@abloatai/ablo 0.9.12 → 0.9.13

package/dist/errorCodes.d.ts

@@ -283,6 +283,8 @@ export declare const ERROR_CODES: {
     readonly invalid_json: ErrorCodeSpec;
     readonly capability_id_required: ErrorCodeSpec;
     readonly organization_mismatch: ErrorCodeSpec;
+    readonly project_scope_denied: ErrorCodeSpec;
+    readonly project_slug_taken: ErrorCodeSpec;
     readonly forbidden: ErrorCodeSpec;
     readonly source_api_key_unresolved: ErrorCodeSpec;
     readonly capability_auth_disabled: ErrorCodeSpec;

package/dist/errorCodes.js

@@ -305,6 +305,8 @@ export const ERROR_CODES = {
     invalid_json: wire('validation', 400, false, 'The request body was not valid JSON.'),
     capability_id_required: wire('validation', 400, false, 'A capability id is required for this request.'),
     organization_mismatch: wire('permission', 403, false, 'The request targeted an organization the caller is not scoped to.'),
+    project_scope_denied: wire('permission', 403, false, "The request targeted a project the caller's key is not scoped to."),
+    project_slug_taken: wire('validation', 409, false, 'A project with this slug already exists in the organization.'),
     forbidden: wire('permission', 403, false, 'The caller lacks permission for this operation.'),
     source_api_key_unresolved: wire('auth', 401, false, 'The source API key could not be resolved.'),
     capability_auth_disabled: wire('server', 503, false, 'Capability authentication is disabled on this server.'),

package/dist/schema/diff.d.ts

@@ -120,7 +120,13 @@ export declare function classifyCast(from: FieldType, to: FieldType): CastSafety
  * drop+add.
  */
 export declare function diffSchema(prev: SchemaJSON | null, next: SchemaJSON, hints?: RenameHints): MigrationStep[];
-export type WarningCode = 'drop_model' | 'drop_field' | 'risky_cast' | 'lossy_recreate' | 'enum_value_removed';
+export type WarningCode = 'drop_model' | 'drop_field' | 'risky_cast' | 'lossy_recreate' | 'enum_value_removed'
+/** A model disappears from what this plane's READERS resolve, without any
+ *  table being dropped. Emitted by the server's push gate (not
+ *  `classifyMigration`) when a first sandbox push shadows the production
+ *  artifact that sandbox readers were served via the registry's test→live
+ *  fallback. The data plane is untouched — the loss is visibility. */
+ | 'remove_model';
 export type BlockerCode = 'required_field_added' | 'made_required';
 export interface MigrationSignal {
     readonly code: WarningCode | BlockerCode;

package/dist/schema/roles.d.ts

@@ -53,6 +53,22 @@ export type SyncGroupInput = SyncGroup | `${string}:${string}` | 'default';
 export declare const syncGroupInputSchema: z.ZodUnion<readonly [z.ZodLiteral<"default">, z.core.$ZodBranded<z.ZodTemplateLiteral<`${string}:${string}`>, "SyncGroup", "out">]>;
 /** Runtime guard matching {@link SyncGroupInput}. */
 export declare function isSyncGroupInput(value: unknown): value is SyncGroupInput;
+/**
+ * The sync-group kinds the AUTH PROVIDER mints directly onto identities — a
+ * CLOSED vocabulary: extend this list, never inline a new namespace string.
+ *
+ *   - `org:<organizationId>`  — every member of the organization
+ *   - `user:<participantId>`  — the participant itself
+ *   - `project:<projectId>`   — every credential scoped to the project
+ *     (project axis, 2026-06-11; the org-default project's id IS the org id)
+ *
+ * Schema-declared roles ({@link identityRole} / {@link entityRole}) extend the
+ * vocabulary per app; these are the engine-reserved anchors.
+ */
+export declare const IDENTITY_ANCHOR_KINDS: readonly ["org", "user", "project"];
+export type IdentityAnchorKind = (typeof IDENTITY_ANCHOR_KINDS)[number];
+/** Mint an engine-reserved identity anchor (typed wrapper over {@link syncGroup}). */
+export declare function identityAnchor(kind: IdentityAnchorKind, id: string): SyncGroup;
 /** Validates how a role pulls ids out of a context (identity or record). */
 export declare const roleSourceSchema: z.ZodObject<{
     field: z.ZodString;

package/dist/schema/roles.js

@@ -50,6 +50,24 @@ export const syncGroupInputSchema = z.union([z.literal('default'), syncGroupSche
 export function isSyncGroupInput(value) {
     return syncGroupInputSchema.safeParse(value).success;
 }
+// ── Identity anchors (closed vocabulary) ────────────────────────────────────
+/**
+ * The sync-group kinds the AUTH PROVIDER mints directly onto identities — a
+ * CLOSED vocabulary: extend this list, never inline a new namespace string.
+ *
+ *   - `org:<organizationId>`  — every member of the organization
+ *   - `user:<participantId>`  — the participant itself
+ *   - `project:<projectId>`   — every credential scoped to the project
+ *     (project axis, 2026-06-11; the org-default project's id IS the org id)
+ *
+ * Schema-declared roles ({@link identityRole} / {@link entityRole}) extend the
+ * vocabulary per app; these are the engine-reserved anchors.
+ */
+export const IDENTITY_ANCHOR_KINDS = ['org', 'user', 'project'];
+/** Mint an engine-reserved identity anchor (typed wrapper over {@link syncGroup}). */
+export function identityAnchor(kind, id) {
+    return syncGroup(kind, id);
+}
 // ── Role source ─────────────────────────────────────────────────────────────
 /** Validates how a role pulls ids out of a context (identity or record). */
 export const roleSourceSchema = z.object({

package/llms.txt

@@ -14,6 +14,10 @@ Second: make sure a key exists — WITHOUT printing it. The key is a secret; it
 
 Then PUSH — this is the step everything depends on. The server keeps its OWN copy of the schema. Run `npx ablo push --no-watch`: it pushes `ablo/schema.ts` (sandbox) AND writes `ABLO_API_KEY` into `.env.local` from the stored login. Until the schema is pushed, EVERY write to a new or changed model fails with `server_execute_unknown_model`. Re-run it after schema changes (`npx ablo push` also works once the key is wired; bare `npx ablo push` watches forever — don't, you have no TTY).
 
+## Projects (one org, many apps)
+
+Each app gets its own PROJECT inside the org — its own schema, its own sandbox/production data planes, its own keys (the Neon/Supabase shape). `npx ablo init` creates one automatically (slug from package.json name; `--project <slug>` to choose, `--no-project` for the org default). A key belongs to exactly ONE project, fixed at mint; everything it mints inherits it. Touching another project's models fails typed: `project_scope_denied` (403) — the fix is a key minted for THAT project, never `ablo push`. Manage: `npx ablo projects list|create <slug>|use <slug|default>`; `npx ablo status` shows the active project. Wire: `GET/POST /api/v1/projects` (sk_ bearer; duplicate slug → `project_slug_taken` 409).
+
 ## Use this API
 
 ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/ablo",
-  "version": "0.9.12",
+  "version": "0.9.13",
   "description": "State control API for AI agents and collaborative apps.",
   "license": "Apache-2.0",
   "type": "module",