@abloatai/humans 0.59.2 → 0.61.0

package/src/local/client/createModelOperations.ts

@@ -6,7 +6,7 @@
  * `read` and `list`, with the same point lookup restricted to the local graph under
  * `local`, the writes `create`, `update`, and `delete`, the coordination
  * namespace `claim` (callable as `claim({ id })`, plus `claim.state`,
- * `claim.queue`, `claim.release`, and `claim.reorder`), `join`, and `onChange`.
+ * `claim.queue`, `claim.release`, and `claim.reorder`), and `onChange`.
  * The factory returns a plain object; the client assembles the `ablo.<model>`
  * lookup table from one of these per model.
  */
@@ -66,7 +66,6 @@ import type { ModelRegistry } from '../ModelRegistry.js';
 import type { InstanceCache } from '../InstanceCache.js';
 import type { SyncClient } from '../SyncClient.js';
 import type { OnDemandLoader } from '../sync/OnDemandLoader.js';
-import type { JoinedParticipant } from '../sync/participants.js';
 import { ModelScope } from '@abloatai/transaction/types';
 import type {
   Duration,
@@ -112,7 +111,6 @@ export type {
   ModelCreateParams,
   ModelUpdateParams,
   ModelDeleteParams,
-  JoinOptions,
 } from '@abloatai/transaction/client/resources/modelOperations';
 export type { Claim, ClaimHeartbeat, ClaimHeartbeatOptions, HeldClaim, HeldLease };
 
@@ -126,7 +124,6 @@ import type {
   ClaimAttemptEvent,
   ClaimQueueView,
   ClaimReorderParams,
-  JoinOptions,
   LocalCountOptions,
   LocalReadOptions,
   ModelCreateManyParams,
@@ -152,6 +149,9 @@ import {
   type ReadSetContext,
 } from '@abloatai/transaction/internal/read-set';
 
+const ignoreSeparatelyObservedMutationFailure = (): undefined => undefined;
+const ignoreBestEffortClaimReleaseFailure = (): undefined => undefined;
+
 export interface ModelClientMeta {
   readonly key: string;
   readonly typename: string;
@@ -284,17 +284,6 @@ export interface ModelCollaboration {
    * fire-and-forget, best-effort semantics as `enterScope`.
    */
   pinScope?(scope: Record<string, string>): void | Promise<void>;
-  /**
-   * Opens a presence and claim subscription on this model's sync group(s) and
-   * returns the live participant handle. Backs `ablo.<model>.join(ids)`.
-   * WebSocket only, since presence needs a live socket; it is absent on other
-   * client constructions, where the surface throws a clear error.
-   */
-  createJoin?(
-    modelKey: string,
-    ids: string | readonly string[],
-    options?: JoinOptions,
-  ): Promise<JoinedParticipant>;
 }
 
 
@@ -375,26 +364,6 @@ interface ReactiveModelSurface<T, Fields = T> {
    */
   claim: ClaimApi<T, Fields>;
 
-  /**
-   * Joins the sync group(s) for one or more rows of this model and returns a
-   * live participant handle — presence (`.peers`), the scoped claim stream
-   * (`.claims`), and `.leave()` / `await using` disposal. This is a presence
-   * subscription: it reports who else is here and what they hold, not row
-   * values changing — for the latter, use `onChange`.
-   *
-   * WebSocket only: presence needs a live socket, so this is absent on HTTP
-   * clients and throws on any non-WebSocket construction.
-   *
-   * ```ts
-   * await using participant = await ablo.sections.join(sectionIds, { ttl: '5m' });
-   * participant.peers; // who else is here
-   * ```
-   */
-  join(
-    ids: string | readonly string[],
-    options?: JoinOptions,
-  ): Promise<JoinedParticipant>;
-
   /** Subscribe to changes; the callback runs on every change. */
   onChange(
     callback: (entities: T[]) => void,
@@ -524,7 +493,7 @@ export function createModelOperations<T, C>(
       // await does not create an unhandled-rejection process error. Returning
       // the original promise preserves normal rejection for callers that do
       // await or attach their own catch handler.
-      void confirmation.catch(() => undefined);
+      void confirmation.catch(ignoreSeparatelyObservedMutationFailure);
       return confirmation;
     };
   };
@@ -546,7 +515,10 @@ export function createModelOperations<T, C>(
     return rows.map((row) => modelAsRow<T>(row));
   };
 
-  const waitForMutation = async (model: Model): Promise<void> => {
+  const waitForMutation = async (
+    model: Model,
+    exactConfirmation?: Promise<void>,
+  ): Promise<void> => {
     // Model writes are optimistic locally, but their promise has one stable
     // meaning: authoritative confirmation. Callers that do not need the
     // barrier can keep using the row immediately and leave the promise to the
@@ -558,7 +530,8 @@ export function createModelOperations<T, C>(
     // coalescer and producing one SQL transaction per delta.
     await Promise.resolve();
     await syncClient.syncNow();
-    await syncClient.waitForConfirmation(model.getModelName(), model.id);
+    if (exactConfirmation) await exactConfirmation;
+    else await syncClient.waitForConfirmation(model.getModelName(), model.id);
   };
 
   // Claims this model surface currently holds, keyed by the exact grant id.
@@ -690,9 +663,9 @@ export function createModelOperations<T, C>(
     // This runs after authoritative confirmation. A best-effort abandon frame
     // cannot turn a committed write into an apparent failure; the server has
     // already fulfilled the participant's claims as part of that commit.
-    await releaseClaimsForEntity(entityId).catch(() => undefined);
+    await releaseClaimsForEntity(entityId).catch(ignoreBestEffortClaimReleaseFailure);
     if (explicit && !explicitWasLocal) {
-      await explicit.release?.().catch(() => undefined);
+      await explicit.release?.().catch(ignoreBestEffortClaimReleaseFailure);
     }
   };
 
@@ -1402,11 +1375,11 @@ export function createModelOperations<T, C>(
               }
             : {}),
         };
-        syncClient.add(model, effective);
-        await waitForMutation(model);
+        const confirmation = syncClient.add(model, effective);
+        await waitForMutation(model, confirmation);
         return modelAsRow<T>(model);
       } finally {
-        await autoLease?.release?.().catch(() => {});
+        await autoLease?.release?.().catch(ignoreBestEffortClaimReleaseFailure);
       }
   });
 
@@ -1528,8 +1501,12 @@ export function createModelOperations<T, C>(
                   : {}),
               };
               model.applyChanges(patch);
-              syncClient.update(model, effective);
-              await waitForMutation(model);
+              const confirmation = syncClient.update(
+                model,
+                effective,
+                patch,
+              );
+              await waitForMutation(model, confirmation);
               return modelAsRow<T>(model);
             },
           });
@@ -1585,8 +1562,12 @@ export function createModelOperations<T, C>(
         // the server. (`updateFromData` is the hydration path and would discard
         // the tracking, producing an empty `input: {}` no-op mutation.)
         model.applyChanges(params.data);
-        syncClient.update(model, effective);
-        await waitForMutation(model);
+        const confirmation = syncClient.update(
+          model,
+          effective,
+          params.data,
+        );
+        await waitForMutation(model, confirmation);
         const updated = modelAsRow<T>(model);
         await settleClaimsAfterWrite(id, handle);
         return updated;
@@ -1658,8 +1639,8 @@ export function createModelOperations<T, C>(
         ...opts,
         ...(selected ? { claimRef: { id: selected.id } } : {}),
       };
-      syncClient.delete(model, effective);
-      await waitForMutation(model);
+      const confirmation = syncClient.delete(model, effective);
+      await waitForMutation(model, confirmation);
       await settleClaimsAfterWrite(id, handle);
     }),
 
@@ -1667,21 +1648,6 @@ export function createModelOperations<T, C>(
     // readers (`claim.state` / `claim.queue` / `claim.release` / `claim.reorder`).
     claim: claimApi,
 
-    join: guard(
-      (
-        ids: string | readonly string[],
-        options?: JoinOptions,
-      ): Promise<JoinedParticipant> => {
-        if (!collaboration?.createJoin) {
-          throw new AbloValidationError(
-            `Model "${schemaKey}" was built without a WebSocket runtime, so join() is unavailable here. Presence needs a live socket — use the standard Ablo({ schema, apiKey }) client (not the HTTP transport).`,
-            { code: 'model_join_not_configured' },
-          );
-        }
-        return collaboration.createJoin(schemaKey, ids, options);
-      },
-    ),
-
     onChange(callback, options): () => void {
       return autorun(() => {
         callback(local.list(options));

package/src/local/client/options.ts

@@ -32,6 +32,11 @@ import type { CommitOutboxScope } from '@abloatai/transaction/commit';
  */
 export type { CredentialProvider } from '@abloatai/transaction/auth/apiKey';
 import type { CredentialProvider } from '@abloatai/transaction/auth/apiKey';
+import type {
+  SessionCredential,
+  SessionEndpoint,
+  SessionProvider,
+} from '@abloatai/transaction/sessions';
 import type { AbloPlugin } from '../../plugin.js';
 import type { ParticipantKind } from '@abloatai/transaction/types/participant';
 
@@ -74,19 +79,21 @@ export interface AbloOptions<S extends SchemaRecord = SchemaRecord> {
    *    `ABLO_API_KEY` environment variable, so you usually pass nothing. A
    *    long-lived key needs no refresh; the client uses it as-is.
    *
-   *  - **An async resolver** `() => Promise<string | null>` — the escape hatch for
-   *    when the exchange needs custom headers, a request body, or a non-HTTP mint
-   *    (vault rotation, a cloud token service, an existing auth session). It uses
-   *    the same renewal machinery as the endpoint form.
-   *
-   * The endpoint and resolver forms share one contract: return a token; return
-   * `null` when the login itself is gone (terminal — the client signs out and
-   * fails `ready()` with `session_expired`); or throw on a transient failure, which
-   * backs off and retries without signing out. The endpoint form maps HTTP onto
-   * this for you: only a structured `401 session_expired` means signed out.
+   *  - **An async resolver** for advanced process-owned key rotation, such as a
+   *    vault or workload-identity exchange. Scoped actor renewal belongs in
+   *    `session` instead.
    */
   apiKey?: string | CredentialProvider | null | undefined;
 
+  /**
+   * Scoped actor identity. Pass a session returned by `sessions.create()` for
+   * bounded work, a provider that re-mints it for a long-lived client, or
+   * `{ endpoint: '/api/ablo-session' }` in a browser. Endpoint responses use
+   * the canonical credential protocol; only a structured `401
+   * session_expired` ends the underlying login.
+   */
+  session?: SessionCredential | SessionProvider | SessionEndpoint | null | undefined;
+
   /**
    * Pins this client to one Ablo project. During `ready()` the server resolves
    * the API key's actual project and the client refuses to start when it differs.
@@ -105,33 +112,6 @@ export interface AbloOptions<S extends SchemaRecord = SchemaRecord> {
    */
   branchId?: string | null | undefined;
 
-  /**
-   * The session-mint endpoint — the browser-side auth field, and the named
-   * endpoint for the route that mints the signed-in user's short-lived token:
-   *
-   * ```ts
-   * const ablo = Ablo({ schema, authEndpoint: '/api/ablo-session' });
-   * ```
-   *
-   * The client owns the whole exchange: it POSTs the route (same-origin, cookies
-   * included), validates the canonical auth response contract, keeps it fresh
-   * ahead of expiry, and re-mints when the server reports the token stale. Only
-   * a structured `401 session_expired` response means signed out. It also
-   * accepts an async resolver `() => Promise<string | null>` when the exchange
-   * needs custom headers or a body — the same contract as the resolver form of
-   * `apiKey`.
-   *
-   * Mutually exclusive with `apiKey`: a server holds a key, a browser holds a mint
-   * route, and passing both is a validation error.
-   */
-  authEndpoint?: string | CredentialProvider | null | undefined;
-
-  /** Timeout for a session-mint request. @default 10000 */
-  authTimeoutMs?: number | undefined;
-
-  /** Explicit opt-in for a cross-origin session-mint endpoint. */
-  allowCrossOriginAuthEndpoint?: boolean | undefined;
-
   /**
    * Local persistence mode. Pass `indexeddb` only when you want offline
    * queueing and a reload-surviving browser cache.
@@ -264,15 +244,12 @@ export interface InternalAbloOptions<S extends SchemaRecord = SchemaRecord> {
    */
   apiKey?: string | CredentialProvider | null | undefined;
 
+  /** A scoped session, or a provider that re-mints it for a long-lived client. */
+  session?: SessionCredential | SessionProvider | SessionEndpoint | null | undefined;
+
   /** Expected project assertion; see {@link AbloOptions.projectId}. */
   projectId?: string | null | undefined;
 
-  /**
-   * Session-mint endpoint (string or async resolver) — see
-   * {@link AbloOptions.authEndpoint}. Mutually exclusive with `apiKey`.
-   */
-  authEndpoint?: string | CredentialProvider | null | undefined;
-
   /**
    * A bearer auth token, sent as `Authorization: Bearer <token>` on every request.
    *

package/src/local/client/reactiveEngine.ts

@@ -2,9 +2,9 @@
  * The reactive engine assembly (ADR 0016). `Ablo({ ... })` resolves auth and
  * capabilities; `humans().init` constructs the store cluster; the lifecycle
  * — first mint, identity, ready() — lives in `./storeLifecycle.ts`. What
- * remains here is assembly around those parts: the claim stream and
- * participant manager, options validation, the typed model proxies, and the
- * commit/claim/session resources — composed into the reactive client.
+ * remains here is assembly around those parts: the claim and presence streams,
+ * options validation, the typed model proxies, and the
+ * commit and claim resources — composed into the reactive client.
  *
  * Extracted from the factory so the composition root stays a root: resolve,
  * dispatch, return. The remaining assembly converts to decoration of a
@@ -12,13 +12,13 @@
  * design step (docs/plans/package-split.md).
  */
 
-import type { Schema, SchemaRecord } from '@abloatai/transaction/schema/schema';
+import type { SchemaRecord } from '@abloatai/transaction/schema/schema';
 import { omittedModelError } from '@abloatai/transaction/schema/select';
 import {
   durableCommitOperationSchema,
   type DurableCommitOperation,
 } from '@abloatai/transaction/commit';
-import { AbloAuthenticationError, AbloConnectionError, AbloValidationError, claimedError } from '@abloatai/transaction/errors';
+import { AbloConnectionError, AbloValidationError, claimedError } from '@abloatai/transaction/errors';
 import type { ModelTarget, ModelClaim } from '@abloatai/transaction/coordination/schema';
 import type { BatchFence } from '@abloatai/transaction/coordination';
 import {
@@ -30,13 +30,6 @@ import {
 	subTarget,
 } from '@abloatai/transaction/coordination';
 import { validateAbloOptions } from './validateAbloOptions.js';
-import { mintSession } from '@abloatai/transaction/auth/sessionMint';
-import type { MintSessionContext } from '@abloatai/transaction/auth/sessionMint';
-import {
-  revokeCapability,
-  rotateCapability,
-} from '@abloatai/transaction/auth/capabilityLifecycle';
-import { modelWireNames } from '@abloatai/transaction/auth/capability';
 import type { StoreCluster } from './storeCluster.js';
 import { startStoreLifecycle } from './storeLifecycle.js';
 import type { SyncWebSocket, CoreSyncEventMap } from '../sync/SyncWebSocket.js';
@@ -46,25 +39,19 @@ import {
   bindClaimLifetime,
   claimLifetimeOf,
 } from '@abloatai/transaction/claims/lifetime';
-import { createParticipantManager } from '../sync/participants.js';
 import type { AttachablePresenceStream } from '../../presenceStream.js';
 import type { ClaimWaitOptions } from '@abloatai/transaction/types/streams';
 import type { Claim } from '@abloatai/transaction/types/streams';
-import type { CredentialProvider } from '@abloatai/transaction/auth/apiKey';
 import { resolveApiKeyValue, resolveBootstrapBaseUrl } from '@abloatai/transaction/auth/apiKey';
 import type { AbloOptions } from './options.js';
 import type { ClientPrelude } from './clientPrelude.js';
 import type {
-  AbloSession,
   ClaimCreateOptions,
   ClaimResource,
   CommitCreateOptions,
   CommitOperationInput,
   CommitReceipt,
   CommitResource,
-  CreateAgentClientParams,
-  CreateAgentSessionParams,
-  CreateSessionParams,
 } from './resourceTypes.js';
 import {
   claimAttemptFailure,
@@ -116,12 +103,6 @@ export interface ReactiveEngineInputs<S extends SchemaRecord> extends ClientPrel
    * assembles around it and constructs none of it.
    */
   cluster: StoreCluster;
-  /**
-   * Constructs a sibling client (`ablo.agents.create(...)` mints a scoped key
-   * and builds a second engine with it). Injected by the factory — a direct
-   * import back into it would close a runtime cycle.
-   */
-  createSibling: (options: AbloOptions<S>) => Ablo<S>;
 }
 
 export function buildReactiveEngine<const S extends SchemaRecord>(
@@ -141,7 +122,6 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
     kind,
     presence,
     cluster,
-    createSibling,
   } = inputs;
   const schema = options.schema;
   const pointReadBaseUrl = resolveBootstrapBaseUrl({
@@ -231,7 +211,7 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
     logger.warn(
       'Ablo: `kind` / `agentId` are ignored when an `apiKey` is configured — ' +
         'the server derives participant identity from the key’s scope. Remove ' +
-        'them (or mint a scoped session via `ablo.sessions.create({ agent })` ' +
+        'them (or mint a scoped session with `Sessions({ schema, apiKey }).create({ agent })` ' +
         'for a distinct agent identity). They apply only to the self-hosted ' +
         '`capabilityToken` path.',
     );
@@ -274,14 +254,6 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
   });
   const ready = lifecycle.ready;
 
-  const participantManager = createParticipantManager({
-    ready,
-    transport,
-    presence: presenceStream,
-    claims: claimStream,
-    schema,
-  });
-
   // 9b. waitForFlush — drains pending mutations using the store's
   //     pendingChanges counter (already maintained by BaseSyncedStore based
   //     on MutationQueue events). Polls every 50ms; uses the existing
@@ -644,17 +616,6 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
         // reconcile errors so read interest never makes a read reject or stall.
         enterScope: (scope) => store.enterScope(scope),
         pinScope: (scope) => store.pinScope(scope),
-        // `ablo.<model>.join(ids, { ttl })` performs a scoped participant join
-        // on this model's sync group(s). WebSocket only — `join` throws
-        // `AbloConnectionError` if the socket isn't ready.
-        // `ttl` passes straight through — both surfaces spell the lease the
-        // same way now, so there is no rename here to make a field's name
-        // disagree with the value it carries.
-        createJoin: (modelKey, ids, options) =>
-          participantManager.join({
-            scope: { [modelKey]: ids },
-            ...(options?.ttl !== undefined ? { ttl: options.ttl } : {}),
-          }),
       },
       readSetContext,
     );
@@ -667,7 +628,7 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
 	      await ready();
 	      const prepared = prepareReadSet(
           cluster.readSetContext,
-          syncClient as object,
+          syncClient,
           commitOptions.readAt,
           commitOptions.idempotencyKey,
           commitOptions.reads,
@@ -752,50 +713,6 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
 	    },
 	  };
 
-	  /**
-	   * The control-plane credential: always the original configured secret key.
-	   * Never reads `authCredentials` — that holds the exchanged sync credential
-	   * (a wide-scope `rk_` on the hosted path), which control-plane routes
-	   * rightly refuse (e.g. the user-session mint is sk_-gated). Counterpart to
-	   * `getAuthToken()`, which resolves the sync-plane token.
-	   *
-	   * The secret-key-only rule is enforced on the server; the credential-kind taxonomy
-	   * (secret/restricted/ephemeral/publishable) lives in `auth/credentialPolicy`.
-	   */
-	  async function controlPlaneApiKey(): Promise<string | null> {
-	    return resolveApiKeyValue(configuredApiKey);
-	  }
-
-	  /**
-	   * Resolve the control-plane context a session/agent mint needs (sk_ +
-	   * bootstrap base URL + the schema-key→typename map the server gates on).
-	   * Shared by `sessions.create` and `agents.create` so the two mint doors
-	   * can never drift on how a token is minted. Throws if no `sk_` is present —
-	   * minting is a backend-only operation.
-	   */
-	  async function buildMintContext(resource: string): Promise<MintSessionContext> {
-	    const apiKey = await controlPlaneApiKey();
-	    if (!apiKey) {
-	      throw new AbloAuthenticationError(
-	        `${resource} requires a secret (sk_) API key — call it from your backend, not the browser.`,
-	        { code: 'apikey_missing' },
-	      );
-	    }
-	    return {
-	      apiKey,
-	      baseUrl: resolveBootstrapBaseUrl({
-	        url,
-	        bootstrapBaseUrl: internalOptions.bootstrapBaseUrl,
-	      }),
-	      ...(internalOptions.fetch ? { fetch: internalOptions.fetch } : {}),
-	      // Map every `can` schema-key to the wire typename the server gates on, so a
-	      // typename override (`documents` → `Document`) doesn't mint a capability
-	      // the server then denies. Derived from this client's schema by the one rule
-	      // the HTTP client and the mint route also read. See `MintSessionContext`.
-	      modelTypenames: modelWireNames(schema.models),
-	    };
-	  }
-
 	  const engine = {
     ...modelProxies,
 
@@ -826,11 +743,6 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
       // is the canonical credential; fall back to a configured API key.
       //
       // This is the sync-plane token (bootstrap, WebSocket, query HTTP). Control-plane
-      // calls (sessions.create, datasource registration) never use it — they
-      // present the original secret key via `controlPlaneApiKey()` below. The
-      // split matters: after the startup exchange this resolver returns the
-      // derived wide-scope `rk_`, a credential the control-plane routes
-      // correctly refuse (an agent token must never mint humans).
       return (
         authCredentials.getAuthToken() ??
         (await resolveApiKeyValue(configuredApiKey)) ??
@@ -857,90 +769,6 @@ export function buildReactiveEngine<const S extends SchemaRecord>(
       store.nudgeReconnect();
     },
 
-    sessions: {
-      // A backend (holding `sk_`) mints a short-lived scoped token for one end
-      // user or one agent.
-      //
-      // Both arms authenticate with the original secret key
-      // (`controlPlaneApiKey()`), never the wide-scope `rk_` the startup exchange
-      // installed as the sync credential. A derived agent credential silently
-      // replacing the secret key on control-plane calls is how humans would get
-      // minted as agents — and correct attribution is the point.
-      async create(params: CreateSessionParams<S>): Promise<AbloSession> {
-        // Both mint paths (`{ user }` → /v1/ephemeral_keys → `ek_`,
-        // `{ agent, can }` → /v1/capabilities → scoped `rk_`) resolve their
-        // control-plane context through the shared `buildMintContext`, so this
-        // client, `agents.create`, and the stateless HTTP client can't drift on
-        // how a token is minted.
-        return mintSession(params, await buildMintContext('sessions.create'));
-      },
-      async revoke({ id }) {
-        const context = await buildMintContext('sessions.revoke');
-        return revokeCapability({
-          apiKey: context.apiKey,
-          baseUrl: context.baseUrl,
-          id,
-          ...(context.fetch ? { fetch: context.fetch } : {}),
-        });
-      },
-      async rotate({ id, graceSeconds, ttlSeconds }) {
-        const context = await buildMintContext('sessions.rotate');
-        return rotateCapability({
-          apiKey: context.apiKey,
-          baseUrl: context.baseUrl,
-          id,
-          ...(graceSeconds !== undefined ? { graceSeconds } : {}),
-          ...(ttlSeconds !== undefined ? { ttlSeconds } : {}),
-          ...(context.fetch ? { fetch: context.fetch } : {}),
-        });
-      },
-    },
-
-    // Mint a scoped agent identity and hand back a connected client bound to it —
-    // `sessions.create({ agent })` plus a typed `Ablo({ schema, apiKey })` client,
-    // for agents that run in this (secret-key-holding) process. Omitting `id`
-    // yields a fresh uuid per call, so concurrent agents are distinct participants
-    // that queue behind each other (even when they share a `name`). Humans don't
-    // get a server-built client — ship them a token via `sessions.create({ user })`.
-    agents: {
-      async create(params: CreateAgentClientParams<S>): Promise<Ablo<S>> {
-        // Distinct participant by default: omit `id` → a fresh uuid, so even two
-        // agents that share a `name` are independent participants and queue
-        // behind one another. `name` is display only (→ userMeta.name); it never
-        // derives the id. Pass an explicit `id` only to re-attach an agent to
-        // its own held claims.
-        const id = params.id ?? globalThis.crypto.randomUUID();
-        const userMeta =
-          params.name !== undefined ? { ...params.userMeta, name: params.name } : params.userMeta;
-        const sessionParams = {
-          agent: { id },
-          can: params.can,
-          ...(params.onBehalfOf ? { onBehalfOf: params.onBehalfOf } : {}),
-          ...(params.syncGroups ? { syncGroups: params.syncGroups } : {}),
-          ...(params.ttlSeconds !== undefined ? { ttlSeconds: params.ttlSeconds } : {}),
-          ...(userMeta ? { userMeta } : {}),
-        } satisfies CreateAgentSessionParams<S>;
-        // Re-mint the `rk_` on every resolver call so a long-lived agent client
-        // never hits token expiry; the `sk_` stays in this process — the child
-        // only ever sees its own short-lived `rk_`.
-        const mintToken = async (): Promise<string> =>
-          (await mintSession(sessionParams, await buildMintContext('agents.create')))
-            .token;
-        // Mint once up front so a bad key / denied scope throws HERE, not later
-        // inside the child's bootstrap; reuse that first token, re-mint on refresh.
-        let pending: string | null = await mintToken();
-        const apiKey: CredentialProvider = async () => {
-          if (pending !== null) {
-            const token = pending;
-            pending = null;
-            return token;
-          }
-          return mintToken();
-        };
-        return createSibling({ ...(internalOptions as AbloOptions<S>), apiKey });
-      },
-    },
-
     async dispose() {
       lifecycle.dispose();
       try {

package/src/local/client/storeLifecycle.ts

@@ -143,7 +143,12 @@ export function startStoreLifecycle<S extends SchemaRecord>(
   // unambiguously a deliberate server client). User-kind clients in Node (an
   // SSR/RSC module evaluating scaffolded browser code) stay reactive-only.
   if (credentialResolver) {
-    const rawEndpoint = internalOptions.authEndpoint ?? internalOptions.apiKey;
+    const rawEndpoint =
+      internalOptions.session &&
+      typeof internalOptions.session === 'object' &&
+      'endpoint' in internalOptions.session
+        ? internalOptions.session.endpoint
+        : internalOptions.apiKey;
     const absoluteEndpoint =
       typeof rawEndpoint === 'string' && /^https?:\/\//i.test(rawEndpoint);
     store.startCredentialLifecycle(credentialResolver, {