@abloatai/transaction 0.46.0 → 0.48.0

package/dist/wire/index.js

@@ -78,7 +78,7 @@ export { projectResponseSchema, projectListResponseSchema, provisionedKeySchema,
 // The datasource routes' responses — the `ablo connect` surface: register,
 // validate, locate, list, deregister. What the server, the CLI, and the
 // dashboard agree on.
-export { READINESS_ITEMS, READINESS_ADVISORY_ITEMS, isReadinessItem, readinessFailureSchema, readinessAdvisorySchema, datasourceSummarySchema, datasourceListResponseSchema, datasourceValidationResponseSchema, datasourceLocationResponseSchema, datasourceDisconnectedResponseSchema, } from './dataSourceResponses.js';
+export { READINESS_ITEMS, READINESS_ADVISORY_ITEMS, isReadinessItem, readinessFailureSchema, readinessAdvisorySchema, datasourceSummarySchema, datasourceListResponseSchema, datasourceValidationResponseSchema, datasourceLocationResponseSchema, datasourceResnapshotResponseSchema, datasourceDisconnectedResponseSchema, } from './dataSourceResponses.js';
 // The inbound socket surface: every frame the server can send, and how each
 // one's payload is validated.
 export { WS_INBOUND_FRAMES, wsInboundEnvelopeSchema, isKnownInboundFrame, isSchemaValidatedFrame, } from './inboundFrames.js';

package/dist/wire/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/wire/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGrE,8EAA8E;AAC9E,8BAA8B;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,cAAc;AACd,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAY9B,6EAA6E;AAC7E,8EAA8E;AAC9E,gDAAgD;AAChD,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,eAAe,EACf,0BAA0B;AAC1B,8EAA8E;AAC9E,oEAAoE;AACpE,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAiBrB,kFAAkF;AAClF,0EAA0E;AAC1E,kFAAkF;AAClF,wDAAwD;AACxD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACZ,MAAM,YAAY,CAAC;AAapB,6EAA6E;AAC7E,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,sBAAsB;AACtB,4EAA4E;AAC5E,4EAA4E;AAC5E,0CAA0C;AAC1C,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,wDAAwD;AACxD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO;AACL,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAmBrB,yEAAyE;AACzE,yDAAyD;AACzD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAQzB,6EAA6E;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGjE,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAqB/B,2EAA2E;AAC3E,wEAAwE;AACxE,sBAAsB;AACtB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,kCAAkC,EAClC,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAalC,4EAA4E;AAC5E,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAS5B,+EAA+E;AAC/E,qDAAqD;AACrD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/wire/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGrE,8EAA8E;AAC9E,8BAA8B;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,cAAc;AACd,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,8BAA8B,EAC9B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAY9B,6EAA6E;AAC7E,8EAA8E;AAC9E,gDAAgD;AAChD,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,eAAe,EACf,0BAA0B;AAC1B,8EAA8E;AAC9E,oEAAoE;AACpE,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAiBrB,kFAAkF;AAClF,0EAA0E;AAC1E,kFAAkF;AAClF,wDAAwD;AACxD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACZ,MAAM,YAAY,CAAC;AAapB,6EAA6E;AAC7E,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,sBAAsB;AACtB,4EAA4E;AAC5E,4EAA4E;AAC5E,0CAA0C;AAC1C,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,wDAAwD;AACxD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO;AACL,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAmBrB,yEAAyE;AACzE,yDAAyD;AACzD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,gFAAgF;AAChF,wEAAwE;AACxE,OAAO,EACL,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAQzB,6EAA6E;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGjE,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAqB/B,2EAA2E;AAC3E,wEAAwE;AACxE,sBAAsB;AACtB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,kCAAkC,EAClC,gCAAgC,EAChC,kCAAkC,EAClC,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAclC,4EAA4E;AAC5E,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAS5B,+EAA+E;AAC/E,qDAAqD;AACrD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,WAAW,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/transaction",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "description": "The headless Ablo transaction client and canonical contracts for reads, commits, settlement, claims, and durable observation.",
   "license": "Apache-2.0",
   "type": "module",

package/src/ai-sdk/modelTools.ts

@@ -100,7 +100,6 @@ export function createTool<TInput, T, CreateInput>(
       const row = await model.create({
         data: options.data(input),
         ...(id !== undefined ? { id } : {}),
-        wait: 'confirmed',
       });
       return { status: 'created', row };
     },
@@ -156,7 +155,7 @@ export function deleteTool<TInput, T, Fields = T>(
         };
       }
       try {
-        await model.delete({ id, claim, wait: 'confirmed' });
+        await model.delete({ id, claim });
         return { status: 'deleted', id };
       } finally {
         await claim.release();

package/src/ai-sdk/updateTool.ts

@@ -184,7 +184,6 @@ export function updateTool<
             id,
             data: options.apply(current, input),
             claim,
-            wait: 'confirmed',
           });
           return { status: 'written', row };
         } finally {

package/src/auth/capability.ts

@@ -27,6 +27,7 @@ import { z } from 'zod';
 import { participantKindSchema } from '../coordination/schema.js';
 import { syncGroupInputSchema } from '../schema/roles.js';
 import { authTokenSchema } from './token.js';
+import { deliveryPartitionRouteSchema } from './deliveryPartition.js';
 
 /**
  * The verbs a grant can name — the whole vocabulary, in one place. Every other
@@ -253,6 +254,7 @@ export const capabilityScopeSchema = z.object({
   operations: z.array(grantedOperationSchema),
   participantKind: participantKindSchema,
   participantId: z.string().min(1),
+  deliveryPartition: deliveryPartitionRouteSchema.nullable().default(null),
 });
 export type CapabilityScope = z.infer<typeof capabilityScopeSchema>;
 

package/src/auth/deliveryPartition.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+
+/**
+ * Opaque gateway-routing coordinate resolved by the server.
+ *
+ * Clients echo this on the WebSocket upgrade; gateways still authenticate the
+ * credential and recompute ownership, so it is routing metadata rather than an
+ * authorization claim.
+ */
+export const deliveryPartitionRouteSchema = z.object({
+  index: z.number().int().nonnegative(),
+  count: z.number().int().min(2),
+}).refine((route) => route.index < route.count, {
+  message: 'delivery partition index must be less than count',
+  path: ['index'],
+});
+
+export type DeliveryPartitionRoute = z.infer<typeof deliveryPartitionRouteSchema>;

package/src/auth/identity.ts

@@ -33,6 +33,7 @@ import type { Logger } from '../logger.js';
 import type { AuthCredentialSource } from '../auth/credentialSource.js';
 import type { CredentialProvider } from './credentialResult.js';
 import { resolveApiKeyValue, resolveBootstrapBaseUrl } from './apiKey.js';
+import type { DeliveryPartitionRoute } from './deliveryPartition.js';
 
 export interface IdentityResolveInput {
   readonly options: {
@@ -69,6 +70,7 @@ export interface ResolvedIdentity {
   readonly capabilityToken: string | undefined;
   readonly syncGroups: readonly string[] | undefined;
   readonly participantKind: ParticipantKind;
+  readonly deliveryPartition: DeliveryPartitionRoute | null;
   /** Set only on the hosted-cloud path; the caller keeps it to stop refreshes on shutdown. */
   readonly refreshScheduler: RefreshScheduler | null;
 }
@@ -192,6 +194,7 @@ export async function resolveParticipantIdentity(
         capabilityToken: cred.getBearer,
         syncGroups: options.syncGroups,
         participantKind: kind,
+        deliveryPartition: null,
         refreshScheduler: null,
       };
     }
@@ -242,6 +245,7 @@ async function resolveViaIdentity(
     capabilityToken: bearer,
     syncGroups: mergedSyncGroups,
     participantKind: identity.participantKind,
+    deliveryPartition: identity.deliveryPartition,
     refreshScheduler: null,
   };
 }
@@ -325,6 +329,7 @@ async function resolveHosted(input: HostedInput): Promise<ResolvedIdentity> {
     capabilityToken: exchange.token,
     syncGroups: exchange.scope.syncGroups,
     participantKind: input.kind,
+    deliveryPartition: exchange.scope.deliveryPartition,
     refreshScheduler,
   };
 }

package/src/auth/schemas.ts

@@ -7,6 +7,7 @@ import {
 } from './capability.js';
 import { AbloAuthenticationError } from '../errors.js';
 import { authTokenSchema } from './token.js';
+import { deliveryPartitionRouteSchema } from './deliveryPartition.js';
 
 // Not a second enum. The auth responses carry the same participant vocabulary
 // the coordination plane parses, so they validate against the same schema — a
@@ -24,6 +25,7 @@ export const IdentityResolveResponseSchema = z.object({
   branchId: z.string().min(1).nullable().default(null),
   branchRoot: z.boolean().default(false),
   syncGroups: z.array(z.string()),
+  deliveryPartition: deliveryPartitionRouteSchema.nullable().default(null),
   userMeta: z.record(z.string(), z.unknown()),
 });
 
@@ -46,6 +48,7 @@ export const EphemeralKeyResponseSchema = z.object({
   branchId: z.string().min(1).nullable().default(null),
   branchRoot: z.boolean().default(false),
   syncGroups: z.array(z.string()),
+  deliveryPartition: deliveryPartitionRouteSchema.nullable().default(null),
   /** Effective operation grant stored on the credential. Empty ONLY for a
    *  control-plane-only session, which grants no data operations by design. */
   operations: z.array(grantedOperationSchema),

package/src/auth/sessionMint.ts

@@ -98,6 +98,7 @@ export async function mintSession<S extends SchemaRecord>(
         operations: res.operations,
         participantKind: 'user',
         participantId: res.participantId,
+        deliveryPartition: res.deliveryPartition,
       },
       userMeta: params.userMeta ?? { id: res.participantId },
     };

package/src/branches.ts

@@ -87,6 +87,28 @@ export const branchParentCompatibilitySchema = z.enum([
 ]);
 export type BranchParentCompatibility = z.infer<typeof branchParentCompatibilitySchema>;
 
+/**
+ * The one ownership/storage vocabulary for durable branch data.
+ * Missing configuration is explicit (`unbound`), never inferred as hosted.
+ */
+export const branchStorageSchema = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('unbound') }).strict(),
+  z.object({
+    kind: z.literal('customer'),
+    transport: z.enum(['direct', 'endpoint']),
+    status: z.enum(['unverified', 'active', 'rejected']),
+  }).strict(),
+  z.object({
+    kind: z.literal('internal'),
+    implementation: z.enum(['log', 'tables']),
+  }).strict(),
+  z.object({
+    kind: z.literal('blocked'),
+    reason: z.literal('orphaned_external_marker'),
+  }).strict(),
+]);
+export type BranchStorage = z.infer<typeof branchStorageSchema>;
+
 export const branchStatusSchemaSummarySchema = z
   .object({
     active: z.boolean(),
@@ -101,8 +123,8 @@ export const branchStatusSchemaSummarySchema = z
 
 export const branchStatusDataSourceSchema = z
   .object({
-    kind: z.enum(['hosted', 'direct', 'endpoint']),
-    status: z.enum(['unverified', 'active', 'rejected']).nullable(),
+    connection: z.enum(['direct', 'endpoint']),
+    status: z.enum(['unverified', 'active', 'rejected']),
     host: z.string().nullable(),
     database: z.string().nullable(),
     cursor: z.string().nullable(),
@@ -111,7 +133,8 @@ export const branchStatusDataSourceSchema = z
     last_success_at: z.string().nullable(),
     last_error: z.string().nullable(),
   })
-  .strict();
+  .strict()
+  .nullable();
 
 export const branchStatusBlockerSchema = z
   .object({
@@ -127,6 +150,7 @@ export const branchStatusResponseSchema = z
     branch: branchResponseSchema,
     ready: z.boolean(),
     schema: branchStatusSchemaSummarySchema,
+    storage: branchStorageSchema,
     data_source: branchStatusDataSourceSchema,
     blockers: z.array(branchStatusBlockerSchema).readonly(),
   })

package/src/errorCodes.ts

@@ -39,7 +39,7 @@ import { z } from 'zod';
  * error documentation and returned on the `Ablo-Version` response header, so a
  * consumer can detect when its expected contract has drifted from the server's.
  */
-export const ERROR_CONTRACT_VERSION = '2026-07-23';
+export const ERROR_CONTRACT_VERSION = '2026-08-03';
 
 /** A coarse grouping of error codes, used to organize metrics and documentation. */
 export type ErrorCategory =
@@ -319,6 +319,18 @@ export const ERROR_CODES = {
     false,
     'This deployment does not accept direct connection-string data sources. Register a signed Data Source endpoint instead.'
   ),
+  source_connector_localhost_required: wire(
+    'validation',
+    400,
+    false,
+    'A connector-only development Data Source must use a localhost descriptor. Use `ablo dev --local`; use the ordinary signed HTTPS endpoint registration for a deployed handler.'
+  ),
+  source_connector_unauthenticated: wire(
+    'auth',
+    401,
+    false,
+    'The localhost Data Source connector could not authenticate. Rerun `ablo dev --local` so it mints and uses a fresh branch-bound secret key.'
+  ),
 
   // ── permission / capability (403) ──────────────────────────────────
   capability_scope_denied: wire(
@@ -339,12 +351,6 @@ export const ERROR_CODES = {
     false,
     'This capability cannot be used — it is unknown, revoked, or expired. Request a fresh grant.'
   ),
-  test_database_not_registered: wire(
-    'permission',
-    403,
-    false,
-    'Test mode requires a registered dev database for this org — run `npx ablo init` to register one for your test key.'
-  ),
   tenant_routing_failed: wire(
     'server',
     500,
@@ -373,7 +379,7 @@ export const ERROR_CODES = {
     'permission',
     403,
     false,
-    "The database host resolves to a private, loopback, or link-local address, which Ablo's servers will not connect to. Use a publicly resolvable host."
+    "The database host resolves to a private, loopback, or link-local address, which Ablo's servers will not connect to directly. Use a publicly resolvable direct endpoint, private networking, or `ablo dev --local` with a signed Data Source reverse channel."
   ),
   connected_database_unreachable: wire(
     'tenant',
@@ -699,6 +705,18 @@ export const ERROR_CODES = {
     false,
     'The participant is not allowed to execute this mutator.'
   ),
+  source_connector_requires_secret_key: wire(
+    'permission',
+    403,
+    false,
+    'A Data Source reverse channel must authenticate with the branch-bound secret (`sk_`) key created by `ablo dev`; browser, ephemeral, restricted, and management keys cannot serve a database.'
+  ),
+  source_connector_production_not_enabled: wire(
+    'permission',
+    403,
+    false,
+    'This production Data Source has not opted into reverse-channel transport. `ablo dev --local` is for child branches; use a direct production endpoint or explicitly enable the supported production reverse-channel route.'
+  ),
 
   // ── not found (404) ────────────────────────────────────────────────
   entity_not_found: wire(
@@ -723,7 +741,13 @@ export const ERROR_CODES = {
     'not_found',
     404,
     false,
-    'No database is connected to this plane yet, so there is nothing to check. Connect one with `ablo connect apply`, then run the check again.'
+    'This branch is not connected to your database yet. Run `ablo connect` for a cloud-reachable direct Postgres endpoint, or `ablo dev --local` to register and serve a localhost Data Source, then retry.'
+  ),
+  source_connector_no_source_registered: wire(
+    'not_found',
+    404,
+    false,
+    'The branch has no endpoint Data Source for this connector to serve. Run `ablo dev --local` with the current CLI, which registers the connector-only source before opening the socket.'
   ),
   task_id_missing: wire(
     'server',
@@ -978,7 +1002,55 @@ export const ERROR_CODES = {
     'transport',
     503,
     true,
-    'A network error occurred while talking to the data source. Check connectivity and retry.'
+    'A network error occurred while talking to the data source. For localhost mode, keep `ablo dev --local` running and check its connector output; for a direct source, check database connectivity and retry.'
+  ),
+  source_request_failed: wire(
+    'transport',
+    502,
+    true,
+    'The signed Data Source returned a failure without a more specific code. Inspect the `ablo dev --local` process or deployed endpoint logs, then retry with the same idempotency key.'
+  ),
+  source_connector_not_attached: wire(
+    'transport',
+    503,
+    true,
+    'This branch uses localhost connector-only storage, but no connector is attached. Start or restart `ablo dev --local` and keep that process running.'
+  ),
+  source_connector_timeout: wire(
+    'transport',
+    504,
+    true,
+    'The local Data Source handler did not answer before the connector deadline. Check the local Postgres connection and handler logs; the same idempotent request may be retried.'
+  ),
+  source_connector_send_failed: wire(
+    'transport',
+    502,
+    true,
+    'The connector socket closed while Ablo was forwarding a signed Data Source request. Keep `ablo dev --local` running; Ablo retries after the connector reconnects.'
+  ),
+  source_connector_disconnected: wire(
+    'transport',
+    503,
+    true,
+    'The localhost Data Source connector disconnected with a request in flight. The connector reconnects automatically; retry after it reports ready.'
+  ),
+  source_connector_superseded: wire(
+    'transport',
+    503,
+    true,
+    'A newer localhost Data Source connector replaced this one. Stop duplicate `ablo dev --local` processes and use the newest process; in-flight requests are safe to retry.'
+  ),
+  source_connector_shutdown: wire(
+    'transport',
+    503,
+    true,
+    'The Ablo service shut down the connector while a request was in flight. The connector reconnects automatically after the service returns.'
+  ),
+  source_connector_protocol_error: wire(
+    'transport',
+    400,
+    false,
+    'The CLI and Ablo service disagreed on the Data Source connector frame protocol, or a malformed frame arrived. Upgrade the Ablo CLI and SDK together, then restart `ablo dev --local`.'
   ),
   source_unreachable: wire(
     'transport',
@@ -990,7 +1062,19 @@ export const ERROR_CODES = {
     'transport',
     503,
     false,
-    "The plane's data source is not in a verified, resolvable state. Fix its registration, secret, or configuration; Ablo will not fall through to hosted storage."
+    "This branch's database connection is not ready. Check its credentials and configuration; Ablo will not send reads or writes anywhere else."
+  ),
+  source_connector_handler_error: wire(
+    'server',
+    500,
+    true,
+    'The local signed Data Source handler threw while processing a request. Read the `ablo dev --local` error immediately above it, fix the database or adapter failure, and retry.'
+  ),
+  source_connector_internal_error: wire(
+    'server',
+    500,
+    true,
+    'Ablo could not establish the Data Source reverse channel because of an internal service failure. Retry; if it persists, report the request id.'
   ),
   identity_network_error: wire(
     'transport',
@@ -1046,6 +1130,12 @@ export const ERROR_CODES = {
     true,
     'The server is at connection capacity. Retry shortly — transient and not specific to your credentials.'
   ),
+  delivery_partition_mismatch: wire(
+    'transport',
+    503,
+    true,
+    'The connection reached a gateway that does not own its delivery partition. Retry through the cell router.'
+  ),
   fetch_unavailable: client(
     'transport',
     'This environment provides no `fetch` implementation, so HTTP requests cannot be made. Run on a platform with `fetch` (Node 18+, modern browsers) or supply a polyfill.'
@@ -1134,7 +1224,7 @@ export const ERROR_CODES = {
   ),
   db_identity_mismatch: client(
     'client',
-    'The local database belongs to a different authenticated identity or data plane.'
+    'The local database is connected to a different organization, project, or branch.'
   ),
   db_cleanup_failed: client(
     'client',
@@ -1240,6 +1330,12 @@ export const ERROR_CODES = {
     false,
     "The request targeted a project the caller's key is not scoped to."
   ),
+  branch_scope_denied: wire(
+    'permission',
+    403,
+    false,
+    "The request targeted a branch the caller's key is not scoped to."
+  ),
   project_slug_taken: wire(
     'validation',
     409,
@@ -1294,19 +1390,19 @@ export const ERROR_CODES = {
     'tenant',
     400,
     false,
-    "This model is scoped by its connected data source (`policy: { by: 'source' }`), so its tenant is resolved from the source registration rather than a row column. Enforcing that resolution requires the write-through connect path, which is not enabled on this plane yet — so the model cannot be served through the tenant-scoped read or bootstrap path without risking a cross-tenant read. If this model lives on a log plane, scope it with `by: 'column'` or `by: 'parent'` instead."
+    "This model gets its tenant identity from the connected Data Source, but that connection is not ready for scoped reads yet. Ablo refused the read to prevent data from crossing tenant boundaries. Connect the branch and retry; for internally logged models, use `by: 'column'` or `by: 'parent'`."
   ),
   user_scope_not_enforced: wire(
     'tenant',
     400,
     false,
-    "Rows in this model belong to one person rather than to the whole organization, and that boundary is kept where the rows are stored. This plane is currently served from its log, which carries the organization and the project on every row but not the owner — so the boundary cannot be applied here, and serving the read would show one member another member's private records. It was declined whole and nothing was returned. Serve the plane from its tables, or read with a credential that acts for the organization rather than for a person."
+    "Rows in this model belong to one person rather than the whole organization, but the current read source does not carry the owner identity needed to enforce that boundary. Ablo returned nothing to prevent one member from seeing another member's private records. Use a read source that preserves owner identity, or a credential that acts for the organization."
   ),
   model_not_provisioned: wire(
     'tenant',
     409,
     false,
-    "This model is in the plane's registered schema, but its table has not been provisioned yet. Registering a schema with `ablo push` records the model; a plane's physical tables are created separately, out of band, so a model can appear in the schema before its table exists. Provision the plane's tables, then retry the read."
+    "This model is in the branch's registered schema, but its table does not exist in the connected database yet. `ablo push` records the model but does not change a customer's database. Apply the table migration in your database, then retry the read."
   ),
   schema_table_invalid: wire('schema', 500, false, "The model's table identifier is invalid."),
   schema_scope_invalid: wire(
@@ -1480,7 +1576,7 @@ export const ERROR_CODES = {
     'not_found',
     404,
     false,
-    'No claim of yours exists with the given id. It was released, it expired, or it was never acquired on this plane.'
+    'No claim of yours exists with the given id. It was released, expired, or belongs to a different branch.'
   ),
   invalid_participant_kind: wire(
     'validation',
@@ -1547,7 +1643,7 @@ export const ERROR_CODES = {
     'conflict',
     409,
     false,
-    'A connected log plane has live rows for a mapped model that disappeared. Declare a rename or an explicit drop/reset before advancing the schema.'
+    'This branch has live replicated rows for a mapped model that disappeared. Declare a rename or an explicit drop/reset before advancing the schema.'
   ),
 } as const satisfies Record<string, ErrorCodeSpec>;
 

package/src/footprint.ts

@@ -51,25 +51,14 @@ export interface FootprintArtifact {
 
 // ── The names, for the code that creates and reads these objects ────────────
 
-/**
- * The publication Ablo's replication reads from. Constant by design: a
- * publication declares what streams, and several readers are meant to share one
- * (`publication_names` is a per-stream option, not slot state).
- */
+/** Prefix used to derive a branch-scoped publication name. The exact unsuffixed
+ * name is retained only so `ablo connect scan` can identify an old installation. */
 export const ABLO_PUBLICATION = 'ablo_publication';
-/**
- * The replication slot that holds Ablo's position in the write-ahead log.
- *
- * Constant, and it should not be — a slot stores ONE position, so two
- * connections sharing this name compete for the same marker. It is why a
- * database can be connected to one plane at a time. ADR 0020 derives it per
- * connection; {@link isValidReplicationSlotName} is the check a derived name
- * has to pass.
- */
+/** Prefix used to derive the branch-scoped replication slot. */
 export const ABLO_REPLICATION_SLOT = 'ablo_slot';
-/** The least-privilege login Ablo reads with. Per-connection under ADR 0020. */
+/** Prefix used to derive the branch-scoped least-privilege replication login. */
 export const ABLO_REPLICATION_ROLE = 'ablo_replicator';
-/** The separate least-privilege login used only for row writes. */
+/** Prefix used to derive the branch-scoped login used only for row writes. */
 export const ABLO_WRITE_ROLE = 'ablo_writer';
 /** The bookkeeping table that makes a retried write land once. */
 export const ABLO_IDEMPOTENCY_TABLE = 'ablo_idempotency';
@@ -90,15 +79,15 @@ export function isValidReplicationSlotName(name: string): boolean {
 
 // ── Per-connection names (ADR 0020) ─────────────────────────────────────────
 
-/** The immutable branch coordinates a connection is identified by. */
-export interface FootprintPlane {
+/** The immutable branch coordinates that identify one customer Data Source. */
+export interface DataSourceIdentity {
   readonly organizationId: string;
   readonly branchId: string;
   /** Omitted for the organization-default project. */
   readonly projectId?: string;
 }
 
-/** The names one connection owns. Nothing here is shared with another plane. */
+/** The names one connection owns. Nothing here is shared with another Data Source. */
 export interface FootprintNames {
   readonly slot: string;
   readonly publication: string;
@@ -114,7 +103,7 @@ export interface FootprintNames {
 const SUFFIX_LENGTH = 16;
 
 /**
- * FNV-1a over the plane, in hex.
+ * FNV-1a over the Data Source identity, in hex.
  *
  * Deliberately not a cryptographic hash: this module is imported by the CLI,
  * which runs in environments without `node:crypto` guaranteed, and the property
@@ -123,11 +112,14 @@ const SUFFIX_LENGTH = 16;
  * over different seeds give the sixteen hex characters, which is ample for the
  * handful of planes any one database is ever connected to.
  */
-function planeDigest(plane: FootprintPlane): string {
+function dataSourceDigest(identity: DataSourceIdentity): string {
   // The organization-default project may be omitted or repeated as the
   // organization id; both spell the same branch coordinates.
-  const project = plane.projectId === plane.organizationId ? '' : (plane.projectId ?? '');
-  const key = [plane.organizationId, project, plane.branchId].join('');
+  const project =
+    identity.projectId === identity.organizationId ? '' : (identity.projectId ?? '');
+  // Delimit the coordinates. Concatenation alone makes structurally different
+  // planes such as ("ab", "c") and ("a", "bc") hash the same input.
+  const key = [identity.organizationId, project, identity.branchId].join('\0');
 
   const round = (seed: number): string => {
     let hash = seed;
@@ -146,16 +138,15 @@ function planeDigest(plane: FootprintPlane): string {
  * The objects this connection owns, named so no other connection can claim them.
  *
  * A slot stores ONE position, so two connections sharing a name compete for the
- * same marker and Postgres reports nothing — which is why the constants these
- * replace made a database connectable to one plane at a time. The publication
+ * same marker and Postgres reports nothing. The publication
  * and roles are derived from the same digest so a database's footprint reads as
  * one set per connection rather than a mix of shared and private objects.
  *
  * Stable: the same plane always derives the same names, so re-running setup is a
  * no-op rather than a second installation.
  */
-export function footprintNamesFor(plane: FootprintPlane): FootprintNames {
-  const suffix = planeDigest(plane);
+export function footprintNamesFor(identity: DataSourceIdentity): FootprintNames {
+  const suffix = dataSourceDigest(identity);
   const names: FootprintNames = {
     slot: `${ABLO_REPLICATION_SLOT}_${suffix}`,
     publication: `${ABLO_PUBLICATION}_${suffix}`,

package/src/pricing.ts

@@ -23,7 +23,7 @@
  *     rather than billed.
  *
  * The allowance a tier advertises is DERIVED, never stored: "the floor covers
- * 49.5M operations" is {@link opsForUsd} applied to the floor. Storing it
+ * 10M operations" is {@link opsForUsd} applied to the floor. Storing it
  * alongside the floor is how a published price silently stops matching the
  * invoice, because raising one number does not fail anything that pins the
  * other.
@@ -47,7 +47,7 @@ export type { MeterEvent, PlanTier, RateBracket };
  * could observe the difference. It is emitted into the generated pricing
  * documentation so a stale copy is identifiable on sight.
  */
-export const PRICING_VERSION = '2026-07-27';
+export const PRICING_VERSION = '2026-07-31';
 
 /**
  * Resolve a stored plan string (`stripe_subscription.plan`) to a tier.
@@ -82,12 +82,40 @@ export const METER_EVENT_AXIS: Record<MeterEvent, BillableAxis | null> = {
 
 /** How each meter reads on an invoice line and in the pricing table. */
 export const METER_EVENT_LABEL: Record<MeterEvent, string> = {
-  'api.commit_ops': 'commit operations',
+  'api.commit_ops': 'writes',
   'api.model_reads': 'model reads',
   'api.claim_creates': 'claim creates',
   'api.bootstraps': 'bootstraps',
 };
 
+/**
+ * What each meter counts, in the words a customer is quoted. It lives beside
+ * the label because a meter's name and its definition are one fact: a page that
+ * renamed the line without restating what it counts would be describing a
+ * different meter.
+ *
+ * These say **write**, never *commit*. A commit is the protocol's atomic batch
+ * and it belongs in the protocol reference; the surface a customer buys against
+ * is `create` / `update` / `delete`, which the front door calls writing. Pricing
+ * copy is read by people who have never opened the protocol reference, and a
+ * word they have not met cannot clarify what they are paying for.
+ *
+ * All three read as "someone did something", because they are one price and a
+ * reader who has to hold three different shapes in mind will assume there are
+ * three different charges. Each line then answers the question that particular
+ * meter provokes: whether batching is cheaper, whether cached reads count, and
+ * whether holding a claim costs more than taking one.
+ */
+export const METER_EVENT_COUNTS: Record<MeterEvent, string> = {
+  'api.commit_ops':
+    'One every time someone changes something. Adding, editing, and removing all count the same, and changing 500 things is 500 operations however they are sent.',
+  'api.model_reads':
+    'One every time someone reads something the engine answers. Reads a client already has locally never reach us and never count.',
+  'api.claim_creates':
+    'One every time someone takes ownership of a row so others wait their turn. Holding it and releasing it are free.',
+  'api.bootstraps': 'Recorded, never charged. Connecting a client is free.',
+};
+
 /** The meters a customer is charged for, in declaration order. */
 export const BILLABLE_METER_EVENTS: readonly MeterEvent[] = (
   meterEventSchema.options as readonly MeterEvent[]
@@ -185,8 +213,8 @@ export const planDefinitionSchema = z.object({
   hardCapOps: z.number().int().positive().nullable(),
   /**
    * A hard daily stop, which is a burst guard rather than an allowance. A month
-   * of operations is a comfortable month of building and about ten minutes of
-   * one agent at full rate, so a monthly cap alone lets a runaway loop erase the
+   * of operations is a comfortable month of building and about a minute of one
+   * agent at full rate, so a monthly cap alone lets a runaway loop erase the
    * whole month before anyone notices. The daily figure is what turns that into
    * a floor on how fast the month can be spent. `null` on metered tiers, which
    * are billed rather than stopped.
@@ -214,8 +242,8 @@ export const PLANS = z
       label: 'Free',
       summary: 'Build against the real engine without a card.',
       monthlyMinimumUsd: 0,
-      hardCapOps: 1_000_000,
-      hardCapOpsPerDay: 100_000,
+      hardCapOps: 100_000,
+      hardCapOpsPerDay: 10_000,
       storageGib: 1,
       maxConcurrentConnections: 25,
       contractPriced: false,
@@ -225,7 +253,7 @@ export const PLANS = z
       tier: 'scale',
       label: 'Scale',
       summary: 'Production traffic, metered above a monthly floor.',
-      monthlyMinimumUsd: 99,
+      monthlyMinimumUsd: 20,
       hardCapOps: null,
       hardCapOpsPerDay: null,
       storageGib: 50,