@abloatai/ablo 0.34.1 → 0.36.0

package/dist/transactions/{deltaConfirmation.js → mutations/deltaConfirmation.js}

@@ -1,13 +1,13 @@
 /**
  * Tracks whether the confirming delta for a write has arrived. It holds the
- * acknowledgement watermark (through the shared {@link SyncPosition}), the
+ * acknowledgement watermark (through the shared {@link LogPosition}), the
  * per-transaction confirmation timeouts, and the retry-with-backoff and
  * reconciliation policy for transactions in the `awaiting_delta` status. It
- * reaches back to {@link TransactionQueue} only through the small
+ * reaches back to {@link MutationQueue} only through the small
  * {@link DeltaConfirmationContext} interface, not the queue class itself, so it
  * has no cyclic dependency and can be tested on its own.
  */
-import { getContext } from '../context.js';
+import { globalRuntime } from '../../context.js';
 export class DeltaConfirmationTracker {
     ctx;
     // Retry configuration for delta confirmation, using exponential backoff.
@@ -20,8 +20,10 @@ export class DeltaConfirmationTracker {
     deltaConfirmationTimeouts = new Map();
     // Track retry attempts per transaction for exponential backoff
     deltaConfirmationRetries = new Map();
+    runtime;
     constructor(ctx) {
         this.ctx = ctx;
+        this.runtime = ctx.runtime ?? globalRuntime;
     }
     /** Applied-cursor alias, kept so the read sites below stay legible. */
     get lastSeenSyncId() {
@@ -48,7 +50,7 @@ export class DeltaConfirmationTracker {
         const executingTxs = this.ctx.store.getByStatus('executing');
         // Debug: Show state when delta arrives
         if (awaitingTxs.length > 0 || executingTxs.length > 0) {
-            getContext().logger.debug('tx:delta_received', {
+            this.runtime.logger.debug('tx:delta_received', {
                 syncId,
                 lastSeenSyncId: this.lastSeenSyncId,
                 awaitingCount: awaitingTxs.length,
@@ -86,7 +88,7 @@ export class DeltaConfirmationTracker {
                 this.ctx.emit(`transaction:completed:${tx.id}`, tx);
                 this.ctx.optimisticUpdates.delete(tx.id);
                 confirmedCount++;
-                getContext().logger.debug('tx:confirm_via_delta', {
+                this.runtime.logger.debug('tx:confirm_via_delta', {
                     txId: tx.id.slice(0, 8),
                     model: tx.modelName,
                     neededSyncId: tx.syncIdNeededForCompletion,
@@ -98,7 +100,7 @@ export class DeltaConfirmationTracker {
         // Log batch summary only if we confirmed something
         if (confirmedCount > 0) {
             // Leave a breadcrumb when transactions confirm.
-            getContext().observability.breadcrumb('Transactions confirmed via delta', 'sync.transaction', 'info', {
+            this.runtime.observability.breadcrumb('Transactions confirmed via delta', 'sync.transaction', 'info', {
                 count: confirmedCount,
                 syncId,
                 remainingAwaiting: awaitingTxs.length - confirmedCount,
@@ -118,7 +120,7 @@ export class DeltaConfirmationTracker {
         // rejection instead of a catchable synchronous error.
         const timeoutHandle = setTimeout(() => {
             const currentTx = this.ctx.store.get(tx.id);
-            if (!currentTx || currentTx.status !== 'awaiting_delta') {
+            if (currentTx?.status !== 'awaiting_delta') {
                 this.deltaConfirmationRetries.delete(tx.id);
                 return; // Already confirmed or failed
             }
@@ -126,7 +128,7 @@ export class DeltaConfirmationTracker {
             if (!this.ctx.isConnected()) {
                 // Self-healing: re-schedule the confirmation wait while offline, no
                 // consumer action needed → debug.
-                getContext().logger.debug('[TransactionQueue] Timeout fired while disconnected - re-scheduling', {
+                this.runtime.logger.debug('[MutationQueue] Timeout fired while disconnected - re-scheduling', {
                     txId: tx.id.slice(0, 8),
                     model: tx.modelName,
                 });
@@ -135,7 +137,7 @@ export class DeltaConfirmationTracker {
                 return;
             }
             const retryCount = this.deltaConfirmationRetries.get(tx.id) ?? 0;
-            getContext().observability.captureReconciliation({
+            this.runtime.observability.captureReconciliation({
                 reason: 'delta_timeout',
                 model: tx.modelName,
                 modelId: tx.modelId,
@@ -165,7 +167,7 @@ export class DeltaConfirmationTracker {
                 });
                 // Self-healing retry with backoff — the server already committed; we're
                 // just waiting on the delta. No consumer action → debug.
-                getContext().logger.debug('[TransactionQueue] Re-scheduling with backoff', {
+                this.runtime.logger.debug('[MutationQueue] Re-scheduling with backoff', {
                     txId: tx.id.slice(0, 8),
                     model: tx.modelName,
                     nextTimeoutMs: nextTimeout,
@@ -180,7 +182,7 @@ export class DeltaConfirmationTracker {
                 // session, reconnecting and catching up on deltas will confirm it.
                 this.deltaConfirmationRetries.delete(tx.id);
                 this.deltaConfirmationTimeouts.delete(tx.id);
-                getContext().observability.captureDeltaRetryExhausted({
+                this.runtime.observability.captureDeltaRetryExhausted({
                     txId: tx.id,
                     model: tx.modelName,
                     modelId: tx.modelId,
@@ -220,7 +222,7 @@ export class DeltaConfirmationTracker {
     }
     /**
      * Clears every armed confirmation timer, one per in-flight transaction.
-     * {@link TransactionQueue.dispose} calls this; without it a disposed queue
+     * {@link MutationQueue.dispose} calls this; without it a disposed queue
      * would keep the process alive and fire callbacks against a cleared store.
      */
     dispose() {

package/dist/transactions/mutations/durableWriteStore.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The durable-write port moved to the settlement core (ADR 0016): it is a
+ * contract over commit envelopes and holds no local rows. Re-exported here so
+ * the existing `transactions/mutations/durableWriteStore` import path keeps
+ * resolving for the queue, the outbox, and the client options.
+ *
+ * The port and its config live in the core's `durableWrites` module (a behavior
+ * contract, not a persisted shape); the records that cross it are owned by
+ * `transactions/settlement/pendingWrite`.
+ */
+export { durableWriteStoreSchema, durableWritesConfigSchema, } from '../../transaction/durableWrites.js';
+export type { DurableWriteStore, DurableWritesConfig, } from '../../transaction/durableWrites.js';
+export { pendingWriteSchema } from '../../transaction/transactions/settlement/pendingWrite.js';
+export type { PendingWrite } from '../../transaction/transactions/settlement/pendingWrite.js';

package/dist/transactions/mutations/durableWriteStore.js

@@ -0,0 +1,12 @@
+/**
+ * The durable-write port moved to the settlement core (ADR 0016): it is a
+ * contract over commit envelopes and holds no local rows. Re-exported here so
+ * the existing `transactions/mutations/durableWriteStore` import path keeps
+ * resolving for the queue, the outbox, and the client options.
+ *
+ * The port and its config live in the core's `durableWrites` module (a behavior
+ * contract, not a persisted shape); the records that cross it are owned by
+ * `transactions/settlement/pendingWrite`.
+ */
+export { durableWriteStoreSchema, durableWritesConfigSchema, } from '../../transaction/durableWrites.js';
+export { pendingWriteSchema } from '../../transaction/transactions/settlement/pendingWrite.js';

package/dist/transactions/{optimisticApply.d.ts → mutations/optimisticApply.d.ts}

@@ -8,8 +8,8 @@
  * than any larger object, so the rules have no dependencies of their own and
  * can be tested in isolation.
  */
-import type { Model } from '../Model.js';
-import type { MutationInput, Transaction } from './commitPayload.js';
+import type { Model } from '../../Model.js';
+import type { MutationInput, QueuedMutation } from './commitPayload.js';
 /**
  * One tracked optimistic mutation: the live model plus the value it held
  * before the change, kept so a rollback can restore it.
@@ -17,7 +17,7 @@ import type { MutationInput, Transaction } from './commitPayload.js';
 export interface OptimisticUpdateEntry {
     model: Model;
     previousState: MutationInput | null | undefined;
-    transaction: Transaction;
+    transaction: QueuedMutation;
 }
 /**
  * The event emitter these functions use to announce each optimistic change and
@@ -30,20 +30,20 @@ export interface OptimisticEmitter {
  * Record an optimistic create and announce it. There is no prior value to
  * restore, so the rollback pre-image is `null`.
  */
-export declare function applyOptimisticCreate(optimisticUpdates: Map<string, OptimisticUpdateEntry>, emitter: OptimisticEmitter, model: Model, transaction: Transaction): void;
+export declare function applyOptimisticCreate(optimisticUpdates: Map<string, OptimisticUpdateEntry>, emitter: OptimisticEmitter, model: Model, transaction: QueuedMutation): void;
 /**
  * Record an optimistic update and announce it, keeping the row's prior value so
  * a rollback can put it back.
  */
-export declare function applyOptimisticUpdate(optimisticUpdates: Map<string, OptimisticUpdateEntry>, emitter: OptimisticEmitter, model: Model, transaction: Transaction): void;
+export declare function applyOptimisticUpdate(optimisticUpdates: Map<string, OptimisticUpdateEntry>, emitter: OptimisticEmitter, model: Model, transaction: QueuedMutation): void;
 /**
  * Record an optimistic delete and announce it, keeping the deleted row so a
  * rollback can restore it.
  */
-export declare function applyOptimisticDelete(optimisticUpdates: Map<string, OptimisticUpdateEntry>, emitter: OptimisticEmitter, model: Model, transaction: Transaction): void;
+export declare function applyOptimisticDelete(optimisticUpdates: Map<string, OptimisticUpdateEntry>, emitter: OptimisticEmitter, model: Model, transaction: QueuedMutation): void;
 /**
  * Undo an optimistic mutation by its transaction id: emit `optimistic:rollback`
  * with the saved pre-image so listeners can restore the prior value, then drop
  * the ledger entry. Does nothing if the transaction was never tracked.
  */
-export declare function rollbackOptimistic(optimisticUpdates: Map<string, OptimisticUpdateEntry>, emitter: OptimisticEmitter, transaction: Transaction, reason?: string, error?: Error): Promise<void>;
+export declare function rollbackOptimistic(optimisticUpdates: Map<string, OptimisticUpdateEntry>, emitter: OptimisticEmitter, transaction: QueuedMutation, reason?: string, error?: Error): Promise<void>;

package/dist/transactions/{replayValidation.d.ts → mutations/replayValidation.d.ts}

@@ -15,7 +15,8 @@
  * quietly rather than flagged as corruption.
  */
 import { z } from 'zod';
-import type { Transaction } from './commitPayload.js';
+import type { QueuedMutation } from './commitPayload.js';
+import type { RuntimeContext } from '../../RuntimeContext.js';
 /**
  * The shape of a persisted transaction that can be replayed: the fields the
  * transaction queue reads when it re-enqueues the row — its id, operation type,
@@ -73,12 +74,12 @@ export type PersistedReplayableTransaction = z.infer<typeof persistedTransaction
  */
 export declare function isNonReplayablePersistedRow(row: unknown): boolean;
 /**
- * Validates one stored row and rehydrates it into a {@link Transaction} ready
+ * Validates one stored row and rehydrates it into a {@link QueuedMutation} ready
  * to replay, or returns `null` when the row fails validation. Bookkeeping
  * fields the stored row lacks — status, attempts, priority, timestamp — are
  * re-derived the same way a freshly staged transaction derives them.
  */
-export declare function deserializePersistedTransaction(row: unknown): Transaction | null;
+export declare function deserializePersistedTransaction(row: unknown, runtime?: RuntimeContext): QueuedMutation | null;
 /**
  * The shape of one entry in the persisted offline mutation queue — an item of
  * the `'queue'` row's `mutations` array, carrying the fields read when the

package/dist/transactions/{replayValidation.js → mutations/replayValidation.js}

@@ -16,12 +16,14 @@
  */
 import { z } from 'zod';
 import { computePriorityScore, normalizeModelKey } from './commitPayload.js';
-import { commitEnvelopeMemberSchema, commitOutboxScopeSchema, } from './commitEnvelope.js';
+import { globalRuntime } from '../../context.js';
+import { commitEnvelopeMemberSchema, commitOutboxScopeSchema, } from '../../transaction/transactions/settlement/commitEnvelope.js';
+import { onStaleModeSchema } from '../../transaction/coordination/schema.js';
 /** The subset of a write's options that is stored with each transaction or queued mutation. */
 const persistedWriteOptionsSchema = z
     .object({
     readAt: z.number().nullable().optional(),
-    onStale: z.enum(['reject', 'overwrite', 'notify']).nullable().optional(),
+    onStale: onStaleModeSchema.nullable().optional(),
     idempotencyKey: z.string().optional(),
     label: z.string().optional(),
     // Aligned with the `WriteOptions` type: a claimed write persisted offline
@@ -81,12 +83,12 @@ export function isNonReplayablePersistedRow(row) {
         NON_REPLAYABLE_TYPES.has(row.type));
 }
 /**
- * Validates one stored row and rehydrates it into a {@link Transaction} ready
+ * Validates one stored row and rehydrates it into a {@link QueuedMutation} ready
  * to replay, or returns `null` when the row fails validation. Bookkeeping
  * fields the stored row lacks — status, attempts, priority, timestamp — are
  * re-derived the same way a freshly staged transaction derives them.
  */
-export function deserializePersistedTransaction(row) {
+export function deserializePersistedTransaction(row, runtime = globalRuntime) {
     const parsed = persistedTransactionSchema.safeParse(row);
     if (!parsed.success)
         return null;
@@ -104,7 +106,7 @@ export function deserializePersistedTransaction(row) {
         createdAt: tx.createdAt ?? Date.now(),
         attempts: 0,
         priority: 'normal',
-        priorityScore: computePriorityScore(tx.type, tx.modelName),
+        priorityScore: computePriorityScore(tx.type, tx.modelName, runtime),
         ...(tx.batchId !== undefined ? { batchId: tx.batchId } : {}),
         ...(tx.commitEnvelope !== undefined
             ? { commitEnvelope: tx.commitEnvelope }

package/dist/utils/mobxSetup.d.ts

@@ -5,7 +5,7 @@
  * each field, leaving any hand-written getter or setter in place.
  */
 import { type AnnotationMapEntry } from 'mobx';
-import { type PropertyMetadata, type ReferenceMetadata } from '../types/index.js';
+import { type PropertyMetadata, type ReferenceMetadata } from '../transaction/types/index.js';
 /**
  * The subset of a model instance that {@link M1} reads and writes. A model calls
  * {@link M1} from its constructor, where these members exist on `this`;

package/dist/utils/mobxSetup.js

@@ -5,7 +5,7 @@
  * each field, leaving any hand-written getter or setter in place.
  */
 import { observable, makeObservable, action, computed, observe, } from 'mobx';
-import { PropertyType } from '../types/index.js';
+import { PropertyType } from '../transaction/types/index.js';
 import { getContext } from '../context.js';
 /**
  * Makes a model instance's schema-defined properties observable with MobX. For
@@ -140,7 +140,10 @@ export function M1(target, propertyMetadata, referenceMetadata) {
         annotations.updatedAt = observable;
     }
     if (!hasGetter('modifiedProperties') && !hasSetter('modifiedProperties')) {
-        annotations.modifiedProperties = observable;
+        // Track map membership, but keep change payloads as plain values. These
+        // entries are replaced rather than mutated and later cross IndexedDB's
+        // structured-clone boundary, where MobX's deep proxies are invalid.
+        annotations.modifiedProperties = observable.shallow;
     }
     // Add actions only if methods exist and aren't already actions.
     // `Reflect.get` keeps the read typed without an index-signature

package/dist/{core → views}/QueryView.d.ts

@@ -10,9 +10,9 @@
  */
 import { type IObservableArray } from 'mobx';
 import { type Model } from '../Model.js';
-import { ModelScope } from '../types/index.js';
+import { ModelScope } from '../transaction/types/index.js';
 import type { ViewRegistry } from './ViewRegistry.js';
-import type { IncrementalView } from './queryUtils.js';
+import type { IncrementalView } from './incrementalView.js';
 /**
  * The slice of the object pool that a {@link QueryView} reads. It is a minimal
  * structural interface rather than the concrete pool class, which lets a query

package/dist/{core → views}/QueryView.js

@@ -10,8 +10,8 @@
  */
 import { observable, runInAction } from 'mobx';
 import { modelAsRow } from '../Model.js';
-import { ModelScope } from '../types/index.js';
-import { compareValues, binaryInsertionIndex, findIndexById, } from './queryUtils.js';
+import { ModelScope } from '../transaction/types/index.js';
+import { compareValues, binaryInsertionIndex, findIndexById, } from './incrementalView.js';
 // ---------------------------------------------------------------------------
 // QueryView
 // ---------------------------------------------------------------------------

package/dist/{core → views}/ViewRegistry.d.ts

@@ -6,7 +6,7 @@
  * QueryView subscribed to that typename.
  */
 import { type Model } from '../Model.js';
-import type { IncrementalView } from './queryUtils.js';
+import type { IncrementalView } from './incrementalView.js';
 export declare class ViewRegistry {
     private views;
     register(typename: string, view: IncrementalView): void;

package/dist/{core/queryUtils.d.ts → views/incrementalView.d.ts}

@@ -1,10 +1,10 @@
 /**
- * Small, self-contained helpers for sorting, filtering, and binary insertion.
- * The incrementally-updated views that implement {@link IncrementalView} rely on
- * these for their ordering and matching, so keeping the rules in one place
- * ensures every view sorts and filters identically. The functions here work on
- * plain arrays and values — they hold no reference to models, pools, or the
- * reactivity system.
+ * The {@link IncrementalView} contract — the interface a live view implements
+ * to receive add/update/remove notifications — together with the sorting,
+ * matching, and binary-insertion rules every view shares. Keeping the rules in
+ * one place ensures every view sorts and filters identically. The functions
+ * here work on plain arrays and values — they hold no reference to models,
+ * pools, or the reactivity system.
  */
 /**
  * The interface a live view implements to receive incremental updates: one call

package/dist/{core/queryUtils.js → views/incrementalView.js}

@@ -1,10 +1,10 @@
 /**
- * Small, self-contained helpers for sorting, filtering, and binary insertion.
- * The incrementally-updated views that implement {@link IncrementalView} rely on
- * these for their ordering and matching, so keeping the rules in one place
- * ensures every view sorts and filters identically. The functions here work on
- * plain arrays and values — they hold no reference to models, pools, or the
- * reactivity system.
+ * The {@link IncrementalView} contract — the interface a live view implements
+ * to receive add/update/remove notifications — together with the sorting,
+ * matching, and binary-insertion rules every view shares. Keeping the rules in
+ * one place ensures every view sorts and filters identically. The functions
+ * here work on plain arrays and values — they hold no reference to models,
+ * pools, or the reactivity system.
  */
 /**
  * Compares two values for sorting, tolerating `null` and `undefined`, which

package/dist/webhooks/events.d.ts

@@ -7,10 +7,10 @@ export interface AbloWebhookEvent {
     /** A stable, unique event identifier equal to `String(syncId)`. Use it to
      *  deduplicate deliveries. */
     readonly id: string;
-    /** The event type, formatted as `<model>.<verb>`, such as `"slide.updated"`.
+    /** The event type, formatted as `<model>.<verb>`, such as `"report.updated"`.
      *  Branch on this to route the event. */
     readonly type: string;
-    /** The name of the model whose row changed, such as `"Slide"`. */
+    /** The name of the model whose row changed, such as `"Report"`. */
     readonly model: string;
     /** The identifier of the row that changed. */
     readonly objectId: string;

package/dist/wire/index.d.ts

@@ -1,34 +1 @@
-/**
- * The wire contract for the sync protocol: the HTTP envelope shapes and the
- * write-path frames, with no dependency on the client runtime. A server — a
- * route handler, an edge function — can import the envelope producers here
- * without pulling in the full sync client.
- *
- * It has two halves, used across every endpoint:
- *   - Error responses — {@link errorEnvelope}, {@link ErrorEnvelope}, and
- *     {@link statusForType} turn any thrown value into the uniform
- *     `{ type, code, param, message, doc_url, request_id }` body.
- *   - List responses — {@link listEnvelope} and {@link ListEnvelope} stamp the
- *     uniform `{ object: 'list', data, has_more, next_cursor }` collection.
- *
- * The {@link AbloError} hierarchy, {@link docUrlForCode}, and the wire-parsing
- * helpers are re-exported too, so a single import lets a route throw the right
- * typed error and serialize it back out.
- */
-export { errorEnvelope, statusForType } from './errorEnvelope.js';
-export type { ErrorEnvelope } from './errorEnvelope.js';
-export { listEnvelope } from './listEnvelope.js';
-export type { ListEnvelope } from './listEnvelope.js';
-export { bootstrapReasonSchema } from './bootstrapReason.js';
-export type { BootstrapReason } from './bootstrapReason.js';
-export { commitOperationSchema, commitPayloadSchema, } from './frames.js';
-export { PROTOCOL_VERSION, MIN_SUPPORTED_PROTOCOL_VERSION, DEFAULT_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, WS_CLOSE_PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER, protocolVersionProblem, resolveProtocolVersion, } from './protocolVersion.js';
-export type { SupportedProtocolVersion, ProtocolVersionProblem, } from './protocolVersion.js';
-export type { CommitOperation, CommitMessage, MutationResultMessage, } from './frames.js';
-export { COMMIT_CORRELATION_ID_MAX_LENGTH, correlationIdSchema, commitStatusSchema, commitSettlementSchema, commitReceiptSchema, legacyCompatibleCommitReceiptSchema, rejectedCommitReceiptSchema, mutationResultPayloadSchema, mutationResultMessageSchema, commitAckSchema, mutationCommitResultSchema, } from './commit.js';
-export type { CorrelationId, CommitStatus, CommitSettlement, CommitReceiptWire, RejectedCommitReceiptWire, MutationResultPayload, MutationResultMessageWire, CommitAck, MutationCommitResultInput, MutationCommitResult, } from './commit.js';
-export { participantKindSchema, confirmationStateSchema, syncDeltaActionSchema, wireDeltaDataSchema, participantRefSchema, syncDeltaWireCoreSchema, clientSyncDeltaSchema, serverSyncDeltaSchema, } from './delta.js';
-export type { ParticipantKind, ConfirmationState, SyncDeltaAction, WireDeltaData, ParticipantRef, SyncDeltaWireCore, ClientSyncDelta, ServerSyncDelta, } from './delta.js';
-export { AbloError, AbloAuthenticationError, AbloPermissionError, AbloValidationError, AbloRateLimitError, AbloIdempotencyError, AbloConnectionError, AbloServerError, AbloStaleContextError, AbloClaimedError, CapabilityError, SyncSessionError, docUrlForCode, translateHttpError, errorFromWire, toAbloError, ERROR_CONTRACT_VERSION, errorCodeSpec, } from '../errors.js';
-export type { ErrorCode, WireErrorCode } from '../errors.js';
-export { PING_INTERVAL_MS, LEASE_TTL_MS, WS_BEARER_SUBPROTOCOL_PREFIX, WS_SYNC_SUBPROTOCOL, } from './protocol.js';
+export * from '../transaction/wire/index.js';

package/dist/wire/index.js

@@ -1,49 +1,8 @@
-/**
- * The wire contract for the sync protocol: the HTTP envelope shapes and the
- * write-path frames, with no dependency on the client runtime. A server — a
- * route handler, an edge function — can import the envelope producers here
- * without pulling in the full sync client.
- *
- * It has two halves, used across every endpoint:
- *   - Error responses — {@link errorEnvelope}, {@link ErrorEnvelope}, and
- *     {@link statusForType} turn any thrown value into the uniform
- *     `{ type, code, param, message, doc_url, request_id }` body.
- *   - List responses — {@link listEnvelope} and {@link ListEnvelope} stamp the
- *     uniform `{ object: 'list', data, has_more, next_cursor }` collection.
- *
- * The {@link AbloError} hierarchy, {@link docUrlForCode}, and the wire-parsing
- * helpers are re-exported too, so a single import lets a route throw the right
- * typed error and serialize it back out.
- */
-export { errorEnvelope, statusForType } from './errorEnvelope.js';
-export { listEnvelope } from './listEnvelope.js';
-export { bootstrapReasonSchema } from './bootstrapReason.js';
-// The write-path frame contract: the message shapes shared by the client and
-// the server. The runtime Zod validators sit beside the interfaces and are
-// pinned to them, and they gate every operation and payload on both commit
-// transports.
-export { commitOperationSchema, commitPayloadSchema, } from './frames.js';
-// Protocol versioning: the single integer the client and server compare to
-// confirm they can speak to each other, plus the WebSocket close code used to
-// reject a mismatch. See protocolVersion.ts for the changelog and deploy rules.
-export { PROTOCOL_VERSION, MIN_SUPPORTED_PROTOCOL_VERSION, DEFAULT_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, WS_CLOSE_PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER, protocolVersionProblem, resolveProtocolVersion, } from './protocolVersion.js';
-// Commit settlement backbone. The transport receipt, server execution cache,
-// and normalized client acknowledgement are different envelopes composed from
-// this one discriminated settlement vocabulary.
-export { COMMIT_CORRELATION_ID_MAX_LENGTH, correlationIdSchema, commitStatusSchema, commitSettlementSchema, commitReceiptSchema, legacyCompatibleCommitReceiptSchema, rejectedCommitReceiptSchema, mutationResultPayloadSchema, mutationResultMessageSchema, commitAckSchema, mutationCommitResultSchema, } from './commit.js';
-// The read-path delta contract: the shape the server broadcasts to clients as the
-// payload of a `delta` or `sync_response` frame, together with the shared
-// participant vocabulary it carries. Both ends derive their delta type from these
-// schemas, so the client and server cannot drift apart.
-export { participantKindSchema, confirmationStateSchema, syncDeltaActionSchema, wireDeltaDataSchema, participantRefSchema, syncDeltaWireCoreSchema, clientSyncDeltaSchema, serverSyncDeltaSchema, } from './delta.js';
-// The error surface a wire consumer needs to throw, classify, and serialize.
-export { AbloError, AbloAuthenticationError, AbloPermissionError, AbloValidationError, AbloRateLimitError, AbloIdempotencyError, AbloConnectionError, AbloServerError, AbloStaleContextError, AbloClaimedError, CapabilityError, SyncSessionError, docUrlForCode, translateHttpError, errorFromWire, toAbloError, ERROR_CONTRACT_VERSION, 
-// The table mapping each error code to its HTTP status and retryable flag —
-// plain data a server can use to resolve a code's canonical status the same
-// way the client's error serializer does.
-errorCodeSpec, } from '../errors.js';
-// Protocol timing constants — the 30-second ping cadence and the lease window
-// derived from it, shared by the client heartbeat and the server keepalive,
-// claim leasing, and presence expiry (see protocol.ts) — plus the WebSocket
-// subprotocols used during the authenticated handshake.
-export { PING_INTERVAL_MS, LEASE_TTL_MS, WS_BEARER_SUBPROTOCOL_PREFIX, WS_SYNC_SUBPROTOCOL, } from './protocol.js';
+// Moved to @ablo/transaction (ADR 0013 — the settlement core extraction).
+// This shim re-exports it at the original path so in-package importers of
+// `wire/index.js` keep working; rewire to `@ablo/transaction/wire`
+// and delete this shim once the core package is fully wired.
+//
+// Line comments on purpose: tsc copies a leading JSDoc block into the
+// published `.d.ts`, and this note names a package npm has never heard of.
+export * from '../transaction/wire/index.js';

package/docs/agent-messaging.md

@@ -1,5 +1,7 @@
 # Agent Messaging
 
+> Durable handoffs between agents, linked to the claim they are about.
+
 Use a normal model when agents or humans need durable communication inside a
 syncGroup. Use claim `description` and `meta` for live coordination context.
 Use a `messages` row when the information must survive reconnects, work over
@@ -32,7 +34,6 @@ export const schema = defineSchema({
       status: z.string(),
       teamId: z.string(),
     },
-    {},
     { entityRoles: [entityRole({ kind: "team", source: "teamId" })] },
   ),
 
@@ -47,7 +48,6 @@ export const schema = defineSchema({
       aboutEntityId: z.string().optional(),
       aboutIntentId: z.string().optional(),
     },
-    {},
     { entityRoles: [entityRole({ kind: "team", source: "teamId" })] },
   ),
 });
@@ -121,7 +121,7 @@ Peers outside that syncGroup do not.
 Live clients read locally and update when deltas arrive:
 
 ```ts
-const rows = ablo.messages.getAll({
+const rows = ablo.messages.local.list({
   where: { teamId },
   orderBy: { createdAt: "asc" },
 });

package/docs/agents.md

@@ -1,14 +1,17 @@
 # Agents
 
+> The stateless participant: wake on a trigger, read, claim, commit, go idle.
+
 An agent is a **reactive** participant: it wakes on something happening, reads
 what it needs, writes a result, and goes idle. That's a request/response
 workload — so agents talk to Ablo over **plain HTTP**, holding no WebSocket. The
 credential *is* the identity; the server resolves the org, scope, and actor from
 the key on every request (the Stripe server-SDK / Liveblocks-node shape).
 
-Humans get the live plane (WebSocket: presence, optimistic, sub-100ms). Agents
-get the stateless plane (HTTP). **Both operate on the same typed, coordinated
-state — and coordinate *with each other*.**
+Agents get the stateless plane (HTTP). People — when you add the `humans()`
+plugin — get the live plane (WebSocket: presence, optimistic, sub-100ms).
+**Both operate on the same typed, coordinated state — and coordinate *with each
+other*.**
 
 <Note>
 Agents transact against your **pushed schema**, same as everyone — `ablo.tasks`
@@ -40,11 +43,11 @@ await ablo.tasks.update({ id: task.id, data: { status: "done" } });
 
 It exposes `retrieve` / `list` / `create` / `update` / `delete`, plus `commits`
 and `claim`. It does **not** expose the stateful-only surface (`get` /
-`getAll` / `getCount` local reads, `onChange` live subscription) — those need a
+`local` reads, `onChange` live subscription) — those need a
 live connection, so with `transport: 'http'` the return type narrows and they
 are a *compile error*, not a runtime surprise.
 
-## Coordination — claim, queue, reorder
+## Coordination: claim, queue, reorder
 
 The differentiator. A claim is a **durable lease + FIFO wait-line** on a row —
 "who's working on this, who's waiting" — and it's request/response, so an agent
@@ -77,14 +80,18 @@ a message back to the claim it discusses.
 
 See [Agent Messaging](/agent-messaging) for the schema and setup details.
 
-## Humans + agents on one state
+## When a person is in the loop
+
+There's no separate "agent mode" — and no separate human mode either. The bare
+client is the coordination layer; `humans()` is the plugin that adds the live
+plane on top of it. An agent acting over HTTP and a person editing over their
+socket share the same typed state and the same coordination: the agent can claim
+the row that person is holding (and wait in line), and they see the agent's
+committed changes stream in **live** over their own socket, even though the
+agent committed over HTTP.
 
-There's no separate "agent mode." A human editing a record over their WebSocket
-and an agent acting over HTTP share the same typed state and the same coordination
-plane: the agent can claim the row a human is editing (and wait in line), and the
-human sees the agent's committed changes stream in **live** — over the human's
-own socket, even though the agent committed over HTTP. You write the agent once;
-it's a first-class participant, not a bolt-on.
+There is no `agents()` plugin, and the absence is the point — an agent is the
+default caller here, not a bolt-on.
 
 ## How an agent runs
 
@@ -101,7 +108,7 @@ agents costs nothing on the live plane — that capacity stays for humans.
 
 ## What stays on the live (human) plane
 
-`onChange` (live subscriptions) and `get`/`getAll`/`getCount` (local synced-pool
+`onChange` (live subscriptions) and the `local` reads (local synced-pool
 reads) require a WebSocket and a local store — they're for interactive UIs, not
 stateless agents. An agent reacts to an external trigger (a job/queue/webhook),
 then reads with `list`/`retrieve`. See [client behavior](/client-behavior) for

package/docs/api-keys.md

@@ -1,5 +1,7 @@
 # API Keys
 
+> The credential that carries an agent's identity and bounds what it may write.
+
 Authenticate a server-side client — a route handler, worker, or CLI — by passing an API key when you create the client.
 
 ```ts
@@ -19,9 +21,9 @@ Pick your row:
 
 | Where your code runs | What to pass | Example |
 |---|---|---|
-| **Server / worker / CLI** (can hold a secret) | your secret `sk_` — it defaults to `ABLO_API_KEY`, so usually pass **nothing** | `Ablo({ schema })` |
-| **Browser — read-only** | a publishable `pk_` (safe to ship, like a Stripe `pk_`) | `Ablo({ schema, apiKey: process.env.NEXT_PUBLIC_ABLO_PUBLISHABLE_KEY })` |
-| **Browser — writing as the signed-in user** | `authEndpoint` — the route on your own backend that mints a short-lived per-user token | `Ablo({ schema, authEndpoint: '/api/ablo-session' })` |
+| **Server / worker / CLI** (can hold a secret) | your secret `sk_`: it defaults to `ABLO_API_KEY`, so usually pass **nothing** | `Ablo({ schema })` |
+| **Browser: read-only** | a publishable `pk_` (safe to ship, like a Stripe `pk_`) | `Ablo({ schema, apiKey: process.env.NEXT_PUBLIC_ABLO_PUBLISHABLE_KEY })` |
+| **Browser: writing as the signed-in user** | `authEndpoint`: the route on your own backend that mints a short-lived per-user token | `Ablo({ schema, authEndpoint: '/api/ablo-session' })` |
 
 That's the whole story: one knob, filled by audience.
 
@@ -29,8 +31,8 @@ That's the whole story: one knob, filled by audience.
 
 | Stripe | Ablo | Where it goes |
 |---|---|---|
-| publishable `pk_` (client-safe) | `pk_` | browser — read-only |
-| secret `sk_` (server, full) | `sk_` | server — full authority |
+| publishable `pk_` (client-safe) | `pk_` | browser: read-only |
+| secret `sk_` (server, full) | `sk_` | server: full authority |
 | restricted `rk_` (granular) | `rk_` | scoped agent sessions (`sessions.create({ agent, can })`) |
 | ephemeral key (client, customer-scoped) | `ek_` | per-user browser sessions (`sessions.create({ user })`) |
 
@@ -72,7 +74,7 @@ Use API keys from trusted (server-side) runtimes:
 
 Never ship a secret API key to a browser bundle.
 
-## Publishable key (`pk_`) — browser-safe, read-only
+## Publishable key (`pk_`): browser-safe, read-only
 
 For a read-only browser experience, a publishable key is safe to ship in the
 bundle. Like a Stripe `pk_` or a Supabase anon key, it is long-lived,
@@ -97,10 +99,12 @@ Test and live keys are the same shape; the prefix names the environment:
 - `sk_live_…` — a key against your live data.
 
 Every org has a default sandbox, plus any number of additional
-sandboxes you create. **Data is isolated per sandbox; the schema is shared
-across the whole org.** A schema you push from a test key defines the same
-models your live keys see — only the rows differ. This mirrors how Stripe
-separates sandbox and production data while keeping the API shape identical.
+sandboxes you create. **Data is isolated per sandbox; the schema is one
+definition serving both.** A sandbox reads the production schema until it is
+pushed one of its own, so your test and live keys see the same models and only
+the rows differ — how Stripe separates sandbox and production data while keeping
+the API shape identical. A schema change reaches production when you push it
+with a live key ([Deployment](./deployment.md)).
 
 ## Scopes