@astrale-os/kernel-client 0.6.0-beta.6 → 0.6.0-beta.60

package/dist/session/discovery/index.d.ts

@@ -1,10 +1,12 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { publication } from '@astrale-os/kernel-protocol';
 import type { Fetch } from '../../transport/http/index.js';
 import type { SessionOperation, SessionPolicy } from '../context/index.js';
 import type { SessionSnapshot } from './snapshot.js';
 export type { SessionSnapshot } from './snapshot.js';
 export interface SessionDiscovery {
     readonly kernel: IssuerId;
+    publication(operation: SessionOperation): Promise<publication.Publication>;
     snapshot(operation: SessionOperation): Promise<SessionSnapshot>;
     clear(): void;
 }
@@ -18,4 +20,3 @@ export interface SessionDiscoveryOptions {
     readonly acquisitionOperation: () => SessionOperation;
 }
 export declare function createSessionDiscovery(options: SessionDiscoveryOptions): SessionDiscovery;
-//# sourceMappingURL=index.d.ts.map

package/dist/session/discovery/index.js

@@ -13,4 +13,3 @@ export function createSessionDiscovery(options) {
         maximumBytes: options.maximumBundleBytes,
     }), options.requireOpen, options.acquisitionOperation);
 }
-//# sourceMappingURL=index.js.map

package/dist/session/discovery/publication.d.ts

@@ -21,4 +21,3 @@ export declare class PublicationDiscovery {
 }
 export declare function boundedResponse(response: Response, maximum: number, signal: AbortSignal): Promise<Uint8Array>;
 export declare function requireExactResponse(response: Response, expected: string, label: string): void;
-//# sourceMappingURL=publication.d.ts.map

package/dist/session/discovery/publication.js

@@ -1,7 +1,8 @@
 import * as codecs from '@astrale-os/kernel-protocol/codecs';
 import * as publicationCodec from '@astrale-os/kernel-protocol/publication/publication';
 import { ClientError } from '../../errors/index.js';
-import { allowEndpoint, runSessionOperation } from '../context/index.js';
+import { allowEndpoint } from '../context/index.js';
+import { runAcquisition } from './transport.js';
 export class PublicationDiscovery {
     options;
     publication;
@@ -29,7 +30,7 @@ export class PublicationDiscovery {
     async fetch(operation, previous) {
         const url = publicationCodec.url(this.options.kernel);
         allowEndpoint(url, this.options.policy);
-        const response = await runSessionOperation(operation, (signal) => this.options.fetch(url, {
+        const response = await runAcquisition(operation, 'publication', 'unknown', 'Kernel Publication could not be retrieved.', (signal) => this.options.fetch(url, {
             headers: {
                 accept: 'application/json',
                 ...(previous === undefined ? {} : { 'if-none-match': `"${previous.etag}"` }),
@@ -51,7 +52,7 @@ export class PublicationDiscovery {
         if (!response.ok) {
             throw new ClientError(`Publication discovery returned HTTP ${response.status}.`);
         }
-        const body = await runSessionOperation(operation, (signal) => boundedResponse(response, this.options.maximumBytes, signal));
+        const body = await runAcquisition(operation, 'publication', 'receive', 'Kernel Publication response could not be read.', (signal) => boundedResponse(response, this.options.maximumBytes, signal));
         const admitted = publicationCodec.accept(codecs.json.decode(body));
         if (admitted.identity.issuer !== this.options.kernel) {
             throw new ClientError('Publication issuer differs from the requested Kernel issuer.');
@@ -120,4 +121,3 @@ function join(parts, length) {
     }
     return output;
 }
-//# sourceMappingURL=publication.js.map

package/dist/session/discovery/snapshot.d.ts

@@ -10,4 +10,3 @@ export interface SessionSnapshot {
     readonly views: ViewCatalog;
 }
 export declare function createSessionSnapshot(kernel: IssuerId, publication: publication.Publication, artifact: bundle.Bundle, views: ViewCatalog): SessionSnapshot;
-//# sourceMappingURL=snapshot.d.ts.map

package/dist/session/discovery/snapshot.js

@@ -1,4 +1,3 @@
 export function createSessionSnapshot(kernel, publication, artifact, views) {
     return Object.freeze({ kernel, publication, bundle: artifact, views });
 }
-//# sourceMappingURL=snapshot.js.map

package/dist/session/discovery/transport.d.ts

@@ -0,0 +1,6 @@
+import type { TransportPhase } from '../../errors/index.js';
+import type { SessionOperation } from '../context/index.js';
+type AcquisitionResource = 'publication' | 'bundle';
+/** Normalize only unknown failures from one injected acquisition capability. */
+export declare function runAcquisition<Result>(operation: SessionOperation, resource: AcquisitionResource, phase: Extract<TransportPhase, 'receive' | 'unknown'>, message: string, task: (signal: AbortSignal) => Result | PromiseLike<Result>): Promise<Result>;
+export {};

package/dist/session/discovery/transport.js

@@ -0,0 +1,13 @@
+import { ClientError, TransportError } from '../../errors/index.js';
+import { runSessionOperation } from '../context/index.js';
+/** Normalize only unknown failures from one injected acquisition capability. */
+export async function runAcquisition(operation, resource, phase, message, task) {
+    try {
+        return await runSessionOperation(operation, task);
+    }
+    catch (cause) {
+        if (cause instanceof ClientError)
+            throw cause;
+        throw TransportError.acquisition(message, { cause, phase, resource });
+    }
+}

package/dist/session/index.d.ts

@@ -1,8 +1,9 @@
 export type { SessionControlOptions, SessionPolicy } from './context/index.js';
-export type { ReadyInstallation } from '../schema/index.js';
+export { bindSession, type BoundClientSession, type BoundSessionControls, type BoundSessionSource, } from './bound.js';
 export type { SessionSnapshot } from './discovery/index.js';
-export type { Auth, SessionAuth, SessionEnvelopeTransport, SessionRequestOptions, } from './routing/index.js';
+export type { Auth, PersistedRoute, SessionRouteArtifact, SessionRouteStore, SessionAuth, SessionEnvelopeTransport, SessionRequestOptions, } from './routing/index.js';
 export { ClientSession, connect, type ClientSessionOptions, type ConnectOptions, } from './session.js';
 export type { CallableReference, InputOfReference, InstanceCallableReference, OutputOfReference, } from './reference.js';
+export { reference } from './reference.js';
 export type { ResolvedView, ViewCatalog } from './views/index.js';
-//# sourceMappingURL=index.d.ts.map
+export type { DomainBinding } from '../graph/domain/index.js';

package/dist/session/index.js

@@ -1,2 +1,3 @@
+export { bindSession, } from './bound.js';
 export { ClientSession, connect, } from './session.js';
-//# sourceMappingURL=index.js.map
+export { reference } from './reference.js';

package/dist/session/reference.d.ts

@@ -1,27 +1,35 @@
 import type { Path as PathValue, PathLike } from '@astrale-os/kernel-core/path';
-import type { Revision } from '@astrale-os/kernel-dsl/v1/schema';
+import type { CallableInputOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ExecutableMethod } from '@astrale-os/kernel-dsl/v1';
+import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
 import { type Key as KeyType } from '@astrale-os/kernel-dsl/v1/addressing';
-import type { Input, Result } from '../client/index.js';
+import type { Binary, Input } from '../client/index.js';
 declare const REFERENCE_INPUT: unique symbol;
 declare const REFERENCE_OUTPUT: unique symbol;
-export interface CallableReference<InputValue extends Input = Input, Output = unknown> {
+export interface CallableReference<InputValue = Input, Output = unknown> {
     readonly origin: KeyType.Origin;
     readonly revision: Revision;
     readonly callable: KeyType.Callable;
     readonly target: PathValue;
-    readonly outputMode: Exclude<Result['kind'], 'redirect'>;
+    readonly outputMode: 'value' | 'stream' | 'binary';
     readonly [REFERENCE_INPUT]?: InputValue;
     readonly [REFERENCE_OUTPUT]?: Output;
 }
-export interface InstanceCallableReference<InputValue extends Input = Input, Output = unknown> {
+export interface InstanceCallableReference<InputValue = Input, Output = unknown> {
     (receiver: PathLike): CallableReference<InputValue, Output>;
     readonly origin: KeyType.Origin;
     readonly revision: Revision;
     readonly callable: KeyType.Callable;
-    readonly outputMode: Exclude<Result['kind'], 'redirect'>;
+    readonly outputMode: 'value' | 'stream' | 'binary';
 }
-export type InputOfReference<Reference extends CallableReference> = Reference extends CallableReference<infer InputValue, unknown> ? InputValue : never;
-export type OutputOfReference<Reference extends CallableReference> = Reference extends CallableReference<infer _Input, infer Output> ? Output : never;
-export declare function admitReference(input: CallableReference): CallableReference;
+export type InputOfReference<Reference extends CallableReference<unknown>> = Reference extends CallableReference<infer InputValue, unknown> ? InputValue : never;
+export type OutputOfReference<Reference extends CallableReference<unknown>> = Reference extends CallableReference<infer _Input, infer Output> ? Output : never;
+type ReferenceInput<Callable> = unknown extends CallableInputOf<Callable> ? Input : CallableInputOf<Callable>;
+type ReferenceOutput<Callable> = unknown extends CallableOutputOf<Callable> ? unknown : CallableResultOf<Callable, Binary>;
+type ExecutableStaticMethod = ExecutableMethod<unknown, unknown, true>;
+type ExecutableInstanceMethod = ExecutableMethod<unknown, unknown, false>;
+/** Project one exact resolved Function or static Method into a typed Client reference. */
+export declare function reference<const Callable extends ResolvedFunction | ExecutableStaticMethod>(domain: Pick<Domain, 'origin' | 'revision'>, callable: Callable): CallableReference<ReferenceInput<Callable>, ReferenceOutput<Callable>>;
+/** Project one exact resolved instance Method into a receiver-bound typed Client reference. */
+export declare function reference<const Callable extends ExecutableInstanceMethod>(domain: Pick<Domain, 'origin' | 'revision'>, callable: Callable): InstanceCallableReference<ReferenceInput<Callable>, ReferenceOutput<Callable>>;
+export declare function admitReference(input: CallableReference<unknown>): CallableReference<unknown>;
 export {};
-//# sourceMappingURL=reference.d.ts.map

package/dist/session/reference.js

@@ -1,5 +1,28 @@
 import { Path } from '@astrale-os/kernel-core/path';
-import { Key, patterns, Ref } from '@astrale-os/kernel-dsl/v1/addressing';
+import { callableAddress, Key, patterns, } from '@astrale-os/kernel-dsl/v1/addressing';
+export function reference(domain, callable) {
+    if (Key.origin(callable.key) !== domain.origin)
+        invalid();
+    if ('owner' in callable && !callable.executable)
+        invalid();
+    const common = Object.freeze({
+        origin: domain.origin,
+        revision: domain.revision,
+        callable: callable.key,
+        outputMode: callable.output.mode,
+    });
+    if ('owner' in callable && !callable.static) {
+        const bind = (receiver) => admitReference({
+            ...common,
+            target: Path.instanceMethod(Path.from(receiver), callable.key),
+        });
+        return Object.assign(bind, common);
+    }
+    const target = 'owner' in callable
+        ? Path.staticMethod(Path.project(callable.owner.ref), callable.name)
+        : Path.project(callable.ref);
+    return admitReference({ ...common, target });
+}
 export function admitReference(input) {
     if (input === null || typeof input !== 'object')
         invalid();
@@ -24,21 +47,21 @@ export function admitReference(input) {
     });
 }
 function matchesCallable(target, callable) {
-    const ref = Key.ref(callable);
+    const coordinate = callableAddress(callable);
     const { anchor, steps } = target.ast;
     const last = steps.at(-1);
-    if (Ref.isMethod(ref)) {
-        if (last?.kind !== 'method' || last.name !== Ref.child(ref))
+    if (coordinate.kind === 'method') {
+        if (last?.kind !== 'method' || last.name !== coordinate.name)
             return false;
         if (last.dispatch === 'instance')
-            return true;
+            return last.class === Key.of(coordinate.owner);
         const owner = steps.at(-2);
         return (anchor.kind === 'domain' &&
             anchor.origin === Key.origin(callable) &&
             steps.length === 2 &&
             owner?.kind === 'projection' &&
-            owner.projection.kind === Ref.namespace(ref) &&
-            owner.projection.name === Ref.member(ref));
+            owner.projection.kind === 'class' &&
+            owner.projection.name === coordinate.owner.name);
     }
     const projection = steps[0];
     return (anchor.kind === 'domain' &&
@@ -46,9 +69,8 @@ function matchesCallable(target, callable) {
         steps.length === 1 &&
         projection?.kind === 'projection' &&
         projection.projection.kind === 'function' &&
-        projection.projection.name === Ref.member(ref));
+        projection.projection.name === coordinate.name);
 }
 function invalid() {
     throw new TypeError('Callable reference is invalid.');
 }
-//# sourceMappingURL=reference.js.map

package/dist/session/routing/auth.d.ts

@@ -16,4 +16,3 @@ export interface EffectiveAuth {
 }
 export declare function admitSessionAuth(input: SessionAuth | undefined): SessionAuth | undefined;
 export declare function resolveAuth(resolver: SessionAuth | undefined, call: invocation.Call, operation: SessionOperation): Promise<EffectiveAuth>;
-//# sourceMappingURL=auth.d.ts.map

package/dist/session/routing/auth.js

@@ -37,4 +37,3 @@ export async function resolveAuth(resolver, call, operation) {
         : protocol.acceptDelegate(input.delegate);
     return Object.freeze({ credential, delegate });
 }
-//# sourceMappingURL=auth.js.map

package/dist/session/routing/cache.d.ts

@@ -1,21 +1,40 @@
-import type { invocation } from '@astrale-os/kernel-protocol';
+import { invocation } from '@astrale-os/kernel-protocol';
 import type { EffectiveAuth } from './auth.js';
-import type { SchemaExpectation } from './expectation.js';
 export interface LearnedRoute {
     readonly route: invocation.Route;
     readonly credential?: string;
     readonly expiresAt: number;
 }
-/** Confidential, process-local warm routing state owned by exactly one ClientSession. */
+export interface PersistedRoute extends LearnedRoute {
+    /** HMAC over this entry and its exact authority partition. */
+    readonly integrity: string;
+}
+export interface SessionRouteArtifact {
+    readonly version: 1;
+    readonly entries: Readonly<Record<string, PersistedRoute>>;
+}
+/** Caller-owned persistence for confidential route artifacts. */
+export interface SessionRouteStore {
+    read(): unknown;
+    write(artifact: SessionRouteArtifact): void;
+}
+/** Confidential warm routing state owned by exactly one ClientSession. */
 export declare class RouteCache {
     private readonly maximumAgeMs;
     private readonly maximumSize;
     private readonly entries;
-    constructor(maximumAgeMs: number, maximumSize?: number);
-    key(source: string, call: invocation.Call, auth: EffectiveAuth, expected?: SchemaExpectation): Promise<string>;
-    get(key: string, now?: number): LearnedRoute | undefined;
-    learn(key: string, route: invocation.Route, credential: string | undefined, now?: number): LearnedRoute;
+    private readonly keyTokens;
+    private readonly store?;
+    constructor(maximumAgeMs: number, maximumSize?: number, store?: SessionRouteStore);
+    key(source: string, call: invocation.Call, auth: EffectiveAuth): Promise<string>;
+    get(key: string, sourceCredential?: string, now?: number): Promise<LearnedRoute | undefined>;
+    learn(key: string, route: invocation.Route, credential: string | undefined, sourceCredential?: string, now?: number): Promise<LearnedRoute>;
     delete(key: string): void;
+    /** Clear this Session's memory without deleting caller-owned persistent state. */
     clear(): void;
+    private invalidate;
+    private reserve;
+    private restore;
+    private restoreInput;
+    private persist;
 }
-//# sourceMappingURL=cache.d.ts.map

package/dist/session/routing/cache.js

@@ -1,39 +1,51 @@
+import { invocation } from '@astrale-os/kernel-protocol';
 import { DEFAULT_MAXIMUM_ROUTES } from '../context/index.js';
-/** Confidential, process-local warm routing state owned by exactly one ClientSession. */
+const DESTINATION_CREDENTIAL_REFRESH_SKEW_MS = 5_000;
+/** Confidential warm routing state owned by exactly one ClientSession. */
 export class RouteCache {
     maximumAgeMs;
     maximumSize;
     entries = new Map();
-    constructor(maximumAgeMs, maximumSize = DEFAULT_MAXIMUM_ROUTES) {
+    keyTokens = new Map();
+    store;
+    constructor(maximumAgeMs, maximumSize = DEFAULT_MAXIMUM_ROUTES, store) {
         this.maximumAgeMs = maximumAgeMs;
         this.maximumSize = maximumSize;
+        this.store = store === undefined ? undefined : captureSessionRouteStore(store);
+        this.restore();
     }
-    async key(source, call, auth, expected) {
+    async key(source, call, auth) {
         const credential = auth.credential === undefined ? 'anonymous' : await digestText(auth.credential);
         const delegate = auth.delegate === undefined ? 'anonymous' : await digestText(canonicalDelegate(auth.delegate));
-        return JSON.stringify([
-            source,
-            call.target,
-            credential,
-            delegate,
-            expected === undefined ? null : [expected.origin, expected.revision],
-        ]);
-    }
-    get(key, now = Date.now()) {
-        const entry = this.entries.get(key);
-        if (entry === undefined)
+        return JSON.stringify([source, call.target, credential, delegate]);
+    }
+    async get(key, sourceCredential, now = Date.now()) {
+        const cached = this.entries.get(key);
+        if (cached === undefined)
             return undefined;
-        if (entry.expiresAt <= now) {
-            this.entries.delete(key);
+        const token = this.keyTokens.get(key);
+        if (cached.learned.expiresAt <= now) {
+            this.invalidate(key);
             return undefined;
         }
+        if (cached.integrity !== undefined) {
+            const matches = sourceCredential !== undefined &&
+                (await matchesIntegrity(sourceCredential, key, cached.sealed ?? cached.learned, cached.integrity));
+            if (this.keyTokens.get(key) !== token || this.entries.get(key) !== cached) {
+                return undefined;
+            }
+            if (!matches) {
+                this.invalidate(key);
+                return undefined;
+            }
+        }
         this.entries.delete(key);
-        this.entries.set(key, entry);
-        return entry;
+        this.entries.set(key, cached);
+        return cached.learned;
     }
-    learn(key, route, credential, now = Date.now()) {
+    async learn(key, route, credential, sourceCredential, now = Date.now()) {
         const credentialExpiry = credential === undefined ? undefined : jwtExpiry(credential);
-        const expiresAt = Math.min(now + this.maximumAgeMs, credentialExpiry ?? Number.POSITIVE_INFINITY);
+        const expiresAt = Math.min(now + this.maximumAgeMs, refreshBoundary(credentialExpiry));
         const entry = Object.freeze({
             route,
             ...(credential === undefined ? {} : { credential }),
@@ -44,22 +56,203 @@ export class RouteCache {
             return entry;
         if (expiresAt <= now)
             return entry;
+        const token = this.reserve(key);
+        let integrity;
+        if (this.store !== undefined && sourceCredential !== undefined) {
+            try {
+                integrity = await routeIntegrity(sourceCredential, key, entry);
+            }
+            catch {
+                // Integrity support is a persistence optimization; the learned route remains usable in memory.
+            }
+        }
+        if (this.keyTokens.get(key) !== token) {
+            return entry;
+        }
         this.entries.delete(key);
         while (this.entries.size >= this.maximumSize) {
             const oldest = this.entries.keys().next().value;
             if (oldest === undefined)
                 break;
             this.entries.delete(oldest);
+            this.keyTokens.delete(oldest);
         }
-        this.entries.set(key, entry);
+        this.entries.set(key, Object.freeze({
+            learned: entry,
+            ...(integrity === undefined ? {} : { sealed: entry, integrity }),
+        }));
+        this.persist();
         return entry;
     }
     delete(key) {
-        this.entries.delete(key);
+        this.invalidate(key);
     }
+    /** Clear this Session's memory without deleting caller-owned persistent state. */
     clear() {
+        this.keyTokens.clear();
         this.entries.clear();
     }
+    invalidate(key) {
+        this.keyTokens.delete(key);
+        if (this.entries.delete(key))
+            this.persist();
+    }
+    reserve(key) {
+        const token = Object.freeze({});
+        this.keyTokens.set(key, token);
+        return token;
+    }
+    restore(now = Date.now()) {
+        if (this.store === undefined)
+            return;
+        try {
+            this.restoreInput(this.store.read(), now);
+        }
+        catch {
+            this.keyTokens.clear();
+            this.entries.clear();
+        }
+    }
+    restoreInput(input, now) {
+        if (input === undefined)
+            return;
+        if (typeof input !== 'object' || input === null || Array.isArray(input))
+            return;
+        const artifact = input;
+        if (artifact.version !== 1 ||
+            typeof artifact.entries !== 'object' ||
+            artifact.entries === null ||
+            Array.isArray(artifact.entries)) {
+            return;
+        }
+        let count = 0;
+        for (const key in artifact.entries) {
+            if (!Object.hasOwn(artifact.entries, key))
+                continue;
+            count += 1;
+            if (count > this.maximumSize) {
+                this.keyTokens.clear();
+                this.entries.clear();
+                return;
+            }
+            const value = Reflect.get(artifact.entries, key);
+            const entry = admitStoredEntry(value, now, this.maximumAgeMs);
+            if (entry === undefined)
+                continue;
+            this.reserve(key);
+            this.entries.set(key, entry);
+        }
+    }
+    persist() {
+        if (this.store === undefined)
+            return;
+        const entries = Object.fromEntries([...this.entries].flatMap(([key, cached]) => cached.integrity === undefined
+            ? []
+            : [
+                [
+                    key,
+                    Object.freeze({
+                        ...(cached.sealed ?? cached.learned),
+                        integrity: cached.integrity,
+                    }),
+                ],
+            ]));
+        try {
+            this.store.write(Object.freeze({ version: 1, entries: Object.freeze(entries) }));
+        }
+        catch {
+            // A cache-store outage must not turn a valid invocation into a product failure.
+        }
+    }
+}
+function captureSessionRouteStore(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        typeof input.read !== 'function' ||
+        typeof input.write !== 'function') {
+        throw new TypeError('Session route store capability is invalid.');
+    }
+    const read = input.read;
+    const write = input.write;
+    return Object.freeze({
+        read: () => read.call(input),
+        write: (artifact) => write.call(input, artifact),
+    });
+}
+function admitStoredEntry(input, now, maximumAgeMs) {
+    try {
+        if (typeof input !== 'object' || input === null || Array.isArray(input))
+            return undefined;
+        const value = input;
+        if ((value.credential !== undefined && typeof value.credential !== 'string') ||
+            typeof value.expiresAt !== 'number' ||
+            !Number.isSafeInteger(value.expiresAt) ||
+            typeof value.integrity !== 'string' ||
+            !/^[A-Za-z0-9_-]{43}$/u.test(value.integrity)) {
+            return undefined;
+        }
+        const credentialExpiry = value.credential === undefined ? undefined : jwtExpiry(value.credential);
+        if (value.credential !== undefined && credentialExpiry === undefined)
+            return undefined;
+        const sealed = Object.freeze({
+            route: invocation.acceptRoute(value.route),
+            ...(value.credential === undefined ? {} : { credential: value.credential }),
+            expiresAt: value.expiresAt,
+        });
+        const expiresAt = Math.min(value.expiresAt, now + maximumAgeMs, refreshBoundary(credentialExpiry));
+        if (expiresAt <= now)
+            return undefined;
+        return Object.freeze({
+            learned: Object.freeze({
+                route: sealed.route,
+                ...(sealed.credential === undefined ? {} : { credential: sealed.credential }),
+                expiresAt,
+            }),
+            sealed,
+            integrity: value.integrity,
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+function refreshBoundary(credentialExpiry) {
+    return credentialExpiry === undefined
+        ? Number.POSITIVE_INFINITY
+        : credentialExpiry - DESTINATION_CREDENTIAL_REFRESH_SKEW_MS;
+}
+async function routeIntegrity(sourceCredential, key, learned) {
+    const webCrypto = typeof crypto === 'undefined' ? undefined : crypto;
+    if (webCrypto?.subtle === undefined) {
+        throw new TypeError('Persistent Session route integrity requires Web Crypto HMAC support.');
+    }
+    const algorithm = Object.freeze({ name: 'HMAC', hash: 'SHA-256' });
+    const cryptographicKey = await webCrypto.subtle.importKey('raw', new TextEncoder().encode(sourceCredential), algorithm, false, ['sign']);
+    const signature = await webCrypto.subtle.sign(algorithm, cryptographicKey, new TextEncoder().encode(integrityMaterial(key, learned)));
+    return encodeBase64Url(new Uint8Array(signature));
+}
+async function matchesIntegrity(sourceCredential, key, learned, expected) {
+    try {
+        return (await routeIntegrity(sourceCredential, key, learned)) === expected;
+    }
+    catch {
+        return false;
+    }
+}
+function integrityMaterial(key, learned) {
+    return JSON.stringify({
+        version: 1,
+        key,
+        route: learned.route,
+        ...(learned.credential === undefined ? {} : { credential: learned.credential }),
+        expiresAt: learned.expiresAt,
+    });
+}
+function encodeBase64Url(input) {
+    let binary = '';
+    for (const byte of input)
+        binary += String.fromCharCode(byte);
+    return globalThis.btoa(binary).replace(/\+/gu, '-').replace(/\//gu, '_').replace(/=+$/gu, '');
 }
 function canonicalDelegate(input) {
     return JSON.stringify({
@@ -83,10 +276,11 @@ function canonicalExpr(input) {
     return { kind: input.kind, operands: input.operands.map(canonicalExpr) };
 }
 async function digestText(input) {
-    if (globalThis.crypto?.subtle === undefined) {
+    const webCrypto = typeof crypto === 'undefined' ? undefined : crypto;
+    if (webCrypto?.subtle === undefined) {
         throw new TypeError('Session route caching requires Web Crypto SHA-256 support.');
     }
-    const bytes = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));
+    const bytes = await webCrypto.subtle.digest('SHA-256', new TextEncoder().encode(input));
     return [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, '0')).join('');
 }
 function jwtExpiry(input) {
@@ -113,4 +307,3 @@ function decodeBase64(input) {
     }
     throw new TypeError('Session route caching requires base64 decoding support.');
 }
-//# sourceMappingURL=cache.js.map

package/dist/session/routing/dispatch.d.ts

@@ -1,12 +1,11 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
-import type { Call, Result } from '../../client/index.js';
+import type { Result } from '../../client/index.js';
 import type { SessionOperation, SessionPolicy } from '../context/index.js';
-import type { SessionDiscovery } from '../discovery/index.js';
 import type { SessionAuth } from './auth.js';
 import type { RouteCache } from './cache.js';
 import type { ClientPoolCapability } from './envelope.js';
-import type { SchemaExpectation } from './expectation.js';
 import type { SessionEnvelopeTransport, SessionRequestOptions } from './request.js';
+import { acceptCall } from '../../client/index.js';
 export interface SessionDispatcherOptions {
     readonly kernel: IssuerId;
     readonly sourceEndpoint: string;
@@ -16,20 +15,17 @@ export interface SessionDispatcherOptions {
     readonly cache: RouteCache;
     readonly policy: Readonly<SessionPolicy>;
     readonly envelopeTransport: SessionEnvelopeTransport;
-    readonly discovery: SessionDiscovery;
     readonly requireOpen: () => void;
 }
 export declare class SessionDispatcher {
     private readonly state;
     constructor(state: SessionDispatcherOptions);
-    dispatch(input: Call, options: SessionRequestOptions, operation: SessionOperation, expected?: SchemaExpectation): Promise<Result>;
+    dispatch(input: Parameters<typeof acceptCall>[0], options: SessionRequestOptions, operation: SessionOperation): Promise<Result>;
     private dispatchSource;
     private followSource;
     private dispatchDestinationWithRecovery;
     private dispatchDestination;
-    private sourceKernel;
 }
 export declare function requireResultKind<Kind extends 'value' | 'stream' | 'binary'>(expected: Kind, result: Result): Extract<Result, {
     kind: Kind;
 }>;
-//# sourceMappingURL=dispatch.d.ts.map