@abloatai/ablo 0.36.0 → 0.37.1

package/dist/transaction/footprint.d.ts

@@ -1,111 +0,0 @@
-/**
- * The footprint — every object Ablo leaves inside a customer's own database,
- * declared once.
- *
- * Four things need this list and each used to carry its own copy: the setup SQL
- * that creates the objects, the replication runtime that reads them, the audit
- * that tells a customer what Ablo put there, and (eventually) the teardown that
- * removes them. They drifted, as hand-maintained copies do — `ABLO_PUBLICATION`
- * was declared twice, under a comment insisting the literals "MUST equal the
- * CLI's" and pointing at a file that no longer held it, and the audit went on
- * looking for a footprint from an earlier era while seeing none of what Ablo
- * installs today.
- *
- * The audit is the copy that matters most. A customer runs it to answer "what is
- * still in my database", and a stale list answers "nothing" — which reads as
- * clean rather than as unexamined. So the list lives here, every consumer
- * derives from it, and an object added to Ablo's setup is visible to the audit
- * because it could not have been added anywhere else.
- *
- * Retired objects stay in the list, marked {@link FootprintArtifact.retired}.
- * They are no longer installed, but a database connected to an older Ablo still
- * holds them, and those are precisely the ones a customer would never think to
- * look for.
- */
-/** The Postgres object class, which decides how the audit looks it up. */
-export type FootprintKind = 'publication' | 'slot' | 'role' | 'table' | 'type';
-export interface FootprintArtifact {
-    readonly kind: FootprintKind;
-    readonly name: string;
-    /** What it is for, in the words a customer reading an audit would want. */
-    readonly purpose: string;
-    /**
-     * Installed only for a data source that reports through the signed endpoint
-     * rather than the write-ahead log.
-     */
-    readonly endpointOnly?: boolean;
-    /**
-     * No longer installed by any current version. A database that once ran an
-     * older Ablo still holds it; the audit reports it so it can be cleaned up.
-     */
-    readonly retired?: boolean;
-    /**
-     * What it costs to leave behind, when leaving it behind costs something. The
-     * audit leads with this, because "you still have an object named X" is not a
-     * reason to act and "this one is retaining your write-ahead log" is.
-     */
-    readonly hazard?: string;
-}
-/**
- * The publication Ablo's replication reads from. Constant by design: a
- * publication declares what streams, and several readers are meant to share one
- * (`publication_names` is a per-stream option, not slot state).
- */
-export declare const ABLO_PUBLICATION = "ablo_publication";
-/**
- * The replication slot that holds Ablo's position in the write-ahead log.
- *
- * Constant, and it should not be — a slot stores ONE position, so two
- * connections sharing this name compete for the same marker. It is why a
- * database can be connected to one plane at a time. ADR 0020 derives it per
- * connection; {@link isValidReplicationSlotName} is the check a derived name
- * has to pass.
- */
-export declare const ABLO_REPLICATION_SLOT = "ablo_slot";
-/** The least-privilege login Ablo reads with. Per-connection under ADR 0020. */
-export declare const ABLO_REPLICATION_ROLE = "ablo_replicator";
-/** The separate least-privilege login used only for row writes. */
-export declare const ABLO_WRITE_ROLE = "ablo_writer";
-/** The bookkeeping table that makes a retried write land once. */
-export declare const ABLO_IDEMPOTENCY_TABLE = "ablo_idempotency";
-/** The transactional outbox an endpoint source reports through. */
-export declare const ABLO_OUTBOX_TABLE = "ablo_outbox";
-/**
- * Postgres will not accept a replication slot name outside this shape — the
- * check is in `ReplicationSlotValidateNameInternal`, and identifier quoting does
- * not exempt a name from it. Anything derived into a slot name is validated
- * here, at the point it is derived, rather than failing at the point it is used.
- */
-export declare const REPLICATION_SLOT_NAME: RegExp;
-export declare function isValidReplicationSlotName(name: string): boolean;
-/** The four plane axes a connection is identified by. */
-export interface FootprintPlane {
-    readonly organizationId: string;
-    readonly environment: string;
-    /** '' for the organization-default project. */
-    readonly projectId?: string;
-    /** '' for the default sandbox. */
-    readonly sandboxId?: string;
-}
-/** The names one connection owns. Nothing here is shared with another plane. */
-export interface FootprintNames {
-    readonly slot: string;
-    readonly publication: string;
-    readonly replicationRole: string;
-    readonly writeRole: string;
-}
-/**
- * The objects this connection owns, named so no other connection can claim them.
- *
- * A slot stores ONE position, so two connections sharing a name compete for the
- * same marker and Postgres reports nothing — which is why the constants these
- * replace made a database connectable to one plane at a time. The publication
- * and roles are derived from the same digest so a database's footprint reads as
- * one set per connection rather than a mix of shared and private objects.
- *
- * Stable: the same plane always derives the same names, so re-running setup is a
- * no-op rather than a second installation.
- */
-export declare function footprintNamesFor(plane: FootprintPlane): FootprintNames;
-/** Everything Ablo has ever put in a customer's database, current and retired. */
-export declare const ABLO_FOOTPRINT: readonly FootprintArtifact[];

package/dist/transaction/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * The Ablo settlement core (ADR 0013).
- *
- * The transaction layer that the reactive client is a consumer of, not the
- * other way round. The root barrel is deliberate: it exports the seam —
- * {@link TransactionLayer} — plus exactly the vocabulary its signatures
- * reference and the error hierarchy callers catch. Everything else stays on
- * subpaths; every addition here is a decision
- * (docs/plans/transaction-layer-barrel-design.md).
- */
-export type { TransactionLayer, ListQuery, CommitReceipt } from './transactionLayer.js';
-export { Ablo } from './ablo.js';
-export type { AbloHttpClient, AbloHttpClientOptions, HttpModelClient, } from './transport/httpClient.js';
-export type { Delta, HeldClaim, HeldLease, ClaimTarget, ClaimLeaseOptions, } from './types/streams.js';
-export type { ModelData } from './types/modelData.js';
-export { LogPosition, logPositionSchema, parseLogPosition } from './logPosition.js';
-export type { LogPositionSnapshot } from './logPosition.js';
-export { AbloError, AbloAuthenticationError, AbloPermissionError, AbloRateLimitError, AbloIdempotencyError, AbloConnectionError, AbloValidationError, AbloNotFoundError, AbloServerError, AbloStaleContextError, AbloContentionError, AbloClaimedError, AbloSessionError, toAbloError, } from './errors.js';
-export * from './errorCodes.js';
-export * from './environment.js';

package/dist/transaction/index.js

@@ -1,20 +0,0 @@
-/**
- * The Ablo settlement core (ADR 0013).
- *
- * The transaction layer that the reactive client is a consumer of, not the
- * other way round. The root barrel is deliberate: it exports the seam —
- * {@link TransactionLayer} — plus exactly the vocabulary its signatures
- * reference and the error hierarchy callers catch. Everything else stays on
- * subpaths; every addition here is a decision
- * (docs/plans/transaction-layer-barrel-design.md).
- */
-// The client entry point (ADR 0016). The bare import constructs the
-// coordination layer over request/response transport; the reactive
-// materialiser is the consumer package's entry point, layered above it.
-export { Ablo } from './ablo.js';
-export { LogPosition, logPositionSchema, parseLogPosition } from './logPosition.js';
-// The error hierarchy callers catch.
-export { AbloError, AbloAuthenticationError, AbloPermissionError, AbloRateLimitError, AbloIdempotencyError, AbloConnectionError, AbloValidationError, AbloNotFoundError, AbloServerError, AbloStaleContextError, AbloContentionError, AbloClaimedError, AbloSessionError, toAbloError, } from './errors.js';
-// Pre-seam leaf surfaces, kept for compatibility with the first extraction.
-export * from './errorCodes.js';
-export * from './environment.js';

package/dist/transaction/keys/index.d.ts

@@ -1,87 +0,0 @@
-/**
- * The Ablo API-key format: how keys are minted, hashed, and validated, in one
- * place so every component that issues or checks a key agrees on the format.
- *
- * This module uses `node:crypto` and is therefore Node-only. It is published on
- * the `@abloatai/ablo/keys` subpath and kept off the main browser-facing entry
- * so a browser bundle never pulls in `node:crypto`.
- *
- * A key looks like `<sk|rk|ek|pk>_<live|test>_<30 base62 chars><6-char base62
- * CRC32 checksum>`. The middle segment is the stable environment prefix, mapped
- * on parse to `production` or `sandbox`. The recognizable prefix lets secret
- * scanners spot a leaked key, and the trailing checksum lets the format reject a
- * mistyped or forged key locally, without a database round-trip. Older keys
- * (roughly a 43-character base64url body with no checksum) still validate by hash
- * and parse here with `checksummed: false`.
- */
-import { z } from 'zod';
-import { type KeyEnvironment } from '../environment.js';
-export declare const API_KEY_KINDS: readonly ["secret", "restricted", "ephemeral", "publishable"];
-export type ApiKeyKind = (typeof API_KEY_KINDS)[number];
-export declare const API_KEY_ENVS: readonly ["production", "sandbox"];
-export type ApiKeyEnv = KeyEnvironment;
-/** A structurally-valid Ablo API key, parsed into its parts. */
-export interface ParsedApiKey {
-    /** The original plaintext. */
-    raw: string;
-    kind: ApiKeyKind;
-    env: ApiKeyEnv;
-    /** The chars after `<prefix>_<env>_` (body + checksum for new keys). */
-    body: string;
-    /** True when this is the new checksummed format (36-char base62 body). */
-    checksummed: boolean;
-}
-/**
- * The Zod schema for an Ablo API key. `parse` and `safeParse` return a typed
- * {@link ParsedApiKey}. A checksummed-format key whose checksum does not match is
- * rejected without any network call; an older key with no checksum parses with
- * `checksummed: false` and is left for the server to validate by hash.
- */
-export declare const apiKeySchema: z.ZodPipe<z.ZodString, z.ZodTransform<ParsedApiKey, string>>;
-/** Parse + fully validate (incl. checksum). Returns null when invalid. */
-export declare function parseApiKey(raw: string): ParsedApiKey | null;
-/**
- * Read the environment off a STORED display prefix (`keyPrefix`, the first 12
- * chars — `rk_test_abcd`), rather than off a full plaintext key.
- *
- * A key row records its environment nowhere but its prefix, so this is how a
- * server-side flow that only has the row — rotation, most importantly — recovers
- * the credential's own mode. Returns null when the prefix is not a recognizable
- * key spelling, so callers can fail closed rather than fall back to a default.
- */
-export declare function environmentFromStoredKeyPrefix(prefix: string): KeyEnvironment | null;
-/** True when the key uses the new checksummed format (regardless of validity). */
-export declare function isChecksummedKey(raw: string): boolean;
-/** Verify the embedded checksum. Meaningful only for checksummed-format keys. */
-export declare function keyChecksumMatches(raw: string): boolean;
-/**
- * Mint a key: `<prefix>_<env>_<body><checksum>`. Returns the plaintext (shown
- * once), its SHA-256 hash (persisted), and the 12-char display prefix.
- */
-export declare function generateApiKey(env?: ApiKeyEnv, kind?: ApiKeyKind): {
-    plaintext: string;
-    hash: string;
-    prefix: string;
-};
-/**
- * The stable SHA-256 hex digest of a plaintext key, computed both when a key is
- * minted and when one is looked up. A fast hash is the right choice here rather
- * than a password hash like bcrypt: API keys are long random strings, so there is
- * no dictionary of guesses to slow down.
- */
-export declare function hashApiKey(plaintext: string): string;
-/** `whsec_` label prefix per the Standard Webhooks spec (not part of the key material). */
-export declare const WEBHOOK_SECRET_PREFIX = "whsec_";
-/**
- * Mints a webhook signing secret following the Standard Webhooks specification
- * (https://www.standardwebhooks.com): a base64-encoded random key of 24–64 bytes,
- * labelled with the `whsec_` prefix. This uses 32 bytes (256 bits), comfortably
- * inside that range. Unlike an API key, a signing secret is not hashed at rest,
- * because signing a request with {@link signAbloSourceRequest} needs the live
- * value. It is therefore kept in a secret store, returned to the customer once at
- * creation, and never shown again.
- */
-export declare function generateWebhookSecret(): {
-    plaintext: string;
-    last4: string;
-};

package/dist/transaction/keys/index.js

@@ -1,207 +0,0 @@
-/**
- * The Ablo API-key format: how keys are minted, hashed, and validated, in one
- * place so every component that issues or checks a key agrees on the format.
- *
- * This module uses `node:crypto` and is therefore Node-only. It is published on
- * the `@abloatai/ablo/keys` subpath and kept off the main browser-facing entry
- * so a browser bundle never pulls in `node:crypto`.
- *
- * A key looks like `<sk|rk|ek|pk>_<live|test>_<30 base62 chars><6-char base62
- * CRC32 checksum>`. The middle segment is the stable environment prefix, mapped
- * on parse to `production` or `sandbox`. The recognizable prefix lets secret
- * scanners spot a leaked key, and the trailing checksum lets the format reject a
- * mistyped or forged key locally, without a database round-trip. Older keys
- * (roughly a 43-character base64url body with no checksum) still validate by hash
- * and parse here with `checksummed: false`.
- */
-import { createHash, randomBytes } from 'node:crypto';
-import { z } from 'zod';
-import { KEY_ENVIRONMENTS, KEY_PREFIX_ENVIRONMENTS, environmentFromKeyPrefix, environmentToKeyPrefix, } from '../environment.js';
-// ── Vocabulary ──────────────────────────────────────────────────────────
-// The four key kinds:
-//   secret (sk_)      — backend and server-to-server use, including agents. Full
-//                       authority; never expose one in a browser.
-//   restricted (rk_)  — a scoped server key, such as an agent session token or a
-//                       narrowed capability.
-//   ephemeral (ek_)   — a short-lived, backend-minted session credential scoped to
-//                       one user, safe to hand to that user's browser. Carries
-//                       `participantKind: 'user'` and its baked-in sync groups.
-//   publishable (pk_) — a long-lived, browser-safe, organization-scoped read-only
-//                       key. It is used directly as the bearer token — never
-//                       exchanged, never expires, nothing to refresh. It grants
-//                       read access to the organization's data and cannot write or
-//                       reach any control-plane operation.
-export const API_KEY_KINDS = ['secret', 'restricted', 'ephemeral', 'publishable'];
-// A key's environment is the CREDENTIAL axis, not the plane axis: the format
-// below spells it as one of two prefixes, so a plane name outside those two has
-// no representation here and must not reach `generateApiKey`.
-export const API_KEY_ENVS = KEY_ENVIRONMENTS;
-const PREFIX_BY_KIND = {
-    secret: 'sk',
-    restricted: 'rk',
-    ephemeral: 'ek',
-    publishable: 'pk',
-};
-const KIND_BY_PREFIX = {
-    sk: 'secret',
-    rk: 'restricted',
-    ek: 'ephemeral',
-    pk: 'publishable',
-};
-const BASE62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
-/** Random base62 chars before the checksum. */
-const KEY_BODY_LEN = 30;
-/** base62(CRC32): 62^6 (~5.7e10) > 2^32, so a CRC32 always fits in 6 chars. */
-const CHECKSUM_LEN = 6;
-/** A new checksummed body is exactly this long and pure base62. */
-const CHECKSUMMED_BODY_LEN = KEY_BODY_LEN + CHECKSUM_LEN;
-/** `<sk|rk|ek|pk>_<live|test>_<body>`; the body charset covers base62 as well as the legacy base64url form. */
-const KEY_RE = /^(sk|rk|ek|pk)_(live|test)_([0-9A-Za-z\-_]+)$/;
-const BASE62_RE = /^[0-9A-Za-z]+$/;
-// ── Checksum (standard CRC-32, GitHub-compatible) ───────────────────────
-const CRC32_TABLE = (() => {
-    const t = new Uint32Array(256);
-    for (let n = 0; n < 256; n++) {
-        let c = n;
-        for (let k = 0; k < 8; k++)
-            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-        t[n] = c >>> 0;
-    }
-    return t;
-})();
-function crc32(s) {
-    let c = 0xffffffff;
-    for (let i = 0; i < s.length; i++) {
-        // `& 0xff` bounds the index to the 256-entry table — the ?? 0 is unreachable.
-        c = ((CRC32_TABLE[(c ^ s.charCodeAt(i)) & 0xff] ?? 0) ^ (c >>> 8)) >>> 0;
-    }
-    return (c ^ 0xffffffff) >>> 0;
-}
-/** 6-char base62 encoding of the CRC32 of `payload`. */
-function checksum6(payload) {
-    let n = crc32(payload);
-    let out = '';
-    for (let i = 0; i < CHECKSUM_LEN; i++) {
-        out = BASE62.charAt(n % 62) + out;
-        n = Math.floor(n / 62);
-    }
-    return out;
-}
-/** `len` cryptographically-random base62 chars (rejection-sampled, no bias). */
-function randomBase62(len) {
-    let out = '';
-    while (out.length < len) {
-        for (const b of randomBytes(len * 2)) {
-            if (b < 248) {
-                out += BASE62.charAt(b % 62);
-                if (out.length === len)
-                    break;
-            }
-        }
-    }
-    return out;
-}
-function bodyIsChecksummed(body) {
-    return body.length === CHECKSUMMED_BODY_LEN && BASE62_RE.test(body);
-}
-/**
- * The Zod schema for an Ablo API key. `parse` and `safeParse` return a typed
- * {@link ParsedApiKey}. A checksummed-format key whose checksum does not match is
- * rejected without any network call; an older key with no checksum parses with
- * `checksummed: false` and is left for the server to validate by hash.
- */
-export const apiKeySchema = z.string().transform((raw, ctx) => {
-    const m = KEY_RE.exec(raw);
-    if (!m) {
-        ctx.addIssue({ code: 'custom', message: 'not a valid Ablo API key format' });
-        return z.NEVER;
-    }
-    const [, prefix, env, body] = m;
-    const kind = prefix === undefined ? undefined : KIND_BY_PREFIX[prefix];
-    // Unreachable on a KEY_RE match (all three groups are non-optional and the
-    // prefix alternation is exactly the KIND_BY_PREFIX key set) — narrows the
-    // regex-group lookups for the checks below.
-    if (kind === undefined || env === undefined || body === undefined) {
-        ctx.addIssue({ code: 'custom', message: 'not a valid Ablo API key format' });
-        return z.NEVER;
-    }
-    const checksummed = bodyIsChecksummed(body);
-    if (checksummed && checksum6(raw.slice(0, -CHECKSUM_LEN)) !== body.slice(KEY_BODY_LEN)) {
-        ctx.addIssue({ code: 'custom', message: 'API key checksum mismatch' });
-        return z.NEVER;
-    }
-    return {
-        raw,
-        kind,
-        env: environmentFromKeyPrefix(env),
-        body,
-        checksummed,
-    };
-});
-// ── Derived validators (thin wrappers over the same spec) ───────────────
-/** Parse + fully validate (incl. checksum). Returns null when invalid. */
-export function parseApiKey(raw) {
-    const r = apiKeySchema.safeParse(raw);
-    return r.success ? r.data : null;
-}
-/**
- * Read the environment off a STORED display prefix (`keyPrefix`, the first 12
- * chars — `rk_test_abcd`), rather than off a full plaintext key.
- *
- * A key row records its environment nowhere but its prefix, so this is how a
- * server-side flow that only has the row — rotation, most importantly — recovers
- * the credential's own mode. Returns null when the prefix is not a recognizable
- * key spelling, so callers can fail closed rather than fall back to a default.
- */
-export function environmentFromStoredKeyPrefix(prefix) {
-    const spelling = /^(?:sk|rk|ek|pk)_([a-z]+)_/.exec(prefix)?.[1];
-    const env = KEY_PREFIX_ENVIRONMENTS.find((candidate) => candidate === spelling);
-    return env === undefined ? null : environmentFromKeyPrefix(env);
-}
-/** True when the key uses the new checksummed format (regardless of validity). */
-export function isChecksummedKey(raw) {
-    const body = KEY_RE.exec(raw)?.[3];
-    return body !== undefined && bodyIsChecksummed(body);
-}
-/** Verify the embedded checksum. Meaningful only for checksummed-format keys. */
-export function keyChecksumMatches(raw) {
-    const body = KEY_RE.exec(raw)?.[3];
-    if (body === undefined || !bodyIsChecksummed(body))
-        return false;
-    return checksum6(raw.slice(0, -CHECKSUM_LEN)) === body.slice(KEY_BODY_LEN);
-}
-// ── Mint + hash (node:crypto) ───────────────────────────────────────────
-/**
- * Mint a key: `<prefix>_<env>_<body><checksum>`. Returns the plaintext (shown
- * once), its SHA-256 hash (persisted), and the 12-char display prefix.
- */
-export function generateApiKey(env = 'production', kind = 'secret') {
-    const body = randomBase62(KEY_BODY_LEN);
-    const payload = `${PREFIX_BY_KIND[kind]}_${environmentToKeyPrefix(env)}_${body}`;
-    const plaintext = `${payload}${checksum6(payload)}`;
-    return { plaintext, hash: hashApiKey(plaintext), prefix: plaintext.slice(0, 12) };
-}
-/**
- * The stable SHA-256 hex digest of a plaintext key, computed both when a key is
- * minted and when one is looked up. A fast hash is the right choice here rather
- * than a password hash like bcrypt: API keys are long random strings, so there is
- * no dictionary of guesses to slow down.
- */
-export function hashApiKey(plaintext) {
-    return createHash('sha256').update(plaintext).digest('hex');
-}
-/** `whsec_` label prefix per the Standard Webhooks spec (not part of the key material). */
-export const WEBHOOK_SECRET_PREFIX = 'whsec_';
-/**
- * Mints a webhook signing secret following the Standard Webhooks specification
- * (https://www.standardwebhooks.com): a base64-encoded random key of 24–64 bytes,
- * labelled with the `whsec_` prefix. This uses 32 bytes (256 bits), comfortably
- * inside that range. Unlike an API key, a signing secret is not hashed at rest,
- * because signing a request with {@link signAbloSourceRequest} needs the live
- * value. It is therefore kept in a secret store, returned to the customer once at
- * creation, and never shown again.
- */
-export function generateWebhookSecret() {
-    const plaintext = `${WEBHOOK_SECRET_PREFIX}${randomBytes(32).toString('base64')}`;
-    return { plaintext, last4: plaintext.slice(-4) };
-}

package/dist/transaction/log/syncDeltaRow.d.ts

@@ -1,158 +0,0 @@
-/**
- * Zod schemas that describe the `sync_deltas` storage row — the durable record of
- * one committed change. The row is split into two slices by the concern each one
- * serves:
- *
- *   - {@link syncDeltaCoreSchema} — the sync-protocol slice: everything a client
- *     needs to reconstruct the change, plus the tenant key. This is a portable
- *     payload shape; it is not a statement that the row is physically stored in
- *     the customer's database.
- *   - {@link deltaAttributionSchema} — who made the change, and on whose authority.
- *
- * {@link syncDeltaRowSchema} composes both into the full stored row.
- * {@link DELTA_DATA_CLASSIFICATION} states which slices contain customer data,
- * while {@link DELTA_PHYSICAL_STORAGE} states where the runtime persists them.
- * Keeping those axes separate prevents a portable schema slice from being cited
- * incorrectly as a physical-residency guarantee.
- *
- * This is the stored shape. The delta broadcast to clients is a narrower projection
- * of it — see {@link import('../wire/delta.js').syncDeltaWireCoreSchema} — and
- * the field names here mirror those on that wire delta.
- */
-import { z } from 'zod';
-export { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-export type { ParticipantKind, ConfirmationState } from '../wire/delta.js';
-/** `backfill_provenance` */
-export declare const backfillProvenanceSchema: z.ZodEnum<{
-    unknown: "unknown";
-    exact: "exact";
-    inferred: "inferred";
-}>;
-export type BackfillProvenance = z.infer<typeof backfillProvenanceSchema>;
-/**
- * Everything a client needs to materialize the change, plus the tenant key. This
- * is the portable shape an authoritative WAL change or endpoint event carries.
- * The runtime persists the resulting full row in Ablo's tenant-scoped ordered
- * sync log; it is not written atomically with a direct application-row mutation.
- * `id`, `createdAt`, and `syncGroups` are assigned when the source change is
- * appended, so they are optional at the ingestion boundary.
- */
-export declare const syncDeltaCoreSchema: z.ZodObject<{
-    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodBigInt, z.ZodNumber]>>;
-    actionType: z.ZodEnum<{
-        I: "I";
-        U: "U";
-        D: "D";
-        A: "A";
-        V: "V";
-        C: "C";
-        G: "G";
-        S: "S";
-    }>;
-    modelName: z.ZodString;
-    modelId: z.ZodString;
-    data: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    previousData: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-    syncGroups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    organizationId: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodOptional<z.ZodString>;
-    transactionId: z.ZodNullable<z.ZodString>;
-    sourceChangeId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-}, z.core.$strip>;
-export type SyncDeltaCore = z.infer<typeof syncDeltaCoreSchema>;
-export declare const deltaAttributionSchema: z.ZodObject<{
-    createdBy: z.ZodNullable<z.ZodString>;
-    actorId: z.ZodNullable<z.ZodString>;
-    actorKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    onBehalfOfId: z.ZodNullable<z.ZodString>;
-    onBehalfOfKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    capabilityId: z.ZodNullable<z.ZodString>;
-    delegationChainRootUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    confirmationState: z.ZodNullable<z.ZodEnum<{
-        auto: "auto";
-        previewed: "previewed";
-        approved: "approved";
-        required_human_approval: "required_human_approval";
-        auto_historical: "auto_historical";
-    }>>;
-    backfillProvenance: z.ZodNullable<z.ZodEnum<{
-        unknown: "unknown";
-        exact: "exact";
-        inferred: "inferred";
-    }>>;
-}, z.core.$strip>;
-export type DeltaAttribution = z.infer<typeof deltaAttributionSchema>;
-/** The complete `sync_deltas` row: core and attribution combined. */
-export declare const syncDeltaRowSchema: z.ZodObject<{
-    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodBigInt, z.ZodNumber]>>;
-    actionType: z.ZodEnum<{
-        I: "I";
-        U: "U";
-        D: "D";
-        A: "A";
-        V: "V";
-        C: "C";
-        G: "G";
-        S: "S";
-    }>;
-    modelName: z.ZodString;
-    modelId: z.ZodString;
-    data: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    previousData: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-    syncGroups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    organizationId: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodOptional<z.ZodString>;
-    transactionId: z.ZodNullable<z.ZodString>;
-    sourceChangeId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    createdBy: z.ZodNullable<z.ZodString>;
-    actorId: z.ZodNullable<z.ZodString>;
-    actorKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    onBehalfOfId: z.ZodNullable<z.ZodString>;
-    onBehalfOfKind: z.ZodNullable<z.ZodEnum<{
-        user: "user";
-        agent: "agent";
-        system: "system";
-    }>>;
-    capabilityId: z.ZodNullable<z.ZodString>;
-    delegationChainRootUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    confirmationState: z.ZodNullable<z.ZodEnum<{
-        auto: "auto";
-        previewed: "previewed";
-        approved: "approved";
-        required_human_approval: "required_human_approval";
-        auto_historical: "auto_historical";
-    }>>;
-    backfillProvenance: z.ZodNullable<z.ZodEnum<{
-        unknown: "unknown";
-        exact: "exact";
-        inferred: "inferred";
-    }>>;
-}, z.core.$strip>;
-export type SyncDeltaRow = z.infer<typeof syncDeltaRowSchema>;
-/** Which slices contain retained customer row data versus control metadata. */
-export declare const DELTA_DATA_CLASSIFICATION: {
-    readonly core: "customer-data";
-    readonly attribution: "control-metadata";
-};
-/**
- * Where the current runtime physically persists each slice. Both live in
- * Ablo's tenant-scoped `sync_deltas` log. `core` contains full post-change row
- * payloads (and optional previous payloads), so `control` here must not be read
- * as "metadata only."
- */
-export declare const DELTA_PHYSICAL_STORAGE: {
-    readonly core: "control";
-    readonly attribution: "control";
-};