@prestack/thread 0.0.1

package/dist/integrations/generators/vault.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/generators/vault.js

@@ -0,0 +1,164 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+import { argv, stderr, stdout } from 'node:process';
+import { fileURLToPath } from 'node:url';
+import ts from 'typescript';
+import { exit } from "../../core/invoked.js";
+import { named as packageOf } from "../../core/scope.js";
+import { findTree, inTree, strayFiles } from "../../core/tree.js";
+import { unclassified, valued } from "../secret.js";
+import { refusals, servesBrowser } from "../target.js";
+import { SEALED_AT } from "../vault.js";
+const TREE = findTree();
+const AT = 'src/vault.ts';
+const here = (one) => relative(TREE.at, one).split('\\').join('/');
+const from = inTree(TREE, 'secrets.ts');
+const path = join(TREE.at, AT);
+const toward = relative(dirname(path), fileURLToPath(new URL('../vault.ts', import.meta.url))).split('\\').join('/');
+const opens = toward.startsWith('.') ? toward : `./${toward}`;
+const declares = relative(dirname(path), from).split('\\').join('/');
+const sheet = declares.startsWith('.') ? declares : `./${declares}`;
+function refuse(because) {
+    stderr.write(`vault: ${because}\n`);
+    exit(1);
+}
+let secrets = [];
+try {
+    const taken = (await import(__rewriteRelativeImportExtension(new URL(`file://${from}`).href)));
+    secrets = taken.SECRETS ?? [];
+}
+catch {
+    refuse(`${here(from)} could not be read. Attach \`${packageOf('integrations')}\` first — an app states its secrets there.`);
+}
+const declared = secrets.map((one) => one.id).sort();
+const SOURCE = `import { opened } from '${opens}'
+
+import { SECRETS } from '${sheet}'
+
+export const vault = opened(process.cwd(), SECRETS.map((one) => one.id), process.env.NODE_ENV === 'production' ? 'production' : 'sandbox')
+`;
+async function taken(file, list) {
+    const at = inTree(TREE, file);
+    if (!existsSync(at))
+        return [];
+    try {
+        const held = (await import(__rewriteRelativeImportExtension(new URL(`file://${at}`).href)));
+        return held[list] ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+function imported(at, text) {
+    const source = ts.createSourceFile(at, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+    const found = [];
+    const walk = (node) => {
+        if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
+            const said = node.moduleSpecifier;
+            if (said !== undefined && ts.isStringLiteral(said))
+                found.push(said.text);
+        }
+        else if (ts.isCallExpression(node)) {
+            const first = node.arguments[0];
+            const dynamic = node.expression.kind === ts.SyntaxKind.ImportKeyword;
+            const legacy = ts.isIdentifier(node.expression) && node.expression.text === 'require';
+            if ((dynamic || legacy) && first !== undefined && ts.isStringLiteral(first))
+                found.push(first.text);
+        }
+        ts.forEachChild(node, walk);
+    };
+    walk(source);
+    return found;
+}
+function names(specifier, id) {
+    const bare = specifier.replace(/\.(?:m|c)?[jt]sx?$/, '');
+    return bare === `operations/${id}` || bare.endsWith(`/operations/${id}`);
+}
+async function reaching() {
+    const targets = await taken('targets.ts', 'TARGETS');
+    const withheld = new Map();
+    for (const one of targets) {
+        const said = servesBrowser(one, secrets);
+        if (said !== true)
+            withheld.set(one.id, said);
+    }
+    if (withheld.size === 0)
+        return [];
+    const operations = await taken('operations.ts', 'MEMBERS');
+    const risky = new Map();
+    for (const one of operations) {
+        for (const word of one.requires ?? []) {
+            const said = withheld.get(word);
+            if (said !== undefined)
+                risky.set(one.id, said);
+        }
+    }
+    if (risky.size === 0)
+        return [];
+    const found = [];
+    for (const one of strayFiles(TREE.at, '', '.tsx')) {
+        let text;
+        try {
+            text = readFileSync(join(TREE.at, one), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const specifiers = imported(one, text);
+        for (const [id, said] of risky) {
+            if (!specifiers.some((each) => names(each, id)))
+                continue;
+            found.push(`${one} is a \`.tsx\` file and it imports \`${id}\`. ${said} This holds whoever bundles it — ` +
+                'a page is a page whether Next, Vite or anything else compiles it, so the refusal is about the ' +
+                'import rather than about any one build. Call it from a server and let the page ask the server');
+        }
+    }
+    return found;
+}
+async function stated() {
+    const targets = await taken('targets.ts', 'TARGETS');
+    const calls = await taken('targets.ts', 'CALLS');
+    const entities = (await taken('entities.ts', 'ENTITIES')).map((one) => one.id);
+    return [
+        ...unclassified(secrets),
+        ...valued(secrets),
+        ...refusals(targets, secrets, calls, entities),
+        ...(await reaching()),
+    ];
+}
+const checking = argv.includes('--check');
+const opening = `${String(declared.length)} declared secret(s)`;
+if (checking) {
+    const wrong = await stated();
+    if (wrong.length > 0) {
+        refuse([
+            `${String(wrong.length)} thing(s) this app states about what it reaches will not hold:`,
+            ...wrong.map((one) => `  ${one}`),
+        ].join('\n'));
+    }
+    if (!existsSync(path)) {
+        refuse(`${AT} is not there, and it is what opens this app's sealed values. Run \`thread vault\` — it seeds the file ` +
+            'once, and from then on it is yours.');
+    }
+    stdout.write(`vault: ${AT} is seeded and opens ${opening}, read off ${here(from)} as they are declared.\n`);
+    exit(0);
+}
+if (existsSync(path)) {
+    stdout.write(`vault: ${AT} is already yours — it opens ${opening}, read off ${here(from)} as they are declared.\n`);
+    exit(0);
+}
+mkdirSync(dirname(path), { recursive: true });
+writeFileSync(path, SOURCE, 'utf8');
+stdout.write(`vault: seeded ${AT} — what opens a secret's value at the moment of use, and yours from here.\n` +
+    `  It opens the values sealed under ${SEALED_AT} for the secrets declared in ${here(from)}, and refuses every other name.\n` +
+    '  `thread create secret` declares one and seals its value; nothing else ever takes a value.\n' +
+    '  To open values from somewhere else in production, replace opened here with what reads them.\n');
+exit(0);

package/dist/integrations/sdk.d.ts

@@ -0,0 +1,6 @@
+export declare function ran(name: string): Promise<void>;
+export declare function run(declared: {
+    readonly name: string;
+    readonly module: string;
+    readonly requires: readonly string[];
+}): Promise<void>;

package/dist/integrations/sdk.js

@@ -0,0 +1,151 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { spawnSync } from 'node:child_process';
+import { argv, stderr, stdout } from 'node:process';
+import { answer, asking, given, only, wordsIn } from "../core/asking.js";
+import { exit } from "../core/invoked.js";
+import { findTree, inTree } from "../core/tree.js";
+import { REACH, reachOf } from "./target.js";
+import { opened } from "./vault.js";
+const PRODUCTION = '--production';
+const METHOD = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/;
+function isClass(fn) {
+    return /^class[\s{]/.test(Function.prototype.toString.call(fn));
+}
+const ASKS = [
+    {
+        key: 'args',
+        says: 'a JSON value — an array for positional arguments, anything else for one, blank for none',
+    },
+];
+const TAKES = ASKS.map((one) => one.key);
+const ASKED = ASKS.map((one) => `\`${one.key}\`: ${one.says}`);
+export async function ran(name) {
+    const say = (because) => {
+        stderr.write(`${name}: ${because}\n`);
+        exit(1);
+    };
+    const tree = findTree();
+    let targets = [];
+    try {
+        const taken = (await import(__rewriteRelativeImportExtension(new URL(`file://${inTree(tree, 'targets.ts')}`).href)));
+        targets = taken.TARGETS ?? [];
+    }
+    catch {
+        return say('`_threads/targets.ts` could not be read, so nothing says what this integration is.');
+    }
+    const mine = targets.find((one) => one.id === `${REACH.cli}${name}` || one.id === `${REACH.sdk}${name}`);
+    if (mine === undefined) {
+        return say(`no target called \`${REACH.cli}${name}\` or \`${REACH.sdk}${name}\` is declared here, so this command should ` +
+            'not exist. Declare it with `thread create target`, or take its row out of `_threads/derivation.ts`.');
+    }
+    const does = mine.offers ?? [];
+    const passed = argv.slice(2);
+    const sub = passed[0];
+    if (sub === undefined) {
+        stdout.write(`${name}: ${mine.describes}\n\n${String(does.length)} command(s), read off \`${mine.uses ?? ''}\` when \`${mine.id}\` was declared:\n` +
+            `${does.join(', ') || '(none were readable — name them with `thread create target edit`)'}\n\n` +
+            `thread run ${name} <command> [anything else] — arguments and flags reach \`${mine.uses ?? ''}\` untouched.\n` +
+            `It takes ${String(ASKED.length)} answer(s): ${ASKED.join('; ')}.\n`);
+        exit(0);
+    }
+    if (!does.includes(sub)) {
+        return say(`\`${sub}\` is not one of the ${String(does.length)} command(s) \`${mine.uses ?? ''}\` stated when \`${mine.id}\` ` +
+            `was declared. It declared: ${does.join(', ') || '(nothing)'}. If the tool has changed, read it again with ` +
+            `\`thread create target edit ${mine.id}\`.`);
+    }
+    if (reachOf(mine.id) === 'sdk') {
+        return run({ name, module: mine.uses ?? '', requires: mine.requires });
+    }
+    const went = spawnSync(mine.uses ?? '', passed, { cwd: tree.at, stdio: 'inherit' });
+    exit(went.status ?? 1);
+}
+export async function run(declared) {
+    const refuse = (because) => {
+        stderr.write(`${declared.name}: ${because}\n`);
+        exit(1);
+    };
+    const method = wordsIn([])[0];
+    if (method === undefined) {
+        return refuse(`takes the method to call, dot-separated for a namespaced one — e.g. \`thread run ${declared.name} customers.list\`.`);
+    }
+    if (!METHOD.test(method)) {
+        return refuse(`\`${method}\` is not a method path — one name, or names joined by dots, e.g. \`customers.list\``);
+    }
+    const piped = given();
+    only(piped, TAKES, `\`thread run ${declared.name} ${method}\``);
+    const { ask, shut } = asking(piped);
+    const typed = (piped.length > 0
+        ? (answer(piped, TAKES[0] ?? 'args') ?? '')
+        : await ask('args', 'args, as JSON — an array for positional arguments, anything else for one (blank for none): ')).trim();
+    shut();
+    let args = [];
+    if (typed !== '') {
+        let parsed;
+        try {
+            parsed = JSON.parse(typed);
+        }
+        catch (thrown) {
+            return refuse(`that is not JSON: ${thrown instanceof Error ? thrown.message : String(thrown)}. Nothing was called.`);
+        }
+        args = Array.isArray(parsed) ? parsed : [parsed];
+    }
+    const env = argv.includes(PRODUCTION) ? 'production' : 'sandbox';
+    const opening = opened(findTree().at, declared.requires, env);
+    let resolved;
+    try {
+        resolved = await opening(declared.requires);
+    }
+    catch (thrown) {
+        return refuse(thrown instanceof Error ? thrown.message : String(thrown));
+    }
+    const credentials = declared.requires.map((one) => resolved[one] ?? '');
+    let mod;
+    try {
+        mod = (await import(__rewriteRelativeImportExtension(declared.module)));
+    }
+    catch (thrown) {
+        return refuse(`\`${declared.module}\` could not be imported: ${thrown instanceof Error ? thrown.message : String(thrown)}. It was ` +
+            `installed when this was declared — if it is gone, \`npm install ${declared.module}\` puts it back.`);
+    }
+    const entry = mod.default ?? mod;
+    const asFunction = entry;
+    const asConstructor = entry;
+    const REACHES = new Set(['constructor', '__proto__', 'prototype']);
+    const client = typeof entry !== 'function' ? entry : isClass(asFunction) ? Reflect.construct(asConstructor, credentials) : asFunction(...credentials);
+    let owner = client;
+    let target = client;
+    for (const segment of method.split('.')) {
+        if (REACHES.has(segment)) {
+            return refuse(`\`${segment}\` is not an operation of \`${declared.module}\` — it is a step every JavaScript value has, and ` +
+                'walking to it leaves what was installed. What may run here is what the SDK exports, and a person fixed that ' +
+                'set when they declared it.');
+        }
+        owner = target;
+        target = target?.[segment];
+    }
+    if (typeof target !== 'function') {
+        return refuse(`\`${method}\` on \`${declared.module}\` is ${target === undefined ? 'nothing' : `a ${typeof target}`}, not a method that can be called`);
+    }
+    let result;
+    try {
+        result = await target.apply(owner, args);
+    }
+    catch (thrown) {
+        return refuse(`\`${method}\` on \`${declared.module}\` threw: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+    }
+    stdout.write(`${declared.name}: ${method} (${env})\n`);
+    try {
+        stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    }
+    catch {
+        stdout.write(`${String(result)}\n`);
+    }
+    exit(0);
+}

package/dist/integrations/secret.d.ts

@@ -0,0 +1,16 @@
+import type { Member } from '../core/thread.ts';
+export declare const SECRECY: {
+    readonly server: "sec_";
+    readonly public: "pub_";
+};
+export declare const SAID: Readonly<Record<keyof typeof SECRECY, string>>;
+export interface Secret extends Member {
+    readonly sends?: {
+        readonly header: string;
+        readonly prefix?: string;
+    };
+}
+export declare function secrecyOf(id: string): keyof typeof SECRECY | undefined;
+export declare const isServerOnly: (id: string) => boolean;
+export declare const unclassified: (secrets: readonly Secret[]) => readonly string[];
+export declare const valued: (secrets: readonly Secret[]) => readonly string[];

package/dist/integrations/secret.js

@@ -0,0 +1,30 @@
+export const SECRECY = {
+    server: 'sec_',
+    public: 'pub_',
+};
+export const SAID = {
+    server: 'A value only a server may ever hold — an API key, a connection string, a signing secret. Everything a browser bundle reaches is in the bundle and belongs to whoever opens the page, so a target requiring one of these is refused a browser entry when it is built rather than when somebody reads it.',
+    public: 'A value that may reach a browser: a base url, a publishable key, a project id. It is still a secret and still lives in the sealed store, because it still differs between a sandbox and production and nothing else here keeps that difference. What it is not is a thing that has to be withheld.',
+};
+export function secrecyOf(id) {
+    return Object.keys(SECRECY).find((one) => id.startsWith(SECRECY[one]));
+}
+export const isServerOnly = (id) => secrecyOf(id) === 'server';
+export const unclassified = (secrets) => secrets
+    .filter((one) => secrecyOf(one.id) === undefined)
+    .map((one) => `\`${one.id}\` wears neither \`${SECRECY.server}\` nor \`${SECRECY.public}\`, so nothing can tell whether it may ` +
+    'reach a browser — and that prefix is the only thing standing between a server credential and a bundle');
+const VALUED = ['value', 'secret', 'key', 'token', 'password', 'env'];
+export const valued = (secrets) => {
+    const found = [];
+    for (const one of secrets) {
+        for (const named of VALUED) {
+            if (!(named in one))
+                continue;
+            found.push(`\`${one.id}\` carries a \`${named}\`. A secret row holds a name and a sentence and never a value — this row is ` +
+                'read by the descent, by every generator and by anything that prints the tree, while a credential is read by ' +
+                'one thing at one moment. Put the value in the sealed store with `thread create secret`');
+        }
+    }
+    return found;
+};

package/dist/integrations/target.d.ts

@@ -0,0 +1,49 @@
+import type { Member } from '../core/thread.ts';
+import { type Secret } from './secret.ts';
+export declare const REACH: {
+    readonly postgres: "pg_";
+    readonly pglite: "pl_";
+    readonly browser: "zu_";
+    readonly https: "ht_";
+    readonly sdk: "sdk_";
+    readonly cli: "cli_";
+};
+export type Reach = keyof typeof REACH;
+export interface Holds {
+    readonly takes: 'entities' | 'calls' | 'names';
+    readonly from: 'server' | 'browser' | 'either';
+    readonly addressed: boolean;
+    readonly arrives: 'npm' | 'machine' | null;
+    readonly migrations: boolean;
+    readonly references: boolean;
+    readonly sql: boolean;
+}
+export declare const HOLDS: Readonly<Record<Reach, Holds>>;
+export declare const SAID: Readonly<Record<Reach, string>>;
+export interface Target extends Member {
+    readonly takes: readonly string[];
+    readonly requires: readonly string[];
+    readonly uses?: string;
+    readonly offers?: readonly string[];
+}
+export interface Call extends Member {
+    readonly of: string;
+    readonly method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    readonly path: string;
+}
+export declare const CALL_PREFIX = "cl_";
+export declare const fills: (one: Call) => readonly string[];
+export declare function reachOf(id: string): Reach | undefined;
+export declare function holdsOf(id: string): Holds | undefined;
+export declare function addressOf(one: Target, secrets: readonly Secret[]): Secret | undefined;
+export declare function credentialsOf(one: Target, secrets: readonly Secret[]): readonly Secret[];
+export declare function servesBrowser(one: Target, secrets: readonly Secret[]): true | string;
+export declare const unreachable: (targets: readonly Target[]) => readonly string[];
+export declare function misnamed(target: string, name: string): string | undefined;
+export declare function misaccepted(targets: readonly Target[], entities: readonly string[], calls: readonly Call[]): readonly string[];
+export declare function unaddressed(targets: readonly Target[], secrets: readonly Secret[]): readonly string[];
+export declare function unheld(targets: readonly Target[], secrets: readonly Secret[]): readonly string[];
+export declare function unanswered(calls: readonly Call[], targets: readonly Target[]): readonly string[];
+export declare function misused(targets: readonly Target[]): readonly string[];
+export declare function refusals(targets: readonly Target[], secrets: readonly Secret[], calls: readonly Call[], entities: readonly string[]): readonly string[];
+export declare function targetOf(entity: string, targets: readonly Target[]): Target | string;

package/dist/integrations/target.js

@@ -0,0 +1,225 @@
+import { SECRECY, secrecyOf } from "./secret.js";
+export const REACH = {
+    postgres: 'pg_',
+    pglite: 'pl_',
+    browser: 'zu_',
+    https: 'ht_',
+    sdk: 'sdk_',
+    cli: 'cli_',
+};
+export const HOLDS = {
+    postgres: { takes: 'entities', from: 'server', addressed: true, arrives: null, migrations: true, references: true, sql: true },
+    pglite: { takes: 'entities', from: 'either', addressed: true, arrives: null, migrations: true, references: true, sql: true },
+    browser: { takes: 'entities', from: 'browser', addressed: false, arrives: null, migrations: false, references: false, sql: false },
+    https: { takes: 'calls', from: 'either', addressed: true, arrives: null, migrations: false, references: false, sql: false },
+    sdk: { takes: 'names', from: 'either', addressed: false, arrives: 'npm', migrations: false, references: false, sql: false },
+    cli: { takes: 'names', from: 'server', addressed: false, arrives: 'machine', migrations: false, references: false, sql: false },
+};
+export const SAID = {
+    postgres: 'A postgres this app connects to over the network. It keeps entities and holds everything a declaration can state about their shape — tables, references and invariants — so what is kept here is held to that shape by the database itself rather than by whatever remembered to check. Who may touch a row is not asked of it: that is answered by the app, against the caller who actually arrived. It is reached from a server only: a connection to it from a page is a database somebody else can open. This is where a thing goes when losing it would matter.',
+    pglite: 'A postgres running inside the process that opened it. It keeps entities and holds tables, references and invariants, exactly as the networked one does — what differs is who can reach it, not what it can be told to hold. What belongs here is what the caller is already entitled to see: a local copy, a working set, an offline cache.',
+    browser: 'A store in the browser, held in memory the viewer owns. It keeps entities and it is addressed by nothing, because it is already where the code runs. It holds no migration, because a page load builds it from nothing every time. What belongs here is what the interface needs to be responsive and can afford to lose.',
+    https: 'Something this app calls over https — a vendor, a service, another app. It accepts calls rather than entities: each is declared with the verb and the path it takes, so a node names the call and never writes a url. Its address and its credential are both secrets, and whether it may be reached from a browser is decided by which kind of secret it needs rather than by the reach itself.',
+    sdk: 'An npm package this app calls directly instead of over the wire — stripe, supabase, neon. Declaring one installs it and reads the methods it publishes, then asks which of them this app may call. What is picked is written down, and a method that is not on that list is refused before the package is imported: what can ever run is fixed when the target is declared, not by whoever calls it. Credentials come from the vault at the moment of the call and are never written anywhere.',
+    cli: 'A program this app runs as a command — git is the one that made this necessary. It is not installed, because it is not a dependency: it is either on the machine or it is not, and declaring one checks that it is there and says what to do when it is not. What it accepts is its subcommands, read off the program itself at the moment it is declared and written down: the whole surface the tool really has, because it was asked rather than typed, and a subcommand that is not on that list never runs. Declaring one is what brings `thread run <name>` into being, so the CLI grows a command by the app stating an integration rather than by anybody writing a verb — and an app that has not declared it has no such command at all.',
+};
+export const CALL_PREFIX = 'cl_';
+const FILLED = /\{([a-z][a-z0-9_]*)\}/g;
+export const fills = (one) => [...one.path.matchAll(FILLED)].map((each) => each[1] ?? '');
+export function reachOf(id) {
+    return Object.keys(REACH).find((one) => id.startsWith(REACH[one]));
+}
+export function holdsOf(id) {
+    const what = reachOf(id);
+    return what === undefined ? undefined : HOLDS[what];
+}
+export function addressOf(one, secrets) {
+    if (holdsOf(one.id)?.addressed !== true)
+        return undefined;
+    const held = new Map(secrets.map((each) => [each.id, each]));
+    return one.requires.map((each) => held.get(each)).find((each) => each !== undefined && each.sends === undefined);
+}
+export function credentialsOf(one, secrets) {
+    const held = new Map(secrets.map((each) => [each.id, each]));
+    return one.requires
+        .map((each) => held.get(each))
+        .filter((each) => each !== undefined && each.sends !== undefined);
+}
+export function servesBrowser(one, secrets) {
+    const holds = holdsOf(one.id);
+    if (holds === undefined) {
+        return `\`${one.id}\` wears none of the prefixes a target is reached by, so nothing can tell where it may be reached from`;
+    }
+    if (holds.from === 'server') {
+        return (`\`${one.id}\` is reached over ${String(reachOf(one.id))}, and that reach is server-only whatever it is ` +
+            'authenticated with — the refusal is about the reach itself and not about any credential');
+    }
+    const held = new Map(secrets.map((each) => [each.id, each]));
+    for (const named of one.requires) {
+        const secret = held.get(named);
+        if (secret === undefined)
+            continue;
+        if (secrecyOf(secret.id) === 'server') {
+            return (`\`${one.id}\` requires \`${secret.id}\`, which wears \`${SECRECY.server}\` — a value only a server may hold. ` +
+                'Everything a browser bundle reaches is in the bundle, so this would ship the credential to whoever opens the page');
+        }
+    }
+    return true;
+}
+export const unreachable = (targets) => targets
+    .filter((one) => reachOf(one.id) === undefined)
+    .map((one) => `\`${one.id}\` wears none of the prefixes a target is reached by (${Object.values(REACH).join(', ')}), so ` +
+    'nothing can tell how to reach it — and how a thing is reached decides what may be declared for it');
+const SHAPED = {
+    sdk: /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/,
+    cli: /^[a-z][a-z0-9-]*$/,
+};
+const EVERY_VALUE = new Set(['constructor', '__proto__', 'prototype']);
+export function misnamed(target, name) {
+    const reach = reachOf(target);
+    if (reach !== 'sdk' && reach !== 'cli')
+        return undefined;
+    if (EVERY_VALUE.has(name)) {
+        return (`\`${name}\` is a step every JavaScript value has rather than something \`${target}\` offers, and walking to ` +
+            'it leaves what was declared');
+    }
+    if (!SHAPED[reach].test(name)) {
+        return reach === 'sdk'
+            ? `\`${name}\` is not a method path — one name, or names joined by dots, e.g. \`customers.list\``
+            : `\`${name}\` is not a subcommand — one word as the program spells it, e.g. \`commit\` or \`rev-parse\``;
+    }
+    return undefined;
+}
+export function misaccepted(targets, entities, calls) {
+    const isEntity = new Set(entities);
+    const isCall = new Set(calls.map((one) => one.id));
+    const found = [];
+    for (const one of targets) {
+        const holds = holdsOf(one.id);
+        if (holds === undefined)
+            continue;
+        for (const named of one.takes) {
+            if (holds.takes === 'entities' && isEntity.has(named))
+                continue;
+            if (holds.takes === 'calls' && isCall.has(named))
+                continue;
+            if (holds.takes === 'names') {
+                found.push(`\`${one.id}\` is reached as ${String(reachOf(one.id))} and its \`takes\` names "${named}" — what an ` +
+                    'installed package or a program responds to goes in `offers`, not here. `takes` is a demand, and the ' +
+                    'descent requires every word on one to be coined by a row in this tree; a method name never can be');
+                continue;
+            }
+            found.push(`\`${one.id}\` is reached over ${String(reachOf(one.id))} and so accepts ${holds.takes}, and its \`takes\` names ` +
+                `"${named}", which is ${isEntity.has(named) ? 'an entity' : isCall.has(named) ? 'a call' : 'nothing this app declares'}`);
+        }
+    }
+    return found;
+}
+export function unaddressed(targets, secrets) {
+    const held = new Map(secrets.map((one) => [one.id, one]));
+    const found = [];
+    for (const one of targets) {
+        const holds = holdsOf(one.id);
+        if (holds === undefined)
+            continue;
+        const addresses = one.requires
+            .map((each) => held.get(each))
+            .filter((each) => each !== undefined && each.sends === undefined);
+        if (!holds.addressed) {
+            if (holds.arrives === null && addresses.length > 0) {
+                found.push(`\`${one.id}\` is reached over ${String(reachOf(one.id))}, which is addressed by nothing and needs nothing to ` +
+                    `reach it, and it requires \`${addresses[0]?.id ?? ''}\` — there is nowhere for that value to go`);
+            }
+            continue;
+        }
+        if (addresses.length === 0) {
+            found.push(`\`${one.id}\` is reached over ${String(reachOf(one.id))} and nothing says where it is. Require one secret with ` +
+                'no `sends` — that one is its address. A credential with nowhere to be sent is a value nothing can use');
+            continue;
+        }
+        if (addresses.length > 1) {
+            found.push(`\`${one.id}\` requires ${addresses.map((each) => `\`${each.id}\``).join(' and ')}, and neither says where it goes, ` +
+                'so both read as its address. One place is reached at one address');
+        }
+    }
+    return found;
+}
+export function unheld(targets, secrets) {
+    const known = new Set(secrets.map((one) => one.id));
+    const found = [];
+    for (const one of targets) {
+        for (const named of one.requires) {
+            if (known.has(named))
+                continue;
+            found.push(`\`${one.id}\` requires "${named}", and this app declares no secret by that name. A secret is declared before it ` +
+                'is required, so the one place saying who may hold a value is never whichever place happened to need it');
+        }
+    }
+    return found;
+}
+export function unanswered(calls, targets) {
+    const held = new Map(targets.map((one) => [one.id, one]));
+    const found = [];
+    for (const one of calls) {
+        const of = held.get(one.of);
+        if (of === undefined) {
+            found.push(`\`${one.id}\` is a call on "${one.of}", and this app declares no target by that name`);
+            continue;
+        }
+        const holds = holdsOf(of.id);
+        if (holds !== undefined && holds.takes !== 'calls') {
+            found.push(`\`${one.id}\` is a call on \`${of.id}\`, which is reached over ${String(reachOf(of.id))} and keeps entities. ` +
+                'A place you keep rows in is not a place you issue verbs at');
+            continue;
+        }
+        if (!of.takes.includes(one.id)) {
+            found.push(`\`${one.id}\` is a call on \`${of.id}\` and \`${of.id}\` does not accept it. Add it to that target's \`takes\` — ` +
+                'what a target accepts is read off the target, not gathered from whatever pointed at it');
+        }
+    }
+    return found;
+}
+export function misused(targets) {
+    const found = [];
+    for (const one of targets) {
+        const holds = holdsOf(one.id);
+        if (holds === undefined)
+            continue;
+        if (holds.arrives !== null && (one.uses ?? '') === '') {
+            found.push(`\`${one.id}\` is reached as ${String(reachOf(one.id))} and does not say what it uses — ` +
+                `${holds.arrives === 'npm' ? 'the npm package to install' : 'the program to run'} goes in \`uses\`, because the ` +
+                'id is what this app calls it and not what it is');
+            continue;
+        }
+        if (holds.arrives === null && one.uses !== undefined) {
+            found.push(`\`${one.id}\` is reached over ${String(reachOf(one.id))}, where nothing is installed and nothing is spawned, ` +
+                `and it states \`uses: '${one.uses}'\` — there is nothing for that name to be`);
+        }
+    }
+    return found;
+}
+export function refusals(targets, secrets, calls, entities) {
+    return [
+        ...unreachable(targets),
+        ...unheld(targets, secrets),
+        ...unaddressed(targets, secrets),
+        ...unanswered(calls, targets),
+        ...misaccepted(targets, entities, calls),
+        ...misused(targets),
+    ];
+}
+export function targetOf(entity, targets) {
+    const keeping = targets.filter((one) => holdsOf(one.id)?.takes === 'entities');
+    const found = keeping.filter((one) => one.takes.includes(entity));
+    const only = found[0];
+    if (only === undefined) {
+        return (`"${entity}" is kept by no target. Add its id to the \`takes\` of one of ` +
+            `${keeping.length === 0 ? '(this app declares none that keep things)' : keeping.map((one) => `\`${one.id}\``).join(', ')} — ` +
+            'an entity nothing keeps is a table no database builds, and nothing else here would ever say so');
+    }
+    if (found.length > 1) {
+        return (`"${entity}" is kept by ${found.map((one) => `\`${one.id}\``).join(' and ')}. One thing kept in two places is two ` +
+            'things that will disagree, and neither declaration says which one is right');
+    }
+    return only;
+}

package/dist/integrations/vault.d.ts

@@ -0,0 +1,12 @@
+import type { Env } from '../core/actor.ts';
+export declare const VAULT_DIR = ".thread";
+export declare const SEALED_AT = ".thread/vault.sealed.json";
+export declare const KEY_AT = ".thread/vault.key";
+export declare const ALGORITHM = "aes-256-gcm";
+export declare const KEY_BYTES = 32;
+export declare const keyOf: (root: string) => Buffer | undefined;
+export declare function keyed(root: string): Buffer;
+export declare function seal(root: string, named: string, env: Env, value: string): void;
+export declare const sealedIn: (root: string, env: Env) => readonly string[];
+export declare function opened(root: string, declared: readonly string[], env: Env): (refs: readonly string[]) => Promise<Readonly<Record<string, string>>>;
+export declare const IGNORES: readonly string[];