@prestack/thread 0.1.3 → 0.1.5

package/dist/operations/capabilities.js

@@ -1,12 +1,21 @@
-export const SURFACES = ['cli', 'api', 'mcp'];
+export const SURFACES = ['cli', 'api', 'mcp', 'webhook'];
 export const isSurface = (one) => SURFACES.includes(one);
+export const MEANS = {
+    cli: 'a command a terminal runs',
+    api: 'a route a request arrives on, and the OpenAPI document written from it. An operation that does not answer on api has no route file and no route row at all',
+    mcp: 'a tool an agent is offered. Switch this off and an AI actor cannot call the operation, while everything else about it goes on working',
+    webhook: 'an address something outside posts to, once a webhook row invokes the operation and the operation names it back',
+};
+export const DEFAULTS_AT = '_threads/defaults.ts';
+export const UNSTATED = ['cli'];
 export const CAPABILITIES_AT = 'operations/_capabilities.json';
 export const CLIENT_AT = 'operations/_client.ts';
 export const DISPATCHING_AT = 'app/_generated/dispatching.ts';
+export const REACHING_AT = 'src/_generated/reaching.ts';
+export const ACTOR_AT = 'src/_generated/actor.ts';
 export const routeAt = (operation) => `app/operations/${operation}/route.ts`;
-export const ROUTE = 'The file that answers a request for this one operation. It imports the operation by name, hands it to this app\'s own dispatch with the seams and the caller its seams file supplies, and answers with the result — or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. Switching the `api` surface off in the capabilities table stops this file being written at all, so the operation stops being served rather than being served and turned away.';
-export const SEAMS_AT = 'src/seams.ts';
-export const DECLARED_SEAMS_AT = 'src/_generated/seams.ts';
+export const ROUTE = "The file that answers a request for this one operation. It imports the operation by name, hands it to this app's own dispatch along with what this app hands its operations and the caller worked out from the request, and answers with the result — or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. An operation that does not answer on api, because its own row turns api off or the defaults sheet leaves it off, has neither this file nor this row: `thread capabilities` takes both out, so it is not served at all rather than served and turned away.";
+export const inboundAt = (webhook) => `app/inbound/${webhook}/route.ts`;
 export const OPENAPI_AT = 'operations/_openapi.json';
 export const MCP_AT = 'operations/_mcp.json';
 export const reachable = (one, surface) => one.live.includes(surface);

package/dist/operations/capabilities.ts

@@ -1,25 +1,42 @@
+import type { Threaded } from '../core/thread.ts'
 
-
-export const SURFACES = ['cli', 'api', 'mcp'] as const
+export const SURFACES = ['cli', 'api', 'mcp', 'webhook'] as const
 
 export type Surface = (typeof SURFACES)[number]
 
 export const isSurface = (one: string): one is Surface => (SURFACES as readonly string[]).includes(one)
 
+export const MEANS: Readonly<Record<Surface, string>> = {
+  cli: 'a command a terminal runs',
+  api: 'a route a request arrives on, and the OpenAPI document written from it. An operation that does not answer on api has no route file and no route row at all',
+  mcp: 'a tool an agent is offered. Switch this off and an AI actor cannot call the operation, while everything else about it goes on working',
+  webhook: 'an address something outside posts to, once a webhook row invokes the operation and the operation names it back',
+}
+
+export const DEFAULTS_AT = '_threads/defaults.ts'
+
+export const UNSTATED: readonly Surface[] = ['cli']
+
+export interface Defaults extends Threaded {
+  readonly live?: readonly Surface[]
+}
+
 export const CAPABILITIES_AT = 'operations/_capabilities.json'
 
 export const CLIENT_AT = 'operations/_client.ts'
 
 export const DISPATCHING_AT = 'app/_generated/dispatching.ts'
 
+export const REACHING_AT = 'src/_generated/reaching.ts'
+
+export const ACTOR_AT = 'src/_generated/actor.ts'
+
 export const routeAt = (operation: string): string => `app/operations/${operation}/route.ts`
 
 export const ROUTE =
-  'The file that answers a request for this one operation. It imports the operation by name, hands it to this app\'s own dispatch with the seams and the caller its seams file supplies, and answers with the result — or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. Switching the `api` surface off in the capabilities table stops this file being written at all, so the operation stops being served rather than being served and turned away.'
-
-export const SEAMS_AT = 'src/seams.ts'
+  "The file that answers a request for this one operation. It imports the operation by name, hands it to this app's own dispatch along with what this app hands its operations and the caller worked out from the request, and answers with the result — or with the status matching whatever dispatch refused it for. One per operation rather than one for all of them: a route that looked its operation up by a name off the path would hand dispatch something no check had ever seen, which reads exactly like a name that was checked. An operation that does not answer on api, because its own row turns api off or the defaults sheet leaves it off, has neither this file nor this row: `thread capabilities` takes both out, so it is not served at all rather than served and turned away."
 
-export const DECLARED_SEAMS_AT = 'src/_generated/seams.ts'
+export const inboundAt = (webhook: string): string => `app/inbound/${webhook}/route.ts`
 
 export const OPENAPI_AT = 'operations/_openapi.json'
 
@@ -34,9 +51,11 @@ export interface Capability {
 
   readonly live: readonly Surface[]
 
-  readonly browsable: boolean
+  readonly webhooks: readonly string[]
+
+  readonly signed: boolean
 
-  readonly local: boolean
+  readonly browsable: boolean
 
   readonly mcp: { readonly name: string; readonly description: string; readonly inputSchema: unknown }
   readonly cli: { readonly invocation: string; readonly describes: string }

package/dist/operations/dispatch.d.ts

@@ -1,14 +1,20 @@
 export declare const DISPATCH_AT = "operations/_dispatch.ts";
 export declare const dispatched: (reached: Readonly<Record<string, {
     readonly reach: string;
-    readonly address: string | null;
+    readonly address?: string;
+    readonly headers: Readonly<Record<string, string>>;
     readonly sends: readonly {
         readonly secret: string;
         readonly header: string;
         readonly prefix: string;
     }[];
+    readonly signs: readonly {
+        readonly secret: string;
+        readonly header: string;
+        readonly prefix: string;
+    }[];
     readonly calls: Readonly<Record<string, {
-        readonly method: string;
+        readonly method: string | null;
         readonly path: string;
     }>>;
 }>>) => string;

package/dist/operations/dispatch.js

@@ -1,49 +1,52 @@
-import { ANONYMOUS, ENVIRONMENT } from "../core/actor.js";
-import { errorDefForResult } from "./error-results.js";
-import { DbConflict } from "./errors/errors.js";
-import { quoted, runtime } from "./generators/seed.js";
-import { SUPPLY } from "./seams.js";
+import { ANONYMOUS, ENVIRONMENT } from '../core/actor.js';
+import { HOLDS } from '../integrations/target.js';
+import { PERMITS_AT } from './access.js';
+import { DbConflict } from '../core/errors/catalogue.js';
+import { beside, quoted, runtime } from './generators/seed.js';
+const reaching = (holds) => Object.keys(HOLDS).filter((one) => holds(HOLDS[one]));
+const KEEPS = reaching((one) => one.takes === 'entities');
+const ANSWERS = reaching((one) => one.takes === null);
+const RUNS = reaching((one) => one.takes === 'calls' && one.addressed === 'nothing');
+const asked = (reaches) => reaches.map((one) => "reach === '" + one + "'").join(' || ');
 export const DISPATCH_AT = 'operations/_dispatch.ts';
-const identity = (code) => {
-    const def = errorDefForResult(code);
-    return { code: def.code, class: def.class };
-};
-const CODES = ['denied', 'invalid', 'rate_limited', 'feature_denied', 'quota_exceeded', 'error'];
 const REFUSAL = {
-    denied: { said: 'not allowed', outcome: 'denied' },
-    invalid: { said: 'invalid input', outcome: 'failed' },
-    rate_limited: { said: 'rate limited', outcome: 'rate_limited' },
-    feature_denied: { said: 'not in plan', outcome: 'feature_denied' },
-    quota_exceeded: { said: 'quota exceeded', outcome: 'quota_exceeded' },
-    error: { said: 'failed', outcome: 'failed' },
+    denied: 'not allowed',
+    invalid: 'invalid input',
+    rate_limited: 'rate limited',
+    feature_denied: 'not in plan',
+    quota_exceeded: 'quota exceeded',
+    error: 'failed',
 };
 const printed = (value) => JSON.stringify(value, null, 2);
-const DEFS = Object.fromEntries(CODES.map((code) => [code, identity(code)]));
 export const dispatched = (reached) => [
+    "import { createHmac } from 'node:crypto'",
+    '',
     `import type { Actor } from ${quoted(runtime(DISPATCH_AT, '../../core/actor.ts'))}`,
-    `import type { Operation } from ${quoted(runtime(DISPATCH_AT, '../operations.ts'))}`,
+    `import type { Allowance, Counting, Operation } from ${quoted(runtime(DISPATCH_AT, '../operations.ts'))}`,
     `import type { FailureIdentity, Result, ResultCode } from ${quoted(runtime(DISPATCH_AT, '../result.ts'))}`,
-    `import type { AuditOutcome, Handed, LogLevel, QuotaHold, Seams } from ${quoted(runtime(DISPATCH_AT, '../seams.ts'))}`,
+    'import type { Opened } from ' + quoted(runtime(DISPATCH_AT, '../operations.ts')),
+    'import type { Vault } from ' + quoted(runtime(DISPATCH_AT, '../../integrations/secret.ts')),
+    `import { permits } from ${quoted(beside(DISPATCH_AT, PERMITS_AT))}`,
     '',
     `const ANONYMOUS: Actor = ${printed(ANONYMOUS)}`,
     '',
     `const ENVIRONMENT: readonly string[] = ${printed(ENVIRONMENT.map(([fact]) => fact))}`,
     '',
-    `const REFUSAL: Readonly<Record<ResultCode, { readonly said: string; readonly outcome: AuditOutcome }>> = ${printed(REFUSAL)}`,
-    '',
-    `const DEFS = ${printed(DEFS)} as Readonly<Record<ResultCode, FailureIdentity>>`,
+    `const REFUSAL: Readonly<Record<ResultCode, string>> = ${printed(REFUSAL)}`,
     '',
     `const CONFLICT = ${printed({ code: DbConflict.def.code, class: DbConflict.def.class })} as FailureIdentity`,
     '',
-    `const SUPPLY: Readonly<Record<string, string>> = ${printed(SUPPLY)}`,
-    '',
     'type Reached = Readonly<Record<string, {',
     '  readonly reach: string',
-    '  readonly address: string | null',
+    '  readonly address?: string',
+    '  readonly headers: Readonly<Record<string, string>>',
     '  readonly sends: readonly { readonly secret: string; readonly header: string; readonly prefix: string }[]',
-    '  readonly calls: Readonly<Record<string, { readonly method: string; readonly path: string }>>',
+    '  readonly signs: readonly { readonly secret: string; readonly header: string; readonly prefix: string }[]',
+    '  readonly calls: Readonly<Record<string, { readonly method: string | null; readonly path: string }>>',
     '}>>',
     '',
+    'type Reaches = Readonly<Record<string, unknown>>',
+    '',
     `const REACHED: Reached = ${printed(reached)}`,
     '',
     "const STOPPED = Symbol.for('thread.operation.stopped')",
@@ -58,6 +61,22 @@ export const dispatched = (reached) => [
     '  ...(identity === undefined ? {} : { errorCode: identity.code, errorClass: identity.class }),',
     '}) as Result<never>',
     '',
+    'const allowance = async (',
+    '  id: string,',
+    '  actor: Actor,',
+    '  counting: Counting | undefined,',
+    '  held: Allowance | undefined,',
+    '  code: ResultCode,',
+    '): Promise<Result<never> | undefined> => {',
+    '  if (held === undefined) return undefined',
+    '  if (counting === undefined) {',
+    "    return fail('error', REFUSAL['error'], id + ' allows ' + String(held.runs) + ' run(s) per ' + held.per + ' and this dispatch was handed nothing to count with. An operation that states an allowance is handed a counter or it does not run')",
+    '  }',
+    "  const seen = await counting['seen'](id + '/' + String(actor.id ?? 'anonymous') + '/' + code, held.per)",
+    '  if (seen <= held.runs) return undefined',
+    "  return fail(code, REFUSAL[code], String(seen) + ' of ' + String(held.runs) + ' allowed per ' + held.per)",
+    '}',
+    '',
     "const strings = (value: unknown): value is string[] => Array.isArray(value) && value.every((one) => typeof one === 'string')",
     '',
     'const person = (value: unknown): Actor | undefined => {',
@@ -90,12 +109,6 @@ export const dispatched = (reached) => [
     "  return one[STOPPED] === true ? { value: one['value'] } : undefined",
     '}',
     '',
-    'const marked = (thrown: unknown): string | undefined => {',
-    "  if (typeof thrown !== 'object' || thrown === null) return undefined",
-    '  const said = (thrown as { readonly node?: unknown }).node',
-    "  return typeof said === 'string' ? said : undefined",
-    '}',
-    '',
     'const platform = (thrown: unknown): string | undefined => {',
     "  if (typeof thrown !== 'object' || thrown === null) return undefined",
     '  const said = (thrown as { readonly because?: unknown }).because',
@@ -110,59 +123,88 @@ export const dispatched = (reached) => [
     '  return held',
     '}',
     '',
-    'const bound = (word: string, wired: Reached[string], seams: Seams): Record<string, unknown> | string => {',
+    'const bound = (word: string, wired: Reached[string], opened: Reaches, opening: Vault | undefined, within: number): Record<string, unknown> | string => {',
+    '  const reached = opened[word]',
+    '  const { reach } = wired',
+    '  if (' + asked(ANSWERS) + ') {',
+    '    const held = reached',
+    '    if (held === undefined) {',
+    "      return word + ' is a disk this operation requires, and this dispatch was handed none under that name. The disk under this process is written in by thread capabilities; one at the other end of a connection is handed in by whoever opened it'",
+    '    }',
+    '    return held as unknown as Record<string, unknown>',
+    '  }',
+    '  if (' + asked(KEEPS) + ') {',
+    '    if (reached === undefined) {',
+    "      return word + ' keeps rows for this app, and this dispatch was handed no store. A store is written in by thread capabilities, out of the target that keeps the entity'",
+    '    }',
+    '    return reached as unknown as Record<string, unknown>',
+    '  }',
+    '',
     '  const names = Object.keys(wired.calls)',
     '  if (names.length === 0) {',
     '    return `\\`${word}\\` is required and takes no call, so there is nothing to hand a node. Declare one with \\`thread create target call\\``',
     '  }',
-    '  if (seams.http === undefined) {',
-    '    return `\\`${word}\\` is reached over ${wired.reach} and the seams this dispatch was handed hold no \\`http\\` — wire one, or take \\`${word}\\` off that operation\'s row`',
+    '  if (' + asked(RUNS) + ') {',
+    '    const held = reached',
+    '    if (held === undefined) {',
+    "      return word + ' is a program this operation requires, and this dispatch was handed none under that name. A program is written in by thread capabilities, out of the calls declared beside the target'",
+    '    }',
+    '    const out: Record<string, unknown> = {}',
+    '    for (const name of names) {',
+    '      const doing = (held as unknown as Record<string, unknown>)[name]',
+    "      if (typeof doing !== 'function') {",
+    "        return word + ' takes ' + name + ' and the program handed in under that name does not answer to it, so a node would be handed a word that does nothing'",
+    '      }',
+    '      out[name] = (args: readonly string[], shows?: boolean, sooner?: number, how?: unknown) => (doing as (a: readonly string[], s?: boolean, w?: number, h?: unknown) => unknown)(args, shows, sooner === undefined ? within : Math.min(sooner, within), how)',
+    '    }',
+    '    return out',
+    '  }',
+    '  if (reached === undefined) {',
+    "    return word + ' is reached over ' + wired.reach + ', and this dispatch was handed nothing to send an outward call through. thread capabilities writes that in; or take that word off the row that requires it'",
     '  }',
-    '  const wanted = [...(wired.address === null ? [] : [wired.address]), ...wired.sends.map((one) => one.secret)]',
-    '  if (wanted.length > 0 && seams.vault === undefined) {',
-    '    return `\\`${word}\\` needs ${wanted.join(\', \')} and the seams this dispatch was handed hold no \\`vault\\` to open them. A target is reached with what opens it or not at all`',
+    '  const wanted = [...wired.sends.map((one) => one.secret), ...wired.signs.map((one) => one.secret)]',
+    '  if (wanted.length > 0 && opening === undefined) {',
+    "    return word + ' needs ' + wanted.join(', ') + ' and this dispatch was handed no vault to open them. A target is reached with what opens it or not at all'",
     '  }',
     '  const out: Record<string, unknown> = {}',
     '  for (const name of names) {',
     '    const call = wired.calls[name]',
     '    if (call === undefined) continue',
-    '    out[name] = async (given?: { fills?: Readonly<Record<string, string | number>>; json?: unknown; body?: Uint8Array; contentType?: string }) => {',
-    '      const values = wanted.length === 0 ? {} : await seams.vault!.resolve(wanted)',
+    '    out[name] = async (given?: { fills?: Readonly<Record<string, string | number>>; json?: unknown; body?: Uint8Array; contentType?: string; told?: (said: unknown) => void }) => {',
+    "      const values = wanted.length === 0 ? {} : await opening!['resolve'](wanted)",
     '      const headers: Record<string, string> = {}',
+    '      for (const [name, value] of Object.entries(wired.headers)) headers[name] = value',
     '      for (const one of wired.sends) headers[one.header] = `${one.prefix}${values[one.secret] ?? \'\'}`',
     '      const body = given?.json === undefined ? given?.body : new TextEncoder().encode(JSON.stringify(given.json))',
-    '      return await seams.http!.call({',
+    '      for (const one of wired.signs) {',
+    "        const mac = createHmac('sha256', values[one.secret] ?? '').update(body ?? new Uint8Array()).digest('hex')",
+    '        headers[one.header] = one.prefix + mac',
+    '      }',
+    "      const send = reached as { call: (request: unknown, within?: number) => Promise<unknown> }",
+    "      return await send['call']({",
     '        target: word,',
-    '        address: wired.address === null ? \'\' : (values[wired.address] ?? \'\'),',
+    '        address: wired.address ?? \'\',',
     "        method: call.method as 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',",
     '        path: filled(call.path, given?.fills),',
     '        headers,',
     '        ...(body === undefined ? {} : { body, contentType: given?.contentType ?? \'application/json\' }),',
-    '      })',
+    '        ...(given?.told === undefined ? {} : { told: given.told }),',
+    '      }, within)',
     '    }',
     '  }',
     '  return out',
     '}',
     '',
-    'const given = (operation: Operation<unknown, string>, actor: Actor, seams: Seams): Record<string, unknown> | string => {',
-    '  const held: Record<string, unknown> = { actor }',
+    'const given = (operation: Operation<unknown, string>, actor: Actor, opened: Reaches, opening: Vault | undefined, telling: (said: unknown) => void): Record<string, unknown> | string => {',
+    '  const held: Record<string, unknown> = { actor, tell: telling }',
     '  for (const word of operation.requires) {',
-    '    const key = SUPPLY[word]',
-    '    if (key === undefined) {',
-    '      const wired = REACHED[word]',
-    '      if (wired === undefined) {',
-    '        return `\\`${operation.id}\\` requires \\`${word}\\`, and nothing here supplies it — what may be required is ${[...Object.keys(SUPPLY), ...Object.keys(REACHED)].join(\', \')}`',
-    '      }',
-    '      const reached = bound(word, wired, seams)',
-    "      if (typeof reached === 'string') return reached",
-    '      held[word] = reached',
-    '      continue',
-    '    }',
-    '    const seam = (seams as unknown as Record<string, unknown>)[key]',
-    '    if (seam === undefined) {',
-    '      return `\\`${operation.id}\\` requires \\`${word}\\`, and the seams this dispatch was handed hold no \\`${key}\\` — wire one, or take \\`${word}\\` off that operation\'s row. An operation does not run short of what it declared`',
+    '    const wired = REACHED[word]',
+    '    if (wired === undefined) {',
+    '      return `\\`${operation[\'id\']}\\` requires \\`${word}\\`, and this app declares no target by that name. An operation requires targets: declare one with \\`thread create target\\`, or take that word off its row`',
     '    }',
-    '    held[key] = seam',
+    '    const reached = bound(word, wired, opened, opening, operation.timeout)',
+    "    if (typeof reached === 'string') return reached",
+    '    held[word] = reached',
     '  }',
     '  return held',
     '}',
@@ -171,155 +213,56 @@ export const dispatched = (reached) => [
     '  operation: Operation<I, R>,',
     '  rawInput: unknown,',
     '  asking: Actor,',
-    '  seams: Seams,',
+    '  opened: Reaches,',
+    '  opening: Vault | undefined,',
+    '  counting?: Counting,',
+    '  telling?: (said: unknown) => void,',
     '): Promise<Result<unknown>> {',
     '  const id = operation.id',
     '  const who = person(asking)',
-    '  const run = who?.run ?? seams.random.uuid()',
-    '  const actor: Actor = { ...(who ?? ANONYMOUS), run }',
-    '  const span = seams.telemetry?.start(id, run, { ...actor })',
-    '',
-    '  const gates = { rate: seams.rateLimiter !== undefined, replay: seams.idempotency !== undefined, quota: seams.quotas !== undefined, telemetry: seams.telemetry !== undefined }',
-    '',
-    '  let hold: QuotaHold | null = null',
-    '  let granted: string | undefined',
-    '',
-    '  const sank = (what: string) => (thrown: unknown): void => {',
-    "    seams.log.write('error', id, actor, {",
-    '      [`${what}_failed`]: thrown instanceof Error ? thrown.message : String(thrown),',
-    '    })',
-    '  }',
-    '',
-    '  const settled = async (held: Result<unknown>, because?: string): Promise<Result<unknown>> => {',
-    "    const outcome: AuditOutcome = held.ok ? 'ok' : REFUSAL[held.code].outcome",
-    '    const detail = because === undefined ? {} : { because }',
-    '',
-    '    const reserved = hold === null ? null : operation.estimate',
-    '    let consumed: number | null = null',
-    '',
-    '    if (hold !== null) {',
-    '      const settling = held.ok ? hold.commit(operation.estimate) : hold.release()',
-    '      consumed = held.ok ? operation.estimate : 0',
-    '      hold = null',
-    "      await settling.catch(sank('quota'))",
-    '    }',
-    '',
-    "    seams.log.write(held.ok ? 'info' : 'warn', id, actor, {",
-    '      outcome,',
-    '      ...detail,',
-    "      access: { roles: actor.roles, entitlements: actor.entitlements, granted: granted ?? 'not reached' },",
-    '      quota: { meter: id, reserved, consumed },',
-    '      gates,',
-    '    })',
-    '    if (held.ok) span?.ok()',
-    '    else span?.error(outcome)',
-    '',
-    '    await seams.audit',
-    "      .append(actor, { action: id, outcome, subject: { type: 'operation', id }, ...detail })",
-    "      .catch(sank('audit'))",
-    '',
-    '    if (!held.ok) {',
-    '      const identity: FailureIdentity =',
-    '        held.errorCode === undefined || held.errorClass === undefined',
-    '          ? DEFS[held.code]',
-    '          : { code: held.errorCode, class: held.errorClass }',
-    '',
-    '      await seams.errors',
-    '        .record(actor, { code: identity.code, class: identity.class, action: id, ...detail })',
-    "        .catch(sank('errors'))",
-    '    }',
-    '',
-    '    return held',
-    '  }',
-    '',
-    '  const refused = (code: ResultCode, because?: string): Promise<Result<unknown>> =>',
-    '    settled(fail(code, REFUSAL[code].said, because), because)',
-    '',
-    '  const recorded = (began: number, ok: boolean, at: string | undefined, because?: string): void => {',
-    '    const took = seams.clock.now() - began',
-    '    const sections = {',
-    '      node: { at: at ?? null },',
-    '      audit: { actor, when: began },',
-    '      observability: { ms: took, ok, ...(because === undefined ? {} : { because }) },',
-    '    }',
-    '',
-    "    seams.log.write(ok ? 'info' : 'warn', id, actor, sections)",
-    '    seams.telemetry?.record?.({',
-    '      key: id,',
-    '      traceId: run,',
-    '      spanId: run,',
-    '      durationMs: took,',
-    '      ok,',
-    '      attrs: sections,',
-    '      actor,',
-    '      ...(at === undefined ? {} : { nodeId: at }),',
-    '      workflowId: id,',
-    '      ...(because === undefined ? {} : { error: because }),',
-    '    })',
-    '  }',
-    '',
+    '  const actor: Actor = who ?? ANONYMOUS',
     '  try {',
-    "    if (who === undefined) return await refused('denied', 'identity_invalid')",
-    '',
-    "    if (seams.rateLimiter !== undefined && !(await seams.rateLimiter.check(actor, id))) return await refused('rate_limited')",
-    '',
-    '    const replayed = seams.idempotency === undefined ? null : await seams.idempotency.check(actor.replay, id)',
-    "    if (replayed !== null && replayed !== undefined) return await settled(ok(replayed), 'replayed')",
-    '',
+    "    if (who === undefined) return fail('denied', REFUSAL['denied'], 'identity_invalid')",
     '    const parsed = operation.input.safeParse(rawInput)',
     '    if (!parsed.success) {',
-    "      return await refused('invalid', parsed.error.issues.map((one) => one.message).join('; '))",
+    "      return fail('invalid', REFUSAL['invalid'], String(parsed['error']))",
     '    }',
-    '',
-    '    if (seams.quotas) {',
-    '      const reserved = await seams.quotas.reserve(actor, id, operation.estimate)',
-    "      if (!reserved.ok) return await refused('quota_exceeded', reserved.behavior ?? 'block')",
-    '      hold = reserved',
-    '    }',
-    '',
-    '    if (seams.permits === undefined) {',
-    "      return await refused('denied', 'no permits check is wired, so nothing can permit this operation')",
+    '    const { resource } = operation',
+    '    const ruled = permits(actor, id, resource(parsed[\'data\']))',
+    '    const { allow, because: why } = ruled',
+    "    if (!allow) return fail('denied', REFUSAL['denied'], why)",
+    '',
+    '    const { entitled } = operation',
+    '    if (entitled !== undefined && !actor.entitlements.includes(entitled)) {',
+    "      return fail('feature_denied', REFUSAL['feature_denied'], id + ' is offered on ' + entitled + ', which this caller does not hold')",
     '    }',
     '',
-    '    const ruled = await seams.permits.check(actor, id, operation.resource(parsed.data))',
-    "    if (!ruled.allow) return await refused('denied', ruled.because)",
-    '    granted = ruled.because',
+    "    const limited = await allowance(id, actor, counting, operation.rate, 'rate_limited')",
+    '    if (limited !== undefined) return limited',
+    "    const over = await allowance(id, actor, counting, operation.quota, 'quota_exceeded')",
+    '    if (over !== undefined) return over',
     '',
-    '    const hands = given(operation as Operation<unknown, string>, actor, seams)',
-    "    if (typeof hands === 'string') return await refused('error', hands)",
+    '    const handed = given(operation as Operation<unknown, string>, actor, opened, opening, telling ?? (() => undefined))',
+    "    if (typeof handed === 'string') return fail('error', REFUSAL['error'], handed)",
     '',
     '    const held: { readonly input: I } & Record<string, unknown> = { input: parsed.data }',
-    '    const began = seams.clock.now()',
-    '    let value: unknown',
-    '    try {',
-    '      value = await operation.run(hands as Handed<R>, held)',
-    '    } catch (thrown) {',
-    '      recorded(began, stopped(thrown) !== undefined, marked(thrown), thrown instanceof Error ? thrown.message : String(thrown))',
-    '      throw thrown',
-    '    }',
-    '    recorded(began, true, undefined)',
-    '',
-    "    if (seams.idempotency !== undefined) await seams.idempotency.store(actor.replay, id, value).catch(sank('idempotency'))",
-    '',
-    '    return await settled(ok(value))',
+    '    const value = await operation.run(handed as Opened<R>, held)',
+    '    return ok(value)',
     '  } catch (thrown) {',
     '    const early = stopped(thrown)',
     '    if (early !== undefined) {',
-    "      if (seams.idempotency !== undefined) await seams.idempotency.store(actor.replay, id, early.value).catch(sank('idempotency'))",
-    "      return await settled(ok(early.value), 'stopped')",
+    '      return ok(early[\'value\'])',
     '    }',
     '',
     '    const message = thrown instanceof Error ? thrown.message : String(thrown)',
     '',
     "    if (named(thrown, 'VersionConflictError')) {",
-    "      return await settled(fail('invalid', message, 'version_conflict', CONFLICT), 'version_conflict')",
+    "      return fail('invalid', message, 'version_conflict', CONFLICT)",
     '    }',
     '',
     "    const code: ResultCode = named(thrown, 'ValidationError') ? 'invalid' : 'error'",
     '    const because = platform(thrown) ?? message',
-    '    return await settled(fail(code, message, because), because)',
-    '  } finally {',
-    '    span?.end()',
+    '    return fail(code, message, because)',
     '  }',
     '}',
     '',