@prestack/thread 0.1.2 → 0.1.4

package/dist/operations/dispatch.d.ts

@@ -1,14 +1,20 @@
 export declare const DISPATCH_AT = "operations/_dispatch.ts";
 export declare const dispatched: (reached: Readonly<Record<string, {
     readonly reach: string;
-    readonly address: string | null;
+    readonly address?: string;
+    readonly headers: Readonly<Record<string, string>>;
     readonly sends: readonly {
         readonly secret: string;
         readonly header: string;
         readonly prefix: string;
     }[];
+    readonly signs: readonly {
+        readonly secret: string;
+        readonly header: string;
+        readonly prefix: string;
+    }[];
     readonly calls: Readonly<Record<string, {
-        readonly method: string;
+        readonly method: string | null;
         readonly path: string;
     }>>;
 }>>) => string;

package/dist/operations/dispatch.js

@@ -1,49 +1,52 @@
-import { ANONYMOUS, ENVIRONMENT } from "../core/actor.js";
-import { errorDefForResult } from "./error-results.js";
-import { DbConflict } from "./errors/errors.js";
-import { quoted, runtime } from "./generators/seed.js";
-import { SUPPLY } from "./seams.js";
+import { ANONYMOUS, ENVIRONMENT } from '../core/actor.js';
+import { HOLDS } from '../integrations/target.js';
+import { PERMITS_AT } from './access.js';
+import { DbConflict } from '../core/errors/catalogue.js';
+import { beside, quoted, runtime } from './generators/seed.js';
+const reaching = (holds) => Object.keys(HOLDS).filter((one) => holds(HOLDS[one]));
+const KEEPS = reaching((one) => one.takes === 'entities');
+const ANSWERS = reaching((one) => one.takes === null);
+const RUNS = reaching((one) => one.takes === 'calls' && one.addressed === 'nothing');
+const asked = (reaches) => reaches.map((one) => "reach === '" + one + "'").join(' || ');
 export const DISPATCH_AT = 'operations/_dispatch.ts';
-const identity = (code) => {
-    const def = errorDefForResult(code);
-    return { code: def.code, class: def.class };
-};
-const CODES = ['denied', 'invalid', 'rate_limited', 'feature_denied', 'quota_exceeded', 'error'];
 const REFUSAL = {
-    denied: { said: 'not allowed', outcome: 'denied' },
-    invalid: { said: 'invalid input', outcome: 'failed' },
-    rate_limited: { said: 'rate limited', outcome: 'rate_limited' },
-    feature_denied: { said: 'not in plan', outcome: 'feature_denied' },
-    quota_exceeded: { said: 'quota exceeded', outcome: 'quota_exceeded' },
-    error: { said: 'failed', outcome: 'failed' },
+    denied: 'not allowed',
+    invalid: 'invalid input',
+    rate_limited: 'rate limited',
+    feature_denied: 'not in plan',
+    quota_exceeded: 'quota exceeded',
+    error: 'failed',
 };
 const printed = (value) => JSON.stringify(value, null, 2);
-const DEFS = Object.fromEntries(CODES.map((code) => [code, identity(code)]));
 export const dispatched = (reached) => [
+    "import { createHmac } from 'node:crypto'",
+    '',
     `import type { Actor } from ${quoted(runtime(DISPATCH_AT, '../../core/actor.ts'))}`,
-    `import type { Operation } from ${quoted(runtime(DISPATCH_AT, '../operations.ts'))}`,
+    `import type { Allowance, Counting, Operation } from ${quoted(runtime(DISPATCH_AT, '../operations.ts'))}`,
     `import type { FailureIdentity, Result, ResultCode } from ${quoted(runtime(DISPATCH_AT, '../result.ts'))}`,
-    `import type { AuditOutcome, Handed, LogLevel, QuotaHold, Seams } from ${quoted(runtime(DISPATCH_AT, '../seams.ts'))}`,
+    'import type { Opened } from ' + quoted(runtime(DISPATCH_AT, '../operations.ts')),
+    'import type { Vault } from ' + quoted(runtime(DISPATCH_AT, '../../integrations/secret.ts')),
+    `import { permits } from ${quoted(beside(DISPATCH_AT, PERMITS_AT))}`,
     '',
     `const ANONYMOUS: Actor = ${printed(ANONYMOUS)}`,
     '',
     `const ENVIRONMENT: readonly string[] = ${printed(ENVIRONMENT.map(([fact]) => fact))}`,
     '',
-    `const REFUSAL: Readonly<Record<ResultCode, { readonly said: string; readonly outcome: AuditOutcome }>> = ${printed(REFUSAL)}`,
-    '',
-    `const DEFS = ${printed(DEFS)} as Readonly<Record<ResultCode, FailureIdentity>>`,
+    `const REFUSAL: Readonly<Record<ResultCode, string>> = ${printed(REFUSAL)}`,
     '',
     `const CONFLICT = ${printed({ code: DbConflict.def.code, class: DbConflict.def.class })} as FailureIdentity`,
     '',
-    `const SUPPLY: Readonly<Record<string, string>> = ${printed(SUPPLY)}`,
-    '',
     'type Reached = Readonly<Record<string, {',
     '  readonly reach: string',
-    '  readonly address: string | null',
+    '  readonly address?: string',
+    '  readonly headers: Readonly<Record<string, string>>',
     '  readonly sends: readonly { readonly secret: string; readonly header: string; readonly prefix: string }[]',
-    '  readonly calls: Readonly<Record<string, { readonly method: string; readonly path: string }>>',
+    '  readonly signs: readonly { readonly secret: string; readonly header: string; readonly prefix: string }[]',
+    '  readonly calls: Readonly<Record<string, { readonly method: string | null; readonly path: string }>>',
     '}>>',
     '',
+    'type Reaches = Readonly<Record<string, unknown>>',
+    '',
     `const REACHED: Reached = ${printed(reached)}`,
     '',
     "const STOPPED = Symbol.for('thread.operation.stopped')",
@@ -58,6 +61,22 @@ export const dispatched = (reached) => [
     '  ...(identity === undefined ? {} : { errorCode: identity.code, errorClass: identity.class }),',
     '}) as Result<never>',
     '',
+    'const allowance = async (',
+    '  id: string,',
+    '  actor: Actor,',
+    '  counting: Counting | undefined,',
+    '  held: Allowance | undefined,',
+    '  code: ResultCode,',
+    '): Promise<Result<never> | undefined> => {',
+    '  if (held === undefined) return undefined',
+    '  if (counting === undefined) {',
+    "    return fail('error', REFUSAL['error'], id + ' allows ' + String(held.runs) + ' run(s) per ' + held.per + ' and this dispatch was handed nothing to count with. An operation that states an allowance is handed a counter or it does not run')",
+    '  }',
+    "  const seen = await counting['seen'](id + '/' + String(actor.id ?? 'anonymous') + '/' + code, held.per)",
+    '  if (seen <= held.runs) return undefined',
+    "  return fail(code, REFUSAL[code], String(seen) + ' of ' + String(held.runs) + ' allowed per ' + held.per)",
+    '}',
+    '',
     "const strings = (value: unknown): value is string[] => Array.isArray(value) && value.every((one) => typeof one === 'string')",
     '',
     'const person = (value: unknown): Actor | undefined => {',
@@ -90,12 +109,6 @@ export const dispatched = (reached) => [
     "  return one[STOPPED] === true ? { value: one['value'] } : undefined",
     '}',
     '',
-    'const marked = (thrown: unknown): string | undefined => {',
-    "  if (typeof thrown !== 'object' || thrown === null) return undefined",
-    '  const said = (thrown as { readonly node?: unknown }).node',
-    "  return typeof said === 'string' ? said : undefined",
-    '}',
-    '',
     'const platform = (thrown: unknown): string | undefined => {',
     "  if (typeof thrown !== 'object' || thrown === null) return undefined",
     '  const said = (thrown as { readonly because?: unknown }).because',
@@ -110,59 +123,88 @@ export const dispatched = (reached) => [
     '  return held',
     '}',
     '',
-    'const bound = (word: string, wired: Reached[string], seams: Seams): Record<string, unknown> | string => {',
+    'const bound = (word: string, wired: Reached[string], opened: Reaches, opening: Vault | undefined, within: number): Record<string, unknown> | string => {',
+    '  const reached = opened[word]',
+    '  const { reach } = wired',
+    '  if (' + asked(ANSWERS) + ') {',
+    '    const held = reached',
+    '    if (held === undefined) {',
+    "      return word + ' is a disk this operation requires, and this dispatch was handed none under that name. The disk under this process is written in by thread capabilities; one at the other end of a connection is handed in by whoever opened it'",
+    '    }',
+    '    return held as unknown as Record<string, unknown>',
+    '  }',
+    '  if (' + asked(KEEPS) + ') {',
+    '    if (reached === undefined) {',
+    "      return word + ' keeps rows for this app, and this dispatch was handed no store. A store is written in by thread capabilities, out of the target that keeps the entity'",
+    '    }',
+    '    return reached as unknown as Record<string, unknown>',
+    '  }',
+    '',
     '  const names = Object.keys(wired.calls)',
     '  if (names.length === 0) {',
     '    return `\\`${word}\\` is required and takes no call, so there is nothing to hand a node. Declare one with \\`thread create target call\\``',
     '  }',
-    '  if (seams.http === undefined) {',
-    '    return `\\`${word}\\` is reached over ${wired.reach} and the seams this dispatch was handed hold no \\`http\\` — wire one, or take \\`${word}\\` off that operation\'s row`',
+    '  if (' + asked(RUNS) + ') {',
+    '    const held = reached',
+    '    if (held === undefined) {',
+    "      return word + ' is a program this operation requires, and this dispatch was handed none under that name. A program is written in by thread capabilities, out of the calls declared beside the target'",
+    '    }',
+    '    const out: Record<string, unknown> = {}',
+    '    for (const name of names) {',
+    '      const doing = (held as unknown as Record<string, unknown>)[name]',
+    "      if (typeof doing !== 'function') {",
+    "        return word + ' takes ' + name + ' and the program handed in under that name does not answer to it, so a node would be handed a word that does nothing'",
+    '      }',
+    '      out[name] = (args: readonly string[], shows?: boolean, sooner?: number, how?: unknown) => (doing as (a: readonly string[], s?: boolean, w?: number, h?: unknown) => unknown)(args, shows, sooner === undefined ? within : Math.min(sooner, within), how)',
+    '    }',
+    '    return out',
+    '  }',
+    '  if (reached === undefined) {',
+    "    return word + ' is reached over ' + wired.reach + ', and this dispatch was handed nothing to send an outward call through. thread capabilities writes that in; or take that word off the row that requires it'",
     '  }',
-    '  const wanted = [...(wired.address === null ? [] : [wired.address]), ...wired.sends.map((one) => one.secret)]',
-    '  if (wanted.length > 0 && seams.vault === undefined) {',
-    '    return `\\`${word}\\` needs ${wanted.join(\', \')} and the seams this dispatch was handed hold no \\`vault\\` to open them. A target is reached with what opens it or not at all`',
+    '  const wanted = [...wired.sends.map((one) => one.secret), ...wired.signs.map((one) => one.secret)]',
+    '  if (wanted.length > 0 && opening === undefined) {',
+    "    return word + ' needs ' + wanted.join(', ') + ' and this dispatch was handed no vault to open them. A target is reached with what opens it or not at all'",
     '  }',
     '  const out: Record<string, unknown> = {}',
     '  for (const name of names) {',
     '    const call = wired.calls[name]',
     '    if (call === undefined) continue',
-    '    out[name] = async (given?: { fills?: Readonly<Record<string, string | number>>; json?: unknown; body?: Uint8Array; contentType?: string }) => {',
-    '      const values = wanted.length === 0 ? {} : await seams.vault!.resolve(wanted)',
+    '    out[name] = async (given?: { fills?: Readonly<Record<string, string | number>>; json?: unknown; body?: Uint8Array; contentType?: string; told?: (said: unknown) => void }) => {',
+    "      const values = wanted.length === 0 ? {} : await opening!['resolve'](wanted)",
     '      const headers: Record<string, string> = {}',
+    '      for (const [name, value] of Object.entries(wired.headers)) headers[name] = value',
     '      for (const one of wired.sends) headers[one.header] = `${one.prefix}${values[one.secret] ?? \'\'}`',
     '      const body = given?.json === undefined ? given?.body : new TextEncoder().encode(JSON.stringify(given.json))',
-    '      return await seams.http!.call({',
+    '      for (const one of wired.signs) {',
+    "        const mac = createHmac('sha256', values[one.secret] ?? '').update(body ?? new Uint8Array()).digest('hex')",
+    '        headers[one.header] = one.prefix + mac',
+    '      }',
+    "      const send = reached as { call: (request: unknown, within?: number) => Promise<unknown> }",
+    "      return await send['call']({",
     '        target: word,',
-    '        address: wired.address === null ? \'\' : (values[wired.address] ?? \'\'),',
+    '        address: wired.address ?? \'\',',
     "        method: call.method as 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',",
     '        path: filled(call.path, given?.fills),',
     '        headers,',
     '        ...(body === undefined ? {} : { body, contentType: given?.contentType ?? \'application/json\' }),',
-    '      })',
+    '        ...(given?.told === undefined ? {} : { told: given.told }),',
+    '      }, within)',
     '    }',
     '  }',
     '  return out',
     '}',
     '',
-    'const given = (operation: Operation<unknown, string>, actor: Actor, seams: Seams): Record<string, unknown> | string => {',
-    '  const held: Record<string, unknown> = { actor }',
+    'const given = (operation: Operation<unknown, string>, actor: Actor, opened: Reaches, opening: Vault | undefined, telling: (said: unknown) => void): Record<string, unknown> | string => {',
+    '  const held: Record<string, unknown> = { actor, tell: telling }',
     '  for (const word of operation.requires) {',
-    '    const key = SUPPLY[word]',
-    '    if (key === undefined) {',
-    '      const wired = REACHED[word]',
-    '      if (wired === undefined) {',
-    '        return `\\`${operation.id}\\` requires \\`${word}\\`, and nothing here supplies it — what may be required is ${[...Object.keys(SUPPLY), ...Object.keys(REACHED)].join(\', \')}`',
-    '      }',
-    '      const reached = bound(word, wired, seams)',
-    "      if (typeof reached === 'string') return reached",
-    '      held[word] = reached',
-    '      continue',
-    '    }',
-    '    const seam = (seams as unknown as Record<string, unknown>)[key]',
-    '    if (seam === undefined) {',
-    '      return `\\`${operation.id}\\` requires \\`${word}\\`, and the seams this dispatch was handed hold no \\`${key}\\` — wire one, or take \\`${word}\\` off that operation\'s row. An operation does not run short of what it declared`',
+    '    const wired = REACHED[word]',
+    '    if (wired === undefined) {',
+    '      return `\\`${operation[\'id\']}\\` requires \\`${word}\\`, and this app declares no target by that name. An operation requires targets: declare one with \\`thread create target\\`, or take that word off its row`',
     '    }',
-    '    held[key] = seam',
+    '    const reached = bound(word, wired, opened, opening, operation.timeout)',
+    "    if (typeof reached === 'string') return reached",
+    '    held[word] = reached',
     '  }',
     '  return held',
     '}',
@@ -171,155 +213,56 @@ export const dispatched = (reached) => [
     '  operation: Operation<I, R>,',
     '  rawInput: unknown,',
     '  asking: Actor,',
-    '  seams: Seams,',
+    '  opened: Reaches,',
+    '  opening: Vault | undefined,',
+    '  counting?: Counting,',
+    '  telling?: (said: unknown) => void,',
     '): Promise<Result<unknown>> {',
     '  const id = operation.id',
     '  const who = person(asking)',
-    '  const run = who?.run ?? seams.random.uuid()',
-    '  const actor: Actor = { ...(who ?? ANONYMOUS), run }',
-    '  const span = seams.telemetry?.start(id, run, { ...actor })',
-    '',
-    '  const gates = { rate: seams.rateLimiter !== undefined, replay: seams.idempotency !== undefined, quota: seams.quotas !== undefined, telemetry: seams.telemetry !== undefined }',
-    '',
-    '  let hold: QuotaHold | null = null',
-    '  let granted: string | undefined',
-    '',
-    '  const sank = (what: string) => (thrown: unknown): void => {',
-    "    seams.log.write('error', id, actor, {",
-    '      [`${what}_failed`]: thrown instanceof Error ? thrown.message : String(thrown),',
-    '    })',
-    '  }',
-    '',
-    '  const settled = async (held: Result<unknown>, because?: string): Promise<Result<unknown>> => {',
-    "    const outcome: AuditOutcome = held.ok ? 'ok' : REFUSAL[held.code].outcome",
-    '    const detail = because === undefined ? {} : { because }',
-    '',
-    '    const reserved = hold === null ? null : operation.estimate',
-    '    let consumed: number | null = null',
-    '',
-    '    if (hold !== null) {',
-    '      const settling = held.ok ? hold.commit(operation.estimate) : hold.release()',
-    '      consumed = held.ok ? operation.estimate : 0',
-    '      hold = null',
-    "      await settling.catch(sank('quota'))",
-    '    }',
-    '',
-    "    seams.log.write(held.ok ? 'info' : 'warn', id, actor, {",
-    '      outcome,',
-    '      ...detail,',
-    "      access: { roles: actor.roles, entitlements: actor.entitlements, granted: granted ?? 'not reached' },",
-    '      quota: { meter: id, reserved, consumed },',
-    '      gates,',
-    '    })',
-    '    if (held.ok) span?.ok()',
-    '    else span?.error(outcome)',
-    '',
-    '    await seams.audit',
-    "      .append(actor, { action: id, outcome, subject: { type: 'operation', id }, ...detail })",
-    "      .catch(sank('audit'))",
-    '',
-    '    if (!held.ok) {',
-    '      const identity: FailureIdentity =',
-    '        held.errorCode === undefined || held.errorClass === undefined',
-    '          ? DEFS[held.code]',
-    '          : { code: held.errorCode, class: held.errorClass }',
-    '',
-    '      await seams.errors',
-    '        .record(actor, { code: identity.code, class: identity.class, action: id, ...detail })',
-    "        .catch(sank('errors'))",
-    '    }',
-    '',
-    '    return held',
-    '  }',
-    '',
-    '  const refused = (code: ResultCode, because?: string): Promise<Result<unknown>> =>',
-    '    settled(fail(code, REFUSAL[code].said, because), because)',
-    '',
-    '  const recorded = (began: number, ok: boolean, at: string | undefined, because?: string): void => {',
-    '    const took = seams.clock.now() - began',
-    '    const sections = {',
-    '      node: { at: at ?? null },',
-    '      audit: { actor, when: began },',
-    '      observability: { ms: took, ok, ...(because === undefined ? {} : { because }) },',
-    '    }',
-    '',
-    "    seams.log.write(ok ? 'info' : 'warn', id, actor, sections)",
-    '    seams.telemetry?.record?.({',
-    '      key: id,',
-    '      traceId: run,',
-    '      spanId: run,',
-    '      durationMs: took,',
-    '      ok,',
-    '      attrs: sections,',
-    '      actor,',
-    '      ...(at === undefined ? {} : { nodeId: at }),',
-    '      workflowId: id,',
-    '      ...(because === undefined ? {} : { error: because }),',
-    '    })',
-    '  }',
-    '',
+    '  const actor: Actor = who ?? ANONYMOUS',
     '  try {',
-    "    if (who === undefined) return await refused('denied', 'identity_invalid')",
-    '',
-    "    if (seams.rateLimiter !== undefined && !(await seams.rateLimiter.check(actor, id))) return await refused('rate_limited')",
-    '',
-    '    const replayed = seams.idempotency === undefined ? null : await seams.idempotency.check(actor.replay, id)',
-    "    if (replayed !== null && replayed !== undefined) return await settled(ok(replayed), 'replayed')",
-    '',
+    "    if (who === undefined) return fail('denied', REFUSAL['denied'], 'identity_invalid')",
     '    const parsed = operation.input.safeParse(rawInput)',
     '    if (!parsed.success) {',
-    "      return await refused('invalid', parsed.error.issues.map((one) => one.message).join('; '))",
+    "      return fail('invalid', REFUSAL['invalid'], String(parsed['error']))",
     '    }',
-    '',
-    '    if (seams.quotas) {',
-    '      const reserved = await seams.quotas.reserve(actor, id, operation.estimate)',
-    "      if (!reserved.ok) return await refused('quota_exceeded', reserved.behavior ?? 'block')",
-    '      hold = reserved',
-    '    }',
-    '',
-    '    if (seams.permits === undefined) {',
-    "      return await refused('denied', 'no permits check is wired, so nothing can permit this operation')",
+    '    const { resource } = operation',
+    '    const ruled = permits(actor, id, resource(parsed[\'data\']))',
+    '    const { allow, because: why } = ruled',
+    "    if (!allow) return fail('denied', REFUSAL['denied'], why)",
+    '',
+    '    const { entitled } = operation',
+    '    if (entitled !== undefined && !actor.entitlements.includes(entitled)) {',
+    "      return fail('feature_denied', REFUSAL['feature_denied'], id + ' is offered on ' + entitled + ', which this caller does not hold')",
     '    }',
     '',
-    '    const ruled = await seams.permits.check(actor, id, operation.resource(parsed.data))',
-    "    if (!ruled.allow) return await refused('denied', ruled.because)",
-    '    granted = ruled.because',
+    "    const limited = await allowance(id, actor, counting, operation.rate, 'rate_limited')",
+    '    if (limited !== undefined) return limited',
+    "    const over = await allowance(id, actor, counting, operation.quota, 'quota_exceeded')",
+    '    if (over !== undefined) return over',
     '',
-    '    const hands = given(operation as Operation<unknown, string>, actor, seams)',
-    "    if (typeof hands === 'string') return await refused('error', hands)",
+    '    const handed = given(operation as Operation<unknown, string>, actor, opened, opening, telling ?? (() => undefined))',
+    "    if (typeof handed === 'string') return fail('error', REFUSAL['error'], handed)",
     '',
     '    const held: { readonly input: I } & Record<string, unknown> = { input: parsed.data }',
-    '    const began = seams.clock.now()',
-    '    let value: unknown',
-    '    try {',
-    '      value = await operation.run(hands as Handed<R>, held)',
-    '    } catch (thrown) {',
-    '      recorded(began, stopped(thrown) !== undefined, marked(thrown), thrown instanceof Error ? thrown.message : String(thrown))',
-    '      throw thrown',
-    '    }',
-    '    recorded(began, true, undefined)',
-    '',
-    "    if (seams.idempotency !== undefined) await seams.idempotency.store(actor.replay, id, value).catch(sank('idempotency'))",
-    '',
-    '    return await settled(ok(value))',
+    '    const value = await operation.run(handed as Opened<R>, held)',
+    '    return ok(value)',
     '  } catch (thrown) {',
     '    const early = stopped(thrown)',
     '    if (early !== undefined) {',
-    "      if (seams.idempotency !== undefined) await seams.idempotency.store(actor.replay, id, early.value).catch(sank('idempotency'))",
-    "      return await settled(ok(early.value), 'stopped')",
+    '      return ok(early[\'value\'])',
     '    }',
     '',
     '    const message = thrown instanceof Error ? thrown.message : String(thrown)',
     '',
     "    if (named(thrown, 'VersionConflictError')) {",
-    "      return await settled(fail('invalid', message, 'version_conflict', CONFLICT), 'version_conflict')",
+    "      return fail('invalid', message, 'version_conflict', CONFLICT)",
     '    }',
     '',
     "    const code: ResultCode = named(thrown, 'ValidationError') ? 'invalid' : 'error'",
     '    const because = platform(thrown) ?? message',
-    '    return await settled(fail(code, message, because), because)',
-    '  } finally {',
-    '    span?.end()',
+    '    return fail(code, message, because)',
     '  }',
     '}',
     '',