@abloatai/transaction 0.37.0

package/dist/schema/schema.js

@@ -0,0 +1,326 @@
+/**
+ * Schema Definition + Type Inference
+ *
+ * defineSchema() wraps your models. Types are inferred via Zod — no custom type system.
+ *
+ * Usage:
+ *   import { z } from 'zod';
+ *   import { defineSchema, model, relation } from '@abloatai/transaction/schema';
+ *
+ *   const schema = defineSchema({
+ *     tasks: model({
+ *       title: z.string(),
+ *       status: z.enum(['todo', 'doing', 'done']).default('todo'),
+ *       projectId: z.string().optional(),
+ *     }, {
+ *       project: relation.belongsTo('projects', 'projectId'),
+ *     }),
+ *   });
+ *
+ *   type Task = InferModel<typeof schema, 'tasks'>;
+ */
+import { z } from 'zod';
+import { AbloValidationError } from '../errors.js';
+import { fieldRef } from './fieldRef.js';
+import { scopeSchema, grantsRefSchema } from './roles.js';
+// Sync-group roles (identity and entity) are defined in `./roles.js` and
+// re-exported here so they can also be imported from this module. See
+// `./roles.js` for the full vocabulary.
+export { identityRole, entityRole, extractIdentityIds, extractEntityIds, composeIdentitySyncGroups, composeEntitySyncGroups, intersectRequestedWithAllowed, syncGroup, syncGroupSchema, syncGroupInputSchema, isSyncGroupInput, identityRoleSchema, entityRoleSchema, roleSchema, roleSourceSchema, scopeSchema, grantsRefSchema, groupsInputSchema, } from './roles.js';
+function resolveCasing(fn) {
+    if (fn === undefined)
+        return (x) => x;
+    if (typeof fn === 'function')
+        return fn;
+    switch (fn) {
+        case 'snake_case':
+            return camelToSnake;
+        case 'camelCase':
+            return (x) => x;
+    }
+}
+/** Converts a camelCase identifier to snake_case. Kept local so the package
+ * carries no database-driver dependency, and so consumers on any stack get the
+ * same result. */
+function camelToSnake(identifier) {
+    return identifier.replace(/[A-Z]/g, (ch) => `_${ch.toLowerCase()}`);
+}
+/**
+ * Session settings Ablo already sets on its direct-write connection. A
+ * `sessionSettings` entry FORWARDS Ablo's trusted context into a setting the
+ * customer's own policies read — it may never reassign one of these, which would
+ * let a schema push relax the engine's own scoping, timeouts, or `row_security`.
+ * Shared with the engine's direct-write seam so authoring-time validation and
+ * the runtime guard read one list. See ADR 0011.
+ */
+export const RESERVED_SESSION_SETTINGS = [
+    'statement_timeout',
+    'lock_timeout',
+    'row_security',
+    'search_path',
+    'app.current_org_id',
+    'app.current_project_id',
+    'app.current_environment',
+    'app.current_sandbox_id',
+    'app.current_participant_id',
+    'app.current_participant_kind',
+    'app.current_user_id',
+];
+/**
+ * Base fields every synced model gets automatically.
+ *
+ * Exported (internal) so `parseSchema` can rebuild a model's validator the
+ * same way `defineSchema` does — `baseFieldsSchema.merge(modelSchema)` — when
+ * reconstructing a `Schema` from its JSON form.
+ */
+export const baseFieldsSchema = z.object({
+    id: z.string(),
+    createdAt: z.date(),
+    updatedAt: z.date(),
+    organizationId: z.string().optional(),
+    createdBy: z.string().optional(),
+});
+/**
+ * The base-column names every model carries automatically — the keys of
+ * {@link baseFieldsSchema}, kept here as the single source of truth. Code
+ * generation reads it to avoid emitting a base column twice, and
+ * {@link defineSchema} uses it to reject a model that redeclares one, since
+ * merging the user's field over the base field would produce a `string & Date`
+ * type and break the build.
+ */
+export const BASE_FIELDS = [
+    'id',
+    'createdAt',
+    'updatedAt',
+    'organizationId',
+    'createdBy',
+];
+// ── Factory ───────────────────────────────────────────────────────────────
+/**
+ * Define a sync engine schema.
+ *
+ * ```ts
+ * const schema = defineSchema({
+ *   tasks: model({ title: z.string(), status: z.string().default('todo') }),
+ *   projects: model({ name: z.string() }),
+ * });
+ * ```
+ */
+/**
+ * Rejects field names that will not survive the sync driver's snake_case ↔
+ * camelCase round-trip. The driver maps identifiers like this:
+ *
+ *   `content_json`       → `contentJson`   (snake → camel)
+ *   `contentJson`        → `content_json`  (camel → snake)
+ *   `contentJSON`        → `content_j_s_o_n` (does not round-trip)
+ *
+ * A name that does not round-trip through this pair of transforms will silently
+ * fail to populate on the client: the wire delivers one casing, the model reads
+ * another, and the field lands as `undefined`. Catching it here surfaces the
+ * problem when the schema is defined rather than at runtime.
+ *
+ * The rule: a standard camelCase identifier has runs of a single uppercase
+ * letter followed by lowercase letters, never two uppercase letters in a row.
+ * `contentJSON` has `JSON` in all caps, so it is rejected.
+ */
+function assertRoundTrippableCamelCase(modelName, fieldName) {
+    // Base fields merged in by defineSchema are already validated; skip.
+    if (fieldName === 'id')
+        return;
+    // Leading-lowercase constraint: fields must be camelCase, not PascalCase.
+    // PascalCase is reserved for typenames.
+    const first = fieldName.charAt(0);
+    if (first >= 'A' && first <= 'Z') {
+        throw new AbloValidationError(`[defineSchema] ${modelName}.${fieldName}: field names must start lowercase ` +
+            `(camelCase). Use "${first.toLowerCase()}${fieldName.slice(1)}" instead.`, { code: 'schema_field_not_camelcase' });
+    }
+    // Two-consecutive-uppercase check. The classic failure mode is
+    // `contentJSON`, `contentHTML`, `myURLParam`, etc. These don't round-trip
+    // through `postgres.camel` — the snake_case intermediate would be
+    // `content_j_s_o_n`, which is not a column that exists.
+    for (let i = 0; i < fieldName.length - 1; i++) {
+        const a = fieldName.charAt(i);
+        const b = fieldName.charAt(i + 1);
+        const aUpper = a >= 'A' && a <= 'Z';
+        const bUpper = b >= 'A' && b <= 'Z';
+        if (aUpper && bUpper) {
+            throw new AbloValidationError(`[defineSchema] ${modelName}.${fieldName}: two consecutive uppercase ` +
+                `letters ("${a}${b}") will not round-trip through the ` +
+                `snake_case ↔ camelCase transform used by the sync driver. ` +
+                `The wire delivers camelCase (lowercase after the first letter of ` +
+                `each word); a field named "${fieldName}" would never receive its ` +
+                `value and read as undefined on the client. Use standard ` +
+                `camelCase (e.g. "contentJson" instead of "contentJSON").`, { code: 'schema_field_consecutive_caps' });
+        }
+    }
+}
+/**
+ * One {@link FieldRef} per declared field, keyed by model then field.
+ *
+ * Every construction of a {@link Schema} goes through here — `defineSchema`,
+ * the `selectModels`/`omitModels` projections, and the deserializer — so a
+ * projection carries references for exactly the models it kept and a schema
+ * rebuilt from JSON carries them at all.
+ */
+export function buildFieldRefs(models) {
+    const refs = {};
+    for (const [model, def] of Object.entries(models)) {
+        const perField = {};
+        for (const field of Object.keys(def.shape))
+            perField[field] = fieldRef(model, field);
+        refs[model] = perField;
+    }
+    return refs;
+}
+export function defineSchema(models, options) {
+    // Build validators with base fields merged in, and resolve defaults for
+    // `typename` and `persist.store` so downstream code (the loader and the
+    // hydration pipeline) can rely on these fields being set without re-deriving
+    // them at every call site.
+    //
+    // Defaults:
+    //   typename      ← schema key (e.g. `block` → `'block'`)
+    //   persist.store ← typename (only resolved when `persist` was provided)
+    //
+    // A consumer that passes `typename: 'Block'` explicitly (common when
+    // the wire shape uses PascalCase while the schema key is camelCase) keeps
+    // that value — the fallback only fires when the field is unset.
+    //
+    // The models record is rebuilt rather than mutated in place because
+    // `ModelDef`'s fields are `readonly`. The rebuild is a shallow spread per
+    // entry, so the inferred shape/relations/fields metadata references are
+    // preserved (no type inference regression at consumer call sites).
+    const validators = {};
+    const resolvedModels = {};
+    const casing = resolveCasing(options?.casing);
+    for (const [name, def] of Object.entries(models)) {
+        // Catch round-trip-hostile field names at definition time. Deferring
+        // this check to runtime means every affected field silently reads
+        // `undefined` on the client — and the author only notices when a UI
+        // that depends on the field goes blank. Throwing here makes the
+        // failure immediate and unambiguous.
+        for (const fieldName of Object.keys(def.shape)) {
+            assertRoundTrippableCamelCase(name, fieldName);
+            // Reserved base columns are merged in below via `baseFieldsSchema.merge`,
+            // and Zod `.merge` silently OVERWRITES the base field with the user's —
+            // e.g. a model declaring `createdAt: z.string()` ends up with a field
+            // typed `string & Date`, which breaks the build. Reject the collision at
+            // definition time so the author sees an unambiguous error instead.
+            if (BASE_FIELDS.includes(fieldName)) {
+                throw new AbloValidationError(`[defineSchema] ${name}.${fieldName}: field \`${fieldName}\` collides with a ` +
+                    `reserved field that the SDK provides automatically ` +
+                    `(${BASE_FIELDS.join(', ')}). Remove it from your model — redeclaring it ` +
+                    `produces a \`string & Date\` type and breaks the build.`, { code: 'schema_reserved_field', param: `${name}.${fieldName}` });
+            }
+        }
+        validators[name] = baseFieldsSchema.merge(def.schema);
+        // Resolve every relation's `foreignKeyColumn` once, now. The builder
+        // constructs each RelationDef with `foreignKeyColumn = foreignKey`
+        // (identity) so this is a no-op when `casing` is unset — existing
+        // consumers get the same behavior they had before the option landed.
+        // When `casing: 'snake_case'` is set, every FK flips to its
+        // snake_case DB column name here and nowhere else. A field-level
+        // `.from(column)` override wins over the convention, so legacy
+        // columns stay declared in the artifact instead of rediscovered by
+        // SQL compilers. Server-side SQL compilers read the resolved value
+        // directly.
+        for (const rel of Object.values(def.relations)) {
+            const fieldColumn = def.fields[rel.foreignKey]?.column;
+            rel.foreignKeyColumn = fieldColumn ?? casing(rel.foreignKey);
+        }
+        const typename = def.typename ?? name;
+        const persist = def.persist
+            ? { ...def.persist, store: def.persist.store ?? typename }
+            : undefined;
+        // Physical table defaults to the schema key — the SAME rule the
+        // provisioner/planner use (`tableName ?? key`), resolved here once so the
+        // serialized artifact always carries it. Required now that models are
+        // mutable by default: the server's `buildModelMap` rejects a mutable
+        // model with no `tableName`, which would otherwise break every commit.
+        const tableName = def.tableName ?? name;
+        resolvedModels[name] = { ...def, typename, tableName, persist };
+    }
+    validateSyncGroupSchema(resolvedModels);
+    validateSessionSettings(options?.sessionSettings ?? {});
+    return {
+        // Cast back to S: we only added values to optional fields that were
+        // already part of ModelDef, so the shape is structurally unchanged.
+        models: resolvedModels,
+        validators: validators,
+        fields: buildFieldRefs(resolvedModels),
+        identityRoles: options?.identityRoles ?? [],
+        sessionSettings: options?.sessionSettings ?? {},
+    };
+}
+/**
+ * Reject session-setting mappings that couldn't do what the author intends —
+ * caught here at definition time rather than silently dropped on the write path.
+ * Each key must name a non-empty setting the customer's policies read, and must
+ * not reassign one Ablo already manages. Uniqueness needs no check: the map is
+ * keyed by the setting name, so a duplicate is unrepresentable.
+ */
+function validateSessionSettings(settings) {
+    for (const setting of Object.keys(settings)) {
+        const name = setting.trim();
+        if (name === '') {
+            throw new AbloValidationError(`[defineSchema] sessionSettings: a key is empty. Name the Postgres ` +
+                `setting your row-level-security policies read, e.g. ` +
+                `\`{ 'app.current_org': 'orgId' }\`.`, { code: 'schema_definition_invalid', param: 'sessionSettings' });
+        }
+        if (RESERVED_SESSION_SETTINGS.includes(name)) {
+            throw new AbloValidationError(`[defineSchema] sessionSettings: \`${name}\` is a setting Ablo already ` +
+                `manages on its write connection, so a mapping can't reassign it — ` +
+                `that would let a schema relax the engine's own scoping. Point your ` +
+                `policies at a setting your app owns (e.g. \`app.current_org\`) and ` +
+                `map Ablo's trusted identity into that instead. Reserved: ` +
+                `${RESERVED_SESSION_SETTINGS.join(', ')}.`, { code: 'schema_definition_invalid', param: `sessionSettings.${name}` });
+        }
+    }
+}
+/**
+ * Validates the relation-driven sync-group declarations (`scope` and `grants`)
+ * at schema-build time, so a mistyped membership edge fails here — with a
+ * structured error (`code`, `param`, `doc_url`) pointing at the exact
+ * declaration — rather than silently mis-routing changes at runtime.
+ */
+function validateSyncGroupSchema(models) {
+    for (const [name, def] of Object.entries(models)) {
+        // Shape-validate the `scope` declaration via the shared Zod schema.
+        if (def.scope !== undefined && !scopeSchema.safeParse(def.scope).success) {
+            throw new AbloValidationError(`Model "${name}": scope kind "${String(def.scope)}" must be a lowercase identifier (e.g. 'workspace').`, { code: 'schema_scope_kind_invalid', param: `${name}.scope` });
+        }
+        if (!def.grants)
+            continue;
+        // Shape-validate the `grants` edge via the shared Zod schema before the
+        // cross-field (relation-exists / belongsTo) checks below.
+        if (!grantsRefSchema.safeParse(def.grants).success) {
+            throw new AbloValidationError(`Model "${name}": grants must be { subject, scope } naming two relations on this model.`, { code: 'schema_grants_shape_invalid', param: `${name}.grants` });
+        }
+        const relations = def.relations;
+        for (const role of ['subject', 'scope']) {
+            const relName = def.grants[role];
+            const rel = relations?.[relName];
+            if (!rel) {
+                throw new AbloValidationError(`Model "${name}": grants.${role} "${relName}" is not a relation on this model. ` +
+                    `Declare a \`belongsTo\` relation named "${relName}" first.`, { code: 'schema_grants_relation_missing', param: `${name}.grants.${role}` });
+            }
+            if (rel.type !== 'belongsTo') {
+                throw new AbloValidationError(`Model "${name}": grants.${role} "${relName}" must be a \`belongsTo\` relation ` +
+                    `(got "${rel.type}"). A membership edge points at a single subject/scope row.`, { code: 'schema_grants_relation_kind', param: `${name}.grants.${role}` });
+            }
+        }
+        // The scope edge must target a model that is actually a scope root —
+        // otherwise the resolved `<kind>:<id>` group is one nothing fans into.
+        const scopeRel = relations[def.grants.scope];
+        // Unreachable: the role loop above already threw if the scope relation
+        // is missing — this narrows the indexed access for the checks below.
+        if (!scopeRel)
+            continue;
+        const target = models[scopeRel.target];
+        if (target && !target.scope) {
+            throw new AbloValidationError(`Model "${name}": grants.scope "${def.grants.scope}" targets "${scopeRel.target}", ` +
+                `which is not a scope root. Add \`scope: true\` to the "${scopeRel.target}" model.`, { code: 'schema_grants_target_not_scope_root', param: `${scopeRel.target}.scope` });
+        }
+    }
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/schema/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAiB,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE1D,yEAAyE;AACzE,sEAAsE;AACtE,wCAAwC;AACxC,OAAO,EAWL,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,EAC7B,SAAS,EACT,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AAqBpB,SAAS,aAAa,CAAC,EAAsB;IAC3C,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IACxC,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,WAAW;YACd,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;kBAEkB;AAClB,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AA2BD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,mBAAmB;IACnB,cAAc;IACd,cAAc;IACd,aAAa;IACb,oBAAoB;IACpB,wBAAwB;IACxB,yBAAyB;IACzB,wBAAwB;IACxB,4BAA4B;IAC5B,8BAA8B;IAC9B,qBAAqB;CACtB,CAAC;AA8DF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI;IACJ,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,WAAW;CACH,CAAC;AAwTX,6EAA6E;AAE7E;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,6BAA6B,CAAC,SAAiB,EAAE,SAAiB;IACzE,qEAAqE;IACrE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO;IAC/B,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,SAAS,IAAI,SAAS,qCAAqC;YAC3E,qBAAqB,KAAK,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAC3E,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;IACJ,CAAC;IACD,+DAA+D;IAC/D,0EAA0E;IAC1E,kEAAkE;IAClE,wDAAwD;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;QACpC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,SAAS,IAAI,SAAS,8BAA8B;gBACpE,aAAa,CAAC,GAAG,CAAC,qCAAqC;gBACvD,4DAA4D;gBAC5D,mEAAmE;gBACnE,8BAA8B,SAAS,4BAA4B;gBACnE,0DAA0D;gBAC1D,0DAA0D,EAC5D,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAgC;IAEhC,MAAM,IAAI,GAA6C,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAA6B,EAAE,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAS,EACT,OAA6B;IAE7B,wEAAwE;IACxE,wEAAwE;IACxE,6EAA6E;IAC7E,2BAA2B;IAC3B,EAAE;IACF,YAAY;IACZ,0DAA0D;IAC1D,yEAAyE;IACzE,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,gEAAgE;IAChE,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,UAAU,GAA+C,EAAE,CAAC;IAClE,MAAM,cAAc,GAA6B,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,qEAAqE;QACrE,kEAAkE;QAClE,oEAAoE;QACpE,gEAAgE;QAChE,qCAAqC;QACrC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/C,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,IAAK,WAAiC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,IAAI,IAAI,SAAS,aAAa,SAAS,qBAAqB;oBAC5E,qDAAqD;oBACrD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,gDAAgD;oBAC1E,yDAAyD,EAC3D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEtD,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,4DAA4D;QAC5D,iEAAiE;QACjE,+DAA+D;QAC/D,mEAAmE;QACnE,mEAAmE;QACnE,YAAY;QACZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAwC,CAAC,EAAE,CAAC;YAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;YACtD,GAAoC,CAAC,gBAAgB,GAAG,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO;YACzB,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,gEAAgE;QAChE,0EAA0E;QAC1E,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;QAExC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IAED,uBAAuB,CAAC,cAAc,CAAC,CAAC;IACxC,uBAAuB,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;IAExD,OAAO;QACL,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,EAAE,cAA8B;QACtC,UAAU,EAAE,UAAqC;QACjD,MAAM,EAAE,cAAc,CAAC,cAAc,CAAwB;QAC7D,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;QAC3C,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,EAAE;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,QAAyB;IACxD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE;gBAClE,sDAAsD;gBACtD,qCAAqC,EACvC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,mBAAmB,CAC3B,qCAAqC,IAAI,+BAA+B;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,qEAAqE;gBACrE,2DAA2D;gBAC3D,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC5C,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,MAAgC;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,oEAAoE;QACpE,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YACzE,MAAM,IAAI,mBAAmB,CAC3B,UAAU,IAAI,kBAAkB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,sDAAsD,EACvG,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,GAAG,IAAI,QAAQ,EAAE,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAE1B,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,IAAI,0EAA0E,EACxF,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,GAAG,IAAI,SAAS,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,SAAwC,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,OAAO,CAAU,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,mBAAmB,CAC3B,UAAU,IAAI,aAAa,IAAI,KAAK,OAAO,qCAAqC;oBAC9E,2CAA2C,OAAO,UAAU,EAC9D,EAAE,IAAI,EAAE,gCAAgC,EAAE,KAAK,EAAE,GAAG,IAAI,WAAW,IAAI,EAAE,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC7B,MAAM,IAAI,mBAAmB,CAC3B,UAAU,IAAI,aAAa,IAAI,KAAK,OAAO,qCAAqC;oBAC9E,SAAS,GAAG,CAAC,IAAI,6DAA6D,EAChF,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,GAAG,IAAI,WAAW,IAAI,EAAE,EAAE,CACzE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,UAAU,IAAI,oBAAoB,GAAG,CAAC,MAAM,CAAC,KAAK,cAAc,QAAQ,CAAC,MAAM,KAAK;gBAClF,0DAA0D,QAAQ,CAAC,MAAM,UAAU,EACrF,EAAE,IAAI,EAAE,qCAAqC,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,QAAQ,EAAE,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/schema/select.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `selectModels` projects a schema down to a subset of its models.
+ *
+ * It lets one canonical schema serve several apps, each subscribing only to the
+ * models it needs. Rather than re-declare a model's fields in a second schema —
+ * which you would then have to keep identical by hand — an app selects the
+ * models it wants from the canonical schema. Field shapes, resolved foreign-key
+ * columns, computed getters, typenames, and identity roles all come from the
+ * source, so a subset cannot drift from the canonical definition.
+ *
+ * ```ts
+ * import { schema as full } from './schema';
+ * import { selectModels } from '@abloatai/transaction/schema';
+ *
+ * // Subscribe to identity and document content only.
+ * export const schema = selectModels(full, ['users', 'organizations', 'workspaces', 'folders', 'files']);
+ * ```
+ *
+ * Relations whose target falls outside the selected set are dropped, so the
+ * subset sees only its own models. Dropping a relation that carries `parent`
+ * scope-inheritance throws instead, because silently losing it would mis-route
+ * a record's fan-out — the selected set must be closed under `parent` edges.
+ */
+import type { Schema, SchemaRecord } from './schema.js';
+export declare function selectModels<S extends SchemaRecord, K extends keyof S & string>(schema: Schema<S>, keys: readonly K[]): Schema<Pick<S, K>>;
+/**
+ * `omitModels` is `selectModels` from the other side: keep every model EXCEPT
+ * the named ones. Use it when an app is the general case and a separate app
+ * owns the omitted models — the suite shell drops a specialized store that the
+ * standalone app selects for itself:
+ *
+ * ```ts
+ * export const schema = omitModels(full, ['reports', 'reportSections']);
+ * ```
+ *
+ * Same validation as `selectModels`: relations into the omitted set are
+ * dropped, and a dropped `parent` edge throws — so a model whose scope routes
+ * through an omitted parent cannot be silently kept.
+ */
+export declare function omitModels<S extends SchemaRecord, K extends keyof S & string>(schema: Schema<S>, keys: readonly K[]): Schema<Omit<S, K>>;
+//# sourceMappingURL=select.d.ts.map

package/dist/schema/select.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../../src/schema/select.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAOxD,wBAAgB,YAAY,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,MAAM,CAAC,GAAG,MAAM,EAC7E,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EACjB,IAAI,EAAE,SAAS,CAAC,EAAE,GACjB,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAiDpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,MAAM,CAAC,GAAG,MAAM,EAC3E,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EACjB,IAAI,EAAE,SAAS,CAAC,EAAE,GACjB,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAYpB"}

package/dist/schema/select.js

@@ -0,0 +1,91 @@
+/**
+ * `selectModels` projects a schema down to a subset of its models.
+ *
+ * It lets one canonical schema serve several apps, each subscribing only to the
+ * models it needs. Rather than re-declare a model's fields in a second schema —
+ * which you would then have to keep identical by hand — an app selects the
+ * models it wants from the canonical schema. Field shapes, resolved foreign-key
+ * columns, computed getters, typenames, and identity roles all come from the
+ * source, so a subset cannot drift from the canonical definition.
+ *
+ * ```ts
+ * import { schema as full } from './schema';
+ * import { selectModels } from '@abloatai/transaction/schema';
+ *
+ * // Subscribe to identity and document content only.
+ * export const schema = selectModels(full, ['users', 'organizations', 'workspaces', 'folders', 'files']);
+ * ```
+ *
+ * Relations whose target falls outside the selected set are dropped, so the
+ * subset sees only its own models. Dropping a relation that carries `parent`
+ * scope-inheritance throws instead, because silently losing it would mis-route
+ * a record's fan-out — the selected set must be closed under `parent` edges.
+ */
+import { buildFieldRefs } from './schema.js';
+import { AbloValidationError } from '../errors.js';
+import { schemaHash } from './serialize.js';
+export function selectModels(schema, keys) {
+    const keep = new Set(keys);
+    const models = {};
+    const validators = {};
+    for (const key of keys) {
+        const def = schema.models[key];
+        if (!def) {
+            throw new AbloValidationError(`selectModels: "${key}" is not a model in the source schema`, { code: 'invalid_schema', param: key });
+        }
+        // Prune relations whose target isn't in the selected set. A pruned
+        // `parent` edge is a routing error, not a silent drop.
+        const relations = {};
+        for (const [relName, rel] of Object.entries(def.relations)) {
+            if (keep.has(rel.target)) {
+                relations[relName] = rel;
+                continue;
+            }
+            if (rel.options?.parent) {
+                throw new AbloValidationError(`selectModels: model "${key}" has a parent relation "${relName}" → "${rel.target}", ` +
+                    `which is not in the selected set. Include "${rel.target}" so scope inheritance still routes.`, { code: 'invalid_schema', param: `${key}.${relName}` });
+            }
+        }
+        models[key] = { ...def, relations };
+        validators[key] = schema.validators[key];
+    }
+    return {
+        models: models,
+        // References for exactly the models this projection kept.
+        fields: buildFieldRefs(models),
+        validators: validators,
+        identityRoles: schema.identityRoles,
+        sessionSettings: schema.sessionSettings,
+        // Record the full source's hash so the drift check can recognize this subset
+        // as current against a server running that full schema. Prefer the source's
+        // OWN `sourceSchemaHash` when it is itself a projection, so a subset-of-a-
+        // subset still points at the original full schema rather than an intermediate
+        // one. `schemaHash` ignores this field, so re-projecting stays deterministic.
+        sourceSchemaHash: schema.sourceSchemaHash ?? schemaHash(schema),
+    };
+}
+/**
+ * `omitModels` is `selectModels` from the other side: keep every model EXCEPT
+ * the named ones. Use it when an app is the general case and a separate app
+ * owns the omitted models — the suite shell drops a specialized store that the
+ * standalone app selects for itself:
+ *
+ * ```ts
+ * export const schema = omitModels(full, ['reports', 'reportSections']);
+ * ```
+ *
+ * Same validation as `selectModels`: relations into the omitted set are
+ * dropped, and a dropped `parent` edge throws — so a model whose scope routes
+ * through an omitted parent cannot be silently kept.
+ */
+export function omitModels(schema, keys) {
+    const drop = new Set(keys);
+    for (const key of keys) {
+        if (!schema.models[key]) {
+            throw new AbloValidationError(`omitModels: "${key}" is not a model in the source schema`, { code: 'invalid_schema', param: key });
+        }
+    }
+    const kept = Object.keys(schema.models).filter((k) => !drop.has(k));
+    return selectModels(schema, kept);
+}
+//# sourceMappingURL=select.js.map

package/dist/schema/select.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.js","sourceRoot":"","sources":["../../src/schema/select.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,UAAU,YAAY,CAC1B,MAAiB,EACjB,IAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,IAAyB,CAAC,CAAC;IACxD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,GAAG,uCAAuC,EAC5D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,CACvC,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,SAAS,GAAgC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAwC,CAAC,EAAE,CAAC;YAC1F,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,GAAG,4BAA4B,OAAO,QAAQ,GAAG,CAAC,MAAM,KAAK;oBACnF,8CAA8C,GAAG,CAAC,MAAM,sCAAsC,EAChG,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI,OAAO,EAAE,EAAE,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC;QACpC,UAAU,CAAC,GAAG,CAAC,GAAI,MAAM,CAAC,UAAsC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAA+B;QACvC,0DAA0D;QAC1D,MAAM,EAAE,cAAc,CAAC,MAAM,CAAiC;QAC9D,UAAU,EAAE,UAA8C;QAC1D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,8EAA8E;QAC9E,8EAA8E;QAC9E,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,UAAU,CAAC,MAAM,CAAC;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CACxB,MAAiB,EACjB,IAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,IAAyB,CAAC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,GAAG,uCAAuC,EAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,CACvC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,YAAY,CAAC,MAAM,EAAE,IAA4B,CAAuB,CAAC;AAClF,CAAC"}

package/dist/schema/serialize.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Schema ⇄ JSON.
+ *
+ * A `Schema` is fully serializable apart from its client-only closures — the
+ * Zod validators and computed getters. {@link serializeSchema} emits the
+ * plain-data JSON form and {@link parseSchema} reconstructs a working `Schema`
+ * from it: one `Schema` type with two representations.
+ *
+ * A hosted, multi-tenant server loads a tenant's schema with `parseSchema(json)`
+ * rather than importing it in process. The JSON is what `ablo push` sends and
+ * what the server stores per tenant and version.
+ *
+ * What round-trips:
+ *   - all model routing and scoping metadata: typename, tableName, load,
+ *     mutable, the `tenancy` descriptor, bootstrap hints, scope, grants,
+ *     entityRoles, the `conflict` disposition map, persist, autoFill,
+ *     requiredFields, and lazyObservable. The authoring shorthands (`policy`
+ *     and `groups`) are normalized into these canonical fields when the model
+ *     is built, so only the canonical fields cross here.
+ *   - relations, including the resolved `foreignKeyColumn`
+ *   - field metadata (names and type tags), from which validators are rebuilt
+ *   - identity roles
+ *
+ * What does not round-trip, because the server never needs it:
+ *   - computed getters, which are closures and are dropped
+ *   - exact Zod refinements, which are rebuilt as permissive validators from
+ *     {@link FieldMeta}; the server does no field-shape validation
+ */
+import type { FieldMeta } from './field.js';
+import type { Tenancy } from './tenancy.js';
+import type { ModelResidency } from './residency.js';
+import type { GrantsRef, LoadStrategy, PersistOptions, AutoFillRule, ConflictAxis } from './model.js';
+import { type RelationType } from './relation.js';
+import { type Schema, type IdentityRole, type EntityRole, type SessionSettings } from './schema.js';
+/** Current schema-JSON envelope version. Bump this on a breaking change to the
+ * JSON shape itself — not to a user's schema. */
+declare const SCHEMA_JSON_VERSION: 3;
+/** A relation in JSON form. Mirrors the serializable members of {@link RelationDef}. */
+export interface RelationJSON {
+    readonly type: RelationType;
+    readonly target: string;
+    readonly foreignKey: string;
+    readonly foreignKeyColumn: string;
+    readonly options?: Record<string, boolean>;
+    readonly orderBy?: string;
+}
+/** A model in JSON form. Everything on {@link ModelDef} except closures. */
+export interface ModelJSON {
+    readonly fields: Record<string, FieldMeta>;
+    readonly relations: Record<string, RelationJSON>;
+    readonly load: LoadStrategy;
+    readonly typename: string;
+    readonly tableName?: string;
+    readonly tenancy: Tenancy;
+    /** The database plane the model's rows live in. Optional for backward
+     *  compatibility: when absent (an artifact written before this field existed)
+     *  it reads as `tenant`, the default. See {@link ModelResidency}. */
+    readonly plane?: ModelResidency;
+    readonly scope?: boolean | string;
+    readonly grants?: GrantsRef;
+    readonly entityRoles?: readonly EntityRole[];
+    /** The declared write-conflict disposition per committer kind. When absent,
+     *  the engine falls back to its default. */
+    readonly conflict?: ConflictAxis;
+    readonly bootstrapLimit?: number;
+    readonly bootstrapOrderBy?: string;
+    readonly mutable?: boolean;
+    readonly lazyObservable?: boolean;
+    readonly persist?: PersistOptions;
+    readonly autoFill?: readonly AutoFillRule[];
+    readonly requiredFields?: readonly string[];
+}
+/** The JSON form of a {@link Schema}. The `ablo push` payload. */
+export interface SchemaJSON {
+    readonly v: typeof SCHEMA_JSON_VERSION;
+    readonly models: Record<string, ModelJSON>;
+    readonly identityRoles: readonly IdentityRole[];
+    /** Optional so schemas pushed before ADR 0011 still parse (defaults to `{}`). */
+    readonly sessionSettings?: SessionSettings;
+}
+/**
+ * Project a `Schema` to its JSON form. Drops the client-only closures
+ * (validators, `computed`); keeps everything the server and a faithful
+ * rebuild need. The result is plain data — `JSON.stringify`-safe.
+ */
+export declare function toSchemaJSON(schema: Schema): SchemaJSON;
+/** Serialize a `Schema` to a JSON string (the `ablo push` payload). */
+export declare function serializeSchema(schema: Schema): string;
+/**
+ * Reconstruct a working `Schema` from its JSON form. Validators are rebuilt
+ * permissively from field metadata (the server never validates field shapes);
+ * `computed` getters are absent. Everything the server reads — routing,
+ * scoping, relations, identity roles — is restored exactly.
+ */
+export declare function fromSchemaJSON(json: SchemaJSON): Schema;
+/** Parse a `Schema` from a JSON string (inverse of {@link serializeSchema}). */
+export declare function parseSchema(json: string): Schema;
+/**
+ * Stable content hash of a `Schema`'s JSON form. FNV-1a over a canonical
+ * (sorted-key) encoding — deterministic across runs and order-invariant, no
+ * `crypto` dependency. Used for connect-time version gating: the client sends
+ * the hash it was built against, the server compares it to the tenant's
+ * active schema hash. Not a security primitive.
+ */
+export declare function schemaHash(schema: Schema): string;
+/**
+ * Content hash of ONE serialized model — the unit of the semantic drift check.
+ * Two schemas agree on a model exactly when these match, which is what lets a
+ * client compare only the models it declares instead of welding itself to the
+ * whole-schema hash (where any additive push reads as drift). Computed over the
+ * model's `SchemaJSON` entry with the same canonicalization and hash as
+ * {@link schemaHash}, on both the client and the server's `GET /api/schema`.
+ */
+export declare function modelHash(modelJson: unknown): string;
+export {};
+//# sourceMappingURL=serialize.d.ts.map

package/dist/schema/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/schema/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAGV,SAAS,EACT,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,YAAY,EACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,MAAM,EAEX,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAErB;iDACiD;AACjD,QAAA,MAAM,mBAAmB,EAAG,CAAU,CAAC;AAIvC,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;yEAEqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7C;gDAC4C;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,iFAAiF;IACjF,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;CAC5C;AA6CD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAmBvD;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AA+GD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAgBvD;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAShD;AAID;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAEpD"}