@prestack/thread 0.0.1 → 0.0.2

package/dist/integrations/generators/vault.js

@@ -16,14 +16,13 @@ import { named as packageOf } from "../../core/scope.js";
 import { findTree, inTree, strayFiles } from "../../core/tree.js";
 import { unclassified, valued } from "../secret.js";
 import { refusals, servesBrowser } from "../target.js";
-import { SEALED_AT } from "../vault.js";
+import { ALGORITHM, KEY_BYTES, KEY_NAME, SEALED_AT, SEALED_NAME, VAULT_DIR } from "../vault.js";
 const TREE = findTree();
 const AT = 'src/vault.ts';
 const here = (one) => relative(TREE.at, one).split('\\').join('/');
 const from = inTree(TREE, 'secrets.ts');
 const path = join(TREE.at, AT);
 const toward = relative(dirname(path), fileURLToPath(new URL('../vault.ts', import.meta.url))).split('\\').join('/');
-const opens = toward.startsWith('.') ? toward : `./${toward}`;
 const declares = relative(dirname(path), from).split('\\').join('/');
 const sheet = declares.startsWith('.') ? declares : `./${declares}`;
 function refuse(because) {
@@ -39,12 +38,43 @@ catch {
     refuse(`${here(from)} could not be read. Attach \`${packageOf('integrations')}\` first — an app states its secrets there.`);
 }
 const declared = secrets.map((one) => one.id).sort();
-const SOURCE = `import { opened } from '${opens}'
-
-import { SECRETS } from '${sheet}'
-
-export const vault = opened(process.cwd(), SECRETS.map((one) => one.id), process.env.NODE_ENV === 'production' ? 'production' : 'sandbox')
-`;
+const SOURCE = [
+    "import { createDecipheriv } from 'node:crypto'",
+    "import { existsSync, readFileSync } from 'node:fs'",
+    "import { join } from 'node:path'",
+    "",
+    `import { SECRETS } from '${sheet}'`,
+    "",
+    "const ENV = process.env.NODE_ENV === 'production' ? 'production' : 'sandbox'",
+    "",
+    "export async function vault(refs: readonly string[]): Promise<Readonly<Record<string, string>>> {",
+    "  if (refs.length === 0) return {}",
+    `  const at = join(process.cwd(), '${VAULT_DIR}', '${KEY_NAME}')`,
+    "  if (!existsSync(at)) throw new Error('there is no vault key at ' + at + ', and nothing here can open a sealed value without it.')",
+    "  const key = Buffer.from(readFileSync(at, 'utf8').trim(), 'base64')",
+    `  if (key.length !== ${String(KEY_BYTES)}) throw new Error('the vault key at ' + at + ' is not the size anything here was sealed under.')`,
+    `  const where = join(process.cwd(), '${VAULT_DIR}', '${SEALED_NAME}')`,
+    "  if (!existsSync(where)) throw new Error('there is no sealed store at ' + where + ', so no declared secret has a value yet.')",
+    "  const store = JSON.parse(readFileSync(where, 'utf8')) as Readonly<Record<string, Readonly<Record<string, string>> | undefined>>",
+    "  const known = SECRETS.map((one) => one.id)",
+    "  const out: Record<string, string> = {}",
+    "  for (const named of refs) {",
+    "    if (!known.includes(named)) throw new Error(named + ' is not a secret this app declares.')",
+    "    const sealed = store[named]?.[ENV]",
+    "    if (sealed === undefined) throw new Error(named + ' is declared and has no value sealed for ' + ENV + '.')",
+    "    const parts = sealed.split('.').map((one) => Buffer.from(one, 'base64'))",
+    "    const iv = parts[0]",
+    "    const tag = parts[1]",
+    "    const body = parts[2]",
+    "    if (iv === undefined || tag === undefined || body === undefined) throw new Error(named + ' is not three base64 parts.')",
+    `    const decipher = createDecipheriv('${ALGORITHM}', key, iv)`,
+    "    decipher.setAuthTag(tag)",
+    "    out[named] = decipher.update(body).toString('utf8') + decipher.final('utf8')",
+    "  }",
+    "  return out",
+    "}",
+    "",
+].join("\n");
 async function taken(file, list) {
     const at = inTree(TREE, file);
     if (!existsSync(at))
@@ -144,21 +174,23 @@ if (checking) {
             ...wrong.map((one) => `  ${one}`),
         ].join('\n'));
     }
-    if (!existsSync(path)) {
-        refuse(`${AT} is not there, and it is what opens this app's sealed values. Run \`thread vault\` — it seeds the file ` +
-            'once, and from then on it is yours.');
+    const current = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    if (current !== SOURCE) {
+        refuse(current === ''
+            ? `${AT} is declared and not on disk, and it is what opens this app's sealed values. Run \`thread vault\` and commit what it writes.`
+            : `${AT} is not what the secrets in ${here(from)} produce. A derived file that differs from its generator is a hand edit wearing a generated name. Run \`thread vault\` and commit what it writes.`);
     }
     stdout.write(`vault: ${AT} is seeded and opens ${opening}, read off ${here(from)} as they are declared.\n`);
     exit(0);
 }
-if (existsSync(path)) {
+if (existsSync(path) && readFileSync(path, 'utf8') === SOURCE) {
     stdout.write(`vault: ${AT} is already yours — it opens ${opening}, read off ${here(from)} as they are declared.\n`);
     exit(0);
 }
 mkdirSync(dirname(path), { recursive: true });
 writeFileSync(path, SOURCE, 'utf8');
-stdout.write(`vault: seeded ${AT} — what opens a secret's value at the moment of use, and yours from here.\n` +
+stdout.write(`vault: wrote ${AT} — what opens a secret's value at the moment of use.\n` +
     `  It opens the values sealed under ${SEALED_AT} for the secrets declared in ${here(from)}, and refuses every other name.\n` +
     '  `thread create secret` declares one and seals its value; nothing else ever takes a value.\n' +
-    '  To open values from somewhere else in production, replace opened here with what reads them.\n');
+    '  It imports nothing of this framework: what a host runs holds none of the scaffolding that assembled it.\n');
 exit(0);

package/dist/integrations/generators/vault.ts

@@ -0,0 +1,212 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join, relative } from 'node:path'
+import { argv, stderr, stdout } from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+import ts from 'typescript'
+
+import { exit } from '../../core/invoked.ts'
+import { named as packageOf } from '../../core/scope.ts'
+import { findTree, inTree, strayFiles } from '../../core/tree.ts'
+
+import { unclassified, valued, type Secret } from '../secret.ts'
+import { refusals, servesBrowser, type Call, type Target } from '../target.ts'
+import { ALGORITHM, KEY_BYTES, KEY_NAME, SEALED_AT, SEALED_NAME, VAULT_DIR } from '../vault.ts'
+
+const TREE = findTree()
+
+const AT = 'src/vault.ts'
+
+const here = (one: string): string => relative(TREE.at, one).split('\\').join('/')
+
+const from = inTree(TREE, 'secrets.ts')
+
+const path = join(TREE.at, AT)
+
+const toward = relative(dirname(path), fileURLToPath(new URL('../vault.ts', import.meta.url))).split('\\').join('/')
+
+const declares = relative(dirname(path), from).split('\\').join('/')
+
+const sheet = declares.startsWith('.') ? declares : `./${declares}`
+
+function refuse(because: string): never {
+  stderr.write(`vault: ${because}\n`)
+  exit(1)
+}
+
+let secrets: readonly Secret[] = []
+try {
+  const taken = (await import(new URL(`file://${from}`).href)) as { SECRETS?: readonly Secret[] }
+  secrets = taken.SECRETS ?? []
+} catch {
+  refuse(`${here(from)} could not be read. Attach \`${packageOf('integrations')}\` first — an app states its secrets there.`)
+}
+
+const declared = secrets.map((one) => one.id).sort()
+
+const SOURCE = [
+  "import { createDecipheriv } from 'node:crypto'",
+  "import { existsSync, readFileSync } from 'node:fs'",
+  "import { join } from 'node:path'",
+  "",
+  `import { SECRETS } from '${sheet}'`,
+  "",
+  "const ENV = process.env.NODE_ENV === 'production' ? 'production' : 'sandbox'",
+  "",
+  "export async function vault(refs: readonly string[]): Promise<Readonly<Record<string, string>>> {",
+  "  if (refs.length === 0) return {}",
+  `  const at = join(process.cwd(), '${VAULT_DIR}', '${KEY_NAME}')`,
+  "  if (!existsSync(at)) throw new Error('there is no vault key at ' + at + ', and nothing here can open a sealed value without it.')",
+  "  const key = Buffer.from(readFileSync(at, 'utf8').trim(), 'base64')",
+  `  if (key.length !== ${String(KEY_BYTES)}) throw new Error('the vault key at ' + at + ' is not the size anything here was sealed under.')`,
+  `  const where = join(process.cwd(), '${VAULT_DIR}', '${SEALED_NAME}')`,
+  "  if (!existsSync(where)) throw new Error('there is no sealed store at ' + where + ', so no declared secret has a value yet.')",
+  "  const store = JSON.parse(readFileSync(where, 'utf8')) as Readonly<Record<string, Readonly<Record<string, string>> | undefined>>",
+  "  const known = SECRETS.map((one) => one.id)",
+  "  const out: Record<string, string> = {}",
+  "  for (const named of refs) {",
+  "    if (!known.includes(named)) throw new Error(named + ' is not a secret this app declares.')",
+  "    const sealed = store[named]?.[ENV]",
+  "    if (sealed === undefined) throw new Error(named + ' is declared and has no value sealed for ' + ENV + '.')",
+  "    const parts = sealed.split('.').map((one) => Buffer.from(one, 'base64'))",
+  "    const iv = parts[0]",
+  "    const tag = parts[1]",
+  "    const body = parts[2]",
+  "    if (iv === undefined || tag === undefined || body === undefined) throw new Error(named + ' is not three base64 parts.')",
+  `    const decipher = createDecipheriv('${ALGORITHM}', key, iv)`,
+  "    decipher.setAuthTag(tag)",
+  "    out[named] = decipher.update(body).toString('utf8') + decipher.final('utf8')",
+  "  }",
+  "  return out",
+  "}",
+  "",
+].join("\n")
+
+async function taken<T>(file: string, list: string): Promise<readonly T[]> {
+  const at = inTree(TREE, file)
+  if (!existsSync(at)) return []
+  try {
+    const held = (await import(new URL(`file://${at}`).href)) as Record<string, readonly T[] | undefined>
+    return held[list] ?? []
+  } catch {
+    return []
+  }
+}
+
+function imported(at: string, text: string): readonly string[] {
+  const source = ts.createSourceFile(at, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX)
+  const found: string[] = []
+  const walk = (node: ts.Node): void => {
+    if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
+      const said = node.moduleSpecifier
+      if (said !== undefined && ts.isStringLiteral(said)) found.push(said.text)
+    } else if (ts.isCallExpression(node)) {
+      const first = node.arguments[0]
+      const dynamic = node.expression.kind === ts.SyntaxKind.ImportKeyword
+      const legacy = ts.isIdentifier(node.expression) && node.expression.text === 'require'
+      if ((dynamic || legacy) && first !== undefined && ts.isStringLiteral(first)) found.push(first.text)
+    }
+    ts.forEachChild(node, walk)
+  }
+  walk(source)
+  return found
+}
+
+function names(specifier: string, id: string): boolean {
+  const bare = specifier.replace(/\.(?:m|c)?[jt]sx?$/, '')
+  return bare === `operations/${id}` || bare.endsWith(`/operations/${id}`)
+}
+
+async function reaching(): Promise<readonly string[]> {
+  const targets = await taken<Target>('targets.ts', 'TARGETS')
+  const withheld = new Map<string, string>()
+  for (const one of targets) {
+    const said = servesBrowser(one, secrets)
+    if (said !== true) withheld.set(one.id, said)
+  }
+  if (withheld.size === 0) return []
+
+  const operations = await taken<{ readonly id: string; readonly requires?: readonly string[] }>('operations.ts', 'MEMBERS')
+  const risky = new Map<string, string>()
+  for (const one of operations) {
+    for (const word of one.requires ?? []) {
+      const said = withheld.get(word)
+      if (said !== undefined) risky.set(one.id, said)
+    }
+  }
+  if (risky.size === 0) return []
+
+  const found: string[] = []
+  for (const one of strayFiles(TREE.at, '', '.tsx')) {
+    let text: string
+    try {
+      text = readFileSync(join(TREE.at, one), 'utf8')
+    } catch {
+      continue
+    }
+    const specifiers = imported(one, text)
+    for (const [id, said] of risky) {
+      if (!specifiers.some((each) => names(each, id))) continue
+      found.push(
+        `${one} is a \`.tsx\` file and it imports \`${id}\`. ${said} This holds whoever bundles it — ` +
+          'a page is a page whether Next, Vite or anything else compiles it, so the refusal is about the ' +
+          'import rather than about any one build. Call it from a server and let the page ask the server',
+      )
+    }
+  }
+  return found
+}
+
+async function stated(): Promise<readonly string[]> {
+  const targets = await taken<Target>('targets.ts', 'TARGETS')
+  const calls = await taken<Call>('targets.ts', 'CALLS')
+  const entities = (await taken<{ readonly id: string }>('entities.ts', 'ENTITIES')).map((one) => one.id)
+  return [
+    ...unclassified(secrets),
+    ...valued(secrets),
+    ...refusals(targets, secrets, calls, entities),
+    ...(await reaching()),
+  ]
+}
+
+const checking = argv.includes('--check')
+
+const opening = `${String(declared.length)} declared secret(s)`
+
+if (checking) {
+  const wrong = await stated()
+  if (wrong.length > 0) {
+    refuse(
+      [
+        `${String(wrong.length)} thing(s) this app states about what it reaches will not hold:`,
+        ...wrong.map((one) => `  ${one}`),
+      ].join('\n'),
+    )
+  }
+
+  const current = existsSync(path) ? readFileSync(path, 'utf8') : ''
+  if (current !== SOURCE) {
+    refuse(
+      current === ''
+        ? `${AT} is declared and not on disk, and it is what opens this app's sealed values. Run \`thread vault\` and commit what it writes.`
+        : `${AT} is not what the secrets in ${here(from)} produce. A derived file that differs from its generator is a hand edit wearing a generated name. Run \`thread vault\` and commit what it writes.`,
+    )
+  }
+  stdout.write(`vault: ${AT} is seeded and opens ${opening}, read off ${here(from)} as they are declared.\n`)
+  exit(0)
+}
+
+if (existsSync(path) && readFileSync(path, 'utf8') === SOURCE) {
+  stdout.write(`vault: ${AT} is already yours — it opens ${opening}, read off ${here(from)} as they are declared.\n`)
+  exit(0)
+}
+
+mkdirSync(dirname(path), { recursive: true })
+writeFileSync(path, SOURCE, 'utf8')
+stdout.write(
+  `vault: wrote ${AT} — what opens a secret's value at the moment of use.\n` +
+    `  It opens the values sealed under ${SEALED_AT} for the secrets declared in ${here(from)}, and refuses every other name.\n` +
+    '  `thread create secret` declares one and seals its value; nothing else ever takes a value.\n' +
+    '  It imports nothing of this framework: what a host runs holds none of the scaffolding that assembled it.\n',
+)
+exit(0)

package/dist/integrations/{sdk.js → module.js}

@@ -40,9 +40,9 @@ export async function ran(name) {
     catch {
         return say('`_threads/targets.ts` could not be read, so nothing says what this integration is.');
     }
-    const mine = targets.find((one) => one.id === `${REACH.cli}${name}` || one.id === `${REACH.sdk}${name}`);
+    const mine = targets.find((one) => one.id === `${REACH.cli}${name}` || one.id === `${REACH.module}${name}`);
     if (mine === undefined) {
-        return say(`no target called \`${REACH.cli}${name}\` or \`${REACH.sdk}${name}\` is declared here, so this command should ` +
+        return say(`no target called \`${REACH.cli}${name}\` or \`${REACH.module}${name}\` is declared here, so this command should ` +
             'not exist. Declare it with `thread create target`, or take its row out of `_threads/derivation.ts`.');
     }
     const does = mine.offers ?? [];
@@ -60,7 +60,7 @@ export async function ran(name) {
             `was declared. It declared: ${does.join(', ') || '(nothing)'}. If the tool has changed, read it again with ` +
             `\`thread create target edit ${mine.id}\`.`);
     }
-    if (reachOf(mine.id) === 'sdk') {
+    if (reachOf(mine.id) === 'module') {
         return run({ name, module: mine.uses ?? '', requires: mine.requires });
     }
     const went = spawnSync(mine.uses ?? '', passed, { cwd: tree.at, stdio: 'inherit' });
@@ -124,7 +124,7 @@ export async function run(declared) {
     for (const segment of method.split('.')) {
         if (REACHES.has(segment)) {
             return refuse(`\`${segment}\` is not an operation of \`${declared.module}\` — it is a step every JavaScript value has, and ` +
-                'walking to it leaves what was installed. What may run here is what the SDK exports, and a person fixed that ' +
+                'walking to it leaves what was installed. What may run here is what the module exports, and a person fixed that ' +
                 'set when they declared it.');
         }
         owner = target;

package/dist/integrations/module.ts

@@ -0,0 +1,189 @@
+import { spawnSync } from 'node:child_process'
+import { argv, stderr, stdout } from 'node:process'
+
+import type { Env } from '../core/actor.ts'
+import { answer, asking, given, only, wordsIn } from '../core/asking.ts'
+import { exit } from '../core/invoked.ts'
+import { findTree, inTree } from '../core/tree.ts'
+
+import { REACH, reachOf, type Target } from './target.ts'
+import { opened } from './vault.ts'
+
+const PRODUCTION = '--production'
+
+const METHOD = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/
+
+function isClass(fn: (...args: readonly unknown[]) => unknown): boolean {
+  return /^class[\s{]/.test(Function.prototype.toString.call(fn))
+}
+
+const ASKS: readonly { readonly key: string; readonly says: string }[] = [
+  {
+    key: 'args',
+    says: 'a JSON value — an array for positional arguments, anything else for one, blank for none',
+  },
+]
+
+const TAKES: readonly string[] = ASKS.map((one) => one.key)
+
+const ASKED: readonly string[] = ASKS.map((one) => `\`${one.key}\`: ${one.says}`)
+
+export async function ran(name: string): Promise<void> {
+  const say = (because: string): never => {
+    stderr.write(`${name}: ${because}\n`)
+    exit(1)
+  }
+
+  const tree = findTree()
+  let targets: readonly Target[] = []
+  try {
+    const taken = (await import(new URL(`file://${inTree(tree, 'targets.ts')}`).href)) as {
+      TARGETS?: readonly Target[]
+    }
+    targets = taken.TARGETS ?? []
+  } catch {
+    return say('`_threads/targets.ts` could not be read, so nothing says what this integration is.')
+  }
+
+  const mine = targets.find((one) => one.id === `${REACH.cli}${name}` || one.id === `${REACH.module}${name}`)
+  if (mine === undefined) {
+    return say(
+      `no target called \`${REACH.cli}${name}\` or \`${REACH.module}${name}\` is declared here, so this command should ` +
+        'not exist. Declare it with `thread create target`, or take its row out of `_threads/derivation.ts`.',
+    )
+  }
+
+  const does = mine.offers ?? []
+  const passed = argv.slice(2)
+  const sub = passed[0]
+
+  if (sub === undefined) {
+    stdout.write(
+      `${name}: ${mine.describes}\n\n${String(does.length)} command(s), read off \`${mine.uses ?? ''}\` when \`${mine.id}\` was declared:\n` +
+        `${does.join(', ') || '(none were readable — name them with `thread create target edit`)'}\n\n` +
+        `thread run ${name} <command> [anything else] — arguments and flags reach \`${mine.uses ?? ''}\` untouched.\n` +
+        `It takes ${String(ASKED.length)} answer(s): ${ASKED.join('; ')}.\n`,
+    )
+    exit(0)
+  }
+
+  if (!does.includes(sub)) {
+    return say(
+      `\`${sub}\` is not one of the ${String(does.length)} command(s) \`${mine.uses ?? ''}\` stated when \`${mine.id}\` ` +
+        `was declared. It declared: ${does.join(', ') || '(nothing)'}. If the tool has changed, read it again with ` +
+        `\`thread create target edit ${mine.id}\`.`,
+    )
+  }
+
+  if (reachOf(mine.id) === 'module') {
+    return run({ name, module: mine.uses ?? '', requires: mine.requires })
+  }
+
+  const went = spawnSync(mine.uses ?? '', passed, { cwd: tree.at, stdio: 'inherit' })
+  exit(went.status ?? 1)
+}
+
+export async function run(declared: {
+  readonly name: string
+  readonly module: string
+  readonly requires: readonly string[]
+}): Promise<void> {
+  const refuse = (because: string): never => {
+    stderr.write(`${declared.name}: ${because}\n`)
+    exit(1)
+  }
+
+  const method = wordsIn([])[0]
+  if (method === undefined) {
+    return refuse(
+      `takes the method to call, dot-separated for a namespaced one — e.g. \`thread run ${declared.name} customers.list\`.`,
+    )
+  }
+  if (!METHOD.test(method)) {
+    return refuse(`\`${method}\` is not a method path — one name, or names joined by dots, e.g. \`customers.list\``)
+  }
+
+  const piped = given()
+  only(piped, TAKES, `\`thread run ${declared.name} ${method}\``)
+  const { ask, shut } = asking(piped)
+  const typed = (
+    piped.length > 0
+      ? (answer(piped, TAKES[0] ?? 'args') ?? '')
+      : await ask('args', 'args, as JSON — an array for positional arguments, anything else for one (blank for none): ')
+  ).trim()
+  shut()
+
+  let args: unknown[] = []
+  if (typed !== '') {
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(typed)
+    } catch (thrown) {
+      return refuse(`that is not JSON: ${thrown instanceof Error ? thrown.message : String(thrown)}. Nothing was called.`)
+    }
+    args = Array.isArray(parsed) ? parsed : [parsed]
+  }
+
+  const env: Env = argv.includes(PRODUCTION) ? 'production' : 'sandbox'
+
+  const opening = opened(findTree().at, declared.requires, env)
+  let resolved: Readonly<Record<string, string>>
+  try {
+    resolved = await opening(declared.requires)
+  } catch (thrown) {
+    return refuse(thrown instanceof Error ? thrown.message : String(thrown))
+  }
+  const credentials = declared.requires.map((one) => resolved[one] ?? '')
+
+  let mod: Record<string, unknown>
+  try {
+    mod = (await import(declared.module)) as Record<string, unknown>
+  } catch (thrown) {
+    return refuse(
+      `\`${declared.module}\` could not be imported: ${thrown instanceof Error ? thrown.message : String(thrown)}. It was ` +
+        `installed when this was declared — if it is gone, \`npm install ${declared.module}\` puts it back.`,
+    )
+  }
+
+  const entry: unknown = mod.default ?? mod
+
+  const asFunction = entry as (...a: readonly unknown[]) => unknown
+  const asConstructor = entry as new (...a: readonly unknown[]) => unknown
+
+const REACHES = new Set(['constructor', '__proto__', 'prototype'])
+
+  const client: unknown =
+    typeof entry !== 'function' ? entry : isClass(asFunction) ? Reflect.construct(asConstructor, credentials) : asFunction(...credentials)
+
+  let owner: unknown = client
+  let target: unknown = client
+  for (const segment of method.split('.')) {
+    if (REACHES.has(segment)) {
+      return refuse(
+        `\`${segment}\` is not an operation of \`${declared.module}\` — it is a step every JavaScript value has, and ` +
+          'walking to it leaves what was installed. What may run here is what the module exports, and a person fixed that ' +
+          'set when they declared it.',
+      )
+    }
+    owner = target
+    target = (target as Record<string, unknown> | null | undefined)?.[segment]
+  }
+  if (typeof target !== 'function') {
+    return refuse(`\`${method}\` on \`${declared.module}\` is ${target === undefined ? 'nothing' : `a ${typeof target}`}, not a method that can be called`)
+  }
+
+  let result: unknown
+  try {
+    result = await (target as (...a: unknown[]) => unknown).apply(owner, args)
+  } catch (thrown) {
+    return refuse(`\`${method}\` on \`${declared.module}\` threw: ${thrown instanceof Error ? thrown.message : String(thrown)}`)
+  }
+
+  stdout.write(`${declared.name}: ${method} (${env})\n`)
+  try {
+    stdout.write(`${JSON.stringify(result, null, 2)}\n`)
+  } catch {
+    stdout.write(`${String(result)}\n`)
+  }
+  exit(0)
+}

package/dist/integrations/secret.ts

@@ -0,0 +1,50 @@
+import type { Member } from '../core/thread.ts'
+
+export const SECRECY = {
+  server: 'sec_',
+  public: 'pub_',
+} as const satisfies Readonly<Record<string, string>>
+
+export const SAID: Readonly<Record<keyof typeof SECRECY, string>> = {
+  server:
+    'A value only a server may ever hold — an API key, a connection string, a signing secret. Everything a browser bundle reaches is in the bundle and belongs to whoever opens the page, so a target requiring one of these is refused a browser entry when it is built rather than when somebody reads it.',
+  public:
+    'A value that may reach a browser: a base url, a publishable key, a project id. It is still a secret and still lives in the sealed store, because it still differs between a sandbox and production and nothing else here keeps that difference. What it is not is a thing that has to be withheld.',
+}
+
+export interface Secret extends Member {
+
+  readonly sends?: { readonly header: string; readonly prefix?: string }
+}
+
+export function secrecyOf(id: string): keyof typeof SECRECY | undefined {
+  return (Object.keys(SECRECY) as (keyof typeof SECRECY)[]).find((one) => id.startsWith(SECRECY[one]))
+}
+
+export const isServerOnly = (id: string): boolean => secrecyOf(id) === 'server'
+
+export const unclassified = (secrets: readonly Secret[]): readonly string[] =>
+  secrets
+    .filter((one) => secrecyOf(one.id) === undefined)
+    .map(
+      (one) =>
+        `\`${one.id}\` wears neither \`${SECRECY.server}\` nor \`${SECRECY.public}\`, so nothing can tell whether it may ` +
+        'reach a browser — and that prefix is the only thing standing between a server credential and a bundle',
+    )
+
+const VALUED = ['value', 'secret', 'key', 'token', 'password', 'env']
+
+export const valued = (secrets: readonly Secret[]): readonly string[] => {
+  const found: string[] = []
+  for (const one of secrets) {
+    for (const named of VALUED) {
+      if (!(named in one)) continue
+      found.push(
+        `\`${one.id}\` carries a \`${named}\`. A secret row holds a name and a sentence and never a value — this row is ` +
+          'read by the descent, by every generator and by anything that prints the tree, while a credential is read by ' +
+          'one thing at one moment. Put the value in the sealed store with `thread create secret`',
+      )
+    }
+  }
+  return found
+}

package/dist/integrations/target.d.ts

@@ -5,7 +5,7 @@ export declare const REACH: {
     readonly pglite: "pl_";
     readonly browser: "zu_";
     readonly https: "ht_";
-    readonly sdk: "sdk_";
+    readonly module: "mod_";
     readonly cli: "cli_";
 };
 export type Reach = keyof typeof REACH;
@@ -17,6 +17,7 @@ export interface Holds {
     readonly migrations: boolean;
     readonly references: boolean;
     readonly sql: boolean;
+    readonly driver: string | null;
 }
 export declare const HOLDS: Readonly<Record<Reach, Holds>>;
 export declare const SAID: Readonly<Record<Reach, string>>;
@@ -35,6 +36,7 @@ export declare const CALL_PREFIX = "cl_";
 export declare const fills: (one: Call) => readonly string[];
 export declare function reachOf(id: string): Reach | undefined;
 export declare function holdsOf(id: string): Holds | undefined;
+export declare function driverOf(id: string): string | null;
 export declare function addressOf(one: Target, secrets: readonly Secret[]): Secret | undefined;
 export declare function credentialsOf(one: Target, secrets: readonly Secret[]): readonly Secret[];
 export declare function servesBrowser(one: Target, secrets: readonly Secret[]): true | string;