@abloatai/ablo 0.35.0 → 0.37.0

package/dist/transaction/schema/tenancy.d.ts

@@ -1,139 +0,0 @@
-/**
- * Defines how a model's rows are scoped to a tenant. Two forms live here, and the
- * separation between them is deliberate:
- *
- *   1. The canonical form, {@link Tenancy} — a discriminated union that every
- *      consumer reads (provisioning and row-level security, introspection, the
- *      runtime, and the CLI) and the shape that crosses the wire in `ModelJSON`.
- *      One exhaustively switchable shape, so the type system enforces the isolation
- *      boundary.
- *   2. The authoring form, {@link PolicyInput} — the `policy: { by }` option a
- *      schema author writes. The name follows SQL row-level security, where a
- *      policy is the rule that decides which rows a tenant may read.
- *      {@link resolvePolicy} converts it to the canonical {@link Tenancy} when the
- *      model is built, so the authoring vocabulary never reaches the wire or any
- *      consumer.
- *
- * The canonical form is an exhaustively switchable discriminated union, so the type
- * system enforces the isolation boundary at every consumer. The authoring form is a
- * flat object whose `by` names the choice and whose per-branch rules are checked by a
- * refinement — the opt-out from tenant scoping (`{ by: 'none' }`) and the
- * source-derived case (`{ by: 'source' }`) are explicit, named values rather than
- * falsy flags, important because `none` makes an entire table readable across tenants.
- */
-import { z } from 'zod';
-/** The default physical tenancy column. This is the single canonical definition of that column name. */
-export declare const DEFAULT_ORG_COLUMN = "organization_id";
-/**
- * Scopes a table's rows through a parent table, for rows that carry no tenancy
- * column of their own (for example, blocks scoped through their section, report,
- * and organization). This is the canonical `parent` payload; authors write the
- * friendlier {@link PolicyInput} `{ by: 'parent', fk, parent }` form, which
- * {@link resolvePolicy} normalizes into this.
- */
-export declare const scopedViaRefSchema: z.ZodObject<{
-    localKey: z.ZodString;
-    parentTable: z.ZodString;
-    parentKey: z.ZodOptional<z.ZodString>;
-    parentOrgColumn: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type ScopedViaRef = z.infer<typeof scopedViaRefSchema>;
-/** How a model's rows are scoped to a tenant — the canonical, wire-facing form. */
-export declare const tenancySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kind: z.ZodLiteral<"column">;
-    column: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"parent">;
-    via: z.ZodObject<{
-        localKey: z.ZodString;
-        parentTable: z.ZodString;
-        parentKey: z.ZodOptional<z.ZodString>;
-        parentOrgColumn: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"none">;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"source">;
-}, z.core.$strip>], "kind">;
-export type Tenancy = z.infer<typeof tenancySchema>;
-/**
- * The authoring form of tenancy — what a schema author writes as the model's
- * `policy` option. The name follows SQL row-level security, where a policy is the
- * rule that decides which rows a tenant may read.
- *
- * The four choices `by` can take:
- *
- * - `{ by: 'column' }` — a row-local tenancy column (the default). `column`
- *   overrides the name (default {@link DEFAULT_ORG_COLUMN}).
- * - `{ by: 'parent', fk, parent }` — inherit tenancy through a foreign key when
- *   this table has no tenancy column of its own. `parentKey` (default `'id'`) and
- *   `parentTenantColumn` (default {@link DEFAULT_ORG_COLUMN}) are optional overrides.
- * - `{ by: 'source' }` — derive the organization from the connected source that
- *   registered the model, for a single-tenant connected database that carries no
- *   `organization_id` column. The registration is the tenant boundary.
- * - `{ by: 'none' }` — genuinely global or reference data. This makes the whole
- *   table readable across tenants, so it is correct only for tables that have no tenant.
- *
- * The runtime schema is one flat object rather than a discriminated union: `by`
- * selects the branch, and the {@link https://zod.dev | superRefine} pass enforces
- * the per-branch field rules (`parent` requires `fk` and `parent`; the other three
- * take no branch fields). The exported {@link PolicyInput} type is hand-written as a
- * precise union so the compiler still requires the right fields per `by` — the flat
- * schema validates at runtime, the union guides at author time, and the type guard
- * below keeps the two from drifting.
- */
-export declare const policyInputSchema: z.ZodObject<{
-    by: z.ZodEnum<{
-        none: "none";
-        source: "source";
-        column: "column";
-        parent: "parent";
-    }>;
-    column: z.ZodOptional<z.ZodString>;
-    fk: z.ZodOptional<z.ZodString>;
-    parent: z.ZodOptional<z.ZodString>;
-    parentKey: z.ZodOptional<z.ZodString>;
-    parentTenantColumn: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-/**
- * The precise authoring type. Hand-written rather than inferred from
- * {@link policyInputSchema} so the compiler enforces the per-branch fields the flat
- * runtime schema can only check at parse time — an author writing `{ by: 'parent' }`
- * gets a type error for the missing `fk`/`parent`, not a runtime one.
- */
-export type PolicyInput = {
-    by: 'column';
-    column?: string;
-} | {
-    by: 'parent';
-    fk: string;
-    parent: string;
-    parentKey?: string;
-    parentTenantColumn?: string;
-} | {
-    by: 'source';
-} | {
-    by: 'none';
-};
-/**
- * Normalizes the authoring {@link PolicyInput} into the canonical {@link Tenancy}.
- * Called once, when the model is built, so that `ModelDef`, `ModelJSON`, and every
- * consumer see only the canonical union. Omitting `policy` defaults to a row-local
- * `organization_id` column.
- */
-export declare function resolvePolicy(input?: PolicyInput): Tenancy;
-/**
- * Reads the canonical {@link Tenancy} off an already-built model definition (or a
- * parsed `ModelJSON`), defaulting to a row-local `organization_id` column when it is
- * absent.
- *
- * This is the read-side helper. Consumers — provisioning and row-level security, the
- * membership resolver, DDL generation, and the CLI — call it to get a model's
- * tenancy without re-deriving the default each time. It is not the authoring
- * normalizer; that is {@link resolvePolicy}.
- */
-export declare function resolveTenancy(def: {
-    tenancy?: Tenancy;
-}): Tenancy;
-/** The physical tenancy column for a column-scoped model, else `null`. */
-export declare function tenancyColumn(t: Tenancy): string | null;

package/dist/transaction/schema/tenancy.js

@@ -1,190 +0,0 @@
-/**
- * Defines how a model's rows are scoped to a tenant. Two forms live here, and the
- * separation between them is deliberate:
- *
- *   1. The canonical form, {@link Tenancy} — a discriminated union that every
- *      consumer reads (provisioning and row-level security, introspection, the
- *      runtime, and the CLI) and the shape that crosses the wire in `ModelJSON`.
- *      One exhaustively switchable shape, so the type system enforces the isolation
- *      boundary.
- *   2. The authoring form, {@link PolicyInput} — the `policy: { by }` option a
- *      schema author writes. The name follows SQL row-level security, where a
- *      policy is the rule that decides which rows a tenant may read.
- *      {@link resolvePolicy} converts it to the canonical {@link Tenancy} when the
- *      model is built, so the authoring vocabulary never reaches the wire or any
- *      consumer.
- *
- * The canonical form is an exhaustively switchable discriminated union, so the type
- * system enforces the isolation boundary at every consumer. The authoring form is a
- * flat object whose `by` names the choice and whose per-branch rules are checked by a
- * refinement — the opt-out from tenant scoping (`{ by: 'none' }`) and the
- * source-derived case (`{ by: 'source' }`) are explicit, named values rather than
- * falsy flags, important because `none` makes an entire table readable across tenants.
- */
-import { z } from 'zod';
-/** The default physical tenancy column. This is the single canonical definition of that column name. */
-export const DEFAULT_ORG_COLUMN = 'organization_id';
-/**
- * Scopes a table's rows through a parent table, for rows that carry no tenancy
- * column of their own (for example, blocks scoped through their section, report,
- * and organization). This is the canonical `parent` payload; authors write the
- * friendlier {@link PolicyInput} `{ by: 'parent', fk, parent }` form, which
- * {@link resolvePolicy} normalizes into this.
- */
-export const scopedViaRefSchema = z.object({
-    /** Column on this table that points at the parent (for example, `'team_id'`). */
-    localKey: z.string().min(1),
-    /** Parent table name (e.g. `'team'`). */
-    parentTable: z.string().min(1),
-    /** Column on the parent that `localKey` references. Default `'id'`. */
-    parentKey: z.string().min(1).optional(),
-    /** Column on the parent holding the tenant id. Default {@link DEFAULT_ORG_COLUMN}. */
-    parentOrgColumn: z.string().min(1).optional(),
-});
-/** How a model's rows are scoped to a tenant — the canonical, wire-facing form. */
-export const tenancySchema = z.discriminatedUnion('kind', [
-    /** Row-local tenancy column (default name `organization_id`, overridable). */
-    z.object({ kind: z.literal('column'), column: z.string().min(1) }),
-    /** Scoped through a parent table's tenancy. */
-    z.object({ kind: z.literal('parent'), via: scopedViaRefSchema }),
-    /** Not tenant-scoped (global / reference data). */
-    z.object({ kind: z.literal('none') }),
-    /**
-     * Scoped by the data source itself: the model carries no tenancy column, and the
-     * owning organization is derived from the connected source that registered it — the
-     * registration is the tenant boundary. This is the natural default for a
-     * single-tenant connected database (`ablo connect`), which holds one org's rows and
-     * so has no per-row `organization_id` to read. Carries no payload for the same
-     * reason `none` does: the binding lives in the source registration, not the model.
-     */
-    z.object({ kind: z.literal('source') }),
-]);
-/**
- * The authoring form of tenancy — what a schema author writes as the model's
- * `policy` option. The name follows SQL row-level security, where a policy is the
- * rule that decides which rows a tenant may read.
- *
- * The four choices `by` can take:
- *
- * - `{ by: 'column' }` — a row-local tenancy column (the default). `column`
- *   overrides the name (default {@link DEFAULT_ORG_COLUMN}).
- * - `{ by: 'parent', fk, parent }` — inherit tenancy through a foreign key when
- *   this table has no tenancy column of its own. `parentKey` (default `'id'`) and
- *   `parentTenantColumn` (default {@link DEFAULT_ORG_COLUMN}) are optional overrides.
- * - `{ by: 'source' }` — derive the organization from the connected source that
- *   registered the model, for a single-tenant connected database that carries no
- *   `organization_id` column. The registration is the tenant boundary.
- * - `{ by: 'none' }` — genuinely global or reference data. This makes the whole
- *   table readable across tenants, so it is correct only for tables that have no tenant.
- *
- * The runtime schema is one flat object rather than a discriminated union: `by`
- * selects the branch, and the {@link https://zod.dev | superRefine} pass enforces
- * the per-branch field rules (`parent` requires `fk` and `parent`; the other three
- * take no branch fields). The exported {@link PolicyInput} type is hand-written as a
- * precise union so the compiler still requires the right fields per `by` — the flat
- * schema validates at runtime, the union guides at author time, and the type guard
- * below keeps the two from drifting.
- */
-export const policyInputSchema = z
-    .object({
-    by: z.enum(['column', 'parent', 'none', 'source']),
-    /** `by: 'column'` — override the physical tenancy column name. Default {@link DEFAULT_ORG_COLUMN}. */
-    column: z.string().min(1).optional(),
-    /** `by: 'parent'` — column on this table that points at the parent (for example, `'sectionId'`). */
-    fk: z.string().min(1).optional(),
-    /** `by: 'parent'` — parent table name (e.g. `'sections'`). */
-    parent: z.string().min(1).optional(),
-    /** `by: 'parent'` — column on the parent that `fk` references. Default `'id'`. */
-    parentKey: z.string().min(1).optional(),
-    /** `by: 'parent'` — column on the parent holding the tenant id. Default {@link DEFAULT_ORG_COLUMN}. */
-    parentTenantColumn: z.string().min(1).optional(),
-})
-    .superRefine((policy, ctx) => {
-    if (policy.by === 'parent') {
-        if (!policy.fk) {
-            ctx.addIssue({
-                code: z.ZodIssueCode.custom,
-                path: ['fk'],
-                message: "A `by: 'parent'` policy needs `fk` — the column on this table that points at the parent row whose tenancy it inherits.",
-            });
-        }
-        if (!policy.parent) {
-            ctx.addIssue({
-                code: z.ZodIssueCode.custom,
-                path: ['parent'],
-                message: "A `by: 'parent'` policy needs `parent` — the name of the parent table this table is scoped through.",
-            });
-        }
-    }
-    // A `column` policy may carry `column`; the parent fields belong only to `parent`.
-    // Flag a field that landed on the wrong branch so a typo doesn't silently no-op.
-    const parentOnly = ['fk', 'parent', 'parentKey', 'parentTenantColumn'];
-    if (policy.by !== 'parent') {
-        for (const field of parentOnly) {
-            if (policy[field] !== undefined) {
-                ctx.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    path: [field],
-                    message: `\`${field}\` only applies to a \`by: 'parent'\` policy; remove it or set \`by: 'parent'\`.`,
-                });
-            }
-        }
-    }
-    if (policy.by !== 'column' && policy.column !== undefined) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ['column'],
-            message: "`column` only applies to a `by: 'column'` policy; remove it or set `by: 'column'`.",
-        });
-    }
-});
-const _policyInputAssignable = [
-    true,
-    true,
-];
-void _policyInputAssignable;
-/**
- * Normalizes the authoring {@link PolicyInput} into the canonical {@link Tenancy}.
- * Called once, when the model is built, so that `ModelDef`, `ModelJSON`, and every
- * consumer see only the canonical union. Omitting `policy` defaults to a row-local
- * `organization_id` column.
- */
-export function resolvePolicy(input) {
-    if (!input)
-        return { kind: 'column', column: DEFAULT_ORG_COLUMN };
-    switch (input.by) {
-        case 'column':
-            return { kind: 'column', column: input.column ?? DEFAULT_ORG_COLUMN };
-        case 'parent':
-            return {
-                kind: 'parent',
-                via: {
-                    localKey: input.fk,
-                    parentTable: input.parent,
-                    parentKey: input.parentKey,
-                    parentOrgColumn: input.parentTenantColumn,
-                },
-            };
-        case 'source':
-            return { kind: 'source' };
-        case 'none':
-            return { kind: 'none' };
-    }
-}
-/**
- * Reads the canonical {@link Tenancy} off an already-built model definition (or a
- * parsed `ModelJSON`), defaulting to a row-local `organization_id` column when it is
- * absent.
- *
- * This is the read-side helper. Consumers — provisioning and row-level security, the
- * membership resolver, DDL generation, and the CLI — call it to get a model's
- * tenancy without re-deriving the default each time. It is not the authoring
- * normalizer; that is {@link resolvePolicy}.
- */
-export function resolveTenancy(def) {
-    return def.tenancy ?? { kind: 'column', column: DEFAULT_ORG_COLUMN };
-}
-/** The physical tenancy column for a column-scoped model, else `null`. */
-export function tenancyColumn(t) {
-    return t.kind === 'column' ? t.column : null;
-}

package/dist/transaction/transactionLayer.d.ts

@@ -1,82 +0,0 @@
-/**
- * The transaction layer's seam — the surface the sync engine (and any other
- * caller) sits on. ADR 0013's thesis as an interface: the layer defines,
- * orders, settles, and authorizes changes; it holds no materialised state.
- *
- * `observe()` is the whole seam in one method. The sync engine is `observe()`
- * piped into a materializer — deltas → local store → IndexedDB → reactive
- * re-render — plus local optimistic mutations reconciled against `commit()` /
- * `settled()`. Everything reactive is downstream of that method; the
- * transaction layer never calls up into it.
- *
- * `participant` stays the WHO (user | agent | system), never the name of this.
- * The taught verbs map onto the seam directly: `create`/`update`/`delete` are
- * operations inside a `commit()` payload; `claim` is `claim()`; `track` rides
- * the commit payload's `track` field (a durable premise is a zero-operation
- * commit). Presence (`join`) is deliberately absent: it is live observation
- * over a socket, and it joins the seam when its core carrier type exists —
- * see docs/plans/transaction-core-language.md, Tier 3.
- *
- * This is the contract, not a runtime: nothing in this package implements it
- * yet. The first explicit implementation (a headless client, a test harness)
- * gains a compile-time conformance pin against this interface.
- */
-import type { CommitMessage } from './wire/frames.js';
-import type { CommitReceiptWire } from './wire/commit.js';
-import type { Delta, HeldClaim, ClaimTarget, ClaimLeaseOptions } from './types/streams.js';
-import type { ModelData } from './types/modelData.js';
-import type { ModelScope } from './types/index.js';
-/**
- * A commit's durable acceptance — `{ status: 'queued' }` with the correlation
- * the settlement feed later confirms. The wire layer names this
- * {@link CommitReceiptWire}; the seam names it plainly.
- */
-export type CommitReceipt = CommitReceiptWire;
-/**
- * The seam's read grammar for {@link TransactionLayer.list} — filter, order,
- * and page through settled rows. Mirrors the taught list options
- * (`where` / `orderBy` / `limit` / `offset` / `state`) without binding the
- * seam to the client's local-read machinery.
- */
-export interface ListQuery {
-    /** Equality filter on field values. */
-    where?: ModelData;
-    /** Sort order, field → direction. */
-    orderBy?: Record<string, 'asc' | 'desc'>;
-    limit?: number;
-    offset?: number;
-    /** Lifecycle filter; defaults to `'live'`. */
-    state?: `${ModelScope}`;
-}
-/**
- * The transaction layer. Reads return settled state, point-in-time — never a
- * reactive subscription. A write is an intent submitted through `commit()`;
- * durable acceptance is the receipt (`queued`), and `settled()` resolves when
- * the sync log has appended it (`confirmed`).
- */
-export interface TransactionLayer {
-    /** Authentication: mint or renew the short-lived credential (`ek_`). */
-    ready(): Promise<void>;
-    /** Read one settled row by id, or `null` when absent. */
-    get(model: string, id: string): Promise<ModelData | null>;
-    /** Read settled rows matching a {@link ListQuery}. */
-    list(model: string, query?: ListQuery): Promise<ModelData[]>;
-    /**
-     * Submit a batch of operations — with its idempotent `clientTxId`, its
-     * `reads` premise, and any durable `track` registrations — and receive
-     * durable acceptance.
-     */
-    commit(payload: CommitMessage['payload']): Promise<CommitReceipt>;
-    /** Resolve when the receipt's operations have appended to the sync log. */
-    settled(receipt: CommitReceipt): Promise<void>;
-    /**
-     * Take a FIFO lease with a fence token on a target; release through the
-     * handle (`await using` disposes it).
-     */
-    claim(target: ClaimTarget, options?: ClaimLeaseOptions): Promise<HeldClaim>;
-    /**
-     * The authoritative change feed, scoped to one or more sync groups —
-     * omitted, everything the credential can see.
-     */
-    observe(scope?: string | readonly string[]): AsyncIterable<Delta>;
-}

package/dist/transaction/transactionLayer.js

@@ -1,24 +0,0 @@
-/**
- * The transaction layer's seam — the surface the sync engine (and any other
- * caller) sits on. ADR 0013's thesis as an interface: the layer defines,
- * orders, settles, and authorizes changes; it holds no materialised state.
- *
- * `observe()` is the whole seam in one method. The sync engine is `observe()`
- * piped into a materializer — deltas → local store → IndexedDB → reactive
- * re-render — plus local optimistic mutations reconciled against `commit()` /
- * `settled()`. Everything reactive is downstream of that method; the
- * transaction layer never calls up into it.
- *
- * `participant` stays the WHO (user | agent | system), never the name of this.
- * The taught verbs map onto the seam directly: `create`/`update`/`delete` are
- * operations inside a `commit()` payload; `claim` is `claim()`; `track` rides
- * the commit payload's `track` field (a durable premise is a zero-operation
- * commit). Presence (`join`) is deliberately absent: it is live observation
- * over a socket, and it joins the seam when its core carrier type exists —
- * see docs/plans/transaction-core-language.md, Tier 3.
- *
- * This is the contract, not a runtime: nothing in this package implements it
- * yet. The first explicit implementation (a headless client, a test harness)
- * gains a compile-time conformance pin against this interface.
- */
-export {};

package/dist/transaction/transactions/settlement/commitEnvelope.d.ts

@@ -1,143 +0,0 @@
-/**
- * Runtime contracts for retry-safe commits.
- *
- * `commitEnvelopeMemberSchema` is the compact pointer stored on an in-memory
- * transaction. `durableCommitEnvelopeSchema` is the actual outbox record: one
- * atomic IndexedDB value containing the stable request key, exact ordered wire
- * operations, and the source mutations it supersedes.
- */
-import { z } from 'zod';
-export declare const COMMIT_ENVELOPE_VERSION: 1;
-export declare const COMMIT_ENVELOPE_RECORD_PREFIX = "commit-envelope:";
-/** One transaction's position in a commit; this is not the envelope itself. */
-export declare const commitEnvelopeMemberSchema: z.ZodObject<{
-    idempotencyKey: z.core.$ZodBranded<z.ZodString, "IdempotencyKey", "out">;
-    operationIndex: z.ZodNumber;
-    operationCount: z.ZodNumber;
-    sealedAt: z.ZodOptional<z.ZodNumber>;
-    sequence: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>;
-export type CommitEnvelopeMember = z.infer<typeof commitEnvelopeMemberSchema>;
-/** One operation stored exactly as the current commit transport sends it. */
-export declare const durableCommitOperationSchema: z.ZodObject<{
-    type: z.ZodEnum<{
-        CREATE: "CREATE";
-        UPDATE: "UPDATE";
-        DELETE: "DELETE";
-        ARCHIVE: "ARCHIVE";
-        UNARCHIVE: "UNARCHIVE";
-    }>;
-    readAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-    onStale: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
-        reject: "reject";
-        overwrite: "overwrite";
-        notify: "notify";
-    }>>>;
-    fenceToken: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-    model: z.ZodString;
-    id: z.ZodString;
-    input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    transactionId: z.ZodOptional<z.ZodString>;
-    options: z.ZodOptional<z.ZodObject<{
-        idempotencyKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        label: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-}, z.core.$strip>;
-export type DurableCommitOperation = z.infer<typeof durableCommitOperationSchema>;
-export type DurableCommitOperationInput = z.input<typeof durableCommitOperationSchema>;
-export declare const commitOutboxScopeSchema: z.ZodObject<{
-    organizationId: z.ZodString;
-    participantId: z.ZodString;
-    namespace: z.ZodString;
-}, z.core.$strict>;
-export type CommitOutboxScope = z.infer<typeof commitOutboxScopeSchema>;
-/**
- * One crash-durable logical commit. Keeping every operation in one record makes
- * membership and order atomic: recovery can observe the old record or the new
- * record, never half an envelope.
- */
-export declare const durableCommitEnvelopeSchema: z.ZodObject<{
-    id: z.ZodString;
-    type: z.ZodLiteral<"commit_envelope">;
-    storageVersion: z.ZodLiteral<1>;
-    origin: z.ZodEnum<{
-        model_batch: "model_batch";
-        atomic_commit: "atomic_commit";
-    }>;
-    idempotencyKey: z.core.$ZodBranded<z.ZodString, "IdempotencyKey", "out">;
-    operations: z.ZodArray<z.ZodObject<{
-        type: z.ZodEnum<{
-            CREATE: "CREATE";
-            UPDATE: "UPDATE";
-            DELETE: "DELETE";
-            ARCHIVE: "ARCHIVE";
-            UNARCHIVE: "UNARCHIVE";
-        }>;
-        readAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-        onStale: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
-            reject: "reject";
-            overwrite: "overwrite";
-            notify: "notify";
-        }>>>;
-        fenceToken: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-        model: z.ZodString;
-        id: z.ZodString;
-        input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        transactionId: z.ZodOptional<z.ZodString>;
-        options: z.ZodOptional<z.ZodObject<{
-            idempotencyKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-            label: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>>;
-    }, z.core.$strip>>;
-    sourceMutationIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    commitOptions: z.ZodDefault<z.ZodObject<{
-        reads: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-            model: z.ZodString;
-            id: z.ZodString;
-            readAt: z.ZodNumber;
-            fields: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
-            onStale: z.ZodOptional<z.ZodEnum<{
-                reject: "reject";
-                overwrite: "overwrite";
-                notify: "notify";
-            }>>;
-        }, z.core.$strip>, z.ZodObject<{
-            group: z.ZodString;
-            readAt: z.ZodNumber;
-            onStale: z.ZodOptional<z.ZodEnum<{
-                reject: "reject";
-                overwrite: "overwrite";
-                notify: "notify";
-            }>>;
-        }, z.core.$strip>]>>>>;
-        track: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
-            model: z.ZodString;
-            id: z.ZodString;
-            readAt: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$strip>, z.ZodObject<{
-            group: z.ZodString;
-            readAt: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$strip>]>>>>;
-    }, z.core.$strict>>;
-    scope: z.ZodOptional<z.ZodObject<{
-        organizationId: z.ZodString;
-        participantId: z.ZodString;
-        namespace: z.ZodString;
-    }, z.core.$strict>>;
-    createdAt: z.ZodNumber;
-    sealedAt: z.ZodNumber;
-    acceptedAt: z.ZodOptional<z.ZodNumber>;
-    correlationId: z.ZodOptional<z.ZodString>;
-    sequence: z.ZodOptional<z.ZodNumber>;
-    timestamp: z.ZodNumber;
-}, z.core.$strict>;
-export type DurableCommitEnvelope = z.infer<typeof durableCommitEnvelopeSchema>;
-export declare function commitEnvelopeRecordId(idempotencyKey: string): string;
-/** Constructs validated member metadata when an in-memory batch is formed. */
-export declare function createCommitEnvelopeMember(value: z.input<typeof commitEnvelopeMemberSchema>): CommitEnvelopeMember;
-/**
- * Freezes the exact JSON request that will be persisted and sent. The shared
- * snapshot contract makes framework proxies plain and rejects values that
- * would be lost or corrupted by JSON serialization.
- */
-export declare function createDurableCommitEnvelope(value: Omit<z.input<typeof durableCommitEnvelopeSchema>, 'id' | 'type' | 'storageVersion' | 'timestamp'>): DurableCommitEnvelope;