@prestack/thread 0.1.21 → 0.1.23

package/dist/integrations/generators/vault.ts

@@ -1,210 +0,0 @@
-import { existsSync, readFileSync, writeFileSync } from '../disk.ts'
-import { valuesIn } from '../../core/rows.ts'
-import { dirname, join, relative } from 'node:path'
-import { argv, stderr, stdout } from 'node:process'
-
-import ts from 'typescript'
-
-import { exit } from '../../core/invoked.ts'
-import { named as packageOf } from '../../core/scope.ts'
-import { findTree, inTree, strayFiles } from '../../core/tree.ts'
-
-import { unclassified, valued, type Secret } from '../secret.ts'
-import { refusals, servesBrowser, type Call, type Integration, type Target } from '../target.ts'
-import { ALGORITHM, KEY_BYTES, KEY_NAME, SEALED_AT, SEALED_NAME, VAULT_DIR } from '../vault.ts'
-
-const TREE = findTree()
-
-const AT = 'src/vault.ts'
-
-const here = (one: string): string => relative(TREE.at, one).split('\\').join('/')
-
-const from = inTree(TREE, 'secrets.ts')
-
-const path = join(TREE.at, AT)
-
-const declares = relative(dirname(path), from).split('\\').join('/')
-
-const sheet = declares.startsWith('.') ? declares : `./${declares}`
-
-function refuse(because: string): never {
-  stderr.write(`vault: ${because}\n`)
-  exit(1)
-}
-
-let secrets: readonly Secret[] = []
-try {
-  const taken = valuesIn(readFileSync(from)) as { SECRETS?: readonly Secret[] }
-  secrets = taken.SECRETS ?? []
-} catch {
-  refuse(`${here(from)} could not be read. Attach \`${packageOf('integrations')}\` first — an app states its secrets there.`)
-}
-
-const declared = secrets.map((one) => one.id).sort()
-
-const SOURCE = [
-  "import { createDecipheriv } from 'node:crypto'",
-  "import { existsSync, readFileSync } from 'node:fs'",
-  "import { join } from 'node:path'",
-  "",
-  `import { SECRETS } from '${sheet}'`,
-  "",
-  "const ENV = process.env.NODE_ENV === 'production' ? 'production' : 'sandbox'",
-  "",
-  "export async function vault(refs: readonly string[]): Promise<Readonly<Record<string, string>>> {",
-  "  if (refs.length === 0) return {}",
-  `  const at = join(process.cwd(), '${VAULT_DIR}', '${KEY_NAME}')`,
-  "  if (!existsSync(at)) throw new Error('there is no vault key at ' + at + ', and nothing here can open a sealed value without it.')",
-  "  const key = Buffer.from(readFileSync(at, 'utf8').trim(), 'base64')",
-  `  if (key.length !== ${String(KEY_BYTES)}) throw new Error('the vault key at ' + at + ' is not the size anything here was sealed under.')`,
-  `  const where = join(process.cwd(), '${VAULT_DIR}', '${SEALED_NAME}')`,
-  "  if (!existsSync(where)) throw new Error('there is no sealed store at ' + where + ', so no declared secret has a value yet.')",
-  "  const store = JSON.parse(readFileSync(where, 'utf8')) as Readonly<Record<string, Readonly<Record<string, string>> | undefined>>",
-  "  const known = SECRETS.map((one) => one.id)",
-  "  const out: Record<string, string> = {}",
-  "  for (const named of refs) {",
-  "    if (!known.includes(named)) throw new Error(named + ' is not a secret this app declares.')",
-  "    const sealed = store[named]?.[ENV]",
-  "    if (sealed === undefined) throw new Error(named + ' is declared and has no value sealed for ' + ENV + '.')",
-  "    const parts = sealed.split('.').map((one) => Buffer.from(one, 'base64'))",
-  "    const iv = parts[0]",
-  "    const tag = parts[1]",
-  "    const body = parts[2]",
-  "    if (iv === undefined || tag === undefined || body === undefined) throw new Error(named + ' is not three base64 parts.')",
-  `    const decipher = createDecipheriv('${ALGORITHM}', key, iv)`,
-  "    decipher.setAuthTag(tag)",
-  "    out[named] = decipher.update(body).toString('utf8') + decipher.final('utf8')",
-  "  }",
-  "  return out",
-  "}",
-  "",
-].join("\n")
-
-async function taken<T>(file: string, list: string): Promise<readonly T[]> {
-  const at = inTree(TREE, file)
-  if (!existsSync(at)) return []
-  try {
-    const held = valuesIn(readFileSync(at)) as Record<string, readonly T[] | undefined>
-    return held[list] ?? []
-  } catch {
-    return []
-  }
-}
-
-function imported(at: string, text: string): readonly string[] {
-  const source = ts.createSourceFile(at, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX)
-  const found: string[] = []
-  const walk = (node: ts.Node): void => {
-    if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
-      const said = node.moduleSpecifier
-      if (said !== undefined && ts.isStringLiteral(said)) found.push(said.text)
-    } else if (ts.isCallExpression(node)) {
-      const first = node.arguments[0]
-      const dynamic = node.expression.kind === ts.SyntaxKind.ImportKeyword
-      const legacy = ts.isIdentifier(node.expression) && node.expression.text === 'require'
-      if ((dynamic || legacy) && first !== undefined && ts.isStringLiteral(first)) found.push(first.text)
-    }
-    ts.forEachChild(node, walk)
-  }
-  walk(source)
-  return found
-}
-
-function names(specifier: string, id: string): boolean {
-  const bare = specifier.replace(/\.(?:m|c)?[jt]sx?$/, '')
-  return bare === `operations/${id}` || bare.endsWith(`/operations/${id}`)
-}
-
-async function reaching(): Promise<readonly string[]> {
-  const targets = await taken<Target>('targets.ts', 'TARGETS')
-  const withheld = new Map<string, string>()
-  for (const one of targets) {
-    const said = servesBrowser(one, secrets)
-    if (said !== true) withheld.set(one.id, said)
-  }
-  if (withheld.size === 0) return []
-
-  const operations = await taken<{ readonly id: string; readonly requires?: readonly string[] }>('operations.ts', 'MEMBERS')
-  const risky = new Map<string, string>()
-  for (const one of operations) {
-    for (const word of one.requires ?? []) {
-      const said = withheld.get(word)
-      if (said !== undefined) risky.set(one.id, said)
-    }
-  }
-  if (risky.size === 0) return []
-
-  const found: string[] = []
-  for (const one of strayFiles(TREE.at, '', '.tsx')) {
-    let text: string
-    try {
-      text = readFileSync(join(TREE.at, one), 'utf8')
-    } catch {
-      continue
-    }
-    const specifiers = imported(one, text)
-    for (const [id, said] of risky) {
-      if (!specifiers.some((each) => names(each, id))) continue
-      found.push(
-        `${one} is a \`.tsx\` file and it imports \`${id}\`. ${said} This holds whoever bundles it — ` +
-          'a page is a page whether Next, Vite or anything else compiles it, so the refusal is about the ' +
-          'import rather than about any one build. Call it from a server and let the page ask the server',
-      )
-    }
-  }
-  return found
-}
-
-async function stated(): Promise<readonly string[]> {
-  const targets = await taken<Target>('targets.ts', 'TARGETS')
-  const integrations = await taken<Integration>('targets.ts', 'INTEGRATIONS')
-  const calls = await taken<Call>('targets.ts', 'CALLS')
-  const entities = (await taken<{ readonly id: string }>('entities.ts', 'ENTITIES')).map((one) => one.id)
-  return [
-    ...unclassified(secrets),
-    ...valued(secrets),
-    ...refusals(targets, secrets, calls, entities, integrations),
-    ...(await reaching()),
-  ]
-}
-
-const checking = argv.includes('--check')
-
-const opening = `${String(declared.length)} declared secret(s)`
-
-if (checking) {
-  const wrong = await stated()
-  if (wrong.length > 0) {
-    refuse(
-      [
-        `${String(wrong.length)} thing(s) this app states about what it reaches will not hold:`,
-        ...wrong.map((one) => `  ${one}`),
-      ].join('\n'),
-    )
-  }
-
-  const current = existsSync(path) ? readFileSync(path, 'utf8') : ''
-  if (current !== SOURCE) {
-    refuse(
-      current === ''
-        ? `${AT} is declared and not on disk, and it is what opens this app's sealed values. Run \`thread vault\` and commit what it writes.`
-        : `${AT} is not what the secrets in ${here(from)} produce. A derived file that differs from its generator is a hand edit wearing a generated name. Run \`thread vault\` and commit what it writes.`,
-    )
-  }
-  stdout.write(`vault: ${AT} is seeded and opens ${opening}, read off ${here(from)} as they are declared.\n`)
-  exit(0)
-}
-
-if (existsSync(path) && readFileSync(path, 'utf8') === SOURCE) {
-  stdout.write(`vault: ${AT} is already yours — it opens ${opening}, read off ${here(from)} as they are declared.\n`)
-  exit(0)
-}
-
-writeFileSync(path, SOURCE, 'utf8')
-stdout.write(
-  `vault: wrote ${AT} — what opens a secret's value at the moment of use.\n` +
-    `  It opens the values sealed under ${SEALED_AT} for the secrets declared in ${here(from)}, and refuses every other name.\n` +
-    '  `thread create secret` declares one and seals its value; nothing else ever takes a value.\n' +
-    '  It imports nothing of this framework: what a host runs holds none of the scaffolding that assembled it.\n',
-)
-exit(0)

package/dist/integrations/https.ts

@@ -1,216 +0,0 @@
-import type { Http, HttpRequest, HttpResponse } from './target.ts'
-import { ValidationError } from '../operations/result.ts'
-
-export const HTTP_CALL_ACTION = 'http.call'
-
-export class HttpNotConfiguredError extends Error {
-  constructor() {
-    super(
-      'nothing here sends. An app hands its operations the transport an outward call leaves through, and this one was handed none. ' +
-        "Run thread capabilities to write the file that hands it on; which hosts may be reached is declared in the tree and is not the transport's business.",
-    )
-    this.name = 'HttpNotConfiguredError'
-  }
-}
-
-const beneath = (thrown: unknown): string => {
-  const under = (thrown as { readonly cause?: { readonly code?: unknown; readonly message?: unknown } } | undefined)?.cause
-  if (under === undefined || under === null) return ''
-  return ' (' + [under.code, under.message].filter((one) => typeof one === 'string' && one !== '').join(': ') + ')'
-}
-
-export class OutwardTransportError extends Error {
-  constructor(
-    readonly target: string,
-    cause: unknown,
-  ) {
-    super(`outward call to "${target}" never reached it: ${cause instanceof Error ? cause.message : String(cause)}${beneath(cause)}`)
-    this.name = 'OutwardTransportError'
-  }
-}
-
-export const refusedPath = (path: string): string | undefined =>
-  path.startsWith('/')
-    ? `a call's path is written from its target's own address onward, and "${path}" opens with a slash — write it without one`
-    : undefined
-
-const LOOPBACK: readonly string[] = ['localhost', '127.0.0.1', '::1']
-
-export function outwardUrl(target: string, address: string, path: string): URL {
-  let base: URL
-  try {
-    base = new URL(address)
-  } catch {
-    throw new ValidationError(`the address resolved for "${target}" is not an absolute URL: ${JSON.stringify(address)}`)
-  }
-  if (base.protocol !== 'https:' && !(base.protocol === 'http:' && LOOPBACK.includes(base.hostname))) {
-    throw new ValidationError(
-      `outward calls go over https, and "${target}" resolved to ${base.protocol.replace(':', '')} at ${base.hostname}. ` +
-        `A server on this machine — ${LOOPBACK.join(', ')} — may answer over http, because nothing leaves the machine to reach it.`,
-    )
-  }
-  if (base.search !== '' || base.hash !== '') {
-    throw new ValidationError(`the address for "${target}" carries a query or a fragment — those belong to the call`)
-  }
-  const said = refusedPath(path)
-  if (said !== undefined) {
-    throw new ValidationError(said)
-  }
-  const url = new URL(`${base.origin}${base.pathname.replace(/\/$/, '')}/${path}`)
-  if (url.origin !== base.origin) {
-    throw new ValidationError(`the path "${path}" resolves to ${url.origin}, which is not where "${target}" is`)
-  }
-  return url
-}
-
-function wireBody(body: Uint8Array): ArrayBuffer {
-  const copy = new ArrayBuffer(body.byteLength)
-  new Uint8Array(copy).set(body)
-  return copy
-}
-
-export interface HttpOptions {
-  readonly timeout?: number
-}
-
-const DEFAULT_TIMEOUT_MS = 10_000
-
-export const STREAMED = 'application/x-ndjson'
-
-export const TOLD = 'told'
-
-async function heard(from: ReadableStream<Uint8Array>, told: (said: unknown) => void): Promise<Uint8Array> {
-  const reader = from.getReader()
-  const decoder = new TextDecoder()
-  let pending = ''
-  let last = ''
-  const line = (one: string): void => {
-    if (one.trim() === '') return
-    const held = JSON.parse(one) as Record<string, unknown>
-    if (typeof held === 'object' && held !== null && TOLD in held) told(held[TOLD])
-    else last = one
-  }
-  for (;;) {
-    const { done, value } = await reader.read()
-    if (done) break
-    pending += decoder.decode(value, { stream: true })
-    let at = pending.indexOf('\n')
-    while (at !== -1) {
-      line(pending.slice(0, at))
-      pending = pending.slice(at + 1)
-      at = pending.indexOf('\n')
-    }
-  }
-  line(pending + decoder.decode())
-  return new TextEncoder().encode(last)
-}
-
-export async function called(request: HttpRequest, options: HttpOptions = {}): Promise<HttpResponse> {
-  const send = fetch
-  const within = options.timeout ?? DEFAULT_TIMEOUT_MS
-
-  const url = outwardUrl(request.target, request.address, request.path)
-
-  const headers: Record<string, string> = { ...request.headers }
-  if (request.contentType !== undefined) headers['content-type'] = request.contentType
-  if (request.idempotencyKey !== undefined) headers['idempotency-key'] = request.idempotencyKey
-  if (request.told !== undefined) headers['accept'] = STREAMED
-
-  let response: Response
-  try {
-    response = await send(url.toString(), {
-      method: request.method,
-      headers,
-      ...(request.body === undefined ? {} : { body: wireBody(request.body) }),
-      signal: AbortSignal.timeout(within),
-    })
-  } catch (error) {
-    throw new OutwardTransportError(request.target, error)
-  }
-
-  const told = request.told
-  const stream = response.body
-  const streamed = (response.headers.get('content-type') ?? '').includes(STREAMED)
-  let body: Uint8Array
-  try {
-    body = told !== undefined && stream !== null && streamed ? await heard(stream, told) : new Uint8Array(await response.arrayBuffer())
-  } catch (error) {
-    throw new OutwardTransportError(request.target, error)
-  }
-
-  return {
-    status: response.status,
-    headers: Object.fromEntries(response.headers.entries()),
-    body,
-  }
-}
-
-export function sendingHttp(options: HttpOptions = {}): Http {
-  return { call: (request, within) => called(request, within === undefined ? options : { ...options, timeout: within }) }
-}
-
-export interface RecordedCall {
-  readonly target: string
-  readonly method: string
-  readonly path: string
-  readonly headers: Readonly<Record<string, string>>
-  readonly body: string
-}
-
-export interface ScriptedAnswer {
-  readonly status: number
-  readonly headers?: Readonly<Record<string, string>>
-  readonly body?: string
-}
-
-const REDACTED = '(sent)'
-
-export type Scripted = ScriptedAnswer | readonly ScriptedAnswer[]
-
-export function recordingHttp(
-  script: Readonly<Record<string, Scripted>> = {},
-): Http & { readonly calls: readonly RecordedCall[] } {
-  const calls: RecordedCall[] = []
-  const decoder = new TextDecoder()
-  const spent = new Map<string, number>()
-
-  return {
-    calls,
-    async call(request) {
-      outwardUrl(request.target, request.address, request.path)
-
-      const body = request.body === undefined ? '' : decoder.decode(request.body)
-      calls.push({
-        target: request.target,
-        method: request.method,
-        path: request.path,
-        headers: Object.fromEntries(Object.keys(request.headers ?? {}).map((one) => [one, REDACTED])),
-        body,
-      })
-
-      const key = `${request.method} ${request.path}`
-      const held = script[key]
-      if (held === undefined) {
-        throw new Error(
-          `this scenario scripts no answer for "${key}", so nothing here knows what ${request.target} would say. Add that key to the scenario's answers — a call answered by something nobody scripted proves it was made and nothing about what came back.`,
-        )
-      }
-      const each = Array.isArray(held) ? (held as readonly ScriptedAnswer[]) : undefined
-      const at = spent.get(key) ?? 0
-      spent.set(key, at + 1)
-      const answer = each === undefined ? (held as ScriptedAnswer) : each[at]
-      if (answer === undefined) {
-        throw new Error(
-          `this scenario scripts ${String(each?.length ?? 0)} answer(s) for "${key}" and it has now been called ${String(at + 1)} time(s). A node that calls the same thing again needs one answer per pass, written in the order they come back.`,
-        )
-      }
-      const answered = new TextEncoder().encode(answer.body ?? '')
-      const headers = answer.headers ?? {}
-      return {
-        status: answer.status,
-        headers,
-        body: answered,
-      }
-    },
-  }
-}

package/dist/integrations/pglite.ts

@@ -1,206 +0,0 @@
-import type { Actor } from '../core/actor.ts'
-import type { FieldList, Row, Store } from './target.ts'
-
-const SHAPE = `
-  select table_name, column_name, data_type, is_nullable
-  from information_schema.columns
-  where table_schema = 'public'
-  order by table_name, column_name
-`
-
-const CONSTRAINTS = `
-  select tc.table_name, tc.constraint_type, kcu.column_name
-  from information_schema.table_constraints tc
-  left join information_schema.key_column_usage kcu on kcu.constraint_name = tc.constraint_name
-  where tc.table_schema = 'public'
-  order by tc.table_name, tc.constraint_type, kcu.column_name
-`
-
-interface Queried {
-  exec(sql: string): Promise<unknown>
-  query(sql: string, params?: readonly unknown[]): Promise<{ rows: readonly unknown[] }>
-  close(): Promise<void>
-}
-
-const MISSING =
-  'a postgres living inside this process needs `@electric-sql/pglite`, and it is not installed. No package here ' +
-  'declares it, because nothing needs one until a target is declared that keeps rows in one — install it in the ' +
-  'app that declares that target. Carrying on without having opened one would be the drift this exists to catch, ' +
-  'wearing a green tick'
-
-async function opened(at?: string): Promise<Queried> {
-  let made: { PGlite: new (at?: string) => Queried }
-  try {
-    made = (await import('@electric-sql/pglite')) as unknown as { PGlite: new (at?: string) => Queried }
-  } catch {
-    throw new Error(MISSING)
-  }
-  return new made.PGlite(at)
-}
-
-const APPLIED = '"_thread_applied"'
-
-async function caughtUp(made: Queried, history: readonly { readonly name: string; readonly sql: string }[]): Promise<void> {
-  if (history.length === 0) return
-  await made.exec('create table if not exists ' + APPLIED + ' ("name" text primary key)')
-  const done = new Set(
-    (await made.query('select "name" from ' + APPLIED)).rows.map((one) => String((one as { readonly name?: unknown }).name)),
-  )
-  for (const one of history) {
-    if (done.has(one.name)) continue
-    await made.exec(one.sql)
-    await made.query('insert into ' + APPLIED + ' ("name") values ($1)', [one.name])
-  }
-}
-
-export async function shapeOf(sql: readonly string[]): Promise<string> {
-  const db = await opened()
-  try {
-    for (const one of sql) await db.exec(one)
-    const columns = await db.query(SHAPE)
-    const constraints = await db.query(CONSTRAINTS)
-    return JSON.stringify({ columns: columns.rows, constraints: constraints.rows }, null, 2)
-  } finally {
-    await db.close()
-  }
-}
-
-export interface Kept {
-
-  readonly name: string
-
-  readonly schema: string
-
-  readonly tables: Readonly<Record<string, string>>
-
-  readonly address: Readonly<Record<string, string>>
-
-  readonly columns: Readonly<Record<string, readonly string[]>>
-
-  readonly at: string
-
-  readonly migrations?: readonly { readonly name: string; readonly sql: string }[]
-}
-
-export interface Stood {
-
-  readonly keeps: readonly string[]
-
-  readonly store: Store
-
-  seed(actor: Actor, rows: readonly { readonly entity: string; readonly row: Row }[]): Promise<void>
-
-  taken(actor: Actor): Promise<Readonly<Record<string, readonly Row[]>>>
-}
-
-export function standing(held: Omit<Kept, 'at'>): Stood {
-  const store = storing({ ...held, at: 'memory://', migrations: [] })
-  const keeps = Object.keys(held.tables)
-  return {
-    keeps,
-    store,
-    async seed(actor, rows) {
-      for (const one of rows) await store.insert(actor, one.entity, one.row)
-    },
-    async taken(actor) {
-      const found: Record<string, readonly Row[]> = {}
-      for (const entity of keeps) found[entity] = await store.list(actor, entity)
-      return found
-    },
-  }
-}
-
-export function storing(held: Kept): Store {
-  const q = (name: string): string => JSON.stringify(name)
-  const rowOf = (one: unknown): Row => one as Row
-  const known = (entity: string): readonly string[] => held.columns[entity] ?? []
-
-  const tableFor = (entity: string): string => {
-    const found = held.tables[entity]
-    if (found === undefined) throw new Error(entity + ' is not kept in ' + held.name + ', so it has no table here')
-    return found
-  }
-
-  const addressOf = (entity: string): string => {
-    const found = held.address[entity]
-    if (found === undefined) {
-      throw new Error(
-        entity + ' declares nothing that identifies one of its rows, so a row of it cannot be addressed here. ' +
-          'Give it a value and say so with `thread create entity edit`.',
-      )
-    }
-    return found
-  }
-
-  let opening: Promise<Queried> | undefined
-
-  const db = async (): Promise<Queried> => {
-    opening ??= (async () => {
-      const made = await opened(held.at)
-      await caughtUp(made, held.migrations ?? [])
-      await made.exec(held.schema)
-      return made
-    })()
-    return await opening
-  }
-
-  return {
-    async insert(_actor, entity, row) {
-      const cols = known(entity)
-      const taken = cols.filter((one) => (row as Record<string, unknown>)[one] !== undefined)
-      const answered = await (await db()).query(
-        'insert into ' + q(tableFor(entity)) + ' (' + taken.map(q).join(', ') + ') values (' +
-          taken.map((_, at) => '$' + String(at + 1)).join(', ') + ') returning *',
-        taken.map((one) => (row as Record<string, unknown>)[one]),
-      )
-      return rowOf(answered.rows[0])
-    },
-
-    async get(_actor, entity, key, fields: FieldList) {
-      const cols = known(entity)
-      const asked = fields.filter((one) => cols.includes(one as string)).map((one) => String(one))
-      const answered = await (await db()).query(
-        'select ' + (asked.length === 0 ? '*' : asked.map(q).join(', ')) + ' from ' + q(tableFor(entity)) +
-          ' where ' + q(addressOf(entity)) + ' = $1 limit 1',
-        [key],
-      )
-      return answered.rows.length === 0 ? null : rowOf(answered.rows[0])
-    },
-
-    async list(_actor, entity, opts) {
-      const cols = known(entity)
-      const asked = Object.entries(opts?.where ?? {}).filter(([one]) => cols.includes(one))
-      const answered = await (await db()).query(
-        'select * from ' + q(tableFor(entity)) +
-          (asked.length === 0 ? '' : ' where ' + asked.map(([one], at) => q(one) + ' = $' + String(at + 1)).join(' and ')) +
-          (opts?.limit === undefined ? '' : ' limit ' + String(opts.limit)),
-        asked.map(([, one]) => one),
-      )
-      return answered.rows.map(rowOf)
-    },
-
-    async update(_actor, entity, key, patch, expectedVersion) {
-      if (expectedVersion !== undefined) {
-        throw new Error(
-          held.name + ' keeps what ' + entity + ' declares and nothing else, so there is no version on a row to ' +
-            'check an expected one against. Declare a value for it and compare that, or update without a version.',
-        )
-      }
-      const cols = known(entity)
-      const taken = Object.entries(patch).filter(([one]) => cols.includes(one))
-      if (taken.length === 0) throw new Error('nothing in this patch is a value ' + entity + ' declares')
-      const answered = await (await db()).query(
-        'update ' + q(tableFor(entity)) + ' set ' +
-          taken.map(([one], at) => q(one) + ' = $' + String(at + 1)).join(', ') +
-          ' where ' + q(addressOf(entity)) + ' = $' + String(taken.length + 1) + ' returning *',
-        [...taken.map(([, one]) => one), key],
-      )
-      if (answered.rows.length === 0) throw new Error('record ' + String(key) + ' not found')
-      return rowOf(answered.rows[0])
-    },
-
-    async remove(_actor, entity, key) {
-      await (await db()).query('delete from ' + q(tableFor(entity)) + ' where ' + q(addressOf(entity)) + ' = $1', [key])
-    },
-  }
-}

package/dist/integrations/secret.ts

@@ -1,54 +0,0 @@
-import type { Member } from '../core/thread.ts'
-
-export const SECRECY = {
-  server: 'sec_',
-} as const satisfies Readonly<Record<string, string>>
-
-export const SAID: Readonly<Record<keyof typeof SECRECY, string>> = {
-  server:
-    'A value only a server may ever hold: an API key, a connection string, a signing key. Every secret is one of these. A value anybody may read is not a secret and is never sealed — the address of a place this app calls and a header every call carries are written on the target row, and only a credential goes into the vault. Everything a browser bundle reaches is in the bundle and belongs to whoever opens the page, so a target requiring a secret is refused a browser entry when it is built rather than when somebody reads it.',
-}
-
-export interface Vault {
-
-  resolve(refs: readonly string[]): Promise<Readonly<Record<string, string>>>
-}
-
-export interface Secret extends Member {
-
-  readonly sends?: { readonly header: string; readonly prefix?: string }
-
-  readonly signs?: { readonly header: string; readonly prefix?: string }
-}
-
-export function secrecyOf(id: string): keyof typeof SECRECY | undefined {
-  return (Object.keys(SECRECY) as (keyof typeof SECRECY)[]).find((one) => id.startsWith(SECRECY[one]))
-}
-
-export const isServerOnly = (id: string): boolean => secrecyOf(id) === 'server'
-
-export const unclassified = (secrets: readonly Secret[]): readonly string[] =>
-  secrets
-    .filter((one) => secrecyOf(one.id) === undefined)
-    .map(
-      (one) =>
-          one.id + ' does not wear ' + SECRECY.server + ', and every secret does: that prefix says only a server may ever hold the value. ' +
-          'A value anybody may read is not a secret. Write it on the row that needs it, as the address of a target or a header every call carries, and take this row out',
-    )
-
-const VALUED = ['value', 'secret', 'key', 'token', 'password', 'env']
-
-export const valued = (secrets: readonly Secret[]): readonly string[] => {
-  const found: string[] = []
-  for (const one of secrets) {
-    for (const named of VALUED) {
-      if (!(named in one)) continue
-      found.push(
-        `\`${one.id}\` carries a \`${named}\`. A secret row holds a name and a sentence and never a value — this row is ` +
-          'read by the descent, by every generator and by anything that prints the tree, while a credential is read by ' +
-          'one thing at one moment. Put the value in the sealed store with `thread create secret`',
-      )
-    }
-  }
-  return found
-}