@astrale-os/sdk 0.6.0-beta.2 → 0.6.0-beta.21

package/dist/execution/workflows/failure.js

@@ -0,0 +1,43 @@
+import { declaredErrorFactory, declaredErrorOf } from '../../application/error/index.js';
+/** Metadata key the Kernel reads a declared failure from (`backend/restate` outcome decoding). */
+const FAILURE = 'astrale.failure';
+const STATUS = {
+    VALIDATION_ERROR: 422,
+    NOT_FOUND: 404,
+    CONFLICT: 409,
+    UNSUPPORTED: 422,
+};
+/**
+ * Encode a declared business error of `definition` as a terminal engine failure, or return
+ * undefined for any other error, which the engine retries.
+ */
+export function terminalFailure(engine, cause, definition) {
+    const declared = declaredErrorOf(cause, definition);
+    if (declared === undefined)
+        return undefined;
+    return new engine.TerminalError(declared.message, {
+        errorCode: STATUS[declared.family],
+        metadata: {
+            [FAILURE]: JSON.stringify({
+                family: declared.family,
+                code: declared.code,
+                message: declared.message,
+                details: declared.details,
+            }),
+        },
+    });
+}
+/**
+ * The declared business error a journaled Step failed with, rebuilt through the definition's own
+ * factory, so a replay throws what the live run threw.
+ */
+export function replayedFailure(engine, cause, definition) {
+    if (!(cause instanceof engine.TerminalError) || cause instanceof engine.CancelledError) {
+        return undefined;
+    }
+    const encoded = cause.metadata?.[FAILURE];
+    if (encoded === undefined)
+        return undefined;
+    const failure = JSON.parse(encoded);
+    return declaredErrorFactory(definition)(failure.code, failure.details);
+}

package/dist/execution/workflows/index.d.ts

@@ -0,0 +1,4 @@
+export type { DurableEngine, EngineRetryPolicy, EngineSharedContext, EngineWorkflowContext, EngineWorkflowDefinition, } from './engine.js';
+export { durableServing, type AdmittedDurableServing, type DurableServing, type DurableServingProvider, } from './options.js';
+export { createDurableReceiver, type DurableReceiver } from './receiver.js';
+export { isDurableRequest, isCanonicalDurableRequest, isLegacyDurableRequest } from './route.js';

package/dist/execution/workflows/index.js

@@ -0,0 +1,3 @@
+export { durableServing, } from './options.js';
+export { createDurableReceiver } from './receiver.js';
+export { isDurableRequest, isCanonicalDurableRequest, isLegacyDurableRequest } from './route.js';

package/dist/execution/workflows/options.d.ts

@@ -0,0 +1,40 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { DurableEngine, EngineRetryPolicy } from './engine.js';
+/** Serving configuration of the durable Workflows of one deployment. */
+export interface DurableServing {
+    /** The Restate SDK Fetch build of this platform. */
+    readonly engine: DurableEngine;
+    /**
+     * @deprecated Explicit signing authority for retained callbacks registered before issuer-prefixed
+     * paths. Canonical requests discover their authority from the named Kernel and ignore these keys.
+     */
+    readonly identityKeys?: readonly string[];
+    /** Fetch capability used for HTTPS discovery of a canonical request's Kernel engine. */
+    readonly fetch?: Fetch;
+    /**
+     * How long the engine retains a finished run. At least the Host minimum (one hour or more, one
+     * day by default); the Kernel resubmits an unstarted call only within half of it. Seven days by
+     * default.
+     */
+    readonly retentionMs?: number;
+    /** Attempts of a failing run before it pauses for `resume` or `cancel`. The Host caps them. */
+    readonly retry?: {
+        readonly maxAttempts?: number;
+        readonly initialIntervalMs?: number;
+        readonly maxIntervalMs?: number;
+    };
+    /** Deadline of one Step, including its Kernel calls. One minute by default. */
+    readonly stepTimeoutMs?: number;
+}
+/** Resolve a deployment's engine only when its durable receiver is first requested. */
+export type DurableServingProvider = (request: Request) => DurableServing | undefined | Promise<DurableServing | undefined>;
+export interface AdmittedDurableServing {
+    readonly engine: DurableEngine;
+    readonly identityKeys: readonly string[];
+    readonly fetch: Fetch;
+    readonly retentionMs: number;
+    readonly retryPolicy: EngineRetryPolicy;
+    readonly stepTimeoutMs: number;
+}
+/** Capture one durable serving configuration, failing closed on any gap. */
+export declare function durableServing(input: DurableServing): AdmittedDurableServing;

package/dist/execution/workflows/options.js

@@ -0,0 +1,83 @@
+import { acceptWorkflowEngineIdentityKey } from '@astrale-os/kernel-protocol/issuer/workflow-engine';
+const HOUR_MS = 60 * 60_000;
+const DAY_MS = 24 * HOUR_MS;
+const MAXIMUM_IDENTITY_KEYS = 16;
+/** Capture one durable serving configuration, failing closed on any gap. */
+export function durableServing(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => key !== 'engine' &&
+            key !== 'identityKeys' &&
+            key !== 'fetch' &&
+            key !== 'retentionMs' &&
+            key !== 'retry' &&
+            key !== 'stepTimeoutMs')) {
+        invalid('Durable serving options are invalid.');
+    }
+    const engine = input.engine;
+    if (engine === null ||
+        typeof engine !== 'object' ||
+        typeof engine.createEndpointHandler !== 'function' ||
+        typeof engine.workflow !== 'function' ||
+        typeof engine.TerminalError !== 'function' ||
+        typeof engine.CancelledError !== 'function') {
+        invalid('Durable serving requires the Restate SDK Fetch entrypoint of this platform.');
+    }
+    const keys = input.identityKeys;
+    let identityKeys = Object.freeze([]);
+    if (keys !== undefined) {
+        if (!Array.isArray(keys) || keys.length === 0 || keys.length > MAXIMUM_IDENTITY_KEYS) {
+            invalid('Durable serving requires engine request identity keys (publickeyv1_…).');
+        }
+        // Legacy callbacks retain their original sixteen-key input budget and duplicate policy.
+        try {
+            identityKeys = Object.freeze(Array.from(keys, acceptWorkflowEngineIdentityKey));
+        }
+        catch (cause) {
+            throw new TypeError('Durable serving requires engine request identity keys (publickeyv1_…).', { cause });
+        }
+    }
+    const fetch = input.fetch ?? globalThis.fetch.bind(globalThis);
+    if (typeof fetch !== 'function')
+        invalid('Durable serving requires Fetch for engine discovery.');
+    const retry = input.retry ?? {};
+    if (retry === null ||
+        typeof retry !== 'object' ||
+        Array.isArray(retry) ||
+        Reflect.ownKeys(retry).some((key) => key !== 'maxAttempts' && key !== 'initialIntervalMs' && key !== 'maxIntervalMs')) {
+        invalid('Durable retry options are invalid.');
+    }
+    const initialInterval = bounded(retry.initialIntervalMs, 1_000, 1, HOUR_MS, 'initialIntervalMs');
+    const maxInterval = bounded(retry.maxIntervalMs, 60_000, initialInterval, DAY_MS, 'maxIntervalMs');
+    return Object.freeze({
+        engine: Object.freeze({
+            createEndpointHandler: engine.createEndpointHandler.bind(engine),
+            workflow: engine.workflow.bind(engine),
+            TerminalError: engine.TerminalError,
+            CancelledError: engine.CancelledError,
+        }),
+        identityKeys,
+        fetch,
+        retentionMs: bounded(input.retentionMs, 7 * DAY_MS, HOUR_MS, 365 * DAY_MS, 'retentionMs'),
+        retryPolicy: Object.freeze({
+            maxAttempts: bounded(retry.maxAttempts, 20, 1, 1_000, 'maxAttempts'),
+            onMaxAttempts: 'pause',
+            initialInterval,
+            maxInterval,
+            exponentiationFactor: 2,
+        }),
+        stepTimeoutMs: bounded(input.stepTimeoutMs, 60_000, 1_000, HOUR_MS, 'stepTimeoutMs'),
+    });
+}
+function bounded(input, fallback, minimum, maximum, label) {
+    if (input === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(input) || input < minimum || input > maximum) {
+        invalid(`Durable ${label} must be an integer between ${minimum} and ${maximum}.`);
+    }
+    return input;
+}
+function invalid(message) {
+    throw new TypeError(message);
+}

package/dist/execution/workflows/receiver.d.ts

@@ -0,0 +1,22 @@
+import type { RuntimeWorkflow } from '../../application/runtime/workflows.js';
+import type { Domain } from '../../platform/schema/index.js';
+import type { Identity } from '../identity/index.js';
+import type { AdmittedDurableServing } from './options.js';
+/** Serves the engine's discovery and invocations of this deployment's durable Workflows. */
+export interface DurableReceiver {
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Route `…/invoke/restate/<Kernel issuer>/<declaration key>/<service>/{discover,invoke/…}` to one
+ * engine endpoint. Retained services registered before issuer-prefixed paths keep their old
+ * `<declaration key>/<service>` route with explicit legacy signing keys. Canonical routes discover
+ * their signing authority at the named Kernel; that issuer also binds the run envelope. Each
+ * endpoint serves exactly that service with the declared Workflow. A declaration this Release does not
+ * serve durably is refused, so an endpoint never runs code it does not declare.
+ */
+export declare function createDurableReceiver(input: {
+    readonly workflows: readonly RuntimeWorkflow[];
+    readonly domain: Domain;
+    readonly identity: Identity;
+    readonly serving: AdmittedDurableServing;
+}): DurableReceiver;

package/dist/execution/workflows/receiver.js

@@ -0,0 +1,99 @@
+import { workflowEngineDiscovery, WorkflowEngineUnavailable } from './discovery.js';
+import { durableRoute } from './route.js';
+import { durableHandlers } from './run.js';
+const MAXIMUM_ENDPOINTS = 256;
+/**
+ * Route `…/invoke/restate/<Kernel issuer>/<declaration key>/<service>/{discover,invoke/…}` to one
+ * engine endpoint. Retained services registered before issuer-prefixed paths keep their old
+ * `<declaration key>/<service>` route with explicit legacy signing keys. Canonical routes discover
+ * their signing authority at the named Kernel; that issuer also binds the run envelope. Each
+ * endpoint serves exactly that service with the declared Workflow. A declaration this Release does not
+ * serve durably is refused, so an endpoint never runs code it does not declare.
+ */
+export function createDurableReceiver(input) {
+    const executor = input.identity.executor;
+    if (executor === undefined) {
+        throw new TypeError('Durable Workflows require an execution Identity that can act as the Domain.');
+    }
+    const bound = executor.bind(input.identity);
+    const declared = new Map(input.workflows
+        .filter((workflow) => workflow.durable)
+        .map((workflow) => [workflow.callable.key, workflow]));
+    const endpoints = new Map();
+    const { engine } = input.serving;
+    const discovery = workflowEngineDiscovery(input.serving.fetch);
+    return Object.freeze({
+        async fetch(request) {
+            const route = durableRoute(request);
+            if (route === undefined)
+                return refused();
+            const { kernel, declaration, service } = route;
+            const workflow = declared.get(declaration);
+            if (workflow === undefined)
+                return refused();
+            let identityKeys = input.serving.identityKeys;
+            if (kernel !== undefined) {
+                try {
+                    identityKeys = (await discovery.resolve(kernel)).identity_keys;
+                }
+                catch (cause) {
+                    if (!(cause instanceof WorkflowEngineUnavailable))
+                        throw cause;
+                    return unavailable();
+                }
+            }
+            else if (identityKeys.length === 0)
+                return refused();
+            request.signal.throwIfAborted();
+            const cacheKey = JSON.stringify([kernel ?? null, declaration, service, identityKeys]);
+            let endpoint = endpoints.get(cacheKey);
+            if (endpoint === undefined) {
+                const definition = engine.workflow({
+                    name: service,
+                    handlers: durableHandlers({
+                        workflow,
+                        domain: input.domain,
+                        executor: bound,
+                        serving: input.serving,
+                        ...(kernel === undefined ? {} : { kernel }),
+                    }),
+                    options: {
+                        workflowRetention: input.serving.retentionMs,
+                        retryPolicy: input.serving.retryPolicy,
+                    },
+                });
+                try {
+                    endpoint = engine.createEndpointHandler({
+                        identityKeys: [...identityKeys],
+                        services: [definition],
+                    });
+                }
+                catch (cause) {
+                    if (kernel === undefined)
+                        throw cause;
+                    discovery.forget(kernel, identityKeys);
+                    return unavailable();
+                }
+                if (endpoints.size >= MAXIMUM_ENDPOINTS)
+                    endpoints.delete(endpoints.keys().next().value);
+                endpoints.set(cacheKey, endpoint);
+            }
+            const response = await endpoint(request);
+            if (kernel !== undefined && response.status === 401)
+                discovery.invalidate(kernel, identityKeys);
+            return response;
+        },
+    });
+}
+function refused() {
+    return new Response('{"error":"Unknown durable declaration."}', {
+        status: 404,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+    });
+}
+function unavailable() {
+    return new Response('{"error":"Workflow engine authority is unavailable."}', {
+        status: 503,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+    });
+}

package/dist/execution/workflows/route.d.ts

@@ -0,0 +1,14 @@
+import type { IssuerId } from '../../platform/auth/index.js';
+export interface DurableRoute {
+    readonly kernel?: IssuerId;
+    readonly declaration: string;
+    readonly service: string;
+}
+/** Whether the request is owned by the durable receiver, including malformed paths. */
+export declare function isDurableRequest(request: Request): boolean;
+/** Canonical requests discover authority at the HTTPS Kernel named by this admitted route. */
+export declare function isCanonicalDurableRequest(request: Request): boolean;
+/** Retained callbacks need explicit legacy signing authority before an engine module is loaded. */
+export declare function isLegacyDurableRequest(request: Request): boolean;
+/** One wire decoder shared by the receiver and platform lazy-load eligibility. */
+export declare function durableRoute(request: Request): DurableRoute | undefined;

package/dist/execution/workflows/route.js

@@ -0,0 +1,40 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { invocationPath } from '../../deployment/release/invocation.js';
+import { AuthValueError } from '../../platform/auth/index.js';
+import { httpIssuer } from '../identity/errors.js';
+const PREFIX = `${invocationPath()}/restate/`;
+const SERVICE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
+/** Whether the request is owned by the durable receiver, including malformed paths. */
+export function isDurableRequest(request) {
+    return new URL(request.url).pathname.startsWith(PREFIX);
+}
+/** Canonical requests discover authority at the HTTPS Kernel named by this admitted route. */
+export function isCanonicalDurableRequest(request) {
+    return durableRoute(request)?.kernel !== undefined;
+}
+/** Retained callbacks need explicit legacy signing authority before an engine module is loaded. */
+export function isLegacyDurableRequest(request) {
+    const route = durableRoute(request);
+    return route !== undefined && route.kernel === undefined;
+}
+/** One wire decoder shared by the receiver and platform lazy-load eligibility. */
+export function durableRoute(request) {
+    const pathname = new URL(request.url).pathname;
+    if (!pathname.startsWith(PREFIX))
+        return undefined;
+    const parts = pathname.slice(PREFIX.length).split('/');
+    try {
+        const first = decodeURIComponent(parts[0] ?? '');
+        const kernel = Key.is(first) ? undefined : httpIssuer(first, false);
+        const declaration = kernel === undefined ? first : decodeURIComponent(parts[1] ?? '');
+        const service = parts[kernel === undefined ? 1 : 2] ?? '';
+        if (!Key.is(declaration) || !SERVICE.test(service))
+            return undefined;
+        return Object.freeze({ ...(kernel === undefined ? {} : { kernel }), declaration, service });
+    }
+    catch (cause) {
+        if (cause instanceof URIError || cause instanceof AuthValueError || cause instanceof TypeError)
+            return undefined;
+        throw cause;
+    }
+}

package/dist/execution/workflows/run.d.ts

@@ -0,0 +1,22 @@
+import type { RuntimeWorkflow } from '../../application/runtime/workflows.js';
+import type { IssuerId } from '../../platform/auth/index.js';
+import type { Domain } from '../../platform/schema/index.js';
+import type { Identity } from '../identity/index.js';
+import type { EngineSharedContext, EngineWorkflowContext } from './engine.js';
+import type { AdmittedDurableServing } from './options.js';
+type Executor = NonNullable<Identity['executor']>;
+export interface DurableRun {
+    readonly kernel?: IssuerId;
+    readonly workflow: RuntimeWorkflow;
+    readonly domain: Domain;
+    readonly executor: Executor;
+    readonly serving: AdmittedDurableServing;
+}
+/** Engine handlers of one durable Workflow: the `run` and the shared `signal`. */
+export declare function durableHandlers(input: DurableRun): Readonly<{
+    run: (context: EngineWorkflowContext, raw: unknown) => Promise<import("../../platform/schema/index.js").Value>;
+    signal(context: EngineSharedContext, raw: unknown): Promise<{
+        accepted: boolean;
+    }>;
+}>;
+export {};

package/dist/execution/workflows/run.js

@@ -0,0 +1,211 @@
+import { declaredErrorFactory } from '../../application/error/index.js';
+import { bindMutation } from '../../application/mutation/execution/executor.js';
+import { bindQuery } from '../../application/query/execution/executor.js';
+import { acceptStepId } from '../../application/workflow/step/index.js';
+import { acceptStepOutput } from '../../application/workflow/step/output.js';
+import { ResponseError } from '../../platform/client/index.js';
+import { bindSession, execution as executionMethods } from '../../platform/client/session/index.js';
+import { validateOutput } from '../invocation/result/index.js';
+import { decodeEnvelope } from './envelope.js';
+import { replayedFailure, terminalFailure } from './failure.js';
+/** Token of a Workflow that declares none. */
+const DEFAULT_COMPAT = '0';
+const MAXIMUM_SLEEP_MS = 365 * 24 * 60 * 60_000;
+const MAXIMUM_PROMISE_NAME = 128;
+/** Bounds of one `result` wait and of the durable pause between two of them. */
+const AWAIT_WAIT_MS = 10_000;
+const AWAIT_MAXIMUM_PAUSE_MS = 5 * 60_000;
+/** Engine handlers of one durable Workflow: the `run` and the shared `signal`. */
+export function durableHandlers(input) {
+    const { engine } = input.serving;
+    return Object.freeze({
+        run: (context, raw) => run(input, context, raw),
+        async signal(context, raw) {
+            const request = signalRequest(raw);
+            try {
+                await context.promise(request.name).resolve(request.value);
+                return { accepted: true };
+            }
+            catch (cause) {
+                // The engine refuses to resolve a promise twice with a terminal failure.
+                if (cause instanceof engine.TerminalError)
+                    return { accepted: false };
+                throw cause;
+            }
+        },
+    });
+}
+async function run(input, context, raw) {
+    const { workflow, serving } = input;
+    const { engine } = serving;
+    const definition = workflow.definition;
+    // Journaled first. A redeployment that changed the token cannot replay this run: it fails every
+    // attempt with this reason until the engine pauses it, then `resume` on compatible code or cancel.
+    const token = definition.compat ?? DEFAULT_COMPAT;
+    const recorded = await context.run('compat', async () => token);
+    if (recorded !== token) {
+        throw new Error(`Workflow ${workflow.address} started under compat token ${JSON.stringify(recorded)}; ` +
+            `this deployment declares ${JSON.stringify(token)}.`);
+    }
+    // Code that cannot read what the Kernel recorded pauses the run the same way.
+    const envelope = admitted(workflow, raw, input.kernel);
+    const durable = durableContext(input, context, envelope);
+    let output;
+    try {
+        output = await definition.run(durable);
+    }
+    catch (cause) {
+        throw terminalFailure(engine, cause, definition) ?? cause;
+    }
+    return validateOutput(workflow.callable, output);
+}
+function admitted(workflow, raw, kernel) {
+    const envelope = decodeEnvelope(raw);
+    if (kernel !== undefined && envelope.execution.kernel !== kernel) {
+        throw new TypeError('Durable envelope Kernel differs from its authenticated endpoint.');
+    }
+    const diagnostics = workflow.callable.validateInput(envelope.input);
+    if (diagnostics.length > 0) {
+        throw new TypeError(`Workflow ${workflow.address} cannot read the recorded input.`);
+    }
+    const instance = 'static' in workflow.callable && workflow.callable.static === false;
+    if (instance !== (envelope.execution.receiver !== undefined)) {
+        throw new TypeError(`Workflow ${workflow.address} cannot use the recorded receiver.`);
+    }
+    return envelope;
+}
+function durableContext(input, context, envelope) {
+    const { serving, domain, workflow } = input;
+    const { engine } = serving;
+    const definition = workflow.definition;
+    const execution = envelope.execution;
+    const signal = context.request().attemptCompletedSignal;
+    const steps = new Set();
+    /** One journaled unit of work acting as the Domain, with keys derived from its name. */
+    const journal = (name, execute) => Promise.resolve(context.run(name, async () => {
+        const deadline = Date.now() + serving.stepTimeoutMs;
+        const session = input.executor(execution.kernel, execution.id, { deadline, signal });
+        try {
+            const kernel = keyed(bindSessionOf(session, deadline, signal), await keySequence(execution.id, name));
+            const output = await execute(Object.freeze({
+                kernel,
+                query: bindQuery(kernel, domain),
+                mutate: bindMutation(kernel, domain),
+            }));
+            try {
+                return acceptStepOutput(output);
+            }
+            catch (cause) {
+                throw new TypeError(`Workflow ${name} output must be portable.`, { cause });
+            }
+        }
+        catch (cause) {
+            throw terminalFailure(engine, cause, definition) ?? cause;
+        }
+        finally {
+            session.close();
+        }
+    })).catch((cause) => {
+        throw replayedFailure(engine, cause, definition) ?? cause;
+    });
+    const step = (id, execute) => {
+        let accepted;
+        try {
+            accepted = acceptStepId(id);
+            if (steps.has(accepted))
+                throw new TypeError(`Workflow Step ${accepted} occurs more than once.`);
+        }
+        catch (cause) {
+            return Promise.reject(cause);
+        }
+        steps.add(accepted);
+        return journal(`step:${accepted}`, execute);
+    };
+    return Object.freeze({
+        domain,
+        input: envelope.input,
+        execution,
+        error: declaredErrorFactory(definition),
+        step: Object.freeze({
+            run: step,
+            mutate: (id, mutation, value) => step(id, (authority) => authority.mutate(mutation, value)),
+        }),
+        async sleep(durationMs) {
+            if (!Number.isSafeInteger(durationMs) || durationMs < 0 || durationMs > MAXIMUM_SLEEP_MS) {
+                throw new TypeError(`Durable sleep must be an integer between 0 and ${MAXIMUM_SLEEP_MS} ms.`);
+            }
+            await context.sleep(durationMs);
+        },
+        async promise(name) {
+            if (typeof name !== 'string' || name.length === 0 || name.length > MAXIMUM_PROMISE_NAME) {
+                throw new TypeError('Durable promise name must have 1 to 128 characters.');
+            }
+            return (await context.promise(name).get());
+        },
+        cancelled: (error) => error instanceof engine.CancelledError,
+        async awaitExecution(target) {
+            for (let poll = 1;; poll++) {
+                const polled = await journal(`await:${target.id}:${poll}`, async ({ kernel }) => {
+                    try {
+                        const outcome = await kernel.invoke(executionMethods.result(target), {
+                            waitMs: Math.min(AWAIT_WAIT_MS, Math.floor(serving.stepTimeoutMs / 2)),
+                        });
+                        return { ended: true, outcome };
+                    }
+                    catch (cause) {
+                        if (cause instanceof ResponseError && cause.reason?.code === 'EXECUTION_PENDING') {
+                            return { ended: false };
+                        }
+                        throw cause;
+                    }
+                });
+                if (polled.ended)
+                    return polled.outcome;
+                await context.sleep(Math.min(AWAIT_MAXIMUM_PAUSE_MS, 1_000 * 2 ** Math.min(poll, 16)));
+            }
+        },
+        ...(execution.receiver === undefined ? {} : { self: execution.receiver }),
+    });
+}
+function bindSessionOf(session, deadline, signal) {
+    return bindSession(session, { deadline, signal });
+}
+/**
+ * Every `invoke` and Mutation of one Step without its own key carries the next key of the Step's
+ * sequence. The sequence restarts with every attempt, so a retried Step replays the same keys and
+ * the Kernel answers with the first outcome, or `IDEMPOTENCY_KEY_CONFLICT` if the request changed.
+ */
+function keyed(session, next) {
+    const invokeSource = session.invoke;
+    const mutateSource = session.mutate;
+    const invoke = ((reference, value, options) => invokeSource(reference, value, withKey(options, next)));
+    const mutate = ((author, options) => mutateSource(author, withKey(options, next)));
+    return Object.freeze({ ...session, invoke, mutate });
+}
+function withKey(options, next) {
+    if (options?.idempotencyKey !== undefined || options?.body !== undefined)
+        return options;
+    return { ...options, idempotencyKey: next() };
+}
+async function keySequence(execution, name) {
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(name)));
+    const prefix = `${execution}.${Array.from(digest.subarray(0, 12), hex).join('')}`;
+    let position = 0;
+    return () => `${prefix}.${++position}`;
+}
+function hex(byte) {
+    return byte.toString(16).padStart(2, '0');
+}
+function signalRequest(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        typeof input.name !== 'string') {
+        throw new TypeError('Durable signal request is invalid.');
+    }
+    const { name, value } = input;
+    if (name.length === 0 || name.length > MAXIMUM_PROMISE_NAME) {
+        throw new TypeError('Durable signal name must have 1 to 128 characters.');
+    }
+    return { name, value: value ?? null };
+}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 /** Curated SDK authoring journey. Semantic values remain available from focused subpaths. */
 export { defineAction } from './application/action/index.js';
 export type { Action, ActionContext, ActionOutputOf, Caller, DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from './application/action/index.js';
-export { defineApplication, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
-export type { Application, Frontend, Requirements, Route, Routes } from './application/index.js';
+export { defineDomain, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
+export type { DomainDefinition, Frontend, Requirements, Route, Routes, } from './application/index.js';
 export { defineIntegration, defineProvider } from './application/integration/index.js';
 export type { IntegrationClient, IntegrationDefinition, Provider, } from './application/integration/index.js';
 export { defineMutation, executeMutation } from './application/mutation/index.js';
@@ -18,4 +18,4 @@ export type { Build, Deployment, Release } from './deployment/index.js';
 export { defineProject } from './project/index.js';
 export type { Project } from './project/index.js';
 export { serve } from './execution/index.js';
-export type { ServedApplication } from './execution/index.js';
+export type { ServedDomain } from './execution/index.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 /** Curated SDK authoring journey. Semantic values remain available from focused subpaths. */
 export { defineAction } from './application/action/index.js';
-export { defineApplication, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
+export { defineDomain, defineFrontend, external, requirements, route, routes, vite, } from './application/index.js';
 export { defineIntegration, defineProvider } from './application/integration/index.js';
 export { defineMutation, executeMutation } from './application/mutation/index.js';
 export { defineCollectionQuery, defineCompositeQuery, defineQuery, executeQuery, } from './application/query/index.js';

package/dist/platform/release/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Canonical `DomainRelease` v4 wire contract and admission owned by the Astrale platform: the
+ * document a deployment serves at `release.json`, its release digest and `ReleaseRef`.
+ */
+export * from '@astrale-os/kernel-protocol/release';
+/**
+ * The Kernel's Publication v2/v3 codec (`@astrale-os/kernel-protocol/release/legacy`): `accept`,
+ * `seal`, `encode`, `url`/`PATH`, the bundle helpers, `PublicationError` and Delivery v1, which
+ * stable targets and pre-v4 Kernels still serve and read.
+ *
+ * @deprecated Read and seal `DomainRelease` v4 with this module's root exports.
+ *
+ * Short-term consumers, which took it from the removed `@astrale-os/sdk/publication`:
+ * - cli `src/lib/domain-publication.ts` and its test (C1a: `accept`, `PATH`, `PublicationError`);
+ * - admin `domain/providers/http-publication/resolver.ts`,
+ *   `domain/providers/remote-kernel/instance-gateway.ts`,
+ *   `domain/providers/scaleway/machine-provider.ts`, `domain/scripts/admin-bootstrap/cli.ts`,
+ *   `domain/scripts/e2e/install-domain-set.ts`, their tests and two `worker/src` tests, which also
+ *   seal v2/v3 fixtures (A10a);
+ * - domains issues `tests/deployment/archived-errors.test.ts` (SV16).
+ *
+ * Removal, in a breaking SDK release: once those consumers no longer import it (the CLI and Admin
+ * read `release.json`), at the latest with the Kernel folder it re-exports, which the Kernel
+ * removes once no supported Kernel predates v4, no installation pins a v2/v3 document and no
+ * stable Worker serves one (D10).
+ */
+export { legacy } from '@astrale-os/kernel-protocol/release';