@astrale-os/cli 1.0.0-beta.28 → 1.0.0-beta.29

package/dist/public/connect-core.js

@@ -8092,7 +8092,7 @@ async function generateKeyPair(alg, options) {
 // src/keys/pair.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { access, mkdir as mkdir2, readFile as readFile3, unlink as unlink2 } from "node:fs/promises";
-import { dirname as dirname2, join as join2, resolve } from "node:path";
+import { dirname as dirname3, join as join2, resolve } from "node:path";
 
 // src/errors.ts
 class AstraleError extends Error {
@@ -8126,6 +8126,15 @@ class IdentityKeyMissingError extends AstraleError {
 
 // src/state/files.ts
 import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
 import { mkdir, open, readFile, rename, stat, unlink } from "node:fs/promises";
 import { dirname } from "node:path";
 async function atomicWrite(path, data) {
@@ -8156,6 +8165,33 @@ async function atomicWrite(path, data) {
     throw error;
   }
 }
+function atomicWriteSync(path, data) {
+  const directory = dirname(path);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  mkdirSync(directory, { recursive: true });
+  let descriptor;
+  try {
+    descriptor = openSync(temporary, "wx", 384);
+    writeFileSync(descriptor, data);
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    descriptor = undefined;
+    renameSync(temporary, path);
+    const directoryDescriptor = openSync(directory, "r");
+    try {
+      fsyncSync(directoryDescriptor);
+    } finally {
+      closeSync(directoryDescriptor);
+    }
+  } catch (error) {
+    if (descriptor !== undefined)
+      closeSync(descriptor);
+    try {
+      unlinkSync(temporary);
+    } catch {}
+    throw error;
+  }
+}
 async function withFileLock(lockPath, transition, options = {}) {
   const pollIntervalMs = options.pollIntervalMs ?? 100;
   const staleAfterMs = options.staleAfterMs ?? 30000;
@@ -8242,14 +8278,14 @@ function isPidAlive(pid) {
 function sleep(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
-// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/value/limits.js
+// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.14/node_modules/@astrale-os/kernel-dsl/dist/value/limits.js
 var defaultLimits = Object.freeze({
   maxBytes: 16 * 1024 * 1024,
   maxDepth: 64,
   maxMembers: 1e5,
   maxStringBytes: 1024 * 1024
 });
-// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/value/canonical.js
+// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.14/node_modules/@astrale-os/kernel-dsl/dist/value/canonical.js
 var encoder2 = new TextEncoder;
 // node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
 var CharacterCodes;
@@ -8429,7 +8465,7 @@ var ParseErrorCode;
   ParseErrorCode2[ParseErrorCode2["InvalidCharacter"] = 16] = "InvalidCharacter";
 })(ParseErrorCode || (ParseErrorCode = {}));
 
-// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/value/decode.js
+// node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.14/node_modules/@astrale-os/kernel-dsl/dist/value/decode.js
 var decoder2 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -22730,6 +22766,7 @@ function createPaths(home, environment) {
     idps: join(idpsDir, "index.json"),
     idpSessionsDir,
     exchangeCredentials: join(base, "exchange", "credentials.json"),
+    sessionRoutes: join(base, "session", "routes.json"),
     idpDir: (name) => join(idpsDir, name),
     idpSession: (identityName) => join(idpSessionsDir, `${identityName}.json`)
   });
@@ -22745,6 +22782,7 @@ var INSTANCES_PATH = paths.instances;
 var IDPS_PATH = paths.idps;
 var IDP_SESSIONS_DIR = paths.idpSessionsDir;
 var EXCHANGE_CREDENTIALS_PATH = paths.exchangeCredentials;
+var SESSION_ROUTES_PATH = paths.sessionRoutes;
 // src/state/identities.ts
 import { readFile as readFile2 } from "node:fs/promises";
 var IDENTITY_STORE_VERSION = 1;
@@ -22866,6 +22904,35 @@ async function preserveLegacyBackup(path, legacyBytes) {
 function invalidState(path, cause) {
   return new IdentityStateError("IDENTITY_STATE_INVALID", path, `Identity state at ${path} is malformed`, cause);
 }
+// src/state/session-routes.ts
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+class FileSessionRouteStore {
+  path;
+  constructor(path = SESSION_ROUTES_PATH) {
+    this.path = path;
+  }
+  read() {
+    return JSON.parse(readFileSync(this.path, "utf8"));
+  }
+  write(artifact) {
+    const directory = dirname2(this.path);
+    mkdirSync2(directory, { recursive: true, mode: 448 });
+    chmodSync(directory, 448);
+    atomicWriteSync(this.path, `${JSON.stringify(artifact)}
+`);
+    chmodSync(this.path, 384);
+  }
+  clear() {
+    try {
+      unlinkSync2(this.path);
+    } catch (error51) {
+      if (error51.code !== "ENOENT")
+        throw error51;
+    }
+  }
+}
+var SESSION_ROUTE_STORE = Object.freeze(new FileSessionRouteStore);
 // src/keys/algorithm.ts
 function inferAlg(privateJwk, keyPath) {
   const explicit = privateJwk.alg;
@@ -22903,7 +22970,7 @@ function keypairPaths(subject, keysDir = KEYS_DIR) {
 }
 function confinedKeyPath(keysDir, filename, subject) {
   const path = join2(keysDir, filename);
-  if (dirname2(resolve(path)) !== resolve(keysDir))
+  if (dirname3(resolve(path)) !== resolve(keysDir))
     throw invalidKeySubject(subject);
   return path;
 }
@@ -23106,7 +23173,7 @@ async function signAs(subject, keysDir = KEYS_DIR, opts) {
 }
 // src/lib/idp.ts
 import { mkdir as mkdir3, readFile as readFile4, readdir, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname3, join as join3 } from "node:path";
+import { dirname as dirname4, join as join3 } from "node:path";
 
 // node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -23659,7 +23726,7 @@ var log = {
   dim: (msg) => console.log(source_default.dim(msg))
 };
 var IS_CI = !!(process.env.CI || process.env.CONTINUOUS_INTEGRATION || process.env.NO_SPINNER);
-// node_modules/.pnpm/@astrale-os+kernel-core@0.9.0-beta.16/node_modules/@astrale-os/kernel-core/dist/dns-label.js
+// node_modules/.pnpm/@astrale-os+kernel-core@0.9.0-beta.17_zod@4.4.3/node_modules/@astrale-os/kernel-core/dist/dns-label.js
 var DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 function isDnsLabel(value) {
   return DNS_LABEL_RE.test(value);
@@ -23830,7 +23897,7 @@ async function readIdpStore() {
   }
 }
 async function writeIdpStore(store) {
-  await mkdir3(dirname3(IDPS_PATH), { recursive: true });
+  await mkdir3(dirname4(IDPS_PATH), { recursive: true });
   await atomicWrite(IDPS_PATH, JSON.stringify(store, null, 2) + `
 `);
 }
@@ -24040,7 +24107,7 @@ function identityNameFromClaims(claims, fallback) {
 }
 async function saveIdpSession(session) {
   const path = idpSessionPath(session.identity);
-  await mkdir3(dirname3(path), { recursive: true });
+  await mkdir3(dirname4(path), { recursive: true });
   await atomicWrite(path, JSON.stringify(session, null, 2) + `
 `);
 }
@@ -24300,7 +24367,7 @@ async function upsertIdpIdentity(name, options) {
 }
 // src/lib/instance.ts
 import { readFile as readFile5, writeFile, mkdir as mkdir4 } from "node:fs/promises";
-import { dirname as dirname4 } from "node:path";
+import { dirname as dirname5 } from "node:path";
 var InstanceKindSchema = exports_external.enum(["bookmark"]);
 var InstanceEntrySchema = exports_external.object({
   url: exports_external.string().optional(),
@@ -24385,7 +24452,7 @@ async function readInstances(_config, opts = {}) {
   return store;
 }
 async function writeInstances(store) {
-  await mkdir4(dirname4(INSTANCES_PATH), { recursive: true });
+  await mkdir4(dirname5(INSTANCES_PATH), { recursive: true });
   await writeFile(INSTANCES_PATH, JSON.stringify(store, null, 2) + `
 `);
   instancesMemo = store;
@@ -24487,7 +24554,7 @@ import {
   rm,
   writeFile as writeFile2
 } from "node:fs/promises";
-import { dirname as dirname5, join as join4 } from "node:path";
+import { dirname as dirname6, join as join4 } from "node:path";
 var DEFAULT_REPO = "astrale-os/cli";
 var DEFAULT_UPDATE_CHANNEL = "beta";
 var InstallMetadataSchema = exports_external.object({
@@ -24519,7 +24586,7 @@ function isMissingFile(error51) {
 async function writeInstallMetadata(meta3, path = INSTALL_PATH, filesystem = { mkdir: mkdir5, rename: rename2, rm, writeFile: writeFile2 }) {
   const staged = `${path}.next`;
   const previous = `${path}.previous`;
-  await filesystem.mkdir(dirname5(path), { recursive: true });
+  await filesystem.mkdir(dirname6(path), { recursive: true });
   await filesystem.rm(staged, { force: true });
   await filesystem.rm(previous, { force: true });
   await filesystem.writeFile(staged, JSON.stringify(meta3, null, 2) + `
@@ -24550,7 +24617,7 @@ async function writeInstallMetadata(meta3, path = INSTALL_PATH, filesystem = { m
 var defaultCohortFilesystem = { chmod, copyFile, mkdir: mkdir5, rename: rename2, rm };
 async function replaceStandaloneCohort(installedBinary, nextBinary, nextViewerDist, filesystem = {}) {
   const fs = { ...defaultCohortFilesystem, ...filesystem };
-  const binDirectory = dirname5(installedBinary);
+  const binDirectory = dirname6(installedBinary);
   const previousBinary = `${installedBinary}.previous`;
   const stagedBinary = `${installedBinary}.next`;
   const viewer = join4(binDirectory, "viewer");
@@ -24925,10 +24992,12 @@ function isManagedInstanceNotFound(error51) {
 }
 // src/lib/config.ts
 import { readFile as readFile7, writeFile as writeFile3, mkdir as mkdir6 } from "node:fs/promises";
+var bound = exports_external.number().positive().finite().optional().catch(undefined);
 var AstraleConfigSchema = exports_external.object({
   issuer: exports_external.string().url().default("https://unregistered.invalid"),
   admin: AdminTargetConfigSchema.default(DEFAULT_ADMIN_TARGET_CONFIG),
-  telemetry: exports_external.object({ enabled: exports_external.boolean().default(true) }).default({ enabled: true })
+  telemetry: exports_external.object({ enabled: exports_external.boolean().default(true), maxAgeDays: bound, maxBytes: bound }).default({ enabled: true }),
+  browser: exports_external.object({ maxCacheBytes: bound, maxProfileAgeDays: bound }).default({})
 });
 var DEFAULT_CONFIG = AstraleConfigSchema.parse({});
 async function readConfig() {
@@ -25263,11 +25332,11 @@ async function obtainToken(idp, opts, scope) {
 }
 // src/lib/ca-fetch.ts
 import { Buffer } from "node:buffer";
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 import { request as httpsRequest } from "node:https";
 import { rootCertificates } from "node:tls";
 function fetchWithCaFile(caFile, fallback = globalThis.fetch) {
-  const ca = readFileSync(caFile);
+  const ca = readFileSync2(caFile);
   const fallbackFetch = fallback.bind(globalThis);
   return async (input, init) => {
     const url2 = requestUrl(input);

package/dist/public/keys/index.js

@@ -1151,7 +1151,7 @@ async function generateKeyPair(alg, options) {
 // src/keys/pair.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { access, mkdir as mkdir2, readFile as readFile3, unlink as unlink2 } from "node:fs/promises";
-import { dirname as dirname2, join as join2, resolve } from "node:path";
+import { dirname as dirname3, join as join2, resolve } from "node:path";
 
 // src/errors.ts
 class AstraleError extends Error {
@@ -1185,6 +1185,15 @@ class IdentityKeyMissingError extends AstraleError {
 
 // src/state/files.ts
 import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
 import { mkdir, open, readFile, rename, stat, unlink } from "node:fs/promises";
 import { dirname } from "node:path";
 async function atomicWrite(path, data) {
@@ -1215,6 +1224,33 @@ async function atomicWrite(path, data) {
     throw error;
   }
 }
+function atomicWriteSync(path, data) {
+  const directory = dirname(path);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  mkdirSync(directory, { recursive: true });
+  let descriptor;
+  try {
+    descriptor = openSync(temporary, "wx", 384);
+    writeFileSync(descriptor, data);
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    descriptor = undefined;
+    renameSync(temporary, path);
+    const directoryDescriptor = openSync(directory, "r");
+    try {
+      fsyncSync(directoryDescriptor);
+    } finally {
+      closeSync(directoryDescriptor);
+    }
+  } catch (error) {
+    if (descriptor !== undefined)
+      closeSync(descriptor);
+    try {
+      unlinkSync(temporary);
+    } catch {}
+    throw error;
+  }
+}
 async function withFileLock(lockPath, transition, options = {}) {
   const pollIntervalMs = options.pollIntervalMs ?? 100;
   const staleAfterMs = options.staleAfterMs ?? 30000;
@@ -15600,6 +15636,7 @@ function createPaths(home, environment) {
     idps: join(idpsDir, "index.json"),
     idpSessionsDir,
     exchangeCredentials: join(base, "exchange", "credentials.json"),
+    sessionRoutes: join(base, "session", "routes.json"),
     idpDir: (name) => join(idpsDir, name),
     idpSession: (identityName) => join(idpSessionsDir, `${identityName}.json`)
   });
@@ -15615,6 +15652,7 @@ var INSTANCES_PATH = paths.instances;
 var IDPS_PATH = paths.idps;
 var IDP_SESSIONS_DIR = paths.idpSessionsDir;
 var EXCHANGE_CREDENTIALS_PATH = paths.exchangeCredentials;
+var SESSION_ROUTES_PATH = paths.sessionRoutes;
 // src/state/identities.ts
 import { readFile as readFile2 } from "node:fs/promises";
 var IDENTITY_STORE_VERSION = 1;
@@ -15736,6 +15774,35 @@ async function preserveLegacyBackup(path, legacyBytes) {
 function invalidState(path, cause) {
   return new IdentityStateError("IDENTITY_STATE_INVALID", path, `Identity state at ${path} is malformed`, cause);
 }
+// src/state/session-routes.ts
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+class FileSessionRouteStore {
+  path;
+  constructor(path = SESSION_ROUTES_PATH) {
+    this.path = path;
+  }
+  read() {
+    return JSON.parse(readFileSync(this.path, "utf8"));
+  }
+  write(artifact) {
+    const directory = dirname2(this.path);
+    mkdirSync2(directory, { recursive: true, mode: 448 });
+    chmodSync(directory, 448);
+    atomicWriteSync(this.path, `${JSON.stringify(artifact)}
+`);
+    chmodSync(this.path, 384);
+  }
+  clear() {
+    try {
+      unlinkSync2(this.path);
+    } catch (error51) {
+      if (error51.code !== "ENOENT")
+        throw error51;
+    }
+  }
+}
+var SESSION_ROUTE_STORE = Object.freeze(new FileSessionRouteStore);
 // src/keys/algorithm.ts
 function inferAlg(privateJwk, keyPath) {
   const explicit = privateJwk.alg;
@@ -15773,7 +15840,7 @@ function keypairPaths(subject, keysDir = KEYS_DIR) {
 }
 function confinedKeyPath(keysDir, filename, subject) {
   const path = join2(keysDir, filename);
-  if (dirname2(resolve(path)) !== resolve(keysDir))
+  if (dirname3(resolve(path)) !== resolve(keysDir))
     throw invalidKeySubject(subject);
   return path;
 }

package/dist/public/paths/index.js

@@ -18,6 +18,15 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/state/files.ts
 import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
 import { mkdir, open, readFile, rename, stat, unlink } from "node:fs/promises";
 import { dirname } from "node:path";
 async function atomicWrite(path, data) {
@@ -48,6 +57,33 @@ async function atomicWrite(path, data) {
     throw error;
   }
 }
+function atomicWriteSync(path, data) {
+  const directory = dirname(path);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  mkdirSync(directory, { recursive: true });
+  let descriptor;
+  try {
+    descriptor = openSync(temporary, "wx", 384);
+    writeFileSync(descriptor, data);
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    descriptor = undefined;
+    renameSync(temporary, path);
+    const directoryDescriptor = openSync(directory, "r");
+    try {
+      fsyncSync(directoryDescriptor);
+    } finally {
+      closeSync(directoryDescriptor);
+    }
+  } catch (error) {
+    if (descriptor !== undefined)
+      closeSync(descriptor);
+    try {
+      unlinkSync(temporary);
+    } catch {}
+    throw error;
+  }
+}
 async function withFileLock(lockPath, transition, options = {}) {
   const pollIntervalMs = options.pollIntervalMs ?? 100;
   const staleAfterMs = options.staleAfterMs ?? 30000;
@@ -14433,6 +14469,7 @@ function createPaths(home, environment) {
     idps: join(idpsDir, "index.json"),
     idpSessionsDir,
     exchangeCredentials: join(base, "exchange", "credentials.json"),
+    sessionRoutes: join(base, "session", "routes.json"),
     idpDir: (name) => join(idpsDir, name),
     idpSession: (identityName) => join(idpSessionsDir, `${identityName}.json`)
   });
@@ -14448,6 +14485,7 @@ var INSTANCES_PATH = paths.instances;
 var IDPS_PATH = paths.idps;
 var IDP_SESSIONS_DIR = paths.idpSessionsDir;
 var EXCHANGE_CREDENTIALS_PATH = paths.exchangeCredentials;
+var SESSION_ROUTES_PATH = paths.sessionRoutes;
 // src/state/identities.ts
 import { readFile as readFile2 } from "node:fs/promises";
 var IDENTITY_STORE_VERSION = 1;
@@ -14569,6 +14607,35 @@ async function preserveLegacyBackup(path, legacyBytes) {
 function invalidState(path, cause) {
   return new IdentityStateError("IDENTITY_STATE_INVALID", path, `Identity state at ${path} is malformed`, cause);
 }
+// src/state/session-routes.ts
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+class FileSessionRouteStore {
+  path;
+  constructor(path = SESSION_ROUTES_PATH) {
+    this.path = path;
+  }
+  read() {
+    return JSON.parse(readFileSync(this.path, "utf8"));
+  }
+  write(artifact) {
+    const directory = dirname2(this.path);
+    mkdirSync2(directory, { recursive: true, mode: 448 });
+    chmodSync(directory, 448);
+    atomicWriteSync(this.path, `${JSON.stringify(artifact)}
+`);
+    chmodSync(this.path, 384);
+  }
+  clear() {
+    try {
+      unlinkSync2(this.path);
+    } catch (error51) {
+      if (error51.code !== "ENOENT")
+        throw error51;
+    }
+  }
+}
+var SESSION_ROUTE_STORE = Object.freeze(new FileSessionRouteStore);
 export {
   ASTRALE_HOME,
   CONFIG_PATH,

package/dist/types/connection/session.d.ts

@@ -1,6 +1,6 @@
 import type { AuthApi } from '@astrale-os/sdk/auth';
 import type { GraphApi } from '@astrale-os/sdk/client';
-import type { ClientSessionOptions, SessionAuth } from '@astrale-os/sdk/client/session';
+import type { ClientSessionOptions, SessionAuth, SessionRouteStore } from '@astrale-os/sdk/client/session';
 import { ClientSession } from '@astrale-os/sdk/client/session';
 import type { AstraleConfig } from '../lib/config';
 import type { AdminConnectionOptions, ConnectionOptions, ConnectionTarget } from './target';
@@ -26,6 +26,6 @@ export declare function withAdminClientSession<Value>(options: AdminConnectionOp
 export declare function withResolvedClientSession<Value>(target: ConnectionTarget, options: ConnectionOptions, config: AstraleConfig, action: (context: ConnectionContext) => Promise<Value>, open?: ConnectionFactory): Promise<Value>;
 export declare function resolveTimeoutMs(raw: string | undefined): number;
 /** Owner-private construction seam proving that transport and source identity stay distinct. */
-export declare function createClientSessionOptions(target: ConnectionTarget, fetch: NonNullable<ClientSessionOptions['fetch']>, auth: SessionAuth | undefined, timeoutMs: number): ClientSessionOptions;
+export declare function createClientSessionOptions(target: ConnectionTarget, fetch: NonNullable<ClientSessionOptions['fetch']>, auth: SessionAuth | undefined, timeoutMs: number, routeStore?: SessionRouteStore): ClientSessionOptions;
 export declare function lookupManagedInstance(slug: string, options: ConnectionOptions, openAdmin?: typeof withAdminClientSession, connect?: typeof connectAdminInstances): Promise<InstanceInfo>;
 export {};

package/dist/types/lib/config.d.ts

@@ -10,6 +10,12 @@ export declare const AstraleConfigSchema: z.ZodObject<{
     }, z.core.$strip>>;
     telemetry: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
+        maxAgeDays: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
+        maxBytes: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
+    }, z.core.$strip>>;
+    browser: z.ZodDefault<z.ZodObject<{
+        maxCacheBytes: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
+        maxProfileAgeDays: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type AstraleConfig = z.infer<typeof AstraleConfigSchema>;

package/dist/types/state/exchange-credentials.d.ts

@@ -1,16 +1,20 @@
 export declare namespace exchange {
     interface Artifact {
-        readonly version: 1;
+        readonly version: 2;
         readonly entries: Record<string, Entry>;
     }
     interface Key {
         readonly kernelIssuer: string;
         readonly domainIssuer: string;
-        readonly user: string;
+        readonly sourceIssuer: string;
+        readonly sourceSubject: string;
     }
     interface Entry {
         readonly credential: string;
         readonly expiresAt: number;
+        readonly user: string;
+        readonly sourceIssuer: string;
+        readonly sourceSubject: string;
     }
 }
 export declare class ExchangeCredentialCache {

package/dist/types/state/files.d.ts

@@ -1,5 +1,7 @@
 /** Atomically publish one complete private state file through a same-directory temporary file. */
 export declare function atomicWrite(path: string, data: string): Promise<void>;
+/** Atomically publish one complete private state file for synchronous consumer capabilities. */
+export declare function atomicWriteSync(path: string, data: string): void;
 export interface FileLockOptions {
     readonly pollIntervalMs?: number;
     readonly staleAfterMs?: number;

package/dist/types/state/index.d.ts

@@ -1,8 +1,9 @@
-export { atomicWrite, withFileLock } from './files';
+export { atomicWrite, atomicWriteSync, withFileLock } from './files';
 export type { FileLockOptions } from './files';
 export { ExchangeCredentialCache } from './exchange-credentials';
 export type { exchange } from './exchange-credentials';
 export { IDENTITY_STORE_VERSION, readIdentityStore, updateIdentityStore } from './identities';
 export type { Identity, IdentityMode, IdentitySource, IdentityStore, IdentityStoreOptions, IdentityUpdate, Registration, } from './identities';
-export { ASTRALE_HOME, CONFIG_PATH, DATA_DIR, IDENTITIES_PATH, IDPS_PATH, IDP_SESSIONS_DIR, EXCHANGE_CREDENTIALS_PATH, INSTALL_PATH, INSTANCES_PATH, KEYS_DIR, createPaths, paths, } from './paths';
+export { ASTRALE_HOME, CONFIG_PATH, DATA_DIR, IDENTITIES_PATH, IDPS_PATH, IDP_SESSIONS_DIR, EXCHANGE_CREDENTIALS_PATH, INSTALL_PATH, INSTANCES_PATH, KEYS_DIR, SESSION_ROUTES_PATH, createPaths, paths, } from './paths';
 export type { PathEnvironment, Paths } from './paths';
+export { FileSessionRouteStore, SESSION_ROUTE_STORE } from './session-routes';

package/dist/types/state/paths.d.ts

@@ -14,6 +14,7 @@ export interface Paths {
     readonly idps: string;
     readonly idpSessionsDir: string;
     readonly exchangeCredentials: string;
+    readonly sessionRoutes: string;
     idpDir(name: string): string;
     idpSession(identityName: string): string;
 }
@@ -30,3 +31,4 @@ export declare const INSTANCES_PATH: string;
 export declare const IDPS_PATH: string;
 export declare const IDP_SESSIONS_DIR: string;
 export declare const EXCHANGE_CREDENTIALS_PATH: string;
+export declare const SESSION_ROUTES_PATH: string;

package/dist/types/state/session-routes.d.ts

@@ -0,0 +1,10 @@
+import type { SessionRouteArtifact, SessionRouteStore } from '@astrale-os/sdk/client/session';
+/** CLI filesystem representation for Kernel Client's admitted confidential route artifact. */
+export declare class FileSessionRouteStore implements SessionRouteStore {
+    private readonly path;
+    constructor(path?: string);
+    read(): unknown;
+    write(artifact: SessionRouteArtifact): void;
+    clear(): void;
+}
+export declare const SESSION_ROUTE_STORE: Readonly<FileSessionRouteStore>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.28",
+  "version": "1.0.0-beta.29",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -63,7 +63,7 @@
   },
   "devDependencies": {
     "@astrale-os/ox": ">=0.1.3 <1.0.0",
-    "@astrale-os/sdk": "0.5.0-beta.51",
+    "@astrale-os/sdk": "0.5.0-beta.54",
     "@astrale-os/shell": "0.4.2-beta.6",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@commitlint/cli": "21.2.2",

package/src/commands/auth/logout.ts

@@ -4,7 +4,7 @@ import { getDefault, readIdentities } from '../../identity/index'
 import { deleteIdpSession, listIdpSessions } from '../../lib/idp'
 import { log } from '../../lib/log'
 import { output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-import { ExchangeCredentialCache } from '../../state/index'
+import { ExchangeCredentialCache, SESSION_ROUTE_STORE } from '../../state/index'
 
 export default {
   name: 'logout',
@@ -30,6 +30,7 @@ export default {
 
     for (const name of names) await deleteIdpSession(name)
     await new ExchangeCredentialCache().clear()
+    SESSION_ROUTE_STORE.clear()
 
     if (opts.raw || opts.json) {
       output({ cleared: names }, opts)

package/src/commands/browser.ts

@@ -13,6 +13,7 @@ import {
   profileDirFor,
   saveSession,
 } from '../lib/browser'
+import { sweepBrowserProfiles } from '../lib/browser-retention'
 import { readLocalStatus } from '../lib/local-status'
 import { fatal, log } from '../lib/log'
 import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../lib/output'
@@ -25,6 +26,29 @@ type BrowserOpts = RawOutputOpts & {
   check?: boolean
 }
 
+/**
+ * Opportunistic profile retention, the same `git gc --auto` shape the session
+ * store uses: no daemon, no cron, it just rides on the command that created the
+ * mess. Silent when there is nothing to do, and never fatal — losing a sweep is
+ * strictly better than losing the browser command.
+ */
+async function reportSweep(machine: boolean): Promise<void> {
+  try {
+    const swept = await sweepBrowserProfiles()
+    if (machine || swept.bytesFreed === 0) return
+    const freed = `${(swept.bytesFreed / 1024 / 1024).toFixed(0)} MB`
+    const what = [
+      swept.removed.length > 0 ? `${swept.removed.length} dormant profile(s) removed` : null,
+      swept.purged.length > 0 ? `${swept.purged.length} cache(s) trimmed` : null,
+    ]
+      .filter(Boolean)
+      .join(', ')
+    log.dim(`retention: ${what} — ${freed} freed`)
+  } catch {
+    /* retention must never break the browser command */
+  }
+}
+
 const LOGIN_TIMEOUT_MS = 180_000
 const POLL_INTERVAL_MS = 2500
 
@@ -125,6 +149,11 @@ Examples:
     const host = new URL(gui).host
     await requireAgentBrowser(machine, opts)
 
+    // Retention runs BEFORE anything launches, so no profile we touch can be in
+    // use by a browser this command started. Profiles held by someone else's
+    // live browser are skipped by the sweep itself.
+    await reportSweep(machine)
+
     const usingCdp = !!opts.cdp
     const profile = usingCdp ? null : (opts.profile ?? profileDirFor(host))
     const target = usingCdp ? { cdp: opts.cdp } : { profile: profile! }