@statewalker/httpeers-hub 0.1.3

package/dist/node.js

@@ -0,0 +1,39 @@
+/**
+ * The Node profile: hub state on disk.
+ *
+ * Write-then-rename, for the reason rung 04 measured: the prototype's file
+ * snapshot store wrote IN PLACE, so a crash mid-write left a truncated JSON
+ * document — and a hub that cannot parse its snapshot starts EMPTY. Every
+ * member forgotten, every spent invitation id forgotten and therefore
+ * replayable, and nothing reporting an error.
+ */
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+export function fileStorage(path) {
+    const pathFor = (key) => `${path}.${key.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+    return {
+        async get(key) {
+            try {
+                return await readFile(pathFor(key), "utf8");
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    return undefined;
+                throw error;
+            }
+        },
+        async set(key, value) {
+            const target = pathFor(key);
+            await mkdir(dirname(target), { recursive: true });
+            // Same directory, so the rename cannot cross a filesystem boundary —
+            // the one case where it would stop being atomic.
+            const staging = `${target}.${process.pid}.${Date.now()}.tmp`;
+            await writeFile(staging, value, { mode: 0o600 });
+            await rename(staging, target);
+        },
+        async delete(key) {
+            const { rm } = await import("node:fs/promises");
+            await rm(pathFor(key), { force: true });
+        },
+    };
+}

package/dist/registries.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The hub's three registries: members, presence, advertisements.
+ *
+ * All three are plain in-memory data structures with an injected clock
+ * (`() => number`) so TTL and sequencing behaviour is deterministic under
+ * test, with no real timers involved. Persistence is a later task's job —
+ * nothing here touches the filesystem or a database.
+ */
+import type { RuleSet } from "@statewalker/httpeers-access";
+import type { AdvertisementStore, MemberStore, PresenceStore } from "@statewalker/httpeers-core";
+/**
+ * Durable membership: who belongs to the mesh, and with what roles.
+ *
+ * `setRoles` validates its `roles` against `rules` before writing — "catch a
+ * typo where it is made, not three hops later as a silent denial" (the v0.9.0
+ * delta's own rationale). Since ADR-0019 there is no separate role registry to
+ * validate against: a role exists for this node exactly when some rule fires
+ * on it, which is what `validateRoles` reads. This is deliberately at the STORE,
+ * not at whichever call site happens to reach `setRoles` today: a guard
+ * placed at a call site is only as durable as that call site, and a later
+ * one added without knowing the guard belongs here would ship an
+ * unvalidated role write. `add` is NOT validated here — every caller that
+ * feeds it caller-supplied roles (e.g. invitation redemption) validates
+ * them earlier, at the point the roles were themselves accepted
+ * (`InvitationStore.create` in `apps/httpeers-stack`), matching the
+ * archived delta's own choice to guard `createInvitation` and `setRoles`,
+ * never `addMember`.
+ */
+export declare function createMemberStore(rules: RuleSet, clock?: () => number): MemberStore;
+/**
+ * TTL'd, swept presence: who is live right now.
+ *
+ * Writes are monotonic per peer — see `PresenceStore` in types.ts for why.
+ * The comparison is always `seq` against the peer's own last-accepted
+ * `seq`, never wall-clock time and never across different peers.
+ */
+export declare function createPresenceStore(clock?: () => number): PresenceStore;
+/**
+ * The bulletin board: what peers offer. Keyed by `(peerId, key)` via a
+ * two-level `Map` — not a joined string — so there is no delimiter to pick
+ * and therefore no way for a `peerId` or `key` value to collide with one.
+ * Entries persist until withdrawn or replaced, not on a timer.
+ */
+export declare function createAdvertisementStore(clock?: () => number): AdvertisementStore;
+//# sourceMappingURL=registries.d.ts.map

package/dist/registries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registries.d.ts","sourceRoot":"","sources":["../src/registries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,KAAK,EAEV,kBAAkB,EAElB,WAAW,EAEX,aAAa,EAEd,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,WAAW,CAyB7F;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,MAAM,MAAiB,GAAG,aAAa,CAqCjF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,GAAE,MAAM,MAAiB,GAAG,kBAAkB,CA+B3F"}

package/dist/registries.js

@@ -0,0 +1,133 @@
+/**
+ * The hub's three registries: members, presence, advertisements.
+ *
+ * All three are plain in-memory data structures with an injected clock
+ * (`() => number`) so TTL and sequencing behaviour is deterministic under
+ * test, with no real timers involved. Persistence is a later task's job —
+ * nothing here touches the filesystem or a database.
+ */
+import { assertValid, validateRoles } from "@statewalker/httpeers-access";
+/**
+ * Durable membership: who belongs to the mesh, and with what roles.
+ *
+ * `setRoles` validates its `roles` against `rules` before writing — "catch a
+ * typo where it is made, not three hops later as a silent denial" (the v0.9.0
+ * delta's own rationale). Since ADR-0019 there is no separate role registry to
+ * validate against: a role exists for this node exactly when some rule fires
+ * on it, which is what `validateRoles` reads. This is deliberately at the STORE,
+ * not at whichever call site happens to reach `setRoles` today: a guard
+ * placed at a call site is only as durable as that call site, and a later
+ * one added without knowing the guard belongs here would ship an
+ * unvalidated role write. `add` is NOT validated here — every caller that
+ * feeds it caller-supplied roles (e.g. invitation redemption) validates
+ * them earlier, at the point the roles were themselves accepted
+ * (`InvitationStore.create` in `apps/httpeers-stack`), matching the
+ * archived delta's own choice to guard `createInvitation` and `setRoles`,
+ * never `addMember`.
+ */
+export function createMemberStore(rules, clock = Date.now) {
+    const members = new Map();
+    return {
+        add(peerId, roles) {
+            const record = { peerId, roles: [...roles], updatedAt: clock() };
+            members.set(peerId, record);
+            return record;
+        },
+        setRoles(peerId, roles) {
+            assertValid(validateRoles(rules, roles, `setRoles(${peerId})`));
+            const record = { peerId, roles: [...roles], updatedAt: clock() };
+            members.set(peerId, record);
+            return record;
+        },
+        remove(peerId) {
+            members.delete(peerId);
+        },
+        get(peerId) {
+            return members.get(peerId);
+        },
+        list() {
+            return [...members.values()];
+        },
+    };
+}
+/**
+ * TTL'd, swept presence: who is live right now.
+ *
+ * Writes are monotonic per peer — see `PresenceStore` in types.ts for why.
+ * The comparison is always `seq` against the peer's own last-accepted
+ * `seq`, never wall-clock time and never across different peers.
+ */
+export function createPresenceStore(clock = Date.now) {
+    const presence = new Map();
+    return {
+        heartbeat(peerId, seq, ttlMs) {
+            const existing = presence.get(peerId);
+            if (existing !== undefined && seq <= existing.seq) {
+                return { accepted: false, reason: "stale-sequence" };
+            }
+            const record = { peerId, seq, expiresAt: clock() + ttlMs };
+            presence.set(peerId, record);
+            return { accepted: true, record };
+        },
+        isPresent(peerId) {
+            const record = presence.get(peerId);
+            return record !== undefined && record.expiresAt > clock();
+        },
+        get(peerId) {
+            return presence.get(peerId);
+        },
+        list() {
+            return [...presence.values()];
+        },
+        sweep() {
+            const now = clock();
+            const expired = [];
+            for (const record of presence.values()) {
+                if (record.expiresAt <= now) {
+                    expired.push(record.peerId);
+                }
+            }
+            for (const peerId of expired) {
+                presence.delete(peerId);
+            }
+            return expired;
+        },
+    };
+}
+/**
+ * The bulletin board: what peers offer. Keyed by `(peerId, key)` via a
+ * two-level `Map` — not a joined string — so there is no delimiter to pick
+ * and therefore no way for a `peerId` or `key` value to collide with one.
+ * Entries persist until withdrawn or replaced, not on a timer.
+ */
+export function createAdvertisementStore(clock = Date.now) {
+    const board = new Map();
+    return {
+        post(peerId, key, payload) {
+            const ad = { peerId, key, payload, postedAt: clock() };
+            let byKey = board.get(peerId);
+            if (byKey === undefined) {
+                byKey = new Map();
+                board.set(peerId, byKey);
+            }
+            byKey.set(key, ad);
+            return ad;
+        },
+        withdraw(peerId, key) {
+            board.get(peerId)?.delete(key);
+        },
+        get(peerId, key) {
+            return board.get(peerId)?.get(key);
+        },
+        list(peerId) {
+            if (peerId !== undefined) {
+                return [...(board.get(peerId)?.values() ?? [])];
+            }
+            const all = [];
+            for (const byKey of board.values()) {
+                all.push(...byKey.values());
+            }
+            return all;
+        },
+    };
+}

package/dist/storage.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The candidate `hub` package's storage seam, and two adapters for it.
+ *
+ * DERIVED, NOT DESIGNED. Everything the hub does to storage today is
+ * whole-value get / set / delete by key: `persist.ts` reads and writes one
+ * JSON file; `browser/snapshot-store.ts` reads and writes one IndexedDB
+ * value. Nothing lists, appends, or compare-and-sets. So the interface is
+ * those three methods and no more.
+ *
+ * `SnapshotStore` (`hub/hub-state.ts`) is deliberately SYNCHRONOUS, because
+ * every mutation writes and returns, and an async write would let a caller be
+ * told "member added" while the snapshot still said otherwise. Both async
+ * backends therefore need the same wrapper the browser already has: the
+ * in-memory copy is authoritative, and flushes are serialised behind it.
+ * `asyncSnapshotStore` below is that wrapper, generalised — it is
+ * `browser/snapshot-store.ts`'s logic over any `KeyValueStorage` rather than
+ * over idb-keyval specifically.
+ */
+import type { FilesApi } from "@statewalker/webrun-files";
+import { type SnapshotStore } from "./hub-state.js";
+/** The whole persistence contract. Three methods, because three is what the hub uses. */
+export interface KeyValueStorage {
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** For tests and for a hub that deliberately keeps nothing. */
+export declare function memoryStorage(): KeyValueStorage;
+/**
+ * A `FilesApi` as key/value storage — one file per key under `dir`.
+ *
+ * WRITE-THEN-MOVE, because a crash mid-write must not leave a half-written
+ * snapshot where the whole state lives. `persist.ts`'s Node implementation
+ * does NOT do this (it writes in place), which is a defect this adapter does
+ * not inherit.
+ *
+ * FilesApi HAS NO CONDITIONAL WRITE — no compare-and-set, no if-match. That
+ * is why the hub's single-writer precondition is a precondition rather than
+ * something the storage layer can enforce; rung 04's third claim measures
+ * exactly what that costs.
+ */
+export declare function filesStorage(files: FilesApi, dir?: string): KeyValueStorage;
+export interface AsyncSnapshotStore extends SnapshotStore {
+    /** Resolves when every write issued so far has reached the backend. */
+    flushed(): Promise<void>;
+}
+/**
+ * Load once, then serve reads from memory and flush writes behind them —
+ * the shape `SnapshotStore`'s synchronous contract forces on any async
+ * backend.
+ */
+export declare function asyncSnapshotStore(storage: KeyValueStorage, key?: string): Promise<AsyncSnapshotStore>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEtF,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,IAAI,eAAe,CAa/C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,SAAQ,GAAG,eAAe,CAkC1E;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,uEAAuE;IACvE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,GAAG,SAAa,GACf,OAAO,CAAC,kBAAkB,CAAC,CA4B7B"}

package/dist/storage.js

@@ -0,0 +1,113 @@
+/**
+ * The candidate `hub` package's storage seam, and two adapters for it.
+ *
+ * DERIVED, NOT DESIGNED. Everything the hub does to storage today is
+ * whole-value get / set / delete by key: `persist.ts` reads and writes one
+ * JSON file; `browser/snapshot-store.ts` reads and writes one IndexedDB
+ * value. Nothing lists, appends, or compare-and-sets. So the interface is
+ * those three methods and no more.
+ *
+ * `SnapshotStore` (`hub/hub-state.ts`) is deliberately SYNCHRONOUS, because
+ * every mutation writes and returns, and an async write would let a caller be
+ * told "member added" while the snapshot still said otherwise. Both async
+ * backends therefore need the same wrapper the browser already has: the
+ * in-memory copy is authoritative, and flushes are serialised behind it.
+ * `asyncSnapshotStore` below is that wrapper, generalised — it is
+ * `browser/snapshot-store.ts`'s logic over any `KeyValueStorage` rather than
+ * over idb-keyval specifically.
+ */
+import { EMPTY_SNAPSHOT } from "./hub-state.js";
+/** For tests and for a hub that deliberately keeps nothing. */
+export function memoryStorage() {
+    const map = new Map();
+    return {
+        async get(key) {
+            return map.get(key);
+        },
+        async set(key, value) {
+            map.set(key, value);
+        },
+        async delete(key) {
+            map.delete(key);
+        },
+    };
+}
+/**
+ * A `FilesApi` as key/value storage — one file per key under `dir`.
+ *
+ * WRITE-THEN-MOVE, because a crash mid-write must not leave a half-written
+ * snapshot where the whole state lives. `persist.ts`'s Node implementation
+ * does NOT do this (it writes in place), which is a defect this adapter does
+ * not inherit.
+ *
+ * FilesApi HAS NO CONDITIONAL WRITE — no compare-and-set, no if-match. That
+ * is why the hub's single-writer precondition is a precondition rather than
+ * something the storage layer can enforce; rung 04's third claim measures
+ * exactly what that costs.
+ */
+export function filesStorage(files, dir = "hub") {
+    const path = (key) => `${dir}/${encodeURIComponent(key)}.json`;
+    return {
+        async get(key) {
+            const file = path(key);
+            if (!(await files.exists(file)))
+                return undefined;
+            const chunks = [];
+            for await (const chunk of files.read(file))
+                chunks.push(chunk);
+            const total = chunks.reduce((n, c) => n + c.length, 0);
+            const bytes = new Uint8Array(total);
+            let at = 0;
+            for (const chunk of chunks) {
+                bytes.set(chunk, at);
+                at += chunk.length;
+            }
+            return new TextDecoder().decode(bytes);
+        },
+        async set(key, value) {
+            const file = path(key);
+            const temp = `${file}.tmp`;
+            const bytes = new TextEncoder().encode(value);
+            await files.write(temp, (async function* () {
+                yield bytes;
+            })());
+            await files.move(temp, file);
+        },
+        async delete(key) {
+            await files.remove(path(key));
+        },
+    };
+}
+/**
+ * Load once, then serve reads from memory and flush writes behind them —
+ * the shape `SnapshotStore`'s synchronous contract forces on any async
+ * backend.
+ */
+export async function asyncSnapshotStore(storage, key = "snapshot") {
+    const raw = await storage.get(key);
+    let current = EMPTY_SNAPSHOT;
+    if (raw != null) {
+        try {
+            current = JSON.parse(raw);
+        }
+        catch {
+            // A corrupt value reads as empty rather than throwing, matching
+            // `browser/snapshot-store.ts`. A hub that refuses to start because its
+            // state file was truncated is worse than one that starts empty and
+            // says so.
+            current = EMPTY_SNAPSHOT;
+        }
+    }
+    // Writes are chained, never concurrent: two overlapping flushes of the same
+    // key can land out of order, and the loser would be the newer state.
+    let chain = Promise.resolve();
+    return {
+        read: () => current,
+        write(snapshot) {
+            current = snapshot;
+            const value = JSON.stringify(snapshot);
+            chain = chain.then(() => storage.set(key, value)).catch(() => { });
+        },
+        flushed: () => chain,
+    };
+}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@statewalker/httpeers-hub",
+  "version": "0.1.3",
+  "type": "module",
+  "description": "Minting membership, holding the registries, and saying who is in the mesh.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/statewalker/httpeers.git",
+    "directory": "packages/httpeers-hub"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./node": {
+      "source": "./src/node.ts",
+      "types": "./dist/node.d.ts",
+      "import": "./dist/node.js"
+    },
+    "./browser": {
+      "source": "./src/browser.ts",
+      "types": "./dist/browser.d.ts",
+      "import": "./dist/browser.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "hono": "^4.13.12",
+    "@statewalker/httpeers-access": "^0.1.3",
+    "@statewalker/httpeers-core": "^0.1.2"
+  },
+  "peerDependencies": {
+    "@statewalker/webrun-files": "^0.9.0 || ^0.10.0"
+  },
+  "peerDependenciesMeta": {
+    "@statewalker/webrun-files": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.15",
+    "@statewalker/webrun-files": "^0.10.0",
+    "@types/node": "^26.6.4",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "pnpm run build && pnpm run typecheck && vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check src tests",
+    "lint:check": "biome check src tests"
+  }
+}

package/src/admin.ts

@@ -0,0 +1,50 @@
+/**
+ * `DELETE /admin/members/{peerId}` — closes the gap the design record has
+ * carried since Task 1: `MemberStore.remove` has existed as a store method
+ * with no endpoint and no authorisation the whole time, "exactly the kind
+ * of thing that must not be reachable by an ordinary member" (design
+ * record §5.2). Capability gating (`std:mesh.admin`) is `policy.ts`'s
+ * `/admin` policy in `policy.ts`, not this handler's job — this file only
+ * does the removal, same split as every other handler in this app.
+ *
+ * TWO CALLS, NOT ONE, BECAUSE THIS PACKAGE SPLIT WHAT THE ARCHIVE KEPT AS
+ * ONE STORE. `hub.memberStore.remove(peerId)` drops membership;
+ * `hub.revocations.revoke(peerId)` records the change so a provider's
+ * pulled deny-list cache can see it — see `tests/support/mesh.ts`'s own
+ * header comment for the archived one-call precedent this splits in two.
+ * `RevocationRegistry.revoke` bumps `policyVersion()` internally (see
+ * `revocation.ts`): there is no separate "bump the version" step to
+ * forget — calling `revoke` at all IS the bump, which is what makes a
+ * provider's next heartbeat see the change.
+ *
+ * Removal (and revocation) is unconditional and idempotent: `MemberStore
+ * .remove` on a peerId that is not currently a member is a harmless no-op
+ * (`Map.delete` on a missing key), and revoking a peerId with no prior
+ * membership is a legitimate "make sure this identity can never redeem an
+ * old token" operation, not an error condition — so this handler does not
+ * 404 on an unknown peerId.
+ */
+
+import type { RevocationRegistry } from "@statewalker/httpeers-access/issuer";
+import type { FetchHandler, MemberStore } from "@statewalker/httpeers-core";
+import { json } from "@statewalker/httpeers-core";
+import { Hono } from "hono";
+
+export interface AdminEndpointsInit {
+  memberStore: MemberStore;
+  revocations: RevocationRegistry;
+}
+
+/** `DELETE /admin/members/{peerId}`. Mounted at `/admin/members` — see `hub/endpoints.ts`. */
+export function createAdminEndpoints(init: AdminEndpointsInit): FetchHandler {
+  const app = new Hono();
+
+  app.delete("/admin/members/:peerId", (c) => {
+    const peerId = c.req.param("peerId");
+    init.memberStore.remove(peerId);
+    init.revocations.revoke(peerId);
+    return json({ ok: true, removed: peerId, policyVersion: init.revocations.policyVersion() });
+  });
+
+  return app.fetch as FetchHandler;
+}

package/src/browser.ts

@@ -0,0 +1,73 @@
+/**
+ * The browser profile: hub state in IndexedDB.
+ *
+ * A hub in a tab is a real hub — it mints, it holds the registries, and its
+ * members expect to still be members after a reload. `localStorage` would do
+ * for strings, but IndexedDB is transactional, which matters when two writes
+ * race a reload.
+ */
+
+import type { KeyValueStorage } from "./storage.js";
+
+type IdbRequest<T> = {
+  result: T;
+  error: unknown;
+  onsuccess: (() => void) | null;
+  onerror: (() => void) | null;
+  onupgradeneeded?: (() => void) | null;
+};
+type IdbStore = {
+  get(key: string): IdbRequest<string | undefined>;
+  put(value: string, key: string): IdbRequest<unknown>;
+  delete(key: string): IdbRequest<unknown>;
+};
+type IdbDatabase = {
+  objectStoreNames: { contains(name: string): boolean };
+  createObjectStore(name: string): unknown;
+  transaction(
+    name: string,
+    mode: "readonly" | "readwrite",
+  ): { objectStore(name: string): IdbStore };
+  close(): void;
+};
+declare const indexedDB: { open(name: string, version: number): IdbRequest<IdbDatabase> };
+
+export function idbStorage(name = "httpeers-hub", store = "state"): KeyValueStorage {
+  const open = (): Promise<IdbDatabase> =>
+    new Promise((resolve, reject) => {
+      const request = indexedDB.open(name, 1);
+      request.onupgradeneeded = () => {
+        if (!request.result.objectStoreNames.contains(store)) {
+          request.result.createObjectStore(store);
+        }
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+
+  const run = async <T>(
+    mode: "readonly" | "readwrite",
+    act: (s: IdbStore) => IdbRequest<unknown>,
+  ): Promise<T> => {
+    const db = await open();
+    try {
+      return await new Promise<T>((resolve, reject) => {
+        const request = act(db.transaction(store, mode).objectStore(store));
+        request.onsuccess = () => resolve(request.result as T);
+        request.onerror = () => reject(request.error);
+      });
+    } finally {
+      db.close();
+    }
+  };
+
+  return {
+    get: (key) => run<string | undefined>("readonly", (s) => s.get(key)),
+    set: async (key, value) => {
+      await run("readwrite", (s) => s.put(value, key));
+    },
+    delete: async (key) => {
+      await run("readwrite", (s) => s.delete(key));
+    },
+  };
+}