@abloatai/ablo 0.36.0 → 0.37.1

package/dist/source-next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-next.d.ts","sourceRoot":"","sources":["../src/source-next.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC"}

package/dist/source-next.js

@@ -0,0 +1,2 @@
+export * from '@abloatai/transaction/source/next';
+//# sourceMappingURL=source-next.js.map

package/dist/source-next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-next.js","sourceRoot":"","sources":["../src/source-next.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC"}

package/dist/source.d.ts

@@ -0,0 +1,2 @@
+export * from '@abloatai/transaction/source';
+//# sourceMappingURL=source.d.ts.map

package/dist/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../src/source.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC"}

package/dist/source.js

@@ -0,0 +1,2 @@
+export * from '@abloatai/transaction/source';
+//# sourceMappingURL=source.js.map

package/dist/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../src/source.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC"}

package/dist/wire.d.ts

@@ -0,0 +1,2 @@
+export * from '@abloatai/transaction/wire';
+//# sourceMappingURL=wire.d.ts.map

package/dist/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../src/wire.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC"}

package/dist/wire.js

@@ -0,0 +1,2 @@
+export * from '@abloatai/transaction/wire';
+//# sourceMappingURL=wire.js.map

package/dist/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../src/wire.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC"}

package/docs/agents.md

@@ -34,7 +34,7 @@ const ablo = Ablo({ schema, apiKey: process.env.ABLO_API_KEY, transport: "http"
 // `retrieve` resolves to the row, or `undefined` when none matches.
 const open = await ablo.tasks.list({ where: { status: "todo" } });
 
-const task = await ablo.tasks.retrieve({ id: open[0].id });
+const task = await ablo.tasks.get({ id: open[0].id });
 if (!task) throw new Error("task not found");
 
 console.log(task.title);

package/docs/api-keys.md

@@ -33,8 +33,8 @@ That's the whole story: one knob, filled by audience.
 |---|---|---|
 | publishable `pk_` (client-safe) | `pk_` | browser: read-only |
 | secret `sk_` (server, full) | `sk_` | server: full authority |
-| restricted `rk_` (granular) | `rk_` | scoped agent sessions (`sessions.create({ agent, can })`) |
-| ephemeral key (client, customer-scoped) | `ek_` | per-user browser sessions (`sessions.create({ user })`) |
+| restricted `rk_` (granular) | `rk_` | scoped agents (`agents.create({ can })`) |
+| ephemeral key (client, customer-scoped) | `ek_` | per-user browser sessions (`sessions.create({ user, can })`) |
 
 Mode lives in the prefix too — `sk_test_` / `sk_live_` — exactly like Stripe. The
 `apiKey` resolver fetching an `ek_` is Ablo's ephemeral-key flow: server mints, client holds.
@@ -42,7 +42,7 @@ Mode lives in the prefix too — `sk_test_` / `sk_live_` — exactly like Stripe
 **Why a function for browser writes?** Anything you ship to a browser must be public, and a
 public `pk_` is **read-only** — it can't carry one specific user's write authority. So when
 the browser writes *as the logged-in user*, your backend (which holds the secret `sk_` and
-knows who's signed in) mints a short-lived per-user token with `sessions.create({ user })`,
+knows who's signed in) mints a short-lived per-user token with `sessions.create({ user, can })`,
 and the browser's `apiKey` function fetches it. You don't manage refresh — the SDK calls the
 function once before connecting and then keeps the token fresh (re-mint before expiry, and on
 tab-focus / network-online / device-wake). This is the Stripe ephemeral-key / Supabase
@@ -58,10 +58,11 @@ knobs, and you set exactly one.
 
 | Mint | Call | Result |
 |---|---|---|
-| Human end-user session | `await server.sessions.create({ user: { id } })` | `ek_` (full user authority) |
-| Scoped delegated agent | `await server.sessions.create({ agent: { id }, can: { Task: ['update'] } })` | `rk_` (scoped to `can`) |
+| Human end-user session | `await server.sessions.create({ user: { id }, can: { tasks: ['read'] } })` | `ek_` (scoped to `can`) |
+| Ready agent client | `await server.agents.create({ can: { tasks: ['update'] } })` | Auto-refreshing client scoped to `can` |
+| Raw delegated agent token | `await server.sessions.create({ agent: { id }, can: { tasks: ['update'] } })` | `rk_` for another runtime |
 
-The principal kind comes from *which* shape you pass — `{ user }` → `user`, `{ agent, can }` → `agent`.
+The principal kind comes from *which* shape you pass — `{ user, can }` → `user`, `{ agent, can }` → `agent`.
 
 ## Server-Side API Keys
 

package/docs/api.md

@@ -13,10 +13,10 @@ row, you can optionally `claim` it so they serialize instead of clobbering
 each other.
 
 Two things to know before the method list. **Reads come in two flavors:**
-`retrieve({ id })` / `list({ where })` are async — they answer from what is
+`get({ id })` / `list({ where })` are async — they answer from what is
 already local and fall back to the server. Put `local.` in front of either and
 you get the same read restricted to what is already here, which is why it can
-return a value rather than a promise: `local.retrieve(id)`, `local.list({ where })`,
+return a value rather than a promise: `local.get(id)`, `local.list({ where })`,
 `local.count({ where })`. Use those in render, after data has synced.
 **Claims don't lock.** If another writer holds the row, `claim` waits
 for them, re-reads the fresh row, then hands it to you — so two writers
@@ -38,7 +38,7 @@ const schema = defineSchema({
 const ablo = Ablo({ schema, apiKey: process.env.ABLO_API_KEY });
 
 await ablo.ready();
-const report = await ablo.weatherReports.retrieve({ id: 'report_stockholm' });
+const report = await ablo.weatherReports.get({ id: 'report_stockholm' });
 if (!report) throw new Error('Row not found');
 
 await ablo.weatherReports.update({ id: 'report_stockholm', data: { status: 'ready' }, wait: 'confirmed' });
@@ -51,24 +51,24 @@ agents, read the [Integration Guide](./integration-guide.md).
 
 Each schema model becomes a typed model on the client:
 
-- `ablo.weatherReports.retrieve({ id })` reads one row asynchronously (server read).
+- `ablo.weatherReports.get({ id })` reads one row asynchronously (server read).
 - `ablo.weatherReports.list({ where })` reads a collection asynchronously (server read).
-- `ablo.weatherReports.local.retrieve(id)` reads one row synchronously from the local graph.
+- `ablo.weatherReports.local.get(id)` reads one row synchronously from the local graph.
 - `ablo.weatherReports.create({ data })` creates a row.
 - `ablo.weatherReports.update({ id, data, ...options })` updates a row.
 - `ablo.weatherReports.delete({ id, ...options })` deletes a row.
 
-`local.` narrows a read to what has already synced. `retrieve({ id })` and
+`local.` narrows a read to what has already synced. `get({ id })` and
 `list({ where })` answer from the local graph and fall back to IndexedDB and
 then the network, so reach for them when the row may not be here yet.
-`local.retrieve(id)` and `local.list({ where })` are the same reads with the
+`local.get(id)` and `local.list({ where })` are the same reads with the
 fallback removed — nothing to await, so they return a value.
 
 | Method | Returns | Use when |
 |---|---|---|
-| `retrieve({ id })` | `Promise<T \| undefined>` | You need one row, hydrating from local store and server. |
+| `get({ id })` | `Promise<T \| undefined>` | You need one row, hydrating from local store and server. |
 | `list({ where })` | `Promise<T[]>` | You need to hydrate a collection from local store and server. |
-| `local.retrieve(id)` | `T \| undefined` | You want a synchronous snapshot of one local row. |
+| `local.get(id)` | `T \| undefined` | You want a synchronous snapshot of one local row. |
 | `local.list(options?)` | `T[]` | You want a synchronous snapshot of a local collection. |
 | `local.count(options?)` | `number` | You want a synchronous count of local rows. |
 | `create({ data, ...options })` | `Promise<T>` | You want to create through the schema model. |
@@ -179,7 +179,7 @@ endpoint documents that model's real field contract instead of a generic blob.
 |---|---|
 | `ablo.<model>.create({ data })` | `POST /api/v1/models/{model}` |
 | `ablo.<model>.list({ where })` | `GET /api/v1/models/{model}` |
-| `ablo.<model>.retrieve({ id })` | `GET /api/v1/models/{model}/{id}` |
+| `ablo.<model>.get({ id })` | `GET /api/v1/models/{model}/{id}` |
 | `ablo.<model>.update({ id, data })` | `PATCH /api/v1/models/{model}/{id}` |
 | `ablo.<model>.delete({ id })` | `DELETE /api/v1/models/{model}/{id}` |
 | `ablo.<model>.claim({ id })` | `POST /api/v1/models/{model}/{id}/claim` |

package/docs/client-behavior.md

@@ -53,8 +53,8 @@ Each schema model becomes a typed model:
 ```ts
 await ablo.ready();
 
-const report = await ablo.weatherReports.retrieve({ id: 'report_stockholm' });
-const local = ablo.weatherReports.local.retrieve('report_stockholm');
+const report = await ablo.weatherReports.get({ id: 'report_stockholm' });
+const local = ablo.weatherReports.local.get('report_stockholm');
 
 await ablo.weatherReports.create({ data: { location: 'Stockholm', status: 'pending' } });
 await ablo.weatherReports.update({ id: 'report_stockholm', data: { status: 'ready' }, wait: 'confirmed' });
@@ -62,7 +62,7 @@ await ablo.weatherReports.delete({ id: 'report_stockholm', wait: 'confirmed' });
 ```
 
 Call `retrieve`/`list` first — they fetch from the server and you `await` them.
-After that, `local.retrieve`/`local.list`/`local.count` read the already-synced data instantly with
+After that, `local.get`/`local.list`/`local.count` read the already-synced data instantly with
 no `await`, and stay reactive in render. Use the async pair to load, the sync trio
 to read.
 
@@ -79,7 +79,7 @@ through the same model client path. A human Server Action, a browser view, and a
 agent worker can all use `ablo.weatherReports`:
 
 ```ts
-const report = await ablo.weatherReports.retrieve({ id });
+const report = await ablo.weatherReports.get({ id });
 const snap = ablo.snapshot({ weatherReports: id });
 
 await ablo.weatherReports.update({
@@ -93,7 +93,7 @@ await ablo.weatherReports.update({
 
 Once the server accepts the write, every other connected client gets the new row
 automatically — no polling or manual refresh on your side. React clients that use
-`useAblo((ablo) => ablo.weatherReports.local.retrieve(id))` receive the new row, and selectors
+`useAblo((ablo) => ablo.weatherReports.local.get(id))` receive the new row, and selectors
 such as `useAblo((ablo) => ablo.weatherReports.claim.state({ id }))`
 receive active claim state. There is
 no extra multiplayer setup beyond routing shared state through Ablo.

package/docs/coordination.md

@@ -38,11 +38,10 @@ Reads stay open: reading a claimed row is allowed unless the caller explicitly
 asks for claimed gating. A claim carries a TTL so a crashed holder is
 auto-released and the queue advances.
 
-A claim is also as narrow as you make it. Name a part of the row — a `field`, a
-`path` into a document, a `range` of text — and exclusion follows the target:
-**two claims on non-overlapping parts of the same row are both granted**, and
-only overlapping targets queue behind each other. See
-[claiming part of a row](#claiming-part-of-a-row).
+A claim is also as narrow as you make it. Select one or more `fields` and
+exclusion follows the target: **two claims on different fields of the same row
+are both granted**, and only claims that share a field queue behind each other.
+See [claiming part of a row](#claiming-part-of-a-row).
 
 > **Transport: both wait — only the mechanism differs.** `claim({ id })` means
 > "serialize me behind whoever holds this row" on every transport. The
@@ -61,7 +60,7 @@ only overlapping targets queue behind each other. See
 > try-claim, which resolves `null` when the target is held (a declined try
 > is not an error) and takes no place in line. For
 > callers that manage the wait themselves, the ticket surface remains:
-> `ablo.claims.retrieve({ claimId })` polls a ticket to its grant,
+> `ablo.claims.get({ claimId })` polls a ticket to its grant,
 > `ablo.claims.heartbeat({ claimId })` keeps the slot, and
 > `ablo.claims.release({ claimId })` leaves the line. And contention can be
 > treated as a signal rather than a wait at all — catch the error, re-read
@@ -221,7 +220,7 @@ a model row. It's what `claim.state()` returns and what observers render.
 |---|---|---|
 | `id` | `string` | The claim id (distinct from the target row id). |
 | `status` | `ClaimStatus` | `'active' \| 'queued' \| 'committed' \| 'expired' \| 'canceled'`. `active` = the holder; `queued` = waiting in line behind it. The other three are terminal states you only see on a claim you just finished: `committed` (released after a successful write), `expired` (TTL lapsed), `canceled` (released early). |
-| `target` | `EntityRef` | What is being coordinated: the row (`{ model, id }`) plus any sub-row narrowing the holder claimed: `path?`, `range?`, `field?`, `fields?`, and opaque `meta?`. A target with no narrowing covers the whole row. |
+| `target` | `EntityRef` | What is being coordinated: the row (`{ model, id }`) plus any field narrowing the holder claimed: `field?`, `fields?`, and opaque `meta?`. A target with no narrowing covers the whole row. |
 | `description` | `string` | Peer-visible description of the work: the sentence another participant reads to decide whether to wait or move on (`'rewriting the risk section'`). Defaults to `'editing'`. |
 | `heldBy` | `string` | Participant holding (or waiting on) it (e.g. `'agent:forecaster'`). |
 | `participantKind` | `'user' \| 'agent' \| 'system'` | Who's behind it: a human (`user`), an AI (`agent`), or automated infrastructure (`system`). |
@@ -309,10 +308,7 @@ four axes. `claim({ id })` alone is a complete call; each axis is opt-in.
 | name | type | required | description |
 |---|---|---|---|
 | `id` | `string` | yes | The row id: same id as `retrieve` / `update`. |
-| `options.field` | `ClaimField` | no | **Deprecated: say it as a set: `fields: ['title']`. Removed in 0.37.0.** One member for a set of one, beside another for a set of any size, is two ways to say one thing, and the singular is the one that misled: a caller needing two parts packed them into it. The wire still reads `field`, so this changes what you write, not what is understood. |
-| `options.fields` | `ClaimField[]` | no | Claim named parts of the row instead of all of it: one or several. Prefer the selector form, `fields: (f) => [f.status]`, where the model hands you its own fields, so a field it does not have stops compiling and a rename is a compile error at every use. A bare name (`'status'`) autocompletes but is not checked; an app-defined part, a cell, a section, is named with `part('B2')`. Two sets conflict where they intersect, so holders of disjoint parts do not wait for each other, see [claiming part of a row](#claiming-part-of-a-row). A name containing a comma is refused: two names in one string compare as a single unrelated name, and both writers would be granted the same part. |
-| `options.path` | `string` | no | A hierarchical position in a document-shaped row: `'/content/3'` claims one block. Paths conflict on containment: `/content` covers `/content/3`, while `/content/3` and `/content/7` are disjoint and both granted. |
-| `options.range` | `TargetRange` | no | A span of the row's text: `{ startLine, endLine, startColumn?, endColumn? }`. Ranges conflict only where their line intervals overlap. An editor addressing by integer position maps it onto `startLine`/`endLine`: the test is plain interval intersection. |
+| `options.fields` | field selector | no | Claim fields declared by the model's Zod schema instead of the whole row: `fields: (task) => task.status`, or `fields: (task) => [task.status, task.title]` for several. The model supplies its own fields, so autocomplete is exact, a typo does not compile, and a schema rename is a compile error at every use. Two sets conflict where they intersect, so holders of disjoint fields do not wait for each other; see [claiming part of a row](#claiming-part-of-a-row). |
 
 *What others see* — the presence half:
 
@@ -373,67 +369,61 @@ Name a field and a typo cannot survive — the model is already bound by the cal
 so it hands you its own fields:
 
 ```ts
-await using mine = await ablo.tasks.claim({ id, fields: (f) => [f.status] });
+await using mine = await ablo.tasks.claim({ id, fields: (task) => task.status });
 ```
 
-`f.status` is checked against the model: a field it does not have stops
+`task.status` is checked against the model: a field it does not have stops
 compiling, and renaming one is a compile error at every use. Nothing to import,
 nothing to add to your schema file.
 
-`fields: ['status']` still works and still autocompletes; it just accepts
-`'titel'` too, which is granted, excludes nobody, and leaves the write of
-`title` unguarded.
+The selector is the public model API. Quoted field names exist only in the wire
+contract and low-level coordination protocol.
 
-A claim covers the whole row only when you name nothing narrower. Name a
-target — a `path` into a document, a `range` of text, a `field` or set of
-`fields` — and exclusion follows it: **two claims on non-overlapping parts of
-the same row are both granted**, and only overlapping targets queue behind
-each other.
+A claim covers the whole row only when you name nothing narrower. Select
+`fields` and exclusion follows them: **two claims on different
+fields of the same row are both granted**, and only claims that share a field
+queue behind each other.
 
 ```ts
-// Agent A holds one block of the document…
-await using intro = await ablo.documents.claim({
-  id: docId,
-  path: '/content/3',
-  description: 'rewriting the risk section',
+// Two agents on the SAME order at the same time. The pricing agent holds
+// `total` and `discount`; the fulfillment agent holds `status`. Disjoint
+// fields, so both are granted at once and neither waits on the other.
+await using priced = await ablo.orders.claim({
+  id: orderId,
+  fields: (o) => [o.total, o.discount],
+  description: 'repricing',
 });
 
-// …while agent B, in another process, holds a different block of the SAME
-// row. Granted immediately — /content/3 and /content/7 do not overlap.
-await using summary = await ablo.documents.claim({
-  id: docId,
-  path: '/content/7',
-  description: 'tightening the summary',
+await using shipping = await ablo.orders.claim({
+  id: orderId,
+  fields: (order) => order.status,
+  description: 'marking shipped',
 });
 ```
 
-Overlap is judged per axis:
+Overlap is set intersection. Holders on `total` and on `status` proceed
+concurrently; two claims that both name `total` queue; naming no field covers
+every field, so it conflicts with any narrower claim on the row.
 
-- **`path`:** hierarchical containment, on a separator boundary. `/content`
-  covers `/content/3`, so the parent's holder queues behind (or is queued
-  behind by) the child's; `/content/3` and `/content/7` are disjoint, and
-  `/content` never collides with `/contentious`.
-- **`field` / `fields`:** set intersection. Holders on `title` and `status`
-  proceed concurrently; naming no field covers all of them.
-- **`range`:** interval intersection on `[startLine, endLine]`. An editor
-  that addresses text by integer position rather than by line maps that
-  position axis straight onto `startLine`/`endLine`: the server's test is
-  plain interval intersection and never assumes the units are lines of a
-  file.
+**Field is the floor.** A claim cannot be finer than a whole field, because
+nothing writes part of a value: whichever holder commits first takes the entire
+field. Sub-field targets, a range of text or a path into a document, are not
+offered. Two writers holding different parts of one field is only safe once
+concurrent edits to that field can be reconciled (operational transformation),
+and that is not solved yet. When it is, sub-field targets return, and they
+return working.
 
-A claim with no target is the widest parent: it covers every part of the row
-and conflicts with any narrower claim on it. Region locking on a single
-document row is therefore one claim per region — the row stays one row, and
-the claims carve it up.
+A claim with no target is the widest parent: it covers every field of the row
+and conflicts with any narrower claim on it.
 
 ### Claim-gated reads
 
 `claim.state({ id })` always returns immediately. Model reads such as
-`ablo.<model>.local.retrieve(id)` are local reads and stay available while a claim is
+`ablo.<model>.local.get(id)` are local reads and stay available while a claim is
 held. Server/model reads can choose a claimed policy:
 
 ```ts
-await ablo.weatherReports.retrieve({
+await ablo.weatherReports.get({
   id: 'report_stockholm',
   ifClaimed: 'fail',
 });
@@ -479,9 +469,9 @@ whole coordination API.
 **One holder, and a row can have several.** This reads a row, not a target, and
 answers with a single claim. That is the whole story for a whole-row claim, and
 only part of it once you [claim parts of a row](#claiming-part-of-a-row): three
-agents holding `/content/3`, `/content/7`, and `title` are all active at once,
-and this read surfaces one of them. To render every holder — a rail per claimed
-block, a chip per participant — use [`claim.list`](#claimlist).
+agents holding `total`, `discount`, and `status` are all active at once, and
+this read surfaces one of them. To render every holder, a badge per claimed
+field or a chip per participant, use [`claim.list`](#claimlist).
 
 **Example**
 
@@ -514,9 +504,9 @@ Every holder of a row. Same synchronous, reactive read as `claim.state` — off
 the same local snapshot, safe to call inline in a render — and the same list
 envelope as [`claim.queue`](#claimqueue).
 
-Reach for it whenever a row can be claimed in parts. One agent rewriting
-`/content/3` while another tightens `/content/7` are two active claims on one
-row, and only this read returns both.
+Reach for it whenever a row can be claimed by field. One agent repricing
+`total` while another marks `status` are two active claims on one row, and only
+this read returns both.
 
 **Parameters**
 
@@ -528,14 +518,14 @@ row, and only this read returns both.
 when this client holds one, then the other participants'. Empty `data` when the
 row is free.
 
-**Example** — a rail for every claimed block:
+**Example** — a badge on every claimed field:
 
 ```tsx
-const { data: holders } = ablo.documents.claim.list({ id: docId });
+const { data: holders } = ablo.orders.claim.list({ id: orderId });
 
-return blocks.map((block) => {
-  const held = holders.find((c) => c.target.path === `/content/${block.index}`);
-  return <Block key={block.id} rail={held?.heldBy} note={held?.description} />;
+return FIELDS.map((field) => {
+  const held = holders.find((c) => c.target.field === field);
+  return <FieldBadge key={field} field={field} by={held?.heldBy} note={held?.description} />;
 });
 ```
 
@@ -791,7 +781,7 @@ try {
 
 ## Errors
 
-All extend `AbloError` (`packages/sync-engine/src/errors.ts`). Catch by `type` or
+All extend `AbloError` (`packages/transaction/src/errors.ts`). Catch by `type` or
 inspect the `code`.
 
 | error | `code` | thrown when | carries |

package/docs/data-sources.md

@@ -182,7 +182,7 @@ await ablo.weatherReports.update({ id: 'report_stockholm', data: { high: 21 } })
 await ablo.weatherReports.update({ id: 'report_stockholm', data: { high: 21 }, wait: 'confirmed' });
 
 // Reads are live off the same stream.
-const report = ablo.weatherReports.local.retrieve('report_stockholm');
+const report = ablo.weatherReports.local.get('report_stockholm');
 ```
 
 A commit is accepted the moment Ablo takes it (`queued`); it becomes `confirmed`

package/docs/examples/agent-human.md

@@ -25,7 +25,7 @@ a typed error if the row moved underneath you while the agent was busy.
 ## Schema-Backed Worker
 
 The worker uses the same schema client the app uses. It reads the task from the
-server with `retrieve({ id })`, claims the row, and writes through
+server with `get({ id })`, claims the row, and writes through
 `ablo.tasks.update(...)` with a stale-check so a concurrent edit can't be
 overwritten.
 
@@ -49,8 +49,8 @@ const ablo = Ablo({
 export async function markDone(taskId: string) {
   await ablo.ready();
 
-  // retrieve({ id }) is an async server read — await it.
-  const task = await ablo.tasks.retrieve({ id: taskId });
+  // get({ id }) is an async server read — await it.
+  const task = await ablo.tasks.get({ id: taskId });
   if (!task) return { status: 'not_found' };
 
   try {
@@ -109,7 +109,7 @@ Keep workers on the same schema-backed client as the app.
 import { useAblo } from '@abloatai/ablo/react';
 
 export function TaskRow({ task: serverTask }: Props) {
-  const data = useAblo((ablo) => ablo.tasks.local.retrieve(serverTask.id)) ?? serverTask;
+  const data = useAblo((ablo) => ablo.tasks.local.get(serverTask.id)) ?? serverTask;
   const holder = useAblo((ablo) => ablo.tasks.claim.state({ id: serverTask.id }));
   const agentActive = holder?.participantKind === 'agent';
 

package/docs/examples/ai-sdk-tool.md

@@ -54,7 +54,7 @@ const updateTask = tool({
     await ablo.ready();
 
     // retrieve hits the server for the latest row (async — await it).
-    const task = await ablo.tasks.retrieve({ id: taskId });
+    const task = await ablo.tasks.get({ id: taskId });
     if (!task) return { ok: false, reason: 'not_found' };
 
     // If another agent already holds this row, claim waits for them to finish,

package/docs/examples/existing-python-backend.md

@@ -87,13 +87,24 @@ browser only ever sees the short-lived token:
 ```ts
 // web/app/api/ablo-session/route.ts
 import { ablo } from '@/ablo';
+import { credentialEndpointSuccessSchema } from '@abloatai/ablo/auth';
 
 export const runtime = 'nodejs';
 
 export async function POST() {
   const userId = await currentUserId(); // your auth
-  const { token } = await ablo.sessions.create({ user: { id: userId } });
-  return Response.json({ token });
+  const { token, expiresAt } = await ablo.sessions.create({
+    user: { id: userId },
+    can: { tasks: ['read', 'update'] },
+  });
+  return Response.json(
+    credentialEndpointSuccessSchema.parse({
+      token,
+      expiresAt,
+      credentialKind: 'ephemeral',
+    }),
+    { headers: { 'Cache-Control': 'no-store' } },
+  );
 }
 ```
 
@@ -112,7 +123,7 @@ export function ReportRow({
 }: {
   report: { id: string; location: string; status: string };
 }) {
-  const report = useAblo((ablo) => ablo.weatherReports.local.retrieve(serverReport.id)) ?? serverReport;
+  const report = useAblo((ablo) => ablo.weatherReports.local.get(serverReport.id)) ?? serverReport;
   const active = useAblo((ablo) => ablo.weatherReports.claim.state({ id: serverReport.id }));
   const claimed = Boolean(active);
 
@@ -275,7 +286,7 @@ and timestamp. If the change originated from an Ablo commit, include the same
 Agents use the same model API as the UI:
 
 ```ts
-const report = await ablo.weatherReports.retrieve({ id: reportId });
+const report = await ablo.weatherReports.get({ id: reportId });
 const snap = ablo.snapshot({ weatherReports: reportId });
 
 await ablo.weatherReports.update({

package/docs/examples/nextjs.md

@@ -64,13 +64,34 @@ The browser can't hold `sk_`, so a backend route mints a scoped, short-lived
 // app/api/ablo-session/route.ts
 import { ablo } from '@/lib/ablo';
 import { getCurrentUser } from '@/auth';
+import {
+  credentialEndpointErrorSchema,
+  credentialEndpointSuccessSchema,
+} from '@abloatai/ablo/auth';
 
 export async function POST() {
   const user = await getCurrentUser();
-  if (!user) return new Response('Unauthorized', { status: 401 });
-
-  const session = await ablo.sessions.create({ user: { id: user.id } });
-  return Response.json({ token: session.token });
+  if (!user) {
+    return Response.json(
+      credentialEndpointErrorSchema.parse({
+        error: { code: 'session_expired' },
+      }),
+      { status: 401, headers: { 'Cache-Control': 'no-store' } },
+    );
+  }
+
+  const { token, expiresAt } = await ablo.sessions.create({
+    user: { id: user.id },
+    can: { tasks: ['read', 'create', 'update'] },
+  });
+  return Response.json(
+    credentialEndpointSuccessSchema.parse({
+      token,
+      expiresAt,
+      credentialKind: 'ephemeral',
+    }),
+    { headers: { 'Cache-Control': 'no-store' } },
+  );
 }
 ```
 
@@ -124,7 +145,7 @@ export default async function TaskPage({
 }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
   await ablo.ready();
-  const task = await ablo.tasks.retrieve({ id });
+  const task = await ablo.tasks.get({ id });
   if (!task) return null;
 
   return <TaskEditor task={task} />;
@@ -167,7 +188,7 @@ you — re-fetch and retry.
 import { useAblo } from '@abloatai/ablo/react';
 
 export function TaskEditor({ task: serverTask }: Props) {
-  const data = useAblo((ablo) => ablo.tasks.local.retrieve(serverTask.id)) ?? serverTask;
+  const data = useAblo((ablo) => ablo.tasks.local.get(serverTask.id)) ?? serverTask;
   const holder = useAblo((ablo) => ablo.tasks.claim.state({ id: serverTask.id }));
   const busy = Boolean(holder);
 

package/docs/examples/server-agent.md

@@ -38,7 +38,7 @@ const ablo = Ablo({
 export async function completeTask(taskId: string) {
   await ablo.ready();
 
-  const task = await ablo.tasks.retrieve({ id: taskId });
+  const task = await ablo.tasks.get({ id: taskId });
   if (!task) return { status: 'not_found' };
 
   await using claim = await ablo.tasks.claim({
@@ -58,7 +58,7 @@ export async function completeTask(taskId: string) {
 }
 ```
 
-`retrieve({ id })` is an async server read — it hits the server and returns the
+`get({ id })` is an async server read — it hits the server and returns the
 row (or `undefined`, which the early `not_found` guard handles). The update runs
 while the claim is held, and `wait: 'confirmed'` makes it resolve only once your
 database has confirmed the row landed.

package/docs/how-it-works.md

@@ -10,7 +10,7 @@ whole model — everything below explains what it means and how to use it.
 await ablo.tasks.update({ id: 'task_42', data: { status: 'done' }, wait: 'confirmed' });
 
 // Reads come back live, kept current from your database.
-const task = ablo.tasks.local.retrieve('task_42');
+const task = ablo.tasks.local.get('task_42');
 ```
 
 ## The mental model: read this once
@@ -42,7 +42,7 @@ echo confirms it → everyone connected sees it live.**
 | Primitive | Plane | Purpose |
 |---|---|---|
 | `Schema` | State | Declares typed models the app and agents can read and write. |
-| `Model` | State | The generated `ablo.<model>` model. Use `retrieve`/`list` (async reads), `local.retrieve`/`local.list`/`local.count` (the same verbs, synchronous and local-only), `create`, `update`, and `delete`. |
+| `Model` | State | The generated `ablo.<model>` model. Use `retrieve`/`list` (async reads), `local.get`/`local.list`/`local.count` (the same verbs, synchronous and local-only), `create`, `update`, and `delete`. |
 | `Claim` | Coordination | Who is working on a target. Taken via `ablo.<model>.claim({ id })` and read via `ablo.<model>.claim.state({ id })`. Ephemeral, never persisted. |
 | `Commit` | Protocol | The durable write underneath model updates. Most users do not call it directly. |
 | `Receipt` | Protocol | The lower-level durable result for custom runtimes. Schema writes use `wait: 'confirmed'`. |
@@ -106,13 +106,13 @@ export const ablo = Ablo({ schema, apiKey: process.env.ABLO_API_KEY });
 await ablo.tasks.update({ id: 'task_42', data: { status: 'done' }, wait: 'confirmed' });
 
 // 6. Read — live, no fetch loop.
-const task = ablo.tasks.local.retrieve('task_42');
+const task = ablo.tasks.local.get('task_42');
 
 // 7. Coordinate when more than one actor can touch a row. Hold a claim and Ablo
 //    serializes writes on that key against everyone else; read after claiming,
 //    then write. The lease releases automatically at the end of the scope.
 await using _hold = await ablo.tasks.claim('task_42');
-const latest = ablo.tasks.local.retrieve('task_42'); // read after claiming, not from memory
+const latest = ablo.tasks.local.get('task_42'); // read after claiming, not from memory
 await ablo.tasks.update({ id: 'task_42', data: { status: 'done' } });
 ```
 

package/docs/identity.md

@@ -180,6 +180,7 @@ await mintUserSessionKey({
     organizationId: schemaOwnerOrgId,
     projectId: schemaProjectId,
   },
+  operations: ['task.read', 'task.update'],
   ttlSeconds: 3600,
 });
 ```
@@ -308,7 +309,7 @@ exposed the whole table cross-tenant, so `validate_schema` rejects the removed
 options as `tenancy-option-removed` errors and steers you to `policy: { by:
 'parent' }` (FK inheritance) or, for genuinely global reference data, the
 explicit `policy: { by: 'none' }`. See
-`packages/sync-engine/src/schema/model.ts` for the full option set.
+`packages/transaction/src/schema/model.ts` for the full option set.
 
 ## How identity reaches Ablo: the proxy model