@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.15

package/dist/deployment/verify/readiness/fetch.d.ts

@@ -0,0 +1,13 @@
+export type ReadinessFetch = (input: string, init: {
+    readonly redirect: 'error';
+    readonly signal?: AbortSignal;
+}) => Promise<Response>;
+export interface ReadinessOptions {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}
+export declare const MAXIMUM_DOCUMENT_BYTES: number;
+export declare const MAXIMUM_BUNDLE_BYTES: number;
+export declare function fetchRequired(fetcher: ReadinessFetch, url: string, signal: AbortSignal | undefined): Promise<Response>;
+export declare function bounded(response: Response, url: string, maximum: number): Promise<ArrayBuffer>;
+export declare function text(response: Response, url: string, maximum: number): Promise<string>;

package/dist/deployment/verify/readiness/fetch.js

@@ -0,0 +1,26 @@
+export const MAXIMUM_DOCUMENT_BYTES = 1024 * 1024;
+export const MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
+export async function fetchRequired(fetcher, url, signal) {
+    const response = await fetcher(url, {
+        redirect: 'error',
+        ...(signal === undefined ? {} : { signal }),
+    });
+    if (!response.ok)
+        throw new Error(`GET ${url} returned ${response.status}.`);
+    return response;
+}
+export async function bounded(response, url, maximum) {
+    const bytes = await response.arrayBuffer();
+    if (bytes.byteLength > maximum)
+        throw new Error(`GET ${url} exceeded ${maximum} bytes.`);
+    return bytes;
+}
+export async function text(response, url, maximum) {
+    const bytes = await bounded(response, url, maximum);
+    try {
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);
+    }
+    catch (cause) {
+        throw new Error(`GET ${url} returned invalid UTF-8.`, { cause });
+    }
+}

package/dist/deployment/verify/readiness/identity.d.ts

@@ -1,7 +1,4 @@
-import type { Addressing } from '../../release/index.js';
-import type { ReadinessFetch } from './publication.js';
+import type { IssuerId } from '../../../platform/auth/index.js';
+import type { ReadinessOptions } from './fetch.js';
 /** Verify issuer discovery and at least one admitted signing key at the serving identity. */
-export declare function verifyIdentity(addressing: Addressing, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<void>;
+export declare function verifyIdentity(serving: IssuerId, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/identity.js

@@ -1,10 +1,10 @@
 import { issuer } from '@astrale-os/kernel-protocol';
 const MAXIMUM_IDENTITY_BYTES = 256 * 1024;
 /** Verify issuer discovery and at least one admitted signing key at the serving identity. */
-export async function verifyIdentity(addressing, options = {}) {
+export async function verifyIdentity(serving, options = {}) {
     const fetcher = options.fetch ?? globalThis.fetch;
-    const configurationUrl = new URL(issuer.paths(addressing.issuer).configuration, addressing.issuer);
-    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), addressing.issuer);
+    const configurationUrl = new URL(issuer.paths(serving).configuration, serving);
+    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), serving);
     const keys = issuer.acceptKeySet(await json(fetcher, configuration.jwks_uri, options.signal), configuration.id_token_signing_alg_values_supported);
     if (keys.keys.length === 0)
         throw new Error('Serving issuer publishes no signing keys.');

package/dist/deployment/verify/readiness/index.d.ts

@@ -1,10 +1,14 @@
-import type { Release } from '../../release/legacy/index.js';
-import type { ReadinessFetch } from './publication.js';
+import type { Release } from '../../release/index.js';
+import type * as legacy from '../../release/legacy/index.js';
+import type { ReadinessOptions } from './fetch.js';
 export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication, type ReadinessFetch } from './publication.js';
-/** Read-only verification of one exact live Release and serving identity. */
-export declare function readiness(release: Release, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<void>;
+export type { ReadinessFetch, ReadinessOptions } from './fetch.js';
+export { verifyPublication } from './legacy/index.js';
+export { verifyRelease } from './release.js';
+/**
+ * Read-only verification of one exact live Release and its serving identity: an immutable
+ * deployment's `release.json` (release digest and build digest), or a stable target's
+ * `domain.json` (deprecated, `legacy/`).
+ */
+export declare function readiness(release: Release | legacy.Release, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/index.js

@@ -1,10 +1,21 @@
 import { verifyIdentity } from './identity.js';
-import { verifyPublication } from './publication.js';
+import { verifyPublication } from './legacy/index.js';
+import { verifyRelease } from './release.js';
 export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication } from './publication.js';
-/** Read-only verification of one exact live Release and serving identity. */
+export { verifyPublication } from './legacy/index.js';
+export { verifyRelease } from './release.js';
+/**
+ * Read-only verification of one exact live Release and its serving identity: an immutable
+ * deployment's `release.json` (release digest and build digest), or a stable target's
+ * `domain.json` (deprecated, `legacy/`).
+ */
 export async function readiness(release, options = {}) {
+    if (release.kind === 'release') {
+        await verifyRelease(release, options);
+        await verifyIdentity(release.url, options);
+        return;
+    }
     await verifyPublication(release, options);
-    await verifyIdentity(release.addressing, options);
+    await verifyIdentity(release.addressing.issuer, options);
 }

package/dist/deployment/verify/readiness/legacy/index.d.ts

@@ -0,0 +1,2 @@
+/** @deprecated Stable-target readiness at `domain.json`; see `publication.ts` (removal D10). */
+export { verifyPublication } from './publication.js';

package/dist/deployment/verify/readiness/legacy/index.js

@@ -0,0 +1,2 @@
+/** @deprecated Stable-target readiness at `domain.json`; see `publication.ts` (removal D10). */
+export { verifyPublication } from './publication.js';

package/dist/deployment/verify/readiness/legacy/publication.d.ts

@@ -0,0 +1,12 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import type * as legacy from '../../../release/legacy/index.js';
+import type { ReadinessOptions } from '../fetch.js';
+/**
+ * Fetch and verify the exact live Publication and Bundle a stable target serves at `domain.json`.
+ *
+ * @deprecated Replacement: `verifyRelease`, the readiness of an immutable deployment at
+ * `release.json` (release digest and build digest). Consumer: the direct-mode deploy path of
+ * adapter-cloudflare (the consumers of `deployment/release/legacy/index.ts`).
+ * Removal: D10, with that path.
+ */
+export declare function verifyPublication(release: legacy.Release, options?: ReadinessOptions): Promise<publication.Publication>;

package/dist/deployment/verify/readiness/legacy/publication.js

@@ -0,0 +1,23 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import { bounded, fetchRequired, MAXIMUM_BUNDLE_BYTES, MAXIMUM_DOCUMENT_BYTES, text, } from '../fetch.js';
+/**
+ * Fetch and verify the exact live Publication and Bundle a stable target serves at `domain.json`.
+ *
+ * @deprecated Replacement: `verifyRelease`, the readiness of an immutable deployment at
+ * `release.json` (release digest and build digest). Consumer: the direct-mode deploy path of
+ * adapter-cloudflare (the consumers of `deployment/release/legacy/index.ts`).
+ * Removal: D10, with that path.
+ */
+export async function verifyPublication(release, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const publicationUrl = publication.url(release.addressing.publicUrl);
+    const response = await fetchRequired(fetcher, publicationUrl, options.signal);
+    const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_DOCUMENT_BYTES)));
+    if (!publication.matchesReference(deployed, publication.reference(release.publication))) {
+        throw new Error('Live Publication differs from the expected Release.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    publication.decodeBundle(deployed, bytes);
+    return deployed;
+}

package/dist/deployment/verify/readiness/release.d.ts

@@ -0,0 +1,8 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import type { Release } from '../../release/index.js';
+import type { ReadinessOptions } from './fetch.js';
+/**
+ * Fetch and verify the exact live release of one immutable deployment at its `release.json`: its
+ * release digest and the build digest of its code, then its Bundle.
+ */
+export declare function verifyRelease(expected: Release, options?: ReadinessOptions): Promise<release.DomainRelease>;

package/dist/deployment/verify/readiness/release.js

@@ -0,0 +1,22 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import { bounded, fetchRequired, MAXIMUM_BUNDLE_BYTES, MAXIMUM_DOCUMENT_BYTES, text, } from './fetch.js';
+/**
+ * Fetch and verify the exact live release of one immutable deployment at its `release.json`: its
+ * release digest and the build digest of its code, then its Bundle.
+ */
+export async function verifyRelease(expected, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const releaseUrl = release.url(expected.url);
+    const response = await fetchRequired(fetcher, releaseUrl, options.signal);
+    const deployed = release.accept(JSON.parse(await text(response, releaseUrl, MAXIMUM_DOCUMENT_BYTES)));
+    if (!release.matchesReference(deployed, release.reference(expected.document))) {
+        throw new Error('Live release differs from the expected Release.');
+    }
+    if (deployed.build.digest !== expected.buildDigest) {
+        throw new Error('Live release build digest differs from the expected build.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    release.decodeBundle(deployed, bytes);
+    return deployed;
+}

package/dist/execution/identity/authentication.d.ts

@@ -5,6 +5,14 @@ import type { InvocationAdmissionInput } from '../invocation/index.js';
 import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
 import { ClientSession } from '../../platform/client/session/index.js';
+import { NodeId } from '../../platform/graph/node/index.js';
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export declare const DEFAULT_ROUTE_AGE_MS = 60000;
 export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
 export interface AuthenticationConfiguration {
     readonly issuer: IssuerId;
@@ -19,10 +27,13 @@ export declare function authenticate(credentialInput: CredentialInput, expectedK
     readonly signal: AbortSignal;
 }, configuration: AuthenticationConfiguration): Promise<AuthenticatedInvocation>;
 /**
- * The Domain's own authority toward one Kernel, for work no caller credential carries: a durable
- * run acts as its executor, never as its initiator. The caller owns the returned Session.
+ * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
+ * which no caller credential carries: the run acts as its executor, never as its initiator. Every
+ * credential names `executionId` in `EXECUTION_CLAIM`, so the Kernel can accept a replaced issuer
+ * for the steps of a run in flight at a consented issuer change. The caller owns the returned
+ * Session.
  */
-export declare function executorSession(kernel: IssuerId, execution: {
+export declare function executorSession(kernel: IssuerId, executionId: NodeId, execution: {
     readonly deadline: number;
     readonly signal: AbortSignal;
 }, configuration: AuthenticationConfiguration): ClientSession;

package/dist/execution/identity/authentication.js

@@ -10,7 +10,13 @@ import { projectError, protocolError } from '../invocation/result/index.js';
 import { callbackIdentities, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, selfIdentity, signDomainCallback, } from './callback.js';
 import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, httpIssuer, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
 import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
-const DEFAULT_ROUTE_AGE_MS = 60_000;
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export const DEFAULT_ROUTE_AGE_MS = 60_000;
 export async function admit(request, configuration) {
     const execution = request.context.execution;
     requireLive(execution);
@@ -73,16 +79,19 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
     });
 }
 /**
- * The Domain's own authority toward one Kernel, for work no caller credential carries: a durable
- * run acts as its executor, never as its initiator. The caller owns the returned Session.
+ * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
+ * which no caller credential carries: the run acts as its executor, never as its initiator. Every
+ * credential names `executionId` in `EXECUTION_CLAIM`, so the Kernel can accept a replaced issuer
+ * for the steps of a run in flight at a consented issuer change. The caller owns the returned
+ * Session.
  */
-export function executorSession(kernel, execution, configuration) {
+export function executorSession(kernel, executionId, execution, configuration) {
     const admitted = httpIssuer(kernel, configuration.policy.allowInsecureHttp === true);
     admitEndpoint(invocationUrl(admitted), configuration.policy);
-    return callbackSession(admitted, selfIdentity, undefined, execution, configuration);
+    return callbackSession(admitted, selfIdentity, undefined, execution, configuration, executionId);
 }
-function callbackSession(kernel, expression, carrier, execution, configuration) {
-    const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, kernel, expression, carrier, execution);
+function callbackSession(kernel, expression, carrier, execution, configuration, executionId) {
+    const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, kernel, expression, carrier, execution, executionId);
     return new ClientSession({
         kernel,
         fetch: boundedFetch(configuration.fetch, execution.signal),

package/dist/execution/identity/callback.d.ts

@@ -1,4 +1,5 @@
 import type { IssuerId, UnresolvedIdentityExpr, VerifiedCredential } from '../../platform/auth/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
 import type { SigningMaterial } from './signing.js';
 export declare const maximumCallbackTtlSeconds = 120;
 export declare const maximumCallbackDelegationTtlSeconds = 60;
@@ -34,9 +35,11 @@ export declare function signCallback(signing: SigningMaterial, issuer: IssuerId,
 }): Promise<string>;
 /**
  * Reuse one exact callback authority partition, refreshing only near its bounded expiry. Without a
- * carrier the callback is the Domain's own authority, bounded by the execution alone.
+ * carrier the callback is the Domain's own authority, bounded by the execution alone. An
+ * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
+ * no caller-bound callback names one.
  */
 export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential | undefined, execution: {
     readonly deadline: number;
     readonly signal: AbortSignal;
-}): (signal: AbortSignal) => Promise<SignedCallback>;
+}, executionId?: NodeId): (signal: AbortSignal) => Promise<SignedCallback>;

package/dist/execution/identity/callback.js

@@ -1,3 +1,4 @@
+import { EXECUTION_CLAIM } from '@astrale-os/kernel-protocol/issuer/claims';
 import { SignJWT } from 'jose';
 import { protocolError } from '../invocation/result/index.js';
 import { requireLive } from './errors.js';
@@ -22,9 +23,11 @@ export async function signCallback(signing, issuer, subject, audience, expressio
 }
 /**
  * Reuse one exact callback authority partition, refreshing only near its bounded expiry. Without a
- * carrier the callback is the Domain's own authority, bounded by the execution alone.
+ * carrier the callback is the Domain's own authority, bounded by the execution alone. An
+ * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
+ * no caller-bound callback names one.
  */
-export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, carrier, execution) {
+export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, carrier, execution, executionId) {
     const maximum = carrier?.exp ?? Number.POSITIVE_INFINITY;
     let cached;
     let pending;
@@ -37,7 +40,7 @@ export function createCallbackCredentialResolver(signing, issuer, subject, audie
             return cached;
         }
         if (pending === undefined) {
-            const current = sign(signing, issuer, subject, audience, expression, execution, maximum).then((signed) => {
+            const current = sign(signing, issuer, subject, audience, expression, execution, maximum, executionId).then((signed) => {
                 const delegateTtlSeconds = Math.min(maximumCallbackDelegationTtlSeconds, signed.expiresAt - signed.issuedAt - CALLBACK_DELEGATION_SKEW_SECONDS);
                 if (delegateTtlSeconds < 1) {
                     throw protocolError('AUTH_INVALID', 'Credential is invalid.');
@@ -60,7 +63,7 @@ export function createCallbackCredentialResolver(signing, issuer, subject, audie
         return withSignal(pending, signal);
     };
 }
-async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY) {
+async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY, executionId) {
     requireLive(execution);
     const privateKey = await withSignal(signing.privateKey, execution.signal);
     requireLive(execution);
@@ -69,7 +72,10 @@ async function sign(signing, issuer, subject, audience, expression, execution, m
     if (!Number.isFinite(expiresAt) || expiresAt <= now) {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    const credential = await withSignal(new SignJWT({ grant: { v: 1, expr: expression } })
+    const credential = await withSignal(new SignJWT({
+        grant: { v: 1, expr: expression },
+        ...(executionId === undefined ? {} : { [EXECUTION_CLAIM]: executionId }),
+    })
         .setProtectedHeader({
         alg: signing.algorithm,
         ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),

package/dist/execution/identity/delivery.d.ts

@@ -1,6 +1,13 @@
-import type { publication as serverPublication } from '@astrale-os/kernel-server';
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import type { release as serverRelease } from '@astrale-os/kernel-server';
+import * as release from '@astrale-os/kernel-protocol/release';
 import type { IssuerId } from '../../platform/auth/index.js';
 import type { SigningMaterial } from './signing.js';
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export declare function publicationDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: publication.Publication): serverPublication.delivery.Provider;
+type Served = release.DomainRelease | release.legacy.Publication;
+/**
+ * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
+ * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
+ * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
+ * deprecated v1 request. A stable target's Publication answers v1 only.
+ */
+export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: Served): serverRelease.delivery.Provider;
+export {};

package/dist/execution/identity/delivery.js

@@ -1,34 +1,61 @@
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { SignJWT } from 'jose';
 const ATTESTATION_TTL_SECONDS = 60;
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export function publicationDelivery(signing, issuer, subject, deployed) {
+/**
+ * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
+ * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
+ * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
+ * deprecated v1 request. A stable target's Publication answers v1 only.
+ */
+export function releaseDelivery(signing, issuer, subject, deployed) {
+    const projection = deployed.version === 4 ? release.legacy.publication(deployed) : deployed;
     return Object.freeze({
         async create(request, context) {
             context.signal.throwIfAborted();
-            const now = Math.floor(Date.now() / 1_000);
-            const attestation = await new SignJWT({
-                purpose: publication.delivery.PURPOSE,
+            if (request.version === 1) {
+                const attestation = await attest(signing, issuer, subject, request.kernel, {
+                    purpose: release.legacy.delivery.PURPOSE,
+                    nonce: request.nonce,
+                    etag: projection.etag,
+                    schemaRevision: projection.schema.revision,
+                });
+                context.signal.throwIfAborted();
+                return release.legacy.delivery.accept({
+                    format: 'astrale.domain.delivery',
+                    version: 1,
+                    publication: projection,
+                    attestation,
+                });
+            }
+            if (deployed.version !== 4) {
+                throw new TypeError('A Publication-backed deployment answers Delivery v1 only.');
+            }
+            const attestation = await attest(signing, issuer, subject, request.kernel, {
+                purpose: release.delivery.PURPOSE,
                 nonce: request.nonce,
-                etag: deployed.etag,
+                release: deployed.digest,
                 schemaRevision: deployed.schema.revision,
-            })
-                .setProtectedHeader({
-                alg: signing.algorithm,
-                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-            })
-                .setIssuer(issuer)
-                .setSubject(subject)
-                .setAudience(request.kernel)
-                .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
-                .sign(await signing.privateKey);
+            });
             context.signal.throwIfAborted();
-            return publication.delivery.accept({
+            return release.delivery.accept({
                 format: 'astrale.domain.delivery',
-                version: 1,
-                publication: deployed,
+                version: 2,
+                release: deployed,
                 attestation,
             });
         },
     });
 }
+async function attest(signing, issuer, subject, kernel, claims) {
+    const now = Math.floor(Date.now() / 1_000);
+    return new SignJWT(claims)
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(issuer)
+        .setSubject(subject)
+        .setAudience(kernel)
+        .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
+        .sign(await signing.privateKey);
+}

package/dist/execution/identity/identity.d.ts

@@ -1,8 +1,9 @@
 import type { Fetch } from '@astrale-os/kernel-client';
-import type * as publicationProtocol from '@astrale-os/kernel-protocol/release/legacy';
-import type { Issuer, exchange, publication } from '@astrale-os/kernel-server';
+import type * as releaseProtocol from '@astrale-os/kernel-protocol/release';
+import type { Issuer, exchange, release } from '@astrale-os/kernel-server';
 import type { IssuerId, JsonWebKey } from '../../platform/auth/index.js';
 import type { ClientSession } from '../../platform/client/session/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
 import type { InvocationAuthority } from '../invocation/index.js';
 import type { ExchangeOptions } from './exchange.js';
 import type { IdentityNetworkPolicy } from './jwks.js';
@@ -10,12 +11,17 @@ import type { IdentityNetworkPolicy } from './jwks.js';
 export interface Identity extends Issuer, InvocationAuthority {
     readonly subject: string;
     readonly tokenExchange?: exchange.Provider;
-    delivery(publication: publicationProtocol.Publication): publication.delivery.Provider;
     /**
-     * The Domain's own authority toward one Kernel for work no caller credential carries, such as a
-     * durable run. Required to serve durable Workflows; the caller closes the Session.
+     * Delivery for the exact document this deployment serves: Delivery v2 over its release and v1
+     * over its frozen v3 projection, or v1 over a stable target's Publication.
      */
-    executor?(kernel: IssuerId, execution: {
+    delivery(served: releaseProtocol.DomainRelease | releaseProtocol.legacy.Publication): release.delivery.Provider;
+    /**
+     * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`
+     * (`ctx.execution.id`), which no caller credential carries; its credentials name `executionId` in
+     * `EXECUTION_CLAIM`. Required to serve durable Workflows; the caller closes the Session.
+     */
+    executor?(kernel: IssuerId, executionId: NodeId, execution: {
         readonly deadline: number;
         readonly signal: AbortSignal;
     }): ClientSession;

package/dist/execution/identity/identity.js

@@ -1,5 +1,5 @@
 import { admit, authenticate, executorSession } from './authentication.js';
-import { publicationDelivery } from './delivery.js';
+import { releaseDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
 import { createVerificationBasisResolver } from './jwks.js';
@@ -49,9 +49,9 @@ export function createIdentity(input) {
             ? {}
             : { loadIssuerPublicKeys: input.loadIssuerPublicKeys }),
         ...(exchangeProvider === undefined ? {} : { tokenExchange: exchangeProvider }),
-        delivery: (publication) => publicationDelivery(material, issuer, input.subject, publication),
+        delivery: (served) => releaseDelivery(material, issuer, input.subject, served),
         admit: (request) => admit(request, configuration),
-        executor: (kernel, execution) => executorSession(kernel, execution, configuration),
+        executor: (kernel, executionId, execution) => executorSession(kernel, executionId, execution, configuration),
         authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),
     });
 }

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,6 +1,5 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
 import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
-import type { Release } from '../../../deployment/release/legacy/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
 export interface AnonymousInvocation {
@@ -10,4 +9,4 @@ export interface AnonymousInvocation {
     close(): void;
 }
 export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
-export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, release: Release, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
+export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;

package/dist/execution/invocation/admission/authentication.js

@@ -9,7 +9,7 @@ const ANONYMOUS = Object.freeze({
     graph: null,
     close() { },
 });
-export async function authentication(callable, request, release, domain, authority) {
+export async function authentication(callable, request, domain, authority) {
     const credential = request.credential;
     if (callable.auth === 'anonymous' && credential === undefined)
         return ANONYMOUS;
@@ -21,7 +21,6 @@ export async function authentication(callable, request, release, domain, authori
     const authenticated = await authority.authenticate({
         credential,
         via: requireVia(request),
-        publication: release.publication,
         domain,
         context: request.context,
     });

package/dist/execution/invocation/admission/authority.d.ts

@@ -1,5 +1,4 @@
 import type * as invocation from '@astrale-os/kernel-protocol/invocation';
-import type * as publication from '@astrale-os/kernel-protocol/release/legacy';
 import type { HandlerRequest, InvocationContext } from '@astrale-os/kernel-server';
 import type { AuthenticatedCaller } from '../../../application/action/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
@@ -8,14 +7,12 @@ export interface InvocationAdmissionInput {
     readonly call: invocation.Call;
     readonly credential?: string;
     readonly via: invocation.Via | invocation.PublicationVia;
-    readonly publication: publication.Publication;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 export interface InvocationAuthenticationInput {
     readonly credential: string;
     readonly via: invocation.Via | invocation.PublicationVia;
-    readonly publication: publication.Publication;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
@@ -26,10 +23,19 @@ export interface AuthenticatedInvocation {
     close(): void;
 }
 export interface InvocationAuthority {
+    /**
+     * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
+     * rejects with the public refusal. A refusal whose reason is `FUNCTION_MISS` (the Kernel no longer
+     * places the call on this deployment) is answered as the reserved miss, never as an error.
+     */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
 }
 /** Capture the execution Identity capability and receiver-bind both privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
-/** The routed witness of a remote call: a `ReleaseRef`, or the `PublicationRef` of a v3 pin. */
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
+ * (a release's exact projection, or a stable target's Publication).
+ */
 export declare function requireVia(request: HandlerRequest): invocation.Via | invocation.PublicationVia;

package/dist/execution/invocation/admission/authority.js

@@ -12,7 +12,11 @@ export function authority(input) {
         authenticate: receiver.authenticate.bind(receiver),
     });
 }
-/** The routed witness of a remote call: a `ReleaseRef`, or the `PublicationRef` of a v3 pin. */
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
+ * (a release's exact projection, or a stable target's Publication).
+ */
 export function requireVia(request) {
     if (request.via === undefined) {
         throw protocolError('VALIDATION_ERROR', 'Remote invocation requires Via.');