@abloatai/transaction 0.46.0 → 0.47.0

package/dist/wire/index.js

@@ -78,7 +78,7 @@ export { projectResponseSchema, projectListResponseSchema, provisionedKeySchema,
 // The datasource routes' responses — the `ablo connect` surface: register,
 // validate, locate, list, deregister. What the server, the CLI, and the
 // dashboard agree on.
-export { READINESS_ITEMS, READINESS_ADVISORY_ITEMS, isReadinessItem, readinessFailureSchema, readinessAdvisorySchema, datasourceSummarySchema, datasourceListResponseSchema, datasourceValidationResponseSchema, datasourceLocationResponseSchema, datasourceDisconnectedResponseSchema, } from './dataSourceResponses.js';
+export { READINESS_ITEMS, READINESS_ADVISORY_ITEMS, isReadinessItem, readinessFailureSchema, readinessAdvisorySchema, datasourceSummarySchema, datasourceListResponseSchema, datasourceValidationResponseSchema, datasourceLocationResponseSchema, datasourceResnapshotResponseSchema, datasourceDisconnectedResponseSchema, } from './dataSourceResponses.js';
 // The inbound socket surface: every frame the server can send, and how each
 // one's payload is validated.
 export { WS_INBOUND_FRAMES, wsInboundEnvelopeSchema, isKnownInboundFrame, isSchemaValidatedFrame, } from './inboundFrames.js';

package/dist/wire/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/wire/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGrE,8EAA8E;AAC9E,8BAA8B;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,cAAc;AACd,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAY9B,6EAA6E;AAC7E,8EAA8E;AAC9E,gDAAgD;AAChD,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,eAAe,EACf,0BAA0B;AAC1B,8EAA8E;AAC9E,oEAAoE;AACpE,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAiBrB,kFAAkF;AAClF,0EAA0E;AAC1E,kFAAkF;AAClF,wDAAwD;AACxD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACZ,MAAM,YAAY,CAAC;AAapB,6EAA6E;AAC7E,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,sBAAsB;AACtB,4EAA4E;AAC5E,4EAA4E;AAC5E,0CAA0C;AAC1C,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,wDAAwD;AACxD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO;AACL,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAmBrB,yEAAyE;AACzE,yDAAyD;AACzD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAQzB,6EAA6E;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGjE,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAqB/B,2EAA2E;AAC3E,wEAAwE;AACxE,sBAAsB;AACtB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,kCAAkC,EAClC,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAalC,4EAA4E;AAC5E,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAS5B,+EAA+E;AAC/E,qDAAqD;AACrD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/wire/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGrE,8EAA8E;AAC9E,8BAA8B;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,cAAc;AACd,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAY9B,6EAA6E;AAC7E,8EAA8E;AAC9E,gDAAgD;AAChD,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,eAAe,EACf,0BAA0B;AAC1B,8EAA8E;AAC9E,oEAAoE;AACpE,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAiBrB,kFAAkF;AAClF,0EAA0E;AAC1E,kFAAkF;AAClF,wDAAwD;AACxD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACZ,MAAM,YAAY,CAAC;AAapB,6EAA6E;AAC7E,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,sBAAsB;AACtB,4EAA4E;AAC5E,4EAA4E;AAC5E,0CAA0C;AAC1C,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,wDAAwD;AACxD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO;AACL,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAmBrB,yEAAyE;AACzE,yDAAyD;AACzD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAQzB,6EAA6E;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGjE,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAqB/B,2EAA2E;AAC3E,wEAAwE;AACxE,sBAAsB;AACtB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,kCAAkC,EAClC,gCAAgC,EAChC,kCAAkC,EAClC,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAclC,4EAA4E;AAC5E,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAS5B,+EAA+E;AAC/E,qDAAqD;AACrD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,WAAW,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/transaction",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "The headless Ablo transaction client and canonical contracts for reads, commits, settlement, claims, and durable observation.",
   "license": "Apache-2.0",
   "type": "module",

package/src/ai-sdk/modelTools.ts

@@ -100,7 +100,6 @@ export function createTool<TInput, T, CreateInput>(
       const row = await model.create({
         data: options.data(input),
         ...(id !== undefined ? { id } : {}),
-        wait: 'confirmed',
       });
       return { status: 'created', row };
     },
@@ -156,7 +155,7 @@ export function deleteTool<TInput, T, Fields = T>(
         };
       }
       try {
-        await model.delete({ id, claim, wait: 'confirmed' });
+        await model.delete({ id, claim });
         return { status: 'deleted', id };
       } finally {
         await claim.release();

package/src/ai-sdk/updateTool.ts

@@ -184,7 +184,6 @@ export function updateTool<
             id,
             data: options.apply(current, input),
             claim,
-            wait: 'confirmed',
           });
           return { status: 'written', row };
         } finally {

package/src/auth/capability.ts

@@ -27,6 +27,7 @@ import { z } from 'zod';
 import { participantKindSchema } from '../coordination/schema.js';
 import { syncGroupInputSchema } from '../schema/roles.js';
 import { authTokenSchema } from './token.js';
+import { deliveryPartitionRouteSchema } from './deliveryPartition.js';
 
 /**
  * The verbs a grant can name — the whole vocabulary, in one place. Every other
@@ -253,6 +254,7 @@ export const capabilityScopeSchema = z.object({
   operations: z.array(grantedOperationSchema),
   participantKind: participantKindSchema,
   participantId: z.string().min(1),
+  deliveryPartition: deliveryPartitionRouteSchema.nullable().default(null),
 });
 export type CapabilityScope = z.infer<typeof capabilityScopeSchema>;
 

package/src/auth/deliveryPartition.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+
+/**
+ * Opaque gateway-routing coordinate resolved by the server.
+ *
+ * Clients echo this on the WebSocket upgrade; gateways still authenticate the
+ * credential and recompute ownership, so it is routing metadata rather than an
+ * authorization claim.
+ */
+export const deliveryPartitionRouteSchema = z.object({
+  index: z.number().int().nonnegative(),
+  count: z.number().int().min(2),
+}).refine((route) => route.index < route.count, {
+  message: 'delivery partition index must be less than count',
+  path: ['index'],
+});
+
+export type DeliveryPartitionRoute = z.infer<typeof deliveryPartitionRouteSchema>;

package/src/auth/identity.ts

@@ -33,6 +33,7 @@ import type { Logger } from '../logger.js';
 import type { AuthCredentialSource } from '../auth/credentialSource.js';
 import type { CredentialProvider } from './credentialResult.js';
 import { resolveApiKeyValue, resolveBootstrapBaseUrl } from './apiKey.js';
+import type { DeliveryPartitionRoute } from './deliveryPartition.js';
 
 export interface IdentityResolveInput {
   readonly options: {
@@ -69,6 +70,7 @@ export interface ResolvedIdentity {
   readonly capabilityToken: string | undefined;
   readonly syncGroups: readonly string[] | undefined;
   readonly participantKind: ParticipantKind;
+  readonly deliveryPartition: DeliveryPartitionRoute | null;
   /** Set only on the hosted-cloud path; the caller keeps it to stop refreshes on shutdown. */
   readonly refreshScheduler: RefreshScheduler | null;
 }
@@ -192,6 +194,7 @@ export async function resolveParticipantIdentity(
         capabilityToken: cred.getBearer,
         syncGroups: options.syncGroups,
         participantKind: kind,
+        deliveryPartition: null,
         refreshScheduler: null,
       };
     }
@@ -242,6 +245,7 @@ async function resolveViaIdentity(
     capabilityToken: bearer,
     syncGroups: mergedSyncGroups,
     participantKind: identity.participantKind,
+    deliveryPartition: identity.deliveryPartition,
     refreshScheduler: null,
   };
 }
@@ -325,6 +329,7 @@ async function resolveHosted(input: HostedInput): Promise<ResolvedIdentity> {
     capabilityToken: exchange.token,
     syncGroups: exchange.scope.syncGroups,
     participantKind: input.kind,
+    deliveryPartition: exchange.scope.deliveryPartition,
     refreshScheduler,
   };
 }

package/src/auth/schemas.ts

@@ -7,6 +7,7 @@ import {
 } from './capability.js';
 import { AbloAuthenticationError } from '../errors.js';
 import { authTokenSchema } from './token.js';
+import { deliveryPartitionRouteSchema } from './deliveryPartition.js';
 
 // Not a second enum. The auth responses carry the same participant vocabulary
 // the coordination plane parses, so they validate against the same schema — a
@@ -24,6 +25,7 @@ export const IdentityResolveResponseSchema = z.object({
   branchId: z.string().min(1).nullable().default(null),
   branchRoot: z.boolean().default(false),
   syncGroups: z.array(z.string()),
+  deliveryPartition: deliveryPartitionRouteSchema.nullable().default(null),
   userMeta: z.record(z.string(), z.unknown()),
 });
 
@@ -46,6 +48,7 @@ export const EphemeralKeyResponseSchema = z.object({
   branchId: z.string().min(1).nullable().default(null),
   branchRoot: z.boolean().default(false),
   syncGroups: z.array(z.string()),
+  deliveryPartition: deliveryPartitionRouteSchema.nullable().default(null),
   /** Effective operation grant stored on the credential. Empty ONLY for a
    *  control-plane-only session, which grants no data operations by design. */
   operations: z.array(grantedOperationSchema),

package/src/auth/sessionMint.ts

@@ -98,6 +98,7 @@ export async function mintSession<S extends SchemaRecord>(
         operations: res.operations,
         participantKind: 'user',
         participantId: res.participantId,
+        deliveryPartition: res.deliveryPartition,
       },
       userMeta: params.userMeta ?? { id: res.participantId },
     };

package/src/errorCodes.ts

@@ -39,7 +39,7 @@ import { z } from 'zod';
  * error documentation and returned on the `Ablo-Version` response header, so a
  * consumer can detect when its expected contract has drifted from the server's.
  */
-export const ERROR_CONTRACT_VERSION = '2026-07-23';
+export const ERROR_CONTRACT_VERSION = '2026-07-30';
 
 /** A coarse grouping of error codes, used to organize metrics and documentation. */
 export type ErrorCategory =
@@ -1046,6 +1046,12 @@ export const ERROR_CODES = {
     true,
     'The server is at connection capacity. Retry shortly — transient and not specific to your credentials.'
   ),
+  delivery_partition_mismatch: wire(
+    'transport',
+    503,
+    true,
+    'The connection reached a gateway that does not own its delivery partition. Retry through the cell router.'
+  ),
   fetch_unavailable: client(
     'transport',
     'This environment provides no `fetch` implementation, so HTTP requests cannot be made. Run on a platform with `fetch` (Node 18+, modern browsers) or supply a polyfill.'
@@ -1240,6 +1246,12 @@ export const ERROR_CODES = {
     false,
     "The request targeted a project the caller's key is not scoped to."
   ),
+  branch_scope_denied: wire(
+    'permission',
+    403,
+    false,
+    "The request targeted a branch the caller's key is not scoped to."
+  ),
   project_slug_taken: wire(
     'validation',
     409,

package/src/footprint.ts

@@ -127,7 +127,9 @@ function planeDigest(plane: FootprintPlane): string {
   // The organization-default project may be omitted or repeated as the
   // organization id; both spell the same branch coordinates.
   const project = plane.projectId === plane.organizationId ? '' : (plane.projectId ?? '');
-  const key = [plane.organizationId, project, plane.branchId].join('');
+  // Delimit the coordinates. Concatenation alone makes structurally different
+  // planes such as ("ab", "c") and ("a", "bc") hash the same input.
+  const key = [plane.organizationId, project, plane.branchId].join('\0');
 
   const round = (seed: number): string => {
     let hash = seed;

package/src/pricing.ts

@@ -23,7 +23,7 @@
  *     rather than billed.
  *
  * The allowance a tier advertises is DERIVED, never stored: "the floor covers
- * 49.5M operations" is {@link opsForUsd} applied to the floor. Storing it
+ * 10M operations" is {@link opsForUsd} applied to the floor. Storing it
  * alongside the floor is how a published price silently stops matching the
  * invoice, because raising one number does not fail anything that pins the
  * other.
@@ -47,7 +47,7 @@ export type { MeterEvent, PlanTier, RateBracket };
  * could observe the difference. It is emitted into the generated pricing
  * documentation so a stale copy is identifiable on sight.
  */
-export const PRICING_VERSION = '2026-07-27';
+export const PRICING_VERSION = '2026-07-31';
 
 /**
  * Resolve a stored plan string (`stripe_subscription.plan`) to a tier.
@@ -82,12 +82,40 @@ export const METER_EVENT_AXIS: Record<MeterEvent, BillableAxis | null> = {
 
 /** How each meter reads on an invoice line and in the pricing table. */
 export const METER_EVENT_LABEL: Record<MeterEvent, string> = {
-  'api.commit_ops': 'commit operations',
+  'api.commit_ops': 'writes',
   'api.model_reads': 'model reads',
   'api.claim_creates': 'claim creates',
   'api.bootstraps': 'bootstraps',
 };
 
+/**
+ * What each meter counts, in the words a customer is quoted. It lives beside
+ * the label because a meter's name and its definition are one fact: a page that
+ * renamed the line without restating what it counts would be describing a
+ * different meter.
+ *
+ * These say **write**, never *commit*. A commit is the protocol's atomic batch
+ * and it belongs in the protocol reference; the surface a customer buys against
+ * is `create` / `update` / `delete`, which the front door calls writing. Pricing
+ * copy is read by people who have never opened the protocol reference, and a
+ * word they have not met cannot clarify what they are paying for.
+ *
+ * All three read as "someone did something", because they are one price and a
+ * reader who has to hold three different shapes in mind will assume there are
+ * three different charges. Each line then answers the question that particular
+ * meter provokes: whether batching is cheaper, whether cached reads count, and
+ * whether holding a claim costs more than taking one.
+ */
+export const METER_EVENT_COUNTS: Record<MeterEvent, string> = {
+  'api.commit_ops':
+    'One every time someone changes something. Adding, editing, and removing all count the same, and changing 500 things is 500 operations however they are sent.',
+  'api.model_reads':
+    'One every time someone reads something the engine answers. Reads a client already has locally never reach us and never count.',
+  'api.claim_creates':
+    'One every time someone takes ownership of a row so others wait their turn. Holding it and releasing it are free.',
+  'api.bootstraps': 'Recorded, never charged. Connecting a client is free.',
+};
+
 /** The meters a customer is charged for, in declaration order. */
 export const BILLABLE_METER_EVENTS: readonly MeterEvent[] = (
   meterEventSchema.options as readonly MeterEvent[]
@@ -185,8 +213,8 @@ export const planDefinitionSchema = z.object({
   hardCapOps: z.number().int().positive().nullable(),
   /**
    * A hard daily stop, which is a burst guard rather than an allowance. A month
-   * of operations is a comfortable month of building and about ten minutes of
-   * one agent at full rate, so a monthly cap alone lets a runaway loop erase the
+   * of operations is a comfortable month of building and about a minute of one
+   * agent at full rate, so a monthly cap alone lets a runaway loop erase the
    * whole month before anyone notices. The daily figure is what turns that into
    * a floor on how fast the month can be spent. `null` on metered tiers, which
    * are billed rather than stopped.
@@ -214,8 +242,8 @@ export const PLANS = z
       label: 'Free',
       summary: 'Build against the real engine without a card.',
       monthlyMinimumUsd: 0,
-      hardCapOps: 1_000_000,
-      hardCapOpsPerDay: 100_000,
+      hardCapOps: 100_000,
+      hardCapOpsPerDay: 10_000,
       storageGib: 1,
       maxConcurrentConnections: 25,
       contractPriced: false,
@@ -225,7 +253,7 @@ export const PLANS = z
       tier: 'scale',
       label: 'Scale',
       summary: 'Production traffic, metered above a monthly floor.',
-      monthlyMinimumUsd: 99,
+      monthlyMinimumUsd: 20,
       hardCapOps: null,
       hardCapOpsPerDay: null,
       storageGib: 50,

package/src/resources/httpResources.ts

@@ -276,7 +276,6 @@ export interface ModelMutationOptions extends ClaimedOptions {
   readonly idempotencyKey?: string | null;
   readonly readAt?: number | null;
   readonly onStale?: OnStaleMode | null;
-  readonly wait?: CommitWait;
   readonly claim?: Claim | ClaimOptions | null;
   /** Fencing token (Option B) from the claim; server-validated at commit. */
   readonly fenceToken?: number | null;

package/src/resources/modelOperations.ts

@@ -558,15 +558,26 @@ export interface ModelRetrieveParams extends ServerRetrieveOptions {
   readonly id: string;
 }
 
+/**
+ * Options shared by schema model writes.
+ *
+ * Reactive clients apply the row change optimistically before returning from
+ * the call. The returned promise has one stable settlement contract across
+ * reactive and stateless clients: it resolves only after authoritative
+ * confirmation. Callers that need an earlier queued receipt use the lower-level
+ * `commits.create` resource instead.
+ */
+export type ModelWriteOptions = Omit<MutationOptions, 'wait'>;
+
 export interface ModelCreateParams<T, CreateInput>
-  extends MutationOptions {
+  extends ModelWriteOptions {
   readonly data: CreateInput;
   readonly id?: string | null;
   readonly claim?: Claim<T> | ClaimTargetOptions<CreateInput> | null;
 }
 
 export interface ModelUpdateParams<T, Fields = T>
-  extends MutationOptions {
+  extends ModelWriteOptions {
   readonly id: string;
   /**
    * Patch only fields declared by the model's Zod input shape. Hydrated rows
@@ -578,7 +589,7 @@ export interface ModelUpdateParams<T, Fields = T>
 }
 
 export interface ModelDeleteParams<T, Fields = T>
-  extends MutationOptions {
+  extends ModelWriteOptions {
   readonly id: string;
   readonly claim?: Claim<T> | ClaimTargetOptions<Fields> | null;
 }

package/src/source/migrations.ts

@@ -22,15 +22,28 @@ import type { Migration } from './contract.js';
  * block resolves the ledger through the search path and runs the `ALTER` only
  * when the column is absent — a true no-op on a table that already has it.
  */
-function addColumnIfAbsent(column: string, definition: string): string {
+function quoteIdent(value: string): string {
+  return `"${value.replace(/"/g, '""')}"`;
+}
+
+function quoteLiteral(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+function qualified(schema: string, relation: string): string {
+  return `${quoteIdent(schema)}.${quoteIdent(relation)}`;
+}
+
+function addColumnIfAbsent(schema: string, column: string, definition: string): string {
+  const ledger = qualified(schema, 'ablo_idempotency');
   return `DO $$
-DECLARE ledger regclass := to_regclass('ablo_idempotency');
+DECLARE ledger regclass := to_regclass(${quoteLiteral(ledger)});
 BEGIN
   IF ledger IS NOT NULL AND NOT EXISTS (
     SELECT 1 FROM pg_attribute
     WHERE attrelid = ledger AND attname = '${column}' AND attnum > 0 AND NOT attisdropped
   ) THEN
-    ALTER TABLE ablo_idempotency ADD COLUMN ${column} ${definition};
+    ALTER TABLE ${ledger} ADD COLUMN ${quoteIdent(column)} ${definition};
   END IF;
 END $$;`;
 }
@@ -39,11 +52,12 @@ END $$;`;
  *  rows carry a bounded `expires_at` (set by the adapter at write time) so the
  *  customer can prune them; the `infinity` column default is only a fallback for
  *  a row inserted without one. */
-export function idempotencyLedgerMigrations(): readonly Migration[] {
+export function idempotencyLedgerMigrations(schema = 'public'): readonly Migration[] {
+  const ledger = qualified(schema, 'ablo_idempotency');
   return [
     {
       name: 'ablo_idempotency',
-      up: `CREATE TABLE IF NOT EXISTS ablo_idempotency (
+      up: `CREATE TABLE IF NOT EXISTS ${ledger} (
   client_tx_id TEXT PRIMARY KEY,
   response     JSONB NOT NULL,
   request_hash TEXT,
@@ -64,11 +78,11 @@ export function idempotencyLedgerMigrations(): readonly Migration[] {
       // setup — owned by another role — the no-op still errors "must be owner".
       // Guard on the catalog (readable regardless of ownership) so the ALTER
       // runs only when the column is genuinely absent, keeping re-runs safe.
-      up: addColumnIfAbsent('request_hash', 'TEXT'),
+      up: addColumnIfAbsent(schema, 'request_hash', 'TEXT'),
     },
     {
       name: 'ablo_idempotency_permanent_retention',
-      up: addColumnIfAbsent('expires_at', `TIMESTAMPTZ NOT NULL DEFAULT 'infinity'`),
+      up: addColumnIfAbsent(schema, 'expires_at', `TIMESTAMPTZ NOT NULL DEFAULT 'infinity'`),
     },
   ];
 }

package/src/transport/httpTransport.ts

@@ -1433,7 +1433,6 @@ export function createHttpTransport(options: HttpTransportOptions): HttpTranspor
         idempotencyKey: options.idempotencyKey,
         readAt: options.readAt,
         onStale: options.onStale,
-        wait: options.wait,
         claim: options.claim,
       },
       `${modelName} ${action}`
@@ -1476,7 +1475,10 @@ export function createHttpTransport(options: HttpTransportOptions): HttpTranspor
           method,
           idempotencyKey: clientTxId,
           body: requestBody,
-          wait: options?.wait ?? 'confirmed',
+          // Model methods have one promise contract: authoritative
+          // confirmation. Early queued receipts remain available through the
+          // lower-level `commits.create` lifecycle surface.
+          wait: 'confirmed',
         },
         beforeSettlement
       );
@@ -1837,7 +1839,6 @@ export function createHttpTransport(options: HttpTransportOptions): HttpTranspor
             mutateModel('update', name, id, patch, {
               readAt,
               onStale: 'reject',
-              wait: 'confirmed',
             }),
         });
       }
@@ -1879,13 +1880,7 @@ export function createHttpTransport(options: HttpTransportOptions): HttpTranspor
             name,
             id,
             params.data,
-            {
-              ...options,
-              // This method returns the authoritative row, not a receipt. A
-              // queued source acceptance cannot satisfy that return contract,
-              // even when the caller supplied `wait: 'queued'`.
-              wait: 'confirmed',
-            },
+            options,
             async () => {
               const read = await retrieveModel<T>(name, { id });
               if (read.data === undefined) {

package/src/transport/wsTransport.ts

@@ -70,6 +70,7 @@ import {
   noopSocketObservability,
   type SocketObservability,
 } from '../observability.js';
+import type { DeliveryPartitionRoute } from '../auth/deliveryPartition.js';
 
 /**
  * Ceiling for the exponential reconnect backoff (`reconnectDelay * 2^n`,
@@ -95,6 +96,11 @@ export interface WsTransportOptions {
    */
   userId?: string;
   organizationId?: string;
+  /**
+   * Opaque server-resolved delivery route. The transport echoes it on every
+   * WebSocket upgrade; the receiving gateway authenticates and verifies it.
+   */
+  deliveryPartition?: DeliveryPartitionRoute | null;
   lastSyncId?: number;
   syncGroups?: string[];
   capabilities?: SyncCapabilities;
@@ -450,6 +456,7 @@ export class WsTransport<
       lastSyncId: 0,
       userId: '',
       organizationId: '',
+      deliveryPartition: null,
       capabilities: {
         partialBootstrap: true,
         compressedDeltas: true,
@@ -672,6 +679,12 @@ export class WsTransport<
     this.options.syncGroups.forEach((group) => {
       params.append('syncGroups', group);
     });
+    if (this.options.deliveryPartition) {
+      params.set(
+        'deliveryPartition',
+        `${this.options.deliveryPartition.index}-${this.options.deliveryPartition.count}`,
+      );
+    }
 
     const wsUrl = `${this.options.url}?${params.toString()}`;
 
@@ -1488,4 +1501,9 @@ export class WsTransport<
   setSyncGroups(syncGroups: readonly string[]): void {
     this.options.syncGroups = [...syncGroups];
   }
+
+  /** Seeds the server-resolved route before the held first connection opens. */
+  setDeliveryPartition(deliveryPartition: DeliveryPartitionRoute | null): void {
+    this.options.deliveryPartition = deliveryPartition;
+  }
 }

package/src/wire/dataSourceResponses.ts

@@ -42,8 +42,10 @@ export const READINESS_ITEMS = [
   'wal_level',
   'publication',
   'replication_role',
+  'replication_slot_capacity',
   'replica_identity',
   'table_select',
+  'snapshot_row_security',
   'write_role',
   'row_security',
   'database_privileges',
@@ -153,6 +155,22 @@ export const datasourceValidationResponseSchema = z.object({
 });
 export type DatasourceValidationResponse = z.infer<typeof datasourceValidationResponseSchema>;
 
+/** `POST /v1/datasources/resnapshot` — accepted reset of the direct source's
+ * initial load. The replacement snapshot completes asynchronously. */
+export const datasourceResnapshotResponseSchema = z.object({
+  object: z.literal('datasource_resnapshot'),
+  initial_snapshot: z.object({ status: z.literal('loading') }),
+  replication_slot: z
+    .object({
+      slot: z.string(),
+      released: z.boolean(),
+      detail: z.string().optional(),
+      remove_with: z.string().optional(),
+    })
+    .optional(),
+});
+export type DatasourceResnapshotResponse = z.infer<typeof datasourceResnapshotResponseSchema>;
+
 /**
  * `POST /v1/datasources/locate` — which plane already holds a database.
  * A targeted lookup, not an enumeration: the caller must hold the connection
@@ -161,6 +179,8 @@ export type DatasourceValidationResponse = z.infer<typeof datasourceValidationRe
  */
 export const datasourceLocationResponseSchema = z.object({
   object: z.literal('datasource_location').optional(),
+  /** False with held=null means another organization owns the binding. */
+  available: z.boolean().optional(),
   held: z
     .object({
       project: z.string().nullable(),

package/src/wire/index.ts

@@ -315,6 +315,7 @@ export {
   datasourceListResponseSchema,
   datasourceValidationResponseSchema,
   datasourceLocationResponseSchema,
+  datasourceResnapshotResponseSchema,
   datasourceDisconnectedResponseSchema,
 } from './dataSourceResponses.js';
 export type {
@@ -326,6 +327,7 @@ export type {
   DatasourceListResponse,
   DatasourceValidationResponse,
   DatasourceLocationResponse,
+  DatasourceResnapshotResponse,
   DatasourceDisconnectedResponse,
 } from './dataSourceResponses.js';