@astrale-os/kernel-client 0.6.0-beta.82 → 0.6.0-beta.84

package/dist/session/discovery/legacy/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Compatibility discovery for Hosts without `release.json` and callers of the Publication API.
+ * Release-backed Hosts expose a locally computed v3 projection to those callers.
+ *
+ * Superseded by `ClientSession.release()` and `SessionSnapshot.release` (`ReleaseDiscovery`,
+ * `IntrinsicRelease`), and, for the stale hint, by `StaleRouteError.current`.
+ *
+ * Short-term consumers:
+ * - Hosts whose Kernel predates intrinsic `release.json`: they answer it with 404 (a browser sees
+ *   a `TypeError`, the 404 carrying no CORS headers) and serve only their version 3 Publication at
+ *   `domain.json`. Every Host does until it runs a Kernel release that serves `release.json`; the
+ *   1Pact path keeps one, because the client in GUI and Admin reads the Kernel .117 Host;
+ * - callers of the Publication API: Shell's `KernelClient.publication()` (and shell-react's graph
+ *   store through it) and Admin's remote instance gateway (`SessionSnapshot.publication`), until
+ *   each reads `release()` / `release`;
+ * - the snapshot's bundle and root Views, whose provenance (`ResolvedView.etag`) keeps the v3 ETag
+ *   until the breaking release (AM-1).
+ *
+ * Removal, in a separate breaking release: no supported Host predates intrinsic `release.json`
+ * (never while GUI and Admin talk to the Kernel .117 Host), no supported consumer reads the
+ * Publication API, and the breaking release of AM-1 emits release digests on every
+ * Kernel-to-client wire value. Then delete, in the same PR:
+ * - this folder, its tests (the pre-v4 cases of `session/__tests__/release.test.ts`) and its laws;
+ *   `SessionDiscovery` then reads `ReleaseDiscovery` directly, reports its 404 as a Client failure
+ *   and designates a snapshot by release digest, so canonical code only narrows `IntrinsicRelease`
+ *   to the `DomainRelease`;
+ * - the `'publication'` acquisition resource of `TransportError`, and the `domain.json` bound of
+ *   `ClientSessionOptions.maximumPublicationBytes`, which keeps bounding the Publications Schema
+ *   results carry until those name releases;
+ * - `ClientSession.publication()`, `SessionDiscovery.publication` and `SessionSnapshot.publication`
+ *   with their `.spec` entries; `BundleDiscovery` and `rootViewCatalog` then take the release,
+ *   whose View provenance is `ResolvedView.release`;
+ * - `StaleRouteError.currentEtag`, from law CLIENT-LEGACY-WIRE-FIELDS and its test, with the
+ *   Protocol fields of law PROTOCOL-LEGACY-WIRE-FIELDS.
+ */
+export { designation, IntrinsicReleaseDiscovery, type ReleaseReader } from './intrinsic.js';
+export { PublicationDiscovery, type PublicationDiscoveryOptions } from './publication.js';
+export { publicationOf } from './projection.js';

package/dist/session/discovery/legacy/index.js

@@ -0,0 +1,38 @@
+/**
+ * Compatibility discovery for Hosts without `release.json` and callers of the Publication API.
+ * Release-backed Hosts expose a locally computed v3 projection to those callers.
+ *
+ * Superseded by `ClientSession.release()` and `SessionSnapshot.release` (`ReleaseDiscovery`,
+ * `IntrinsicRelease`), and, for the stale hint, by `StaleRouteError.current`.
+ *
+ * Short-term consumers:
+ * - Hosts whose Kernel predates intrinsic `release.json`: they answer it with 404 (a browser sees
+ *   a `TypeError`, the 404 carrying no CORS headers) and serve only their version 3 Publication at
+ *   `domain.json`. Every Host does until it runs a Kernel release that serves `release.json`; the
+ *   1Pact path keeps one, because the client in GUI and Admin reads the Kernel .117 Host;
+ * - callers of the Publication API: Shell's `KernelClient.publication()` (and shell-react's graph
+ *   store through it) and Admin's remote instance gateway (`SessionSnapshot.publication`), until
+ *   each reads `release()` / `release`;
+ * - the snapshot's bundle and root Views, whose provenance (`ResolvedView.etag`) keeps the v3 ETag
+ *   until the breaking release (AM-1).
+ *
+ * Removal, in a separate breaking release: no supported Host predates intrinsic `release.json`
+ * (never while GUI and Admin talk to the Kernel .117 Host), no supported consumer reads the
+ * Publication API, and the breaking release of AM-1 emits release digests on every
+ * Kernel-to-client wire value. Then delete, in the same PR:
+ * - this folder, its tests (the pre-v4 cases of `session/__tests__/release.test.ts`) and its laws;
+ *   `SessionDiscovery` then reads `ReleaseDiscovery` directly, reports its 404 as a Client failure
+ *   and designates a snapshot by release digest, so canonical code only narrows `IntrinsicRelease`
+ *   to the `DomainRelease`;
+ * - the `'publication'` acquisition resource of `TransportError`, and the `domain.json` bound of
+ *   `ClientSessionOptions.maximumPublicationBytes`, which keeps bounding the Publications Schema
+ *   results carry until those name releases;
+ * - `ClientSession.publication()`, `SessionDiscovery.publication` and `SessionSnapshot.publication`
+ *   with their `.spec` entries; `BundleDiscovery` and `rootViewCatalog` then take the release,
+ *   whose View provenance is `ResolvedView.release`;
+ * - `StaleRouteError.currentEtag`, from law CLIENT-LEGACY-WIRE-FIELDS and its test, with the
+ *   Protocol fields of law PROTOCOL-LEGACY-WIRE-FIELDS.
+ */
+export { designation, IntrinsicReleaseDiscovery } from './intrinsic.js';
+export { PublicationDiscovery } from './publication.js';
+export { publicationOf } from './projection.js';

package/dist/session/discovery/legacy/intrinsic.d.ts

@@ -0,0 +1,33 @@
+import type { release } from '@astrale-os/kernel-protocol';
+import type { SessionOperation } from '../../context/index.js';
+import type { IntrinsicRelease } from '../release.js';
+import type { PublicationDiscovery } from './publication.js';
+/** Reprobe absent `release.json` after this interval so Host upgrades become visible. */
+export declare const RELEASE_ABSENCE_MAXIMUM_AGE_MS = 60000;
+export interface ReleaseReader {
+    current(): release.DomainRelease | undefined;
+    revalidate(operation: SessionOperation): Promise<release.DomainRelease | undefined>;
+    invalidate(): void;
+}
+/**
+ * The intrinsic release of a Host whichever document it serves. `release.json` is read first; the
+ * version 3 Publication at `domain.json` is read in its place only when that URL answers its exact
+ * 404, or, while no `DomainRelease` has been admitted since construction, the last `invalidate()`
+ * or the last 404, when its Fetch fails before any response, which is how a browser reports a
+ * cross-origin 404 without CORS headers. Once a release is admitted, a failed Fetch is the release
+ * acquisition failure it is. An observed absence is trusted for `RELEASE_ABSENCE_MAXIMUM_AGE_MS`.
+ *
+ * @deprecated Successor: `ReleaseDiscovery` alone, once no supported Host predates intrinsic
+ * `release.json`. Deleted with this folder (see `index.ts`).
+ */
+export declare class IntrinsicReleaseDiscovery {
+    private readonly releases;
+    private readonly publications;
+    private absentUntil;
+    private revision;
+    constructor(releases: ReleaseReader, publications: PublicationDiscovery);
+    revalidate(operation: SessionOperation): Promise<IntrinsicRelease>;
+    invalidate(): void;
+}
+/** The digest designating one intrinsic release: its release digest, or a pre-v4 ETag. */
+export declare function designation(input: IntrinsicRelease): string;

package/dist/session/discovery/legacy/intrinsic.js

@@ -0,0 +1,67 @@
+import { TransportError } from '../../../errors/index.js';
+/** Reprobe absent `release.json` after this interval so Host upgrades become visible. */
+export const RELEASE_ABSENCE_MAXIMUM_AGE_MS = 60_000;
+/**
+ * The intrinsic release of a Host whichever document it serves. `release.json` is read first; the
+ * version 3 Publication at `domain.json` is read in its place only when that URL answers its exact
+ * 404, or, while no `DomainRelease` has been admitted since construction, the last `invalidate()`
+ * or the last 404, when its Fetch fails before any response, which is how a browser reports a
+ * cross-origin 404 without CORS headers. Once a release is admitted, a failed Fetch is the release
+ * acquisition failure it is. An observed absence is trusted for `RELEASE_ABSENCE_MAXIMUM_AGE_MS`.
+ *
+ * @deprecated Successor: `ReleaseDiscovery` alone, once no supported Host predates intrinsic
+ * `release.json`. Deleted with this folder (see `index.ts`).
+ */
+export class IntrinsicReleaseDiscovery {
+    releases;
+    publications;
+    absentUntil;
+    revision = 0;
+    constructor(releases, publications) {
+        this.releases = releases;
+        this.publications = publications;
+    }
+    async revalidate(operation) {
+        const revision = this.revision;
+        if (this.absentUntil === undefined || Date.now() >= this.absentUntil) {
+            const admitted = this.releases.current() !== undefined;
+            let served;
+            try {
+                served = await this.releases.revalidate(operation);
+            }
+            catch (cause) {
+                if (admitted || !isUnreadableAbsence(cause))
+                    throw cause;
+                served = undefined;
+            }
+            if (revision !== this.revision)
+                return this.revalidate(operation);
+            this.absentUntil = undefined;
+            if (served !== undefined)
+                return served;
+        }
+        const legacy = await this.publications.revalidate(operation);
+        if (revision !== this.revision)
+            return this.revalidate(operation);
+        this.absentUntil ??= Date.now() + RELEASE_ABSENCE_MAXIMUM_AGE_MS;
+        return legacy;
+    }
+    invalidate() {
+        this.revision += 1;
+        this.absentUntil = undefined;
+        this.releases.invalidate();
+        this.publications.invalidate();
+    }
+}
+/** The digest designating one intrinsic release: its release digest, or a pre-v4 ETag. */
+export function designation(input) {
+    return input.version === 4 ? input.digest : input.etag;
+}
+/** A `release.json` request that failed with the Fetch-standard network error, before any response. */
+function isUnreadableAbsence(cause) {
+    return (cause instanceof TransportError &&
+        cause.phase === 'unknown' &&
+        cause.context.kind === 'acquisition' &&
+        cause.context.resource === 'release' &&
+        cause.cause instanceof TypeError);
+}

package/dist/session/discovery/legacy/projection.d.ts

@@ -0,0 +1,8 @@
+import type { publication } from '@astrale-os/kernel-protocol';
+import type { IntrinsicRelease } from '../release.js';
+/**
+ * Retain one Publication object per admitted release; bundle and View provenance use its ETag.
+ *
+ * @deprecated Use `IntrinsicRelease`.
+ */
+export declare function publicationOf(input: IntrinsicRelease): publication.Publication;

package/dist/session/discovery/legacy/projection.js

@@ -0,0 +1,17 @@
+import * as releaseLegacy from '@astrale-os/kernel-protocol/release/legacy';
+const projections = new WeakMap();
+/**
+ * Retain one Publication object per admitted release; bundle and View provenance use its ETag.
+ *
+ * @deprecated Use `IntrinsicRelease`.
+ */
+export function publicationOf(input) {
+    if (input.version !== 4)
+        return input;
+    const retained = projections.get(input);
+    if (retained !== undefined)
+        return retained;
+    const projected = releaseLegacy.publication(input);
+    projections.set(input, projected);
+    return projected;
+}

package/dist/session/discovery/{publication.d.ts → legacy/publication.d.ts}

@@ -1,14 +1,19 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { publication } from '@astrale-os/kernel-protocol';
-import type { Fetch } from '../../transport/http/index.js';
-import type { SessionOperation } from '../context/index.js';
-import { type SessionPolicy } from '../context/index.js';
+import type { Fetch } from '../../../transport/http/index.js';
+import type { SessionOperation } from '../../context/index.js';
+import { type SessionPolicy } from '../../context/index.js';
 export interface PublicationDiscoveryOptions {
     readonly kernel: IssuerId;
     readonly fetch: Fetch;
     readonly policy: Readonly<SessionPolicy>;
     readonly maximumBytes: number;
 }
+/**
+ * Conditionally revalidate `domain.json` by ETag when intrinsic release discovery is unavailable.
+ *
+ * @deprecated Use `ReleaseDiscovery`.
+ */
 export declare class PublicationDiscovery {
     private readonly options;
     private publication;
@@ -19,5 +24,3 @@ export declare class PublicationDiscovery {
     invalidate(): void;
     private fetch;
 }
-export declare function boundedResponse(response: Response, maximum: number, signal: AbortSignal): Promise<Uint8Array>;
-export declare function requireExactResponse(response: Response, expected: string, label: string): void;

package/dist/session/discovery/{publication.js → legacy/publication.js}

@@ -1,8 +1,14 @@
 import * as codecs from '@astrale-os/kernel-protocol/codecs';
 import * as publicationCodec from '@astrale-os/kernel-protocol/publication/publication';
-import { ClientError } from '../../errors/index.js';
-import { allowEndpoint } from '../context/index.js';
-import { runAcquisition } from './transport.js';
+import { ClientError } from '../../../errors/index.js';
+import { allowEndpoint } from '../../context/index.js';
+import { boundedResponse, requireExactResponse } from '../response.js';
+import { runAcquisition } from '../transport.js';
+/**
+ * Conditionally revalidate `domain.json` by ETag when intrinsic release discovery is unavailable.
+ *
+ * @deprecated Use `ReleaseDiscovery`.
+ */
 export class PublicationDiscovery {
     options;
     publication;
@@ -54,6 +60,10 @@ export class PublicationDiscovery {
         }
         const body = await runAcquisition(operation, 'publication', 'receive', 'Kernel Publication response could not be read.', (signal) => boundedResponse(response, this.options.maximumBytes, signal));
         const admitted = publicationCodec.accept(codecs.json.decode(body));
+        // Version 2 is only a retained Kernel-side format; a live Kernel serves version 3.
+        if (admitted.version !== 3) {
+            throw new ClientError('Kernel Publication version 2 is no longer supported; the Kernel must serve Publication version 3.');
+        }
         if (admitted.identity.issuer !== this.options.kernel) {
             throw new ClientError('Publication issuer differs from the requested Kernel issuer.');
         }
@@ -64,60 +74,3 @@ export class PublicationDiscovery {
         return admitted;
     }
 }
-export async function boundedResponse(response, maximum, signal) {
-    const declared = response.headers.get('content-length');
-    if (declared !== null) {
-        const length = Number(declared);
-        if (!Number.isSafeInteger(length) || length < 0) {
-            throw new ClientError('Response Content-Length is invalid.');
-        }
-        if (length > maximum)
-            throw new ClientError('Response exceeds its byte limit.');
-    }
-    if (response.body === null)
-        return new Uint8Array();
-    const reader = response.body.getReader();
-    const chunks = [];
-    let total = 0;
-    const abort = () => void reader.cancel(signal.reason).catch(() => undefined);
-    if (signal.aborted)
-        abort();
-    else
-        signal.addEventListener('abort', abort, { once: true });
-    try {
-        while (true) {
-            if (signal.aborted)
-                throw signal.reason;
-            const next = await reader.read();
-            if (next.done)
-                break;
-            total += next.value.byteLength;
-            if (total > maximum) {
-                await reader.cancel('response exceeds byte limit').catch(() => undefined);
-                throw new ClientError('Response exceeds its byte limit.');
-            }
-            chunks.push(next.value);
-        }
-    }
-    finally {
-        signal.removeEventListener('abort', abort);
-        reader.releaseLock();
-    }
-    return join(chunks, total);
-}
-export function requireExactResponse(response, expected, label) {
-    if (response.redirected || response.url !== expected) {
-        throw new ClientError(`${label} did not return the exact requested URL.`);
-    }
-}
-function join(parts, length) {
-    if (parts.length === 1)
-        return new Uint8Array(parts[0]);
-    const output = new Uint8Array(length);
-    let offset = 0;
-    for (const part of parts) {
-        output.set(part, offset);
-        offset += part.byteLength;
-    }
-    return output;
-}

package/dist/session/discovery/release.d.ts

@@ -0,0 +1,29 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { release } from '@astrale-os/kernel-protocol';
+import type { Fetch } from '../../transport/http/index.js';
+import type { SessionOperation } from '../context/index.js';
+import { type SessionPolicy } from '../context/index.js';
+/** The source Kernel's release, or its version 3 Publication when `release.json` is unavailable. */
+export type IntrinsicRelease = release.DomainRelease | release.legacy.Publication;
+export interface ReleaseDiscoveryOptions {
+    readonly kernel: IssuerId;
+    readonly fetch: Fetch;
+    readonly policy: Readonly<SessionPolicy>;
+    readonly maximumBytes: number;
+}
+/**
+ * Conditionally revalidate by release digest. Only an exact 404 means absence;
+ * all other unsuccessful responses and Fetch failures remain errors.
+ */
+export declare class ReleaseDiscovery {
+    private readonly options;
+    private release;
+    private revision;
+    constructor(options: ReleaseDiscoveryOptions);
+    /** The release admitted since construction, the last `invalidate()` or the last 404, if any. */
+    current(): release.DomainRelease | undefined;
+    /** The admitted release, or undefined when the Host answers `release.json` with its exact 404. */
+    revalidate(operation: SessionOperation): Promise<release.DomainRelease | undefined>;
+    invalidate(): void;
+    private fetch;
+}

package/dist/session/discovery/release.js

@@ -0,0 +1,81 @@
+import * as codecs from '@astrale-os/kernel-protocol/codecs';
+import * as releaseCodec from '@astrale-os/kernel-protocol/release';
+import { ClientError } from '../../errors/index.js';
+import { allowEndpoint } from '../context/index.js';
+import { boundedResponse, requireExactResponse } from './response.js';
+import { runAcquisition } from './transport.js';
+/**
+ * Conditionally revalidate by release digest. Only an exact 404 means absence;
+ * all other unsuccessful responses and Fetch failures remain errors.
+ */
+export class ReleaseDiscovery {
+    options;
+    release;
+    revision = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    /** The release admitted since construction, the last `invalidate()` or the last 404, if any. */
+    current() {
+        return this.release;
+    }
+    /** The admitted release, or undefined when the Host answers `release.json` with its exact 404. */
+    async revalidate(operation) {
+        const revision = this.revision;
+        const previous = this.release;
+        const discovered = await this.fetch(operation, previous);
+        if (revision !== this.revision)
+            return this.revalidate(operation);
+        const retained = discovered !== undefined && previous?.digest === discovered.digest ? previous : discovered;
+        this.release = retained;
+        return retained;
+    }
+    invalidate() {
+        this.revision += 1;
+        this.release = undefined;
+    }
+    async fetch(operation, previous) {
+        const url = releaseCodec.url(this.options.kernel);
+        allowEndpoint(url, this.options.policy);
+        const response = await runAcquisition(operation, 'release', 'unknown', 'Kernel release could not be retrieved.', (signal) => this.options.fetch(url, {
+            headers: {
+                accept: releaseCodec.MEDIA_TYPE,
+                ...(previous === undefined ? {} : { 'if-none-match': `"${previous.digest}"` }),
+            },
+            redirect: 'manual',
+            signal,
+        }));
+        requireExactResponse(response, url, 'Release discovery');
+        if (response.status === 404) {
+            // Cleanup must not hold discovery open on an injected body cancellation.
+            void response.body?.cancel().catch(() => undefined);
+            return undefined;
+        }
+        if (response.status === 304) {
+            if (previous === undefined) {
+                throw new ClientError('Release discovery returned an unexpected not-modified response.');
+            }
+            const etag = response.headers.get('etag');
+            if (etag !== null && etag !== `"${previous.digest}"`) {
+                throw new ClientError('Release not-modified ETag differs from the retained release digest.');
+            }
+            return previous;
+        }
+        if (!response.ok) {
+            throw new ClientError(`Release discovery returned HTTP ${response.status}.`);
+        }
+        if (response.headers.get('content-type') !== releaseCodec.MEDIA_TYPE) {
+            throw new ClientError('Release response media type differs from the DomainRelease v4 media type.');
+        }
+        const body = await runAcquisition(operation, 'release', 'receive', 'Kernel release response could not be read.', (signal) => boundedResponse(response, this.options.maximumBytes, signal));
+        const admitted = releaseCodec.accept(codecs.json.decode(body));
+        if (admitted.identity.issuer !== this.options.kernel) {
+            throw new ClientError('Release issuer differs from the requested Kernel issuer.');
+        }
+        const etag = response.headers.get('etag');
+        if (etag !== null && etag !== `"${admitted.digest}"`) {
+            throw new ClientError('Release response ETag differs from its release digest.');
+        }
+        return admitted;
+    }
+}

package/dist/session/discovery/response.d.ts

@@ -0,0 +1,3 @@
+/** Read external bytes within one Session operation's byte and lifetime bounds. */
+export declare function boundedResponse(response: Response, maximum: number, signal: AbortSignal): Promise<Uint8Array>;
+export declare function requireExactResponse(response: Response, expected: string, label: string): void;

package/dist/session/discovery/response.js

@@ -0,0 +1,59 @@
+import { ClientError } from '../../errors/index.js';
+/** Read external bytes within one Session operation's byte and lifetime bounds. */
+export async function boundedResponse(response, maximum, signal) {
+    const declared = response.headers.get('content-length');
+    if (declared !== null) {
+        const length = Number(declared);
+        if (!Number.isSafeInteger(length) || length < 0) {
+            throw new ClientError('Response Content-Length is invalid.');
+        }
+        if (length > maximum)
+            throw new ClientError('Response exceeds its byte limit.');
+    }
+    if (response.body === null)
+        return new Uint8Array();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    const abort = () => void reader.cancel(signal.reason).catch(() => undefined);
+    if (signal.aborted)
+        abort();
+    else
+        signal.addEventListener('abort', abort, { once: true });
+    try {
+        while (true) {
+            if (signal.aborted)
+                throw signal.reason;
+            const next = await reader.read();
+            if (next.done)
+                break;
+            total += next.value.byteLength;
+            if (total > maximum) {
+                await reader.cancel('response exceeds byte limit').catch(() => undefined);
+                throw new ClientError('Response exceeds its byte limit.');
+            }
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        signal.removeEventListener('abort', abort);
+        reader.releaseLock();
+    }
+    return join(chunks, total);
+}
+export function requireExactResponse(response, expected, label) {
+    if (response.redirected || response.url !== expected) {
+        throw new ClientError(`${label} did not return the exact requested URL.`);
+    }
+}
+function join(parts, length) {
+    if (parts.length === 1)
+        return new Uint8Array(parts[0]);
+    const output = new Uint8Array(length);
+    let offset = 0;
+    for (const part of parts) {
+        output.set(part, offset);
+        offset += part.byteLength;
+    }
+    return output;
+}

package/dist/session/discovery/snapshot.d.ts

@@ -2,11 +2,18 @@ import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { bundle } from '@astrale-os/kernel-dsl/v1';
 import type { publication } from '@astrale-os/kernel-protocol';
 import type { ViewCatalog } from '../views/index.js';
-/** Coherent public observation acquired through one Client Session at one Publication ETag. */
+import type { IntrinsicRelease } from './release.js';
+/** Coherent public observation acquired through one Client Session at one intrinsic release. */
 export interface SessionSnapshot {
     readonly kernel: IssuerId;
+    readonly release: IntrinsicRelease;
+    /**
+     * Bundle and root View provenance use this v3 document's ETag.
+     *
+     * @deprecated Use `release`.
+     */
     readonly publication: publication.Publication;
     readonly bundle: bundle.Bundle;
     readonly views: ViewCatalog;
 }
-export declare function createSessionSnapshot(kernel: IssuerId, publication: publication.Publication, artifact: bundle.Bundle, views: ViewCatalog): SessionSnapshot;
+export declare function createSessionSnapshot(kernel: IssuerId, release: IntrinsicRelease, publication: publication.Publication, artifact: bundle.Bundle, views: ViewCatalog): SessionSnapshot;

package/dist/session/discovery/snapshot.js

@@ -1,3 +1,3 @@
-export function createSessionSnapshot(kernel, publication, artifact, views) {
-    return Object.freeze({ kernel, publication, bundle: artifact, views });
+export function createSessionSnapshot(kernel, release, publication, artifact, views) {
+    return Object.freeze({ kernel, release, publication, bundle: artifact, views });
 }

package/dist/session/discovery/transport.d.ts

@@ -1,6 +1,4 @@
-import type { TransportPhase } from '../../errors/index.js';
+import type { AcquisitionResource, TransportPhase } from '../../errors/index.js';
 import type { SessionOperation } from '../context/index.js';
-type AcquisitionResource = 'publication' | 'bundle';
 /** Normalize only unknown failures from one injected acquisition capability. */
 export declare function runAcquisition<Result>(operation: SessionOperation, resource: AcquisitionResource, phase: Extract<TransportPhase, 'receive' | 'unknown'>, message: string, task: (signal: AbortSignal) => Result | PromiseLike<Result>): Promise<Result>;
-export {};

package/dist/session/exchange/options.d.ts

@@ -1,19 +1,20 @@
 import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { SessionControlOptions } from '../context/index.js';
 import type { SessionAuth } from '../routing/index.js';
-/** Choose how authenticated Calls to remote Domains present the Session's source authority. */
-export interface SessionExchangeOptions {
-    /**
-     * `auto` exchanges through each callable's declaring Domain; `source` keeps the source credential.
-     * Defaults to `auto`, including legacy empty objects and options containing only `ttlSeconds`.
-     */
-    readonly mode?: 'auto' | 'source';
+/**
+ * Choose how authenticated Calls to remote Domains present the Session's source authority: `auto`
+ * exchanges through each callable's declaring Domain; `source` keeps the source credential.
+ */
+export type SessionExchangeOptions = {
+    readonly mode: 'auto';
     /**
      * Delegation lifetime requested for each Domain credential. The source credential's remaining
-     * lifetime and the Domain's own ceiling may shorten it. Applies only in `auto` mode.
+     * lifetime and the Domain's own ceiling may shorten it.
      */
     readonly ttlSeconds?: number;
-}
+} | {
+    readonly mode: 'source';
+};
 /** One explicit exchange through a named Domain issuer. */
 export interface SessionExchangeRequest extends SessionControlOptions {
     /** Requested delegation lifetime; the source credential and the Domain may shorten it. */
@@ -29,6 +30,8 @@ export interface ExchangeRequest {
  * Admit exchange options against the Session auth they extend. Every Domain credential must still
  * cover the Session delegation, so a request that could never cover it is rejected.
  */
-export declare function admitExchangeOptions(input: SessionExchangeOptions | undefined, auth: SessionAuth | undefined): Readonly<Required<Pick<SessionExchangeOptions, 'ttlSeconds'>>> | undefined;
+export declare function admitExchangeOptions(input: SessionExchangeOptions | undefined, auth: SessionAuth | undefined): Readonly<{
+    ttlSeconds: number;
+}> | undefined;
 /** Admit an explicit exchange: the canonical absolute issuer URL of the named Domain and its lifetime. */
 export declare function admitExchangeRequest(domain: string, input: SessionExchangeRequest | undefined): ExchangeRequest;

package/dist/session/exchange/options.js

@@ -12,14 +12,15 @@ export function admitExchangeOptions(input, auth) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
         throw new TypeError('Session exchange options are invalid.');
     }
-    if (Reflect.ownKeys(input).some((key) => key !== 'mode' && key !== 'ttlSeconds')) {
-        throw new TypeError('Session exchange options contain unexpected fields.');
-    }
-    const mode = input.mode === undefined ? 'auto' : input.mode;
+    const mode = input.mode;
     if (mode !== 'auto' && mode !== 'source') {
         throw new TypeError('Session exchange mode is invalid.');
     }
-    if (mode === 'source')
+    const fields = mode === 'auto' ? ['mode', 'ttlSeconds'] : ['mode'];
+    if (Reflect.ownKeys(input).some((key) => typeof key !== 'string' || !fields.includes(key))) {
+        throw new TypeError('Session exchange options contain unexpected fields.');
+    }
+    if (input.mode === 'source')
         return undefined;
     if (auth === undefined)
         throw new TypeError('Session exchange requires Session auth.');

package/dist/session/exchange/presentation.d.ts

@@ -1,6 +1,5 @@
 import type { AuthExchange, SessionAuth } from '../routing/index.js';
 import type { ExchangeDependencies } from './exchange.js';
-import type { SessionExchangeOptions } from './options.js';
 /** The per-Call exchange a Session applies after resolving its source authority. */
 export interface SessionExchange extends AuthExchange {
     clear(): void;
@@ -15,4 +14,6 @@ export interface SessionExchange extends AuthExchange {
  */
 export declare function createSessionExchange(dependencies: ExchangeDependencies & {
     readonly auth: SessionAuth;
-}, options: Readonly<Required<Pick<SessionExchangeOptions, 'ttlSeconds'>>>): SessionExchange;
+}, options: Readonly<{
+    ttlSeconds: number;
+}>): SessionExchange;

package/dist/session/index.d.ts

@@ -2,7 +2,7 @@ export type { SessionControlOptions, SessionPolicy } from './context/index.js';
 export type { ContentApi, ContentLocation, ContentUploadOptions, ContentUploadResult, } from './content.js';
 export { bindSession, type BoundClientSession, type BoundSessionControls, type BoundSessionSource, } from './bound.js';
 export { createSessionCredentialProvider, type SessionCredential, type SessionCredentialProvider, type SessionCredentialProviderOptions, type SessionCredentialState, } from './credential/index.js';
-export type { SessionSnapshot } from './discovery/index.js';
+export type { IntrinsicRelease, SessionSnapshot } from './discovery/index.js';
 export type { SessionExchangeOptions, SessionExchangeRequest } from './exchange/index.js';
 export type { Auth, PersistedRoute, SessionRouteArtifact, SessionRouteStore, SessionAuth, SessionEnvelopeTransport, SessionRequestOptions, SessionRequestOptionsWithBody, } from './routing/index.js';
 export { ClientSession, connect, type ClientSessionOptions, type ConnectOptions, } from './session.js';