@sanoma-ai/workflows 0.7.1 → 0.8.1

package/README.md

@@ -59,7 +59,9 @@ A model connector attaches a model half, as `model`: `withSetup(connector, { mod
 
 A git host's connector attaches a remote half, as `remote`: `withSetup(connector, { remote: () => half })`, a `RemoteHalf` made once per resolved config and kept in `ResolvedConfig.remotes` by vendor; `remoteFor(remotes, url)` finds the one whose `matches` reads a clone URL, with the repository. `open(repo, { secrets })` gives a `SourceHost`: the repository's pull requests (find, open, squash-merge at a head, close), the `sanoma` commit status, and `enforcement(base)`, whether the host refuses a change to the branch that is not a merge (`HostEnforcement`); its `token(prefer)` is what a push signs in with. `webhook(request, { secrets })` verifies a delivery and says what happened (`RemoteEvent`: a branch pushed, a pull request closed). It reads its tokens through `secrets` when called, as a model half does. One vendor's connectors attach one `remote`. [`@sanoma-ai/connector-github`](https://www.npmjs.com/package/@sanoma-ai/connector-github#remote-half) is one.
 
-A config names the workflows and the connectors:
+`SanomaClient.remoteEvent(event, { by })` does what a webhook says happened (the app's `POST /webhooks/<vendor>` calls it for each event), for the repository of the client's `source` (`SanomaClient.connect(config, { source })`, as the worker's): an event of another repository, or with no source, is ignored. A push to `main` starts apply on the declared hosts (`ResolvedConfig.hosts()`) as the runtime's agent `host-check`, as the run `deploy:<head>`, so a merge made outside Sanoma deploys too: nothing without a host, nor while a change is merging or deploying, which applies `main` itself, nor when the checkout cannot follow `main` first (warned: a redelivery deploys it). A push to `draft/<id>` while the change of `id` is open brings the host's commits into the draft (`Source.follow` on its branch, a fast-forward) and tells the change `commits`; a closed pull request of `draft/<id>` tells it `merged` (with the merge commit) or `closed`, as `by`. The change run checks a merge or a close on the host before it believes it. A delivery repeated does nothing more: the run id, a draft already at the head, and the event's key (`changeEvent`'s `key`, an idempotency key of its message) see to it. `by` is not the Publish approval's approver, so it withdraws nothing: a change waiting on Publish reads the event when Publish is decided.
+
+A config names the connectors, and the workflows when no launcher finds them (`sanoma` imports every file of `workflows/` and of each [app's](#apps), so a company's config lists none; one it lists is kept, once):
 
 ```ts
 import { defineConfig } from "@sanoma-ai/workflows";
@@ -73,10 +75,10 @@ export default defineConfig({
 That is the whole config; the rest is convention, from its `root` (`defineConfig`'s call site's directory, or `root` where that is not the source's, as in a bundle). Three conventions give what a config no longer says:
 
 - **The app's name** is the `name` in `<root>/package.json`, kept whole (`@acme/ops`), when that file exists and names one; otherwise, and for a config with no root, it is `"sanoma"`. Only the root's own file counts, never one above it, so a parent project's name never becomes the app's; a `package.json` that is not JSON is refused, naming it. The name scopes the app's runs, queues and versions in its database.
-- **The [scenarios](#scenarios-and-sandbox-runs)** are `<root>/scenarios/` when that is a directory; otherwise the config has none.
-- **The [policy](#policies)** is `<root>/policies/**/*.cedar`, decided as the [people](#people) the data files declare; without any, every call and start is allowed (`allowAll`).
+- **The [scenarios](#scenarios-and-sandbox-runs)** are the `.feature` files of `<root>/scenarios/` and of each [app's](#apps) `scenarios/`, named by their path from the root (`scenarios/x.feature`, `apps/crm/scenarios/y.feature`); without any such directory the config has none.
+- **The [policy](#policies)** is `<root>/policies/**/*.cedar` and each [app's](#apps) `policies/**/*.cedar`, decided as the [people](#people) the data files declare; without any, every call and start is allowed (`allowAll`).
 
-The [data files](#data-files) are `resources/` in the root. `ledger` and `databaseUrl` are the only other fields. `drivers`, `fakes`, `appName`, `scenarios` and `policy` are typed `never` on `SanomaConfig`, each deprecated with where it went, so the compiler and the editor say so; an untyped config that still names `drivers` or `fakes` is refused at run time rather than run live on what it no longer reads, and one that names `policy` rather than run allowing everything.
+The [data files](#data-files) are `resources/` in the root and in each [app](#apps). `ledger` and `databaseUrl` are the only other fields. `drivers`, `fakes`, `appName`, `scenarios` and `policy` are typed `never` on `SanomaConfig`, each deprecated with where it went, so the compiler and the editor say so; an untyped config that still names `drivers` or `fakes` is refused at run time rather than run live on what it no longer reads, and one that names `policy` rather than run allowing everything.
 
 The audit record goes to the ledger, by default `postgresLedger(databaseUrl)` on the config's database (see [Ledger](#ledger)); `ledger: jsonlLedger(dir)` keeps it in files instead, and `memoryLedger()` in this process only, for tests. `resolveConfig(config)` checks a config and derives what the runtime uses from it: the app name, database, version and queue (`sanoma:<appName>`, for every run, [sandbox runs](#scenarios-and-sandbox-runs) included), the operations by id, the driver each vendor's connector attaches, made once for the resolution (`driversByVendor`, in `connectors` order, and their functions by operation id, `drivers`), the makers of their fakes (`fakes`, by vendor), the scenarios directory, the policy (`policy`, the policies it is made from as `policies`, and what is wrong in them as `policyProblems`), and the config's `ledger` when it gives one; it opens nothing and reads no file outside the root: its `package.json`, whether `scenarios/` is a directory, and the policies with the people files. It throws, with one message, whatever the worker would refuse: a workflow or driver naming an operation the `connectors` don't declare, a workflow redeclaring an operation with another effect, an operation with no driver (`` `shop.order.refund` has no driver: the connector package must attach one ``), two different drivers or fakes for one vendor, two workflows with one name, a `ledger` that is not a store, a `drivers`, `fakes` or `policy` an untyped config still names. `startWorker`, `SanomaClient.connect` and `describeConfig` all call it, so they fail the same way. `resolveConfig(config, { fakes: "instance" })` runs the whole instance on the connectors' fakes, as a [demo](#demos) does: each vendor's fake is made once for the resolution (`instanceFakes`, by vendor) and is its driver, so live runs, sandbox runs and direct calls all call it; the collections stay on the database, and a vendor whose connector attaches a driver and no fake is refused, since it would run live. A worker and a client share such a resolution when given it (`startWorker(config, { resolved })`, `SanomaClient.connect(config, { resolved })`), and its `dataStore` is then the caller's to close. It adds the built-in [`drift`](#drift) and [`apply`](#apply) workflows when the connectors declare resource types, and [`call`](#direct-calls) when an operation may be called directly. The worker takes each operation's effect, schemas and retry setting from `connectors`, never from the workflow.
 
@@ -112,6 +114,16 @@ const run = await client.run(runId); // run.status: "queued" | "running" | "wait
 
 The worker, the client and the app find Postgres at the config's `databaseUrl`, else the `SANOMA_DATABASE_URL` environment variable, else `postgresql://postgres:dbos@localhost:5433/sanoma`, the database `pnpm db:up` starts from this repo's docker compose file. The `sanoma` launcher always sets `SANOMA_DATABASE_URL`: when none is named it starts the company's own Postgres ([sanoma's Postgres](../sanoma/README.md#postgres)). Set one of the first two anywhere but on your own machine.
 
+### Apps
+
+A company's apps are the folders of `apps/`, each holding what the root does: `workflows/`, `resources/` (its `data.ts` too), `policies/`, `scenarios/` and `sites/`. An app is merged into the repo from a source repository, or made there; its `app.ts` says which, `export default defineApp({ source: "https://github.com/acme/crm" })` (`defineApp({})` for the company's own), read with oxc and never run, as `readApps(root)` reads each (`AppEntry`, `{ name, dir, source? }`, by name). A folder's name is the app's (`APP_NAME`: a lowercase letter, then lowercase letters and digits); `describeConfig` refuses another as a problem, and lists the apps as `apps`.
+
+What an app's folder declares is named with the folder, from where its file is (`appOfFile`: the nearest directory with a `sanoma.config.ts`, then `apps/<app>/`), never written: a collection `customers` in `apps/crm/resources/data.ts` is `crm.customers`, its operations `data.crm.customers.get` and so on, and a workflow `follow-up` in `apps/crm/workflows/` is `crm.follow-up`, each with `app: "crm"`; what the root declares keeps its name. So two apps may declare one name. A file is an app's while the nearest directory above it with a `sanoma.config.ts` is the company's root (an app may keep its own `package.json`; a `node_modules` ends the search). A workflow calls an app's collection as `ctx.data.crm.customers.get(…)`, and a site as `api.data.crm.customers.list()`; an app's workflow is `api.crmFollowUp` (`apiNameOf`), and its Cedar action `workflow:crm.follow-up`. A site in `apps/crm/sites/pipeline/` is `crm/pipeline`, at `/sites/crm/pipeline`. `describeConfig`'s workflows, collections and sites carry their `app`.
+
+The people are the company's: an app's data files declare none (`readPeople` refuses one, naming its file). A workflow may import the root's `resources/data.ts` and any app's. A relative import from one app's files into another's folder is a warning (`crossAppImports(root, apps)`, from `@sanoma-ai/workflows/describe`, which `sanoma check` prints), since a company may take one app without the other: reach the other through `ctx` or `api` instead. A collection or site at the root named as an app is a problem: `api.data.<app>` and `/sites/<app>/` are the app's.
+
+Taking an app is a git merge into a draft of the company's `Source` (the `sanoma` package's `localGitSource`). `draft.take({ url, ref?, folder?, author })` fetches the source repository, a public company repo holding one `apps/<folder>/` (`folder` names it when it holds more), by https alone, and merges it with its history as one merge commit. `draft.update({ folder, author })` merges the new commits of the default branch of the URL the app's `app.ts` names, and `source.behind(folder)` counts them, fetched now (both refuse a source that shares no history with the checkout). Either merge takes `apps/<folder>/` (a take, the source's folder whole) and `package.json` (its connectors, both sides kept); every other file stays the company's, as does a file one side deleted, since the source's root is the starter's. Both return an `AppMerge` (`{ folder, revision, merged, conflicts }`): a line both sides changed is committed with git's markers (diff3: ours, the base, theirs) and its file named in `conflicts`, so the draft's checks fail until the agent resolves it. An update needs the take's merge commit in the history: a draft that takes an app is merged into `main` as a merge, not squashed.
+
 ### People
 
 People, groups and agents are resources of the built-in `sanoma` connector, declared in a [data file](#data-files) (`resources/people.ts` by convention) and read without running it:
@@ -151,7 +163,7 @@ permit (principal == Sanoma::Principal::"anonymous", action == Sanoma::Action::"
 - **The schema**, namespace `Sanoma`: `Principal` in `Group` (an enum of the declared groups, `agents` and `visitors`, so a misspelt group fails validation), with `onBehalfOf`; each operation's id an action in its effect's group (`effect:money`), on a `Target` (its `target`, else its id; a collection's in `Collection::"<name>"`), with `context.input` from its input schema and, for a collection's save or delete, `context.before`; `sanoma.change.merge` on a `Change` instead, whose attributes are the change's facts; `workflow:<name>` in the group `start`, on a `Workflow`, with the run's input. `schemaText` prints it; the `sanoma` bin writes it to `.sanoma/schema.cedarschema`.
 - **A hold** is a `forbid` with `@hold("<group>" | "<person id>" | "on-behalf-of")`: the call waits for that approver (`on-behalf-of`: whom the agent acts for), with `@title` as the approval's title. The runtime lifts it once an approval addressed to that approver and covering the operation is approved (`approvedFor`), so a workflow's own `ctx.approval` to the same approver, covering the operation, lets it through. Several holds on one call or start are asked one at a time, in the order written: once one is approved, the policy is asked again. **A deny** is a `forbid` without `@hold`, with `@reason` as its message (else `Refused by <id>`). A policy's id is its `@id`, else `<file>#<n>`; a decision's `reasons` carry the ids into the ledger.
 - **Where it runs**: before every operation call, a run's node, a [direct call](#direct-calls) and [apply](#apply)'s changes (`decideCall`), and before a run starts (see [Approvals](#approvals)). `policy.preview(requests)` asks the same with the input unknown, through Cedar's partial evaluation: `allow`, `hold` with its approver, `deny`, or `depends` on the input, each with the rule behind it; the app's run form and Permissions page show it. A request with `inRun: true` asks about an operation inside a run, not a direct call, which only a visitor's answer tells apart.
-- **A change** to the company's repository is decided on its merge, `sanoma.change.merge`, one of four operations of the built-in connector `sanoma` (`changeOps`: `sanoma.change.open`, `.review`, `.merge` and `.close`, effect `write`) that every config has and only the built-in `change` workflow may call, so a policy names it in every repo. Its resource is a `Sanoma::Change` whose attributes are the facts of the change (`ChangeFacts`): `touches` (each path it edits and each parent directory, `touchesOf`: `resources/`, `resources/finance/`, `resources/finance/cards.ts`), `strandedRuns` and `stranded` (the waiting runs of a workflow it edits), `checksOk` and `rules`. Cedar has no quantifier over a set and `like` reads one string, so a rule asks `contains` of a directory: `forbid (principal, action == Sanoma::Action::"sanoma.change.merge", resource is Sanoma::Change) when { resource.touches.contains("resources/finance/") } unless { principal in Sanoma::Group::"finance" };`. A preview asks with the facts unknown: a rule on any change holds, a rule on the facts depends. Before any policy, the runtime's own rule (`runtimeHold`): a merge of a change to the rules (`rules`: a policy or a people file) waits for the group `admin`, with the reason `sanoma:rules-wait-for-admin`, under `allowAll` too, and is denied while no data file declares `admin`; the people are the running instance's, so a change cannot add its author to `admin`. The company's policy is asked once an approval addressed to `admin` covering the merge lifts it. The template's `policies/changes.cedar` holds every change for `admin`.
+- **A change** to the company's repository is decided on its merge, `sanoma.change.merge`, one of four operations of the built-in connector `sanoma` (`changeOps`: `sanoma.change.open`, `.review`, `.merge` and `.close`, effect `write`) that every config has and only the built-in `change` workflow may call, so a policy names it in every repo. The connector's fifth operation, `sanoma.apps.list` (`APPS_LIST`, a read), lists the apps on GitHub (the repositories with the topic `sanoma-app`) with Sanoma's claims about each (`claims.ts`: tier, review, blocked commits, the solutions holding it); a page calls it directly, as the person, so the policy decides it like any direct call, and every config has the built-in `call` workflow for it. Its resource is a `Sanoma::Change` whose attributes are the facts of the change (`ChangeFacts`): `touches` (each path it edits and each parent directory, `touchesOf`: `resources/`, `resources/finance/`, `resources/finance/cards.ts`), `strandedRuns` and `stranded` (the waiting runs of a workflow it edits), `checksOk` and `rules`. Cedar has no quantifier over a set and `like` reads one string, so a rule asks `contains` of a directory, and an app's files are under its own (`apps/crm/resources/`), which a rule on `resources/` does not cover: `forbid (principal, action == Sanoma::Action::"sanoma.change.merge", resource is Sanoma::Change) when { resource.touches.contains("resources/finance/") } unless { principal in Sanoma::Group::"finance" };`. A preview asks with the facts unknown: a rule on any change holds, a rule on the facts depends. Before any policy, the runtime's own rule (`runtimeHold`): a merge of a change to the rules (`rules`: a policy, the root's or an app's, or a people file) waits for the group `admin`, with the reason `sanoma:rules-wait-for-admin`, under `allowAll` too, and is denied while no data file declares `admin`; the people are the running instance's, so a change cannot add its author to `admin`. The company's policy is asked once an approval addressed to `admin` covering the merge lifts it. The template's `policies/changes.cedar` holds every change for `admin`.
 - **Problems** (a file that does not parse, two policies with one id, a template, what Cedar's strict validation finds, a `permit` for anyone but the visitors or `anonymous`, or with a `@hold`, a `@hold` naming no declared group or person, `visitors` among them) are `resolveConfig`'s `policyProblems`, one line each, `file:line:col: <policy id>: <message>`. While there are any, the policy refuses every call, start and preview ("The policies do not hold: …"): a repo never runs on part of its rules. `describeConfig(config).policy` carries them as `problems`; `startWorker` warns with them (unless `quiet`), `startApp` lists them and its pages say the policies do not hold, `sanoma check` reports them and runs no scenario, and the `sanoma` bin starts nothing.
 
 Later, not yet: the person's numeric GitHub id is stored but unused, so a login renamed and taken by someone else would be admitted as them. The app describes the config when it starts, so a person added while it runs shows in the who-are-you picker and the Permissions grid after a restart (login admits them at once). The Permissions grid asks about workflow starts and direct operations only, not the operations a run calls.
@@ -182,6 +194,19 @@ The policy decides a run's start too, as the action `workflow:<name>` with the i
 
 An approval that no longer stands, as when its change gets a new commit, is withdrawn: its `status` becomes `withdrawn`, with `withdrawnReason`, `withdrawnAt` and `withdrawnBy` (who, unless its run withdrew it), and the ledger gets `approval.withdrawn` with the same `reason` and `by`. `client.withdraw(runId, approvalId, reason, { by, timeoutSeconds? })` withdraws a pending one, as the run's starter or someone who may decide it (`not_approver` otherwise; a visitor never), and refuses as `decide` does (`already_decided` once it is not pending); the run reads the withdrawal as it would a decision (an `ApprovalWithdrawal` message, `{ withdraw: reason, by, id? }`, on the approval's topic), checks `by` again (refusing as `approval.refused` otherwise), sets `decidedWith`, and the call or `ctx.approval` waiting on it throws `WithdrawnError` (`approval_withdrawn`, with `approvalId` and `reason`); a held call records it as its failed `op.called`, as a rejection. A decision sent after it is `already_decided`. A built-in withdraws its own approved approvals of an operation from its body, so they lift no later hold on it.
 
+### Changes
+
+A change is how an edit to the company's repository goes live once the repository has a remote (`origin`): an agent's draft, reviewed and published in the app. Without a remote there is no change, and the draft's card says to merge its branch by hand.
+
+- **The draft.** A chat's edits are commits on the branch `draft/<id>` (the chat's id), in a checkout of its own under `.sanoma/drafts/<id>` (the `sanoma` package's `localGitSource`), never the live one. The chat's card lists the files and the result of `sanoma check` on the draft, and offers **Send for review** once something is committed and the checks pass.
+- **Send for review** starts the built-in `change` workflow on the draft, as the chat's person and titled as the chat (`SanomaClient.openChange({ id, title, page }, { startedBy })`; the run is `change:<id>`, and `change:<id>~2` for the draft's next change once that one has ended). Each round pushes the branch and opens its pull request into `main` (`sanoma.change.open`), runs `sanoma check` on the draft, with its Permissions grid, works out the facts the policy decides the merge on ([Policies](#policies)), asks the policy about the merge ahead, and sets the `sanoma` commit status on the head, linking the change's page (`sanoma.change.review`): pending, or failure while the checks fail or the policy denies. Then it asks one approval, **Publish the change**, covering `sanoma.change.merge`, of whom the policy's hold names, else of the person who drafted it. A deny waits instead, until something happens to the change.
+- **The review.** The app's Changes section, in the bar when the repository has a remote, lists the changes. A change's page shows where it is, its branch at the head it last planned, its pull request, the files it edits by kind, the Permissions grid of `main` against the branch's, and Publish. The Inbox shows Publish as any approval, with the change linked.
+- **New commits** on the draft start a new round at the new head. The agent tells the change after it commits, which withdraws Publish; a push to the branch on the host, told by its webhook, is read when Publish is decided, which then plans again instead of merging. An approval given in an earlier round lifts no hold on the new head.
+- **Publish**, approved, squash-merges the pull request at the head the round planned, titled `<title> (#<number>)`, sets the status to success and deletes the branch (`sanoma.change.merge`); a head that moved meanwhile is planned again, and a merge the host refuses waits. Then the deploy: the checkout follows `main` (a fast-forward, skipped while another branch is checked out, the checkout has uncommitted changes or its `main` has commits the remote's lacks), apply runs on the declared hosts as the run `<run>:deploy`, drift reads them back as `<run>:verify`, and the draft is closed. The page says Published, with the merge commit and what the deploy did. The change run outlives the deploy's restart of the worker on the merged code ([Versions](#versions)).
+- **Reject** on Publish closes the pull request and the change. A pull request merged on the host deploys as Publish does, and one closed there closes the change: the run checks either on the host before it believes it.
+- **Who publishes.** A change to the rules (a policy, the root's or an app's, or a people file) waits for `admin` whatever the policies say ([Policies](#policies)). A new company's `policies/changes.cedar` holds every other change for `admin` too; replace it with rules on the change's facts when another group should own part of the repository.
+- **The Permissions line.** Under the Permissions grid the app says what the repository's host enforces on `main` (`SourceHost.enforcement`): a pull request, and the `sanoma` check. Where it enforces neither (a private repository on GitHub Free), a push to `main` that does not go through Sanoma is neither reviewed nor decided by the policy.
+
 ### Calls run one at a time
 
 A run's ctx calls run one at a time, in program order. Even inside `Promise.all`, each call waits for the one before it to settle, so two calls a policy holds for approval are asked for one after the other. DBOS matches a replayed call to its recorded result by the order calls reach it, so calls left to race would replay out of step. A call that fails rejects its caller. The calls queued after it still run only if the workflow catches the failure and goes on; otherwise the body has ended, and each queued call is refused with `run_ended` (the run has ended, so the call is never made) instead of reaching its vendor, an approver or a sleep. Write calls one after another, as the workflow means them, and a fan-out with `ctx.all`.
@@ -262,7 +287,7 @@ Only declared fields are compared for drift, as CloudFormation does: `compareDec
 
 ### Collections
 
-A collection holds the company's own records, the state no vendor holds. `collection()`, from `@sanoma-ai/workflows/data` (`sanoma/data` in a company repo), declares one with plain values: a name (a lowercase letter, then letters and digits), its key, and typed fields. A company declares its collections in one file, `resources/data.ts`:
+A collection holds the company's own records, the state no vendor holds. `collection()`, from `@sanoma-ai/workflows/data` (`sanoma/data` in a company repo), declares one with plain values: a name (a lowercase letter, then letters and digits), its key, and typed fields. A company declares its collections in one file, `resources/data.ts` (and each [app](#apps) in its own, whose collections are named with the app):
 
 ```ts
 // resources/data.ts
@@ -439,6 +464,8 @@ A secret a resource needs is named, never written. A data file gives `secret("NA
 
 Every run is stamped with the application version of the worker that runs it, `<appName>@<version>`, and only a worker on that version recovers it after a restart. Versioning is automatic: the version is a hash of each workflow's name, the source of its `run` function, its operations and its input schema, which is DBOS's own scheme applied to the workflow code rather than to the runtime's registration wrapper (DBOS would otherwise see one identical function for every workflow and never change). The hash cannot see functions `run` calls that live elsewhere, op schemas, drivers or the policy: edit those with no run in flight, or restart on the old code first. To name a version instead (a git commit, say), set DBOS's `DBOS__APPVERSION` environment variable; it is prefixed with the app name the same way. A new version becomes the app's latest when it first starts, and runs queued without a version go to the latest; a worker started on an older version (a rollback) warns instead, unless started with `{ promote: true }`. The hash is of the code as it runs, so TypeScript source and the compiled JavaScript of the same workflow have different versions.
 
+Change runs are the exception: a change's own deploy restarts the worker on the merged code, a new version, so the run has to outlive its version. Each change run carries a hash of the change workflow's own code (its `changeCode` attribute: what the version hashes of the change workflow, with the runtime's and DBOS's versions, never the company's workflows), and a worker that starts as the app's latest version takes over the unfinished change runs of other versions whose hash is its own, keeping each run's id, its completed steps and the messages it has not read yet (an approval decided, an event told while no worker ran). It says so in one line at `info`. Runs of the company's workflows stay on their version, a change's `apply` and `drift` runs among them; so does a change run whose hash differs, after an upgrade of the runtime.
+
 When a worker starts, it warns about unfinished runs it will not pick up, naming them: runs started on another version, and runs queued on another queue. Run the version that started them, or fork each onto the current version with `DBOSClient.forkWorkflow(id, step, { applicationVersion, queueName })` and cancel the original.
 
 Queues used to be one `sanoma` queue for every app and are now `sanoma:<appName>`, so runs queued before the change are never started. Sandbox runs had their own queue, `sanoma:<appName>:sandbox`, until they went on the app's; the warning names the runs left on it, and a sandbox run forked or resumed past its seed step fails at once, so start its scenario again or cancel it. On a local database, `pnpm db:down && pnpm db:up` resets it.
@@ -604,7 +631,7 @@ A scenario with no `When`, in a feature none of whose scenarios has one, is a _w
 
 ### Demos
 
-A demo is a company repo run on its connectors' fakes, seeded from its scenarios. Resolve the config with `fakes: "instance"` and start the worker and the client on that one resolution, then `reseed(client, resolved)` from `@sanoma-ai/workflows/scenarios`: it empties `sanoma_data`, resets the instance's fakes, applies every world to the instance (its records saved through the collections' driver, its vendor objects and calls into the instance's fakes; a fault is refused, since every run shares them), and starts each moment as a sandbox run by its person, undriven, so its first approval waits in the Inbox. A sandbox run on such an instance seeds and calls the instance's fakes and the collections' table, not fakes of its own. `reseed` resolves to a `DemoState`, `{ seededAt, worlds, moments, problems }`, each moment with its `person`, `path`, `scenario` and `runId`, and a line in `problems` for each feature file that did not load and each world or moment that failed while the rest went on; `demoState(resolved)` is the last one, for a banner. The runs of earlier moments are left as they are.
+A demo is a company repo run on its connectors' fakes, seeded from its scenarios. Resolve the config with `fakes: "instance"` and start the worker and the client on that one resolution, then `reseed(client, resolved)` from `@sanoma-ai/workflows/scenarios`: it empties `sanoma_data`, resets the instance's fakes, applies every world to the instance (its records saved through the collections' driver, its vendor objects and calls into the instance's fakes; a fault is refused, since every run shares them), and starts each moment as a sandbox run by its person, undriven, so its first approval waits in the Inbox. A sandbox run on such an instance seeds and calls the instance's fakes and the collections' table, not fakes of its own. `reseed` resolves to a `DemoState`, `{ seededAt, worlds, moments, problems }`, each moment with its `person`, `path`, `scenario` and `runId`, and a line in `problems` for each feature file that did not load and each world or moment that failed while the rest went on; `demoState(resolved)` is the last one, for a banner. Before it seeds, it cancels every run of the app that has not ended (`client.cancelUnfinished()`), the last seed's moments among them, so only the new ones wait. `reseed(client, resolved, { only })` seeds one half (`SeedHalf`): `"database"` (the runs cancelled, `sanoma_data` emptied, the worlds' collection records, the moments started) or `"memory"` (the instance's fakes reset, the worlds' vendor objects and calls), so a process over a copy of a seeded database fills its own fakes with `only: "memory"`. A demo's app does all of this itself: `startApp(config, { demo: true })`, which `sanoma demo` runs ([the app's Demo](../app/README.md#demo)); the config's `demo.start` is the URL its banner's "Start with these apps" opens.
 
 ```ts
 const resolved = resolveConfig(config, { fakes: "instance" });

package/dist/apps-list.d.ts

@@ -0,0 +1,90 @@
+import { z } from "zod";
+import { type Claims } from "./claims.ts";
+/** The topic a source repository carries so the listing finds it. */
+export declare const APP_TOPIC = "sanoma-app";
+/** GitHub's REST API, searched without a token (so rate-limited: ten searches a minute per address). */
+export declare const GITHUB_API = "https://api.github.com";
+/** An app's source on GitHub, with what Sanoma claims about it. */
+export declare const AvailableApp: z.ZodObject<{
+    repo: z.ZodString;
+    url: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    license: z.ZodOptional<z.ZodString>;
+    tier: z.ZodEnum<{
+        community: "community";
+        official: "official";
+        "vendor-verified": "vendor-verified";
+    }>;
+    reviewed: z.ZodBoolean;
+    blocked: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    solutions: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        demo: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AvailableApp = z.infer<typeof AvailableApp>;
+/** The apps found, Sanoma's first; `error` says why there are none when GitHub could not be searched. */
+export declare const AvailableApps: z.ZodObject<{
+    apps: z.ZodArray<z.ZodObject<{
+        repo: z.ZodString;
+        url: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        license: z.ZodOptional<z.ZodString>;
+        tier: z.ZodEnum<{
+            community: "community";
+            official: "official";
+            "vendor-verified": "vendor-verified";
+        }>;
+        reviewed: z.ZodBoolean;
+        blocked: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        solutions: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodString;
+            demo: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AvailableApps = z.infer<typeof AvailableApps>;
+/** The built-in `sanoma.apps.list` (`APPS_LIST`), which `resolveConfig` registers in every config with its driver. */
+export declare const appsListOps: import("./op.ts").Connector<"sanoma", {
+    readonly apps: {
+        readonly list: {
+            readonly effect: "read";
+            readonly idempotent: true;
+            readonly description: "List the apps on GitHub (the topic sanoma-app), with Sanoma's claims about each";
+            readonly input: z.ZodObject<{}, z.core.$strip>;
+            readonly output: z.ZodObject<{
+                apps: z.ZodArray<z.ZodObject<{
+                    repo: z.ZodString;
+                    url: z.ZodString;
+                    description: z.ZodOptional<z.ZodString>;
+                    license: z.ZodOptional<z.ZodString>;
+                    tier: z.ZodEnum<{
+                        community: "community";
+                        official: "official";
+                        "vendor-verified": "vendor-verified";
+                    }>;
+                    reviewed: z.ZodBoolean;
+                    blocked: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    solutions: z.ZodArray<z.ZodObject<{
+                        id: z.ZodString;
+                        title: z.ZodString;
+                        demo: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strip>>;
+                }, z.core.$strip>>;
+                error: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+        };
+    };
+}>;
+/** The driver of `sanoma.apps.list`: GitHub's search, now. */
+export declare const appsListDriver: import("./op.ts").Driver;
+/**
+ * The repositories GitHub finds with the topic `sanoma-app`, not archived, the first hundred, each with what
+ * `from` claims about it (the claims by default), official first, then by name. A repository
+ * GitHub describes otherwise than expected is left out. When GitHub cannot be searched the list
+ * is empty, and says why.
+ */
+export declare function availableApps(from?: Claims): Promise<AvailableApps>;

package/dist/apps-list.js

@@ -0,0 +1,109 @@
+import { z } from "zod";
+import { appClaim, appTier, claims, TIERS } from "./claims.js";
+import { defineConnector, defineDriver } from "./op.js";
+import { errorMessage } from "./shared.js";
+// The apps a company could take: GitHub's repositories with the topic `sanoma-app`, read when
+// asked and never stored, joined with Sanoma's claims (`claims.ts`). One built-in read operation,
+// `sanoma.apps.list`, which the app's Apps page and a public site's pages both call (`isDirect`
+// admits it), under the policy as the person asking.
+/** The topic a source repository carries so the listing finds it. */
+export const APP_TOPIC = "sanoma-app";
+/** GitHub's REST API, searched without a token (so rate-limited: ten searches a minute per address). */
+export const GITHUB_API = "https://api.github.com";
+/** How long GitHub gets to answer, so a slow or absent network only empties the list. */
+const TIMEOUT_MS = 5_000;
+/** One repository of GitHub's search answer: what the list shows of it. */
+const Found = z.object({
+    full_name: z.string().regex(/^[\w.-]+\/[\w.-]+$/),
+    html_url: z.url({ protocol: /^https$/, hostname: /^github\.com$/ }),
+    description: z.string().nullish(),
+    license: z.object({ spdx_id: z.string().nullish() }).nullish(),
+});
+const Search = z.object({ items: z.array(z.unknown()) });
+/** An app's source on GitHub, with what Sanoma claims about it. */
+export const AvailableApp = z.object({
+    /** `<owner>/<repo>`, as GitHub names it. */
+    repo: z.string(),
+    /** Its page on GitHub, `https://github.com/<owner>/<repo>`: what `app.ts`'s `source` names once taken. */
+    url: z.string(),
+    description: z.string().optional(),
+    /** Its licence's SPDX id, when GitHub recognizes one. */
+    license: z.string().optional(),
+    /** Its claim's tier, else official for `Sanoma-AI`'s, else community (`appTier`). */
+    tier: z.enum(TIERS),
+    reviewed: z.boolean(),
+    /** Its commits Sanoma blocks. */
+    blocked: z.array(z.string()).optional(),
+    /** The solutions it is in, each with its demo's URL once that runs: where "Try it" goes. */
+    solutions: z.array(z.object({ id: z.string(), title: z.string(), demo: z.string().optional() })),
+});
+/** The apps found, Sanoma's first; `error` says why there are none when GitHub could not be searched. */
+export const AvailableApps = z.object({ apps: z.array(AvailableApp), error: z.string().optional() });
+/** The built-in `sanoma.apps.list` (`APPS_LIST`), which `resolveConfig` registers in every config with its driver. */
+export const appsListOps = defineConnector("sanoma", {
+    apps: {
+        list: {
+            effect: "read",
+            idempotent: true,
+            description: `List the apps on GitHub (the topic ${APP_TOPIC}), with Sanoma's claims about each`,
+            input: z.object({}),
+            output: AvailableApps,
+        },
+    },
+});
+/** The driver of `sanoma.apps.list`: GitHub's search, now. */
+export const appsListDriver = defineDriver(appsListOps, { apps: { list: () => availableApps() } });
+/** An app found, with what `from` claims about it. */
+function listed(found, from) {
+    const repo = found.full_name;
+    const claim = appClaim(repo, from);
+    const solutions = (claim?.solutions ?? []).flatMap((id) => {
+        const solution = from.solutions[id];
+        return solution ? [{ id, title: solution.title, ...(solution.demo.url && { demo: solution.demo.url }) }] : [];
+    });
+    return {
+        repo,
+        url: found.html_url,
+        ...(found.description && { description: found.description }),
+        ...(found.license?.spdx_id && found.license.spdx_id !== "NOASSERTION" && { license: found.license.spdx_id }),
+        tier: appTier(repo, from),
+        reviewed: claim?.reviewed ?? false,
+        ...(claim?.blocked?.length && { blocked: claim.blocked }),
+        solutions,
+    };
+}
+/** 1 for an official app, which the list shows first. */
+const official = (app) => Number(app.tier === "official");
+/**
+ * The repositories GitHub finds with the topic `sanoma-app`, not archived, the first hundred, each with what
+ * `from` claims about it (the claims by default), official first, then by name. A repository
+ * GitHub describes otherwise than expected is left out. When GitHub cannot be searched the list
+ * is empty, and says why.
+ */
+export async function availableApps(from = claims) {
+    const url = `${GITHUB_API}/search/repositories?q=${encodeURIComponent(`topic:${APP_TOPIC} archived:false`)}&per_page=100`;
+    let items;
+    try {
+        const res = await fetch(url, {
+            headers: { accept: "application/vnd.github+json", "user-agent": "sanoma", "x-github-api-version": "2022-11-28" },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!res.ok) {
+            await res.body?.cancel();
+            throw new Error(`${new URL(url).host} answered ${res.status} to ${new URL(url).pathname}`);
+        }
+        items = Search.parse(await res.json()).items;
+    }
+    catch (err) {
+        return { apps: [], error: `Could not search GitHub: ${errorMessage(err)}` };
+    }
+    return {
+        apps: items
+            .flatMap((item) => {
+            const found = Found.safeParse(item);
+            return found.success ? [listed(found.data, from)] : [];
+        })
+            .toSorted((a, b) => official(b) - official(a) || a.repo.localeCompare(b.repo, "en")),
+    };
+}
+//# sourceMappingURL=apps-list.js.map

package/dist/apps-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps-list.js","sourceRoot":"","sources":["../src/apps-list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAe,MAAM,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,8FAA8F;AAC9F,kGAAkG;AAClG,gGAAgG;AAChG,qDAAqD;AAErD,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;AACtC,wGAAwG;AACxG,MAAM,CAAC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AACnD,yFAAyF;AACzF,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB,2EAA2E;AAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/D,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzD,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,4CAA4C;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,0GAA0G;IAC1G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,yDAAyD;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,qFAAqF;IACrF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,iCAAiC;IACjC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,4FAA4F;IAC5F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;CACjG,CAAC,CAAC;AAGH,yGAAyG;AACzG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAGrG,sHAAsH;AACtH,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE;IACnD,IAAI,EAAE;QACJ,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,sCAAsC,SAAS,oCAAoC;YAChG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,MAAM,EAAE,aAAa;SACtB;KACF;CACF,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;AAEnG,sDAAsD;AACtD,SAAS,MAAM,CAAC,KAA4B,EAAE,IAAY;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChH,CAAC,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,aAAa,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5G,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QACzB,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK;QAClC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACzD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,QAAQ,GAAG,CAAC,GAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAI,GAAW,MAAM;IACvD,MAAM,GAAG,GAAG,GAAG,UAAU,0BAA0B,kBAAkB,CAAC,SAAS,SAAS,iBAAiB,CAAC,eAAe,CAAC;IAC1H,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,YAAY,EAAE,QAAQ,EAAE,sBAAsB,EAAE,YAAY,EAAE;YAChH,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,4BAA4B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK;aACR,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAChB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC,CAAC;aACD,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;KACvF,CAAC;AACJ,CAAC"}

package/dist/apps.d.ts

@@ -0,0 +1,42 @@
+import { type LintProblem } from "./ast.ts";
+/** An app: a folder of `apps/`, by its name, and the source repository its `app.ts` names. */
+export interface AppEntry {
+    /** The folder's name, which prefixes what it declares (`crm.contacts`) and is the app's title. */
+    name: string;
+    /** The folder, relative to the root, with `/`: `apps/crm`. */
+    dir: string;
+    /** `defineApp({ source })` in its `app.ts`: the repository it was taken from; absent for the company's own app. */
+    source?: string;
+}
+/** What `app.ts` declares: the source repository's URL, when the app was taken from one. */
+export interface AppDefinition {
+    source?: string;
+}
+/**
+ * Declares an app in its folder's `app.ts`, read without running it: `defineApp({ source:
+ * "https://github.com/acme/crm" })`, the repository it was taken from; `defineApp({})` for an app
+ * the company made itself.
+ */
+export declare function defineApp(definition: AppDefinition): AppDefinition;
+/** What is wrong with a company's apps, at a file relative to the root. */
+export type AppProblem = LintProblem & {
+    file: string;
+};
+/** The apps under `root` (`appsAt`), without what is wrong with them. */
+export declare const readApps: (root: string | undefined) => AppEntry[];
+/**
+ * The apps under `root`: each folder of `apps/` whose name is an `APP_NAME`, sorted, with what is
+ * wrong in its `app.ts` and each folder refused for its name as `problems`. `app.ts` is read
+ * with oxc, never run: its default export must be `defineApp({ … })`, from `sanoma`, written out,
+ * and `source` a string.
+ */
+export declare function appsAt(root: string | undefined): {
+    apps: AppEntry[];
+    problems: AppProblem[];
+};
+/**
+ * Each import, from a file under one app's folder, of a file under another's, at its place: a
+ * warning, since a company may take one app without the other. Static imports, re-exports and
+ * `import("…")` with a literal path; relative specifiers only.
+ */
+export declare function crossAppImports(root: string | undefined, apps: readonly AppEntry[]): AppProblem[];

package/dist/apps.js

@@ -0,0 +1,137 @@
+import { existsSync, readdirSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { childrenOf, readSource } from "./ast.js";
+import { keyName } from "./datafile.js";
+import { stringValue, unwrap } from "./outline.js";
+import { APPS_DIR, filesUnder, inside, isDirectory, RELATIVE } from "./paths.js";
+import { APP_NAME } from "./shared.js";
+/**
+ * Declares an app in its folder's `app.ts`, read without running it: `defineApp({ source:
+ * "https://github.com/acme/crm" })`, the repository it was taken from; `defineApp({})` for an app
+ * the company made itself.
+ */
+export function defineApp(definition) {
+    return Object.freeze({ ...definition });
+}
+/** The apps under `root` (`appsAt`), without what is wrong with them. */
+export const readApps = (root) => appsAt(root).apps;
+/**
+ * The apps under `root`: each folder of `apps/` whose name is an `APP_NAME`, sorted, with what is
+ * wrong in its `app.ts` and each folder refused for its name as `problems`. `app.ts` is read
+ * with oxc, never run: its default export must be `defineApp({ … })`, from `sanoma`, written out,
+ * and `source` a string.
+ */
+export function appsAt(root) {
+    const dir = root === undefined ? undefined : join(root, APPS_DIR);
+    if (dir === undefined || !isDirectory(dir))
+        return { apps: [], problems: [] };
+    const apps = [];
+    const problems = [];
+    const folders = readdirSync(dir, { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => d.name)
+        .toSorted();
+    for (const name of folders) {
+        const at = `${APPS_DIR}/${name}`;
+        if (!APP_NAME.test(name)) {
+            problems.push({
+                file: at,
+                line: 1,
+                column: 1,
+                message: `${at} is not an app: an app's folder name is a lowercase letter, then lowercase letters and digits`,
+            });
+            continue;
+        }
+        const read = appOptionsOf(join(dir, name, "app.ts"));
+        problems.push(...read.problems.map((p) => ({ file: `${at}/app.ts`, ...p })));
+        apps.push({ name, dir: at, ...(read.source !== undefined && { source: read.source }) });
+    }
+    return { apps, problems };
+}
+/** Where `defineApp` comes from in `app.ts`. */
+const APP_SOURCES = new Set(["sanoma", "@sanoma-ai/workflows"]);
+/** `app.ts`'s `source`, read without running it, and what is wrong there; nothing for no file. */
+function appOptionsOf(path) {
+    if (!existsSync(path))
+        return { problems: [] };
+    const file = readSource(path);
+    if (typeof file === "string")
+        return { problems: [{ line: 1, column: 1, message: file }] };
+    const problems = [...file.problems];
+    const problem = (at, message) => problems.push({ ...file.at(at.start), message });
+    const unread = 'app.ts is read without running it: its default export is `defineApp({ source })` from "sanoma", written out';
+    const exported = file.program.body.find((s) => s.type === "ExportDefaultDeclaration");
+    const call = unwrap(exported?.declaration);
+    const callee = unwrap(call?.callee);
+    const options = unwrap(call?.arguments?.[0]);
+    const defineApps = new Set();
+    for (const statement of file.program.body) {
+        if (statement.type !== "ImportDeclaration" || !APP_SOURCES.has(statement.source.value))
+            continue;
+        for (const s of statement.specifiers) {
+            if (s.type === "ImportSpecifier" && keyName(s.imported) === "defineApp")
+                defineApps.add(s.local.name);
+        }
+    }
+    const written = call?.type === "CallExpression" &&
+        callee?.type === "Identifier" &&
+        defineApps.has(callee.name) &&
+        (options === undefined || options.type === "ObjectExpression");
+    if (!written) {
+        problem(exported ?? file.program, unread);
+        return { problems };
+    }
+    const property = options?.properties.findLast((p) => p.type === "Property" && !p.computed && keyName(p.key) === "source");
+    const source = property && stringValue(property.value);
+    if (property && source === undefined)
+        problem(property, "`source` is read without running app.ts: write it as a string");
+    return { ...(source !== undefined && { source }), problems };
+}
+/** A source file under an app: `.ts` or `.tsx`, but a declaration. */
+const isSource = (name) => /\.tsx?$/.test(name) && !name.endsWith(".d.ts");
+/**
+ * Each import, from a file under one app's folder, of a file under another's, at its place: a
+ * warning, since a company may take one app without the other. Static imports, re-exports and
+ * `import("…")` with a literal path; relative specifiers only.
+ */
+export function crossAppImports(root, apps) {
+    if (root === undefined)
+        return [];
+    const warnings = [];
+    for (const app of apps) {
+        const own = join(root, app.dir);
+        for (const path of filesUnder(own, isSource)) {
+            const file = readSource(path);
+            if (typeof file === "string")
+                continue;
+            const rel = relative(root, path).split(sep).join("/");
+            const visit = (node) => {
+                if (!node)
+                    return;
+                const specifier = node.type === "ImportDeclaration" ||
+                    node.type === "ExportAllDeclaration" ||
+                    node.type === "ExportNamedDeclaration"
+                    ? node.source?.value
+                    : node.type === "ImportExpression"
+                        ? stringValue(node.source)
+                        : undefined;
+                if (typeof specifier === "string" && RELATIVE.test(specifier)) {
+                    const target = resolve(dirname(path), specifier);
+                    const other = apps.find((a) => a !== app && inside(join(root, a.dir), target));
+                    if (other) {
+                        warnings.push({
+                            file: rel,
+                            ...file.at(node.start),
+                            message: `imports "${specifier}" from the app ${other.name}: a company may take ${app.name} without it, so reach it through ctx or api instead`,
+                        });
+                    }
+                }
+                for (const child of childrenOf(node))
+                    visit(child);
+            };
+            visit(file.program);
+        }
+    }
+    return warnings;
+}
+//# sourceMappingURL=apps.js.map

package/dist/apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.js","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,UAAU,EAA+B,UAAU,EAAE,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAsBvC;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,UAAyB;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;AAC1C,CAAC;AAKD,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAwB,EAAc,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,IAAwB;IAC7C,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,QAAQ,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,EAAE;gBACR,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,GAAG,EAAE,+FAA+F;aAC9G,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,gDAAgD;AAChD,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,kGAAkG;AAClG,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC3F,MAAM,QAAQ,GAAkB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,EAAQ,EAAE,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAChG,MAAM,MAAM,GACV,6GAA6G,CAAC;IAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,SAAS;QACjG,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,WAAW;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GACX,IAAI,EAAE,IAAI,KAAK,gBAAgB;QAC/B,MAAM,EAAE,IAAI,KAAK,YAAY;QAC7B,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3B,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,CAAC,QAAQ,CAC3C,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,CACjF,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,QAAQ,IAAI,MAAM,KAAK,SAAS;QAClC,OAAO,CAAC,QAAQ,EAAE,+DAA+D,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED,sEAAsE;AACtE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB,EAAE,IAAyB;IACjF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,CAAC,IAAU,EAAE,EAAE;gBAC3B,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,KAAK,mBAAmB;oBACjC,IAAI,CAAC,IAAI,KAAK,sBAAsB;oBACpC,IAAI,CAAC,IAAI,KAAK,wBAAwB;oBACpC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK;oBACpB,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB;wBAChC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC1B,CAAC,CAAC,SAAS,CAAC;gBAClB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC/E,IAAI,KAAK,EAAE,CAAC;wBACV,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,GAAG;4BACT,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtB,OAAO,EAAE,YAAY,SAAS,kBAAkB,KAAK,CAAC,IAAI,wBAAwB,GAAG,CAAC,IAAI,qDAAqD;yBAChJ,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/call-workflow.js

@@ -2,10 +2,6 @@ import { z } from "zod";
 import { defineWorkflow } from "./define.js";
 import { isDirect } from "./direct.js";
 export { CALL_WORKFLOW } from "./shared.js";
-// The built-in `call` workflow: one operation that may be called directly (`isDirect`), as a run.
-// `SanomaClient.call` starts it, as the person, when the policy holds a direct call for an
-// approval, so the approval reaches the Inbox like any run's. It is a workflow like any other,
-// held to the same lint: the call goes through `ctx`, under the policy, in the ledger.
 /** The call workflow's input: the operation's id, and its input. */
 export const CallInput = z.object({ op: z.string(), input: z.unknown() });
 /**
@@ -27,8 +23,11 @@ export function callWorkflow(ops, drivers, types) {
         uses,
         // `ctx` refuses an operation that is not in `uses`: one that may not be called directly, or has no driver.
         run: async (ctx, input) => {
-            const [vendor = "", resource = "", name = ""] = input.op.split(".");
-            return ctx[vendor][resource][name](input.input);
+            // Four segments for an app's collection: `data.<app>.<collection>.<op>`.
+            const [vendor = "", a = "", b = "", c] = input.op.split(".");
+            return c === undefined
+                ? ctx[vendor][a][b](input.input)
+                : ctx[vendor][a][b][c](input.input);
         },
     });
 }

package/dist/call-workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"call-workflow.js","sourceRoot":"","sources":["../src/call-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA2B,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,kGAAkG;AAClG,2FAA2F;AAC3F,+FAA+F;AAC/F,uFAAuF;AAEvF,oEAAoE;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,GAA4B,EAC5B,OAAqC,EACrC,KAAmC;IAEnC,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;SAC3B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SACzD,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,cAAc,CAAC;QACpB,2GAA2G;QAC3G,IAAI,EAAE,MAAqC;QAC3C,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,SAAS;QAChB,IAAI;QACJ,2GAA2G;QAC3G,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpE,OAAO,GAAG,CAAC,MAAM,CAAE,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"call-workflow.js","sourceRoot":"","sources":["../src/call-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA2B,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAU5C,oEAAoE;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,GAA4B,EAC5B,OAAqC,EACrC,KAAmC;IAEnC,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;SAC3B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SACzD,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,cAAc,CAAC;QACpB,2GAA2G;QAC3G,IAAI,EAAE,MAAqC;QAC3C,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,SAAS;QAChB,IAAI;QACJ,2GAA2G;QAC3G,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxB,yEAAyE;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,SAAS;gBACpB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,KAAK,CAAC;gBACnC,CAAC,CAAE,GAAyF,CAAC,MAAM,CAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CACzG,CAAC,CACD,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/call.js

@@ -105,9 +105,12 @@ export function buildCtx(wf, run) {
     };
     const members = {};
     for (const op of uses.filter(isOp)) {
-        const vendor = (members[op.vendor] ??= {});
-        const resource = (vendor[op.resource] ??= {});
-        resource[op.name] = placed(op.id, (node, input) => serial(run, () => callOp(run, op.id, input, { node: node.path, name: named(node) ?? op.id })));
+        // By the id's segments: an app's collection, `data.crm.contacts.get`, is `ctx.data.crm.contacts.get`.
+        const group = op.id
+            .split(".")
+            .slice(0, -1)
+            .reduce((at, key) => (at[key] ??= {}), members);
+        group[op.name] = placed(op.id, (node, input) => serial(run, () => callOp(run, op.id, input, { node: node.path, name: named(node) ?? op.id })));
     }
     members.runId = run.id;
     members.now = () => serial(run, () => DBOS.now());