Workspaces Payload collection with the PAT as a write-only field:
access.read () => false strips it from every access-controlled read
path, and a field-level beforeChange hook encrypts on write with
AES-256-GCM (scrypt key from VEECT_SECRET, random per-value salt + IV,
v1 storage format) via node:crypto only. The real repository replaces
the phase-1 stub with payload create/findByID; toDomain never maps the
credential, and getDecryptedCredential(id) is the single server-side
decrypt path for the runner handoff (story 07). Contract suite now
covers create, write-only behaviour, and the decrypt path against both
the mock and the Payload impl (stub runs the real collection hooks).
Missing VEECT_SECRET fails production bind/boot with an actionable
message; dev-seed boots without it. Env declared in turbo.json
globalEnv + .env.example.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
Veect retrofit (ADR-027): the product is a hosted SaaS built on
web-next; apps/web-tanstack existed only as template demo surface for
the TanStack Start framework path. This slice removes the app and all
wiring that referenced it:
- turbo.json globalEnv: WEB_TANSTACK_SENTRY_DSN,
VITE_WEB_TANSTACK_SENTRY_DSN, VITE_GIT_COMMIT_SHA,
SENTRY_PROJECT_WEB_TANSTACK
- .env.example: the same four DSN/release vars
- generator e2e fixtures that stripped deps from the app's package.json
- coverage diff comment + test fixtures referencing apps/web-tanstack
- app-list entries in README, CLAUDE.md (port table, Sentry projects),
AGENTS.md (tags, binder list, per-app docs), docs/glossary.md (App)
- pnpm-lock.yaml importer + orphaned transitive deps
Framework-support code in core packages stays: core-trpc's TanStack
provider, core-shared security/tanstack middleware, and the Sentry
react/node init adapters are generic TanStack support, not app wiring.
Prose in guides/ADRs/library traces is story 08 scope.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
