@procedures/store 0.44.0 → 0.45.0

package/src/indexeddb/program-store.ts

@@ -5,10 +5,23 @@
  * as the key of its record. IndexedDB keeps a structured clone of each record, so a caller that
  * changes a result does not change the store. The store checks each record that it reads: the
  * database of a browser can hold records of an older version or of another application.
+ *
+ * The version of a record is a counter. Each put gives one more than the highest version in the
+ * store, in the transaction of the write. The database has no field for a counter. Thus after a
+ * delete of the record with the highest version, a later put can give that version again.
  */
 
-import { byKey, checkStoredProgram, keyMatches, type ProgramStore, type StoredProgram } from "../program-store/types.js";
-import { IdbStoreConnection, type IndexedDbOptions } from "./idb.js";
+import {
+  byKey,
+  checkProgramVersion,
+  checkStoredProgram,
+  keyMatches,
+  nextCounterVersion,
+  type ProgramStore,
+  type ProgramWriteOptions,
+  type StoredProgram,
+} from "../program-store/types.js";
+import { IdbStoreConnection, onResult, type IndexedDbOptions } from "./idb.js";
 
 /** The default name of the database of the programs. */
 export const DEFAULT_PROGRAM_DATABASE = "procedures-programs";
@@ -56,15 +69,32 @@ export class IndexedDbProgramStore implements ProgramStore {
     });
   }
 
-  async put(program: StoredProgram): Promise<void> {
+  async put(program: StoredProgram, options?: ProgramWriteOptions): Promise<void> {
     const checked = checkStoredProgram(structuredClone(program));
-    await this.connection.run("readwrite", (store) => {
-      store.put(checked);
+    await this.connection.run("readwrite", (store, fail) => {
+      // The read, the test and the write are one transaction: another tab cannot write between them
+      onResult(store.getAll(), fail, (records) => {
+        const programs = records.map((record) => checkStoredProgram(record));
+        checkProgramVersion(checked.key, programs.find((current) => current.key === checked.key), options);
+        store.put({ ...checked, version: nextCounterVersion(0, programs) });
+      });
       return () => undefined;
     });
   }
 
-  delete(key: string): Promise<boolean> {
+  delete(key: string, options?: ProgramWriteOptions): Promise<boolean> {
+    if (options?.expectedVersion !== undefined) {
+      return this.connection.run("readwrite", (store, fail) => {
+        let existed = false;
+        onResult(store.get(key), fail, (record) => {
+          const current = record === undefined ? undefined : checkStoredProgram(record);
+          checkProgramVersion(key, current, options);
+          existed = current !== undefined;
+          if (existed) store.delete(key);
+        });
+        return () => existed;
+      });
+    }
     return this.connection.run("readwrite", (store) => {
       // The requests of one transaction run in order: the count sees the record before the delete
       const count = store.count(key);

package/src/indexeddb.ts

@@ -25,5 +25,5 @@ export { MemoryProgramStore } from "./program-store/memory.js";
 export { MemoryQueueStore } from "./storage/queue.js";
 export { MemorySyncStateStore } from "./storage/sync-state.js";
 export type { SyncState, SyncStateChange, SyncStateStore } from "./storage/sync-state.js";
-export type { ProgramStore, StoredProgram } from "./program-store/types.js";
+export type { ProgramStore, ProgramWriteOptions, StoredProgram } from "./program-store/types.js";
 export type { QueuedOperation, QueueStore } from "./storage/queue.js";

package/src/program-store/collection.ts

@@ -2,15 +2,43 @@
  * A program store on a collection storage: `InMemoryStorage` of client-collections, or a remote
  * one, `ApiStorage` (the collection procedures of a server) or `HybridStorage` (a local cache with
  * a remote copy). The key of each record is the key of the program.
+ *
+ * The version of a record is a revision string: a counter and a random part, for example
+ * `"3-k2j9x0aq"`. The storage tests `expectedVersion` itself, with its own `versionOf`, in one
+ * step with the write. So give the storage the option `versionOf: storedProgramVersion`. A storage
+ * without `versionOf` rejects a write with `expectedVersion` (a `TypeError`). It accepts a write
+ * without `expectedVersion`.
  */
 
 import type { CollectionStorage } from "@procedures/client";
-import { byKey, checkStoredProgram, keyMatches, type ProgramStore, type StoredProgram } from "./types.js";
+import {
+  byKey,
+  checkStoredProgram,
+  expectedVersionOf,
+  keyMatches,
+  type ProgramStore,
+  type ProgramWriteOptions,
+  type StoredProgram,
+} from "./types.js";
+
+/** The counter of a revision string: the digits before the dash, or 0. */
+function revisionCounter(version: string | number | null | undefined): number {
+  const counter = Number.parseInt(String(version ?? "0"), 10);
+  return Number.isSafeInteger(counter) && counter > 0 ? counter : 0;
+}
+
+/** A new revision string after a version. The random part makes two writes of one base differ. */
+function nextRevision(version: string | number | null | undefined): string {
+  return `${revisionCounter(version) + 1}-${Math.random().toString(36).slice(2, 10).padEnd(8, "0")}`;
+}
 
 export class CollectionProgramStore implements ProgramStore {
   readonly kind = "collection";
 
-  /** @param storage - The storage of the records. The store closes it in `close()`. */
+  /**
+   * @param storage - The storage of the records. The store closes it in `close()`. Give it the
+   *   option `versionOf: storedProgramVersion`, so that it can test `expectedVersion`.
+   */
   constructor(private readonly storage: CollectionStorage<StoredProgram>) {}
 
   async get(key: string): Promise<StoredProgram | undefined> {
@@ -24,13 +52,18 @@ export class CollectionProgramStore implements ProgramStore {
     return byKey(records.map((record) => checkStoredProgram(structuredClone(record))).filter((p) => keyMatches(p.key, prefix)));
   }
 
-  async put(program: StoredProgram): Promise<void> {
+  async put(program: StoredProgram, options?: ProgramWriteOptions): Promise<void> {
     const checked = checkStoredProgram(structuredClone(program));
-    await this.storage.set(checked.key, checked);
+    const expected = expectedVersionOf(options);
+    // The expected version is the base of the write. Without it, the current record is the base.
+    const base = expected !== undefined ? expected : (await this.storage.get(checked.key))?.version;
+    const record: StoredProgram = { ...checked, version: nextRevision(base) };
+    await this.storage.set(checked.key, record, expected === undefined ? undefined : { expectedVersion: expected });
   }
 
-  async delete(key: string): Promise<boolean> {
-    return this.storage.delete(key);
+  async delete(key: string, options?: ProgramWriteOptions): Promise<boolean> {
+    const expected = expectedVersionOf(options);
+    return expected === undefined ? this.storage.delete(key) : this.storage.delete(key, { expectedVersion: expected });
   }
 
   async close(): Promise<void> {

package/src/program-store/file.ts

@@ -6,14 +6,29 @@
  * file (`<file>.lock`), reads, changes and writes the file through a temporary file and a rename,
  * so a reader never sees a part of a write and two writers do not lose each other's programs.
  * A file that is not valid JSON is an error: the store does not write over it.
+ *
+ * The version of a record is a counter of the file, in the optional field `counter`. Each put takes
+ * the next number under the lock, and tests `expectedVersion` under the same lock. A file of an
+ * older release has no counter: the highest version of its records starts the count.
  */
 
 import { mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
-import { byKey, checkStoredProgram, keyMatches, type ProgramStore, type StoredProgram } from "./types.js";
+import {
+  byKey,
+  checkProgramVersion,
+  checkStoredProgram,
+  keyMatches,
+  nextCounterVersion,
+  type ProgramStore,
+  type ProgramWriteOptions,
+  type StoredProgram,
+} from "./types.js";
 
 interface ProgramFile {
   schemaVersion: 1;
+  /** The last version that a put gave. A file of an older release does not have it. */
+  counter?: number;
   programs: Record<string, StoredProgram>;
 }
 
@@ -34,6 +49,11 @@ function isContention(error: unknown): boolean {
 
 const pause = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
 
+/** The program of a key, or undefined. A key such as "constructor" is not a field of the prototype. */
+function ownProgram(file: ProgramFile, key: string): StoredProgram | undefined {
+  return Object.hasOwn(file.programs, key) ? file.programs[key] : undefined;
+}
+
 /**
  * This function runs a file operation again while Windows holds the file for a moment. `FileQueueStore` uses it
  * too.
@@ -66,17 +86,21 @@ export class FileProgramStore implements ProgramStore {
     return byKey(Object.values((await this.read()).programs).filter((p) => keyMatches(p.key, prefix)));
   }
 
-  async put(program: StoredProgram): Promise<void> {
+  async put(program: StoredProgram, options?: ProgramWriteOptions): Promise<void> {
     const checked = checkStoredProgram(structuredClone(program));
     await this.change((file) => {
-      file.programs[checked.key] = checked;
+      checkProgramVersion(checked.key, ownProgram(file, checked.key), options);
+      const version = nextCounterVersion(file.counter ?? 0, Object.values(file.programs));
+      file.counter = version;
+      file.programs[checked.key] = { ...checked, version };
       return true;
     });
   }
 
-  async delete(key: string): Promise<boolean> {
+  async delete(key: string, options?: ProgramWriteOptions): Promise<boolean> {
     let deleted = false;
     await this.change((file) => {
+      checkProgramVersion(key, ownProgram(file, key), options);
       deleted = Object.hasOwn(file.programs, key);
       if (deleted) delete file.programs[key];
       return deleted;
@@ -106,7 +130,8 @@ export class FileProgramStore implements ProgramStore {
     // A null-prototype object: a key such as "__proto__" stays a plain key
     const programs: Record<string, StoredProgram> = Object.create(null);
     for (const [key, value] of Object.entries(file.programs)) programs[key] = checkStoredProgram(value);
-    return { schemaVersion: 1, programs };
+    const counter = typeof file.counter === "number" && Number.isSafeInteger(file.counter) && file.counter > 0 ? file.counter : undefined;
+    return counter === undefined ? { schemaVersion: 1, programs } : { schemaVersion: 1, counter, programs };
   }
 
   /** Read, change and write the file under the lock. `change` gives false when nothing changed. */

package/src/program-store/index.ts

@@ -2,8 +2,8 @@
  * The program store (roadmap 3.2): programs of procedure.define that outlive the process.
  */
 
-export type { ProgramStore, StoredProgram } from "./types.js";
-export { checkStoredProgram } from "./types.js";
+export type { ProgramStore, ProgramWriteOptions, StoredProgram } from "./types.js";
+export { checkStoredProgram, storedProgramVersion } from "./types.js";
 export { MemoryProgramStore } from "./memory.js";
 export { FileProgramStore } from "./file.js";
 export { CollectionProgramStore } from "./collection.js";
@@ -15,3 +15,13 @@ export {
   procedureRemoteProcedure,
   programStoreProcedures,
 } from "./procedures.js";
+export { createProgramModule, createProgramProcedures } from "./programs.js";
+export type {
+  ProgramGetInput,
+  ProgramListInput,
+  ProgramProceduresOptions,
+  ProgramRemoveInput,
+  ProgramRemoveOutput,
+  ProgramSaveDefinition,
+  ProgramSaveInput,
+} from "./programs.js";

package/src/program-store/memory.ts

@@ -1,14 +1,25 @@
 /**
  * A program store in memory: for tests, and for a process that keeps its programs only while it
  * runs. Each read and write copies the record, so a caller that changes a result does not change
- * the store.
+ * the store. The version of a record is a counter of the store: each put takes the next number.
+ * Thus a program that is deleted and written again does not get an old version back.
  */
 
-import { byKey, checkStoredProgram, keyMatches, type ProgramStore, type StoredProgram } from "./types.js";
+import {
+  byKey,
+  checkProgramVersion,
+  checkStoredProgram,
+  keyMatches,
+  type ProgramStore,
+  type ProgramWriteOptions,
+  type StoredProgram,
+} from "./types.js";
 
 export class MemoryProgramStore implements ProgramStore {
   readonly kind = "memory";
   private readonly programs = new Map<string, StoredProgram>();
+  /** The last version that a put gave. */
+  private counter = 0;
 
   async get(key: string): Promise<StoredProgram | undefined> {
     const program = this.programs.get(key);
@@ -19,12 +30,16 @@ export class MemoryProgramStore implements ProgramStore {
     return byKey([...this.programs.values()].filter((p) => keyMatches(p.key, prefix)).map((p) => structuredClone(p)));
   }
 
-  async put(program: StoredProgram): Promise<void> {
+  async put(program: StoredProgram, options?: ProgramWriteOptions): Promise<void> {
     const checked = checkStoredProgram(structuredClone(program));
-    this.programs.set(checked.key, checked);
+    // The test and the write are one synchronous step
+    checkProgramVersion(checked.key, this.programs.get(checked.key), options);
+    this.counter++;
+    this.programs.set(checked.key, { ...checked, version: this.counter });
   }
 
-  async delete(key: string): Promise<boolean> {
+  async delete(key: string, options?: ProgramWriteOptions): Promise<boolean> {
+    checkProgramVersion(key, this.programs.get(key), options);
     return this.programs.delete(key);
   }
 }

package/src/program-store/procedures.ts

@@ -35,11 +35,13 @@ import type { ProgramStore, StoredProgram } from "./types.js";
 // Shared
 // =============================================================================
 
-const pathField = z
+/** The schema of a path: a list of segments, or a dotted key. `createProgramProcedures` uses it too. */
+export const pathField: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodString]> = z
   .union([z.array(z.string().min(1)).min(1), z.string().min(1)])
   .describe('The path of the procedure: a list of segments, or a dotted key such as "reports.weekly"');
 
-function toPath(path: ProcedurePath | string): ProcedurePath {
+/** This function gives the path of a path field: a dotted key becomes a list of segments. */
+export function toPath(path: ProcedurePath | string): ProcedurePath {
   return typeof path === "string" ? keyToPath(path) : path;
 }
 

package/src/program-store/programs.ts

@@ -0,0 +1,307 @@
+/**
+ * The procedures of the saved programs of a tenant (AG1-B): `programs.save`, `get`, `list` and
+ * `remove`.
+ *
+ * One program store has two scopes:
+ *
+ * - The scope "host": the store of a registry (`attachProgramStore`). `procedure.store`, `load` and
+ *   `sync` use it, and `procedure.load` defines its programs in the registry.
+ * - The scope "tenant": the store of a partition. The procedures of this module read and write it.
+ *   They do not define a program in a registry. A program of a tenant is data: a view lists it,
+ *   and a caller starts it with `client.chain` or `client.exec`.
+ *
+ * The partition of each call comes from the resolver of the host, as for `createCollectionProcedures`.
+ * The resolver gets the context (with `ctx.principal`) and the partition that the input asks for.
+ * The input only selects: the resolver decides. A `null` result refuses the call (`FORBIDDEN`,
+ * reason `partition-not-allowed`). The function `storeFor` gives the store of the partition.
+ * Thus one tenant does not read the store of another tenant.
+ *
+ * A save tests the record with `checkStoredProgram`, and the program with the test of
+ * `procedure.define` (`isAnyProcedureRef`). A save and a remove take `expectedVersion` (decision
+ * D11): a conflict rejects with `VersionConflictError` and changes nothing.
+ */
+
+import { z } from "zod";
+import {
+  createProcedure,
+  defineModule,
+  InvocationError,
+  isAnyProcedureRef,
+  pathToKey,
+  PARTITION_PATTERN,
+  RAW_INPUT_TAG,
+  typed,
+  type AggregationDefinition,
+  type AnyProcedure,
+  type PartitionResolver,
+  type ProcedureContext,
+  type ProcedureModule,
+  type ProcedurePath,
+} from "@procedures/client";
+import { pathField, toPath } from "./procedures.js";
+import { checkStoredProgram, type ProgramStore, type ProgramWriteOptions, type StoredProgram } from "./types.js";
+
+/** The options of `createProgramProcedures`. */
+export interface ProgramProceduresOptions {
+  /**
+   * The resolver of the partition of a call: the tenant comes from the principal, not from the
+   * input alone. It gives the partition, `undefined` for the store without a partition, or `null`
+   * to refuse the call.
+   */
+  readonly partition: PartitionResolver;
+  /**
+   * The store of a partition. Give the same store for the same partition each time, and a store of
+   * its own for each tenant.
+   */
+  readonly storeFor: (partition: string | undefined) => ProgramStore | Promise<ProgramStore>;
+  /**
+   * The namespace of the procedures.
+   * @default ["programs"]
+   */
+  readonly namespace?: ProcedurePath | undefined;
+}
+
+/** The program of `programs.save`: a procedure ref, as `procedure.define` takes it. */
+export interface ProgramSaveDefinition {
+  [field: string]: unknown;
+  $proc: ProcedurePath;
+  input?: unknown;
+  $name?: string | undefined;
+}
+
+/** The input of `programs.save`. */
+export interface ProgramSaveInput {
+  path: ProcedurePath | string;
+  program: ProgramSaveDefinition;
+  name?: string | undefined;
+  description?: string | undefined;
+  expectedVersion?: string | number | null | undefined;
+  partition?: string | undefined;
+}
+
+/** The input of `programs.get`: a path or a key. */
+export interface ProgramGetInput {
+  path?: ProcedurePath | string | undefined;
+  key?: string | undefined;
+  partition?: string | undefined;
+}
+
+/** The input of `programs.list`. */
+export interface ProgramListInput {
+  prefix?: ProcedurePath | string | undefined;
+  partition?: string | undefined;
+}
+
+/** The input of `programs.remove`. */
+export interface ProgramRemoveInput {
+  path: ProcedurePath | string;
+  expectedVersion?: string | number | null | undefined;
+  partition?: string | undefined;
+}
+
+/** The output of `programs.remove`. */
+export interface ProgramRemoveOutput {
+  /** True when the store had the program. */
+  removed: boolean;
+  /** The key of the program. */
+  key: string;
+}
+
+/** The resource of the effects of the procedures. */
+const PROGRAMS = "programs";
+
+const partitionField = z
+  .string()
+  .regex(PARTITION_PATTERN)
+  .optional()
+  .describe("The partition that the call asks for, for example a scope. The resolver of the host decides.");
+
+const expectedVersionField = z
+  .union([z.string().max(1024), z.number(), z.null()])
+  .optional()
+  .describe("The version that the write expects for the current program. null expects no program. Absent: the last write wins.");
+
+/** The schema of a program, as `procedure.define` takes it. */
+const programField = z
+  .looseObject({
+    $proc: z.array(z.string().min(1)).min(1).describe("The path of the procedure that the program calls"),
+    input: z.unknown().optional().describe("The input of that call"),
+    $name: z.string().optional().describe("A name that a $ref can read"),
+  })
+  .describe('The program: a procedure ref, for example { "$proc": ["client", "chain"], "input": { "steps": [...] } }');
+
+/** The options of a write: only a given `expectedVersion`, so a store without versions gets no field. */
+function writeOptionsOf(expectedVersion: string | number | null | undefined): ProgramWriteOptions | undefined {
+  return expectedVersion === undefined ? undefined : { expectedVersion };
+}
+
+/**
+ * This function gives the procedures of the saved programs of a tenant: `save`, `get`, `list` and
+ * `remove` under the namespace. Each call resolves its partition, and reads and writes only the
+ * store of that partition. The function registers nothing.
+ *
+ * @example
+ * ```typescript
+ * const stores = new Map<string, ProgramStore>();
+ * const procedures = createProgramProcedures({
+ *   // The tenant comes from the principal. A call without a principal is refused.
+ *   partition: (ctx) => ctx.principal?.id ?? null,
+ *   storeFor: (tenant) => {
+ *     const key = tenant ?? "";
+ *     if (!stores.has(key)) stores.set(key, new MemoryProgramStore());
+ *     return stores.get(key)!;
+ *   },
+ * });
+ * ```
+ */
+export function createProgramProcedures(options: ProgramProceduresOptions): AnyProcedure[] {
+  const namespace: ProcedurePath = [...(options.namespace ?? [PROGRAMS])];
+  if (namespace.length === 0 || !namespace.every((segment) => typeof segment === "string" && segment !== "")) {
+    throw new TypeError("The namespace of the program procedures must be a list of non-empty strings");
+  }
+  const what = pathToKey(namespace);
+
+  /** The store of a call: the resolver gives the partition, and `storeFor` its store. */
+  const storeOf = async (ctx: ProcedureContext, requested: string | undefined): Promise<ProgramStore> => {
+    const partition = await options.partition(ctx, requested);
+    if (partition === null) {
+      const of = requested === undefined ? "" : ` "${requested}"`;
+      throw new InvocationError("FORBIDDEN", `The call cannot use the partition${of} of ${what}`, ctx.path, "partition-not-allowed");
+    }
+    if (partition !== undefined && !PARTITION_PATTERN.test(partition)) {
+      throw new Error(`The partition resolver gave a partition that is not valid: ${JSON.stringify(partition).slice(0, 80)}`);
+    }
+    return options.storeFor(partition);
+  };
+
+  const notFound = (ctx: ProcedureContext, key: string): InvocationError =>
+    new InvocationError("NOT_FOUND", `No program is saved at ${key}`, ctx.path);
+
+  const save: AnyProcedure = createProcedure()
+    .path([...namespace, "save"])
+    .input(
+      z.object({
+        path: pathField,
+        program: programField,
+        name: z.string().min(1).max(200).optional().describe("The name of the program, for a list of programs"),
+        description: z.string().max(2000).optional().describe("The description of the program, in words"),
+        expectedVersion: expectedVersionField,
+        partition: partitionField,
+      })
+    )
+    .output(typed<StoredProgram>())
+    .meta({
+      description: "Save a program of the caller's partition: a new program, or a new version of a saved one",
+      // The program is data: exec() does not run its refs
+      tags: ["programs", "storage", RAW_INPUT_TAG],
+      // It replaces the saved program of the same path
+      effects: { reads: [PROGRAMS], writes: [PROGRAMS] },
+      args: ["path"],
+    })
+    .handler(async (input: ProgramSaveInput, ctx: ProcedureContext): Promise<StoredProgram> => {
+      const path = toPath(input.path);
+      if (!isAnyProcedureRef(input.program)) {
+        throw new InvocationError("VALIDATION_ERROR", 'The program must be a procedure ref: { "$proc": [...], "input": {...} }', ctx.path);
+      }
+      const record = checkStoredProgram({
+        key: pathToKey(path),
+        path: [...path],
+        program: input.program as AggregationDefinition,
+        storedAt: Date.now(),
+        ...(input.name !== undefined && { name: input.name }),
+        ...(input.description !== undefined && { description: input.description }),
+      });
+      const store = await storeOf(ctx, input.partition);
+      await store.put(record, writeOptionsOf(input.expectedVersion));
+      // The store sets the version: the record of the store is the result
+      return (await store.get(record.key)) ?? record;
+    })
+    .build();
+
+  const get: AnyProcedure = createProcedure()
+    .path([...namespace, "get"])
+    .input(
+      z.object({
+        path: pathField.optional(),
+        key: z.string().min(1).optional().describe('The dotted key of the program, for example "reports.weekly"'),
+        partition: partitionField,
+      })
+    )
+    .output(typed<StoredProgram>())
+    .meta({
+      description: "Read a saved program of the caller's partition, with its version",
+      tags: ["programs", "storage"],
+      effects: { reads: [PROGRAMS], writes: [], idempotent: true },
+    })
+    .handler(async (input: ProgramGetInput, ctx: ProcedureContext): Promise<StoredProgram> => {
+      if ((input.path === undefined) === (input.key === undefined)) {
+        throw new InvocationError("VALIDATION_ERROR", `${what}.get needs exactly one of \`path\` or \`key\``, ctx.path);
+      }
+      const key = input.key ?? pathToKey(toPath(input.path!));
+      const store = await storeOf(ctx, input.partition);
+      const program = await store.get(key);
+      if (!program) throw notFound(ctx, key);
+      return program;
+    })
+    .build();
+
+  const list: AnyProcedure = createProcedure()
+    .path([...namespace, "list"])
+    .input(
+      z.object({
+        prefix: pathField.optional().describe("Only the programs of this path and under it"),
+        partition: partitionField,
+      })
+    )
+    .output(typed<StoredProgram[]>())
+    .meta({
+      description: "List the saved programs of the caller's partition, sorted by key",
+      tags: ["programs", "storage"],
+      effects: { reads: [PROGRAMS], writes: [], idempotent: true },
+    })
+    .handler(async (input: ProgramListInput, ctx: ProcedureContext): Promise<StoredProgram[]> => {
+      const store = await storeOf(ctx, input.partition);
+      return store.list(input.prefix === undefined ? undefined : pathToKey(toPath(input.prefix)));
+    })
+    .build();
+
+  const remove: AnyProcedure = createProcedure()
+    .path([...namespace, "remove"])
+    .input(
+      z.object({
+        path: pathField,
+        expectedVersion: expectedVersionField,
+        partition: partitionField,
+      })
+    )
+    .output(
+      z.object({
+        removed: z.boolean().describe("True when the store had the program"),
+        key: z.string().describe("The key of the program"),
+      })
+    )
+    .meta({
+      description: "Remove a saved program of the caller's partition",
+      tags: ["programs", "storage"],
+      effects: { reads: [PROGRAMS], writes: [PROGRAMS], destructive: true, idempotent: true },
+      args: ["path"],
+    })
+    .handler(async (input: ProgramRemoveInput, ctx: ProcedureContext): Promise<ProgramRemoveOutput> => {
+      const key = pathToKey(toPath(input.path));
+      const store = await storeOf(ctx, input.partition);
+      return { removed: await store.delete(key, writeOptionsOf(input.expectedVersion)), key };
+    })
+    .build();
+
+  return [save, get, list, remove];
+}
+
+/**
+ * This function gives the procedures of `createProgramProcedures` as a module, for
+ * `createRegistry()` or `registerModules()`. The name of the module has the namespace, so two
+ * namespaces give two modules. The function registers nothing.
+ */
+export function createProgramModule(options: ProgramProceduresOptions): ProcedureModule {
+  const namespace = options.namespace ?? [PROGRAMS];
+  return defineModule(`@procedures/store/programs:${pathToKey(namespace)}`, createProgramProcedures(options));
+}