@prestack/thread 0.0.2 → 0.1.0

package/dist/integrations/generators/secret.ts

@@ -1,289 +0,0 @@
-import { spawnSync } from 'node:child_process'
-import { appendFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs'
-import { join, relative } from 'node:path'
-import { argv, stdin, stdout } from 'node:process'
-import { createInterface } from 'node:readline'
-
-import { exit } from '../../core/invoked.ts'
-import type { Env } from '../../core/actor.ts'
-import { ELSEWHERE, RECEIPT, answer, asking, asksOf, given, issue, needed, only, ownAnswers, refuse, rowLines, seeding, slug, spend, stating, wordsIn } from '../../core/asking.ts'
-import { holdsRow, listBounds, rowsIn, withRow } from '../../core/rows.ts'
-import { named as packageOf } from '../../core/scope.ts'
-import { findTree, inTree } from '../../core/tree.ts'
-
-import { SAID, SECRECY, secrecyOf, type Secret } from '../secret.ts'
-import { IGNORES, KEY_AT, SEALED_AT, keyOf, seal, sealedIn } from '../vault.ts'
-
-const TREE = findTree()
-
-const FILE = 'secrets.ts'
-
-const LIST = 'SECRETS'
-
-const NAME = /^[a-z][a-z0-9_]*$/
-
-const ENVS: readonly Env[] = ['sandbox', 'production']
-
-const WORDS = Object.keys(SECRECY) as (keyof typeof SECRECY)[]
-
-const ASKS: readonly { readonly key: string; readonly says: readonly string[]; readonly edits?: true }[] = [
-  { key: 'name', says: ['lower_snake_case, and the prefix is added for you'] },
-  { key: 'holder', says: [`who may hold it — ${WORDS.join(', ')}`] },
-  { key: 'describes', says: ['what it is for, in one sentence'], edits: true },
-  { key: 'header', says: ['blank if this value IS the address of what requires it'], edits: true },
-  { key: 'prefix', says: ['what precedes it in that header, trailing space and all'], edits: true },
-]
-
-const TAKES: readonly string[] = ASKS.map((one) => one.key)
-
-const EDITS: readonly string[] = ASKS.filter((one) => one.edits === true).map((one) => one.key)
-
-const ASKED: readonly string[] = ASKS.flatMap((one) =>
-  one.says.map((line, at) => `  ${at === 0 ? `${one.key}:`.padEnd(32) : ' '.repeat(32)}${line}`),
-)
-
-const here = (one: string): string => relative(TREE.at, one).split('\\').join('/')
-
-const path = inTree(TREE, FILE)
-
-const at = here(path)
-
-import { quoted } from '../../core/rows.ts'
-
-let secrets: readonly Secret[] = []
-try {
-  const taken = (await import(new URL(`file://${path}`).href)) as { SECRETS?: readonly Secret[] }
-  secrets = taken.SECRETS ?? []
-} catch {
-  refuse(`${at} could not be read. Attach \`${packageOf('integrations')}\` first — an app states its secrets there.`)
-}
-
-const held = new Map(ENVS.map((env) => [env, new Set(sealedIn(TREE.at, env))]))
-
-const setIn = (id: string): string => {
-  const found = ENVS.filter((env) => held.get(env)?.has(id) === true)
-  return found.length === 0 ? 'no value anywhere yet' : `set for ${found.join(' and ')}`
-}
-
-async function sealing(id: string): Promise<number> {
-  const hidden = async (question: string): Promise<string> => {
-    stdout.write(question)
-    const rl = createInterface({ input: stdin, output: stdout, terminal: true })
-    ;(rl as unknown as { _writeToOutput: (one: string) => void })._writeToOutput = () => {}
-    const value = await new Promise<string>((done) => rl.question('', done))
-    rl.close()
-    stdout.write('\n')
-    return value
-  }
-
-  let sealed = 0
-  for (const env of ENVS) {
-    const value = await hidden(`  ${id} for ${env} (paste it, or press enter to skip): `)
-    if (value.trim() === '') continue
-    seal(TREE.at, id, env, value)
-    sealed += 1
-  }
-  if (sealed === 0) return 0
-
-  const ignore = join(TREE.at, '.gitignore')
-  const already = existsSync(ignore) ? readFileSync(ignore, 'utf8') : ''
-  const missing = IGNORES.filter((one) => !already.split('\n').some((line) => line.trim() === one))
-  if (missing.length > 0) {
-    appendFileSync(ignore, `${already.endsWith('\n') || already === '' ? '' : '\n'}${missing.join('\n')}\n`)
-    stdout.write(`secret: added ${missing.join(', ')} to .gitignore — the key is never committed.\n`)
-  }
-
-  stdout.write(`secret: sealed ${id} for ${String(sealed)} environment(s) into ${SEALED_AT}.\n`)
-  return sealed
-}
-
-const listing =
-  secrets.length === 0
-    ? 'no secrets yet.'
-    : [
-        `${String(secrets.length)} secret(s):`,
-        ...secrets.flatMap((one) => [
-          `  ${one.id} — ${secrecyOf(one.id) ?? 'wearing no prefix, which is refused'}, ${setIn(one.id)}`,
-          `      ${one.sends === undefined ? 'no `sends`, so it is an address' : `sent as ${one.sends.header}: ${one.sends.prefix ?? ''}<value>`}`,
-        ]),
-      ].join('\n')
-
-const words = wordsIn(['new', 'set'])
-
-const verb = words[0]
-
-stdout.write(`${listing}\n`)
-if (keyOf(TREE.at) === undefined && secrets.length > 0) {
-  stdout.write(
-    `\nthere is no vault key at ${KEY_AT}, so nothing above can be opened here. It is never committed — ` +
-      'whoever set this app up has it.\n',
-  )
-}
-
-const method = (nonce: string): string =>
-  [
-    '',
-    'what this makes:',
-    '',
-    `  thread create secret new <name> ${RECEIPT} ${nonce}`,
-    `  thread create secret set <id> ${RECEIPT} ${nonce}`,
-    '',
-    ...ELSEWHERE,
-    '',
-    `  ${RECEIPT} is spent by one run and refused if ${at} moved after it was issued.`,
-    '',
-    'who may hold a value. The word is what you send; the prefix is what the id wears, and the prefix',
-    'IS who may hold it — no field says so:',
-    '',
-    ...WORDS.flatMap((one) => [`  ${one.padEnd(7)} → ${SECRECY[one]}<name>`, `      ${SAID[one]}`, '']),
-    '`new` asks, in this order:',
-    '',
-    ...ASKED,
-    '',
-    'and then, at a terminal only, it asks for the value itself — echo off, sealed as you press enter.',
-    'A piped run declares the row and says so instead, because there is no terminal to read one from.',
-    '',
-    '`edit` asks the same three, and a blank answer keeps what is already there — except that naming',
-    'a DIFFERENT header drops the old prefix unless you give a new one, because a prefix belongs to',
-    'the scheme its header names. `-` as the header removes the header and makes this an address.',
-    '',
-    'It will not change who may hold a value. That is the prefix, the prefix is the id, and an id that',
-    'changes is a different secret — every target requiring the old name would go on requiring a name',
-    'nothing declares. Declare the other one and move what requires it.',
-    '',
-    '`set` is the same prompt on its own, for changing a value later or giving one a `new` run skipped.',
-    'It takes no answers and cannot be piped. The value goes from the keyboard into the sealed store and',
-    `nowhere else — not into a row, not into this output, not into ${SEALED_AT} in any readable form.`,
-    '',
-    'So an agent may declare a secret and may never give it one. That is the point of the split.',
-  ].join('\n')
-
-const flagged = argv.indexOf(RECEIPT)
-
-if (verb === undefined && flagged === -1) {
-  const nonce = issue(TREE.at, listing)
-  stdout.write(`${method(nonce)}\n`)
-  stdout.write(`\nsecret: receipt ${nonce} — spent on use, and stale the moment ${at} changes.\n`)
-  exit(0)
-}
-
-spend(TREE.at, listing, argv[flagged + 1], at)
-
-if (verb !== 'new' && verb !== 'set' && verb !== 'edit') {
-  refuse(`there is nothing called "${verb ?? ''}" to do here — say new, edit or set`)
-}
-
-const text = readFileSync(path, 'utf8')
-const where = listBounds(text, LIST)
-if (where === undefined) refuse(`${at} states no \`${LIST}\` list to declare a secret in`)
-
-if (verb === 'set') {
-  const id = words[1] ?? refuse('`set` takes the id of a secret this app already declares')
-  const one = secrets.find((each) => each.id === id)
-  if (one === undefined) {
-    refuse(
-      `\`${id}\` is not a secret this app declares. Declare it first with \`thread create secret new\` — a value is ` +
-        'given to something that said it needed it, or not at all.',
-    )
-  }
-  if (stdin.isTTY !== true) {
-    refuse(
-      'a value is typed by a person at a terminal, and this run is piped. Nothing was written. Run ' +
-        `\`thread create secret set ${id}\` yourself — an agent may declare a secret and may never give it one.`,
-    )
-  }
-
-  if ((await sealing(id)) === 0) {
-    stdout.write('secret: nothing typed, so nothing was sealed.\n')
-    exit(0)
-  }
-
-  const kept = spawnSync('npx', ['thread', 'vault'], { cwd: TREE.at, encoding: 'utf8' })
-  stdout.write(`${`${kept.stdout ?? ''}${kept.stderr ?? ''}`.trim()}\n`)
-  exit(kept.status === 0 ? 0 : 1)
-}
-
-const piped = given()
-only(piped, TAKES, 'a secret')
-
-const { ask, line, shut } = asking(piped)
-
-const own = ownAnswers(piped)
-
-const name = slug(words[1] ?? (await ask('name', 'name: ')))
-if (name === '') {
-  shut()
-  refuse('a secret has to be called something')
-}
-if (!NAME.test(name)) {
-  shut()
-  refuse(`"${name}" cannot be the name of a secret — it is written in lower_snake_case`)
-}
-
-const holder = (piped.length > 0 ? needed(own, 'holder', 'a secret') : await ask('holder', `who may hold it — ${WORDS.join(', ')}: `)).trim()
-if (!WORDS.includes(holder as keyof typeof SECRECY)) {
-  shut()
-  refuse(
-    `there is no such holder as "${holder}". A secret is held by a ${WORDS.join(' or a ')}, and that prefix is the ` +
-      'only thing standing between a server credential and a browser bundle.',
-  )
-}
-const word = holder as keyof typeof SECRECY
-const id = `${SECRECY[word]}${name}`
-
-if (secrets.some((one) => one.id === id) || holdsRow(text, where, id)) {
-  shut()
-  refuse(`\`${id}\` is already declared in ${at}`)
-}
-
-const describes = (piped.length > 0 ? needed(own, 'describes', 'a secret') : await ask('describes', 'what is it for? ')).trim()
-if (describes === '') {
-  shut()
-  refuse('a secret says what it is for — the sentence is what somebody reads before requiring it')
-}
-
-const header = (piped.length > 0 ? (answer(own, 'header') ?? '') : await ask('header', 'header (blank if this value IS an address): ')).trim()
-const typed = header === '' ? '' : (piped.length > 0 ? (answer(own, 'prefix') ?? '') : await ask('prefix', 'prefix in that header, e.g. "Bearer ": '))
-
-const { stated, kids } = await stating(asksOf('secret', 'Secret', {}, ['id', 'at', 'describes', 'version', 'sends']), piped, piped.length > 0, ask, line, [])
-
-shut()
-
-const prefix = typed === '' || typed.endsWith(' ') ? typed : `${typed} `
-
-const row = [
-  '  {',
-  `    id: ${quoted(id)},`,
-  `    at: '_threads/${FILE}',`,
-  `    describes: ${quoted(describes)},`,
-  '    version: 1,',
-  ...(header === ''
-    ? []
-    : [`    sends: { header: ${quoted(header.toLowerCase())}${prefix === '' ? '' : `, prefix: ${quoted(prefix)}`} },`]),
-  ...rowLines('    ', stated, kids),
-  '  },',
-].join('\n')
-
-writeFileSync(path, withRow(text, where, row), 'utf8')
-
-for (const told of seeding(kids, TREE.at)) stdout.write(`secret: ${told}\n`)
-
-stdout.write(
-  `secret: declared ${id} in ${at}${header === '' ? ' — it has no `sends`, so it is the address of whatever requires it' : ''}.\n`,
-)
-
-if (stdin.isTTY === true) {
-  stdout.write(`\n${SAID[word]}\n\nThe value is not echoed and is sealed straight into ${SEALED_AT}.\n`)
-  if ((await sealing(id)) === 0) {
-    stdout.write(`secret: nothing typed, so ${id} has no value yet. Run \`thread create secret set ${id}\` when you have it.\n`)
-  }
-} else {
-  stdout.write(
-    `secret: it has no value anywhere yet, and this run is piped — a value is typed by a person at a terminal. ` +
-      `Run \`thread create secret set ${id}\` yourself.\n`,
-  )
-}
-
-const kept = spawnSync('npx', ['thread', 'vault'], { cwd: TREE.at, encoding: 'utf8' })
-stdout.write(`${`${kept.stdout ?? ''}${kept.stderr ?? ''}`.trim()}\n`)
-exit(kept.status === 0 ? 0 : 1)

package/dist/integrations/generators/target.d.ts

@@ -1 +0,0 @@
-export {};