@prestack/thread 0.1.2 → 0.1.4

package/dist/integrations/vault.js

@@ -1,7 +1,6 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-import * as disk from 'node:fs';
 import { join } from 'node:path';
-import { existsSync, readFileSync, writeFileSync } from "../core/files.js";
+import { existsSync, readFileSync, writeFileSync } from './disk.js';
 export const VAULT_DIR = '.thread';
 export const SEALED_NAME = 'vault.sealed.json';
 export const KEY_NAME = 'vault.key';
@@ -18,7 +17,7 @@ const unsealable = (named, why) => new Error(`"${named}" is in the sealed store
 const undeclared = (named, known) => new Error(`nothing may ask for a secret this app does not declare, and "${named}" is not one of ` +
     `${known.length === 0 ? '(this app declares none)' : known.join(', ')}. A value is asked for by something that ` +
     'declared it needed it, or not at all.');
-const unset = (named, env) => new Error(`"${named}" is declared and has no value sealed for \`${env}\`. Run \`thread create secret\` and give it one — a ` +
+const unset = (named, env) => new Error(`"${named}" is declared and has no value sealed for \`${env}\`. Run \`thread create secret set ${named}\` and give it one — a ` +
     'declared secret nothing was ever given is refused here rather than resolved to an empty string.');
 const store = (root) => {
     const at = join(root, SEALED_AT);
@@ -49,8 +48,7 @@ export function keyed(root) {
     if (held !== undefined)
         return held;
     const made = randomBytes(KEY_BYTES);
-    disk.mkdirSync(join(root, VAULT_DIR), { recursive: true });
-    disk.writeFileSync(join(root, KEY_AT), `${made.toString('base64')}\n`, { mode: 0o600 });
+    writeFileSync(join(root, KEY_AT), `${made.toString('base64')}\n`, { mode: 0o600 });
     return made;
 }
 export function seal(root, named, env, value) {
@@ -103,4 +101,21 @@ export function opened(root, declared, env) {
         return out;
     };
 }
+export function unseal(root, named, envs) {
+    const held = store(root);
+    const kept = held[named];
+    if (kept === undefined)
+        return [];
+    const taken = envs.filter((env) => kept[env] !== undefined);
+    if (taken.length === 0)
+        return [];
+    const left = Object.fromEntries(Object.entries(kept).filter(([env]) => !envs.includes(env)));
+    if (Object.keys(left).length === 0)
+        delete held[named];
+    else
+        held[named] = left;
+    const sorted = Object.fromEntries(Object.keys(held).sort().map((each) => [each, held[each]]));
+    writeFileSync(join(root, SEALED_AT), `${JSON.stringify(sorted, null, 2)}\n`);
+    return taken;
+}
 export const IGNORES = [KEY_AT];

package/dist/integrations/vault.ts

@@ -1,9 +1,8 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
-import * as disk from 'node:fs'
 import { join } from 'node:path'
 
 import type { Env } from '../core/actor.ts'
-import { existsSync, readFileSync, writeFileSync } from '../core/files.ts'
+import { existsSync, readFileSync, writeFileSync } from './disk.ts'
 
 export const VAULT_DIR = '.thread'
 
@@ -43,7 +42,7 @@ const undeclared = (named: string, known: readonly string[]): Error =>
 
 const unset = (named: string, env: Env): Error =>
   new Error(
-    `"${named}" is declared and has no value sealed for \`${env}\`. Run \`thread create secret\` and give it one — a ` +
+    `"${named}" is declared and has no value sealed for \`${env}\`. Run \`thread create secret set ${named}\` and give it one — a ` +
       'declared secret nothing was ever given is refused here rather than resolved to an empty string.',
   )
 
@@ -75,8 +74,7 @@ export function keyed(root: string): Buffer {
   const held = keyOf(root)
   if (held !== undefined) return held
   const made = randomBytes(KEY_BYTES)
-  disk.mkdirSync(join(root, VAULT_DIR), { recursive: true })
-  disk.writeFileSync(join(root, KEY_AT), `${made.toString('base64')}\n`, { mode: 0o600 })
+  writeFileSync(join(root, KEY_AT), `${made.toString('base64')}\n`, { mode: 0o600 })
   return made
 }
 
@@ -133,4 +131,18 @@ export function opened(
   }
 }
 
+export function unseal(root: string, named: string, envs: readonly Env[]): readonly Env[] {
+  const held = store(root)
+  const kept = held[named]
+  if (kept === undefined) return []
+  const taken = envs.filter((env) => kept[env] !== undefined)
+  if (taken.length === 0) return []
+  const left = Object.fromEntries(Object.entries(kept).filter(([env]) => !envs.includes(env as Env)))
+  if (Object.keys(left).length === 0) delete held[named]
+  else held[named] = left as Partial<Record<Env, string>>
+  const sorted = Object.fromEntries(Object.keys(held).sort().map((each) => [each, held[each]]))
+  writeFileSync(join(root, SEALED_AT), `${JSON.stringify(sorted, null, 2)}\n`)
+  return taken
+}
+
 export const IGNORES: readonly string[] = [KEY_AT]

package/dist/integrity/attach.js

@@ -1,5 +1,5 @@
-import { named } from "../core/scope.js";
-import { quoted } from "../core/rows.js";
+import { named } from '../core/scope.js';
+import { quoted } from '../core/rows.js';
 const DESCRIBES = 'What this app refuses, and the checks that make each refusal actually happen. Every check has one owner, so none of them can be switched off somewhere nobody is looking.';
 const CONSTRAINT = 'The rules the framework enforces on every app that installs it. They are read from the installed package rather than from this tree, so there is nothing here to weaken.';
 const RULES = 'What this app refuses on top of what the framework already does. `thread create rule` asks what to ban, where it applies and what to do instead, then writes the row and the check beside it.';
@@ -103,7 +103,7 @@ const SHIPPED = [
         into: 'derivation.ts',
         list: 'GENERATORS',
         id: 'publish-runner',
-        source: "  {\n    id: 'publish-runner',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/publish.js',\n    describes: 'Sends this repository\\'s packages to a registry. It derives what each package says about itself first, then builds, then refuses to send anything until the gate, the typecheck, the lint and the seal have each passed, and commits what it derived once the packages are out. The seal is checked rather than regenerated, because a release that rewrites its own seal can never fail it.',\n    version: 1,\n    by: 'thread publish',\n  },",
+        source: "  {\n    id: 'publish-runner',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/publish.js',\n    describes: 'Sends this repository\\'s packages to a registry. It derives what each package says about itself first, then builds, then refuses to send anything until the gate, the typecheck and the seal have each passed, and commits what it derived once the packages are out. The seal is checked rather than regenerated, because a release that rewrites its own seal can never fail it.',\n    version: 1,\n    by: 'thread publish',\n  },",
     },
 ];
 export const ATTACH = {
@@ -115,79 +115,9 @@ export const ATTACH = {
         { file: 'rules.ts', source: RULES_SOURCE },
         { file: 'gate.ts', source: GATE_SOURCE },
     ],
-    retires: [
-        {
-            into: 'gate.ts',
-            list: 'declares',
-            id: 'compiler',
-            why: 'moved into `GENERATORS` beside the generator that writes it, which is what makes `tsconfig.json` settle when declarations move. Left here it would be a second gate step running the same command, which the gate refuses.',
-        },
-        {
-            into: 'gate.ts',
-            list: 'declares',
-            id: 'descent',
-            why: 'its step now comes from the `descent-runner` row this package ships into `GENERATORS`, which states `runs` beside `by`. Left here it would be a second gate step running the same command, which the gate refuses.',
-        },
-        {
-            into: 'gate.ts',
-            list: 'declares',
-            id: 'sweep',
-            why: 'its step now comes from the `sweep-runner` row this package ships into `GENERATORS`, which states `runs` beside `by`. Left here it would be a second gate step running the same command, which the gate refuses.',
-        },
-        {
-            into: 'constraint.ts',
-            list: 'GENERATORS',
-            id: 'sql-duplicate-id',
-            why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-        },
-        {
-            into: 'constraint.ts',
-            list: 'GENERATORS',
-            id: 'sql-name-collision',
-            why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-        },
-        {
-            into: 'constraint.ts',
-            list: 'GENERATORS',
-            id: 'sql-duplicate-parameter',
-            why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-        },
-        {
-            into: 'constraint.ts',
-            list: 'GENERATORS',
-            id: 'sql-unwritable-parameter-type',
-            why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-        },
-        {
-            into: 'constraint.ts',
-            list: 'GENERATORS',
-            id: 'sql-duplicate-returned-column',
-            why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-        },
-        {
-            into: 'constraint.ts',
-            list: 'GENERATORS',
-            id: 'sql-unwritable-return-type',
-            why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-        },
-        {
-            into: 'constraint.ts',
-            list: 'GENERATORS',
-            id: 'sql-unknown-write-target',
-            why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-        },
-        {
-            into: 'constraint.ts',
-            list: 'GENERATORS',
-            id: 'sql-multi-statement',
-            why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-        },
-    ],
     ignores: ['.thread/', '.next/', 'node_modules/', 'tsconfig.tsbuildinfo'],
     scripts: {
         gate: 'thread gate',
-        predev: 'thread gate',
-        dev: 'next dev',
         prebuild: 'thread gate',
         build: 'next build',
         prestart: 'thread gate',

package/dist/integrity/attach.ts

@@ -121,7 +121,7 @@ const SHIPPED: readonly { readonly into: string; readonly list: string; readonly
     into: 'derivation.ts',
     list: 'GENERATORS',
     id: 'publish-runner',
-    source: "  {\n    id: 'publish-runner',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/publish.js',\n    describes: 'Sends this repository\\'s packages to a registry. It derives what each package says about itself first, then builds, then refuses to send anything until the gate, the typecheck, the lint and the seal have each passed, and commits what it derived once the packages are out. The seal is checked rather than regenerated, because a release that rewrites its own seal can never fail it.',\n    version: 1,\n    by: 'thread publish',\n  },",
+    source: "  {\n    id: 'publish-runner',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/publish.js',\n    describes: 'Sends this repository\\'s packages to a registry. It derives what each package says about itself first, then builds, then refuses to send anything until the gate, the typecheck and the seal have each passed, and commits what it derived once the packages are out. The seal is checked rather than regenerated, because a release that rewrites its own seal can never fail it.',\n    version: 1,\n    by: 'thread publish',\n  },",
   },
 ]
 export const ATTACH: Attaching = {
@@ -134,80 +134,10 @@ export const ATTACH: Attaching = {
     { file: 'gate.ts', source: GATE_SOURCE },
   ],
 
-  retires: [
-    {
-      into: 'gate.ts',
-      list: 'declares',
-      id: 'compiler',
-      why: 'moved into `GENERATORS` beside the generator that writes it, which is what makes `tsconfig.json` settle when declarations move. Left here it would be a second gate step running the same command, which the gate refuses.',
-    },
-    {
-      into: 'gate.ts',
-      list: 'declares',
-      id: 'descent',
-      why: 'its step now comes from the `descent-runner` row this package ships into `GENERATORS`, which states `runs` beside `by`. Left here it would be a second gate step running the same command, which the gate refuses.',
-    },
-    {
-      into: 'gate.ts',
-      list: 'declares',
-      id: 'sweep',
-      why: 'its step now comes from the `sweep-runner` row this package ships into `GENERATORS`, which states `runs` beside `by`. Left here it would be a second gate step running the same command, which the gate refuses.',
-    },
-    {
-      into: 'constraint.ts',
-      list: 'GENERATORS',
-      id: 'sql-duplicate-id',
-      why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-    },
-    {
-      into: 'constraint.ts',
-      list: 'GENERATORS',
-      id: 'sql-name-collision',
-      why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-    },
-    {
-      into: 'constraint.ts',
-      list: 'GENERATORS',
-      id: 'sql-duplicate-parameter',
-      why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-    },
-    {
-      into: 'constraint.ts',
-      list: 'GENERATORS',
-      id: 'sql-unwritable-parameter-type',
-      why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-    },
-    {
-      into: 'constraint.ts',
-      list: 'GENERATORS',
-      id: 'sql-duplicate-returned-column',
-      why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-    },
-    {
-      into: 'constraint.ts',
-      list: 'GENERATORS',
-      id: 'sql-unwritable-return-type',
-      why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-    },
-    {
-      into: 'constraint.ts',
-      list: 'GENERATORS',
-      id: 'sql-unknown-write-target',
-      why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-    },
-    {
-      into: 'constraint.ts',
-      list: 'GENERATORS',
-      id: 'sql-multi-statement',
-      why: 'its check imported a package this framework no longer ships and read a folder no app has, so it could never refuse anything. A rule that cannot fire reads as coverage while enforcing nothing.',
-    },
-  ],
 
   ignores: ['.thread/', '.next/', 'node_modules/', 'tsconfig.tsbuildinfo'],
   scripts: {
     gate: 'thread gate',
-    predev: 'thread gate',
-    dev: 'next dev',
     prebuild: 'thread gate',
     build: 'next build',
     prestart: 'thread gate',

package/dist/integrity/check-threads.js

@@ -1,9 +1,9 @@
-import { readdirSync } from "../core/files.js";
+import { readdirSync } from '../integrations/disk.js';
 import { dirname, join } from 'node:path';
 import { argv, stdout } from 'node:process';
-import { exit, invoked } from "../core/invoked.js";
-import { ROOT, THREAD_AT, TREE, configured, descend, unkept } from "../core/descend.js";
-import { runChecker } from "../core/finding.js";
+import { exit, invoked } from '../core/invoked.js';
+import { ROOT, THREAD_AT, TREE, configured, descend, unkept } from '../core/descend.js';
+import { runChecker } from '../core/finding.js';
 export { ROOT, THREAD_AT, TREE, descend };
 const ELSEWHERE = new Set(['node_modules', '.git']);
 export function trackedFiles() {
@@ -121,7 +121,7 @@ if (invoked(import.meta.url)) {
         stdout.write(`threads: ${String(warned.length)} of these is a derivation nothing has produced yet — the row states what a ` +
             'generator would write and no file is there. A generator that refuses to write an empty file is doing its ' +
             'job, so this is said rather than refused. A derived file that is there and differs from what its generator ' +
-            'writes is the other case, and that one fails.\n');
+            'writes is the other case, and the command its row names in `runs` refuses it at the gate.\n');
     }
     if (refused.length > 0)
         exit(1);

package/dist/integrity/check-threads.ts

@@ -1,4 +1,4 @@
-import { readdirSync } from '../core/files.ts'
+import { readdirSync } from '../integrations/disk.ts'
 import { dirname, join } from 'node:path'
 import { argv, stdout } from 'node:process'
 
@@ -157,7 +157,7 @@ if (invoked(import.meta.url)) {
       `threads: ${String(warned.length)} of these is a derivation nothing has produced yet — the row states what a ` +
         'generator would write and no file is there. A generator that refuses to write an empty file is doing its ' +
         'job, so this is said rather than refused. A derived file that is there and differs from what its generator ' +
-        'writes is the other case, and that one fails.\n',
+        'writes is the other case, and the command its row names in `runs` refuses it at the gate.\n',
     )
   }
 

package/dist/integrity/constraint.d.ts

@@ -12,7 +12,6 @@ export interface Constraint extends Threaded {
     readonly version: number;
     readonly where: {
         readonly paths: readonly string[];
-        readonly except?: readonly string[];
     };
     readonly bans: string;
     readonly because: string;