@abloatai/ablo 0.35.0 → 0.37.0

package/dist/transaction/resources/httpResources.d.ts

@@ -1,266 +0,0 @@
-/**
- * Shared resource types for the typed clients and private HTTP transport.
- * the commit and claim shapes, the session-mint params and resource, and the
- * {@link HttpClaimApi} derivation. This module holds only types and has no runtime
- * imports.
- */
-import type { OnStaleMode, ReadDependency, TrackDependency } from '../coordination/schema.js';
-import type { ClientCommitReceipt, CommitWait } from '../wire/commit.js';
-export type { CommitWait };
-import type { ModelTarget, ModelClaim } from '../coordination/schema.js';
-export type { ModelTarget, ModelClaim };
-import type { ResolveClaimMeta } from '../types/global.js';
-import type { SchemaRecord } from '../schema/schema.js';
-import type { SyncGroupInput } from '../schema/roles.js';
-import type { CapabilityCan, CapabilityOperation, CapabilityScope } from '../auth/capability.js';
-import type { Claim, ClaimStream, ClaimWaitOptions, Duration, HeldClaim } from '../types/streams.js';
-import type { ClaimOptions, ClaimParams, ClaimReadApi, AwaitedClaimMethod } from './modelOperations.js';
-/**
- * The operations available on each model in the sync engine:
- *   `retrieve({ id })` — an async single-row server read
- *   `list({ where })` — an async collection server read
- *   `local.retrieve(id)` / `local.list(...)` / `local.count(...)` — synchronous local reads
- *   `create({ data })` / `update({ id, data })` / `delete({ id })` — writes
- *   `claim({ id })` — a durable claim handle for coordinated writes
- */
-export type ModelOperationAction = 'create' | 'update' | 'delete' | 'archive' | 'unarchive';
-export type IfClaimedPolicy = 'return' | 'fail';
-export interface ClaimedOptions {
-    /**
-     * What to do when another participant has claimed the target: `return` lets
-     * the read proceed; `fail` throws `AbloClaimedError`. Inspect claim state via
-     * `ablo.<model>.claim.state({ id })`. Waiting is a claim-side concern — take
-     * `ablo.<model>.claim({ id })` (it queues fairly); reads never block.
-     */
-    readonly ifClaimed?: IfClaimedPolicy;
-}
-export type { ClaimWaitOptions } from '../types/streams.js';
-export interface ModelReadOptions extends ClaimedOptions {
-}
-/**
- * The target a caller names when creating a claim: {@link ModelTarget} with its
- * one caller-authored member typed — `meta` is the shape declared on
- * `Register`'s `ClaimMeta` slot, the same declaration every reader of the claim
- * is given back.
- *
- * Derived rather than restated, and narrowed only here: `modelTargetSchema`
- * keeps parsing `meta` as an open record, because a peer on a newer build must
- * still be understood. The wire stays permissive; the DTO the caller writes
- * does not.
- */
-export type ModelTargetInput = Omit<ModelTarget, 'meta'> & {
-    readonly meta?: ResolveClaimMeta;
-};
-export interface ClaimCreateOptions {
-    readonly target: ModelTargetInput;
-    /** Peer-visible description of the work — the same field on every claim
-     *  surface. Defaults to `'editing'` when omitted. */
-    readonly description?: string;
-    readonly ttl?: Duration;
-    /**
-     * Join the server's fair FIFO queue when the target is already claimed,
-     * rather than failing immediately. `create` then resolves only once the
-     * lease is actually ours (the server pushes `claim_acquired` if the target
-     * was free, or `claim_granted` when we reach the head of the line). Without
-     * this, a contended claim throws. Used by `ablo.<model>.claim` so writers
-     * serialize instead of racing.
-     */
-    readonly queue?: boolean;
-    /** Cap on how long to wait for a queued grant before rejecting. */
-    readonly waitTimeoutMs?: number;
-    /**
-     * Backpressure: reject with `AbloClaimedError('queue_too_deep')` instead of
-     * waiting if the queue is already `>= maxQueueDepth` when we join.
-     */
-    readonly maxQueueDepth?: number;
-}
-export interface CommitOperationInput {
-    readonly action: ModelOperationAction;
-    /** The model name — matches `ablo.<model>` and the schema's `model()`. */
-    readonly model: string;
-    readonly id?: string | null;
-    readonly data?: Record<string, unknown> | null;
-    readonly transactionId?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: OnStaleMode | null;
-    /** Fencing token (Option B) from the batch's claim handle; server-validated. */
-    readonly fenceToken?: number | null;
-}
-export interface CommitCreateOptions {
-    readonly idempotencyKey?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: OnStaleMode | null;
-    /**
-     * A claim handle from `ablo.<model>.claim({ id })` (or the HTTP claim
-     * surface). Same vocabulary as the per-model writes: the handle's
-     * snapshot watermark becomes the batch `readAt` default and `onStale`
-     * defaults to `'reject'`, so a commit that follows a claim is guarded
-     * against concurrent edits without re-stating the watermark by hand.
-     * Explicit `readAt`/`onStale` on the options win.
-     */
-    readonly claim?: Claim | null;
-    /** One atomic batch. Use a one-element array for a single operation. */
-    readonly operations: readonly CommitOperationInput[];
-    readonly wait?: CommitWait;
-    /**
-     * The batch premise — the "did anything I looked at change?" guard.
-     * Declare the rows (`{ model, id, readAt, fields? }`) or sync groups
-     * (`{ group, readAt }`, for example `report:abc`) this batch was premised on; the
-     * server checks that none moved since `readAt` and fires the entry's `onStale`
-     * over the batch. This is distinct from the write-target `readAt`: it guards what
-     * you read, not what you write.
-     */
-    readonly reads?: readonly ReadDependency[] | null;
-    /**
-     * Durable premises to register as part of this batch — the persisted
-     * sibling of `reads`. Where `reads` guards only this commit, a `track` entry
-     * (`{ model, id, readAt? }` for a row or `{ group, readAt? }` for a sync group)
-     * lives on past it: a later matching change rides back on a future receipt's
-     * `notifications`. A track-only batch (just `track`, an empty `operations`) is
-     * the batch form of `ablo.<model>.track()`.
-     */
-    readonly track?: readonly TrackDependency[] | null;
-}
-/** Public projection inferred from the canonical runtime schema. */
-export type CommitReceipt = ClientCommitReceipt;
-export interface CommitResource {
-    create(options: CommitCreateOptions): Promise<CommitReceipt>;
-}
-export interface ClaimResource extends ClaimStream {
-    create(options: ClaimCreateOptions): Promise<Claim>;
-    list(target?: Partial<ModelTarget>): readonly ModelClaim[];
-    waitFor(target: Partial<ModelTarget>, options?: ClaimWaitOptions): Promise<void>;
-}
-export interface ModelMutationOptions extends ClaimedOptions {
-    readonly claimRef?: string | {
-        readonly id: string;
-    } | null;
-    readonly idempotencyKey?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: OnStaleMode | null;
-    readonly wait?: CommitWait;
-    readonly claim?: Claim | ClaimOptions | null;
-    /** Fencing token (Option B) from the claim; server-validated at commit. */
-    readonly fenceToken?: number | null;
-}
-/**
- * The stateless HTTP claim surface. Most code puts a `claim` directly on the write
- * (`update({ id, data, claim })`) and lets the SDK release it; reach for this
- * namespace for multi-step handles and coordination screens.
- *
- * It is the same surface as the reactive claim API, but because every read is a
- * server round-trip, `state`, `queue`, and `reorder` are awaited here. The
- * WebSocket client resolves those synchronously from its local cache, which is what
- * lets it read a claim's state inside a React render; a stateless client has no
- * cache to read, so the promise is unavoidable.
- *
- * It is derived from `ClaimReadApi` through {@link AwaitedClaimMethod} so the two
- * transports cannot drift: the only difference is the promise wrapper that
- * statelessness forces. `claim({ id })` is identical on both (already async);
- * `state`, `queue`, `reorder`, and `release` are the awaited form.
- */
-export type HttpClaimApi<T = Record<string, unknown>> = ((params: ClaimParams<T>) => Promise<HeldClaim<T>>) & {
-    [K in keyof ClaimReadApi<T>]: AwaitedClaimMethod<ClaimReadApi<T>[K]>;
-};
-/** A single data operation a scoped **agent** session may perform on a model.
- *  The SDK-facing name for {@link CapabilityOperation}; the vocabulary itself is
- *  declared once, as a schema, in `auth/capability.ts`. */
-export type SessionOperation = CapabilityOperation;
-/** Parameters for minting an end-user session — full data authority within the
- *  organization. Mints an `ek_` token. `user.id` is your end user's id from your
- *  own identity provider and becomes the session's `participantId`; Ablo does not
- *  model your users, so it is treated as an opaque string at the trust boundary. */
-export interface CreateUserSessionParams {
-    /** Your end user. `id` becomes the token's `participantId`. */
-    user: {
-        id: string;
-    };
-    /** Mint the session into this organization instead of the key's own — for a
-     *  platform that serves many tenants from one backend. Requires the `sk_` key to
-     *  carry the `ephemeral:mint-any-org` scope; omit it for the normal
-     *  single-tenant case. */
-    organizationId?: string;
-    /** Sync groups this session may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`; build with `syncGroup(kind, id)` from
-     *  `@abloatai/ablo/schema`). Omit for the server default:
-     *  `[org:<your org>, user:<user.id>]`. */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes). */
-    ttlSeconds?: number;
-    /** Opaque identity blob echoed back to the client as `ablo.user`. */
-    userMeta?: Record<string, unknown>;
-    agent?: never;
-    can?: never;
-}
-/** Mint params for a scoped **agent** session — mints a restricted `rk_` token
- *  gated to exactly the operations named in `can`. `can` is typed off your
- *  schema (no magic `'task.update'` strings): `{ Task: ['update'], Report: ['read'] }`
- *  — the SDK serializes each entry to the wire allowlist (`task.update`). */
-export interface CreateAgentSessionParams<S extends SchemaRecord> {
-    /** Your agent. `id` becomes the token's `participantId`. */
-    agent: {
-        id: string;
-    };
-    /** Per-model operation allowlist, typed against the schema's model names. */
-    can: CapabilityCan<S>;
-    /** Sync groups this session may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`; build with `syncGroup(kind, id)` from
-     *  `@abloatai/ablo/schema`). Omit for the server default: the org
-     *  anchor (`org:<your org>`) + the agent's own anchor. */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes). */
-    ttlSeconds?: number;
-    /** Opaque identity blob echoed back to the client as `ablo.agent`. */
-    userMeta?: Record<string, unknown>;
-    user?: never;
-}
-/** Params for {@link Ablo.sessions}.create — a discriminated union: pass
- *  `{ user }` for a full-authority end-user session (`ek_`) or `{ agent, can }`
- *  for a scoped agent session (`rk_`). */
-export type CreateSessionParams<S extends SchemaRecord> = CreateUserSessionParams | CreateAgentSessionParams<S>;
-/** Params for {@link Ablo.agents}.create — a flattened agent descriptor (no
- *  `{ agent }` discriminator: `agents.create` only ever mints an agent). Unlike
- *  {@link CreateSessionParams} it resolves to a connected, scoped {@link Ablo}
- *  client rather than a raw token. */
-export interface CreateAgentClientParams<S extends SchemaRecord> {
-    /** The wire participant identity (`agent:<id>`) that claim exclusion and the
-     *  FIFO queue gate on. Omit it to get a fresh random id — a distinct, independent
-     *  participant, which is the default and what you want for concurrent agents.
-     *  Pass a stable string only when one logical agent must re-attach to its own
-     *  held claims across reconnects or restarts. */
-    id?: string;
-    /** A human-readable label for logs and attribution (carried in `userMeta.name`).
-     *  It is independent of `id`: two agents that share a `name` still receive
-     *  distinct ids and coordinate as separate participants — `name` never derives or
-     *  collapses identity. */
-    name?: string;
-    /** Per-model operation allowlist, typed against the schema's model names. */
-    can: CapabilityCan<S>;
-    /** Sync groups this agent may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`). Omit for the server default (org anchor + the
-     *  agent's own anchor). */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes); the returned client
-     *  re-mints before expiry, so a long-running agent never handles rotation
-     *  itself. */
-    ttlSeconds?: number;
-    /** Extra opaque identity blob echoed on the session scope. Merged with
-     *  `name` (the `name` param wins if you also set `userMeta.name`). */
-    userMeta?: Record<string, unknown>;
-}
-/** A minted session. `token` is the secret the holder presents as its bearer. */
-export interface AbloSession {
-    object: 'session';
-    /** Stable id of the minted credential (for revocation). */
-    id: string;
-    /** The short-lived session token — `ek_` for a `{ user }` session, `rk_`
-     *  for an `{ agent }` session. Hand this to the participant's runtime. */
-    token: string;
-    /** ISO-8601 expiry. */
-    expiresAt: string;
-    organizationId: string;
-    /** The grant this token carries, on both axes — the same shape the key row
-     *  stores and the gates enforce. */
-    scope: CapabilityScope;
-    userMeta: Record<string, unknown>;
-}

package/dist/transaction/resources/httpResources.js

@@ -1,7 +0,0 @@
-/**
- * Shared resource types for the typed clients and private HTTP transport.
- * the commit and claim shapes, the session-mint params and resource, and the
- * {@link HttpClaimApi} derivation. This module holds only types and has no runtime
- * imports.
- */
-export {};

package/dist/transaction/resources/modelOperations.d.ts

@@ -1,319 +0,0 @@
-/**
- * The request contract for `ablo.<model>` — the option and parameter shapes a
- * caller passes to a read, a write, or a claim.
- *
- * These types describe the *change or the query being requested*, never a local
- * copy of the rows it touches, so they sit in the settlement core and are shared
- * by every transport and every caller (ADR 0013 §4, ADR 0016). The factory that
- * binds them to reactive model instances — `createModelProxy` — stays with the
- * reactive consumer, along with `ModelOperations` and `ModelCollaboration`,
- * which reference the live participant handle.
- */
-import type { ModelScope } from '../types/index.js';
-import type { ResolveClaimMeta } from '../types/global.js';
-import type { AbloClaimedError } from '../errors.js';
-import type { StaleNotification, TrackDependency } from '../coordination/schema.js';
-import type { Duration } from '../utils/duration.js';
-import type { Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease, TargetRange } from '../types/streams.js';
-import type { MutationOptions } from './mutationOptions.js';
-import type { LoadWhere } from './where.js';
-/**
- * A lifecycle filter, accepted either as the enum or as its bare string. The
- * string arm is a template projection of the enum rather than a second list, so
- * a scope added to {@link ModelScope} is spellable both ways at once.
- */
-export type ModelListScope = ModelScope | `${ModelScope}`;
-/**
- * Options for `track({ id })` — register a durable premise on a row.
- *
- * Derived from the wire's row-form {@link TrackDependency} rather than restated
- * beside it: the caller names the row and, optionally, the watermark it is
- * premised on, while `model` comes from the proxy the call was made on. Adding
- * a field to the dependency therefore reaches this surface automatically, and
- * removing one stops the callers compiling.
- *
- * On `readAt`: omit it to baseline at the current head — "tell me about
- * anything from here on". Pass a known watermark (the one you read the row at)
- * to also catch a change that landed between that read and this call.
- */
-export type ModelTrackParams = Omit<Extract<TrackDependency, {
-    model: string;
-}>, 'model'>;
-/** The result of `track({ id })`. */
-export interface ModelTrackResult {
-    /**
-     * Tracks that had ALREADY fired at registration time — a change matching an
-     * open track that landed before this call. Present only when something was
-     * already stale; the ongoing signal arrives on the receipts of later commits.
-     */
-    notifications?: StaleNotification[];
-}
-/** Options for the synchronous local-graph reads `local.list` and `onChange` —
- *  a JavaScript `filter`, an equality `where`, and a lifecycle `state`. This is
- *  the local, reactive axis; contrast {@link ServerReadOptions}, the
- *  asynchronous server axis. */
-export interface LocalReadOptions<T> {
-    where?: Partial<T>;
-    /** Arbitrary local predicate. Applied after `where`. */
-    filter?: (entity: T) => boolean;
-    orderBy?: {
-        [K in keyof T]?: 'asc' | 'desc';
-    };
-    limit?: number;
-    offset?: number;
-    /** Lifecycle filter — `live` (the default), `archived`, or `all`. Named
-     *  `state` so it does not collide with the sync-group `scope`. */
-    state?: ModelListScope;
-}
-export type LocalCountOptions<T> = Pick<LocalReadOptions<T>, 'where' | 'filter' | 'state'>;
-/** Options for the asynchronous server reads `retrieve` and `list` — the
- *  operator `where` filter, `type`, and `expand`. This is the server axis;
- *  contrast {@link LocalReadOptions}, the local, reactive axis. */
-export interface ServerReadOptions<T> {
-    /**
-     * Filter for the lookup. Accepts two forms:
-     *   - object form — `{ name: 'foo' }`: equality, where an array value means `IN`
-     *   - tuple form — `[['name', 'ILIKE', '%Goldman%']]`: explicit operators
-     *
-     * See {@link LoadWhere} for the full grammar. The wire protocol matches on AND
-     * only; for OR semantics, run two `list()` calls and union the results.
-     */
-    where?: LoadWhere<T>;
-    orderBy?: {
-        [K in keyof T]?: 'asc' | 'desc';
-    };
-    limit?: number;
-    /**
-     * `complete` waits for the server. `unknown` returns whatever is local
-     * immediately and refreshes in the background.
-     */
-    type?: 'complete' | 'unknown';
-    /**
-     * Schema-declared relation names to hydrate alongside the primary
-     * rows. The server's compiler resolves each name via the schema's
-     * relation metadata (`relation.belongsTo` / `relation.hasMany`)
-     * and emits the JOIN.
-     */
-    expand?: readonly string[];
-}
-/** Options for the single-row async server read `retrieve({ id })`. A subset of
- *  {@link ServerReadOptions} — `where`/`limit`/`orderBy` are fixed by the id. */
-export type ServerRetrieveOptions = Pick<ServerReadOptions<unknown>, 'type' | 'expand'>;
-export interface ClaimTargetOptions<T = Record<string, unknown>> {
-    /** Peer-visible description of the work being performed — the sentence a
-     *  contending participant reads to decide whether to wait, work elsewhere, or
-     *  move on. Defaults to `'editing'`. The same field on every claim surface. */
-    description?: string;
-    /** Field-level target, for fine-grained claimed-state badges. */
-    field?: string;
-    /**
-     * Several named parts of the row at once. Claims conflict where their sets
-     * intersect, so two holders on disjoint parts do not wait for each other.
-     * Prefer this to packing names into `field`, which compares as one opaque
-     * string and lets overlapping sets both be granted.
-     */
-    fields?: readonly string[];
-    /** Optional path for document/file-like targets. */
-    path?: string;
-    /** Optional range for document/file-like targets. */
-    range?: TargetRange;
-    /**
-     * App-defined structured metadata, carried verbatim to every participant
-     * that observes the claim. Declare its shape once, on `Register`'s
-     * `ClaimMeta` slot, and what you write here is what every reader is typed to
-     * find — the write side and the read side are the same declaration.
-     */
-    meta?: ResolveClaimMeta;
-    /** Crash-cleanup TTL — the claim auto-releases if the holder dies. */
-    ttl?: Duration;
-    /**
-     * Behavior under contention. `true` (the default) queues behind the current
-     * holder and resolves once the row is yours. `false` is fail-fast: if another
-     * participant already holds the row, it rejects immediately with
-     * {@link AbloClaimedError} instead of waiting. Use `false` to deduplicate
-     * distributed work ("if someone else has this job, skip it"), where waiting
-     * would mean double-processing.
-     *
-     * The high-level typed claim defaults this on because it serializes writers;
-     * the low-level lease and the HTTP client default it off, since they resolve
-     * immediately and cannot transparently wait for a grant.
-     */
-    queue?: boolean;
-    /**
-     * Backpressure: queue, but not behind too many others. If the server reports a
-     * position at or beyond `maxQueueDepth` when the client joins the line, it
-     * rejects with {@link AbloClaimedError} (`queue_too_deep`) instead of waiting.
-     * Omit to wait however deep the queue is.
-     */
-    maxQueueDepth?: number;
-    /**
-     * Keep the lease alive for the duration of real work by beating on a
-     * cadence — the pattern for background workers whose task outlives the
-     * crash-cleanup TTL. `true` beats every third of the TTL (so two beats can
-     * fail before the lease is at risk, and a crashed worker's lease still
-     * lapses within one beat window); a duration such as `'2m'` sets the
-     * cadence explicitly. The loop stops on release. A beat answered with a
-     * definitive loss stops the loop and calls {@link onHeartbeatLost}; you can
-     * also beat manually with `held.heartbeat()`.
-     */
-    heartbeat?: true | Duration;
-    /**
-     * Called once if the auto-heartbeat learns the lease is no longer yours
-     * (expired and possibly granted onward). The loop has already stopped;
-     * abandon the work or re-claim. Any write attempted under the old lease is
-     * independently rejected by its `readAt` guard.
-     */
-    onHeartbeatLost?: (error: AbloClaimedError) => void;
-    /**
-     * Called after every successful beat (manual or auto) with the server's
-     * answer — chiefly `queueDepth`, the number of participants waiting in
-     * line behind this lease. A worker that can checkpoint may read pressure
-     * here and release early when others wait.
-     */
-    onHeartbeat?(beat: ClaimHeartbeat): void;
-}
-/** Options for `claim({ id, ... })`. */
-export interface ClaimParams<T = Record<string, unknown>> extends ClaimTargetOptions<T> {
-    readonly id: string;
-}
-export interface ClaimLookupParams<T = Record<string, unknown>> {
-    readonly id: string;
-    readonly field?: string;
-}
-export interface ClaimReorderParams<T = Record<string, unknown>> extends ClaimLookupParams<T> {
-    readonly order: readonly Claim[];
-}
-/**
- * A claim handle: the held entity data plus an explicit release hook.
- *
- * ```ts
- * const claim = await ablo.weatherReports.claim({
- *   id: 'report_stockholm',
- *   description: 'Fetching current weather before writing the forecast.',
- * });
- * try {
- *   await ablo.weatherReports.update({
- *     id: claim.target.id,
- *     data: { status: 'ready' },
- *     claim,
- *   });
- * } finally {
- *   await claim.release();
- * }
- * ```
- *
- * `data` is a snapshot taken after the lease is held. Write through the flat
- * `ablo.<model>.update({ id, data, claim })` verb — the handle carries the
- * lease id and snapshot watermark for attribution and stale-write protection.
- */
-export type { Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease };
-export type ClaimOptions<T = Record<string, unknown>> = ClaimTargetOptions<T>;
-/**
- * The coordination surface for a model, exposed as a callable namespace.
- *
- * Most callers do not need this namespace directly. Put `claim: { ... }` on a
- * write and the SDK acquires/releases around that one mutation:
- *
- * ```ts
- * await ablo.tasks.update({
- *   id,
- *   data: { title },
- *   claim: {
- *     field: 'title',
- *     description: 'Renaming the task to match the project brief.',
- *   },
- * });
- * ```
- *
- * Use `claim({ id, ... })` when a tool spans multiple writes and needs one
- * handle. `state`, `queue`, and `reorder` are coordination reads/scheduler
- * controls for UI and operators.
- */
-/**
- * The coordination reads and scheduler controls on a claim namespace, in their
- * reactive (synchronous) form: `state`, `queue`, and `reorder` resolve against
- * the local pool with no round-trip, which is what lets a reactive selector read
- * coordination state inside a React render.
- *
- * This is the single source of truth for the claim read surface. The stateless
- * HTTP client exposes the awaited projection of exactly these methods (derived
- * via {@link AwaitedClaimMethod}), so the two transports cannot drift — change a
- * signature here and the HTTP surface follows.
- */
-export interface ClaimReadApi<T = Record<string, unknown>> {
-    /**
-     * Current holder for a row, or `null` when free. Use this for UI badges and
-     * preflight checks, not for the normal write path.
-     *
-     * `target.meta` reads as the shape declared on `Register`'s `ClaimMeta`
-     * slot, so no read of it needs a guard. Pass `M` only to override that
-     * declaration for one call — `state<OtherMeta>({ id })` — which a program
-     * carrying more than one meta shape occasionally needs.
-     */
-    state<M = ResolveClaimMeta>(params: ClaimLookupParams<T>): Claim<Record<string, unknown>, M> | null;
-    /**
-     * FIFO wait line behind the current holder. Advanced: useful for operator
-     * UIs and schedulers. Takes the same `meta` parameter as
-     * {@link ClaimReadApi.state}.
-     */
-    queue<M = ResolveClaimMeta>(params: ClaimLookupParams<T>): {
-        readonly object: 'list';
-        readonly data: readonly Claim<Record<string, unknown>, M>[];
-    };
-    /**
-     * Re-rank the wait line. Advanced and permission-gated.
-     */
-    reorder(params: ClaimReorderParams<T>): void;
-    /** Release a manual claim handle early. Single-write claims auto-release. */
-    release(params: ClaimLookupParams<T> | Claim<T>): Promise<void>;
-}
-/**
- * The awaited form of a claim method: a synchronous return becomes a `Promise`,
- * an already-async one (`release`) is left untouched. Used to derive the
- * stateless HTTP claim surface from the reactive {@link ClaimReadApi}.
- */
-export type AwaitedClaimMethod<F> = F extends (...args: infer A) => infer R ? R extends Promise<unknown> ? (...args: A) => R : (...args: A) => Promise<R> : F;
-export interface ClaimApi<T> extends ClaimReadApi<T> {
-    /**
-     * Takes a claim and returns an explicit held-work handle — a {@link HeldClaim}.
-     * `data`, `release`, `revoke`, and the async disposer are always present (this
-     * call re-reads the row under the lease), so callers can use `handle.data`
-     * directly and `await using` works without a guard.
-     */
-    (params: ClaimParams<T>): Promise<HeldClaim<T>>;
-    /**
-     * Takes a claim by id alone, for a row that lives only in the customer's own
-     * database — Ablo has never seen it, so there is nothing to re-read. Returns a
-     * {@link HeldLease}: the same lease controls as {@link HeldClaim}
-     * (`release`, `revoke`, `heartbeat`, `await using`) but no `.data`. Locking a
-     * key you know by id is exactly this — serialize writers without first
-     * syncing the row into Ablo.
-     */
-    (id: string, opts?: ClaimOptions<T>): Promise<HeldLease>;
-}
-export interface ModelRetrieveParams extends ServerRetrieveOptions {
-    readonly id: string;
-}
-export interface ModelCreateParams<T, CreateInput> extends MutationOptions {
-    readonly data: CreateInput;
-    readonly id?: string | null;
-    readonly claim?: Claim<T> | ClaimTargetOptions<T> | null;
-}
-export interface ModelUpdateParams<T> extends MutationOptions {
-    readonly id: string;
-    readonly data: Partial<T>;
-    readonly claim?: Claim<T> | ClaimTargetOptions<T> | null;
-}
-export interface ModelDeleteParams<T> extends MutationOptions {
-    readonly id: string;
-    readonly claim?: Claim<T> | ClaimTargetOptions<T> | null;
-}
-/** Options for the WebSocket-only `ablo.<model>.join(ids, options?)`. */
-export interface JoinOptions {
-    /**
-     * Lease TTL for the underlying presence claim — the participant
-     * auto-releases after this if the holder dies. Compact duration string
-     * (`'5m'`) or ms number, mirroring the claim `ttl`.
-     */
-    ttl?: Duration;
-}

package/dist/transaction/resources/modelOperations.js

@@ -1,12 +0,0 @@
-/**
- * The request contract for `ablo.<model>` — the option and parameter shapes a
- * caller passes to a read, a write, or a claim.
- *
- * These types describe the *change or the query being requested*, never a local
- * copy of the rows it touches, so they sit in the settlement core and are shared
- * by every transport and every caller (ADR 0013 §4, ADR 0016). The factory that
- * binds them to reactive model instances — `createModelProxy` — stays with the
- * reactive consumer, along with `ModelOperations` and `ModelCollaboration`,
- * which reference the live participant handle.
- */
-export {};

package/dist/transaction/resources/mutationOptions.d.ts

@@ -1,66 +0,0 @@
-/**
- * Per-call options accepted by any mutation.
- *
- * Every field here defines, orders, settles, or authorises *the change itself*
- * — request identity, commit disposition, fencing, and the premise it rests on.
- * None of it touches a local copy of rows, so it belongs with the settlement
- * core rather than the reactive consumer (ADR 0013 §4, ADR 0016).
- */
-import type { CommitWait } from '../wire/commit.js';
-import type { OnStaleMode, ReadDependency, TrackDependency } from '../coordination/schema.js';
-/**
- * Per-call options accepted by any mutation, passed as the last argument.
- * Every field is optional; omitted fields fall back to sensible defaults.
- *
- * - `idempotencyKey` — when set, the server caches the response for 24 hours and
- *   returns the cached result on any retry using the same key. When omitted, the
- *   SDK generates a fresh UUID per mutation, so every call is retry-safe by
- *   default. `null` is retained for source compatibility and is treated like
- *   omission; write retries never opt out of request identity.
- * - `label` — a human-readable tag recorded with the mutation for debugging, such
- *   as "nightly cleanup" or "user click".
- */
-export interface MutationOptions {
-    idempotencyKey?: string | null;
-    label?: string;
-    wait?: CommitWait;
-    readAt?: number | null;
-    onStale?: OnStaleMode | null;
-    /**
-     * The fencing token (Option B) of the held claim this write belongs to. The
-     * server validates it against the entity's persisted high-water and rejects a
-     * stale token. Sourced from the claim handle, never set by hand.
-     */
-    fenceToken?: number | null;
-    /** The id (or `{ id }`) of the claim this write belongs to. This is the
-     *  low-level reference the commit carries so the write is attributed to a claim
-     *  and can pass the holder's own lock. It is distinct from the `claim` handle on
-     *  the model write parameters, which is the higher-level object you usually pass. */
-    claimRef?: string | {
-        readonly id: string;
-    } | null;
-    /**
-     * The batch premise — the answer to "did anything I looked at change?" Each
-     * entry is a row (`{ model, id, readAt, fields? }`) or a sync group
-     * (`{ group, readAt }`) that this write was premised on. The server checks
-     * that none of them moved since their `readAt` and applies the entry's
-     * `onStale` behavior to the whole batch. This is distinct from the per-operation
-     * `readAt`, which guards only the row being written.
-     *
-     * See `packages/sync-engine/docs/concurrency-convention.md` (§3 the two
-     * premises, §4 the batch premise) for the governing convention.
-     */
-    reads?: ReadDependency[] | null;
-    /**
-     * Durable premises — what this write (or the record it produces) should
-     * keep watching. Unlike `reads`, which is checked once at commit and discarded,
-     * each `track` entry is persisted and re-checked against every future delta; a
-     * later matching change opens a `StaleNotification` for the tracking participant,
-     * delivered at their next commit or live to a held claim. Each entry is a row
-     * (`{ model, id }`) or a sync group (`{ group }`), optionally pinned to a `readAt`
-     * baseline (defaults to this commit's watermark).
-     *
-     * See `packages/sync-engine/docs/groups.md` for how `track` drives propagation.
-     */
-    track?: TrackDependency[] | null;
-}