@abloatai/ablo 0.35.0 → 0.36.0

package/dist/transaction/coordination/targetConflict.js

@@ -37,10 +37,28 @@
  * lowercased them.
  */
 function fieldSet(target) {
-    const names = [
+    const named = [
         ...(target?.field !== undefined ? [target.field] : []),
         ...(target?.fields ?? []),
     ];
+    // A path names a part too: `/content/3` addresses a position inside the
+    // `content` field, so a claim on it covers that field and nothing else.
+    //
+    // Deriving it here is what stops a path from reading as EVERY field. A
+    // target that named no field left this set empty, and an empty set means
+    // "all of them" — so a claim on one paragraph blocked a write to `status`
+    // on the same row. It also makes the exclusion honest in the other
+    // direction: a write of the whole `content` field does conflict with a
+    // claim on part of it, because nothing can write only that part.
+    //
+    // Only when no field was named outright — an explicit `field`/`fields`
+    // beside a path is the caller being specific, and is not second-guessed.
+    // A bare `range` derives nothing: it names a span without saying of what,
+    // so it stays the conservative whole-row answer.
+    const rootOfPath = named.length === 0 && target?.path !== undefined
+        ? target.path.split('/').filter(Boolean)[0]
+        : undefined;
+    const names = rootOfPath !== undefined ? [...named, rootOfPath] : named;
     return new Set(names.map((n) => n.toLowerCase()));
 }
 /** Whether a claim narrows below the whole entity at all. */
@@ -50,30 +68,6 @@ function hasSubtarget(target) {
         (target?.fields && target.fields.length > 0) ||
         target?.range);
 }
-function lower(value) {
-    return value?.toLowerCase();
-}
-/**
- * Whether two paths address overlapping parts of a document.
- *
- * Paths are hierarchical, so equality is the wrong test: `/content` contains
- * `/content/3`, and a writer holding the parent is holding the child too.
- * Comparing them as opaque strings reported no conflict and granted both
- * leases — the parent's writer and the child's writer would then both write,
- * and one update would vanish with nothing raised anywhere.
- *
- * Containment is checked on a separator boundary so `/content` contains
- * `/content/3` but not `/contentious`, which is the same trap as any
- * prefix match over structured names.
- */
-function pathsOverlap(a, b) {
-    const x = lower(a) ?? '';
-    const y = lower(b) ?? '';
-    if (x === y)
-        return true;
-    const contains = (parent, child) => child.startsWith(parent.endsWith('/') ? parent : `${parent}/`);
-    return contains(x, y) || contains(y, x);
-}
 function rangesOverlap(a, b) {
     // Line-level overlap is the stable default. Columns can be layered
     // in by policy later, but line ranges are what code/editor agents
@@ -85,9 +79,19 @@ export function targetsConflict(held, incoming) {
     // narrower path/field/range claim under the same entity.
     if (!hasSubtarget(held) || !hasSubtarget(incoming))
         return true;
-    if (held.path && incoming?.path && !pathsOverlap(held.path, incoming.path)) {
-        return false;
-    }
+    // A claim is only as fine as the smallest thing the write path can address,
+    // and today that is a field: nothing writes part of a value. So two paths
+    // into the SAME field contend, and this rule used to grant them both — by
+    // comparing paths for containment and answering "disjoint" for `/content/3`
+    // against `/content/7`. Both holders were then blocked at their first write,
+    // each by the other, which is a wait dressed as concurrency and resolves
+    // only when someone releases.
+    //
+    // Both are answered below instead, through the field a path names: same
+    // field, conflict; different fields, disjoint. Path containment returns when
+    // a field can declare a smaller write unit than its whole value — an
+    // operation rather than a value — because that is what makes two positions
+    // inside one field separately writable and the disjointness real.
     // A claim that names no field covers every field, so it conflicts with any
     // claim under the same path. Two that both name fields conflict only where
     // their sets intersect.

package/dist/transaction/errorCodes.d.ts

@@ -37,7 +37,7 @@ import { z } from 'zod';
  * error documentation and returned on the `Ablo-Version` response header, so a
  * consumer can detect when its expected contract has drifted from the server's.
  */
-export declare const ERROR_CONTRACT_VERSION = "2026-07-21";
+export declare const ERROR_CONTRACT_VERSION = "2026-07-23";
 /** A coarse grouping of error codes, used to organize metrics and documentation. */
 export type ErrorCategory = 'auth' | 'permission' | 'capability' | 'claim' | 'conflict' | 'validation' | 'not_found' | 'tenant' | 'schema' | 'bootstrap' | 'transport' | 'rate_limit' | 'server' | 'client';
 /**
@@ -227,7 +227,6 @@ export declare const ERROR_CODES: {
     readonly claim_not_wired: ErrorCodeSpec;
     readonly claim_queued: ErrorCodeSpec;
     readonly claim_wait_aborted: ErrorCodeSpec;
-    readonly claim_wait_poll_interval_required: ErrorCodeSpec;
     readonly grant_timeout: ErrorCodeSpec;
     readonly bootstrap_fetch_timeout: ErrorCodeSpec;
     readonly bootstrap_cancelled: ErrorCodeSpec;
@@ -360,6 +359,7 @@ export declare const ERROR_CODES: {
     readonly request_too_large: ErrorCodeSpec;
     readonly invalid_schema: ErrorCodeSpec;
     readonly incompatible_change: ErrorCodeSpec;
+    readonly replication_reset_required: ErrorCodeSpec;
 };
 /**
  * The type of a valid error code: any key registered in {@link ERROR_CODES},

package/dist/transaction/errorCodes.js

@@ -37,7 +37,7 @@ import { z } from 'zod';
  * error documentation and returned on the `Ablo-Version` response header, so a
  * consumer can detect when its expected contract has drifted from the server's.
  */
-export const ERROR_CONTRACT_VERSION = '2026-07-21';
+export const ERROR_CONTRACT_VERSION = '2026-07-23';
 /**
  * A closed classification of how a failure can be recovered from — a level above
  * the raw {@link ErrorCode}. Where a code says what went wrong, a recovery class
@@ -150,15 +150,19 @@ export const ERROR_CODES = {
     // only loop. Recovery belongs to the caller: take a claim, which queues fairly
     // behind the holder (`ablo.<model>.claim`), or re-read and rebase.
     claim_conflict: wire('claim', 409, false, 'Another participant holds a claim on this row, so the write was rejected. Take a claim with `ablo.<model>.claim` to queue fairly behind the holder, or re-read and rebase.'),
-    claim_lost: wire('claim', 409, false, 'The claim held on this row was lost before the write could apply. Re-acquire the claim and retry.'),
+    claim_lost: wire('claim', 409, false, 'The claim held on this row was lost before the write could apply. Re-acquire with `ablo.<model>.claim` and retry from its fresh snapshot.'),
     fence_token_stale: wire('claim', 409, false, 'This write carried a fencing token below the row’s current high-water: a later holder claimed the row, wrote, and moved on while this claim was lapsed, so applying the write would silently overwrite their work. The claim is gone — re-claim the row and retry from the current state.'),
     entity_claimed: wire('claim', 409, false, 'This row is currently claimed by another participant, so the write was blocked. Queue behind the holder with `ablo.<model>.claim`, or wait for the claim to clear.'),
     // A claim payload that cannot be parsed is a malformed request, not
     // contention — it is filed with `malformed_subscription` below rather than
     // with the 409s above, so the claim category stays purely about a target
     // being held. This is the code for a claim that fails to name its target,
-    // over either transport.
-    malformed_claim: wire('validation', 400, false, 'The claim payload could not be parsed. A claim must name the model and the entity it targets; check the payload shape and resend.'),
+    // over either transport — and for the participant claim behind `join`, which
+    // names scopes rather than a row but fails the same way and to the same
+    // caller. The copy covers both because the caller sees one word, `claim`, and
+    // needs to be told which shape was expected without being handed a lecture on
+    // the two frames.
+    malformed_claim: wire('validation', 400, false, 'The claim payload could not be parsed. A claim on a row must name the model and the entity it targets; a claim on a scope, which is what `join` opens, must name sync groups spelled `kind:id` or `default`. Check the payload shape and resend.'),
     malformed_subscription: wire('validation', 400, false, 'The `update_subscription` payload was malformed; expected `{ syncGroups: string[] }`.'),
     // The counterpart to the two above, pointing the other way: those are a
     // client sending the server something it cannot read, this is the server
@@ -177,7 +181,7 @@ export const ERROR_CODES = {
     // `readAt`, so resending the identical payload can never succeed. Recovery
     // is a caller-level re-read that produces a NEW request with a fresh
     // watermark — the same shape as `claim_conflict`.
-    stale_context: wire('conflict', 409, false, "The row changed after you read it — the write's `readAt` watermark is older than the current row version. Re-read the row and retry."),
+    stale_context: wire('conflict', 409, false, "The row changed after you read it — the write's `readAt` watermark is older than the current row version. Pass a function to `update(id, current => next)` and the SDK re-reads and retries for you; or re-read and retry by hand."),
     // Raised by the functional `update(id, current => next)` form once its
     // internal reconcile budget is exhausted, because the row stayed continuously
     // contended. The SDK has already retried; the caller decides whether to back
@@ -261,10 +265,9 @@ export const ERROR_CODES = {
     // ── claim / lease (409 / transport) ───────────────────────────────
     claim_lease_unavailable: wire('claim', 503, true, 'The claim-lease coordination subsystem is temporarily unavailable, so the claim could not be processed. Retry shortly.'),
     claim_not_wired: client('claim', 'Claims were used, but this runtime has no claim support wired in. The standard `Ablo({ schema, apiKey })` client wires it up automatically.'),
-    claim_queued: wire('claim', 409, true, 'The claim was queued behind the current lease holder and will be granted in turn. Wait, or read `claim.queue` to see your position.'),
+    claim_queued: wire('claim', 409, true, 'The claim was queued behind the current lease holder and will be granted in turn. Poll `claims.retrieve({ claimId })` for the grant — the id rides on the error — or read `claim.queue` to see the line.'),
     claim_wait_aborted: wire('claim', 409, true, 'The wait for this claim lease was aborted before the lease was granted.'),
-    claim_wait_poll_interval_required: client('claim', 'Waiting on a claim requires a poll interval, and none was provided.'),
-    grant_timeout: wire('claim', 504, true, 'The wait for a capability grant timed out before one arrived. Retry the request.'),
+    grant_timeout: wire('claim', 504, true, 'The wait for the claim grant timed out before your turn arrived (`waitTimeoutMs`). Claim again to rejoin the line, raise the cap, or re-read and proceed without the claim.'),
     // ── bootstrap (transport) ──────────────────────────────────────────
     bootstrap_fetch_timeout: wire('bootstrap', 504, true, 'The initial bootstrap fetch timed out before the server responded. Retry shortly.'),
     // Deliberate cancellation, never a failure of the network. It is what the
@@ -289,7 +292,7 @@ export const ERROR_CODES = {
     commit_failed: wire('transport', 500, true, 'The commit reached the server but failed to apply. Retrying may succeed.'),
     replication_lag_timeout: wire('transport', 504, true, "The data source accepted the write, but its correlated authoritative source delta did not arrive before the confirmation deadline. The write may still materialize; retry with the same idempotency key or wait for source ingestion to recover."),
     commit_offline_grace_expired: wire('transport', 503, false, 'The offline grace window expired before this commit could be sent, so it was not applied. Re-apply the change once the connection returns.'),
-    queue_too_deep: wire('transport', 503, true, 'The transaction queue is over its depth limit, so new writes are being rejected until it drains. Retry shortly.'),
+    queue_too_deep: wire('transport', 503, true, 'The line is already past its depth limit. For a claim, more participants were waiting than your `maxQueueDepth` allows — claim again without the cap to wait anyway, or work elsewhere and retry later. For a write, the transaction queue is draining — retry shortly.'),
     flush_timeout: wire('transport', 504, true, 'Flushing the transaction queue timed out before every pending write was sent. Retry once connectivity stabilizes.'),
     wait_for_timeout: wire('transport', 504, true, 'A wait-for condition timed out before it was satisfied. Retry, or extend the timeout.'),
     instance_at_capacity: wire('transport', 503, true, 'The server is at connection capacity. Retry shortly — transient and not specific to your credentials.'),
@@ -421,6 +424,7 @@ export const ERROR_CODES = {
     request_too_large: wire('validation', 413, false, 'The request body exceeds the maximum size.'),
     invalid_schema: wire('validation', 400, false, 'The submitted schema could not be parsed.'),
     incompatible_change: wire('conflict', 409, false, 'The schema change is incompatible with the schema currently deployed and cannot be applied as-is.'),
+    replication_reset_required: wire('conflict', 409, false, 'A connected log plane has live rows for a mapped model that disappeared. Declare a rename or an explicit drop/reset before advancing the schema.'),
 };
 /** Looks up the {@link ErrorCodeSpec} for a code. Returns `undefined` for the
  *  dynamic `policy:*` family and for any newer code this client does not yet

package/dist/transaction/plugin.d.ts

@@ -18,6 +18,9 @@ import type { ErrorCodeSpec } from './errorCodes.js';
 import type { Logger } from './logger.js';
 import type { CoordinationObservability } from './observability.js';
 import type { WsTransport } from './transport/wsTransport.js';
+import type { AuthCredentialSource } from './auth/credentialSource.js';
+import type { SyncDeltaWireCore } from './wire/delta.js';
+import type { ModelData } from './types/modelData.js';
 /**
  * A string type that keeps literal inference alive: `id: 'humans'` stays the
  * literal `'humans'` through object-literal inference instead of widening to
@@ -51,6 +54,59 @@ export type PipelineStage =
  | 'notify';
 /** Canonical order. A plugin runner must run stages in this sequence. */
 export declare const PIPELINE_STAGES: readonly PipelineStage[];
+/**
+ * A delta as stage handlers receive it — the identity slice of the wire
+ * shape, projected rather than restated so the wire schema stays the one
+ * definition.
+ */
+export type StageDelta = Pick<SyncDeltaWireCore, 'id' | 'actionType' | 'modelName' | 'modelId'>;
+/**
+ * One persisted change: what the durable write reported and the apply stage
+ * lands in the in-memory graph. `data` is absent for actions that carry
+ * none (a remove reports identity only).
+ */
+export interface AppliedChange {
+    action: 'add' | 'update' | 'remove' | 'archive' | 'verify';
+    modelName: string;
+    modelId: string;
+    data?: ModelData | null;
+    /**
+     * Server-stamped transaction id, echoing the client's own commit
+     * operation id — how a client recognizes the confirmation of a change it
+     * already applied locally. Absent for system-emitted changes, which have
+     * no client transaction behind them.
+     */
+    transactionId?: string;
+}
+/**
+ * What each stage hands its handlers. Read off the delta pipeline these
+ * stages were read off, not invented: `receive` sees the delta being
+ * queued, `dedupe` and `persist` see the batch at those boundaries,
+ * `apply` and `notify` see the persisted changes, and `acknowledge` sees
+ * the persistence-gated cursor value.
+ */
+export interface StagePayloads {
+    receive: {
+        readonly delta: StageDelta;
+    };
+    dedupe: {
+        readonly deltas: readonly StageDelta[];
+    };
+    persist: {
+        readonly deltas: readonly StageDelta[];
+    };
+    apply: {
+        readonly changes: readonly AppliedChange[];
+    };
+    acknowledge: {
+        readonly syncId: number;
+    };
+    notify: {
+        readonly changes: readonly AppliedChange[];
+    };
+}
+/** The handler a plugin attaches at one stage. The payload derives from the key. */
+export type StageHandler<K extends PipelineStage> = (payload: StagePayloads[K]) => void;
 /**
  * What a capability needs from whatever transport was selected.
  *
@@ -97,6 +153,28 @@ export interface PluginContext<Options = unknown> {
     };
     /** The connection's initial read scope (sync groups). */
     readonly syncGroups?: readonly string[];
+    /** The resolved server base URL, settled by the host before construction. */
+    readonly url?: string;
+    /**
+     * The client's single bearer-credential source, shared with every
+     * auth-aware transport the host built. A plugin that constructs its own
+     * fetching component hands this on rather than re-deriving a credential.
+     */
+    readonly auth?: AuthCredentialSource;
+    /**
+     * Whether a plugin with the given id is installed on this client. Supplied
+     * by {@link resolvePlugins} from the list it is resolving — the one place
+     * that truthfully knows the assembly — so a plugin interrogates what is
+     * installed instead of the host special-casing plugins by name.
+     */
+    readonly hasPlugin?: (id: string) => boolean;
+    /**
+     * The resolved plugin list itself, supplied by {@link resolvePlugins}
+     * alongside {@link hasPlugin} (which derives from it). A component a
+     * plugin constructs — the store and its delta pipeline — holds this list
+     * to dispatch the declared stage handlers through {@link runStage}.
+     */
+    readonly plugins?: readonly AbloPlugin[];
 }
 /**
  * One installed capability.
@@ -130,8 +208,16 @@ export interface AbloPlugin<Surface = unknown> {
      * hole in the published reference.
      */
     readonly errorCodes?: Readonly<Record<string, ErrorCodeSpec>>;
-    /** Which pipeline stage this plugin attaches to, if it observes deltas. */
-    readonly stage?: PipelineStage;
+    /**
+     * The pipeline stages this plugin attaches to: each key names a stage and
+     * holds the handler the runner invokes there. One field on purpose — a
+     * declared stage cannot exist without its handler, nor a handler without
+     * its stage, so the declaration can never point at nothing. The payload
+     * type derives from the key ({@link StagePayloads}).
+     */
+    readonly stages?: {
+        readonly [K in PipelineStage]?: StageHandler<K>;
+    };
     /** Build the plugin's contribution to the client surface. */
     init(context: PluginContext): Surface;
 }
@@ -189,4 +275,11 @@ export declare function layerPluginSurface<T extends object>(base: T, installed:
  * to choose and carries no correctness weight.
  */
 export declare function pluginsForStage(plugins: readonly AbloPlugin[], stage: PipelineStage): readonly AbloPlugin[];
+/**
+ * Invokes every handler declared for one stage, in declaration order, with
+ * that stage's payload. No handlers declared is a plain no-op, so a pipeline
+ * dispatches unconditionally at each boundary and pays nothing when the
+ * stage is unclaimed.
+ */
+export declare function runStage<K extends PipelineStage>(plugins: readonly AbloPlugin[], stage: K, payload: StagePayloads[K]): void;
 export {};

package/dist/transaction/plugin.js

@@ -33,6 +33,14 @@ export const PIPELINE_STAGES = [
 export function resolvePlugins(plugins, transport, context) {
     const surface = {};
     const seen = new Set();
+    // The assembly, injected from the list being resolved. Always this list's
+    // own answer — a host-supplied `plugins` or `hasPlugin` could disagree
+    // with the assembly it describes, so both are replaced, not deferred to.
+    const initContext = {
+        ...context,
+        plugins,
+        hasPlugin: (id) => plugins.some((plugin) => plugin.id === id),
+    };
     for (const plugin of plugins) {
         if (seen.has(plugin.id)) {
             throw new AbloValidationError(`The ${plugin.id} plugin is listed twice. Remove the duplicate; a plugin is installed once per client.`, { code: 'invalid_options', param: 'plugins' });
@@ -41,7 +49,7 @@ export function resolvePlugins(plugins, transport, context) {
         if (plugin.requires?.duplex && !transport.duplex) {
             throw new AbloValidationError(`The ${plugin.id} plugin needs a connection the server can send on, and this client is set up for request-response only. Switch the transport to 'websocket', or drop the plugin.`, { code: 'invalid_options', param: 'plugins' });
         }
-        surface[plugin.id] = plugin.init(context);
+        surface[plugin.id] = plugin.init(initContext);
     }
     return surface;
 }
@@ -83,5 +91,16 @@ export function layerPluginSurface(base, installed) {
  * to choose and carries no correctness weight.
  */
 export function pluginsForStage(plugins, stage) {
-    return plugins.filter((plugin) => plugin.stage === stage);
+    return plugins.filter((plugin) => plugin.stages?.[stage] !== undefined);
+}
+/**
+ * Invokes every handler declared for one stage, in declaration order, with
+ * that stage's payload. No handlers declared is a plain no-op, so a pipeline
+ * dispatches unconditionally at each boundary and pays nothing when the
+ * stage is unclaimed.
+ */
+export function runStage(plugins, stage, payload) {
+    for (const plugin of plugins) {
+        plugin.stages?.[stage]?.(payload);
+    }
 }

package/dist/transaction/resources/httpResources.d.ts

@@ -4,7 +4,8 @@
  * {@link HttpClaimApi} derivation. This module holds only types and has no runtime
  * imports.
  */
-import type { OnStaleMode, ReadDependency, TrackDependency } from '../coordination/schema.js';
+import type { ClaimHeartbeatAckPayload, OnStaleMode, ReadDependency, TrackDependency } from '../coordination/schema.js';
+import type { ClaimHeartbeatReply, ClaimState } from '../wire/claims.js';
 import type { ClientCommitReceipt, CommitWait } from '../wire/commit.js';
 export type { CommitWait };
 import type { ModelTarget, ModelClaim } from '../coordination/schema.js';
@@ -68,6 +69,9 @@ export interface ClaimCreateOptions {
     readonly queue?: boolean;
     /** Cap on how long to wait for a queued grant before rejecting. */
     readonly waitTimeoutMs?: number;
+    /** Abort a pending wait from outside — rejects with `claim_wait_aborted`.
+     *  Ignored once the grant has arrived. */
+    readonly signal?: AbortSignal;
     /**
      * Backpressure: reject with `AbloClaimedError('queue_too_deep')` instead of
      * waiting if the queue is already `>= maxQueueDepth` when we join.
@@ -131,6 +135,55 @@ export interface ClaimResource extends ClaimStream {
     list(target?: Partial<ModelTarget>): readonly ModelClaim[];
     waitFor(target: Partial<ModelTarget>, options?: ClaimWaitOptions): Promise<void>;
 }
+/**
+ * The claim-ticket surface of the stateless HTTP client — the operations a
+ * caller performs holding only a `claimId`, which is what a queued acquire
+ * leaves in its hand (`AbloClaimedError('claim_queued')` carries it on
+ * `error.claims`). The WebSocket client never needs these: it awaits the grant
+ * on its socket.
+ *
+ * All three shapes are the wire's own — `claimStateSchema`,
+ * `claimHeartbeatReplySchema`, and the batch ack — so this surface cannot
+ * describe a response the server does not send.
+ */
+export interface HttpClaimsResource {
+    /**
+     * The claim's current state, by its id — `GET /v1/claims/{claimId}`. The
+     * poll half of the queued-grant handover: a queued caller polls until
+     * `status` is `'active'`, at which point `fenceToken` is present and the
+     * work can begin. `position` is advisory (a privileged caller can reorder
+     * the line, so it may go up); only `status` is authoritative.
+     */
+    retrieve(params: {
+        readonly claimId: string;
+    }): Promise<ClaimState>;
+    /**
+     * One beat on the named lease — `POST /v1/claims/{claimId}/heartbeat`. On a
+     * held lease it extends the TTL; on a queued ticket it refreshes the
+     * waiter's slot in the line and reports `{ status: 'queued', position }`.
+     */
+    heartbeat(params: {
+        readonly claimId: string;
+        readonly ttl?: string | number;
+    }): Promise<ClaimHeartbeatReply>;
+    /**
+     * One beat for every lease this identity holds — `POST /v1/claims/heartbeat`,
+     * one ack per extended lease. The socketless twin of the realtime
+     * keepalive, for a stateless worker holding many rows.
+     */
+    heartbeatAll(options?: {
+        readonly ttl?: string | number;
+    }): Promise<readonly ClaimHeartbeatAckPayload[]>;
+    /**
+     * Give the ticket back — `DELETE /v1/claims/{claimId}`. On a held lease this
+     * releases it and promotes the head of the queue; on a queued ticket it
+     * leaves the line, so the waiters behind move up instead of waiting out
+     * your slot's TTL. Idempotent: releasing an already-ended claim is a no-op.
+     */
+    release(params: {
+        readonly claimId: string;
+    }): Promise<void>;
+}
 export interface ModelMutationOptions extends ClaimedOptions {
     readonly claimRef?: string | {
         readonly id: string;
@@ -159,7 +212,9 @@ export interface ModelMutationOptions extends ClaimedOptions {
  * statelessness forces. `claim({ id })` is identical on both (already async);
  * `state`, `queue`, `reorder`, and `release` are the awaited form.
  */
-export type HttpClaimApi<T = Record<string, unknown>> = ((params: ClaimParams<T>) => Promise<HeldClaim<T>>) & {
+export type HttpClaimApi<T = Record<string, unknown>> = ((params: ClaimParams<T> & {
+    queue: false;
+}) => Promise<HeldClaim<T> | null>) & ((params: ClaimParams<T>) => Promise<HeldClaim<T>>) & {
     [K in keyof ClaimReadApi<T>]: AwaitedClaimMethod<ClaimReadApi<T>[K]>;
 };
 /** A single data operation a scoped **agent** session may perform on a model.