@astrale-os/sdk 0.6.0-beta.3 → 0.6.0-beta.30

package/dist/execution/invocation/admission/authentication.js

@@ -1,18 +1,14 @@
-import { grant, issuer } from '../../../platform/auth/index.js';
+import { issuer } from '../../../platform/auth/index.js';
 import { bindSession } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { protocolError } from '../result/index.js';
 import { requireVia } from './authority.js';
-const ANONYMOUS = Object.freeze({
-    caller: Object.freeze({ kind: 'anonymous' }),
-    kernel: null,
-    graph: null,
-    close() { },
-});
-export async function authentication(callable, request, release, domain, authority) {
+const ANONYMOUS = Object.freeze({ kind: 'anonymous' });
+export async function authentication(callable, request, domain, authority) {
     const credential = request.credential;
-    if (callable.auth === 'anonymous' && credential === undefined)
-        return ANONYMOUS;
+    if (callable.auth === 'anonymous' && credential === undefined) {
+        return anonymous(await authority.self({ via: requireVia(request), domain, context: request.context }));
+    }
     if (credential === undefined) {
         throw protocolError('AUTH_MISSING', 'Authentication is required.');
     }
@@ -21,7 +17,6 @@ export async function authentication(callable, request, release, domain, authori
     const authenticated = await authority.authenticate({
         credential,
         via: requireVia(request),
-        publication: release.publication,
         domain,
         context: request.context,
     });
@@ -36,34 +31,54 @@ export async function authentication(callable, request, release, domain, authori
             invalid();
         }
         const caller = admitCaller(authenticated.caller);
-        const graphInput = admitGraph(authenticated.graph);
+        const graphInput = admitGraph(authenticated.graph, ['caller', 'self']);
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
-            union: bindSession(graphInput.union),
         });
         return Object.freeze({ caller, graph, close });
     }
     catch (cause) {
-        if (close === undefined)
-            invalid(cause);
-        try {
-            close();
-        }
-        catch (cleanup) {
-            throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid authenticated capabilities and cleanup failed.');
+        rejectClosing(close, cause);
+    }
+}
+/** Admit the Domain's own capabilities for a call that carries no credential. */
+function anonymous(own) {
+    let close;
+    try {
+        close = captureClose(own);
+        if (own === null ||
+            typeof own !== 'object' ||
+            Array.isArray(own) ||
+            Reflect.ownKeys(own).some((key) => key !== 'graph' && key !== 'close') ||
+            close === undefined) {
+            invalid();
         }
+        const graph = Object.freeze({ self: bindSession(admitGraph(own.graph, ['self']).self) });
+        return Object.freeze({ caller: ANONYMOUS, graph, close });
+    }
+    catch (cause) {
+        rejectClosing(close, cause);
+    }
+}
+/** Release whatever the authority opened before refusing its invalid capabilities. */
+function rejectClosing(close, cause) {
+    if (close === undefined)
         invalid(cause);
+    try {
+        close();
+    }
+    catch (cleanup) {
+        throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid capabilities and cleanup failed.');
     }
+    invalid(cause);
 }
-function admitGraph(input) {
+function admitGraph(input, modes) {
     if (input === null ||
         typeof input !== 'object' ||
         Array.isArray(input) ||
-        !Object.hasOwn(input, 'caller') ||
-        !Object.hasOwn(input, 'self') ||
-        !Object.hasOwn(input, 'union') ||
-        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self' && key !== 'union')) {
+        modes.some((mode) => !Object.hasOwn(input, mode)) ||
+        Reflect.ownKeys(input).some((key) => !modes.includes(key))) {
         invalid();
     }
     return input;
@@ -79,29 +94,18 @@ function admitCaller(input) {
         invalid();
     if (!Object.hasOwn(input, 'kind') ||
         !Object.hasOwn(input, 'principal') ||
-        !Object.hasOwn(input, 'authority') ||
+        !Object.hasOwn(input, 'identity') ||
         !Object.hasOwn(input, 'authentication') ||
-        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'authority' && key !== 'authentication') ||
+        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'identity' && key !== 'authentication') ||
         Reflect.get(input, 'kind') !== 'authenticated') {
         invalid();
     }
-    const principal = NodeId(Reflect.get(input, 'principal'));
-    const authority = grant.accept(Reflect.get(input, 'authority'));
-    const authentication = admitEvidence(Reflect.get(input, 'authentication'));
-    const caller = {
+    return Object.freeze({
         kind: 'authenticated',
-        get identity() {
-            if (authority.expr.kind !== 'identity') {
-                throw new TypeError('Caller authority does not resolve to one exact Identity.');
-            }
-            return authority.expr.id;
-        },
-        principal,
-        authority,
-        authentication,
-    };
-    Object.defineProperty(caller, 'identity', { enumerable: false });
-    return Object.freeze(caller);
+        identity: NodeId(Reflect.get(input, 'identity')),
+        principal: NodeId(Reflect.get(input, 'principal')),
+        authentication: admitEvidence(Reflect.get(input, 'authentication')),
+    });
 }
 function admitEvidence(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
@@ -148,6 +152,6 @@ function optionalTime(input) {
     return input === undefined || (typeof input === 'number' && Number.isFinite(input));
 }
 function invalid(cause) {
-    const message = 'Invocation authority returned invalid authenticated capabilities.';
+    const message = 'Invocation authority returned invalid capabilities.';
     throw cause === undefined ? new TypeError(message) : new TypeError(message, { cause });
 }

package/dist/execution/invocation/admission/authority.d.ts

@@ -1,5 +1,4 @@
 import type * as invocation from '@astrale-os/kernel-protocol/invocation';
-import type * as publication from '@astrale-os/kernel-protocol/publication';
 import type { HandlerRequest, InvocationContext } from '@astrale-os/kernel-server';
 import type { AuthenticatedCaller } from '../../../application/action/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
@@ -8,27 +7,50 @@ export interface InvocationAdmissionInput {
     readonly call: invocation.Call;
     readonly credential?: string;
     readonly via: invocation.Via;
-    readonly publication: publication.Publication;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 export interface InvocationAuthenticationInput {
     readonly credential: string;
     readonly via: invocation.Via;
-    readonly publication: publication.Publication;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
+export interface InvocationSelfInput {
+    readonly via: invocation.Via;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 /** Authenticated capabilities before the SDK admits and derives application caller context. */
 export interface AuthenticatedInvocation {
-    readonly caller: Omit<AuthenticatedCaller, 'identity'>;
-    readonly graph: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>;
+    readonly caller: AuthenticatedCaller;
+    readonly graph: Readonly<Record<'caller' | 'self', BoundClientSession>>;
+    close(): void;
+}
+/** The Domain's own capabilities, before the SDK admits them for a call without a credential. */
+export interface SelfInvocation {
+    readonly graph: Readonly<Record<'self', BoundClientSession>>;
     close(): void;
 }
 export interface InvocationAuthority {
+    /**
+     * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
+     * rejects with the public refusal. A refusal whose reason is `FUNCTION_MISS` (the Kernel no longer
+     * places the call on this deployment) is answered as the reserved miss, never as an error.
+     */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
+    /**
+     * The Domain's own authority toward the source Kernel, for an admitted call to an `anonymous`
+     * callable that carries no credential: its handler acts as the installed Domain, never as a
+     * caller.
+     */
+    self(input: InvocationSelfInput): Promise<SelfInvocation>;
 }
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact ReleaseRef of this immutable deployment.
+ */
 export declare function requireVia(request: HandlerRequest): invocation.Via;

package/dist/execution/invocation/admission/authority.js

@@ -1,17 +1,24 @@
 import { protocolError } from '../result/index.js';
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export function authority(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    if (typeof input.admit !== 'function' || typeof input.authenticate !== 'function') {
+    if (typeof input.admit !== 'function' ||
+        typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function') {
         invalid();
     }
     const receiver = Object.freeze({ ...input });
     return Object.freeze({
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
     });
 }
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact ReleaseRef of this immutable deployment.
+ */
 export function requireVia(request) {
     if (request.via === undefined) {
         throw protocolError('VALIDATION_ERROR', 'Remote invocation requires Via.');

package/dist/execution/invocation/admission/index.d.ts

@@ -1,5 +1,5 @@
 export { authority, requireVia } from './authority.js';
-export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, } from './authority.js';
-export { authentication, type InvocationAuthentication } from './authentication.js';
+export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, InvocationSelfInput, SelfInvocation, } from './authority.js';
+export { authentication, type AnonymousInvocation, type InvocationAuthentication, type InvocationSessions, } from './authentication.js';
 export { input } from './input.js';
 export { target, type InvocationTarget } from './target.js';

package/dist/execution/invocation/admission/index.js

@@ -1,4 +1,4 @@
 export { authority, requireVia } from './authority.js';
-export { authentication } from './authentication.js';
+export { authentication, } from './authentication.js';
 export { input } from './input.js';
 export { target } from './target.js';

package/dist/execution/invocation/admission/input.d.ts

@@ -1,2 +1,2 @@
-import type { ResolvedCallable } from '../../../application/action/index.js';
-export declare function input(callable: ResolvedCallable, value: unknown): void;
+import type { ResolvedCallable, ActionBinaryInput } from '../../../application/action/index.js';
+export declare function input(callable: ResolvedCallable, value: unknown, binary?: ActionBinaryInput): void;

package/dist/execution/invocation/admission/input.js

@@ -1,4 +1,18 @@
-import { validateInput } from '../result/index.js';
-export function input(callable, value) {
+import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
+import { validateInput, protocolError } from '../result/index.js';
+export function input(callable, value, binary) {
+    if (isBinaryInput(callable.input)) {
+        if (binary === undefined) {
+            throw protocolError('VALIDATION_ERROR', 'Binary Function request body is required.');
+        }
+        if (!Number.isSafeInteger(binary.length) ||
+            binary.length < 0 ||
+            binary.length > callable.input.maximumBytes) {
+            throw protocolError('LIMIT_EXCEEDED', 'Binary Function request body exceeds its limit.');
+        }
+    }
+    else if (binary !== undefined) {
+        throw protocolError('VALIDATION_ERROR', 'Callable does not accept a binary request body.');
+    }
     validateInput(callable, value);
 }

package/dist/execution/invocation/dependency/bind.d.ts

@@ -1,5 +1,7 @@
 import type { HandlerDependencies } from '../../../application/dependency/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
+import type { InvocationSessions } from '../admission/index.js';
 /** Bind each explicit authority to its admitted session; metadata remains inert. */
-export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>): HandlerDependencies<D>;
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self', BoundClientSession>>): HandlerDependencies<D>;
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: InvocationSessions): HandlerDependencies<D> | HandlerDependencies<D, 'self'>;

package/dist/execution/invocation/dependency/bind.js

@@ -1,17 +1,16 @@
 import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
 import { reference } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { Path } from '../../../platform/graph/path/index.js';
-/** Bind each explicit authority to its admitted session; metadata remains inert. */
 export function bindDependencies(domain, sessions) {
     const dependencies = Object.create(null);
     for (const [alias, dependency] of Object.entries(domain.dependencies)) {
         if (dependency.origin === 'kernel.astrale.ai')
             continue;
         dependencies[alias] = Object.freeze({
-            caller: bindDependency(dependency, sessions.caller),
+            ...('caller' in sessions ? { caller: bindDependency(dependency, sessions.caller) } : {}),
             self: bindDependency(dependency, sessions.self),
-            union: bindDependency(dependency, sessions.union),
         });
     }
     return Object.freeze(dependencies);
@@ -20,19 +19,14 @@ function bindDependency(dependency, session) {
     const invoke = session.invoke.bind(session);
     return Object.freeze({
         async invoke(select, ...args) {
-            if (typeof select !== 'function')
-                invalid();
-            const selected = select(dependency);
-            if (selected === null ||
-                typeof selected !== 'object' ||
-                !('key' in selected) ||
-                typeof selected.key !== 'string')
-                invalid();
-            const callable = dependency.callable(selected.key);
-            if (callable !== selected || Key.origin(callable.key) !== dependency.origin)
-                invalid();
-            if ('owner' in callable && (!callable.executable || !ownMethod(dependency, callable)))
-                invalid();
+            const callable = selectedCallable(dependency, select);
+            if (isBinaryInput(callable.input)) {
+                if ('owner' in callable || args.length !== 2)
+                    invalid();
+                // Runtime selection is wider than the authored Function; mode was checked above.
+                const binaryReference = reference(dependency, callable);
+                return invoke(binaryReference, args[0], binaryOptions(args[1]));
+            }
             if ('owner' in callable && !callable.static) {
                 if (args.length < 2 || args.length > 3 || typeof args[0] !== 'string')
                     invalid();
@@ -45,6 +39,22 @@ function bindDependency(dependency, session) {
         },
     });
 }
+function selectedCallable(domain, select) {
+    if (typeof select !== 'function')
+        invalid();
+    const selected = select(domain);
+    if (selected === null ||
+        typeof selected !== 'object' ||
+        !('key' in selected) ||
+        typeof selected.key !== 'string')
+        invalid();
+    const callable = domain.callable(selected.key);
+    if (callable !== selected || Key.origin(callable.key) !== domain.origin)
+        invalid();
+    if ('owner' in callable && (!callable.executable || !ownMethod(domain, callable)))
+        invalid();
+    return callable;
+}
 function ownMethod(domain, callable) {
     const owner = Object.values(domain.classes).find((value) => value === callable.owner);
     if (owner === undefined)
@@ -63,6 +73,16 @@ function options(value) {
     // Canonical ClientSession admits option values and clamps them to the parent lifetime.
     return value;
 }
+function binaryOptions(value) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        !Object.hasOwn(value, 'body') ||
+        !(value.body instanceof Blob) ||
+        Reflect.ownKeys(value).some((key) => key !== 'body' && key !== 'timeoutMs'))
+        invalid();
+    return value;
+}
 function invalid() {
     throw new TypeError('Dependency invocation requires one owned executable callable, its input, and valid instance/options.');
 }

package/dist/execution/invocation/dispatch/context.d.ts

@@ -1,5 +1,5 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
-import type { ActionExecution, Caller, DomainGraphExecutors, DomainKernelSessions } from '../../../application/action/index.js';
+import type { ActionExecution, ActionBinaryInput, Caller, DomainGraphExecutors, DomainKernelSessions } from '../../../application/action/index.js';
 import type { HandlerDependencies } from '../../../application/dependency/index.js';
 import type { MutationExecutor } from '../../../application/mutation/index.js';
 import type { QueryExecutor } from '../../../application/query/index.js';
@@ -10,12 +10,13 @@ import type { InvocationAuthentication } from '../admission/index.js';
 export interface DispatchContext {
     readonly domain: Domain;
     readonly input: unknown;
+    readonly body?: ActionBinaryInput;
     readonly caller: Caller;
-    readonly dependencies: HandlerDependencies<Domain> | null;
-    readonly kernel: DomainKernelSessions | null;
-    readonly graph: DomainGraphExecutors | null;
-    readonly query?: QueryExecutor;
-    readonly mutate?: MutationExecutor;
+    readonly dependencies: HandlerDependencies<Domain> | HandlerDependencies<Domain, 'self'>;
+    readonly kernel: DomainKernelSessions | DomainKernelSessions<'self'>;
+    readonly graph: DomainGraphExecutors | DomainGraphExecutors<Domain, 'self'>;
+    readonly query: QueryExecutor;
+    readonly mutate: MutationExecutor;
     readonly integrations: Readonly<Record<string, unknown>>;
     readonly execution: ActionExecution;
     readonly self?: NodeId;

package/dist/execution/invocation/dispatch/context.js

@@ -3,7 +3,8 @@ import { bindQuery } from '../../../application/query/execution/executor.js';
 import { bindDependencies } from '../dependency/index.js';
 import { clients } from '../integration/index.js';
 export function context(request, runtime, authentication, self) {
-    const graph = authentication.graph === null ? null : bindGraph(authentication.graph, runtime.loaded.domain);
+    const sessions = authentication.graph;
+    const graph = bindGraph(sessions, runtime.loaded.domain);
     const execution = Object.freeze({
         signal: request.context.execution.signal,
         deadline: request.context.execution.deadline,
@@ -17,48 +18,33 @@ export function context(request, runtime, authentication, self) {
     return Object.freeze({
         domain: runtime.loaded.domain,
         input: request.call.input,
+        ...(request.context.binary === undefined ? {} : { body: request.context.binary }),
         caller: authentication.caller,
-        kernel: authentication.graph === null
-            ? null
-            : Object.freeze({
-                ...authentication.graph.self,
-                ...authentication.graph,
-            }),
-        dependencies: authentication.graph === null
-            ? null
-            : bindDependencies(runtime.loaded.domain, authentication.graph),
+        kernel: Object.freeze({ ...sessions.self, ...sessions }),
+        dependencies: bindDependencies(runtime.loaded.domain, sessions),
         graph,
-        ...(graph === null
-            ? {}
-            : {
-                query: graph.self.query,
-                mutate: graph.self.mutate,
-            }),
-        integrations: clients(runtime, request.context, authentication.graph === null
-            ? null
-            : {
-                caller: authentication.graph.caller,
-                self: authentication.graph.self,
-                ...(authentication.caller.authentication.expiresAt === undefined
-                    ? {}
-                    : {
-                        expiresAt: authentication.caller.authentication.expiresAt,
-                    }),
-            }),
+        query: graph.self.query,
+        mutate: graph.self.mutate,
+        integrations: clients(runtime, request.context, {
+            ...sessions,
+            ...(authentication.caller.kind !== 'authenticated' ||
+                authentication.caller.authentication.expiresAt === undefined
+                ? {}
+                : { expiresAt: authentication.caller.authentication.expiresAt }),
+        }),
         execution,
         ...(self === undefined ? {} : { self }),
     });
 }
-function bindGraph(clients, domain) {
+function bindGraph(sessions, domain) {
     const bind = (client) => Object.freeze({
         query: bindQuery(client, domain),
         mutate: bindMutation(client, domain),
     });
-    const self = bind(clients.self);
+    const self = bind(sessions.self);
     return Object.freeze({
         ...self,
-        caller: bind(clients.caller),
+        ...('caller' in sessions ? { caller: bind(sessions.caller) } : {}),
         self,
-        union: bind(clients.union),
     });
 }

package/dist/execution/invocation/dispatch/workflow.js

@@ -1,12 +1,8 @@
 import { declaredErrorFactory, declaredErrorOf } from '../../../application/error/index.js';
 import { protocolError } from '../result/index.js';
 export async function workflow(selected, context, runner) {
-    if (context.caller.kind !== 'authenticated' || context.kernel === null) {
-        throw protocolError('AUTH_MISSING', 'Workflow authentication is required.');
-    }
     const complete = Object.freeze({
         ...context,
-        caller: context.caller,
         error: declaredErrorFactory(selected.definition),
     });
     try {

package/dist/execution/invocation/index.d.ts

@@ -1,5 +1,5 @@
 export { createHandler, type HandlerInput } from './handler.js';
 export { invoke, type InvocationInput } from './invocation.js';
 export type * from './admission/index.js';
-export { InvocationDefect, InvocationError } from './result/index.js';
-export type { InvocationDefectCode, InvocationErrorCode } from './result/index.js';
+export { InvocationDefect } from './result/index.js';
+export type { InvocationDefectCode } from './result/index.js';

package/dist/execution/invocation/index.js

@@ -1,3 +1,3 @@
 export { createHandler } from './handler.js';
 export { invoke } from './invocation.js';
-export { InvocationDefect, InvocationError } from './result/index.js';
+export { InvocationDefect } from './result/index.js';

package/dist/execution/invocation/integration/call.d.ts

@@ -2,7 +2,8 @@ import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationInvocationOwner } from '../../../application/integration/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 export interface IntegrationInvocationSessions {
-    readonly caller: BoundClientSession;
+    /** Absent when the call carried no credential: there is no caller to invoke for. */
+    readonly caller?: BoundClientSession;
     readonly self: BoundClientSession;
     /** Verified incoming carrier expiry, in Unix seconds. */
     readonly expiresAt?: number;

package/dist/execution/invocation/integration/call.js

@@ -3,7 +3,7 @@ import { bindIntegrationAuthentication } from './authentication.js';
 /** One invocation-owned logical Integration call sequence. */
 export function calls(context, sessions = null) {
     const prefix = context.idempotencyKey ?? JSON.stringify([context.invocation.source, context.invocation.id]);
-    const invoke = sessions?.caller.invoke.bind(sessions.caller);
+    const invoke = sessions?.caller?.invoke.bind(sessions.caller);
     const auth = sessions === null
         ? undefined
         : bindIntegrationAuthentication(context, sessions.self, sessions.expiresAt);

package/dist/execution/invocation/integration/clients.d.ts

@@ -2,4 +2,4 @@ import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationClients, Integrations } from '../../../application/integration/index.js';
 import type { InitializedRuntime } from '../../runtime/index.js';
 import type { IntegrationInvocationSessions } from './call.js';
-export declare function clients(runtime: InitializedRuntime, context: InvocationContext, sessions: IntegrationInvocationSessions | null): IntegrationClients<Integrations>;
+export declare function clients(runtime: InitializedRuntime, context: InvocationContext, sessions: IntegrationInvocationSessions): IntegrationClients<Integrations>;

package/dist/execution/invocation/invocation.js

@@ -1,36 +1,42 @@
-import * as publication from '@astrale-os/kernel-protocol/publication';
+import * as errors from '@astrale-os/kernel-protocol/errors';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { authentication, input, requireVia, target } from './admission/index.js';
 import { action, context, select, workflow } from './dispatch/index.js';
 import { active, settle } from './lifecycle/index.js';
 import { project, protocolError } from './result/index.js';
+/** The reserved answer of a deployment that does not serve the call: its caller re-routes. */
+const MISS = Object.freeze({ kind: 'miss' });
+const FUNCTION_MISS = 'FUNCTION_MISS';
 export async function invoke(request, inputConfig) {
     active(request.context);
-    const release = inputConfig.runtime.loaded.release;
-    const snapshot = request.publication;
-    if (snapshot === undefined ||
-        !publication.matchesReference(snapshot.publication, publication.reference(release.publication))) {
-        throw protocolError('CONFLICT', 'Invocation Publication differs from the running Release.');
+    if (!pinsRunningRelease(request, inputConfig.runtime.loaded.release)) {
+        throw protocolError('CONFLICT', 'Invocation release differs from the running Release.');
     }
     if (request.credential !== undefined && typeof request.credential !== 'string') {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    const via = requireVia(request);
-    const selectedTarget = target(await inputConfig.authority.admit({
+    const admitted = await admit(inputConfig.authority, {
         call: request.call,
         ...(request.credential === undefined ? {} : { credential: request.credential }),
-        via,
-        publication: release.publication,
+        via: requireVia(request),
         domain: inputConfig.runtime.loaded.domain,
         context: request.context,
-    }));
-    const selected = select(inputConfig.runtime.loaded.registry, selectedTarget);
+    });
+    if (admitted === undefined)
+        return MISS;
+    const selected = select(inputConfig.runtime.loaded.registry, admitted);
     if (selected === undefined)
-        return Object.freeze({ kind: 'miss' });
-    input(selected.implementation.callable, request.call.input);
-    const admittedAuthentication = await authentication(selected.implementation.callable, request, release, inputConfig.runtime.loaded.domain, inputConfig.authority);
+        return MISS;
+    if (selected.implementation.kind === 'workflow' && selected.implementation.durable) {
+        // The Kernel records a durable call as an Execution and runs it on the engine; running it
+        // inline here would silently drop durability.
+        throw protocolError('UNSUPPORTED', 'A durable Workflow runs only as a Kernel Execution.');
+    }
+    input(selected.implementation.callable, request.call.input, request.context.binary);
+    const admittedAuthentication = await authentication(selected.implementation.callable, request, inputConfig.runtime.loaded.domain, inputConfig.authority);
     const close = once(admittedAuthentication.close);
-    active(request.context);
     try {
+        active(request.context);
         const dispatchContext = context(request, inputConfig.runtime, admittedAuthentication, selected.self);
         const output = selected.implementation.kind === 'action'
             ? await action(selected.implementation, dispatchContext)
@@ -42,6 +48,33 @@ export async function invoke(request, inputConfig) {
         throw cause;
     }
 }
+/**
+ * The source Kernel's `Function.admit` refuses `FUNCTION_MISS` when it no longer places the call on
+ * this deployment, as for a client whose learned route still names a deployment replaced by a
+ * consented install. That refusal is answered as the reserved miss, never as a public error, so
+ * the client re-routes through its source Kernel (AM-85). Every other refusal is unchanged.
+ */
+async function admit(authority, admission) {
+    let admitted;
+    try {
+        admitted = await authority.admit(admission);
+    }
+    catch (cause) {
+        if (refusedAsMiss(cause))
+            return undefined;
+        throw cause;
+    }
+    return target(admitted);
+}
+function refusedAsMiss(cause) {
+    return (cause instanceof errors.ProtocolError &&
+        errors.reasonOf(cause.payload.data)?.code === FUNCTION_MISS);
+}
+/** Execution answers only for the exact release pinned by the Kernel Server snapshot. */
+function pinsRunningRelease(request, running) {
+    return (request.release !== undefined &&
+        release.matchesReference(request.release.release, release.reference(running.document)));
+}
 function once(operation) {
     let called = false;
     return () => {