@astrale-os/sdk 0.6.0-beta.2 → 0.6.0-beta.21

package/dist/execution/invocation/admission/authentication.js

@@ -1,4 +1,4 @@
-import { grant, issuer } from '../../../platform/auth/index.js';
+import { issuer } from '../../../platform/auth/index.js';
 import { bindSession } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { protocolError } from '../result/index.js';
@@ -9,7 +9,7 @@ const ANONYMOUS = Object.freeze({
     graph: null,
     close() { },
 });
-export async function authentication(callable, request, release, domain, authority) {
+export async function authentication(callable, request, domain, authority) {
     const credential = request.credential;
     if (callable.auth === 'anonymous' && credential === undefined)
         return ANONYMOUS;
@@ -21,7 +21,6 @@ export async function authentication(callable, request, release, domain, authori
     const authenticated = await authority.authenticate({
         credential,
         via: requireVia(request),
-        publication: release.publication,
         domain,
         context: request.context,
     });
@@ -40,7 +39,6 @@ export async function authentication(callable, request, release, domain, authori
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
-            union: bindSession(graphInput.union),
         });
         return Object.freeze({ caller, graph, close });
     }
@@ -62,8 +60,7 @@ function admitGraph(input) {
         Array.isArray(input) ||
         !Object.hasOwn(input, 'caller') ||
         !Object.hasOwn(input, 'self') ||
-        !Object.hasOwn(input, 'union') ||
-        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self' && key !== 'union')) {
+        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self')) {
         invalid();
     }
     return input;
@@ -79,29 +76,18 @@ function admitCaller(input) {
         invalid();
     if (!Object.hasOwn(input, 'kind') ||
         !Object.hasOwn(input, 'principal') ||
-        !Object.hasOwn(input, 'authority') ||
+        !Object.hasOwn(input, 'identity') ||
         !Object.hasOwn(input, 'authentication') ||
-        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'authority' && key !== 'authentication') ||
+        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'identity' && key !== 'authentication') ||
         Reflect.get(input, 'kind') !== 'authenticated') {
         invalid();
     }
-    const principal = NodeId(Reflect.get(input, 'principal'));
-    const authority = grant.accept(Reflect.get(input, 'authority'));
-    const authentication = admitEvidence(Reflect.get(input, 'authentication'));
-    const caller = {
+    return Object.freeze({
         kind: 'authenticated',
-        get identity() {
-            if (authority.expr.kind !== 'identity') {
-                throw new TypeError('Caller authority does not resolve to one exact Identity.');
-            }
-            return authority.expr.id;
-        },
-        principal,
-        authority,
-        authentication,
-    };
-    Object.defineProperty(caller, 'identity', { enumerable: false });
-    return Object.freeze(caller);
+        identity: NodeId(Reflect.get(input, 'identity')),
+        principal: NodeId(Reflect.get(input, 'principal')),
+        authentication: admitEvidence(Reflect.get(input, 'authentication')),
+    });
 }
 function admitEvidence(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))

package/dist/execution/invocation/admission/authority.d.ts

@@ -1,5 +1,4 @@
 import type * as invocation from '@astrale-os/kernel-protocol/invocation';
-import type * as publication from '@astrale-os/kernel-protocol/publication';
 import type { HandlerRequest, InvocationContext } from '@astrale-os/kernel-server';
 import type { AuthenticatedCaller } from '../../../application/action/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
@@ -7,28 +6,36 @@ import type { Domain } from '../../../platform/schema/index.js';
 export interface InvocationAdmissionInput {
     readonly call: invocation.Call;
     readonly credential?: string;
-    readonly via: invocation.Via;
-    readonly publication: publication.Publication;
+    readonly via: invocation.Via | invocation.PublicationVia;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 export interface InvocationAuthenticationInput {
     readonly credential: string;
-    readonly via: invocation.Via;
-    readonly publication: publication.Publication;
+    readonly via: invocation.Via | invocation.PublicationVia;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 /** Authenticated capabilities before the SDK admits and derives application caller context. */
 export interface AuthenticatedInvocation {
-    readonly caller: Omit<AuthenticatedCaller, 'identity'>;
-    readonly graph: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>;
+    readonly caller: AuthenticatedCaller;
+    readonly graph: Readonly<Record<'caller' | 'self', BoundClientSession>>;
     close(): void;
 }
 export interface InvocationAuthority {
+    /**
+     * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
+     * rejects with the public refusal. A refusal whose reason is `FUNCTION_MISS` (the Kernel no longer
+     * places the call on this deployment) is answered as the reserved miss, never as an error.
+     */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
 }
 /** Capture the execution Identity capability and receiver-bind both privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
-export declare function requireVia(request: HandlerRequest): invocation.Via;
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
+ * (a release's exact projection, or a stable target's Publication).
+ */
+export declare function requireVia(request: HandlerRequest): invocation.Via | invocation.PublicationVia;

package/dist/execution/invocation/admission/authority.js

@@ -12,6 +12,11 @@ export function authority(input) {
         authenticate: receiver.authenticate.bind(receiver),
     });
 }
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
+ * (a release's exact projection, or a stable target's Publication).
+ */
 export function requireVia(request) {
     if (request.via === undefined) {
         throw protocolError('VALIDATION_ERROR', 'Remote invocation requires Via.');

package/dist/execution/invocation/admission/input.d.ts

@@ -1,2 +1,2 @@
-import type { ResolvedCallable } from '../../../application/action/index.js';
-export declare function input(callable: ResolvedCallable, value: unknown): void;
+import type { ResolvedCallable, ActionBinaryInput } from '../../../application/action/index.js';
+export declare function input(callable: ResolvedCallable, value: unknown, binary?: ActionBinaryInput): void;

package/dist/execution/invocation/admission/input.js

@@ -1,4 +1,18 @@
-import { validateInput } from '../result/index.js';
-export function input(callable, value) {
+import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
+import { validateInput, protocolError } from '../result/index.js';
+export function input(callable, value, binary) {
+    if (isBinaryInput(callable.input)) {
+        if (binary === undefined) {
+            throw protocolError('VALIDATION_ERROR', 'Binary Function request body is required.');
+        }
+        if (!Number.isSafeInteger(binary.length) ||
+            binary.length < 0 ||
+            binary.length > callable.input.maximumBytes) {
+            throw protocolError('LIMIT_EXCEEDED', 'Binary Function request body exceeds its limit.');
+        }
+    }
+    else if (binary !== undefined) {
+        throw protocolError('VALIDATION_ERROR', 'Callable does not accept a binary request body.');
+    }
     validateInput(callable, value);
 }

package/dist/execution/invocation/dependency/bind.d.ts

@@ -2,4 +2,4 @@ import type { HandlerDependencies } from '../../../application/dependency/index.
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 /** Bind each explicit authority to its admitted session; metadata remains inert. */
-export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>): HandlerDependencies<D>;
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self', BoundClientSession>>): HandlerDependencies<D>;

package/dist/execution/invocation/dependency/bind.js

@@ -1,4 +1,5 @@
 import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
 import { reference } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { Path } from '../../../platform/graph/path/index.js';
@@ -11,7 +12,6 @@ export function bindDependencies(domain, sessions) {
         dependencies[alias] = Object.freeze({
             caller: bindDependency(dependency, sessions.caller),
             self: bindDependency(dependency, sessions.self),
-            union: bindDependency(dependency, sessions.union),
         });
     }
     return Object.freeze(dependencies);
@@ -20,19 +20,14 @@ function bindDependency(dependency, session) {
     const invoke = session.invoke.bind(session);
     return Object.freeze({
         async invoke(select, ...args) {
-            if (typeof select !== 'function')
-                invalid();
-            const selected = select(dependency);
-            if (selected === null ||
-                typeof selected !== 'object' ||
-                !('key' in selected) ||
-                typeof selected.key !== 'string')
-                invalid();
-            const callable = dependency.callable(selected.key);
-            if (callable !== selected || Key.origin(callable.key) !== dependency.origin)
-                invalid();
-            if ('owner' in callable && (!callable.executable || !ownMethod(dependency, callable)))
-                invalid();
+            const callable = selectedCallable(dependency, select);
+            if (isBinaryInput(callable.input)) {
+                if ('owner' in callable || args.length !== 2)
+                    invalid();
+                // Runtime selection is wider than the authored Function; mode was checked above.
+                const binaryReference = reference(dependency, callable);
+                return invoke(binaryReference, args[0], binaryOptions(args[1]));
+            }
             if ('owner' in callable && !callable.static) {
                 if (args.length < 2 || args.length > 3 || typeof args[0] !== 'string')
                     invalid();
@@ -45,6 +40,22 @@ function bindDependency(dependency, session) {
         },
     });
 }
+function selectedCallable(domain, select) {
+    if (typeof select !== 'function')
+        invalid();
+    const selected = select(domain);
+    if (selected === null ||
+        typeof selected !== 'object' ||
+        !('key' in selected) ||
+        typeof selected.key !== 'string')
+        invalid();
+    const callable = domain.callable(selected.key);
+    if (callable !== selected || Key.origin(callable.key) !== domain.origin)
+        invalid();
+    if ('owner' in callable && (!callable.executable || !ownMethod(domain, callable)))
+        invalid();
+    return callable;
+}
 function ownMethod(domain, callable) {
     const owner = Object.values(domain.classes).find((value) => value === callable.owner);
     if (owner === undefined)
@@ -63,6 +74,16 @@ function options(value) {
     // Canonical ClientSession admits option values and clamps them to the parent lifetime.
     return value;
 }
+function binaryOptions(value) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        !Object.hasOwn(value, 'body') ||
+        !(value.body instanceof Blob) ||
+        Reflect.ownKeys(value).some((key) => key !== 'body' && key !== 'timeoutMs'))
+        invalid();
+    return value;
+}
 function invalid() {
     throw new TypeError('Dependency invocation requires one owned executable callable, its input, and valid instance/options.');
 }

package/dist/execution/invocation/dispatch/context.d.ts

@@ -1,5 +1,5 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
-import type { ActionExecution, Caller, DomainGraphExecutors, DomainKernelSessions } from '../../../application/action/index.js';
+import type { ActionExecution, ActionBinaryInput, Caller, DomainGraphExecutors, DomainKernelSessions } from '../../../application/action/index.js';
 import type { HandlerDependencies } from '../../../application/dependency/index.js';
 import type { MutationExecutor } from '../../../application/mutation/index.js';
 import type { QueryExecutor } from '../../../application/query/index.js';
@@ -10,6 +10,7 @@ import type { InvocationAuthentication } from '../admission/index.js';
 export interface DispatchContext {
     readonly domain: Domain;
     readonly input: unknown;
+    readonly body?: ActionBinaryInput;
     readonly caller: Caller;
     readonly dependencies: HandlerDependencies<Domain> | null;
     readonly kernel: DomainKernelSessions | null;

package/dist/execution/invocation/dispatch/context.js

@@ -17,6 +17,7 @@ export function context(request, runtime, authentication, self) {
     return Object.freeze({
         domain: runtime.loaded.domain,
         input: request.call.input,
+        ...(request.context.binary === undefined ? {} : { body: request.context.binary }),
         caller: authentication.caller,
         kernel: authentication.graph === null
             ? null
@@ -59,6 +60,5 @@ function bindGraph(clients, domain) {
         ...self,
         caller: bind(clients.caller),
         self,
-        union: bind(clients.union),
     });
 }

package/dist/execution/invocation/invocation.js

@@ -1,36 +1,42 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as errors from '@astrale-os/kernel-protocol/errors';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { authentication, input, requireVia, target } from './admission/index.js';
 import { action, context, select, workflow } from './dispatch/index.js';
 import { active, settle } from './lifecycle/index.js';
 import { project, protocolError } from './result/index.js';
+/** The reserved answer of a deployment that does not serve the call: its caller re-routes. */
+const MISS = Object.freeze({ kind: 'miss' });
+const FUNCTION_MISS = 'FUNCTION_MISS';
 export async function invoke(request, inputConfig) {
     active(request.context);
-    const release = inputConfig.runtime.loaded.release;
-    const snapshot = request.publication;
-    if (snapshot === undefined ||
-        !publication.matchesReference(snapshot.publication, publication.reference(release.publication))) {
-        throw protocolError('CONFLICT', 'Invocation Publication differs from the running Release.');
+    if (!pinsRunningRelease(request, inputConfig.runtime.loaded.release)) {
+        throw protocolError('CONFLICT', 'Invocation release differs from the running Release.');
     }
     if (request.credential !== undefined && typeof request.credential !== 'string') {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    const via = requireVia(request);
-    const selectedTarget = target(await inputConfig.authority.admit({
+    const admitted = await admit(inputConfig.authority, {
         call: request.call,
         ...(request.credential === undefined ? {} : { credential: request.credential }),
-        via,
-        publication: release.publication,
+        via: requireVia(request),
         domain: inputConfig.runtime.loaded.domain,
         context: request.context,
-    }));
-    const selected = select(inputConfig.runtime.loaded.registry, selectedTarget);
+    });
+    if (admitted === undefined)
+        return MISS;
+    const selected = select(inputConfig.runtime.loaded.registry, admitted);
     if (selected === undefined)
-        return Object.freeze({ kind: 'miss' });
-    input(selected.implementation.callable, request.call.input);
-    const admittedAuthentication = await authentication(selected.implementation.callable, request, release, inputConfig.runtime.loaded.domain, inputConfig.authority);
+        return MISS;
+    if (selected.implementation.kind === 'workflow' && selected.implementation.durable) {
+        // The Kernel records a durable call as an Execution and runs it on the engine; running it
+        // inline here would silently drop durability.
+        throw protocolError('UNSUPPORTED', 'A durable Workflow runs only as a Kernel Execution.');
+    }
+    input(selected.implementation.callable, request.call.input, request.context.binary);
+    const admittedAuthentication = await authentication(selected.implementation.callable, request, inputConfig.runtime.loaded.domain, inputConfig.authority);
     const close = once(admittedAuthentication.close);
-    active(request.context);
     try {
+        active(request.context);
         const dispatchContext = context(request, inputConfig.runtime, admittedAuthentication, selected.self);
         const output = selected.implementation.kind === 'action'
             ? await action(selected.implementation, dispatchContext)
@@ -42,6 +48,42 @@ export async function invoke(request, inputConfig) {
         throw cause;
     }
 }
+/**
+ * The source Kernel's `Function.admit` refuses `FUNCTION_MISS` when it no longer places the call on
+ * this deployment, as for a client whose learned route still names a deployment replaced by a
+ * consented install. That refusal is answered as the reserved miss, never as a public error, so
+ * the client re-routes through its source Kernel (AM-85). Every other refusal is unchanged.
+ */
+async function admit(authority, admission) {
+    let admitted;
+    try {
+        admitted = await authority.admit(admission);
+    }
+    catch (cause) {
+        if (refusedAsMiss(cause))
+            return undefined;
+        throw cause;
+    }
+    return target(admitted);
+}
+function refusedAsMiss(cause) {
+    return (cause instanceof errors.ProtocolError &&
+        errors.reasonOf(cause.payload.data)?.code === FUNCTION_MISS);
+}
+/**
+ * The Kernel Server pins every request to the one snapshot it serves: the release of an immutable
+ * deployment, or a stable target's Publication. Execution answers only for that exact document.
+ */
+function pinsRunningRelease(request, running) {
+    if (running.kind === 'release') {
+        return (request.publication === undefined &&
+            request.release !== undefined &&
+            release.matchesReference(request.release.release, release.reference(running.document)));
+    }
+    return (request.release === undefined &&
+        request.publication !== undefined &&
+        release.legacy.matchesReference(request.publication.publication, release.legacy.reference(running.publication)));
+}
 function once(operation) {
     let called = false;
     return () => {

package/dist/execution/invocation/result/project.js

@@ -2,6 +2,10 @@ import { InvocationDefect } from './errors.js';
 import { validateOutput } from './validate.js';
 const MEDIA_TYPE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
 const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
+const BUFFERED_FIELDS = new Set(['body', 'mediaType', 'status', 'headers']);
+const STREAMING_FIELDS = new Set([...BUFFERED_FIELDS, 'length', 'delivery']);
+/** Largest delay a host timer accepts; the Server rejects a longer delivery budget. */
+const MAXIMUM_TIMER_MS = 2_147_483_647;
 export function project(callable, output) {
     switch (callable.output.mode) {
         case 'value':
@@ -72,7 +76,8 @@ function binary(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalidBinary();
     const value = input;
-    if (Reflect.ownKeys(input).some((key) => key !== 'body' && key !== 'mediaType' && key !== 'status' && key !== 'headers') ||
+    const fields = isBytes(value.body) ? BUFFERED_FIELDS : STREAMING_FIELDS;
+    if (Reflect.ownKeys(input).some((key) => typeof key !== 'string' || !fields.has(key)) ||
         (!isBytes(value.body) && !isAsyncBytes(value.body)) ||
         typeof value.mediaType !== 'string' ||
         !MEDIA_TYPE.test(value.mediaType) ||
@@ -89,13 +94,48 @@ function binary(input) {
             ...(headers === undefined ? {} : { headers }),
         });
     }
+    const length = streamingLength(value.length);
+    const delivery = deliveryBudget(value.delivery);
     return Object.freeze({
         body: new InvocationByteStream(value.body),
         mediaType: value.mediaType,
+        // The declared length is the only count a Client verifies a streaming delivery against.
+        ...(length === undefined ? {} : { length }),
+        ...(delivery === undefined ? {} : { delivery }),
         ...(value.status === undefined ? {} : { status: value.status }),
         ...(headers === undefined ? {} : { headers }),
     });
 }
+function streamingLength(input) {
+    if (input === undefined)
+        return undefined;
+    if (typeof input !== 'number' || !Number.isSafeInteger(input) || input < 0)
+        invalidBinary();
+    return input;
+}
+function deliveryBudget(input) {
+    if (input === undefined)
+        return undefined;
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalidBinary();
+    const value = input;
+    if (Reflect.ownKeys(input).some((key) => key !== 'maximumDurationMs' && key !== 'idleTimeoutMs') ||
+        !isTimerDuration(value.maximumDurationMs) ||
+        !isTimerDuration(value.idleTimeoutMs) ||
+        value.idleTimeoutMs > value.maximumDurationMs) {
+        invalidBinary();
+    }
+    return Object.freeze({
+        maximumDurationMs: value.maximumDurationMs,
+        idleTimeoutMs: value.idleTimeoutMs,
+    });
+}
+function isTimerDuration(input) {
+    return (typeof input === 'number' &&
+        Number.isSafeInteger(input) &&
+        input > 0 &&
+        input <= MAXIMUM_TIMER_MS);
+}
 class InvocationByteStream {
     source;
     consumed = false;

package/dist/execution/node/serve.d.ts

@@ -1,4 +1,4 @@
-import type { ServedApplication } from '../serve.js';
+import type { ServedDomain } from '../serve.js';
 import type { NodeListener } from './listener.js';
 export interface NodeOptions<Environment> {
     readonly environment: Environment;
@@ -6,4 +6,4 @@ export interface NodeOptions<Environment> {
     readonly hostname?: string;
 }
 /** Listen on Node around one already composed provider-neutral served application. */
-export declare function listen<Environment>(application: ServedApplication<Environment>, options: NodeOptions<Environment>): Promise<NodeListener>;
+export declare function listen<Environment>(application: ServedDomain<Environment>, options: NodeOptions<Environment>): Promise<NodeListener>;

package/dist/execution/node/serve.js

@@ -7,7 +7,7 @@ export async function listen(application, options) {
         typeof application.fetch !== 'function' ||
         typeof application.drain !== 'function' ||
         typeof application.close !== 'function') {
-        throw new TypeError('Node listener requires a served Application.');
+        throw new TypeError('Node listener requires a served Domain.');
     }
     const config = admit(options);
     let server;

package/dist/execution/runtime/index.d.ts

@@ -3,3 +3,4 @@ export { initialize, type InitializedRuntime } from './initialize.js';
 export { integrations } from './integrations.js';
 export { load, type LoadedRuntime } from './load.js';
 export { providers } from './providers.js';
+export { isServedRelease, serving, type ServedRelease, type Serving } from './release.js';

package/dist/execution/runtime/index.js

@@ -3,3 +3,4 @@ export { initialize } from './initialize.js';
 export { integrations } from './integrations.js';
 export { load } from './load.js';
 export { providers } from './providers.js';
+export { isServedRelease, serving } from './release.js';

package/dist/execution/runtime/load.d.ts

@@ -2,13 +2,13 @@ import type { Domain } from '@astrale-os/kernel-dsl/v1/domain';
 import type { DomainSchema, DomainOf } from '@astrale-os/kernel-dsl/v1/schema';
 import type { RuntimeRegistry } from '../../application/runtime/index.js';
 import type { Build } from '../../deployment/build/build.js';
-import type { Release } from '../../deployment/release/release.js';
+import type { ServedRelease } from './release.js';
 type DomainOfBuild<BuildValue extends Build> = BuildValue extends Build<infer Schema extends DomainSchema, object> ? Extract<DomainOf<Schema>, Domain> : Domain;
 export interface LoadedRuntime<BuildValue extends Build = Build> {
-    readonly release: Release<BuildValue>;
+    readonly release: ServedRelease<BuildValue>;
     readonly domain: DomainOfBuild<BuildValue>;
     readonly registry: RuntimeRegistry;
 }
 /** Load one execution Runtime from the exact evidence retained by its admitted Build. */
-export declare function load<const BuildValue extends Build>(release: Release<BuildValue>): LoadedRuntime<BuildValue>;
+export declare function load<const BuildValue extends Build>(release: ServedRelease<BuildValue>): LoadedRuntime<BuildValue>;
 export {};

package/dist/execution/runtime/load.js

@@ -1,10 +1,11 @@
 import { evidenceOf } from '../../deployment/build/admission.js';
-import { isRelease } from '../../deployment/release/admission.js';
 import { capture } from './admission.js';
+import { isServedRelease } from './release.js';
 /** Load one execution Runtime from the exact evidence retained by its admitted Build. */
 export function load(release) {
-    if (!isRelease(release))
+    if (!isServedRelease(release)) {
         throw new TypeError('Runtime loading requires an admitted Release.');
+    }
     const evidence = evidenceOf(release.build);
     const domain = evidence.domain;
     const { registry } = evidence;

package/dist/execution/runtime/release.d.ts

@@ -0,0 +1,22 @@
+import type * as release from '@astrale-os/kernel-protocol/release';
+import type { Build } from '../../deployment/build/build.js';
+import type * as legacy from '../../deployment/release/legacy/index.js';
+import type { Release } from '../../deployment/release/release.js';
+import type { IssuerId } from '../../platform/auth/index.js';
+/**
+ * What one Service serves: the `DomainRelease` v4 Release of an immutable deployment, or the
+ * deprecated v3 Release of a stable target (`legacy`, its consumers and removal in
+ * `deployment/release/legacy/index.ts`, D10).
+ */
+export type ServedRelease<BuildValue extends Build = Build> = Release<BuildValue> | legacy.Release<BuildValue>;
+/** Where and as whom one served Release answers, and the document it serves. */
+export interface Serving {
+    /** Domain identity issuer: a deployment's URL, or a stable target's configured issuer. */
+    readonly issuer: IssuerId;
+    /** Public origin the Server answers at: a deployment's URL, or a stable target's route. */
+    readonly publicUrl: IssuerId;
+    /** The document served at `release.json`, or a stable target's v3 Publication at `domain.json`. */
+    readonly document: release.DomainRelease | release.legacy.Publication;
+}
+export declare function isServedRelease(input: unknown): input is ServedRelease;
+export declare function serving(served: ServedRelease): Serving;

package/dist/execution/runtime/release.js

@@ -0,0 +1,14 @@
+import { isRelease } from '../../deployment/release/admission.js';
+import { isRelease as isLegacyRelease } from '../../deployment/release/legacy/admission.js';
+export function isServedRelease(input) {
+    return isRelease(input) || isLegacyRelease(input);
+}
+export function serving(served) {
+    return served.kind === 'release'
+        ? Object.freeze({ issuer: served.url, publicUrl: served.url, document: served.document })
+        : Object.freeze({
+            issuer: served.addressing.issuer,
+            publicUrl: served.addressing.publicUrl,
+            document: served.publication,
+        });
+}

package/dist/execution/serve.d.ts

@@ -1,10 +1,11 @@
 import type { ServerCloseOptions } from '@astrale-os/kernel-server';
-import type { publication } from '@astrale-os/kernel-server';
+import type { release } from '@astrale-os/kernel-server';
 import type { Runtime } from '../application/runtime/index.js';
 import type { WorkflowRunner } from '../application/workflow/runner/index.js';
 import type { Identity } from './identity/index.js';
 import type { ReleaseLoader } from './service/index.js';
 import type { ServiceServerOptions } from './service/index.js';
+import type { DurableServingProvider } from './workflows/index.js';
 export interface ExecutionContext {
     waitUntil(promise: Promise<unknown>): void;
     readonly sleep?: (durationMs: number) => Promise<void>;
@@ -15,13 +16,18 @@ export interface ServeInput<Environment, RuntimeValue extends Runtime, RuntimeEn
     identity(environment: Environment): Identity;
     readonly initialize?: (environment: Environment) => RuntimeEnvironment;
     readonly server: ServiceServerOptions;
-    readonly delivery?: (environment: Environment) => publication.delivery.Provider | undefined;
+    readonly delivery?: (environment: Environment) => release.delivery.Provider | undefined;
     readonly workflows?: WorkflowRunner;
+    /**
+     * Serve durable Workflows to the workflow engine; required when the Release declares any.
+     * Undefined for an environment that names no engine: engine requests are then refused.
+     */
+    readonly durable?: (environment: Environment, request: Request) => ReturnType<DurableServingProvider>;
 }
-export interface ServedApplication<Environment> {
+export interface ServedDomain<Environment> {
     fetch(request: Request, environment: Environment, context?: ExecutionContext): Promise<Response>;
     drain(): void;
     close(options: ServerCloseOptions): Promise<void>;
 }
 /** Create one provider-neutral Fetch entrypoint around a lazily initialized current Service. */
-export declare function serve<Environment, RuntimeValue extends Runtime, RuntimeEnvironment = Environment>(input: ServeInput<Environment, RuntimeValue, RuntimeEnvironment>): ServedApplication<Environment>;
+export declare function serve<Environment, RuntimeValue extends Runtime, RuntimeEnvironment = Environment>(input: ServeInput<Environment, RuntimeValue, RuntimeEnvironment>): ServedDomain<Environment>;

package/dist/execution/serve.js

@@ -22,6 +22,9 @@ export function serve(input) {
             server: input.server,
             ...(input.delivery === undefined ? {} : { delivery: input.delivery(environment) }),
             ...(input.workflows === undefined ? {} : { workflows: input.workflows }),
+            ...(input.durable === undefined
+                ? {}
+                : { durable: (request) => input.durable(environment, request) }),
         });
         if (drained)
             service.drain();