@astrale-os/kernel-client 0.6.0-beta.81 → 0.6.0-beta.83

package/dist/client/admission.js

@@ -25,17 +25,9 @@ function admitPath(input) {
 }
 function admitInput(input) {
     try {
-        return freezeValue(portable.accept(input));
+        return portable.acceptImmutable(input);
     }
     catch (cause) {
         throw new TypeError('Client input must be a portable Value.', { cause });
     }
 }
-function freezeValue(input) {
-    if (input !== null && typeof input === 'object' && !Object.isFrozen(input)) {
-        for (const value of Object.values(input))
-            freezeValue(value);
-        Object.freeze(input);
-    }
-    return input;
-}

package/dist/client/client.js

@@ -3,7 +3,7 @@ import { HttpTransport } from '../transport/http/index.js';
 import { authenticated, resolveCredential } from './credential.js';
 import { admitRequest, invocation } from './request.js';
 import { requireBinary, requireStream, requireValue } from './result.js';
-import { admittedMissError, admittedStaleRouteError } from './routing-control.js';
+import { admittedDeploymentRetiredError, admittedMissError, admittedStaleRouteError, } from './routing-control.js';
 const controlledDispatch = new WeakMap();
 /** Package-private redirect continuation path; intentionally absent from the public Client facade. */
 export function dispatchTrace(client, credential, call, options, trace) {
@@ -73,6 +73,8 @@ export class Client {
             throw admittedStaleRouteError(result.current, result.invocation);
         if (result.kind === 'miss')
             throw admittedMissError(result.invocation);
+        if (result.kind === 'deployment-retired')
+            throw admittedDeploymentRetiredError(result);
         return result;
     }
 }

package/dist/client/index.d.ts

@@ -3,4 +3,4 @@ export { acceptCall } from './admission.js';
 export type { AuthenticatedClient, RemoteCredential } from './credential.js';
 export { call, type Call, type ClientDispatchOptions, type ClientDispatchOptionsWithBody, } from './request.js';
 export type { Binary, BinaryResponse, Input, RedirectResult, Result, Stream, StreamResult, ValueResult, } from './result.js';
-export { isAdmittedMissError, isAdmittedStaleRouteError } from './routing-control.js';
+export { isAdmittedDeploymentRetiredError, isAdmittedMissError, isAdmittedStaleRouteError, } from './routing-control.js';

package/dist/client/index.js

@@ -1,4 +1,4 @@
 export { Client, dispatchTrace } from './client.js';
 export { acceptCall } from './admission.js';
 export { call, } from './request.js';
-export { isAdmittedMissError, isAdmittedStaleRouteError } from './routing-control.js';
+export { isAdmittedDeploymentRetiredError, isAdmittedMissError, isAdmittedStaleRouteError, } from './routing-control.js';

package/dist/client/routing-control.d.ts

@@ -1,10 +1,18 @@
-import type { invocation as protocol, publication } from '@astrale-os/kernel-protocol';
-import { MissError, StaleRouteError } from '../errors/index.js';
+import type { invocation as protocol, release } from '@astrale-os/kernel-protocol';
+import type { DeploymentRetired } from '../transport/index.js';
+import { MissError, ResponseError, StaleRouteError } from '../errors/index.js';
 /** Create a private routing witness only after exact reserved-control decoding. */
 export declare function admittedMissError(invocation: protocol.InvocationId): MissError;
 /** Create a private routing witness only after exact reserved-control decoding. */
-export declare function admittedStaleRouteError(currentEtag: publication.Etag, invocation: protocol.InvocationId): StaleRouteError;
+export declare function admittedStaleRouteError(current: release.Sha256Digest, invocation: protocol.InvocationId): StaleRouteError;
+/**
+ * Raise one decoded retirement control as the typed error every Client reports for it,
+ * `ResponseError(3002, DEPLOYMENT_RETIRED)`, privately witnessed for Session recovery.
+ */
+export declare function admittedDeploymentRetiredError(control: DeploymentRetired): ResponseError;
 /** Distinguish decoded routing control from public or caller-supplied lookalike errors. */
 export declare function isAdmittedMissError(input: unknown): input is MissError;
 /** Distinguish decoded routing control from public or caller-supplied lookalike errors. */
 export declare function isAdmittedStaleRouteError(input: unknown): input is StaleRouteError;
+/** Distinguish a decoded retirement control from a lookalike `DEPLOYMENT_RETIRED` response. */
+export declare function isAdmittedDeploymentRetiredError(input: unknown): input is ResponseError;

package/dist/client/routing-control.js

@@ -1,6 +1,8 @@
-import { MissError, StaleRouteError } from '../errors/index.js';
+import { CODES } from '@astrale-os/kernel-protocol/errors';
+import { MissError, ResponseError, StaleRouteError } from '../errors/index.js';
 const admittedMisses = new WeakSet();
 const admittedStaleRoutes = new WeakSet();
+const admittedRetirements = new WeakSet();
 /** Create a private routing witness only after exact reserved-control decoding. */
 export function admittedMissError(invocation) {
     const error = new MissError(invocation);
@@ -8,11 +10,20 @@ export function admittedMissError(invocation) {
     return error;
 }
 /** Create a private routing witness only after exact reserved-control decoding. */
-export function admittedStaleRouteError(currentEtag, invocation) {
-    const error = new StaleRouteError(currentEtag, invocation);
+export function admittedStaleRouteError(current, invocation) {
+    const error = new StaleRouteError(current, invocation);
     admittedStaleRoutes.add(error);
     return error;
 }
+/**
+ * Raise one decoded retirement control as the typed error every Client reports for it,
+ * `ResponseError(3002, DEPLOYMENT_RETIRED)`, privately witnessed for Session recovery.
+ */
+export function admittedDeploymentRetiredError(control) {
+    const error = new ResponseError(CODES.NOT_FOUND, control.message, control.invocation, control.reason);
+    admittedRetirements.add(error);
+    return error;
+}
 /** Distinguish decoded routing control from public or caller-supplied lookalike errors. */
 export function isAdmittedMissError(input) {
     return input instanceof MissError && admittedMisses.has(input);
@@ -21,3 +32,7 @@ export function isAdmittedMissError(input) {
 export function isAdmittedStaleRouteError(input) {
     return input instanceof StaleRouteError && admittedStaleRoutes.has(input);
 }
+/** Distinguish a decoded retirement control from a lookalike `DEPLOYMENT_RETIRED` response. */
+export function isAdmittedDeploymentRetiredError(input) {
+    return input instanceof ResponseError && admittedRetirements.has(input);
+}

package/dist/errors/stale-route-error.d.ts

@@ -1,9 +1,20 @@
-import type { invocation as protocol, publication } from '@astrale-os/kernel-protocol';
+import type { invocation as protocol, publication, release } from '@astrale-os/kernel-protocol';
 import { ClientError } from './client-error.js';
 /** Client-visible stale-route error shape; public instances are not routing-control witnesses. */
 export declare class StaleRouteError extends ClientError {
-    readonly currentEtag: publication.Etag;
     readonly invocation: protocol.InvocationId;
     readonly name = "StaleRouteError";
-    constructor(currentEtag: publication.Etag, invocation: protocol.InvocationId);
+    /**
+     * Digest the destination reports it currently serves, an untrusted hint the Session never
+     * installs. Until the breaking release (AM-1) it is a v3 ETag: the served Publication's, or the
+     * frozen v3 projection's on a v4 deployment.
+     */
+    readonly current: release.Sha256Digest;
+    /**
+     * The same digest as `current` under its Publication name.
+     *
+     * @deprecated Successor: `current`, emitted by the breaking release (AM-1) as the release digest.
+     */
+    readonly currentEtag: publication.Etag;
+    constructor(current: release.Sha256Digest, invocation: protocol.InvocationId);
 }

package/dist/errors/stale-route-error.js

@@ -1,12 +1,24 @@
 import { ClientError } from './client-error.js';
 /** Client-visible stale-route error shape; public instances are not routing-control witnesses. */
 export class StaleRouteError extends ClientError {
-    currentEtag;
     invocation;
     name = 'StaleRouteError';
-    constructor(currentEtag, invocation) {
+    /**
+     * Digest the destination reports it currently serves, an untrusted hint the Session never
+     * installs. Until the breaking release (AM-1) it is a v3 ETag: the served Publication's, or the
+     * frozen v3 projection's on a v4 deployment.
+     */
+    current;
+    /**
+     * The same digest as `current` under its Publication name.
+     *
+     * @deprecated Successor: `current`, emitted by the breaking release (AM-1) as the release digest.
+     */
+    currentEtag;
+    constructor(current, invocation) {
         super('The destination Publication route is stale.');
-        this.currentEtag = currentEtag;
         this.invocation = invocation;
+        this.current = current;
+        this.currentEtag = current;
     }
 }

package/dist/errors/transport-error.d.ts

@@ -4,9 +4,10 @@ import { ClientError } from './client-error.js';
 export type TransportDelivery = 'not-sent' | 'unknown';
 /** Observable transport phase in which communication stopped. */
 export type TransportPhase = 'connect' | 'send' | 'receive' | 'timeout' | 'closed' | 'unknown';
+export type AcquisitionResource = 'release' | 'publication' | 'bundle';
 export type TransportContext = {
     readonly kind: 'acquisition';
-    readonly resource: 'publication' | 'bundle';
+    readonly resource: AcquisitionResource;
 } | {
     readonly kind: 'invocation';
     readonly delivery: TransportDelivery;
@@ -14,7 +15,7 @@ export type TransportContext = {
 };
 export interface AcquisitionTransportErrorOptions extends ErrorOptions {
     readonly phase: TransportPhase;
-    readonly resource: 'publication' | 'bundle';
+    readonly resource: AcquisitionResource;
 }
 export interface InvocationTransportErrorOptions extends ErrorOptions {
     readonly phase: TransportPhase;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { Target, targetPath } from '@astrale-os/kernel-core/callable';
 export { Client, call, type AuthenticatedClient, type Call, type ClientDispatchOptions, type ClientDispatchOptionsWithBody, type ClientOptions, type Binary, type BinaryResponse, type Input, type RemoteCredential, type Result, type Stream, type StreamResult, type ValueResult, } from './client/index.js';
 export * from './errors/index.js';
-export { type RequestOptions, type MissControl, type StaleControl, type Transport, type TransportRequest, type TransportResult, } from './transport/index.js';
+export { type RequestOptions, type DeploymentRetired, type MissControl, type StaleControl, type Transport, type TransportRequest, type TransportResult, } from './transport/index.js';
 export { HttpTransport, type Fetch, type HttpTransportOptions } from './transport/http/index.js';
 export { WebSocketTransport, type WebSocketConstructor, type WebSocketTransportOptions, } from './transport/websocket/index.js';
 export { AutoTransport, formatClientWarning, type AutoTransportOptions, type ClientWarning, } from './transport/auto/index.js';

package/dist/schema/introspection.js

@@ -1,23 +1,27 @@
 import { Path } from '@astrale-os/kernel-core/path';
 import { introspect as introspectRef } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
-import { loadMsgpack } from '@astrale-os/kernel-protocol/codecs';
 import * as schema from '@astrale-os/kernel-protocol/schema';
+import * as legacy from '@astrale-os/kernel-protocol/schema/installation/legacy';
 import { call } from '../client/index.js';
 const INTROSPECT_PATH = Path.project(introspectRef).raw;
 export async function introspect(invoke, limits, request, options) {
-    // The evidence is MessagePack behind a lazy import: fetch it with the request, not after it.
-    // A failed preload is surfaced by decode, which imports the same modules again.
-    void loadMsgpack().catch(() => undefined);
     const result = await invoke(call(INTROSPECT_PATH, request), options);
     if (result.kind !== 'binary') {
         throw new TypeError('Schema introspection returned a non-binary result.');
     }
-    if (result.value.mediaType !== schema.installation.introspection.MEDIA_TYPE) {
+    const { mediaType } = result.value;
+    const decode = mediaType === schema.installation.introspection.MEDIA_TYPE
+        ? schema.installation.introspection.decode
+        : // Deprecated: Hosts older than beta.127 (see protocol/schema/installation/legacy).
+            mediaType === legacy.introspection.MEDIA_TYPE
+                ? legacy.introspection.decode
+                : undefined;
+    if (decode === undefined) {
         throw new TypeError('Schema introspection returned an unsupported media type.');
     }
     if (!(result.value.body instanceof Uint8Array)) {
         await result.value.body[Symbol.asyncIterator]().return?.();
         throw new TypeError('Schema introspection returned a streaming binary result.');
     }
-    return schema.installation.introspection.decode(request, result.value.body, limits);
+    return decode(request, result.value.body, limits);
 }

package/dist/schema/schema.js

@@ -2,6 +2,7 @@ import { Path } from '@astrale-os/kernel-core/path';
 import { uninstallOutput } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
 import { install, uninstall } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
 import * as protocolSchema from '@astrale-os/kernel-protocol/schema';
+import * as legacy from '@astrale-os/kernel-protocol/schema/installation/legacy';
 import { call as invocation } from '../client/index.js';
 import { acceptOutput } from './admission.js';
 import { introspect } from './introspection.js';
@@ -19,14 +20,21 @@ export function createSchema(call, limits) {
             if (result.kind !== 'binary') {
                 throw new TypeError('Schema install returned a non-binary result.');
             }
-            if (result.value.mediaType !== protocolSchema.installation.MEDIA_TYPE) {
+            const { mediaType } = result.value;
+            const decode = mediaType === protocolSchema.installation.MEDIA_TYPE
+                ? protocolSchema.installation.decode
+                : // Deprecated: Hosts older than beta.127 (see protocol/schema/installation/legacy).
+                    mediaType === legacy.MEDIA_TYPE
+                        ? legacy.decode
+                        : undefined;
+            if (decode === undefined) {
                 throw new TypeError('Schema install returned an unsupported media type.');
             }
             if (!(result.value.body instanceof Uint8Array)) {
                 await result.value.body[Symbol.asyncIterator]().return?.();
                 throw new TypeError('Schema install returned a streaming binary result.');
             }
-            const decoded = await protocolSchema.installation.decode(result.value.body, installationResultLimit(admittedLimits.maximumPublicationBytes, request.domains.length));
+            const decoded = await decode(result.value.body, installationResultLimit(admittedLimits.maximumPublicationBytes, request.domains.length));
             proveInstallResult(request, decoded);
             return decoded;
         },

package/dist/session/content.js

@@ -115,23 +115,13 @@ function delay(ms, signal) {
     });
 }
 async function verifiedDownload(input) {
-    const raw = input.headers?.['x-astrale-blob-size'];
-    if (raw === undefined || !/^(?:0|[1-9][0-9]*)$/u.test(raw)) {
+    // The HTTP transport sets `length` only from an admitted declared length, and its byte stream
+    // enforces that exact count through the final read.
+    if (input.body instanceof Uint8Array || !('length' in input) || input.length === undefined) {
         await cancelBinary(input);
         throw new ProtocolError('Content download omitted its exact content size.');
     }
-    const expected = Number(raw);
-    if (!Number.isSafeInteger(expected)) {
-        await cancelBinary(input);
-        throw new ProtocolError('Content download content size is invalid.');
-    }
-    if (input.body instanceof Uint8Array) {
-        if (input.body.byteLength !== expected) {
-            throw new ProtocolError('Content download ended before its exact content size.');
-        }
-        return input;
-    }
-    return Object.freeze({ ...input, body: exactContentBytes(input.body, expected) });
+    return input;
 }
 async function cancelBinary(input) {
     if (input.body instanceof Uint8Array)
@@ -143,16 +133,3 @@ async function cancelBinary(input) {
         // Preserve the admission error after the response stream has been closed.
     }
 }
-async function* exactContentBytes(body, expected) {
-    let received = 0;
-    for await (const bytes of body) {
-        received += bytes.byteLength;
-        if (received > expected) {
-            throw new ProtocolError('Content download exceeded its exact content size.');
-        }
-        yield bytes;
-    }
-    if (received !== expected) {
-        throw new ProtocolError('Content download ended before its exact content size.');
-    }
-}

package/dist/session/context/index.d.ts

@@ -1,4 +1,4 @@
 export { admitControlOptions, type SessionControlOptions } from './control.js';
-export { DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_MAXIMUM_ROUTES, DEFAULT_TIMEOUT_MS, platformDuration, positive, } from './limits.js';
-export { createSessionOperation, runSessionOperation, sessionTransportOptions, type SessionOperation, } from './operation.js';
+export { DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RELEASE_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_MAXIMUM_ROUTES, DEFAULT_TIMEOUT_MS, platformDuration, positive, } from './limits.js';
+export { createSessionOperation, remainingSessionTime, runSessionOperation, sessionTransportOptions, type SessionOperation, } from './operation.js';
 export { admitKernel, admitPolicy, allowEndpoint, kernelInvocationEndpoint, type SessionPolicy, } from './policy.js';

package/dist/session/context/index.js

@@ -1,4 +1,4 @@
 export { admitControlOptions } from './control.js';
-export { DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_MAXIMUM_ROUTES, DEFAULT_TIMEOUT_MS, platformDuration, positive, } from './limits.js';
-export { createSessionOperation, runSessionOperation, sessionTransportOptions, } from './operation.js';
+export { DEFAULT_MAXIMUM_BUNDLE_BYTES, DEFAULT_MAXIMUM_PUBLICATION_BYTES, DEFAULT_MAXIMUM_RELEASE_BYTES, DEFAULT_MAXIMUM_RESPONSE_BYTES, DEFAULT_MAXIMUM_ROUTES, DEFAULT_TIMEOUT_MS, platformDuration, positive, } from './limits.js';
+export { createSessionOperation, remainingSessionTime, runSessionOperation, sessionTransportOptions, } from './operation.js';
 export { admitKernel, admitPolicy, allowEndpoint, kernelInvocationEndpoint, } from './policy.js';

package/dist/session/context/limits.d.ts

@@ -1,3 +1,4 @@
+export declare const DEFAULT_MAXIMUM_RELEASE_BYTES: number;
 export declare const DEFAULT_MAXIMUM_PUBLICATION_BYTES: number;
 export declare const DEFAULT_MAXIMUM_BUNDLE_BYTES: number;
 export declare const DEFAULT_MAXIMUM_RESPONSE_BYTES: number;

package/dist/session/context/limits.js

@@ -1,3 +1,4 @@
+export const DEFAULT_MAXIMUM_RELEASE_BYTES = 1024 * 1024;
 export const DEFAULT_MAXIMUM_PUBLICATION_BYTES = 1024 * 1024;
 export const DEFAULT_MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
 export const DEFAULT_MAXIMUM_RESPONSE_BYTES = 16 * 1024 * 1024;

package/dist/session/discovery/bundle.js

@@ -2,7 +2,7 @@ import { bundleUrl } from '@astrale-os/kernel-protocol/publication';
 import { decodeBundleValue } from '@astrale-os/kernel-protocol/publication/bundle';
 import { ClientError } from '../../errors/index.js';
 import { allowEndpoint } from '../context/index.js';
-import { boundedResponse, requireExactResponse } from './publication.js';
+import { boundedResponse, requireExactResponse } from './response.js';
 import { runAcquisition } from './transport.js';
 /** Internal evidence that a selected immutable artifact is no longer served. */
 export class BundleUnavailableError extends ClientError {

package/dist/session/discovery/discovery.d.ts

@@ -1,22 +1,30 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { publication } from '@astrale-os/kernel-protocol';
 import type { SessionOperation, SessionPolicy } from '../context/index.js';
-import type { PublicationDiscovery } from './publication.js';
+import type { IntrinsicRelease } from './release.js';
 import type { SessionSnapshot } from './snapshot.js';
 import { type BundleDiscovery } from './bundle.js';
+/** Revalidating reader of the source Kernel's intrinsic release. */
+interface IntrinsicReleases {
+    revalidate(operation: SessionOperation): Promise<IntrinsicRelease>;
+    invalidate(): void;
+}
 export declare class SessionDiscovery {
     readonly kernel: IssuerId;
     private readonly policy;
-    private readonly publications;
+    private readonly releases;
     private readonly bundles;
     private readonly requireOpen;
     private readonly acquisitionOperation;
     private retained?;
     private flight?;
-    private publicationFlight?;
-    constructor(kernel: IssuerId, policy: Readonly<SessionPolicy>, publications: PublicationDiscovery, bundles: BundleDiscovery, requireOpen: () => void, acquisitionOperation: () => SessionOperation);
+    private releaseFlight?;
+    constructor(kernel: IssuerId, policy: Readonly<SessionPolicy>, releases: IntrinsicReleases, bundles: BundleDiscovery, requireOpen: () => void, acquisitionOperation: () => SessionOperation);
+    release(operation: SessionOperation): Promise<IntrinsicRelease>;
+    /** @deprecated Successor: `release`. The v3 document of the current release. */
     publication(operation: SessionOperation): Promise<publication.Publication>;
     snapshot(operation: SessionOperation): Promise<SessionSnapshot>;
     clear(): void;
     private acquireSnapshot;
 }
+export {};

package/dist/session/discovery/discovery.js

@@ -1,43 +1,48 @@
 import { runSessionOperation } from '../context/index.js';
 import { rootViewCatalog } from '../views/index.js';
 import { BundleUnavailableError } from './bundle.js';
+import { designation, publicationOf } from './legacy/index.js';
 import { createSessionSnapshot } from './snapshot.js';
 export class SessionDiscovery {
     kernel;
     policy;
-    publications;
+    releases;
     bundles;
     requireOpen;
     acquisitionOperation;
     retained;
     flight;
-    publicationFlight;
-    constructor(kernel, policy, publications, bundles, requireOpen, acquisitionOperation) {
+    releaseFlight;
+    constructor(kernel, policy, releases, bundles, requireOpen, acquisitionOperation) {
         this.kernel = kernel;
         this.policy = policy;
-        this.publications = publications;
+        this.releases = releases;
         this.bundles = bundles;
         this.requireOpen = requireOpen;
         this.acquisitionOperation = acquisitionOperation;
     }
-    publication(operation) {
+    release(operation) {
         this.requireOpen();
-        const current = this.publicationFlight;
+        const current = this.releaseFlight;
         if (current !== undefined)
             return runSessionOperation(operation, () => current);
-        const flight = this.publications.revalidate(this.acquisitionOperation()).then((value) => {
+        const flight = this.releases.revalidate(this.acquisitionOperation()).then((value) => {
             this.requireOpen();
             return value;
         });
-        this.publicationFlight = flight;
+        this.releaseFlight = flight;
         void flight
             .finally(() => {
-            if (this.publicationFlight === flight)
-                this.publicationFlight = undefined;
+            if (this.releaseFlight === flight)
+                this.releaseFlight = undefined;
         })
             .catch(() => undefined);
         return runSessionOperation(operation, () => flight);
     }
+    /** @deprecated Successor: `release`. The v3 document of the current release. */
+    async publication(operation) {
+        return publicationOf(await this.release(operation));
+    }
     snapshot(operation) {
         this.requireOpen();
         const current = this.flight;
@@ -54,30 +59,34 @@ export class SessionDiscovery {
         return runSessionOperation(operation, () => flight);
     }
     clear() {
-        this.publications.invalidate();
+        this.releases.invalidate();
         this.bundles.clear();
         this.retained = undefined;
     }
     async acquireSnapshot(operation) {
-        let publication = await this.publication(operation);
+        let release = await this.release(operation);
         let artifact;
         try {
-            artifact = await this.bundles.get(publication, operation);
+            artifact = await this.bundles.get(publicationOf(release), operation);
         }
         catch (cause) {
             if (!(cause instanceof BundleUnavailableError))
                 throw cause;
-            const current = await this.publication(operation);
-            if (current.etag === publication.etag)
+            const current = await this.release(operation);
+            if (designation(current) === designation(release))
                 throw cause;
-            publication = current;
-            artifact = await this.bundles.get(publication, operation);
+            release = current;
+            artifact = await this.bundles.get(publicationOf(release), operation);
         }
         this.requireOpen();
-        if (this.retained?.publication.etag === publication.etag)
+        if (this.retained !== undefined &&
+            designation(this.retained.release) === designation(release)) {
             return this.retained;
+        }
+        // Bundle and root Views come from the v3 document until View provenance names the release.
+        const publication = publicationOf(release);
         const views = rootViewCatalog(publication, artifact, this.policy);
-        const snapshot = createSessionSnapshot(this.kernel, publication, artifact, views);
+        const snapshot = createSessionSnapshot(this.kernel, release, publication, artifact, views);
         this.retained = snapshot;
         return snapshot;
     }

package/dist/session/discovery/index.d.ts

@@ -2,11 +2,15 @@ import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { publication } from '@astrale-os/kernel-protocol';
 import type { Fetch } from '../../transport/http/index.js';
 import type { SessionOperation, SessionPolicy } from '../context/index.js';
+import type { IntrinsicRelease } from './release.js';
 import type { SessionSnapshot } from './snapshot.js';
+export type { IntrinsicRelease } from './release.js';
 export type { SessionSnapshot } from './snapshot.js';
-export { boundedResponse, requireExactResponse } from './publication.js';
+export { boundedResponse, requireExactResponse } from './response.js';
 export interface SessionDiscovery {
     readonly kernel: IssuerId;
+    release(operation: SessionOperation): Promise<IntrinsicRelease>;
+    /** @deprecated Successor: `release`. */
     publication(operation: SessionOperation): Promise<publication.Publication>;
     snapshot(operation: SessionOperation): Promise<SessionSnapshot>;
     clear(): void;
@@ -15,6 +19,9 @@ export interface SessionDiscoveryOptions {
     readonly kernel: IssuerId;
     readonly fetch: Fetch;
     readonly policy: Readonly<SessionPolicy>;
+    /** Bounds the source Kernel's own `release.json`. */
+    readonly maximumReleaseBytes: number;
+    /** Bounds the version 3 Publication a Host that predates `release.json` serves at `domain.json`. */
     readonly maximumPublicationBytes: number;
     readonly maximumBundleBytes: number;
     readonly requireOpen: () => void;

package/dist/session/discovery/index.js

@@ -1,14 +1,11 @@
 import { BundleDiscovery } from './bundle.js';
 import { SessionDiscovery as SessionDiscoveryImplementation } from './discovery.js';
-import { PublicationDiscovery } from './publication.js';
-export { boundedResponse, requireExactResponse } from './publication.js';
+import { IntrinsicReleaseDiscovery, PublicationDiscovery } from './legacy/index.js';
+import { ReleaseDiscovery } from './release.js';
+export { boundedResponse, requireExactResponse } from './response.js';
 export function createSessionDiscovery(options) {
-    return new SessionDiscoveryImplementation(options.kernel, options.policy, new PublicationDiscovery({
-        kernel: options.kernel,
-        fetch: options.fetch,
-        policy: options.policy,
-        maximumBytes: options.maximumPublicationBytes,
-    }), new BundleDiscovery({
+    const source = { kernel: options.kernel, fetch: options.fetch, policy: options.policy };
+    return new SessionDiscoveryImplementation(options.kernel, options.policy, new IntrinsicReleaseDiscovery(new ReleaseDiscovery({ ...source, maximumBytes: options.maximumReleaseBytes }), new PublicationDiscovery({ ...source, maximumBytes: options.maximumPublicationBytes })), new BundleDiscovery({
         fetch: options.fetch,
         policy: options.policy,
         maximumBytes: options.maximumBundleBytes,

package/dist/session/discovery/legacy/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Compatibility discovery for Hosts without `release.json` and callers of the Publication API.
+ * Release-backed Hosts expose a locally computed v3 projection to those callers.
+ *
+ * Superseded by `ClientSession.release()` and `SessionSnapshot.release` (`ReleaseDiscovery`,
+ * `IntrinsicRelease`), and, for the stale hint, by `StaleRouteError.current`.
+ *
+ * Short-term consumers:
+ * - Hosts whose Kernel predates intrinsic `release.json`: they answer it with 404 (a browser sees
+ *   a `TypeError`, the 404 carrying no CORS headers) and serve only their version 3 Publication at
+ *   `domain.json`. Every Host does until it runs a Kernel release that serves `release.json`; the
+ *   1Pact path keeps one, because the client in GUI and Admin reads the Kernel .117 Host;
+ * - callers of the Publication API: Shell's `KernelClient.publication()` (and shell-react's graph
+ *   store through it) and Admin's remote instance gateway (`SessionSnapshot.publication`), until
+ *   each reads `release()` / `release`;
+ * - the snapshot's bundle and root Views, whose provenance (`ResolvedView.etag`) keeps the v3 ETag
+ *   until the breaking release (AM-1).
+ *
+ * Removal, in a separate breaking release: no supported Host predates intrinsic `release.json`
+ * (never while GUI and Admin talk to the Kernel .117 Host), no supported consumer reads the
+ * Publication API, and the breaking release of AM-1 emits release digests on every
+ * Kernel-to-client wire value. Then delete, in the same PR:
+ * - this folder, its tests (the pre-v4 cases of `session/__tests__/release.test.ts`) and its laws;
+ *   `SessionDiscovery` then reads `ReleaseDiscovery` directly, reports its 404 as a Client failure
+ *   and designates a snapshot by release digest, so canonical code only narrows `IntrinsicRelease`
+ *   to the `DomainRelease`;
+ * - the `'publication'` acquisition resource of `TransportError`, and the `domain.json` bound of
+ *   `ClientSessionOptions.maximumPublicationBytes`, which keeps bounding the Publications Schema
+ *   results carry until those name releases;
+ * - `ClientSession.publication()`, `SessionDiscovery.publication` and `SessionSnapshot.publication`
+ *   with their `.spec` entries; `BundleDiscovery` and `rootViewCatalog` then take the release,
+ *   whose View provenance is `ResolvedView.release`;
+ * - `StaleRouteError.currentEtag`, from law CLIENT-LEGACY-WIRE-FIELDS and its test, with the
+ *   Protocol fields of law PROTOCOL-LEGACY-WIRE-FIELDS.
+ */
+export { designation, IntrinsicReleaseDiscovery, type ReleaseReader } from './intrinsic.js';
+export { PublicationDiscovery, type PublicationDiscoveryOptions } from './publication.js';
+export { publicationOf } from './projection.js';

package/dist/session/discovery/legacy/index.js

@@ -0,0 +1,38 @@
+/**
+ * Compatibility discovery for Hosts without `release.json` and callers of the Publication API.
+ * Release-backed Hosts expose a locally computed v3 projection to those callers.
+ *
+ * Superseded by `ClientSession.release()` and `SessionSnapshot.release` (`ReleaseDiscovery`,
+ * `IntrinsicRelease`), and, for the stale hint, by `StaleRouteError.current`.
+ *
+ * Short-term consumers:
+ * - Hosts whose Kernel predates intrinsic `release.json`: they answer it with 404 (a browser sees
+ *   a `TypeError`, the 404 carrying no CORS headers) and serve only their version 3 Publication at
+ *   `domain.json`. Every Host does until it runs a Kernel release that serves `release.json`; the
+ *   1Pact path keeps one, because the client in GUI and Admin reads the Kernel .117 Host;
+ * - callers of the Publication API: Shell's `KernelClient.publication()` (and shell-react's graph
+ *   store through it) and Admin's remote instance gateway (`SessionSnapshot.publication`), until
+ *   each reads `release()` / `release`;
+ * - the snapshot's bundle and root Views, whose provenance (`ResolvedView.etag`) keeps the v3 ETag
+ *   until the breaking release (AM-1).
+ *
+ * Removal, in a separate breaking release: no supported Host predates intrinsic `release.json`
+ * (never while GUI and Admin talk to the Kernel .117 Host), no supported consumer reads the
+ * Publication API, and the breaking release of AM-1 emits release digests on every
+ * Kernel-to-client wire value. Then delete, in the same PR:
+ * - this folder, its tests (the pre-v4 cases of `session/__tests__/release.test.ts`) and its laws;
+ *   `SessionDiscovery` then reads `ReleaseDiscovery` directly, reports its 404 as a Client failure
+ *   and designates a snapshot by release digest, so canonical code only narrows `IntrinsicRelease`
+ *   to the `DomainRelease`;
+ * - the `'publication'` acquisition resource of `TransportError`, and the `domain.json` bound of
+ *   `ClientSessionOptions.maximumPublicationBytes`, which keeps bounding the Publications Schema
+ *   results carry until those name releases;
+ * - `ClientSession.publication()`, `SessionDiscovery.publication` and `SessionSnapshot.publication`
+ *   with their `.spec` entries; `BundleDiscovery` and `rootViewCatalog` then take the release,
+ *   whose View provenance is `ResolvedView.release`;
+ * - `StaleRouteError.currentEtag`, from law CLIENT-LEGACY-WIRE-FIELDS and its test, with the
+ *   Protocol fields of law PROTOCOL-LEGACY-WIRE-FIELDS.
+ */
+export { designation, IntrinsicReleaseDiscovery } from './intrinsic.js';
+export { PublicationDiscovery } from './publication.js';
+export { publicationOf } from './projection.js';