@astrale-os/sdk 0.6.0-beta.2 → 0.6.0-beta.20

package/dist/execution/identity/authentication.js

@@ -7,10 +7,16 @@ import { bindSession, ClientSession } from '../../platform/client/session/index.
 import { NodeId } from '../../platform/graph/node/index.js';
 import { Path } from '../../platform/graph/path/index.js';
 import { projectError, protocolError } from '../invocation/result/index.js';
-import { callbackIdentities, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, signDomainCallback, } from './callback.js';
-import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
+import { callbackIdentities, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, selfIdentity, signDomainCallback, } from './callback.js';
+import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, httpIssuer, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
 import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
-const DEFAULT_ROUTE_AGE_MS = 60_000;
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export const DEFAULT_ROUTE_AGE_MS = 60_000;
 export async function admit(request, configuration) {
     const execution = request.context.execution;
     requireLive(execution);
@@ -32,10 +38,7 @@ export async function admit(request, configuration) {
         }), {
             signal: execution.signal,
             timeoutMs: Math.max(1, execution.deadline - Date.now()),
-            delegate: {
-                ttlSeconds: callbackTtl(execution.deadline),
-                attenuation: { kind: 'identity', self: true },
-            },
+            delegate: { ttlSeconds: callbackTtl(execution.deadline) },
         });
         return result.value;
     }
@@ -53,15 +56,14 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
     const expressions = callbackIdentities(established.delegation.credential);
+    const session = (expression) => callbackSession(expectedKernel, expression, established.verified, execution, configuration);
     const sessions = Object.freeze({
-        caller: callbackSession(expressions.caller),
-        self: callbackSession(expressions.self),
-        union: callbackSession(expressions.union),
+        caller: session(expressions.caller),
+        self: session(expressions.self),
     });
     const graph = Object.freeze({
         caller: bindSession(sessions.caller, execution),
         self: bindSession(sessions.self, execution),
-        union: bindSession(sessions.union, execution),
     });
     let closed = false;
     return Object.freeze({
@@ -73,35 +75,46 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
             closed = true;
             sessions.caller.close();
             sessions.self.close();
-            sessions.union.close();
         },
     });
-    function callbackSession(expression) {
-        const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, expectedKernel, expression, established.verified, execution);
-        return new ClientSession({
-            kernel: expectedKernel,
-            fetch: boundedFetch(configuration.fetch, execution.signal),
-            auth: {
-                ttlSeconds: Math.min(callbackTtl(execution.deadline), maximumCallbackDelegationTtlSeconds),
-                async resolve(_call, signal) {
-                    const callback = await resolveCallback(signal);
-                    signal.throwIfAborted();
-                    return {
-                        credential: callback.credential,
-                        delegate: { ttlSeconds: callback.delegateTtlSeconds },
-                    };
-                },
-            },
-            policy: {
-                maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,
-                ...(configuration.policy.allowEndpoint === undefined
-                    ? {}
-                    : { allowEndpoint: configuration.policy.allowEndpoint }),
-                ...(configuration.policy.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+}
+/**
+ * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
+ * which no caller credential carries: the run acts as its executor, never as its initiator. Every
+ * credential names `executionId` in `EXECUTION_CLAIM`, so the Kernel can accept a replaced issuer
+ * for the steps of a run in flight at a consented issuer change. The caller owns the returned
+ * Session.
+ */
+export function executorSession(kernel, executionId, execution, configuration) {
+    const admitted = httpIssuer(kernel, configuration.policy.allowInsecureHttp === true);
+    admitEndpoint(invocationUrl(admitted), configuration.policy);
+    return callbackSession(admitted, selfIdentity, undefined, execution, configuration, executionId);
+}
+function callbackSession(kernel, expression, carrier, execution, configuration, executionId) {
+    const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, kernel, expression, carrier, execution, executionId);
+    return new ClientSession({
+        kernel,
+        fetch: boundedFetch(configuration.fetch, execution.signal),
+        auth: {
+            ttlSeconds: Math.min(callbackTtl(execution.deadline), maximumCallbackDelegationTtlSeconds),
+            async resolve(_call, signal) {
+                const callback = await resolveCallback(signal);
+                signal.throwIfAborted();
+                return {
+                    credential: callback.credential,
+                    delegate: { ttlSeconds: callback.delegateTtlSeconds },
+                };
             },
-            timeoutMs: Math.max(1, execution.deadline - Date.now()),
-        });
-    }
+        },
+        policy: {
+            maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,
+            ...(configuration.policy.allowEndpoint === undefined
+                ? {}
+                : { allowEndpoint: configuration.policy.allowEndpoint }),
+            ...(configuration.policy.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+        },
+        timeoutMs: Math.max(1, execution.deadline - Date.now()),
+    });
 }
 async function establishCaller(input, audience, verification, execution, policy) {
     requireLive(execution);
@@ -115,7 +128,7 @@ async function establishCaller(input, audience, verification, execution, policy)
         if (proof.verified.sub !== context.verified.sub) {
             throw new CredentialRejected('Destination carrier and authority proof subjects differ.');
         }
-        const authority = acceptResolvedDelegation(proof.verified.claims.delegation);
+        const identity = acceptResolvedDelegation(proof.verified.claims.delegation);
         let principal;
         try {
             principal = NodeId(context.verified.sub);
@@ -129,7 +142,7 @@ async function establishCaller(input, audience, verification, execution, policy)
             caller: Object.freeze({
                 kind: 'authenticated',
                 principal,
-                authority,
+                identity,
                 authentication: credential.evidence(context),
             }),
         });
@@ -140,6 +153,7 @@ async function establishCaller(input, audience, verification, execution, policy)
             throw protocolError('BACKEND_UNAVAILABLE', 'Credential issuer is unavailable.');
         }
         if (cause instanceof CredentialRejected ||
+            cause instanceof AuthValueError ||
             cause instanceof joseErrors.JOSEError ||
             cause instanceof protocolErrors.ProtocolError) {
             throw protocolError('AUTH_INVALID', 'Credential is invalid.');
@@ -147,6 +161,7 @@ async function establishCaller(input, audience, verification, execution, policy)
         throw cause;
     }
 }
+/** Accept a Kernel delegation proof claim naming exactly one resolved caller Identity. */
 export function acceptResolvedDelegation(input) {
     if (input === null ||
         typeof input !== 'object' ||
@@ -157,5 +172,14 @@ export function acceptResolvedDelegation(input) {
         Reflect.get(input, 'v') !== 1) {
         throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected resolved delegation.');
     }
-    return grant.accept({ expr: Reflect.get(input, 'expr') });
+    const raw = Reflect.get(input, 'expr');
+    // grant.accept collapses duplicate operands (union(X, X) becomes X), so the leaf is checked as sent.
+    if (raw === null || typeof raw !== 'object' || Reflect.get(raw, 'kind') !== 'identity') {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected one resolved caller Identity.');
+    }
+    const { expr } = grant.accept({ expr: raw });
+    if (expr.kind !== 'identity') {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected one resolved caller Identity.');
+    }
+    return expr.id;
 }

package/dist/execution/identity/callback.d.ts

@@ -1,4 +1,5 @@
 import type { IssuerId, UnresolvedIdentityExpr, VerifiedCredential } from '../../platform/auth/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
 import type { SigningMaterial } from './signing.js';
 export declare const maximumCallbackTtlSeconds = 120;
 export declare const maximumCallbackDelegationTtlSeconds = 60;
@@ -7,8 +8,13 @@ export interface SignedCallback {
     readonly expiresAt: number;
     readonly delegateTtlSeconds: number;
 }
-export type CallbackGrantMode = 'caller' | 'self' | 'union';
-/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+export type CallbackMode = 'caller' | 'self';
+/** The Domain's own authority, independent of any caller. */
+export declare const selfIdentity: Readonly<{
+    kind: 'identity';
+    self: true;
+}>;
+/** Exact single-identity callback authority for each Kernel Domain graph mode. */
 export declare function callbackIdentities(nested: string | Uint8Array): Readonly<{
     caller: Readonly<{
         kind: 'identity';
@@ -18,16 +24,6 @@ export declare function callbackIdentities(nested: string | Uint8Array): Readonl
         kind: 'identity';
         self: true;
     }>;
-    union: Readonly<{
-        kind: 'union';
-        operands: readonly (Readonly<{
-            kind: 'identity';
-            credential: string | Uint8Array<ArrayBufferLike>;
-        }> | Readonly<{
-            kind: 'identity';
-            self: true;
-        }>)[];
-    }>;
 }>;
 export declare function signDomainCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, execution: {
     readonly deadline: number;
@@ -37,8 +33,13 @@ export declare function signCallback(signing: SigningMaterial, issuer: IssuerId,
     readonly deadline: number;
     readonly signal: AbortSignal;
 }): Promise<string>;
-/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
-export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
+/**
+ * Reuse one exact callback authority partition, refreshing only near its bounded expiry. Without a
+ * carrier the callback is the Domain's own authority, bounded by the execution alone. An
+ * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
+ * no caller-bound callback names one.
+ */
+export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential | undefined, execution: {
     readonly deadline: number;
     readonly signal: AbortSignal;
-}): (signal: AbortSignal) => Promise<SignedCallback>;
+}, executionId?: NodeId): (signal: AbortSignal) => Promise<SignedCallback>;

package/dist/execution/identity/callback.js

@@ -1,32 +1,34 @@
+import { EXECUTION_CLAIM } from '@astrale-os/kernel-protocol/issuer/claims';
 import { SignJWT } from 'jose';
 import { protocolError } from '../invocation/result/index.js';
 import { requireLive } from './errors.js';
 export const maximumCallbackTtlSeconds = 120;
 export const maximumCallbackDelegationTtlSeconds = 60;
 const CALLBACK_DELEGATION_SKEW_SECONDS = 5;
-/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+/** The Domain's own authority, independent of any caller. */
+export const selfIdentity = Object.freeze({ kind: 'identity', self: true });
+/** Exact single-identity callback authority for each Kernel Domain graph mode. */
 export function callbackIdentities(nested) {
-    const caller = Object.freeze({ kind: 'identity', credential: nested });
-    const self = Object.freeze({ kind: 'identity', self: true });
     return Object.freeze({
-        caller,
-        self,
-        union: Object.freeze({
-            kind: 'union',
-            operands: Object.freeze([self, caller]),
-        }),
+        caller: Object.freeze({ kind: 'identity', credential: nested }),
+        self: selfIdentity,
     });
 }
 export async function signDomainCallback(signing, issuer, subject, audience, execution) {
-    return (await sign(signing, issuer, subject, audience, { kind: 'identity', self: true }, execution)).credential;
+    return (await sign(signing, issuer, subject, audience, selfIdentity, execution)).credential;
 }
 export async function signCallback(signing, issuer, subject, audience, expression, carrier, execution) {
     const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
     return (await sign(signing, issuer, subject, audience, expression, execution, maximum)).credential;
 }
-/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
-export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, carrier, execution) {
-    const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
+/**
+ * Reuse one exact callback authority partition, refreshing only near its bounded expiry. Without a
+ * carrier the callback is the Domain's own authority, bounded by the execution alone. An
+ * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
+ * no caller-bound callback names one.
+ */
+export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, carrier, execution, executionId) {
+    const maximum = carrier?.exp ?? Number.POSITIVE_INFINITY;
     let cached;
     let pending;
     return async (signal) => {
@@ -38,7 +40,7 @@ export function createCallbackCredentialResolver(signing, issuer, subject, audie
             return cached;
         }
         if (pending === undefined) {
-            const current = sign(signing, issuer, subject, audience, expression, execution, maximum).then((signed) => {
+            const current = sign(signing, issuer, subject, audience, expression, execution, maximum, executionId).then((signed) => {
                 const delegateTtlSeconds = Math.min(maximumCallbackDelegationTtlSeconds, signed.expiresAt - signed.issuedAt - CALLBACK_DELEGATION_SKEW_SECONDS);
                 if (delegateTtlSeconds < 1) {
                     throw protocolError('AUTH_INVALID', 'Credential is invalid.');
@@ -61,7 +63,7 @@ export function createCallbackCredentialResolver(signing, issuer, subject, audie
         return withSignal(pending, signal);
     };
 }
-async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY) {
+async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY, executionId) {
     requireLive(execution);
     const privateKey = await withSignal(signing.privateKey, execution.signal);
     requireLive(execution);
@@ -70,7 +72,10 @@ async function sign(signing, issuer, subject, audience, expression, execution, m
     if (!Number.isFinite(expiresAt) || expiresAt <= now) {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    const credential = await withSignal(new SignJWT({ grant: { v: 1, expr: expression } })
+    const credential = await withSignal(new SignJWT({
+        grant: { v: 1, expr: expression },
+        ...(executionId === undefined ? {} : { [EXECUTION_CLAIM]: executionId }),
+    })
         .setProtectedHeader({
         alg: signing.algorithm,
         ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),

package/dist/execution/identity/delivery.d.ts

@@ -1,6 +1,13 @@
-import type { publication as serverPublication } from '@astrale-os/kernel-server';
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import type { release as serverRelease } from '@astrale-os/kernel-server';
+import * as release from '@astrale-os/kernel-protocol/release';
 import type { IssuerId } from '../../platform/auth/index.js';
 import type { SigningMaterial } from './signing.js';
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export declare function publicationDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: publication.Publication): serverPublication.delivery.Provider;
+type Served = release.DomainRelease | release.legacy.Publication;
+/**
+ * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
+ * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
+ * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
+ * deprecated v1 request. A stable target's Publication answers v1 only.
+ */
+export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: Served): serverRelease.delivery.Provider;
+export {};

package/dist/execution/identity/delivery.js

@@ -1,34 +1,61 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { SignJWT } from 'jose';
 const ATTESTATION_TTL_SECONDS = 60;
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export function publicationDelivery(signing, issuer, subject, deployed) {
+/**
+ * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
+ * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
+ * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
+ * deprecated v1 request. A stable target's Publication answers v1 only.
+ */
+export function releaseDelivery(signing, issuer, subject, deployed) {
+    const projection = deployed.version === 4 ? release.legacy.publication(deployed) : deployed;
     return Object.freeze({
         async create(request, context) {
             context.signal.throwIfAborted();
-            const now = Math.floor(Date.now() / 1_000);
-            const attestation = await new SignJWT({
-                purpose: publication.delivery.PURPOSE,
+            if (request.version === 1) {
+                const attestation = await attest(signing, issuer, subject, request.kernel, {
+                    purpose: release.legacy.delivery.PURPOSE,
+                    nonce: request.nonce,
+                    etag: projection.etag,
+                    schemaRevision: projection.schema.revision,
+                });
+                context.signal.throwIfAborted();
+                return release.legacy.delivery.accept({
+                    format: 'astrale.domain.delivery',
+                    version: 1,
+                    publication: projection,
+                    attestation,
+                });
+            }
+            if (deployed.version !== 4) {
+                throw new TypeError('A Publication-backed deployment answers Delivery v1 only.');
+            }
+            const attestation = await attest(signing, issuer, subject, request.kernel, {
+                purpose: release.delivery.PURPOSE,
                 nonce: request.nonce,
-                etag: deployed.etag,
+                release: deployed.digest,
                 schemaRevision: deployed.schema.revision,
-            })
-                .setProtectedHeader({
-                alg: signing.algorithm,
-                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-            })
-                .setIssuer(issuer)
-                .setSubject(subject)
-                .setAudience(request.kernel)
-                .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
-                .sign(await signing.privateKey);
+            });
             context.signal.throwIfAborted();
-            return publication.delivery.accept({
+            return release.delivery.accept({
                 format: 'astrale.domain.delivery',
-                version: 1,
-                publication: deployed,
+                version: 2,
+                release: deployed,
                 attestation,
             });
         },
     });
 }
+async function attest(signing, issuer, subject, kernel, claims) {
+    const now = Math.floor(Date.now() / 1_000);
+    return new SignJWT(claims)
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(issuer)
+        .setSubject(subject)
+        .setAudience(kernel)
+        .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
+        .sign(await signing.privateKey);
+}

package/dist/execution/identity/identity.d.ts

@@ -1,7 +1,9 @@
 import type { Fetch } from '@astrale-os/kernel-client';
-import type * as publicationProtocol from '@astrale-os/kernel-protocol/publication';
-import type { Issuer, exchange, publication } from '@astrale-os/kernel-server';
+import type * as releaseProtocol from '@astrale-os/kernel-protocol/release';
+import type { Issuer, exchange, release } from '@astrale-os/kernel-server';
 import type { IssuerId, JsonWebKey } from '../../platform/auth/index.js';
+import type { ClientSession } from '../../platform/client/session/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
 import type { InvocationAuthority } from '../invocation/index.js';
 import type { ExchangeOptions } from './exchange.js';
 import type { IdentityNetworkPolicy } from './jwks.js';
@@ -9,7 +11,20 @@ import type { IdentityNetworkPolicy } from './jwks.js';
 export interface Identity extends Issuer, InvocationAuthority {
     readonly subject: string;
     readonly tokenExchange?: exchange.Provider;
-    delivery(publication: publicationProtocol.Publication): publication.delivery.Provider;
+    /**
+     * Delivery for the exact document this deployment serves: Delivery v2 over its release and v1
+     * over its frozen v3 projection, or v1 over a stable target's Publication.
+     */
+    delivery(served: releaseProtocol.DomainRelease | releaseProtocol.legacy.Publication): release.delivery.Provider;
+    /**
+     * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`
+     * (`ctx.execution.id`), which no caller credential carries; its credentials name `executionId` in
+     * `EXECUTION_CLAIM`. Required to serve durable Workflows; the caller closes the Session.
+     */
+    executor?(kernel: IssuerId, executionId: NodeId, execution: {
+        readonly deadline: number;
+        readonly signal: AbortSignal;
+    }): ClientSession;
 }
 export interface IdentityInput extends IdentityNetworkPolicy {
     readonly issuer: IssuerId;

package/dist/execution/identity/identity.js

@@ -1,5 +1,5 @@
-import { admit, authenticate } from './authentication.js';
-import { publicationDelivery } from './delivery.js';
+import { admit, authenticate, executorSession } from './authentication.js';
+import { releaseDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
 import { createVerificationBasisResolver } from './jwks.js';
@@ -49,8 +49,9 @@ export function createIdentity(input) {
             ? {}
             : { loadIssuerPublicKeys: input.loadIssuerPublicKeys }),
         ...(exchangeProvider === undefined ? {} : { tokenExchange: exchangeProvider }),
-        delivery: (publication) => publicationDelivery(material, issuer, input.subject, publication),
+        delivery: (served) => releaseDelivery(material, issuer, input.subject, served),
         admit: (request) => admit(request, configuration),
+        executor: (kernel, executionId, execution) => executorSession(kernel, executionId, execution, configuration),
         authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),
     });
 }
@@ -67,6 +68,7 @@ export function identity(input) {
         'delivery',
         'admit',
         'authenticate',
+        'executor',
     ]);
     if (Reflect.ownKeys(input).some((key) => !allowed.has(key)) ||
         typeof input.subject !== 'string' ||
@@ -74,7 +76,8 @@ export function identity(input) {
         typeof input.loadPublicKeys !== 'function' ||
         typeof input.delivery !== 'function' ||
         typeof input.admit !== 'function' ||
-        typeof input.authenticate !== 'function') {
+        typeof input.authenticate !== 'function' ||
+        (input.executor !== undefined && typeof input.executor !== 'function')) {
         invalid();
     }
     const receiver = Object.freeze({ ...input });
@@ -92,6 +95,7 @@ export function identity(input) {
         delivery: receiver.delivery.bind(receiver),
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        ...(receiver.executor === undefined ? {} : { executor: receiver.executor.bind(receiver) }),
     });
 }
 function invalid() {

package/dist/execution/identity/jwks.js

@@ -8,6 +8,17 @@ const MAXIMUM_DISCOVERY_BYTES = 256 * 1024;
 const MAXIMUM_VERIFICATION_BASES = 64;
 const VERIFICATION_BASIS_TTL_MS = 60_000;
 const UNKNOWN_KEY_REFRESH_COOLDOWN_MS = 60_000;
+const DISCOVERY_RETRY_DELAY_MS = 250;
+// Only typed transport failures are replayable. Browser TypeError, TLS, HTTP and document
+// admission failures carry no evidence that repeating the request can safely recover.
+const TRANSIENT_TRANSPORT_CODES = new Set([
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ECONNRESET',
+    'ETIMEDOUT',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_SOCKET',
+]);
 /**
  * Retain only recently admitted public issuer material for one execution Identity.
  * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
@@ -220,21 +231,55 @@ async function discover(issuer, fetch, signal, policy) {
     });
 }
 async function request(fetch, url, signal) {
-    try {
-        const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+    for (let attempt = 0;; attempt += 1) {
+        signal.throwIfAborted();
+        try {
+            const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
+            if (!response.ok) {
+                await response.body?.cancel();
+                throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+            }
+            return response;
+        }
+        catch (cause) {
+            if (signal.aborted)
+                throw signal.reason;
+            if (cause instanceof IssuerUnavailable)
+                throw cause;
+            // One retry belongs to the shared issuer load, never to each observer or business call.
+            if (attempt !== 0 || !transientTransport(cause)) {
+                throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+            }
+            await retryDelay(signal);
         }
-        return response;
     }
-    catch (cause) {
-        if (signal.aborted)
-            throw signal.reason;
-        if (cause instanceof IssuerUnavailable)
-            throw cause;
-        throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+}
+function transientTransport(cause) {
+    // Node fetch wraps its transport Error; Bun may expose the code directly. Bound traversal
+    // of an external cause chain, including cycles, and do not look past a classified refusal.
+    for (let depth = 0; depth < 4; depth += 1) {
+        if (cause === null || typeof cause !== 'object')
+            return false;
+        const code = Reflect.get(cause, 'code');
+        if (typeof code === 'string')
+            return TRANSIENT_TRANSPORT_CODES.has(code);
+        cause = Reflect.get(cause, 'cause');
     }
+    return false;
+}
+function retryDelay(signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const cancel = () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', cancel);
+            resolve();
+        }, DISCOVERY_RETRY_DELAY_MS);
+        signal.addEventListener('abort', cancel, { once: true });
+    });
 }
 async function json(response, signal) {
     const bytes = new Uint8Array(await response.arrayBuffer());

package/dist/execution/index.d.ts

@@ -1,5 +1,7 @@
 export { serve } from './serve.js';
-export type { ExecutionContext, ServedApplication, ServeInput } from './serve.js';
-export { createIdentity, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
+export type { ExecutionContext, ServedDomain, ServeInput } from './serve.js';
+export { createIdentity, maximumExchangeTtl, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
 export { InvocationError } from './invocation/index.js';
 export type { InvocationErrorCode } from './invocation/index.js';
+export type { DurableEngine, DurableServing, DurableServingProvider } from './workflows/index.js';
+export { isCanonicalDurableRequest, isLegacyDurableRequest } from './workflows/route.js';

package/dist/execution/index.js

@@ -1,3 +1,4 @@
 export { serve } from './serve.js';
-export { createIdentity, } from './identity/index.js';
+export { createIdentity, maximumExchangeTtl, } from './identity/index.js';
 export { InvocationError } from './invocation/index.js';
+export { isCanonicalDurableRequest, isLegacyDurableRequest } from './workflows/route.js';

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,6 +1,5 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
-import type { AnonymousCaller, AuthenticatedCaller, ResolvedCallable } from '../../../application/action/index.js';
-import type { Release } from '../../../deployment/release/index.js';
+import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
 export interface AnonymousInvocation {
@@ -9,9 +8,5 @@ export interface AnonymousInvocation {
     readonly graph: null;
     close(): void;
 }
-interface AdmittedAuthenticatedInvocation extends Omit<AuthenticatedInvocation, 'caller'> {
-    readonly caller: AuthenticatedCaller;
-}
-export type InvocationAuthentication = AnonymousInvocation | AdmittedAuthenticatedInvocation;
-export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, release: Release, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
-export {};
+export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
+export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;