optional(),
-    /** Routing keys that decide which subscribers receive this delta; computed by the server at append time. */
-    syncGroups: z.array(z.string()).optional(),
-    /** The committing organization id — the coarse-grained tenant-isolation boundary. */
-    organizationId: z.string().nullable(),
-    /** ISO 8601 timestamp, assigned by the server when the delta is appended. */
-    createdAt: z.string().optional(),
-    transactionId: z.string().nullable(),
-    /**
-     * Stable identity of the authoritative WAL row or endpoint event. It is
-     * nullable for hosted/legacy rows and is never exposed as the optimistic
-     * client transaction id.
-     */
-    sourceChangeId: z.string().min(1).nullable().optional(),
-});
-// ── Attribution — who made the change, and on whose authority ─────────────────
-export const deltaAttributionSchema = z.object({
-    /** The acting participant, recorded as a single column for compatibility; the structured pair below is the richer form. */
-    createdBy: z.string().nullable(),
-    actorId: z.string().nullable(),
-    actorKind: participantKindSchema.nullable(),
-    onBehalfOfId: z.string().nullable(),
-    onBehalfOfKind: participantKindSchema.nullable(),
-    capabilityId: z.string().nullable(),
-    delegationChainRootUserId: z.string().nullable().optional(),
-    confirmationState: confirmationStateSchema.nullable(),
-    backfillProvenance: backfillProvenanceSchema.nullable(),
-});
-// ── Provenance — which AI task produced the change ────────────────────────────
-export const deltaProvenanceSchema = z.object({
-    /** Foreign key to the task record for the AI turn that produced this commit; null when no task applies. */
-    causedByTaskId: z.string().nullable(),
-});
-// ── Full stored row, classification, and physical storage ─────────────────────
-/** The complete `sync_deltas` row: core, attribution, and provenance combined. */
-export const syncDeltaRowSchema = syncDeltaCoreSchema
-    .extend(deltaAttributionSchema.shape)
-    .extend(deltaProvenanceSchema.shape);
-/** Which slices contain retained customer row data versus control metadata. */
-export const DELTA_DATA_CLASSIFICATION = {
-    core: 'customer-data',
-    attribution: 'control-metadata',
-    provenance: 'control-metadata',
-};
-/**
- * Where the current runtime physically persists each slice. All three live in
- * Ablo's tenant-scoped `sync_deltas` log. `core` contains full post-change row
- * payloads (and optional previous payloads), so `control` here must not be read
- * as "metadata only."
- */
-export const DELTA_PHYSICAL_STORAGE = {
-    core: 'control',
-    attribution: 'control',
-    provenance: 'control',
-};
-/** @deprecated Use `DELTA_PHYSICAL_STORAGE`; classification is a separate axis. */
-export const DELTA_RESIDENCY = DELTA_PHYSICAL_STORAGE;
+export * from '../transaction/log/syncDeltaRow.js';

package/dist/server/adapter.d.ts

@@ -16,7 +16,7 @@
  * database row that the rest of the engine reads and writes.
  */
 import type { SourceListQuery, SourceOperation, SourceRequestContext } from '../source/index.js';
-import type { ServerSyncDelta } from '../wire/delta.js';
+import type { ServerSyncDelta } from '../transaction/wire/delta.js';
 import type { BootstrapModel } from './readConfig.js';
 import type { CommitContext, CommitResult } from './commit.js';
 import type { StorageMode } from './storageMode.js';
@@ -41,6 +41,12 @@ export type ReadResult = {
     readonly models: Record<string, Row[]>;
     /** Models whose read failed (partial success), if any. */
     readonly failedModels?: string[];
+    /**
+     * Present when a paged read (`ReadRequest.page`) stopped at its row
+     * limit with rows remaining: pass it back as the next page's cursor.
+     * Absent on the final page and on unpaged reads.
+     */
+    readonly nextCursor?: string;
 } | {
     readonly kind: 'query';
     readonly rows: readonly Row[];
@@ -93,6 +99,17 @@ export type ReadRequest = {
     readonly models: readonly BootstrapModel[];
     readonly requestedModels?: readonly string[];
     readonly scope?: SourceRequestContext;
+    /**
+     * Keyset pagination for a SINGLE-model read (`requestedModels` names
+     * exactly one model): return at most `limit` rows, starting after the
+     * row whose id equals `cursor`. The result carries `nextCursor` while
+     * rows remain. Ignored for multi-model reads and by adapters whose
+     * backend pages upstream on its own.
+     */
+    readonly page?: {
+        readonly cursor?: string;
+        readonly limit: number;
+    };
 } | {
     readonly kind: 'query';
     readonly model: string;

package/dist/server/commit.d.ts

@@ -14,10 +14,10 @@
  * rather than being kept in step by hand.
  */
 import type { ParticipantKind, ConfirmationState } from '../schema/syncDeltaRow.js';
-import type { ParticipantRef } from '../wire/delta.js';
-import type { CommitExecutionResultInput } from '../wire/commit.js';
-import type { Environment } from '../environment.js';
-import type { ReadDependency, TrackDependency } from '../coordination/schema.js';
+import type { ParticipantRef } from '../transaction/wire/delta.js';
+import type { CommitExecutionResultInput } from '../transaction/wire/commit.js';
+import type { Environment } from '../transaction/environment.js';
+import type { ReadDependency, TrackDependency } from '../transaction/coordination/schema.js';
 export interface CommitContext {
     participantId: string;
     /**
@@ -45,7 +45,7 @@ export interface CommitContext {
      * The sync groups this participant subscribes to, taken from the connection
      * upgrade or the capability token. Each is appended to every delta's `sync_groups`
      * so that writes fan out to subscribers of entity-level groups (such as
-     * `deck:abc`), not only the default `org:X` and `user:Y` groups. When omitted, the
+     * `report:abc`), not only the default `org:X` and `user:Y` groups. When omitted, the
      * commit fans out to just the organization and user groups.
      */
     syncGroups?: readonly string[];
@@ -84,13 +84,7 @@ export interface CommitContext {
      */
     confirmationState?: ConfirmationState;
     /**
-     * Optional foreign key to the task that caused the change, written to the
-     * `caused_by_task_id` column when present. Validated when set; clients typically
-     * leave it null and let attribution ride on the actor and capability instead.
-     */
-    causedByTaskId?: string | null;
-    /**
-     * Read dependencies for the whole batch. The committer declares the rows or groups
+     * The premise for the whole batch. The committer declares the rows or groups
      * it read to form this batch; the engine checks that none of them changed since
      * each entry's `readAt` timestamp and applies that entry's `onStale` disposition
      * across the batch. This differs from the per-operation `readAt` guard, which
@@ -98,10 +92,10 @@ export interface CommitContext {
      */
     reads?: ReadDependency[] | null;
     /**
-     * Durable read-dependencies to persist for this commit's participant. Each entry
-     * is kept in `track_dependencies` and re-checked against every future delta; a
-     * later match opens a `StaleNotification` delivered out of band. Distinct from
-     * `reads`, which is checked once here and discarded.
+     * Durable premises to persist for this commit's participant. Each entry is
+     * kept in `track_dependencies` and re-checked against every future delta; a
+     * later match opens a `StaleNotification` delivered out of band. Distinct
+     * from `reads`, which is checked once here and discarded.
      */
     track?: TrackDependency[] | null;
 }

package/dist/server/index.d.ts

@@ -9,6 +9,6 @@
  */
 export type { Row, ReadResult, SyncCursor, DataAdapterCapabilities, ProposalResult, ReadRequest, ChangeSet, SyncResult, DataAdapter, ProposableDataAdapter, AdapterResolver, } from './adapter.js';
 export type { CommitContext, CommitResult } from './commit.js';
-export { commitExecutionResultSchema } from '../wire/commit.js';
+export { commitExecutionResultSchema } from '../transaction/wire/commit.js';
 export { storageModeSchema, type StorageMode } from './storageMode.js';
 export type { ColumnOverride, BootstrapModel } from './readConfig.js';

package/dist/server/index.js

@@ -1,2 +1,2 @@
-export { commitExecutionResultSchema } from '../wire/commit.js';
+export { commitExecutionResultSchema } from '../transaction/wire/commit.js';
 export { storageModeSchema } from './storageMode.js';

package/dist/server/readConfig.d.ts

@@ -23,7 +23,7 @@ export interface BootstrapModel {
     /**
      * The schema key used by source endpoints. `name` stays the wire and result model
      * name (usually the typename), while source handlers are keyed by the developer's
-     * schema key, such as `files` or `slideLayers`.
+     * schema key, such as `files` or `blocks`.
      */
     sourceModel?: string;
     table: string;

package/dist/source/adapter.d.ts

@@ -8,16 +8,18 @@
  * write your own.
  *
  * An endpoint adapter reads and writes your database, and it owns the transactional
- * outbox and idempotency bookkeeping as well, so you never write those by hand:
+ * outbox and idempotency bookkeeping as well, so you never write those by hand.
+ * Hand it to the handler in one slot:
  *
  *   export const POST = dataSource({
  *     schema, apiKey: process.env.ABLO_API_KEY!,
- *     ...sourceHandlersFromAdapter(prismaDataSource(prisma, schema), schema),
+ *     adapter: prismaDataSource(prisma, schema),
  *   });
  *
- * `sourceHandlersFromAdapter` is the bridge: it turns a single adapter into the
- * handler's `commit`, `events`, and per-model `load` and `list` operations, so no
- * code above the adapter needs to know which mapper you chose.
+ * That is the path to teach. {@link sourceHandlersFromAdapter} is the lower-level
+ * bridge behind it — it expands one adapter into the handler's `commit`, `events`,
+ * and per-model `load` and `list` operations, and is worth reaching for only when
+ * you want to override one of those while the adapter serves the rest.
  */
 import type { SourceListQuery, SourceRequestContext } from './types.js';
 import type { AdapterCapabilities, ChangeSet, EventsPage, Migration } from './contract.js';

package/dist/source/adapter.js

@@ -8,15 +8,17 @@
  * write your own.
  *
  * An endpoint adapter reads and writes your database, and it owns the transactional
- * outbox and idempotency bookkeeping as well, so you never write those by hand:
+ * outbox and idempotency bookkeeping as well, so you never write those by hand.
+ * Hand it to the handler in one slot:
  *
  *   export const POST = dataSource({
  *     schema, apiKey: process.env.ABLO_API_KEY!,
- *     ...sourceHandlersFromAdapter(prismaDataSource(prisma, schema), schema),
+ *     adapter: prismaDataSource(prisma, schema),
  *   });
  *
- * `sourceHandlersFromAdapter` is the bridge: it turns a single adapter into the
- * handler's `commit`, `events`, and per-model `load` and `list` operations, so no
- * code above the adapter needs to know which mapper you chose.
+ * That is the path to teach. {@link sourceHandlersFromAdapter} is the lower-level
+ * bridge behind it — it expands one adapter into the handler's `commit`, `events`,
+ * and per-model `load` and `list` operations, and is worth reaching for only when
+ * you want to override one of those while the adapter serves the rest.
  */
 export {};

package/dist/source/adapters/drizzle.d.ts

@@ -35,7 +35,7 @@
  */
 import { type SQL } from 'drizzle-orm';
 import type { DataSourceAdapter, Row } from '../adapter.js';
-import type { Schema, SchemaRecord } from '../../schema/schema.js';
+import type { Schema, SchemaRecord } from '../../transaction/schema/schema.js';
 /** The subset of a Drizzle database/transaction handle the adapter calls. */
 export interface DrizzleLike {
     execute(query: SQL): Promise<DrizzleExecuteResult>;

package/dist/source/adapters/drizzle.js

@@ -33,14 +33,14 @@
  * which keeps the adapter one small, fully typed unit with no per-driver builder
  * generics.
  */
-import { AbloValidationError } from '../../errors.js';
+import { AbloValidationError } from '../../transaction/errors.js';
 import { sql } from 'drizzle-orm';
 import { outboxEventSchema } from '../contract.js';
 import { adapterTableMigrations } from '../migrations.js';
 import { assertSourceIdempotencyIntent, assertSourceIdempotencyRetention, SOURCE_IDEMPOTENCY_RETENTION, sourceChangeIntentHash, } from '../idempotency.js';
 import { toSchemaJSON } from '../../schema/serialize.js';
 import { camelToSnake, snakeToCamel } from '../../schema/ddl.js';
-import { tenancyColumn } from '../../schema/tenancy.js';
+import { tenancyColumn } from '../../transaction/schema/tenancy.js';
 import { ABLO_POSTGRES_COMMIT_ECHO_PREFIX } from '../types.js';
 function rowsOf(result) {
     return Array.isArray(result) ? result : result.rows;