@astrale-os/sdk 0.6.0-beta.36 → 0.6.0-beta.37

package/dist/application/workflow/index.d.ts

@@ -1,6 +1,6 @@
 export { defineWorkflow, isWorkflow } from './define.js';
 export type { InlineWorkflowContext, WorkflowContext } from './context.js';
-export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableWorkflowContext, } from './durable.js';
+export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableWorkflowContext, SignalOutcome, } from './durable.js';
 export type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowCallable, WorkflowDefinition, WorkflowOptions, } from './workflow.js';
 export * as step from './step/index.js';
 export * as runner from './runner/index.js';

package/dist/execution/identity/authentication.js

@@ -56,10 +56,10 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
     const expressions = callbackIdentities(established.delegation.credential);
-    const session = (expression) => callbackSession(expectedKernel, expression, established.verified, execution, configuration);
+    const session = (expression, validUntil) => callbackSession(expectedKernel, expression, validUntil, execution, configuration);
     const sessions = Object.freeze({
-        caller: session(expressions.caller),
-        self: session(expressions.self),
+        caller: session(expressions.caller, established.validUntil),
+        self: session(expressions.self, established.verified.exp),
     });
     const graph = Object.freeze({
         caller: bindSession(sessions.caller, execution),
@@ -111,13 +111,18 @@ export function executorSession(kernel, executionId, execution, configuration) {
     admitEndpoint(invocationUrl(admitted), configuration.policy);
     return callbackSession(admitted, selfIdentity, undefined, execution, configuration, executionId);
 }
-function callbackSession(kernel, expression, carrier, execution, configuration, executionId) {
-    const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, kernel, expression, carrier, execution, executionId);
+/**
+ * A Session whose callbacks carry `expression`, none outliving the execution or `validUntil`, the
+ * earliest expiry in Unix seconds of the credentials they derive from.
+ */
+function callbackSession(kernel, expression, validUntil, execution, configuration, executionId) {
+    const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, kernel, expression, validUntil, execution, executionId);
+    const expiresAt = Math.min(execution.deadline, (validUntil ?? Number.POSITIVE_INFINITY) * 1_000);
     return new ClientSession({
         kernel,
         fetch: boundedFetch(configuration.fetch, execution.signal),
         auth: {
-            ttlSeconds: Math.min(callbackTtl(execution.deadline), maximumCallbackDelegationTtlSeconds),
+            ttlSeconds: Math.min(callbackTtl(expiresAt), maximumCallbackDelegationTtlSeconds),
             async resolve(_call, signal) {
                 const callback = await resolveCallback(signal);
                 signal.throwIfAborted();
@@ -159,6 +164,7 @@ async function establishCaller(input, audience, verification, execution, policy)
         }
         return Object.freeze({
             verified: context.verified,
+            validUntil: Math.min(context.verified.exp ?? Number.POSITIVE_INFINITY, proof.verified.exp ?? Number.POSITIVE_INFINITY),
             delegation: carried,
             caller: Object.freeze({
                 kind: 'authenticated',

package/dist/execution/identity/callback.d.ts

@@ -1,4 +1,4 @@
-import type { IssuerId, UnresolvedIdentityExpr, VerifiedCredential } from '../../platform/auth/index.js';
+import type { IssuerId, UnresolvedIdentityExpr } from '../../platform/auth/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
 import type { SigningMaterial } from './signing.js';
 export declare const maximumCallbackTtlSeconds = 120;
@@ -29,17 +29,16 @@ export declare function signDomainCallback(signing: SigningMaterial, issuer: Iss
     readonly deadline: number;
     readonly signal: AbortSignal;
 }): Promise<string>;
-export declare function signCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
-    readonly deadline: number;
-    readonly signal: AbortSignal;
-}): Promise<string>;
 /**
- * Reuse one exact callback authority partition, refreshing only near its bounded expiry. Without a
- * carrier the callback is the Domain's own authority, bounded by the execution alone. An
+ * Reuse one exact callback authority partition, refreshing only near its bounded expiry. No callback
+ * outlives `validUntil`, the earliest expiry in Unix seconds of the credentials it derives from: the
+ * Kernel folds each of them into the callback's validity, so a longer callback could not carry its
+ * delegation. Without it the callback is the Domain's own authority, bounded by the execution alone.
+ * Once that authority can no longer carry a callback, the call ends as DEADLINE_EXCEEDED. An
  * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
  * no caller-bound callback names one.
  */
-export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential | undefined, execution: {
+export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, validUntil: number | undefined, execution: {
     readonly deadline: number;
     readonly signal: AbortSignal;
 }, executionId?: NodeId): (signal: AbortSignal) => Promise<SignedCallback>;

package/dist/execution/identity/callback.js

@@ -17,18 +17,17 @@ export function callbackIdentities(nested) {
 export async function signDomainCallback(signing, issuer, subject, audience, execution) {
     return (await sign(signing, issuer, subject, audience, selfIdentity, execution)).credential;
 }
-export async function signCallback(signing, issuer, subject, audience, expression, carrier, execution) {
-    const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
-    return (await sign(signing, issuer, subject, audience, expression, execution, maximum)).credential;
-}
 /**
- * Reuse one exact callback authority partition, refreshing only near its bounded expiry. Without a
- * carrier the callback is the Domain's own authority, bounded by the execution alone. An
+ * Reuse one exact callback authority partition, refreshing only near its bounded expiry. No callback
+ * outlives `validUntil`, the earliest expiry in Unix seconds of the credentials it derives from: the
+ * Kernel folds each of them into the callback's validity, so a longer callback could not carry its
+ * delegation. Without it the callback is the Domain's own authority, bounded by the execution alone.
+ * Once that authority can no longer carry a callback, the call ends as DEADLINE_EXCEEDED. An
  * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
  * no caller-bound callback names one.
  */
-export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, carrier, execution, executionId) {
-    const maximum = carrier?.exp ?? Number.POSITIVE_INFINITY;
+export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, validUntil, execution, executionId) {
+    const maximum = validUntil ?? Number.POSITIVE_INFINITY;
     let cached;
     let pending;
     return async (signal) => {
@@ -42,9 +41,8 @@ export function createCallbackCredentialResolver(signing, issuer, subject, audie
         if (pending === undefined) {
             const current = sign(signing, issuer, subject, audience, expression, execution, maximum, executionId).then((signed) => {
                 const delegateTtlSeconds = Math.min(maximumCallbackDelegationTtlSeconds, signed.expiresAt - signed.issuedAt - CALLBACK_DELEGATION_SKEW_SECONDS);
-                if (delegateTtlSeconds < 1) {
-                    throw protocolError('AUTH_INVALID', 'Credential is invalid.');
-                }
+                if (delegateTtlSeconds < 1)
+                    throw exhausted(execution, maximum);
                 return (cached = Object.freeze({
                     credential: signed.credential,
                     expiresAt: signed.expiresAt,
@@ -69,9 +67,8 @@ async function sign(signing, issuer, subject, audience, expression, execution, m
     requireLive(execution);
     const now = Math.floor(Date.now() / 1_000);
     const expiresAt = Math.min(maximum, Math.floor(execution.deadline / 1_000), now + maximumCallbackTtlSeconds);
-    if (!Number.isFinite(expiresAt) || expiresAt <= now) {
-        throw protocolError('AUTH_INVALID', 'Credential is invalid.');
-    }
+    if (!Number.isFinite(expiresAt) || expiresAt <= now)
+        throw exhausted(execution, maximum);
     const credential = await withSignal(new SignJWT({
         grant: { v: 1, expr: expression },
         ...(executionId === undefined ? {} : { [EXECUTION_CLAIM]: executionId }),
@@ -89,6 +86,12 @@ async function sign(signing, issuer, subject, audience, expression, execution, m
     requireLive(execution);
     return Object.freeze({ credential, issuedAt: now, expiresAt });
 }
+/** The authority a callback derives from ends before the callback could serve a call. */
+function exhausted(execution, maximum) {
+    return protocolError('DEADLINE_EXCEEDED', maximum * 1_000 < execution.deadline
+        ? 'Caller authority has expired.'
+        : 'Invocation deadline was exceeded.');
+}
 function withSignal(operation, signal) {
     if (signal.aborted)
         return Promise.reject(signal.reason);

package/dist/execution/invocation/capabilities/bind.d.ts

@@ -0,0 +1,11 @@
+import type { DomainCapabilities } from '../../../application/action/index.js';
+import type { BoundClientSession } from '../../../platform/client/session/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+import type { InvocationSessions } from '../admission/index.js';
+/**
+ * Bind what code acting under `sessions` holds: self-default Kernel and graph, and dependency
+ * invokers per authority. An Action and a durable Step receive these same capabilities.
+ */
+export declare function bindCapabilities(domain: Domain, sessions: Readonly<Record<'caller' | 'self', BoundClientSession>>): DomainCapabilities;
+export declare function bindCapabilities(domain: Domain, sessions: Readonly<Record<'self', BoundClientSession>>): DomainCapabilities<Domain, 'self'>;
+export declare function bindCapabilities(domain: Domain, sessions: InvocationSessions): DomainCapabilities | DomainCapabilities<Domain, 'self'>;

package/dist/execution/invocation/capabilities/bind.js

@@ -0,0 +1,25 @@
+import { bindMutation } from '../../../application/mutation/execution/executor.js';
+import { bindQuery } from '../../../application/query/execution/executor.js';
+import { bindDependencies } from '../dependency/index.js';
+export function bindCapabilities(domain, sessions) {
+    const graph = bindGraph(sessions, domain);
+    return Object.freeze({
+        kernel: Object.freeze({ ...sessions.self, ...sessions }),
+        dependencies: bindDependencies(domain, sessions),
+        graph,
+        query: graph.self.query,
+        mutate: graph.self.mutate,
+    });
+}
+function bindGraph(sessions, domain) {
+    const bind = (client) => Object.freeze({
+        query: bindQuery(client, domain),
+        mutate: bindMutation(client, domain),
+    });
+    const self = bind(sessions.self);
+    return Object.freeze({
+        ...self,
+        ...('caller' in sessions ? { caller: bind(sessions.caller) } : {}),
+        self,
+    });
+}

package/dist/execution/invocation/capabilities/index.d.ts

@@ -0,0 +1 @@
+export { bindCapabilities } from './bind.js';

package/dist/execution/invocation/capabilities/index.js

@@ -0,0 +1 @@
+export { bindCapabilities } from './bind.js';

package/dist/execution/invocation/dispatch/context.js

@@ -1,10 +1,7 @@
-import { bindMutation } from '../../../application/mutation/execution/executor.js';
-import { bindQuery } from '../../../application/query/execution/executor.js';
-import { bindDependencies } from '../dependency/index.js';
+import { bindCapabilities } from '../capabilities/index.js';
 import { clients } from '../integration/index.js';
 export function context(request, runtime, authentication, self) {
     const sessions = authentication.graph;
-    const graph = bindGraph(sessions, runtime.loaded.domain);
     const execution = Object.freeze({
         signal: request.context.execution.signal,
         deadline: request.context.execution.deadline,
@@ -20,11 +17,7 @@ export function context(request, runtime, authentication, self) {
         input: request.call.input,
         ...(request.context.binary === undefined ? {} : { body: request.context.binary }),
         caller: authentication.caller,
-        kernel: Object.freeze({ ...sessions.self, ...sessions }),
-        dependencies: bindDependencies(runtime.loaded.domain, sessions),
-        graph,
-        query: graph.self.query,
-        mutate: graph.self.mutate,
+        ...bindCapabilities(runtime.loaded.domain, sessions),
         integrations: clients(runtime, request.context, {
             ...sessions,
             ...(authentication.caller.kind !== 'authenticated' ||
@@ -36,15 +29,3 @@ export function context(request, runtime, authentication, self) {
         ...(self === undefined ? {} : { self }),
     });
 }
-function bindGraph(sessions, domain) {
-    const bind = (client) => Object.freeze({
-        query: bindQuery(client, domain),
-        mutate: bindMutation(client, domain),
-    });
-    const self = bind(sessions.self);
-    return Object.freeze({
-        ...self,
-        ...('caller' in sessions ? { caller: bind(sessions.caller) } : {}),
-        self,
-    });
-}

package/dist/execution/invocation/integration/authentication.d.ts

@@ -1,5 +1,5 @@
-import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationAuthentication } from '../../../application/integration/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
-/** Capture only self mint, bounded by this invocation's verified credential horizon. */
-export declare function bindIntegrationAuthentication(context: InvocationContext, self: BoundClientSession, expiresAt?: number): IntegrationAuthentication;
+import type { Lifetime } from '../lifecycle/index.js';
+/** Capture only self mint, bounded by its lifetime and the verified credential horizon. */
+export declare function bindIntegrationAuthentication(lifetime: Lifetime, self: BoundClientSession, expiresAt?: number): IntegrationAuthentication;

package/dist/execution/invocation/integration/authentication.js

@@ -3,15 +3,15 @@ import { active } from '../lifecycle/index.js';
 import { protocolError } from '../result/index.js';
 // Match the callback resolver's reserve; a child credential cannot outlive its source.
 const TRANSPORT_RESERVE_SECONDS = 5;
-/** Capture only self mint, bounded by this invocation's verified credential horizon. */
-export function bindIntegrationAuthentication(context, self, expiresAt) {
+/** Capture only self mint, bounded by its lifetime and the verified credential horizon. */
+export function bindIntegrationAuthentication(lifetime, self, expiresAt) {
     if (expiresAt !== undefined && !Number.isFinite(expiresAt)) {
         throw new TypeError('Invalid Integration authentication expiry.');
     }
     const mint = self.auth.mint.bind(self.auth);
     return Object.freeze({
         async mint(input) {
-            active(context);
+            active(lifetime);
             if (input === null || typeof input !== 'object' || Array.isArray(input))
                 invalidInput();
             const keys = Reflect.ownKeys(input);
@@ -25,16 +25,16 @@ export function bindIntegrationAuthentication(context, self, expiresAt) {
                 ttlSeconds < 1 ||
                 ttlSeconds > 60)
                 invalidInput();
-            const horizon = Math.min(context.execution.deadline / 1000, expiresAt ?? Infinity);
+            const horizon = Math.min(lifetime.deadline / 1000, expiresAt ?? Infinity);
             const remaining = Math.floor(horizon) - Math.floor(Date.now() / 1000) - TRANSPORT_RESERVE_SECONDS;
             if (remaining < 1) {
                 throw protocolError('DEADLINE_EXCEEDED', 'Insufficient lifetime for Integration credential.');
             }
             const credential = await mint({ audience, ttlSeconds: Math.min(ttlSeconds, remaining) }, {
-                signal: context.execution.signal,
-                timeoutMs: Math.max(1, context.execution.deadline - Date.now()),
+                signal: lifetime.signal,
+                timeoutMs: Math.max(1, lifetime.deadline - Date.now()),
             });
-            active(context);
+            active(lifetime);
             // Inspect only the result of the trusted Kernel call, not a Provider-supplied token.
             // The reserve is an optimization; this absolute check is the lifetime boundary.
             const expiry = credentials.inspect(credential).claims.exp;

package/dist/execution/invocation/integration/call.js

@@ -6,11 +6,11 @@ export function calls(context, sessions = null) {
     const invoke = sessions?.caller?.invoke.bind(sessions.caller);
     const auth = sessions === null
         ? undefined
-        : bindIntegrationAuthentication(context, sessions.self, sessions.expiresAt);
+        : bindIntegrationAuthentication(context.execution, sessions.self, sessions.expiresAt);
     let sequence = 0;
     return Object.freeze({
         invoke(call) {
-            active(context);
+            active(context.execution);
             sequence += 1;
             return call.attempt({
                 callId: `${prefix}:${sequence}`,

package/dist/execution/invocation/integration/index.d.ts

@@ -1,2 +1,3 @@
+export { bindIntegrationAuthentication } from './authentication.js';
 export { calls } from './call.js';
 export { clients } from './clients.js';

package/dist/execution/invocation/integration/index.js

@@ -1,2 +1,3 @@
+export { bindIntegrationAuthentication } from './authentication.js';
 export { calls } from './call.js';
 export { clients } from './clients.js';

package/dist/execution/invocation/invocation.js

@@ -8,7 +8,7 @@ import { project, protocolError } from './result/index.js';
 const MISS = Object.freeze({ kind: 'miss' });
 const FUNCTION_MISS = 'FUNCTION_MISS';
 export async function invoke(request, inputConfig) {
-    active(request.context);
+    active(request.context.execution);
     if (!pinsRunningRelease(request, inputConfig.runtime.loaded.release)) {
         throw protocolError('CONFLICT', 'Invocation release differs from the running Release.');
     }
@@ -111,7 +111,7 @@ async function dispatchAdmitted(request, inputConfig, admitted, established) {
         input(selected.implementation.callable, request.call.input, request.context.binary);
         admittedAuthentication ??= await authentication(selected.implementation.callable, request, inputConfig.runtime.loaded.domain, inputConfig.authority);
         close ??= once(admittedAuthentication.close);
-        active(request.context);
+        active(request.context.execution);
         const dispatchContext = context(request, inputConfig.runtime, admittedAuthentication, selected.self);
         const output = selected.implementation.kind === 'action'
             ? await action(selected.implementation, dispatchContext)

package/dist/execution/invocation/lifecycle/active.d.ts

@@ -1,4 +1,10 @@
-import type { HandlerResult, InvocationContext } from '@astrale-os/kernel-server';
-export declare function active(context: InvocationContext): void;
+import type { HandlerResult } from '@astrale-os/kernel-server';
+/** The bounds of one unit of work: an invocation, or one attempt of a durable Step. */
+export interface Lifetime {
+    readonly signal: AbortSignal;
+    /** Absolute Unix time in milliseconds. */
+    readonly deadline: number;
+}
+export declare function active(lifetime: Lifetime): void;
 /** Close authenticated resources after finite results or stream settlement. */
 export declare function settle(result: HandlerResult, close: () => void): HandlerResult;

package/dist/execution/invocation/lifecycle/active.js

@@ -1,9 +1,9 @@
 import { protocolError } from '../result/index.js';
-export function active(context) {
-    if (context.execution.signal.aborted) {
+export function active(lifetime) {
+    if (lifetime.signal.aborted) {
         throw protocolError('CANCELLED', 'Invocation was cancelled.');
     }
-    if (Date.now() >= context.execution.deadline) {
+    if (Date.now() >= lifetime.deadline) {
         throw protocolError('DEADLINE_EXCEEDED', 'Invocation deadline was exceeded.');
     }
 }

package/dist/execution/invocation/lifecycle/index.d.ts

@@ -1 +1 @@
-export { active, settle } from './active.js';
+export { active, settle, type Lifetime } from './active.js';

package/dist/execution/service/create.js

@@ -72,6 +72,7 @@ export function createService(input) {
             domain: runtime.loaded.domain,
             identity: selectedIdentity,
             serving: configuration,
+            integrations: runtime.clients,
         });
     });
     let closing;

package/dist/execution/workflows/engine.d.ts

@@ -15,6 +15,8 @@ export interface DurableEngine {
         readonly metadata?: Record<string, string>;
     }) => Error;
     readonly CancelledError: abstract new (...input: never[]) => Error;
+    /** The rejection of `orTimeout` once its duration elapses first. */
+    readonly TimeoutError: abstract new (...input: never[]) => Error;
 }
 export interface EngineWorkflowDefinition {
     readonly name: string;
@@ -34,12 +36,20 @@ export interface EngineRetryPolicy {
     readonly maxInterval: number;
     readonly exponentiationFactor: number;
 }
+/**
+ * A promise the engine journals. Its combinators are journaled too, so a replay settles them as the
+ * first run did; racing it against another promise with `Promise.race` would not be.
+ */
+export interface EnginePromise<Output> extends PromiseLike<Output> {
+    /** Settle with this promise, or reject with `TimeoutError` once `millis` elapse first. */
+    orTimeout(millis: number): PromiseLike<unknown>;
+}
 /** Journaled operations of one workflow run. */
 export interface EngineWorkflowContext {
     run<Output>(name: string, action: () => Promise<Output>): PromiseLike<Output>;
     sleep(durationMs: number, name?: string): PromiseLike<void>;
-    promise<Output>(name: string): {
-        get(): PromiseLike<Output>;
+    promise(name: string): {
+        get(): EnginePromise<unknown>;
     };
     request(): {
         readonly attemptCompletedSignal: AbortSignal;

package/dist/execution/workflows/index.d.ts

@@ -1,4 +1,4 @@
-export type { DurableEngine, EngineRetryPolicy, EngineSharedContext, EngineWorkflowContext, EngineWorkflowDefinition, } from './engine.js';
+export type { DurableEngine, EnginePromise, EngineRetryPolicy, EngineSharedContext, EngineWorkflowContext, EngineWorkflowDefinition, } from './engine.js';
 export { durableServing, type AdmittedDurableServing, type DurableServing, type DurableServingProvider, } from './options.js';
 export { createDurableReceiver, type DurableReceiver } from './receiver.js';
 export { isDurableRequest, isCanonicalDurableRequest } from './route.js';

package/dist/execution/workflows/integrations.d.ts

@@ -0,0 +1,13 @@
+import type { IntegrationAuthentication, IntegrationInvocationOwner } from '../../application/integration/index.js';
+import type { Lifetime } from '../invocation/lifecycle/index.js';
+/**
+ * The Integration calls of one Step attempt. Each call takes the Step's next derived key as its
+ * call id, so every attempt presents the same ids in the same order, and a keyed operation of
+ * source `execution` sends the same idempotency key. A retried Step may run an operation again,
+ * so an `unsafe` one is refused before its Provider runs. There is no caller to invoke for.
+ */
+export declare function stepCalls(input: {
+    readonly next: () => string;
+    readonly lifetime: Lifetime;
+    readonly auth: IntegrationAuthentication;
+}): IntegrationInvocationOwner;

package/dist/execution/workflows/integrations.js

@@ -0,0 +1,25 @@
+import { active } from '../invocation/lifecycle/index.js';
+/**
+ * The Integration calls of one Step attempt. Each call takes the Step's next derived key as its
+ * call id, so every attempt presents the same ids in the same order, and a keyed operation of
+ * source `execution` sends the same idempotency key. A retried Step may run an operation again,
+ * so an `unsafe` one is refused before its Provider runs. There is no caller to invoke for.
+ */
+export function stepCalls(input) {
+    const { next, lifetime, auth } = input;
+    return Object.freeze({
+        invoke(call) {
+            if (call.replay.kind === 'unsafe') {
+                throw new TypeError(`Integration operation ${call.integration}.${call.operation} is unsafe, and a retried ` +
+                    'durable Step would run it again.');
+            }
+            active(lifetime);
+            return call.attempt({
+                callId: next(),
+                signal: lifetime.signal,
+                deadline: lifetime.deadline,
+                auth,
+            });
+        },
+    });
+}

package/dist/execution/workflows/options.js

@@ -18,7 +18,8 @@ export function durableServing(input) {
         typeof engine.createEndpointHandler !== 'function' ||
         typeof engine.workflow !== 'function' ||
         typeof engine.TerminalError !== 'function' ||
-        typeof engine.CancelledError !== 'function') {
+        typeof engine.CancelledError !== 'function' ||
+        typeof engine.TimeoutError !== 'function') {
         invalid('Durable serving requires the Restate SDK Fetch entrypoint of this platform.');
     }
     const fetch = input.fetch ?? globalThis.fetch.bind(globalThis);
@@ -39,6 +40,7 @@ export function durableServing(input) {
             workflow: engine.workflow.bind(engine),
             TerminalError: engine.TerminalError,
             CancelledError: engine.CancelledError,
+            TimeoutError: engine.TimeoutError,
         }),
         fetch,
         retentionMs: bounded(input.retentionMs, 7 * DAY_MS, HOUR_MS, 365 * DAY_MS, 'retentionMs'),

package/dist/execution/workflows/receiver.d.ts

@@ -1,3 +1,4 @@
+import type { IntegrationClientFactory, Integrations } from '../../application/integration/index.js';
 import type { RuntimeWorkflow } from '../../application/runtime/workflows.js';
 import type { Domain } from '../../platform/schema/index.js';
 import type { Identity } from '../identity/index.js';
@@ -18,4 +19,6 @@ export declare function createDurableReceiver(input: {
     readonly domain: Domain;
     readonly identity: Identity;
     readonly serving: AdmittedDurableServing;
+    /** Integration clients of the initialized Runtime, which every Step holds. */
+    readonly integrations: IntegrationClientFactory<Integrations>;
 }): DurableReceiver;

package/dist/execution/workflows/receiver.js

@@ -1,6 +1,7 @@
 import { workflowEngineDiscovery, WorkflowEngineUnavailable } from './discovery.js';
 import { durableRoute } from './route.js';
 import { durableHandlers } from './run.js';
+import { sessionSteps } from './steps.js';
 const MAXIMUM_ENDPOINTS = 256;
 /**
  * Route `…/invoke/restate/<Kernel issuer>/<declaration key>/<service>/{discover,invoke/…}` to one
@@ -14,7 +15,11 @@ export function createDurableReceiver(input) {
     if (executor === undefined) {
         throw new TypeError('Durable Workflows require an execution Identity that can act as the Domain.');
     }
-    const bound = executor.bind(input.identity);
+    const steps = sessionSteps({
+        executor: executor.bind(input.identity),
+        domain: input.domain,
+        integrations: input.integrations,
+    });
     const declared = new Map(input.workflows
         .filter((workflow) => workflow.durable)
         .map((workflow) => [workflow.callable.key, workflow]));
@@ -48,8 +53,8 @@ export function createDurableReceiver(input) {
                     handlers: durableHandlers({
                         workflow,
                         domain: input.domain,
-                        executor: bound,
                         serving: input.serving,
+                        steps,
                         kernel,
                     }),
                     options: {

package/dist/execution/workflows/run.d.ts

@@ -1,16 +1,16 @@
 import type { RuntimeWorkflow } from '../../application/runtime/workflows.js';
 import type { IssuerId } from '../../platform/auth/index.js';
 import type { Domain } from '../../platform/schema/index.js';
-import type { Identity } from '../identity/index.js';
 import type { EngineSharedContext, EngineWorkflowContext } from './engine.js';
 import type { AdmittedDurableServing } from './options.js';
-type Executor = NonNullable<Identity['executor']>;
+import type { StepAuthorities } from './steps.js';
 export interface DurableRun {
     readonly kernel: IssuerId;
     readonly workflow: RuntimeWorkflow;
     readonly domain: Domain;
-    readonly executor: Executor;
     readonly serving: AdmittedDurableServing;
+    /** What each Step attempt holds. */
+    readonly steps: StepAuthorities;
 }
 /** Engine handlers of one durable Workflow: the `run` and the shared `signal`. */
 export declare function durableHandlers(input: DurableRun): Readonly<{
@@ -19,4 +19,3 @@ export declare function durableHandlers(input: DurableRun): Readonly<{
         accepted: boolean;
     }>;
 }>;
-export {};