@abloatai/humans 0.59.2 → 0.60.0

package/README.md

@@ -25,7 +25,7 @@ import { Ablo } from '@abloatai/ablo/client';
 
 const ablo = Ablo({
   schema,
-  authEndpoint: '/api/ablo-session',
+  session: { endpoint: '/api/ablo-session' },
 });
 
 await ablo.ready();

package/dist/Ablo.d.ts

@@ -50,11 +50,11 @@ export type Ablo<S extends SchemaRecord> = AbloClient<S>;
  * ```
  *
  * In the browser (or any client that shouldn't hold a secret key), point
- * `authEndpoint` at your session-mint route instead — the SDK fetches it, keeps the
+ * `session.endpoint` at your session-mint route instead — the SDK fetches it, keeps the
  * short-lived token fresh, and re-mints on expiry:
  *
  * ```ts
- * const ablo = Ablo({ schema, authEndpoint: '/api/ablo-session' });
+ * const ablo = Ablo({ schema, session: { endpoint: '/api/ablo-session' } });
  * ```
  *
  * Server-side agents, workers, and services use `@abloatai/transaction`.
@@ -64,7 +64,6 @@ export declare function Ablo<const S extends SchemaRecord, const P extends reado
 }): Ablo<S> & MergedSurface<P>;
 export declare function Ablo<const S extends SchemaRecord>(options: AbloOptions<S>): Ablo<S>;
 import type * as _Streams from '@abloatai/transaction/types/streams';
-import type * as _Participants from './local/sync/participants.js';
 import type * as _Mutators from './local/mutators/defineMutators.js';
 import type * as _Tx from './local/mutators/Transaction.js';
 import type * as _Undo from './local/mutators/UndoManager.js';
@@ -110,13 +109,6 @@ export declare namespace Ablo {
     namespace Auth {
         type Actor = _Streams.ParticipantRef;
     }
-    namespace Participant {
-        type Manager = _Participants.ParticipantManager;
-        type Joined = _Participants.JoinedParticipant;
-        type Scope = _Participants.ParticipantScope;
-        type Status = _Participants.ParticipantStatus;
-        type JoinOptions = _Participants.ParticipantJoinOptions;
-    }
     type Schema<S extends _SchemaTypes.SchemaRecord = _SchemaTypes.SchemaRecord> = _SchemaTypes.Schema<S>;
     /**
      * The schema this program has registered via `interface Register { Schema }`

package/dist/Ablo.js

@@ -115,6 +115,5 @@ export function Ablo(options) {
         transport,
         presence: humansSurface.presence,
         cluster,
-        createSibling: (siblingOptions) => Ablo(siblingOptions),
     }), installedPlugins);
 }

package/dist/client.d.ts

@@ -17,7 +17,7 @@ import type { SyncStoreContract } from './react/context.js';
 import type { SyncWebSocket, CoreSyncEventMap } from './local/sync/SyncWebSocket.js';
 import type { SyncStatus } from './local/BaseSyncedStore.js';
 import type { ModelOperations } from './local/client/createModelOperations.js';
-import type { ClaimResource, CommitResource, CreateAgentClientParams, SessionResource } from '@abloatai/transaction/client/resources/httpResources';
+import type { ClaimResource, CommitResource } from '@abloatai/transaction/client/resources/httpResources';
 import type { EffectiveAuthority } from '@abloatai/transaction/auth';
 import type { ReadDependency } from '@abloatai/transaction/coordination';
 import type { CapturedRow } from '@abloatai/transaction/transport/http';
@@ -102,53 +102,6 @@ export type AbloClient<S extends SchemaRecord> = {
      * the watchdog.
      */
     nudgeReconnect(): void;
-    /**
-     * Mint a short-lived, scoped session token for one end user. Call this on your
-     * backend, where the `sk_` secret key lives, then hand the returned `token` to
-     * that user's browser — typically through a token route the browser's `apiKey`
-     * resolver fetches. The browser presents the token as its bearer, and the
-     * server verifies it. The browser must never see the `sk_` key, only the
-     * per-user session token.
-     *
-     * Pass `{ user: { id }, can: { items: ['read', 'update'] } }` for an end-user
-     * session. It mints an `ek_` and attributes writes to a user (recorded as
-     * `actor_kind` on the delta row). Pass `{ agent: { id }, can: {
-     * items: ['update'] } }` for a scoped agent session, which mints an `rk_`.
-     * Both kinds require `can`, typed against your schema's model names. This
-     * always authenticates with the original `sk_`, never the client's exchanged
-     * sync credential.
-     */
-    sessions: SessionResource<S>;
-    /**
-     * Mint a scoped **agent identity** and return a ready-to-use client bound to
-     * it — the `ablo.<resource>.<verb>` shape for the agent use case. One call
-     * replaces `sessions.create({ agent, can })` + constructing a second
-     * `Ablo({ apiKey: token })`:
-     *
-     * ```ts
-     * const agent = await ablo.agents.create({
-     *   name: 'researcher',                  // readable label (optional)
-     *   can: { records: ['read', 'update'] },
-     *   // id omitted → a fresh uuid: a distinct, independent participant
-     * });
-     * await agent.records.update({ id, data, claim });
-     * await agent.dispose(); // when the agent is done
-     * ```
-     *
-     * Server-side only: it requires the `sk_` secret key (like `sessions.create`)
-     * and throws `AbloAuthenticationError` in the browser. The returned client
-     * holds its own auto-refreshing `rk_`, so a long run never hits token expiry,
-     * and the `sk_` never leaves this process. Each call is a distinct participant
-     * by default (omit `id` for a fresh uuid), so even two agents sharing a `name`
-     * queue behind one another on a contended row — `name` is display only and
-     * never collapses identity. Humans don't get a server-built client; ship them a
-     * token via `sessions.create({ user, can })`. If you need the raw token for
-     * revocation, or a stable re-attachable id, use `sessions.create({ agent, can })`
-     * or pass `id`.
-     */
-    agents: {
-        create(params: CreateAgentClientParams<S>): Promise<AbloClient<S>>;
-    };
     /**
      * The organization this client resolved to — `null` until `ready()`
      * completes. Use it instead of scraping CLI output or hardcoding env vars:

package/dist/humans.d.ts

@@ -13,7 +13,7 @@ export interface HumansSurface {
     readonly [kStoreCluster]?: StoreCluster;
 }
 export declare function humans(): {
-    readonly id: 'humans';
+    readonly id: "humans";
     readonly requires: {
         readonly duplex: true;
     };

package/dist/local/BaseSyncedStore.d.ts

@@ -13,7 +13,7 @@
 import type { RecoveryClass } from '@abloatai/transaction/errorCodes';
 import { ConnectionManager } from './sync/ConnectionManager.js';
 import { SubscriptionManager } from './sync/SubscriptionManager.js';
-import { type ParticipantScope } from './sync/participants.js';
+import { type GroupScope } from './sync/scopeGroups.js';
 import type { SyncClient } from './SyncClient.js';
 import type { Database, BootstrapResult, BootstrapRequirements } from './Database.js';
 import type { InstanceCache } from './InstanceCache.js';
@@ -254,7 +254,7 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
      * Hydration is best-effort — a failed backfill never rejects `enterScope`,
      * and the live delta stream keeps flowing regardless.
      */
-    enterScope(scope: ParticipantScope, opts?: {
+    enterScope(scope: GroupScope, opts?: {
         hydrate?: boolean;
     }): Promise<void>;
     /**
@@ -266,11 +266,11 @@ export declare class BaseSyncedStore<TCollaboration extends EventMap<TCollaborat
      */
     protected hydrateGroups(syncGroups: readonly string[]): Promise<void>;
     /** Leave a scope → its groups go warm (hysteresis), then drop on sweep. */
-    leaveScope(scope: ParticipantScope): Promise<void>;
+    leaveScope(scope: GroupScope): Promise<void>;
     /** Pin a scope (active claim / prominence) → never warms while pinned. */
-    pinScope(scope: ParticipantScope): Promise<void>;
+    pinScope(scope: GroupScope): Promise<void>;
     /** Release a pin → the group transitions to warm rather than dropping. */
-    unpinScope(scope: ParticipantScope): Promise<void>;
+    unpinScope(scope: GroupScope): Promise<void>;
     protected readonly queryProcessor: QueryProcessor;
     /**
      * Runtime behavior flags only — the schema/config arrays

package/dist/local/BaseSyncedStore.js

@@ -15,7 +15,7 @@ import { AbloConnectionError, AbloValidationError, toAbloError } from '@abloatai
 import { ConnectionManager } from './sync/ConnectionManager.js';
 import { contextLogger, contextSocketObservability } from './sync/contextPorts.js';
 import { SubscriptionManager } from './sync/SubscriptionManager.js';
-import { resolveParticipantSyncGroups, } from './sync/participants.js';
+import { resolveScopeGroups, } from './sync/scopeGroups.js';
 import { ModelRegistry } from './ModelRegistry.js';
 import { PropertyType } from '@abloatai/transaction/types';
 import { SyncWebSocket, } from './sync/SyncWebSocket.js';
@@ -180,7 +180,7 @@ export class BaseSyncedStore {
     // {@link SubscriptionManager.reconcile}); the on-connect `resync` pushes
     // whatever interest accumulated.
     scopeToGroups(scope) {
-        return resolveParticipantSyncGroups(scope, this.schema);
+        return resolveScopeGroups(scope, this.schema);
     }
     /**
      * Bring a scope into view and subscribe to its sync groups. With

package/dist/local/Database.d.ts

@@ -101,7 +101,7 @@ export declare class Database {
      * where a missing store points to silent data loss. Callers that
      * already expect optional behavior (e.g. lazy lookups) can omit it.
      */
-    getStore(modelName: string, context?: string): InMemoryObjectStore | import("./stores/ObjectStore.js").ObjectStore | undefined;
+    getStore(modelName: string, context?: string): import("./stores/ObjectStore.js").ObjectStore | InMemoryObjectStore | undefined;
     /** Get store or throw if not found (for operations that require the store). */
     private getRequiredStore;
     /** Log preserved fields during partial UPDATE merge (debug helper) */
@@ -274,7 +274,7 @@ export declare class Database {
      * `getStore(modelName, context?)` is defined near the top of this
      * class — single accessor for both inMemory and IDB modes.
      */
-    getAllStores(): Map<string, InMemoryObjectStore> | Map<string, import("./stores/ObjectStore.js").ObjectStore>;
+    getAllStores(): Map<string, import("./stores/ObjectStore.js").ObjectStore> | Map<string, InMemoryObjectStore>;
     /**
      * Model persistence tracking
      */

package/dist/local/LazyReferenceCollection.d.ts

@@ -65,7 +65,7 @@ export declare class LazyReferenceCollection<T extends Model> {
     private get database();
     /** Get objectPool from static dependencies */
     private get objectPool();
-    constructor(modelName: string, parent: Model, foreignKey: string, customQuery?: any, options?: LazyCollectionOptions);
+    constructor(modelName: string, parent: Model, foreignKey: string, customQuery?: any | undefined, options?: LazyCollectionOptions);
     /**
      * Set up MobX observation lifecycle hooks
      * When React components observe this collection, we prevent GC of the parent model

package/dist/local/SyncClient.d.ts

@@ -186,9 +186,9 @@ export declare class SyncClient extends EventEmitter {
      */
     private captureModelChanges;
     /** Add new model (CREATE) - works offline */
-    add(model: Model, options?: WriteOptions): void;
+    add(model: Model, options?: WriteOptions): Promise<void> | undefined;
     /** Update existing model (UPDATE) - works offline */
-    update(model: Model, options?: WriteOptions): void;
+    update(model: Model, options?: WriteOptions, capturedChanges?: Record<string, unknown>): Promise<void> | undefined;
     /**
      * Update existing model with pre-computed changes.
      * Used by saveManyOptimized when incoming models have empty change-tracking
@@ -200,7 +200,7 @@ export declare class SyncClient extends EventEmitter {
      *  but still need optimistic pool updates at the sync layer. */
     get gql(): import("./interfaces/index.js").MutationExecutor;
     /** Delete model (DELETE) - works offline */
-    delete(model: Model, options?: WriteOptions): void;
+    delete(model: Model, options?: WriteOptions): Promise<void> | undefined;
     /**
      * Upload a file and create its attachment record. The upload runs through
      * the {@link MutationQueue}, and a model is built from the server's
@@ -409,14 +409,14 @@ export declare class SyncClient extends EventEmitter {
      * Get detailed debug info for the sync debug page
      */
     getDebugInfo(): {
-        connectionState: "connected" | "connecting" | "disconnected";
+        connectionState: "connected" | "disconnected" | "connecting";
         pendingMutationsCount: number;
         mutationQueue: {
             lastSeenSyncId: number;
             awaitingDeltaCount: number;
             awaitingDeltaTransactions: {
                 id: string;
-                type: "archive" | "create" | "delete" | "unarchive" | "update";
+                type: "update" | "create" | "delete" | "archive" | "unarchive";
                 modelName: string;
                 modelId: string;
                 syncIdNeeded: number | undefined;
@@ -425,13 +425,13 @@ export declare class SyncClient extends EventEmitter {
             }[];
             pendingTransactions: {
                 id: string;
-                type: "archive" | "create" | "delete" | "unarchive" | "update";
+                type: "update" | "create" | "delete" | "archive" | "unarchive";
                 modelName: string;
                 modelId: string;
             }[];
             executingTransactions: {
                 id: string;
-                type: "archive" | "create" | "delete" | "unarchive" | "update";
+                type: "update" | "create" | "delete" | "archive" | "unarchive";
                 modelName: string;
                 modelId: string;
             }[];

package/dist/local/SyncClient.js

@@ -758,7 +758,7 @@ export class SyncClient extends EventEmitter {
      * capturing first ensures those changes are never lost. The captured set is
      * frozen and handed to {@link queueMutation}.
      */
-    mutate(type, model, poolAction, writeOptions) {
+    mutate(type, model, poolAction, writeOptions, capturedChangesOverride) {
         // No-op UPDATE guard (O(1)). An update with no dirty fields would travel
         // to the server, get dropped by `coalesceOperations` Rule 4 (empty input),
         // and — if it was the only op — come back as `lastSyncId: 0`. That trips
@@ -772,21 +772,28 @@ export class SyncClient extends EventEmitter {
         // is false → we fall through to the normal path rather than risk dropping a
         // real write. Only a genuine Model with an empty dirty-set is skipped.
         const hasChanges = model.hasChanges;
-        if (type === 'update' && hasChanges === false) {
-            return;
+        if (type === 'update' &&
+            hasChanges === false &&
+            capturedChangesOverride === undefined) {
+            return Promise.resolve();
         }
         // Capture changes before the pool action runs. Pool operations —
         // upsert in particular — can clear the model's local changes, so
         // capturing first ensures they are never lost.
-        const capturedChanges = type === 'update' || type === 'create' ? this.captureModelChanges(model) : undefined;
+        const capturedChanges = capturedChangesOverride !== undefined
+            ? Object.freeze({ ...capturedChangesOverride })
+            : type === 'update' || type === 'create'
+                ? this.captureModelChanges(model)
+                : undefined;
         poolAction();
-        this.stageMutation(type, model, capturedChanges, writeOptions);
+        const confirmation = this.stageMutation(type, model, capturedChanges, writeOptions);
         this.notifyObservers({
             type,
             modelType: model.getModelName(),
             model: type !== 'delete' ? model : undefined,
             modelId: model.id,
         });
+        return confirmation;
         // QueryProcessor uses `models:changed` to invalidate caches. Coalesce
         // to one event per microtask: a paste of 100 rows should re-run
         // affected queries ONCE, not 100×.
@@ -821,11 +828,11 @@ export class SyncClient extends EventEmitter {
     }
     /** Add new model (CREATE) - works offline */
     add(model, options) {
-        this.mutate('create', model, () => { this.objectPool.add(model, ModelScope.live); }, options);
+        return this.mutate('create', model, () => { this.objectPool.add(model, ModelScope.live); }, options);
     }
     /** Update existing model (UPDATE) - works offline */
-    update(model, options) {
-        this.mutate('update', model, () => { this.objectPool.upsert(model, ModelScope.live); }, options);
+    update(model, options, capturedChanges) {
+        return this.mutate('update', model, () => { this.objectPool.upsert(model, ModelScope.live); }, options, capturedChanges);
     }
     /**
      * Update existing model with pre-computed changes.
@@ -867,7 +874,7 @@ export class SyncClient extends EventEmitter {
     delete(model, options) {
         // Clear pending mutations first to prevent "not found" errors on fast delete
         this.mutationQueue.cancelTransactionsForModel(model.id);
-        this.mutate('delete', model, () => this.objectPool.remove(model.id), options);
+        return this.mutate('delete', model, () => this.objectPool.remove(model.id), options);
     }
     /**
      * Upload a file and create its attachment record. The upload runs through
@@ -979,13 +986,20 @@ export class SyncClient extends EventEmitter {
     /** Stage one mutation through the queue, which owns durability and execution. */
     stageMutation(type, model, capturedChanges, writeOptions) {
         if (this.isDisposed)
-            return;
+            return Promise.resolve();
         if (!this.userId || !this.organizationId) {
             this.mutationQueue.deferMutation(type, model, capturedChanges, writeOptions);
             return;
         }
         const context = { userId: this.userId, organizationId: this.organizationId };
         const staging = this.mutationQueue.enqueueModelMutation(type, model, context, capturedChanges, writeOptions);
+        const confirmation = staging.then(async (transaction) => {
+            await transaction.confirmation;
+        });
+        // Most internal callers intentionally use fire-and-forget writes. Observe
+        // their rejection without replacing the exact promise returned to model
+        // operations that need authoritative per-transaction confirmation.
+        void confirmation.catch(() => undefined);
         const pending = staging.then(() => undefined).catch((error) => {
             this.runtime.observability.captureMutationFailure({
                 context: `stage-mutation-${type}`,
@@ -996,6 +1010,7 @@ export class SyncClient extends EventEmitter {
         });
         this.pendingStages.add(pending);
         void pending.finally(() => this.pendingStages.delete(pending));
+        return confirmation;
     }
     scheduleSync() {
         if (!this.runtime.onlineStatus.isOnline() || this.isDisposed)

package/dist/local/client/createModelOperations.d.ts

@@ -6,7 +6,7 @@
  * `read` and `list`, with the same point lookup restricted to the local graph under
  * `local`, the writes `create`, `update`, and `delete`, the coordination
  * namespace `claim` (callable as `claim({ id })`, plus `claim.state`,
- * `claim.queue`, `claim.release`, and `claim.reorder`), `join`, and `onChange`.
+ * `claim.queue`, `claim.release`, and `claim.reorder`), and `onChange`.
  * The factory returns a plain object; the client assembles the `ablo.<model>`
  * lookup table from one of these per model.
  */
@@ -16,11 +16,10 @@ import type { ModelRegistry } from '../ModelRegistry.js';
 import type { InstanceCache } from '../InstanceCache.js';
 import type { SyncClient } from '../SyncClient.js';
 import type { OnDemandLoader } from '../sync/OnDemandLoader.js';
-import type { JoinedParticipant } from '../sync/participants.js';
 import type { Duration, Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease, ClaimWaitOptions } from '@abloatai/transaction/types/streams';
-export type { ModelListScope, LocalReadOptions, LocalCountOptions, ServerReadOptions, ListAllOptions, ServerPointReadOptions, ClaimTargetOptions, ClaimParams, ClaimContentionOptions, ClaimAttemptEvent, ClaimQueueView, ClaimSkipOptions, ClaimSkipParams, ClaimLookupParams, ClaimReorderParams, ClaimOptions, ClaimReadApi, AwaitedClaimMethod, ClaimApi, ModelReadParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, JoinOptions, } from '@abloatai/transaction/client/resources/modelOperations';
+export type { ModelListScope, LocalReadOptions, LocalCountOptions, ServerReadOptions, ListAllOptions, ServerPointReadOptions, ClaimTargetOptions, ClaimParams, ClaimContentionOptions, ClaimAttemptEvent, ClaimQueueView, ClaimSkipOptions, ClaimSkipParams, ClaimLookupParams, ClaimReorderParams, ClaimOptions, ClaimReadApi, AwaitedClaimMethod, ClaimApi, ModelReadParams, ModelCreateParams, ModelUpdateParams, ModelDeleteParams, } from '@abloatai/transaction/client/resources/modelOperations';
 export type { Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease };
-import type { ClaimApi, ClaimAttemptEvent, JoinOptions, LocalCountOptions, LocalReadOptions } from '@abloatai/transaction/client/resources/modelOperations';
+import type { ClaimApi, ClaimAttemptEvent, LocalCountOptions, LocalReadOptions } from '@abloatai/transaction/client/resources/modelOperations';
 import type { HttpModelClient } from '@abloatai/transaction/transport/http';
 import type { ParticipantKind } from '@abloatai/transaction/types/participant';
 import { type ReadSetContext } from '@abloatai/transaction/internal/read-set';
@@ -142,13 +141,6 @@ export interface ModelCollaboration {
      * fire-and-forget, best-effort semantics as `enterScope`.
      */
     pinScope?(scope: Record<string, string>): void | Promise<void>;
-    /**
-     * Opens a presence and claim subscription on this model's sync group(s) and
-     * returns the live participant handle. Backs `ablo.<model>.join(ids)`.
-     * WebSocket only, since presence needs a live socket; it is absent on other
-     * client constructions, where the surface throws a clear error.
-     */
-    createJoin?(modelKey: string, ids: string | readonly string[], options?: JoinOptions): Promise<JoinedParticipant>;
 }
 /**
  * The synchronous, local-only reads — reached as `ablo.<model>.local.*`.
@@ -222,22 +214,6 @@ interface ReactiveModelSurface<T, Fields = T> {
      * ```
      */
     claim: ClaimApi<T, Fields>;
-    /**
-     * Joins the sync group(s) for one or more rows of this model and returns a
-     * live participant handle — presence (`.peers`), the scoped claim stream
-     * (`.claims`), and `.leave()` / `await using` disposal. This is a presence
-     * subscription: it reports who else is here and what they hold, not row
-     * values changing — for the latter, use `onChange`.
-     *
-     * WebSocket only: presence needs a live socket, so this is absent on HTTP
-     * clients and throws on any non-WebSocket construction.
-     *
-     * ```ts
-     * await using participant = await ablo.sections.join(sectionIds, { ttl: '5m' });
-     * participant.peers; // who else is here
-     * ```
-     */
-    join(ids: string | readonly string[], options?: JoinOptions): Promise<JoinedParticipant>;
     /** Subscribe to changes; the callback runs on every change. */
     onChange(callback: (entities: T[]) => void, options?: LocalReadOptions<T>): () => void;
 }

package/dist/local/client/createModelOperations.js

@@ -6,7 +6,7 @@
  * `read` and `list`, with the same point lookup restricted to the local graph under
  * `local`, the writes `create`, `update`, and `delete`, the coordination
  * namespace `claim` (callable as `claim({ id })`, plus `claim.state`,
- * `claim.queue`, `claim.release`, and `claim.reorder`), `join`, and `onChange`.
+ * `claim.queue`, `claim.release`, and `claim.reorder`), and `onChange`.
  * The factory returns a plain object; the client assembles the `ablo.<model>`
  * lookup table from one of these per model.
  */
@@ -130,7 +130,7 @@ hydration, collaboration, readSetContext) {
         const rows = await hydration.fetch(schemaKey, options);
         return rows.map((row) => modelAsRow(row));
     };
-    const waitForMutation = async (model) => {
+    const waitForMutation = async (model, exactConfirmation) => {
         // Model writes are optimistic locally, but their promise has one stable
         // meaning: authoritative confirmation. Callers that do not need the
         // barrier can keep using the row immediately and leave the promise to the
@@ -142,7 +142,10 @@ hydration, collaboration, readSetContext) {
         // coalescer and producing one SQL transaction per delta.
         await Promise.resolve();
         await syncClient.syncNow();
-        await syncClient.waitForConfirmation(model.getModelName(), model.id);
+        if (exactConfirmation)
+            await exactConfirmation;
+        else
+            await syncClient.waitForConfirmation(model.getModelName(), model.id);
     };
     const activeClaims = new Map();
     const claimIdsByEntity = new Map();
@@ -811,8 +814,8 @@ hydration, collaboration, readSetContext) {
                     }
                     : {}),
             };
-            syncClient.add(model, effective);
-            await waitForMutation(model);
+            const confirmation = syncClient.add(model, effective);
+            await waitForMutation(model, confirmation);
             return modelAsRow(model);
         }
         finally {
@@ -888,8 +891,8 @@ hydration, collaboration, readSetContext) {
                                     : {}),
                             };
                             model.applyChanges(patch);
-                            syncClient.update(model, effective);
-                            await waitForMutation(model);
+                            const confirmation = syncClient.update(model, effective, patch);
+                            await waitForMutation(model, confirmation);
                             return modelAsRow(model);
                         },
                     });
@@ -939,8 +942,8 @@ hydration, collaboration, readSetContext) {
                 // the server. (`updateFromData` is the hydration path and would discard
                 // the tracking, producing an empty `input: {}` no-op mutation.)
                 model.applyChanges(params.data);
-                syncClient.update(model, effective);
-                await waitForMutation(model);
+                const confirmation = syncClient.update(model, effective, params.data);
+                await waitForMutation(model, confirmation);
                 const updated = modelAsRow(model);
                 await settleClaimsAfterWrite(id, handle);
                 return updated;
@@ -997,19 +1000,13 @@ hydration, collaboration, readSetContext) {
                 ...opts,
                 ...(selected ? { claimRef: { id: selected.id } } : {}),
             };
-            syncClient.delete(model, effective);
-            await waitForMutation(model);
+            const confirmation = syncClient.delete(model, effective);
+            await waitForMutation(model, confirmation);
             await settleClaimsAfterWrite(id, handle);
         }),
         // `claim` is a callable namespace (take a claim) carrying the coordination
         // readers (`claim.state` / `claim.queue` / `claim.release` / `claim.reorder`).
         claim: claimApi,
-        join: guard((ids, options) => {
-            if (!collaboration?.createJoin) {
-                throw new AbloValidationError(`Model "${schemaKey}" was built without a WebSocket runtime, so join() is unavailable here. Presence needs a live socket — use the standard Ablo({ schema, apiKey }) client (not the HTTP transport).`, { code: 'model_join_not_configured' });
-            }
-            return collaboration.createJoin(schemaKey, ids, options);
-        }),
         onChange(callback, options) {
             return autorun(() => {
                 callback(local.list(options));

package/dist/local/client/options.d.ts

@@ -17,6 +17,7 @@ import type { CommitOutboxScope } from '@abloatai/transaction/commit';
  */
 export type { CredentialProvider } from '@abloatai/transaction/auth/apiKey';
 import type { CredentialProvider } from '@abloatai/transaction/auth/apiKey';
+import type { SessionCredential, SessionEndpoint, SessionProvider } from '@abloatai/transaction/sessions';
 import type { AbloPlugin } from '../../plugin.js';
 import type { ParticipantKind } from '@abloatai/transaction/types/participant';
 /**
@@ -56,18 +57,19 @@ export interface AbloOptions<S extends SchemaRecord = SchemaRecord> {
      *    `ABLO_API_KEY` environment variable, so you usually pass nothing. A
      *    long-lived key needs no refresh; the client uses it as-is.
      *
-     *  - **An async resolver** `() => Promise<string | null>` — the escape hatch for
-     *    when the exchange needs custom headers, a request body, or a non-HTTP mint
-     *    (vault rotation, a cloud token service, an existing auth session). It uses
-     *    the same renewal machinery as the endpoint form.
-     *
-     * The endpoint and resolver forms share one contract: return a token; return
-     * `null` when the login itself is gone (terminal — the client signs out and
-     * fails `ready()` with `session_expired`); or throw on a transient failure, which
-     * backs off and retries without signing out. The endpoint form maps HTTP onto
-     * this for you: only a structured `401 session_expired` means signed out.
+     *  - **An async resolver** for advanced process-owned key rotation, such as a
+     *    vault or workload-identity exchange. Scoped actor renewal belongs in
+     *    `session` instead.
      */
     apiKey?: string | CredentialProvider | null | undefined;
+    /**
+     * Scoped actor identity. Pass a session returned by `sessions.create()` for
+     * bounded work, a provider that re-mints it for a long-lived client, or
+     * `{ endpoint: '/api/ablo-session' }` in a browser. Endpoint responses use
+     * the canonical credential protocol; only a structured `401
+     * session_expired` ends the underlying login.
+     */
+    session?: SessionCredential | SessionProvider | SessionEndpoint | null | undefined;
     /**
      * Pins this client to one Ablo project. During `ready()` the server resolves
      * the API key's actual project and the client refuses to start when it differs.
@@ -84,30 +86,6 @@ export interface AbloOptions<S extends SchemaRecord = SchemaRecord> {
      * environment could reach this process.
      */
     branchId?: string | null | undefined;
-    /**
-     * The session-mint endpoint — the browser-side auth field, and the named
-     * endpoint for the route that mints the signed-in user's short-lived token:
-     *
-     * ```ts
-     * const ablo = Ablo({ schema, authEndpoint: '/api/ablo-session' });
-     * ```
-     *
-     * The client owns the whole exchange: it POSTs the route (same-origin, cookies
-     * included), validates the canonical auth response contract, keeps it fresh
-     * ahead of expiry, and re-mints when the server reports the token stale. Only
-     * a structured `401 session_expired` response means signed out. It also
-     * accepts an async resolver `() => Promise<string | null>` when the exchange
-     * needs custom headers or a body — the same contract as the resolver form of
-     * `apiKey`.
-     *
-     * Mutually exclusive with `apiKey`: a server holds a key, a browser holds a mint
-     * route, and passing both is a validation error.
-     */
-    authEndpoint?: string | CredentialProvider | null | undefined;
-    /** Timeout for a session-mint request. @default 10000 */
-    authTimeoutMs?: number | undefined;
-    /** Explicit opt-in for a cross-origin session-mint endpoint. */
-    allowCrossOriginAuthEndpoint?: boolean | undefined;
     /**
      * Local persistence mode. Pass `indexeddb` only when you want offline
      * queueing and a reload-surviving browser cache.
@@ -222,13 +200,10 @@ export interface InternalAbloOptions<S extends SchemaRecord = SchemaRecord> {
      * the original available as `cause`.
      */
     apiKey?: string | CredentialProvider | null | undefined;
+    /** A scoped session, or a provider that re-mints it for a long-lived client. */
+    session?: SessionCredential | SessionProvider | SessionEndpoint | null | undefined;
     /** Expected project assertion; see {@link AbloOptions.projectId}. */
     projectId?: string | null | undefined;
-    /**
-     * Session-mint endpoint (string or async resolver) — see
-     * {@link AbloOptions.authEndpoint}. Mutually exclusive with `apiKey`.
-     */
-    authEndpoint?: string | CredentialProvider | null | undefined;
     /**
      * A bearer auth token, sent as `Authorization: Bearer <token>` on every request.
      *

package/dist/local/client/reactiveEngine.d.ts

@@ -2,9 +2,9 @@
  * The reactive engine assembly (ADR 0016). `Ablo({ ... })` resolves auth and
  * capabilities; `humans().init` constructs the store cluster; the lifecycle
  * — first mint, identity, ready() — lives in `./storeLifecycle.ts`. What
- * remains here is assembly around those parts: the claim stream and
- * participant manager, options validation, the typed model proxies, and the
- * commit/claim/session resources — composed into the reactive client.
+ * remains here is assembly around those parts: the claim and presence streams,
+ * options validation, the typed model proxies, and the
+ * commit and claim resources — composed into the reactive client.
  *
  * Extracted from the factory so the composition root stays a root: resolve,
  * dispatch, return. The remaining assembly converts to decoration of a
@@ -43,11 +43,5 @@ export interface ReactiveEngineInputs<S extends SchemaRecord> extends ClientPrel
      * assembles around it and constructs none of it.
      */
     cluster: StoreCluster;
-    /**
-     * Constructs a sibling client (`ablo.agents.create(...)` mints a scoped key
-     * and builds a second engine with it). Injected by the factory — a direct
-     * import back into it would close a runtime cycle.
-     */
-    createSibling: (options: AbloOptions<S>) => Ablo<S>;
 }
 export declare function buildReactiveEngine<const S extends SchemaRecord>(inputs: ReactiveEngineInputs<S>): Ablo<S>;