@abloatai/transaction 0.57.0 → 0.58.0

package/src/{resources → client/resources}/httpResources.ts

@@ -7,11 +7,9 @@
 
 import type {
   ClaimHeartbeatAckPayload,
-  OnStaleMode,
   ReadDependency,
-  TrackDependency,
-} from '../coordination/schema.js';
-import type { ClaimHeartbeatReply, ClaimState } from '../wire/claims.js';
+} from '../../coordination/schema.js';
+import type { ClaimHeartbeatReply, ClaimState } from '../../claims/contract.js';
 import type {
   ClientCommitReceipt,
   CommitWait,
@@ -21,11 +19,11 @@ import type {
   CommitRecordWhere,
   CommitOperationBody,
   ModelOperationAction,
-} from '../wire/commit.js';
-import type { LogListResponse, LogQuery } from '../wire/feedEvent.js';
-import type { ModelListEvidence } from '../wire/modelResponses.js';
-import { AbloValidationError } from '../errors.js';
-// Re-exported, not redeclared. `wire/commit.ts` owns the commit-status vocabulary
+} from '../../commit/contract.js';
+import type { LogListResponse, LogQuery } from '../../observation/feedContract.js';
+import type { ModelListEvidence } from '../../wire/modelResponses.js';
+import { AbloValidationError } from '../../errors.js';
+// Re-exported, not redeclared. `commit/contract.ts` owns the commit-status vocabulary
 // and derives the waitable subset from it; this module serves that name to SDK
 // consumers. Restating the subset here as its own union produced a type that
 // matched the canonical one only by both happening to list the same two
@@ -36,36 +34,33 @@ export type { CommitWait };
 // claim view) are defined in `../coordination/schema`, derived from a single
 // schema so the client, the HTTP client, and the server share one definition.
 // They are re-exported here so the resource types live behind one import.
-import type { ModelTarget, ModelClaim } from '../coordination/schema.js';
+import type { ModelTarget, ModelClaim } from '../../coordination/schema.js';
 export type { ModelTarget, ModelClaim };
-import type { ResolveClaimMeta } from '../types/global.js';
-import type { ParticipantKind } from '../types/participant.js';
-import type { SchemaRecord } from '../schema/schema.js';
-import type { SyncGroupInput } from '../schema/roles.js';
+import type { ResolveClaimMeta } from '../../types/global.js';
+import type { ParticipantKind } from '../../types/participant.js';
+import type { SchemaRecord } from '../../schema/schema.js';
+import type { SyncGroupInput } from '../../schema/roles.js';
 // The capability vocabulary — `auth/capability.ts` owns what a grant is on both
 // axes, and these params are the surface a developer declares it through.
 import type {
   CapabilityCan,
   CapabilityOperation,
   EffectiveAuthority,
-} from '../auth/capability.js';
+} from '../../auth/capability.js';
 import type {
   Claim,
   ClaimStream,
   ClaimWaitOptions,
   Duration,
   HeldClaim,
-} from '../types/streams.js';
+} from '../../types/streams.js';
 import type { ModelUpdater, FunctionalUpdateOptions } from './functionalUpdate.js';
 import type {
   ClaimOptions,
   ClaimAttemptEvent,
-  ClaimParams,
-  ClaimSkipParams,
+  ClaimCall,
   ClaimReadApi,
   AwaitedClaimMethod,
-  ModelTrackParams,
-  ModelTrackResult,
   ModelCreateManyParams,
   ServerReadOptions,
 } from './modelOperations.js';
@@ -74,7 +69,8 @@ import type {
 
 /**
  * The operations available on each model in the sync engine:
- *   `get({ id })` — an async single-row server read
+ *   `get({ id })` — an observational async single-row server read
+ *   `read({ id })` — an async single-row server read that may guard a write
  *   `list({ where })` — an async collection server read
  *   `local.get(id)` / `local.list(...)` / `local.count(...)` — synchronous local reads
  *   `create({ data })` / `update({ id, data })` / `delete({ id })` — writes
@@ -256,7 +252,7 @@ export interface ClaimedOptions {
   readonly ifClaimed?: IfClaimedPolicy;
 }
 
-export type { ClaimWaitOptions } from '../types/streams.js';
+export type { ClaimWaitOptions } from '../../types/streams.js';
 
 export interface ModelReadOptions extends ClaimedOptions {}
 
@@ -307,19 +303,19 @@ export interface ClaimCreateOptions {
 /** Public commit operation inferred from the canonical request-body schema. */
 export type CommitOperationInput = CommitOperationBody;
 
-export interface CommitCreateOptions {
+export type CommitClaim = Omit<Claim<unknown>, 'data'>;
+
+export interface CommitCreateOptions<Read = ReadDependency> {
   readonly idempotencyKey?: string | null;
   readonly readAt?: number | null;
-  readonly onStale?: OnStaleMode | null;
   /**
    * A claim handle from `ablo.<model>.claim({ id })` (or the HTTP claim
    * surface). Same vocabulary as the per-model writes: the handle's
-   * snapshot watermark becomes the batch `readAt` default and `onStale`
-   * defaults to `'reject'`, so a commit that follows a claim is guarded
+   * snapshot watermark becomes the batch `readAt` default, so a commit that follows a claim is guarded
    * against concurrent edits without re-stating the watermark by hand.
-   * Explicit `readAt`/`onStale` on the options win.
+   * An explicit `readAt` on the options wins.
    */
-  readonly claim?: Claim | null;
+  readonly claim?: CommitClaim | null;
   /** One atomic batch. Use a one-element array for a single operation. */
   readonly operations: readonly CommitOperationInput[];
   readonly wait?: CommitWait;
@@ -327,27 +323,17 @@ export interface CommitCreateOptions {
    * The batch premise — the "did anything I looked at change?" guard.
    * Declare the rows (`{ model, id, readAt, fields? }`) or sync groups
    * (`{ group, readAt }`, for example `report:abc`) this batch was premised on; the
-   * server checks that none moved since `readAt` and fires the entry's `onStale`
-   * over the batch. This is distinct from the write-target `readAt`: it guards what
+   * server rejects the batch if any moved since `readAt`. This is distinct from the write-target `readAt`: it guards what
    * you read, not what you write.
    */
-  readonly reads?: readonly ReadDependency[] | null;
-  /**
-   * Durable premises to register as part of this batch — the persisted
-   * sibling of `reads`. Where `reads` guards only this commit, a `track` entry
-   * (`{ model, id, readAt? }` for a row or `{ group, readAt? }` for a sync group)
-   * lives on past it: a later matching change rides back on a future receipt's
-   * `notifications`. A track-only batch (just `track`, an empty `operations`) is
-   * the batch form of `ablo.<model>.track()`.
-   */
-  readonly track?: readonly TrackDependency[] | null;
+  readonly reads?: readonly Read[] | null;
 }
 
 /** Public projection inferred from the canonical runtime schema. */
 export type CommitReceipt = ClientCommitReceipt;
 
-export interface CommitResource {
-  create(options: CommitCreateOptions): Promise<CommitReceipt>;
+export interface CommitResource<Read = ReadDependency> {
+  create(options: CommitCreateOptions<Read>): Promise<CommitReceipt>;
   get(options: { readonly id: string }): Promise<CommitRecord | null>;
   list(options?: CommitRecordListOptions): Promise<CommitRecordList>;
 }
@@ -415,15 +401,16 @@ export interface HttpClaimsResource {
 }
 
 export interface ModelMutationOptions extends ClaimedOptions {
-  readonly claimRef?: string | { readonly id: string } | null;
   readonly idempotencyKey?: string | null;
-  readonly readAt?: number | null;
-  readonly onStale?: OnStaleMode | null;
   /** Commit-lifetime read dependencies checked before this mutation lands. */
   readonly reads?: readonly ReadDependency[] | null;
-  /** Persisted read dependencies registered by this mutation. */
-  readonly track?: readonly TrackDependency[] | null;
   readonly claim?: Claim | ClaimOptions | null;
+}
+
+/** Internal fields derived from a claim or functional update, never authored on a model write. */
+export interface InternalModelMutationOptions extends ModelMutationOptions {
+  readonly claimRef?: string | { readonly id: string } | null;
+  readonly readAt?: number | null;
   /** Fencing token (Option B) from the claim; server-validated at commit. */
   readonly fenceToken?: number | null;
 }
@@ -434,7 +421,7 @@ export interface ModelMutationOptions extends ClaimedOptions {
  * namespace for multi-step handles and coordination screens.
  *
  * It is the same surface as the reactive claim API, but because every read is a
- * server round-trip, `state`, `queue`, and `reorder` are awaited here. The
+ * server round-trip, `state`, `list`, `queue`, and `reorder` are awaited here. The
  * WebSocket client resolves those synchronously from its local cache, which is what
  * lets it read a claim's state inside a React render; a stateless client has no
  * cache to read, so the promise is unavoidable.
@@ -442,19 +429,14 @@ export interface ModelMutationOptions extends ClaimedOptions {
  * It is derived from `ClaimReadApi` through {@link AwaitedClaimMethod} so the two
  * transports cannot drift: the only difference is the promise wrapper that
  * statelessness forces. `claim({ id })` is identical on both (already async);
- * `state`, `queue`, `reorder`, and `release` are the awaited form.
+ * `state`, `list`, `queue`, `reorder`, and `release` are the awaited form.
  */
 export type HttpClaimApi<
   T = Record<string, unknown>,
   Fields = T,
-> =
-  // The try-claim first: `queue: false` resolves `null` on a held target —
-  // an expected outcome, not an error — while the queued default always
-  // resolves a held claim or rejects with a queue error.
-  ((params: ClaimSkipParams<Fields>) => Promise<HeldClaim<T> | null>) &
-  ((params: ClaimParams<Fields>) => Promise<HeldClaim<T>>) & {
-    [K in keyof ClaimReadApi<T>]: AwaitedClaimMethod<ClaimReadApi<T>[K]>;
-  };
+> = ClaimCall<T, Fields> & {
+  [K in keyof ClaimReadApi<T>]: AwaitedClaimMethod<ClaimReadApi<T>[K]>;
+};
 
 /** @internal String-keyed model routing owned by the private HTTP transport. */
 export interface HttpTransportModel<
@@ -470,10 +452,7 @@ export interface HttpTransportModel<
    *
    * Public callers never see this shape; `createAbloHttpClient` unwraps it.
    */
-  /** Canonical point lookup for the schema-agnostic transport. */
-  get(params: ModelReadOptions & { readonly id: string }): Promise<HttpTransportRead<T>>;
-  /** @deprecated Use `get({ id })`; retained for the private transport compatibility seam. */
-  retrieve(params: ModelReadOptions & { readonly id: string }): Promise<HttpTransportRead<T>>;
+  read(params: ModelReadOptions & { readonly id: string }): Promise<HttpTransportRead<T>>;
   /**
    * Collection read over HTTP (server round-trip). Equality `where`, `orderBy`,
    * and `limit`. The typed public client always exposes `ablo.<model>.list`;
@@ -516,13 +495,6 @@ export interface HttpTransportModel<
    * schema-agnostic shape stays inside the HTTP transport.
    */
   claim: HttpClaimApi<T, Fields>;
-  /**
-   * Registers a durable premise on a row — request/response, no socket. A track
-   * declares what a caller is watching; it keeps no local copy of the row, so it
-   * belongs to every transport rather than to the reactive client (ADR 0013 §4).
-   * The typed public clients expose it as `ablo.<model>.track`.
-   */
-  track(params: ModelTrackParams): Promise<ModelTrackResult>;
 }
 
 /** A single data operation a scoped **agent** session may perform on a model.
@@ -571,6 +543,11 @@ export interface CreateUserSessionParams<S extends SchemaRecord> {
 export interface CreateAgentSessionParams<S extends SchemaRecord> {
   /** Your agent. `id` becomes the token's `participantId`. */
   agent: { id: string };
+  /** The authenticated person who started this agent run. The backend holding
+   *  the secret key attests this identity, and every resulting delta records
+   *  the agent as actor plus this user as `onBehalfOf`. Persist the user id on
+   *  durable work before enqueueing it so a later worker can supply it here. */
+  onBehalfOf?: { readonly user: { readonly id: string } };
   /** Per-model operation allowlist, typed against the schema's model names. */
   can: CapabilityCan<S>;
   /** Sync groups this session may subscribe to — typed (`'default'` or
@@ -603,6 +580,9 @@ export interface CreateAgentClientParams<S extends SchemaRecord> {
    *  Pass a stable string only when one logical agent must re-attach to its own
    *  held claims across reconnects or restarts. */
   id?: string;
+  /** The authenticated person who started this run. Preserving it on durable
+   *  work and supplying it here gives every write dual-principal attribution. */
+  onBehalfOf?: { readonly user: { readonly id: string } };
   /** A human-readable label for logs and attribution (carried in `userMeta.name`).
    *  It is independent of `id`: two agents that share a `name` still receive
    *  distinct ids and coordinate as separate participants — `name` never derives or

package/src/{resources → client/resources}/modelCreate.ts

@@ -1,8 +1,8 @@
 /** Canonical create identity and result correlation shared by every client. */
 
 import { v5 as uuidv5 } from 'uuid';
-import { AbloConnectionError } from '../errors.js';
-import type { CommitOperationResult } from '../wire/commit.js';
+import { AbloConnectionError } from '../../errors.js';
+import type { CommitOperationResult } from '../../commit/contract.js';
 
 /** Resolve the two supported single-create id spellings. The sibling wins. */
 export function resolveCreateId(

package/src/{resources → client/resources}/modelOperations.ts

@@ -5,19 +5,18 @@
  * These types describe the *change or the query being requested*, never a local
  * copy of the rows it touches, so they sit in the commit core and are shared
  * by every transport and every caller (ADR 0013 §4, ADR 0016). The factory that
- * binds them to reactive model instances — `createModelProxy` — stays with the
+ * binds them to reactive model instances — `createModelOperations` — stays with the
  * reactive consumer, along with `ModelOperations` and `ModelCollaboration`,
  * which reference the live participant handle.
  */
 
-import type { ModelScope } from '../types/index.js';
-import type { ResolveClaimMeta } from '../types/global.js';
-import type { AbloError } from '../errors.js';
-import type { StaleNotification, TrackDependency } from '../coordination/schema.js';
-import type { FieldRef, FieldSelector } from '../schema/fieldRef.js';
-import type { BaseModelFields, Clearable } from '../schema/schema.js';
-import type { ClaimHeartbeatPlan } from '../coordination/claimHeartbeatLoop.js';
-import type { Duration } from '../utils/duration.js';
+import type { ModelScope } from '../../types/index.js';
+import type { ResolveClaimMeta } from '../../types/global.js';
+import type { AbloError } from '../../errors.js';
+import type { FieldRef, FieldSelector } from '../../schema/fieldRef.js';
+import type { BaseModelFields, Clearable } from '../../schema/schema.js';
+import type { ClaimHeartbeatPlan } from '../../claims/heartbeat.js';
+import type { Duration } from '../../utils/duration.js';
 import type {
   Claim,
   ClaimHeartbeat,
@@ -25,7 +24,7 @@ import type {
   HeldClaim,
   HeldLease,
   Peer,
-} from '../types/streams.js';
+} from '../../types/streams.js';
 import type { MutationOptions } from './mutationOptions.js';
 import type { LoadWhere } from './where.js';
 
@@ -142,34 +141,6 @@ export function claimAttemptFailure(
  */
 export type ModelListScope = ModelScope | `${ModelScope}`;
 
-/**
- * Options for `track({ id })` — register a durable premise on a row.
- *
- * Derived from the wire's row-form {@link TrackDependency} rather than restated
- * beside it: the caller names the row and, optionally, the watermark it is
- * premised on, while `model` comes from the proxy the call was made on. Adding
- * a field to the dependency therefore reaches this surface automatically, and
- * removing one stops the callers compiling.
- *
- * On `readAt`: omit it to baseline at the current head — "tell me about
- * anything from here on". Pass a known watermark (the one you read the row at)
- * to also catch a change that landed between that read and this call.
- */
-export type ModelTrackParams = Omit<
-  Extract<TrackDependency, { model: string }>,
-  'model'
->;
-
-/** The result of `track({ id })`. */
-export interface ModelTrackResult {
-  /**
-   * Tracks that had ALREADY fired at registration time — a change matching an
-   * open track that landed before this call. Present only when something was
-   * already stale; the ongoing signal arrives on the receipts of later commits.
-   */
-  notifications?: StaleNotification[];
-}
-
 /** Options for the synchronous local-graph reads `local.list` and `onChange` —
  *  a JavaScript `filter`, an equality `where`, and a lifecycle `state`. This is
  *  the local, reactive axis; contrast {@link ServerReadOptions}, the
@@ -191,7 +162,7 @@ export type LocalCountOptions<T> = Pick<
   'where' | 'filter' | 'state'
 >;
 
-/** Options for the asynchronous server reads `get` and `list` — the
+/** Options for the asynchronous server reads `read` and `list` — the
  *  operator `where` filter, `type`, and `expand`. This is the server axis;
  *  contrast {@link LocalReadOptions}, the local, reactive axis. */
 export interface ServerReadOptions<T> {
@@ -240,11 +211,9 @@ export interface ListAllOptions<T> extends Omit<ServerReadOptions<T>, 'cursor'>
   signal?: AbortSignal;
 }
 
-/** Options for the single-row async server read `get({ id })`. A subset of
+/** Options for the single-row async server `read({ id })`. A subset of
  *  {@link ServerReadOptions} — `where`/`limit`/`orderBy` are fixed by the id. */
-export type ServerRetrieveOptions = Pick<ServerReadOptions<unknown>, 'type' | 'expand'>;
-/** Canonical point-lookup options; retained separately for compatibility naming. */
-export type ServerGetOptions = ServerRetrieveOptions;
+export type ServerPointReadOptions = Pick<ServerReadOptions<unknown>, 'type' | 'expand'>;
 /**
  * A claimable part of a row is a field declared by that model's Zod shape.
  *
@@ -535,15 +504,26 @@ export interface ClaimReadApi<T = Record<string, unknown>> {
  * stateless HTTP claim surface from the reactive {@link ClaimReadApi}.
  */
 export type AwaitedClaimMethod<F> = F extends (...args: infer A) => infer R
-  ? R extends Promise<unknown>
+  // `[R]` keeps the check non-distributive. `state` returns `Claim | null`, and
+  // a bare `R extends …` split that into two function types, one per union
+  // member, so the HTTP `state` was typed as a union of functions rather than
+  // one function returning the union. The cast that hid it is gone.
+  ? [R] extends [Promise<unknown>]
     ? (...args: A) => R
     : (...args: A) => Promise<R>
   : F;
 
-export interface ClaimApi<
+/**
+ * The four ways to take a claim. Already async on every transport, so this is
+ * the ONE definition of the callable half of a claim namespace: the reactive
+ * {@link ClaimApi} and the stateless {@link HttpClaimApi} both extend it, and an
+ * overload added here reaches both. (The two used to restate these by hand, and
+ * the row-free pair below existed on one surface and not the other.)
+ */
+export interface ClaimCall<
   T,
   Fields = T,
-> extends ClaimReadApi<T> {
+> {
   /**
    * The try-claim: `contention: { mode: 'skip' }` (or `queue: false`)
    * treats a held target as an expected outcome, not an error — it resolves
@@ -558,23 +538,31 @@ export interface ClaimApi<
    * Takes a claim and returns an explicit held-work handle — a {@link HeldClaim}.
    * `data`, `release`, `revoke`, and the async disposer are always present (this
    * call re-reads the row under the lease), so callers can use `handle.data`
-   * directly and `await using` works without a guard.
+   * directly and `await using` works without a guard. A row that does not
+   * exist rejects with `AbloNotFoundError` after the lease is given back; to
+   * hold a key before its row exists, use the id-only form below.
    */
   (params: ClaimParams<Fields>): Promise<HeldClaim<T>>;
   /** The row-free try-claim — `null` when the key is already held. */
   (id: string, opts: ClaimSkipOptions<Fields>): Promise<HeldLease | null>;
   /**
    * Takes a claim by id alone, for a row that lives only in the customer's own
-   * database — Ablo has never seen it, so there is nothing to re-read. Returns a
-   * {@link HeldLease}: the same lease controls as {@link HeldClaim}
-   * (`release`, `revoke`, `heartbeat`, `await using`) but no `.data`. Locking a
-   * key you know by id is exactly this — serialize writers without first
-   * syncing the row into Ablo.
+   * database or does not exist yet — Ablo has nothing to re-read, so no read is
+   * made after the grant. Returns a {@link HeldLease}: the same lease controls
+   * as {@link HeldClaim} (`release`, `revoke`, `heartbeat`, `await using`) but
+   * no `.data`. Locking a key you know by id is exactly this — serialize
+   * writers without first syncing the row into Ablo, or claim an id before
+   * creating its row so two actors cannot both create it.
    */
   (id: string, opts?: ClaimOptions<Fields>): Promise<HeldLease>;
 }
 
-export interface ModelRetrieveParams extends ServerRetrieveOptions {
+export interface ClaimApi<
+  T,
+  Fields = T,
+> extends ClaimReadApi<T>, ClaimCall<T, Fields> {}
+
+export interface ModelReadParams extends ServerPointReadOptions {
   readonly id: string;
 }
 
@@ -587,7 +575,10 @@ export interface ModelRetrieveParams extends ServerRetrieveOptions {
  * confirmation. Callers that need an earlier queued receipt use the lower-level
  * `commits.create` resource instead.
  */
-export type ModelWriteOptions = Omit<MutationOptions, 'wait'>;
+export type ModelWriteOptions = Omit<
+  MutationOptions,
+  'wait' | 'readAt' | 'fenceToken' | 'claimRef'
+>;
 
 export interface ModelCreateParams<T, CreateInput>
   extends ModelWriteOptions {
@@ -606,7 +597,7 @@ export interface ModelCreateParams<T, CreateInput>
  */
 export type ModelCreateManyParams<CreateInput> = Pick<
   ModelWriteOptions,
-  'idempotencyKey' | 'reads' | 'track'
+  'idempotencyKey' | 'reads'
 > & {
   readonly data: readonly CreateInput[];
 };

package/src/{resources → client/resources}/mutationOptions.ts

@@ -7,8 +7,8 @@
  * core rather than the reactive consumer (ADR 0013 §4, ADR 0016).
  */
 
-import type { CommitWait } from '../wire/commit.js';
-import type { OnStaleMode, ReadDependency, TrackDependency } from '../coordination/schema.js';
+import type { CommitWait } from '../../commit/contract.js';
+import type { ReadDependency } from '../../coordination/schema.js';
 
 /**
  * Per-call options accepted by any mutation, passed as the last argument.
@@ -27,7 +27,6 @@ export interface MutationOptions {
   label?: string;
   wait?: CommitWait;
   readAt?: number | null;
-  onStale?: OnStaleMode | null;
   /**
    * The fencing token (Option B) of the held claim this write belongs to. The
    * server validates it against the entity's persisted high-water and rejects a
@@ -43,24 +42,12 @@ export interface MutationOptions {
    * The batch premise — the answer to "did anything I looked at change?" Each
    * entry is a row (`{ model, id, readAt, fields? }`) or a sync group
    * (`{ group, readAt }`) that this write was premised on. The server checks
-   * that none of them moved since their `readAt` and applies the entry's
-   * `onStale` behavior to the whole batch. This is distinct from the per-operation
+   * that none of them moved since their `readAt`; a stale dependency rejects the
+   * whole batch. This is distinct from the per-operation
    * `readAt`, which guards only the row being written.
    *
    * See `packages/ablo/docs/concurrency-convention.md` (§3 the two
    * premises, §4 the batch premise) for the governing convention.
    */
   reads?: ReadDependency[] | null;
-  /**
-   * Durable premises — what this write (or the record it produces) should
-   * keep watching. Unlike `reads`, which is checked once at commit and discarded,
-   * each `track` entry is persisted and re-checked against every future delta; a
-   * later matching change opens a `StaleNotification` for the tracking participant,
-   * delivered at their next commit or live to a held claim. Each entry is a row
-   * (`{ model, id }`) or a sync group (`{ group }`), optionally pinned to a `readAt`
-   * baseline (defaults to this commit's watermark).
-   *
-   * See `packages/ablo/docs/groups.md` for how `track` drives propagation.
-   */
-  track?: TrackDependency[] | null;
 }

package/src/{resources → client/resources}/where.ts

@@ -15,7 +15,7 @@
 
 import { z } from 'zod';
 
-import { AbloValidationError } from '../errors.js';
+import { AbloValidationError } from '../../errors.js';
 
 /** Primitive operand types allowed in a where clause. */
 export const wherePrimitiveSchema = z.union([

package/src/{resources → client/resources}/writeOptionsSchema.ts

@@ -2,7 +2,7 @@
  * The Zod schema for write options — the settings accepted by every write
  * entry point, including `ablo.<model>.create/update/delete`, `commits.create`,
  * and the HTTP write routes. Each of those boundaries validates against this
- * one schema, so a caller who passes, say, `onStale: 'rejct'` fails right away
+ * one schema, so a caller who passes a malformed option fails right away
  * with a typed {@link AbloValidationError} at the call site instead of silently
  * or with a 400 from the server.
  *
@@ -17,25 +17,12 @@
  */
 
 import { z } from 'zod';
-import { logPositionSchema } from '../syncLog/contract.js';
-import type { MutationOptions } from '../resources/mutationOptions.js';
-import { AbloValidationError } from '../errors.js';
-import { commitWaitSchema } from '../wire/commit.js';
-import {
-  onStaleModeSchema,
-  MAX_READ_SET_ENTRIES,
-  readDependencyListSchema,
-  readSetProjectionEntryCount,
-  trackDependencyListSchema,
-} from '../coordination/schema.js';
-import type { AssertExact } from '../types/assertExact.js';
-
-// Re-exported, not redeclared. `coordination/schema.ts` owns this enum — it is
-// what the wire schemas and the server validate against — while the published
-// SDK barrel exports the name from this module. Declaring it twice put a second
-// object behind the public export that agreed with the canonical one only by
-// both happening to list the same three strings.
-export { onStaleModeSchema };
+import { logPositionSchema } from '../../syncLog/contract.js';
+import type { MutationOptions } from './mutationOptions.js';
+import { AbloValidationError } from '../../errors.js';
+import { commitWaitSchema } from '../../commit/contract.js';
+import { readDependencyListSchema } from '../../coordination/schema.js';
+import type { AssertExact } from '../../types/assertExact.js';
 
 export const writeOptionsSchema = z.object({
   /** Idempotency key the server records in `mutation_log` to make retries
@@ -47,8 +34,6 @@ export const writeOptionsSchema = z.object({
   wait: commitWaitSchema.optional(),
   /** Stale guard: the sync watermark the caller's reasoning was based on. */
   readAt: logPositionSchema.nullish(),
-  /** What the server does when the target moved past `readAt`. */
-  onStale: onStaleModeSchema.nullish(),
   /** The held claim's fencing token (Option B), sourced from the claim handle
    *  rather than set by hand; the server validates it against the entity's
    *  high-water. Kept in the schema so it stays aligned with `MutationOptions`
@@ -61,11 +46,6 @@ export const writeOptionsSchema = z.object({
   claimRef: z.union([z.string(), z.object({ id: z.string() })]).nullish(),
   /** Commit-lifetime entries in the write's ReadSet. */
   reads: readDependencyListSchema.nullish(),
-  /** Persisted entries projected from the write's ReadSet. */
-  track: trackDependencyListSchema.nullish(),
-}).refine((value) => readSetProjectionEntryCount(value) <= MAX_READ_SET_ENTRIES, {
-  path: ['reads'],
-  message: `reads and track may contain at most ${MAX_READ_SET_ENTRIES} entries combined`,
 });
 
 export type WriteOptionsInput = z.infer<typeof writeOptionsSchema>;

package/src/{transactions → commit}/confirmation/commitEnvelope.ts

@@ -8,14 +8,9 @@
  */
 
 import { z } from 'zod';
-import {
-  MAX_READ_SET_ENTRIES,
-  readDependencyListSchema,
-  readSetProjectionEntryCount,
-  trackDependencyListSchema,
-} from '../../coordination/schema.js';
+import { readDependencyListSchema } from '../../coordination/schema.js';
 import { wireCommitOperationSchema } from '../../wire/frames.js';
-import { correlationIdSchema } from '../../wire/commit.js';
+import { correlationIdSchema } from '../contract.js';
 import { idempotencyKeySchema } from './idempotencyKey.js';
 import { snapshotJsonValue } from '../../utils/json.js';
 
@@ -48,7 +43,6 @@ export const durableCommitOperationSchema = wireCommitOperationSchema
     transactionId: true,
     claimId: true,
     readAt: true,
-    onStale: true,
     fenceToken: true,
   })
   .extend({
@@ -70,10 +64,6 @@ export type DurableCommitOperationInput = z.input<typeof durableCommitOperationS
 
 const durableCommitOptionsSchema = z.strictObject({
   reads: readDependencyListSchema.nullable().optional(),
-  track: trackDependencyListSchema.nullable().optional(),
-}).refine((value) => readSetProjectionEntryCount(value) <= MAX_READ_SET_ENTRIES, {
-  path: ['reads'],
-  message: `reads and track may contain at most ${MAX_READ_SET_ENTRIES} entries combined`,
 });
 
 export const commitOutboxScopeSchema = z.strictObject({

package/src/{transactions → commit}/confirmation/httpCommitEnvelope.ts

@@ -3,7 +3,7 @@
 import { z } from 'zod';
 import { v5 as uuidv5 } from 'uuid';
 import { snapshotJsonValue, stableStringify } from '../../utils/json.js';
-import { correlationIdSchema } from '../../wire/commit.js';
+import { correlationIdSchema } from '../contract.js';
 import { PROTOCOL_VERSION } from '../../wire/protocolVersion.js';
 import { idempotencyKeySchema } from './idempotencyKey.js';
 

package/src/{transactions → commit}/confirmation/pendingWrite.ts

@@ -8,7 +8,7 @@
  * this module only unions them.
  *
  * The port that persists these records is a behavior contract, not a persisted
- * shape, so it lives outside this directory in `src/durableWrites.ts`.
+ * shape, so it lives outside this directory in `src/commit/durableWrites.ts`.
  */
 
 import { z } from 'zod';