@prestack/thread 0.0.1

package/dist/integrations/generators/read.js

@@ -0,0 +1,92 @@
+import { stdout } from 'node:process';
+import { exit } from "../../core/invoked.js";
+import { wordsIn } from "../../core/asking.js";
+import { descend } from "../../core/descend.js";
+const words = wordsIn([]);
+const looking = words.join(' ').trim().toLowerCase();
+const pass = descend();
+const said = (one) => (one.describes ?? '').replace(/\s+/g, ' ');
+const carries = (one, list, file) => {
+    if (looking === '')
+        return true;
+    const held = [one.id ?? '', one.at ?? '', said(one), one.by ?? '', one.runs ?? '', list, file, ...(one.requires ?? []), ...(one.takes ?? [])];
+    return held.some((each) => each.toLowerCase().includes(looking));
+};
+const shown = (one, list, pad, alone = false) => {
+    const marks = [
+        ...(one.by === undefined ? [] : [`written by \`${one.by}\``]),
+        ...(one.runs === undefined ? [] : [`checked by \`${one.runs}\``]),
+        ...((one.requires ?? []).length === 0 ? [] : [`requires ${(one.requires ?? []).join(', ')}`]),
+        ...((one.takes ?? []).length === 0 ? [] : [`takes ${(one.takes ?? []).join(', ')}`]),
+    ];
+    const sentence = said(one);
+    return [
+        `${pad}${one.id ?? '(unnamed)'}  [${list}]`,
+        ...(marks.length === 0 ? [] : [`${pad}  ${marks.join(' · ')}`]),
+        ...(sentence === ''
+            ? []
+            : [`${pad}  ${alone || sentence.length <= 160 ? sentence : `${sentence.slice(0, 157)}...`}`]),
+    ];
+};
+const files = [...pass.threaded.keys()].sort();
+const matched = files.reduce((sum, file) => sum + (pass.threaded.get(file) ?? []).filter((each) => carries(each.row, each.list, file)).length, 0) +
+    [...pass.stated.entries()].filter(([, one]) => !files.some((file) => (pass.threaded.get(file) ?? []).some((each) => each.row === one)) && carries(one, 'stated', one.at ?? '')).length;
+const only = matched === 1;
+let rows = 0;
+const out = [];
+if (looking === '') {
+    for (const file of files) {
+        const held = pass.threaded.get(file) ?? [];
+        if (held.length === 0)
+            continue;
+        rows += held.length;
+        out.push(`  ${String(held.length).padStart(4)}  ${file}`);
+    }
+    out.unshift(`${String(files.length)} sheet(s) in this tree, and what each holds:`, '');
+    out.push('', 'Name a word to read the rows themselves — every row whose id, sentence, path, command or', 'requirement carries it, each with what it means:', '', '  npx thread inspect element', '  npx thread inspect variant', '  npx thread inspect <any word above, or any word this tree coins>', '');
+    stdout.write(`${out.join('\n')}\n`);
+    stdout.write(`read: ${String(rows)} row(s) across ${String(pass.declarations)} declaration(s), ` +
+        `and ${String(pass.findings.length)} finding(s) the gate would report.\n`);
+    exit(0);
+}
+for (const file of files) {
+    const held = (pass.threaded.get(file) ?? []).filter((each) => carries(each.row, each.list, file));
+    if (held.length === 0)
+        continue;
+    out.push(file);
+    for (const each of held) {
+        rows += 1;
+        out.push(...shown(each.row, each.list, '  ', only));
+    }
+    out.push('');
+}
+const loose = [...pass.stated.entries()]
+    .filter(([, one]) => !files.some((file) => (pass.threaded.get(file) ?? []).some((each) => each.row === one)))
+    .filter(([, one]) => carries(one, 'stated', one.at ?? ''));
+if (loose.length > 0) {
+    out.push('stated outright, in no parent\'s list');
+    for (const [, one] of loose) {
+        rows += 1;
+        out.push(...shown(one, 'stated', '  ', only));
+    }
+    out.push('');
+}
+if (looking !== '') {
+    const coined = [...pass.coined.entries()].filter(([word]) => word.toLowerCase().includes(looking));
+    if (coined.length > 0) {
+        out.push('words this tree coins');
+        for (const [word, held] of coined)
+            out.push(`  ${word} — declared under ${held.under}`);
+        out.push('');
+    }
+}
+stdout.write(`${out.join('\n')}\n`);
+if (rows === 0) {
+    stdout.write(looking === ''
+        ? 'read: this tree declares nothing yet. Attach a package with `thread attach`.\n'
+        : `read: nothing in this tree carries "${looking}" — not an id, a sentence, a path, a command, a requirement or a thing taken.\n`);
+    exit(0);
+}
+stdout.write(`read: ${String(rows)} row(s)${looking === '' ? '' : ` carrying "${looking}"`} across ` +
+    `${String(pass.declarations)} declaration(s), and ${String(pass.findings.length)} finding(s) the gate would report.\n`);
+exit(0);

package/dist/integrations/generators/sdk.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/generators/sdk.js

@@ -0,0 +1,148 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { spawnSync } from 'node:child_process';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { relative } from 'node:path';
+import { stdout } from 'node:process';
+import { generators } from "../../core/chain.js";
+import { exit } from "../../core/invoked.js";
+import { asking, given, nouns, refuse, slug, wordsIn } from "../../core/asking.js";
+import { listBounds, withRow } from "../../core/rows.js";
+import { named as packageOf } from "../../core/scope.js";
+import { findTree, inTree } from "../../core/tree.js";
+const TREE = findTree();
+const FILE = 'derivation.ts';
+const LIST = 'GENERATORS';
+const OWNER = 'integrations';
+const DECLARES = 'declares';
+const NAME = /^[a-z][a-z0-9_]*$/;
+const PACKAGE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+const PREFIX = 'sdk_';
+const here = (one) => relative(TREE.at, one).split('\\').join('/');
+const path = inTree(TREE, FILE);
+const at = here(path);
+import { quoted } from "../../core/rows.js";
+const words = wordsIn([]);
+const rows = await generators(TREE);
+const already = rows.filter((one) => typeof one.id === 'string' && one.id.startsWith(PREFIX));
+const first = words[0];
+if (first === undefined) {
+    stdout.write(already.length === 0
+        ? 'sdk: no SDK declared yet.\n'
+        : `sdk: ${String(already.length)} declared:\n${already
+            .map((one) => `  ${(one.by ?? '').slice('thread run '.length)} — ${one.describes ?? ''}`)
+            .join('\n')}\n`);
+    stdout.write('\nthread create sdk <name> — installs an npm package, asks what it is for and which declared secret it\n' +
+        'needs, and declares it. Then `thread run <name> <method>` calls it, resolving the credential through the\n' +
+        'vault at the moment of the call. `<method>` is dot-separated for a namespaced one, e.g. `customers.list`.\n');
+    exit(0);
+}
+const name = slug(first);
+if (name === '')
+    refuse('an SDK has to be called something — `thread create sdk <name>`');
+if (!NAME.test(name))
+    refuse(`"${name}" cannot be the name of an SDK — it is written in lower_snake_case`);
+const claimed = nouns(rows, 'run').get(name);
+if (claimed !== undefined) {
+    refuse(`\`thread run ${name}\` already resolves to ${claimed} — that name is taken`);
+}
+const { ask, shut } = asking(given());
+const npmPackage = (await ask('package', 'npm package to install: ')).trim();
+if (npmPackage === '') {
+    shut();
+    refuse('an SDK installs something — the npm package is what `npm install` is given');
+}
+if (!PACKAGE.test(npmPackage)) {
+    shut();
+    refuse(`"${npmPackage}" does not read as an npm package name`);
+}
+const describes = (await ask('describes', 'what is it for? ')).trim();
+if (describes === '') {
+    shut();
+    refuse('an SDK says what it is for — the sentence is what somebody reads before running it');
+}
+let secrets = [];
+try {
+    const taken = (await import(__rewriteRelativeImportExtension(new URL(`file://${inTree(TREE, 'secrets.ts')}`).href)));
+    secrets = taken.SECRETS ?? [];
+}
+catch {
+    secrets = [];
+}
+const carrying = (await ask('requires', `which secret does it need — ${secrets.map((one) => one.id).join(', ') || '(none declared yet)'}\n` +
+    '  If this SDK needs a url, a key, a token or a password to work, IT GOES HERE and nowhere else.\n' +
+    '  Declare it first with `thread create secret`, then name it here, comma-separated. It is resolved\n' +
+    '  through the vault at the moment of the call and is never written into any file.\n' +
+    '  Blank only if the SDK genuinely needs no credential at all — a declaration with the wrong answer\n' +
+    '  here does not fail now, it fails at the call with the vendor\'s own error.\n' +
+    '  > '))
+    .split(',')
+    .map((one) => one.trim())
+    .filter((one) => one !== '');
+shut();
+for (const one of carrying) {
+    if (!secrets.some((each) => each.id === one)) {
+        refuse(`\`${one}\` is not a secret this app declares. Declare it first with \`thread create secret\` — a credential is given to something that said it needed it, or not at all.`);
+    }
+}
+let text;
+try {
+    text = readFileSync(path, 'utf8');
+}
+catch {
+    refuse(`${at} could not be read. Attach \`${packageOf('derivation')}\` first — that is what writes it.`);
+}
+const where = listBounds(text, LIST);
+if (where === undefined)
+    refuse(`${at} states no \`${LIST}\` list to declare a generator in`);
+stdout.write(`sdk: installing ${npmPackage} …\n`);
+const installed = spawnSync('npm', ['install', npmPackage], { cwd: TREE.at, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+if (installed.status !== 0) {
+    refuse(`\`npm install ${npmPackage}\` failed, so nothing was declared:\n${`${installed.stdout ?? ''}${installed.stderr ?? ''}`.trim()}`);
+}
+stdout.write(`sdk: installed ${npmPackage}.\n`);
+const fileAt = `_threads/sdk_${name}.ts`;
+const SOURCE = `import { run } from '../sdk.ts'
+
+await run({ name: ${quoted(name)}, module: ${quoted(npmPackage)}, requires: [${carrying.map(quoted).join(', ')}] })
+`;
+writeFileSync(inTree(TREE, `sdk_${name}.ts`), SOURCE, 'utf8');
+const row = [
+    '  {',
+    `    id: ${quoted(`${PREFIX}${name}`)},`,
+    `    at: ${quoted(fileAt)},`,
+    `    describes: ${quoted(describes)},`,
+    '    version: 1,',
+    `    by: ${quoted(`thread run ${name}`)},`,
+    ...(carrying.length === 0 ? [] : [`    requires: [${carrying.map(quoted).join(', ')}],`]),
+    '  },',
+].join('\n');
+writeFileSync(path, withRow(text, where, row), 'utf8');
+const owner = inTree(TREE, `${OWNER}.ts`);
+let owned = '';
+try {
+    owned = readFileSync(owner, 'utf8');
+}
+catch {
+    refuse(`${OWNER}.ts could not be read, so there is nothing to declare this under.`);
+}
+const under = listBounds(owned, DECLARES);
+if (under === undefined)
+    refuse(`${OWNER}.ts states no \`${DECLARES}\` list to declare this in`);
+writeFileSync(owner, withRow(owned, under, [
+    '  {',
+    `    id: ${quoted(`${PREFIX}${name}`)},`,
+    `    at: ${quoted(fileAt)},`,
+    `    describes: ${quoted(describes)},`,
+    '    version: 1,',
+    '  },',
+].join('\n')), 'utf8');
+stdout.write(`sdk: declared ${name} — ${npmPackage}, reached with \`thread run ${name} <method>\`. ` +
+    `${carrying.length === 0 ? 'It needs no secret.' : `It resolves ${carrying.join(', ')} through the vault at call time.`}\n`);
+exit(0);

package/dist/integrations/generators/secret.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/generators/secret.js

@@ -0,0 +1,233 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { spawnSync } from 'node:child_process';
+import { appendFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { argv, stdin, stdout } from 'node:process';
+import { createInterface } from 'node:readline';
+import { exit } from "../../core/invoked.js";
+import { ELSEWHERE, RECEIPT, answer, asking, asksOf, given, issue, needed, only, ownAnswers, refuse, rowLines, seeding, slug, spend, stating, wordsIn } from "../../core/asking.js";
+import { holdsRow, listBounds, withRow } from "../../core/rows.js";
+import { named as packageOf } from "../../core/scope.js";
+import { findTree, inTree } from "../../core/tree.js";
+import { SAID, SECRECY, secrecyOf } from "../secret.js";
+import { IGNORES, KEY_AT, SEALED_AT, keyOf, seal, sealedIn } from "../vault.js";
+const TREE = findTree();
+const FILE = 'secrets.ts';
+const LIST = 'SECRETS';
+const NAME = /^[a-z][a-z0-9_]*$/;
+const ENVS = ['sandbox', 'production'];
+const WORDS = Object.keys(SECRECY);
+const ASKS = [
+    { key: 'name', says: ['lower_snake_case, and the prefix is added for you'] },
+    { key: 'holder', says: [`who may hold it — ${WORDS.join(', ')}`] },
+    { key: 'describes', says: ['what it is for, in one sentence'], edits: true },
+    { key: 'header', says: ['blank if this value IS the address of what requires it'], edits: true },
+    { key: 'prefix', says: ['what precedes it in that header, trailing space and all'], edits: true },
+];
+const TAKES = ASKS.map((one) => one.key);
+const EDITS = ASKS.filter((one) => one.edits === true).map((one) => one.key);
+const ASKED = ASKS.flatMap((one) => one.says.map((line, at) => `  ${at === 0 ? `${one.key}:`.padEnd(32) : ' '.repeat(32)}${line}`));
+const here = (one) => relative(TREE.at, one).split('\\').join('/');
+const path = inTree(TREE, FILE);
+const at = here(path);
+import { quoted } from "../../core/rows.js";
+let secrets = [];
+try {
+    const taken = (await import(__rewriteRelativeImportExtension(new URL(`file://${path}`).href)));
+    secrets = taken.SECRETS ?? [];
+}
+catch {
+    refuse(`${at} could not be read. Attach \`${packageOf('integrations')}\` first — an app states its secrets there.`);
+}
+const held = new Map(ENVS.map((env) => [env, new Set(sealedIn(TREE.at, env))]));
+const setIn = (id) => {
+    const found = ENVS.filter((env) => held.get(env)?.has(id) === true);
+    return found.length === 0 ? 'no value anywhere yet' : `set for ${found.join(' and ')}`;
+};
+async function sealing(id) {
+    const hidden = async (question) => {
+        stdout.write(question);
+        const rl = createInterface({ input: stdin, output: stdout, terminal: true });
+        rl._writeToOutput = () => { };
+        const value = await new Promise((done) => rl.question('', done));
+        rl.close();
+        stdout.write('\n');
+        return value;
+    };
+    let sealed = 0;
+    for (const env of ENVS) {
+        const value = await hidden(`  ${id} for ${env} (paste it, or press enter to skip): `);
+        if (value.trim() === '')
+            continue;
+        seal(TREE.at, id, env, value);
+        sealed += 1;
+    }
+    if (sealed === 0)
+        return 0;
+    const ignore = join(TREE.at, '.gitignore');
+    const already = existsSync(ignore) ? readFileSync(ignore, 'utf8') : '';
+    const missing = IGNORES.filter((one) => !already.split('\n').some((line) => line.trim() === one));
+    if (missing.length > 0) {
+        appendFileSync(ignore, `${already.endsWith('\n') || already === '' ? '' : '\n'}${missing.join('\n')}\n`);
+        stdout.write(`secret: added ${missing.join(', ')} to .gitignore — the key is never committed.\n`);
+    }
+    stdout.write(`secret: sealed ${id} for ${String(sealed)} environment(s) into ${SEALED_AT}.\n`);
+    return sealed;
+}
+const listing = secrets.length === 0
+    ? 'no secrets yet.'
+    : [
+        `${String(secrets.length)} secret(s):`,
+        ...secrets.flatMap((one) => [
+            `  ${one.id} — ${secrecyOf(one.id) ?? 'wearing no prefix, which is refused'}, ${setIn(one.id)}`,
+            `      ${one.sends === undefined ? 'no `sends`, so it is an address' : `sent as ${one.sends.header}: ${one.sends.prefix ?? ''}<value>`}`,
+        ]),
+    ].join('\n');
+const words = wordsIn(['new', 'set']);
+const verb = words[0];
+stdout.write(`${listing}\n`);
+if (keyOf(TREE.at) === undefined && secrets.length > 0) {
+    stdout.write(`\nthere is no vault key at ${KEY_AT}, so nothing above can be opened here. It is never committed — ` +
+        'whoever set this app up has it.\n');
+}
+const method = (nonce) => [
+    '',
+    'what this makes:',
+    '',
+    `  thread create secret new <name> ${RECEIPT} ${nonce}`,
+    `  thread create secret set <id> ${RECEIPT} ${nonce}`,
+    '',
+    ...ELSEWHERE,
+    '',
+    `  ${RECEIPT} is spent by one run and refused if ${at} moved after it was issued.`,
+    '',
+    'who may hold a value. The word is what you send; the prefix is what the id wears, and the prefix',
+    'IS who may hold it — no field says so:',
+    '',
+    ...WORDS.flatMap((one) => [`  ${one.padEnd(7)} → ${SECRECY[one]}<name>`, `      ${SAID[one]}`, '']),
+    '`new` asks, in this order:',
+    '',
+    ...ASKED,
+    '',
+    'and then, at a terminal only, it asks for the value itself — echo off, sealed as you press enter.',
+    'A piped run declares the row and says so instead, because there is no terminal to read one from.',
+    '',
+    '`edit` asks the same three, and a blank answer keeps what is already there — except that naming',
+    'a DIFFERENT header drops the old prefix unless you give a new one, because a prefix belongs to',
+    'the scheme its header names. `-` as the header removes the header and makes this an address.',
+    '',
+    'It will not change who may hold a value. That is the prefix, the prefix is the id, and an id that',
+    'changes is a different secret — every target requiring the old name would go on requiring a name',
+    'nothing declares. Declare the other one and move what requires it.',
+    '',
+    '`set` is the same prompt on its own, for changing a value later or giving one a `new` run skipped.',
+    'It takes no answers and cannot be piped. The value goes from the keyboard into the sealed store and',
+    `nowhere else — not into a row, not into this output, not into ${SEALED_AT} in any readable form.`,
+    '',
+    'So an agent may declare a secret and may never give it one. That is the point of the split.',
+].join('\n');
+const flagged = argv.indexOf(RECEIPT);
+if (verb === undefined && flagged === -1) {
+    const nonce = issue(TREE.at, listing);
+    stdout.write(`${method(nonce)}\n`);
+    stdout.write(`\nsecret: receipt ${nonce} — spent on use, and stale the moment ${at} changes.\n`);
+    exit(0);
+}
+spend(TREE.at, listing, argv[flagged + 1], at);
+if (verb !== 'new' && verb !== 'set' && verb !== 'edit') {
+    refuse(`there is nothing called "${verb ?? ''}" to do here — say new, edit or set`);
+}
+const text = readFileSync(path, 'utf8');
+const where = listBounds(text, LIST);
+if (where === undefined)
+    refuse(`${at} states no \`${LIST}\` list to declare a secret in`);
+if (verb === 'set') {
+    const id = words[1] ?? refuse('`set` takes the id of a secret this app already declares');
+    const one = secrets.find((each) => each.id === id);
+    if (one === undefined) {
+        refuse(`\`${id}\` is not a secret this app declares. Declare it first with \`thread create secret new\` — a value is ` +
+            'given to something that said it needed it, or not at all.');
+    }
+    if (stdin.isTTY !== true) {
+        refuse('a value is typed by a person at a terminal, and this run is piped. Nothing was written. Run ' +
+            `\`thread create secret set ${id}\` yourself — an agent may declare a secret and may never give it one.`);
+    }
+    if ((await sealing(id)) === 0) {
+        stdout.write('secret: nothing typed, so nothing was sealed.\n');
+        exit(0);
+    }
+    const kept = spawnSync('npx', ['thread', 'vault'], { cwd: TREE.at, encoding: 'utf8' });
+    stdout.write(`${`${kept.stdout ?? ''}${kept.stderr ?? ''}`.trim()}\n`);
+    exit(kept.status === 0 ? 0 : 1);
+}
+const piped = given();
+only(piped, TAKES, 'a secret');
+const { ask, line, shut } = asking(piped);
+const own = ownAnswers(piped);
+const name = slug(words[1] ?? (await ask('name', 'name: ')));
+if (name === '') {
+    shut();
+    refuse('a secret has to be called something');
+}
+if (!NAME.test(name)) {
+    shut();
+    refuse(`"${name}" cannot be the name of a secret — it is written in lower_snake_case`);
+}
+const holder = (piped.length > 0 ? needed(own, 'holder', 'a secret') : await ask('holder', `who may hold it — ${WORDS.join(', ')}: `)).trim();
+if (!WORDS.includes(holder)) {
+    shut();
+    refuse(`there is no such holder as "${holder}". A secret is held by a ${WORDS.join(' or a ')}, and that prefix is the ` +
+        'only thing standing between a server credential and a browser bundle.');
+}
+const word = holder;
+const id = `${SECRECY[word]}${name}`;
+if (secrets.some((one) => one.id === id) || holdsRow(text, where, id)) {
+    shut();
+    refuse(`\`${id}\` is already declared in ${at}`);
+}
+const describes = (piped.length > 0 ? needed(own, 'describes', 'a secret') : await ask('describes', 'what is it for? ')).trim();
+if (describes === '') {
+    shut();
+    refuse('a secret says what it is for — the sentence is what somebody reads before requiring it');
+}
+const header = (piped.length > 0 ? (answer(own, 'header') ?? '') : await ask('header', 'header (blank if this value IS an address): ')).trim();
+const typed = header === '' ? '' : (piped.length > 0 ? (answer(own, 'prefix') ?? '') : await ask('prefix', 'prefix in that header, e.g. "Bearer ": '));
+const { stated, kids } = await stating(asksOf('secret', 'Secret', {}, ['id', 'at', 'describes', 'version', 'sends']), piped, piped.length > 0, ask, line, []);
+shut();
+const prefix = typed === '' || typed.endsWith(' ') ? typed : `${typed} `;
+const row = [
+    '  {',
+    `    id: ${quoted(id)},`,
+    `    at: '_threads/${FILE}',`,
+    `    describes: ${quoted(describes)},`,
+    '    version: 1,',
+    ...(header === ''
+        ? []
+        : [`    sends: { header: ${quoted(header.toLowerCase())}${prefix === '' ? '' : `, prefix: ${quoted(prefix)}`} },`]),
+    ...rowLines('    ', stated, kids),
+    '  },',
+].join('\n');
+writeFileSync(path, withRow(text, where, row), 'utf8');
+for (const told of seeding(kids, TREE.at))
+    stdout.write(`secret: ${told}\n`);
+stdout.write(`secret: declared ${id} in ${at}${header === '' ? ' — it has no `sends`, so it is the address of whatever requires it' : ''}.\n`);
+if (stdin.isTTY === true) {
+    stdout.write(`\n${SAID[word]}\n\nThe value is not echoed and is sealed straight into ${SEALED_AT}.\n`);
+    if ((await sealing(id)) === 0) {
+        stdout.write(`secret: nothing typed, so ${id} has no value yet. Run \`thread create secret set ${id}\` when you have it.\n`);
+    }
+}
+else {
+    stdout.write(`secret: it has no value anywhere yet, and this run is piped — a value is typed by a person at a terminal. ` +
+        `Run \`thread create secret set ${id}\` yourself.\n`);
+}
+const kept = spawnSync('npx', ['thread', 'vault'], { cwd: TREE.at, encoding: 'utf8' });
+stdout.write(`${`${kept.stdout ?? ''}${kept.stderr ?? ''}`.trim()}\n`);
+exit(kept.status === 0 ? 0 : 1);

package/dist/integrations/generators/target.d.ts

@@ -0,0 +1 @@
+export {};