@prestack/thread 0.0.1 → 0.0.3

package/dist/derivation/generators/determinism.ts

@@ -0,0 +1,145 @@
+import { createHash } from 'node:crypto'
+
+import { named } from '../../core/scope.ts'
+
+export interface GeneratedFile {
+
+  readonly path: string
+
+  readonly contents: string
+}
+
+export function sortedBy<T>(items: Iterable<T>, key: (item: T) => string): T[] {
+  return [...items].sort((a, b) => compare(key(a), key(b)))
+}
+
+export function compare(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0
+}
+
+export function sortedEntries<V>(record: Readonly<Record<string, V>>): [string, V][] {
+  return Object.keys(record)
+    .sort(compare)
+    .map((key) => [key, record[key] as V])
+}
+
+const BANNER = `GENERATED by ${named('derivation')} — do not edit by hand.`
+const HASH_LABEL = 'codegen-hash:'
+
+interface HeaderSyntax {
+  readonly wrap: (text: string) => string
+  readonly unwrap: (line: string) => string | null
+}
+
+function headerSyntax(path: string): HeaderSyntax {
+  if (path.endsWith('.md')) {
+    return {
+      wrap: (text) => `<!-- ${text} -->`,
+      unwrap: (line) =>
+        line.startsWith('<!-- ') && line.endsWith(' -->') ? line.slice(5, -4) : null,
+    }
+  }
+  const prefix = path.endsWith('.sql') ? '--' : path.endsWith('.ts') || path.endsWith('.tsx') ? '//' : null
+  if (prefix === null) {
+    throw new Error(
+      `${named('derivation')} emits only .ts, .sql and .md, received "${path}". ` +
+        'A format with no comment syntax cannot carry a header, and an unheadered generated ' +
+        'file is one somebody edits by hand.',
+    )
+  }
+  return {
+    wrap: (text) => `${prefix} ${text}`,
+    unwrap: (line) => (line.startsWith(`${prefix} `) ? line.slice(prefix.length + 1) : null),
+  }
+}
+
+export function bodyHash(body: string): string {
+  return createHash('sha256').update(body, 'utf8').digest('hex')
+}
+
+const HEADER_LINES = 5
+
+export function withHeader(path: string, source: string, body: string): GeneratedFile {
+  const { wrap } = headerSyntax(path)
+  const normalized = body.endsWith('\n') ? body : `${body}\n`
+
+  const header = [
+    wrap(BANNER),
+    wrap(`Source: ${source}`),
+    wrap('Edit the island and re-run `thread generate`. CI fails when this file is stale.'),
+    wrap(`${HASH_LABEL} ${bodyHash(normalized)}`),
+    '',
+  ]
+
+  return { path, contents: `${header.join('\n')}\n${normalized}` }
+}
+
+export interface ParsedFile {
+  readonly source: string
+  readonly declaredHash: string
+  readonly body: string
+}
+
+export function parseGenerated(path: string, contents: string): ParsedFile | null {
+  let unwrap: HeaderSyntax['unwrap']
+  try {
+    unwrap = headerSyntax(path).unwrap
+  } catch {
+    return null
+  }
+  const lines = contents.split('\n')
+
+  if (unwrap(lines[0] ?? '') !== BANNER) return null
+
+  const sourceLine = unwrap(lines[1] ?? '')
+  const hashLine = unwrap(lines[3] ?? '')
+  if (sourceLine === null || !sourceLine.startsWith('Source: ')) return null
+  if (hashLine === null || !hashLine.startsWith(`${HASH_LABEL} `)) return null
+
+  return {
+    source: sourceLine.slice('Source: '.length),
+    declaredHash: hashLine.slice(HASH_LABEL.length + 1),
+    body: lines.slice(HEADER_LINES).join('\n'),
+  }
+}
+
+export function lines(...parts: readonly (string | readonly string[])[]): string {
+  return parts.flat().join('\n').replace(/[ \t]+$/gm, '')
+}
+
+export function tsString(value: string): string {
+  return `'${value.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/\n/g, '\\n')}'`
+}
+
+export function stableJson(value: unknown, indent = 0): string {
+  const pad = '  '.repeat(indent)
+  const padInner = '  '.repeat(indent + 1)
+
+  if (value === null) return 'null'
+  if (Array.isArray(value)) {
+    if (value.length === 0) return '[]'
+    return `[\n${value.map((item) => `${padInner}${stableJson(item, indent + 1)}`).join(',\n')}\n${pad}]`
+  }
+  if (typeof value === 'object') {
+    const keys = Object.keys(value as Record<string, unknown>).sort()
+    if (keys.length === 0) return '{}'
+    return `{\n${keys
+      .map((key) => `${padInner}${JSON.stringify(key)}: ${stableJson((value as Record<string, unknown>)[key], indent + 1)}`)
+      .join(',\n')}\n${pad}}`
+  }
+  return JSON.stringify(value)
+}
+
+export function pascal(id: string): string {
+  return id
+    .replace(/^(ent_|fld_|rel_|wf_|role_)/, '')
+    .split(/[_.]/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join('')
+}
+
+export function camel(id: string): string {
+  const p = pascal(id)
+  return p.charAt(0).toLowerCase() + p.slice(1)
+}

package/dist/derivation/generators/release.js

@@ -12,10 +12,11 @@ import { argv, stderr, stdout } from 'node:process';
 import { pathToFileURL } from 'node:url';
 import { marked, wordsIn } from "../../core/asking.js";
 import { exit, invoked } from "../../core/invoked.js";
-import { NAMED } from "../../core/scope.js";
+import { ours } from "../../core/scope.js";
 import { findTree, inTree } from "../../core/tree.js";
 import { CHECKED_BY, KINDS, LISTENS, SAID, WRITES, WRITTEN_BY, kindOf } from "../release.js";
 const TREE = findTree();
+const MANIFEST = 'package.json';
 const mark = (one) => marked([one.id ?? '', one.at ?? '']);
 async function releases() {
     const at = inTree(TREE, 'derivation.ts');
@@ -43,7 +44,7 @@ async function named() {
 }
 function scripted() {
     try {
-        const held = JSON.parse(readFileSync(join(TREE.at, 'package.json'), 'utf8'));
+        const held = JSON.parse(readFileSync(join(TREE.at, MANIFEST), 'utf8'));
         const scripts = held.scripts ?? {};
         return {
             build: scripts['build'] === undefined ? 'npm run build' : 'npm run build',
@@ -112,7 +113,14 @@ async function made() {
     }
     return found;
 }
-const SHIPPED = NAMED;
+function installed() {
+    const at = join(TREE.at, MANIFEST);
+    if (!existsSync(at)) {
+        throw new Error(`this app has no ${MANIFEST}, so what a host would install cannot be read`);
+    }
+    const held = JSON.parse(readFileSync(at, 'utf8'));
+    return Object.keys(held.dependencies ?? {}).filter((one) => ours(one)).sort();
+}
 async function run() {
     const rows = await releases();
     if (rows.length === 0) {
@@ -145,12 +153,14 @@ async function run() {
     }
     const files = await made();
     const checking = argv.includes('--check');
-    for (const [at, text] of files) {
-        if (text.includes(SHIPPED)) {
-            stderr.write(`release: ${at} names a \`${SHIPPED}\` module, and what a host runs may hold nothing of this ` +
-                'framework. It writes the format that host already reads and ships none of itself. Nothing was written.\n');
-            return 1;
-        }
+    const shipped = installed();
+    if (shipped.length > 0) {
+        stderr.write(`release: this app installs ${shipped.join(', ')} as a dependency, and what a host runs may hold ` +
+            'nothing of this framework. A package here is scaffolding: it writes the app, and the bundler folds ' +
+            'whatever the app imports into what it builds, so nothing of it is fetched again where this runs. ' +
+            `Install ${shipped.length === 1 ? 'it' : 'them'} with \`npm i -D\` instead, or move ${shipped.length === 1 ? 'it' : 'them'} ` +
+            'to `devDependencies` and run this again. Nothing was written.\n');
+        return 1;
     }
     if (checking) {
         for (const [at, text] of files) {

package/dist/derivation/generators/release.ts

@@ -0,0 +1,213 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { argv, stderr, stdout } from 'node:process'
+import { pathToFileURL } from 'node:url'
+
+import { marked, wordsIn } from '../../core/asking.ts'
+import { exit, invoked } from '../../core/invoked.ts'
+import { ours } from '../../core/scope.ts'
+import { findTree, inTree } from '../../core/tree.ts'
+
+import { CHECKED_BY, KINDS, LISTENS, SAID, WRITES, WRITTEN_BY, kindOf } from '../release.ts'
+
+const TREE = findTree()
+
+const MANIFEST = 'package.json'
+
+interface Row {
+  readonly id?: string
+  readonly at?: string
+}
+
+const mark = (one: Row): string => marked([one.id ?? '', one.at ?? ''])
+
+async function releases(): Promise<readonly Row[]> {
+  const at = inTree(TREE, 'derivation.ts')
+  if (!existsSync(at)) return []
+  try {
+    const held = (await import(pathToFileURL(at).href)) as { DERIVATION?: { readonly derives?: readonly Row[] } }
+    return held.DERIVATION?.derives ?? []
+  } catch {
+    return []
+  }
+}
+
+async function named(): Promise<readonly string[]> {
+  const at = inTree(TREE, 'secrets.ts')
+  if (!existsSync(at)) return []
+  try {
+    const held = (await import(pathToFileURL(at).href)) as { SECRETS?: readonly { readonly id: string }[] }
+    return (held.SECRETS ?? []).map((one) => one.id.toUpperCase()).sort()
+  } catch {
+    return []
+  }
+}
+
+function scripted(): { readonly build: string; readonly start: string } {
+  try {
+    const held = JSON.parse(readFileSync(join(TREE.at, MANIFEST), 'utf8')) as {
+      scripts?: Readonly<Record<string, string>>
+    }
+    const scripts = held.scripts ?? {}
+    return {
+      build: scripts['build'] === undefined ? 'npm run build' : 'npm run build',
+      start: scripts['start'] === undefined ? 'npm start' : 'npm start',
+    }
+  } catch {
+    return { build: 'npm run build', start: 'npm start' }
+  }
+}
+
+function dockerfile(build: string, start: string): string {
+  return [
+    '# GENERATED by thread — do not edit. It is derived from what this app declares.',
+    '',
+    'FROM node:22-slim AS build',
+    'WORKDIR /app',
+    'COPY package.json package-lock.json* ./',
+    'RUN npm ci --omit=dev --ignore-scripts || npm install --omit=dev --ignore-scripts',
+    'COPY . .',
+    'RUN npm install --ignore-scripts',
+    `RUN ${build}`,
+    '',
+    'FROM node:22-slim',
+    'WORKDIR /app',
+    'ENV NODE_ENV=production',
+    'COPY --from=build /app ./',
+    `EXPOSE ${String(LISTENS)}`,
+    `CMD ${JSON.stringify(start.split(' '))}`,
+    '',
+  ].join('\n')
+}
+
+function compose(id: string, secrets: readonly string[]): string {
+  return [
+    '# GENERATED by thread — do not edit. It is derived from what this app declares.',
+    '',
+    'services:',
+    `  ${id}:`,
+    '    build: .',
+    '    ports:',
+    `      - "${String(LISTENS)}:${String(LISTENS)}"`,
+    ...(secrets.length === 0
+      ? []
+      : [
+          '    environment:',
+
+          ...secrets.map((one) => `      ${one}: \${${one}}`),
+        ]),
+    '',
+  ].join('\n')
+}
+
+async function made(): Promise<ReadonlyMap<string, string>> {
+  const found = new Map<string, string>()
+  const rows = await releases()
+  const secrets = await named()
+  const { build, start } = scripted()
+
+  for (const one of rows) {
+    const id = one.id
+    if (id === undefined) continue
+    const kind = kindOf(id)
+    if (kind === undefined) continue
+    if (kind === 'docker') {
+      found.set('Dockerfile', dockerfile(build, start))
+      found.set('compose.yaml', compose(id, secrets))
+    }
+  }
+  return found
+}
+
+function installed(): readonly string[] {
+  const at = join(TREE.at, MANIFEST)
+  if (!existsSync(at)) {
+    throw new Error(`this app has no ${MANIFEST}, so what a host would install cannot be read`)
+  }
+  const held = JSON.parse(readFileSync(at, 'utf8')) as { dependencies?: Readonly<Record<string, string>> }
+  return Object.keys(held.dependencies ?? {}).filter((one) => ours(one)).sort()
+}
+
+async function run(): Promise<number> {
+  const rows = await releases()
+  if (rows.length === 0) {
+    stdout.write(
+      `release: this app declares no release, so there is nowhere for it to go yet. Declare one with ` +
+        `\`thread create release\` — it is ${KINDS.join(' or ')}, and the prefix on its id says which.\n`,
+    )
+    return 0
+  }
+
+  const words = wordsIn(['read'])
+  if (words[0] === 'read') {
+    const which = words[1]
+    const one = rows.find((row) => mark(row) === which)
+    if (one === undefined) {
+      stderr.write(
+        `release: \`${which ?? '(nothing)'}\` is not a mark this tree issued. This app declares ` +
+          `${rows.map((row) => `[${mark(row)}] ${String(row.id)}`).join(', ')} — read one of those, or run ` +
+          '`thread release` to write it, or `thread create release` to declare another.\n',
+      )
+      return 1
+    }
+
+    const kind = kindOf(one.id ?? '')
+    stdout.write(`${String(one.id)} — ${kind === undefined ? 'a release of a kind this generator does not recognise' : SAID[kind]}\n`)
+    for (const file of kind === undefined ? [] : WRITES[kind]) {
+      stdout.write(`\n${file}\n`)
+      try {
+        stdout.write(readFileSync(join(TREE.at, file), 'utf8'))
+      } catch {
+        stdout.write('(nothing is there)\n')
+      }
+    }
+    return 0
+  }
+
+  const files = await made()
+  const checking = argv.includes('--check')
+
+  const shipped = installed()
+  if (shipped.length > 0) {
+    stderr.write(
+      `release: this app installs ${shipped.join(', ')} as a dependency, and what a host runs may hold ` +
+        'nothing of this framework. A package here is scaffolding: it writes the app, and the bundler folds ' +
+        'whatever the app imports into what it builds, so nothing of it is fetched again where this runs. ' +
+        `Install ${shipped.length === 1 ? 'it' : 'them'} with \`npm i -D\` instead, or move ${shipped.length === 1 ? 'it' : 'them'} ` +
+        'to `devDependencies` and run this again. Nothing was written.\n',
+    )
+    return 1
+  }
+
+  if (checking) {
+    for (const [at, text] of files) {
+      let current = ''
+      try {
+        current = readFileSync(join(TREE.at, at), 'utf8')
+      } catch {
+        current = ''
+      }
+      if (current === text) continue
+      stderr.write(
+        current === ''
+          ? `release: ${at} is declared and not on disk. Run \`${WRITTEN_BY}\` and commit what it writes.\n`
+          : `release: ${at} is not what the declarations produce. A derived file that differs from its ` +
+              `generator is a hand edit wearing a generated name. Run \`${WRITTEN_BY}\` and commit what it writes.\n`,
+      )
+      return 1
+    }
+    stdout.write(`release: ${[...files.keys()].join(', ')} ${files.size === 1 ? 'is' : 'are'} what the declarations produce\n`)
+    return 0
+  }
+
+  for (const [at, text] of files) writeFileSync(join(TREE.at, at), text, 'utf8')
+  stdout.write(
+    `release: wrote ${[...files.keys()].join(', ')} — built and started by what this app's own manifest ` +
+      `declares, listening on ${String(LISTENS)}, naming ${String((await named()).length)} secret(s) and holding none of them.\n`,
+  )
+  return 0
+}
+
+if (invoked(import.meta.url)) exit(await run())
+
+export { CHECKED_BY, WRITES, made }

package/dist/derivation/makers/release.ts

@@ -0,0 +1,135 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { argv, exit, stdout } from 'node:process'
+import { pathToFileURL } from 'node:url'
+
+import { RECEIPT, answer, answering, asking, given, guidance, issue, named, only, prompted, refuse, slug, spend, wordsIn, type Asked } from '../../core/asking.ts'
+import { listBounds, withRow } from '../../core/rows.ts'
+import { named as packageOf } from '../../core/scope.ts'
+import { findTree, inTree } from '../../core/tree.ts'
+
+import { CHECKED_BY, KINDS, PREFIXES, SAID, WRITES, WRITTEN_BY } from '../release.ts'
+
+const TREE = findTree()
+
+const SHEET = 'derivation.ts'
+
+const KEBAB = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
+
+const NAME: Asked = { at: 'name', guide: 'lowercase words joined by dashes' }
+
+const KIND: Asked = { at: 'kind', guide: `one of ${KINDS.join(', ')} — the prefix on the id says which` }
+
+const ASKS: readonly Asked[] = [NAME, KIND]
+
+interface Row {
+  readonly id?: string
+  readonly at?: string
+  readonly describes?: string
+}
+
+const at = inTree(TREE, SHEET)
+
+if (!existsSync(at)) {
+  refuse(
+    `there is no ${SHEET} here, so a release has nowhere to go. Run \`npx thread attach ${packageOf('derivation')}\` — ` +
+      "the sheet is the package's to write, not yours.",
+  )
+}
+
+const held = (await import(pathToFileURL(at).href)) as { DERIVATION?: { readonly derives?: readonly Row[] } }
+const already = held.DERIVATION?.derives ?? []
+
+const listing = [
+  already.length === 0
+    ? 'no releases yet, so this app declares nowhere to go.'
+    : `${String(already.length)} release(s):`,
+  ...already.map((one) => `  ${String(one.id)} — writes ${String(one.at)} — ${String(one.describes)}`),
+  '',
+  'what a release is:',
+  '',
+  ...KINDS.map((one) => `  ${one} → ${PREFIXES[one]}<name>, writing ${WRITES[one].join(' and ')}`),
+  ...KINDS.flatMap((one) => ['', `  ${SAID[one]}`]),
+].join('\n')
+
+const words = wordsIn(['new'])
+
+const piped = given()
+only(piped, named(ASKS), 'a release')
+const { ask, shut } = asking(piped)
+
+const nonce = issue(TREE.at, listing)
+
+if (words[0] !== 'new') {
+  stdout.write(`${listing}\n\n`)
+  stdout.write(`  npx thread create release new <name> ${RECEIPT} ${nonce}\n\n`)
+  stdout.write(`${answering('release').join('\n')}\n\n`)
+  stdout.write(`${guidance(ASKS).join('\n')}\n\n`)
+  stdout.write(
+    `  ${RECEIPT} is spent by one run and refused if ${SHEET} changed after it was issued — what is\n` +
+      '  listed above is what you are writing against, and handing one back says you read it.\n',
+  )
+  exit(1)
+}
+
+spend(TREE.at, listing, argv[argv.indexOf(RECEIPT) + 1], SHEET)
+
+const name = slug(piped.length > 0 ? (answer(piped, NAME.at) ?? '') : await ask(NAME.at, prompted(NAME)))
+if (name === '' || !KEBAB.test(name)) {
+  shut()
+  refuse(`"${name}" cannot be the name of a release — it is written in kebab-case, so main or blue-green.`)
+}
+
+const said = piped.length > 0 ? (answer(piped, KIND.at) ?? '') : await ask(KIND.at, prompted(KIND))
+const kind = KINDS.find((one) => one === said)
+if (kind === undefined) {
+  shut()
+  refuse(`"${said}" is not something this can release to. It is one of ${KINDS.join(', ')}.`)
+}
+shut()
+
+const id = `${PREFIXES[kind]}${name.replace(/-/g, '_')}`
+if (already.some((one) => one.id === id)) refuse(`\`${id}\` is already declared in ${SHEET}.`)
+
+const text = readFileSync(at, 'utf8')
+const bounds = listBounds(text, 'derives')
+if (bounds === undefined) {
+  refuse(
+    `${SHEET} states no \`derives\` list on its node, so this app was attached before releases existed. ` +
+      `Run \`npx thread attach ${packageOf('derivation')}\` again — it adds the list without touching what is in the sheet.`,
+  )
+}
+
+const [first, ...rest] = WRITES[kind]
+
+const row = [
+  '  {',
+  `    id: '${id}',`,
+  `    at: '${String(first)}',`,
+  `    describes: '${SAID[kind].replace(/\\/g, '\\\\').replace(/'/g, "\\'")}',`,
+  '    version: 1,',
+  `    by: '${WRITTEN_BY}',`,
+  `    runs: '${CHECKED_BY}',`,
+  ...(rest.length === 0
+    ? []
+    : [
+        '    derives: [',
+        ...rest.flatMap((one) => [
+          '      {',
+          `        id: '${id}_${one.split('.')[0] ?? one}',`,
+          `        at: '${one}',`,
+          `        describes: 'What runs the image this release builds, named beside it because one row states one address.',`,
+          '        version: 1,',
+          `        by: '${WRITTEN_BY}',`,
+          `        runs: '${CHECKED_BY}',`,
+          '      },',
+        ]),
+        '    ],',
+      ]),
+  '  },',
+].join('\n')
+
+writeFileSync(at, withRow(text, bounds, row), 'utf8')
+
+stdout.write(`create: declared ${id} in ${SHEET} — it writes ${WRITES[kind].join(' and ')}.\n`)
+stdout.write(`create: run \`${WRITTEN_BY}\`, and the gate checks it from here on without a line written for it.\n`)
+exit(0)

package/dist/derivation/release.ts

@@ -0,0 +1,23 @@
+
+
+export const PREFIXES = { docker: 'dk_' } as const
+
+export const KINDS = ['docker'] as const
+
+export const WRITES: Readonly<Record<(typeof KINDS)[number], readonly string[]>> = {
+  docker: ['Dockerfile', 'compose.yaml'],
+}
+
+export const LISTENS = 3000
+
+export const SAID: Readonly<Record<(typeof KINDS)[number], string>> = {
+  docker:
+    'A container image built from this app and the compose file that runs it. It is the one that needs no account and no network to be proven, so it is what an app can be taken end to end with before anybody has chosen where it really lives. What it holds is derived: the build and start commands this app already declares, the port its own server listens on, and the name of every secret it says it must be given — the names only, because a value is typed by a person and a row has never held one.',
+}
+
+export const kindOf = (id: string): (typeof KINDS)[number] | undefined =>
+  KINDS.find((one) => id.startsWith(PREFIXES[one]))
+
+export const WRITTEN_BY = 'thread release'
+
+export const CHECKED_BY = 'thread release --check'

package/dist/integrations/attach.js

@@ -1,7 +1,7 @@
 import { named } from "../core/scope.js";
 const VERSION = 1;
 const DESCRIBES = 'The system that states every place this app reaches and every credential it reaches with. A target is a destination and the prefix on its id is how it is reached; what it accepts is entities if it keeps them, calls if it is called over https, and the methods or subcommands it answers to if it is an npm package or a program; what it requires is secrets, and where the reach has an address one of them is it. Nothing else in this app names a host, a connection string or an environment variable, so an operation says which place it needs and the rest is worked out from the declaration.';
-const TARGETS = 'Where this app states the places it reaches and what each one accepts. Declare one with `thread create target`, which asks how it is reached and puts the matching prefix on its id — `pg_` for a postgres over the network, `pl_` for one in this process, `zu_` for a store in the browser, `ht_` for something called over https, `sdk_` for an npm package this app installs and calls, `cli_` for a program it runs at a command line — and writes what it accepts and the secrets reaching it needs. A place that keeps things accepts entities; a place that is called accepts the calls declared beside it; a package or a program says in `uses` what it is and in `offers` what it responds to, and takes nothing, because a method name belongs to something outside this tree and `takes` is a demand this tree has to be able to meet. This is the one place the split between what reaches a server and what stays local is written down.';
+const TARGETS = 'Where this app states the places it reaches and what each one accepts. Declare one with `thread create target`, which asks how it is reached and puts the matching prefix on its id — `pg_` for a postgres over the network, `pl_` for one in this process, `zu_` for a store in the browser, `ht_` for something called over https, `mod_` for something this app brings in from outside the repository and calls, `cli_` for a program it runs at a command line — and writes what it accepts and the secrets reaching it needs. A place that keeps things accepts entities; a place that is called accepts the calls declared beside it; a package or a program says in `uses` what it is and in `offers` what it responds to, and takes nothing, because a method name belongs to something outside this tree and `takes` is a demand this tree has to be able to meet. This is the one place the split between what reaches a server and what stays local is written down.';
 const SECRETS = 'Where this app states every value it must be given and may not hold. A row here is a name and a sentence and never a value: `sec_` for one only a server may ever hold, `pub_` for one that may reach a browser, and that prefix is the whole of what decides where the target requiring it can be reached from. A secret with a `sends` goes into a header on every call; the one without is the address of the target that requires it.';
 const VAULT = 'What opens a secret\'s value at the moment of use, written once and then yours. It reads the names off _threads/secrets.ts and opens the values sealed beside the tree, refusing any other name; add a secret with `thread create secret`, which is the only thing that ever takes a value. To open values from somewhere else in production, replace what opens them here.';
 const SECRET = 'A value this app must be given and may never hold — a key, a token, a connection string. The row names it and says what it is for, and there is no field on it for the value, because a row is read by everything and a credential is read by one thing at one moment. The prefix says who may ever hold it: `sec_` a server and nothing else, `pub_` anybody including whoever opens the page. That one letter is what refuses a server credential its way into a browser bundle, so it is on the id rather than in a field somebody could forget.';
@@ -169,7 +169,7 @@ export const ATTACH = {
             list: 'CONCEPTS',
             id: 'sdk',
             why: '`sdk` is no longer a noun beside a target — it is one of the ways a target is reached, and its meaning is ' +
-                `now \`SAID.sdk\` in \`${named('integrations')}/target\`, beside \`https\` and every other reach, none of which is ` +
+                `now \`SAID.module\` in \`${named('integrations')}/target\`, beside \`https\` and every other reach, none of which is ` +
                 'coined here either. It also collided with an app declaring a meta called `sdk`, which coins the word: two ' +
                 'meanings for one word is what `twice-meant` refuses, and it was holding the glossary and the docs red.',
         },