@astrale-os/sdk 0.6.0-beta.4 → 0.6.0-beta.41

package/dist/application/query/index.js

@@ -1,6 +1,6 @@
 export { defineCollectionQuery, defineCompositeQuery, defineQuery, realizeQuery } from './define.js';
 export { executeQuery } from './execution/index.js';
-export { QueryPaginationError, } from './failure.js';
+export { QueryPaginationError, QueryValueMismatchError, } from './failure.js';
 export { queryResult } from './single/index.js';
 /** Canonical Query language and authoring values accept DSL ResolvedClass directly. */
 export * from '@astrale-os/kernel-core/graph/query';

package/dist/application/routes/admission.d.ts

@@ -1,5 +1,5 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 import type { RuntimeRegistry } from '../runtime/index.js';
 import type { Routes } from './collection.js';
 /** Lower recipe identities to canonical callable keys after Runtime admission. */
-export declare function admit(input: Routes | undefined, registry: RuntimeRegistry): readonly publication.HttpRouteDeclaration[];
+export declare function admit(input: Routes | undefined, registry: RuntimeRegistry): readonly release.HttpRouteDeclaration[];

package/dist/application/routes/admission.js

@@ -4,7 +4,7 @@ export function admit(input, registry) {
     if (input === undefined)
         return Object.freeze([]);
     if (!isRoutes(input))
-        throw new TypeError('Application routes are not admitted.');
+        throw new TypeError('Domain routes are not admitted.');
     return Object.freeze(input.entries.map(({ target, ...declaration }) => {
         const implementation = registry.implementations.find(({ definition }) => definition === target);
         if (implementation === undefined) {

package/dist/application/routes/route.d.ts

@@ -1,9 +1,9 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type { release } from '@astrale-os/kernel-protocol';
 export interface RouteTarget {
     readonly kind: 'action' | 'workflow';
     readonly address: string;
 }
-export type RouteInput = Omit<publication.HttpRouteDeclaration, 'callable'>;
+export type RouteInput = Omit<release.HttpRouteDeclaration, 'callable'>;
 /** One provider-neutral HTTP route targeting an admitted Action or Workflow recipe. */
 export interface Route<Target extends RouteTarget = RouteTarget> extends RouteInput {
     readonly target: Target;

package/dist/application/runtime/actions.js

@@ -16,6 +16,9 @@ export function admitActions(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Action ${definition.address} is not root-local and executable.`);
         }
+        if (callable.execution?.durable === true) {
+            throw new TypeError(`Runtime Action ${definition.address} is durable; implement it with defineWorkflow.`);
+        }
         return Object.freeze({
             kind: 'action',
             address: definition.address,

package/dist/application/runtime/workflows.d.ts

@@ -6,6 +6,8 @@ export interface RuntimeWorkflow {
     readonly address: string;
     readonly callable: ResolvedCallable;
     readonly definition: WorkflowDefinition;
+    /** Declared `execution: { durable: true }`: runs on the workflow engine, never inline. */
+    readonly durable: boolean;
 }
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export declare function admitWorkflows(callables: readonly RuntimeCallable[], input: unknown): readonly RuntimeWorkflow[];

package/dist/application/runtime/workflows.js

@@ -1,6 +1,6 @@
 import { isWorkflow } from '../workflow/index.js';
 import { runtimeCallableAt } from './callables.js';
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export function admitWorkflows(callables, input) {
     if (!Array.isArray(input))
         throw new TypeError('Runtime workflows must be an array.');
@@ -16,17 +16,16 @@ export function admitWorkflows(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Workflow ${definition.address} is not root-local and executable.`);
         }
-        if (callable.auth === 'anonymous') {
-            throw new TypeError(`Runtime Workflow ${definition.address} must be authenticated.`);
-        }
         if (callable.output.mode !== 'value') {
             throw new TypeError(`Runtime Workflow ${definition.address} must have value output.`);
         }
+        const durable = callable.execution?.durable === true;
         return Object.freeze({
             kind: 'workflow',
             address: definition.address,
             callable,
             definition,
+            durable,
         });
     });
     return Object.freeze(workflows);

package/dist/application/view/define.js

@@ -5,7 +5,10 @@ import { isFrontendSource } from './source.js';
 export function defineFrontend(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    if (Reflect.ownKeys(input).some((key) => key !== 'schema' && key !== 'source' && key !== 'routes' && key !== 'entrypoint')) {
+    if (Object.hasOwn(input, 'entrypoint')) {
+        throw new TypeError('Frontend entrypoint is removed: declare it with defineSchema(origin, { entrypoint }).');
+    }
+    if (Reflect.ownKeys(input).some((key) => key !== 'schema' && key !== 'source' && key !== 'routes')) {
         invalid();
     }
     const names = Object.keys(input.schema.views).sort(compare);
@@ -18,10 +21,6 @@ export function defineFrontend(input) {
     const unknown = Reflect.ownKeys(authored).find((name) => typeof name !== 'string' || !names.includes(name));
     if (unknown !== undefined)
         throw new TypeError(`Frontend route ${String(unknown)} is unknown.`);
-    const entrypoint = input.entrypoint ?? (names.length === 1 ? names[0] : undefined);
-    if (entrypoint === undefined || !names.includes(entrypoint)) {
-        throw new TypeError('Frontend entrypoint must name one Schema View.');
-    }
     const paths = new Set();
     const routes = {};
     for (const name of names) {
@@ -36,7 +35,6 @@ export function defineFrontend(input) {
         schema: input.schema,
         source,
         routes: Object.freeze(routes),
-        entrypoint: entrypoint,
     }));
 }
 function admitSource(input) {

package/dist/application/view/frontend.d.ts

@@ -8,12 +8,12 @@ export interface FrontendInput<Schema extends schema.DomainSchema> {
     readonly schema: Schema;
     readonly source: FrontendSource;
     readonly routes?: FrontendRouteInputs<Schema>;
-    readonly entrypoint?: ViewName<Schema>;
+    /** Removed: the Schema declares its entrypoint with `defineSchema(origin, { entrypoint })`. */
+    readonly entrypoint?: never;
 }
 export interface Frontend<Schema extends schema.DomainSchema = schema.DomainSchema> {
     readonly kind: 'frontend';
     readonly schema: Schema;
     readonly source: FrontendSource;
     readonly routes: FrontendRoutes<Schema>;
-    readonly entrypoint: ViewName<Schema>;
 }

package/dist/application/view/index.d.ts

@@ -1,6 +1,6 @@
 export { isFrontend } from './admission.js';
 export { defineFrontend } from './define.js';
 export type { Frontend, FrontendInput, FrontendRouteInputs, FrontendRoutes, ViewName, } from './frontend.js';
-export type { FrontendHandshake, FrontendRoute, FrontendRouteInput, IframeRequirements, ViewHostRequirements, } from './route.js';
+export type { FrontendHandshake, FrontendRoute, FrontendRouteInput, ViewHostRequirements, } from './route.js';
 export { external, isFrontendSource, vite } from './source.js';
 export type { ExternalSource, FrontendSource, ViteSource } from './source.js';

package/dist/application/view/route.d.ts

@@ -1,30 +1,16 @@
 import { type ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 export type { ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 export type FrontendHandshake = 'shell' | 'none';
-/**
- * @deprecated Every trusted View receives the Shell's shared browser profile: requirements within
- * it are redundant, and Astrale hosts refuse any beyond it. Declare none.
- */
-export interface IframeRequirements {
-    readonly sandbox?: readonly string[];
-    readonly allow?: readonly string[];
-}
 export type FrontendRouteInput = string | {
     readonly path?: string;
     readonly document?: string;
     readonly handshake?: FrontendHandshake;
-    /**
-     * @deprecated Every trusted View receives the Shell's shared browser profile: requirements
-     * within it are redundant, and Astrale hosts refuse any beyond it. Remove this field.
-     */
-    readonly iframe?: IframeRequirements;
     readonly host?: ViewHostRequirements;
 };
 export interface FrontendRoute {
     readonly path: string;
     readonly document: string;
     readonly handshake: FrontendHandshake;
-    readonly iframe?: IframeRequirements;
     readonly host?: ViewHostRequirements;
 }
 export declare function normalizeRoute(input: FrontendRouteInput | undefined, fallback: string): FrontendRoute;

package/dist/application/view/route.js

@@ -1,16 +1,10 @@
 import { acceptViewHostRequirements, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
-const TOKEN = /^[a-z][a-z0-9-]*$/u;
-const BASELINES = Object.freeze({
-    none: iframeRequirements(['allow-scripts'], []),
-    shell: iframeRequirements(['allow-same-origin', 'allow-scripts'], ['clipboard-write']),
-});
 export function normalizeRoute(input, fallback) {
     if (typeof input === 'string') {
         return Object.freeze({ path: routePath(input), document: 'index.html', handshake: 'shell' });
     }
     const value = plainRecord(input ?? {});
-    if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' ||
-        !['path', 'document', 'handshake', 'iframe', 'host'].includes(key))) {
+    if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' || !['path', 'document', 'handshake', 'host'].includes(key))) {
         invalid();
     }
     const authoredHandshake = dataValue(value, 'handshake');
@@ -20,59 +14,14 @@ export function normalizeRoute(input, fallback) {
         invalid();
     }
     const handshake = authoredHandshake ?? 'shell';
-    const iframe = normalizeIframeRequirements(dataValue(value, 'iframe'), handshake);
     const host = acceptViewHostRequirements(dataValue(value, 'host'), handshake, true);
     return Object.freeze({
         path: routePath(dataValue(value, 'path') ?? fallback),
         document: filePath(dataValue(value, 'document') ?? 'index.html'),
         handshake,
-        ...(iframe === undefined ? {} : { iframe }),
         ...(host === undefined ? {} : { host }),
     });
 }
-function normalizeIframeRequirements(input, handshake) {
-    if (input === undefined)
-        return undefined;
-    const value = plainRecord(input);
-    if (Reflect.ownKeys(value).some((key) => key !== 'sandbox' && key !== 'allow'))
-        invalid();
-    const authored = iframeRequirements(tokenArray(dataValue(value, 'sandbox')), tokenArray(dataValue(value, 'allow')));
-    assertSandboxRelationships(authored.sandbox);
-    const baseline = BASELINES[handshake];
-    const sandbox = authored.sandbox.filter((token) => !baseline.sandbox.includes(token));
-    const allow = authored.allow.filter((feature) => !baseline.allow.includes(feature));
-    return sandbox.length === 0 && allow.length === 0 ? undefined : iframeRequirements(sandbox, allow);
-}
-function iframeRequirements(sandbox, allow) {
-    return Object.freeze({
-        sandbox: Object.freeze([...new Set(sandbox)].sort()),
-        allow: Object.freeze([...new Set(allow)].sort()),
-    });
-}
-function tokenArray(input) {
-    if (input === undefined)
-        return [];
-    if (!Array.isArray(input))
-        invalid();
-    const descriptors = Object.getOwnPropertyDescriptors(input);
-    const result = [];
-    for (let index = 0; index < input.length; index += 1) {
-        const descriptor = descriptors[String(index)];
-        if (descriptor === undefined || !('value' in descriptor))
-            invalid();
-        if (typeof descriptor.value !== 'string' || !TOKEN.test(descriptor.value))
-            invalid();
-        result.push(descriptor.value);
-    }
-    for (const key of Reflect.ownKeys(descriptors)) {
-        if (key === 'length')
-            continue;
-        if (typeof key !== 'string' || !/^(0|[1-9][0-9]*)$/u.test(key) || Number(key) >= input.length) {
-            invalid();
-        }
-    }
-    return result;
-}
 function plainRecord(input) {
     if (typeof input !== 'object' || input === null || Array.isArray(input))
         invalid();
@@ -89,18 +38,6 @@ function dataValue(input, key) {
         invalid();
     return descriptor.value;
 }
-function assertSandboxRelationships(sandbox) {
-    const tokens = new Set(sandbox);
-    if (tokens.has('allow-popups-to-escape-sandbox') && !tokens.has('allow-popups'))
-        invalid();
-    if (tokens.has('allow-top-navigation') && tokens.has('allow-top-navigation-by-user-activation')) {
-        invalid();
-    }
-    if (tokens.has('allow-top-navigation-to-custom-protocols') &&
-        (tokens.has('allow-top-navigation') || tokens.has('allow-popups'))) {
-        invalid();
-    }
-}
 export function defaultRoute(name) {
     return routePath(`/${name
         .replace(/([a-z0-9])([A-Z])/gu, '$1-$2')

package/dist/application/workflow/authoring.d.ts

@@ -1,4 +1,5 @@
 export { defineWorkflow } from './define.js';
-export type { WorkflowContext } from './context.js';
-export type { Workflow, WorkflowAddress, WorkflowDefinition } from './workflow.js';
+export type { InlineWorkflowContext, WorkflowContext } from './context.js';
+export type { DurableCallable, DurableExecution, DurableParallelOutputs, DurableParallelStep, DurableParallelSteps, DurableStep, DurableStepAuthority, DurableStepDeclaration, DurableStepId, DurableStepRetry, DurableWorkflowContext, SignalOutcome, } from './durable.js';
+export type { Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/workflow/context.d.ts

@@ -2,8 +2,14 @@ import type { Domain } from '../../platform/schema/index.js';
 import type { ActionContext, ResolvedCallable } from '../action/index.js';
 import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
+import type { DurableCallable, DurableWorkflowContext } from './durable.js';
 import type { WorkflowStep } from './step/index.js';
-/** Exact multi-step Workflow context for one authenticated value-output callable. */
-export type WorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = ActionContext<Callable, DomainValue, Definitions, Errors> & {
+/** Multi-step context of one value-output callable run inside its invocation. */
+export type InlineWorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = ActionContext<Callable, DomainValue, Definitions, Errors> & {
     readonly step: WorkflowStep;
 };
+/**
+ * Exact Workflow context for one callable: engine-journaled when its Schema declares
+ * `execution: { durable: true }`, otherwise run inside its invocation.
+ */
+export type WorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = Callable extends DurableCallable ? DurableWorkflowContext<Callable, DomainValue, Definitions, Errors> : InlineWorkflowContext<Callable, DomainValue, Definitions, Errors>;

package/dist/application/workflow/define.d.ts

@@ -1,11 +1,11 @@
 import type { schema } from '../../platform/schema/index.js';
 import type { ResolvedDomainOf } from '../action/index.js';
-import type { DeclaredErrorOptions, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
+import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
-import type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowDefinition } from './workflow.js';
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+import type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export declare function defineWorkflow<Schema extends schema.DomainSchema, Definitions extends Integrations = Readonly<Record<never, never>>>(): {
     <const Address extends WorkflowAddress<Schema>>(address: Address, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): WorkflowDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
-    <const Address extends WorkflowAddress<Schema>, const Errors extends DeclaredErrors>(address: Address, options: DeclaredErrorOptions<Errors>, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, Errors>): WorkflowDefinition<Schema, Address, Definitions, Errors>;
+    <const Address extends WorkflowAddress<Schema>, const Errors extends DeclaredErrors = NoDeclaredErrors>(address: Address, options: WorkflowOptions<Errors>, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, Errors>): WorkflowDefinition<Schema, Address, Definitions, Errors>;
 };
 export declare function isWorkflow(input: unknown): input is WorkflowDefinition;

package/dist/application/workflow/define.js

@@ -1,25 +1,30 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { rememberDeclaredErrors } from '../error/index.js';
 const admittedWorkflows = new WeakSet();
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export function defineWorkflow() {
     return function define(address, optionsOrRun, possibleRun) {
         acceptWorkflowAddress(address);
-        const options = possibleRun === undefined ? undefined : optionsOrRun;
+        const options = possibleRun === undefined ? undefined : acceptOptions(optionsOrRun);
         const run = possibleRun ?? optionsOrRun;
         if (typeof run !== 'function')
             throw new TypeError('Workflow run must be a function.');
-        const workflow = Object.freeze({
-            kind: 'workflow',
-            address,
-            run,
-        });
-        if (options !== undefined)
-            rememberDeclaredErrors(workflow, options);
+        const workflow = Object.freeze({ kind: 'workflow', address, run });
+        if (options?.errors !== undefined)
+            rememberDeclaredErrors(workflow, { errors: options.errors });
         admittedWorkflows.add(workflow);
         return workflow;
     };
 }
+function acceptOptions(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => key !== 'errors')) {
+        throw new TypeError('Workflow options accept only errors.');
+    }
+    return input;
+}
 export function isWorkflow(input) {
     return input !== null && typeof input === 'object' && admittedWorkflows.has(input);
 }

package/dist/application/workflow/durable.d.ts

@@ -0,0 +1,197 @@
+import type { IssuerId } from '../../platform/auth/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
+import type { CallableInputOf, Domain, ResolvedMethod } from '../../platform/schema/index.js';
+import type { Value } from '../../platform/value/index.js';
+import type { DomainCapabilities, DomainKernelSessions } from '../action/index.js';
+import type { HandlerDependencies } from '../dependency/index.js';
+import type { DeclaredErrorFactory, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
+import type { Integrations, ReplayableIntegrationClients } from '../integration/index.js';
+import type { Mutation, MutationExecutor } from '../mutation/index.js';
+import type { QueryDefinition } from '../query/index.js';
+/** A callable whose Schema declares `execution: { durable: true }`. */
+export interface DurableCallable {
+    readonly execution: {
+        readonly durable: true;
+    };
+}
+/** Attested facts of the running Execution. They are data, never authority. */
+export interface DurableExecution {
+    /** The `K.Execution` node recording this call. */
+    readonly id: NodeId;
+    readonly function: {
+        readonly id: NodeId;
+        readonly version: `sha256:${string}`;
+    };
+    /** Kernel that recorded the Execution; every Step calls it back as the Domain. */
+    readonly kernel: IssuerId;
+    /** Who started the Execution. The Workflow never receives their credential. */
+    readonly initiator: {
+        readonly principal: NodeId;
+        readonly caller: NodeId;
+    };
+    /** Receiver of a durable instance Method. */
+    readonly receiver?: NodeId;
+}
+/**
+ * What one Step holds: the capabilities of an Action, acting as the Domain alone. Kernel access
+ * exists only here, so every Kernel call belongs to a journaled Step and a replay never repeats it.
+ * Every key below comes from one sequence derived from the Execution, the Step and the position of
+ * the call, which restarts with each attempt: a retried Step sends the same keys again.
+ */
+export interface DurableStepAuthority<DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>> extends DomainCapabilities<DomainValue, 'self'> {
+    /**
+     * Kernel Session acting as the Domain. Each `invoke` of a durable callable without an explicit
+     * `idempotencyKey` carries the next derived key, so a retried Step reaches the same durable child
+     * Execution. An `invoke` of any other callable carries no key, which the Kernel would refuse, and
+     * runs again when the Step is retried.
+     */
+    readonly kernel: DomainKernelSessions<'self'>;
+    /** Dependency invokers acting as the Domain, keyed like `kernel.invoke`. */
+    readonly dependencies: HandlerDependencies<DomainValue, 'self'>;
+    /**
+     * Each Mutation carries the next derived key. The Kernel commits a receipt with the write and
+     * answers a retried Step with its first result.
+     */
+    readonly mutate: MutationExecutor<DomainValue>;
+    /**
+     * Operations a retried Step may attempt again. A keyed operation of source `execution` receives
+     * the next derived key as its idempotency key. An operation whose decision may be `unsafe` is
+     * absent, and refused before its Provider runs if its decision is `unsafe` anyway.
+     */
+    readonly integrations: ReplayableIntegrationClients<Definitions>;
+}
+/**
+ * How long a failing Step is retried. Its limits, `maxAttempts` and `maxDurationMs`, go together: a
+ * Step that declares either replaces both limits of the deployment, and the one it omits does not
+ * bound it. The budget is spent at the first limit reached.
+ *
+ * Only a failure of the Step's own spends an attempt. A Kernel that refuses with a prescribed delay
+ * (capacity, draining, maintenance), or that does not answer a Query or a keyed call, is waited out
+ * without spending one; a request the Kernel can never accept fails the Step at once.
+ */
+export interface DurableStepRetry {
+    /**
+     * Attempts that may fail on the Step's own account, the first one included: 1 to 1,000. A wait for
+     * the platform spends none.
+     */
+    readonly maxAttempts?: number;
+    /**
+     * Time from the first attempt after which a failed attempt is not retried, whatever it failed on,
+     * 1 ms to 365 days; an attempt already scheduled, such as after a long prescribed delay, still
+     * runs. The only bound on waiting for the platform.
+     */
+    readonly maxDurationMs?: number;
+    /** Delay before the first retry, doubled on each failure: 1 ms to one hour. */
+    readonly initialIntervalMs?: number;
+    /**
+     * Longest backoff between two attempts: `initialIntervalMs` to one day. A longer delay the Kernel
+     * prescribes is still waited.
+     */
+    readonly maxIntervalMs?: number;
+}
+/** A Step: its id, and the retry budget and timeout it declares instead of the deployment's. */
+export interface DurableStepDeclaration {
+    readonly id: string;
+    readonly retry?: DurableStepRetry;
+    /** Deadline of one attempt, including its Kernel calls: one second to ten minutes. */
+    readonly timeoutMs?: number;
+}
+/**
+ * A Step's id alone, under the deployment's retry budget and Step timeout, or a declaration of its
+ * own. A Step that spends its budget, or that the Kernel refuses for good, throws an error
+ * `exhausted` recognizes; uncaught, the Execution ends `failed` with code `STEP_EXHAUSTED`.
+ */
+export type DurableStepId = string | DurableStepDeclaration;
+export interface DurableStep<DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>> {
+    /**
+     * Run `execute` once and journal its portable output; a replay returns the journaled output. A
+     * Step may run again when its outcome was not journaled: its Mutations, durable calls and keyed
+     * Integration operations are answered from their keys, and any other effect must be idempotent.
+     */
+    run<Output>(step: DurableStepId, execute: (authority: DurableStepAuthority<DomainValue, Definitions>) => Output | Promise<Output>): Promise<Output>;
+    /**
+     * One journaled Query. A replay returns the result of its first run, so a later Step that depends
+     * on it resends the same request whenever it is retried.
+     */
+    query<Output>(step: DurableStepId, query: QueryDefinition<DomainValue, void, Output>): Promise<Output>;
+    query<Input, Output>(step: DurableStepId, query: QueryDefinition<DomainValue, Input, Output>, input: Input): Promise<Output>;
+    /**
+     * One journaled Mutation. A Step replayed after its commit receives the result of that commit
+     * from the Kernel's receipt instead of writing again.
+     */
+    mutate<Input, Output>(step: DurableStepId, mutation: Mutation<DomainValue, Input, Output>, input: Input): Promise<Output>;
+    /**
+     * Run the Steps `declare` declares together, in one round trip to the engine, the one way to await
+     * several Steps at once. Each keeps its id, retry budget, timeout and keys. Once every Step has
+     * settled, resolves with their outputs in declaration order, or throws the failure of the first
+     * failed Step in that order, as that Step alone would throw it; the other Steps' effects stand.
+     * An empty list resolves with `[]`.
+     */
+    parallel<const Steps extends readonly [] | readonly DurableParallelStep<unknown>[]>(declare: (steps: DurableParallelSteps<DomainValue, Definitions>) => Steps): Promise<DurableParallelOutputs<Steps>>;
+}
+declare const PARALLEL_STEP: unique symbol;
+/** A Step `step.parallel` starts with its siblings. It runs nothing on its own and is never awaited. */
+export interface DurableParallelStep<out Output> {
+    readonly [PARALLEL_STEP]: Output;
+}
+/** The Steps one `step.parallel` declares, with the arguments of `step.run`, `query` and `mutate`. */
+export interface DurableParallelSteps<DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>> {
+    run<Output>(step: DurableStepId, execute: (authority: DurableStepAuthority<DomainValue, Definitions>) => Output | Promise<Output>): DurableParallelStep<Output>;
+    query<Output>(step: DurableStepId, query: QueryDefinition<DomainValue, void, Output>): DurableParallelStep<Output>;
+    query<Input, Output>(step: DurableStepId, query: QueryDefinition<DomainValue, Input, Output>, input: Input): DurableParallelStep<Output>;
+    mutate<Input, Output>(step: DurableStepId, mutation: Mutation<DomainValue, Input, Output>, input: Input): DurableParallelStep<Output>;
+}
+/** The outputs of parallel Steps, in their declaration order. */
+export type DurableParallelOutputs<Steps extends readonly DurableParallelStep<unknown>[]> = {
+    -readonly [Index in keyof Steps]: Steps[Index] extends DurableParallelStep<infer Output> ? Output : never;
+};
+type DurableSelfOf<Callable> = Callable extends ResolvedMethod<unknown, unknown, false> ? {
+    readonly self: NodeId;
+} : {
+    readonly self?: never;
+};
+/** What a bounded wait for a signal ended with: the signal's value, or its timeout. */
+export type SignalOutcome<Signal extends Value = Value> = {
+    readonly kind: 'signal';
+    readonly value: Signal;
+} | {
+    readonly kind: 'timeout';
+};
+/** Context of a durable Workflow: engine-journaled, acting as its Domain. */
+export type DurableWorkflowContext<Callable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = {
+    readonly domain: DomainValue;
+    readonly input: CallableInputOf<Callable>;
+    readonly execution: DurableExecution;
+    /** Construct one implementation-declared safe business error for `throw error(...)`. */
+    readonly error: DeclaredErrorFactory<Errors>;
+    readonly step: DurableStep<DomainValue, Definitions>;
+    /** Durable timer kept by the engine, even while the Domain is idle or down. */
+    sleep(durationMs: number): Promise<void>;
+    /**
+     * Wait for the value `Execution.signal({ name, value })` delivers once under `name`, whether it
+     * was sent before or during the wait.
+     */
+    awaitSignal<Signal extends Value = Value>(name: string): Promise<Signal>;
+    /**
+     * Wait at most `timeoutMs` for the signal `name`. The engine journals which came first, so a
+     * replay answers the same. A signal sent after the timeout is kept for a later wait.
+     */
+    awaitSignal<Signal extends Value = Value>(name: string, options: {
+        readonly timeoutMs: number;
+    }): Promise<SignalOutcome<Signal>>;
+    /** Whether `error` is the engine's cooperative cancellation, which the Workflow may compensate. */
+    cancelled(error: unknown): boolean;
+    /**
+     * Whether `error` is a Step that spent its retry budget, or that the Kernel refused for good,
+     * which the Workflow may handle.
+     */
+    exhausted(error: unknown): boolean;
+    /**
+     * The failure of a Step attempt, to throw inside the Step, that the engine attempts again after
+     * exactly `delayMs` (at most one hour), as an HTTP `Retry-After` asks. The attempt spends the
+     * Step's budget, since only the Step knows whether its cause clears. A Kernel refusal that
+     * prescribes a delay is waited out already, without spending it.
+     */
+    retryAfter(delayMs: number, cause?: unknown): Error;
+} & DurableSelfOf<Callable>;
+export {};

package/dist/application/workflow/index.d.ts

@@ -1,6 +1,7 @@
 export { defineWorkflow, isWorkflow } from './define.js';
-export type { WorkflowContext } from './context.js';
-export type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowCallable, WorkflowDefinition, } from './workflow.js';
+export type { InlineWorkflowContext, WorkflowContext } from './context.js';
+export type { DurableCallable, DurableExecution, DurableParallelOutputs, DurableParallelStep, DurableParallelSteps, DurableStep, DurableStepAuthority, DurableStepDeclaration, DurableStepId, DurableStepRetry, DurableWorkflowContext, SignalOutcome, } from './durable.js';
+export type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowCallable, WorkflowDefinition, WorkflowOptions, } from './workflow.js';
 export * as step from './step/index.js';
 export * as runner from './runner/index.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/workflow/runner/inline.js

@@ -1,11 +1,12 @@
-import * as value from '../../../platform/value/index.js';
 import { acceptStepId } from '../step/index.js';
+import { acceptStepOutput } from '../step/output.js';
 /** Process-local runner for tests and explicitly non-durable embeddings. */
 export function createInlineWorkflowRunner() {
     async function run(workflow, context) {
         const execution = createInlineStep(context.execution.signal);
         const complete = Object.freeze({ ...context, step: execution.step });
         try {
+            // Runtime dispatches only non-durable Workflows inline; durable ones run on the engine.
             return await workflow.run(complete);
         }
         finally {
@@ -37,10 +38,8 @@ function createInlineStep(signal) {
             started.add(accepted);
             execution = (async () => {
                 const output = await execute();
-                if (output === undefined)
-                    return output;
                 try {
-                    return value.accept(output);
+                    return acceptStepOutput(output);
                 }
                 catch (cause) {
                     throw new TypeError(`Workflow Step ${accepted} output must be portable.`, {

package/dist/application/workflow/runner/runner.d.ts

@@ -2,9 +2,9 @@ import type { Domain, schema } from '../../../platform/schema/index.js';
 import type { ActionOutputOf, ResolvedCallable, ResolvedDomainOf } from '../../action/index.js';
 import type { DeclaredErrors, NoDeclaredErrors } from '../../error/index.js';
 import type { Integrations } from '../../integration/index.js';
-import type { WorkflowContext } from '../context.js';
+import type { InlineWorkflowContext } from '../context.js';
 import type { CallableAtWorkflowAddress, WorkflowAddress, WorkflowDefinition } from '../workflow.js';
-export type WorkflowExecutionContext<Callable extends ResolvedCallable, Definitions extends Integrations, DomainValue extends Domain = Domain, Errors extends DeclaredErrors = NoDeclaredErrors> = Omit<WorkflowContext<Callable, DomainValue, Definitions, Errors>, 'step'>;
+export type WorkflowExecutionContext<Callable extends ResolvedCallable, Definitions extends Integrations, DomainValue extends Domain = Domain, Errors extends DeclaredErrors = NoDeclaredErrors> = Omit<InlineWorkflowContext<Callable, DomainValue, Definitions, Errors>, 'step'>;
 export interface WorkflowRunner {
     run<Schema extends schema.DomainSchema, Address extends WorkflowAddress<Schema>, Definitions extends Integrations, Errors extends DeclaredErrors, Callable extends CallableAtWorkflowAddress<Schema, Address> = CallableAtWorkflowAddress<Schema, Address>>(workflow: WorkflowDefinition<Schema, Address, Definitions, Errors>, context: WorkflowExecutionContext<Callable, Definitions, ResolvedDomainOf<Schema>, Errors>): Promise<ActionOutputOf<Callable>>;
 }

package/dist/application/workflow/step/output.d.ts

@@ -0,0 +1,2 @@
+/** Capture optional Object fields as absence without changing portable Array or scalar semantics. */
+export declare function acceptStepOutput<Output>(input: Output): Output;