@abloatai/ablo 0.34.1 → 0.36.0

package/dist/{schema → transaction/schema}/relation.d.ts

@@ -22,7 +22,7 @@
  * `index: true` registers a foreign-key index for the child model when the
  * engine starts, turning "every child that points at this parent" from a full
  * scan into a constant-time lookup. Reach for it on relations you query this
- * way often, such as a slide layer's `slideId`.
+ * way often, such as a block's `sectionId`.
  *
  * `enrich: true` auto-populates the parent reference on an incoming change
  * before the child data lands. A change to `Task { teamId: 't1' }` picks up the
@@ -44,11 +44,11 @@
  * relax the foreign-key check itself. For example:
  *
  *   ```ts
- *   layouts: model({ deckId: z.string().nullish() }, {
- *     // The deck-owns-layout link is nullable and the layout is always
- *     // created first; marking it `defer` lets the deck commit ahead of the
+ *   layouts: model({ reportId: z.string().nullish() }, {
+ *     // The report-owns-layout link is nullable and the layout is always
+ *     // created first; marking it `defer` lets the report commit ahead of the
  *     // layout instead of sharing its insert-order slot.
- *     deck: relation.belongsTo('slideDecks', 'deckId', { defer: true }),
+ *     report: relation.belongsTo('reports', 'reportId', { defer: true }),
  *   }),
  *   ```
  */
@@ -65,14 +65,14 @@ export interface BelongsToOptions {
      * container to the things it holds, as a folder does to its files.
      *
      * Do not set `parent` on a reference that merely points at another record for
-     * provenance or as a template, such as `sourceSlideId` or `templateId`; doing
+     * provenance or as a template, such as `sourceSectionId` or `templateId`; doing
      * so would leak the record into an unrelated scope. The engine also cannot
      * infer the parent from whether a field is optional — many real parent keys
      * are optional, like a root folder or an inbox task — so you must declare the
      * parent edge explicitly.
      *
      * It reads naturally at the call site:
-     * `belongsTo('deck', 'deckId', { parent: true })` — the deck is the parent.
+     * `belongsTo('report', 'reportId', { parent: true })` — the report is the parent.
      */
     readonly parent?: boolean;
     /**
@@ -84,7 +84,7 @@ export interface BelongsToOptions {
      *
      * Set `fk: true` only when the target row lives in the same database and is
      * written in the same commit as this row, and points at a strong, contained
-     * entity. Leave it off provenance or template pointers (`sourceSlideId`,
+     * entity. Leave it off provenance or template pointers (`sourceSectionId`,
      * `templateId`), cross-tenant references, or anything that may be written in a
      * different transaction than its target — a hard constraint there would reject
      * the write and break out-of-order sync. The constraint is emitted as
@@ -96,7 +96,13 @@ export interface BelongsToOptions {
 declare const __relationType: unique symbol;
 declare const __relationTarget: unique symbol;
 declare const __relationField: unique symbol;
-export type RelationType = 'belongsTo' | 'hasMany' | 'hasOne';
+/**
+ * The three edges the engine resolves. Inferred from `wire/modelShape.ts`
+ * rather than restated: the set is reported to callers by `GET /api/schema`,
+ * so it is protocol, and protocol has one definition.
+ */
+export type { RelationType } from '../wire/modelShape.js';
+import type { RelationType } from '../wire/modelShape.js';
 /**
  * A relation definition, carrying its type information at both the type and
  * runtime level.
@@ -157,7 +163,7 @@ export declare const relation: {
      * project: relation.belongsTo('projects', 'projectId'),
      *
      * // Register an FK index for O(1) child lookups
-     * slide: relation.belongsTo('slides', 'slideId', { index: true }),
+     * section: relation.belongsTo('sections', 'sectionId', { index: true }),
      *
      * // Auto-populate the parent on delta arrival
      * team: relation.belongsTo('teams', 'teamId', { enrich: true }),
@@ -167,7 +173,7 @@ export declare const relation: {
      *
      * // Mark the soft side of a cycle so the priority computer breaks
      * // the cycle deterministically instead of tying the two models.
-     * deck: relation.belongsTo('slideDecks', 'deckId', { defer: true }),
+     * report: relation.belongsTo('reports', 'reportId', { defer: true }),
      * ```
      */
     readonly belongsTo: <Target extends string, Field extends string, const Opts extends BelongsToOptions = Record<string, never>>(target: Target, foreignKey: Field, options?: Opts) => RelationDef<"belongsTo", Target, Field, Opts>;
@@ -180,11 +186,11 @@ export declare const relation: {
      * child model automatically.
      *
      * ```ts
-     * slides: relation.hasMany('slideLayers', 'slideId'),
-     * // → deck.slides returns all SlideLayer[] where slideId === deck.id
+     * blocks: relation.hasMany('blocks', 'sectionId'),
+     * // → section.blocks returns all Block[] where sectionId === section.id
      *
-     * slides: relation.hasMany('slideLayers', 'slideId', { orderBy: 'zIndex' }),
-     * // → deck.slides returns SlideLayer[] sorted by zIndex ascending
+     * blocks: relation.hasMany('blocks', 'sectionId', { orderBy: 'zIndex' }),
+     * // → section.blocks returns Block[] sorted by zIndex ascending
      * ```
      */
     readonly hasMany: <Target extends string, Field extends string>(target: Target, foreignKey: Field, options?: {
@@ -196,4 +202,3 @@ export declare const relation: {
      */
     readonly hasOne: <Target extends string, Field extends string>(target: Target, foreignKey: Field) => RelationDef<"hasOne", Target, Field>;
 };
-export {};

package/dist/{schema → transaction/schema}/relation.js

@@ -33,7 +33,7 @@ class RelationBuilder {
      * Stashed by `hasMany` when the caller provides `{ orderBy }`. Read
      * back in `createSyncEngine` to install the sort comparator on the
      * generated relation getter. Declared on the builder so both writer
-     * and reader stay type-safe — no `as unknown as Record<...>` smuggle.
+     * and reader stay type-safe — no double-cast smuggle through `Record<...>`.
      */
     _orderBy;
     constructor(type, target, foreignKey, options) {
@@ -55,7 +55,7 @@ export const relation = {
      * project: relation.belongsTo('projects', 'projectId'),
      *
      * // Register an FK index for O(1) child lookups
-     * slide: relation.belongsTo('slides', 'slideId', { index: true }),
+     * section: relation.belongsTo('sections', 'sectionId', { index: true }),
      *
      * // Auto-populate the parent on delta arrival
      * team: relation.belongsTo('teams', 'teamId', { enrich: true }),
@@ -65,7 +65,7 @@ export const relation = {
      *
      * // Mark the soft side of a cycle so the priority computer breaks
      * // the cycle deterministically instead of tying the two models.
-     * deck: relation.belongsTo('slideDecks', 'deckId', { defer: true }),
+     * report: relation.belongsTo('reports', 'reportId', { defer: true }),
      * ```
      */
     belongsTo(target, foreignKey, options) {
@@ -80,11 +80,11 @@ export const relation = {
      * child model automatically.
      *
      * ```ts
-     * slides: relation.hasMany('slideLayers', 'slideId'),
-     * // → deck.slides returns all SlideLayer[] where slideId === deck.id
+     * blocks: relation.hasMany('blocks', 'sectionId'),
+     * // → section.blocks returns all Block[] where sectionId === section.id
      *
-     * slides: relation.hasMany('slideLayers', 'slideId', { orderBy: 'zIndex' }),
-     * // → deck.slides returns SlideLayer[] sorted by zIndex ascending
+     * blocks: relation.hasMany('blocks', 'sectionId', { orderBy: 'zIndex' }),
+     * // → section.blocks returns Block[] sorted by zIndex ascending
      * ```
      */
     hasMany(target, foreignKey, options) {

package/dist/{schema → transaction/schema}/residency.d.ts

@@ -27,12 +27,3 @@ export declare const residencySchema: z.ZodEnum<{
 export type ModelResidency = z.infer<typeof residencySchema>;
 /** Default residency for a model that doesn't declare one — the tenant data plane. */
 export declare const DEFAULT_RESIDENCY: ModelResidency;
-/** @deprecated Use `residencySchema`. */
-export declare const planeSchema: z.ZodEnum<{
-    tenant: "tenant";
-    control: "control";
-}>;
-/** @deprecated Use `ModelResidency`. */
-export type SchemaPlane = ModelResidency;
-/** @deprecated Use `DEFAULT_RESIDENCY`. */
-export declare const DEFAULT_PLANE: "tenant";

package/dist/{schema → transaction/schema}/residency.js

@@ -23,8 +23,3 @@ import { z } from 'zod';
 export const residencySchema = z.enum(['tenant', 'control']);
 /** Default residency for a model that doesn't declare one — the tenant data plane. */
 export const DEFAULT_RESIDENCY = 'tenant';
-// ── Deprecated aliases (published schema subpath) ───────────────────────────
-/** @deprecated Use `residencySchema`. */
-export const planeSchema = residencySchema;
-/** @deprecated Use `DEFAULT_RESIDENCY`. */
-export const DEFAULT_PLANE = DEFAULT_RESIDENCY;

package/dist/{schema → transaction/schema}/roles.d.ts

@@ -14,7 +14,7 @@ import { z } from 'zod';
  *     Reads fields off an identity context (`organizationId`, `teamIds`).
  *
  *   • {@link EntityRole} — "which groups does this *record* live in?" Reads
- *     fields off the record itself (`id`, `deckId`), so the server can fan a
+ *     fields off the record itself (`id`, `reportId`), so the server can fan a
  *     committed delta to the right entity streams regardless of what the
  *     committer was subscribed to.
  *
@@ -110,11 +110,11 @@ export type Role = z.infer<typeof roleSchema>;
 export type IdentityRole = Role;
 /**
  * Record-anchored role. Reads a record field; `kind` names the group. A record
- * can route to a group keyed by its own `id` *or* a foreign key like `deckId`.
+ * can route to a group keyed by its own `id` *or* a foreign key like `reportId`.
  *
  * ```ts
- * entityRole({ kind: 'deck', source: 'id' })      // a deck → deck:<id>
- * entityRole({ kind: 'deck', source: 'deckId' })  // a layer → its parent deck
+ * entityRole({ kind: 'report', source: 'id' })        // a report → report:<id>
+ * entityRole({ kind: 'report', source: 'reportId' })  // a block → its parent report
  * ```
  */
 export type EntityRole = Role;
@@ -203,7 +203,7 @@ export declare function entityRole(spec: {
 /**
  * Evaluate a {@link RoleSource} against a context. Absent or falsy fields yield
  * `[]`, so a role whose field isn't present (a user with no `teamIds`, a record
- * with no `deckId`) is a silent no-op.
+ * with no `reportId`) is a silent no-op.
  */
 export declare function extractRoleIds(context: RoleContext, source: RoleSource): readonly string[];
 /** Identity-side name for {@link extractRoleIds}. */

package/dist/{schema → transaction/schema}/roles.js

@@ -14,7 +14,7 @@ import { z } from 'zod';
  *     Reads fields off an identity context (`organizationId`, `teamIds`).
  *
  *   • {@link EntityRole} — "which groups does this *record* live in?" Reads
- *     fields off the record itself (`id`, `deckId`), so the server can fan a
+ *     fields off the record itself (`id`, `reportId`), so the server can fan a
  *     committed delta to the right entity streams regardless of what the
  *     committer was subscribed to.
  *
@@ -73,7 +73,7 @@ export function identityAnchor(kind, id) {
 // ── Role source ─────────────────────────────────────────────────────────────
 /** Validates how a role pulls ids out of a context (identity or record). */
 export const roleSourceSchema = z.object({
-    /** The context field to read, e.g. `'organizationId'`, `'id'`, `'deckId'`. */
+    /** The context field to read, e.g. `'organizationId'`, `'id'`, `'reportId'`. */
     field: z.string().regex(/^[a-zA-Z_][a-zA-Z0-9_]*$/, 'source must be a valid identifier'),
     /**
      * When `true`, `field` holds an array; every non-empty string element yields
@@ -88,7 +88,7 @@ export const roleSourceSchema = z.object({
  * no template/placeholder for the author to get wrong.
  */
 export const roleSchema = z.object({
-    kind: z.string().regex(/^[a-z][a-z0-9_]*$/, 'kind must be a lowercase identifier, e.g. "deck"'),
+    kind: z.string().regex(/^[a-z][a-z0-9_]*$/, 'kind must be a lowercase identifier, e.g. "report"'),
     source: roleSourceSchema,
 });
 /** Validates an {@link IdentityRole}. */
@@ -102,7 +102,7 @@ export const entityRoleSchema = roleSchema;
  */
 export const scopeSchema = z.union([
     z.boolean(),
-    z.string().regex(/^[a-z][a-z0-9_]*$/, 'scope kind must be a lowercase identifier, e.g. "dataroom"'),
+    z.string().regex(/^[a-z][a-z0-9_]*$/, 'scope kind must be a lowercase identifier, e.g. "workspace"'),
 ]);
 /**
  * Validates a model's `grants` membership edge. Both values are relation names
@@ -148,7 +148,7 @@ export function entityRole(spec) {
 /**
  * Evaluate a {@link RoleSource} against a context. Absent or falsy fields yield
  * `[]`, so a role whose field isn't present (a user with no `teamIds`, a record
- * with no `deckId`) is a silent no-op.
+ * with no `reportId`) is a silent no-op.
  */
 export function extractRoleIds(context, source) {
     const raw = context[source.field];

package/dist/{schema → transaction/schema}/schema.d.ts

@@ -23,6 +23,7 @@ import { z } from 'zod';
 import type { ModelDef, RelationRecord } from './model.js';
 import type { RelationDef } from './relation.js';
 import type { IdentityRole } from './roles.js';
+import { type FieldRef } from './fieldRef.js';
 export { type IdentityRole, type IdentityRoleSource, type IdentityContext, type EntityRole, type EntityRoleSource, type EntityContext, type RoleSource, type RoleContext, type SyncGroup, type SyncGroupInput, identityRole, entityRole, extractIdentityIds, extractEntityIds, composeIdentitySyncGroups, composeEntitySyncGroups, intersectRequestedWithAllowed, syncGroup, syncGroupSchema, syncGroupInputSchema, isSyncGroupInput, identityRoleSchema, entityRoleSchema, roleSchema, roleSourceSchema, scopeSchema, grantsRefSchema, groupsInputSchema, type GroupsInput, } from './roles.js';
 /** The set of built-in casing conventions supported by `defineSchema`. */
 export type CasingConvention = 'snake_case' | 'camelCase';
@@ -141,7 +142,7 @@ export type BaseModelFields = z.infer<typeof baseFieldsSchema>;
  * input types, since methods are not valid input.
  */
 export interface BaseModelMethods {
-    /** Wire-format model name (e.g. `'Slide'`, `'Comment'`). */
+    /** Wire-format model name (e.g. `'Section'`, `'Comment'`). */
     getModelName(): string;
     /** Plain-object serialization suitable for sending over the wire. */
     toJSON(): Record<string, unknown>;
@@ -150,6 +151,23 @@ export interface BaseModelMethods {
 export interface Schema<S extends SchemaRecord = SchemaRecord> {
     /** The raw model definitions */
     readonly models: S;
+    /**
+     * Every declared field as a {@link FieldRef} — the field as a value rather
+     * than a quoted name: `schema.fields.tasks.status`.
+     *
+     * A surface that names a field takes one of these instead of a string, so a
+     * name that does not exist stops compiling and a rename is a compile error at
+     * every use. Claims are the first caller; anything else that has to say
+     * "which field" should take a reference for the same reason.
+     *
+     * Base fields (`id`, `createdAt`, …) are not here: the schema does not
+     * declare them, and a caller naming one means the row, not a part of it.
+     */
+    readonly fields: {
+        readonly [K in keyof S]: S[K] extends ModelDef<infer Shape> ? {
+            readonly [F in Extract<keyof Shape, string>]: FieldRef;
+        } : never;
+    };
     /** Zod schemas with base fields merged in */
     readonly validators: {
         readonly [K in keyof S]: S[K] extends ModelDef<infer Shape> ? z.ZodObject<Shape & typeof baseFieldsSchema.shape> : never;
@@ -208,9 +226,11 @@ type RegisteredSchema = import('../types/global.js').Register extends {
  */
 export type Model<A, B = never> = [B] extends [never] ? A extends keyof RegisteredSchema['models'] ? InferModel<RegisteredSchema, A> : never : A extends Schema ? InferModel<A, B extends keyof A['models'] ? B : never> : never;
 /**
- * @deprecated Use {@link Model} instead — `Model<typeof schema, 'tasks'>` reads
- * as the domain ("the Task model from my schema") rather than the machinery.
- * Kept as an alias with no behavioral difference.
+ * The row type {@link Model} resolves to. Internal: `Model<typeof schema,
+ * 'tasks'>` is the published spelling, because it reads as the domain rather
+ * than the machinery. This one is no longer exported from any subpath — it
+ * stays because `Model` is defined in terms of it, not as a second name for
+ * the same idea.
  */
 export type InferModel<S extends Schema, ModelName extends keyof S['models']> = S['models'][ModelName] extends ModelDef<infer Shape, infer R, infer C> ? // `Omit<…, keyof BaseModelFields>` so a model that (wrongly) redeclares a
 Omit<z.infer<z.ZodObject<Shape>>, keyof BaseModelFields> & BaseModelFields & BaseModelMethods & InferComputed<C> & InferRelations<S, R> : never;
@@ -218,7 +238,7 @@ Omit<z.infer<z.ZodObject<Shape>>, keyof BaseModelFields> & BaseModelFields & Bas
  * Infer the relation accessor types from a model's relations record.
  *
  * At runtime the engine installs a getter for each declared relation, so this
- * type mirrors them and you can read `slide.layers` and `slide.deck` without a
+ * type mirrors them and you can read `section.blocks` and `section.report` without a
  * cast.
  *
  * - `hasMany` → `InferModel<S, Target>[]`
@@ -226,7 +246,7 @@ Omit<z.infer<z.ZodObject<Shape>>, keyof BaseModelFields> & BaseModelFields & Bas
  *   when the foreign key is unset or the parent has not loaded yet)
  *
  * Kept `readonly` because the accessors are getters with no setter — assigning
- * to `slide.layers` would have no effect at runtime.
+ * to `section.blocks` would have no effect at runtime.
  */
 export type InferRelations<S extends Schema, R extends RelationRecord> = string extends keyof R ? unknown : {
     readonly [K in keyof R]: R[K] extends RelationDef<infer Type, infer Target> ? Target extends keyof S['models'] ? Type extends 'hasMany' ? InferModel<S, Target>[] : Type extends 'hasOne' | 'belongsTo' ? InferModel<S, Target> | undefined : never : never : never;
@@ -239,7 +259,7 @@ export type InferRelations<S extends Schema, R extends RelationRecord> = string
  *
  * Relations (`hasMany` / `belongsTo`) are store-backed getters that exist only
  * on the pool's model instances, so a reactive row honestly omits them —
- * reading `row.layers` is a compile error instead of a silent `undefined`.
+ * reading `row.blocks` is a compile error instead of a silent `undefined`.
  * Compose relations through a selector or hook instead.
  *
  * The same pairing other data layers converged on: Zero's data-only `Row<...>`
@@ -253,12 +273,12 @@ Omit<z.infer<z.ZodObject<Shape>>, keyof BaseModelFields> & BaseModelFields & Inf
  * `ablo/register.ts` registers the schema, a single argument is all it takes:
  *
  * ```ts
- * type SlideRow = Row<'slides'>;    // data fields + computeds, no relations
- * type Slide    = Model<'slides'>;  // the pool's model instance
+ * type SectionRow = Row<'sections'>;    // data fields + computeds, no relations
+ * type Section    = Model<'sections'>;  // the pool's model instance
  * ```
  *
  * Without that registration, or for a second schema, pass the schema
- * explicitly: `Row<typeof schema, 'slides'>`.
+ * explicitly: `Row<typeof schema, 'sections'>`.
  */
 export type Row<A, B = never> = [B] extends [never] ? A extends keyof RegisteredSchema['models'] ? InferRow<RegisteredSchema, A> : never : A extends Schema ? InferRow<A, B extends keyof A['models'] ? B : never> : never;
 /**
@@ -319,4 +339,13 @@ export type UpdateValue<S extends Schema, ModelName extends keyof S['models']> =
 export interface DeleteId<S extends Schema, ModelName extends keyof S['models']> {
     id: string;
 }
+/**
+ * One {@link FieldRef} per declared field, keyed by model then field.
+ *
+ * Every construction of a {@link Schema} goes through here — `defineSchema`,
+ * the `selectModels`/`omitModels` projections, and the deserializer — so a
+ * projection carries references for exactly the models it kept and a schema
+ * rebuilt from JSON carries them at all.
+ */
+export declare function buildFieldRefs(models: Record<string, ModelDef>): Record<string, Record<string, FieldRef>>;
 export declare function defineSchema<const S extends SchemaRecord>(models: S, options?: DefineSchemaOptions): Schema<S>;

package/dist/{schema → transaction/schema}/schema.js

@@ -21,6 +21,7 @@
  */
 import { z } from 'zod';
 import { AbloValidationError } from '../errors.js';
+import { fieldRef } from './fieldRef.js';
 import { scopeSchema, grantsRefSchema } from './roles.js';
 // Sync-group roles (identity and entity) are defined in `./roles.js` and
 // re-exported here so they can also be imported from this module. See
@@ -63,6 +64,7 @@ export const RESERVED_SESSION_SETTINGS = [
     'app.current_sandbox_id',
     'app.current_participant_id',
     'app.current_participant_kind',
+    'app.current_user_id',
 ];
 /**
  * Base fields every synced model gets automatically.
@@ -152,6 +154,24 @@ function assertRoundTrippableCamelCase(modelName, fieldName) {
         }
     }
 }
+/**
+ * One {@link FieldRef} per declared field, keyed by model then field.
+ *
+ * Every construction of a {@link Schema} goes through here — `defineSchema`,
+ * the `selectModels`/`omitModels` projections, and the deserializer — so a
+ * projection carries references for exactly the models it kept and a schema
+ * rebuilt from JSON carries them at all.
+ */
+export function buildFieldRefs(models) {
+    const refs = {};
+    for (const [model, def] of Object.entries(models)) {
+        const perField = {};
+        for (const field of Object.keys(def.shape))
+            perField[field] = fieldRef(model, field);
+        refs[model] = perField;
+    }
+    return refs;
+}
 export function defineSchema(models, options) {
     // Build validators with base fields merged in, and resolve defaults for
     // `typename` and `persist.store` so downstream code (the loader and the
@@ -159,10 +179,10 @@ export function defineSchema(models, options) {
     // them at every call site.
     //
     // Defaults:
-    //   typename      ← schema key (e.g. `slideLayer` → `'slideLayer'`)
+    //   typename      ← schema key (e.g. `block` → `'block'`)
     //   persist.store ← typename (only resolved when `persist` was provided)
     //
-    // A consumer that passes `typename: 'SlideLayer'` explicitly (common when
+    // A consumer that passes `typename: 'Block'` explicitly (common when
     // the wire shape uses PascalCase while the schema key is camelCase) keeps
     // that value — the fallback only fires when the field is unset.
     //
@@ -227,6 +247,7 @@ export function defineSchema(models, options) {
         // already part of ModelDef, so the shape is structurally unchanged.
         models: resolvedModels,
         validators: validators,
+        fields: buildFieldRefs(resolvedModels),
         identityRoles: options?.identityRoles ?? [],
         sessionSettings: options?.sessionSettings ?? {},
     };
@@ -266,7 +287,7 @@ function validateSyncGroupSchema(models) {
     for (const [name, def] of Object.entries(models)) {
         // Shape-validate the `scope` declaration via the shared Zod schema.
         if (def.scope !== undefined && !scopeSchema.safeParse(def.scope).success) {
-            throw new AbloValidationError(`Model "${name}": scope kind "${String(def.scope)}" must be a lowercase identifier (e.g. 'dataroom').`, { code: 'schema_scope_kind_invalid', param: `${name}.scope` });
+            throw new AbloValidationError(`Model "${name}": scope kind "${String(def.scope)}" must be a lowercase identifier (e.g. 'workspace').`, { code: 'schema_scope_kind_invalid', param: `${name}.scope` });
         }
         if (!def.grants)
             continue;

package/dist/{schema → transaction/schema}/tenancy.d.ts

@@ -26,7 +26,7 @@ import { z } from 'zod';
 export declare const DEFAULT_ORG_COLUMN = "organization_id";
 /**
  * Scopes a table's rows through a parent table, for rows that carry no tenancy
- * column of their own (for example, slide layers scoped through their slide, deck,
+ * column of their own (for example, blocks scoped through their section, report,
  * and organization). This is the canonical `parent` payload; authors write the
  * friendlier {@link PolicyInput} `{ by: 'parent', fk, parent }` form, which
  * {@link resolvePolicy} normalizes into this.

package/dist/{schema → transaction/schema}/tenancy.js

@@ -26,7 +26,7 @@ import { z } from 'zod';
 export const DEFAULT_ORG_COLUMN = 'organization_id';
 /**
  * Scopes a table's rows through a parent table, for rows that carry no tenancy
- * column of their own (for example, slide layers scoped through their slide, deck,
+ * column of their own (for example, blocks scoped through their section, report,
  * and organization). This is the canonical `parent` payload; authors write the
  * friendlier {@link PolicyInput} `{ by: 'parent', fk, parent }` form, which
  * {@link resolvePolicy} normalizes into this.
@@ -90,9 +90,9 @@ export const policyInputSchema = z
     by: z.enum(['column', 'parent', 'none', 'source']),
     /** `by: 'column'` — override the physical tenancy column name. Default {@link DEFAULT_ORG_COLUMN}. */
     column: z.string().min(1).optional(),
-    /** `by: 'parent'` — column on this table that points at the parent (for example, `'slideId'`). */
+    /** `by: 'parent'` — column on this table that points at the parent (for example, `'sectionId'`). */
     fk: z.string().min(1).optional(),
-    /** `by: 'parent'` — parent table name (e.g. `'slides'`). */
+    /** `by: 'parent'` — parent table name (e.g. `'sections'`). */
     parent: z.string().min(1).optional(),
     /** `by: 'parent'` — column on the parent that `fk` references. Default `'id'`. */
     parentKey: z.string().min(1).optional(),
@@ -138,7 +138,10 @@ export const policyInputSchema = z
         });
     }
 });
-const _policyInputAssignable = true;
+const _policyInputAssignable = [
+    true,
+    true,
+];
 void _policyInputAssignable;
 /**
  * Normalizes the authoring {@link PolicyInput} into the canonical {@link Tenancy}.

package/dist/transaction/transactionLayer.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The transaction layer's seam — the surface the sync engine (and any other
+ * caller) sits on. ADR 0013's thesis as an interface: the layer defines,
+ * orders, settles, and authorizes changes; it holds no materialised state.
+ *
+ * `observe()` is the whole seam in one method. The sync engine is `observe()`
+ * piped into a materializer — deltas → local store → IndexedDB → reactive
+ * re-render — plus local optimistic mutations reconciled against `commit()` /
+ * `settled()`. Everything reactive is downstream of that method; the
+ * transaction layer never calls up into it.
+ *
+ * `participant` stays the WHO (user | agent | system), never the name of this.
+ * The taught verbs map onto the seam directly: `create`/`update`/`delete` are
+ * operations inside a `commit()` payload; `claim` is `claim()`; `track` rides
+ * the commit payload's `track` field (a durable premise is a zero-operation
+ * commit). Presence (`join`) is deliberately absent: it is live observation
+ * over a socket, and it joins the seam when its core carrier type exists —
+ * see docs/plans/transaction-core-language.md, Tier 3.
+ *
+ * This is the contract, not a runtime: nothing in this package implements it
+ * yet. The first explicit implementation (a headless client, a test harness)
+ * gains a compile-time conformance pin against this interface.
+ */
+import type { CommitMessage } from './wire/frames.js';
+import type { CommitReceiptWire } from './wire/commit.js';
+import type { Delta, HeldClaim, ClaimTarget, ClaimLeaseOptions } from './types/streams.js';
+import type { ModelData } from './types/modelData.js';
+import type { ModelScope } from './types/index.js';
+/**
+ * A commit's durable acceptance — `{ status: 'queued' }` with the correlation
+ * the settlement feed later confirms. The wire layer names this
+ * {@link CommitReceiptWire}; the seam names it plainly.
+ */
+export type CommitReceipt = CommitReceiptWire;
+/**
+ * The seam's read grammar for {@link TransactionLayer.list} — filter, order,
+ * and page through settled rows. Mirrors the taught list options
+ * (`where` / `orderBy` / `limit` / `offset` / `state`) without binding the
+ * seam to the client's local-read machinery.
+ */
+export interface ListQuery {
+    /** Equality filter on field values. */
+    where?: ModelData;
+    /** Sort order, field → direction. */
+    orderBy?: Record<string, 'asc' | 'desc'>;
+    limit?: number;
+    offset?: number;
+    /** Lifecycle filter; defaults to `'live'`. */
+    state?: `${ModelScope}`;
+}
+/**
+ * The transaction layer. Reads return settled state, point-in-time — never a
+ * reactive subscription. A write is an intent submitted through `commit()`;
+ * durable acceptance is the receipt (`queued`), and `settled()` resolves when
+ * the sync log has appended it (`confirmed`).
+ */
+export interface TransactionLayer {
+    /** Authentication: mint or renew the short-lived credential (`ek_`). */
+    ready(): Promise<void>;
+    /** Read one settled row by id, or `null` when absent. */
+    get(model: string, id: string): Promise<ModelData | null>;
+    /** Read settled rows matching a {@link ListQuery}. */
+    list(model: string, query?: ListQuery): Promise<ModelData[]>;
+    /**
+     * Submit a batch of operations — with its idempotent `clientTxId`, its
+     * `reads` premise, and any durable `track` registrations — and receive
+     * durable acceptance.
+     */
+    commit(payload: CommitMessage['payload']): Promise<CommitReceipt>;
+    /** Resolve when the receipt's operations have appended to the sync log. */
+    settled(receipt: CommitReceipt): Promise<void>;
+    /**
+     * Take a FIFO lease with a fence token on a target; release through the
+     * handle (`await using` disposes it).
+     */
+    claim(target: ClaimTarget, options?: ClaimLeaseOptions): Promise<HeldClaim>;
+    /**
+     * The authoritative change feed, scoped to one or more sync groups —
+     * omitted, everything the credential can see.
+     */
+    observe(scope?: string | readonly string[]): AsyncIterable<Delta>;
+}

package/dist/transaction/transactionLayer.js

@@ -0,0 +1,24 @@
+/**
+ * The transaction layer's seam — the surface the sync engine (and any other
+ * caller) sits on. ADR 0013's thesis as an interface: the layer defines,
+ * orders, settles, and authorizes changes; it holds no materialised state.
+ *
+ * `observe()` is the whole seam in one method. The sync engine is `observe()`
+ * piped into a materializer — deltas → local store → IndexedDB → reactive
+ * re-render — plus local optimistic mutations reconciled against `commit()` /
+ * `settled()`. Everything reactive is downstream of that method; the
+ * transaction layer never calls up into it.
+ *
+ * `participant` stays the WHO (user | agent | system), never the name of this.
+ * The taught verbs map onto the seam directly: `create`/`update`/`delete` are
+ * operations inside a `commit()` payload; `claim` is `claim()`; `track` rides
+ * the commit payload's `track` field (a durable premise is a zero-operation
+ * commit). Presence (`join`) is deliberately absent: it is live observation
+ * over a socket, and it joins the seam when its core carrier type exists —
+ * see docs/plans/transaction-core-language.md, Tier 3.
+ *
+ * This is the contract, not a runtime: nothing in this package implements it
+ * yet. The first explicit implementation (a headless client, a test harness)
+ * gains a compile-time conformance pin against this interface.
+ */
+export {};

package/dist/{transactions → transaction/transactions/settlement}/commitEnvelope.d.ts

@@ -91,12 +91,11 @@ export declare const durableCommitEnvelopeSchema: z.ZodObject<{
     }, z.core.$strip>>;
     sourceMutationIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
     commitOptions: z.ZodDefault<z.ZodObject<{
-        causedByTaskId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         reads: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
             model: z.ZodString;
             id: z.ZodString;
             readAt: z.ZodNumber;
-            fields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            fields: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
             onStale: z.ZodOptional<z.ZodEnum<{
                 reject: "reject";
                 overwrite: "overwrite";
@@ -112,8 +111,8 @@ export declare const durableCommitEnvelopeSchema: z.ZodObject<{
             }>>;
         }, z.core.$strip>]>>>>;
         track: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-            model: z.ZodString;
             id: z.ZodString;
+            model: z.ZodString;
             readAt: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>, z.ZodObject<{
             group: z.ZodString;
@@ -137,8 +136,8 @@ export declare function commitEnvelopeRecordId(idempotencyKey: string): string;
 /** Constructs validated member metadata when an in-memory batch is formed. */
 export declare function createCommitEnvelopeMember(value: z.input<typeof commitEnvelopeMemberSchema>): CommitEnvelopeMember;
 /**
- * Freezes the exact JSON request that will be persisted and sent. The JSON
- * round-trip deliberately applies the same Date/undefined semantics as the
- * WebSocket transport before the request fingerprint becomes durable.
+ * Freezes the exact JSON request that will be persisted and sent. The shared
+ * snapshot contract makes framework proxies plain and rejects values that
+ * would be lost or corrupted by JSON serialization.
  */
 export declare function createDurableCommitEnvelope(value: Omit<z.input<typeof durableCommitEnvelopeSchema>, 'id' | 'type' | 'storageVersion' | 'timestamp'>): DurableCommitEnvelope;