@astrale-os/kernel-client 0.6.0-beta.8 → 0.6.0-beta.80

package/dist/pacer/batcher/index.js

@@ -1,2 +1 @@
 export { createBatcher } from './batcher.js';
-//# sourceMappingURL=index.js.map

package/dist/pacer/index.d.ts

@@ -2,4 +2,3 @@ export { retry, type RetryOptions } from './retry/index.js';
 export { createQueue, type QueueOptions } from './queue/index.js';
 export { createBatcher, type BatchOptions } from './batcher/index.js';
 export { createRateLimiter, type RateLimitOptions } from './limiter/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/pacer/index.js

@@ -2,4 +2,3 @@ export { retry } from './retry/index.js';
 export { createQueue } from './queue/index.js';
 export { createBatcher } from './batcher/index.js';
 export { createRateLimiter } from './limiter/index.js';
-//# sourceMappingURL=index.js.map

package/dist/pacer/limiter/defaults.d.ts

@@ -1,3 +1,2 @@
 export declare const DEFAULT_RATE_LIMIT = 10;
 export declare const DEFAULT_RATE_WINDOW_MS = 1000;
-//# sourceMappingURL=defaults.d.ts.map

package/dist/pacer/limiter/defaults.js

@@ -1,3 +1,2 @@
 export const DEFAULT_RATE_LIMIT = 10;
 export const DEFAULT_RATE_WINDOW_MS = 1_000;
-//# sourceMappingURL=defaults.js.map

package/dist/pacer/limiter/index.d.ts

@@ -1,2 +1 @@
 export { createRateLimiter, type RateLimitOptions } from './limiter.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/pacer/limiter/index.js

@@ -1,2 +1 @@
 export { createRateLimiter } from './limiter.js';
-//# sourceMappingURL=index.js.map

package/dist/pacer/limiter/limiter.d.ts

@@ -5,4 +5,3 @@ export type RateLimitOptions<Operation extends AnyAsyncFunction> = Omit<AsyncRat
     readonly window?: number;
 };
 export declare function createRateLimiter<Operation extends AnyAsyncFunction>(operation: Operation, options?: RateLimitOptions<Operation>): AsyncRateLimiter<Operation>;
-//# sourceMappingURL=limiter.d.ts.map

package/dist/pacer/limiter/limiter.js

@@ -12,4 +12,3 @@ export function createRateLimiter(operation, options = {}) {
         window: options.window ?? DEFAULT_RATE_WINDOW_MS,
     });
 }
-//# sourceMappingURL=limiter.js.map

package/dist/pacer/queue/defaults.d.ts

@@ -1,2 +1 @@
 export declare const DEFAULT_QUEUE_CONCURRENCY = 4;
-//# sourceMappingURL=defaults.d.ts.map

package/dist/pacer/queue/defaults.js

@@ -1,2 +1 @@
 export const DEFAULT_QUEUE_CONCURRENCY = 4;
-//# sourceMappingURL=defaults.js.map

package/dist/pacer/queue/index.d.ts

@@ -1,2 +1 @@
 export { createQueue, type QueueOptions } from './queue.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/pacer/queue/index.js

@@ -1,2 +1 @@
 export { createQueue } from './queue.js';
-//# sourceMappingURL=index.js.map

package/dist/pacer/queue/queue.d.ts

@@ -4,4 +4,3 @@ export type QueueOptions<Value> = Omit<AsyncQueuerOptions<Value>, 'concurrency'>
     readonly concurrency?: number;
 };
 export declare function createQueue<Value>(consume: (value: Value) => Promise<unknown>, options?: QueueOptions<Value>): AsyncQueuer<Value>;
-//# sourceMappingURL=queue.d.ts.map

package/dist/pacer/queue/queue.js

@@ -10,4 +10,3 @@ export function createQueue(consume, options = {}) {
         concurrency: options.concurrency ?? DEFAULT_QUEUE_CONCURRENCY,
     });
 }
-//# sourceMappingURL=queue.js.map

package/dist/pacer/retry/defaults.d.ts

@@ -4,4 +4,3 @@ export declare const DEFAULT_RETRY_MAX_WAIT_MS = 5000;
 export declare const DEFAULT_RETRY_JITTER = 0.2;
 export declare function positive(input: number, label: string): number;
 export declare function nonNegative(input: number, label: string): number;
-//# sourceMappingURL=defaults.d.ts.map

package/dist/pacer/retry/defaults.js

@@ -14,4 +14,3 @@ export function nonNegative(input, label) {
     }
     return input;
 }
-//# sourceMappingURL=defaults.js.map

package/dist/pacer/retry/index.d.ts

@@ -1,2 +1 @@
 export { retry, type RetryOptions } from './retry.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/pacer/retry/index.js

@@ -1,2 +1 @@
 export { retry } from './retry.js';
-//# sourceMappingURL=index.js.map

package/dist/pacer/retry/retry.d.ts

@@ -7,4 +7,3 @@ export interface RetryOptions {
 }
 /** Retry with bounded exponential backoff and never swallow the final failure. */
 export declare function retry<Result>(operation: () => Promise<Result>, options?: RetryOptions): Promise<Result>;
-//# sourceMappingURL=retry.d.ts.map

package/dist/pacer/retry/retry.js

@@ -53,4 +53,3 @@ export async function retry(operation, options = {}) {
     }
     return result;
 }
-//# sourceMappingURL=retry.js.map

package/dist/pool/index.d.ts

@@ -1,3 +1,2 @@
 export { ClientPool, type ClientFactory, type ClientPoolOptions } from './pool.js';
 export type { ClientTarget } from './target.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/pool/index.js

@@ -1,2 +1 @@
 export { ClientPool } from './pool.js';
-//# sourceMappingURL=index.js.map

package/dist/pool/pool.d.ts

@@ -21,4 +21,3 @@ export declare class ClientPool {
     private evictOldest;
     private requireOpen;
 }
-//# sourceMappingURL=pool.d.ts.map

package/dist/pool/pool.js

@@ -67,4 +67,3 @@ export class ClientPool {
             throw new ClientError('ClientPool is closed.');
     }
 }
-//# sourceMappingURL=pool.js.map

package/dist/pool/target.d.ts

@@ -13,4 +13,3 @@ export type ClientTarget = {
 };
 export declare function admitTarget(input: ClientTarget): ClientTarget;
 export declare function targetKey(target: ClientTarget): string;
-//# sourceMappingURL=target.d.ts.map

package/dist/pool/target.js

@@ -47,4 +47,3 @@ function endpoint(input, protocols) {
     }
     return url.toString();
 }
-//# sourceMappingURL=target.js.map

package/dist/schema/admission.d.ts

@@ -8,6 +8,5 @@ interface OutputContract {
     };
 }
 /** Admit one value result through its Core-owned syscall contract. */
-export declare function acceptOutput<T extends Value>(contract: OutputContract, input: unknown): T;
+export declare function acceptOutput<T>(contract: OutputContract, input: unknown): T;
 export {};
-//# sourceMappingURL=admission.d.ts.map

package/dist/schema/admission.js

@@ -15,4 +15,3 @@ function freeze(input) {
     }
     return input;
 }
-//# sourceMappingURL=admission.js.map

package/dist/schema/contracts.d.ts

@@ -1,22 +1,12 @@
-import type { InputOf, OutputOf } from '@astrale-os/kernel-core/domain';
-import type { syscalls } from '@astrale-os/kernel-core/schema';
 import type { installation } from '@astrale-os/kernel-core/schema';
+import type { DomainRequest as CoreDomainRequest, InstallInput, InstallReceipt as CoreInstallReceipt, UninstallInput, UninstallOutput } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
 export type OperationId = installation.OperationId;
 /** Canonical caller input accepted by the Kernel install syscall. */
-export type InstallRequest = Omit<InputOf<(typeof syscalls.install)['callable']>, 'operation'> & {
-    readonly operation: OperationId;
-};
+export type DomainRequest = CoreDomainRequest;
+export type InstallRequest = InstallInput;
 /** Admitted terminal install receipt returned by the Kernel. */
-export type InstallReceipt = Omit<OutputOf<(typeof syscalls.install)['callable']>, 'operation'> & {
-    readonly operation: OperationId;
-};
+export type InstallReceipt = CoreInstallReceipt;
 /** Canonical caller input accepted by the Kernel uninstall syscall. */
-export type UninstallRequest = Omit<InputOf<(typeof syscalls.uninstall)['callable']>, 'operation'> & {
-    readonly operation: OperationId;
-};
+export type UninstallRequest = UninstallInput;
 /** Admitted terminal uninstall receipt returned by the Kernel. */
-export type UninstallReceipt = Omit<OutputOf<(typeof syscalls.uninstall)['callable']>, 'operation'> & {
-    readonly operation: OperationId;
-};
-export type DesiredInstallation = InstallRequest['domains'][number];
-//# sourceMappingURL=contracts.d.ts.map
+export type UninstallReceipt = UninstallOutput;

package/dist/schema/contracts.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=contracts.js.map

package/dist/schema/index.d.ts

@@ -1,4 +1,3 @@
-export { createSchema, type SchemaApi, type SchemaCall, type SchemaOptions, type ReadyInstallation, } from './schema.js';
+export { createSchema, DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS, type SchemaApi, type SchemaCall, type SchemaOptions, type DomainBundle, type DomainDependencies, type DomainInfo, type InstallResult, } from './schema.js';
 export { acceptOperationId, createOperationId } from './operation.js';
-export type { DesiredInstallation, InstallReceipt, InstallRequest, OperationId, UninstallReceipt, UninstallRequest, } from './contracts.js';
-//# sourceMappingURL=index.d.ts.map
+export type { DomainRequest, InstallReceipt, InstallRequest, OperationId, UninstallReceipt, UninstallRequest, } from './contracts.js';

package/dist/schema/index.js

@@ -1,3 +1,2 @@
-export { createSchema, } from './schema.js';
+export { createSchema, DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS, } from './schema.js';
 export { acceptOperationId, createOperationId } from './operation.js';
-//# sourceMappingURL=index.js.map

package/dist/schema/introspection.d.ts

@@ -1,6 +1,5 @@
 import type { introspection as language } from '@astrale-os/kernel-core/schema';
-import type { schema as protocol } from '@astrale-os/kernel-protocol';
+import type * as protocol from '@astrale-os/kernel-protocol/schema';
 import type { RequestOptions } from '../transport/index.js';
 import type { SchemaCall, SchemaOptions } from './schema.js';
 export declare function introspect<InputType extends language.Introspection>(invoke: SchemaCall, limits: SchemaOptions, request: InputType, options?: RequestOptions): Promise<protocol.installation.introspection.ResultFor<InputType>>;
-//# sourceMappingURL=introspection.d.ts.map

package/dist/schema/introspection.js

@@ -1,9 +1,13 @@
 import { Path } from '@astrale-os/kernel-core/path';
 import { introspect as introspectRef } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
-import { schema } from '@astrale-os/kernel-protocol';
+import { loadMsgpack } from '@astrale-os/kernel-protocol/codecs';
+import * as schema from '@astrale-os/kernel-protocol/schema';
 import { call } from '../client/index.js';
 const INTROSPECT_PATH = Path.project(introspectRef).raw;
 export async function introspect(invoke, limits, request, options) {
+    // The evidence is MessagePack behind a lazy import: fetch it with the request, not after it.
+    // A failed preload is surfaced by decode, which imports the same modules again.
+    void loadMsgpack().catch(() => undefined);
     const result = await invoke(call(INTROSPECT_PATH, request), options);
     if (result.kind !== 'binary') {
         throw new TypeError('Schema introspection returned a non-binary result.');
@@ -11,6 +15,9 @@ export async function introspect(invoke, limits, request, options) {
     if (result.value.mediaType !== schema.installation.introspection.MEDIA_TYPE) {
         throw new TypeError('Schema introspection returned an unsupported media type.');
     }
+    if (!(result.value.body instanceof Uint8Array)) {
+        await result.value.body[Symbol.asyncIterator]().return?.();
+        throw new TypeError('Schema introspection returned a streaming binary result.');
+    }
     return schema.installation.introspection.decode(request, result.value.body, limits);
 }
-//# sourceMappingURL=introspection.js.map

package/dist/schema/operation.d.ts

@@ -3,4 +3,3 @@ import type { OperationId } from './contracts.js';
 export declare function acceptOperationId(input: unknown): OperationId;
 /** Allocate one cryptographically generated operation identity for a new lifecycle request. */
 export declare function createOperationId(): OperationId;
-//# sourceMappingURL=operation.d.ts.map

package/dist/schema/operation.js

@@ -1,10 +1,9 @@
-import { installation } from '@astrale-os/kernel-core/schema';
+import * as installation from '@astrale-os/kernel-core/schema/installation';
 /** Accept one canonical lowercase RFC 9562 UUIDv4 operation identity. */
 export function acceptOperationId(input) {
     return installation.acceptOperationId(input);
 }
 /** Allocate one cryptographically generated operation identity for a new lifecycle request. */
 export function createOperationId() {
-    return acceptOperationId(globalThis.crypto.randomUUID());
+    return acceptOperationId(crypto.randomUUID());
 }
-//# sourceMappingURL=operation.js.map

package/dist/schema/schema.d.ts

@@ -1,20 +1,23 @@
-import type { introspection } from '@astrale-os/kernel-core/schema';
-import type { schema as protocolSchema } from '@astrale-os/kernel-protocol';
+import type { Key } from '@astrale-os/kernel-dsl/v1';
+import * as protocolSchema from '@astrale-os/kernel-protocol/schema';
 import type { Call, Result } from '../client/index.js';
 import type { RequestOptions } from '../transport/index.js';
-import type { InstallReceipt, InstallRequest, UninstallReceipt, UninstallRequest } from './contracts.js';
+import type { InstallRequest, UninstallReceipt, UninstallRequest } from './contracts.js';
 export type SchemaCall = (call: Call, options?: RequestOptions) => Promise<Result>;
 export interface SchemaOptions extends protocolSchema.installation.introspection.Limits {
+    readonly lifecycleTimeoutMs?: number;
 }
-export type ReadyInstallation = protocolSchema.installation.introspection.Installation & {
-    readonly state: 'ready';
-    readonly readiness: protocolSchema.installation.introspection.Digest;
-};
+export type DomainInfo = protocolSchema.installation.introspection.DomainInfo;
+export type DomainBundle = protocolSchema.installation.introspection.DomainBundle;
+export type DomainDependencies = protocolSchema.installation.introspection.DomainDependencies;
+export type InstallResult = protocolSchema.installation.InstallResult;
 export interface SchemaApi {
-    install(request: InstallRequest, options?: RequestOptions): Promise<InstallReceipt>;
+    install(request: InstallRequest, options?: RequestOptions): Promise<InstallResult>;
     uninstall(request: UninstallRequest, options?: RequestOptions): Promise<UninstallReceipt>;
-    introspect<Input extends introspection.Introspection>(request: Input, options?: RequestOptions): Promise<protocolSchema.installation.introspection.ResultFor<Input>>;
+    inspect(origin: Key.Origin, options?: RequestOptions): Promise<DomainInfo>;
+    bundle(origin: Key.Origin, options?: RequestOptions): Promise<DomainBundle>;
+    dependencies(origin: Key.Origin, options?: RequestOptions): Promise<DomainDependencies>;
 }
+export declare const DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS = 110000;
 /** Bind the canonical Schema lifecycle syscalls to one caller-scoped value-call capability. */
 export declare function createSchema(call: SchemaCall, limits: SchemaOptions): SchemaApi;
-//# sourceMappingURL=schema.d.ts.map

package/dist/schema/schema.js

@@ -1,11 +1,13 @@
 import { Path } from '@astrale-os/kernel-core/path';
-import { installOutput, uninstallOutput, } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
+import { uninstallOutput } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
 import { install, uninstall } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import * as protocolSchema from '@astrale-os/kernel-protocol/schema';
 import { call as invocation } from '../client/index.js';
 import { acceptOutput } from './admission.js';
-import { introspect as inspect } from './introspection.js';
+import { introspect } from './introspection.js';
 const INSTALL_PATH = Path.project(install).raw;
 const UNINSTALL_PATH = Path.project(uninstall).raw;
+export const DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS = 110_000;
 /** Bind the canonical Schema lifecycle syscalls to one caller-scoped value-call capability. */
 export function createSchema(call, limits) {
     if (typeof call !== 'function')
@@ -13,32 +15,102 @@ export function createSchema(call, limits) {
     const admittedLimits = admitLimits(limits);
     return Object.freeze({
         async install(request, options) {
-            const output = value(await call(invocation(INSTALL_PATH, request), options));
-            return acceptOutput(installOutput, output);
+            const result = await call(invocation(INSTALL_PATH, request), lifecycleOptions(options, admittedLimits.lifecycleTimeoutMs));
+            if (result.kind !== 'binary') {
+                throw new TypeError('Schema install returned a non-binary result.');
+            }
+            if (result.value.mediaType !== protocolSchema.installation.MEDIA_TYPE) {
+                throw new TypeError('Schema install returned an unsupported media type.');
+            }
+            if (!(result.value.body instanceof Uint8Array)) {
+                await result.value.body[Symbol.asyncIterator]().return?.();
+                throw new TypeError('Schema install returned a streaming binary result.');
+            }
+            const decoded = await protocolSchema.installation.decode(result.value.body, installationResultLimit(admittedLimits.maximumPublicationBytes, request.domains.length));
+            proveInstallResult(request, decoded);
+            return decoded;
         },
         async uninstall(request, options) {
-            const output = value(await call(invocation(UNINSTALL_PATH, request), options));
-            return acceptOutput(uninstallOutput, output);
+            const snapshot = snapshotUninstallRequest(request);
+            const output = value(await call(invocation(UNINSTALL_PATH, snapshot), lifecycleOptions(options, admittedLimits.lifecycleTimeoutMs)));
+            const receipt = acceptOutput(uninstallOutput, output);
+            proveUninstallReceipt(snapshot, receipt);
+            return receipt;
         },
-        async introspect(request, options) {
-            return inspect(call, admittedLimits, request, options);
+        async inspect(origin, options) {
+            return introspect(call, admittedLimits, { kind: 'inspect', origin }, options);
         },
+        async bundle(origin, options) {
+            return introspect(call, admittedLimits, { kind: 'bundle', origin }, options);
+        },
+        async dependencies(origin, options) {
+            return introspect(call, admittedLimits, { kind: 'dependencies', origin }, options);
+        },
+    });
+}
+function snapshotUninstallRequest(request) {
+    return Object.freeze({
+        operation: request.operation,
+        domains: Object.freeze([...new Set(request.domains)].sort(compare)),
+        data: Object.freeze({ mode: request.data.mode }),
     });
 }
+function proveUninstallReceipt(request, receipt) {
+    if (receipt.operation !== request.operation) {
+        throw new TypeError('Schema uninstall result does not match the requested operation.');
+    }
+    const actual = receipt.transitions.map((transition) => transition.intent.origin);
+    if (actual.length !== request.domains.length ||
+        actual.some((origin, index) => origin !== request.domains[index])) {
+        throw new TypeError('Schema uninstall result does not match the requested Domains.');
+    }
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function installationResultLimit(maximumDomainBytes, roots) {
+    const perDomain = maximumDomainBytes + 4_096;
+    if (roots > Math.floor((Number.MAX_SAFE_INTEGER - 4_096) / perDomain)) {
+        return Number.MAX_SAFE_INTEGER;
+    }
+    return perDomain * roots + 4_096;
+}
+function proveInstallResult(request, result) {
+    if (result.changed) {
+        if (result.receipt.operation !== request.operation) {
+            throw new TypeError('Schema install result does not match the requested operation.');
+        }
+        if (result.receipt.transitions.length > request.domains.length) {
+            throw new TypeError('Schema install result contains more transitions than requested Domains.');
+        }
+        return;
+    }
+    if (result.domains.length !== request.domains.length) {
+        throw new TypeError('Schema unchanged result does not match the requested Domain count.');
+    }
+}
 function value(result) {
     if (result.kind !== 'value')
         throw new TypeError('Schema syscall returned a non-value result.');
     return result.value;
 }
 function admitLimits(input) {
+    const lifecycleTimeoutMs = input?.lifecycleTimeoutMs ?? DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS;
     if (input === null ||
         typeof input !== 'object' ||
         !Number.isSafeInteger(input.maximumPublicationBytes) ||
         input.maximumPublicationBytes < 1 ||
         !Number.isSafeInteger(input.maximumBundleBytes) ||
-        input.maximumBundleBytes < 1) {
+        input.maximumBundleBytes < 1 ||
+        !Number.isSafeInteger(lifecycleTimeoutMs) ||
+        lifecycleTimeoutMs < 1 ||
+        lifecycleTimeoutMs > 2_147_483_647) {
         throw new TypeError('Schema introspection limits are invalid.');
     }
-    return Object.freeze({ ...input });
+    return Object.freeze({ ...input, lifecycleTimeoutMs });
+}
+function lifecycleOptions(options, timeoutMs) {
+    if (options?.timeoutMs !== undefined)
+        return options;
+    return Object.freeze({ ...options, timeoutMs });
 }
-//# sourceMappingURL=schema.js.map

package/dist/session/admission.d.ts

@@ -0,0 +1,6 @@
+import type { invocation } from '@astrale-os/kernel-protocol';
+import type { AdmissionOptions, FunctionAdmission } from '../auth/index.js';
+import type { SessionOperation } from './context/index.js';
+import type { ExchangeDependencies } from './exchange/index.js';
+/** Check a remote Call through the existing Domain exchange and Kernel admission protocols. */
+export declare function admitFunction(dependencies: ExchangeDependencies, call: invocation.Call, options: AdmissionOptions | undefined, operation: SessionOperation): Promise<FunctionAdmission>;

package/dist/session/admission.js

@@ -0,0 +1,59 @@
+import { grant } from '@astrale-os/kernel-core/auth';
+import { targetPath } from '@astrale-os/kernel-core/callable';
+import { Path } from '@astrale-os/kernel-core/path';
+import { admitOutput } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
+import { function as functions } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { ClientError } from '../errors/index.js';
+import { runSessionOperation, sessionTransportOptions } from './context/index.js';
+import { callableOrigin, exchangeDomainCredential, installedIssuer, isAuthority, SELF_ATTENUATION, } from './exchange/index.js';
+import { matchesCallable } from './reference.js';
+import { requireResultKind, resolveAuth } from './routing/index.js';
+const ADMIT = Path.staticMethod(Path.project(functions.admit.owner), functions.admit.name);
+/** Check a remote Call through the existing Domain exchange and Kernel admission protocols. */
+export async function admitFunction(dependencies, call, options, operation) {
+    const target = Path.parse(targetPath(call.target));
+    const origin = callableOrigin(target);
+    if (origin === undefined) {
+        throw new ClientError('Function admission requires a Domain-qualified callable target.');
+    }
+    const attenuation = options?.attenuation === undefined
+        ? undefined
+        : grant.acceptUnresolved({ v: 1, expr: options.attenuation }).expr;
+    const effective = await resolveAuth(dependencies.auth, call, operation);
+    if (!isAuthority(effective)) {
+        throw new ClientError('Function admission requires an authenticated session.');
+    }
+    // Resolve once for the intended Call, then retain that exact caller across every helper syscall.
+    const domain = await installedIssuer(dependencies, origin, effective, operation);
+    if (domain === undefined) {
+        throw new ClientError('Function admission through token exchange requires a remote Domain.');
+    }
+    const exchanged = await exchangeDomainCredential(dependencies, effective, {
+        issuer: domain,
+        ttlSeconds: effective.delegate.ttlSeconds,
+        attenuation: attenuation ?? effective.delegate.attenuation ?? SELF_ATTENUATION,
+    }, operation);
+    const result = await runSessionOperation(operation, () => dependencies
+        .source()
+        .as(exchanged.credential)
+        .dispatch({ target: ADMIT, input: { call, credential: exchanged.delegation } }, { ...sessionTransportOptions(operation), delegate: effective.delegate }));
+    const output = admitOutput.parse(requireResultKind('value', result).value);
+    const callable = Key(output.callable);
+    if (!matchesCallable(target, callable)) {
+        throw new ClientError('Function admission returned a different callable.');
+    }
+    const receiver = output.receiver === undefined ? undefined : Path.parse(output.receiver);
+    const method = target.ast.steps.at(-1);
+    const instance = method?.kind === 'method' && method.dispatch === 'instance';
+    if (instance !== (receiver !== undefined) ||
+        (receiver !== undefined &&
+            (receiver.ast.anchor.kind !== 'id' ||
+                receiver.ast.steps.length !== 0 ||
+                (target.ast.anchor.kind === 'id' &&
+                    target.ast.steps.length === 1 &&
+                    receiver.ast.anchor.id !== target.ast.anchor.id)))) {
+        throw new ClientError('Function admission returned a different receiver.');
+    }
+    return Object.freeze({ callable, ...(receiver === undefined ? {} : { receiver: receiver.raw }) });
+}

package/dist/session/bound.d.ts

@@ -0,0 +1,48 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth';
+import type { AuthApi } from '../auth/index.js';
+import type { SchemaApi } from '../schema/index.js';
+import type { ContentApi } from './content.js';
+import type { SessionControlOptions } from './context/index.js';
+import type { SessionRequestOptions } from './routing/index.js';
+import type { ClientSession } from './session.js';
+import type { ViewCatalog } from './views/index.js';
+import { type Binary, type Call, type Stream } from '../client/index.js';
+import { type GraphApi } from '../graph/index.js';
+/** Exact live Session surface captured by one credential-bound Kernel view. */
+export interface BoundSessionSource {
+    readonly kernel: IssuerId;
+    readonly schema: SchemaApi;
+    readonly auth: Pick<AuthApi, 'admit'>;
+    readonly content?: ContentApi;
+    dispatch: ClientSession['dispatch'];
+    call: ClientSession['call'];
+    invoke: ClientSession['invoke'];
+    stream(call: Call, options?: SessionRequestOptions): Promise<Stream>;
+    binary(call: Call, options?: SessionRequestOptions): Promise<Binary>;
+    viewsFor(target: Parameters<ClientSession['viewsFor']>[0], options?: SessionControlOptions): Promise<ViewCatalog>;
+}
+export interface BoundSessionControls {
+    readonly signal: AbortSignal;
+    /** Absolute Unix time in milliseconds. */
+    readonly deadline: number;
+}
+/**
+ * Credential-bound Kernel operations over one caller-owned ClientSession.
+ *
+ * The view owns no credential, transport, route cache, or lifecycle. Its source Session owns all of
+ * those concerns and closing that Session invalidates every operation exposed here.
+ */
+export interface BoundClientSession extends GraphApi {
+    readonly kernel: IssuerId;
+    readonly auth: AuthApi;
+    readonly schema: SchemaApi;
+    readonly content: ContentApi;
+    dispatch: ClientSession['dispatch'];
+    call: ClientSession['call'];
+    invoke: ClientSession['invoke'];
+    stream(call: Call, options?: SessionRequestOptions): Promise<Stream>;
+    binary(call: Call, options?: SessionRequestOptions): Promise<Binary>;
+    viewsFor: BoundSessionSource['viewsFor'];
+}
+/** Capture one Session into the ordinary graph, auth, and invocation Kernel journey. */
+export declare function bindSession(source: BoundSessionSource, controls?: BoundSessionControls): BoundClientSession;