@abloatai/transaction 0.56.0 → 0.58.0

package/dist/transport/{httpTransport.d.ts → http/transport.d.ts}

@@ -5,11 +5,12 @@
  * facade in `httpClient.ts` is the application boundary; this module owns
  * transport envelopes, watermarks, replay, and route details.
  */
-import type { HttpClientConfig } from './httpOptions.js';
-import type { CommitResource, HttpClaimsResource, HttpTransportModel, HttpLogsResource, SessionResource } from '../resources/httpResources.js';
-import type { EffectiveAuthority } from '../auth/capability.js';
-import type { SchemaRecord } from '../schema/schema.js';
-import type { CoordinationObservability } from '../observability.js';
+import type { HttpClientConfig } from './options.js';
+import type { CommitResource, HttpClaimsResource, HttpTransportModel, HttpLogsResource, SessionResource } from '../../client/resources/httpResources.js';
+import type { EffectiveAuthority } from '../../auth/capability.js';
+import type { SchemaRecord } from '../../schema/schema.js';
+import type { CoordinationObservability } from '../../observability.js';
+import { type HttpReadOnChange } from './subscription.js';
 /** @internal Private options for the schema-agnostic HTTP protocol transport. */
 export type HttpTransportOptions = Omit<HttpClientConfig, 'schema'> & {
     readonly bootstrapBaseUrl?: string | undefined;
@@ -41,6 +42,8 @@ export interface HttpTransport {
     /** Drains scheduled commits and active requests. */
     dispose(): Promise<void>;
     purge(): Promise<void>;
+    /** @internal Live check used only by `context().onChange`. */
+    readonly onChange: HttpReadOnChange;
     readonly commits: CommitResource;
     /**
      * Claim-ticket operations keyed by `claimId` — the id a queued acquire
@@ -69,4 +72,4 @@ export interface HttpTransport {
 }
 /** @internal Constructed only by the typed HTTP facade. */
 export declare function createHttpTransport(options: HttpTransportOptions): HttpTransport;
-//# sourceMappingURL=httpTransport.d.ts.map
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport/http/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../src/transport/http/transport.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAKV,cAAc,EAGd,kBAAkB,EAClB,kBAAkB,EAMlB,gBAAgB,EAIhB,eAAe,EAChB,MAAM,yCAAyC,CAAC;AAOjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAOnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAqC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AA4BxE,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAElF,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACpE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,yBAAyB,CAAC;IACnD;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAMjD,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,oDAAoD;IACpD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC7C,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,EAC3C,IAAI,EAAE,MAAM,GACX,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;CAClD;AAID,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA83DhF"}

package/dist/transport/{httpTransport.js → http/transport.js}

@@ -5,87 +5,34 @@
  * facade in `httpClient.ts` is the application boundary; this module owns
  * transport envelopes, watermarks, replay, and route details.
  */
-import { AbloClaimedError, AbloError, AbloAuthenticationError, AbloConnectionError, AbloIdempotencyError, AbloValidationError, AbloNotFoundError, claimedError, translateHttpError, } from '../errors.js';
-import { v5 as uuidv5 } from 'uuid';
-import { reconcileFunctionalUpdate, } from '../resources/functionalUpdate.js';
-import { assertBrowserSafety, readProcessEnv, resolveApiKey, resolveApiKeyValue, resolveAuthToken, resolveBaseURL, resolveBootstrapBaseUrl, rejectRemovedDatabaseUrlOption, warnIfCliKeyMismatch, } from '../auth/apiKey.js';
-import { PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER } from '../wire/protocolVersion.js';
-import { commitReceiptSchema, commitRecordSchema, commitRecordListSchema, commitRecordListOptionsSchema, commitRecordWhereSchema, } from '../wire/commit.js';
-import { logListResponseSchema } from '../wire/feedEvent.js';
-import { claimAcquireResponseSchema, claimHeartbeatBatchReplySchema, claimHeartbeatReplySchema, claimListResponseSchema, claimStateSchema, } from '../wire/claims.js';
-import { modelListResponseSchema, modelReadResponseSchema, } from '../wire/modelResponses.js';
-import { toMs } from '../utils/duration.js';
-import { heartbeatCadenceMs, resolveHeartbeatOptions, resolveHeartbeatPlan, startClaimHeartbeatLoop, } from '../coordination/claimHeartbeatLoop.js';
-import { mintSession } from '../auth/sessionMint.js';
-import { revokeCapability, rotateCapability, } from '../auth/capabilityLifecycle.js';
-import { parseIdentityResolveResponse } from '../auth/schemas.js';
-/**
- * Interpret a heartbeat reply for a lease this handle HOLDS: anything other
- * than `held` means the lease is no longer ours (a holder cannot be `queued`;
- * `lost` rides a 409 that the wire error mapping already surfaces as
- * AbloClaimedError before reaching here). The thrown loss is the definitive
- * signal that stops the auto-heartbeat loop.
- */
-function heldHeartbeatReply(reply, label) {
-    if (reply.status === 'held' && typeof reply.expiresAt === 'number') {
-        return {
-            expiresAt: reply.expiresAt,
-            ...(reply.queueDepth !== undefined ? { queueDepth: reply.queueDepth } : {}),
-        };
-    }
-    throw new AbloClaimedError(`The lease behind ${label} is no longer held — it expired or was granted onward. Re-acquire the claim and retry; a write attempted under the old lease is rejected by its \`readAt\` guard.`, { code: 'claim_lost' });
-}
-import { claimAttemptFailure, claimQueueView, emitClaimStatus, resolveClaimContentionOptions, } from '../resources/modelOperations.js';
-import { claimDescription } from '../coordination/schema.js';
-import { subTarget, streamTarget, batchFence, claimIdFor, fenceTokenFor, } from '../coordination/locator.js';
-import { declaredMeta, wireMeta } from '../coordination/claimMeta.js';
-import { assertWriteOptions } from '../resources/writeOptionsSchema.js';
-import { normalizeWhere } from '../resources/where.js';
-import { createDurableHttpCommitEnvelope, canonicalHttpCommitBody, durableHttpCommitEnvelopeSchema, httpCommitEnvelopeRecordId, isHttpCommitReplayExpired, } from '../transactions/confirmation/httpCommitEnvelope.js';
-import { resolveDurableWrites } from '../durableWrites.js';
+import { AbloClaimedError, AbloError, AbloAuthenticationError, AbloConnectionError, AbloIdempotencyError, AbloValidationError, AbloNotFoundError, claimedError, translateHttpError, } from '../../errors.js';
+import { reconcileFunctionalUpdate, } from '../../client/resources/functionalUpdate.js';
+import { assertBrowserSafety, readProcessEnv, resolveApiKey, resolveApiKeyValue, resolveAuthToken, resolveBaseURL, resolveBootstrapBaseUrl, rejectRemovedDatabaseUrlOption, warnIfCliKeyMismatch, } from '../../auth/apiKey.js';
+import { PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER } from '../../wire/protocolVersion.js';
+import { commitRecordSchema, commitRecordListSchema, commitRecordListOptionsSchema, commitRecordWhereSchema, } from '../../commit/contract.js';
+import { logListResponseSchema } from '../../observation/feedContract.js';
+import { claimAcquireResponseSchema, claimHeartbeatBatchReplySchema, claimHeartbeatReplySchema, claimListResponseSchema, claimStateSchema, DEFAULT_CLAIM_TTL_MS, } from '../../claims/contract.js';
+import { modelListResponseSchema, modelReadResponseSchema, } from '../../wire/modelResponses.js';
+import { toMs } from '../../utils/duration.js';
+import { heartbeatCadenceMs, resolveHeartbeatOptions, resolveHeartbeatPlan, startClaimHeartbeatLoop, } from '../../claims/heartbeat.js';
+import { mintSession } from '../../auth/sessionMint.js';
+import { revokeCapability, rotateCapability, } from '../../auth/capabilityLifecycle.js';
+import { parseIdentityResolveResponse } from '../../auth/schemas.js';
+import { claimFromModelClaim, heldHeartbeatReply, parseSuccessfulCommitResponse, } from './helpers.js';
+import { claimAttemptFailure, claimQueueView, emitClaimStatus, resolveClaimContentionOptions, } from '../../client/resources/modelOperations.js';
+import { claimDescription } from '../../coordination/schema.js';
+import { subTarget, streamTarget, batchFence, } from '../../claims/locator.js';
+import { declaredMeta, wireMeta } from '../../claims/meta.js';
+import { assertWriteOptions, assertWriteTarget, } from '../../client/resources/writeOptionsSchema.js';
+import { createModelId, resolveCreatedRows, resolveCreateId, } from '../../client/resources/modelCreate.js';
+import { normalizeWhere } from '../../client/resources/where.js';
+import { createDurableHttpCommitEnvelope, canonicalHttpCommitBody, durableHttpCommitEnvelopeSchema, httpCommitEnvelopeRecordId, isHttpCommitReplayExpired, } from '../../commit/confirmation/httpCommitEnvelope.js';
+import { createClientTxId, normalizeCommitOperations, replicationLagTimeout, } from '../../commit/httpRequest.js';
+import { resolveDurableWrites } from '../../commit/durableWrites.js';
+import { createHttpReadOnChange } from './subscription.js';
 /** @internal Default per-request deadline for the private HTTP transport. */
 export const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
 const HTTP_CONFIRMATION_POLL_INTERVAL_MS = 250;
-/**
- * The server's acquire window, mirrored here as the client-side default for a
- * claim that names no `ttl` — it sets the auto-heartbeat cadence.
- */
-const DEFAULT_CLAIM_TTL_MS = 60_000;
-function parseSuccessfulCommitResponse(value, idempotencyKey) {
-    const parsed = commitReceiptSchema.safeParse(value);
-    if (!parsed.success || parsed.data.clientTxId !== idempotencyKey) {
-        throw new AbloConnectionError('The commit endpoint returned an invalid success receipt; its outcome remains pending and is safe to retry.', {
-            code: 'commit_no_result',
-            cause: parsed.success
-                ? new Error('Commit receipt clientTxId did not match its idempotency key')
-                : parsed.error,
-        });
-    }
-    return parsed.data;
-}
-/** Decode the HTTP claim DTO into the one public Claim shape. */
-function claimFromModelClaim(claim) {
-    // The handle a caller reads back is a public claim, so its `meta` is the
-    // declared shape; the rest of the sub-entity locator crosses whole rather
-    // than member by member, which is how `fields` used to die on this hop.
-    const { meta, ...details } = subTarget(claim.target);
-    return {
-        object: 'claim',
-        id: claim.id,
-        ...(claim.status ? { status: claim.status } : {}),
-        // The server always stamps a description; default only for total safety.
-        description: claim.description ?? 'editing',
-        heldBy: claim.actor,
-        participantKind: claim.participantKind,
-        expiresAt: claim.expiresAt,
-        ...(claim.position !== undefined ? { position: claim.position } : {}),
-        target: {
-            ...streamTarget(claim.target),
-            ...details,
-            ...(meta !== undefined ? { meta: declaredMeta(meta) } : {}),
-        },
-    };
-}
 /** @internal Constructed only by the typed HTTP facade. */
 export function createHttpTransport(options) {
     const env = readProcessEnv();
@@ -120,8 +67,7 @@ export function createHttpTransport(options) {
         const code = errorRecord?.code;
         const isConflict = code === 'stale_context' ||
             code === 'claim_conflict' ||
-            code === 'entity_claimed' ||
-            (typeof code === 'string' && code.startsWith('policy:'));
+            code === 'entity_claimed';
         if (!isConflict)
             return;
         const rawConflicts = errorRecord?.conflicts;
@@ -161,6 +107,7 @@ export function createHttpTransport(options) {
     let activeRequests = 0;
     let requestIdleWaiters = [];
     let disposePromise = null;
+    const readChangeControllers = new Set();
     function requestStarted() {
         activeRequests += 1;
     }
@@ -268,7 +215,23 @@ export function createHttpTransport(options) {
         }
         return target.toString();
     }
+    function subscriptionEndpoint() {
+        const target = new URL(endpoint('/v1/subscriptions'));
+        const partition = effectiveAuthority?.deliveryPartition;
+        if (partition) {
+            target.searchParams.set('deliveryPartition', `${partition.index}-${partition.count}`);
+        }
+        return target.toString();
+    }
     const requestTimeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    const onChange = createHttpReadOnChange({
+        fetch: fetchImpl,
+        endpoint: subscriptionEndpoint,
+        authHeaders,
+        prepare: ready,
+        register: (controller) => readChangeControllers.add(controller),
+        unregister: (controller) => readChangeControllers.delete(controller),
+    });
     /**
      * Issues one request and returns its decoded body without a contract.
      *
@@ -456,18 +419,6 @@ export function createHttpTransport(options) {
             // Receipt observation must never change the commit outcome.
         }
     }
-    function replicationLagTimeout(request, response) {
-        return new AbloConnectionError(`The source accepted commit ${request.idempotencyKey}, but its replication echo did not arrive within ${requestTimeoutMs}ms.`, {
-            code: 'replication_lag_timeout',
-            httpStatus: 504,
-            details: {
-                clientTxId: request.idempotencyKey,
-                ...(response.correlationId ? { correlationId: response.correlationId } : {}),
-                timeoutMs: requestTimeoutMs,
-                accepted: true,
-            },
-        });
-    }
     /**
      * Replays one byte-identical, idempotent HTTP commit until mutation-log
      * replay reports the source echo as confirmed. `queued` is acceptance only:
@@ -485,7 +436,7 @@ export function createHttpTransport(options) {
         while (current.status === 'queued') {
             const remaining = deadlineAt === null ? null : deadlineAt - Date.now();
             if (remaining !== null && remaining <= 0) {
-                throw replicationLagTimeout(request, current);
+                throw replicationLagTimeout(request, current, requestTimeoutMs);
             }
             const confirmationController = new AbortController();
             const confirmationDeadline = remaining !== null
@@ -513,7 +464,7 @@ export function createHttpTransport(options) {
             catch (error) {
                 if (confirmationController.signal.aborted ||
                     (deadlineAt !== null && Date.now() >= deadlineAt)) {
-                    throw replicationLagTimeout(request, current);
+                    throw replicationLagTimeout(request, current, requestTimeoutMs);
                 }
                 throw error;
             }
@@ -762,43 +713,6 @@ export function createHttpTransport(options) {
             return response;
         });
     }
-    function createClientTxId(idempotencyKey) {
-        if (idempotencyKey && idempotencyKey.length > 0)
-            return idempotencyKey;
-        return typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
-            ? crypto.randomUUID()
-            : `tx_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-    }
-    function createModelId(modelName, idempotencyKey) {
-        if (idempotencyKey) {
-            return uuidv5(`${modelName}:${idempotencyKey}`, 'aa4ba6d4-bf0b-5b38-9c45-116f79a6e548');
-        }
-        return typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
-            ? crypto.randomUUID()
-            : `id_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-    }
-    function normalizeCommitOperation(op, defaults, fence, claim) {
-        return {
-            action: op.action,
-            model: op.model,
-            id: op.id ?? null,
-            data: op.data ?? null,
-            where: op.where ?? null,
-            transactionId: op.transactionId ?? null,
-            claimId: op.claimId ?? claimIdFor(claim?.target, claim?.id, op.model, op.id ?? null),
-            readAt: op.readAt ?? defaults.readAt ?? null,
-            onStale: op.onStale ?? defaults.onStale ?? null,
-            fenceToken: op.fenceToken ?? fenceTokenFor(fence, op.model, op.id ?? null),
-        };
-    }
-    function normalizeCommitOperations(commitOptions, fence) {
-        if (commitOptions.operations.length === 0) {
-            throw new AbloValidationError('Commit requires a non-empty `operations` array.', {
-                code: 'commit_operation_required',
-            });
-        }
-        return commitOptions.operations.map((op) => normalizeCommitOperation(op, commitOptions, fence, commitOptions.claim ?? null));
-    }
     async function listClaimState(target) {
         const params = new URLSearchParams();
         if (target?.model)
@@ -936,11 +850,9 @@ export function createHttpTransport(options) {
             assertWriteOptions({
                 idempotencyKey: commitOptions.idempotencyKey,
                 readAt: commitOptions.readAt,
-                onStale: commitOptions.onStale,
                 wait: commitOptions.wait,
                 claim: commitOptions.claim,
                 reads: commitOptions.reads,
-                track: commitOptions.track,
             }, 'commits.create');
             const clientTxId = createClientTxId(commitOptions.idempotencyKey);
             // Same claim vocabulary as the WS client's `commits.create`: a handle
@@ -949,12 +861,10 @@ export function createHttpTransport(options) {
             const operations = normalizeCommitOperations({
                 ...commitOptions,
                 readAt: commitOptions.readAt ?? claim?.readAt ?? null,
-                onStale: commitOptions.onStale ?? (claim?.readAt !== undefined ? 'reject' : null),
             }, batchFence(claim?.target, claim?.fenceToken));
             const requestBody = {
                 operations,
                 reads: commitOptions.reads,
-                track: commitOptions.track,
             };
             const wait = commitOptions.wait ?? 'confirmed';
             let body;
@@ -986,9 +896,6 @@ export function createHttpTransport(options) {
                 id: body.id ?? body.clientTxId,
                 status: body.status,
                 lastSyncId: body.lastSyncId,
-                ...(body.notifications && body.notifications.length > 0
-                    ? { notifications: body.notifications }
-                    : {}),
                 ...(body.missingIds && body.missingIds.length > 0 ? { missingIds: body.missingIds } : {}),
                 ...(body.operationResults && body.operationResults.length > 0
                     ? { operationResults: body.operationResults }
@@ -1093,11 +1000,11 @@ export function createHttpTransport(options) {
             ...(res.evidence ? { evidence: res.evidence } : {}),
         };
     }
-    async function retrieveModel(modelName, params) {
+    async function readModel(modelName, params) {
         await applyClaimedPolicy({ model: modelName, id: params.id }, params);
         const query = await requestJson(`/v1/models/${encodeURIComponent(modelName)}/${encodeURIComponent(params.id)}`, { method: 'GET' }, modelReadResponseSchema);
         // A miss is `data: undefined`, not a thrown error. The WebSocket client's
-        // `retrieve` returns `T | undefined` for a missing row; throwing only here
+        // `read` returns `T | undefined` for a missing row; throwing only here
         // made the obvious read ("does this row exist?") a hard edge that an agent
         // had to wrap in try/catch. Both transports agree: an absent row means absent
         // data. Callers branch on `.data` (the documented `.data?.x` usage).
@@ -1123,13 +1030,13 @@ export function createHttpTransport(options) {
         assertWriteOptions(options && {
             idempotencyKey: options.idempotencyKey,
             readAt: options.readAt,
-            onStale: options.onStale,
             claim: options.claim,
             claimRef: options.claimRef,
             fenceToken: options.fenceToken,
             reads: options.reads,
-            track: options.track,
         }, `${modelName} ${action}`);
+        if (action !== 'create')
+            assertWriteTarget(action, modelName, id);
         const clientTxId = createClientTxId(options?.idempotencyKey);
         const encModel = encodeURIComponent(modelName);
         const path = action === 'create'
@@ -1148,10 +1055,8 @@ export function createHttpTransport(options) {
         const readAt = options?.readAt ?? claimHandle?.readAt;
         const requestBody = {
             claim: normalizeClaimId(options?.claimRef) ?? claimHandle?.id,
-            onStale: options?.onStale ?? (claimHandle?.readAt !== undefined ? 'reject' : undefined),
             readAt,
             reads: options?.reads,
-            track: options?.track,
             // The claim's fencing token (Option B), so the per-model HTTP write door
             // fences the same as the WS proxy and `commits.create`.
             fenceToken: options?.fenceToken ?? claimHandle?.fenceToken,
@@ -1280,7 +1185,15 @@ export function createHttpTransport(options) {
             }, claimHeartbeatReplySchema);
             return heldHeartbeatReply(reply, `claim ${claimId} on ${name}/${id}`);
         };
-        async function claimImpl(params) {
+        async function claimImpl(idOrParams, opts) {
+            // The row-free form names a key by id alone. Ablo has never held that
+            // row, so there is no snapshot to take after the grant and no `data` on
+            // the handle: the lease is the whole answer. The object form re-reads
+            // the row under the lease and hands back a `HeldClaim`.
+            const rowFree = typeof idOrParams === 'string';
+            const params = rowFree
+                ? { ...(opts ?? {}), id: idOrParams }
+                : idOrParams;
             let acquired;
             try {
                 acquired = await acquireClaim(params);
@@ -1306,13 +1219,6 @@ export function createHttpTransport(options) {
                 id: params.id,
                 description: claimDescription(params),
             });
-            const { data, stamp } = await retrieveModel(name, { id: params.id });
-            // A held claim hands back a snapshot; the typed `HeldClaim.data` is `T`.
-            // `retrieve` now reports a miss as `undefined` rather than throwing, but a
-            // claim on a row that doesn't exist has nothing to hold — surface it.
-            if (data === undefined) {
-                throw new AbloNotFoundError(`Cannot claim ${name}/${params.id}: it does not exist (or is outside this credential's scope).`, [params.id]);
-            }
             // One reading of the heartbeat options — cadence and callbacks from
             // whichever spelling the caller used (plan object, shorthand, or the
             // deprecated flat callbacks).
@@ -1345,10 +1251,9 @@ export function createHttpTransport(options) {
             // way. `subTarget` is wire-shaped by contract, including here, where the
             // value happens to have started out declared.
             const { meta, ...narrowed } = subTarget(params, name);
-            return {
+            const lease = {
                 object: 'claim',
                 id: claimId,
-                readAt: stamp,
                 ...(fenceToken !== undefined ? { fenceToken } : {}),
                 target: {
                     ...streamTarget({ model: name, id: params.id }),
@@ -1356,7 +1261,6 @@ export function createHttpTransport(options) {
                     ...(meta !== undefined ? { meta: declaredMeta(meta) } : {}),
                 },
                 description: claimDescription(params),
-                data,
                 release,
                 revoke: () => {
                     void release().catch(() => { });
@@ -1364,6 +1268,21 @@ export function createHttpTransport(options) {
                 heartbeat,
                 [Symbol.asyncDispose]: release,
             };
+            if (rowFree)
+                return lease;
+            const { data, stamp } = await readModel(name, { id: params.id });
+            // A held claim hands back a snapshot; the typed `HeldClaim.data` is `T`.
+            // `retrieve` reports a miss as `undefined`, and a claim on a row that does
+            // not exist has nothing to hold. The grant came BEFORE this read, so the
+            // miss must give the lease back first: otherwise the key stays held under
+            // this credential until the TTL lapses, behind no handle anyone can
+            // release, and every other participant is refused for the duration.
+            if (data === undefined) {
+                await release().catch(() => undefined);
+                throw new AbloNotFoundError(`Cannot claim ${name}/${params.id}: it does not exist (or is outside this credential's scope). ` +
+                    `To hold a key before its row exists, claim it by id alone: claim('${params.id}') returns a lease without a snapshot.`, [params.id]);
+            }
+            return { ...lease, readAt: stamp, data };
         }
         const claimsForEntity = (params) => requestJson(`/v1/claims?model=${encodeURIComponent(name)}&id=${encodeURIComponent(params.id)}${''}`, { method: 'GET' }, claimListResponseSchema);
         const claim = Object.assign(claimImpl, {
@@ -1374,6 +1293,19 @@ export function createHttpTransport(options) {
                 const first = res.data.find((row) => row.status !== 'queued');
                 return first ? claimFromModelClaim(first) : null;
             },
+            // Every holder, from the same one read `state` takes its first entry
+            // from: the server lists holders before waiters, and the caller's own
+            // lease before its peers'. (This member was missing for as long as the
+            // namespace was cast to its type instead of typed as it.)
+            list: async (params) => {
+                const res = await claimsForEntity(params);
+                return {
+                    object: 'list',
+                    data: res.data
+                        .filter((row) => row.status !== 'queued')
+                        .map(claimFromModelClaim),
+                };
+            },
             queue: async (params) => {
                 const res = await claimsForEntity(params);
                 return claimQueueView(res.data
@@ -1396,12 +1328,23 @@ export function createHttpTransport(options) {
             if (!claimInput)
                 return run(input);
             if (isClaimHandle(claimInput)) {
+                // The lease's watermark travels with it. Unwrapping the handle to a
+                // `claimRef` is what put this here: `mutateModel` reads `readAt` off a
+                // handle on `claim`, and this sets `claim: undefined` before it looks,
+                // so the stale guard was silently dropped on every write that named a
+                // handle. The result was mutual exclusion without lost-update
+                // detection, on the transport agents run, under code that reads as
+                // though it had both. The reactive client binds the same three values
+                // from the claim it holds; a caller's own `readAt` wins.
                 return run({
                     ...input,
                     claimRef: { id: claimInput.id },
                     ...(claimInput.fenceToken !== undefined
                         ? { fenceToken: claimInput.fenceToken }
                         : {}),
+                    ...(input?.readAt === undefined && claimInput.readAt !== undefined
+                        ? { readAt: claimInput.readAt }
+                        : {}),
                     claim: undefined,
                 });
             }
@@ -1427,7 +1370,7 @@ export function createHttpTransport(options) {
         function updateModel(arg, updater, contention) {
             // Functional form: update(id, current => next). The SDK owns the
             // read-fresh → compute → compare-and-swap → reconcile loop; correctness
-            // rides on the row's watermark (readAt + onStale:'reject'), so no claim
+            // rides on the row's watermark (`readAt`), so no claim
             // or per-participant identity is needed and contention never clobbers.
             if (typeof arg === 'string') {
                 const id = arg;
@@ -1439,12 +1382,11 @@ export function createHttpTransport(options) {
                     model: name,
                     id,
                     readFresh: async () => {
-                        const read = await retrieveModel(name, { id });
+                        const read = await readModel(name, { id });
                         return { data: read.data, stamp: read.stamp };
                     },
                     writeNext: (patch, readAt) => mutateModel('update', name, id, patch, {
                         readAt,
-                        onStale: 'reject',
                     }),
                 });
             }
@@ -1456,11 +1398,8 @@ export function createHttpTransport(options) {
         }
         return {
             claim,
-            get(params) {
-                return retrieveModel(name, params);
-            },
-            retrieve(params) {
-                return retrieveModel(name, params);
+            read(params) {
+                return readModel(name, params);
             },
             list(options) {
                 return listModel(name, options);
@@ -1476,7 +1415,7 @@ export function createHttpTransport(options) {
                     // an existing id, the existing row rather than the caller's input.
                     let created;
                     await mutateModel('create', name, id, params.data, options, async () => {
-                        const read = await retrieveModel(name, { id });
+                        const read = await readModel(name, { id });
                         if (read.data === undefined) {
                             throw new AbloNotFoundError(`create ${name}/${id} did not yield a readable row (the write did not confirm).`, [id]);
                         }
@@ -1490,6 +1429,51 @@ export function createHttpTransport(options) {
                     return created;
                 });
             },
+            /**
+             * Creates many rows as ONE commit, and returns them.
+             *
+             * Atomic on purpose: a batch that half-lands leaves the caller to work
+             * out which half, and every other write door here declines whole. One
+             * rejected row declines the batch.
+             *
+             * A fresh receipt returns the authoritative rows directly from the
+             * writing transaction. A durable idempotency replay deliberately redacts
+             * those rows, so that path verifies every deterministic id with a point
+             * read and fails loudly if policy prevents a complete answer. Neither
+             * path can report a partial collection as success.
+             *
+             * Ids are resolved here rather than left to the server, so the results
+             * can be returned in the caller's own order rather than the order the
+             * transaction happened to settle them.
+             */
+            async createMany(params) {
+                if (params.data.length === 0)
+                    return [];
+                // A claim/stale guard addresses one existing row, so the canonical
+                // batch-create options do not admit those fields at all.
+                const { data, ...options } = params;
+                const ids = data.map((row, index) => resolveCreateId(undefined, row) ??
+                    createModelId(name, params.idempotencyKey ? `${params.idempotencyKey}:${index}` : null));
+                const receipt = await commits.create({
+                    ...options,
+                    operations: data.map((row, index) => ({
+                        action: 'create',
+                        model: name,
+                        id: ids[index] ?? null,
+                        data: row,
+                    })),
+                    wait: 'confirmed',
+                });
+                return resolveCreatedRows({
+                    modelName: name,
+                    ids,
+                    operationResults: receipt.operationResults,
+                    readRow: async (id) => {
+                        const read = await readModel(name, { id });
+                        return read.data;
+                    },
+                });
+            },
             update: updateModel,
             async delete(params) {
                 return withMutationClaim(params.id, params, async (options) => {
@@ -1497,29 +1481,6 @@ export function createHttpTransport(options) {
                     return mutateModel('delete', name, params.id, undefined, options);
                 });
             },
-            async track(params) {
-                const dependency = {
-                    model: name.toLowerCase(),
-                    id: params.id,
-                    ...(params.readAt !== undefined ? { readAt: params.readAt } : {}),
-                };
-                // A track carries no write, so it rides the commit lane as a
-                // zero-operation body — the shape `/v1/commits` accepts for registering
-                // a premise without one. Going through the same durable lane as every
-                // other commit means a disconnect replays the registration rather than
-                // dropping it, and a notification that had already fired is not lost to
-                // a retry.
-                const body = await dispatchHttpCommit({
-                    path: '/v1/commits',
-                    method: 'POST',
-                    idempotencyKey: createClientTxId(),
-                    body: { track: [dependency] },
-                    wait: 'confirmed',
-                });
-                return body.notifications && body.notifications.length > 0
-                    ? { notifications: body.notifications }
-                    : {};
-            },
         };
     }
     return {
@@ -1532,6 +1493,9 @@ export function createHttpTransport(options) {
         }),
         dispose() {
             if (!disposePromise) {
+                for (const controller of readChangeControllers)
+                    controller.abort();
+                readChangeControllers.clear();
                 const scheduledCommits = httpCommitLane;
                 disposePromise = (async () => {
                     await scheduledCommits;
@@ -1541,6 +1505,7 @@ export function createHttpTransport(options) {
             return disposePromise;
         },
         async purge() { },
+        onChange,
         commits,
         claims,
         logs,
@@ -1614,4 +1579,4 @@ function parseBody(bodyText) {
         return bodyText;
     }
 }
-//# sourceMappingURL=httpTransport.js.map
+//# sourceMappingURL=transport.js.map