@prestack/thread 0.1.2 → 0.1.4

package/dist/operations/access.ts

@@ -36,6 +36,49 @@ export function undeclared(answered: string, offers: readonly string[], which: '
   )
 }
 
+export interface Declaring {
+  readonly id: string
+  readonly holds: readonly { readonly id: string; readonly options?: readonly string[] }[]
+  readonly rows?: readonly Record<string, unknown>[]
+  readonly must?: readonly { readonly unique?: readonly string[] }[]
+  readonly actor?: { readonly roles: string; readonly entitlements?: string }
+}
+
+export interface Caller {
+  readonly id: string
+  readonly entity: string
+  readonly roles: readonly string[]
+  readonly entitlements: readonly string[]
+}
+
+export const keyIn = (one: Declaring): string | undefined =>
+  (one.must ?? []).flatMap((each) => (each.unique?.length === 1 ? [each.unique[0] as string] : []))[0]
+
+const wordsFrom = (held: unknown): readonly string[] => {
+  if (typeof held === 'string') return [held]
+  if (Array.isArray(held)) return held.filter((each): each is string => typeof each === 'string')
+  return []
+}
+
+export const declaredCallers = (entities: readonly Declaring[]): readonly Caller[] =>
+  entities.flatMap((one) => {
+    const said = one.actor
+    const key = keyIn(one)
+    if (said === undefined || key === undefined) return []
+    return (one.rows ?? []).flatMap((row): readonly Caller[] => {
+      const named = row[key]
+      if (typeof named !== 'string') return []
+      return [
+        {
+          id: named,
+          entity: one.id,
+          roles: wordsFrom(row[said.roles]),
+          entitlements: said.entitlements === undefined ? [] : wordsFrom(row[said.entitlements]),
+        },
+      ]
+    })
+  })
+
 export interface Grant extends Member {
 
   readonly may: readonly string[]

package/dist/operations/attach.js

@@ -1,12 +1,11 @@
-import { named } from "../core/scope.js";
-import { LISTS } from "../core/descend.js";
-import { quoted } from "../core/rows.js";
-import { PERMITS_AT } from "./access.js";
-import { CAPABILITIES_AT, CLIENT_AT, DECLARED_SEAMS_AT, DISPATCHING_AT, MCP_AT, OPENAPI_AT, SEAMS_AT } from "./capabilities.js";
-import { DISPATCH_AT } from "./dispatch.js";
-import { TRIALS_AT } from "./operations.js";
-import { MEMBERS_LIST, NODES_FILE, OPERATIONS_FILE } from "./operations.js";
-import { SUPPLIES } from "./seams.js";
+import { named } from '../core/scope.js';
+import { LISTS } from '../core/descend.js';
+import { quoted } from '../core/rows.js';
+import { PERMITS_AT } from './access.js';
+import { CAPABILITIES_AT, CLIENT_AT, DEFAULTS_AT, DISPATCHING_AT, MCP_AT, OPENAPI_AT } from './capabilities.js';
+import { DISPATCH_AT } from './dispatch.js';
+import { TRIALS_AT } from './operations.js';
+import { MEMBERS_LIST, NODES_FILE, OPERATIONS_FILE } from './operations.js';
 const HOME = `node_modules/${named('operations')}/dist`;
 const VERSION = 1;
 const ROOT = 'operations';
@@ -16,31 +15,13 @@ const DESCRIBES = 'Everything this app can be asked to do. Each operation is a n
 export const TAKES = 'What one operation needs before it will run: the shape of its input, what it is expected to cost, and who is allowed to ask for it. Written once when the operation is created, then yours to change.';
 export const WOVEN = 'The operation written out as one function. `thread compile` builds it from the steps declared for it, so nothing here is edited by hand — anything added here is gone the next time it is compiled.';
 const NODES = 'Every kind of step an operation can be built from — a read, a branch, a loop. A step holds no code of its own: the work goes in a file written beside the operation that uses it.';
-const HANDS = 'What each kind of step hands the code inside it to work with. These live in the package rather than in this app, so a step of the same kind means the same thing in every tree.';
 const DISPATCH = 'Every operation runs through here and nowhere else. `thread compile` writes it for this app: before a run starts it checks who is asking, what the run may cost and whether the input is valid, then runs the operation and records what happened.';
 const PROGRAM = 'Every row this package adds to an app, listed in one place so what it put there can be read rather than guessed at. `thread attach` writes back anything missing or edited.';
 const TRIALS = 'What each operation actually did when it was run, recorded rather than written by hand. `thread trials` runs them against their example inputs and keeps the results; `thread trials --check` runs them again and refuses anything that has changed since.';
-const CAPABILITIES = 'Which of this app\'s operations can be reached from outside, and how — as an MCP tool, a terminal command, or a web route. Everything here is worked out from the operations themselves except whether a surface is switched on, which is yours to set.';
+const CAPABILITIES = 'Which of this app\'s operations can be reached from outside, and how — as an MCP tool, a terminal command, or a web route. Everything here is worked out, and nothing here is yours to set: which surfaces are on comes from _threads/defaults.ts and from `off` on each operation row, and `thread create capability` changes either.';
 const OPENAPI = 'This app\'s web API written as an OpenAPI document: the route, the verb and the input shape of every operation that answers on the web. Generated rather than written, so it cannot describe a route that is not there.';
 const TOOLS = 'The tools an MCP client is offered: every operation switched on for that surface, with its own sentence and the shape of its input. Switching `mcp` off for an operation is how an agent is told it may not call it.';
 const CLIENT = 'Every operation a page in this app may call. An operation that is switched off is absent from this file rather than listed and disabled, as is any operation needing a credential a browser must not hold.';
-const SAID = {
-    sm_store: 'Reading and writing rows. An operation that requires it is handed get, list, insert, update and remove already bound to whoever asked, so every row it touches is written under the caller the log names.',
-    sm_search: 'Indexing a row and querying an index. Required by an operation that has to find something it cannot address by id.',
-    sm_queue: 'Handing work to something else to run later. Required by an operation that finishes before its effect does.',
-    sm_events: 'Announcing that something happened, to whoever is listening. Required by an operation other parts of an app react to.',
-    sm_clock: 'The current time. Required rather than read off the runtime, because an operation that reads the wall clock directly cannot be replayed and its trial cannot be trusted.',
-    sm_random: 'Randomness. Required for the same reason as the clock: a run nobody can reproduce is a run nobody can check.',
-    sm_vault: 'Resolving a secret by name, for the rare thing that is not a call — signing a webhook, checking a shared token. An operation that reaches a target does not need this: requiring the target hands its nodes calls with the credential already in them, which is the whole point of declaring one.',
-    sm_views: 'Reading through a declared view rather than a table. Required by an operation that reads what somebody else composed.',
-    sm_files: 'Putting a file somewhere, fetching one back, or handing out a signed link to one. Required rather than reached for, because a node that opens a path directly is doing work no record names.',
-};
-const OFFERED = SUPPLIES.map((id) => ({
-    id,
-    at: NODES_AT,
-    describes: SAID[id],
-    version: VERSION,
-}));
 const valued = (one) => {
     if (typeof one === 'string')
         return quoted(one);
@@ -69,12 +50,20 @@ export const said = (one, pad) => {
 };
 const ACCESS = 'Who may ask this app to do what. A row says which operations it permits, on what, to whom, and under what condition. Nothing is permitted by default: an operation no row grants here cannot be run at all.';
 const PERMITS = 'The check compiled from the grants in _threads/access.ts: one branch per grant, so who may ask for what comes from one statement. Nobody edits it, because an edit here widens or narrows access nobody granted. An app that grants nothing permits nothing.';
-const SEAMS = 'What this app hands its operations, written once and then yours. It starts by handing on everything src/_generated/seams.ts settles from your declarations. Replace a seam or add one by naming it in SEAMS: the queue, the events, telemetry, whatever a real deployment needs.';
-const DECLARED_SEAMS = 'The seams your declarations settle. Rows go to the store each target derived, and until one does no store is handed, so an operation that needs one is refused; who is calling is read off the entity that names the caller; calls leave through http with credentials the vault opens. Nobody edits it: `thread capabilities` writes it again from the rows.';
 const ACCESS_SOURCE = `import type { Grant } from './access.ts'
 
 export const GRANTS: readonly Grant[] = []
 `;
+const DEFAULTS = 'Which surfaces every operation in this app answers on, stated once for all of them. An operation turns one off with `off` on its own row and can never turn on one this row leaves off. With no `live` stated, every operation answers on cli alone, so nothing is reachable from outside the machine until this row says so. `thread create capability edit defaults` changes it.';
+const DEFAULTS_SOURCE = `import type { Defaults } from './capabilities.ts'
+
+export const DEFAULTS: Defaults = {
+  id: 'defaults',
+  at: ${quoted(DEFAULTS_AT)},
+  describes: ${quoted(DEFAULTS)},
+  version: ${String(VERSION)},
+}
+`;
 const shipped = () => ({
     id: 'shipped',
     at: `${HOME}/attach.js`,
@@ -99,6 +88,12 @@ const shipped = () => ({
             describes: ACCESS,
             version: VERSION,
         },
+        {
+            id: 'defaults',
+            at: DEFAULTS_AT,
+            describes: DEFAULTS,
+            version: VERSION,
+        },
         {
             id: 'permits',
             at: PERMITS_AT,
@@ -115,12 +110,6 @@ const shipped = () => ({
             by: 'thread compile',
             runs: 'thread compile --check',
         },
-        {
-            id: 'hands',
-            at: `${HOME}/nodes.js`,
-            describes: HANDS,
-            version: VERSION,
-        },
         {
             id: 'trials',
             at: TRIALS_AT,
@@ -169,21 +158,6 @@ const shipped = () => ({
             by: 'thread capabilities',
             runs: 'thread capabilities --check',
         },
-        {
-            id: 'seams',
-            at: SEAMS_AT,
-            describes: SEAMS,
-            version: VERSION,
-            by: 'thread capabilities',
-        },
-        {
-            id: 'declared-seams',
-            at: DECLARED_SEAMS_AT,
-            describes: DECLARED_SEAMS,
-            version: VERSION,
-            by: 'thread capabilities',
-            runs: 'thread capabilities --check',
-        },
         {
             id: 'nd_read',
             at: NODES_AT,
@@ -226,7 +200,6 @@ const shipped = () => ({
             describes: 'A step that ends the operation early with an answer. Whatever its block returns becomes the result, and nothing after it runs.',
             version: VERSION,
         },
-        ...OFFERED,
     ],
 });
 const SHIPS = shipped();
@@ -234,16 +207,15 @@ const WHERE = {
     nodes: { into: OPERATIONS_FILE, list: 'declares' },
     dispatch: { into: OPERATIONS_FILE, list: 'declares' },
     access: { into: OPERATIONS_FILE, list: 'declares' },
+    defaults: { into: OPERATIONS_FILE, list: 'declares' },
     permits: { into: OPERATIONS_FILE, list: 'declares' },
-    'declared-seams': { into: OPERATIONS_FILE, list: 'declares' },
     trials: { into: OPERATIONS_FILE, list: 'declares' },
     capabilities: { into: OPERATIONS_FILE, list: 'declares' },
     openapi: { into: OPERATIONS_FILE, list: 'declares' },
     tools: { into: OPERATIONS_FILE, list: 'declares' },
     client: { into: OPERATIONS_FILE, list: 'declares' },
     dispatching: { into: OPERATIONS_FILE, list: 'declares' },
-    seams: { into: OPERATIONS_FILE, list: 'declares' },
-    hands: { into: NODES_FILE, list: 'declares' },
+    reaching: { into: OPERATIONS_FILE, list: 'declares' },
 };
 const placed = (id) => WHERE[id] ?? { into: NODES_FILE, list: MEMBERS_LIST };
 const NODES_SOURCE = `import type { Threaded } from '../core/thread.ts'
@@ -323,60 +295,7 @@ export const ATTACH = {
         { file: OPERATIONS_FILE, source: OPERATIONS_SOURCE },
         { file: NODES_FILE, source: NODES_SOURCE },
         { file: 'access.ts', source: ACCESS_SOURCE },
-    ],
-    retires: [
-        {
-            into: 'operations.ts',
-            list: 'declares',
-            id: 'reference',
-            made: `${ROOT}/_docs.md`,
-            why: `the page stating what this app declares is written by \`${named('knowledge')}\` now, at docs.md, and it states every node rather than operations alone — a package documenting what another package declares would be one package authoring another's`,
-        },
-        {
-            into: 'derivation.ts',
-            list: 'GENERATORS',
-            id: 'create-generator',
-            why: '`thread create` is a command of the CLI itself now, so no row declares it. This package still makes operations, through the `operation-noun` row beside this one',
-        },
-        {
-            into: 'operations.ts',
-            list: 'declares',
-            id: 'identity',
-            made: `src/identity.${'ts'}`,
-            why: 'who is calling is answered in `src/seams.ts` now, beside the store it reads the caller\'s row from. One derived file says both, because both are read off the same rows',
-        },
-        {
-            into: 'operations.ts',
-            list: 'declares',
-            id: 'store',
-            made: `src/store.${'ts'}`,
-            why: 'where rows go is decided in `src/seams.ts` now, read off the targets this app declares. A second file that only re-exported one name said nothing the seams did not',
-        },
-        {
-            into: 'operations.ts',
-            list: 'declares',
-            id: 'rules-gate',
-            made: `src/rules.${'ts'}`,
-            why: '`rules` is what this app refuses, declared in _threads/rules.ts with `thread create rule`. Who may ask for what is `permits`, compiled from the grants and handed to dispatch by src/_generated/seams.ts, so a second file wearing the word said nothing the grants did not',
-        },
-        {
-            into: 'derivation.ts',
-            list: 'GENERATORS',
-            id: 'rules-generator',
-            why: 'the check compiled from the grants is `permits`, and `thread permits` writes it now, through the `permits-generator` row beside this one. A generator called `rules` read as the app\'s own rules, which are declared in _threads/rules.ts with `thread create rule`',
-        },
-        {
-            into: NODES_FILE,
-            list: MEMBERS_LIST,
-            id: 'sm_http',
-            why: 'a call goes to a place, and a place is a target — declare it with `thread create target` and require that instead. Asking for a bare transport is what made an operation impossible to try, because nothing said where it went',
-        },
-        {
-            into: NODES_FILE,
-            list: MEMBERS_LIST,
-            id: 'sm_llm',
-            why: 'a model is reached over https like any other vendor, so it is an `ht_` target with its calls declared beside it. Nothing was lost: its address and its key are now under the same rules as every other credential, and an operation that asks a model can now be tried',
-        },
+        { file: 'defaults.ts', source: DEFAULTS_SOURCE },
     ],
     rows: [
         ...(SHIPS.declares ?? [])

package/dist/operations/attach.ts

@@ -6,11 +6,10 @@ import { quoted } from '../core/rows.ts'
 import type { Threaded } from '../core/thread.ts'
 
 import { PERMITS_AT } from './access.ts'
-import { CAPABILITIES_AT, CLIENT_AT, DECLARED_SEAMS_AT, DISPATCHING_AT, MCP_AT, OPENAPI_AT, SEAMS_AT } from './capabilities.ts'
+import { CAPABILITIES_AT, CLIENT_AT, DEFAULTS_AT, DISPATCHING_AT, MCP_AT, OPENAPI_AT } from './capabilities.ts'
 import { DISPATCH_AT } from './dispatch.ts'
 import { TRIALS_AT } from './operations.ts'
 import { MEMBERS_LIST, NODES_FILE, OPERATIONS_FILE } from './operations.ts'
-import { SUPPLIES, type Supplied } from './seams.ts'
 
 const HOME = `node_modules/${named('operations')}/dist`
 
@@ -34,9 +33,6 @@ export const WOVEN =
 const NODES =
   'Every kind of step an operation can be built from — a read, a branch, a loop. A step holds no code of its own: the work goes in a file written beside the operation that uses it.'
 
-const HANDS =
-  'What each kind of step hands the code inside it to work with. These live in the package rather than in this app, so a step of the same kind means the same thing in every tree.'
-
 const DISPATCH =
   'Every operation runs through here and nowhere else. `thread compile` writes it for this app: before a run starts it checks who is asking, what the run may cost and whether the input is valid, then runs the operation and records what happened.'
 
@@ -47,7 +43,7 @@ const TRIALS =
   'What each operation actually did when it was run, recorded rather than written by hand. `thread trials` runs them against their example inputs and keeps the results; `thread trials --check` runs them again and refuses anything that has changed since.'
 
 const CAPABILITIES =
-  'Which of this app\'s operations can be reached from outside, and how — as an MCP tool, a terminal command, or a web route. Everything here is worked out from the operations themselves except whether a surface is switched on, which is yours to set.'
+  'Which of this app\'s operations can be reached from outside, and how — as an MCP tool, a terminal command, or a web route. Everything here is worked out, and nothing here is yours to set: which surfaces are on comes from _threads/defaults.ts and from `off` on each operation row, and `thread create capability` changes either.'
 
 const OPENAPI =
   'This app\'s web API written as an OpenAPI document: the route, the verb and the input shape of every operation that answers on the web. Generated rather than written, so it cannot describe a route that is not there.'
@@ -58,28 +54,28 @@ const TOOLS =
 const CLIENT =
   'Every operation a page in this app may call. An operation that is switched off is absent from this file rather than listed and disabled, as is any operation needing a credential a browser must not hold.'
 
-const SAID: Readonly<Record<Supplied, string>> = {
-  sm_store:
-    'Reading and writing rows. An operation that requires it is handed get, list, insert, update and remove already bound to whoever asked, so every row it touches is written under the caller the log names.',
-  sm_search: 'Indexing a row and querying an index. Required by an operation that has to find something it cannot address by id.',
-  sm_queue: 'Handing work to something else to run later. Required by an operation that finishes before its effect does.',
-  sm_events: 'Announcing that something happened, to whoever is listening. Required by an operation other parts of an app react to.',
-  sm_clock:
-    'The current time. Required rather than read off the runtime, because an operation that reads the wall clock directly cannot be replayed and its trial cannot be trusted.',
-  sm_random: 'Randomness. Required for the same reason as the clock: a run nobody can reproduce is a run nobody can check.',
-  sm_vault:
-    'Resolving a secret by name, for the rare thing that is not a call — signing a webhook, checking a shared token. An operation that reaches a target does not need this: requiring the target hands its nodes calls with the credential already in them, which is the whole point of declaring one.',
-  sm_views: 'Reading through a declared view rather than a table. Required by an operation that reads what somebody else composed.',
-  sm_files:
-    'Putting a file somewhere, fetching one back, or handing out a signed link to one. Required rather than reached for, because a node that opens a path directly is doing work no record names.',
-}
 
-const OFFERED: readonly Threaded[] = SUPPLIES.map((id) => ({
-  id,
-  at: NODES_AT,
-  describes: SAID[id],
-  version: VERSION,
-}))
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 const valued = (one: unknown): string => {
   if (typeof one === 'string') return quoted(one)
@@ -110,17 +106,24 @@ const ACCESS =
 const PERMITS =
   'The check compiled from the grants in _threads/access.ts: one branch per grant, so who may ask for what comes from one statement. Nobody edits it, because an edit here widens or narrows access nobody granted. An app that grants nothing permits nothing.'
 
-const SEAMS =
-  'What this app hands its operations, written once and then yours. It starts by handing on everything src/_generated/seams.ts settles from your declarations. Replace a seam or add one by naming it in SEAMS: the queue, the events, telemetry, whatever a real deployment needs.'
-
-const DECLARED_SEAMS =
-  'The seams your declarations settle. Rows go to the store each target derived, and until one does no store is handed, so an operation that needs one is refused; who is calling is read off the entity that names the caller; calls leave through http with credentials the vault opens. Nobody edits it: `thread capabilities` writes it again from the rows.'
-
 const ACCESS_SOURCE = `import type { Grant } from './access.ts'
 
 export const GRANTS: readonly Grant[] = []
 `
 
+const DEFAULTS =
+  'Which surfaces every operation in this app answers on, stated once for all of them. An operation turns one off with `off` on its own row and can never turn on one this row leaves off. With no `live` stated, every operation answers on cli alone, so nothing is reachable from outside the machine until this row says so. `thread create capability edit defaults` changes it.'
+
+const DEFAULTS_SOURCE = `import type { Defaults } from './capabilities.ts'
+
+export const DEFAULTS: Defaults = {
+  id: 'defaults',
+  at: ${quoted(DEFAULTS_AT)},
+  describes: ${quoted(DEFAULTS)},
+  version: ${String(VERSION)},
+}
+`
+
 const shipped = (): Threaded => ({
   id: 'shipped',
   at: `${HOME}/attach.js`,
@@ -145,6 +148,12 @@ const shipped = (): Threaded => ({
       describes: ACCESS,
       version: VERSION,
     },
+    {
+      id: 'defaults',
+      at: DEFAULTS_AT,
+      describes: DEFAULTS,
+      version: VERSION,
+    },
     {
       id: 'permits',
       at: PERMITS_AT,
@@ -161,12 +170,6 @@ const shipped = (): Threaded => ({
       by: 'thread compile',
       runs: 'thread compile --check',
     },
-    {
-      id: 'hands',
-      at: `${HOME}/nodes.js`,
-      describes: HANDS,
-      version: VERSION,
-    },
     {
       id: 'trials',
       at: TRIALS_AT,
@@ -217,21 +220,6 @@ const shipped = (): Threaded => ({
       by: 'thread capabilities',
       runs: 'thread capabilities --check',
     },
-    {
-      id: 'seams',
-      at: SEAMS_AT,
-      describes: SEAMS,
-      version: VERSION,
-      by: 'thread capabilities',
-    },
-    {
-      id: 'declared-seams',
-      at: DECLARED_SEAMS_AT,
-      describes: DECLARED_SEAMS,
-      version: VERSION,
-      by: 'thread capabilities',
-      runs: 'thread capabilities --check',
-    },
     {
       id: 'nd_read',
       at: NODES_AT,
@@ -274,7 +262,7 @@ const shipped = (): Threaded => ({
       describes: 'A step that ends the operation early with an answer. Whatever its block returns becomes the result, and nothing after it runs.',
       version: VERSION,
     },
-    ...OFFERED,
+
   ],
 })
 
@@ -285,16 +273,15 @@ const WHERE: Readonly<Record<string, { readonly into: string; readonly list: str
 
   dispatch: { into: OPERATIONS_FILE, list: 'declares' },
   access: { into: OPERATIONS_FILE, list: 'declares' },
+  defaults: { into: OPERATIONS_FILE, list: 'declares' },
   permits: { into: OPERATIONS_FILE, list: 'declares' },
-  'declared-seams': { into: OPERATIONS_FILE, list: 'declares' },
   trials: { into: OPERATIONS_FILE, list: 'declares' },
   capabilities: { into: OPERATIONS_FILE, list: 'declares' },
   openapi: { into: OPERATIONS_FILE, list: 'declares' },
   tools: { into: OPERATIONS_FILE, list: 'declares' },
   client: { into: OPERATIONS_FILE, list: 'declares' },
   dispatching: { into: OPERATIONS_FILE, list: 'declares' },
-  seams: { into: OPERATIONS_FILE, list: 'declares' },
-  hands: { into: NODES_FILE, list: 'declares' },
+  reaching: { into: OPERATIONS_FILE, list: 'declares' },
 }
 
 const placed = (id: string): { readonly into: string; readonly list: string } =>
@@ -381,63 +368,9 @@ export const ATTACH: Attaching = {
     { file: NODES_FILE, source: NODES_SOURCE },
 
     { file: 'access.ts', source: ACCESS_SOURCE },
+    { file: 'defaults.ts', source: DEFAULTS_SOURCE },
   ],
 
-  retires: [
-    {
-      into: 'operations.ts',
-      list: 'declares',
-      id: 'reference',
-      made: `${ROOT}/_docs.md`,
-      why: `the page stating what this app declares is written by \`${named('knowledge')}\` now, at docs.md, and it states every node rather than operations alone — a package documenting what another package declares would be one package authoring another's`,
-    },
-    {
-      into: 'derivation.ts',
-      list: 'GENERATORS',
-      id: 'create-generator',
-      why: '`thread create` is a command of the CLI itself now, so no row declares it. This package still makes operations, through the `operation-noun` row beside this one',
-    },
-    {
-      into: 'operations.ts',
-      list: 'declares',
-      id: 'identity',
-      made: `src/identity.${'ts'}`,
-      why: 'who is calling is answered in `src/seams.ts` now, beside the store it reads the caller\'s row from. One derived file says both, because both are read off the same rows',
-    },
-    {
-      into: 'operations.ts',
-      list: 'declares',
-      id: 'store',
-      made: `src/store.${'ts'}`,
-      why: 'where rows go is decided in `src/seams.ts` now, read off the targets this app declares. A second file that only re-exported one name said nothing the seams did not',
-    },
-    {
-      into: 'operations.ts',
-      list: 'declares',
-      id: 'rules-gate',
-      made: `src/rules.${'ts'}`,
-      why: '`rules` is what this app refuses, declared in _threads/rules.ts with `thread create rule`. Who may ask for what is `permits`, compiled from the grants and handed to dispatch by src/_generated/seams.ts, so a second file wearing the word said nothing the grants did not',
-    },
-    {
-      into: 'derivation.ts',
-      list: 'GENERATORS',
-      id: 'rules-generator',
-      why: 'the check compiled from the grants is `permits`, and `thread permits` writes it now, through the `permits-generator` row beside this one. A generator called `rules` read as the app\'s own rules, which are declared in _threads/rules.ts with `thread create rule`',
-    },
-
-    {
-      into: NODES_FILE,
-      list: MEMBERS_LIST,
-      id: 'sm_http',
-      why: 'a call goes to a place, and a place is a target — declare it with `thread create target` and require that instead. Asking for a bare transport is what made an operation impossible to try, because nothing said where it went',
-    },
-    {
-      into: NODES_FILE,
-      list: MEMBERS_LIST,
-      id: 'sm_llm',
-      why: 'a model is reached over https like any other vendor, so it is an `ht_` target with its calls declared beside it. Nothing was lost: its address and its key are now under the same rules as every other credential, and an operation that asks a model can now be tried',
-    },
-  ],
   rows: [
     ...(SHIPS.declares ?? [])
       .filter((one) => one.id !== ROOT)

package/dist/operations/capabilities.d.ts

@@ -1,13 +1,21 @@
-export declare const SURFACES: readonly ["cli", "api", "mcp"];
+import type { Threaded } from '../core/thread.ts';
+export declare const SURFACES: readonly ['cli', 'api', 'mcp', 'webhook'];
 export type Surface = (typeof SURFACES)[number];
 export declare const isSurface: (one: string) => one is Surface;
+export declare const MEANS: Readonly<Record<Surface, string>>;
+export declare const DEFAULTS_AT = "_threads/defaults.ts";
+export declare const UNSTATED: readonly Surface[];
+export interface Defaults extends Threaded {
+    readonly live?: readonly Surface[];
+}
 export declare const CAPABILITIES_AT = "operations/_capabilities.json";
 export declare const CLIENT_AT = "operations/_client.ts";
 export declare const DISPATCHING_AT = "app/_generated/dispatching.ts";
+export declare const REACHING_AT = "src/_generated/reaching.ts";
+export declare const ACTOR_AT = "src/_generated/actor.ts";
 export declare const routeAt: (operation: string) => string;
-export declare const ROUTE = "The file that answers a request for this one operation. It imports the operation by name, hands it to this app's own dispatch with the seams and the caller its seams file supplies, and answers with the result \u2014 or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. Switching the `api` surface off in the capabilities table stops this file being written at all, so the operation stops being served rather than being served and turned away.";
-export declare const SEAMS_AT = "src/seams.ts";
-export declare const DECLARED_SEAMS_AT = "src/_generated/seams.ts";
+export declare const ROUTE = "The file that answers a request for this one operation. It imports the operation by name, hands it to this app's own dispatch along with what this app hands its operations and the caller worked out from the request, and answers with the result \u2014 or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. An operation that does not answer on api, because its own row turns api off or the defaults sheet leaves it off, has neither this file nor this row: `thread capabilities` takes both out, so it is not served at all rather than served and turned away.";
+export declare const inboundAt: (webhook: string) => string;
 export declare const OPENAPI_AT = "operations/_openapi.json";
 export declare const MCP_AT = "operations/_mcp.json";
 export interface Capability {
@@ -17,8 +25,9 @@ export interface Capability {
     readonly nodes: readonly string[];
     readonly input: unknown;
     readonly live: readonly Surface[];
+    readonly webhooks: readonly string[];
+    readonly signed: boolean;
     readonly browsable: boolean;
-    readonly local: boolean;
     readonly mcp: {
         readonly name: string;
         readonly description: string;

package/dist/operations/capabilities.js

@@ -1,12 +1,21 @@
-export const SURFACES = ['cli', 'api', 'mcp'];
+export const SURFACES = ['cli', 'api', 'mcp', 'webhook'];
 export const isSurface = (one) => SURFACES.includes(one);
+export const MEANS = {
+    cli: 'a command a terminal runs',
+    api: 'a route a request arrives on, and the OpenAPI document written from it. An operation that does not answer on api has no route file and no route row at all',
+    mcp: 'a tool an agent is offered. Switch this off and an AI actor cannot call the operation, while everything else about it goes on working',
+    webhook: 'an address something outside posts to, once a webhook row invokes the operation and the operation names it back',
+};
+export const DEFAULTS_AT = '_threads/defaults.ts';
+export const UNSTATED = ['cli'];
 export const CAPABILITIES_AT = 'operations/_capabilities.json';
 export const CLIENT_AT = 'operations/_client.ts';
 export const DISPATCHING_AT = 'app/_generated/dispatching.ts';
+export const REACHING_AT = 'src/_generated/reaching.ts';
+export const ACTOR_AT = 'src/_generated/actor.ts';
 export const routeAt = (operation) => `app/operations/${operation}/route.ts`;
-export const ROUTE = 'The file that answers a request for this one operation. It imports the operation by name, hands it to this app\'s own dispatch with the seams and the caller its seams file supplies, and answers with the result — or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. Switching the `api` surface off in the capabilities table stops this file being written at all, so the operation stops being served rather than being served and turned away.';
-export const SEAMS_AT = 'src/seams.ts';
-export const DECLARED_SEAMS_AT = 'src/_generated/seams.ts';
+export const ROUTE = "The file that answers a request for this one operation. It imports the operation by name, hands it to this app's own dispatch along with what this app hands its operations and the caller worked out from the request, and answers with the result — or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. An operation that does not answer on api, because its own row turns api off or the defaults sheet leaves it off, has neither this file nor this row: `thread capabilities` takes both out, so it is not served at all rather than served and turned away.";
+export const inboundAt = (webhook) => `app/inbound/${webhook}/route.ts`;
 export const OPENAPI_AT = 'operations/_openapi.json';
 export const MCP_AT = 'operations/_mcp.json';
 export const reachable = (one, surface) => one.live.includes(surface);

package/dist/operations/capabilities.ts

@@ -1,25 +1,42 @@
+import type { Threaded } from '../core/thread.ts'
 
-
-export const SURFACES = ['cli', 'api', 'mcp'] as const
+export const SURFACES = ['cli', 'api', 'mcp', 'webhook'] as const
 
 export type Surface = (typeof SURFACES)[number]
 
 export const isSurface = (one: string): one is Surface => (SURFACES as readonly string[]).includes(one)
 
+export const MEANS: Readonly<Record<Surface, string>> = {
+  cli: 'a command a terminal runs',
+  api: 'a route a request arrives on, and the OpenAPI document written from it. An operation that does not answer on api has no route file and no route row at all',
+  mcp: 'a tool an agent is offered. Switch this off and an AI actor cannot call the operation, while everything else about it goes on working',
+  webhook: 'an address something outside posts to, once a webhook row invokes the operation and the operation names it back',
+}
+
+export const DEFAULTS_AT = '_threads/defaults.ts'
+
+export const UNSTATED: readonly Surface[] = ['cli']
+
+export interface Defaults extends Threaded {
+  readonly live?: readonly Surface[]
+}
+
 export const CAPABILITIES_AT = 'operations/_capabilities.json'
 
 export const CLIENT_AT = 'operations/_client.ts'
 
 export const DISPATCHING_AT = 'app/_generated/dispatching.ts'
 
+export const REACHING_AT = 'src/_generated/reaching.ts'
+
+export const ACTOR_AT = 'src/_generated/actor.ts'
+
 export const routeAt = (operation: string): string => `app/operations/${operation}/route.ts`
 
 export const ROUTE =
-  'The file that answers a request for this one operation. It imports the operation by name, hands it to this app\'s own dispatch with the seams and the caller its seams file supplies, and answers with the result — or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. Switching the `api` surface off in the capabilities table stops this file being written at all, so the operation stops being served rather than being served and turned away.'
-
-export const SEAMS_AT = 'src/seams.ts'
+  "The file that answers a request for this one operation. It imports the operation by name, hands it to this app's own dispatch along with what this app hands its operations and the caller worked out from the request, and answers with the result — or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. An operation that does not answer on api, because its own row turns api off or the defaults sheet leaves it off, has neither this file nor this row: `thread capabilities` takes both out, so it is not served at all rather than served and turned away."
 
-export const DECLARED_SEAMS_AT = 'src/_generated/seams.ts'
+export const inboundAt = (webhook: string): string => `app/inbound/${webhook}/route.ts`
 
 export const OPENAPI_AT = 'operations/_openapi.json'
 
@@ -34,9 +51,11 @@ export interface Capability {
 
   readonly live: readonly Surface[]
 
-  readonly browsable: boolean
+  readonly webhooks: readonly string[]
+
+  readonly signed: boolean
 
-  readonly local: boolean
+  readonly browsable: boolean
 
   readonly mcp: { readonly name: string; readonly description: string; readonly inputSchema: unknown }
   readonly cli: { readonly invocation: string; readonly describes: string }