@abloatai/transaction 0.37.1 → 0.39.0

package/dist/wire/auth.js

@@ -10,7 +10,7 @@
  * `auth/schemas.ts`.
  */
 import { z } from 'zod';
-import { grantedOperationSchema } from '../auth/capability.js';
+import { capabilityOperationSchema, grantedOperationSchema } from '../auth/capability.js';
 import { syncGroupInputSchema } from '../coordination/schema.js';
 /** The participant this session acts as. */
 export const ephemeralKeyUserSchema = z.object({
@@ -44,8 +44,25 @@ export const ephemeralKeyRequestSchema = z.object({
     schemaOwnerOrgId: z.string().min(1).optional(),
     /** Narrow the session to these sync groups. */
     syncGroups: z.array(syncGroupInputSchema).readonly().optional(),
-    /** Required least-privilege allowlist. */
-    operations: z.array(grantedOperationSchema).min(1),
+    /**
+     * Least-privilege allowlist, named model by model. For a caller that knows
+     * the schema the session will resolve. Exactly one of this and
+     * {@link ephemeralKeyRequestSchema.shape.activeSchemaOperations} is required.
+     */
+    operations: z.array(grantedOperationSchema).min(1).optional(),
+    /**
+     * The same allowlist expressed as verbs alone, for a caller that CANNOT know
+     * the models: an identity service minting sessions for organizations whose
+     * schemas it does not own has no way to name them, and a grant is checked
+     * against the session's schema at mint time, so naming another schema's
+     * models fails every time.
+     *
+     * The server expands these across the models in the session's active schema
+     * and stores the concrete result, so what lands on the credential is the same
+     * enumerated allowlist as the field above. A verb is granted only where the
+     * model admits it — an immutable model takes `read` and nothing else.
+     */
+    activeSchemaOperations: z.array(capabilityOperationSchema).min(1).optional(),
     /** Lifetime in seconds. Capped by the server's maximum. */
     ttlSeconds: z.number().int().positive().optional(),
     /** A human-readable tag recorded with the key, for debugging. */
@@ -54,6 +71,12 @@ export const ephemeralKeyRequestSchema = z.object({
     (request.schemaOwnerOrgId === undefined), {
     message: 'schemaProjectId and schemaOwnerOrgId must be provided together',
     path: ['schemaProjectId'],
+}).refine((request) => (request.operations === undefined) !== (request.activeSchemaOperations === undefined), {
+    // Exactly one, never both and never neither. Neither would leave the
+    // credential with an empty allowlist, which reads as UNRESTRICTED at the
+    // gate rather than as nothing; both would leave two answers to one question.
+    message: 'provide either operations or activeSchemaOperations, not both',
+    path: ['operations'],
 });
 /**
  * The capability mint body lives with the rest of the capability vocabulary in

package/dist/wire/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/wire/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,4CAA4C;IAC5C,IAAI,EAAE,sBAAsB;IAC5B;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/D,0CAA0C;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,CACP,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC;IACvC,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,EAC1C;IACE,OAAO,EACL,gEAAgE;IAClE,IAAI,EAAE,CAAC,iBAAiB,CAAC;CAC1B,CACF,CAAC;AAGF;;;;;;;;;;;GAWG;AACH,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/wire/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,4CAA4C;IAC5C,IAAI,EAAE,sBAAsB;IAC5B;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;;OAWG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5E,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,CACP,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC;IACvC,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,EAC1C;IACE,OAAO,EACL,gEAAgE;IAClE,IAAI,EAAE,CAAC,iBAAiB,CAAC;CAC1B,CACF,CAAC,MAAM,CACN,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,KAAK,SAAS,CAAC,EACvF;IACE,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,OAAO,EAAE,+DAA+D;IACxE,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CACF,CAAC;AAGF;;;;;;;;;;;GAWG;AACH,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC"}

package/dist/wire/delta.d.ts

@@ -62,6 +62,17 @@ export type SyncDeltaAction = z.infer<typeof syncDeltaActionSchema>;
  * serialized string (used by the group-change frames on `G` and `S` deltas), or
  * `null` on deletes. This is wider than the stored row's payload — which is only a
  * row or null — because the group-change frames encode their payload as a string.
+ *
+ * The record branch costs more than its contract suggests: it walks
+ * `Reflect.ownKeys` and rebuilds the payload into a fresh object on every parse,
+ * so client-side validation scales with a row's field count on a path that runs
+ * once per delta (2.7 microseconds at 23 fields, against 0.15 for a predicate).
+ * Replacing it was tried and reverted, because every faster spelling gives up
+ * something this contract owns: `z.custom` cannot be represented in JSON Schema
+ * and breaks the derived spec, and `z.unknown().refine` derives to an empty
+ * schema and infers `unknown`, which would widen {@link WireDeltaData}. A
+ * predicate must also match this schema's real acceptance, which is
+ * plain-object: `z.record` rejects `Date`, `Map`, and class instances.
  */
 export declare const wireDeltaDataSchema: z.ZodNullable<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodString]>>;
 export type WireDeltaData = z.infer<typeof wireDeltaDataSchema>;

package/dist/wire/delta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delta.d.ts","sourceRoot":"","sources":["../../src/wire/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;yCAEyC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,2EAA2E;AAC3E,eAAO,MAAM,uBAAuB;;;;;;EAMlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;EAAmD,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,2FAEnB,CAAC;AACd,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAG/B,CAAC;AACH,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAO9D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;iBAYlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAQhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWpB,CAAC;AACL,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"delta.d.ts","sourceRoot":"","sources":["../../src/wire/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;yCAEyC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,2EAA2E;AAC3E,eAAO,MAAM,uBAAuB;;;;;;EAMlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;EAAmD,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,2FAEnB,CAAC;AACd,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAG/B,CAAC;AACH,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAO9D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;iBAYlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAQhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWpB,CAAC;AACL,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/wire/delta.js

@@ -54,6 +54,17 @@ export const syncDeltaActionSchema = z.enum(['I', 'U', 'D', 'A', 'V', 'C', 'G',
  * serialized string (used by the group-change frames on `G` and `S` deltas), or
  * `null` on deletes. This is wider than the stored row's payload — which is only a
  * row or null — because the group-change frames encode their payload as a string.
+ *
+ * The record branch costs more than its contract suggests: it walks
+ * `Reflect.ownKeys` and rebuilds the payload into a fresh object on every parse,
+ * so client-side validation scales with a row's field count on a path that runs
+ * once per delta (2.7 microseconds at 23 fields, against 0.15 for a predicate).
+ * Replacing it was tried and reverted, because every faster spelling gives up
+ * something this contract owns: `z.custom` cannot be represented in JSON Schema
+ * and breaks the derived spec, and `z.unknown().refine` derives to an empty
+ * schema and infers `unknown`, which would widen {@link WireDeltaData}. A
+ * predicate must also match this schema's real acceptance, which is
+ * plain-object: `z.record` rejects `Date`, `Map`, and class instances.
  */
 export const wireDeltaDataSchema = z
     .union([z.record(z.string(), z.unknown()), z.string()])

package/dist/wire/delta.js.map

@@ -1 +1 @@
-{"version":3,"file":"delta.js","sourceRoot":"","sources":["../../src/wire/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIlE,iFAAiF;AAEjF;;yCAEyC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGlE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,MAAM;IACN,WAAW;IACX,UAAU;IACV,yBAAyB;IACzB,iBAAiB;CAClB,CAAC,CAAC;AAGH,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAGtF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACtD,QAAQ,EAAE,CAAC;AAGd;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,qBAAqB;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAGzB,IAAI,CAAC;AACT,KAAK,uBAAuB,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,UAAU,EAAE,qBAAqB;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,mBAAmB;IACzB,YAAY,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,gFAAgF;IAChF,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAClE;+FAC2F;IAC3F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,8EAA8E;IAC9E,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACxC,8EAA8E;IAC9E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAClE;;;;8EAI0E;IAC1E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,4DAA4D;IAC5D,SAAS,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC1C,gDAAgD;IAChD,KAAK,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACtC,qGAAqG;IACrG,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,iBAAiB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB;KAC/C,IAAI,CAAC;IACJ,UAAU,EAAE,IAAI;IAChB,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,CAAC;IACN,KAAK,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,iBAAiB,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC"}
+{"version":3,"file":"delta.js","sourceRoot":"","sources":["../../src/wire/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIlE,iFAAiF;AAEjF;;yCAEyC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGlE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,MAAM;IACN,WAAW;IACX,UAAU;IACV,yBAAyB;IACzB,iBAAiB;CAClB,CAAC,CAAC;AAGH,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAGtF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACtD,QAAQ,EAAE,CAAC;AAGd;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,qBAAqB;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAGzB,IAAI,CAAC;AACT,KAAK,uBAAuB,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,UAAU,EAAE,qBAAqB;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,mBAAmB;IACzB,YAAY,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,gFAAgF;IAChF,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAClE;+FAC2F;IAC3F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,8EAA8E;IAC9E,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACxC,8EAA8E;IAC9E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAClE;;;;8EAI0E;IAC1E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,4DAA4D;IAC5D,SAAS,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC1C,gDAAgD;IAChD,KAAK,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACtC,qGAAqG;IACrG,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,iBAAiB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB;KAC/C,IAAI,CAAC;IACJ,UAAU,EAAE,IAAI;IAChB,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,CAAC;IACN,KAAK,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,iBAAiB,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC"}

package/dist/wire/inboundFrames.d.ts

@@ -326,6 +326,7 @@ export declare const WS_INBOUND_FRAMES: {
         readonly payload: z.ZodObject<{
             claimId: z.ZodString;
             fenceToken: z.ZodOptional<z.ZodNumber>;
+            readAt: z.ZodOptional<z.ZodNumber>;
             target: z.ZodObject<{
                 entityType: z.ZodString;
                 entityId: z.ZodString;
@@ -389,6 +390,7 @@ export declare const WS_INBOUND_FRAMES: {
         readonly payload: z.ZodObject<{
             claimId: z.ZodString;
             fenceToken: z.ZodOptional<z.ZodNumber>;
+            readAt: z.ZodOptional<z.ZodNumber>;
             target: z.ZodObject<{
                 entityType: z.ZodString;
                 entityId: z.ZodString;

package/dist/wire/inboundFrames.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inboundFrames.d.ts","sourceRoot":"","sources":["../../src/wire/inboundFrames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;kCAKZ,CAAC;AACzB,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0CAA0C;AAC1C,MAAM,MAAM,oBAAoB;AAC9B,wDAAwD;AACtD;IAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAA;CAAE;AAChE;;;;;;GAMG;GACD;IACE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAChC,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D2B,CAAC;AAE1D,8CAA8C;AAC9C,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;KAC7C,GACG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GACV,KAAK;CACV,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;KACpC,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;KAC/B,GACG,CAAC,GACD,KAAK;CACV,CAAC,gBAAgB,CAAC,CAAC;AAEpB,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,gBAAgB,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,GACrB,IAAI,IAAI,wBAAwB,CAElC"}
+{"version":3,"file":"inboundFrames.d.ts","sourceRoot":"","sources":["../../src/wire/inboundFrames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;kCAKZ,CAAC;AACzB,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0CAA0C;AAC1C,MAAM,MAAM,oBAAoB;AAC9B,wDAAwD;AACtD;IAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAA;CAAE;AAChE;;;;;;GAMG;GACD;IACE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAChC,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D2B,CAAC;AAE1D,8CAA8C;AAC9C,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;KAC7C,GACG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GACV,KAAK;CACV,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;KACpC,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;KAC/B,GACG,CAAC,GACD,KAAK;CACV,CAAC,gBAAgB,CAAC,CAAC;AAEpB,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,gBAAgB,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,GACrB,IAAI,IAAI,wBAAwB,CAElC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/transaction",
-  "version": "0.37.1",
+  "version": "0.39.0",
   "description": "The headless Ablo transaction client and canonical contracts for reads, commits, settlement, claims, and durable observation.",
   "license": "Apache-2.0",
   "type": "module",
@@ -22,6 +22,11 @@
       "import": "./dist/environment.js",
       "default": "./dist/environment.js"
     },
+    "./branches": {
+      "types": "./dist/branches.d.ts",
+      "import": "./dist/branches.js",
+      "default": "./dist/branches.js"
+    },
     "./coordination": {
       "types": "./dist/coordination/index.d.ts",
       "import": "./dist/coordination/index.js",
@@ -161,7 +166,7 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "ai": "^6.0.0",
+    "ai": "^6.0.0 || ^7.0.0",
     "drizzle-orm": ">=0.44.0"
   },
   "peerDependenciesMeta": {
@@ -177,6 +182,7 @@
     "@jest/globals": "^30.2.0",
     "@types/jest": "^30.0.0",
     "ai": "^6.0.0",
+    "drizzle-orm": "^0.45.2",
     "jest": "^30.2.0",
     "jest-environment-node": "^30.2.0",
     "publint": "^0.3.17",

package/src/ai-sdk/index.ts

@@ -1,7 +1,20 @@
 export {
-  coordinatedTool,
-  type CoordinationStrategy,
-  type CoordinatedModel,
-  type CoordinatedToolOptions,
-  type CoordinatedWriteResult,
-} from './coordinatedTool.js';
+  updateTool,
+  type UpdateStrategy,
+  type UpdateToolModel,
+  type UpdateToolOptions,
+  type UpdateToolResult,
+} from './updateTool.js';
+export {
+  createTool,
+  deleteTool,
+  readTool,
+  type CreateToolOptions,
+  type CreateToolResult,
+  type DeleteToolOptions,
+  type DeleteToolResult,
+  type ReadToolOptions,
+  type ReadToolResult,
+  type ToolModel,
+} from './modelTools.js';
+export type { ModelToolOptions } from './toolOptions.js';

package/src/ai-sdk/modelTools.ts

@@ -0,0 +1,165 @@
+/**
+ * Small AI SDK adapters for Ablo model resources.
+ *
+ * The AI SDK owns the agent loop. These helpers only expose Ablo's
+ * authoritative model operations as tools, preserving the same credential,
+ * validation, idempotency, claims, and settlement behavior as direct SDK use.
+ */
+
+import { tool, type ToolExecutionOptions } from 'ai';
+import type { z } from 'zod';
+import type {
+  ClaimParams,
+  ModelCreateParams,
+  ModelDeleteParams,
+  ModelRetrieveParams,
+} from '../resources/modelOperations.js';
+import type { HeldClaim } from '../types/streams.js';
+import type { ModelToolOptions } from './toolOptions.js';
+
+export interface ToolModel<T, CreateInput = Partial<T>, Fields = T> {
+  get(params: ModelRetrieveParams): Promise<T | undefined>;
+  create(params: ModelCreateParams<T, CreateInput>): Promise<T>;
+  delete(params: ModelDeleteParams<T, Fields>): Promise<void>;
+  claim(
+    params: ClaimParams<Fields> & { queue: false },
+  ): Promise<HeldClaim<T> | null>;
+  claim(params: ClaimParams<Fields>): Promise<HeldClaim<T>>;
+}
+
+export interface ReadToolOptions<TInput, T>
+  extends ModelToolOptions<TInput, ReadToolResult<T>> {
+  readonly description: string;
+  readonly inputSchema: z.ZodType<TInput>;
+  readonly id: (input: TInput) => string;
+}
+
+export type ReadToolResult<T> =
+  | { readonly status: 'found'; readonly row: T }
+  | { readonly status: 'not_found'; readonly message: string };
+
+export function readTool<TInput, T>(
+  model: Pick<ToolModel<T>, 'get'>,
+  options: ReadToolOptions<TInput, T>,
+) {
+  return tool<TInput, ReadToolResult<T>>({
+    description: options.description,
+    title: options.title,
+    inputSchema: options.inputSchema,
+    inputExamples: options.inputExamples,
+    needsApproval: options.needsApproval,
+    strict: options.strict,
+    outputSchema: options.outputSchema,
+    toModelOutput: options.toModelOutput,
+    execute: async (input) => {
+      const id = options.id(input);
+      const row = await model.get({ id });
+      return row === undefined
+        ? {
+            status: 'not_found',
+            message: `No accessible row exists with id ${id}.`,
+          }
+        : { status: 'found', row };
+    },
+  });
+}
+
+export interface CreateToolOptions<TInput, CreateInput, T>
+  extends ModelToolOptions<TInput, CreateToolResult<T>> {
+  readonly description: string;
+  readonly inputSchema: z.ZodType<TInput>;
+  readonly data: (input: TInput) => CreateInput;
+  /**
+   * Stable ids make retries idempotent. Omit only when the model or server
+   * generates the id and duplicate creation is acceptable to the application.
+   */
+  readonly id?: (input: TInput) => string | undefined;
+}
+
+export interface CreateToolResult<T> {
+  readonly status: 'created';
+  readonly row: T;
+}
+
+export function createTool<TInput, T, CreateInput>(
+  model: Pick<ToolModel<T, CreateInput>, 'create'>,
+  options: CreateToolOptions<TInput, CreateInput, T>,
+) {
+  return tool<TInput, CreateToolResult<T>>({
+    description: options.description,
+    title: options.title,
+    inputSchema: options.inputSchema,
+    inputExamples: options.inputExamples,
+    needsApproval: options.needsApproval,
+    strict: options.strict,
+    outputSchema: options.outputSchema,
+    toModelOutput: options.toModelOutput,
+    execute: async (input) => {
+      const id = options.id?.(input);
+      const row = await model.create({
+        data: options.data(input),
+        ...(id !== undefined ? { id } : {}),
+        wait: 'confirmed',
+      });
+      return { status: 'created', row };
+    },
+  });
+}
+
+export interface DeleteToolOptions<TInput>
+  extends ModelToolOptions<TInput, DeleteToolResult> {
+  readonly description: string;
+  readonly inputSchema: z.ZodType<TInput>;
+  readonly id: (input: TInput) => string;
+  /** Defaults to waiting in the server-owned FIFO claim queue. */
+  readonly strategy?: 'claim' | 'queue';
+  readonly claim?: { readonly description?: string };
+}
+
+export type DeleteToolResult =
+  | { readonly status: 'deleted'; readonly id: string }
+  | { readonly status: 'claimed'; readonly message: string };
+
+export function deleteTool<TInput, T, Fields = T>(
+  model: Pick<ToolModel<T, Partial<T>, Fields>, 'claim' | 'delete'>,
+  options: DeleteToolOptions<TInput>,
+) {
+  return tool<TInput, DeleteToolResult>({
+    description: options.description,
+    title: options.title,
+    inputSchema: options.inputSchema,
+    inputExamples: options.inputExamples,
+    // Destructive tools require approval unless an application deliberately
+    // opts into autonomous deletion.
+    needsApproval: options.needsApproval ?? true,
+    strict: options.strict,
+    outputSchema: options.outputSchema,
+    toModelOutput: options.toModelOutput,
+    execute: async (
+      input: TInput,
+      execution: ToolExecutionOptions,
+    ): Promise<DeleteToolResult> => {
+      const id = options.id(input);
+      const queue = options.strategy !== 'claim';
+      const claim = await model.claim({
+        id,
+        queue,
+        description: options.claim?.description,
+        signal: execution.abortSignal,
+      });
+      if (!claim) {
+        return {
+          status: 'claimed',
+          message:
+            'Another participant holds this row right now — it was not deleted.',
+        };
+      }
+      try {
+        await model.delete({ id, claim, wait: 'confirmed' });
+        return { status: 'deleted', id };
+      } finally {
+        await claim.release();
+      }
+    },
+  });
+}

package/src/ai-sdk/toolOptions.ts

@@ -0,0 +1,18 @@
+import type { Tool } from 'ai';
+
+/**
+ * AI SDK-native presentation and execution policy shared by Ablo model tools.
+ * Ablo owns the data operation; AI SDK owns how the tool is presented,
+ * validated, approved, and returned to the model.
+ */
+export type ModelToolOptions<TInput, TResult> = Partial<
+  Pick<
+    Tool<TInput, TResult>,
+    | 'title'
+    | 'inputExamples'
+    | 'needsApproval'
+    | 'strict'
+    | 'outputSchema'
+    | 'toModelOutput'
+  >
+>;

package/src/ai-sdk/{coordinatedTool.ts → updateTool.ts}

@@ -1,5 +1,5 @@
 /**
- * Turns a write to one of your models into a Vercel AI SDK tool that handles
+ * Turns a write to one of your models into an AI SDK tool that handles
  * multi-agent coordination for you, so an agent can contribute to shared state
  * without silently overwriting another writer's concurrent change.
  *
@@ -11,10 +11,10 @@
  * write:
  *
  * ```ts
- * import { coordinatedTool } from '@abloatai/transaction/ai-sdk';
+ * import { updateTool } from '@abloatai/ablo/ai-sdk';
  * import { z } from 'zod';
  *
- * const saveSection = coordinatedTool(ablo.documents, {
+ * const saveSection = updateTool(ablo.documents, {
  *   description: 'Save your section into the shared document.',
  *   inputSchema: z.object({ text: z.string() }),
  *   id: () => DOC_ID,
@@ -25,7 +25,7 @@
  * await streamText({ model, messages, tools: { saveSection } });
  * ```
  *
- * The {@link CoordinatedToolOptions.apply} function is the whole API: a pure
+ * The {@link UpdateToolOptions.apply} function is the whole API: a pure
  * function from the freshest row and the tool input to a patch, in the same
  * spirit as a functional state update. Everything beneath it — reading the latest
  * row, the compare-and-swap, backing off between retries, and releasing claims —
@@ -52,42 +52,39 @@
  *   than a hidden wait when it might spend its turn on something else. Works under
  *   any conflict policy.
  *
- * - `'queue'` serializes writers over stateless HTTP. The tool polls to acquire
- *   the claim until it is granted or `poll.timeoutMs` elapses, so the model calls
- *   once and the tool waits its turn. Ordering is approximate rather than strict
- *   first-in-first-out, which would require a persistent connection.
+ * - `'queue'` joins Ablo's server-owned FIFO queue. The model calls once and
+ *   the tool waits for the canonical claim grant; it does not recreate queueing
+ *   with client-side polling.
  */
 
-import { tool } from 'ai';
+import { tool, type ToolExecutionOptions } from 'ai';
 import type { z } from 'zod';
-import { AbloClaimedError, AbloNotFoundError } from '@abloatai/transaction/errors';
 import type {
   ClaimParams,
-  ModelRetrieveParams,
   ModelUpdateParams,
 } from '../resources/modelOperations.js';
 import type { ModelUpdater, ContentionOptions } from '../resources/functionalUpdate.js';
 import type { HeldClaim } from '../types/streams.js';
+import type { ModelToolOptions } from './toolOptions.js';
 
-export type CoordinationStrategy = 'merge' | 'claim' | 'queue';
+export type UpdateStrategy = 'merge' | 'claim' | 'queue';
 
 /** The structured result the tool hands back to the model (or the caller). */
-export interface CoordinatedWriteResult<T> {
+export interface UpdateToolResult<T> {
   /**
    * `'written'` means the change was saved. `'claimed'` means another participant
    * holds the row, so nothing was saved and the model should try again.
-   * `'timeout'` means the `'queue'` strategy could not acquire the row within
-   * `poll.timeoutMs`.
    */
-  status: 'written' | 'claimed' | 'timeout';
+  status: 'written' | 'claimed';
   /** The reconciled row, on `'written'`. */
   row?: T;
   message?: string;
-  /** On `'written'` via the `queue` strategy, how long the tool waited in line. */
+  /** On `'written'` via the `queue` strategy, how long the tool waited. */
   waitedMs?: number;
 }
 
-export interface CoordinatedToolOptions<TInput, T> {
+export interface UpdateToolOptions<TInput, T>
+  extends ModelToolOptions<TInput, UpdateToolResult<T>> {
   /** Tool description shown to the model. */
   description: string;
   /** The schema of what the model may send, as a standard AI SDK / Zod input schema. */
@@ -103,45 +100,50 @@ export interface CoordinatedToolOptions<TInput, T> {
    */
   apply: (current: T, input: TInput) => Partial<T>;
   /** How concurrent writers relate. Defaults to `'merge'`. */
-  strategy?: CoordinationStrategy;
+  strategy?: UpdateStrategy;
   /** Human-readable coordination metadata attached to the claim, used by the `'claim'` and `'queue'` strategies. */
   claim?: { description?: string };
   /** How many reconcile rounds `'merge'` may take before it gives up with `AbloContentionError`. */
   retries?: number;
-  /** Poll interval and overall timeout for `'queue'`. Defaults to 250ms and 30s. */
-  poll?: { intervalMs?: number; timeoutMs?: number };
 }
 
-const sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));
-
 /**
  * The small model port this helper needs. Both typed transports implement this
  * exact contract; local-cache methods, wire receipts, and transport lifecycle
  * deliberately stay out of an AI tool's dependency surface.
  */
-export interface CoordinatedModel<T> {
-  get(params: ModelRetrieveParams): Promise<T | undefined>;
-  /** @deprecated Use `get({ id })`. */
-  retrieve?(params: ModelRetrieveParams): Promise<T | undefined>;
+export interface UpdateToolModel<T> {
   update(params: ModelUpdateParams<T>): Promise<T>;
   update(
     id: string,
     updater: ModelUpdater<T>,
     options?: ContentionOptions,
   ): Promise<T | undefined>;
+  claim(
+    params: ClaimParams<T> & { queue: false },
+  ): Promise<HeldClaim<T> | null>;
   claim(params: ClaimParams<T>): Promise<HeldClaim<T>>;
 }
 
-export function coordinatedTool<
+export function updateTool<
   TInput,
   T = Record<string, unknown>,
->(model: CoordinatedModel<T>, options: CoordinatedToolOptions<TInput, T>) {
+>(model: UpdateToolModel<T>, options: UpdateToolOptions<TInput, T>) {
   const strategy = options.strategy ?? 'merge';
 
-  return tool<TInput, CoordinatedWriteResult<T>>({
+  return tool<TInput, UpdateToolResult<T>>({
     description: options.description,
+    title: options.title,
     inputSchema: options.inputSchema,
-    execute: async (input: TInput): Promise<CoordinatedWriteResult<T>> => {
+    inputExamples: options.inputExamples,
+    needsApproval: options.needsApproval,
+    strict: options.strict,
+    outputSchema: options.outputSchema,
+    toModelOutput: options.toModelOutput,
+    execute: async (
+      input: TInput,
+      execution: ToolExecutionOptions,
+    ): Promise<UpdateToolResult<T>> => {
       const id = options.id(input);
 
       if (strategy === 'merge') {
@@ -150,29 +152,39 @@ export function coordinatedTool<
         // backoff. The model never sees a conflict.
         const row = await model.update(id, (current) => options.apply(current, input), {
           retries: options.retries,
+          signal: execution.abortSignal,
         });
         return { status: 'written', row: row ?? undefined };
       }
 
       // The 'claim' and 'queue' strategies both acquire a claim, write under it,
       // and release it. They differ only in what they do when the row is already
-      // held: 'claim' returns a signal to the model, while 'queue' waits and
-      // retries by polling to acquire.
-      const acquireWriteRelease = async (): Promise<CoordinatedWriteResult<T>> => {
+      // held: 'claim' returns a signal to the model, while 'queue' waits for
+      // the server-owned FIFO grant.
+      const acquireWriteRelease = async (
+        queue: boolean,
+      ): Promise<UpdateToolResult<T>> => {
         const claim = await model.claim({
           id,
-          queue: false,
+          queue,
           description: options.claim?.description,
+          signal: execution.abortSignal,
         });
+        if (!claim) {
+          return {
+            status: 'claimed',
+            message:
+              'Another participant holds this row right now — it was not saved.',
+          };
+        }
         try {
-          const current = await model.get({ id });
-          if (current === undefined) {
-            throw new AbloNotFoundError(
-              `Cannot write ${id}: it does not exist (or is outside this credential's scope).`,
-              [id],
-            );
-          }
-          const row = await model.update({ id, data: options.apply(current, input), claim, wait: 'confirmed' });
+          const current = claim.data;
+          const row = await model.update({
+            id,
+            data: options.apply(current, input),
+            claim,
+            wait: 'confirmed',
+          });
           return { status: 'written', row };
         } finally {
           await claim.release();
@@ -180,35 +192,13 @@ export function coordinatedTool<
       };
 
       if (strategy === 'claim') {
-        try {
-          return await acquireWriteRelease();
-        } catch (e) {
-          if (e instanceof AbloClaimedError) {
-            return { status: 'claimed', message: 'Another participant holds this row right now — it was NOT saved. Wait briefly and try again.' };
-          }
-          throw e;
-        }
+        return acquireWriteRelease(false);
       }
 
-      // strategy === 'queue': poll to acquire the claim over stateless HTTP.
-      const interval = options.poll?.intervalMs ?? 250;
-      const timeout = options.poll?.timeoutMs ?? 30_000;
+      // The transaction client owns the server FIFO and resolves once granted.
       const start = Date.now();
-      for (;;) {
-        try {
-          const result = await acquireWriteRelease();
-          return { ...result, waitedMs: Date.now() - start };
-        } catch (e) {
-          if (e instanceof AbloClaimedError) {
-            if (Date.now() - start >= timeout) {
-              return { status: 'timeout', message: `Could not acquire the row within ${timeout}ms.` };
-            }
-            await sleep(interval);
-            continue;
-          }
-          throw e;
-        }
-      }
+      const result = await acquireWriteRelease(true);
+      return { ...result, waitedMs: Date.now() - start };
     },
   });
 }

package/src/auth/capability.ts

@@ -239,6 +239,10 @@ export function grantedOperations(
  */
 export const capabilityScopeSchema = z.object({
   organizationId: z.string().min(1),
+  /** Credential target. Branch id is authoritative; null supports self-hosted identities. */
+  projectId: z.string().min(1).nullable().default(null),
+  branchId: z.string().min(1).nullable().default(null),
+  branchRoot: z.boolean().default(false),
   /**
    * The ROW axis — which sync groups this credential may act within. Read back
    * as plain strings rather than the branded form the request enforces: this is