@astrale-os/sdk 0.6.0-beta.2 → 0.6.0-beta.20

package/README.md

@@ -1,8 +1,8 @@
 # SDK
 
-Schema-first SDK for authoring and deploying Astrale Applications. The public surface separates
+Schema-first SDK for authoring and deploying Astrale Domains. The public surface separates
 single-step Actions, explicit multi-step Workflows, provider-neutral Integrations, concrete Providers, graph
-authoring, Application composition, Deployment, and Execution without exposing DSL callable
+authoring, Domain composition, Deployment, and Execution without exposing DSL callable
 topology in implementation files.
 
 [![CI](https://github.com/astrale-os/sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/astrale-os/sdk/actions/workflows/ci.yml)
@@ -17,7 +17,7 @@ npm install @astrale-os/sdk
 ```
 
 Zod schemas cross the SDK and Kernel compiler boundary by runtime identity. The SDK therefore
-declares one exact, non-optional Zod peer. If an Application declares Zod directly, it must use the
+declares one exact, non-optional Zod peer. If a Domain declares Zod directly, it must use the
 same exact version rather than a range; a second physical Zod runtime is not an admitted authoring
 environment.
 
@@ -42,7 +42,7 @@ The command covers the workspace root and its packages, pins exact versions, and
 lockfile through pnpm. Use `--channel latest` to select that tag instead. Missing tags and local,
 catalog, or aliased dependencies are left unchanged and reported; peers and overrides are not edited.
 For an older SDK without this command, start with `pnpm dlx @astrale-os/sdk@beta upgrade`.
-Stop development watchers first, then run the project's checks and validate on development.
+Run the project's checks and validate on development.
 Nothing is committed or deployed. A Shell update also requires checking the installed Shell revision.
 Rerunning an upgrade synchronizes installation even when the manifest versions are already current.
 
@@ -67,17 +67,26 @@ original issuer discovery endpoints and keys available; unadopted instances cont
 previous bindings. Deployment readiness checks the exact new Worker version separately from issuer
 discovery. No uninstall or identity rotation is involved.
 
-At the provider-neutral release boundary, use
-`addressing('https://services.example.com', { publicUrl: 'https://services-v2.example.com' })`.
-The one-argument form continues to use the issuer as the public URL.
+At the provider-neutral release boundary, this stable-target path uses
+`addressing('https://services.example.com', { publicUrl: 'https://services-v2.example.com' })` with
+`legacy.assemble`. That split is deprecated with direct mode and goes with it: an immutable
+deployment's URL is its issuer, so `assemble(build, buildDigest, url)` takes the URL alone.
 
 ## Handler authority and dependencies
 
 Authenticated handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.
-`dependencies.directory.invoke(d => d.functions.lookup, input)` calls a direct declared dependency
-with the incoming caller Grant. Explicit authority remains on `kernel` and `graph`; the former
+`dependencies.directory.caller.invoke(d => d.functions.lookup, input)` calls a direct declared
+dependency on behalf of the incoming caller Identity; `.self` calls it as the executing Domain.
+Explicit `caller` or `self` authority is also available on `kernel` and `graph`; the former
 handler `client` is removed. See [the API and migration guide](docs/handler-dependencies.md).
 
+## Durable Workflows
+
+A callable declared with `execution: { durable: true }` is implemented by `defineWorkflow` and runs
+on the Kernel's workflow engine: a call returns its `K.Execution` at once, and the run survives
+restarts with journaled Steps, durable timers and signals. Serve it with `serve({ durable })`. See
+[the durable Workflow guide](docs/durable-workflows.md).
+
 ## Node Class icons
 
 Every Node Class authored through the SDK must explicitly declare a self-contained SVG icon.
@@ -128,7 +137,7 @@ Error declarations are not yet published in the installed Kernel Schema.
 ### Core Identity requirements
 
 Use `requirements({ core: [{ subject, functions, classes, authority }] })` to declare capabilities
-for an Identity in the Application's local Core. `subject` is the resolved Core Node; each entry
+for an Identity in the Domain's local Core. `subject` is the resolved Core Node; each entry
 must request at least one capability. The top-level `functions`, `classes`, and `authority` members
 describe capabilities for the Domain principal.
 
@@ -281,7 +290,7 @@ const session = connect({
     // Return { credential, expiresAt } with expiresAt in Unix milliseconds.
     mint: (signal) => mintSourceCredential(signal),
   }),
-  exchange: {},
+  exchange: { mode: 'auto' },
 })
 
 await session.call({ target: '/:orders.example:class.Order:create', input }) // Domain callable
@@ -291,8 +300,10 @@ await session.graph.get('@order-id') // Kernel callable: the source credential
 - **Hold the source in a provider.** Domain credentials are cached per source credential, so a
   `resolve` that returns a new token on every call also exchanges on every call. The provider also
   lets the Session renew a source that is too close to expiry to feed a Domain credential.
-- **Lifetimes.** `exchange.ttlSeconds` (default 300) must exceed the provider's `ttlSeconds` plus a
-  5-second settlement skew. A Domain credential never outlives its source.
+- **Lifetimes.** In `exchange: { mode: 'auto', ttlSeconds }`, `ttlSeconds` (default 300) must exceed
+  the provider's `ttlSeconds` plus a 5-second settlement skew. A Domain credential never outlives its
+  source. `exchange: { mode: 'source' }` keeps the source credential for every Call and takes no
+  `ttlSeconds`; an empty `{}` or a bare `{ ttlSeconds }` is rejected.
 - **Reading as a Domain.** To call Kernel callables as a Domain, for example to read Shell-owned
   Classes, feed a second Session from an explicit exchange:
   `createSessionCredentialProvider({ ttlSeconds: 60, mint: (signal) => session.exchange(shellIssuer, { signal }) })`.
@@ -309,6 +320,52 @@ await session.graph.get('@order-id') // Kernel callable: the source credential
 | Session with `exchange` | the declaring Domain, for Domain callables | ✅ with the source credential | ✅ Policy evaluated against the identity |
 | `session.exchange(issuer)` held by a second Session | that Domain | ✅ as that Domain | only what that Domain may use |
 
+## Deployment addresses
+
+`@astrale-os/sdk/deployment/address` derives the one immutable URL of a deployment,
+`https://<line>-<content>.<routingDomain>`, from its inputs alone. Whoever deploys and whoever
+hosts compute it with the same pure, runtime-safe functions, so a host can refuse an address it
+did not derive.
+
+- **Line.** `deploymentLine({ origin, environment, addressing })` is shared by every deployment of
+  an origin in an environment. Its 16-character fingerprint, the first 80 bits of
+  `sha256(origin ‖ 0x00 ‖ environment)` in base32, makes it unique. A `readable` line (platform
+  Domains) prefixes it with a cosmetic part, so `agencies.example.com` in `staging` gives
+  `agencies-staging-354iwg4avm6wdmrs`. An `opaque` line (tenant Domains) is the fingerprint alone.
+- **Content.** `deploymentContent(buildDigest, configuration)` covers the build and the
+  `FrozenConfigurationV1`: the plain variables and execution settings (with the durable Workflow
+  options, when declared), the services and dispatch namespaces it binds, and the names of the
+  bound secrets, never their values. A changed variable or binding gives another URL, and a rotated
+  secret keeps the URL. `configurationDigest` gives the full digest that a deployment record keeps. It checks
+  canonical form only: the host refuses settings no Worker runs under when it encodes
+  `ASTRALE_SETTINGS` (`encodeWorkerSettings`), before it uploads anything.
+- **Label.** `deploymentLabel(line, content)` is at most 57 characters. `DEPLOYMENT_LABEL`
+  recognizes it, never a legacy UUID or stable Worker name, and `parseDeploymentLabel` splits it
+  and refuses anything longer than 57 characters.
+- **Record.** `acceptDeploymentRecord` admits a `DeploymentRecordV1` only when its provider
+  script is the label that its own fields derive. A host admits the record a deploy declares with
+  it before storing it, so every stored record decodes.
+- **Platform summary.** `acceptPlatformDeploymentSummary` admits the `summary:<label>` a platform
+  dispatch namespace keeps beside `record:<label>`: the deployment's `DeploymentSummaryV1` without
+  its record, owned by `platform`, named by its label, with no provider version id and no
+  `lastCallAt` or `expiresAt`. `encodePlatformDeploymentSummary` gives its one canonical text.
+
+```ts
+import {
+  deploymentContent,
+  deploymentLabel,
+  deploymentLine,
+  deploymentUrl,
+} from '@astrale-os/sdk/deployment/address'
+
+const line = deploymentLine({ origin, environment, addressing: 'opaque' })
+const url = deploymentUrl(deploymentLabel(line, deploymentContent(build, configuration)), routingDomain)
+```
+
+`@astrale-os/sdk/deployment/address/vectors` holds the conformance vectors: Worker uploads and
+configurations with the manifest, build digest, label and URL each one gives. Every host that
+recomputes an address tests against them.
+
 ## License
 
 Apache License 2.0 — see [LICENSE](LICENSE) for details.
@@ -331,10 +388,13 @@ routes: {
 ```
 
 These requirements are publication metadata, so changing them updates the publication ETag without
-changing the Application's business Schema. They require the `shell` handshake. Origins must use
+changing the Domain's business Schema. They require the `shell` handshake. Origins must use
 HTTPS without credentials, paths, queries, fragments, or wildcards; authoring normalizes and sorts
 them. Supporting hosts admit them per mount and execute the existing `browser.openExternal`
 intent. Nested Views cannot expand their parent's grant.
 
 For the unified authentication facade and coordinated consumer update, see
 [the Auth API migration guide](docs/auth-api-migration.md).
+
+The authored composition formerly called an Application is now a Domain definition: see
+[the Domain definition migration guide](docs/domain-definition-migration.md).

package/dist/application/action/action.d.ts

@@ -29,6 +29,12 @@ export type ActionAddressOf<Callable> = Callable extends {
 export type ResolvedDomainOf<Schema extends schema.DomainSchema> = Extract<schema.DomainOf<Schema>, Domain>;
 /** SDK Action address derived mechanically from the canonical local callable key. */
 export type ActionAddress<Schema extends schema.DomainSchema> = ActionAddressOf<LocalCallable<ResolvedDomainOf<Schema>>>;
+/** Address of a callable an Action may implement: a durable callable needs a Workflow. */
+export type ImmediateActionAddress<Schema extends schema.DomainSchema> = ActionAddressOf<Exclude<LocalCallable<ResolvedDomainOf<Schema>>, {
+    readonly execution: {
+        readonly durable: true;
+    };
+}>>;
 export type CallableAtAddress<Schema extends schema.DomainSchema, Address extends string> = LocalCallable<ResolvedDomainOf<Schema>> extends infer Callable ? Callable extends unknown ? ActionAddressOf<Callable> extends Address ? Callable : never : never : never;
 export type Action<Callable extends ResolvedCallable, Definitions extends Integrations = Readonly<Record<never, never>>, DomainValue extends Domain = Domain, Errors extends DeclaredErrors = NoDeclaredErrors> = (context: ActionContext<Callable, DomainValue, Definitions, Errors>) => Promise<ActionOutputOf<Callable>>;
 declare const ACTION_SCHEMA: unique symbol;

package/dist/application/action/authoring.d.ts

@@ -1,5 +1,5 @@
 export { defineAction } from './define.js';
 export type { Action, ActionDefinition } from './action.js';
-export type { ActionContext, ActionExecution, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, } from './context.js';
+export type { ActionContext, ActionBinaryInput, ActionExecution, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/action/context.d.ts

@@ -1,7 +1,7 @@
-import type { AuthenticationEvidence, Grant, IdentityId } from '../../platform/auth/index.js';
+import type { AuthenticationEvidence, IdentityId } from '../../platform/auth/index.js';
 import type { BoundClientSession } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
-import type { CallableInputOf, Domain, ResolvedFunction, ResolvedMethod } from '../../platform/schema/index.js';
+import type { CallableInputOf, CallableInputModeOf, Domain, ResolvedFunction, ResolvedMethod } from '../../platform/schema/index.js';
 import type { HandlerDependencies } from '../dependency/index.js';
 import type { DeclaredErrorFactory, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { IntegrationClients, Integrations } from '../integration/index.js';
@@ -11,11 +11,10 @@ export type ResolvedCallable = ResolvedFunction | ResolvedMethod;
 /** Bearer-free caller evidence established before an Action or Workflow runs. */
 export interface AuthenticatedCaller {
     readonly kind: 'authenticated';
-    /** Exact effective caller Identity. Access fails when authority is compound. */
+    /** The one Identity whose authority this invocation exercises: ownership and attribution. */
     readonly identity: IdentityId;
-    /** Identity whose credential directly authenticated this invocation. */
+    /** Executor whose credential directly authenticated this invocation (for example this Domain). */
     readonly principal: IdentityId;
-    readonly authority: Grant;
     readonly authentication: AuthenticationEvidence;
 }
 export interface AnonymousCaller {
@@ -34,13 +33,23 @@ export interface ActionExecution {
         body(): Uint8Array;
     };
 }
+/** One admitted, single-consumer binary Function request body. */
+export interface ActionBinaryInput {
+    readonly body: ReadableStream<Uint8Array>;
+    readonly length: number;
+}
+type BinaryInputOf<Callable> = CallableInputModeOf<Callable> extends 'binary' ? {
+    readonly body: ActionBinaryInput;
+} : {
+    readonly body?: never;
+};
 export interface DomainGraphExecutor<DomainValue extends Domain = Domain> {
     readonly query: QueryExecutor<DomainValue>;
     readonly mutate: MutationExecutor<DomainValue>;
 }
-export type DomainGraphExecutors<DomainValue extends Domain = Domain> = Readonly<DomainGraphExecutor<DomainValue> & Record<'caller' | 'self' | 'union', DomainGraphExecutor<DomainValue>>>;
+export type DomainGraphExecutors<DomainValue extends Domain = Domain> = Readonly<DomainGraphExecutor<DomainValue> & Record<'caller' | 'self', DomainGraphExecutor<DomainValue>>>;
 /** Self-default Kernel session with one level of explicit authority selection. */
-export type DomainKernelSessions = Readonly<BoundClientSession & Record<'caller' | 'self' | 'union', BoundClientSession>>;
+export type DomainKernelSessions = Readonly<BoundClientSession & Record<'caller' | 'self', BoundClientSession>>;
 type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
     readonly auth: 'anonymous';
 } ? {
@@ -83,5 +92,5 @@ export type ActionContext<Callable extends ResolvedCallable, DomainValue extends
     readonly execution: ActionExecution;
     /** Construct one implementation-declared safe business error for `throw error(...)`. */
     readonly error: DeclaredErrorFactory<Errors>;
-} & AuthorityOf<Callable, DomainValue> & SelfOf<Callable>;
+} & AuthorityOf<Callable, DomainValue> & SelfOf<Callable> & BinaryInputOf<Callable>;
 export {};

package/dist/application/action/define.d.ts

@@ -1,12 +1,12 @@
 import type { schema } from '../../platform/schema/index.js';
 import type { DeclaredErrorOptions, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
-import type { Action, ActionAddress, ActionDefinition, CallableAtAddress, ResolvedDomainOf } from './action.js';
+import type { Action, ActionDefinition, CallableAtAddress, ImmediateActionAddress, ResolvedDomainOf } from './action.js';
 import type { ResolvedCallable } from './context.js';
 /** Define one simple single-step implementation by its SDK Action address. */
 export declare function defineAction<Schema extends schema.DomainSchema, Definitions extends Integrations = Readonly<Record<never, never>>>(): {
-    <const Address extends ActionAddress<Schema>>(address: Address, run: Action<Extract<CallableAtAddress<Schema, Address>, ResolvedCallable>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): ActionDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
-    <const Address extends ActionAddress<Schema>, const Errors extends DeclaredErrors>(address: Address, options: DeclaredErrorOptions<Errors>, run: Action<Extract<CallableAtAddress<Schema, Address>, ResolvedCallable>, Definitions, ResolvedDomainOf<Schema>, Errors>): ActionDefinition<Schema, Address, Definitions, Errors>;
+    <const Address extends ImmediateActionAddress<Schema>>(address: Address, run: Action<Extract<CallableAtAddress<Schema, Address>, ResolvedCallable>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): ActionDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
+    <const Address extends ImmediateActionAddress<Schema>, const Errors extends DeclaredErrors>(address: Address, options: DeclaredErrorOptions<Errors>, run: Action<Extract<CallableAtAddress<Schema, Address>, ResolvedCallable>, Definitions, ResolvedDomainOf<Schema>, Errors>): ActionDefinition<Schema, Address, Definitions, Errors>;
 };
 /** True only for an Action produced by defineAction in this SDK package root. */
 export declare function isAction(input: unknown): input is ActionDefinition;

package/dist/application/action/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAction, isAction } from './define.js';
 export type { Action, ActionAddress, ActionAddressOf, ActionDefinition, CallableAtAddress, LocalCallable, ResolvedDomainOf, } from './action.js';
-export type { ActionContext, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
+export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/define.d.ts

@@ -1,16 +1,16 @@
 import type { schema } from '../platform/schema/index.js';
-import type { Application } from './application.js';
+import type { DomainDefinition } from './domain.js';
 import type { Requirements } from './requirements/index.js';
 import type { Routes } from './routes/index.js';
 import type { Runtime } from './runtime/index.js';
 import type { Frontend } from './view/index.js';
-export interface ApplicationInput<Schema extends schema.DomainSchema, RuntimeValue extends Runtime<Schema>, FrontendValue extends Frontend<Schema> | undefined, RoutesValue extends Routes | undefined, RequirementsValue extends Requirements | undefined> {
+export interface DomainDefinitionInput<Schema extends schema.DomainSchema, RuntimeValue extends Runtime<Schema>, FrontendValue extends Frontend<Schema> | undefined, RoutesValue extends Routes | undefined, RequirementsValue extends Requirements | undefined> {
     readonly schema: Schema;
     readonly runtime: RuntimeValue;
     readonly frontend?: FrontendValue;
     readonly routes?: RoutesValue;
     readonly requirements?: RequirementsValue;
 }
-/** Capture one inert authored Application without resolving, compiling, loading, or deploying it. */
-export declare function defineApplication<const Schema extends schema.DomainSchema, const RuntimeValue extends Runtime<Schema>, const FrontendValue extends Frontend<Schema> | undefined = undefined, const RoutesValue extends Routes | undefined = undefined, const RequirementsValue extends Requirements | undefined = undefined>(input: ApplicationInput<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>): Application<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>;
-export declare function isApplication(input: unknown): input is Application;
+/** Capture one inert authored Domain without resolving, compiling, loading, or deploying it. */
+export declare function defineDomain<const Schema extends schema.DomainSchema, const RuntimeValue extends Runtime<Schema>, const FrontendValue extends Frontend<Schema> | undefined = undefined, const RoutesValue extends Routes | undefined = undefined, const RequirementsValue extends Requirements | undefined = undefined>(input: DomainDefinitionInput<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>): DomainDefinition<Schema, RuntimeValue, FrontendValue, RoutesValue, RequirementsValue>;
+export declare function isDomainDefinition(input: unknown): input is DomainDefinition;

package/dist/application/define.js

@@ -2,39 +2,39 @@ import { isRequirements } from './requirements/index.js';
 import { isRoutes } from './routes/index.js';
 import { isRuntime } from './runtime/index.js';
 import { isFrontend } from './view/index.js';
-const admittedApplications = new WeakSet();
-/** Capture one inert authored Application without resolving, compiling, loading, or deploying it. */
-export function defineApplication(input) {
+const admittedDomainDefinitions = new WeakSet();
+/** Capture one inert authored Domain without resolving, compiling, loading, or deploying it. */
+export function defineDomain(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
     const allowed = new Set(['schema', 'runtime', 'frontend', 'routes', 'requirements']);
     if (Reflect.ownKeys(input).some((key) => !allowed.has(key)))
         invalid();
     if (!isRuntime(input.runtime))
-        throw new TypeError('Application Runtime is not admitted.');
+        throw new TypeError('Domain Runtime is not admitted.');
     if (input.frontend !== undefined &&
         (!isFrontend(input.frontend) || input.frontend.schema !== input.schema)) {
-        throw new TypeError('Application Frontend is not admitted for its exact Schema.');
+        throw new TypeError('Domain Frontend is not admitted for its exact Schema.');
     }
     if (input.routes !== undefined && !isRoutes(input.routes)) {
-        throw new TypeError('Application routes are not admitted.');
+        throw new TypeError('Domain routes are not admitted.');
     }
     if (input.requirements !== undefined && !isRequirements(input.requirements)) {
-        throw new TypeError('Application requirements are not admitted.');
+        throw new TypeError('Domain requirements are not admitted.');
     }
-    const application = Object.freeze({
+    const domain = Object.freeze({
         schema: input.schema,
         runtime: input.runtime,
         ...(input.frontend === undefined ? {} : { frontend: input.frontend }),
         ...(input.routes === undefined ? {} : { routes: input.routes }),
         ...(input.requirements === undefined ? {} : { requirements: input.requirements }),
     });
-    admittedApplications.add(application);
-    return application;
+    admittedDomainDefinitions.add(domain);
+    return domain;
 }
-export function isApplication(input) {
-    return input !== null && typeof input === 'object' && admittedApplications.has(input);
+export function isDomainDefinition(input) {
+    return input !== null && typeof input === 'object' && admittedDomainDefinitions.has(input);
 }
 function invalid() {
-    throw new TypeError('Application definition may contain only schema, runtime, frontend, routes, and requirements.');
+    throw new TypeError('Domain definition may contain only schema, runtime, frontend, routes, and requirements.');
 }

package/dist/application/dependency/index.d.ts

@@ -1 +1 @@
-export type { DependencyCallOptions, DependencyInvoker, HandlerDependencies } from './invoker.js';
+export type { DependencyBinaryCallOptions, DependencyCallOptions, DependencyInvoker, HandlerDependencies, } from './invoker.js';

package/dist/application/dependency/invoker.d.ts

@@ -1,26 +1,31 @@
 import type { Binary, Input } from '../../platform/client/index.js';
-import type { SessionRequestOptions } from '../../platform/client/session/index.js';
+import type { SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
-import type { CallableInputOf, CallableOutputOf, CallableResultOf, Domain, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
+import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
 import type { LocalCallable } from '../action/index.js';
-export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey'>;
+export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey' | 'body'>;
+export type DependencyBinaryCallOptions = Pick<SessionRequestOptionsWithBody, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 type InstanceMethodOf<D extends Domain> = Extract<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
 type FunctionOrStaticMethodOf<D extends Domain> = Exclude<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
+type WithInputMode<C, Mode extends 'value' | 'binary'> = C extends unknown ? CallableInputModeOf<C> extends Mode ? C : never : never;
+type ValueFunctionOrStaticMethodOf<D extends Domain> = WithInputMode<FunctionOrStaticMethodOf<D>, 'value'>;
+type BinaryFunctionOf<D extends Domain> = WithInputMode<Extract<LocalCallable<D>, ResolvedFunction>, 'binary'>;
 type DependencyInputOf<C> = C extends unknown ? unknown extends CallableInputOf<C> ? Input : [CallableInputOf<C>] extends [void] ? undefined : CallableInputOf<C> : never;
 type DependencyResultOf<C> = unknown extends CallableOutputOf<C> ? unknown : CallableResultOf<C, Binary>;
 /** One declared dependency, bound to one explicitly selected invocation authority. */
 export interface DependencyInvoker<D extends Domain> {
     readonly invoke: {
-        <const C extends FunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends ValueFunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
         <const C extends InstanceMethodOf<D>>(select: (domain: D) => C, instance: NodeId, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends BinaryFunctionOf<D>>(select: (domain: D) => C, metadata: NoInfer<DependencyInputOf<C>>, options: DependencyBinaryCallOptions): Promise<DependencyResultOf<C>>;
     };
 }
 /**
  * Direct Schema aliases with explicit authority selection and no default invoke.
- * self is the executing Domain; caller forwards the incoming Grant; union combines both.
+ * self is the executing Domain; caller forwards the incoming caller Identity.
  * The canonical Kernel is exposed through context.kernel.
  */
 export type HandlerDependencies<D extends Domain> = Readonly<{
-    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: Readonly<Record<'caller' | 'self' | 'union', DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>>>;
+    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: Readonly<Record<'caller' | 'self', DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>>>;
 }>;
 export {};

package/dist/application/domain.d.ts

@@ -0,0 +1,28 @@
+import type { schema } from '../platform/schema/index.js';
+import type { Requirements } from './requirements/index.js';
+import type { Routes } from './routes/index.js';
+import type { Runtime, SchemaOfRuntime as RuntimeSchemaOf } from './runtime/index.js';
+import type { Frontend } from './view/index.js';
+declare const DOMAIN_DEFINITION_IDENTITY: unique symbol;
+declare const DOMAIN_DEFINITION_SCHEMA: unique symbol;
+/** Schema-independent type witness shared by every admitted Domain definition. */
+export interface DomainDefinitionIdentity {
+    readonly [DOMAIN_DEFINITION_IDENTITY]: true;
+}
+/** Inert source/build composition of one Domain: its exact Schema and authored Runtime. */
+export interface DomainDefinition<Schema extends schema.DomainSchema = schema.DomainSchema, RuntimeValue extends Runtime<Schema> = Runtime<Schema>, FrontendValue extends Frontend<Schema> | undefined = undefined, RoutesValue extends Routes | undefined = undefined, RequirementsValue extends Requirements | undefined = undefined> extends DomainDefinitionIdentity {
+    readonly schema: Schema;
+    readonly runtime: RuntimeValue;
+    readonly frontend?: FrontendValue;
+    readonly routes?: RoutesValue;
+    readonly requirements?: RequirementsValue;
+    readonly [DOMAIN_DEFINITION_SCHEMA]: (schema: Schema) => Schema;
+}
+export type SchemaOfDomainDefinition<Value> = Value extends {
+    readonly schema: infer Schema;
+} ? Extract<Schema, schema.DomainSchema> : never;
+export type RuntimeOfDomainDefinition<Value> = Value extends {
+    readonly runtime: infer RuntimeValue;
+} ? Extract<RuntimeValue, Runtime> : never;
+export type SchemaOfRuntime<Value> = RuntimeSchemaOf<Value>;
+export {};

package/dist/application/index.d.ts

@@ -1,9 +1,9 @@
-export { defineApplication, isApplication } from './define.js';
-export type { ApplicationInput } from './define.js';
+export { defineDomain, isDomainDefinition } from './define.js';
+export type { DomainDefinitionInput } from './define.js';
 export { requirements } from './requirements/index.js';
 export type { AuthorityRequirements, AuthorityRequirementsInput, ClassOperation, ClassRequirement, ClassRequirementInput, CoreRequirement, CoreRequirementInput, FunctionRequirementTarget, Requirements, RequirementsInput, } from './requirements/index.js';
 export { route, routes } from './routes/index.js';
 export type { Route, RouteInput, RouteTarget, Routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';
 export type { Frontend, FrontendInput, FrontendSource, IframeRequirements, ViewHostRequirements, } from './view/index.js';
-export type { Application, ApplicationIdentity, RuntimeOfApplication, SchemaOfApplication, SchemaOfRuntime, } from './application.js';
+export type { DomainDefinition, DomainDefinitionIdentity, RuntimeOfDomainDefinition, SchemaOfDomainDefinition, SchemaOfRuntime, } from './domain.js';

package/dist/application/index.js

@@ -1,4 +1,4 @@
-export { defineApplication, isApplication } from './define.js';
+export { defineDomain, isDomainDefinition } from './define.js';
 export { requirements } from './requirements/index.js';
 export { route, routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';

package/dist/application/mutation/authoring/properties.d.ts

@@ -1,9 +1,11 @@
 import type { MutationPropsInput } from '@astrale-os/kernel-core/graph/mutate';
 import type { PropertyInputOf, ResolvedClass, ResolvedProperty } from '@astrale-os/kernel-dsl/v1';
+import { PropertyValues } from '@astrale-os/kernel-dsl/v1/language';
+import type { StoredPropertyInputOf } from '../../../platform/schema/property-input.js';
 export type RichPropertyInput<Class> = PropertyInputOf<Class>;
 export type RichPropertyName<Class> = Extract<keyof PropertyInputOf<Class>, string>;
 export interface RichPropertyConditions<Class> {
-    readonly equals?: RichPropertyInput<Class>;
+    readonly equals?: StoredPropertyInputOf<Class>;
     readonly absent?: readonly RichPropertyName<Class>[];
 }
 export interface RichPropertyDelta<Class> {
@@ -12,11 +14,11 @@ export interface RichPropertyDelta<Class> {
 }
 export declare function properties<Class extends ResolvedClass>(selected: Class, input: RichPropertyInput<Class>): MutationPropsInput;
 export declare function conditions<Class extends ResolvedClass>(selected: Class, input: RichPropertyConditions<Class>): Readonly<{
-    equals?: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/value").Value>> | undefined;
+    equals?: PropertyValues | undefined;
     absent?: readonly `${string}:class.${string}.property.${string}`[] | undefined;
 }>;
 export declare function delta<Class extends ResolvedClass>(selected: Class, input: RichPropertyDelta<Class>): Readonly<{
-    set: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/value").Value>>;
+    set: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/v1/language").PropertyValue>>;
     unset: readonly `${string}:class.${string}.property.${string}`[];
 }>;
 export declare function resolvedProperty<Class extends ResolvedClass>(selected: Class, name: RichPropertyName<Class>): ResolvedProperty;

package/dist/application/mutation/authoring/properties.js

@@ -1,10 +1,39 @@
 import { PropertyKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import { PropertyValues } from '@astrale-os/kernel-dsl/v1/language';
 export function properties(selected, input) {
-    return selected.properties.from(input);
+    const ordinary = Object.create(null);
+    const receipts = [];
+    const sources = new Map();
+    for (const [name, value] of Object.entries(input)) {
+        const property = resolvedProperty(selected, name);
+        const previous = sources.get(property.key);
+        if (previous !== undefined) {
+            throw new TypeError(`Property ${property.key} is supplied through both ${JSON.stringify(previous)} and ${JSON.stringify(name)}.`);
+        }
+        sources.set(property.key, name);
+        if (isBlobProperty(property)) {
+            if (typeof value !== 'string') {
+                throw new TypeError(`Blob Property ${property.key} requires an upload receipt.`);
+            }
+            receipts.push([property.key, value]);
+        }
+        else {
+            ordinary[name] = value;
+        }
+    }
+    // Blob receipts are admitted by the Kernel executor. A property's ordinary validator expects
+    // the stored Ref, so run it only for ordinary write values before combining the two sets.
+    const admitted = selected.properties.from(ordinary);
+    return receipts.length === 0
+        ? admitted
+        : PropertyValues.create([
+            ...Object.entries(admitted).map(([key, value]) => [PropertyKey(key), value]),
+            ...receipts,
+        ]);
 }
 export function conditions(selected, input) {
     return Object.freeze({
-        ...(input.equals === undefined ? {} : { equals: properties(selected, input.equals) }),
+        ...(input.equals === undefined ? {} : { equals: selected.properties.from(input.equals) }),
         ...(input.absent === undefined
             ? {}
             : {
@@ -12,6 +41,10 @@ export function conditions(selected, input) {
             }),
     });
 }
+function isBlobProperty(property) {
+    const contract = property.definition.schema;
+    return (contract !== null && typeof contract === 'object' && contract['x-astrale-value-kind'] === 'blob');
+}
 export function delta(selected, input) {
     return Object.freeze({
         set: properties(selected, input.set ?? {}),

package/dist/application/mutation/authoring/transition.js

@@ -49,7 +49,10 @@ export function authorStateTransition(core, input) {
         class: selectedClassKey,
         props: conditions(selectedClass, {
             ...(suppliedAbsent === undefined ? {} : { absent: suppliedAbsent }),
-            equals: { ...suppliedEquals, ...from },
+            equals: {
+                ...suppliedEquals,
+                ...from,
+            },
         }),
     });
     core.updateNode({

package/dist/application/routes/admission.d.ts

@@ -1,5 +1,5 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 import type { RuntimeRegistry } from '../runtime/index.js';
 import type { Routes } from './collection.js';
 /** Lower recipe identities to canonical callable keys after Runtime admission. */
-export declare function admit(input: Routes | undefined, registry: RuntimeRegistry): readonly publication.HttpRouteDeclaration[];
+export declare function admit(input: Routes | undefined, registry: RuntimeRegistry): readonly release.HttpRouteDeclaration[];

package/dist/application/routes/admission.js

@@ -4,7 +4,7 @@ export function admit(input, registry) {
     if (input === undefined)
         return Object.freeze([]);
     if (!isRoutes(input))
-        throw new TypeError('Application routes are not admitted.');
+        throw new TypeError('Domain routes are not admitted.');
     return Object.freeze(input.entries.map(({ target, ...declaration }) => {
         const implementation = registry.implementations.find(({ definition }) => definition === target);
         if (implementation === undefined) {

package/dist/application/routes/route.d.ts

@@ -1,9 +1,9 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 export interface RouteTarget {
     readonly kind: 'action' | 'workflow';
     readonly address: string;
 }
-export type RouteInput = Omit<publication.HttpRouteDeclaration, 'callable'>;
+export type RouteInput = Omit<release.HttpRouteDeclaration, 'callable'>;
 /** One provider-neutral HTTP route targeting an admitted Action or Workflow recipe. */
 export interface Route<Target extends RouteTarget = RouteTarget> extends RouteInput {
     readonly target: Target;

package/dist/application/runtime/actions.js

@@ -16,6 +16,9 @@ export function admitActions(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Action ${definition.address} is not root-local and executable.`);
         }
+        if (callable.execution?.durable === true) {
+            throw new TypeError(`Runtime Action ${definition.address} is durable; implement it with defineWorkflow.`);
+        }
         return Object.freeze({
             kind: 'action',
             address: definition.address,

package/dist/application/runtime/workflows.d.ts

@@ -6,6 +6,8 @@ export interface RuntimeWorkflow {
     readonly address: string;
     readonly callable: ResolvedCallable;
     readonly definition: WorkflowDefinition;
+    /** Declared `execution: { durable: true }`: runs on the workflow engine, never inline. */
+    readonly durable: boolean;
 }
 /** Associate admitted Workflows with their exact authenticated value callables. */
 export declare function admitWorkflows(callables: readonly RuntimeCallable[], input: unknown): readonly RuntimeWorkflow[];

package/dist/application/runtime/workflows.js

@@ -22,11 +22,16 @@ export function admitWorkflows(callables, input) {
         if (callable.output.mode !== 'value') {
             throw new TypeError(`Runtime Workflow ${definition.address} must have value output.`);
         }
+        const durable = callable.execution?.durable === true;
+        if (!durable && definition.compat !== undefined) {
+            throw new TypeError(`Runtime Workflow ${definition.address} declares compat but its callable is not durable.`);
+        }
         return Object.freeze({
             kind: 'workflow',
             address: definition.address,
             callable,
             definition,
+            durable,
         });
     });
     return Object.freeze(workflows);

package/dist/application/workflow/authoring.d.ts

@@ -1,4 +1,5 @@
 export { defineWorkflow } from './define.js';
-export type { WorkflowContext } from './context.js';
-export type { Workflow, WorkflowAddress, WorkflowDefinition } from './workflow.js';
+export type { InlineWorkflowContext, WorkflowContext } from './context.js';
+export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableWorkflowContext, } from './durable.js';
+export type { Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';