@astrale-os/sdk 0.6.0-beta.0 → 0.6.0-beta.10

package/dist/execution/service/create.js

@@ -4,6 +4,7 @@ import { invocationPath } from '../../deployment/release/invocation.js';
 import { identity as captureIdentity } from '../identity/index.js';
 import { createHandler } from '../invocation/index.js';
 import { initialize, load } from '../runtime/index.js';
+import { createDurableReceiver, durableServing, isDurableRequest, } from '../workflows/index.js';
 import { initialization } from './initialization.js';
 import { lifecycle } from './lifecycle.js';
 import { delivery, installation, source } from './publication/index.js';
@@ -16,6 +17,9 @@ export function createService(input) {
         throw new TypeError('Service Runtime is not admitted.');
     const selectedIdentity = captureIdentity(input.identity);
     const providedDelivery = delivery(input.delivery);
+    const durable = input.durable;
+    // Preserve eager admission for an already loaded engine; providers stay outside ordinary startup.
+    const serving = durable === undefined || typeof durable === 'function' ? undefined : durableServing(durable);
     let running;
     const state = lifecycle(() => running?.server.drain());
     const realized = initialization(async () => {
@@ -55,6 +59,19 @@ export function createService(input) {
             server.drain();
         return running;
     });
+    const receiver = initialization(async (request) => {
+        const selected = typeof durable === 'function' ? await durable(request) : undefined;
+        const configuration = serving ?? (selected === undefined ? undefined : durableServing(selected));
+        if (configuration === undefined)
+            return undefined;
+        const { runtime } = await realized.get();
+        return createDurableReceiver({
+            workflows: runtime.loaded.registry.workflows,
+            domain: runtime.loaded.domain,
+            identity: selectedIdentity,
+            serving: configuration,
+        });
+    });
     let closing;
     const service = Object.freeze({
         async fetch(request, host) {
@@ -63,6 +80,13 @@ export function createService(input) {
             const ready = await realized.get();
             if (!state.accepting)
                 return unavailable();
+            // Without engine configuration only durable calls fail: the engine's discovery is refused.
+            if (isDurableRequest(request)) {
+                const selected = await receiver.get(request);
+                if (!state.accepting)
+                    return unavailable();
+                return selected?.fetch(request) ?? notServed();
+            }
             return ready.server.app.fetch(request, host);
         },
         async release() {
@@ -104,6 +128,12 @@ function serverOptions(input) {
     }
     return input;
 }
+function notServed() {
+    return new Response('{"error":"This deployment serves no durable Workflows."}', {
+        status: 404,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+    });
+}
 function unavailable() {
     return new Response('{"error":"Service is draining."}', {
         status: 503,

package/dist/execution/service/initialization.d.ts

@@ -1,6 +1,6 @@
-export interface Initialization<Value> {
-    get(): Promise<Value>;
+export interface Initialization<Value, Arguments extends readonly unknown[] = []> {
+    get(...args: Arguments): Promise<Value>;
     current(): Promise<Value> | undefined;
 }
-/** Share one successful initialization and allow a later retry after failure. */
-export declare function initialization<Value>(create: () => Promise<Value>): Initialization<Value>;
+/** Share an initialized value; absence and failure leave initialization retryable. */
+export declare function initialization<Value, Arguments extends readonly unknown[] = []>(create: (...args: Arguments) => Promise<Value>): Initialization<Value, Arguments>;

package/dist/execution/service/initialization.js

@@ -1,18 +1,27 @@
-/** Share one successful initialization and allow a later retry after failure. */
+/** Share an initialized value; absence and failure leave initialization retryable. */
 export function initialization(create) {
-    let current;
+    let state;
+    const get = (...args) => {
+        if (state?.phase === 'ready')
+            return state.promise;
+        if (state !== undefined) {
+            // Absence can depend on the initializing request. A waiter gets its own eligibility check.
+            return state.promise.then((value) => (value === undefined ? get(...args) : value));
+        }
+        const pending = create(...args).then((value) => {
+            if (state?.promise === pending)
+                state = value === undefined ? undefined : { phase: 'ready', promise: pending };
+            return value;
+        }, (cause) => {
+            if (state?.promise === pending)
+                state = undefined;
+            throw cause;
+        });
+        state = { phase: 'pending', promise: pending };
+        return pending;
+    };
     return Object.freeze({
-        get() {
-            if (current !== undefined)
-                return current;
-            const pending = create().catch((cause) => {
-                if (current === pending)
-                    current = undefined;
-                throw cause;
-            });
-            current = pending;
-            return pending;
-        },
-        current: () => current,
+        get,
+        current: () => state?.promise,
     });
 }

package/dist/execution/service/service.d.ts

@@ -4,6 +4,7 @@ import type { Runtime } from '../../application/runtime/index.js';
 import type { WorkflowRunner } from '../../application/workflow/runner/index.js';
 import type { Release } from '../../deployment/release/index.js';
 import type { Identity } from '../identity/index.js';
+import type { DurableServing, DurableServingProvider } from '../workflows/index.js';
 import type { ReleaseLoader } from './release.js';
 export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'publicOrigin' | 'tokenExchange' | 'publication' | 'delivery'>;
 export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtime> {
@@ -14,6 +15,11 @@ export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtim
     readonly server: ServiceServerOptions;
     readonly delivery?: publication.delivery.Provider;
     readonly workflows?: WorkflowRunner;
+    /**
+     * Serve the Release's durable Workflows. A provider is resolved on the first engine request,
+     * shared by concurrent requests, and retried after initialization fails.
+     */
+    readonly durable?: DurableServing | DurableServingProvider;
 }
 export interface Service {
     fetch(request: Request, host?: ApplicationHost): Promise<Response>;

package/dist/execution/workflows/discovery.d.ts

@@ -0,0 +1,14 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { WorkflowEngine } from '@astrale-os/kernel-protocol/issuer/workflow-engine';
+/** Discovery failure never admits static keys for an issuer-prefixed request. */
+export declare class WorkflowEngineUnavailable extends Error {
+    readonly name = "WorkflowEngineUnavailable";
+}
+/** One receiver retains bounded, recently admitted engine authority and deduplicates refreshes. */
+export declare function workflowEngineDiscovery(fetch: Fetch, now?: () => number): Readonly<{
+    resolve(issuer: string): Promise<WorkflowEngine>;
+    /** A crypto provider rejected this authority; the next request must discover it again. */
+    forget(issuer: string, observedKeys: readonly string[]): void;
+    /** Authentication refusal expires the basis for the next request, without replaying its body. */
+    invalidate(issuer: string, observedKeys: readonly string[]): void;
+}>;

package/dist/execution/workflows/discovery.js

@@ -0,0 +1,151 @@
+import { paths } from '@astrale-os/kernel-protocol/issuer/paths';
+import { acceptWorkflowEngine } from '@astrale-os/kernel-protocol/issuer/workflow-engine';
+const MAXIMUM_BYTES = 16 * 1024;
+const MAXIMUM_ISSUERS = 64;
+const TTL_MS = 60_000;
+const TIMEOUT_MS = 10_000;
+/** Discovery failure never admits static keys for an issuer-prefixed request. */
+export class WorkflowEngineUnavailable extends Error {
+    name = 'WorkflowEngineUnavailable';
+}
+/** One receiver retains bounded, recently admitted engine authority and deduplicates refreshes. */
+export function workflowEngineDiscovery(fetch, now = Date.now) {
+    const bases = new Map();
+    return Object.freeze({
+        async resolve(issuer) {
+            const basis = bases.get(issuer);
+            if (basis?.pending !== undefined)
+                return basis.pending;
+            const observedAt = now();
+            if (basis?.engine !== undefined &&
+                observedAt >= basis.expiresAt - TTL_MS &&
+                observedAt < basis.expiresAt)
+                return basis.engine;
+            if (basis === undefined) {
+                if (bases.size >= MAXIMUM_ISSUERS) {
+                    // Pending requests retain their slot; arbitrary issuers cannot exceed the concurrency cap.
+                    const oldest = [...bases].find(([, value]) => value.pending === undefined);
+                    if (oldest === undefined)
+                        throw new WorkflowEngineUnavailable('Engine discovery is busy.');
+                    bases.delete(oldest[0]);
+                }
+            }
+            // A refresh owns a new basis, so a late rejection of old keys cannot discard pending work.
+            const selected = {
+                expiresAt: 0,
+                ...(basis?.rejectedAt === undefined ? {} : { rejectedAt: basis.rejectedAt }),
+            };
+            bases.set(issuer, selected);
+            const pending = discover(fetch, issuer)
+                .then((engine) => {
+                selected.engine = engine;
+                selected.expiresAt = now() + TTL_MS;
+                // Move the successfully refreshed authority to the end of the bounded cache.
+                bases.delete(issuer);
+                bases.set(issuer, selected);
+                return engine;
+            })
+                .finally(() => {
+                if (selected.pending === pending)
+                    selected.pending = undefined;
+            });
+            selected.pending = pending;
+            return pending;
+        },
+        /** A crypto provider rejected this authority; the next request must discover it again. */
+        forget(issuer, observedKeys) {
+            if (bases.get(issuer)?.engine?.identity_keys === observedKeys)
+                bases.delete(issuer);
+        },
+        /** Authentication refusal expires the basis for the next request, without replaying its body. */
+        invalidate(issuer, observedKeys) {
+            const basis = bases.get(issuer);
+            const observedAt = now();
+            if (basis?.engine?.identity_keys !== observedKeys ||
+                (basis.rejectedAt !== undefined &&
+                    observedAt >= basis.rejectedAt &&
+                    observedAt - basis.rejectedAt < TTL_MS))
+                return;
+            basis.rejectedAt = observedAt;
+            basis.expiresAt = 0;
+        },
+    });
+}
+async function discover(fetch, issuer) {
+    const url = new URL(paths(issuer).workflowEngine, issuer);
+    if (url.protocol !== 'https:')
+        throw new WorkflowEngineUnavailable('Engine discovery requires HTTPS.');
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new WorkflowEngineUnavailable('Engine discovery timed out.')), TIMEOUT_MS);
+    let expired;
+    const timeout = new Promise((_resolve, reject) => {
+        expired = () => reject(controller.signal.reason);
+        controller.signal.addEventListener('abort', expired, { once: true });
+    });
+    try {
+        return await Promise.race([readDocument(fetch, url, issuer, controller.signal), timeout]);
+    }
+    catch (cause) {
+        if (cause instanceof WorkflowEngineUnavailable)
+            throw cause;
+        throw new WorkflowEngineUnavailable('Engine discovery is unavailable or invalid.', { cause });
+    }
+    finally {
+        clearTimeout(timer);
+        controller.signal.removeEventListener('abort', expired);
+    }
+}
+async function readDocument(fetch, url, issuer, signal) {
+    const response = await fetch(url.href, {
+        method: 'GET',
+        redirect: 'manual',
+        signal: signal,
+    });
+    if (!response.ok || response.redirected || (response.url !== '' && response.url !== url.href)) {
+        await response.body?.cancel();
+        throw new WorkflowEngineUnavailable('Engine discovery did not return its document.');
+    }
+    if (signal.aborted) {
+        await response.body?.cancel();
+        signal.throwIfAborted();
+    }
+    const advertised = response.headers.get('content-length');
+    if (advertised !== null && Number(advertised) > MAXIMUM_BYTES) {
+        await response.body?.cancel();
+        throw new WorkflowEngineUnavailable('Engine discovery exceeds its byte limit.');
+    }
+    if (response.body === null)
+        throw new WorkflowEngineUnavailable('Engine discovery is empty.');
+    const reader = response.body.getReader();
+    const cancel = () => {
+        void reader.cancel(signal.reason).catch(() => { });
+    };
+    signal.addEventListener('abort', cancel, { once: true });
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            signal.throwIfAborted();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAXIMUM_BYTES)
+                throw new WorkflowEngineUnavailable('Engine discovery exceeds its byte limit.');
+            chunks.push(value);
+        }
+    }
+    finally {
+        signal.removeEventListener('abort', cancel);
+        await reader.cancel();
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    const document = JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes));
+    return acceptWorkflowEngine(document, issuer);
+}

package/dist/execution/workflows/engine.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The part of the Restate TypeScript SDK's Fetch entrypoint the durable receiver uses. A runtime
+ * supplies the build for its platform: `@restatedev/restate-sdk/fetch` on Node and Bun,
+ * `@restatedev/restate-sdk-cloudflare-workers/fetch` on Cloudflare Workers, which cannot compile
+ * WebAssembly at run time. Both expose this exact surface.
+ */
+export interface DurableEngine {
+    createEndpointHandler(options: {
+        readonly services: unknown[];
+        readonly identityKeys?: string[];
+    }): (request: Request) => Promise<Response>;
+    workflow(definition: EngineWorkflowDefinition): unknown;
+    readonly TerminalError: new (message: string, options?: {
+        readonly errorCode?: number;
+        readonly metadata?: Record<string, string>;
+    }) => Error;
+    readonly CancelledError: abstract new (...input: never[]) => Error;
+}
+export interface EngineWorkflowDefinition {
+    readonly name: string;
+    readonly handlers: {
+        readonly run: (context: EngineWorkflowContext, input: unknown) => Promise<unknown>;
+        readonly signal: (context: EngineSharedContext, input: unknown) => Promise<unknown>;
+    };
+    readonly options: {
+        readonly workflowRetention: number;
+        readonly retryPolicy: EngineRetryPolicy;
+    };
+}
+export interface EngineRetryPolicy {
+    readonly maxAttempts: number;
+    readonly onMaxAttempts: 'pause' | 'kill';
+    readonly initialInterval: number;
+    readonly maxInterval: number;
+    readonly exponentiationFactor: number;
+}
+/** Journaled operations of one workflow run. */
+export interface EngineWorkflowContext {
+    run<Output>(name: string, action: () => Promise<Output>): PromiseLike<Output>;
+    sleep(durationMs: number, name?: string): PromiseLike<void>;
+    promise<Output>(name: string): {
+        get(): PromiseLike<Output>;
+    };
+    request(): {
+        readonly attemptCompletedSignal: AbortSignal;
+    };
+}
+export interface EngineSharedContext {
+    promise<Output>(name: string): {
+        resolve(value?: Output): PromiseLike<void>;
+    };
+}

package/dist/execution/workflows/engine.js

@@ -0,0 +1 @@
+export {};

package/dist/execution/workflows/envelope.d.ts

@@ -0,0 +1,12 @@
+import type { DurableExecution } from '../../application/workflow/index.js';
+import type { Value } from '../../platform/value/index.js';
+/** Engine input of one run, as the Kernel submits it. */
+export interface Envelope {
+    readonly execution: DurableExecution;
+    readonly input: Value;
+}
+/**
+ * Decode the run input the engine delivers. Fields a newer Kernel may add are ignored, so a Domain
+ * keeps running Executions submitted by it.
+ */
+export declare function decodeEnvelope(input: unknown): Envelope;

package/dist/execution/workflows/envelope.js

@@ -0,0 +1,46 @@
+import { issuer } from '../../platform/auth/index.js';
+import { NodeId } from '../../platform/graph/node/index.js';
+import * as portable from '../../platform/value/index.js';
+const VERSION = /^sha256:[0-9a-f]{64}$/u;
+/**
+ * Decode the run input the engine delivers. Fields a newer Kernel may add are ignored, so a Domain
+ * keeps running Executions submitted by it.
+ */
+export function decodeEnvelope(input) {
+    const envelope = record(input, 'envelope');
+    const fn = record(envelope.function, 'envelope.function');
+    const initiator = record(envelope.initiator, 'envelope.initiator');
+    if (typeof fn.version !== 'string' || !VERSION.test(fn.version)) {
+        throw new TypeError('Durable envelope.function.version is invalid.');
+    }
+    if (typeof envelope.kernel !== 'string')
+        throw new TypeError('Durable envelope.kernel is invalid.');
+    const receiver = envelope.receiver === undefined ? undefined : node(envelope.receiver, 'receiver');
+    const execution = Object.freeze({
+        id: node(envelope.execution, 'execution'),
+        function: Object.freeze({
+            id: node(fn.id, 'function.id'),
+            version: fn.version,
+        }),
+        kernel: issuer.accept(envelope.kernel),
+        initiator: Object.freeze({
+            principal: node(initiator.principal, 'initiator.principal'),
+            caller: node(initiator.caller, 'initiator.caller'),
+        }),
+        ...(receiver === undefined ? {} : { receiver }),
+    });
+    if (!Object.hasOwn(envelope, 'input'))
+        throw new TypeError('Durable envelope.input is missing.');
+    return Object.freeze({ execution, input: portable.accept(envelope.input) });
+}
+function record(input, label) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new TypeError(`Durable ${label} must be an object.`);
+    }
+    return input;
+}
+function node(input, label) {
+    if (typeof input !== 'string')
+        throw new TypeError(`Durable envelope.${label} is invalid.`);
+    return NodeId(input);
+}

package/dist/execution/workflows/failure.d.ts

@@ -0,0 +1,11 @@
+import type { DurableEngine } from './engine.js';
+/**
+ * Encode a declared business error of `definition` as a terminal engine failure, or return
+ * undefined for any other error, which the engine retries.
+ */
+export declare function terminalFailure(engine: DurableEngine, cause: unknown, definition: object): Error | undefined;
+/**
+ * The declared business error a journaled Step failed with, rebuilt through the definition's own
+ * factory, so a replay throws what the live run threw.
+ */
+export declare function replayedFailure(engine: DurableEngine, cause: unknown, definition: object): Error | undefined;

package/dist/execution/workflows/failure.js

@@ -0,0 +1,43 @@
+import { declaredErrorFactory, declaredErrorOf } from '../../application/error/index.js';
+/** Metadata key the Kernel reads a declared failure from (`backend/restate` outcome decoding). */
+const FAILURE = 'astrale.failure';
+const STATUS = {
+    VALIDATION_ERROR: 422,
+    NOT_FOUND: 404,
+    CONFLICT: 409,
+    UNSUPPORTED: 422,
+};
+/**
+ * Encode a declared business error of `definition` as a terminal engine failure, or return
+ * undefined for any other error, which the engine retries.
+ */
+export function terminalFailure(engine, cause, definition) {
+    const declared = declaredErrorOf(cause, definition);
+    if (declared === undefined)
+        return undefined;
+    return new engine.TerminalError(declared.message, {
+        errorCode: STATUS[declared.family],
+        metadata: {
+            [FAILURE]: JSON.stringify({
+                family: declared.family,
+                code: declared.code,
+                message: declared.message,
+                details: declared.details,
+            }),
+        },
+    });
+}
+/**
+ * The declared business error a journaled Step failed with, rebuilt through the definition's own
+ * factory, so a replay throws what the live run threw.
+ */
+export function replayedFailure(engine, cause, definition) {
+    if (!(cause instanceof engine.TerminalError) || cause instanceof engine.CancelledError) {
+        return undefined;
+    }
+    const encoded = cause.metadata?.[FAILURE];
+    if (encoded === undefined)
+        return undefined;
+    const failure = JSON.parse(encoded);
+    return declaredErrorFactory(definition)(failure.code, failure.details);
+}

package/dist/execution/workflows/index.d.ts

@@ -0,0 +1,4 @@
+export type { DurableEngine, EngineRetryPolicy, EngineSharedContext, EngineWorkflowContext, EngineWorkflowDefinition, } from './engine.js';
+export { durableServing, type AdmittedDurableServing, type DurableServing, type DurableServingProvider, } from './options.js';
+export { createDurableReceiver, type DurableReceiver } from './receiver.js';
+export { isDurableRequest, isCanonicalDurableRequest, isLegacyDurableRequest } from './route.js';

package/dist/execution/workflows/index.js

@@ -0,0 +1,3 @@
+export { durableServing, } from './options.js';
+export { createDurableReceiver } from './receiver.js';
+export { isDurableRequest, isCanonicalDurableRequest, isLegacyDurableRequest } from './route.js';

package/dist/execution/workflows/options.d.ts

@@ -0,0 +1,40 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { DurableEngine, EngineRetryPolicy } from './engine.js';
+/** Serving configuration of the durable Workflows of one deployment. */
+export interface DurableServing {
+    /** The Restate SDK Fetch build of this platform. */
+    readonly engine: DurableEngine;
+    /**
+     * @deprecated Explicit signing authority for retained callbacks registered before issuer-prefixed
+     * paths. Canonical requests discover their authority from the named Kernel and ignore these keys.
+     */
+    readonly identityKeys?: readonly string[];
+    /** Fetch capability used for HTTPS discovery of a canonical request's Kernel engine. */
+    readonly fetch?: Fetch;
+    /**
+     * How long the engine retains a finished run. At least the Host minimum (one hour or more, one
+     * day by default); the Kernel resubmits an unstarted call only within half of it. Seven days by
+     * default.
+     */
+    readonly retentionMs?: number;
+    /** Attempts of a failing run before it pauses for `resume` or `cancel`. The Host caps them. */
+    readonly retry?: {
+        readonly maxAttempts?: number;
+        readonly initialIntervalMs?: number;
+        readonly maxIntervalMs?: number;
+    };
+    /** Deadline of one Step, including its Kernel calls. One minute by default. */
+    readonly stepTimeoutMs?: number;
+}
+/** Resolve a deployment's engine only when its durable receiver is first requested. */
+export type DurableServingProvider = (request: Request) => DurableServing | undefined | Promise<DurableServing | undefined>;
+export interface AdmittedDurableServing {
+    readonly engine: DurableEngine;
+    readonly identityKeys: readonly string[];
+    readonly fetch: Fetch;
+    readonly retentionMs: number;
+    readonly retryPolicy: EngineRetryPolicy;
+    readonly stepTimeoutMs: number;
+}
+/** Capture one durable serving configuration, failing closed on any gap. */
+export declare function durableServing(input: DurableServing): AdmittedDurableServing;

package/dist/execution/workflows/options.js

@@ -0,0 +1,83 @@
+import { acceptWorkflowEngineIdentityKey } from '@astrale-os/kernel-protocol/issuer/workflow-engine';
+const HOUR_MS = 60 * 60_000;
+const DAY_MS = 24 * HOUR_MS;
+const MAXIMUM_IDENTITY_KEYS = 16;
+/** Capture one durable serving configuration, failing closed on any gap. */
+export function durableServing(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => key !== 'engine' &&
+            key !== 'identityKeys' &&
+            key !== 'fetch' &&
+            key !== 'retentionMs' &&
+            key !== 'retry' &&
+            key !== 'stepTimeoutMs')) {
+        invalid('Durable serving options are invalid.');
+    }
+    const engine = input.engine;
+    if (engine === null ||
+        typeof engine !== 'object' ||
+        typeof engine.createEndpointHandler !== 'function' ||
+        typeof engine.workflow !== 'function' ||
+        typeof engine.TerminalError !== 'function' ||
+        typeof engine.CancelledError !== 'function') {
+        invalid('Durable serving requires the Restate SDK Fetch entrypoint of this platform.');
+    }
+    const keys = input.identityKeys;
+    let identityKeys = Object.freeze([]);
+    if (keys !== undefined) {
+        if (!Array.isArray(keys) || keys.length === 0 || keys.length > MAXIMUM_IDENTITY_KEYS) {
+            invalid('Durable serving requires engine request identity keys (publickeyv1_…).');
+        }
+        // Legacy callbacks retain their original sixteen-key input budget and duplicate policy.
+        try {
+            identityKeys = Object.freeze(Array.from(keys, acceptWorkflowEngineIdentityKey));
+        }
+        catch (cause) {
+            throw new TypeError('Durable serving requires engine request identity keys (publickeyv1_…).', { cause });
+        }
+    }
+    const fetch = input.fetch ?? globalThis.fetch.bind(globalThis);
+    if (typeof fetch !== 'function')
+        invalid('Durable serving requires Fetch for engine discovery.');
+    const retry = input.retry ?? {};
+    if (retry === null ||
+        typeof retry !== 'object' ||
+        Array.isArray(retry) ||
+        Reflect.ownKeys(retry).some((key) => key !== 'maxAttempts' && key !== 'initialIntervalMs' && key !== 'maxIntervalMs')) {
+        invalid('Durable retry options are invalid.');
+    }
+    const initialInterval = bounded(retry.initialIntervalMs, 1_000, 1, HOUR_MS, 'initialIntervalMs');
+    const maxInterval = bounded(retry.maxIntervalMs, 60_000, initialInterval, DAY_MS, 'maxIntervalMs');
+    return Object.freeze({
+        engine: Object.freeze({
+            createEndpointHandler: engine.createEndpointHandler.bind(engine),
+            workflow: engine.workflow.bind(engine),
+            TerminalError: engine.TerminalError,
+            CancelledError: engine.CancelledError,
+        }),
+        identityKeys,
+        fetch,
+        retentionMs: bounded(input.retentionMs, 7 * DAY_MS, HOUR_MS, 365 * DAY_MS, 'retentionMs'),
+        retryPolicy: Object.freeze({
+            maxAttempts: bounded(retry.maxAttempts, 20, 1, 1_000, 'maxAttempts'),
+            onMaxAttempts: 'pause',
+            initialInterval,
+            maxInterval,
+            exponentiationFactor: 2,
+        }),
+        stepTimeoutMs: bounded(input.stepTimeoutMs, 60_000, 1_000, HOUR_MS, 'stepTimeoutMs'),
+    });
+}
+function bounded(input, fallback, minimum, maximum, label) {
+    if (input === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(input) || input < minimum || input > maximum) {
+        invalid(`Durable ${label} must be an integer between ${minimum} and ${maximum}.`);
+    }
+    return input;
+}
+function invalid(message) {
+    throw new TypeError(message);
+}

package/dist/execution/workflows/receiver.d.ts

@@ -0,0 +1,22 @@
+import type { RuntimeWorkflow } from '../../application/runtime/workflows.js';
+import type { Domain } from '../../platform/schema/index.js';
+import type { Identity } from '../identity/index.js';
+import type { AdmittedDurableServing } from './options.js';
+/** Serves the engine's discovery and invocations of this deployment's durable Workflows. */
+export interface DurableReceiver {
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Route `…/invoke/restate/<Kernel issuer>/<declaration key>/<service>/{discover,invoke/…}` to one
+ * engine endpoint. Retained services registered before issuer-prefixed paths keep their old
+ * `<declaration key>/<service>` route with explicit legacy signing keys. Canonical routes discover
+ * their signing authority at the named Kernel; that issuer also binds the run envelope. Each
+ * endpoint serves exactly that service with the declared Workflow. A declaration this Release does not
+ * serve durably is refused, so an endpoint never runs code it does not declare.
+ */
+export declare function createDurableReceiver(input: {
+    readonly workflows: readonly RuntimeWorkflow[];
+    readonly domain: Domain;
+    readonly identity: Identity;
+    readonly serving: AdmittedDurableServing;
+}): DurableReceiver;