@abloatai/ablo 0.36.0 → 0.37.1

package/dist/server/commit.d.ts

@@ -1,107 +0,0 @@
-/**
- * The commit contract types for the sync engine's server surface.
- *
- * {@link CommitContext} is the attribution envelope stamped onto every delta a
- * commit produces; {@link CommitResult} is the receipt returned when the commit
- * finishes. Both are plain data descriptors — no database driver, no SQL, no
- * functions — so they belong to this package's public contract, which your commit
- * implementation reads and writes. They feed the `ChangeSet` and `DataAdapter`
- * contracts defined alongside them.
- *
- * The attribution fields reuse the shared {@link ParticipantKind},
- * {@link ConfirmationState}, and {@link ParticipantRef} types, so the shape at
- * commit time and the shape of a stored or broadcast delta share one definition
- * rather than being kept in step by hand.
- */
-import type { ParticipantKind, ConfirmationState } from '../schema/syncDeltaRow.js';
-import type { ParticipantRef } from '../transaction/wire/delta.js';
-import type { CommitExecutionResultInput } from '../transaction/wire/commit.js';
-import type { Environment } from '../transaction/environment.js';
-import type { ReadDependency, TrackDependency } from '../transaction/coordination/schema.js';
-export interface CommitContext {
-    participantId: string;
-    /**
-     * The kind of participant making the commit. Required, so that every delta carries
-     * structured attribution rather than a string-prefix convention.
-     */
-    participantKind: ParticipantKind;
-    organizationId: string;
-    /**
-     * Project scope used to route source-mode storage. When omitted, the commit
-     * targets the organization's default project.
-     */
-    projectId?: string;
-    /** Exact sandbox plane derived from the authenticated key, when present. */
-    sandboxId?: string;
-    /** Optional external account scope forwarded to storage resolvers. */
-    accountScope?: string;
-    /**
-     * The environment this commit runs in. Source-mode adapters forward it to the
-     * customer's handlers so that sandbox and production traffic can reach distinct
-     * customer-owned stores.
-     */
-    environment?: Environment;
-    /**
-     * The sync groups this participant subscribes to, taken from the connection
-     * upgrade or the capability token. Each is appended to every delta's `sync_groups`
-     * so that writes fan out to subscribers of entity-level groups (such as
-     * `report:abc`), not only the default `org:X` and `user:Y` groups. When omitted, the
-     * commit fans out to just the organization and user groups.
-     */
-    syncGroups?: readonly string[];
-    /**
-     * When true, the commit does not add `org:<organizationId>` to a delta's sync
-     * groups. Set this for sandbox writes, so that live organization subscribers do
-     * not receive test-environment changes.
-     */
-    omitOrgSyncGroup?: boolean;
-    /**
-     * The participant on whose authority the actor acted. For a direct human commit
-     * this equals the actor; for an agent commit it is the human at the root of the
-     * capability's delegation chain. Null for `system` principals.
-     */
-    onBehalfOf?: ParticipantRef | null;
-    /**
-     * The id of the scoped credential that authorized the commit. Non-null for agent
-     * and system commits when that credential is known; null for direct human commits.
-     */
-    capabilityId?: string | null;
-    /**
-     * The id of the human user at the root of the delegated-authority chain. Stored
-     * directly on `sync_deltas` so that audit triggers appending the hash chain never
-     * need to join mutable credential tables.
-     */
-    delegationChainRootUserId?: string | null;
-    /**
-     * The id of the API key row when the caller authenticated with an API key. Used by
-     * the idempotency cache and for usage attribution. Null for session and capability
-     * callers.
-     */
-    apiKeyId?: string | null;
-    /**
-     * Whether a human explicitly approved the change. Defaults to `auto` when the
-     * caller does not specify an approval state.
-     */
-    confirmationState?: ConfirmationState;
-    /**
-     * The premise for the whole batch. The committer declares the rows or groups
-     * it read to form this batch; the engine checks that none of them changed since
-     * each entry's `readAt` timestamp and applies that entry's `onStale` disposition
-     * across the batch. This differs from the per-operation `readAt` guard, which
-     * validates only the rows being written. Omit it to check the write targets alone.
-     */
-    reads?: ReadDependency[] | null;
-    /**
-     * Durable premises to persist for this commit's participant. Each entry is
-     * kept in `track_dependencies` and re-checked against every future delta; a
-     * later match opens a `StaleNotification` delivered out of band. Distinct
-     * from `reads`, which is checked once here and discarded.
-     */
-    track?: TrackDependency[] | null;
-}
-/**
- * The server execution receipt persisted in `mutation_log`. Its runtime schema
- * lives with the HTTP/WS settlement contract so queued correlation cannot drift
- * between cache, transport, and client.
- */
-export type CommitResult = CommitExecutionResultInput;

package/dist/server/commit.js

@@ -1 +0,0 @@
-export {};

package/dist/server/index.d.ts

@@ -1,14 +0,0 @@
-/**
- * The server-side entry point of the sync engine. It re-exports the contract types
- * you implement a storage backend against: the {@link DataAdapter} and its
- * vocabulary ({@link Row}, {@link ReadRequest}, {@link ChangeSet}, and the rest),
- * the {@link CommitContext} and {@link CommitResult} commit types, the
- * {@link StorageMode} enumeration, and the per-model read configuration
- * ({@link BootstrapModel}, {@link ColumnOverride}). These are plain, driver-free
- * types; you supply the database code that fulfills them.
- */
-export type { Row, ReadResult, SyncCursor, DataAdapterCapabilities, ProposalResult, ReadRequest, ChangeSet, SyncResult, DataAdapter, ProposableDataAdapter, AdapterResolver, } from './adapter.js';
-export type { CommitContext, CommitResult } from './commit.js';
-export { commitExecutionResultSchema } from '../transaction/wire/commit.js';
-export { storageModeSchema, type StorageMode } from './storageMode.js';
-export type { ColumnOverride, BootstrapModel } from './readConfig.js';

package/dist/server/index.js

@@ -1,2 +0,0 @@
-export { commitExecutionResultSchema } from '../transaction/wire/commit.js';
-export { storageModeSchema } from './storageMode.js';

package/dist/server/readConfig.d.ts

@@ -1,80 +0,0 @@
-/**
- * Per-model read configuration consumed when a client bootstraps. Each
- * {@link BootstrapModel} maps a model to its physical table, its tenancy column, and
- * any parent scoping — plain data with no database driver. It feeds the read side of
- * the data adapter contract; your query builder reads it to load a model's initial
- * rows.
- */
-/** A mapping from a declared field to a physical column, with the alias to apply after a `SELECT *`. */
-export interface ColumnOverride {
-    readonly field: string;
-    readonly column: string;
-    readonly alias: string;
-}
-/** Read configuration for one model: how to locate its rows and scope them to a tenant. */
-export interface BootstrapModel {
-    name: string;
-    /**
-     * Extra names accepted when a request looks up or filters this model. When the
-     * physical table name is canonical, `name` stays that table name and the aliases
-     * cover generated compatibility names such as `WeatherReports` or `weatherReports`.
-     */
-    aliases?: readonly string[];
-    /**
-     * The schema key used by source endpoints. `name` stays the wire and result model
-     * name (usually the typename), while source handlers are keyed by the developer's
-     * schema key, such as `files` or `blocks`.
-     */
-    sourceModel?: string;
-    table: string;
-    syncGroups?: string[];
-    enabled?: boolean;
-    /** Max rows to return. Omit for unlimited. Maps to schema's bootstrapLimit. */
-    limit?: number;
-    /** SQL ORDER BY clause. Default: 'id'. Maps to schema's bootstrapOrderBy. */
-    orderBy?: string;
-    /** Whether the table has organization_id. Default: true. */
-    orgScoped?: boolean;
-    /**
-     * The model derives its tenant from the connected data source (`policy:
-     * { by: 'source' }`) rather than a row column. It carries no tenant predicate on a
-     * log plane, so it is excluded from the bootstrap set entirely until the
-     * write-through connect path can resolve the org from the source registration —
-     * serving it now would return every row to every tenant. Kept on the type as a
-     * defense-in-depth marker so a source-scoped model that reaches `getBootstrapData`
-     * fails closed rather than bootstrapping unscoped.
-     */
-    sourceScoped?: boolean;
-    /** Physical tenancy column (default `organization_id`, configurable per model). */
-    orgColumn?: string;
-    /**
-     * Parent-table scoping for rows that have no `organization_id` column, mirroring
-     * the schema's `scopedVia` option. When set, the bootstrap query adds:
-     *
-     *   WHERE <table>.<localKey> IN
-     *     (SELECT <parentKey> FROM <parentTable> WHERE <parentOrgColumn> = $1)
-     *
-     * This applies on top of whatever `orgScoped` dictates, so a table can carry its
-     * own `organization_id` and still narrow through a parent. The common case,
-     * though, is `orgScoped: false` together with `scopedVia` on a table that lacks the
-     * column.
-     */
-    scopedVia?: {
-        localKey: string;
-        parentTable: string;
-        parentKey?: string;
-        parentOrgColumn?: string;
-    };
-    /** Client-facing field name → physical DB column for declared fields. */
-    fieldColumns?: Record<string, string>;
-    /** Physical-column aliases needed after SELECT * for `.from(...)` fields. */
-    columnOverrides?: readonly ColumnOverride[];
-    /**
-     * Physical columns the schema declares as JSON (via `field.json()`). A JSON field
-     * stored in a text column comes back from `row_to_json` as a serialized string, so
-     * the bootstrap reparses these columns to make the wire value the canonical object
-     * regardless of the physical column type. A `jsonb` column already returns an
-     * object, so reparsing it is a no-op.
-     */
-    jsonColumns?: readonly string[];
-}

package/dist/server/readConfig.js

@@ -1,8 +0,0 @@
-/**
- * Per-model read configuration consumed when a client bootstraps. Each
- * {@link BootstrapModel} maps a model to its physical table, its tenancy column, and
- * any parent scoping — plain data with no database driver. It feeds the read side of
- * the data adapter contract; your query builder reads it to load a model's initial
- * rows.
- */
-export {};

package/dist/server/storageMode.d.ts

@@ -1,23 +0,0 @@
-/**
- * The set of storage modes a `DataAdapter` can run in. An adapter carries one of
- * these as a label for diagnostics; it does not decide routing, which the adapter
- * resolver handles separately. The package defines the enum so that the contract
- * and every adapter agree on the same closed set of values:
- *
- *   - `hosted`     — a database this engine operates on the caller's behalf.
- *   - `selfHosted` — the caller's own database, reached through the same execution
- *                    path as `hosted`.
- *   - `source`     — a caller-owned endpoint that accepts changes over HTTP without
- *                    database credentials.
- *
- * These names describe where the data lives, not anything an end user sees.
- */
-import { z } from 'zod';
-/** Runtime validator for the storage-mode values; {@link StorageMode} is its inferred type. */
-export declare const storageModeSchema: z.ZodEnum<{
-    source: "source";
-    hosted: "hosted";
-    selfHosted: "selfHosted";
-}>;
-/** The storage mode an adapter runs in — one of the values described in the module overview. */
-export type StorageMode = z.infer<typeof storageModeSchema>;

package/dist/server/storageMode.js

@@ -1,17 +0,0 @@
-/**
- * The set of storage modes a `DataAdapter` can run in. An adapter carries one of
- * these as a label for diagnostics; it does not decide routing, which the adapter
- * resolver handles separately. The package defines the enum so that the contract
- * and every adapter agree on the same closed set of values:
- *
- *   - `hosted`     — a database this engine operates on the caller's behalf.
- *   - `selfHosted` — the caller's own database, reached through the same execution
- *                    path as `hosted`.
- *   - `source`     — a caller-owned endpoint that accepts changes over HTTP without
- *                    database credentials.
- *
- * These names describe where the data lives, not anything an end user sees.
- */
-import { z } from 'zod';
-/** Runtime validator for the storage-mode values; {@link StorageMode} is its inferred type. */
-export const storageModeSchema = z.enum(['hosted', 'source', 'selfHosted']);

package/dist/source/adapter.d.ts

@@ -1,83 +0,0 @@
-/**
- * The interface every data-source backend implements, together with the bridge
- * that wires an implementation into the `dataSource()` HTTP handler. This package
- * defines the contract and ships adapters for three object-relational mappers —
- * {@link prismaDataSource}, {@link drizzleDataSource}, and {@link kyselyDataSource} —
- * each verified by shared mutation checks plus endpoint-only outbox checks. The
- * direct Kysely wrapper runs only the shared mutation contract. You can also
- * write your own.
- *
- * An endpoint adapter reads and writes your database, and it owns the transactional
- * outbox and idempotency bookkeeping as well, so you never write those by hand.
- * Hand it to the handler in one slot:
- *
- *   export const POST = dataSource({
- *     schema, apiKey: process.env.ABLO_API_KEY!,
- *     adapter: prismaDataSource(prisma, schema),
- *   });
- *
- * That is the path to teach. {@link sourceHandlersFromAdapter} is the lower-level
- * bridge behind it — it expands one adapter into the handler's `commit`, `events`,
- * and per-model `load` and `list` operations, and is worth reaching for only when
- * you want to override one of those while the adapter serves the rest.
- */
-import type { SourceListQuery, SourceRequestContext } from './types.js';
-import type { AdapterCapabilities, ChangeSet, EventsPage, Migration } from './contract.js';
-/**
- * A single row keyed by the schema's field names (for example `operatorId`), not
- * by physical column names. Each adapter is the boundary that translates between
- * the two, mapping a field name to whatever the underlying database column is
- * called. Values are typed as `unknown`, so a caller must narrow a value before
- * using it.
- */
-export type Row = Record<string, unknown>;
-/** A read request handed to an adapter: either a single-row load by id, or a filtered list. */
-export type AdapterReadRequest = {
-    readonly kind: 'load';
-    readonly model: string;
-    readonly id: string;
-    readonly scope?: SourceRequestContext;
-} | {
-    readonly kind: 'list';
-    readonly model: string;
-    readonly query?: SourceListQuery;
-    readonly scope?: SourceRequestContext;
-};
-/** What {@link MutationAdapter.commit} returns: the rows as they stand after the write. */
-export interface AdapterCommitResult {
-    /** The affected rows after the write. The change log is derived from these. */
-    readonly rows: readonly Row[];
-}
-/**
- * Guarantees shared by direct and endpoint mutation wrappers. Both apply row DML
- * and write the permanent idempotency ledger in one transaction. The scoped,
- * server-authored `correlationId` is the ledger key; a caller-authored operation
- * transaction id is never used as that namespace.
- */
-export interface MutationAdapter {
-    readonly capabilities: AdapterCapabilities;
-    /** Infrastructure migrations required by this wrapper's advertised capabilities. */
-    migrations(): readonly Migration[];
-    /** The rows matching a load or list request. */
-    read(req: AdapterReadRequest): Promise<readonly Row[]>;
-    /**
-     * Applies a change set in one transaction, keyed by its scoped `correlationId`.
-     * Replaying the same correlation and canonical request hash returns the original
-     * rows without applying DML again; a different hash fails closed.
-     */
-    commit(change: ChangeSet): Promise<AdapterCommitResult>;
-}
-/**
- * Endpoint-only extension of {@link MutationAdapter}. Its commit writes one
- * correlated outbox event per operation in the same transaction as the DML and
- * ledger. Direct wrappers deliberately do not implement this interface: WAL is
- * their authoritative source feed and they must never write `ablo_outbox`.
- */
-export interface DataSourceAdapter extends MutationAdapter {
-    readonly capabilities: AdapterCapabilities & {
-        readonly outboxEvents: true;
-    };
-    /** Reads outbox events after `cursor` (`null` starts from the beginning), up to `limit` events. */
-    events(cursor: string | null, limit: number): Promise<EventsPage>;
-}
-export type { AdapterCapabilities, ChangeSet, Migration, OutboxEvent, EventsPage } from './contract.js';

package/dist/source/adapter.js

@@ -1,24 +0,0 @@
-/**
- * The interface every data-source backend implements, together with the bridge
- * that wires an implementation into the `dataSource()` HTTP handler. This package
- * defines the contract and ships adapters for three object-relational mappers —
- * {@link prismaDataSource}, {@link drizzleDataSource}, and {@link kyselyDataSource} —
- * each verified by shared mutation checks plus endpoint-only outbox checks. The
- * direct Kysely wrapper runs only the shared mutation contract. You can also
- * write your own.
- *
- * An endpoint adapter reads and writes your database, and it owns the transactional
- * outbox and idempotency bookkeeping as well, so you never write those by hand.
- * Hand it to the handler in one slot:
- *
- *   export const POST = dataSource({
- *     schema, apiKey: process.env.ABLO_API_KEY!,
- *     adapter: prismaDataSource(prisma, schema),
- *   });
- *
- * That is the path to teach. {@link sourceHandlersFromAdapter} is the lower-level
- * bridge behind it — it expands one adapter into the handler's `commit`, `events`,
- * and per-model `load` and `list` operations, and is worth reaching for only when
- * you want to override one of those while the adapter serves the rest.
- */
-export {};

package/dist/source/adapters/drizzle.d.ts

@@ -1,48 +0,0 @@
-/**
- * The Drizzle adapter for the data-source interface. It implements the same
- * {@link DataSourceAdapter} contract as {@link prismaDataSource} and passes the
- * same conformance suite, built against Drizzle's query API:
- *   - `db.transaction(async (tx) => …)` runs an interactive transaction that
- *     commits or rolls back as a unit.
- *   - `db.execute(sql`…`)` runs parameterized raw SQL; `sql.identifier()` safely
- *     quotes dynamic table and column names, and `sql`${value}`` parameterizes
- *     values.
- *
- * Table and column names come from your schema, not from a hand-written Drizzle
- * table. Because this adapter issues raw SQL, it would otherwise bypass any
- * field-to-column translation, so it derives every name from the same rule the
- * table provisioner uses:
- *   table  = `model.tableName ?? key`
- *   column = `fieldMeta.column ?? camelToSnake(field)`   (plus the tenancy column)
- * This keeps the tables `ablo migrate` creates (for example `operator_id`) and the
- * columns this adapter reads and writes in agreement. You define the schema once
- * and point the engine at your Postgres database. The adapter is the translation
- * boundary: the rows it accepts and returns, and the outbox `data` it writes, are
- * keyed by field name, while the physical columns it touches are snake_case.
- *
- * Two things to know about drivers:
- *   1. Interactive `db.transaction` needs a driver that supports it. Neon's
- *      `neon-http` driver is single-shot and does not, so use `neon-serverless`
- *      (over WebSocket) or `pg`; under `neon-http` the commit path throws at
- *      runtime.
- *   2. The `db.execute` result shape is driver-specific — `postgres-js` returns an
- *      array-like row list, while `node-postgres` returns `{ rows }`. `rowsOf`
- *      normalizes both.
- *
- * Every write goes through `sql` and `db.execute` rather than the fluent builder,
- * which keeps the adapter one small, fully typed unit with no per-driver builder
- * generics.
- */
-import { type SQL } from 'drizzle-orm';
-import type { DataSourceAdapter, Row } from '../adapter.js';
-import type { Schema, SchemaRecord } from '../../transaction/schema/schema.js';
-/** The subset of a Drizzle database/transaction handle the adapter calls. */
-export interface DrizzleLike {
-    execute(query: SQL): Promise<DrizzleExecuteResult>;
-    transaction<T>(fn: (tx: DrizzleLike) => Promise<T>): Promise<T>;
-}
-/** `db.execute` is array-like (postgres-js) or `{ rows }` (node-postgres). */
-export type DrizzleExecuteResult = readonly Row[] | {
-    readonly rows: readonly Row[];
-};
-export declare function drizzleDataSource<S extends SchemaRecord>(db: DrizzleLike, schema: Schema<S>): DataSourceAdapter;

package/dist/source/adapters/drizzle.js

@@ -1,219 +0,0 @@
-/**
- * The Drizzle adapter for the data-source interface. It implements the same
- * {@link DataSourceAdapter} contract as {@link prismaDataSource} and passes the
- * same conformance suite, built against Drizzle's query API:
- *   - `db.transaction(async (tx) => …)` runs an interactive transaction that
- *     commits or rolls back as a unit.
- *   - `db.execute(sql`…`)` runs parameterized raw SQL; `sql.identifier()` safely
- *     quotes dynamic table and column names, and `sql`${value}`` parameterizes
- *     values.
- *
- * Table and column names come from your schema, not from a hand-written Drizzle
- * table. Because this adapter issues raw SQL, it would otherwise bypass any
- * field-to-column translation, so it derives every name from the same rule the
- * table provisioner uses:
- *   table  = `model.tableName ?? key`
- *   column = `fieldMeta.column ?? camelToSnake(field)`   (plus the tenancy column)
- * This keeps the tables `ablo migrate` creates (for example `operator_id`) and the
- * columns this adapter reads and writes in agreement. You define the schema once
- * and point the engine at your Postgres database. The adapter is the translation
- * boundary: the rows it accepts and returns, and the outbox `data` it writes, are
- * keyed by field name, while the physical columns it touches are snake_case.
- *
- * Two things to know about drivers:
- *   1. Interactive `db.transaction` needs a driver that supports it. Neon's
- *      `neon-http` driver is single-shot and does not, so use `neon-serverless`
- *      (over WebSocket) or `pg`; under `neon-http` the commit path throws at
- *      runtime.
- *   2. The `db.execute` result shape is driver-specific — `postgres-js` returns an
- *      array-like row list, while `node-postgres` returns `{ rows }`. `rowsOf`
- *      normalizes both.
- *
- * Every write goes through `sql` and `db.execute` rather than the fluent builder,
- * which keeps the adapter one small, fully typed unit with no per-driver builder
- * generics.
- */
-import { AbloValidationError } from '../../transaction/errors.js';
-import { sql } from 'drizzle-orm';
-import { outboxEventSchema } from '../contract.js';
-import { adapterTableMigrations } from '../migrations.js';
-import { assertSourceIdempotencyIntent, assertSourceIdempotencyRetention, SOURCE_IDEMPOTENCY_RETENTION, sourceChangeIntentHash, } from '../idempotency.js';
-import { toSchemaJSON } from '../../schema/serialize.js';
-import { camelToSnake, snakeToCamel } from '../../schema/ddl.js';
-import { tenancyColumn } from '../../transaction/schema/tenancy.js';
-import { ABLO_POSTGRES_COMMIT_ECHO_PREFIX } from '../types.js';
-function rowsOf(result) {
-    return Array.isArray(result) ? result : result.rows;
-}
-function rowId(op) {
-    const id = op.id ?? op.input?.id;
-    if (typeof id !== 'string' || id.length === 0) {
-        throw new AbloValidationError(`operation on "${op.model}" requires an id`, { code: 'source_operation_id_required' });
-    }
-    return id;
-}
-/** `col1, col2` as a safely-quoted identifier list. */
-const identList = (cols) => sql.join(cols.map((c) => sql.identifier(c)), sql `, `);
-function buildColumnMaps(schema) {
-    const json = toSchemaJSON(schema);
-    const out = new Map();
-    for (const [key, model] of Object.entries(json.models)) {
-        const fieldToColumn = new Map();
-        const columnToField = new Map();
-        const register = (field, column) => {
-            // The default rule already covers `camelToSnake(field)`; only record real
-            // divergences so the reverse map never shadows a clean round-trip.
-            if (column === camelToSnake(field))
-                return;
-            fieldToColumn.set(field, column);
-            columnToField.set(column, field);
-        };
-        for (const [field, meta] of Object.entries(model.fields)) {
-            if (meta.column)
-                register(field, meta.column);
-        }
-        const orgColumn = tenancyColumn(model.tenancy);
-        if (orgColumn)
-            register('organizationId', orgColumn);
-        out.set(key, { table: model.tableName ?? key, fieldToColumn, columnToField });
-    }
-    return out;
-}
-export function drizzleDataSource(db, schema) {
-    const maps = buildColumnMaps(schema);
-    const modelColumns = (model) => {
-        const mc = maps.get(model);
-        if (!mc)
-            throw new AbloValidationError(`drizzleDataSource: no model "${model}" in schema`, { code: 'source_adapter_misconfigured' });
-        return mc;
-    };
-    const columnFor = (mc, field) => mc.fieldToColumn.get(field) ?? camelToSnake(field);
-    const fieldFor = (mc, column) => mc.columnToField.get(column) ?? snakeToCamel(column);
-    /** Field-keyed row to column-keyed row, for INSERT and UPDATE values. */
-    const toColumns = (mc, row) => {
-        const out = {};
-        for (const k of Object.keys(row))
-            out[columnFor(mc, k)] = row[k];
-        return out;
-    };
-    /** Column-keyed row (from `RETURNING *` or `SELECT *`) back to a field-keyed row, for reads and results. */
-    const toFields = (mc, row) => {
-        const out = {};
-        for (const k of Object.keys(row))
-            out[fieldFor(mc, k)] = row[k];
-        return out;
-    };
-    const applyOperation = async (tx, op) => {
-        const mc = modelColumns(op.model);
-        const table = sql.identifier(mc.table);
-        const id = rowId(op);
-        const input = op.input ?? {};
-        if (op.type === 'DELETE') {
-            const deleted = rowsOf(await tx.execute(sql `DELETE FROM ${table} WHERE id = ${id} RETURNING *`));
-            return deleted[0] ? toFields(mc, deleted[0]) : { id };
-        }
-        if (op.type === 'CREATE') {
-            const data = toColumns(mc, { id, ...input });
-            const cols = Object.keys(data);
-            const values = sql.join(cols.map((c) => sql `${data[c]}`), sql `, `);
-            const inserted = rowsOf(await tx.execute(sql `INSERT INTO ${table} (${identList(cols)}) VALUES (${values}) RETURNING *`));
-            return inserted[0] ? toFields(mc, inserted[0]) : { id, ...input };
-        }
-        // UPDATE / ARCHIVE / UNARCHIVE — a SET clause + the lifecycle field. The
-        // lifecycle field is `archivedAt` (camelCase) and goes through `toColumns`
-        // like any other, so it lands in `archived_at` — same column the provisioner
-        // emits and the Prisma adapter writes (no per-adapter casing divergence).
-        const patch = toColumns(mc, {
-            ...input,
-            ...(op.type === 'ARCHIVE' ? { archivedAt: new Date() } : {}),
-            ...(op.type === 'UNARCHIVE' ? { archivedAt: null } : {}),
-        });
-        const assignments = sql.join(Object.keys(patch).map((c) => sql `${sql.identifier(c)} = ${patch[c]}`), sql `, `);
-        const updated = rowsOf(await tx.execute(sql `UPDATE ${table} SET ${assignments} WHERE id = ${id} RETURNING *`));
-        return updated[0] ? toFields(mc, updated[0]) : { id, ...input };
-    };
-    return {
-        capabilities: {
-            transactions: true,
-            propose: false,
-            schemaIntrospection: true,
-            postgresWalEcho: true,
-            outboxEvents: true,
-        },
-        migrations() {
-            return adapterTableMigrations();
-        },
-        async read(req) {
-            const mc = modelColumns(req.model);
-            const table = sql.identifier(mc.table);
-            if (req.kind === 'load') {
-                const rows = rowsOf(await db.execute(sql `SELECT * FROM ${table} WHERE id = ${req.id} LIMIT 1`));
-                return rows.map((r) => toFields(mc, r));
-            }
-            const limit = req.query?.limit ?? 1000;
-            const rows = rowsOf(await db.execute(sql `SELECT * FROM ${table} LIMIT ${limit}`));
-            return rows.map((r) => toFields(mc, r));
-        },
-        async commit(change) {
-            const requestHash = sourceChangeIntentHash(change);
-            return db.transaction(async (tx) => {
-                const cached = rowsOf(await tx.execute(sql `SELECT response, request_hash AS "requestHash", expires_at AS "expiresAt"
-                FROM ablo_idempotency
-                WHERE client_tx_id = ${change.correlationId} LIMIT 1`));
-                const cachedRow = cached[0];
-                if (cachedRow) {
-                    assertSourceIdempotencyIntent(cachedRow.requestHash, requestHash);
-                    assertSourceIdempotencyRetention(cachedRow.expiresAt);
-                    return { rows: cachedRow.response };
-                }
-                const rows = [];
-                for (const [index, op] of change.operations.entries()) {
-                    const row = await applyOperation(tx, op);
-                    rows.push(row);
-                    const entityId = String(row.id ?? rowId(op));
-                    await tx.execute(sql `
-            INSERT INTO ablo_outbox (
-              id, model, entity_id, type, data,
-              correlation_id, transaction_id, occurred_at
-            )
-            VALUES (
-              ${`${change.correlationId}:${index}`}, ${op.model}, ${entityId}, ${op.type},
-              ${op.type === 'DELETE' ? null : JSON.stringify(row)}::jsonb,
-              ${change.correlationId}, ${op.transactionId ?? null}, ${Date.now()}
-            )`);
-                }
-                await tx.execute(sql `
-          INSERT INTO ablo_idempotency (client_tx_id, response, request_hash, expires_at)
-          VALUES (
-            ${change.correlationId}, ${JSON.stringify(rows)}::jsonb, ${requestHash},
-            now() + ${SOURCE_IDEMPOTENCY_RETENTION}::interval
-          )`);
-                if (change.echo?.kind === 'postgres-wal') {
-                    await tx.execute(sql `SELECT pg_logical_emit_message(true, ${ABLO_POSTGRES_COMMIT_ECHO_PREFIX}, ${change.echo.payload})`);
-                }
-                return { rows };
-            });
-        },
-        async events(cursor, limit) {
-            const after = cursor ?? '0';
-            const rows = rowsOf(await db.execute(sql `
-          SELECT cursor, id, model, entity_id, type, data, organization_id,
-                 client_tx_id, correlation_id, transaction_id, occurred_at
-          FROM ablo_outbox WHERE cursor > ${after} ORDER BY cursor ASC LIMIT ${limit}`));
-            const events = rows.map((r) => outboxEventSchema.parse({
-                id: r.id,
-                model: r.model,
-                entityId: r.entity_id,
-                type: r.type,
-                data: r.data ?? null,
-                organizationId: r.organization_id ?? null,
-                clientTxId: r.client_tx_id ?? null,
-                correlationId: r.correlation_id ?? null,
-                transactionId: r.transaction_id ?? null,
-                occurredAt: r.occurred_at != null ? Number(r.occurred_at) : null,
-                cursor: String(r.cursor),
-            }));
-            return { events, nextCursor: events.at(-1)?.cursor ?? null };
-        },
-    };
-}