@astrale-os/kernel-client 0.6.0-beta.7 → 0.6.0-beta.71

package/dist/session/routing/dispatch.js

@@ -1,30 +1,39 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import * as invocationProtocol from '@astrale-os/kernel-protocol/invocation';
 import { acceptCall, dispatchTrace, isAdmittedMissError, isAdmittedStaleRouteError, } from '../../client/index.js';
 import { ClientError, ResponseError } from '../../errors/index.js';
 import { runSessionOperation, sessionTransportOptions, allowEndpoint } from '../context/index.js';
 import { resolveAuth } from './auth.js';
-import { selectEnvelope } from './envelope.js';
+import { selectEnvelope, selectEnvelopeTarget } from './envelope.js';
 export class SessionDispatcher {
     state;
     constructor(state) {
         this.state = state;
     }
-    async dispatch(input, options, operation, expected) {
+    async dispatch(input, options, operation) {
         this.state.requireOpen();
         const call = acceptCall(input);
         // Authority is resolved before warm lookup so changed credentials or delegation cannot reuse a
         // carrier minted for a different caller partition.
         const auth = await resolveAuth(this.state.auth, call, operation);
-        const source = await this.sourceKernel(operation);
-        const cacheKey = await this.state.cache.key(source.issuer, call, auth, expected);
+        const source = this.state.kernel;
+        const cacheKey = await this.state.cache.key(source, call, auth);
         const dispatch = Object.freeze({
             call,
             auth,
             source,
             cacheKey,
-            ...(expected === undefined ? {} : { expected }),
         });
-        const learned = this.state.cache.get(cacheKey);
+        let learned = await this.state.cache.get(cacheKey, auth.credential);
+        if (learned !== undefined) {
+            try {
+                requireCachedRoute(learned, source, call.target, this.state.envelopeTransport, this.state.websocketAvailable, this.state.policy);
+            }
+            catch {
+                this.state.cache.delete(cacheKey);
+                learned = undefined;
+            }
+        }
         if (learned !== undefined) {
             return this.dispatchDestinationWithRecovery(learned, dispatch, options, operation);
         }
@@ -39,23 +48,22 @@ export class SessionDispatcher {
             ...sessionTransportOptions(operation, options.idempotencyKey),
             ...(state.auth.delegate === undefined ? {} : { delegate: state.auth.delegate }),
             ...(routing === undefined ? {} : { routing }),
-            ...(state.expected === undefined ? {} : { schema: { revision: state.expected.revision } }),
         }));
     }
     async followSource(result, state, options, operation) {
         if (result.kind !== 'redirect')
             return result;
         const redirect = result.redirect;
-        if (redirect.route.via.issuer !== state.source.issuer) {
+        if (redirect.route.via.issuer !== state.source) {
             throw new ClientError('Redirect issuer differs from the session-pinned source Kernel identity.');
         }
-        requireExpectedPublication(redirect.route, state.expected);
-        const learned = this.state.cache.learn(state.cacheKey, redirect.route, redirect.credential);
+        requireTargetPublication(redirect.route, state.call.target);
+        const learned = await this.state.cache.learn(state.cacheKey, redirect.route, redirect.credential, state.auth.credential);
         return this.dispatchDestinationWithRecovery(learned, state, options, operation, redirect.trace);
     }
     async dispatchDestinationWithRecovery(learned, state, options, operation, trace) {
         try {
-            return await this.dispatchDestination(learned, state.call, options, operation, state.expected, trace);
+            return await this.dispatchDestination(learned, state.call, options, operation, state.source, trace);
         }
         catch (cause) {
             const stale = isAdmittedStaleRouteError(cause);
@@ -79,31 +87,45 @@ export class SessionDispatcher {
             return this.followSource(refreshed, state, options, operation);
         }
     }
-    async dispatchDestination(learned, call, options, operation, expected, trace) {
-        if (learned.route.via.issuer !== (await this.sourceKernel(operation)).issuer) {
+    async dispatchDestination(learned, call, options, operation, source, trace) {
+        if (learned.route.via.issuer !== source) {
             throw new ClientError('Learned route issuer differs from the session-pinned source Kernel.');
         }
-        requireExpectedPublication(learned.route, expected);
+        requireTargetPublication(learned.route, call.target);
         const envelope = selectEnvelope(learned.route.endpoint, this.state.envelopeTransport, this.state.websocketAvailable, this.state.pool, this.state.policy);
         const requestOptions = {
             ...sessionTransportOptions(operation, options.idempotencyKey),
             routing: learned.route.via,
         };
+        // The source has admitted this fingerprint against the exact Publication carried by Via.
+        // Pin that revision at the destination so existing Workers can execute the same admitted
+        // callable without understanding the newer fingerprint Target representation. The cache
+        // remains partitioned by the original fingerprint, and stale recovery re-admits it at source.
+        const destinationCall = typeof call.target !== 'string' && call.target.fingerprint !== undefined
+            ? {
+                ...call,
+                target: invocationProtocol.Target({
+                    callable: call.target.callable,
+                    revision: learned.route.via.publication.revision,
+                    ...(call.target.instance === undefined ? {} : { instance: call.target.instance }),
+                }),
+            }
+            : call;
         const result = await runSessionOperation(operation, () => trace === undefined
-            ? authenticated(envelope.client, learned.credential).dispatch(call, requestOptions)
-            : dispatchTrace(envelope.client, learned.credential, call, requestOptions, trace));
+            ? authenticated(envelope.client, learned.credential).dispatch(destinationCall, requestOptions)
+            : dispatchTrace(envelope.client, learned.credential, destinationCall, requestOptions, trace));
         if (result.kind === 'redirect') {
             throw new ClientError('A destination redirect is invalid; only the source Kernel may redirect.');
         }
         return result;
     }
-    async sourceKernel(operation) {
-        const snapshot = await this.state.discovery.snapshot(operation);
-        if (snapshot.kernel !== this.state.kernel) {
-            throw new ClientError('Session discovery returned another Kernel identity.');
-        }
-        return Object.freeze({ issuer: snapshot.publication.identity.issuer });
+}
+function requireCachedRoute(learned, source, target, envelopeTransport, websocketAvailable, policy) {
+    if (learned.route.via.issuer !== source) {
+        throw new ClientError('Learned route issuer differs from the session-pinned source Kernel.');
     }
+    requireTargetPublication(learned.route, target);
+    selectEnvelopeTarget(learned.route.endpoint, envelopeTransport, websocketAvailable, policy);
 }
 function isRouteCompatibilityConflict(input) {
     if (!(input instanceof ResponseError))
@@ -113,15 +135,16 @@ function isRouteCompatibilityConflict(input) {
         message: input.message,
         ...(input.data === undefined ? {} : { data: input.data }),
     });
-    return (failure?.data.code === invocationProtocol.SCHEMA_UPGRADE_REQUIRED ||
-        failure?.data.code === invocationProtocol.SCHEMA_REVISION_MISMATCH ||
+    return (failure?.data.code === invocationProtocol.SCHEMA_REVISION_MISMATCH ||
+        failure?.data.code === invocationProtocol.CALLABLE_FINGERPRINT_MISMATCH ||
         failure?.data.code === invocationProtocol.SERVICE_TRUST_REQUIRED);
 }
-function requireExpectedPublication(route, expected) {
-    if (expected === undefined)
+function requireTargetPublication(route, target) {
+    if (typeof target === 'string')
         return;
     const actual = route.via.publication;
-    if (actual.origin !== expected.origin || actual.revision !== expected.revision) {
+    if (actual.origin !== Key.origin(target.callable) ||
+        (target.revision !== undefined && actual.revision !== target.revision)) {
         throw new ClientError('Resolved route does not match the expected Schema revision.');
     }
 }
@@ -130,9 +153,11 @@ export function requireResultKind(expected, result) {
         return result;
     if (result.kind === 'stream')
         void result.stream.cancel(`Expected ${expected} result.`);
+    if (result.kind === 'binary' && !(result.value.body instanceof Uint8Array)) {
+        void result.value.body[Symbol.asyncIterator]().return?.();
+    }
     throw new ClientError(`Function returned ${result.kind}; ${expected} was required.`);
 }
 function authenticated(client, credential) {
     return credential === undefined ? client : client.as(credential);
 }
-//# sourceMappingURL=dispatch.js.map

package/dist/session/routing/envelope.d.ts

@@ -11,4 +11,5 @@ export interface EnvelopeSelection {
     readonly destination: ClientTarget;
 }
 export declare function selectEnvelope(endpoints: publication.InvocationEndpoints, preference: SessionEnvelopeTransport, websocketAvailable: boolean, pool: ClientPoolCapability, policy: Readonly<SessionPolicy>): EnvelopeSelection;
-//# sourceMappingURL=envelope.d.ts.map
+/** Resolve and admit one route endpoint without acquiring a transport Client. */
+export declare function selectEnvelopeTarget(endpoints: publication.InvocationEndpoints, preference: SessionEnvelopeTransport, websocketAvailable: boolean, policy: Readonly<SessionPolicy>): ClientTarget;

package/dist/session/routing/envelope.js

@@ -1,6 +1,19 @@
 import { ClientError } from '../../errors/index.js';
 import { allowEndpoint } from '../context/index.js';
 export function selectEnvelope(endpoints, preference, websocketAvailable, pool, policy) {
+    const destination = selectEnvelopeTarget(endpoints, preference, websocketAvailable, policy);
+    const client = pool.clientFor(destination);
+    if (client === null ||
+        typeof client !== 'object' ||
+        typeof client.dispatch !== 'function' ||
+        typeof client.as !== 'function' ||
+        typeof client.close !== 'function') {
+        throw new TypeError('Session client pool capability returned an invalid Client.');
+    }
+    return Object.freeze({ client, destination });
+}
+/** Resolve and admit one route endpoint without acquiring a transport Client. */
+export function selectEnvelopeTarget(endpoints, preference, websocketAvailable, policy) {
     let destination;
     if (preference === 'websocket') {
         if (endpoints.websocket === undefined) {
@@ -23,14 +36,5 @@ export function selectEnvelope(endpoints, preference, websocketAvailable, pool,
         allowEndpoint(endpoints.http, policy);
         destination = Object.freeze({ transport: 'http', url: endpoints.http });
     }
-    const client = pool.clientFor(destination);
-    if (client === null ||
-        typeof client !== 'object' ||
-        typeof client.dispatch !== 'function' ||
-        typeof client.as !== 'function' ||
-        typeof client.close !== 'function') {
-        throw new TypeError('Session client pool capability returned an invalid Client.');
-    }
-    return Object.freeze({ client, destination });
+    return destination;
 }
-//# sourceMappingURL=envelope.js.map

package/dist/session/routing/index.d.ts

@@ -1,7 +1,5 @@
 export { admitSessionAuth, resolveAuth, type Auth, type EffectiveAuth, type SessionAuth, } from './auth.js';
-export type { SchemaExpectation } from './expectation.js';
-export { RouteCache, type LearnedRoute } from './cache.js';
+export { RouteCache, type LearnedRoute, type PersistedRoute, type SessionRouteArtifact, type SessionRouteStore, } from './cache.js';
 export { requireResultKind, SessionDispatcher, type SessionDispatcherOptions } from './dispatch.js';
 export { type ClientPoolCapability, type EnvelopeSelection } from './envelope.js';
 export { admitEnvelopeTransport, admitRequestOptions, type SessionEnvelopeTransport, type SessionRequestOptions, } from './request.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/session/routing/index.js

@@ -1,6 +1,5 @@
 export { admitSessionAuth, resolveAuth, } from './auth.js';
-export { RouteCache } from './cache.js';
+export { RouteCache, } from './cache.js';
 export { requireResultKind, SessionDispatcher } from './dispatch.js';
 export {} from './envelope.js';
 export { admitEnvelopeTransport, admitRequestOptions, } from './request.js';
-//# sourceMappingURL=index.js.map

package/dist/session/routing/request.d.ts

@@ -6,4 +6,3 @@ export interface SessionRequestOptions extends SessionControlOptions {
 }
 export declare function admitRequestOptions(input?: SessionRequestOptions): Readonly<SessionRequestOptions>;
 export declare function admitEnvelopeTransport(input: SessionEnvelopeTransport): SessionEnvelopeTransport;
-//# sourceMappingURL=request.d.ts.map

package/dist/session/routing/request.js

@@ -23,4 +23,3 @@ export function admitEnvelopeTransport(input) {
     }
     return input;
 }
-//# sourceMappingURL=request.js.map

package/dist/session/session.d.ts

@@ -1,16 +1,19 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { PathLike } from '@astrale-os/kernel-core/path';
-import type { Key } from '@astrale-os/kernel-dsl/v1';
+import type { Domain } from '@astrale-os/kernel-dsl/v1/domain';
+import type { publication } from '@astrale-os/kernel-protocol';
+import type { AuthApi } from '../auth/index.js';
 import type { Call, Input, Result } from '../client/index.js';
+import type { DomainBinding, GraphApi } from '../graph/index.js';
 import type { ClientFactory, ClientPool as ClientPoolType } from '../pool/index.js';
-import type { ReadyInstallation, SchemaApi } from '../schema/index.js';
+import type { SchemaApi } from '../schema/index.js';
 import type { ClientWarning } from '../transport/auto/index.js';
 import type { Fetch } from '../transport/http/index.js';
 import type { WebSocketConstructor } from '../transport/websocket/index.js';
 import type { SessionControlOptions, SessionPolicy } from './context/index.js';
 import type { SessionSnapshot } from './discovery/index.js';
 import type { CallableReference, InputOfReference, OutputOfReference } from './reference.js';
-import type { SessionAuth, SessionEnvelopeTransport, SessionRequestOptions } from './routing/index.js';
+import type { SessionRouteStore, SessionAuth, SessionEnvelopeTransport, SessionRequestOptions } from './routing/index.js';
 import type { ViewCatalog } from './views/index.js';
 export interface ClientSessionOptions {
     /** Exact canonical source Kernel identity; its invocation and discovery endpoints are derived. */
@@ -20,6 +23,8 @@ export interface ClientSessionOptions {
     readonly pool?: Pick<ClientPoolType, 'clientFor'>;
     readonly websocket?: WebSocketConstructor;
     readonly auth?: SessionAuth;
+    /** Optional caller-owned persistence for bounded confidential route artifacts. */
+    readonly routeStore?: SessionRouteStore;
     readonly policy: SessionPolicy;
     readonly envelopeTransport?: SessionEnvelopeTransport;
     readonly onWarning?: (warning: ClientWarning) => void;
@@ -27,6 +32,7 @@ export interface ClientSessionOptions {
     readonly maximumBundleBytes?: number;
     readonly maximumResponseBytes?: number;
     readonly timeoutMs?: number;
+    readonly schemaLifecycleTimeoutMs?: number;
 }
 export type ConnectOptions = Omit<ClientSessionOptions, 'kernel' | 'policy'> & {
     readonly url: string;
@@ -36,6 +42,8 @@ export type ConnectOptions = Omit<ClientSessionOptions, 'kernel' | 'policy'> & {
 export declare class ClientSession {
     readonly kernel: IssuerId;
     readonly schema: SchemaApi;
+    readonly graph: GraphApi;
+    readonly auth: AuthApi;
     private readonly ownedPool?;
     private readonly discovery;
     private readonly dispatcher;
@@ -45,18 +53,21 @@ export declare class ClientSession {
     private readonly admitTargetViews;
     private closed;
     constructor(options: ClientSessionOptions);
+    /** Bind one admitted DSL Domain to authenticated graph projection and Method dispatch. */
+    bind<const DomainValue extends Domain>(domain: DomainValue): DomainBinding<DomainValue>;
+    /** Revalidate the intrinsic Publication without acquiring its bundle or Views. */
+    publication(options?: SessionControlOptions): Promise<publication.Publication>;
     snapshot(options?: SessionControlOptions): Promise<SessionSnapshot>;
     viewsFor(target: PathLike, options?: SessionControlOptions): Promise<ViewCatalog>;
-    installation(origin: Key.Origin, options?: SessionControlOptions): Promise<ReadyInstallation>;
     dispatch(call: Call, options?: SessionRequestOptions): Promise<Result>;
     call(call: Call, options?: SessionRequestOptions): Promise<Input>;
-    invoke<const Reference extends CallableReference>(reference: Reference, input: InputOfReference<Reference>, options?: SessionRequestOptions): Promise<OutputOfReference<Reference>>;
+    invoke<const Reference extends CallableReference<unknown>>(reference: Reference, input: InputOfReference<Reference>, options?: SessionRequestOptions): Promise<OutputOfReference<Reference>>;
     stream(call: Call, options?: SessionRequestOptions): Promise<import("../client/result.js").Stream>;
-    binary(call: Call, options?: SessionRequestOptions): Promise<import("@astrale-os/kernel-core/domain").BinaryResult>;
+    binary(call: Call, options?: SessionRequestOptions): Promise<import("@astrale-os/kernel-core/callable").BinaryOutput>;
     close(): void;
     private requireOpen;
+    private invokeDomainMethod;
     private operation;
 }
 /** Open one caller-owned conversation with a Kernel using secure defaults. */
 export declare function connect(options: ConnectOptions): ClientSession;
-//# sourceMappingURL=session.d.ts.map

package/dist/session/session.js

@@ -1,11 +1,17 @@
-import { Client } from '../client/index.js';
-import { ClientError } from '../errors/index.js';
+import { Path } from '@astrale-os/kernel-core/path';
+import { callableFingerprint } from '@astrale-os/kernel-dsl/v1/schema/fingerprint';
+import { createAuth } from '../auth/auth.js';
+import { Client, acceptCall } from '../client/index.js';
+import { SessionError } from '../errors/index.js';
+import { createDomainBinding } from '../graph/domain/binding.js';
+import { createGraph } from '../graph/index.js';
 import { ClientPool } from '../pool/index.js';
-import { createSchema } from '../schema/index.js';
+import { createSchema, DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS } from '../schema/index.js';
 import { AutoTransport } from '../transport/auto/index.js';
 import { HttpTransport } from '../transport/http/index.js';
 import { WebSocketTransport } from '../transport/websocket/index.js';
-import { admitControlOptions, admitPolicy, createSessionOperation, DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_TIMEOUT_MS, admitKernel, kernelInvocationEndpoint, platformDuration, positive, } from './context/index.js';
+import { admitFunction } from './admission.js';
+import { admitControlOptions, admitPolicy, createSessionOperation, DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_TIMEOUT_MS, admitKernel, allowEndpoint, kernelInvocationEndpoint, platformDuration, positive, } from './context/index.js';
 import { createSessionDiscovery } from './discovery/index.js';
 import { admitReference } from './reference.js';
 import { admitEnvelopeTransport, admitRequestOptions, admitSessionAuth, requireResultKind, RouteCache, SessionDispatcher, } from './routing/index.js';
@@ -15,6 +21,8 @@ const DEFAULT_SESSION_POLICY = Object.freeze({ maximumRouteAgeMs: 60_000 });
 export class ClientSession {
     kernel;
     schema;
+    graph;
+    auth;
     ownedPool;
     discovery;
     dispatcher;
@@ -42,11 +50,12 @@ export class ClientSession {
         const maximumBundleBytes = positive(options.maximumBundleBytes ?? DEFAULT_MAXIMUM_BUNDLE_BYTES, 'maximumBundleBytes');
         const maximumResponseBytes = positive(options.maximumResponseBytes ?? DEFAULT_MAXIMUM_RESPONSE_BYTES, 'maximumResponseBytes');
         const timeoutMs = platformDuration(options.timeoutMs ?? DEFAULT_TIMEOUT_MS, 'timeoutMs');
+        const schemaLifecycleTimeoutMs = platformDuration(options.schemaLifecycleTimeoutMs ?? DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS, 'schemaLifecycleTimeoutMs');
         this.timeoutMs = timeoutMs;
         const websocketAvailable = options.client !== undefined ||
             options.pool !== undefined ||
             options.websocket !== undefined ||
-            typeof globalThis.WebSocket === 'function';
+            typeof WebSocket === 'function';
         const client = options.client ??
             defaultClientFactory({
                 fetch: fetchImpl,
@@ -73,24 +82,50 @@ export class ClientSession {
             requireOpen: () => this.requireOpen(),
             acquisitionOperation: () => this.operation(undefined),
         });
-        this.routes = new RouteCache(policy.maximumRouteAgeMs);
+        this.routes = new RouteCache(policy.maximumRouteAgeMs, undefined, options.routeStore);
+        const auth = admitSessionAuth(options.auth);
+        const admission = {
+            kernel: this.kernel,
+            auth,
+            source: () => {
+                allowEndpoint(sourceEndpoint, policy);
+                return pool.clientFor({ transport: 'http', url: sourceEndpoint });
+            },
+            fetch: fetchImpl,
+            policy,
+            limits: { maximumPublicationBytes, maximumBundleBytes },
+            maximumResponseBytes,
+        };
         this.dispatcher = new SessionDispatcher({
             kernel: this.kernel,
             sourceEndpoint,
             pool,
             websocketAvailable,
-            auth: admitSessionAuth(options.auth),
+            auth,
             cache: this.routes,
             policy,
             envelopeTransport: admitEnvelopeTransport(options.envelopeTransport ?? 'http'),
-            discovery: this.discovery,
             requireOpen: () => this.requireOpen(),
         });
         this.schema = createSchema((request, options) => this.dispatch(request, options), {
             maximumPublicationBytes,
             maximumBundleBytes,
+            lifecycleTimeoutMs: schemaLifecycleTimeoutMs,
+        });
+        this.graph = createGraph((call, options) => this.call(call, options));
+        this.auth = createAuth((target, input, options) => this.call({ target, input }, options), (call, options) => {
+            const operation = this.operation(admitControlOptions(options));
+            return admitFunction(admission, acceptCall(call), options, operation);
         });
     }
+    /** Bind one admitted DSL Domain to authenticated graph projection and Method dispatch. */
+    bind(domain) {
+        return createDomainBinding(domain, this.graph, (node, method, input) => this.invokeDomainMethod(domain, node, method, input));
+    }
+    /** Revalidate the intrinsic Publication without acquiring its bundle or Views. */
+    publication(options) {
+        return this.discovery.publication(this.operation(admitControlOptions(options)));
+    }
     snapshot(options) {
         return this.discovery.snapshot(this.operation(admitControlOptions(options)));
     }
@@ -98,23 +133,6 @@ export class ClientSession {
         this.requireOpen();
         return resolveViewsFor(async (call, operation) => requireResultKind('value', await this.dispatcher.dispatch(call, {}, operation)).value, this.admitTargetViews, target, this.operation(admitControlOptions(options)));
     }
-    async installation(origin, options) {
-        const result = await this.schema.introspect({
-            from: { kind: 'installation', origin },
-            select: {
-                state: true,
-                target: true,
-                source: true,
-                bundle: true,
-                readiness: true,
-                capabilities: true,
-            },
-        }, options);
-        if (result?.state !== 'ready' || result.readiness === null) {
-            throw new ClientError(`Domain ${origin} is not ready on this Kernel.`);
-        }
-        return result;
-    }
     dispatch(call, options) {
         const admitted = admitRequestOptions(options);
         return this.dispatcher.dispatch(call, admitted, this.operation(admitted));
@@ -126,11 +144,22 @@ export class ClientSession {
     async invoke(reference, input, options) {
         const admittedReference = admitReference(reference);
         const admittedOptions = admitRequestOptions(options);
-        const expected = Object.freeze({
-            origin: admittedReference.origin,
-            revision: admittedReference.revision,
-        });
-        const result = await this.dispatcher.dispatch({ target: admittedReference.target, input }, admittedOptions, this.operation(admittedOptions), expected);
+        const { anchor, steps } = admittedReference.target.ast;
+        const last = steps.at(-1);
+        const instance = last?.kind === 'method' && last.dispatch === 'instance'
+            ? Path.fromAST({ anchor, steps: steps.slice(0, -1) }).raw
+            : undefined;
+        // A generated reference pins the callable meaning; a hand-written one still pins the revision.
+        const result = await this.dispatcher.dispatch({
+            target: Object.freeze({
+                callable: admittedReference.callable,
+                ...(admittedReference.fingerprint === undefined
+                    ? { revision: admittedReference.revision }
+                    : { fingerprint: admittedReference.fingerprint }),
+                ...(instance === undefined ? {} : { instance }),
+            }),
+            input,
+        }, admittedOptions, this.operation(admittedOptions));
         const narrowed = requireResultKind(admittedReference.outputMode, result);
         return (narrowed.kind === 'value'
             ? narrowed.value
@@ -150,14 +179,30 @@ export class ClientSession {
         if (this.closed)
             return;
         this.closed = true;
-        this.lifecycle.abort(new ClientError('ClientSession is closed.'));
+        this.lifecycle.abort(new SessionError('ClientSession is closed.', { failure: 'closed' }));
         this.ownedPool?.close();
         this.routes.clear();
         this.discovery.clear();
     }
     requireOpen() {
         if (this.closed)
-            throw new ClientError('ClientSession is closed.');
+            throw new SessionError('ClientSession is closed.', { failure: 'closed' });
+    }
+    invokeDomainMethod(domain, node, method, input) {
+        const diagnostics = method.validateInput(input);
+        if (diagnostics.length > 0)
+            throw new TypeError(`Method ${method.key} input is invalid.`);
+        const owner = domain.closure.find(({ origin }) => origin === method.owner.ref.origin);
+        if (owner === undefined)
+            throw new TypeError(`Method owner ${method.owner.ref.origin} is absent.`);
+        return this.invoke({
+            origin: owner.origin,
+            revision: owner.revision,
+            fingerprint: callableFingerprint(method),
+            callable: method.key,
+            target: Path.instanceMethod(Path.id(node.id), method.key),
+            outputMode: method.output.mode,
+        }, input);
     }
     operation(options) {
         this.requireOpen();
@@ -231,4 +276,3 @@ function defaultClientFactory(options) {
         }
     };
 }
-//# sourceMappingURL=session.js.map

package/dist/session/session.typecheck.d.ts

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=session.typecheck.d.ts.map

package/dist/session/session.typecheck.js

@@ -1,4 +1,8 @@
-import { ClientSession } from './index.js';
+import { NodeId } from '@astrale-os/kernel-core/graph/node';
+import { Path } from '@astrale-os/kernel-core/path';
+import { K, KernelSchema } from '@astrale-os/kernel-core/schema';
+import { defineSchema, func, method, nodeClass, schema, valueSchema, } from '@astrale-os/kernel-dsl/v1';
+import { ClientSession, createSessionCredentialProvider, reference } from './index.js';
 void new ClientSession(options);
 void auth;
 void control;
@@ -6,5 +10,101 @@ void envelope;
 void policy;
 void request;
 void snapshot;
-void {};
-//# sourceMappingURL=session.typecheck.js.map
+const observedPublication = session.publication(control);
+void observedPublication;
+const admitted = session.auth.admit({
+    target: Path.parse('/:example.test:function.write'),
+    input: {},
+}, { attenuation: { kind: 'identity', self: true }, ...control });
+void admitted;
+// @ts-expect-error Admission belongs to Auth, not the top-level Session.
+void session.admit({ target: Path.parse('/:example.test:function.write'), input: {} });
+const credentials = createSessionCredentialProvider({
+    ttlSeconds: 60,
+    mint: async () => minted,
+});
+// A credential provider is a Session authentication resolver; no adapter stands between them.
+const credentialAuth = credentials;
+void new ClientSession({ ...options, auth: credentialAuth });
+// @ts-expect-error A minted credential must carry its own absolute expiry.
+void createSessionCredentialProvider({ ttlSeconds: 60, mint: async () => minted.credential });
+const dynamicReference = reference(dynamicDomain, dynamicMethod)(Path.id(NodeId('dynamic-node')));
+void session.invoke(dynamicReference, dynamicInput);
+const dynamicInputIsClientInput = true;
+const dynamicOutputIsUnknown = true;
+void dynamicInputIsClientInput;
+void dynamicOutputIsUnknown;
+const renameInput = valueSchema()({
+    type: 'object',
+    properties: { name: { type: 'string' } },
+    required: ['name'],
+    additionalProperties: false,
+});
+const registrationInput = valueSchema()(K.functions.register.input);
+const booleanOutput = valueSchema()({ type: 'boolean' });
+const typedDomain = schema.resolve(defineSchema('client.input-witness.typecheck', {
+    dependencies: { kernel: KernelSchema },
+    functions: {
+        registerIdentity: func({
+            auth: 'authenticated',
+            input: registrationInput,
+            output: booleanOutput,
+        }),
+    },
+    classes: {
+        Person: nodeClass({
+            methods: {
+                rename: method({ auth: 'authenticated', input: renameInput, output: booleanOutput }),
+                registerIdentity: method({
+                    static: true,
+                    auth: 'authenticated',
+                    input: registrationInput,
+                    output: booleanOutput,
+                }),
+            },
+        }),
+    },
+}));
+const registerReference = reference(typedDomain, typedDomain.functions.registerIdentity);
+const staticRegisterReference = reference(typedDomain, typedDomain.classes.Person.static.methods.registerIdentity);
+const renameReference = reference(typedDomain, typedDomain.classes.Person.methods.rename)(Path.id(NodeId('person')));
+void session.invoke(registerReference, registration);
+void boundSession.invoke(staticRegisterReference, registration);
+void session.invoke(renameReference, renameRequest);
+const registerInputIsRequest = true;
+const renameInputIsInterface = true;
+const renameOutputIsBoolean = true;
+void registerInputIsRequest;
+void renameInputIsInterface;
+void renameOutputIsBoolean;
+// @ts-expect-error The exact Schema's required input fields are retained.
+void session.invoke(renameReference, {});
+// @ts-expect-error A Date is not the Schema's declared string input.
+void session.invoke(renameReference, { name: new Date() });
+// @ts-expect-error A function is not the Schema's declared string input.
+void session.invoke(renameReference, { name: () => 'Ada' });
+// @ts-expect-error RegisterRequest retains its nonempty identities tuple.
+void session.invoke(registerReference, { idempotencyKey: 'key', identities: [] });
+// @ts-expect-error An unknown-schema reference still accepts only portable Client Input.
+void session.invoke(dynamicReference, new Date());
+const abstractMethod = method({
+    auth: 'authenticated',
+    input: { type: 'null' },
+    output: { type: 'null' },
+    abstract: true,
+});
+const abstractDomain = schema.resolve(defineSchema('client.reference.typecheck', {
+    classes: {
+        AbstractItem: nodeClass({ abstract: true, methods: { abstractMethod } }),
+    },
+}));
+// @ts-expect-error Abstract Methods are declarations and cannot become Client references.
+reference(abstractDomain, abstractDomain.classes.AbstractItem.methods.abstractMethod);
+// @ts-expect-error Exact identity is derived internally, never supplied as a Session option.
+void session.invoke(dynamicReference, dynamicInput, { expect: undefined });
+// @ts-expect-error Raw Client options do not select a declaration.
+const unsupportedClientOptions = { expect: undefined };
+void unsupportedClientOptions;
+// @ts-expect-error Internal metadata dispatch is absent from the public package facade.
+import { dispatchTrace } from '../index.js';
+void dispatchTrace;

package/dist/session/views/catalog.d.ts

@@ -13,4 +13,3 @@ export declare function rootViewCatalog(publication: publication.Publication, ar
 export declare function catalogFromKeys(root: ViewCatalog, keys: readonly Key.View[]): ViewCatalog;
 /** Re-admit one Runtime-resolved heterogeneous View catalog at the Client trust boundary. */
 export declare function targetViewCatalog(input: unknown, policy: Readonly<SessionPolicy>): ViewCatalog;
-//# sourceMappingURL=catalog.d.ts.map