@prestack/thread 0.0.1 → 0.0.3

package/dist/integrity/slopnators/sl_no_dispatch_bypass.ts

@@ -0,0 +1,328 @@
+import { dirname, join, normalize } from 'node:path'
+
+import { parser } from 'typescript-eslint'
+
+import { descend } from '../../core/descend.ts'
+
+import type { Slopnator } from '../slopnator.ts'
+import { here, index, parses, unreadable } from './sl_unthreaded.ts'
+
+const RELATIVE = /^\.\.?\//
+
+const UNDER = 'operations/'
+
+const NODES = 'nodes'
+
+/*
+ * The one thing an operation may be handed to.
+ *
+ * It is still `dispatch` and it is still the only one. What moved 2026-08-28 is where it lives:
+ * it was imported from this framework, and it is now the app's own `operations/_dispatch.ts`,
+ * written by `thread compile`. The name a caller writes did not change, so neither did this.
+ */
+const INVOKER = 'dispatch'
+
+const slash = (one: string): string => one.split('\\').join('/')
+
+interface Held {
+  readonly type?: string
+  readonly name?: string
+  readonly value?: unknown
+  readonly callee?: Held
+  readonly source?: Held
+  readonly arguments?: readonly Held[]
+  readonly quasis?: readonly { readonly value?: { readonly cooked?: string; readonly raw?: string } }[]
+}
+
+/* Where a name is bound, rather than used. An import is how the operation arrives. */
+const BINDS = new Set(['ImportSpecifier', 'ImportDefaultSpecifier', 'ImportNamespaceSpecifier'])
+
+/*
+ * Where a name is a shape, not a thing.
+ *
+ * `const one: typeof operation` runs nothing and reaches nothing — it borrows the type and is erased
+ * before anything executes. Refusing it was a false positive found by reading, not by running: the
+ * probe written to test the reassignment form used exactly this line to type its own variable, and
+ * the law would have refused the probe for its type annotation rather than for the bypass under it.
+ */
+const TYPED = new Set(['TSTypeQuery', 'TSTypeReference', 'TSQualifiedName', 'TSImportType'])
+
+let bodies: ReadonlySet<string> | undefined
+
+/*
+ * Which files are operation bodies, asked of the tree rather than guessed from a directory.
+ *
+ * An operation body is a file a row beneath `operations` DERIVES and that is not a node's body, and
+ * the descent already knows every one of them. Reading the directory instead was close enough while
+ * an operation was the only thing living there — and stopped being close enough the moment an
+ * operation was folded into a body plus the steps it is woven from: the woven body imports its own
+ * steps, the steps sat under `operations/`, and this law refused the one file it exists to protect
+ * for importing the one file it is made of. A rule that refuses the sanctioned form is deciding
+ * nothing, which is the same failure this law was rewritten for on 2026-08-25.
+ */
+function operations(): ReadonlySet<string> {
+  if (bodies !== undefined) return bodies
+  const pass = descend()
+
+  const under = (id: string, root: string, seen: Set<string>): boolean => {
+    if (id === root) return true
+    if (seen.has(id)) return false
+    seen.add(id)
+    return (pass.coined.get(id)?.from ?? []).some((one) => under(one, root, seen))
+  }
+
+  const found = new Set<string>()
+  for (const [at, threadings] of pass.threaded) {
+    for (const one of threadings) {
+      if (one.list !== 'derives') continue
+      if (!under(one.by, 'operations', new Set())) continue
+      if (under(one.by, NODES, new Set())) continue
+      found.add(at)
+    }
+  }
+  bodies = found
+  return found
+}
+
+/*
+ * Whether a path is an operation body.
+ *
+ * The tree decides for every file the tree reaches. For a file it does not reach — a probe, a
+ * scratch file, anything not yet declared — the shape decides: an operation is seeded as one file
+ * directly inside `operations/`, so a single segment is a body and a deeper path is something an
+ * operation is built from. Nothing the tree does not reach can be part of an app anyway; that
+ * fallback is what makes this law's own proofs mean the same thing in every repository.
+ */
+function isBody(path: string): boolean {
+  const known = index().reached
+  if (known.has(path)) return operations().has(path)
+  if (!path.startsWith(UNDER)) return false
+  return !path.slice(UNDER.length).includes('/')
+}
+
+const TRIED = ['', '.ts', '.tsx']
+
+function reaches(said: string, from: string): boolean {
+  if (said === '') return false
+  const at = slash(normalize(RELATIVE.test(said) ? join(from, said) : said))
+  return TRIED.some((one) => isBody(`${at}${one}`))
+}
+
+/* Whatever a run-time reach spells out, whole or in pieces. */
+function spelled(node: Held | undefined, said: string[]): void {
+  if (node === undefined || node === null || typeof node !== 'object') return
+  if (node.type === 'Literal' && typeof node.value === 'string') said.push(node.value)
+  for (const one of node.quasis ?? []) {
+    const held = one.value?.cooked ?? one.value?.raw
+    if (typeof held === 'string') said.push(held)
+  }
+  for (const value of Object.values(node as Record<string, unknown>)) {
+    if (Array.isArray(value)) for (const one of value) spelled(one as Held, said)
+    else if (value !== null && typeof value === 'object') spelled(value as Held, said)
+  }
+}
+
+const IMPORTS = /import\s+((?:type\s+)?[^'"]*?)\s+from\s+['"]([^'"]+)['"]/g
+
+const LOCAL = /(?:^|[,{]|\s)(?:[A-Za-z_$][\w$]*\s+as\s+)?([A-Za-z_$][\w$]*)/g
+
+/*
+ * `dispatch` IS NOT AN OPERATION, AND IT LIVES WHERE THE OPERATIONS LIVE.
+ *
+ * `bound` below calls every name imported from under the operations directory an operation, which is
+ * right for every file there but one: an app's own dispatch is written to `operations/_dispatch.ts`,
+ * so a file importing `dispatch` from beside its operations had `dispatch` itself added to the set —
+ * and then this law refused that file for doing something with an operation other than handing it to
+ * dispatch. The thing it was accused of mishandling was the handler.
+ *
+ * It had never surfaced because nothing imported dispatch from inside that directory. Measured
+ * 2026-08-30, when the generated client gained a binding that calls the app's own dispatch for an
+ * operation needing no server, and the app refused a file its own generator had just written.
+ *
+ * The other three below are not names at all — they are the words of an import clause that the
+ * regex cannot tell from an identifier. This one is a real binding that is really imported and
+ * really is not an operation, which is the same answer for a different reason.
+ */
+const NOT_A_NAME = new Set(['type', 'as', 'from', 'import', 'dispatch'])
+
+/*
+ * The names this file bound by importing an operation body.
+ *
+ * A type-only import binds nothing that can be run and is skipped: `import type { Operation }` names
+ * a shape, and a shape cannot be dispatched or reached past.
+ */
+function bound(text: string, from: string): ReadonlySet<string> {
+  const found = new Set<string>()
+  for (const one of text.matchAll(IMPORTS)) {
+    const clause = one[1] ?? ''
+    if (/^type\s/.test(clause)) continue
+    if (!reaches(one[2] ?? '', from)) continue
+    for (const name of clause.matchAll(LOCAL)) {
+      const held = name[1]
+      if (held !== undefined && !NOT_A_NAME.has(held)) found.add(held)
+    }
+  }
+  return found
+}
+
+/*
+ * Parsed here rather than taken from the visitor.
+ *
+ * `holds` is handed a node when a law runs as an eslint rule and nothing at all when the sweep runs
+ * it over a file — measured 2026-08-25, the sweep calls it once per file with `node` undefined, so a
+ * reading that only inspected what it was given threw on the first file it saw. What a file DOES
+ * with a binding is a question about the whole file anyway, not about one node in it.
+ *
+ * The parent comes down with the node because the whole rule is about where a name appears.
+ */
+function walked(
+  node: unknown,
+  up: Held | undefined,
+  seen: (one: Held, parent: Held | undefined) => string | undefined,
+): string | undefined {
+  if (node === null || typeof node !== 'object') return undefined
+  if (Array.isArray(node)) {
+    for (const one of node) {
+      const said = walked(one, up, seen)
+      if (said !== undefined) return said
+    }
+    return undefined
+  }
+  const held = node as Held
+  const real = typeof held.type === 'string'
+  if (real) {
+    const said = seen(held, up)
+    if (said !== undefined) return said
+  }
+  for (const value of Object.values(node as Record<string, unknown>)) {
+    const said = walked(value, real ? held : up, seen)
+    if (said !== undefined) return said
+  }
+  return undefined
+}
+
+export const slopnator: Slopnator = {
+  holds: (_node, at) => {
+    const path = here(at.filename)
+    if (unreadable(path, at.text) !== undefined) return false
+    if (!parses(path)) return false
+
+    const text = String(at.text)
+    if (!text.includes(UNDER)) return false
+
+    const from = dirname(path)
+    const mine = bound(text, from)
+
+    let ast: unknown
+    try {
+      ast = (parser.parseForESLint as (t: string, o: unknown) => { ast: unknown })(text, {
+        range: true,
+        ecmaVersion: 'latest',
+        sourceType: 'module',
+        ecmaFeatures: { jsx: true },
+      }).ast
+    } catch {
+      return false
+    }
+
+    /*
+     * One rule, stated once.
+     *
+     * The first reading of this enumerated the SHAPES of a bypass — a member access, a call, an
+     * argument — and every shape it did not think of walked through: an alias, a destructure, an
+     * array holding the name, a comma operator. Enumerating forms is how a refusal ends up with a
+     * list of everything somebody happened to try. The rule is not a list. An operation goes to
+     * `dispatch` and nowhere else, so the name may appear where it is bound and as an argument to
+     * `dispatch`, and every other appearance is the finding — whatever it happens to look like.
+     */
+    return (
+      walked(ast, undefined, (held, parent) => {
+        /*
+         * A body reached at run time never binds a name at all, so the rule above cannot see it.
+         *
+         * What is read is everything the reach spells out, whole or in pieces: a plain literal, a
+         * concatenation, a template. Measured 2026-08-26 against the reading this replaces, which
+         * only ever inspected a plain `Literal` — `await import('../operations/' + name + '.ts')`
+         * passed it without a word, which is the exact form its own comment said it was written to
+         * catch. Nothing legitimate needs any of it: dispatch is handed the operation, and the one
+         * file that hands it over imports it statically.
+         */
+        const dynamic =
+          held.type === 'ImportExpression'
+            ? held.source
+            : held.type === 'CallExpression' && held.callee?.type === 'Identifier' && held.callee.name === 'require'
+              ? held.arguments?.[0]
+              : undefined
+
+        if (dynamic !== undefined) {
+          const said: string[] = []
+          spelled(dynamic, said)
+          const reaching = said.find((one) => one.includes(UNDER) || reaches(one, from))
+          if (reaching !== undefined) {
+            return (
+              `this reaches \`${reaching}\` at run time, which points at an operation. An operation is handed ` +
+              `to \`${INVOKER}\`, and a file that goes looking for one is looking for a second way in`
+            )
+          }
+        }
+
+        if (held.type !== 'Identifier' || typeof held.name !== 'string' || !mine.has(held.name)) return undefined
+        const up = parent?.type ?? ''
+        if (BINDS.has(up) || TYPED.has(up)) return undefined
+        if (
+          parent?.type === 'CallExpression' &&
+          parent.callee?.type === 'Identifier' &&
+          parent.callee.name === INVOKER &&
+          (parent.arguments ?? []).includes(held)
+        ) {
+          return undefined
+        }
+
+        return (
+          `\`${held.name}\` is an operation, and this does something with it other than hand it to ` +
+          `\`${INVOKER}\`. Every gate that decides whether it may run is in \`${INVOKER}\` — naming it, ` +
+          'aliasing it, taking it apart or passing it on all reach past every one of them'
+        )
+      }) ?? false
+    )
+  },
+  /*
+   * These were driven at `holds` directly, because the trial harness cannot run them.
+   *
+   * A shipped law is meant to be proved by `thread trials`, and today nothing proves one anywhere:
+   * the harness cannot run in this repository at all — the framework has no tree, and the command
+   * that once tried was removed in 6e98a6d after it was measured exiting 1 — and in an app
+   * `thread trials` answers "0 trials from the 0 rule(s) this tree declares",
+   * because a shipped constraint is proved in the package that ships it. So every proof below was
+   * written to a real probe file and handed to `slopnator.holds` by hand, 2026-08-26: fourteen
+   * refused, six accepted, no failures. That is a stand-in for the harness and it is written down
+   * here rather than only in a report, because a proof nobody can run is indistinguishable from a
+   * proof that passes, and the next person to read this list deserves to know which one it is.
+   */
+  proves: {
+    wrong: [
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nawait operation.run(input)",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nconst { run } = operation\n\nawait run(hands, held)",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nawait operation(input)",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nawait somewhere(operation, input)",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nconst one = operation\n\nawait one.run(input)",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nconst { requires } = operation",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nlet one\none = operation\nawait one.run(input)",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nconst [one] = [operation]\n\nawait one.run(input)",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nawait (0, operation).run(input)",
+      "import { operation } from './operations/wf_send_invoice.ts'\n\nexport { operation }",
+      "const held = await import('./operations/wf_send_invoice.ts')",
+      "const held = require('../operations/wf_send_invoice.ts')",
+      "const held = await import('../operations/' + name + '.ts')",
+      'const held = await import(`../operations/${name}.ts`)',
+    ],
+    right: [
+      "import { dispatch } from './operations/_dispatch.ts'\n\nimport { operation } from './operations/wf_send_invoice.ts'\n\nawait dispatch(operation, input, actor, seams)",
+      "import type { Operation } from '../../operations/operations.ts'\n\nexport const held: Operation = one",
+      "import { dispatch } from './operations/_dispatch.ts'\n\nawait dispatch(one, input, actor, seams)",
+      "import { dispatch } from './operations/_dispatch.ts'\n\nimport { operation } from './operations/wf_send_invoice.ts'\n\nlet one: typeof operation\n\nawait dispatch(operation, input, actor, seams)",
+      "import * as steps from './operations/wf_send_invoice/steps.ts'\n\nexport const held = steps.reads_the_invoice",
+      "import * as steps from './steps/wf_send_invoice.ts'\n\nexport const held = steps.reads_the_invoice",
+    ],
+  },
+}

package/dist/integrity/slopnators/sl_no_import_cycle.ts

@@ -0,0 +1,50 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+
+import type { Slopnator } from '../slopnator.ts'
+import { findTree } from '../../core/tree.ts'
+
+const ROOT = findTree().at
+
+const IMPORTS = /(?:^|\n)\s*import\s[^'"]*['"]([^'"]+)['"]/g
+
+type Node = { source?: { value?: unknown } }
+
+const target = (from: string, spec: string): string | undefined =>
+  spec.startsWith('.') ? resolve(dirname(from), spec) : undefined
+
+export const slopnator: Slopnator = {
+  on: ['ImportDeclaration'],
+  holds: (node, at) => {
+    const spec = (node as Node).source?.value
+    if (typeof spec !== 'string') return false
+
+    const here = resolve(ROOT, at.filename)
+    const there = target(here, spec)
+    if (there === undefined || !existsSync(there)) return false
+
+    for (const found of readFileSync(there, 'utf8').matchAll(IMPORTS)) {
+      const back = found[1] ?? ''
+      if (target(there, back) === here) return `${spec} imports \`${back}\` straight back, so the two initialise each other`
+    }
+    return false
+  },
+  proves: {
+    wrong: [
+      {
+        files: [
+          { at: 'threads/_probe_one.ts', source: "import { two } from './_probe_two.ts'\nexport const one = two\n" },
+          { at: 'threads/_probe_two.ts', source: "import { one } from './_probe_one.ts'\nexport const two = one\n" },
+        ],
+        at: 'threads/_probe_one.ts',
+      },
+    ],
+    right: [
+      "import type { Law } from '../../core/generators/meta.ts'",
+      "import { SLUG, type Shaped } from '../../core/types.ts'",
+      "import { existsSync } from 'node:fs'",
+      "import type { Rule } from 'eslint'",
+      "import { CONSTRAINTS } from '../constraint.ts'",
+    ],
+  },
+}

package/dist/integrity/slopnators/sl_no_such_command.ts

@@ -0,0 +1,64 @@
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+import type { Slopnator } from '../slopnator.ts'
+import { findTree } from '../../core/tree.ts'
+
+const ROOT = findTree().at
+
+type Node = {
+  type?: string
+  key?: { type?: string; name?: string; value?: unknown }
+  value?: { type?: string; value?: unknown }
+  computed?: boolean
+}
+
+const keyOf = (property: Node): string | undefined => {
+  if (property.computed === true) return undefined
+  const key = property.key
+  if (key?.type === 'Identifier') return key.name
+  if (key?.type === 'Literal' && typeof key.value === 'string') return key.value
+  return undefined
+}
+
+function scripts(): ReadonlySet<string> {
+  try {
+    const held = JSON.parse(readFileSync(resolve(ROOT, 'package.json'), 'utf8')) as { scripts?: Record<string, string> }
+    return new Set(Object.keys(held.scripts ?? {}))
+  } catch {
+    return new Set()
+  }
+}
+
+export const slopnator: Slopnator = {
+  on: ['Property'],
+  holds: (node) => {
+    const property = node as Node
+    const key = keyOf(property)
+    if (key !== 'runs' && key !== 'by') return false
+
+    const held = property.value
+    if (held?.type !== 'Literal' || typeof held.value !== 'string') return false
+
+    const spoken = held.value.trim()
+    if (!spoken.startsWith('pnpm ')) return false
+
+    const named = spoken.replace(/^pnpm (run )?/, '').split(/\s+/)[0] ?? ''
+    const known = scripts()
+    if (known.size === 0 || known.has(named)) return false
+
+    return `\`${key}: ${spoken}\` names the script \`${named}\`, and package.json has no such script`
+  },
+  proves: {
+    wrong: [
+      "const M = {\n  runs: 'pnpm nope:check',\n}",
+      "const M = {\n  by: 'pnpm also-not-a-script',\n}",
+    ],
+    right: [
+      "const M = {\n  runs: 'pnpm typecheck',\n}",
+      "const M = {\n  by: 'pnpm gate:generate',\n}",
+      "const M = {\n  runs: 'node scripts/_generated/gate.mjs',\n}",
+      "const M = {\n  describes: 'A sentence mentioning pnpm nope:check without naming it as a command.',\n}",
+    ],
+  },
+}

package/dist/integrity/slopnators/sl_only_takes_a_literal.ts

@@ -0,0 +1,63 @@
+import type { Slopnator } from '../slopnator.ts'
+
+interface Node {
+  readonly type?: string
+  readonly callee?: { readonly type?: string; readonly name?: string }
+  readonly arguments?: readonly { readonly type?: string; readonly elements?: readonly { readonly type?: string }[] }[]
+}
+
+export const slopnator: Slopnator = {
+  on: ['CallExpression'],
+  holds: (node) => {
+    const held = node as Node
+    if (held.callee?.type !== 'Identifier' || held.callee.name !== 'only') return false
+    if (held.arguments?.length !== 3) return false
+    const keys = held.arguments[1]
+    if (keys?.type !== 'ArrayExpression') return false
+    const typed = (keys.elements ?? []).filter((one) => one?.type !== 'SpreadElement')
+    if (typed.length === 0) return false
+    return `it hands \`only\` ${String(typed.length)} key(s) written here, and the receipt prints its questions from somewhere else`
+  },
+  proves: {
+    wrong: [
+      {
+        files: [
+          {
+            at: 'packages/core/src/integrations/generators/probe.ts',
+            source: "only(piped, ['name', 'describes'], 'a thing')\n",
+          },
+        ],
+        at: 'packages/core/src/integrations/generators/probe.ts',
+      },
+      {
+        files: [
+          {
+            at: 'packages/core/src/integrations/generators/probe.ts',
+            source: "only(one, ['stop', 'sets'], 'a stop')\n",
+          },
+        ],
+        at: 'packages/core/src/integrations/generators/probe.ts',
+      },
+    ],
+    right: [
+      {
+        files: [
+          {
+            at: 'packages/core/src/integrations/generators/probe.ts',
+            source: "const TAKES = ASKS.map((one) => one.key)\nonly(piped, TAKES, 'a thing')\n",
+          },
+        ],
+        at: 'packages/core/src/integrations/generators/probe.ts',
+      },
+      {
+        files: [
+          {
+            at: 'packages/core/src/integrations/generators/probe.ts',
+            source: "only(all, [...allowed, ...worded], 'a thing')\n",
+          },
+        ],
+        at: 'packages/core/src/integrations/generators/probe.ts',
+      },
+    ],
+  },
+}

package/dist/integrity/slopnators/sl_secret_literal.ts

@@ -0,0 +1,100 @@
+import type { Slopnator } from '../slopnator.ts'
+
+/*
+ * Credentials that announce themselves.
+ *
+ * A vendor prefix is the one thing here that is certain rather than probable: nothing else in a
+ * source file begins `sk_live_` or `AKIA` followed by twenty characters. These are matched on their
+ * own, with no need to look at what they were assigned to.
+ */
+const ANNOUNCED: readonly { readonly what: string; readonly pattern: RegExp }[] = [
+  { what: 'a Stripe secret key', pattern: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}/ },
+  { what: 'a Stripe restricted key', pattern: /\brk_(?:live|test)_[A-Za-z0-9]{16,}/ },
+  { what: 'a GitHub token', pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{30,}/ },
+  { what: 'a GitHub personal access token', pattern: /\bgithub_pat_[A-Za-z0-9_]{30,}/ },
+  { what: 'an AWS access key id', pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/ },
+  { what: 'a Slack token', pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}/ },
+  { what: 'an OpenAI key', pattern: /\bsk-[A-Za-z0-9_-]{32,}/ },
+  { what: 'an Anthropic key', pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/ },
+  { what: 'a Google API key', pattern: /\bAIza[A-Za-z0-9_-]{35}\b/ },
+  { what: 'a JSON web token', pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { what: 'a private key', pattern: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/ },
+  { what: 'a password inside a connection string', pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]{6,}@/ },
+]
+
+/*
+ * A value that does not announce itself, read off what it was called.
+ *
+ * Needs both halves — a name that means credential AND something long enough and mixed enough to be
+ * one. Either alone is noise: `const key = 'id'` is a map key, and a long opaque string is as likely
+ * to be a hash, a path or a fixture. `process.env.X`, an import, a template hole and a reference to
+ * a declared row are all values rather than literals and are not matched at all.
+ */
+const NAMED = /\b(?:secret|password|passwd|api_?key|apikey|access_?token|auth_?token|private_?key|client_?secret|credential)s?\b\s*[:=]\s*(['"`])([^'"`\n]{16,})\1/gi
+
+const MIXED = /^(?=.*[a-z])(?=.*[A-Z0-9])[A-Za-z0-9_+/=.-]{16,}$/
+
+/*
+ * What is deliberately NOT a finding.
+ *
+ * A secret this app declares is a NAME, and naming one is the whole remedy this law recommends — so
+ * `sec_stripe_key` sitting in a row, a `requires`, or a call to the vault must never be the thing
+ * that trips it. The same for an environment variable, which is a value read at run time rather than
+ * a value written down, and for the obvious placeholders people write while wiring something up.
+ */
+const NOT = [
+  /^(?:sec|pub)_[a-z0-9_]+$/,
+  /^\$\{/,
+  /^(?:x{3,}|X{3,}|\.{3,}|<[^>]+>|change[-_]?me|your[-_]|example|placeholder|redacted|todo|test|dummy|sample|fake|dGhpcyBpcyBub3QgYSBzZWNyZXQ)/i,
+]
+
+const CODE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs|json|env|ya?ml|toml|sql|md|sh)$/
+
+export const slopnator: Slopnator = {
+  holds: (_node, at) => {
+    if (!CODE.test(at.filename)) return false
+
+    /*
+     * The sealed store is ciphertext and is meant to be here.
+     *
+     * It is base64 by construction, so the entropy half below would find every value in it — and
+     * the fix it would recommend is the thing the file already is. A law whose refusal has no honest
+     * remedy is one people learn to ignore.
+     */
+    if (/(?:^|\/)\.thread\/vault\.sealed\.json$/.test(at.filename)) return false
+
+    const text = String(at.text)
+
+    for (const one of ANNOUNCED) {
+      if (!one.pattern.test(text)) continue
+      return (
+        `this holds ${one.what}, written into the file. It is in every copy of this repository, in its history for ` +
+        'ever, and in whatever bundle reaches it'
+      )
+    }
+
+    for (const found of text.matchAll(NAMED)) {
+      const value = found[2] ?? ''
+      if (NOT.some((each) => each.test(value))) continue
+      if (!MIXED.test(value)) continue
+      return (
+        `this writes a ${(found[0].split(/[:=]/)[0] ?? '').trim()} down as a literal ${String(value.length)} characters ` +
+        'long. A credential in a file is in every copy of this repository and in its history for ever'
+      )
+    }
+
+    return false
+  },
+  proves: {
+    wrong: [
+      "export const stripe = { apiKey: 'sk_live_51H8xQvL2eZvKYlo2C0Nx9K4mQwErTyUiOp' }\n",
+      "const config = { password: 'Hunter2Hunter2Hunter2' }\n",
+      "export const db = 'postgres://app:s3cr3tpassword@db.example.com:5432/main'\n",
+    ],
+    right: [
+      "export const stripe = { apiKey: 'sec_stripe_key' }\n",
+      "const config = { password: process.env['DB_PASSWORD'] }\n",
+      "export const node = nd_action(async (hands) => await hands.ht_stripe.charge({ json: { amount: 100 } }))\n",
+    ],
+  },
+}