@prestack/thread 0.0.1 → 0.0.2

package/dist/integrity/generators/publish.ts

@@ -0,0 +1,247 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { argv, env, execPath, stderr, stdout } from 'node:process'
+import { pathToFileURL } from 'node:url'
+import { CLI, exit } from '../../core/invoked.ts'
+import { named } from '../../core/scope.ts'
+import { findTree, inTree } from '../../core/tree.ts'
+
+import type { Secret } from '../../integrations/secret.ts'
+import { opened, sealedIn } from '../../integrations/vault.ts'
+
+const TREE = findTree()
+const ROOT = TREE.at
+
+const STEP_TIMEOUT = 900_000
+
+const REGISTRY = '--registry'
+
+const DEFAULT = 'https://registry.npmjs.org'
+
+interface Check {
+  readonly id: string
+  readonly runs: string
+  readonly because: string
+}
+
+const CHECKS: readonly Check[] = [
+  {
+    id: 'gate',
+    runs: 'thread gate',
+    because: 'every step this tree declares, in the order it declares them, which is where the descent and the sweep are',
+  },
+  {
+    id: 'lint',
+    runs: 'pnpm exec eslint .',
+    because: 'the rules that live on the lint surface, which is the only one carrying a fixer the sweep can report but not repair',
+  },
+  {
+    id: 'seal',
+    runs: 'pnpm seal:check',
+    because: 'the package must be the bytes it says it is. CHECKED and never regenerated, because a release that rewrites its own seal can never fail it',
+  },
+]
+
+const MINE = /^(?:npx |pnpm )?thread /
+
+function run(what: string, extra?: Record<string, string>): number {
+  const ours = MINE.exec(what)
+  if (ours !== null) {
+    const words = what.slice(ours[0].length).split(/\s+/).filter((one) => one !== '')
+    const ran = spawnSync(execPath, [...CLI, ...words], {
+      cwd: ROOT,
+      stdio: 'inherit',
+      timeout: STEP_TIMEOUT,
+      killSignal: 'SIGKILL',
+      env: extra === undefined ? env : { ...env, ...extra },
+    })
+    return ran.error !== undefined ? 1 : (ran.status ?? 1)
+  }
+  const result = spawnSync(what, {
+    shell: true,
+    cwd: ROOT,
+    stdio: 'inherit',
+    timeout: STEP_TIMEOUT,
+    killSignal: 'SIGKILL',
+    env: extra === undefined ? env : { ...env, ...extra },
+  })
+  return result.error !== undefined ? 1 : (result.status ?? 1)
+}
+
+function refuse(id: string, code: number, because: string, runs: string): never {
+  stderr.write(`\npublish: REFUSED — \`${id}\` exited ${String(code)}. NOTHING was published.\n`)
+  stderr.write(`publish: ${because}.\n`)
+  stderr.write(`publish: what refused is above, in that command's own words — this does not restate it, because a\n`)
+  stderr.write(`publish: second copy of a refusal drifts from the first. Run \`${runs}\` alone to work on it.\n`)
+  exit(1)
+}
+
+const flag = argv.indexOf(REGISTRY)
+const registry = flag === -1 ? DEFAULT : (argv[flag + 1] ?? '')
+
+if (registry === '' || registry.startsWith('-')) {
+  stderr.write(`thread publish ${REGISTRY} <url>   where the packages go. Leave it off for ${DEFAULT}.\n`)
+  stderr.write('\nit builds, then runs every check, then publishes. A check that fails publishes nothing.\n')
+  exit(1)
+}
+
+const TOKEN = 'sec_registry_token'
+
+const PRODUCTION = 'production'
+
+const secrets = inTree(TREE, 'secrets.ts')
+
+const declared = existsSync(secrets)
+  ? (((await import(pathToFileURL(secrets).href)) as { SECRETS?: readonly Secret[] }).SECRETS ?? [])
+  : []
+
+const vaulted = declared.some((one) => one.id === TOKEN)
+
+if (vaulted && !sealedIn(ROOT, PRODUCTION).includes(TOKEN)) {
+  stderr.write(`\npublish: ${TOKEN} is declared in _threads/secrets.ts and has no value sealed for ${PRODUCTION}, so nothing was checked and NOTHING was published.\n`)
+  stderr.write(`publish: run \`thread create secret set ${TOKEN}\` at a terminal and paste the registry token, or take the row out to publish with the login this machine holds.\n`)
+  exit(1)
+}
+
+const setting = (): string => {
+  const at = new URL(registry)
+  return `npm_config_//${at.host}${at.pathname.endsWith('/') ? at.pathname : `${at.pathname}/`}:_authToken`
+}
+
+async function tokened(): Promise<string> {
+  const values = await opened(ROOT, declared.map((one) => one.id), PRODUCTION)([TOKEN]).catch((thrown: unknown) => {
+    stderr.write(`\npublish: ${TOKEN} is sealed here and would not open: ${thrown instanceof Error ? thrown.message : String(thrown)}. NOTHING was published.\n`)
+    exit(1)
+  })
+  const token = values[TOKEN]
+  if (token === undefined) {
+    stderr.write(`\npublish: the vault opened and answered nothing for ${TOKEN}. NOTHING was published.\n`)
+    exit(1)
+  }
+  return token
+}
+
+const signedAs = env['GITHUB_ACTIONS'] === 'true' ? 'the identity npm trusts this GitHub Actions run under' : 'the login this machine already holds'
+
+stdout.write(
+  vaulted
+    ? `publish: ${TOKEN} is declared and sealed for ${PRODUCTION}. It is opened only after every check passes, and handed to pnpm as its auth setting for ${registry}.\n`
+    : `publish: no row declares ${TOKEN}, so this publish uses ${signedAs}. Declare it with \`thread create secret\` to publish with a token sealed in this repository instead.\n`,
+)
+
+stdout.write('publish: deriving and building what the packaging rows state first, so every check below reads the files this release ships rather than the source they were written from.\n')
+
+const made = run('npx thread packaged --build')
+stdout.write(`publish: packaged exited ${String(made)}\n`)
+if (made !== 0) {
+  refuse(
+    'packaged',
+    made,
+    'a package whose manifest and release note are not what its rows state would go out describing itself as something nobody declared, and one that did not compile would go out promising files it does not have',
+    'npx thread packaged --build',
+  )
+}
+
+stdout.write(`\npublish: ${String(CHECKS.length)} check(s) stand between this tree and ${registry}. Any one of them stops it.\n`)
+for (const check of CHECKS) stdout.write(`  ${check.id} — ${check.runs}\n`)
+
+for (const [index, check] of CHECKS.entries()) {
+  const at = `check ${String(index + 1)} of ${String(CHECKS.length)}`
+  stdout.write(`\npublish: ${at} — ${check.runs} (${check.id})\n`)
+
+  const code = run(check.runs)
+  stdout.write(`publish: ${at} — exited ${String(code)}\n`)
+  if (code !== 0) refuse(check.id, code, check.because, check.runs)
+}
+
+const numbered = run('npx thread packaged --release')
+stdout.write(`publish: packaged --release exited ${String(numbered)}\n`)
+if (numbered !== 0) {
+  refuse(
+    'packaged',
+    numbered,
+    'the next release number is written onto the manifests only once every check has passed, and writing it refused, so nothing here carries a number to go out under',
+    'npx thread packaged --release',
+  )
+}
+
+const handed = vaulted ? { [setting()]: await tokened() } : undefined
+
+stdout.write(`\npublish: every check passed. Publishing to ${registry} with ${vaulted ? `${TOKEN} from this repository's vault` : signedAs}.\n`)
+
+const sent = run(`pnpm -r publish --registry ${registry} --no-git-checks --access public`, handed)
+
+if (sent !== 0) {
+  stderr.write(`\npublish: the checks passed and the publish itself exited ${String(sent)}.\n`)
+  const back = run('npx thread packaged')
+  stderr.write(
+    back === 0
+      ? 'publish: the manifests carry the last recorded release again and no note was written, so the next `thread publish` numbers this release once more.\n'
+      : 'publish: the manifests still carry the number that did not go out. Run `npx thread packaged` to put the last recorded release back.\n',
+  )
+  exit(1)
+}
+
+const recorded = run('npx thread packaged --record')
+stdout.write(`publish: packaged --record exited ${String(recorded)}\n`)
+if (recorded !== 0) {
+  stderr.write('\npublish: the packages went out and the note recording them refused to be written, so the next publish would number this release again. Run `npx thread packaged --record` and read what it says.\n')
+  exit(1)
+}
+
+const SHEET = 'packaging.ts'
+
+interface Packaged {
+  readonly id?: string
+  readonly folder?: string
+}
+
+const sheet = inTree(TREE, SHEET)
+
+const stated = existsSync(sheet)
+  ? ((await import(pathToFileURL(sheet).href)) as { PACKAGES?: readonly Packaged[] })
+  : {}
+
+const shipped = stated.PACKAGES ?? []
+
+function versionAt(folder: string): string {
+  const at = join(ROOT, folder, 'package.json')
+  if (!existsSync(at)) return 'no manifest'
+  try {
+    return (JSON.parse(readFileSync(at, 'utf8')) as { version?: string }).version ?? 'no version'
+  } catch {
+    return 'no version'
+  }
+}
+
+function asked(what: readonly string[]): string {
+  return (spawnSync('git', what, { cwd: ROOT, encoding: 'utf8' }).stdout ?? '').trim()
+}
+
+if (asked(['rev-parse', '--is-inside-work-tree']) !== 'true') {
+  stdout.write("\npublish: it's not a repo, so nothing was committed.\n")
+} else if (shipped.length === 0) {
+  stdout.write('\npublish: no packaging row names a folder, so there is nothing derived here to commit.\n')
+} else {
+  const going = shipped.map((one) => `${named(one.id ?? '')} ${versionAt(one.folder ?? '')}`).join(', ')
+  const branch = asked(['rev-parse', '--abbrev-ref', 'HEAD'])
+
+  for (const one of shipped) run(`git add ${one.folder ?? ''}`)
+
+  if (spawnSync('git', ['diff', '--cached', '--quiet'], { cwd: ROOT }).status === 0) {
+    stdout.write(`\npublish: ${going} — what is on disk is already what is committed, so this release added no artifact.\n`)
+  } else {
+    const wrote = run(`git commit -m ${JSON.stringify(`thread publish — ${going}`)}`)
+    stdout.write(`publish: commit exited ${String(wrote)}\n`)
+    if (wrote !== 0) {
+      stderr.write('\npublish: the packages went out and the files that describe them are not committed, so this release has no record in git.\n')
+      stderr.write('publish: commit them by hand — everything is staged.\n')
+      exit(1)
+    }
+    stdout.write(`publish: committed the derived artifacts to ${branch} — ${going}.\n`)
+  }
+}
+
+stdout.write(`\npublish: done. What went out was derived, then built, then passed the gate, the lint and the seal, in that order. The compile inside \`thread packaged --build\` is the typecheck.\n`)
+exit(0)

package/dist/integrity/generators/rule.ts

@@ -0,0 +1,271 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { argv, stdout } from 'node:process'
+
+import { exit } from '../../core/invoked.ts'
+import { ELSEWHERE, RECEIPT, answer, answering, asking, asksOf, bodied, given as pipedIn, guidance, issue, marked, named as answerNames, needed, only, ownAnswers, refuse, rowLines, seeding, spend, stating, within, wordsIn, type Asked } from '../../core/asking.ts'
+import { holdsRow, listBounds, withRow } from '../../core/rows.ts'
+import { named } from '../../core/scope.ts'
+import { findTree, inTree } from '../../core/tree.ts'
+
+import type { Constraint } from '../constraint.ts'
+import { ROOT, SEEDED, declareSeeded, rules, scaffold, slopnatorName, write } from '../slopnator.ts'
+
+const TREE = findTree()
+
+const FILE = 'rules.ts'
+
+const LIST = 'RULES'
+
+const at = within(TREE.at, inTree(TREE, FILE))
+
+const kebab = (one: string): string => one.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '')
+
+const KEBAB = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
+
+export const ASKS: readonly Asked[] = asksOf(
+  'rule',
+  'Constraint',
+  {
+    name: { guide: 'kebab-case, e.g. no-fetch-in-a-screen', asks: 'name: ' },
+    describes: {
+      guide: 'one sentence a reader who has not seen the code could act on',
+      asks: 'describes — one sentence a reader who has not seen the code could act on: ',
+    },
+    where: {
+      guide: 'comma separated path fragments this governs, e.g. app/, src/nodes/',
+      asks: 'where (comma separated path fragments this governs, e.g. app/, src/nodes/): ',
+    },
+    except: {
+      guide: 'optional — comma separated path fragments to leave out',
+      asks: 'except (comma separated, blank for none): ',
+    },
+    bans: { guide: 'the exact form this refuses, in one line', asks: 'bans — the exact form this refuses, in one line: ' },
+    because: { guide: 'a fact somebody measured — why this is refused', asks: 'because — a fact somebody measured: ' },
+    instead: { guide: 'what to do instead', asks: 'instead — what to do instead: ' },
+    wrong: {
+      guide: 'one line of the form this refuses — its trial',
+      asks: 'wrong — one line of the form this refuses, its trial: ',
+    },
+    right: {
+      guide: 'one line of the form this allows — its trial',
+      asks: 'right — one line of the form this allows, its trial: ',
+    },
+    severity: {
+      guide: 'optional — forbidden (default, leave blank) or warning',
+      asks: 'severity — forbidden or warning (blank for forbidden): ',
+    },
+    finds: {
+      guide: 'one sentence saying what the check looks for, read by whoever opens it next',
+      asks: 'finds — one sentence saying what the check looks for: ',
+    },
+    body: {
+      guide:
+        'the check itself, written where it is asked for. Leave it blank and the rule is declared with nothing behind it, which `npx thread trials` reports unproven',
+      asks: 'body: ',
+      optional: true,
+    },
+  },
+  ['id', 'at', 'version'],
+)
+
+const said = (one: string): string => ASKS.find((each) => each.at === one)?.asks ?? `${one}: `
+
+import { quoted } from '../../core/rows.ts'
+
+const held = await rules()
+if (held === undefined) {
+  refuse(
+    `there is no ${at} declaring \`${LIST}\` here, so a rule has nowhere to go. ` +
+      `Run \`npx thread attach ${named('integrity')}\` — the sheet is the package's to write, not yours.`,
+  )
+}
+const existing: readonly Constraint[] = held
+
+const mark = (one: Constraint): string =>
+  marked([one.id, one.describes, one.bans, one.because, one.instead, one.wrong, one.right, JSON.stringify(one.where), one.severity ?? ''])
+
+const listing = [
+  existing.length === 0
+    ? 'no rules of its own yet — this app enforces only what the packages it attached ship.'
+    : `${String(existing.length)} rule(s) this app adds of its own:`,
+  ...existing.map((one) => `  [${mark(one)}] ${one.id} — ${one.bans}${one.severity === 'warning' ? ' (warning)' : ''}`),
+].join('\n')
+
+const words = wordsIn(['new'])
+
+stdout.write(`${listing}\n`)
+
+const flagged = argv.indexOf(RECEIPT)
+
+if (flagged === -1) {
+  const nonce = issue(TREE.at, listing)
+  stdout.write(
+    [
+      '',
+      ...answering('rule'),
+      '',
+      ...guidance(ASKS),
+      '',
+      `  npx thread create rule new <name> ${RECEIPT} ${nonce}`,
+      '',
+      ...ELSEWHERE,
+      '',
+      `${RECEIPT} is spent by one run, and is refused if ${at} changed after it was issued.`,
+      '',
+      'this writes three things, not one. The row goes in the sheet, the check goes in the file it ' +
+        'seeds from the `body` you give, and the trial comes from `wrong` and `right`.',
+      '',
+      'then it runs every generator this tree declares, that trial among them, so before this command ' +
+        'returns you see whether the rule fires at the form it refuses and stays silent at the fix it ' +
+        'names. Leave `body` blank and the row is declared with nothing behind it, and `npx thread ' +
+        'trials` reports it unproven until somebody writes the check.',
+      '',
+    ].join('\n'),
+  )
+  stdout.write(`create: receipt ${nonce} — spent on use, and stale the moment ${at} changes.\n`)
+  exit(0)
+}
+
+spend(TREE.at, listing, argv[flagged + 1], at)
+
+const all = pipedIn()
+const { piped, ask, line, shut } = asking(all)
+
+const own = ownAnswers(all)
+
+if (piped) only(own, answerNames(ASKS), '`new`')
+
+const name = kebab(words[1] ?? (piped ? needed(own, 'name', '`new`') : await ask('name', said('name'))))
+if (!KEBAB.test(name)) {
+  shut()
+  refuse(`\`${name}\` cannot be the id of a rule — it is kebab-case, e.g. no-fetch-in-a-screen.`)
+}
+if (existing.some((one) => one.id === name)) {
+  shut()
+  refuse(`\`${name}\` is already declared in ${at}. One id, one rule — two would silently keep whichever ran second.`)
+}
+
+const describes = piped
+  ? needed(own, 'describes', '`new`')
+  : await ask('describes', said('describes'))
+if (describes === '') {
+  shut()
+  refuse(`\`${name}\` was given no meaning, and a row without one is a name nobody can read.`)
+}
+
+const whereSaid = piped ? needed(own, 'where', '`new`') : await ask('where', said('where'))
+const paths = whereSaid.split(',').map((one) => one.trim()).filter((one) => one !== '')
+if (paths.length === 0) {
+  shut()
+  refuse(`\`${name}\` names no path, so it would govern nothing — a rule that cannot fire is indistinguishable from a rule being obeyed.`)
+}
+
+const exceptSaid = piped ? (answer(own, 'except') ?? '') : await ask('except', said('except'))
+const except = exceptSaid.split(',').map((one) => one.trim()).filter((one) => one !== '')
+
+const bans = piped ? needed(own, 'bans', '`new`') : await ask('bans', said('bans'))
+if (bans === '') {
+  shut()
+  refuse(`\`${name}\` names no \`bans\`, and a rule that does not say what form it refuses cannot be told from one refusing nothing.`)
+}
+
+const because = piped ? needed(own, 'because', '`new`') : await ask('because', said('because'))
+if (because === '') {
+  shut()
+  refuse(`\`${name}\` names no \`because\`, and a refusal with no reason is an order rather than a rule.`)
+}
+
+const instead = piped ? needed(own, 'instead', '`new`') : await ask('instead', said('instead'))
+if (instead === '') {
+  shut()
+  refuse(`\`${name}\` names no \`instead\`, so whoever it refuses is told only what they did wrong.`)
+}
+
+const wrong = piped ? needed(own, 'wrong', '`new`') : await ask('wrong', said('wrong'))
+if (wrong === '') {
+  shut()
+  refuse(`\`${name}\` names no \`wrong\`, and a rule with nothing it refuses is a predicate with no trial to prove it fires.`)
+}
+
+const right = piped ? needed(own, 'right', '`new`') : await ask('right', said('right'))
+if (right === '') {
+  shut()
+  refuse(
+    `\`${name}\` names no \`right\`, and a rule that only shows what it refuses cannot prove it stays silent on the fix it recommends.`,
+  )
+}
+
+const severity = piped ? (answer(own, 'severity') ?? '') : await ask('severity', said('severity'))
+if (severity !== '' && severity !== 'forbidden' && severity !== 'warning') {
+  shut()
+  refuse(`\`${severity}\` is not a severity — a rule is \`forbidden\` (the default, leave blank to use it) or \`warning\`.`)
+}
+
+const finds = piped ? needed(own, 'finds', '`new`') : await ask('finds', said('finds'))
+if (finds === '') {
+  shut()
+  refuse(
+    `\`${name}\` says nothing about what its check looks for, and that sentence is the only thing between the ` +
+      'next person and opening the file. Say what THIS one looks for, not what a check is.',
+  )
+}
+
+const body = await bodied(`the check for \`${name}\``, scaffold(), piped, all, line)
+
+const { stated, kids } = await stating(ASKS, all, piped, ask, line, ['name', 'id', 'at', 'describes', 'version', 'where', 'except', 'bans', 'because', 'instead', 'wrong', 'right', 'severity', 'finds', 'body'])
+
+shut()
+
+const row = [
+  '  {',
+  `    id: ${quoted(name)},`,
+  `    at: ${quoted(at)},`,
+  `    describes: ${quoted(describes)},`,
+  '    version: 1,',
+  `    where: { paths: [${paths.map(quoted).join(', ')}]${except.length === 0 ? '' : `, except: [${except.map(quoted).join(', ')}]`} },`,
+  `    bans: ${quoted(bans)},`,
+  `    because: ${quoted(because)},`,
+  `    instead: ${quoted(instead)},`,
+  `    wrong: ${quoted(wrong)},`,
+  `    right: ${quoted(right)},`,
+  ...(severity === '' || severity === 'forbidden' ? [] : [`    severity: ${quoted(severity)},`]),
+  ...rowLines('    ', stated, kids),
+  '  },',
+].join('\n')
+
+const path = inTree(TREE, FILE)
+const text = readFileSync(path, 'utf8')
+const where = listBounds(text, LIST)
+if (where === undefined) refuse(`${at} states no \`${LIST}\` list to declare a rule in.`)
+if (holdsRow(text, where, name)) refuse(`\`${name}\` is already declared in ${at}.`)
+
+writeFileSync(path, withRow(text, where, row), 'utf8')
+stdout.write(`create: declared ${name} in ${at}.\n`)
+
+const slopAt = `${SEEDED}/${slopnatorName(name)}.ts`
+if (existsSync(join(ROOT, slopAt))) {
+  stdout.write(`create: ${slopAt} is already on disk — left untouched, and declared below.\n`)
+} else {
+  write(ROOT, { path: slopAt, content: body ?? scaffold() })
+  stdout.write(
+    body === undefined
+      ? `create: seeded ${slopAt} with nothing behind it — its \`holds\` answers NOT_WRITTEN.\n`
+      : `create: seeded ${slopAt} with the check you wrote.\n`,
+  )
+}
+
+for (const told of seeding(kids, ROOT)) stdout.write(`create: ${told}\n`)
+
+const declared = await declareSeeded(ROOT, [name], finds)
+if (declared.length > 0) stdout.write(`create: declared the check for "${name}" in its own row.\n`)
+
+stdout.write(
+  body === undefined
+    ? `create: ${name} refuses nothing yet — write ${slopAt}, matching the shape any file already under ` +
+        'slopnators/ uses. `npx thread trials` reports it unproven until you do.\n'
+    : `create: ${name} is declared and its check is written. The trial derived from \`wrong\` and \`right\` ` +
+        'runs below — it proves the rule fires at the form it refuses and stays silent at the fix it names.\n',
+)
+
+exit(0)

package/dist/integrity/generators/seal.ts

@@ -0,0 +1,117 @@
+import { createHash } from 'node:crypto'
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'
+import { basename, dirname, join, relative, resolve } from 'node:path'
+import { argv, stderr, stdout } from 'node:process'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+import { runChecker, type Finding } from '../../core/finding.ts'
+import { exit, invoked } from '../../core/invoked.ts'
+import { findTree, inTree } from '../../core/tree.ts'
+import { SEALED } from '../sealed.ts'
+
+export const SEALED_AT = 'sealed.ts'
+
+const HERE = fileURLToPath(import.meta.url)
+
+const FROM_SOURCE = HERE.endsWith('.ts')
+
+const ROOT = FROM_SOURCE ? findTree().at : resolve(HERE, '../..')
+
+const DOMAIN = basename(resolve(HERE, '../..'))
+
+const WRITTEN = join(dirname(HERE), '..', SEALED_AT)
+
+const BUILT = SEALED_AT.replace(/\.ts$/, '.js')
+
+const CODE = /\.js$/
+
+const SHEET = 'packaging.ts'
+
+interface Packaged {
+  readonly id?: string
+  readonly folder?: string
+}
+
+async function declared(): Promise<readonly Packaged[]> {
+  const sheet = inTree(findTree(), SHEET)
+  if (!existsSync(sheet)) return []
+  const loaded = (await import(pathToFileURL(sheet).href)) as { readonly PACKAGES?: readonly Packaged[] }
+  return loaded.PACKAGES ?? []
+}
+
+const PACKAGES: readonly Packaged[] = FROM_SOURCE ? await declared() : []
+
+function built(): string {
+  if (!FROM_SOURCE) return ROOT
+  const folders = PACKAGES.map((one) => one.folder ?? '').filter((one) => one !== '')
+  const holder = folders.find((folder) => existsSync(join(ROOT, folder, 'dist', DOMAIN)))
+  if (holder === undefined) {
+    stderr.write(
+      `seal: no package built here holds \`${DOMAIN}\` — ${folders.length === 0 ? '_threads/packaging.ts declares no package' : `none of ${folders.join(', ')} has a dist/${DOMAIN}`}. ` +
+        `Run \`thread packaged --build\` first, and if no package row carries the ${DOMAIN} words, put them on one in _threads/packaging.ts.\n`,
+    )
+    exit(1)
+  }
+  return join(ROOT, holder, 'dist', DOMAIN)
+}
+
+export function sealable(home: string = built()): readonly string[] {
+  const found: string[] = []
+  const step = (at: string): void => {
+    for (const entry of readdirSync(at).sort()) {
+      const here = join(at, entry)
+      if (statSync(here).isDirectory()) step(here)
+      else if (CODE.test(entry) && relative(home, here) !== BUILT) found.push(here)
+    }
+  }
+  step(home)
+  return found.sort()
+}
+
+export function sealOf(home: string = built()): Readonly<Record<string, string>> {
+  const held: Record<string, string> = {}
+  for (const file of sealable(home)) {
+    held[relative(home, file)] = createHash('sha256').update(readFileSync(file)).digest('hex')
+  }
+  return held
+}
+
+export function content(seal: Readonly<Record<string, string>>): string {
+  const rows = Object.entries(seal).map(([at, hash]) => `  '${at}': '${hash}',`)
+  return [
+    'export const SEALED: Readonly<Record<string, string>> = {',
+    ...rows,
+    '}',
+    '',
+  ].join('\n')
+}
+
+if (invoked(import.meta.url)) {
+  const seal = sealOf()
+  const emitted = content(seal)
+
+  if (argv.includes('--check')) {
+    const sealed = Object.keys(seal).length
+    const findings: Finding[] =
+      content(SEALED) === emitted
+        ? []
+        : [
+            {
+              detail: `${SEALED_AT} is not the bytes this package is made of`,
+              instead: 'run `thread seal` and commit what it writes — the seal is what proves an installed copy is the one that shipped',
+              file: relative(ROOT, WRITTEN),
+            },
+          ]
+    runChecker('seal', findings, `${String(sealed)} file(s) sealed`)
+    exit(findings.length === 0 ? 0 : 1)
+  }
+
+  if (!FROM_SOURCE) {
+    stderr.write('seal: this copy is installed, and a seal is written where the package is made. Nothing was rewritten — `thread seal --check` says whether this copy is the one that shipped.\n')
+    exit(1)
+  }
+
+  mkdirSync(dirname(WRITTEN), { recursive: true })
+  writeFileSync(WRITTEN, emitted)
+  stdout.write(`seal: wrote ${SEALED_AT} — ${String(Object.keys(seal).length)} file(s).\n`)
+}