@abloatai/transaction 0.56.0 → 0.58.0

package/src/internal/read-set.ts

@@ -3,21 +3,18 @@
  * Application code declares dependencies through `reads: [returnedRow]`.
  */
 export {
-  abortReadSetCommit,
   capturePointRead,
   createReadSetContext,
-  commitRecordIdentity,
-  consumeReadSet,
   evidenceForRow,
   kReadEvidence,
   prepareReadSet,
   publishCommitRecord,
   readEvidenceBinding,
-} from '../readSetContext.js';
-export { recordWebSocketCommitReceipt } from '../commitRecordRuntime.js';
+} from '../commit/readSetContext.js';
+export { recordWebSocketCommitReceipt } from '../commit/recordRuntime.js';
 export type {
   CapturedReadEvidence,
   PreparedReadSet,
   ReadEvidenceBinding,
   ReadSetContext,
-} from '../readSetContext.js';
+} from '../commit/readSetContext.js';

package/src/observability.ts

@@ -1,8 +1,8 @@
 /**
  * The observability the confirmation core reports on its own behalf.
  *
- * Coordination outcomes — a claim changing state, a stale-write collision that
- * notified instead of aborting — happen with no UI and no local store anywhere,
+ * Coordination outcomes — a claim changing state or a rejected write collision
+ * — happen with no UI and no local store anywhere,
  * so the core must be able to report them without depending on the consumer's
  * full provider (ADR 0016).
  *
@@ -11,13 +11,13 @@
  * this interface, so a single implementation still satisfies both.
  */
 
-import type { ClaimEvent, ConflictEvent } from './coordination/events.js';
+import type { ClaimEvent, ConflictEvent } from './claims/events.js';
 
 export interface CoordinationObservability {
   /** Capture a claim state change (acquired / queued / granted / lost / rejected / expired). */
   captureClaim(event: ClaimEvent): void;
 
-  /** Capture a notify-instead-of-abort stale-write collision. */
+  /** Capture a rejected stale-write or foreign-claim collision. */
   captureConflict(event: ConflictEvent): void;
 }
 

package/src/{wire/delta.ts → observation/contract.ts}

@@ -6,7 +6,7 @@
  * layer, alongside the other protocol shapes in `wire/`.
  *
  * The wire delta is a projection of the stored `sync_deltas` row (the
- * `syncDeltaRowSchema` in `../log/syncDeltaRow.ts`) and differs from it
+ * `syncDeltaRowSchema` in `./persistence/syncDeltaRow.ts`) and differs from it
  * in three ways: it omits `organizationId` (the tenant-isolation predicate is
  * never broadcast), it uses the full action vocabulary (see
  * {@link syncDeltaActionSchema}) rather than plain create, update, and delete, and
@@ -26,7 +26,7 @@
  */
 
 import { z } from 'zod';
-import { correlationIdSchema } from './commit.js';
+import { correlationIdSchema } from '../commit/contract.js';
 import { participantKindSchema } from '../coordination/schema.js';
 import type { ParticipantKind, ParticipantRef } from '../types/participant.js';
 import type { AssertExact } from '../types/assertExact.js';

package/src/{wire/feedEvent.ts → observation/feedContract.ts}

@@ -14,9 +14,9 @@
  */
 
 import { z } from 'zod';
-import { logEventSchema, logOpSchema, type LogEvent } from './accountResponses.js';
-import { claimEventSchema, type ClaimEvent } from './claimEvent.js';
-import { listEnvelopeSchema, type ListEnvelope } from './listEnvelope.js';
+import { logEventSchema, logOpSchema, type LogEvent } from '../wire/accountResponses.js';
+import { claimEventSchema, type ClaimEvent } from '../claims/eventContract.js';
+import { listEnvelopeSchema, type ListEnvelope } from '../wire/listEnvelope.js';
 
 /**
  * One entry, from either source. Discriminated on `object`, so a consumer
@@ -71,4 +71,3 @@ export type LogQuery = z.infer<typeof logQuerySchema>;
  * What is here is the definition the producer will fill: the union parses
  * today's pages unchanged, and the cursor already carries the second position.
  */
-

package/src/{transport → observation}/httpFeed.ts

@@ -1,9 +1,9 @@
-import { formatFeedCursor, parseFeedCursor } from '../wire/feedCursor.js';
-import type { HttpLogsResource } from '../resources/httpResources.js';
+import { formatFeedCursor, parseFeedCursor } from './cursor.js';
+import type { HttpLogsResource } from '../client/resources/httpResources.js';
 import type {
   ObserveOptions,
   ObservedDelta,
-} from '../transactionLayer.js';
+} from '../client/contract.js';
 
 const DEFAULT_PAGE_SIZE = 100;
 const DEFAULT_POLL_INTERVAL_MS = 500;

package/src/observation/index.ts

@@ -0,0 +1,12 @@
+/**
+ * Observation subsystem.
+ *
+ * Start here and descend through delta contracts, feed contracts, cursor
+ * handling, delivery inspection, HTTP polling, and persisted row projection.
+ */
+export * from './contract.js';
+export * from './cursor.js';
+export * from './feedContract.js';
+export * from './deliveryContract.js';
+export * from './httpFeed.js';
+export * from './persistence/syncDeltaRow.js';

package/src/{log → observation/persistence}/syncDeltaRow.ts

@@ -16,25 +16,25 @@
  * incorrectly as a physical-residency guarantee.
  *
  * This is the stored shape. The delta broadcast to clients is a narrower projection
- * of it — see {@link import('../wire/delta.js').syncDeltaWireCoreSchema} — and
+ * of it — see {@link import('../contract.js').syncDeltaWireCoreSchema} — and
  * the field names here mirror those on that wire delta.
  */
 
 import { z } from 'zod';
-import type { ModelResidency } from '../schema/residency.js';
+import type { ModelResidency } from '../../schema/residency.js';
 import {
   participantKindSchema,
   confirmationStateSchema,
   syncDeltaActionSchema,
-} from '../wire/delta.js';
+} from '../contract.js';
 
 // ── Enumerations that mirror the corresponding Postgres enum types ────────────
 
 // `participant_kind` and `confirmation_state` are shared with the wire delta and
-// live at the wire layer (see `../wire/delta.js`); they are re-exported here so
+// live in the observation contract (see `../contract.js`); they are re-exported here so
 // code that imports them from `schema` keeps resolving.
-export { participantKindSchema, confirmationStateSchema } from '../wire/delta.js';
-export type { ParticipantKind, ConfirmationState } from '../wire/delta.js';
+export { participantKindSchema, confirmationStateSchema } from '../contract.js';
+export type { ParticipantKind, ConfirmationState } from '../contract.js';
 
 /** `backfill_provenance` */
 export const backfillProvenanceSchema = z.enum(['exact', 'inferred', 'unknown']);
@@ -116,4 +116,3 @@ export const DELTA_PHYSICAL_STORAGE = {
   core: 'control',
   attribution: 'control',
 } as const satisfies Record<string, ModelResidency>;
-

package/src/pricing.ts

@@ -28,10 +28,9 @@
  * invoice, because raising one number does not fail anything that pins the
  * other.
  *
- * Storage is deliberately absent from {@link billableAxisSchema}. It is a real
- * recurring cost and it is quoted per tier as a ceiling, but no per-organization
- * bytes sampler emits it yet, and pricing a dimension nothing measures would be
- * a claim the invoice cannot support. Add the axis when the sampler ships.
+ * Audit-log storage is quoted as an included allowance plus Scale overage. It
+ * remains separate from the request meter because GiB-months come from a
+ * periodic storage sampler rather than an API event.
  */
 
 import { z } from 'zod';
@@ -47,7 +46,7 @@ export type { MeterEvent, PlanTier, RateBracket };
  * could observe the difference. It is emitted into the generated pricing
  * documentation so a stale copy is identifiable on sight.
  */
-export const PRICING_VERSION = '2026-07-31';
+export const PRICING_VERSION = '2026-08-24';
 
 /**
  * Resolve a stored plan string (`stripe_subscription.plan`) to a tier.
@@ -66,8 +65,8 @@ export function toPlanTier(plan: string | null | undefined): PlanTier {
 }
 
 /**
- * The axes a bill is actually computed from: `ops` is metered, `connections` is
- * capped. Storage is quoted but not billed, so it is not here.
+ * The request-time axes: `ops` is metered and `connections` is capped. Audit
+ * storage is sampled periodically, so it does not map from a request event.
  */
 export const billableAxisSchema = z.enum(['ops', 'connections']);
 export type BillableAxis = z.infer<typeof billableAxisSchema>;
@@ -184,11 +183,12 @@ const rateCardSchema = z
  * knob; the bracket structure is the contract.
  */
 export const OPS_RATE_CARD: readonly RateBracket[] = rateCardSchema.parse([
-  { throughOps: 50_000_000, usdPerMillionOps: 2.0 },
-  { throughOps: 500_000_000, usdPerMillionOps: 1.2 },
-  { throughOps: null, usdPerMillionOps: 0.6 },
+  { throughOps: null, usdPerMillionOps: 5 },
 ]);
 
+/** Scale audit-log storage above the included allowance, per GiB-month. */
+export const AUDIT_LOG_STORAGE_USD_PER_GIB_MONTH = 1;
+
 /**
  * A tier. `null` on a floor, a cap, or a quota means negotiated rather than
  * unlimited, and the runtime treats it as "no typed default, use the operator's
@@ -206,9 +206,9 @@ export const planDefinitionSchema = z.object({
    */
   monthlyMinimumUsd: z.number().nonnegative().nullable(),
   /**
-   * A hard monthly stop on operations. Set only where the tier is not billed at
-   * all: Free is capped rather than metered, so exceeding it is refused instead
-   * of invoiced. `null` on every metered tier.
+   * The no-billing monthly stop. On Free this is also the included allowance:
+   * organizations without billing enabled stop here, while organizations that
+   * enable billing pay only for operations above it. `null` on paid tiers.
    */
   hardCapOps: z.number().int().positive().nullable(),
   /**
@@ -220,7 +220,7 @@ export const planDefinitionSchema = z.object({
    * are billed rather than stopped.
    */
   hardCapOpsPerDay: z.number().int().positive().nullable(),
-  /** Quoted ceiling on stored data, in GiB. Not billed. `null` is negotiated. */
+  /** Included audit-log storage, in GiB. `null` means contract-priced capacity. */
   storageGib: z.number().positive().nullable(),
   /** Hard concurrent-connection cap, the real Free to Scale boundary. */
   maxConcurrentConnections: z.number().int().positive().nullable(),
@@ -240,7 +240,7 @@ export const PLANS = z
     free: {
       tier: 'free',
       label: 'Free',
-      summary: 'Build against the real engine without a card.',
+      summary: 'Free for early-stage teams building against the real engine.',
       monthlyMinimumUsd: 0,
       hardCapOps: 100_000,
       hardCapOpsPerDay: 10_000,
@@ -252,8 +252,8 @@ export const PLANS = z
     scale: {
       tier: 'scale',
       label: 'Scale',
-      summary: 'Production traffic, metered above a monthly floor.',
-      monthlyMinimumUsd: 20,
+      summary: 'Built for scaling teams with production traffic.',
+      monthlyMinimumUsd: 250,
       hardCapOps: null,
       hardCapOpsPerDay: null,
       storageGib: 50,
@@ -264,8 +264,8 @@ export const PLANS = z
     enterprise: {
       tier: 'enterprise',
       label: 'Enterprise',
-      summary: 'Committed volume, private networking, and an uptime guarantee.',
-      monthlyMinimumUsd: 2_000,
+      summary: 'Custom infrastructure, security, and support for critical workloads.',
+      monthlyMinimumUsd: 4_000,
       hardCapOps: null,
       hardCapOpsPerDay: null,
       storageGib: null,
@@ -336,8 +336,8 @@ export function opsForUsd(usd: number): number {
 }
 
 /**
- * The operations a tier includes, as shown on the pricing page. A capped tier
- * shows its cap; a metered tier shows what its floor covers, computed from the
+ * The operations a tier includes, as shown on the pricing page. Free shows its
+ * pay-as-you-go allowance; a tier with a floor shows what that floor covers, computed from the
  * floor rather than stored beside it. `null` where the terms are contractual.
  */
 export function monthlyOpsAllowance(tier: PlanTier): number | null {
@@ -348,17 +348,38 @@ export function monthlyOpsAllowance(tier: PlanTier): number | null {
 }
 
 /**
- * The invoice for a month: the floor, or the metered usage, whichever is
- * greater. A capped tier is never billed above its floor because the cap is
- * enforced before the usage exists. `null` where the terms are contractual.
+ * The invoice for a month. Free subtracts its included operations before
+ * applying the rate. Scale charges the floor or metered usage, whichever is
+ * greater. `null` where the terms are contractual.
  */
 export function monthlyBillUsd(tier: PlanTier, ops: number): number | null {
   const plan = PLANS[tier];
   if (plan.contractPriced || plan.monthlyMinimumUsd === null) return null;
-  if (plan.hardCapOps !== null) return plan.monthlyMinimumUsd;
+  if (plan.hardCapOps !== null) {
+    return roundUsd(usdForOps(Math.max(0, ops - plan.hardCapOps)));
+  }
   return roundUsd(Math.max(plan.monthlyMinimumUsd, usdForOps(ops)));
 }
 
+/**
+ * Audit-log storage overage for a month. Free and Scale meter only the GiB
+ * above their included amount, and Enterprise is priced in the contract.
+ */
+export function auditLogStorageBillUsd(tier: PlanTier, storageGib: number): number | null {
+  const plan = PLANS[tier];
+  if (plan.contractPriced || plan.storageGib === null) return null;
+  if (!Number.isFinite(storageGib)) return 0;
+  return roundUsd(Math.max(0, storageGib - plan.storageGib) * AUDIT_LOG_STORAGE_USD_PER_GIB_MONTH);
+}
+
+/** The complete published estimate across operation and audit-storage usage. */
+export function monthlyEstimateUsd(tier: PlanTier, ops: number, auditStorageGib: number): number | null {
+  const operationsBill = monthlyBillUsd(tier, ops);
+  const storageBill = auditLogStorageBillUsd(tier, auditStorageGib);
+  if (operationsBill === null || storageBill === null) return null;
+  return roundUsd(operationsBill + storageBill);
+}
+
 /**
  * The daily operations cap for a tier: the typed default the quota gate falls
  * back to when no `plan_limit` row sets one. `null` means the tier is metered

package/src/schema/audit.ts

@@ -0,0 +1,121 @@
+import type { ModelJSON, SchemaJSON } from './serialize.js';
+import { resolveTenancy } from './tenancy.js';
+
+export interface SchemaAuditFinding {
+  readonly code: 'scope_routing_without_access_policy';
+  readonly severity: 'error';
+  readonly model: string;
+  readonly message: string;
+  readonly fix: string;
+}
+
+interface RoutingAnchor {
+  readonly description: string;
+  readonly column: string;
+  readonly parentTable?: string;
+}
+
+function tableName(key: string, model: ModelJSON): string {
+  return model.tableName ?? key;
+}
+
+function fieldColumn(model: ModelJSON, field: string): string {
+  return model.fields[field]?.column ?? field;
+}
+
+function camelToSnake(value: string): string {
+  return value.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+}
+
+function reachesScope(
+  key: string,
+  models: SchemaJSON['models'],
+  seen: ReadonlySet<string> = new Set(),
+): boolean {
+  if (seen.has(key)) return false;
+  const model = models[key];
+  if (!model) return false;
+  if (model.scope) return true;
+  const nextSeen = new Set(seen).add(key);
+  return Object.values(model.relations).some(
+    (relation) => relation.type === 'belongsTo' && reachesScope(relation.target, models, nextSeen),
+  );
+}
+
+function routingAnchors(
+  model: ModelJSON,
+  models: SchemaJSON['models'],
+): readonly RoutingAnchor[] {
+  const anchors: RoutingAnchor[] = [];
+
+  if (model.scope) {
+    anchors.push({ description: `scope root ${String(model.scope)}`, column: 'id' });
+  }
+
+  for (const role of model.entityRoles ?? []) {
+    anchors.push({
+      description: `entity role ${role.kind}`,
+      column: fieldColumn(model, role.source.field),
+    });
+  }
+
+  for (const [relationName, relation] of Object.entries(model.relations)) {
+    if (relation.type !== 'belongsTo' || !reachesScope(relation.target, models)) continue;
+    const target = models[relation.target];
+    if (!target) continue;
+    anchors.push({
+      description: `parent scope ${relationName}`,
+      column: relation.foreignKeyColumn,
+      parentTable: tableName(relation.target, target),
+    });
+  }
+
+  return anchors;
+}
+
+function policyMatches(anchor: RoutingAnchor, model: ModelJSON): boolean {
+  const tenancy = resolveTenancy(model);
+  if (tenancy.kind === 'source') return true;
+  if (tenancy.kind === 'column') {
+    return tenancy.column === anchor.column || tenancy.column === camelToSnake(anchor.column);
+  }
+  if (tenancy.kind === 'parent') {
+    return tenancy.via.localKey === anchor.column &&
+      (anchor.parentTable === undefined || tenancy.via.parentTable === anchor.parentTable);
+  }
+  return false;
+}
+
+/**
+ * Finds mutable models whose sync-group routing is narrower than their row-read
+ * policy. A correctly filtered list or routed stream is not evidence that a
+ * foreign row is unreadable; only the policy is the authorization boundary.
+ */
+export function auditSchemaAccessPolicies(schema: SchemaJSON): readonly SchemaAuditFinding[] {
+  const findings: SchemaAuditFinding[] = [];
+
+  for (const [key, model] of Object.entries(schema.models)) {
+    if (model.mutable === false || model.routingOnly === true) continue;
+    const mismatched = routingAnchors(model, schema.models)
+      .filter((anchor) => !policyMatches(anchor, model));
+    if (mismatched.length === 0) continue;
+
+    const policy = resolveTenancy(model);
+    const routedBy = mismatched.map(({ description, column }) => `${description} (${column})`).join(', ');
+    findings.push({
+      code: 'scope_routing_without_access_policy',
+      severity: 'error',
+      model: key,
+      message:
+        `Model "${key}" routes changes by ${routedBy}, but its row-access policy is ` +
+        `by ${policy.kind}. Sync groups route delivery; they do not authorize reads. ` +
+        `A filtered list or correctly routed live stream is not an authorization proof.`,
+      fix:
+        `Make policy follow the same customer/workspace boundary on every reachable model, ` +
+        `use policy: { by: 'source' } with one Ablo organization per hard tenant, or set ` +
+        `groups.routingOnly: true to explicitly acknowledge an intentionally broader read policy.`,
+    });
+  }
+
+  return findings;
+}

package/src/schema/ddl.ts

@@ -27,6 +27,7 @@ import type { SchemaJSON, ModelJSON } from './serialize.js';
 import type { MigrationStep, BackfillValue, FieldType } from './diff.js';
 import type { FieldMeta } from './field.js';
 import { resolveTenancy, tenancyColumn } from './tenancy.js';
+import type { SubjectRule } from './subject.js';
 
 export interface ProvisionPlan {
   /** The Postgres schema the tables live in (`app_<id>` or `public`). */
@@ -119,6 +120,22 @@ export function sqlType(fieldType: ModelJSON['fields'][string]['type']): string
 
 const BASE_COLUMNS = new Set(['id']);
 
+function subjectPredicate(model: ModelJSON, rule: SubjectRule): string {
+  const meta = model.fields[rule.field];
+  if (!meta) {
+    throw new AbloValidationError(`subject field ${JSON.stringify(rule.field)} is not declared`, {
+      code: 'schema_definition_invalid',
+      param: 'subject.field',
+    });
+  }
+  const column = meta.column ?? camelToSnake(rule.field);
+  const prefix = `${rule.group}:`.replace(/'/g, "''");
+  return (
+    `COALESCE(NULLIF(current_setting('app.current_subject_groups', true), ''), '[]')::jsonb ` +
+    `? ('${prefix}' || ${q(column)}::text)`
+  );
+}
+
 // ── Foreign keys (relation-driven, sync-safe) ────────────────────────────────
 
 /**
@@ -324,7 +341,20 @@ export function generateProvisionPlan(
       statements.push(`ALTER TABLE ${qt} ENABLE ROW LEVEL SECURITY;`);
       statements.push(`ALTER TABLE ${qt} FORCE ROW LEVEL SECURITY;`);
       const policy = `${table}_tenant_isolation`;
-      const predicate = `${q(orgCol)} = current_setting('app.current_org_id', true)`;
+      const predicates = [
+        `${q(orgCol)} = current_setting('app.current_org_id', true)`,
+        ...(model.subject ? [subjectPredicate(model, model.subject)] : []),
+      ];
+      const predicate = predicates.length === 1
+        ? predicates[0]!
+        : predicates.map((part) => `(${part})`).join(' AND ');
+      statements.push(`DROP POLICY IF EXISTS ${q(policy)} ON ${qt};`);
+      statements.push(`CREATE POLICY ${q(policy)} ON ${qt}\n  USING (${predicate})\n  WITH CHECK (${predicate});`);
+    } else if (model.subject) {
+      statements.push(`ALTER TABLE ${qt} ENABLE ROW LEVEL SECURITY;`);
+      statements.push(`ALTER TABLE ${qt} FORCE ROW LEVEL SECURITY;`);
+      const policy = `${table}_subject_isolation`;
+      const predicate = subjectPredicate(model, model.subject);
       statements.push(`DROP POLICY IF EXISTS ${q(policy)} ON ${qt};`);
       statements.push(`CREATE POLICY ${q(policy)} ON ${qt}\n  USING (${predicate})\n  WITH CHECK (${predicate});`);
     }
@@ -585,5 +615,45 @@ export function generateMigrationPlan(
     }
   }
 
+  // Subject authorization is metadata rather than a field diff. Reconcile when
+  // that metadata changes, or when the protected field's physical column
+  // changes. An identical empty migration must remain a true no-op.
+  for (const [key, model] of Object.entries(next.models)) {
+    if ((model.plane ?? 'tenant') === 'control') continue;
+    const previousModel = prev?.models[key];
+    const subjectChanged = JSON.stringify(previousModel?.subject) !== JSON.stringify(model.subject);
+    const subjectColumnChanged = steps.some((step) =>
+      'model' in step && step.model === key &&
+      step.kind === 'alter_field' &&
+      (step.field === model.subject?.field || step.field === previousModel?.subject?.field) &&
+      step.changes.column !== undefined
+    );
+    if (!subjectChanged && !subjectColumnChanged) continue;
+    const table = model.tableName ?? key;
+    const qt = qtFor(table);
+    const orgCol = tenancyColumn(resolveTenancy(model));
+    const tenantPolicy = `${table}_tenant_isolation`;
+    const subjectPolicy = `${table}_subject_isolation`;
+    if (orgCol || model.subject) {
+      statements.push(`ALTER TABLE ${qt} ENABLE ROW LEVEL SECURITY;`);
+      statements.push(`ALTER TABLE ${qt} FORCE ROW LEVEL SECURITY;`);
+      statements.push(`DROP POLICY IF EXISTS ${q(tenantPolicy)} ON ${qt};`);
+      statements.push(`DROP POLICY IF EXISTS ${q(subjectPolicy)} ON ${qt};`);
+      const parts = [
+        ...(orgCol ? [`${q(orgCol)} = current_setting('app.current_org_id', true)`] : []),
+        ...(model.subject ? [subjectPredicate(model, model.subject)] : []),
+      ];
+      const predicate = parts.length === 1
+        ? parts[0]!
+        : parts.map((part) => `(${part})`).join(' AND ');
+      const policy = orgCol ? tenantPolicy : subjectPolicy;
+      statements.push(`CREATE POLICY ${q(policy)} ON ${qt}\n  USING (${predicate})\n  WITH CHECK (${predicate});`);
+    } else if (previousModel?.subject) {
+      statements.push(`DROP POLICY IF EXISTS ${q(subjectPolicy)} ON ${qt};`);
+      statements.push(`ALTER TABLE ${qt} NO FORCE ROW LEVEL SECURITY;`);
+      statements.push(`ALTER TABLE ${qt} DISABLE ROW LEVEL SECURITY;`);
+    }
+  }
+
   return { appSchema: targetSchema, statements, concurrent };
 }

package/src/schema/index.ts

@@ -13,7 +13,7 @@
  *     status: z.enum(['todo', 'doing', 'done']).default('todo'),
  *     projectId: z.string().optional(),
  *   }, {
- *     project: relation.belongsTo('projects', 'projectId'),
+ *     relations: { project: relation.belongsTo('projects', 'projectId') },
  *   }),
  * });
  *
@@ -80,7 +80,7 @@ export {
   type ParticipantKind,
   type ConfirmationState,
   type BackfillProvenance,
-} from '../log/syncDeltaRow.js';
+} from '../observation/persistence/syncDeltaRow.js';
 
 // The wire delta contract — the server-to-client projection of the stored row.
 // Both the client SDK and the server derive their `SyncDelta` type from these with
@@ -98,7 +98,7 @@ export {
   type SyncDeltaWireCore,
   type ClientSyncDelta,
   type ServerSyncDelta,
-} from '../wire/delta.js';
+} from '../observation/contract.js';
 
 // Model builder
 export {
@@ -115,25 +115,8 @@ export {
   type PersistOptions,
   type RelationRecord,
   type GrantsRef,
-  type ConflictAxis,
 } from './model.js';
 
-// Coordination authoring helpers for the `conflict` axis — composable disposition
-// functions plus a combinator that merges them.
-export {
-  coordination,
-  humansOverwrite,
-  humansReject,
-  humansNotify,
-  agentsOverwrite,
-  agentsReject,
-  agentsNotify,
-  systemOverwrite,
-  systemReject,
-  systemNotify,
-  type ConflictRule,
-} from './coordination.js';
-
 // Claim-first shorthand for common model options: `mutable.lazy({...})` and friends
 // encode a model's write-safety and load strategy in the verb, and fall back to
 // sensible defaults for everything else.
@@ -145,6 +128,7 @@ export {
   composeIdentitySyncGroups,
   type Schema,
   type SchemaRecord,
+  BASE_FIELDS,
   type Model,
   type Row,
   type InferCreate,
@@ -154,12 +138,16 @@ export {
   type InsertValue,
   type UpsertValue,
   type UpdateValue,
+  type Clearable,
   type DeleteId,
   type DefineSchemaOptions,
   type Casing,
   type CasingConvention,
   type CasingFn,
   composeEntitySyncGroups,
+  syncGroupsForRow,
+  InvalidRecordSubjectError,
+  type RecordSyncGroupSpec,
   intersectRequestedWithAllowed,
   type IdentityRole,
   type IdentityContext,
@@ -210,6 +198,18 @@ export {
   type RelationJSON,
 } from './serialize.js';
 
+export {
+  auditSchemaAccessPolicies,
+  type SchemaAuditFinding,
+} from './audit.js';
+
+export {
+  subjectRuleSchema,
+  subjectGroupForRow,
+  subjectAuthorized,
+  type SubjectRule,
+} from './subject.js';
+
 // Schema projection — derive an app's subset from one canonical schema.
 export { selectModels, omitModels, omittedModelError } from './select.js';