@abloatai/humans 0.59.1 → 0.60.0

package/README.md

@@ -25,7 +25,7 @@ import { Ablo } from '@abloatai/ablo/client';
 
 const ablo = Ablo({
   schema,
-  authEndpoint: '/api/ablo-session',
+  session: { endpoint: '/api/ablo-session' },
 });
 
 await ablo.ready();

package/dist/Ablo.d.ts

@@ -50,11 +50,11 @@ export type Ablo<S extends SchemaRecord> = AbloClient<S>;
  * ```
  *
  * In the browser (or any client that shouldn't hold a secret key), point
- * `authEndpoint` at your session-mint route instead — the SDK fetches it, keeps the
+ * `session.endpoint` at your session-mint route instead — the SDK fetches it, keeps the
  * short-lived token fresh, and re-mints on expiry:
  *
  * ```ts
- * const ablo = Ablo({ schema, authEndpoint: '/api/ablo-session' });
+ * const ablo = Ablo({ schema, session: { endpoint: '/api/ablo-session' } });
  * ```
  *
  * Server-side agents, workers, and services use `@abloatai/transaction`.
@@ -64,7 +64,6 @@ export declare function Ablo<const S extends SchemaRecord, const P extends reado
 }): Ablo<S> & MergedSurface<P>;
 export declare function Ablo<const S extends SchemaRecord>(options: AbloOptions<S>): Ablo<S>;
 import type * as _Streams from '@abloatai/transaction/types/streams';
-import type * as _Participants from './local/sync/participants.js';
 import type * as _Mutators from './local/mutators/defineMutators.js';
 import type * as _Tx from './local/mutators/Transaction.js';
 import type * as _Undo from './local/mutators/UndoManager.js';
@@ -110,13 +109,6 @@ export declare namespace Ablo {
     namespace Auth {
         type Actor = _Streams.ParticipantRef;
     }
-    namespace Participant {
-        type Manager = _Participants.ParticipantManager;
-        type Joined = _Participants.JoinedParticipant;
-        type Scope = _Participants.ParticipantScope;
-        type Status = _Participants.ParticipantStatus;
-        type JoinOptions = _Participants.ParticipantJoinOptions;
-    }
     type Schema<S extends _SchemaTypes.SchemaRecord = _SchemaTypes.SchemaRecord> = _SchemaTypes.Schema<S>;
     /**
      * The schema this program has registered via `interface Register { Schema }`

package/dist/Ablo.js

@@ -115,6 +115,5 @@ export function Ablo(options) {
         transport,
         presence: humansSurface.presence,
         cluster,
-        createSibling: (siblingOptions) => Ablo(siblingOptions),
     }), installedPlugins);
 }

package/dist/client.d.ts

@@ -17,7 +17,7 @@ import type { SyncStoreContract } from './react/context.js';
 import type { SyncWebSocket, CoreSyncEventMap } from './local/sync/SyncWebSocket.js';
 import type { SyncStatus } from './local/BaseSyncedStore.js';
 import type { ModelOperations } from './local/client/createModelOperations.js';
-import type { ClaimResource, CommitResource, CreateAgentClientParams, SessionResource } from '@abloatai/transaction/client/resources/httpResources';
+import type { ClaimResource, CommitResource } from '@abloatai/transaction/client/resources/httpResources';
 import type { EffectiveAuthority } from '@abloatai/transaction/auth';
 import type { ReadDependency } from '@abloatai/transaction/coordination';
 import type { CapturedRow } from '@abloatai/transaction/transport/http';
@@ -102,53 +102,6 @@ export type AbloClient<S extends SchemaRecord> = {
      * the watchdog.
      */
     nudgeReconnect(): void;
-    /**
-     * Mint a short-lived, scoped session token for one end user. Call this on your
-     * backend, where the `sk_` secret key lives, then hand the returned `token` to
-     * that user's browser — typically through a token route the browser's `apiKey`
-     * resolver fetches. The browser presents the token as its bearer, and the
-     * server verifies it. The browser must never see the `sk_` key, only the
-     * per-user session token.
-     *
-     * Pass `{ user: { id }, can: { items: ['read', 'update'] } }` for an end-user
-     * session. It mints an `ek_` and attributes writes to a user (recorded as
-     * `actor_kind` on the delta row). Pass `{ agent: { id }, can: {
-     * items: ['update'] } }` for a scoped agent session, which mints an `rk_`.
-     * Both kinds require `can`, typed against your schema's model names. This
-     * always authenticates with the original `sk_`, never the client's exchanged
-     * sync credential.
-     */
-    sessions: SessionResource<S>;
-    /**
-     * Mint a scoped **agent identity** and return a ready-to-use client bound to
-     * it — the `ablo.<resource>.<verb>` shape for the agent use case. One call
-     * replaces `sessions.create({ agent, can })` + constructing a second
-     * `Ablo({ apiKey: token })`:
-     *
-     * ```ts
-     * const agent = await ablo.agents.create({
-     *   name: 'researcher',                  // readable label (optional)
-     *   can: { records: ['read', 'update'] },
-     *   // id omitted → a fresh uuid: a distinct, independent participant
-     * });
-     * await agent.records.update({ id, data, claim });
-     * await agent.dispose(); // when the agent is done
-     * ```
-     *
-     * Server-side only: it requires the `sk_` secret key (like `sessions.create`)
-     * and throws `AbloAuthenticationError` in the browser. The returned client
-     * holds its own auto-refreshing `rk_`, so a long run never hits token expiry,
-     * and the `sk_` never leaves this process. Each call is a distinct participant
-     * by default (omit `id` for a fresh uuid), so even two agents sharing a `name`
-     * queue behind one another on a contended row — `name` is display only and
-     * never collapses identity. Humans don't get a server-built client; ship them a
-     * token via `sessions.create({ user, can })`. If you need the raw token for
-     * revocation, or a stable re-attachable id, use `sessions.create({ agent, can })`
-     * or pass `id`.
-     */
-    agents: {
-        create(params: CreateAgentClientParams<S>): Promise<AbloClient<S>>;
-    };
     /**
      * The organization this client resolved to — `null` until `ready()`
      * completes. Use it instead of scraping CLI output or hardcoding env vars:

package/dist/local/BaseSyncedStore.d.ts

@@ -13,7 +13,7 @@
 import type { RecoveryClass } from '@abloatai/transaction/errorCodes';
 import { ConnectionManager } from './sync/ConnectionManager.js';
 import { SubscriptionManager } from './sync/SubscriptionManager.js';
-import { type ParticipantScope } from './sync/participants.js';
+import { type GroupScope } from './sync/scopeGroups.js';
 import type { SyncClient } from './SyncClient.js';
 import type { Database, BootstrapResult, BootstrapRequirements } from './Database.js';
 import type { InstanceCache } from './InstanceCache.js';
@@ -254,7 +254,7 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
      * Hydration is best-effort — a failed backfill never rejects `enterScope`,
      * and the live delta stream keeps flowing regardless.
      */
-    enterScope(scope: ParticipantScope, opts?: {
+    enterScope(scope: GroupScope, opts?: {
         hydrate?: boolean;
     }): Promise<void>;
     /**
@@ -266,11 +266,11 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
      */
     protected hydrateGroups(syncGroups: readonly string[]): Promise<void>;
     /** Leave a scope → its groups go warm (hysteresis), then drop on sweep. */
-    leaveScope(scope: ParticipantScope): Promise<void>;
+    leaveScope(scope: GroupScope): Promise<void>;
     /** Pin a scope (active claim / prominence) → never warms while pinned. */
-    pinScope(scope: ParticipantScope): Promise<void>;
+    pinScope(scope: GroupScope): Promise<void>;
     /** Release a pin → the group transitions to warm rather than dropping. */
-    unpinScope(scope: ParticipantScope): Promise<void>;
+    unpinScope(scope: GroupScope): Promise<void>;
     protected readonly queryProcessor: QueryProcessor;
     /**
      * Runtime behavior flags only — the schema/config arrays
@@ -647,9 +647,7 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
      * (no plugins installed) and the `humans()` apply handler both call it.
      */
     applyChangesToPool(changes: readonly AppliedChange[]): void;
-    /** Get fields that represent meaningful state for deduplication. Override for model-specific fields. */
-    protected getStateFields(_modelName: string): string[];
-    /** Deduplicate deltas to the same entity — keep meaningful state transitions only */
+    /** Deduplicate repeated delivery of the same positive sync id. */
     protected deduplicateDeltas(deltas: SyncDelta[]): SyncDelta[];
     /** Process incoming delta with smart batching */
     protected processDeltaWithBatching(delta: SyncDelta): void;

package/dist/local/BaseSyncedStore.js

@@ -15,7 +15,7 @@ import { AbloConnectionError, AbloValidationError, toAbloError } from '@abloatai
 import { ConnectionManager } from './sync/ConnectionManager.js';
 import { contextLogger, contextSocketObservability } from './sync/contextPorts.js';
 import { SubscriptionManager } from './sync/SubscriptionManager.js';
-import { resolveParticipantSyncGroups, } from './sync/participants.js';
+import { resolveScopeGroups, } from './sync/scopeGroups.js';
 import { ModelRegistry } from './ModelRegistry.js';
 import { PropertyType } from '@abloatai/transaction/types';
 import { SyncWebSocket, } from './sync/SyncWebSocket.js';
@@ -180,7 +180,7 @@ export class BaseSyncedStore {
     // {@link SubscriptionManager.reconcile}); the on-connect `resync` pushes
     // whatever interest accumulated.
     scopeToGroups(scope) {
-        return resolveParticipantSyncGroups(scope, this.schema);
+        return resolveScopeGroups(scope, this.schema);
     }
     /**
      * Bring a scope into view and subscribe to its sync groups. With
@@ -1179,7 +1179,6 @@ export class BaseSyncedStore {
             acknowledge: (syncId) => { this.syncWebSocket.acknowledge(syncId); },
             get objectPool() { return store.objectPool; },
             // Dynamic-dispatch hooks — protected override points on this class.
-            getStateFields: (modelName) => this.getStateFields(modelName),
             isCustomEntity: (modelName) => this.isCustomEntity(modelName),
             createCustomEntity: (modelName, modelId, data) => this.createCustomEntity(modelName, modelId, data),
             deduplicateDeltas: (deltas) => this.deduplicateDeltas(deltas),
@@ -1202,13 +1201,9 @@ export class BaseSyncedStore {
     applyChangesToPool(changes) {
         this.syncClient.applyDeltaBatchToPool(changes, (name, data) => this.enrichRelations(name, data));
     }
-    /** Get fields that represent meaningful state for deduplication. Override for model-specific fields. */
-    getStateFields(_modelName) {
-        return ['status', 'state', 'isActive'];
-    }
-    /** Deduplicate deltas to the same entity — keep meaningful state transitions only */
+    /** Deduplicate repeated delivery of the same positive sync id. */
     deduplicateDeltas(deltas) {
-        return deltaPipeline.deduplicateDeltas(this.deltaPipelineContext, deltas);
+        return deltaPipeline.deduplicateDeltas(deltas);
     }
     /** Process incoming delta with smart batching */
     processDeltaWithBatching(delta) {

package/dist/local/Model.js

@@ -306,7 +306,7 @@ export class Model {
      */
     capturePreviousValues(keys, opts) {
         const out = {};
-        const modified = this.modifiedProperties instanceof Map ? this.modifiedProperties : null;
+        const modified = this.modifiedProperties;
         const original = this.getOriginalSnapshot();
         for (const key of keys) {
             if (key === 'id')
@@ -334,7 +334,7 @@ export class Model {
      * is never consumed. With no `keys`, consumes every tracked field.
      */
     consumeModifiedFields(keys) {
-        if (!(this.modifiedProperties instanceof Map) || this.modifiedProperties.size === 0) {
+        if (this.modifiedProperties.size === 0) {
             return;
         }
         const only = keys ? new Set(keys) : null;

package/dist/local/SyncClient.d.ts

@@ -186,9 +186,9 @@ export declare class SyncClient extends EventEmitter {
      */
     private captureModelChanges;
     /** Add new model (CREATE) - works offline */
-    add(model: Model, options?: WriteOptions): void;
+    add(model: Model, options?: WriteOptions): Promise<void> | undefined;
     /** Update existing model (UPDATE) - works offline */
-    update(model: Model, options?: WriteOptions): void;
+    update(model: Model, options?: WriteOptions, capturedChanges?: Record<string, unknown>): Promise<void> | undefined;
     /**
      * Update existing model with pre-computed changes.
      * Used by saveManyOptimized when incoming models have empty change-tracking
@@ -200,7 +200,7 @@ export declare class SyncClient extends EventEmitter {
      *  but still need optimistic pool updates at the sync layer. */
     get gql(): import("./interfaces/index.js").MutationExecutor;
     /** Delete model (DELETE) - works offline */
-    delete(model: Model, options?: WriteOptions): void;
+    delete(model: Model, options?: WriteOptions): Promise<void> | undefined;
     /**
      * Upload a file and create its attachment record. The upload runs through
      * the {@link MutationQueue}, and a model is built from the server's

package/dist/local/SyncClient.js

@@ -10,7 +10,7 @@
 import { runInAction } from 'mobx';
 import { InstanceCache, ModelScope } from './InstanceCache.js';
 import { Model } from './Model.js';
-import { snapshotJsonValue } from '@abloatai/transaction/utils/json';
+import { deepEqual, snapshotJsonValue } from '@abloatai/transaction/utils/json';
 // ModelRegistry instance accessed via this.objectPool.registry
 import { LoadStrategy } from '@abloatai/transaction/types';
 import { globalRuntime } from './context.js';
@@ -758,7 +758,7 @@ export class SyncClient extends EventEmitter {
      * capturing first ensures those changes are never lost. The captured set is
      * frozen and handed to {@link queueMutation}.
      */
-    mutate(type, model, poolAction, writeOptions) {
+    mutate(type, model, poolAction, writeOptions, capturedChangesOverride) {
         // No-op UPDATE guard (O(1)). An update with no dirty fields would travel
         // to the server, get dropped by `coalesceOperations` Rule 4 (empty input),
         // and — if it was the only op — come back as `lastSyncId: 0`. That trips
@@ -772,21 +772,28 @@ export class SyncClient extends EventEmitter {
         // is false → we fall through to the normal path rather than risk dropping a
         // real write. Only a genuine Model with an empty dirty-set is skipped.
         const hasChanges = model.hasChanges;
-        if (type === 'update' && hasChanges === false) {
-            return;
+        if (type === 'update' &&
+            hasChanges === false &&
+            capturedChangesOverride === undefined) {
+            return Promise.resolve();
         }
         // Capture changes before the pool action runs. Pool operations —
         // upsert in particular — can clear the model's local changes, so
         // capturing first ensures they are never lost.
-        const capturedChanges = type === 'update' || type === 'create' ? this.captureModelChanges(model) : undefined;
+        const capturedChanges = capturedChangesOverride !== undefined
+            ? Object.freeze({ ...capturedChangesOverride })
+            : type === 'update' || type === 'create'
+                ? this.captureModelChanges(model)
+                : undefined;
         poolAction();
-        this.stageMutation(type, model, capturedChanges, writeOptions);
+        const confirmation = this.stageMutation(type, model, capturedChanges, writeOptions);
         this.notifyObservers({
             type,
             modelType: model.getModelName(),
             model: type !== 'delete' ? model : undefined,
             modelId: model.id,
         });
+        return confirmation;
         // QueryProcessor uses `models:changed` to invalidate caches. Coalesce
         // to one event per microtask: a paste of 100 rows should re-run
         // affected queries ONCE, not 100×.
@@ -821,11 +828,11 @@ export class SyncClient extends EventEmitter {
     }
     /** Add new model (CREATE) - works offline */
     add(model, options) {
-        this.mutate('create', model, () => { this.objectPool.add(model, ModelScope.live); }, options);
+        return this.mutate('create', model, () => { this.objectPool.add(model, ModelScope.live); }, options);
     }
     /** Update existing model (UPDATE) - works offline */
-    update(model, options) {
-        this.mutate('update', model, () => { this.objectPool.upsert(model, ModelScope.live); }, options);
+    update(model, options, capturedChanges) {
+        return this.mutate('update', model, () => { this.objectPool.upsert(model, ModelScope.live); }, options, capturedChanges);
     }
     /**
      * Update existing model with pre-computed changes.
@@ -867,7 +874,7 @@ export class SyncClient extends EventEmitter {
     delete(model, options) {
         // Clear pending mutations first to prevent "not found" errors on fast delete
         this.mutationQueue.cancelTransactionsForModel(model.id);
-        this.mutate('delete', model, () => this.objectPool.remove(model.id), options);
+        return this.mutate('delete', model, () => this.objectPool.remove(model.id), options);
     }
     /**
      * Upload a file and create its attachment record. The upload runs through
@@ -979,13 +986,20 @@ export class SyncClient extends EventEmitter {
     /** Stage one mutation through the queue, which owns durability and execution. */
     stageMutation(type, model, capturedChanges, writeOptions) {
         if (this.isDisposed)
-            return;
+            return Promise.resolve();
         if (!this.userId || !this.organizationId) {
             this.mutationQueue.deferMutation(type, model, capturedChanges, writeOptions);
             return;
         }
         const context = { userId: this.userId, organizationId: this.organizationId };
         const staging = this.mutationQueue.enqueueModelMutation(type, model, context, capturedChanges, writeOptions);
+        const confirmation = staging.then(async (transaction) => {
+            await transaction.confirmation;
+        });
+        // Most internal callers intentionally use fire-and-forget writes. Observe
+        // their rejection without replacing the exact promise returned to model
+        // operations that need authoritative per-transaction confirmation.
+        void confirmation.catch(() => undefined);
         const pending = staging.then(() => undefined).catch((error) => {
             this.runtime.observability.captureMutationFailure({
                 context: `stage-mutation-${type}`,
@@ -996,6 +1010,7 @@ export class SyncClient extends EventEmitter {
         });
         this.pendingStages.add(pending);
         void pending.finally(() => this.pendingStages.delete(pending));
+        return confirmation;
     }
     scheduleSync() {
         if (!this.runtime.onlineStatus.isOnline() || this.isDisposed)
@@ -1588,6 +1603,25 @@ export class SyncClient extends EventEmitter {
             // otherwise re-add it for the brief window before the matching delete
             // confirmation lands.
             if (this.echoTracker.consumeEcho(transactionId)) {
+                // A direct assignment can re-enter change tracking while this
+                // optimistic write is in flight. Leaving the acknowledged field dirty
+                // makes conflict resolution preserve it over the next collaborator
+                // delta, so peers appear desynchronized until refresh.
+                //
+                // Re-baseline only values this echo actually confirms. If the user has
+                // edited the same field again since the write was sent, its current
+                // dirty value differs from the echo and remains queued.
+                if (resident && result.data) {
+                    const acknowledgedFields = [];
+                    for (const [field, change] of resident.modifiedProperties) {
+                        if (Object.prototype.hasOwnProperty.call(result.data, field) &&
+                            deepEqual(change.new, result.data[field])) {
+                            acknowledgedFields.push(field);
+                        }
+                    }
+                    resident.consumeModifiedFields(acknowledgedFields);
+                    resident.markAsSynced();
+                }
                 continue;
             }
             // If a later op in this batch will remove this id, skip earlier

package/dist/local/client/createModelOperations.d.ts

@@ -6,7 +6,7 @@
  * `read` and `list`, with the same point lookup restricted to the local graph under
  * `local`, the writes `create`, `update`, and `delete`, the coordination
  * namespace `claim` (callable as `claim({ id })`, plus `claim.state`,
- * `claim.queue`, `claim.release`, and `claim.reorder`), `join`, and `onChange`.
+ * `claim.queue`, `claim.release`, and `claim.reorder`), and `onChange`.
  * The factory returns a plain object; the client assembles the `ablo.<model>`
  * lookup table from one of these per model.
  */
@@ -16,11 +16,10 @@ import type { ModelRegistry } from '../ModelRegistry.js';
 import type { InstanceCache } from '../InstanceCache.js';
 import type { SyncClient } from '../SyncClient.js';
 import type { OnDemandLoader } from '../sync/OnDemandLoader.js';
-import type { JoinedParticipant } from '../sync/participants.js';
 import type { Duration, Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease, ClaimWaitOptions } from '@abloatai/transaction/types/streams';
-export type { ModelListScope, LocalReadOptions, LocalCountOptions, ServerReadOptions, ListAllOptions, ServerPointReadOptions, ClaimTargetOptions, ClaimParams, ClaimContentionOptions, ClaimAttemptEvent, ClaimQueueView, ClaimSkipOptions, ClaimSkipParams, ClaimLookupParams, ClaimReorderParams, ClaimOptions, ClaimReadApi, AwaitedClaimMethod, ClaimApi, ModelReadParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, JoinOptions, } from '@abloatai/transaction/client/resources/modelOperations';
+export type { ModelListScope, LocalReadOptions, LocalCountOptions, ServerReadOptions, ListAllOptions, ServerPointReadOptions, ClaimTargetOptions, ClaimParams, ClaimContentionOptions, ClaimAttemptEvent, ClaimQueueView, ClaimSkipOptions, ClaimSkipParams, ClaimLookupParams, ClaimReorderParams, ClaimOptions, ClaimReadApi, AwaitedClaimMethod, ClaimApi, ModelReadParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, } from '@abloatai/transaction/client/resources/modelOperations';
 export type { Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease };
-import type { ClaimApi, ClaimAttemptEvent, JoinOptions, LocalCountOptions, LocalReadOptions } from '@abloatai/transaction/client/resources/modelOperations';
+import type { ClaimApi, ClaimAttemptEvent, LocalCountOptions, LocalReadOptions } from '@abloatai/transaction/client/resources/modelOperations';
 import type { HttpModelClient } from '@abloatai/transaction/transport/http';
 import type { ParticipantKind } from '@abloatai/transaction/types/participant';
 import { type ReadSetContext } from '@abloatai/transaction/internal/read-set';
@@ -142,13 +141,6 @@ export interface ModelCollaboration {
      * fire-and-forget, best-effort semantics as `enterScope`.
      */
     pinScope?(scope: Record<string, string>): void | Promise<void>;
-    /**
-     * Opens a presence and claim subscription on this model's sync group(s) and
-     * returns the live participant handle. Backs `ablo.<model>.join(ids)`.
-     * WebSocket only, since presence needs a live socket; it is absent on other
-     * client constructions, where the surface throws a clear error.
-     */
-    createJoin?(modelKey: string, ids: string | readonly string[], options?: JoinOptions): Promise<JoinedParticipant>;
 }
 /**
  * The synchronous, local-only reads — reached as `ablo.<model>.local.*`.
@@ -222,22 +214,6 @@ interface ReactiveModelSurface<T, Fields = T> {
      * ```
      */
     claim: ClaimApi<T, Fields>;
-    /**
-     * Joins the sync group(s) for one or more rows of this model and returns a
-     * live participant handle — presence (`.peers`), the scoped claim stream
-     * (`.claims`), and `.leave()` / `await using` disposal. This is a presence
-     * subscription: it reports who else is here and what they hold, not row
-     * values changing — for the latter, use `onChange`.
-     *
-     * WebSocket only: presence needs a live socket, so this is absent on HTTP
-     * clients and throws on any non-WebSocket construction.
-     *
-     * ```ts
-     * await using participant = await ablo.sections.join(sectionIds, { ttl: '5m' });
-     * participant.peers; // who else is here
-     * ```
-     */
-    join(ids: string | readonly string[], options?: JoinOptions): Promise<JoinedParticipant>;
     /** Subscribe to changes; the callback runs on every change. */
     onChange(callback: (entities: T[]) => void, options?: LocalReadOptions<T>): () => void;
 }

package/dist/local/client/createModelOperations.js

@@ -6,7 +6,7 @@
  * `read` and `list`, with the same point lookup restricted to the local graph under
  * `local`, the writes `create`, `update`, and `delete`, the coordination
  * namespace `claim` (callable as `claim({ id })`, plus `claim.state`,
- * `claim.queue`, `claim.release`, and `claim.reorder`), `join`, and `onChange`.
+ * `claim.queue`, `claim.release`, and `claim.reorder`), and `onChange`.
  * The factory returns a plain object; the client assembles the `ablo.<model>`
  * lookup table from one of these per model.
  */
@@ -130,7 +130,7 @@ hydration, collaboration, readSetContext) {
         const rows = await hydration.fetch(schemaKey, options);
         return rows.map((row) => modelAsRow(row));
     };
-    const waitForMutation = async (model) => {
+    const waitForMutation = async (model, exactConfirmation) => {
         // Model writes are optimistic locally, but their promise has one stable
         // meaning: authoritative confirmation. Callers that do not need the
         // barrier can keep using the row immediately and leave the promise to the
@@ -142,7 +142,10 @@ hydration, collaboration, readSetContext) {
         // coalescer and producing one SQL transaction per delta.
         await Promise.resolve();
         await syncClient.syncNow();
-        await syncClient.waitForConfirmation(model.getModelName(), model.id);
+        if (exactConfirmation)
+            await exactConfirmation;
+        else
+            await syncClient.waitForConfirmation(model.getModelName(), model.id);
     };
     const activeClaims = new Map();
     const claimIdsByEntity = new Map();
@@ -811,8 +814,8 @@ hydration, collaboration, readSetContext) {
                     }
                     : {}),
             };
-            syncClient.add(model, effective);
-            await waitForMutation(model);
+            const confirmation = syncClient.add(model, effective);
+            await waitForMutation(model, confirmation);
             return modelAsRow(model);
         }
         finally {
@@ -888,8 +891,8 @@ hydration, collaboration, readSetContext) {
                                     : {}),
                             };
                             model.applyChanges(patch);
-                            syncClient.update(model, effective);
-                            await waitForMutation(model);
+                            const confirmation = syncClient.update(model, effective, patch);
+                            await waitForMutation(model, confirmation);
                             return modelAsRow(model);
                         },
                     });
@@ -939,8 +942,8 @@ hydration, collaboration, readSetContext) {
                 // the server. (`updateFromData` is the hydration path and would discard
                 // the tracking, producing an empty `input: {}` no-op mutation.)
                 model.applyChanges(params.data);
-                syncClient.update(model, effective);
-                await waitForMutation(model);
+                const confirmation = syncClient.update(model, effective, params.data);
+                await waitForMutation(model, confirmation);
                 const updated = modelAsRow(model);
                 await settleClaimsAfterWrite(id, handle);
                 return updated;
@@ -997,19 +1000,13 @@ hydration, collaboration, readSetContext) {
                 ...opts,
                 ...(selected ? { claimRef: { id: selected.id } } : {}),
             };
-            syncClient.delete(model, effective);
-            await waitForMutation(model);
+            const confirmation = syncClient.delete(model, effective);
+            await waitForMutation(model, confirmation);
             await settleClaimsAfterWrite(id, handle);
         }),
         // `claim` is a callable namespace (take a claim) carrying the coordination
         // readers (`claim.state` / `claim.queue` / `claim.release` / `claim.reorder`).
         claim: claimApi,
-        join: guard((ids, options) => {
-            if (!collaboration?.createJoin) {
-                throw new AbloValidationError(`Model "${schemaKey}" was built without a WebSocket runtime, so join() is unavailable here. Presence needs a live socket — use the standard Ablo({ schema, apiKey }) client (not the HTTP transport).`, { code: 'model_join_not_configured' });
-            }
-            return collaboration.createJoin(schemaKey, ids, options);
-        }),
         onChange(callback, options) {
             return autorun(() => {
                 callback(local.list(options));

package/dist/local/client/options.d.ts

@@ -17,6 +17,7 @@ import type { CommitOutboxScope } from '@abloatai/transaction/commit';
  */
 export type { CredentialProvider } from '@abloatai/transaction/auth/apiKey';
 import type { CredentialProvider } from '@abloatai/transaction/auth/apiKey';
+import type { SessionCredential, SessionEndpoint, SessionProvider } from '@abloatai/transaction/sessions';
 import type { AbloPlugin } from '../../plugin.js';
 import type { ParticipantKind } from '@abloatai/transaction/types/participant';
 /**
@@ -56,18 +57,19 @@ export interface AbloOptions<S extends SchemaRecord = SchemaRecord> {
      *    `ABLO_API_KEY` environment variable, so you usually pass nothing. A
      *    long-lived key needs no refresh; the client uses it as-is.
      *
-     *  - **An async resolver** `() => Promise<string | null>` — the escape hatch for
-     *    when the exchange needs custom headers, a request body, or a non-HTTP mint
-     *    (vault rotation, a cloud token service, an existing auth session). It uses
-     *    the same renewal machinery as the endpoint form.
-     *
-     * The endpoint and resolver forms share one contract: return a token; return
-     * `null` when the login itself is gone (terminal — the client signs out and
-     * fails `ready()` with `session_expired`); or throw on a transient failure, which
-     * backs off and retries without signing out. The endpoint form maps HTTP onto
-     * this for you: only a structured `401 session_expired` means signed out.
+     *  - **An async resolver** for advanced process-owned key rotation, such as a
+     *    vault or workload-identity exchange. Scoped actor renewal belongs in
+     *    `session` instead.
      */
     apiKey?: string | CredentialProvider | null | undefined;
+    /**
+     * Scoped actor identity. Pass a session returned by `sessions.create()` for
+     * bounded work, a provider that re-mints it for a long-lived client, or
+     * `{ endpoint: '/api/ablo-session' }` in a browser. Endpoint responses use
+     * the canonical credential protocol; only a structured `401
+     * session_expired` ends the underlying login.
+     */
+    session?: SessionCredential | SessionProvider | SessionEndpoint | null | undefined;
     /**
      * Pins this client to one Ablo project. During `ready()` the server resolves
      * the API key's actual project and the client refuses to start when it differs.
@@ -84,30 +86,6 @@ export interface AbloOptions<S extends SchemaRecord = SchemaRecord> {
      * environment could reach this process.
      */
     branchId?: string | null | undefined;
-    /**
-     * The session-mint endpoint — the browser-side auth field, and the named
-     * endpoint for the route that mints the signed-in user's short-lived token:
-     *
-     * ```ts
-     * const ablo = Ablo({ schema, authEndpoint: '/api/ablo-session' });
-     * ```
-     *
-     * The client owns the whole exchange: it POSTs the route (same-origin, cookies
-     * included), validates the canonical auth response contract, keeps it fresh
-     * ahead of expiry, and re-mints when the server reports the token stale. Only
-     * a structured `401 session_expired` response means signed out. It also
-     * accepts an async resolver `() => Promise<string | null>` when the exchange
-     * needs custom headers or a body — the same contract as the resolver form of
-     * `apiKey`.
-     *
-     * Mutually exclusive with `apiKey`: a server holds a key, a browser holds a mint
-     * route, and passing both is a validation error.
-     */
-    authEndpoint?: string | CredentialProvider | null | undefined;
-    /** Timeout for a session-mint request. @default 10000 */
-    authTimeoutMs?: number | undefined;
-    /** Explicit opt-in for a cross-origin session-mint endpoint. */
-    allowCrossOriginAuthEndpoint?: boolean | undefined;
     /**
      * Local persistence mode. Pass `indexeddb` only when you want offline
      * queueing and a reload-surviving browser cache.
@@ -222,13 +200,10 @@ export interface InternalAbloOptions<S extends SchemaRecord = SchemaRecord> {
      * the original available as `cause`.
      */
     apiKey?: string | CredentialProvider | null | undefined;
+    /** A scoped session, or a provider that re-mints it for a long-lived client. */
+    session?: SessionCredential | SessionProvider | SessionEndpoint | null | undefined;
     /** Expected project assertion; see {@link AbloOptions.projectId}. */
     projectId?: string | null | undefined;
-    /**
-     * Session-mint endpoint (string or async resolver) — see
-     * {@link AbloOptions.authEndpoint}. Mutually exclusive with `apiKey`.
-     */
-    authEndpoint?: string | CredentialProvider | null | undefined;
     /**
      * A bearer auth token, sent as `Authorization: Bearer <token>` on every request.
      *

package/dist/local/client/reactiveEngine.d.ts

@@ -2,9 +2,9 @@
  * The reactive engine assembly (ADR 0016). `Ablo({ ... })` resolves auth and
  * capabilities; `humans().init` constructs the store cluster; the lifecycle
  * — first mint, identity, ready() — lives in `./storeLifecycle.ts`. What
- * remains here is assembly around those parts: the claim stream and
- * participant manager, options validation, the typed model proxies, and the
- * commit/claim/session resources — composed into the reactive client.
+ * remains here is assembly around those parts: the claim and presence streams,
+ * options validation, the typed model proxies, and the
+ * commit and claim resources — composed into the reactive client.
  *
  * Extracted from the factory so the composition root stays a root: resolve,
  * dispatch, return. The remaining assembly converts to decoration of a
@@ -43,11 +43,5 @@ export interface ReactiveEngineInputs<S extends SchemaRecord> extends ClientPrel
      * assembles around it and constructs none of it.
      */
     cluster: StoreCluster;
-    /**
-     * Constructs a sibling client (`ablo.agents.create(...)` mints a scoped key
-     * and builds a second engine with it). Injected by the factory — a direct
-     * import back into it would close a runtime cycle.
-     */
-    createSibling: (options: AbloOptions<S>) => Ablo<S>;
 }
 export declare function buildReactiveEngine<const S extends SchemaRecord>(inputs: ReactiveEngineInputs<S>): Ablo<S>;