@prestack/thread 0.1.20 → 0.1.22

package/dist/operations/generators/permits.js

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, writeFileSync } from '../../integrations/disk
 import { valuesIn } from '../../core/rows.js';
 import { resolve } from 'node:path';
 import { argv, stderr, stdout } from 'node:process';
-import { exit } from '../../core/invoked.js';
+import { exit, invoked } from '../../core/invoked.js';
 import { PUBLIC_ROLE as PUBLIC } from '../../core/actor.js';
 import { ROOT, descend } from '../../core/descend.js';
 import { forbids, runChecker } from '../../core/finding.js';
@@ -14,12 +14,6 @@ function stop(why) {
     exit(1);
 }
 const CHECKING = argv.includes('--check');
-const pass = await descend();
-const stopped = [...pass.broken, ...pass.findings].filter(forbids)[0];
-if (stopped !== undefined) {
-    stop('the descent is broken, so who may ask for what is only partly known, and a gate written from half of it ' +
-        `would permit callers nobody granted — ${stopped.detail} (${stopped.file ?? ''})`);
-}
 async function taken(file, name, what) {
     const at = inTree(findTree(), file);
     if (!existsSync(at))
@@ -38,28 +32,6 @@ async function taken(file, name, what) {
         stop(`${at} exports no \`${name}\` list, so nothing there states ${what}`);
     return list;
 }
-const grants = await taken('access.ts', 'GRANTS', 'who may ask for what');
-const operations = [...woven(pass, types(pass))].map(([id]) => ({
-    id,
-    describes: pass.stated.get(id)?.describes ?? '',
-}));
-for (const found of [unanswerable(grants)]) {
-    if (found.length > 0)
-        stop(found.join('; '));
-}
-const twice = grantedTwice(grants);
-if (twice.length > 0) {
-    stop(`${twice.map((one) => `\`${one}\``).join(', ')} ${twice.length === 1 ? 'is granted' : 'are granted'} more than once, ` +
-        'so two arms answer to one id and either may permit. One id, one policy — rename one of them, or delete the ' +
-        'arm that is not meant to stand');
-}
-const open = opensToEverybody(grants);
-if (open.length > 0) {
-    stop(`${open.map((one) => `\`${one.id}\``).join(', ')} names no roles or entitlements and states no condition that ` +
-        'reads the caller, so who may run this is left unsaid rather than decided. If it is meant to be open, say so: ' +
-        `\`to: { roles: ['${PUBLIC}'] }\` is the role an unauthenticated caller already wears, and naming it puts ` +
-        'that decision in the sheet. Otherwise name the roles that may, or state a `when` saying whose row it is');
-}
 const said = (held) => JSON.stringify(held);
 const used = new Set();
 function reads(one, grant) {
@@ -133,7 +105,8 @@ const COMPARES = [
     '  return left >= other',
     '}',
 ];
-function permitting() {
+export function permitting(grants) {
+    used.clear();
     const arms = grants.flatMap((one) => {
         const parts = [...wears(one), ...(one.when === undefined ? [] : [predicate(one.when, one)])];
         return [
@@ -168,22 +141,54 @@ function permitting() {
     ].join('\n');
 }
 const RUNS = 'thread permits';
-const permitted = resolve(ROOT, PERMITS_AT);
-const content = permitting();
-const count = `${String(grants.length)} grant(s) over ${String(operations.length)} operation(s)`;
-if (CHECKING) {
-    const findings = [];
-    const current = existsSync(permitted) ? readFileSync(permitted, 'utf8') : '';
-    if (current !== content) {
-        findings.push({
-            file: PERMITS_AT,
-            detail: 'is not what this app grants',
-            instead: `run \`${RUNS}\` and commit what it writes. Never edit this file — a branch here exists because a grant was declared, and an edit widens or narrows access nobody agreed to`,
-        });
+async function run() {
+    const pass = await descend();
+    const stopped = [...pass.broken, ...pass.findings].filter(forbids)[0];
+    if (stopped !== undefined) {
+        stop('the descent is broken, so who may ask for what is only partly known, and a gate written from half of it ' +
+            `would permit callers nobody granted — ${stopped.detail} (${stopped.file ?? ''})`);
+    }
+    const grants = await taken('access.ts', 'GRANTS', 'who may ask for what');
+    const operations = [...woven(pass, types(pass))].map(([id]) => ({
+        id,
+        describes: pass.stated.get(id)?.describes ?? '',
+    }));
+    for (const found of [unanswerable(grants)]) {
+        if (found.length > 0)
+            stop(found.join('; '));
+    }
+    const twice = grantedTwice(grants);
+    if (twice.length > 0) {
+        stop(`${twice.map((one) => `\`${one}\``).join(', ')} ${twice.length === 1 ? 'is granted' : 'are granted'} more than once, ` +
+            'so two arms answer to one id and either may permit. One id, one policy — rename one of them, or delete the ' +
+            'arm that is not meant to stand');
+    }
+    const open = opensToEverybody(grants);
+    if (open.length > 0) {
+        stop(`${open.map((one) => `\`${one.id}\``).join(', ')} names no roles or entitlements and states no condition that ` +
+            'reads the caller, so who may run this is left unsaid rather than decided. If it is meant to be open, say so: ' +
+            `\`to: { roles: ['${PUBLIC}'] }\` is the role an unauthenticated caller already wears, and naming it puts ` +
+            'that decision in the sheet. Otherwise name the roles that may, or state a `when` saying whose row it is');
+    }
+    const permitted = resolve(ROOT, PERMITS_AT);
+    const content = permitting(grants);
+    const count = `${String(grants.length)} grant(s) over ${String(operations.length)} operation(s)`;
+    if (CHECKING) {
+        const findings = [];
+        const current = existsSync(permitted) ? readFileSync(permitted, 'utf8') : '';
+        if (current !== content) {
+            findings.push({
+                file: PERMITS_AT,
+                detail: 'is not what this app grants',
+                instead: `run \`${RUNS}\` and commit what it writes. Never edit this file — a branch here exists because a grant was declared, and an edit widens or narrows access nobody agreed to`,
+            });
+        }
+        runChecker('permits', findings, count);
+        exit(findings.length === 0 ? 0 : 1);
     }
-    runChecker('permits', findings, count);
-    exit(findings.length === 0 ? 0 : 1);
+    writeFileSync(permitted, content);
+    stdout.write(`permits: wrote ${PERMITS_AT} — ${count}. Dispatch imports this check itself, so every operation passes it; ` +
+        '`thread grant` adds a grant, and a refusal no grant can say is an invariant on the entity, or a rule from `thread create rule`.\n');
 }
-writeFileSync(permitted, content);
-stdout.write(`permits: wrote ${PERMITS_AT} — ${count}. Dispatch imports this check itself, so every operation passes it; ` +
-    '`thread grant` adds a grant, and a refusal no grant can say is an invariant on the entity, or a rule from `thread create rule`.\n');
+if (invoked(import.meta.url))
+    await run();

package/dist/operations/generators/seed.d.ts

@@ -9,10 +9,13 @@ interface Woven {
     readonly nodes: readonly Row[];
     readonly takes: readonly Row[];
     readonly body?: string;
+    readonly within: ReadonlyMap<string, readonly Row[]>;
     readonly requires: readonly string[];
     readonly stray: readonly string[];
     readonly timeout?: number;
 }
+export declare const HOLDING: Readonly<Record<string, (first: string) => string>>;
+export declare const stepsOf: (one: Woven) => readonly Row[];
 export declare function operations(pass: Pass, known: ReadonlySet<string>): ReadonlyMap<string, Woven>;
 export declare const problem: (id: string, one: Woven) => string | undefined;
 export declare function blockIn(text: string): string | undefined;

package/dist/operations/generators/seed.js

@@ -50,6 +50,11 @@ export function builtFrom(row, known) {
     const found = (row.requires ?? []).filter((one) => known.has(one));
     return found.length === 1 ? found[0] : undefined;
 }
+export const HOLDING = {
+    nd_repeat: () => '1',
+    nd_branch: (first) => `async () => ${quoted(first)}`,
+};
+export const stepsOf = (one) => [...one.nodes, ...[...one.within.values()].flat()];
 const reaches = (pass, one) => pass.stated.has(one) && !under(pass, one, NODES_ID);
 const waiting = (held) => held !== undefined && ts.isNumericLiteral(held) ? Number(held.text.replace(/_/g, '')) : undefined;
 export function operations(pass, known) {
@@ -64,6 +69,7 @@ export function operations(pass, known) {
             nodes: [],
             takes: [],
             body: undefined,
+            within: new Map(),
             wants: new Set(stated?.takes ?? []),
             requires: asked.filter((one) => reaches(pass, one)),
             stray: asked.filter((one) => !reaches(pass, one)),
@@ -72,8 +78,17 @@ export function operations(pass, known) {
         found.set(id, made);
         return made;
     };
+    const steps = new Map();
     for (const [at, threadings] of pass.threaded) {
         for (const one of threadings) {
+            const holder = steps.get(one.by);
+            if (holder !== undefined && one.list === 'seeds') {
+                const within = held(holder).within;
+                within.set(one.by, [...(within.get(one.by) ?? []), one.row]);
+                if (one.row.id !== undefined)
+                    steps.set(one.row.id, holder);
+                continue;
+            }
             if (!isOperation(pass, one.by))
                 continue;
             if (one.list === 'derives' && one.row.by === COMPILES)
@@ -82,8 +97,11 @@ export function operations(pass, known) {
                 const mine = held(one.by);
                 if (mine.wants.has(one.row.id ?? ''))
                     mine.takes.push(one.row);
-                else
+                else {
                     mine.nodes.push(one.row);
+                    if (one.row.id !== undefined)
+                        steps.set(one.row.id, one.by);
+                }
             }
         }
     }
@@ -166,14 +184,18 @@ function planned(bodies) {
         for (const row of one.takes)
             if (row.at !== undefined)
                 found.push({ at: row.at, derived: false, text: takesFile(row.at) });
-        for (const row of one.nodes) {
+        for (const row of stepsOf(one)) {
             const from = builtFrom(row, known);
             const takes = one.takes[0]?.at;
             if (row.at === undefined || from === undefined || takes === undefined)
                 continue;
             const path = resolve(ROOT, row.at);
             const held = existsSync(path) ? readFileSync(path, 'utf8') : undefined;
-            const block = bodies.get(row.at) ?? (held === undefined ? undefined : blockIn(held));
+            const first = one.within.get(String(row.id))?.[0]?.id;
+            const fresh = first === undefined ? undefined : HOLDING[from]?.(first);
+            const written = held === undefined ? undefined : blockIn(held);
+            const untouched = held === undefined || written === scaffold(from, String(row.id));
+            const block = bodies.get(row.at) ?? (fresh !== undefined && untouched ? fresh : written);
             if (held !== undefined && block === undefined) {
                 found.push({
                     at: row.at,

package/dist/operations/nodes.d.ts

@@ -14,7 +14,7 @@ export declare const nd_read: <I, R extends string = never>(block: (opened: Read
 export declare const nd_action: <I, R extends string = never>(block: (opened: Opened<R>, held: Held<I>) => Promise<unknown>) => {
     type: 'nd_action';
 };
-export declare const nd_branch: <I, R extends string = never>(choose: (opened: Reads<Opened<R>>, held: Held<I>) => Promise<string>, ways: Readonly<Record<string, (opened: Opened<R>, held: Held<I>) => Promise<unknown>>>) => {
+export declare const nd_branch: <I, R extends string = never>(choose: (opened: Reads<Opened<R>>, held: Held<I>) => Promise<string>, ways?: Readonly<Record<string, (opened: Opened<R>, held: Held<I>) => Promise<unknown>>>) => {
     type: 'nd_branch';
 };
 export declare const nd_each: <I, R extends string = never>(over: (held: Held<I>) => readonly unknown[], block: (item: unknown, opened: Opened<R>, held: Held<I>) => Promise<unknown>) => {
@@ -23,7 +23,7 @@ export declare const nd_each: <I, R extends string = never>(over: (held: Held<I>
 export declare const nd_parallel: <I, R extends string = never>(blocks: readonly ((opened: Opened<R>, held: Held<I>) => Promise<unknown>)[]) => {
     type: 'nd_parallel';
 };
-export declare const nd_repeat: <I, R extends string = never>(ceiling: number, block: (pass: number, carried: unknown, opened: Opened<R>, held: Held<I>) => Promise<{
+export declare const nd_repeat: <I, R extends string = never>(ceiling: number, block?: (pass: number, carried: unknown, opened: Opened<R>, held: Held<I>) => Promise<{
     readonly done: boolean;
     readonly value: unknown;
 }>) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prestack/thread",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "type": "module",
   "files": [
     "dist",

package/dist/core/actor.ts

@@ -1,21 +0,0 @@
-export type Env = 'sandbox' | 'production'
-
-export const ENVIRONMENT = [
-  ['run', 'x-request-id', 'crypto.randomUUID()'],
-  ['address', 'x-forwarded-for', null],
-  ['device', 'user-agent', null],
-  ['replay', 'idempotency-key', null],
-  ['moment', null, 'new Date().toISOString()'],
-] as const
-
-export type Environment = { readonly [K in (typeof ENVIRONMENT)[number][0]]?: string }
-
-export type Actor = Environment & {
-  readonly id: string | null
-  readonly roles: readonly string[]
-  readonly entitlements: readonly string[]
-}
-
-export const PUBLIC_ROLE = 'role_public'
-
-export const ANONYMOUS: Actor = { id: null, roles: [PUBLIC_ROLE], entitlements: [] }