@astrale-os/sdk 0.6.0-beta.3 → 0.6.0-beta.31

package/dist/application/dependency/invoker.d.ts

@@ -1,26 +1,31 @@
 import type { Binary, Input } from '../../platform/client/index.js';
-import type { SessionRequestOptions } from '../../platform/client/session/index.js';
+import type { SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
-import type { CallableInputOf, CallableOutputOf, CallableResultOf, Domain, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
-import type { LocalCallable } from '../action/index.js';
-export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey'>;
+import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
+import type { AuthorityMode, AuthoritySelection, LocalCallable } from '../action/index.js';
+export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey' | 'body'>;
+export type DependencyBinaryCallOptions = Pick<SessionRequestOptionsWithBody, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 type InstanceMethodOf<D extends Domain> = Extract<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
 type FunctionOrStaticMethodOf<D extends Domain> = Exclude<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
+type WithInputMode<C, Mode extends 'value' | 'binary'> = C extends unknown ? CallableInputModeOf<C> extends Mode ? C : never : never;
+type ValueFunctionOrStaticMethodOf<D extends Domain> = WithInputMode<FunctionOrStaticMethodOf<D>, 'value'>;
+type BinaryFunctionOf<D extends Domain> = WithInputMode<Extract<LocalCallable<D>, ResolvedFunction>, 'binary'>;
 type DependencyInputOf<C> = C extends unknown ? unknown extends CallableInputOf<C> ? Input : [CallableInputOf<C>] extends [void] ? undefined : CallableInputOf<C> : never;
 type DependencyResultOf<C> = unknown extends CallableOutputOf<C> ? unknown : CallableResultOf<C, Binary>;
 /** One declared dependency, bound to one explicitly selected invocation authority. */
 export interface DependencyInvoker<D extends Domain> {
     readonly invoke: {
-        <const C extends FunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends ValueFunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
         <const C extends InstanceMethodOf<D>>(select: (domain: D) => C, instance: NodeId, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends BinaryFunctionOf<D>>(select: (domain: D) => C, metadata: NoInfer<DependencyInputOf<C>>, options: DependencyBinaryCallOptions): Promise<DependencyResultOf<C>>;
     };
 }
 /**
  * Direct Schema aliases with explicit authority selection and no default invoke.
- * self is the executing Domain; caller forwards the incoming Grant; union combines both.
- * The canonical Kernel is exposed through context.kernel.
+ * self is the executing Domain; caller forwards the incoming caller Identity, and is absent from a
+ * call that carried no credential. The canonical Kernel is exposed through context.kernel.
  */
-export type HandlerDependencies<D extends Domain> = Readonly<{
-    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: Readonly<Record<'caller' | 'self' | 'union', DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>>>;
+export type HandlerDependencies<D extends Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<{
+    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: AuthoritySelection<DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>, Selectable>;
 }>;
 export {};

package/dist/application/domain.d.ts

@@ -0,0 +1,30 @@
+import type { ClassIcon, schema } from '../platform/schema/index.js';
+import type { Requirements } from './requirements/index.js';
+import type { Routes } from './routes/index.js';
+import type { Runtime, SchemaOfRuntime as RuntimeSchemaOf } from './runtime/index.js';
+import type { Frontend } from './view/index.js';
+declare const DOMAIN_DEFINITION_IDENTITY: unique symbol;
+declare const DOMAIN_DEFINITION_SCHEMA: unique symbol;
+/** Schema-independent type witness shared by every admitted Domain definition. */
+export interface DomainDefinitionIdentity {
+    readonly [DOMAIN_DEFINITION_IDENTITY]: true;
+}
+/** Inert source/build composition of one Domain: its exact Schema and authored Runtime. */
+export interface DomainDefinition<Schema extends schema.DomainSchema = schema.DomainSchema, RuntimeValue extends Runtime<Schema> = Runtime<Schema>, FrontendValue extends Frontend<Schema> | undefined = undefined, RoutesValue extends Routes | undefined = undefined, RequirementsValue extends Requirements | undefined = undefined> extends DomainDefinitionIdentity {
+    readonly schema: Schema;
+    readonly runtime: RuntimeValue;
+    readonly frontend?: FrontendValue;
+    readonly routes?: RoutesValue;
+    readonly requirements?: RequirementsValue;
+    /** The application's icon. */
+    readonly icon?: ClassIcon;
+    readonly [DOMAIN_DEFINITION_SCHEMA]: (schema: Schema) => Schema;
+}
+export type SchemaOfDomainDefinition<Value> = Value extends {
+    readonly schema: infer Schema;
+} ? Extract<Schema, schema.DomainSchema> : never;
+export type RuntimeOfDomainDefinition<Value> = Value extends {
+    readonly runtime: infer RuntimeValue;
+} ? Extract<RuntimeValue, Runtime> : never;
+export type SchemaOfRuntime<Value> = RuntimeSchemaOf<Value>;
+export {};

package/dist/application/index.d.ts

@@ -1,9 +1,9 @@
-export { defineApplication, isApplication } from './define.js';
-export type { ApplicationInput } from './define.js';
+export { defineDomain, isDomainDefinition } from './define.js';
+export type { DomainDefinitionInput } from './define.js';
 export { requirements } from './requirements/index.js';
 export type { AuthorityRequirements, AuthorityRequirementsInput, ClassOperation, ClassRequirement, ClassRequirementInput, CoreRequirement, CoreRequirementInput, FunctionRequirementTarget, Requirements, RequirementsInput, } from './requirements/index.js';
 export { route, routes } from './routes/index.js';
 export type { Route, RouteInput, RouteTarget, Routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';
-export type { Frontend, FrontendInput, FrontendSource, IframeRequirements, ViewHostRequirements, } from './view/index.js';
-export type { Application, ApplicationIdentity, RuntimeOfApplication, SchemaOfApplication, SchemaOfRuntime, } from './application.js';
+export type { Frontend, FrontendInput, FrontendSource, ViewHostRequirements } from './view/index.js';
+export type { DomainDefinition, DomainDefinitionIdentity, RuntimeOfDomainDefinition, SchemaOfDomainDefinition, SchemaOfRuntime, } from './domain.js';

package/dist/application/index.js

@@ -1,4 +1,4 @@
-export { defineApplication, isApplication } from './define.js';
+export { defineDomain, isDomainDefinition } from './define.js';
 export { requirements } from './requirements/index.js';
 export { route, routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';

package/dist/application/integration/operation.d.ts

@@ -19,9 +19,9 @@ export interface IntegrationExecution {
     readonly signal: AbortSignal;
     readonly deadline: number;
     readonly idempotencyKey?: string;
-    /** Exact caller-bound invocation capability; absent for an anonymous invocation. */
+    /** Exact caller-bound invocation capability; absent when the call carried no credential. */
     readonly invoke?: BoundClientSession['invoke'];
-    /** Domain-self transport authentication; absent for an anonymous invocation. */
+    /** Domain-self transport authentication; absent only outside a Kernel invocation. */
     readonly auth?: IntegrationAuthentication;
 }
 export interface IntegrationOperation<Input = unknown, Output = unknown> {

package/dist/application/mutation/authoring/properties.d.ts

@@ -1,9 +1,11 @@
 import type { MutationPropsInput } from '@astrale-os/kernel-core/graph/mutate';
 import type { PropertyInputOf, ResolvedClass, ResolvedProperty } from '@astrale-os/kernel-dsl/v1';
+import { PropertyValues } from '@astrale-os/kernel-dsl/v1/language';
+import type { StoredPropertyInputOf } from '../../../platform/schema/property-input.js';
 export type RichPropertyInput<Class> = PropertyInputOf<Class>;
 export type RichPropertyName<Class> = Extract<keyof PropertyInputOf<Class>, string>;
 export interface RichPropertyConditions<Class> {
-    readonly equals?: RichPropertyInput<Class>;
+    readonly equals?: StoredPropertyInputOf<Class>;
     readonly absent?: readonly RichPropertyName<Class>[];
 }
 export interface RichPropertyDelta<Class> {
@@ -12,11 +14,11 @@ export interface RichPropertyDelta<Class> {
 }
 export declare function properties<Class extends ResolvedClass>(selected: Class, input: RichPropertyInput<Class>): MutationPropsInput;
 export declare function conditions<Class extends ResolvedClass>(selected: Class, input: RichPropertyConditions<Class>): Readonly<{
-    equals?: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/value").Value>> | undefined;
+    equals?: PropertyValues | undefined;
     absent?: readonly `${string}:class.${string}.property.${string}`[] | undefined;
 }>;
 export declare function delta<Class extends ResolvedClass>(selected: Class, input: RichPropertyDelta<Class>): Readonly<{
-    set: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/value").Value>>;
+    set: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/v1/language").PropertyValue>>;
     unset: readonly `${string}:class.${string}.property.${string}`[];
 }>;
 export declare function resolvedProperty<Class extends ResolvedClass>(selected: Class, name: RichPropertyName<Class>): ResolvedProperty;

package/dist/application/mutation/authoring/properties.js

@@ -1,10 +1,39 @@
 import { PropertyKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import { PropertyValues } from '@astrale-os/kernel-dsl/v1/language';
 export function properties(selected, input) {
-    return selected.properties.from(input);
+    const ordinary = Object.create(null);
+    const receipts = [];
+    const sources = new Map();
+    for (const [name, value] of Object.entries(input)) {
+        const property = resolvedProperty(selected, name);
+        const previous = sources.get(property.key);
+        if (previous !== undefined) {
+            throw new TypeError(`Property ${property.key} is supplied through both ${JSON.stringify(previous)} and ${JSON.stringify(name)}.`);
+        }
+        sources.set(property.key, name);
+        if (isBlobProperty(property)) {
+            if (typeof value !== 'string') {
+                throw new TypeError(`Blob Property ${property.key} requires an upload receipt.`);
+            }
+            receipts.push([property.key, value]);
+        }
+        else {
+            ordinary[name] = value;
+        }
+    }
+    // Blob receipts are admitted by the Kernel executor. A property's ordinary validator expects
+    // the stored Ref, so run it only for ordinary write values before combining the two sets.
+    const admitted = selected.properties.from(ordinary);
+    return receipts.length === 0
+        ? admitted
+        : PropertyValues.create([
+            ...Object.entries(admitted).map(([key, value]) => [PropertyKey(key), value]),
+            ...receipts,
+        ]);
 }
 export function conditions(selected, input) {
     return Object.freeze({
-        ...(input.equals === undefined ? {} : { equals: properties(selected, input.equals) }),
+        ...(input.equals === undefined ? {} : { equals: selected.properties.from(input.equals) }),
         ...(input.absent === undefined
             ? {}
             : {
@@ -12,6 +41,10 @@ export function conditions(selected, input) {
             }),
     });
 }
+function isBlobProperty(property) {
+    const contract = property.definition.schema;
+    return (contract !== null && typeof contract === 'object' && contract['x-astrale-value-kind'] === 'blob');
+}
 export function delta(selected, input) {
     return Object.freeze({
         set: properties(selected, input.set ?? {}),

package/dist/application/mutation/authoring/transition.js

@@ -49,7 +49,10 @@ export function authorStateTransition(core, input) {
         class: selectedClassKey,
         props: conditions(selectedClass, {
             ...(suppliedAbsent === undefined ? {} : { absent: suppliedAbsent }),
-            equals: { ...suppliedEquals, ...from },
+            equals: {
+                ...suppliedEquals,
+                ...from,
+            },
         }),
     });
     core.updateNode({

package/dist/application/mutation/index.d.ts

@@ -5,4 +5,4 @@ export type { Mutation, MutationDefinition, MutationInputOf, MutationOutputOf }
 export type { CreatedNode, EdgeSelector, ExistingEndpoint, MutationEndpoint, QueryPrecondition, RichMutationBuilder, RichPropertyConditions, RichPropertyDelta, RichPropertyInput, RichPropertyName, } from './authoring/index.js';
 /** Canonical low-level Mutation documents remain available as the explicit escape hatch. */
 export * from '@astrale-os/kernel-core/graph/mutate';
-export type { LocalAlias, LocalBinding } from '../../platform/graph/alias.js';
+export type { LocalAlias } from '../../platform/graph/alias.js';

package/dist/application/query/composite/plan.d.ts

@@ -7,10 +7,6 @@ export declare const QUERY_COMPOSITION_LIMITS: Readonly<{
     maximumDependencyDepth: 8;
 }>;
 export interface QueryPlanAnalysis {
-    /** @deprecated Use physicalQueries. */
-    readonly queries: number;
-    /** @deprecated Use dependencyDepth. */
-    readonly depth: number;
     readonly logicalQueries: number;
     readonly physicalQueries: number;
     readonly dependencyDepth: number;

package/dist/application/query/composite/plan.js

@@ -53,8 +53,6 @@ export function analyzeQueryPlan(plan) {
         throw new QueryCompositionError('QUERY_COMPOSITION_LIMIT', `Composite Query exceeds ${QUERY_COMPOSITION_LIMITS.maximumPhysicalQueries} physical Queries or dependency depth ${QUERY_COMPOSITION_LIMITS.maximumDependencyDepth}.`);
     }
     return Object.freeze({
-        queries: physicalKeys.size,
-        depth: maximumDepth,
         logicalQueries,
         physicalQueries: physicalKeys.size,
         dependencyDepth: maximumDepth,

package/dist/application/routes/admission.d.ts

@@ -1,5 +1,5 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 import type { RuntimeRegistry } from '../runtime/index.js';
 import type { Routes } from './collection.js';
 /** Lower recipe identities to canonical callable keys after Runtime admission. */
-export declare function admit(input: Routes | undefined, registry: RuntimeRegistry): readonly publication.HttpRouteDeclaration[];
+export declare function admit(input: Routes | undefined, registry: RuntimeRegistry): readonly release.HttpRouteDeclaration[];

package/dist/application/routes/admission.js

@@ -4,7 +4,7 @@ export function admit(input, registry) {
     if (input === undefined)
         return Object.freeze([]);
     if (!isRoutes(input))
-        throw new TypeError('Application routes are not admitted.');
+        throw new TypeError('Domain routes are not admitted.');
     return Object.freeze(input.entries.map(({ target, ...declaration }) => {
         const implementation = registry.implementations.find(({ definition }) => definition === target);
         if (implementation === undefined) {

package/dist/application/routes/route.d.ts

@@ -1,9 +1,9 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 export interface RouteTarget {
     readonly kind: 'action' | 'workflow';
     readonly address: string;
 }
-export type RouteInput = Omit<publication.HttpRouteDeclaration, 'callable'>;
+export type RouteInput = Omit<release.HttpRouteDeclaration, 'callable'>;
 /** One provider-neutral HTTP route targeting an admitted Action or Workflow recipe. */
 export interface Route<Target extends RouteTarget = RouteTarget> extends RouteInput {
     readonly target: Target;

package/dist/application/runtime/actions.js

@@ -16,6 +16,9 @@ export function admitActions(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Action ${definition.address} is not root-local and executable.`);
         }
+        if (callable.execution?.durable === true) {
+            throw new TypeError(`Runtime Action ${definition.address} is durable; implement it with defineWorkflow.`);
+        }
         return Object.freeze({
             kind: 'action',
             address: definition.address,

package/dist/application/runtime/workflows.d.ts

@@ -6,6 +6,8 @@ export interface RuntimeWorkflow {
     readonly address: string;
     readonly callable: ResolvedCallable;
     readonly definition: WorkflowDefinition;
+    /** Declared `execution: { durable: true }`: runs on the workflow engine, never inline. */
+    readonly durable: boolean;
 }
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export declare function admitWorkflows(callables: readonly RuntimeCallable[], input: unknown): readonly RuntimeWorkflow[];

package/dist/application/runtime/workflows.js

@@ -1,6 +1,6 @@
 import { isWorkflow } from '../workflow/index.js';
 import { runtimeCallableAt } from './callables.js';
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export function admitWorkflows(callables, input) {
     if (!Array.isArray(input))
         throw new TypeError('Runtime workflows must be an array.');
@@ -16,17 +16,19 @@ export function admitWorkflows(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Workflow ${definition.address} is not root-local and executable.`);
         }
-        if (callable.auth === 'anonymous') {
-            throw new TypeError(`Runtime Workflow ${definition.address} must be authenticated.`);
-        }
         if (callable.output.mode !== 'value') {
             throw new TypeError(`Runtime Workflow ${definition.address} must have value output.`);
         }
+        const durable = callable.execution?.durable === true;
+        if (!durable && definition.compat !== undefined) {
+            throw new TypeError(`Runtime Workflow ${definition.address} declares compat but its callable is not durable.`);
+        }
         return Object.freeze({
             kind: 'workflow',
             address: definition.address,
             callable,
             definition,
+            durable,
         });
     });
     return Object.freeze(workflows);

package/dist/application/view/define.js

@@ -5,7 +5,10 @@ import { isFrontendSource } from './source.js';
 export function defineFrontend(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    if (Reflect.ownKeys(input).some((key) => key !== 'schema' && key !== 'source' && key !== 'routes' && key !== 'entrypoint')) {
+    if (Object.hasOwn(input, 'entrypoint')) {
+        throw new TypeError('Frontend entrypoint is removed: declare it with defineSchema(origin, { entrypoint }).');
+    }
+    if (Reflect.ownKeys(input).some((key) => key !== 'schema' && key !== 'source' && key !== 'routes')) {
         invalid();
     }
     const names = Object.keys(input.schema.views).sort(compare);
@@ -18,10 +21,6 @@ export function defineFrontend(input) {
     const unknown = Reflect.ownKeys(authored).find((name) => typeof name !== 'string' || !names.includes(name));
     if (unknown !== undefined)
         throw new TypeError(`Frontend route ${String(unknown)} is unknown.`);
-    const entrypoint = input.entrypoint ?? (names.length === 1 ? names[0] : undefined);
-    if (entrypoint === undefined || !names.includes(entrypoint)) {
-        throw new TypeError('Frontend entrypoint must name one Schema View.');
-    }
     const paths = new Set();
     const routes = {};
     for (const name of names) {
@@ -36,7 +35,6 @@ export function defineFrontend(input) {
         schema: input.schema,
         source,
         routes: Object.freeze(routes),
-        entrypoint: entrypoint,
     }));
 }
 function admitSource(input) {

package/dist/application/view/frontend.d.ts

@@ -8,12 +8,12 @@ export interface FrontendInput<Schema extends schema.DomainSchema> {
     readonly schema: Schema;
     readonly source: FrontendSource;
     readonly routes?: FrontendRouteInputs<Schema>;
-    readonly entrypoint?: ViewName<Schema>;
+    /** Removed: the Schema declares its entrypoint with `defineSchema(origin, { entrypoint })`. */
+    readonly entrypoint?: never;
 }
 export interface Frontend<Schema extends schema.DomainSchema = schema.DomainSchema> {
     readonly kind: 'frontend';
     readonly schema: Schema;
     readonly source: FrontendSource;
     readonly routes: FrontendRoutes<Schema>;
-    readonly entrypoint: ViewName<Schema>;
 }

package/dist/application/view/index.d.ts

@@ -1,6 +1,6 @@
 export { isFrontend } from './admission.js';
 export { defineFrontend } from './define.js';
 export type { Frontend, FrontendInput, FrontendRouteInputs, FrontendRoutes, ViewName, } from './frontend.js';
-export type { FrontendHandshake, FrontendRoute, FrontendRouteInput, IframeRequirements, ViewHostRequirements, } from './route.js';
+export type { FrontendHandshake, FrontendRoute, FrontendRouteInput, ViewHostRequirements, } from './route.js';
 export { external, isFrontendSource, vite } from './source.js';
 export type { ExternalSource, FrontendSource, ViteSource } from './source.js';

package/dist/application/view/route.d.ts

@@ -1,30 +1,16 @@
 import { type ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 export type { ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 export type FrontendHandshake = 'shell' | 'none';
-/**
- * @deprecated Every trusted View receives the Shell's shared browser profile: requirements within
- * it are redundant, and Astrale hosts refuse any beyond it. Declare none.
- */
-export interface IframeRequirements {
-    readonly sandbox?: readonly string[];
-    readonly allow?: readonly string[];
-}
 export type FrontendRouteInput = string | {
     readonly path?: string;
     readonly document?: string;
     readonly handshake?: FrontendHandshake;
-    /**
-     * @deprecated Every trusted View receives the Shell's shared browser profile: requirements
-     * within it are redundant, and Astrale hosts refuse any beyond it. Remove this field.
-     */
-    readonly iframe?: IframeRequirements;
     readonly host?: ViewHostRequirements;
 };
 export interface FrontendRoute {
     readonly path: string;
     readonly document: string;
     readonly handshake: FrontendHandshake;
-    readonly iframe?: IframeRequirements;
     readonly host?: ViewHostRequirements;
 }
 export declare function normalizeRoute(input: FrontendRouteInput | undefined, fallback: string): FrontendRoute;

package/dist/application/view/route.js

@@ -1,16 +1,10 @@
 import { acceptViewHostRequirements, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
-const TOKEN = /^[a-z][a-z0-9-]*$/u;
-const BASELINES = Object.freeze({
-    none: iframeRequirements(['allow-scripts'], []),
-    shell: iframeRequirements(['allow-same-origin', 'allow-scripts'], ['clipboard-write']),
-});
 export function normalizeRoute(input, fallback) {
     if (typeof input === 'string') {
         return Object.freeze({ path: routePath(input), document: 'index.html', handshake: 'shell' });
     }
     const value = plainRecord(input ?? {});
-    if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' ||
-        !['path', 'document', 'handshake', 'iframe', 'host'].includes(key))) {
+    if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' || !['path', 'document', 'handshake', 'host'].includes(key))) {
         invalid();
     }
     const authoredHandshake = dataValue(value, 'handshake');
@@ -20,59 +14,14 @@ export function normalizeRoute(input, fallback) {
         invalid();
     }
     const handshake = authoredHandshake ?? 'shell';
-    const iframe = normalizeIframeRequirements(dataValue(value, 'iframe'), handshake);
     const host = acceptViewHostRequirements(dataValue(value, 'host'), handshake, true);
     return Object.freeze({
         path: routePath(dataValue(value, 'path') ?? fallback),
         document: filePath(dataValue(value, 'document') ?? 'index.html'),
         handshake,
-        ...(iframe === undefined ? {} : { iframe }),
         ...(host === undefined ? {} : { host }),
     });
 }
-function normalizeIframeRequirements(input, handshake) {
-    if (input === undefined)
-        return undefined;
-    const value = plainRecord(input);
-    if (Reflect.ownKeys(value).some((key) => key !== 'sandbox' && key !== 'allow'))
-        invalid();
-    const authored = iframeRequirements(tokenArray(dataValue(value, 'sandbox')), tokenArray(dataValue(value, 'allow')));
-    assertSandboxRelationships(authored.sandbox);
-    const baseline = BASELINES[handshake];
-    const sandbox = authored.sandbox.filter((token) => !baseline.sandbox.includes(token));
-    const allow = authored.allow.filter((feature) => !baseline.allow.includes(feature));
-    return sandbox.length === 0 && allow.length === 0 ? undefined : iframeRequirements(sandbox, allow);
-}
-function iframeRequirements(sandbox, allow) {
-    return Object.freeze({
-        sandbox: Object.freeze([...new Set(sandbox)].sort()),
-        allow: Object.freeze([...new Set(allow)].sort()),
-    });
-}
-function tokenArray(input) {
-    if (input === undefined)
-        return [];
-    if (!Array.isArray(input))
-        invalid();
-    const descriptors = Object.getOwnPropertyDescriptors(input);
-    const result = [];
-    for (let index = 0; index < input.length; index += 1) {
-        const descriptor = descriptors[String(index)];
-        if (descriptor === undefined || !('value' in descriptor))
-            invalid();
-        if (typeof descriptor.value !== 'string' || !TOKEN.test(descriptor.value))
-            invalid();
-        result.push(descriptor.value);
-    }
-    for (const key of Reflect.ownKeys(descriptors)) {
-        if (key === 'length')
-            continue;
-        if (typeof key !== 'string' || !/^(0|[1-9][0-9]*)$/u.test(key) || Number(key) >= input.length) {
-            invalid();
-        }
-    }
-    return result;
-}
 function plainRecord(input) {
     if (typeof input !== 'object' || input === null || Array.isArray(input))
         invalid();
@@ -89,18 +38,6 @@ function dataValue(input, key) {
         invalid();
     return descriptor.value;
 }
-function assertSandboxRelationships(sandbox) {
-    const tokens = new Set(sandbox);
-    if (tokens.has('allow-popups-to-escape-sandbox') && !tokens.has('allow-popups'))
-        invalid();
-    if (tokens.has('allow-top-navigation') && tokens.has('allow-top-navigation-by-user-activation')) {
-        invalid();
-    }
-    if (tokens.has('allow-top-navigation-to-custom-protocols') &&
-        (tokens.has('allow-top-navigation') || tokens.has('allow-popups'))) {
-        invalid();
-    }
-}
 export function defaultRoute(name) {
     return routePath(`/${name
         .replace(/([a-z0-9])([A-Z])/gu, '$1-$2')

package/dist/application/workflow/authoring.d.ts

@@ -1,4 +1,5 @@
 export { defineWorkflow } from './define.js';
-export type { WorkflowContext } from './context.js';
-export type { Workflow, WorkflowAddress, WorkflowDefinition } from './workflow.js';
+export type { InlineWorkflowContext, WorkflowContext } from './context.js';
+export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableWorkflowContext, } from './durable.js';
+export type { Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/workflow/context.d.ts

@@ -2,8 +2,14 @@ import type { Domain } from '../../platform/schema/index.js';
 import type { ActionContext, ResolvedCallable } from '../action/index.js';
 import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
+import type { DurableCallable, DurableWorkflowContext } from './durable.js';
 import type { WorkflowStep } from './step/index.js';
-/** Exact multi-step Workflow context for one authenticated value-output callable. */
-export type WorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = ActionContext<Callable, DomainValue, Definitions, Errors> & {
+/** Multi-step context of one value-output callable run inside its invocation. */
+export type InlineWorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = ActionContext<Callable, DomainValue, Definitions, Errors> & {
     readonly step: WorkflowStep;
 };
+/**
+ * Exact Workflow context for one callable: engine-journaled when its Schema declares
+ * `execution: { durable: true }`, otherwise run inside its invocation.
+ */
+export type WorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = Callable extends DurableCallable ? DurableWorkflowContext<Callable, DomainValue, Errors> : InlineWorkflowContext<Callable, DomainValue, Definitions, Errors>;

package/dist/application/workflow/define.d.ts

@@ -1,11 +1,11 @@
 import type { schema } from '../../platform/schema/index.js';
 import type { ResolvedDomainOf } from '../action/index.js';
-import type { DeclaredErrorOptions, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
+import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
-import type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowDefinition } from './workflow.js';
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+import type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export declare function defineWorkflow<Schema extends schema.DomainSchema, Definitions extends Integrations = Readonly<Record<never, never>>>(): {
     <const Address extends WorkflowAddress<Schema>>(address: Address, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): WorkflowDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
-    <const Address extends WorkflowAddress<Schema>, const Errors extends DeclaredErrors>(address: Address, options: DeclaredErrorOptions<Errors>, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, Errors>): WorkflowDefinition<Schema, Address, Definitions, Errors>;
+    <const Address extends WorkflowAddress<Schema>, const Errors extends DeclaredErrors = NoDeclaredErrors>(address: Address, options: WorkflowOptions<Errors>, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, Errors>): WorkflowDefinition<Schema, Address, Definitions, Errors>;
 };
 export declare function isWorkflow(input: unknown): input is WorkflowDefinition;

package/dist/application/workflow/define.js

@@ -1,11 +1,12 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { rememberDeclaredErrors } from '../error/index.js';
 const admittedWorkflows = new WeakSet();
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+const COMPAT_TOKEN = /^[A-Za-z0-9._~-]{1,64}$/u;
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export function defineWorkflow() {
     return function define(address, optionsOrRun, possibleRun) {
         acceptWorkflowAddress(address);
-        const options = possibleRun === undefined ? undefined : optionsOrRun;
+        const options = possibleRun === undefined ? undefined : acceptOptions(optionsOrRun);
         const run = possibleRun ?? optionsOrRun;
         if (typeof run !== 'function')
             throw new TypeError('Workflow run must be a function.');
@@ -13,13 +14,28 @@ export function defineWorkflow() {
             kind: 'workflow',
             address,
             run,
+            ...(options?.compat === undefined ? {} : { compat: options.compat }),
         });
-        if (options !== undefined)
-            rememberDeclaredErrors(workflow, options);
+        if (options?.errors !== undefined)
+            rememberDeclaredErrors(workflow, { errors: options.errors });
         admittedWorkflows.add(workflow);
         return workflow;
     };
 }
+function acceptOptions(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => key !== 'errors' && key !== 'compat')) {
+        throw new TypeError('Workflow options accept only errors and compat.');
+    }
+    const options = input;
+    if (options.compat !== undefined &&
+        (typeof options.compat !== 'string' || !COMPAT_TOKEN.test(options.compat))) {
+        throw new TypeError(`Invalid Workflow compat token: ${JSON.stringify(options.compat)}.`);
+    }
+    return options;
+}
 export function isWorkflow(input) {
     return input !== null && typeof input === 'object' && admittedWorkflows.has(input);
 }