@astrale-os/kernel-client 0.6.0-beta.7 → 0.6.0-beta.71

package/dist/schema/introspection.js

@@ -1,6 +1,6 @@
 import { Path } from '@astrale-os/kernel-core/path';
 import { introspect as introspectRef } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
-import { schema } from '@astrale-os/kernel-protocol';
+import * as schema from '@astrale-os/kernel-protocol/schema';
 import { call } from '../client/index.js';
 const INTROSPECT_PATH = Path.project(introspectRef).raw;
 export async function introspect(invoke, limits, request, options) {
@@ -11,6 +11,9 @@ export async function introspect(invoke, limits, request, options) {
     if (result.value.mediaType !== schema.installation.introspection.MEDIA_TYPE) {
         throw new TypeError('Schema introspection returned an unsupported media type.');
     }
+    if (!(result.value.body instanceof Uint8Array)) {
+        await result.value.body[Symbol.asyncIterator]().return?.();
+        throw new TypeError('Schema introspection returned a streaming binary result.');
+    }
     return schema.installation.introspection.decode(request, result.value.body, limits);
 }
-//# sourceMappingURL=introspection.js.map

package/dist/schema/operation.d.ts

@@ -3,4 +3,3 @@ import type { OperationId } from './contracts.js';
 export declare function acceptOperationId(input: unknown): OperationId;
 /** Allocate one cryptographically generated operation identity for a new lifecycle request. */
 export declare function createOperationId(): OperationId;
-//# sourceMappingURL=operation.d.ts.map

package/dist/schema/operation.js

@@ -1,10 +1,9 @@
-import { installation } from '@astrale-os/kernel-core/schema';
+import * as installation from '@astrale-os/kernel-core/schema/installation';
 /** Accept one canonical lowercase RFC 9562 UUIDv4 operation identity. */
 export function acceptOperationId(input) {
     return installation.acceptOperationId(input);
 }
 /** Allocate one cryptographically generated operation identity for a new lifecycle request. */
 export function createOperationId() {
-    return acceptOperationId(globalThis.crypto.randomUUID());
+    return acceptOperationId(crypto.randomUUID());
 }
-//# sourceMappingURL=operation.js.map

package/dist/schema/schema.d.ts

@@ -1,20 +1,23 @@
-import type { introspection } from '@astrale-os/kernel-core/schema';
-import type { schema as protocolSchema } from '@astrale-os/kernel-protocol';
+import type { Key } from '@astrale-os/kernel-dsl/v1';
+import * as protocolSchema from '@astrale-os/kernel-protocol/schema';
 import type { Call, Result } from '../client/index.js';
 import type { RequestOptions } from '../transport/index.js';
-import type { InstallReceipt, InstallRequest, UninstallReceipt, UninstallRequest } from './contracts.js';
+import type { InstallRequest, UninstallReceipt, UninstallRequest } from './contracts.js';
 export type SchemaCall = (call: Call, options?: RequestOptions) => Promise<Result>;
 export interface SchemaOptions extends protocolSchema.installation.introspection.Limits {
+    readonly lifecycleTimeoutMs?: number;
 }
-export type ReadyInstallation = protocolSchema.installation.introspection.Installation & {
-    readonly state: 'ready';
-    readonly readiness: protocolSchema.installation.introspection.Digest;
-};
+export type DomainInfo = protocolSchema.installation.introspection.DomainInfo;
+export type DomainBundle = protocolSchema.installation.introspection.DomainBundle;
+export type DomainDependencies = protocolSchema.installation.introspection.DomainDependencies;
+export type InstallResult = protocolSchema.installation.InstallResult;
 export interface SchemaApi {
-    install(request: InstallRequest, options?: RequestOptions): Promise<InstallReceipt>;
+    install(request: InstallRequest, options?: RequestOptions): Promise<InstallResult>;
     uninstall(request: UninstallRequest, options?: RequestOptions): Promise<UninstallReceipt>;
-    introspect<Input extends introspection.Introspection>(request: Input, options?: RequestOptions): Promise<protocolSchema.installation.introspection.ResultFor<Input>>;
+    inspect(origin: Key.Origin, options?: RequestOptions): Promise<DomainInfo>;
+    bundle(origin: Key.Origin, options?: RequestOptions): Promise<DomainBundle>;
+    dependencies(origin: Key.Origin, options?: RequestOptions): Promise<DomainDependencies>;
 }
+export declare const DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS = 110000;
 /** Bind the canonical Schema lifecycle syscalls to one caller-scoped value-call capability. */
 export declare function createSchema(call: SchemaCall, limits: SchemaOptions): SchemaApi;
-//# sourceMappingURL=schema.d.ts.map

package/dist/schema/schema.js

@@ -1,11 +1,13 @@
 import { Path } from '@astrale-os/kernel-core/path';
-import { installOutput, uninstallOutput, } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
+import { uninstallOutput } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
 import { install, uninstall } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import * as protocolSchema from '@astrale-os/kernel-protocol/schema';
 import { call as invocation } from '../client/index.js';
 import { acceptOutput } from './admission.js';
-import { introspect as inspect } from './introspection.js';
+import { introspect } from './introspection.js';
 const INSTALL_PATH = Path.project(install).raw;
 const UNINSTALL_PATH = Path.project(uninstall).raw;
+export const DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS = 110_000;
 /** Bind the canonical Schema lifecycle syscalls to one caller-scoped value-call capability. */
 export function createSchema(call, limits) {
     if (typeof call !== 'function')
@@ -13,32 +15,102 @@ export function createSchema(call, limits) {
     const admittedLimits = admitLimits(limits);
     return Object.freeze({
         async install(request, options) {
-            const output = value(await call(invocation(INSTALL_PATH, request), options));
-            return acceptOutput(installOutput, output);
+            const result = await call(invocation(INSTALL_PATH, request), lifecycleOptions(options, admittedLimits.lifecycleTimeoutMs));
+            if (result.kind !== 'binary') {
+                throw new TypeError('Schema install returned a non-binary result.');
+            }
+            if (result.value.mediaType !== protocolSchema.installation.MEDIA_TYPE) {
+                throw new TypeError('Schema install returned an unsupported media type.');
+            }
+            if (!(result.value.body instanceof Uint8Array)) {
+                await result.value.body[Symbol.asyncIterator]().return?.();
+                throw new TypeError('Schema install returned a streaming binary result.');
+            }
+            const decoded = await protocolSchema.installation.decode(result.value.body, installationResultLimit(admittedLimits.maximumPublicationBytes, request.domains.length));
+            proveInstallResult(request, decoded);
+            return decoded;
         },
         async uninstall(request, options) {
-            const output = value(await call(invocation(UNINSTALL_PATH, request), options));
-            return acceptOutput(uninstallOutput, output);
+            const snapshot = snapshotUninstallRequest(request);
+            const output = value(await call(invocation(UNINSTALL_PATH, snapshot), lifecycleOptions(options, admittedLimits.lifecycleTimeoutMs)));
+            const receipt = acceptOutput(uninstallOutput, output);
+            proveUninstallReceipt(snapshot, receipt);
+            return receipt;
         },
-        async introspect(request, options) {
-            return inspect(call, admittedLimits, request, options);
+        async inspect(origin, options) {
+            return introspect(call, admittedLimits, { kind: 'inspect', origin }, options);
         },
+        async bundle(origin, options) {
+            return introspect(call, admittedLimits, { kind: 'bundle', origin }, options);
+        },
+        async dependencies(origin, options) {
+            return introspect(call, admittedLimits, { kind: 'dependencies', origin }, options);
+        },
+    });
+}
+function snapshotUninstallRequest(request) {
+    return Object.freeze({
+        operation: request.operation,
+        domains: Object.freeze([...new Set(request.domains)].sort(compare)),
+        data: Object.freeze({ mode: request.data.mode }),
     });
 }
+function proveUninstallReceipt(request, receipt) {
+    if (receipt.operation !== request.operation) {
+        throw new TypeError('Schema uninstall result does not match the requested operation.');
+    }
+    const actual = receipt.transitions.map((transition) => transition.intent.origin);
+    if (actual.length !== request.domains.length ||
+        actual.some((origin, index) => origin !== request.domains[index])) {
+        throw new TypeError('Schema uninstall result does not match the requested Domains.');
+    }
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function installationResultLimit(maximumDomainBytes, roots) {
+    const perDomain = maximumDomainBytes + 4_096;
+    if (roots > Math.floor((Number.MAX_SAFE_INTEGER - 4_096) / perDomain)) {
+        return Number.MAX_SAFE_INTEGER;
+    }
+    return perDomain * roots + 4_096;
+}
+function proveInstallResult(request, result) {
+    if (result.changed) {
+        if (result.receipt.operation !== request.operation) {
+            throw new TypeError('Schema install result does not match the requested operation.');
+        }
+        if (result.receipt.transitions.length > request.domains.length) {
+            throw new TypeError('Schema install result contains more transitions than requested Domains.');
+        }
+        return;
+    }
+    if (result.domains.length !== request.domains.length) {
+        throw new TypeError('Schema unchanged result does not match the requested Domain count.');
+    }
+}
 function value(result) {
     if (result.kind !== 'value')
         throw new TypeError('Schema syscall returned a non-value result.');
     return result.value;
 }
 function admitLimits(input) {
+    const lifecycleTimeoutMs = input?.lifecycleTimeoutMs ?? DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS;
     if (input === null ||
         typeof input !== 'object' ||
         !Number.isSafeInteger(input.maximumPublicationBytes) ||
         input.maximumPublicationBytes < 1 ||
         !Number.isSafeInteger(input.maximumBundleBytes) ||
-        input.maximumBundleBytes < 1) {
+        input.maximumBundleBytes < 1 ||
+        !Number.isSafeInteger(lifecycleTimeoutMs) ||
+        lifecycleTimeoutMs < 1 ||
+        lifecycleTimeoutMs > 2_147_483_647) {
         throw new TypeError('Schema introspection limits are invalid.');
     }
-    return Object.freeze({ ...input });
+    return Object.freeze({ ...input, lifecycleTimeoutMs });
+}
+function lifecycleOptions(options, timeoutMs) {
+    if (options?.timeoutMs !== undefined)
+        return options;
+    return Object.freeze({ ...options, timeoutMs });
 }
-//# sourceMappingURL=schema.js.map

package/dist/session/admission.d.ts

@@ -0,0 +1,18 @@
+import type { invocation } from '@astrale-os/kernel-protocol';
+import type { AdmissionOptions, FunctionAdmission } from '../auth/index.js';
+import type { Client } from '../client/index.js';
+import type { SchemaOptions } from '../schema/schema.js';
+import type { Fetch } from '../transport/http/index.js';
+import type { SessionOperation, SessionPolicy } from './context/index.js';
+import type { SessionAuth } from './routing/index.js';
+export interface FunctionAdmissionDependencies {
+    readonly kernel: string;
+    readonly auth?: SessionAuth;
+    readonly source: () => Client;
+    readonly fetch: Fetch;
+    readonly policy: Readonly<SessionPolicy>;
+    readonly limits: SchemaOptions;
+    readonly maximumResponseBytes: number;
+}
+/** Check a remote Call through the existing Domain exchange and Kernel admission protocols. */
+export declare function admitFunction(dependencies: FunctionAdmissionDependencies, call: invocation.Call, options: AdmissionOptions | undefined, operation: SessionOperation): Promise<FunctionAdmission>;

package/dist/session/admission.js

@@ -0,0 +1,117 @@
+import { grant } from '@astrale-os/kernel-core/auth';
+import { targetPath } from '@astrale-os/kernel-core/callable';
+import { Path } from '@astrale-os/kernel-core/path';
+import { admitOutput } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
+import { function as functions } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { codecs, issuer } from '@astrale-os/kernel-protocol';
+import { credentialApi } from '../auth/credential.js';
+import { identityApi } from '../auth/identity.js';
+import { ClientError } from '../errors/index.js';
+import { createSchema } from '../schema/index.js';
+import { allowEndpoint, runSessionOperation, sessionTransportOptions } from './context/index.js';
+import { boundedResponse, requireExactResponse } from './discovery/index.js';
+import { matchesCallable } from './reference.js';
+import { requireResultKind, resolveAuth } from './routing/index.js';
+const ADMIT = Path.staticMethod(Path.project(functions.admit.owner), functions.admit.name);
+/** Check a remote Call through the existing Domain exchange and Kernel admission protocols. */
+export async function admitFunction(dependencies, call, options, operation) {
+    const target = Path.parse(targetPath(call.target));
+    const origin = callableOrigin(target);
+    const attenuation = options?.attenuation === undefined
+        ? undefined
+        : grant.acceptUnresolved({ v: 1, expr: options.attenuation }).expr;
+    const effective = await resolveAuth(dependencies.auth, call, operation);
+    if (effective.credential === undefined || effective.delegate === undefined) {
+        throw new ClientError('Function admission requires an authenticated session.');
+    }
+    // Resolve once for the intended Call, then retain that exact caller across every helper syscall.
+    const client = dependencies.source();
+    const caller = client.as(effective.credential);
+    const dispatch = (input) => runSessionOperation(operation, () => caller.dispatch(input, {
+        ...sessionTransportOptions(operation),
+        delegate: effective.delegate,
+    }));
+    const callIdentity = async (target, input) => requireResultKind('value', await dispatch({ target, input })).value;
+    const identity = identityApi(callIdentity);
+    const credentials = credentialApi(callIdentity);
+    const schema = createSchema(dispatch, dependencies.limits);
+    const [domain, self] = await Promise.all([schema.inspect(origin), identity.whoami()]);
+    const remote = domain.publication;
+    if (remote === null || remote.identity.issuer === dependencies.kernel) {
+        throw new ClientError('Function admission through token exchange requires a remote Domain.');
+    }
+    const configuration = issuer.acceptConfiguration(await fetchJson(dependencies, new URL(issuer.paths(remote.identity.issuer).configuration, remote.identity.issuer).href, operation), remote.identity.issuer);
+    const endpoint = configuration.token_exchange_endpoint;
+    if (endpoint === undefined) {
+        throw new ClientError('The installed Domain does not advertise token exchange.');
+    }
+    allowEndpoint(endpoint, dependencies.policy);
+    const credential = await credentials.delegate(self.id, {
+        audience: remote.identity.issuer,
+        ttlSeconds: effective.delegate.ttlSeconds,
+        attenuation: attenuation ?? effective.delegate.attenuation ?? { kind: 'identity', self: true },
+    });
+    const exchanged = issuer.exchange.acceptResponse(await fetchJson(dependencies, endpoint, operation, credential));
+    if (exchanged.expiresAt * 1_000 <= Date.now()) {
+        throw new ClientError('Domain token exchange returned an expired credential.');
+    }
+    const result = await runSessionOperation(operation, () => client
+        .as(exchanged.token)
+        .dispatch({ target: ADMIT, input: { call, credential } }, { ...sessionTransportOptions(operation), delegate: effective.delegate }));
+    const output = admitOutput.parse(requireResultKind('value', result).value);
+    const callable = Key(output.callable);
+    if (!matchesCallable(target, callable)) {
+        throw new ClientError('Function admission returned a different callable.');
+    }
+    const receiver = output.receiver === undefined ? undefined : Path.parse(output.receiver);
+    const method = target.ast.steps.at(-1);
+    const instance = method?.kind === 'method' && method.dispatch === 'instance';
+    if (instance !== (receiver !== undefined) ||
+        (receiver !== undefined &&
+            (receiver.ast.anchor.kind !== 'id' ||
+                receiver.ast.steps.length !== 0 ||
+                (target.ast.anchor.kind === 'id' &&
+                    target.ast.steps.length === 1 &&
+                    receiver.ast.anchor.id !== target.ast.anchor.id)))) {
+        throw new ClientError('Function admission returned a different receiver.');
+    }
+    return Object.freeze({ callable, ...(receiver === undefined ? {} : { receiver: receiver.raw }) });
+}
+function callableOrigin(path) {
+    const last = path.ast.steps.at(-1);
+    if (last?.kind === 'method' && last.dispatch === 'instance')
+        return Key.origin(last.class);
+    if (path.ast.anchor.kind === 'domain')
+        return path.ast.anchor.origin;
+    throw new ClientError('Function admission requires a Domain-qualified callable target.');
+}
+async function fetchJson(dependencies, url, operation, credential) {
+    allowEndpoint(url, dependencies.policy);
+    return runSessionOperation(operation, async (signal) => {
+        const init = {
+            method: credential === undefined ? 'GET' : 'POST',
+            headers: {
+                accept: 'application/json',
+                ...(credential === undefined ? {} : { authorization: `Bearer ${credential}` }),
+            },
+            credentials: 'omit',
+            cache: 'no-store',
+            referrerPolicy: 'no-referrer',
+            redirect: 'manual',
+            signal,
+        };
+        const response = await dependencies.fetch(url, init);
+        try {
+            requireExactResponse(response, url, 'Domain token exchange');
+            if (!response.ok) {
+                throw new ClientError(`Domain ${credential === undefined ? 'discovery' : 'token exchange'} returned HTTP ${response.status}.`);
+            }
+            return codecs.json.decode(await boundedResponse(response, dependencies.maximumResponseBytes, signal));
+        }
+        finally {
+            // Also release unread bodies rejected by URL, status, or declared-size validation.
+            void response.body?.cancel().catch(() => undefined);
+        }
+    });
+}

package/dist/session/bound.d.ts

@@ -0,0 +1,46 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth';
+import type { AuthApi } from '../auth/index.js';
+import type { SchemaApi } from '../schema/index.js';
+import type { SessionControlOptions } from './context/index.js';
+import type { CallableReference, InputOfReference, OutputOfReference } from './reference.js';
+import type { SessionRequestOptions } from './routing/index.js';
+import type { ClientSession } from './session.js';
+import type { ViewCatalog } from './views/index.js';
+import { type Binary, type Call, type Input, type Result, type Stream } from '../client/index.js';
+import { type GraphApi } from '../graph/index.js';
+/** Exact live Session surface captured by one credential-bound Kernel view. */
+export interface BoundSessionSource {
+    readonly kernel: IssuerId;
+    readonly schema: SchemaApi;
+    readonly auth: Pick<AuthApi, 'admit'>;
+    dispatch(call: Call, options?: SessionRequestOptions): Promise<Result>;
+    call(call: Call, options?: SessionRequestOptions): Promise<Input>;
+    invoke<const Reference extends CallableReference<unknown>>(reference: Reference, input: InputOfReference<Reference>, options?: SessionRequestOptions): Promise<OutputOfReference<Reference>>;
+    stream(call: Call, options?: SessionRequestOptions): Promise<Stream>;
+    binary(call: Call, options?: SessionRequestOptions): Promise<Binary>;
+    viewsFor(target: Parameters<ClientSession['viewsFor']>[0], options?: SessionControlOptions): Promise<ViewCatalog>;
+}
+export interface BoundSessionControls {
+    readonly signal: AbortSignal;
+    /** Absolute Unix time in milliseconds. */
+    readonly deadline: number;
+}
+/**
+ * Credential-bound Kernel operations over one caller-owned ClientSession.
+ *
+ * The view owns no credential, transport, route cache, or lifecycle. Its source Session owns all of
+ * those concerns and closing that Session invalidates every operation exposed here.
+ */
+export interface BoundClientSession extends GraphApi {
+    readonly kernel: IssuerId;
+    readonly auth: AuthApi;
+    readonly schema: SchemaApi;
+    dispatch(call: Call, options?: SessionRequestOptions): Promise<Result>;
+    call(call: Call, options?: SessionRequestOptions): Promise<Input>;
+    invoke<const Reference extends CallableReference<unknown>>(reference: Reference, input: InputOfReference<Reference>, options?: SessionRequestOptions): Promise<OutputOfReference<Reference>>;
+    stream(call: Call, options?: SessionRequestOptions): Promise<Stream>;
+    binary(call: Call, options?: SessionRequestOptions): Promise<Binary>;
+    viewsFor: BoundSessionSource['viewsFor'];
+}
+/** Capture one Session into the ordinary graph, auth, and invocation Kernel journey. */
+export declare function bindSession(source: BoundSessionSource, controls?: BoundSessionControls): BoundClientSession;

package/dist/session/bound.js

@@ -0,0 +1,93 @@
+import { createAuth } from '../auth/auth.js';
+import { call as createCall, } from '../client/index.js';
+import { createGraph } from '../graph/index.js';
+/** Capture one Session into the ordinary graph, auth, and invocation Kernel journey. */
+export function bindSession(source, controls) {
+    if (source === null || typeof source !== 'object')
+        invalid();
+    const admittedControls = admitControls(controls);
+    const dispatchSource = capture(source, 'dispatch');
+    const admitSource = capture(source.auth, 'admit');
+    const callSource = capture(source, 'call');
+    const invokeSource = capture(source, 'invoke');
+    const streamSource = capture(source, 'stream');
+    const binarySource = capture(source, 'binary');
+    const viewsForSource = capture(source, 'viewsFor');
+    const schemaSource = captureSchema(source.schema);
+    const dispatch = (input, options) => dispatchSource(input, requestOptions(options, admittedControls));
+    const admit = (input, options) => admitSource(input, mergeOptions(options, admittedControls));
+    const call = (input, options) => callSource(input, requestOptions(options, admittedControls));
+    const invoke = (reference, input, options) => invokeSource(reference, input, requestOptions(options, admittedControls));
+    const stream = (input, options) => streamSource(input, requestOptions(options, admittedControls));
+    const binary = (input, options) => binarySource(input, requestOptions(options, admittedControls));
+    const viewsFor = (target, options) => viewsForSource(target, controlOptions(options, admittedControls));
+    const install = (request, options) => schemaSource.install(request, controlOptions(options, admittedControls));
+    const uninstall = (request, options) => schemaSource.uninstall(request, controlOptions(options, admittedControls));
+    const inspect = (origin, options) => schemaSource.inspect(origin, controlOptions(options, admittedControls));
+    const bundle = (origin, options) => schemaSource.bundle(origin, controlOptions(options, admittedControls));
+    const dependencies = (origin, options) => schemaSource.dependencies(origin, controlOptions(options, admittedControls));
+    const schema = Object.freeze({ install, uninstall, inspect, bundle, dependencies });
+    const graph = createGraph(call);
+    const auth = createAuth((target, input, options) => call(createCall(target, input), options), admit);
+    return Object.freeze({
+        ...graph,
+        kernel: source.kernel,
+        auth,
+        schema,
+        dispatch,
+        call,
+        invoke,
+        stream,
+        binary,
+        viewsFor,
+    });
+}
+function admitControls(input) {
+    if (input === undefined)
+        return undefined;
+    if (input === null ||
+        typeof input !== 'object' ||
+        !(input.signal instanceof AbortSignal) ||
+        !Number.isFinite(input.deadline)) {
+        invalid();
+    }
+    return Object.freeze({ signal: input.signal, deadline: input.deadline });
+}
+function requestOptions(options, controls) {
+    return mergeOptions(options, controls);
+}
+function controlOptions(options, controls) {
+    return mergeOptions(options, controls);
+}
+function mergeOptions(options, controls) {
+    if (controls === undefined)
+        return options;
+    if (options?.signal !== undefined && options.signal !== controls.signal) {
+        throw new TypeError('Bound ClientSession cancellation cannot be replaced.');
+    }
+    if (controls.signal.aborted)
+        throw controls.signal.reason ?? new Error('Invocation cancelled.');
+    const remaining = Math.max(1, Math.ceil(controls.deadline - Date.now()));
+    const timeoutMs = options?.timeoutMs === undefined ? remaining : Math.min(options.timeoutMs, remaining);
+    return Object.freeze({ ...options, signal: controls.signal, timeoutMs });
+}
+function capture(source, key) {
+    const value = source[key];
+    if (typeof value !== 'function')
+        invalid();
+    return value.bind(source);
+}
+function captureSchema(input) {
+    if (input === null || typeof input !== 'object')
+        invalid();
+    return Object.freeze({
+        install: capture(input, 'install'),
+        uninstall: capture(input, 'uninstall'),
+        inspect: capture(input, 'inspect'),
+        bundle: capture(input, 'bundle'),
+        dependencies: capture(input, 'dependencies'),
+    });
+}
+function invalid() {
+    throw new TypeError('Bound ClientSession source is invalid.');
+}

package/dist/session/context/control.d.ts

@@ -3,4 +3,3 @@ export interface SessionControlOptions {
     readonly timeoutMs?: number;
 }
 export declare function admitControlOptions(input: SessionControlOptions | undefined): Readonly<SessionControlOptions>;
-//# sourceMappingURL=control.d.ts.map

package/dist/session/context/control.js

@@ -15,4 +15,3 @@ export function admitControlOptions(input) {
             : { timeoutMs: platformDuration(input.timeoutMs, 'timeoutMs') }),
     });
 }
-//# sourceMappingURL=control.js.map

package/dist/session/context/index.d.ts

@@ -2,4 +2,3 @@ export { admitControlOptions, type SessionControlOptions } from './control.js';
 export { DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_MAXIMUM_ROUTES, DEFAULT_TIMEOUT_MS, platformDuration, positive, } from './limits.js';
 export { createSessionOperation, runSessionOperation, sessionTransportOptions, type SessionOperation, } from './operation.js';
 export { admitKernel, admitPolicy, allowEndpoint, kernelInvocationEndpoint, type SessionPolicy, } from './policy.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/session/context/index.js

@@ -2,4 +2,3 @@ export { admitControlOptions } from './control.js';
 export { DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_MAXIMUM_ROUTES, DEFAULT_TIMEOUT_MS, platformDuration, positive, } from './limits.js';
 export { createSessionOperation, runSessionOperation, sessionTransportOptions, } from './operation.js';
 export { admitKernel, admitPolicy, allowEndpoint, kernelInvocationEndpoint, } from './policy.js';
-//# sourceMappingURL=index.js.map

package/dist/session/context/limits.d.ts

@@ -5,4 +5,3 @@ export declare const DEFAULT_TIMEOUT_MS = 30000;
 export declare const DEFAULT_MAXIMUM_ROUTES = 256;
 export declare function positive(input: number, label: string): number;
 export declare function platformDuration(input: number, label: string): number;
-//# sourceMappingURL=limits.d.ts.map

package/dist/session/context/limits.js

@@ -16,4 +16,3 @@ export function platformDuration(input, label) {
     }
     return admitted;
 }
-//# sourceMappingURL=limits.js.map

package/dist/session/context/operation.d.ts

@@ -17,4 +17,3 @@ export declare function sessionTransportOptions(operation: SessionOperation, ide
 /** Settle independently of a caller capability that ignores its supplied AbortSignal. */
 export declare function runSessionOperation<Result>(operation: SessionOperation, task: (signal: AbortSignal) => Result | PromiseLike<Result>): Promise<Result>;
 export declare function requireSessionOperation(operation: SessionOperation): void;
-//# sourceMappingURL=operation.d.ts.map

package/dist/session/context/operation.js

@@ -1,4 +1,4 @@
-import { ClientError } from '../../errors/index.js';
+import { SessionError } from '../../errors/index.js';
 /** Create one total wall-clock budget for a complete public Client Session operation. */
 export function createSessionOperation(lifecycle, input, defaultTimeoutMs) {
     const timeoutMs = input?.timeoutMs ?? defaultTimeoutMs;
@@ -22,7 +22,7 @@ export function remainingSessionTime(operation) {
     requireSessionOperation(operation);
     const remaining = operation.deadline - Date.now();
     if (remaining < 1)
-        throw new ClientError('Session operation timed out.');
+        throw new SessionError('Session operation timed out.', { failure: 'timeout' });
     return remaining;
 }
 export function sessionTransportOptions(operation, idempotencyKey) {
@@ -33,13 +33,8 @@ export function sessionTransportOptions(operation, idempotencyKey) {
     });
 }
 /** Settle independently of a caller capability that ignores its supplied AbortSignal. */
-export function runSessionOperation(operation, task) {
-    try {
-        requireSessionOperation(operation);
-    }
-    catch (error) {
-        return Promise.reject(error);
-    }
+export async function runSessionOperation(operation, task) {
+    requireSessionOperation(operation);
     let abort;
     const interrupted = new Promise((_resolve, reject) => {
         abort = () => reject(sessionInterruption(operation.signal.reason));
@@ -49,9 +44,14 @@ export function runSessionOperation(operation, task) {
         requireSessionOperation(operation);
         return task(operation.signal);
     });
-    return Promise.race([execution, interrupted]).finally(() => {
-        if (abort !== undefined)
-            operation.signal.removeEventListener('abort', abort);
+    return Promise.race([execution, interrupted])
+        .catch((cause) => {
+        if (operation.signal.aborted)
+            throw sessionInterruption(operation.signal.reason);
+        throw cause;
+    })
+        .finally(() => {
+        operation.signal.removeEventListener('abort', abort);
     });
 }
 export function requireSessionOperation(operation) {
@@ -60,11 +60,13 @@ export function requireSessionOperation(operation) {
     throw sessionInterruption(operation.signal.reason);
 }
 function sessionInterruption(reason) {
+    if (reason instanceof SessionError)
+        return reason;
     if (reason instanceof DOMException && reason.name === 'TimeoutError') {
-        return new ClientError('Session operation timed out.', { cause: reason });
+        return new SessionError('Session operation timed out.', { cause: reason, failure: 'timeout' });
     }
-    return reason instanceof Error
-        ? reason
-        : new ClientError('Session operation was cancelled.', { cause: reason });
+    return new SessionError('Session operation was cancelled.', {
+        cause: reason,
+        failure: 'cancelled',
+    });
 }
-//# sourceMappingURL=operation.js.map

package/dist/session/context/policy.d.ts

@@ -9,4 +9,3 @@ export declare function admitKernel(input: string, insecure: boolean): IssuerId;
 export declare function kernelInvocationEndpoint(input: IssuerId): string;
 export declare function websocketEndpoint(input: string, insecure: boolean): string;
 export declare function allowEndpoint(url: string, policy: Readonly<SessionPolicy>): void;
-//# sourceMappingURL=policy.d.ts.map

package/dist/session/context/policy.js

@@ -67,4 +67,3 @@ export function allowEndpoint(url, policy) {
         throw new ClientError('Endpoint is denied by Session policy.');
     }
 }
-//# sourceMappingURL=policy.js.map

package/dist/session/credential/index.d.ts

@@ -0,0 +1 @@
+export { createSessionCredentialProvider, type SessionCredential, type SessionCredentialProvider, type SessionCredentialProviderOptions, type SessionCredentialState, } from './provider.js';

package/dist/session/credential/index.js

@@ -0,0 +1 @@
+export { createSessionCredentialProvider, } from './provider.js';

package/dist/session/credential/limits.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Settlement allowance added to the declared delegation TTL to form the refresh threshold. It
+ * matches the destination-credential skew routing already applies to a warm entry, so a credential
+ * served here cannot expire between admission and delivery.
+ */
+export declare const SETTLEMENT_SKEW_MS = 5000;
+/** Total budget for one mint, matching the default Session operation budget. */
+export declare const MINT_TIMEOUT_MS = 30000;
+/** Bounded backoff between anticipation attempts after a failed mint. */
+export declare const BACKOFF_MS: readonly [1000, 2000, 4000];
+/** Steady retry interval once the bounded backoff is exhausted. */
+export declare const RETRY_INTERVAL_MS = 4000;

package/dist/session/credential/limits.js

@@ -0,0 +1,12 @@
+/**
+ * Settlement allowance added to the declared delegation TTL to form the refresh threshold. It
+ * matches the destination-credential skew routing already applies to a warm entry, so a credential
+ * served here cannot expire between admission and delivery.
+ */
+export const SETTLEMENT_SKEW_MS = 5_000;
+/** Total budget for one mint, matching the default Session operation budget. */
+export const MINT_TIMEOUT_MS = 30_000;
+/** Bounded backoff between anticipation attempts after a failed mint. */
+export const BACKOFF_MS = [1_000, 2_000, 4_000];
+/** Steady retry interval once the bounded backoff is exhausted. */
+export const RETRY_INTERVAL_MS = 4_000;