@abloatai/ablo 0.35.0 → 0.36.0

package/dist/transaction/wire/auth.js

@@ -53,5 +53,11 @@ export const ephemeralKeyRequestSchema = z.object({
  * `auth/capability.ts` — the grant is one structure, and its request form is a
  * face of it rather than a separate shape. Re-exported here so the wire barrel
  * stays the single import path for the boundary.
+ *
+ * This is the only import wire makes for something larger than a schema leaf,
+ * so it carries exactly the shape the barrel forwards and nothing else: the
+ * grant's own vocabulary — the verb enum, the `model.verb` spelling, the
+ * helpers that derive one from the other — is read from `auth/capability.ts`
+ * by the callers that build a grant, not through here.
  */
-export { capabilityRequestSchema, grantedOperationSchema, capabilityOperationSchema, } from '../auth/capability.js';
+export { capabilityRequestSchema, capabilityMintResponseSchema, } from '../auth/capability.js';

package/dist/transaction/wire/claims.d.ts

@@ -10,6 +10,37 @@
  * unvalidated and the reference described the shape from memory.
  */
 import { z } from 'zod';
+/**
+ * How long a lease runs when the caller does not ask for a length.
+ *
+ * One definition for both ends: the server stamps `expiresAt` with it, and the
+ * client's auto-heartbeat derives its cadence from it, so a claim that names no
+ * TTL beats comfortably inside the window the server actually granted.
+ */
+export declare const DEFAULT_CLAIM_TTL_MS = 60000;
+/**
+ * A lease length on the wire, in the SDK's one duration grammar: a
+ * unit-suffixed string (`'500ms'`, `'30s'`, `'5m'`, `'24h'`) or a bare number of
+ * **seconds** — the same reading `ttlSeconds` has everywhere else in the API.
+ *
+ * It used to be `z.union([z.string(), z.number()])`, and the units lived only in
+ * the route's private parser, which read a bare number as MILLISECONDS. So the
+ * SDK computed its heartbeat cadence from one grammar while the server granted a
+ * lease under another, and `ttl: 300` meant five minutes to the client and three
+ * hundred milliseconds to the server. Publishing the grammar is what makes that
+ * class of disagreement impossible: there is now one pattern, emitted into the
+ * contract, and one parser behind it.
+ */
+export declare const claimTtlSchema: z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>;
+/**
+ * A wire TTL as milliseconds — the single reading of the grammar above.
+ *
+ * The server calls this rather than carrying its own parser. An absent TTL takes
+ * {@link DEFAULT_CLAIM_TTL_MS}; anything present has already been validated by
+ * {@link claimTtlSchema} at the boundary, so a malformed duration is a 400 at the
+ * door rather than a silent one-minute lease that lapses mid-work.
+ */
+export declare function claimTtlMs(ttl: z.infer<typeof claimTtlSchema> | null | undefined): number;
 /** The row a claim points at, when it is not already given by the URL. */
 export declare const claimTargetSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodString>;
@@ -51,7 +82,7 @@ export declare const claimRequestSchema: z.ZodObject<{
     reason: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodString>;
     meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    ttl: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    ttl: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>>;
     queue: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type ClaimRequest = z.infer<typeof claimRequestSchema>;
@@ -63,7 +94,7 @@ export type ClaimRequest = z.infer<typeof claimRequestSchema>;
  */
 export declare const claimHeartbeatRequestSchema: z.ZodObject<{
     claimId: z.ZodOptional<z.ZodString>;
-    ttl: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    ttl: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>>;
     details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 export type ClaimHeartbeatRequest = z.infer<typeof claimHeartbeatRequestSchema>;
@@ -113,11 +144,11 @@ export type ListQuery = z.infer<typeof listQuerySchema>;
  * its own read, the same way the socket path takes it from a local snapshot.
  */
 export declare const claimStateSchema: z.ZodObject<{
+    id: z.ZodString;
     expiresAt: z.ZodOptional<z.ZodNumber>;
     fenceToken: z.ZodOptional<z.ZodNumber>;
     position: z.ZodOptional<z.ZodNumber>;
     object: z.ZodLiteral<"claim">;
-    claimId: z.ZodString;
     status: z.ZodEnum<{
         active: "active";
         committed: "committed";
@@ -136,6 +167,9 @@ export type ClaimState = z.infer<typeof claimStateSchema>;
 export declare const claimAcquiredResponseSchema: z.ZodObject<{
     id: z.ZodString;
     object: z.ZodLiteral<"claim">;
+    status: z.ZodLiteral<"active">;
+    fenceToken: z.ZodOptional<z.ZodNumber>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
     claim: z.ZodReadonly<z.ZodObject<{
         id: z.ZodString;
         actor: z.ZodString;
@@ -183,13 +217,17 @@ export type ClaimAcquiredResponse = z.infer<typeof claimAcquiredResponseSchema>;
  * put you in line. The grant arrives later on the caller's stream, or through
  * `GET /v1/claims/{claimId}`.
  *
- * There is deliberately no `object` field here: a queued claim is not yet a
- * created resource, and the status code plus `status: 'queued'` already carry
- * the distinction.
+ * Shaped as a claim resource, exactly like the 201, because that is what it is:
+ * a queue entry is a lease in a different state — the reason one `DELETE`
+ * serves both, and the reason the poll can move one to the other. It once
+ * withheld `object` and `id` on the argument that a queued claim is not yet a
+ * created resource, which read as principled and cost a caller the ability to
+ * treat the two answers as one type.
  */
 export declare const claimQueuedResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    object: z.ZodLiteral<"claim">;
     status: z.ZodLiteral<"queued">;
-    claimId: z.ZodString;
     position: z.ZodNumber;
     heldBy: z.ZodOptional<z.ZodString>;
     expiresAt: z.ZodOptional<z.ZodNumber>;
@@ -221,14 +259,21 @@ export declare const claimQueuedResponseSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type ClaimQueuedResponse = z.infer<typeof claimQueuedResponseSchema>;
 /**
- * Either answer to a claim acquire. The two arms cannot be a discriminated
- * union — the 201 keys on `object` and the 202 on `status`, and neither field
- * appears in both — so a caller branches on `status === 'queued'`, which is
- * what the HTTP transport does.
+ * Either answer to a claim acquire — one resource, two states, told apart by
+ * `status`.
+ *
+ * A real discriminated union, which it could not be while the arms disagreed
+ * about what the handle was called (`id` on the 201, `claimId` on the 202) and
+ * only one of them said `object`. `claimRecordSchema.id` states the rule both
+ * now follow: `id` where the claim IS the resource, `claimId` where some other
+ * object names one.
  */
-export declare const claimAcquireResponseSchema: z.ZodUnion<readonly [z.ZodObject<{
+export declare const claimAcquireResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     id: z.ZodString;
     object: z.ZodLiteral<"claim">;
+    status: z.ZodLiteral<"active">;
+    fenceToken: z.ZodOptional<z.ZodNumber>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
     claim: z.ZodReadonly<z.ZodObject<{
         id: z.ZodString;
         actor: z.ZodString;
@@ -270,8 +315,9 @@ export declare const claimAcquireResponseSchema: z.ZodUnion<readonly [z.ZodObjec
         field: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
+    id: z.ZodString;
+    object: z.ZodLiteral<"claim">;
     status: z.ZodLiteral<"queued">;
-    claimId: z.ZodString;
     position: z.ZodNumber;
     heldBy: z.ZodOptional<z.ZodString>;
     expiresAt: z.ZodOptional<z.ZodNumber>;
@@ -300,7 +346,7 @@ export declare const claimAcquireResponseSchema: z.ZodUnion<readonly [z.ZodObjec
         }>>>>;
         capabilityId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
-}, z.core.$strip>]>;
+}, z.core.$strip>], "status">;
 export type ClaimAcquireResponse = z.infer<typeof claimAcquireResponseSchema>;
 /**
  * `POST /v1/models/{model}/{id}/claim/heartbeat`.
@@ -373,91 +419,112 @@ export type ClaimListQuery = z.infer<typeof claimListQuerySchema>;
 /**
  * `GET /v1/claims` — who holds what, and who waits.
  *
- * `queue` is populated only when the request names both a `model` and an `id`;
- * a wait line belongs to one row, so an unscoped listing has nothing to report
- * and answers with an empty array rather than omitting the field.
+ * One list in the shape every other list has, because holders and waiters are
+ * the same resource in two states: each entry carries `status`, and a `queued`
+ * one carries its `position`. Holders come first, then the wait line in order.
+ *
+ * It used to answer `{ claims[], queue[] }` — a bespoke envelope on the endpoint
+ * a coordination client touches most, which cost a generated client a
+ * special-cased model to read the one call it makes constantly.
+ *
+ * Waiters appear only when the request names both a `model` and an `id`: a wait
+ * line belongs to one row, so an unscoped listing has none to report.
  */
 export declare const claimListResponseSchema: z.ZodObject<{
     object: z.ZodLiteral<"list">;
-    claims: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
-        id: z.ZodString;
-        actor: z.ZodString;
-        participantKind: z.ZodPreprocess<z.ZodEnum<{
-            user: "user";
-            agent: "agent";
-            system: "system";
-        }>>;
-        onBehalfOfId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        onBehalfOfKind: z.ZodOptional<z.ZodNullable<z.ZodPreprocess<z.ZodEnum<{
-            user: "user";
-            agent: "agent";
-            system: "system";
-        }>>>>;
-        capabilityId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        description: z.ZodOptional<z.ZodString>;
-        status: z.ZodOptional<z.ZodEnum<{
-            active: "active";
-            queued: "queued";
-        }>>;
-        position: z.ZodOptional<z.ZodNumber>;
-        expiresAt: z.ZodNumber;
-        fenceToken: z.ZodOptional<z.ZodNumber>;
-        target: z.ZodReadonly<z.ZodObject<{
-            model: z.ZodString;
-            id: z.ZodString;
-            path: z.ZodOptional<z.ZodString>;
-            range: z.ZodOptional<z.ZodObject<{
-                startLine: z.ZodNumber;
-                endLine: z.ZodNumber;
-                startColumn: z.ZodOptional<z.ZodNumber>;
-                endColumn: z.ZodOptional<z.ZodNumber>;
-            }, z.core.$strip>>;
-            field: z.ZodOptional<z.ZodString>;
-            fields: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
-            meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        }, z.core.$strip>>;
-        meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        field: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>>;
-    queue: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
-        id: z.ZodString;
-        actor: z.ZodString;
-        participantKind: z.ZodPreprocess<z.ZodEnum<{
-            user: "user";
-            agent: "agent";
-            system: "system";
-        }>>;
-        onBehalfOfId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        onBehalfOfKind: z.ZodOptional<z.ZodNullable<z.ZodPreprocess<z.ZodEnum<{
-            user: "user";
-            agent: "agent";
-            system: "system";
-        }>>>>;
-        capabilityId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        description: z.ZodOptional<z.ZodString>;
-        status: z.ZodOptional<z.ZodEnum<{
-            active: "active";
-            queued: "queued";
-        }>>;
-        position: z.ZodOptional<z.ZodNumber>;
-        expiresAt: z.ZodNumber;
-        fenceToken: z.ZodOptional<z.ZodNumber>;
-        target: z.ZodReadonly<z.ZodObject<{
-            model: z.ZodString;
-            id: z.ZodString;
-            path: z.ZodOptional<z.ZodString>;
-            range: z.ZodOptional<z.ZodObject<{
-                startLine: z.ZodNumber;
-                endLine: z.ZodNumber;
-                startColumn: z.ZodOptional<z.ZodNumber>;
-                endColumn: z.ZodOptional<z.ZodNumber>;
-            }, z.core.$strip>>;
-            field: z.ZodOptional<z.ZodString>;
-            fields: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
-            meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        }, z.core.$strip>>;
-        meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        field: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>>;
+    data: z.ZodReadonly<z.ZodArray<z.ZodType<Readonly<{
+        id: string;
+        actor: string;
+        participantKind: "user" | "agent" | "system";
+        expiresAt: number;
+        target: Readonly<{
+            model: string;
+            id: string;
+            path?: string | undefined;
+            range?: {
+                startLine: number;
+                endLine: number;
+                startColumn?: number | undefined;
+                endColumn?: number | undefined;
+            } | undefined;
+            field?: string | undefined;
+            fields?: readonly string[] | undefined;
+            meta?: Record<string, unknown> | undefined;
+        }>;
+        onBehalfOfId?: string | null | undefined;
+        onBehalfOfKind?: "user" | "agent" | "system" | null | undefined;
+        capabilityId?: string | null | undefined;
+        description?: string | undefined;
+        status?: "active" | "queued" | undefined;
+        position?: number | undefined;
+        fenceToken?: number | undefined;
+        meta?: Record<string, unknown> | undefined;
+        field?: string | undefined;
+    }>, unknown, z.core.$ZodTypeInternals<Readonly<{
+        id: string;
+        actor: string;
+        participantKind: "user" | "agent" | "system";
+        expiresAt: number;
+        target: Readonly<{
+            model: string;
+            id: string;
+            path?: string | undefined;
+            range?: {
+                startLine: number;
+                endLine: number;
+                startColumn?: number | undefined;
+                endColumn?: number | undefined;
+            } | undefined;
+            field?: string | undefined;
+            fields?: readonly string[] | undefined;
+            meta?: Record<string, unknown> | undefined;
+        }>;
+        onBehalfOfId?: string | null | undefined;
+        onBehalfOfKind?: "user" | "agent" | "system" | null | undefined;
+        capabilityId?: string | null | undefined;
+        description?: string | undefined;
+        status?: "active" | "queued" | undefined;
+        position?: number | undefined;
+        fenceToken?: number | undefined;
+        meta?: Record<string, unknown> | undefined;
+        field?: string | undefined;
+    }>, unknown>>>>;
+    has_more: z.ZodBoolean;
+    next_cursor: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type ClaimListResponse = z.infer<typeof claimListResponseSchema>;
+/**
+ * `POST /v1/models/{model}/{id}/claim/reorder` — re-rank the wait line.
+ *
+ * `claimId` rather than `id` here by the rule in {@link claimRecordSchema}: an
+ * entry in this list names a claim, it is not one. The server parsed this body
+ * by hand — `JSON.parse(raw) as { order?: … }`, a cast onto an inline shape at a
+ * wire boundary — until it had a schema to parse against.
+ */
+export declare const claimReorderRequestSchema: z.ZodObject<{
+    order: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        heldBy: z.ZodString;
+        claimId: z.ZodString;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>;
+export type ClaimReorderRequest = z.infer<typeof claimReorderRequestSchema>;
+/** The reorder reply. */
+export declare const claimReorderReplySchema: z.ZodObject<{
+    object: z.ZodLiteral<"claim_reorder">;
+    reordered: z.ZodBoolean;
+}, z.core.$strip>;
+export type ClaimReorderReply = z.infer<typeof claimReorderReplySchema>;
+/**
+ * `DELETE /v1/claims/{claimId}` and `DELETE /v1/models/{model}/{id}/claim`.
+ *
+ * `released` distinguishes "your lease is gone because this call ended it" from
+ * "there was nothing of yours to end" — both are success, and a caller
+ * retrying a release deserves to know which happened. The two routes answered
+ * `{ ok: true }` and `{ ok, released }`: two shapes, neither written down, and
+ * `ok` restating the status code.
+ */
+export declare const claimReleaseReplySchema: z.ZodObject<{
+    object: z.ZodLiteral<"claim_release">;
+    released: z.ZodBoolean;
+}, z.core.$strip>;
+export type ClaimReleaseReply = z.infer<typeof claimReleaseReplySchema>;

package/dist/transaction/wire/claims.js

@@ -10,7 +10,42 @@
  * unvalidated and the reference described the shape from memory.
  */
 import { z } from 'zod';
+import { durationSchema, parseDurationMs } from '../utils/duration.js';
+import { listEnvelopeSchema } from './listEnvelope.js';
 import { targetRangeSchema, publicClaimStatusSchema, wireParticipantKindSchema, claimRecordSchema, modelClaimSchema, claimHeartbeatAckPayloadSchema, wireClaimSummarySchema, } from '../coordination/schema.js';
+/**
+ * How long a lease runs when the caller does not ask for a length.
+ *
+ * One definition for both ends: the server stamps `expiresAt` with it, and the
+ * client's auto-heartbeat derives its cadence from it, so a claim that names no
+ * TTL beats comfortably inside the window the server actually granted.
+ */
+export const DEFAULT_CLAIM_TTL_MS = 60_000;
+/**
+ * A lease length on the wire, in the SDK's one duration grammar: a
+ * unit-suffixed string (`'500ms'`, `'30s'`, `'5m'`, `'24h'`) or a bare number of
+ * **seconds** — the same reading `ttlSeconds` has everywhere else in the API.
+ *
+ * It used to be `z.union([z.string(), z.number()])`, and the units lived only in
+ * the route's private parser, which read a bare number as MILLISECONDS. So the
+ * SDK computed its heartbeat cadence from one grammar while the server granted a
+ * lease under another, and `ttl: 300` meant five minutes to the client and three
+ * hundred milliseconds to the server. Publishing the grammar is what makes that
+ * class of disagreement impossible: there is now one pattern, emitted into the
+ * contract, and one parser behind it.
+ */
+export const claimTtlSchema = durationSchema;
+/**
+ * A wire TTL as milliseconds — the single reading of the grammar above.
+ *
+ * The server calls this rather than carrying its own parser. An absent TTL takes
+ * {@link DEFAULT_CLAIM_TTL_MS}; anything present has already been validated by
+ * {@link claimTtlSchema} at the boundary, so a malformed duration is a 400 at the
+ * door rather than a silent one-minute lease that lapses mid-work.
+ */
+export function claimTtlMs(ttl) {
+    return ttl == null ? DEFAULT_CLAIM_TTL_MS : parseDurationMs(ttl);
+}
 /** The row a claim points at, when it is not already given by the URL. */
 export const claimTargetSchema = z.object({
     model: z.string().optional(),
@@ -35,8 +70,8 @@ export const claimRequestSchema = z.object({
     /** Defaults to `editing`. Shown to other participants holding the row. */
     description: z.string().optional(),
     meta: z.record(z.string(), z.unknown()).optional(),
-    /** Lease length in the same grammar as a heartbeat: `'5m'` or `30000`. */
-    ttl: z.union([z.string(), z.number()]).nullish(),
+    /** Lease length in the same grammar as a heartbeat — see {@link claimTtlSchema}. */
+    ttl: claimTtlSchema.nullish(),
     /**
      * Join the fair wait line when the row is already held, instead of failing.
      * The response carries `{ status: 'queued', position }` and the grant arrives
@@ -52,7 +87,8 @@ export const claimRequestSchema = z.object({
  */
 export const claimHeartbeatRequestSchema = z.object({
     claimId: z.string().optional(),
-    ttl: z.union([z.string(), z.number()]).nullish(),
+    /** Extends the lease by this much from now — see {@link claimTtlSchema}. */
+    ttl: claimTtlSchema.nullish(),
     /** Progress carried on the beat — becomes the claim's peer-visible
      *  `meta.progress`. Last beat wins, and it goes with the lease. */
     details: z.record(z.string(), z.unknown()).optional(),
@@ -100,21 +136,27 @@ export const listQuerySchema = z.object({
  * its own read, the same way the socket path takes it from a local snapshot.
  */
 export const claimStateSchema = claimRecordSchema
-    .pick({ position: true, expiresAt: true, fenceToken: true })
-    .partial()
+    .pick({ id: true, position: true, expiresAt: true, fenceToken: true })
+    .partial({ position: true, expiresAt: true, fenceToken: true })
     .extend({
     object: z.literal('claim'),
-    /** The claim named, rather than the claim as a resource — which is why this
-     *  is `claimId` and not the record's `id`. */
-    claimId: z.string(),
     /**
      * Widened from the record's two observable states to all five.
      *
      * A poll is the one surface that can arrive after the claim ended: the
-     * caller holds an id and asks what became of it, so `committed`, `expired`,
-     * and `canceled` are answers this route must be able to give. A peer's
-     * listing cannot see them, because a terminal claim has already left the
-     * set being listed.
+     * caller holds an id and asks what became of it, so the terminal statuses
+     * are answers this route must be able to give. A peer's listing cannot see
+     * them, because a terminal claim has already left the set being listed.
+     *
+     * `expired` and `canceled` are answered for a few minutes after the fact,
+     * long enough for a straggler poll and no longer — the ClaimLog is the
+     * record, this is a courtesy. Past that window the claim is genuinely gone
+     * and the route answers 404 `claim_not_found`.
+     *
+     * `committed` is declared and not yet answered: it needs the release path
+     * to know that a write settled under the lease, which the commit path does
+     * not hand back today. A caller must therefore treat the terminal statuses
+     * as a set rather than switching exhaustively on the two it sees.
      */
     status: publicClaimStatusSchema,
 });
@@ -127,6 +169,19 @@ export const claimStateSchema = claimRecordSchema
 export const claimAcquiredResponseSchema = z.object({
     id: z.string(),
     object: z.literal('claim'),
+    status: z.literal('active'),
+    /**
+     * The lease's own fields, in the same place the poll puts them.
+     *
+     * They are also inside `claim`, which is the peer-visible view and carries
+     * far more — actor, target, description, delegation. Mirroring the two that a
+     * holder actually acts on is what lets one reader handle both answers: a
+     * client that had to look in `claim.fenceToken` here and `fenceToken` on the
+     * poll is reading one resource through two shapes, which is the defect this
+     * response pair was just unified to remove.
+     */
+    fenceToken: z.number().int().optional(),
+    expiresAt: z.number().int().optional(),
     claim: modelClaimSchema,
 });
 /**
@@ -134,25 +189,33 @@ export const claimAcquiredResponseSchema = z.object({
  * put you in line. The grant arrives later on the caller's stream, or through
  * `GET /v1/claims/{claimId}`.
  *
- * There is deliberately no `object` field here: a queued claim is not yet a
- * created resource, and the status code plus `status: 'queued'` already carry
- * the distinction.
+ * Shaped as a claim resource, exactly like the 201, because that is what it is:
+ * a queue entry is a lease in a different state — the reason one `DELETE`
+ * serves both, and the reason the poll can move one to the other. It once
+ * withheld `object` and `id` on the argument that a queued claim is not yet a
+ * created resource, which read as principled and cost a caller the ability to
+ * treat the two answers as one type.
  */
 export const claimQueuedResponseSchema = z.object({
+    id: z.string(),
+    object: z.literal('claim'),
     status: z.literal('queued'),
-    claimId: z.string(),
     position: z.number().int().nonnegative(),
     heldBy: z.string().optional(),
     expiresAt: z.number().int().optional(),
     heldByClaim: wireClaimSummarySchema.optional(),
 });
 /**
- * Either answer to a claim acquire. The two arms cannot be a discriminated
- * union — the 201 keys on `object` and the 202 on `status`, and neither field
- * appears in both — so a caller branches on `status === 'queued'`, which is
- * what the HTTP transport does.
+ * Either answer to a claim acquire — one resource, two states, told apart by
+ * `status`.
+ *
+ * A real discriminated union, which it could not be while the arms disagreed
+ * about what the handle was called (`id` on the 201, `claimId` on the 202) and
+ * only one of them said `object`. `claimRecordSchema.id` states the rule both
+ * now follow: `id` where the claim IS the resource, `claimId` where some other
+ * object names one.
  */
-export const claimAcquireResponseSchema = z.union([
+export const claimAcquireResponseSchema = z.discriminatedUnion('status', [
     claimAcquiredResponseSchema,
     claimQueuedResponseSchema,
 ]);
@@ -218,12 +281,47 @@ export const claimListQuerySchema = z.object({
 /**
  * `GET /v1/claims` — who holds what, and who waits.
  *
- * `queue` is populated only when the request names both a `model` and an `id`;
- * a wait line belongs to one row, so an unscoped listing has nothing to report
- * and answers with an empty array rather than omitting the field.
+ * One list in the shape every other list has, because holders and waiters are
+ * the same resource in two states: each entry carries `status`, and a `queued`
+ * one carries its `position`. Holders come first, then the wait line in order.
+ *
+ * It used to answer `{ claims[], queue[] }` — a bespoke envelope on the endpoint
+ * a coordination client touches most, which cost a generated client a
+ * special-cased model to read the one call it makes constantly.
+ *
+ * Waiters appear only when the request names both a `model` and an `id`: a wait
+ * line belongs to one row, so an unscoped listing has none to report.
  */
-export const claimListResponseSchema = z.object({
-    object: z.literal('list'),
-    claims: z.array(modelClaimSchema).readonly(),
-    queue: z.array(modelClaimSchema).readonly(),
+export const claimListResponseSchema = listEnvelopeSchema(modelClaimSchema);
+/**
+ * `POST /v1/models/{model}/{id}/claim/reorder` — re-rank the wait line.
+ *
+ * `claimId` rather than `id` here by the rule in {@link claimRecordSchema}: an
+ * entry in this list names a claim, it is not one. The server parsed this body
+ * by hand — `JSON.parse(raw) as { order?: … }`, a cast onto an inline shape at a
+ * wire boundary — until it had a schema to parse against.
+ */
+export const claimReorderRequestSchema = z.object({
+    order: z
+        .array(z.object({ heldBy: z.string(), claimId: z.string() }))
+        .readonly()
+        .optional(),
+});
+/** The reorder reply. */
+export const claimReorderReplySchema = z.object({
+    object: z.literal('claim_reorder'),
+    reordered: z.boolean(),
+});
+/**
+ * `DELETE /v1/claims/{claimId}` and `DELETE /v1/models/{model}/{id}/claim`.
+ *
+ * `released` distinguishes "your lease is gone because this call ended it" from
+ * "there was nothing of yours to end" — both are success, and a caller
+ * retrying a release deserves to know which happened. The two routes answered
+ * `{ ok: true }` and `{ ok, released }`: two shapes, neither written down, and
+ * `ok` restating the status code.
+ */
+export const claimReleaseReplySchema = z.object({
+    object: z.literal('claim_release'),
+    released: z.boolean(),
 });

package/dist/transaction/wire/commit.d.ts

@@ -592,8 +592,8 @@ export declare const commitRequestSchema: z.ZodObject<{
         }>>;
     }, z.core.$strip>]>>>>;
     track: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-        model: z.ZodString;
         id: z.ZodString;
+        model: z.ZodString;
         readAt: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>, z.ZodObject<{
         group: z.ZodString;

package/dist/transaction/wire/feedEvent.d.ts

@@ -165,6 +165,33 @@ export declare const logListResponseSchema: z.ZodObject<{
     next_cursor: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type LogListResponse = ListEnvelope<FeedEvent>;
+/**
+ * The query string on `GET /v1/logs`.
+ *
+ * Values arrive as strings, so this describes the wire spelling rather than the
+ * parsed result — the same reason {@link listQuerySchema} does.
+ *
+ * Scope is NOT here and never will be: the plane, the organization and the sync
+ * groups all come off the credential. A caller cannot widen what it sees by
+ * asking, which is what makes this feed safe to hand an agent.
+ */
+export declare const logQuerySchema: z.ZodObject<{
+    after: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodString>;
+    op: z.ZodOptional<z.ZodEnum<{
+        update: "update";
+        visible: "visible";
+        create: "create";
+        delete: "delete";
+        archive: "archive";
+        revive: "revive";
+        group_added: "group_added";
+        group_removed: "group_removed";
+    }>>;
+    since: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type LogQuery = z.infer<typeof logQuerySchema>;
 /**
  * The claim arm has no producer yet: claim transitions are broadcast today and
  * recorded nowhere, so there is no sequence to read `seq` from. Until that log