@abloatai/ablo 0.36.0 → 0.37.1

package/dist/transaction/policy/types.js

@@ -1,126 +0,0 @@
-/**
- * The conflict types a policy decides on. The engine detects a conflict and
- * hands it to your {@link ConflictPolicy}, which returns a
- * {@link ConflictDecision}.
- *
- * There are two conflict shapes. A {@link StaleContextConflict} is a write
- * whose `readAt` watermark is older than the latest delta on the target row. A
- * {@link ClaimHeldConflict} is a participant trying to claim a target that
- * someone else already holds. {@link Conflict} is the discriminated union of
- * the two; switch on `kind` to narrow it.
- */
-/**
- * The conflict policy the engine uses when you do not supply your own. It
- * favors people: a human is never blocked, while agents and automated writers
- * yield to a claim someone else holds.
- *
- * For a `claim_held` conflict, the decision follows the committer's kind:
- *
- *   • `user`   → `allow`  — a human is never blocked by a claim. A claim is a
- *                           coordination hint among agents, not a lock on
- *                           people.
- *   • `agent`  → `reject` — an agent yields to a claim held by someone else.
- *                           The one sanctioned exception is the privileged
- *                           `claim.preempt` capability; see
- *                           {@link capabilityPreemptPolicy}.
- *   • `system` → `reject` — automated and backend writers serialize through
- *                           claims the same way agents do, so a server job
- *                           cannot silently overwrite a held row. Declare the
- *                           model's conflict axis to overwrite if you want that.
- *
- * Allowing only `user` by default is deliberate: a backend key is a
- * full-access credential, and claim serialization depends on those writers
- * respecting claims unless a model opts out.
- *
- * For a `stale_context` conflict, the decision honors the committer's declared
- * `onStale` intent: `'notify'` holds the write and notifies the actor to
- * resolve it, and anything else (including `'reject'` or an absent value)
- * rejects. An `onStale` of `'overwrite'` never reaches a policy — it is a hard
- * opt-out resolved before the conflict is detected.
- *
- * To change this behavior for a model, declare its conflict axis in the schema;
- * a declared axis overrides this default.
- */
-// Typed by its real synchronous shape with `satisfies`, rather than the
-// async-permissive `ConflictPolicy` alias, so synchronous callers such as
-// `interpretConflictAxis` and `capabilityPreemptPolicy` receive a plain
-// `ConflictDecision` rather than `ConflictDecision | Promise<…>`. It remains
-// assignable to `ConflictPolicy` wherever it is used as one.
-export const defaultPolicy = ((conflict) => {
-    if (conflict.kind === 'claim_held') {
-        // A human (`user`) is never blocked; agents and system actors yield.
-        // Keeping every non-`user` kind on `reject` here ensures an agent cannot
-        // bypass a claim even on this default resolution path, which — unlike the
-        // declared-axis path — has no separate agent guard of its own.
-        return conflict.committer.kind === 'user'
-            ? { action: 'allow', note: 'principal:not-blocked' }
-            : { action: 'reject', reason: 'claim_conflict' };
-    }
-    return conflict.requestedMode === 'notify'
-        ? { action: 'notify', reason: 'stale_notify_hold' }
-        : { action: 'reject', reason: 'stale_context' };
-});
-/**
- * A ready-made policy that grants capability-gated preemption. When the
- * committer's capability allowlist includes the `claim.preempt` operation, a
- * `claim_held` conflict is preempted: the current holder is evicted and the
- * committer takes the lease. Every other conflict falls back to
- * {@link defaultPolicy}, which rejects. Register it as your conflict policy to
- * let a privileged identity take over a held entity without writing a bespoke
- * policy. The authorization rests on holding the capability, not on any
- * particular identity string.
- */
-export const capabilityPreemptPolicy = (conflict) => {
-    if (conflict.kind === 'claim_held' &&
-        conflict.committerOperations.includes('claim.preempt')) {
-        return { action: 'preempt', reason: 'capability:claim.preempt' };
-    }
-    return defaultPolicy(conflict);
-};
-const _conflictAxisPinned = [true, true];
-void _conflictAxisPinned;
-/**
- * Resolves a declared {@link ConflictAxis} into a {@link ConflictDecision} for
- * one concrete conflict. It is pure and synchronous, doing no I/O, so it can
- * run on either the client or the server. It reads the committer's kind from
- * the conflict and maps the declared mode:
- *
- *   - undefined   → the engine default, {@link defaultPolicy}: a human is
- *                   allowed, an agent or system committer is rejected on a
- *                   `claim_held`, and a stale write honors `onStale: 'notify'`.
- *   - `overwrite` → `allow`; the write wins and the committer is never blocked.
- *   - `reject`    → `reject`; the committer yields.
- *   - `notify`    → on a `stale_context` conflict, hold the write and notify so
- *                   the committer re-reads and re-applies; on a `claim_held`
- *                   conflict there is no held write to reconcile (see
- *                   {@link ConflictDecision} `notify`), so it degrades to
- *                   `reject` rather than silently writing to a claimed row.
- *
- * This is only the generic interpretation. Stronger server-side rules — such as
- * an agent never bypassing a claim held by someone else — are enforced where
- * the decision is applied, not here.
- */
-export function interpretConflictAxis(axis, conflict) {
-    const mode = axis[conflict.committer.kind];
-    if (mode === undefined)
-        return defaultPolicy(conflict);
-    switch (mode) {
-        case 'overwrite':
-            return { action: 'allow', note: 'conflict:overwrite' };
-        case 'reject':
-            return {
-                action: 'reject',
-                reason: conflict.kind === 'claim_held' ? 'claim_conflict' : 'stale_context',
-            };
-        case 'notify':
-            return conflict.kind === 'stale_context'
-                ? { action: 'notify', reason: 'stale_notify_hold' }
-                : { action: 'reject', reason: 'claim_conflict' };
-        default: {
-            // Exhaustiveness backstop: a future `OnStaleMode` member surfaces as a
-            // localized compile error here, not a missing-return at the signature.
-            const _exhaustive = mode;
-            return _exhaustive;
-        }
-    }
-}

package/dist/transaction/resources/functionalUpdate.d.ts

@@ -1,79 +0,0 @@
-/**
- * The functional update — `ablo.<model>.update(id, current => next)`.
- *
- * This is the surface that just works under contention. You express only your
- * intent — given the latest row, here is the next state — and the client does
- * the rest: it reads the fresh row and its watermark, runs your updater, writes
- * the result as a compare-and-swap against that watermark, and on any concurrent
- * write it re-reads, recomputes, and retries. No claim, no identity, no transport
- * awareness, and no `stale_context` or `claim_*` error codes ever reach the
- * caller. The write either lands or, at the extreme, throws a single
- * {@link AbloContentionError} once the reconcile budget is spent.
- *
- * Correctness comes from the `readAt` watermark plus `onStale: 'reject'`
- * (optimistic concurrency, or compare-and-swap), not from participant identity.
- * That is why it is immune to the shared-credential silent-overwrite hazard and
- * behaves identically on both transports: the HTTP and WebSocket clients inject
- * the same two functions ({@link ReconcileTransport}) into the shared loop below,
- * so the guarantee cannot drift between them — only the mechanism differs.
- *
- * The mental model is React's `setState(prev => next)`: pass a function of the
- * current state and the runtime owns reconciliation.
- */
-import { AbloContentionError } from '../errors.js';
-/**
- * The functional form of an update: given the freshly-read row, return the
- * fields to write. Return `null` or `undefined` to make no write — a no-op the
- * caller chose after seeing the latest state (for example, "already done").
- */
-export type ModelUpdater<T> = (current: T) => Partial<T> | null | undefined | Promise<Partial<T> | null | undefined>;
-/** Tuning for the functional update's internal reconcile loop. */
-export interface ContentionOptions {
-    /**
-     * Max reconcile rounds under contention before throwing
-     * {@link AbloContentionError}. Each round re-reads the latest row and re-runs
-     * your updater. Defaults to {@link DEFAULT_CONTENTION_RETRIES}.
-     */
-    readonly retries?: number;
-    /** Abort the reconcile loop (e.g. the request was cancelled). */
-    readonly signal?: AbortSignal;
-}
-/** Reconcile rounds before a hot row is declared permanently contended. */
-export declare const DEFAULT_CONTENTION_RETRIES = 16;
-/**
- * Reports whether a thrown error means "another writer moved the row — re-read
- * and retry" rather than a genuine failure to surface. These are the
- * optimistic-concurrency signals the functional update reconciles against:
- *   - `stale_context` — the `readAt` watermark was overtaken by a concurrent write
- *   - `claim_lost`    — a holder preempted the write (for example a human under `humansOverwrite`)
- *   - `claim_queued`  — a holder is actively editing the row right now
- */
-export declare function isReconcilableConflict(err: unknown): boolean;
-/**
- * The transport-specific read and write that the shared loop drives. Each client
- * injects its own pair — the one thing that differs between the HTTP and
- * WebSocket transports.
- */
-export interface ReconcileTransport<T, R> {
-    readonly model: string;
-    readonly id: string;
-    /** Read the latest row and its watermark from the authoritative store. */
-    readFresh: () => Promise<{
-        readonly data: T | null | undefined;
-        readonly stamp: number;
-    }>;
-    /**
-     * Write the computed patch as a compare-and-swap against `readAt`. It must
-     * throw a reconcilable conflict (`stale_context` or `claim_*`) when the
-     * watermark was overtaken — that rejection is what drives the next reconcile
-     * round.
-     */
-    writeNext: (patch: Partial<T>, readAt: number) => Promise<R>;
-}
-/**
- * Run the read-fresh → compute → compare-and-swap → reconcile loop. Shared by
- * both transports so the guarantee is provably identical. Returns the write's
- * result, or `undefined` when the updater opted out of writing.
- */
-export declare function reconcileFunctionalUpdate<T, R>(updater: ModelUpdater<T>, options: ContentionOptions | undefined, transport: ReconcileTransport<T, R>): Promise<R | undefined>;
-export { AbloContentionError };

package/dist/transaction/resources/functionalUpdate.js

@@ -1,87 +0,0 @@
-/**
- * The functional update — `ablo.<model>.update(id, current => next)`.
- *
- * This is the surface that just works under contention. You express only your
- * intent — given the latest row, here is the next state — and the client does
- * the rest: it reads the fresh row and its watermark, runs your updater, writes
- * the result as a compare-and-swap against that watermark, and on any concurrent
- * write it re-reads, recomputes, and retries. No claim, no identity, no transport
- * awareness, and no `stale_context` or `claim_*` error codes ever reach the
- * caller. The write either lands or, at the extreme, throws a single
- * {@link AbloContentionError} once the reconcile budget is spent.
- *
- * Correctness comes from the `readAt` watermark plus `onStale: 'reject'`
- * (optimistic concurrency, or compare-and-swap), not from participant identity.
- * That is why it is immune to the shared-credential silent-overwrite hazard and
- * behaves identically on both transports: the HTTP and WebSocket clients inject
- * the same two functions ({@link ReconcileTransport}) into the shared loop below,
- * so the guarantee cannot drift between them — only the mechanism differs.
- *
- * The mental model is React's `setState(prev => next)`: pass a function of the
- * current state and the runtime owns reconciliation.
- */
-import { AbloError, AbloNotFoundError, AbloStaleContextError, AbloClaimedError, AbloContentionError, } from '../errors.js';
-/** Reconcile rounds before a hot row is declared permanently contended. */
-export const DEFAULT_CONTENTION_RETRIES = 16;
-/**
- * Reports whether a thrown error means "another writer moved the row — re-read
- * and retry" rather than a genuine failure to surface. These are the
- * optimistic-concurrency signals the functional update reconciles against:
- *   - `stale_context` — the `readAt` watermark was overtaken by a concurrent write
- *   - `claim_lost`    — a holder preempted the write (for example a human under `humansOverwrite`)
- *   - `claim_queued`  — a holder is actively editing the row right now
- */
-export function isReconcilableConflict(err) {
-    if (err instanceof AbloStaleContextError)
-        return true;
-    if (err instanceof AbloClaimedError) {
-        return err.code === 'claim_lost' || err.code === 'claim_queued';
-    }
-    return false;
-}
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/**
- * Jittered backoff so N reconcilers retrying at once don't lock-step straight
- * back into the same collision. Bounded; grows mildly with the attempt.
- */
-function backoffMs(attempt) {
-    return 60 + attempt * 40 + Math.floor(Math.random() * 60);
-}
-/**
- * Run the read-fresh → compute → compare-and-swap → reconcile loop. Shared by
- * both transports so the guarantee is provably identical. Returns the write's
- * result, or `undefined` when the updater opted out of writing.
- */
-export async function reconcileFunctionalUpdate(updater, options, transport) {
-    const retries = options?.retries ?? DEFAULT_CONTENTION_RETRIES;
-    let lastConflict;
-    for (let attempt = 0; attempt <= retries; attempt++) {
-        if (options?.signal?.aborted) {
-            throw new AbloError(`Update of ${transport.model}/${transport.id} was aborted before it landed.`, { code: 'update_aborted' });
-        }
-        const { data, stamp } = await transport.readFresh();
-        if (data == null) {
-            throw new AbloNotFoundError(`Cannot update ${transport.model}/${transport.id}: it does not exist (or is ` +
-                `outside this credential's scope).`, [transport.id]);
-        }
-        const patch = await updater(data);
-        if (patch == null)
-            return undefined; // updater opted out after reading fresh
-        try {
-            return await transport.writeNext(patch, stamp);
-        }
-        catch (err) {
-            if (!isReconcilableConflict(err))
-                throw err; // genuine failure — surface it
-            lastConflict = err;
-            if (attempt < retries)
-                await sleep(backoffMs(attempt));
-        }
-    }
-    throw new AbloContentionError(transport.model, transport.id, retries + 1, {
-        cause: lastConflict,
-    });
-}
-// Re-exported so call sites import the loop and its terminal error from one
-// place; the class itself lives with the rest of the error hierarchy.
-export { AbloContentionError };

package/dist/transaction/resources/httpResources.d.ts

@@ -1,321 +0,0 @@
-/**
- * Shared resource types for the typed clients and private HTTP transport.
- * the commit and claim shapes, the session-mint params and resource, and the
- * {@link HttpClaimApi} derivation. This module holds only types and has no runtime
- * imports.
- */
-import type { ClaimHeartbeatAckPayload, OnStaleMode, ReadDependency, TrackDependency } from '../coordination/schema.js';
-import type { ClaimHeartbeatReply, ClaimState } from '../wire/claims.js';
-import type { ClientCommitReceipt, CommitWait } from '../wire/commit.js';
-export type { CommitWait };
-import type { ModelTarget, ModelClaim } from '../coordination/schema.js';
-export type { ModelTarget, ModelClaim };
-import type { ResolveClaimMeta } from '../types/global.js';
-import type { SchemaRecord } from '../schema/schema.js';
-import type { SyncGroupInput } from '../schema/roles.js';
-import type { CapabilityCan, CapabilityOperation, CapabilityScope } from '../auth/capability.js';
-import type { Claim, ClaimStream, ClaimWaitOptions, Duration, HeldClaim } from '../types/streams.js';
-import type { ClaimOptions, ClaimParams, ClaimReadApi, AwaitedClaimMethod } from './modelOperations.js';
-/**
- * The operations available on each model in the sync engine:
- *   `retrieve({ id })` — an async single-row server read
- *   `list({ where })` — an async collection server read
- *   `local.retrieve(id)` / `local.list(...)` / `local.count(...)` — synchronous local reads
- *   `create({ data })` / `update({ id, data })` / `delete({ id })` — writes
- *   `claim({ id })` — a durable claim handle for coordinated writes
- */
-export type ModelOperationAction = 'create' | 'update' | 'delete' | 'archive' | 'unarchive';
-export type IfClaimedPolicy = 'return' | 'fail';
-export interface ClaimedOptions {
-    /**
-     * What to do when another participant has claimed the target: `return` lets
-     * the read proceed; `fail` throws `AbloClaimedError`. Inspect claim state via
-     * `ablo.<model>.claim.state({ id })`. Waiting is a claim-side concern — take
-     * `ablo.<model>.claim({ id })` (it queues fairly); reads never block.
-     */
-    readonly ifClaimed?: IfClaimedPolicy;
-}
-export type { ClaimWaitOptions } from '../types/streams.js';
-export interface ModelReadOptions extends ClaimedOptions {
-}
-/**
- * The target a caller names when creating a claim: {@link ModelTarget} with its
- * one caller-authored member typed — `meta` is the shape declared on
- * `Register`'s `ClaimMeta` slot, the same declaration every reader of the claim
- * is given back.
- *
- * Derived rather than restated, and narrowed only here: `modelTargetSchema`
- * keeps parsing `meta` as an open record, because a peer on a newer build must
- * still be understood. The wire stays permissive; the DTO the caller writes
- * does not.
- */
-export type ModelTargetInput = Omit<ModelTarget, 'meta'> & {
-    readonly meta?: ResolveClaimMeta;
-};
-export interface ClaimCreateOptions {
-    readonly target: ModelTargetInput;
-    /** Peer-visible description of the work — the same field on every claim
-     *  surface. Defaults to `'editing'` when omitted. */
-    readonly description?: string;
-    readonly ttl?: Duration;
-    /**
-     * Join the server's fair FIFO queue when the target is already claimed,
-     * rather than failing immediately. `create` then resolves only once the
-     * lease is actually ours (the server pushes `claim_acquired` if the target
-     * was free, or `claim_granted` when we reach the head of the line). Without
-     * this, a contended claim throws. Used by `ablo.<model>.claim` so writers
-     * serialize instead of racing.
-     */
-    readonly queue?: boolean;
-    /** Cap on how long to wait for a queued grant before rejecting. */
-    readonly waitTimeoutMs?: number;
-    /** Abort a pending wait from outside — rejects with `claim_wait_aborted`.
-     *  Ignored once the grant has arrived. */
-    readonly signal?: AbortSignal;
-    /**
-     * Backpressure: reject with `AbloClaimedError('queue_too_deep')` instead of
-     * waiting if the queue is already `>= maxQueueDepth` when we join.
-     */
-    readonly maxQueueDepth?: number;
-}
-export interface CommitOperationInput {
-    readonly action: ModelOperationAction;
-    /** The model name — matches `ablo.<model>` and the schema's `model()`. */
-    readonly model: string;
-    readonly id?: string | null;
-    readonly data?: Record<string, unknown> | null;
-    readonly transactionId?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: OnStaleMode | null;
-    /** Fencing token (Option B) from the batch's claim handle; server-validated. */
-    readonly fenceToken?: number | null;
-}
-export interface CommitCreateOptions {
-    readonly idempotencyKey?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: OnStaleMode | null;
-    /**
-     * A claim handle from `ablo.<model>.claim({ id })` (or the HTTP claim
-     * surface). Same vocabulary as the per-model writes: the handle's
-     * snapshot watermark becomes the batch `readAt` default and `onStale`
-     * defaults to `'reject'`, so a commit that follows a claim is guarded
-     * against concurrent edits without re-stating the watermark by hand.
-     * Explicit `readAt`/`onStale` on the options win.
-     */
-    readonly claim?: Claim | null;
-    /** One atomic batch. Use a one-element array for a single operation. */
-    readonly operations: readonly CommitOperationInput[];
-    readonly wait?: CommitWait;
-    /**
-     * The batch premise — the "did anything I looked at change?" guard.
-     * Declare the rows (`{ model, id, readAt, fields? }`) or sync groups
-     * (`{ group, readAt }`, for example `report:abc`) this batch was premised on; the
-     * server checks that none moved since `readAt` and fires the entry's `onStale`
-     * over the batch. This is distinct from the write-target `readAt`: it guards what
-     * you read, not what you write.
-     */
-    readonly reads?: readonly ReadDependency[] | null;
-    /**
-     * Durable premises to register as part of this batch — the persisted
-     * sibling of `reads`. Where `reads` guards only this commit, a `track` entry
-     * (`{ model, id, readAt? }` for a row or `{ group, readAt? }` for a sync group)
-     * lives on past it: a later matching change rides back on a future receipt's
-     * `notifications`. A track-only batch (just `track`, an empty `operations`) is
-     * the batch form of `ablo.<model>.track()`.
-     */
-    readonly track?: readonly TrackDependency[] | null;
-}
-/** Public projection inferred from the canonical runtime schema. */
-export type CommitReceipt = ClientCommitReceipt;
-export interface CommitResource {
-    create(options: CommitCreateOptions): Promise<CommitReceipt>;
-}
-export interface ClaimResource extends ClaimStream {
-    create(options: ClaimCreateOptions): Promise<Claim>;
-    list(target?: Partial<ModelTarget>): readonly ModelClaim[];
-    waitFor(target: Partial<ModelTarget>, options?: ClaimWaitOptions): Promise<void>;
-}
-/**
- * The claim-ticket surface of the stateless HTTP client — the operations a
- * caller performs holding only a `claimId`, which is what a queued acquire
- * leaves in its hand (`AbloClaimedError('claim_queued')` carries it on
- * `error.claims`). The WebSocket client never needs these: it awaits the grant
- * on its socket.
- *
- * All three shapes are the wire's own — `claimStateSchema`,
- * `claimHeartbeatReplySchema`, and the batch ack — so this surface cannot
- * describe a response the server does not send.
- */
-export interface HttpClaimsResource {
-    /**
-     * The claim's current state, by its id — `GET /v1/claims/{claimId}`. The
-     * poll half of the queued-grant handover: a queued caller polls until
-     * `status` is `'active'`, at which point `fenceToken` is present and the
-     * work can begin. `position` is advisory (a privileged caller can reorder
-     * the line, so it may go up); only `status` is authoritative.
-     */
-    retrieve(params: {
-        readonly claimId: string;
-    }): Promise<ClaimState>;
-    /**
-     * One beat on the named lease — `POST /v1/claims/{claimId}/heartbeat`. On a
-     * held lease it extends the TTL; on a queued ticket it refreshes the
-     * waiter's slot in the line and reports `{ status: 'queued', position }`.
-     */
-    heartbeat(params: {
-        readonly claimId: string;
-        readonly ttl?: string | number;
-    }): Promise<ClaimHeartbeatReply>;
-    /**
-     * One beat for every lease this identity holds — `POST /v1/claims/heartbeat`,
-     * one ack per extended lease. The socketless twin of the realtime
-     * keepalive, for a stateless worker holding many rows.
-     */
-    heartbeatAll(options?: {
-        readonly ttl?: string | number;
-    }): Promise<readonly ClaimHeartbeatAckPayload[]>;
-    /**
-     * Give the ticket back — `DELETE /v1/claims/{claimId}`. On a held lease this
-     * releases it and promotes the head of the queue; on a queued ticket it
-     * leaves the line, so the waiters behind move up instead of waiting out
-     * your slot's TTL. Idempotent: releasing an already-ended claim is a no-op.
-     */
-    release(params: {
-        readonly claimId: string;
-    }): Promise<void>;
-}
-export interface ModelMutationOptions extends ClaimedOptions {
-    readonly claimRef?: string | {
-        readonly id: string;
-    } | null;
-    readonly idempotencyKey?: string | null;
-    readonly readAt?: number | null;
-    readonly onStale?: OnStaleMode | null;
-    readonly wait?: CommitWait;
-    readonly claim?: Claim | ClaimOptions | null;
-    /** Fencing token (Option B) from the claim; server-validated at commit. */
-    readonly fenceToken?: number | null;
-}
-/**
- * The stateless HTTP claim surface. Most code puts a `claim` directly on the write
- * (`update({ id, data, claim })`) and lets the SDK release it; reach for this
- * namespace for multi-step handles and coordination screens.
- *
- * It is the same surface as the reactive claim API, but because every read is a
- * server round-trip, `state`, `queue`, and `reorder` are awaited here. The
- * WebSocket client resolves those synchronously from its local cache, which is what
- * lets it read a claim's state inside a React render; a stateless client has no
- * cache to read, so the promise is unavoidable.
- *
- * It is derived from `ClaimReadApi` through {@link AwaitedClaimMethod} so the two
- * transports cannot drift: the only difference is the promise wrapper that
- * statelessness forces. `claim({ id })` is identical on both (already async);
- * `state`, `queue`, `reorder`, and `release` are the awaited form.
- */
-export type HttpClaimApi<T = Record<string, unknown>> = ((params: ClaimParams<T> & {
-    queue: false;
-}) => Promise<HeldClaim<T> | null>) & ((params: ClaimParams<T>) => Promise<HeldClaim<T>>) & {
-    [K in keyof ClaimReadApi<T>]: AwaitedClaimMethod<ClaimReadApi<T>[K]>;
-};
-/** A single data operation a scoped **agent** session may perform on a model.
- *  The SDK-facing name for {@link CapabilityOperation}; the vocabulary itself is
- *  declared once, as a schema, in `auth/capability.ts`. */
-export type SessionOperation = CapabilityOperation;
-/** Parameters for minting an end-user session — full data authority within the
- *  organization. Mints an `ek_` token. `user.id` is your end user's id from your
- *  own identity provider and becomes the session's `participantId`; Ablo does not
- *  model your users, so it is treated as an opaque string at the trust boundary. */
-export interface CreateUserSessionParams {
-    /** Your end user. `id` becomes the token's `participantId`. */
-    user: {
-        id: string;
-    };
-    /** Mint the session into this organization instead of the key's own — for a
-     *  platform that serves many tenants from one backend. Requires the `sk_` key to
-     *  carry the `ephemeral:mint-any-org` scope; omit it for the normal
-     *  single-tenant case. */
-    organizationId?: string;
-    /** Sync groups this session may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`; build with `syncGroup(kind, id)` from
-     *  `@abloatai/ablo/schema`). Omit for the server default:
-     *  `[org:<your org>, user:<user.id>]`. */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes). */
-    ttlSeconds?: number;
-    /** Opaque identity blob echoed back to the client as `ablo.user`. */
-    userMeta?: Record<string, unknown>;
-    agent?: never;
-    can?: never;
-}
-/** Mint params for a scoped **agent** session — mints a restricted `rk_` token
- *  gated to exactly the operations named in `can`. `can` is typed off your
- *  schema (no magic `'task.update'` strings): `{ Task: ['update'], Report: ['read'] }`
- *  — the SDK serializes each entry to the wire allowlist (`task.update`). */
-export interface CreateAgentSessionParams<S extends SchemaRecord> {
-    /** Your agent. `id` becomes the token's `participantId`. */
-    agent: {
-        id: string;
-    };
-    /** Per-model operation allowlist, typed against the schema's model names. */
-    can: CapabilityCan<S>;
-    /** Sync groups this session may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`; build with `syncGroup(kind, id)` from
-     *  `@abloatai/ablo/schema`). Omit for the server default: the org
-     *  anchor (`org:<your org>`) + the agent's own anchor. */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes). */
-    ttlSeconds?: number;
-    /** Opaque identity blob echoed back to the client as `ablo.agent`. */
-    userMeta?: Record<string, unknown>;
-    user?: never;
-}
-/** Params for {@link Ablo.sessions}.create — a discriminated union: pass
- *  `{ user }` for a full-authority end-user session (`ek_`) or `{ agent, can }`
- *  for a scoped agent session (`rk_`). */
-export type CreateSessionParams<S extends SchemaRecord> = CreateUserSessionParams | CreateAgentSessionParams<S>;
-/** Params for {@link Ablo.agents}.create — a flattened agent descriptor (no
- *  `{ agent }` discriminator: `agents.create` only ever mints an agent). Unlike
- *  {@link CreateSessionParams} it resolves to a connected, scoped {@link Ablo}
- *  client rather than a raw token. */
-export interface CreateAgentClientParams<S extends SchemaRecord> {
-    /** The wire participant identity (`agent:<id>`) that claim exclusion and the
-     *  FIFO queue gate on. Omit it to get a fresh random id — a distinct, independent
-     *  participant, which is the default and what you want for concurrent agents.
-     *  Pass a stable string only when one logical agent must re-attach to its own
-     *  held claims across reconnects or restarts. */
-    id?: string;
-    /** A human-readable label for logs and attribution (carried in `userMeta.name`).
-     *  It is independent of `id`: two agents that share a `name` still receive
-     *  distinct ids and coordinate as separate participants — `name` never derives or
-     *  collapses identity. */
-    name?: string;
-    /** Per-model operation allowlist, typed against the schema's model names. */
-    can: CapabilityCan<S>;
-    /** Sync groups this agent may subscribe to — typed (`'default'` or
-     *  `<namespace>:<id>`). Omit for the server default (org anchor + the
-     *  agent's own anchor). */
-    syncGroups?: readonly SyncGroupInput[];
-    /** Token lifetime in seconds. Defaults to 900 (15 minutes); the returned client
-     *  re-mints before expiry, so a long-running agent never handles rotation
-     *  itself. */
-    ttlSeconds?: number;
-    /** Extra opaque identity blob echoed on the session scope. Merged with
-     *  `name` (the `name` param wins if you also set `userMeta.name`). */
-    userMeta?: Record<string, unknown>;
-}
-/** A minted session. `token` is the secret the holder presents as its bearer. */
-export interface AbloSession {
-    object: 'session';
-    /** Stable id of the minted credential (for revocation). */
-    id: string;
-    /** The short-lived session token — `ek_` for a `{ user }` session, `rk_`
-     *  for an `{ agent }` session. Hand this to the participant's runtime. */
-    token: string;
-    /** ISO-8601 expiry. */
-    expiresAt: string;
-    organizationId: string;
-    /** The grant this token carries, on both axes — the same shape the key row
-     *  stores and the gates enforce. */
-    scope: CapabilityScope;
-    userMeta: Record<string, unknown>;
-}

package/dist/transaction/resources/httpResources.js

@@ -1,7 +0,0 @@
-/**
- * Shared resource types for the typed clients and private HTTP transport.
- * the commit and claim shapes, the session-mint params and resource, and the
- * {@link HttpClaimApi} derivation. This module holds only types and has no runtime
- * imports.
- */
-export {};