@astrale-os/sdk 0.6.0-beta.1 → 0.6.0-beta.11

package/README.md

@@ -1,8 +1,8 @@
 # SDK
 
-Schema-first SDK for authoring and deploying Astrale Applications. The public surface separates
+Schema-first SDK for authoring and deploying Astrale Domains. The public surface separates
 single-step Actions, explicit multi-step Workflows, provider-neutral Integrations, concrete Providers, graph
-authoring, Application composition, Deployment, and Execution without exposing DSL callable
+authoring, Domain composition, Deployment, and Execution without exposing DSL callable
 topology in implementation files.
 
 [![CI](https://github.com/astrale-os/sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/astrale-os/sdk/actions/workflows/ci.yml)
@@ -17,7 +17,7 @@ npm install @astrale-os/sdk
 ```
 
 Zod schemas cross the SDK and Kernel compiler boundary by runtime identity. The SDK therefore
-declares one exact, non-optional Zod peer. If an Application declares Zod directly, it must use the
+declares one exact, non-optional Zod peer. If a Domain declares Zod directly, it must use the
 same exact version rather than a range; a second physical Zod runtime is not an admitted authoring
 environment.
 
@@ -67,9 +67,10 @@ original issuer discovery endpoints and keys available; unadopted instances cont
 previous bindings. Deployment readiness checks the exact new Worker version separately from issuer
 discovery. No uninstall or identity rotation is involved.
 
-At the provider-neutral release boundary, use
-`addressing('https://services.example.com', { publicUrl: 'https://services-v2.example.com' })`.
-The one-argument form continues to use the issuer as the public URL.
+At the provider-neutral release boundary, this stable-target path uses
+`addressing('https://services.example.com', { publicUrl: 'https://services-v2.example.com' })` with
+`legacy.assemble`. That split is deprecated with direct mode and goes with it: an immutable
+deployment's URL is its issuer, so `assemble(build, buildDigest, url)` takes the URL alone.
 
 ## Handler authority and dependencies
 
@@ -78,6 +79,13 @@ Authenticated handlers use Domain self authority for `kernel`, `graph`, `query`,
 with the incoming caller Grant. Explicit authority remains on `kernel` and `graph`; the former
 handler `client` is removed. See [the API and migration guide](docs/handler-dependencies.md).
 
+## Durable Workflows
+
+A callable declared with `execution: { durable: true }` is implemented by `defineWorkflow` and runs
+on the Kernel's workflow engine: a call returns its `K.Execution` at once, and the run survives
+restarts with journaled Steps, durable timers and signals. Serve it with `serve({ durable })`. See
+[the durable Workflow guide](docs/durable-workflows.md).
+
 ## Node Class icons
 
 Every Node Class authored through the SDK must explicitly declare a self-contained SVG icon.
@@ -128,7 +136,7 @@ Error declarations are not yet published in the installed Kernel Schema.
 ### Core Identity requirements
 
 Use `requirements({ core: [{ subject, functions, classes, authority }] })` to declare capabilities
-for an Identity in the Application's local Core. `subject` is the resolved Core Node; each entry
+for an Identity in the Domain's local Core. `subject` is the resolved Core Node; each entry
 must request at least one capability. The top-level `functions`, `classes`, and `authority` members
 describe capabilities for the Domain principal.
 
@@ -213,6 +221,21 @@ Disabled rules are skipped before evaluation and remain visible in lint coverage
 project rule disable does not bypass generic Oxlint, project admission, type-universe checks, or
 linter tool failures.
 
+A committed tree that is not Domain source, such as client mockups or a preview harness, can be
+excluded from `astrale-domain lint` with root-relative globs:
+
+```json
+{
+  "ignore": ["mockups/**", "prototypes/**"]
+}
+```
+
+Ignored paths are pruned before discovery: they are never read, parsed, counted against source
+limits, included in the source snapshot digest, or passed to generic Oxlint. Each glob starts with a
+literal root entry and may use `*` and `?` within a segment and `**` as a whole segment; a matched
+directory excludes everything below it. A glob that would cover a declared layer (including a
+remapped `sourcePath`) or a governed root file is rejected, so `ignore` cannot bypass the layout.
+
 Structured review [issues](issues/README.md) retain observation-first evidence and later governance
 attachments without becoming current contract authority.
 
@@ -246,6 +269,96 @@ URL, size, and ETag checks. Concurrent publication and snapshot observations sha
 cancelling one observer does not cancel another. `session.snapshot()` remains the complete,
 coherent Publication, bundle, and View catalog observation.
 
+## Headless scripts and Domain callables
+
+Function admission requires the principal itself to be able to use the Function. A credential
+minted for a user or key, such as `astrale token`, carries that identity as principal: it passes
+Kernel callables, but a Domain callable that the identity reaches only through a Policy fails with
+`2004`. The Session `exchange` option presents each Domain callable with a credential its declaring
+Domain exchanged for the caller instead. The Domain becomes the principal, and the Policy is still
+evaluated against the caller. Kernel callables, including graph reads and writes, keep the source
+credential.
+
+```ts
+import { connect, createSessionCredentialProvider } from '@astrale-os/sdk/client/session'
+
+const session = connect({
+  url: 'https://instance.example/api',
+  auth: createSessionCredentialProvider({
+    ttlSeconds: 60,
+    // Return { credential, expiresAt } with expiresAt in Unix milliseconds.
+    mint: (signal) => mintSourceCredential(signal),
+  }),
+  exchange: {},
+})
+
+await session.call({ target: '/:orders.example:class.Order:create', input }) // Domain callable
+await session.graph.get('@order-id') // Kernel callable: the source credential
+```
+
+- **Hold the source in a provider.** Domain credentials are cached per source credential, so a
+  `resolve` that returns a new token on every call also exchanges on every call. The provider also
+  lets the Session renew a source that is too close to expiry to feed a Domain credential.
+- **Lifetimes.** `exchange.ttlSeconds` (default 300) must exceed the provider's `ttlSeconds` plus a
+  5-second settlement skew. A Domain credential never outlives its source.
+- **Reading as a Domain.** To call Kernel callables as a Domain, for example to read Shell-owned
+  Classes, feed a second Session from an explicit exchange:
+  `createSessionCredentialProvider({ ttlSeconds: 60, mint: (signal) => session.exchange(shellIssuer, { signal }) })`.
+  `session.exchange(issuer)` caches nothing.
+- **Current identity.** Use `session.auth.whoami()`; `@self` is a CLI shorthand.
+- **Failures.** A failed exchange raises `ExchangeError` from `@astrale-os/sdk/client`. Its
+  `failure` names the reason (`discovery`, `unsupported`, `unavailable`, `rejected`,
+  `invalid-response` or `source-exhausted`); a `rejected` error carries the Domain's public error
+  as its cause. Branch on `failure`, not on the message.
+
+| Credential presented | Principal | Kernel callable | Domain callable reached by Policy |
+| --- | --- | --- | --- |
+| Source credential (minted or key) | the identity | ✅ | ❌ `2004`, unless the identity holds `can_use` on it through a Group |
+| Session with `exchange` | the declaring Domain, for Domain callables | ✅ with the source credential | ✅ Policy evaluated against the identity |
+| `session.exchange(issuer)` held by a second Session | that Domain | ✅ as that Domain | only what that Domain may use |
+
+## Deployment addresses
+
+`@astrale-os/sdk/deployment/address` derives the one immutable URL of a deployment,
+`https://<line>-<content>.<routingDomain>`, from its inputs alone. Whoever deploys and whoever
+hosts compute it with the same pure, runtime-safe functions, so a host can refuse an address it
+did not derive.
+
+- **Line.** `deploymentLine({ origin, environment, addressing })` is shared by every deployment of
+  an origin in an environment. Its 16-character fingerprint, the first 80 bits of
+  `sha256(origin ‖ 0x00 ‖ environment)` in base32, makes it unique. A `readable` line (platform
+  Domains) prefixes it with a cosmetic part, so `agencies.example.com` in `staging` gives
+  `agencies-staging-354iwg4avm6wdmrs`. An `opaque` line (tenant Domains) is the fingerprint alone.
+- **Content.** `deploymentContent(buildDigest, configuration)` covers the build and the
+  `FrozenConfigurationV1`: the plain variables and execution settings (with the durable Workflow
+  options, when declared), the services and dispatch namespaces it binds, and the names of the
+  bound secrets, never their values. A changed variable or binding gives another URL, and a rotated
+  secret keeps the URL. `configurationDigest` gives the full digest that a deployment record keeps. It checks
+  canonical form only: the host refuses settings no Worker runs under when it encodes
+  `ASTRALE_SETTINGS` (`encodeWorkerSettings`), before it uploads anything.
+- **Label.** `deploymentLabel(line, content)` is at most 57 characters. `DEPLOYMENT_LABEL`
+  recognizes it, never a legacy UUID or stable Worker name, and `parseDeploymentLabel` splits it
+  and refuses anything longer than 57 characters.
+- **Record.** `acceptDeploymentRecord` admits a `DeploymentRecordV1` only when its provider
+  script is the label that its own fields derive. A host admits the record a deploy declares with
+  it before storing it, so every stored record decodes.
+
+```ts
+import {
+  deploymentContent,
+  deploymentLabel,
+  deploymentLine,
+  deploymentUrl,
+} from '@astrale-os/sdk/deployment/address'
+
+const line = deploymentLine({ origin, environment, addressing: 'opaque' })
+const url = deploymentUrl(deploymentLabel(line, deploymentContent(build, configuration)), routingDomain)
+```
+
+`@astrale-os/sdk/deployment/address/vectors` holds the conformance vectors: Worker uploads and
+configurations with the manifest, build digest, label and URL each one gives. Every host that
+recomputes an address tests against them.
+
 ## License
 
 Apache License 2.0 — see [LICENSE](LICENSE) for details.
@@ -268,10 +381,13 @@ routes: {
 ```
 
 These requirements are publication metadata, so changing them updates the publication ETag without
-changing the Application's business Schema. They require the `shell` handshake. Origins must use
+changing the Domain's business Schema. They require the `shell` handshake. Origins must use
 HTTPS without credentials, paths, queries, fragments, or wildcards; authoring normalizes and sorts
 them. Supporting hosts admit them per mount and execute the existing `browser.openExternal`
 intent. Nested Views cannot expand their parent's grant.
 
 For the unified authentication facade and coordinated consumer update, see
 [the Auth API migration guide](docs/auth-api-migration.md).
+
+The authored composition formerly called an Application is now a Domain definition: see
+[the Domain definition migration guide](docs/domain-definition-migration.md).

package/dist/application/action/action.d.ts

@@ -29,6 +29,12 @@ export type ActionAddressOf<Callable> = Callable extends {
 export type ResolvedDomainOf<Schema extends schema.DomainSchema> = Extract<schema.DomainOf<Schema>, Domain>;
 /** SDK Action address derived mechanically from the canonical local callable key. */
 export type ActionAddress<Schema extends schema.DomainSchema> = ActionAddressOf<LocalCallable<ResolvedDomainOf<Schema>>>;
+/** Address of a callable an Action may implement: a durable callable needs a Workflow. */
+export type ImmediateActionAddress<Schema extends schema.DomainSchema> = ActionAddressOf<Exclude<LocalCallable<ResolvedDomainOf<Schema>>, {
+    readonly execution: {
+        readonly durable: true;
+    };
+}>>;
 export type CallableAtAddress<Schema extends schema.DomainSchema, Address extends string> = LocalCallable<ResolvedDomainOf<Schema>> extends infer Callable ? Callable extends unknown ? ActionAddressOf<Callable> extends Address ? Callable : never : never : never;
 export type Action<Callable extends ResolvedCallable, Definitions extends Integrations = Readonly<Record<never, never>>, DomainValue extends Domain = Domain, Errors extends DeclaredErrors = NoDeclaredErrors> = (context: ActionContext<Callable, DomainValue, Definitions, Errors>) => Promise<ActionOutputOf<Callable>>;
 declare const ACTION_SCHEMA: unique symbol;

package/dist/application/action/authoring.d.ts

@@ -1,5 +1,5 @@
 export { defineAction } from './define.js';
 export type { Action, ActionDefinition } from './action.js';
-export type { ActionContext, ActionExecution, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, } from './context.js';
+export type { ActionContext, ActionBinaryInput, ActionExecution, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/action/context.d.ts

@@ -1,7 +1,7 @@
 import type { AuthenticationEvidence, Grant, IdentityId } from '../../platform/auth/index.js';
 import type { BoundClientSession } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
-import type { CallableInputOf, Domain, ResolvedFunction, ResolvedMethod } from '../../platform/schema/index.js';
+import type { CallableInputOf, CallableInputModeOf, Domain, ResolvedFunction, ResolvedMethod } from '../../platform/schema/index.js';
 import type { HandlerDependencies } from '../dependency/index.js';
 import type { DeclaredErrorFactory, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { IntegrationClients, Integrations } from '../integration/index.js';
@@ -34,6 +34,16 @@ export interface ActionExecution {
         body(): Uint8Array;
     };
 }
+/** One admitted, single-consumer binary Function request body. */
+export interface ActionBinaryInput {
+    readonly body: ReadableStream<Uint8Array>;
+    readonly length: number;
+}
+type BinaryInputOf<Callable> = CallableInputModeOf<Callable> extends 'binary' ? {
+    readonly body: ActionBinaryInput;
+} : {
+    readonly body?: never;
+};
 export interface DomainGraphExecutor<DomainValue extends Domain = Domain> {
     readonly query: QueryExecutor<DomainValue>;
     readonly mutate: MutationExecutor<DomainValue>;
@@ -83,5 +93,5 @@ export type ActionContext<Callable extends ResolvedCallable, DomainValue extends
     readonly execution: ActionExecution;
     /** Construct one implementation-declared safe business error for `throw error(...)`. */
     readonly error: DeclaredErrorFactory<Errors>;
-} & AuthorityOf<Callable, DomainValue> & SelfOf<Callable>;
+} & AuthorityOf<Callable, DomainValue> & SelfOf<Callable> & BinaryInputOf<Callable>;
 export {};

package/dist/application/action/define.d.ts

@@ -1,12 +1,12 @@
 import type { schema } from '../../platform/schema/index.js';
 import type { DeclaredErrorOptions, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
-import type { Action, ActionAddress, ActionDefinition, CallableAtAddress, ResolvedDomainOf } from './action.js';
+import type { Action, ActionDefinition, CallableAtAddress, ImmediateActionAddress, ResolvedDomainOf } from './action.js';
 import type { ResolvedCallable } from './context.js';
 /** Define one simple single-step implementation by its SDK Action address. */
 export declare function defineAction<Schema extends schema.DomainSchema, Definitions extends Integrations = Readonly<Record<never, never>>>(): {
-    <const Address extends ActionAddress<Schema>>(address: Address, run: Action<Extract<CallableAtAddress<Schema, Address>, ResolvedCallable>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): ActionDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
-    <const Address extends ActionAddress<Schema>, const Errors extends DeclaredErrors>(address: Address, options: DeclaredErrorOptions<Errors>, run: Action<Extract<CallableAtAddress<Schema, Address>, ResolvedCallable>, Definitions, ResolvedDomainOf<Schema>, Errors>): ActionDefinition<Schema, Address, Definitions, Errors>;
+    <const Address extends ImmediateActionAddress<Schema>>(address: Address, run: Action<Extract<CallableAtAddress<Schema, Address>, ResolvedCallable>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): ActionDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
+    <const Address extends ImmediateActionAddress<Schema>, const Errors extends DeclaredErrors>(address: Address, options: DeclaredErrorOptions<Errors>, run: Action<Extract<CallableAtAddress<Schema, Address>, ResolvedCallable>, Definitions, ResolvedDomainOf<Schema>, Errors>): ActionDefinition<Schema, Address, Definitions, Errors>;
 };
 /** True only for an Action produced by defineAction in this SDK package root. */
 export declare function isAction(input: unknown): input is ActionDefinition;

package/dist/application/action/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAction, isAction } from './define.js';
 export type { Action, ActionAddress, ActionAddressOf, ActionDefinition, CallableAtAddress, LocalCallable, ResolvedDomainOf, } from './action.js';
-export type { ActionContext, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
+export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/define.d.ts

@@ -1,16 +1,16 @@
 import type { schema } from '../platform/schema/index.js';
-import type { Application } from './application.js';
+import type { DomainDefinition } from './domain.js';
 import type { Requirements } from './requirements/index.js';
 import type { Routes } from './routes/index.js';
 import type { Runtime } from './runtime/index.js';
 import type { Frontend } from './view/index.js';
-export interface ApplicationInput<Schema extends schema.DomainSchema, RuntimeValue extends Runtime<Schema>, FrontendValue extends Frontend<Schema> | undefined, RoutesValue extends Routes | undefined, RequirementsValue extends Requirements | undefined> {
+export interface DomainDefinitionInput<Schema extends schema.DomainSchema, RuntimeValue extends Runtime<Schema>, FrontendValue extends Frontend<Schema> | undefined, RoutesValue extends Routes | undefined, RequirementsValue extends Requirements | undefined> {
     readonly schema: Schema;
     readonly runtime: RuntimeValue;
     readonly frontend?: FrontendValue;
     readonly routes?: RoutesValue;
     readonly requirements?: RequirementsValue;
 }
-/** Capture one inert authored Application without resolving, compiling, loading, or deploying it. */
-export declare function defineApplication<const Schema extends schema.DomainSchema, const RuntimeValue extends Runtime<Schema>, const FrontendValue extends Frontend<Schema> | undefined = undefined, const RoutesValue extends Routes | undefined = undefined, const RequirementsValue extends Requirements | undefined = undefined>(input: ApplicationInput<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>): Application<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>;
-export declare function isApplication(input: unknown): input is Application;
+/** Capture one inert authored Domain without resolving, compiling, loading, or deploying it. */
+export declare function defineDomain<const Schema extends schema.DomainSchema, const RuntimeValue extends Runtime<Schema>, const FrontendValue extends Frontend<Schema> | undefined = undefined, const RoutesValue extends Routes | undefined = undefined, const RequirementsValue extends Requirements | undefined = undefined>(input: DomainDefinitionInput<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>): DomainDefinition<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>;
+export declare function isDomainDefinition(input: unknown): input is DomainDefinition;

package/dist/application/define.js

@@ -2,39 +2,39 @@ import { isRequirements } from './requirements/index.js';
 import { isRoutes } from './routes/index.js';
 import { isRuntime } from './runtime/index.js';
 import { isFrontend } from './view/index.js';
-const admittedApplications = new WeakSet();
-/** Capture one inert authored Application without resolving, compiling, loading, or deploying it. */
-export function defineApplication(input) {
+const admittedDomainDefinitions = new WeakSet();
+/** Capture one inert authored Domain without resolving, compiling, loading, or deploying it. */
+export function defineDomain(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
     const allowed = new Set(['schema', 'runtime', 'frontend', 'routes', 'requirements']);
     if (Reflect.ownKeys(input).some((key) => !allowed.has(key)))
         invalid();
     if (!isRuntime(input.runtime))
-        throw new TypeError('Application Runtime is not admitted.');
+        throw new TypeError('Domain Runtime is not admitted.');
     if (input.frontend !== undefined &&
         (!isFrontend(input.frontend) || input.frontend.schema !== input.schema)) {
-        throw new TypeError('Application Frontend is not admitted for its exact Schema.');
+        throw new TypeError('Domain Frontend is not admitted for its exact Schema.');
     }
     if (input.routes !== undefined && !isRoutes(input.routes)) {
-        throw new TypeError('Application routes are not admitted.');
+        throw new TypeError('Domain routes are not admitted.');
     }
     if (input.requirements !== undefined && !isRequirements(input.requirements)) {
-        throw new TypeError('Application requirements are not admitted.');
+        throw new TypeError('Domain requirements are not admitted.');
     }
-    const application = Object.freeze({
+    const domain = Object.freeze({
         schema: input.schema,
         runtime: input.runtime,
         ...(input.frontend === undefined ? {} : { frontend: input.frontend }),
         ...(input.routes === undefined ? {} : { routes: input.routes }),
         ...(input.requirements === undefined ? {} : { requirements: input.requirements }),
     });
-    admittedApplications.add(application);
-    return application;
+    admittedDomainDefinitions.add(domain);
+    return domain;
 }
-export function isApplication(input) {
-    return input !== null && typeof input === 'object' && admittedApplications.has(input);
+export function isDomainDefinition(input) {
+    return input !== null && typeof input === 'object' && admittedDomainDefinitions.has(input);
 }
 function invalid() {
-    throw new TypeError('Application definition may contain only schema, runtime, frontend, routes, and requirements.');
+    throw new TypeError('Domain definition may contain only schema, runtime, frontend, routes, and requirements.');
 }

package/dist/application/dependency/index.d.ts

@@ -1 +1 @@
-export type { DependencyCallOptions, DependencyInvoker, HandlerDependencies } from './invoker.js';
+export type { DependencyBinaryCallOptions, DependencyCallOptions, DependencyInvoker, HandlerDependencies, } from './invoker.js';

package/dist/application/dependency/invoker.d.ts

@@ -1,18 +1,23 @@
 import type { Binary, Input } from '../../platform/client/index.js';
-import type { SessionRequestOptions } from '../../platform/client/session/index.js';
+import type { SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
-import type { CallableInputOf, CallableOutputOf, CallableResultOf, Domain, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
+import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
 import type { LocalCallable } from '../action/index.js';
-export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey'>;
+export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey' | 'body'>;
+export type DependencyBinaryCallOptions = Pick<SessionRequestOptionsWithBody, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 type InstanceMethodOf<D extends Domain> = Extract<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
 type FunctionOrStaticMethodOf<D extends Domain> = Exclude<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
+type WithInputMode<C, Mode extends 'value' | 'binary'> = C extends unknown ? CallableInputModeOf<C> extends Mode ? C : never : never;
+type ValueFunctionOrStaticMethodOf<D extends Domain> = WithInputMode<FunctionOrStaticMethodOf<D>, 'value'>;
+type BinaryFunctionOf<D extends Domain> = WithInputMode<Extract<LocalCallable<D>, ResolvedFunction>, 'binary'>;
 type DependencyInputOf<C> = C extends unknown ? unknown extends CallableInputOf<C> ? Input : [CallableInputOf<C>] extends [void] ? undefined : CallableInputOf<C> : never;
 type DependencyResultOf<C> = unknown extends CallableOutputOf<C> ? unknown : CallableResultOf<C, Binary>;
 /** One declared dependency, bound to one explicitly selected invocation authority. */
 export interface DependencyInvoker<D extends Domain> {
     readonly invoke: {
-        <const C extends FunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends ValueFunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
         <const C extends InstanceMethodOf<D>>(select: (domain: D) => C, instance: NodeId, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends BinaryFunctionOf<D>>(select: (domain: D) => C, metadata: NoInfer<DependencyInputOf<C>>, options: DependencyBinaryCallOptions): Promise<DependencyResultOf<C>>;
     };
 }
 /**

package/dist/application/domain.d.ts

@@ -0,0 +1,28 @@
+import type { schema } from '../platform/schema/index.js';
+import type { Requirements } from './requirements/index.js';
+import type { Routes } from './routes/index.js';
+import type { Runtime, SchemaOfRuntime as RuntimeSchemaOf } from './runtime/index.js';
+import type { Frontend } from './view/index.js';
+declare const DOMAIN_DEFINITION_IDENTITY: unique symbol;
+declare const DOMAIN_DEFINITION_SCHEMA: unique symbol;
+/** Schema-independent type witness shared by every admitted Domain definition. */
+export interface DomainDefinitionIdentity {
+    readonly [DOMAIN_DEFINITION_IDENTITY]: true;
+}
+/** Inert source/build composition of one Domain: its exact Schema and authored Runtime. */
+export interface DomainDefinition<Schema extends schema.DomainSchema = schema.DomainSchema, RuntimeValue extends Runtime<Schema> = Runtime<Schema>, FrontendValue extends Frontend<Schema> | undefined = undefined, RoutesValue extends Routes | undefined = undefined, RequirementsValue extends Requirements | undefined = undefined> extends DomainDefinitionIdentity {
+    readonly schema: Schema;
+    readonly runtime: RuntimeValue;
+    readonly frontend?: FrontendValue;
+    readonly routes?: RoutesValue;
+    readonly requirements?: RequirementsValue;
+    readonly [DOMAIN_DEFINITION_SCHEMA]: (schema: Schema) => Schema;
+}
+export type SchemaOfDomainDefinition<Value> = Value extends {
+    readonly schema: infer Schema;
+} ? Extract<Schema, schema.DomainSchema> : never;
+export type RuntimeOfDomainDefinition<Value> = Value extends {
+    readonly runtime: infer RuntimeValue;
+} ? Extract<RuntimeValue, Runtime> : never;
+export type SchemaOfRuntime<Value> = RuntimeSchemaOf<Value>;
+export {};

package/dist/application/index.d.ts

@@ -1,9 +1,9 @@
-export { defineApplication, isApplication } from './define.js';
-export type { ApplicationInput } from './define.js';
+export { defineDomain, isDomainDefinition } from './define.js';
+export type { DomainDefinitionInput } from './define.js';
 export { requirements } from './requirements/index.js';
 export type { AuthorityRequirements, AuthorityRequirementsInput, ClassOperation, ClassRequirement, ClassRequirementInput, CoreRequirement, CoreRequirementInput, FunctionRequirementTarget, Requirements, RequirementsInput, } from './requirements/index.js';
 export { route, routes } from './routes/index.js';
 export type { Route, RouteInput, RouteTarget, Routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';
 export type { Frontend, FrontendInput, FrontendSource, IframeRequirements, ViewHostRequirements, } from './view/index.js';
-export type { Application, ApplicationIdentity, RuntimeOfApplication, SchemaOfApplication, SchemaOfRuntime, } from './application.js';
+export type { DomainDefinition, DomainDefinitionIdentity, RuntimeOfDomainDefinition, SchemaOfDomainDefinition, SchemaOfRuntime, } from './domain.js';

package/dist/application/index.js

@@ -1,4 +1,4 @@
-export { defineApplication, isApplication } from './define.js';
+export { defineDomain, isDomainDefinition } from './define.js';
 export { requirements } from './requirements/index.js';
 export { route, routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';

package/dist/application/mutation/authoring/properties.d.ts

@@ -1,9 +1,11 @@
 import type { MutationPropsInput } from '@astrale-os/kernel-core/graph/mutate';
 import type { PropertyInputOf, ResolvedClass, ResolvedProperty } from '@astrale-os/kernel-dsl/v1';
+import { PropertyValues } from '@astrale-os/kernel-dsl/v1/language';
+import type { StoredPropertyInputOf } from '../../../platform/schema/property-input.js';
 export type RichPropertyInput<Class> = PropertyInputOf<Class>;
 export type RichPropertyName<Class> = Extract<keyof PropertyInputOf<Class>, string>;
 export interface RichPropertyConditions<Class> {
-    readonly equals?: RichPropertyInput<Class>;
+    readonly equals?: StoredPropertyInputOf<Class>;
     readonly absent?: readonly RichPropertyName<Class>[];
 }
 export interface RichPropertyDelta<Class> {
@@ -12,11 +14,11 @@ export interface RichPropertyDelta<Class> {
 }
 export declare function properties<Class extends ResolvedClass>(selected: Class, input: RichPropertyInput<Class>): MutationPropsInput;
 export declare function conditions<Class extends ResolvedClass>(selected: Class, input: RichPropertyConditions<Class>): Readonly<{
-    equals?: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/value").Value>> | undefined;
+    equals?: PropertyValues | undefined;
     absent?: readonly `${string}:class.${string}.property.${string}`[] | undefined;
 }>;
 export declare function delta<Class extends ResolvedClass>(selected: Class, input: RichPropertyDelta<Class>): Readonly<{
-    set: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/value").Value>>;
+    set: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/v1/language").PropertyValue>>;
     unset: readonly `${string}:class.${string}.property.${string}`[];
 }>;
 export declare function resolvedProperty<Class extends ResolvedClass>(selected: Class, name: RichPropertyName<Class>): ResolvedProperty;

package/dist/application/mutation/authoring/properties.js

@@ -1,10 +1,39 @@
 import { PropertyKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import { PropertyValues } from '@astrale-os/kernel-dsl/v1/language';
 export function properties(selected, input) {
-    return selected.properties.from(input);
+    const ordinary = Object.create(null);
+    const receipts = [];
+    const sources = new Map();
+    for (const [name, value] of Object.entries(input)) {
+        const property = resolvedProperty(selected, name);
+        const previous = sources.get(property.key);
+        if (previous !== undefined) {
+            throw new TypeError(`Property ${property.key} is supplied through both ${JSON.stringify(previous)} and ${JSON.stringify(name)}.`);
+        }
+        sources.set(property.key, name);
+        if (isBlobProperty(property)) {
+            if (typeof value !== 'string') {
+                throw new TypeError(`Blob Property ${property.key} requires an upload receipt.`);
+            }
+            receipts.push([property.key, value]);
+        }
+        else {
+            ordinary[name] = value;
+        }
+    }
+    // Blob receipts are admitted by the Kernel executor. A property's ordinary validator expects
+    // the stored Ref, so run it only for ordinary write values before combining the two sets.
+    const admitted = selected.properties.from(ordinary);
+    return receipts.length === 0
+        ? admitted
+        : PropertyValues.create([
+            ...Object.entries(admitted).map(([key, value]) => [PropertyKey(key), value]),
+            ...receipts,
+        ]);
 }
 export function conditions(selected, input) {
     return Object.freeze({
-        ...(input.equals === undefined ? {} : { equals: properties(selected, input.equals) }),
+        ...(input.equals === undefined ? {} : { equals: selected.properties.from(input.equals) }),
         ...(input.absent === undefined
             ? {}
             : {
@@ -12,6 +41,10 @@ export function conditions(selected, input) {
             }),
     });
 }
+function isBlobProperty(property) {
+    const contract = property.definition.schema;
+    return (contract !== null && typeof contract === 'object' && contract['x-astrale-value-kind'] === 'blob');
+}
 export function delta(selected, input) {
     return Object.freeze({
         set: properties(selected, input.set ?? {}),

package/dist/application/mutation/authoring/transition.js

@@ -49,7 +49,10 @@ export function authorStateTransition(core, input) {
         class: selectedClassKey,
         props: conditions(selectedClass, {
             ...(suppliedAbsent === undefined ? {} : { absent: suppliedAbsent }),
-            equals: { ...suppliedEquals, ...from },
+            equals: {
+                ...suppliedEquals,
+                ...from,
+            },
         }),
     });
     core.updateNode({

package/dist/application/routes/admission.d.ts

@@ -1,5 +1,5 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 import type { RuntimeRegistry } from '../runtime/index.js';
 import type { Routes } from './collection.js';
 /** Lower recipe identities to canonical callable keys after Runtime admission. */
-export declare function admit(input: Routes | undefined, registry: RuntimeRegistry): readonly publication.HttpRouteDeclaration[];
+export declare function admit(input: Routes | undefined, registry: RuntimeRegistry): readonly release.HttpRouteDeclaration[];

package/dist/application/routes/admission.js

@@ -4,7 +4,7 @@ export function admit(input, registry) {
     if (input === undefined)
         return Object.freeze([]);
     if (!isRoutes(input))
-        throw new TypeError('Application routes are not admitted.');
+        throw new TypeError('Domain routes are not admitted.');
     return Object.freeze(input.entries.map(({ target, ...declaration }) => {
         const implementation = registry.implementations.find(({ definition }) => definition === target);
         if (implementation === undefined) {

package/dist/application/routes/route.d.ts

@@ -1,9 +1,9 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 export interface RouteTarget {
     readonly kind: 'action' | 'workflow';
     readonly address: string;
 }
-export type RouteInput = Omit<publication.HttpRouteDeclaration, 'callable'>;
+export type RouteInput = Omit<release.HttpRouteDeclaration, 'callable'>;
 /** One provider-neutral HTTP route targeting an admitted Action or Workflow recipe. */
 export interface Route<Target extends RouteTarget = RouteTarget> extends RouteInput {
     readonly target: Target;

package/dist/application/runtime/actions.js

@@ -16,6 +16,9 @@ export function admitActions(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Action ${definition.address} is not root-local and executable.`);
         }
+        if (callable.execution?.durable === true) {
+            throw new TypeError(`Runtime Action ${definition.address} is durable; implement it with defineWorkflow.`);
+        }
         return Object.freeze({
             kind: 'action',
             address: definition.address,

package/dist/application/runtime/workflows.d.ts

@@ -6,6 +6,8 @@ export interface RuntimeWorkflow {
     readonly address: string;
     readonly callable: ResolvedCallable;
     readonly definition: WorkflowDefinition;
+    /** Declared `execution: { durable: true }`: runs on the workflow engine, never inline. */
+    readonly durable: boolean;
 }
 /** Associate admitted Workflows with their exact authenticated value callables. */
 export declare function admitWorkflows(callables: readonly RuntimeCallable[], input: unknown): readonly RuntimeWorkflow[];

package/dist/application/runtime/workflows.js

@@ -22,11 +22,16 @@ export function admitWorkflows(callables, input) {
         if (callable.output.mode !== 'value') {
             throw new TypeError(`Runtime Workflow ${definition.address} must have value output.`);
         }
+        const durable = callable.execution?.durable === true;
+        if (!durable && definition.compat !== undefined) {
+            throw new TypeError(`Runtime Workflow ${definition.address} declares compat but its callable is not durable.`);
+        }
         return Object.freeze({
             kind: 'workflow',
             address: definition.address,
             callable,
             definition,
+            durable,
         });
     });
     return Object.freeze(workflows);

package/dist/application/workflow/authoring.d.ts

@@ -1,4 +1,5 @@
 export { defineWorkflow } from './define.js';
-export type { WorkflowContext } from './context.js';
-export type { Workflow, WorkflowAddress, WorkflowDefinition } from './workflow.js';
+export type { InlineWorkflowContext, WorkflowContext } from './context.js';
+export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableWorkflowContext, } from './durable.js';
+export type { Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';