@astrale-os/kernel-client 0.6.0-beta.8 → 0.6.0-beta.80

package/dist/session/routing/request.d.ts

@@ -3,7 +3,15 @@ import type { SessionControlOptions } from '../context/index.js';
 export type SessionEnvelopeTransport = 'auto' | 'http' | 'websocket';
 export interface SessionRequestOptions extends SessionControlOptions {
     readonly idempotencyKey?: invocation.IdempotencyKey;
+    readonly body?: never;
 }
+export type SessionRequestOptionsWithBody = Omit<SessionRequestOptions, 'body' | 'idempotencyKey'> & {
+    readonly body: Blob;
+    readonly idempotencyKey?: never;
+};
+export declare function admitInvocationOptions(input: SessionRequestOptions | SessionRequestOptionsWithBody | undefined): {
+    readonly options: Readonly<SessionRequestOptions>;
+    readonly body?: Blob;
+};
 export declare function admitRequestOptions(input?: SessionRequestOptions): Readonly<SessionRequestOptions>;
 export declare function admitEnvelopeTransport(input: SessionEnvelopeTransport): SessionEnvelopeTransport;
-//# sourceMappingURL=request.d.ts.map

package/dist/session/routing/request.js

@@ -1,5 +1,22 @@
 import * as invocationProtocol from '@astrale-os/kernel-protocol/invocation';
 import { admitControlOptions } from '../context/index.js';
+export function admitInvocationOptions(input) {
+    if (input === undefined)
+        return Object.freeze({ options: admitRequestOptions() });
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new TypeError('Session request options are invalid.');
+    }
+    if (!Object.hasOwn(input, 'body')) {
+        return Object.freeze({ options: admitRequestOptions(input) });
+    }
+    const { body, ...options } = input;
+    if (!(body instanceof Blob))
+        throw new TypeError('Binary input must be a Blob or File.');
+    if (options.idempotencyKey !== undefined) {
+        throw new TypeError('Binary requests cannot carry an idempotency key.');
+    }
+    return Object.freeze({ options: admitRequestOptions(options), body });
+}
 export function admitRequestOptions(input = {}) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
         throw new TypeError('Session request options are invalid.');
@@ -23,4 +40,3 @@ export function admitEnvelopeTransport(input) {
     }
     return input;
 }
-//# sourceMappingURL=request.js.map

package/dist/session/session.d.ts

@@ -1,16 +1,22 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { PathLike } from '@astrale-os/kernel-core/path';
-import type { Key } from '@astrale-os/kernel-dsl/v1';
+import type { Domain } from '@astrale-os/kernel-dsl/v1/domain';
+import type { publication } from '@astrale-os/kernel-protocol';
+import type { AuthApi } from '../auth/index.js';
 import type { Call, Input, Result } from '../client/index.js';
+import type { DomainBinding, GraphApi } from '../graph/index.js';
 import type { ClientFactory, ClientPool as ClientPoolType } from '../pool/index.js';
-import type { ReadyInstallation, SchemaApi } from '../schema/index.js';
+import type { SchemaApi } from '../schema/index.js';
 import type { ClientWarning } from '../transport/auto/index.js';
 import type { Fetch } from '../transport/http/index.js';
 import type { WebSocketConstructor } from '../transport/websocket/index.js';
+import type { ContentApi } from './content.js';
 import type { SessionControlOptions, SessionPolicy } from './context/index.js';
+import type { SessionCredential } from './credential/index.js';
 import type { SessionSnapshot } from './discovery/index.js';
-import type { CallableReference, InputOfReference, OutputOfReference } from './reference.js';
-import type { SessionAuth, SessionEnvelopeTransport, SessionRequestOptions } from './routing/index.js';
+import type { SessionExchangeOptions, SessionExchangeRequest } from './exchange/index.js';
+import type { CallableReference, InputModeOfReference, InputOfReference, OutputOfReference } from './reference.js';
+import type { SessionRouteStore, SessionAuth, SessionEnvelopeTransport, SessionRequestOptions, SessionRequestOptionsWithBody } from './routing/index.js';
 import type { ViewCatalog } from './views/index.js';
 export interface ClientSessionOptions {
     /** Exact canonical source Kernel identity; its invocation and discovery endpoints are derived. */
@@ -20,6 +26,14 @@ export interface ClientSessionOptions {
     readonly pool?: Pick<ClientPoolType, 'clientFor'>;
     readonly websocket?: WebSocketConstructor;
     readonly auth?: SessionAuth;
+    /**
+     * Present each Domain callable with a credential its declaring Domain exchanges for the `auth`
+     * caller, so the Domain is the principal and the caller is `auth`. Kernel and local callables keep
+     * the `auth` credential.
+     */
+    readonly exchange?: SessionExchangeOptions;
+    /** Optional caller-owned persistence for bounded confidential route artifacts. */
+    readonly routeStore?: SessionRouteStore;
     readonly policy: SessionPolicy;
     readonly envelopeTransport?: SessionEnvelopeTransport;
     readonly onWarning?: (warning: ClientWarning) => void;
@@ -27,6 +41,7 @@ export interface ClientSessionOptions {
     readonly maximumBundleBytes?: number;
     readonly maximumResponseBytes?: number;
     readonly timeoutMs?: number;
+    readonly schemaLifecycleTimeoutMs?: number;
 }
 export type ConnectOptions = Omit<ClientSessionOptions, 'kernel' | 'policy'> & {
     readonly url: string;
@@ -36,27 +51,45 @@ export type ConnectOptions = Omit<ClientSessionOptions, 'kernel' | 'policy'> & {
 export declare class ClientSession {
     readonly kernel: IssuerId;
     readonly schema: SchemaApi;
+    readonly graph: GraphApi;
+    readonly auth: AuthApi;
+    readonly content: ContentApi;
     private readonly ownedPool?;
     private readonly discovery;
     private readonly dispatcher;
     private readonly lifecycle;
     private readonly timeoutMs;
     private readonly routes;
+    private readonly exchangeDependencies;
+    private readonly callExchange?;
     private readonly admitTargetViews;
     private closed;
     constructor(options: ClientSessionOptions);
+    /** Bind one admitted DSL Domain to authenticated graph projection and Method dispatch. */
+    bind<const DomainValue extends Domain>(domain: DomainValue): DomainBinding<DomainValue>;
+    /**
+     * Delegate this Session's caller to one Domain issuer and exchange that delegation for the
+     * Domain's credential to this Kernel. Nothing is cached: hold the result, for example through
+     * `createSessionCredentialProvider`, for as long as it covers the calls it carries.
+     */
+    exchange(domain: string, options?: SessionExchangeRequest): Promise<SessionCredential>;
+    /** Revalidate the intrinsic Publication without acquiring its bundle or Views. */
+    publication(options?: SessionControlOptions): Promise<publication.Publication>;
     snapshot(options?: SessionControlOptions): Promise<SessionSnapshot>;
     viewsFor(target: PathLike, options?: SessionControlOptions): Promise<ViewCatalog>;
-    installation(origin: Key.Origin, options?: SessionControlOptions): Promise<ReadyInstallation>;
     dispatch(call: Call, options?: SessionRequestOptions): Promise<Result>;
+    dispatch(call: Call, options: SessionRequestOptionsWithBody): Promise<Result>;
     call(call: Call, options?: SessionRequestOptions): Promise<Input>;
-    invoke<const Reference extends CallableReference>(reference: Reference, input: InputOfReference<Reference>, options?: SessionRequestOptions): Promise<OutputOfReference<Reference>>;
+    call(call: Call, options: SessionRequestOptionsWithBody): Promise<Input>;
+    invoke<const Reference extends CallableReference<unknown>>(reference: InputModeOfReference<Reference> extends 'binary' ? never : Reference, input: InputOfReference<Reference>, options?: SessionRequestOptions): Promise<OutputOfReference<Reference>>;
+    invoke<const Reference extends CallableReference<unknown, unknown, 'binary'>>(reference: Reference, input: InputOfReference<Reference>, options: SessionRequestOptionsWithBody): Promise<OutputOfReference<Reference>>;
+    private dispatchWith;
     stream(call: Call, options?: SessionRequestOptions): Promise<import("../client/result.js").Stream>;
-    binary(call: Call, options?: SessionRequestOptions): Promise<import("@astrale-os/kernel-core/domain").BinaryResult>;
+    binary(call: Call, options?: SessionRequestOptions): Promise<import("@astrale-os/kernel-core/callable").BinaryOutput>;
     close(): void;
     private requireOpen;
+    private invokeDomainMethod;
     private operation;
 }
 /** Open one caller-owned conversation with a Kernel using secure defaults. */
 export declare function connect(options: ConnectOptions): ClientSession;
-//# sourceMappingURL=session.d.ts.map

package/dist/session/session.js

@@ -1,26 +1,39 @@
-import { Client } from '../client/index.js';
-import { ClientError } from '../errors/index.js';
+import { Path } from '@astrale-os/kernel-core/path';
+import { callableFingerprint } from '@astrale-os/kernel-dsl/v1/schema/fingerprint';
+import { createAuth } from '../auth/auth.js';
+import { Client, acceptCall } from '../client/index.js';
+import { SessionError } from '../errors/index.js';
+import { createDomainBinding } from '../graph/domain/binding.js';
+import { createGraph } from '../graph/index.js';
 import { ClientPool } from '../pool/index.js';
-import { createSchema } from '../schema/index.js';
+import { createSchema, DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS } from '../schema/index.js';
 import { AutoTransport } from '../transport/auto/index.js';
 import { HttpTransport } from '../transport/http/index.js';
 import { WebSocketTransport } from '../transport/websocket/index.js';
-import { admitControlOptions, admitPolicy, createSessionOperation, DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_TIMEOUT_MS, admitKernel, kernelInvocationEndpoint, platformDuration, positive, } from './context/index.js';
+import { admitFunction } from './admission.js';
+import { createContentApi } from './content.js';
+import { admitControlOptions, admitPolicy, createSessionOperation, DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_TIMEOUT_MS, admitKernel, allowEndpoint, kernelInvocationEndpoint, platformDuration, positive, } from './context/index.js';
 import { createSessionDiscovery } from './discovery/index.js';
+import { acquireDomainCredential, admitExchangeOptions, admitExchangeRequest, createSessionExchange, } from './exchange/index.js';
 import { admitReference } from './reference.js';
-import { admitEnvelopeTransport, admitRequestOptions, admitSessionAuth, requireResultKind, RouteCache, SessionDispatcher, } from './routing/index.js';
+import { admitEnvelopeTransport, admitInvocationOptions, admitSessionAuth, requireResultKind, RouteCache, SessionDispatcher, } from './routing/index.js';
 import { resolveViewsFor, targetViewCatalog } from './views/index.js';
 const DEFAULT_SESSION_POLICY = Object.freeze({ maximumRouteAgeMs: 60_000 });
 /** Caller-owned discovery and redirect-following conversation with one exact source Kernel. */
 export class ClientSession {
     kernel;
     schema;
+    graph;
+    auth;
+    content;
     ownedPool;
     discovery;
     dispatcher;
     lifecycle = new AbortController();
     timeoutMs;
     routes;
+    exchangeDependencies;
+    callExchange;
     admitTargetViews;
     closed = false;
     constructor(options) {
@@ -42,11 +55,12 @@ export class ClientSession {
         const maximumBundleBytes = positive(options.maximumBundleBytes ?? DEFAULT_MAXIMUM_BUNDLE_BYTES, 'maximumBundleBytes');
         const maximumResponseBytes = positive(options.maximumResponseBytes ?? DEFAULT_MAXIMUM_RESPONSE_BYTES, 'maximumResponseBytes');
         const timeoutMs = platformDuration(options.timeoutMs ?? DEFAULT_TIMEOUT_MS, 'timeoutMs');
+        const schemaLifecycleTimeoutMs = platformDuration(options.schemaLifecycleTimeoutMs ?? DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS, 'schemaLifecycleTimeoutMs');
         this.timeoutMs = timeoutMs;
         const websocketAvailable = options.client !== undefined ||
             options.pool !== undefined ||
             options.websocket !== undefined ||
-            typeof globalThis.WebSocket === 'function';
+            typeof WebSocket === 'function';
         const client = options.client ??
             defaultClientFactory({
                 fetch: fetchImpl,
@@ -73,23 +87,74 @@ export class ClientSession {
             requireOpen: () => this.requireOpen(),
             acquisitionOperation: () => this.operation(undefined),
         });
-        this.routes = new RouteCache(policy.maximumRouteAgeMs);
+        this.routes = new RouteCache(policy.maximumRouteAgeMs, undefined, options.routeStore);
+        const auth = admitSessionAuth(options.auth);
+        const exchange = admitExchangeOptions(options.exchange, auth);
+        this.exchangeDependencies = Object.freeze({
+            kernel: this.kernel,
+            source: () => {
+                allowEndpoint(sourceEndpoint, policy);
+                return pool.clientFor({ transport: 'http', url: sourceEndpoint });
+            },
+            ...(auth === undefined ? {} : { auth }),
+            fetch: fetchImpl,
+            policy,
+            limits: { maximumPublicationBytes, maximumBundleBytes },
+            maximumResponseBytes,
+            operation: (signal) => this.operation(signal === undefined ? undefined : { signal }),
+        });
+        this.callExchange =
+            exchange === undefined || auth === undefined
+                ? undefined
+                : createSessionExchange({ ...this.exchangeDependencies, auth }, exchange);
         this.dispatcher = new SessionDispatcher({
             kernel: this.kernel,
             sourceEndpoint,
             pool,
             websocketAvailable,
-            auth: admitSessionAuth(options.auth),
+            auth,
+            ...(this.callExchange === undefined ? {} : { exchange: this.callExchange }),
             cache: this.routes,
             policy,
             envelopeTransport: admitEnvelopeTransport(options.envelopeTransport ?? 'http'),
-            discovery: this.discovery,
             requireOpen: () => this.requireOpen(),
+            streamingHttp: {
+                fetch: fetchImpl,
+                maximumResponseBytes: 100 * 1024 * 1024,
+                timeoutMs: 30 * 60 * 1_000,
+            },
+        });
+        this.content = createContentApi({
+            operation: (options) => this.operation(options),
+            dispatch: (target, input, operation, body) => this.dispatcher.dispatchHttp({ target, input }, {}, operation, body),
         });
         this.schema = createSchema((request, options) => this.dispatch(request, options), {
             maximumPublicationBytes,
             maximumBundleBytes,
+            lifecycleTimeoutMs: schemaLifecycleTimeoutMs,
         });
+        this.graph = createGraph((call, options) => this.call(call, options));
+        this.auth = createAuth((target, input, options) => this.call({ target, input }, options), (call, options) => {
+            const operation = this.operation(admitControlOptions(options));
+            return admitFunction(this.exchangeDependencies, acceptCall(call), options, operation);
+        });
+    }
+    /** Bind one admitted DSL Domain to authenticated graph projection and Method dispatch. */
+    bind(domain) {
+        return createDomainBinding(domain, this.graph, (node, method, input) => this.invokeDomainMethod(domain, node, method, input));
+    }
+    /**
+     * Delegate this Session's caller to one Domain issuer and exchange that delegation for the
+     * Domain's credential to this Kernel. Nothing is cached: hold the result, for example through
+     * `createSessionCredentialProvider`, for as long as it covers the calls it carries.
+     */
+    async exchange(domain, options) {
+        const request = admitExchangeRequest(domain, options);
+        return acquireDomainCredential(this.exchangeDependencies, request, this.operation(request.control));
+    }
+    /** Revalidate the intrinsic Publication without acquiring its bundle or Views. */
+    publication(options) {
+        return this.discovery.publication(this.operation(admitControlOptions(options)));
     }
     snapshot(options) {
         return this.discovery.snapshot(this.operation(admitControlOptions(options)));
@@ -98,66 +163,90 @@ export class ClientSession {
         this.requireOpen();
         return resolveViewsFor(async (call, operation) => requireResultKind('value', await this.dispatcher.dispatch(call, {}, operation)).value, this.admitTargetViews, target, this.operation(admitControlOptions(options)));
     }
-    async installation(origin, options) {
-        const result = await this.schema.introspect({
-            from: { kind: 'installation', origin },
-            select: {
-                state: true,
-                target: true,
-                source: true,
-                bundle: true,
-                readiness: true,
-                capabilities: true,
-            },
-        }, options);
-        if (result?.state !== 'ready' || result.readiness === null) {
-            throw new ClientError(`Domain ${origin} is not ready on this Kernel.`);
-        }
-        return result;
-    }
     dispatch(call, options) {
-        const admitted = admitRequestOptions(options);
-        return this.dispatcher.dispatch(call, admitted, this.operation(admitted));
+        return this.dispatchWith(call, options);
     }
     async call(call, options) {
-        const result = await this.dispatch(call, options);
+        const result = await this.dispatchWith(call, options);
         return requireResultKind('value', result).value;
     }
     async invoke(reference, input, options) {
         const admittedReference = admitReference(reference);
-        const admittedOptions = admitRequestOptions(options);
-        const expected = Object.freeze({
-            origin: admittedReference.origin,
-            revision: admittedReference.revision,
-        });
-        const result = await this.dispatcher.dispatch({ target: admittedReference.target, input }, admittedOptions, this.operation(admittedOptions), expected);
+        const admitted = admitInvocationOptions(options);
+        const { anchor, steps } = admittedReference.target.ast;
+        const last = steps.at(-1);
+        const instance = last?.kind === 'method' && last.dispatch === 'instance'
+            ? Path.fromAST({ anchor, steps: steps.slice(0, -1) }).raw
+            : undefined;
+        // A generated reference pins the callable meaning, a hand-written one its revision, and a Kernel
+        // reference nothing, like every other syscall the Session addresses.
+        const call = {
+            target: Object.freeze({
+                callable: admittedReference.callable,
+                ...(admittedReference.fingerprint !== undefined
+                    ? { fingerprint: admittedReference.fingerprint }
+                    : admittedReference.revision !== undefined
+                        ? { revision: admittedReference.revision }
+                        : {}),
+                ...(instance === undefined ? {} : { instance }),
+            }),
+            input,
+        };
+        const operation = this.operation(admitted.options);
+        const result = await (admitted.body === undefined && admittedReference.outputMode !== 'binary'
+            ? this.dispatcher.dispatch(call, admitted.options, operation)
+            : this.dispatcher.dispatchHttp(call, admitted.options, operation, admitted.body));
         const narrowed = requireResultKind(admittedReference.outputMode, result);
-        return (narrowed.kind === 'value'
+        return narrowed.kind === 'value'
             ? narrowed.value
             : narrowed.kind === 'stream'
                 ? narrowed.stream
-                : narrowed.value);
+                : narrowed.value;
+    }
+    dispatchWith(call, options, requireHttp = false) {
+        const admitted = admitInvocationOptions(options);
+        const operation = this.operation(admitted.options);
+        return admitted.body === undefined && !requireHttp
+            ? this.dispatcher.dispatch(call, admitted.options, operation)
+            : this.dispatcher.dispatchHttp(call, admitted.options, operation, admitted.body);
     }
     async stream(call, options) {
         const result = await this.dispatch(call, options);
         return requireResultKind('stream', result).stream;
     }
     async binary(call, options) {
-        const result = await this.dispatch(call, options);
+        const result = await this.dispatchWith(call, options, true);
         return requireResultKind('binary', result).value;
     }
     close() {
         if (this.closed)
             return;
         this.closed = true;
-        this.lifecycle.abort(new ClientError('ClientSession is closed.'));
+        this.lifecycle.abort(new SessionError('ClientSession is closed.', { failure: 'closed' }));
         this.ownedPool?.close();
         this.routes.clear();
         this.discovery.clear();
+        this.callExchange?.clear();
     }
     requireOpen() {
         if (this.closed)
-            throw new ClientError('ClientSession is closed.');
+            throw new SessionError('ClientSession is closed.', { failure: 'closed' });
+    }
+    invokeDomainMethod(domain, node, method, input) {
+        const diagnostics = method.validateInput(input);
+        if (diagnostics.length > 0)
+            throw new TypeError(`Method ${method.key} input is invalid.`);
+        const owner = domain.closure.find(({ origin }) => origin === method.owner.ref.origin);
+        if (owner === undefined)
+            throw new TypeError(`Method owner ${method.owner.ref.origin} is absent.`);
+        return this.invoke({
+            origin: owner.origin,
+            revision: owner.revision,
+            fingerprint: callableFingerprint(method),
+            callable: method.key,
+            target: Path.instanceMethod(Path.id(node.id), method.key),
+            outputMode: method.output.mode,
+        }, input);
     }
     operation(options) {
         this.requireOpen();
@@ -231,4 +320,3 @@ function defaultClientFactory(options) {
         }
     };
 }
-//# sourceMappingURL=session.js.map

package/dist/session/session.typecheck.d.ts

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=session.typecheck.d.ts.map

package/dist/session/session.typecheck.js

@@ -1,4 +1,10 @@
-import { ClientSession } from './index.js';
+import { NodeId } from '@astrale-os/kernel-core/graph/node';
+import { Path } from '@astrale-os/kernel-core/path';
+import { K, KernelSchema } from '@astrale-os/kernel-core/schema';
+import { defineSchema, func, method, nodeClass, schema, valueSchema, } from '@astrale-os/kernel-dsl/v1';
+import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
+import { call } from '../client/index.js';
+import { ClientSession, createSessionCredentialProvider, execution, reference } from './index.js';
 void new ClientSession(options);
 void auth;
 void control;
@@ -6,5 +12,168 @@ void envelope;
 void policy;
 void request;
 void snapshot;
-void {};
-//# sourceMappingURL=session.typecheck.js.map
+const observedPublication = session.publication(control);
+void observedPublication;
+const admitted = session.auth.admit({
+    target: Path.parse('/:example.test:function.write'),
+    input: {},
+}, { attenuation: { kind: 'identity', self: true }, ...control });
+void admitted;
+// @ts-expect-error Admission belongs to Auth, not the top-level Session.
+void session.admit({ target: Path.parse('/:example.test:function.write'), input: {} });
+const credentials = createSessionCredentialProvider({
+    ttlSeconds: 60,
+    mint: async () => minted,
+});
+// A credential provider is a Session authentication resolver; no adapter stands between them.
+const credentialAuth = credentials;
+void new ClientSession({ ...options, auth: credentialAuth });
+// @ts-expect-error A minted credential must carry its own absolute expiry.
+void createSessionCredentialProvider({ ttlSeconds: 60, mint: async () => minted.credential });
+const dynamicReference = reference(dynamicDomain, dynamicMethod)(Path.id(NodeId('dynamic-node')));
+void session.invoke(dynamicReference, dynamicInput);
+const dynamicInputIsClientInput = true;
+const dynamicOutputIsUnknown = true;
+void dynamicInputIsClientInput;
+void dynamicOutputIsUnknown;
+const renameInput = valueSchema()({
+    type: 'object',
+    properties: { name: { type: 'string' } },
+    required: ['name'],
+    additionalProperties: false,
+});
+const registerInput = K.functions.register.input;
+if (isBinaryInput(registerInput))
+    throw new TypeError('Register input must be a Value.');
+const registrationInput = valueSchema()(registerInput);
+const booleanOutput = valueSchema()({ type: 'boolean' });
+const typedDomain = schema.resolve(defineSchema('client.input-witness.typecheck', {
+    dependencies: { kernel: KernelSchema },
+    functions: {
+        registerIdentity: func({
+            auth: 'authenticated',
+            input: registrationInput,
+            output: booleanOutput,
+        }),
+    },
+    classes: {
+        Person: nodeClass({
+            methods: {
+                rename: method({ auth: 'authenticated', input: renameInput, output: booleanOutput }),
+                registerIdentity: method({
+                    static: true,
+                    auth: 'authenticated',
+                    input: registrationInput,
+                    output: booleanOutput,
+                }),
+            },
+        }),
+    },
+}));
+const registerReference = reference(typedDomain, typedDomain.functions.registerIdentity);
+const staticRegisterReference = reference(typedDomain, typedDomain.classes.Person.static.methods.registerIdentity);
+const renameReference = reference(typedDomain, typedDomain.classes.Person.methods.rename)(Path.id(NodeId('person')));
+const blobReceipt = session.content
+    .upload(blobBytes, { mediaType: 'image/png' })
+    .then(({ receipt }) => receipt);
+const boundBlobReceipt = boundSession.content
+    .upload(blobBytes, { mediaType: 'image/png' })
+    .then(({ receipt }) => receipt);
+void blobReceipt;
+void boundBlobReceipt;
+void session.invoke(registerReference, registration);
+void boundSession.invoke(staticRegisterReference, registration);
+void session.invoke(renameReference, renameRequest);
+const binaryUploadReference = reference(K, K.functions.upload);
+void session.invoke(binaryUploadReference, { mediaType: 'image/png' }, { body: new Blob() });
+void boundSession.invoke(binaryUploadReference, { mediaType: 'image/png' }, { body: new Blob() });
+const rawBinaryCall = call(Path.parse('/:example.test:function.write'), { mediaType: 'image/png' });
+void client.dispatch(rawBinaryCall, { body: new Blob() });
+void client.as('credential').call(rawBinaryCall, { body: new Blob() });
+// @ts-expect-error Binary Functions require a byte source.
+void session.invoke(binaryUploadReference, { mediaType: 'image/png' });
+// @ts-expect-error Value Functions reject binary bodies.
+void session.invoke(registerReference, registration, { body: new Blob() });
+// @ts-expect-error Bound binary Functions require a byte source.
+void boundSession.invoke(binaryUploadReference, { mediaType: 'image/png' });
+// @ts-expect-error Bound value Functions reject binary bodies.
+void boundSession.invoke(registerReference, registration, { body: new Blob() });
+void session.invoke(binaryUploadReference, { mediaType: 'image/png' }, 
+// @ts-expect-error Binary invocations cannot carry an idempotency key.
+{ body: new Blob(), idempotencyKey: 'retry' });
+// @ts-expect-error Raw Session binary calls cannot carry an idempotency key.
+void session.dispatch(rawBinaryCall, { body: new Blob(), idempotencyKey: 'retry' });
+// @ts-expect-error Raw Client binary calls cannot carry an idempotency key.
+void client.dispatch(rawBinaryCall, { body: new Blob(), idempotencyKey: 'retry' });
+// @ts-expect-error Authenticated Client binary calls cannot carry an idempotency key.
+void client.as('credential').call(rawBinaryCall, { body: new Blob(), idempotencyKey: 'retry' });
+void session.dispatch({ target: Path.parse('/:example.test:function.write'), input: {} }, { body: new Blob() });
+void session.call({ target: Path.parse('/:example.test:function.write'), input: {} }, { body: new Blob() });
+const registerInputIsRequest = true;
+const renameInputIsInterface = true;
+const renameOutputIsBoolean = true;
+void registerInputIsRequest;
+void renameInputIsInterface;
+void renameOutputIsBoolean;
+// @ts-expect-error The exact Schema's required input fields are retained.
+void session.invoke(renameReference, {});
+// @ts-expect-error A Date is not the Schema's declared string input.
+void session.invoke(renameReference, { name: new Date() });
+// @ts-expect-error A function is not the Schema's declared string input.
+void session.invoke(renameReference, { name: () => 'Ada' });
+// @ts-expect-error RegisterRequest retains its nonempty identities tuple.
+void session.invoke(registerReference, { idempotencyKey: 'key', identities: [] });
+// @ts-expect-error An unknown-schema reference still accepts only portable Client Input.
+void session.invoke(dynamicReference, new Date());
+const abstractMethod = method({
+    auth: 'authenticated',
+    input: { type: 'null' },
+    output: { type: 'null' },
+    abstract: true,
+});
+const abstractDomain = schema.resolve(defineSchema('client.reference.typecheck', {
+    classes: {
+        AbstractItem: nodeClass({ abstract: true, methods: { abstractMethod } }),
+    },
+}));
+const reminderOutput = valueSchema()({
+    type: 'object',
+    properties: { reminder: { type: 'string' } },
+    required: ['reminder'],
+    additionalProperties: false,
+});
+const durableDomain = schema.resolve(defineSchema('client.durable.typecheck', {
+    classes: {
+        Invoice: nodeClass({
+            methods: {
+                remind: method({
+                    auth: 'authenticated',
+                    input: renameInput,
+                    output: reminderOutput,
+                    execution: { durable: true },
+                }),
+            },
+        }),
+    },
+}));
+const remindReference = reference(durableDomain, durableDomain.classes.Invoice.methods.remind)(Path.id(NodeId('invoice-1')));
+const durableReturnsExecution = true;
+const outcomeIsTyped = true;
+const statusIsTyped = true;
+void session.invoke(execution.result(run), { waitMs: 1_000 });
+void session.invoke(execution.signal(run), { name: 'approval', value: { by: 'billing' } });
+// @ts-expect-error Force is the only cancellation option.
+void session.invoke(execution.cancel(run), { waitMs: 1_000 });
+void durableReturnsExecution;
+void outcomeIsTyped;
+void statusIsTyped;
+// @ts-expect-error Abstract Methods are declarations and cannot become Client references.
+reference(abstractDomain, abstractDomain.classes.AbstractItem.methods.abstractMethod);
+// @ts-expect-error Exact identity is derived internally, never supplied as a Session option.
+void session.invoke(dynamicReference, dynamicInput, { expect: undefined });
+// @ts-expect-error Raw Client options do not select a declaration.
+const unsupportedClientOptions = { expect: undefined };
+void unsupportedClientOptions;
+// @ts-expect-error Internal metadata dispatch is absent from the public package facade.
+import { dispatchTrace } from '../index.js';
+void dispatchTrace;

package/dist/session/views/catalog.d.ts

@@ -13,4 +13,3 @@ export declare function rootViewCatalog(publication: publication.Publication, ar
 export declare function catalogFromKeys(root: ViewCatalog, keys: readonly Key.View[]): ViewCatalog;
 /** Re-admit one Runtime-resolved heterogeneous View catalog at the Client trust boundary. */
 export declare function targetViewCatalog(input: unknown, policy: Readonly<SessionPolicy>): ViewCatalog;
-//# sourceMappingURL=catalog.d.ts.map

package/dist/session/views/catalog.js

@@ -1,20 +1,23 @@
 import { acceptViewResolution, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
-import { Key as ViewKey, Ref } from '@astrale-os/kernel-dsl/v1/addressing';
+import { Key as ViewKey } from '@astrale-os/kernel-dsl/v1/addressing';
 import { ClientError } from '../../errors/index.js';
 import { allowEndpoint } from '../context/index.js';
 export function rootViewCatalog(publication, artifact, policy) {
     const views = publication.bindings.views
         .map((binding) => {
         allowEndpoint(binding.href, policy);
-        const declaration = artifact.root.views[Ref.member(ViewKey.ref(binding.view))];
+        const declaration = artifact.root.views[viewName(binding.view)];
         if (declaration === undefined) {
             throw new ClientError('Published View has no verified root declaration.');
         }
+        const { ref: _ref, ...viewDeclaration } = declaration;
         return Object.freeze({
             key: binding.view,
-            declaration,
+            declaration: Object.freeze(viewDeclaration),
             href: binding.href,
             handshake: binding.handshake,
+            ...(binding.iframe === undefined ? {} : { iframe: binding.iframe }),
+            ...(binding.host === undefined ? {} : { host: binding.host }),
             issuer: publication.identity.issuer,
             etag: publication.etag,
             revision: publication.schema.revision,
@@ -25,7 +28,7 @@ export function rootViewCatalog(publication, artifact, policy) {
     const entrypointRef = publication.manifest?.entrypoint;
     const entrypoint = entrypointRef === undefined
         ? undefined
-        : catalogViews.find(({ key }) => key === ViewKey.of(publication.origin, entrypointRef));
+        : catalogViews.find(({ key }) => key === ViewKey.of(entrypointRef));
     if (entrypointRef !== undefined && entrypoint === undefined) {
         throw new ClientError('Published View entrypoint has no verified Publication binding.');
     }
@@ -60,4 +63,10 @@ export function targetViewCatalog(input, policy) {
 function compareKeys(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
-//# sourceMappingURL=catalog.js.map
+function viewName(input) {
+    const coordinate = input.slice(input.indexOf(':') + 1);
+    const match = /^view\.([A-Za-z][A-Za-z0-9_]*)$/u.exec(coordinate);
+    if (match === null)
+        throw new ClientError('Published View key is invalid.');
+    return match[1];
+}

package/dist/session/views/index.d.ts

@@ -1,3 +1,2 @@
 export { catalogFromKeys, rootViewCatalog, targetViewCatalog, type ResolvedView, type ViewCatalog, } from './catalog.js';
 export { resolveViewsFor, type ViewCatalogAdmission, type ViewInvoker } from './resolve.js';
-//# sourceMappingURL=index.d.ts.map