@prestack/thread 0.0.1

package/dist/integrity/generators/compiler.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrity/generators/compiler.js

@@ -0,0 +1,130 @@
+import { spawnSync } from 'node:child_process';
+import { readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+import { argv, execPath, stderr, stdout } from 'node:process';
+import { exit } from "../../core/invoked.js";
+import { ROOT, THREAD_AT, descend } from "../../core/descend.js";
+import { MANIFEST } from "../../core/init.js";
+import { forbids, runChecker } from "../../core/finding.js";
+function refuse(why) {
+    stderr.write(`compiler: ${why}\n`);
+    exit(1);
+}
+const SOURCE = /\.(?:ts|tsx|mts|cts)$/;
+const DECLARING = /\.d\.[cm]?ts$/;
+const INSTALLED = 'node_' + 'modules';
+const pass = await descend();
+const stopped = [...pass.broken, ...pass.findings].filter(forbids)[0];
+if (stopped !== undefined) {
+    refuse('the descent is broken, so what this tree declares is short — and a short list of declarations ' +
+        `leaves out more of the app than it should, which is a compiler that agrees with anything. ${stopped.detail} (${stopped.file ?? ''})`);
+}
+const WORD = 'thread compiler';
+const SELF = [...pass.threaded.entries()]
+    .flatMap(([at, held]) => held.map((one) => ({ at, row: one.row })))
+    .filter((one) => (one.row.by ?? '') === WORD)
+    .find((one) => !one.at.split('/').includes(INSTALLED));
+if (SELF === undefined) {
+    refuse(`no row in this tree names a file of this app with \`by: '${WORD}'\`, so nothing says which config is this app's. ` +
+        'Run `thread attach integrity`, which declares it.');
+}
+const AT = SELF.at;
+const PATH = resolve(ROOT, AT);
+const declared = new Set([THREAD_AT, ...pass.threaded.keys()]);
+function scan(rel) {
+    let entries;
+    try {
+        entries = readdirSync(join(ROOT, rel === '' ? '.' : rel), { withFileTypes: true });
+    }
+    catch {
+        return { declares: false, holds: false, out: [] };
+    }
+    let declares = false;
+    let holds = false;
+    const out = [];
+    for (const entry of [...entries].sort((one, two) => one.name.localeCompare(two.name))) {
+        if (entry.name === '.git' || entry.name === INSTALLED)
+            continue;
+        const at = rel === '' ? entry.name : `${rel}/${entry.name}`;
+        if (entry.isDirectory()) {
+            const held = scan(at);
+            if (held.declares) {
+                declares = true;
+                holds = true;
+                out.push(...held.out);
+            }
+            else if (held.holds) {
+                holds = true;
+                out.push(at);
+            }
+            continue;
+        }
+        if (declared.has(at)) {
+            declares = true;
+            holds = true;
+            continue;
+        }
+        if (!SOURCE.test(entry.name) || DECLARING.test(entry.name))
+            continue;
+        holds = true;
+        out.push(at);
+    }
+    return { declares, holds, out };
+}
+const held = scan('');
+if (!held.declares) {
+    refuse('no TypeScript file in this tree is declared by anything, so every one of them would be left out ' +
+        'and the compiler would pass by reading nothing. Declare something with `thread create` first.');
+}
+const leave = [...held.out].sort();
+let current;
+try {
+    current = JSON.parse(readFileSync(PATH, 'utf8'));
+}
+catch (cause) {
+    refuse(`${AT} could not be read as JSON, so what it already states cannot be kept — ${String(cause)}`);
+}
+const wanted = JSON.stringify({ ...current, exclude: leave }, null, 2);
+const has = JSON.stringify(current.exclude ?? []) === JSON.stringify(leave);
+if (argv.includes('--check')) {
+    const findings = [];
+    if (!has) {
+        findings.push({
+            file: AT,
+            detail: leave.length === 0
+                ? 'leaves out paths this tree declares something under, so the compiler is not reading all of this app'
+                : `does not leave out ${String(leave.length)} path(s) nothing in this tree declares, so the compiler is holding this app to code it never wrote`,
+            instead: 'run `thread compiler`. What the compiler reads is derived from what the tree declares — an edit here is a declaration somebody skipped, and a path put here by hand is taken back out on the next settle',
+        });
+    }
+    runChecker('compiler', findings, `${String(leave.length)} path(s) left out, over ${String(pass.declarations)} declaration(s)`);
+    if (findings.length > 0)
+        exit(1);
+    const asks = createRequire(join(ROOT, MANIFEST));
+    let cli;
+    try {
+        const manifest = asks.resolve(`typescript/${MANIFEST}`);
+        const bin = JSON.parse(readFileSync(manifest, 'utf8')).bin;
+        const named = typeof bin === 'string' ? bin : (bin?.tsc ?? Object.values(bin ?? {})[0]);
+        if (named === undefined)
+            refuse(`the installed \`typescript\` states no executable in its ${MANIFEST}, so there is nothing here to run.`);
+        cli = resolve(dirname(manifest), named);
+    }
+    catch (cause) {
+        refuse(`the compiler is not installed — ${String(cause)}. \`typescript\` is a dependency this app declares, so \`npm install\` is what puts it there.`);
+    }
+    const built = spawnSync(execPath, [cli, '--noEmit'], { cwd: ROOT, stdio: 'inherit' });
+    if (built.error !== undefined)
+        refuse(`the compiler could not be started — ${built.error.message}.`);
+    exit(built.status ?? 1);
+}
+if (has) {
+    stdout.write(`compiler: ${AT} already leaves out exactly what this tree declares nothing under.\n`);
+    exit(0);
+}
+writeFileSync(PATH, `${wanted}\n`);
+stdout.write(leave.length === 0
+    ? `compiler: wrote ${AT} — every path here has something declared under it, so none is left out.\n`
+    : `compiler: wrote ${AT} — ${String(leave.length)} path(s) left out, declared by nobody: ${leave.join(', ')}.\n`);
+exit(0);

package/dist/integrity/generators/gate.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrity/generators/gate.js

@@ -0,0 +1,172 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { argv, execPath, stderr, stdout } from 'node:process';
+import { pathToFileURL } from 'node:url';
+import { descend } from "../../core/descend.js";
+import { LOADER, exit } from "../../core/invoked.js";
+import { ORGANISATION, ours } from "../../core/scope.js";
+import { findTree, inTree } from "../../core/tree.js";
+const TREE = findTree();
+const ROOT = TREE.at;
+const STEP_TIMEOUT = 600_000;
+const { GATE } = (await import(__rewriteRelativeImportExtension(pathToFileURL(inTree(TREE, 'gate.ts')).href)));
+const { GENERATORS } = (await import(__rewriteRelativeImportExtension(pathToFileURL(inTree(TREE, 'derivation.ts')).href)));
+function refuse(why) {
+    stderr.write(`gate: ${why}\n`);
+    exit(1);
+}
+const rowsOf = (edge) => (Array.isArray(edge) ? edge : []);
+const walked = await descend();
+const every = [
+    ...rowsOf(GATE.declares),
+    ...rowsOf(GENERATORS),
+    ...[...walked.threaded.values()].flat().map((one) => one.row),
+    ...[...walked.stated.values()].map((one) => one),
+];
+function steps() {
+    const found = [];
+    const claimed = new Set();
+    for (const row of every) {
+        const runs = (row.runs ?? '').trim();
+        if (runs === '' || claimed.has(runs))
+            continue;
+        claimed.add(runs);
+        found.push({ id: row.id ?? runs, runs });
+    }
+    if (found.length === 0) {
+        refuse('no row in this tree names a command to check it, so the gate would pass by running nothing');
+    }
+    return found;
+}
+const writers = [
+    ...rowsOf(GATE.declares),
+    ...rowsOf(GENERATORS),
+    ...[...walked.threaded.values()].flat().filter((one) => one.list === 'declares').map((one) => one.row),
+    ...[...walked.stated.values()].map((one) => one),
+];
+const written = new Map();
+for (const row of writers) {
+    const by = (row.by ?? '').trim();
+    const at = (row.at ?? '').trim();
+    if (by !== '' && at !== '' && !written.has(by))
+        written.set(by, at);
+}
+function ran(runs) {
+    const said = runs.trim().split(/\s+/);
+    const spent = { cwd: ROOT, stdio: 'inherit', timeout: STEP_TIMEOUT, killSignal: 'SIGKILL' };
+    if (said[0] !== 'thread') {
+        const shelled = spawnSync(runs, { shell: true, ...spent });
+        return shelled.error !== undefined ? 1 : (shelled.status ?? 1);
+    }
+    const of = `thread ${said[1] ?? ''}`;
+    const at = written.get(of);
+    if (at === undefined) {
+        stderr.write(`gate: nothing in this tree is written by \`${of}\`, so this step names a command that does not exist here\n`);
+        return 1;
+    }
+    const spun = spawnSync(execPath, [...LOADER, join(ROOT, at), ...said.slice(2)], spent);
+    return spun.error !== undefined ? 1 : (spun.status ?? 1);
+}
+function named(flag) {
+    const at = argv.indexOf(flag);
+    if (at === -1)
+        return undefined;
+    return (argv[at + 1] ?? '').split(',').map((one) => one.trim()).filter(Boolean);
+}
+const all = steps();
+if (argv.includes('--list')) {
+    stdout.write(`gate: ${String(all.length)} step(s) declared\n`);
+    for (const step of all)
+        stdout.write(`  ${step.id} — ${step.runs}\n`);
+    exit(0);
+}
+const only = named('--only');
+const skip = named('--skip') ?? [];
+const known = new Set(all.map((step) => step.id));
+const unknown = [...(only ?? []), ...skip].filter((id) => !known.has(id));
+if (unknown.length > 0) {
+    stderr.write(`gate: no declared step is called ${unknown.join(', ')} — a filter naming nothing would run a shorter gate and exit 0\n`);
+    stderr.write(`gate: the declared steps are ${[...known].join(', ')}\n`);
+    exit(1);
+}
+const chosen = all.filter((step) => (only === undefined || only.includes(step.id)) && !skip.includes(step.id));
+const dropped = all.filter((step) => !chosen.includes(step));
+if (chosen.length === 0) {
+    stderr.write('gate: the filter selected no steps, and a gate that runs nothing must not exit 0\n');
+    exit(1);
+}
+const failed = [];
+let passed = 0;
+for (const [index, step] of chosen.entries()) {
+    const at = `step ${String(index + 1)} of ${String(chosen.length)}`;
+    stdout.write(`\ngate: ${at} — ${step.runs} (${step.id})\n`);
+    const code = ran(step.runs);
+    stdout.write(`gate: ${at} — exited ${String(code)}\n`);
+    if (code === 0)
+        passed += 1;
+    else
+        failed.push(step);
+}
+stdout.write(`\ngate: ${String(passed)} of ${String(chosen.length)} steps passed.\n`);
+if (dropped.length > 0) {
+    stdout.write(`gate: PARTIAL RUN — ${String(dropped.length)} of ${String(all.length)} declared step(s) did not run: ${dropped.map((step) => step.id).join(', ')}\n`);
+    stdout.write('gate: this is not a gate pass. `thread gate` with no filter runs every step the tree declares.\n');
+}
+function fingerprint() {
+    const of = {};
+    const hash = (at) => {
+        if (!existsSync(join(ROOT, at)))
+            return;
+        of[at] = createHash('sha256').update(readFileSync(join(ROOT, at))).digest('hex').slice(0, 16);
+    };
+    const sheets = join(ROOT, '_threads');
+    if (existsSync(sheets)) {
+        for (const name of readdirSync(sheets))
+            if (name.endsWith('.ts'))
+                hash(join('_threads', name));
+    }
+    const versions = {};
+    const held = join(ROOT, 'node_modules', ORGANISATION);
+    if (existsSync(held)) {
+        for (const name of readdirSync(held)) {
+            const pkg = `${ORGANISATION}/${name}`;
+            if (!ours(pkg))
+                continue;
+            const at = join(held, name, 'package.json');
+            if (!existsSync(at))
+                continue;
+            const read = JSON.parse(readFileSync(at, 'utf8'));
+            if (typeof read.version === 'string')
+                versions[pkg] = read.version;
+        }
+    }
+    return { of, versions };
+}
+const RECEIPT_AT = join('.thread', 'gate.json');
+const RECEIPT = join(ROOT, RECEIPT_AT);
+if (failed.length === 0 && dropped.length === 0) {
+    mkdirSync(dirname(RECEIPT), { recursive: true });
+    writeFileSync(RECEIPT, `${JSON.stringify({ passed: chosen.length, ...fingerprint() }, null, 2)}\n`, 'utf8');
+    stdout.write(`gate: wrote ${RECEIPT_AT} — what compiles is checked against this, so a tree that skipped the gate does not build.\n`);
+}
+else if (existsSync(RECEIPT)) {
+    rmSync(RECEIPT);
+    stdout.write(`gate: removed ${RECEIPT_AT} — the tree no longer passes, so nothing may compile against an older run.\n`);
+}
+if (failed.length === 0)
+    exit(0);
+stderr.write(`gate: FAILED — ${String(failed.length)} of ${String(chosen.length)} step(s). The other ${String(passed)} ran and passed; a failing step stops nothing.\n`);
+for (const step of failed)
+    stderr.write(`  - ${step.id} — run it alone with \`${step.runs}\`\n`);
+stderr.write('gate: every step above is its own command. Run the failing one on its own to work on it, and `thread issues` for everything wrong with the tree at once.\n');
+exit(1);

package/dist/integrity/generators/issues.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrity/generators/issues.js

@@ -0,0 +1,100 @@
+import { argv, stderr, stdout } from 'node:process';
+import { exit } from "../../core/invoked.js";
+import { uncompiled } from "../../core/descend.js";
+import { THREAD_AT, descend, refusals, trackedFiles, unthreaded } from "../check-threads.js";
+import { CONSTRAINTS } from "../constraint.js";
+import { ruleMessage } from "../lint.js";
+import { ROOT, load, rules } from "../slopnator.js";
+import { sweep, tracked as governed } from "../sweep.js";
+const WITHIN = '--in';
+const CHECK = '--check';
+const checking = argv.includes(CHECK);
+const scoped = argv.indexOf(WITHIN);
+const under = scoped === -1 ? undefined : argv[scoped + 1];
+if (scoped !== -1 && (under === undefined || under.startsWith('-'))) {
+    stderr.write(`thread issues ${WITHIN} <path> — which directory to report on. The totals still count the whole tree.\n`);
+    exit(1);
+}
+const inside = (one) => under === undefined || one.file === undefined || one.file === under || one.file.startsWith(`${under.replace(/\/+$/, '')}/`);
+const pass = await descend();
+const tracked = trackedFiles();
+const kept = new Set(tracked);
+const found = refusals(pass, tracked);
+const loose = new Set(unthreaded(pass, tracked));
+const governing = [...CONSTRAINTS, ...((await rules()) ?? [])];
+const named = new Map(governing.map((one) => [one.id, one]));
+const ran = sweep(ROOT, governing, await load(ROOT, governing), governed(ROOT));
+const refused = [
+    ...ran.findings.map((one) => {
+        const rule = named.get(one.rule);
+        return {
+            detail: `${rule === undefined ? one.rule : ruleMessage(rule)} Found: ${one.found}.`,
+            instead: rule?.instead ?? `read what ${one.rule} refuses and stop writing it`,
+            ...(one.file === '' ? {} : { file: one.file }),
+        };
+    }),
+    ...ran.unrun.map((one) => ({
+        detail: `${one} DID NOT RUN — no slopnator is on disk for it, so nothing here measured that rule and its absence from this list says nothing about it`,
+        instead: 'write the walk the rule names, or delete the rule and its row together — half a rule reads as a whole one from every direction',
+    })),
+];
+const warned = found.filter((one) => one.severity === 'warning');
+const firm = found.filter((one) => one.severity !== 'warning');
+const cut = firm.filter((one) => one.file !== undefined && loose.has(one.file));
+const rest = firm.filter((one) => !(one.file !== undefined && loose.has(one.file)));
+const wrong = uncompiled().filter((one) => one.file === undefined || kept.has(one.file));
+const where = (one) => {
+    const line = one.at?.line;
+    const column = one.at?.column;
+    return `${one.file ?? '(nowhere named)'}${line === undefined ? '' : `:${String(line)}${column === undefined ? '' : `:${String(column)}`}`}`;
+};
+const listed = (held) => held.flatMap((one) => [`  ${where(one)}`, `    ${one.detail}`, `    fix: ${one.instead}`, '']);
+const out = [];
+let shown = 0;
+const group = (title, taught, held) => {
+    if (held.length === 0)
+        return;
+    const here = held.filter(inside);
+    shown += here.length;
+    if (here.length === 0)
+        return;
+    out.push('', `${title} — ${String(held.length)}${here.length === held.length ? '' : `, ${String(here.length)} of them under ${String(under)}`}`, taught, '', ...listed(here));
+};
+group('files nothing declares', '  every file here is named by a row, or it is not part of this app. The descent starts at\n' +
+    `  ${THREAD_AT} and walks what each row declares; whatever it never arrives at is not wired,\n` +
+    '  however well it reads. Declare it with `thread create`, or delete it.', cut);
+group('files that will not compile', '  nothing in this tree builds, serves or gates while one of its files does not typecheck.\n' +
+    '  Read off the same program the descent judged the declarations with.', wrong);
+group('declarations this tree refuses', '  the files are reached and they compile; these are the things the descent will not accept about\n' +
+    '  how they are declared.', rest);
+group('what the rules refuse', '  every rule this framework ships and every rule this app added, run over the files each one\n' +
+    `  governs — ${String(ran.rules)} rule(s) over ${String(ran.swept)} of ${String(ran.tracked)} tracked file(s).\n` +
+    '  This is what `thread sweep` reports, said here so one read answers the whole question.', refused);
+group('derivations nothing has produced yet', '  each row here states what a generator would write, and no file is there. A generator that refuses\n' +
+    '  to write an empty file is doing its job, so the descent says these and does not refuse them, and\n' +
+    '  neither does this. Run the command the row names in `by` to produce the file.', warned);
+const total = cut.length + wrong.length + rest.length + refused.length;
+const saidNotCounted = () => {
+    if (warned.length === 0)
+        return;
+    stdout.write(`issues: ${String(warned.length)} derivation(s) nothing has produced yet — listed below, said and not counted.\n`);
+};
+if (total === 0) {
+    stdout.write(`issues: none — ${String(tracked.length)} tracked file(s), every one of them declared by a row, and all of them compile.\n` +
+        'issues: that is what a threaded tree is. Nothing here is written by hand; everything here was declared.\n');
+    saidNotCounted();
+    if (out.length > 0)
+        stdout.write(`${out.join('\n')}\n`);
+    exit(0);
+}
+stdout.write(`issues: ${String(total)} — ${String(cut.length)} file(s) nothing declares, ${String(wrong.length)} that will not compile, ` +
+    `${String(rest.length)} declared in a way it refuses, ${String(refused.length)} the rules refuse, over ${String(tracked.length)} tracked file(s).\n`);
+saidNotCounted();
+stdout.write(under === undefined
+    ? `issues: listing all ${String(total)} below. \`thread issues ${WITHIN} <path>\` reports on one directory instead.\n`
+    : `issues: listing the ${String(shown)} of them under ${under}. The counts above are the whole tree.\n`);
+stdout.write(checking
+    ? `issues: ${CHECK} refuses while any of these stand. Without it this reads and never refuses, so it still answers on a tree that is entirely broken.\n`
+    : `issues: this reads and never refuses, so it works on a tree that is entirely broken. Run it with ${CHECK}, which is what the gate runs, to have it refuse instead.\n`);
+stdout.write(`${out.join('\n')}\n`);
+exit(checking ? 1 : 0);

package/dist/integrity/generators/publish.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrity/generators/publish.js

@@ -0,0 +1,186 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { argv, env, execPath, stderr, stdout } from 'node:process';
+import { pathToFileURL } from 'node:url';
+import { CLI, exit } from "../../core/invoked.js";
+import { named } from "../../core/scope.js";
+import { findTree, inTree } from "../../core/tree.js";
+import { opened, sealedIn } from "../../integrations/vault.js";
+const TREE = findTree();
+const ROOT = TREE.at;
+const STEP_TIMEOUT = 900_000;
+const REGISTRY = '--registry';
+const DEFAULT = 'https://registry.npmjs.org';
+const CHECKS = [
+    {
+        id: 'gate',
+        runs: 'thread gate',
+        because: 'every step this tree declares, in the order it declares them, which is where the descent and the sweep are',
+    },
+    {
+        id: 'lint',
+        runs: 'pnpm exec eslint .',
+        because: 'the rules that live on the lint surface, which is the only one carrying a fixer the sweep can report but not repair',
+    },
+    {
+        id: 'seal',
+        runs: 'pnpm seal:check',
+        because: 'the package must be the bytes it says it is. CHECKED and never regenerated, because a release that rewrites its own seal can never fail it',
+    },
+];
+const MINE = /^(?:npx |pnpm )?thread /;
+function run(what, extra) {
+    const ours = MINE.exec(what);
+    if (ours !== null) {
+        const words = what.slice(ours[0].length).split(/\s+/).filter((one) => one !== '');
+        const ran = spawnSync(execPath, [...CLI, ...words], {
+            cwd: ROOT,
+            stdio: 'inherit',
+            timeout: STEP_TIMEOUT,
+            killSignal: 'SIGKILL',
+            env: extra === undefined ? env : { ...env, ...extra },
+        });
+        return ran.error !== undefined ? 1 : (ran.status ?? 1);
+    }
+    const result = spawnSync(what, {
+        shell: true,
+        cwd: ROOT,
+        stdio: 'inherit',
+        timeout: STEP_TIMEOUT,
+        killSignal: 'SIGKILL',
+        env: extra === undefined ? env : { ...env, ...extra },
+    });
+    return result.error !== undefined ? 1 : (result.status ?? 1);
+}
+function refuse(id, code, because, runs) {
+    stderr.write(`\npublish: REFUSED — \`${id}\` exited ${String(code)}. NOTHING was published.\n`);
+    stderr.write(`publish: ${because}.\n`);
+    stderr.write(`publish: what refused is above, in that command's own words — this does not restate it, because a\n`);
+    stderr.write(`publish: second copy of a refusal drifts from the first. Run \`${runs}\` alone to work on it.\n`);
+    exit(1);
+}
+const flag = argv.indexOf(REGISTRY);
+const registry = flag === -1 ? DEFAULT : (argv[flag + 1] ?? '');
+if (registry === '' || registry.startsWith('-')) {
+    stderr.write(`thread publish ${REGISTRY} <url>   where the packages go. Leave it off for ${DEFAULT}.\n`);
+    stderr.write('\nit builds, then runs every check, then publishes. A check that fails publishes nothing.\n');
+    exit(1);
+}
+const TOKEN = 'sec_registry_token';
+const PRODUCTION = 'production';
+const secrets = inTree(TREE, 'secrets.ts');
+const declared = existsSync(secrets)
+    ? ((await import(__rewriteRelativeImportExtension(pathToFileURL(secrets).href))).SECRETS ?? [])
+    : [];
+const vaulted = declared.some((one) => one.id === TOKEN);
+if (vaulted && !sealedIn(ROOT, PRODUCTION).includes(TOKEN)) {
+    stderr.write(`\npublish: ${TOKEN} is declared in _threads/secrets.ts and has no value sealed for ${PRODUCTION}, so nothing was checked and NOTHING was published.\n`);
+    stderr.write(`publish: run \`thread create secret set ${TOKEN}\` at a terminal and paste the registry token, or take the row out to publish with the login this machine holds.\n`);
+    exit(1);
+}
+const setting = () => {
+    const at = new URL(registry);
+    return `npm_config_//${at.host}${at.pathname.endsWith('/') ? at.pathname : `${at.pathname}/`}:_authToken`;
+};
+async function tokened() {
+    const values = await opened(ROOT, declared.map((one) => one.id), PRODUCTION)([TOKEN]).catch((thrown) => {
+        stderr.write(`\npublish: ${TOKEN} is sealed here and would not open: ${thrown instanceof Error ? thrown.message : String(thrown)}. NOTHING was published.\n`);
+        exit(1);
+    });
+    const token = values[TOKEN];
+    if (token === undefined) {
+        stderr.write(`\npublish: the vault opened and answered nothing for ${TOKEN}. NOTHING was published.\n`);
+        exit(1);
+    }
+    return token;
+}
+stdout.write(vaulted
+    ? `publish: ${TOKEN} is declared and sealed for ${PRODUCTION}. It is opened only after every check passes, and handed to pnpm as its auth setting for ${registry}.\n`
+    : `publish: no row declares ${TOKEN}, so this publish uses the login this machine already holds. Declare it with \`thread create secret\` to publish with a token sealed in this repository instead.\n`);
+stdout.write('publish: deriving and building what the packaging rows state first, so every check below reads the files this release ships rather than the source they were written from.\n');
+const made = run('npx thread packaged --build');
+stdout.write(`publish: packaged exited ${String(made)}\n`);
+if (made !== 0) {
+    refuse('packaged', made, 'a package whose manifest and release note are not what its rows state would go out describing itself as something nobody declared, and one that did not compile would go out promising files it does not have', 'npx thread packaged --build');
+}
+stdout.write(`\npublish: ${String(CHECKS.length)} check(s) stand between this tree and ${registry}. Any one of them stops it.\n`);
+for (const check of CHECKS)
+    stdout.write(`  ${check.id} — ${check.runs}\n`);
+for (const [index, check] of CHECKS.entries()) {
+    const at = `check ${String(index + 1)} of ${String(CHECKS.length)}`;
+    stdout.write(`\npublish: ${at} — ${check.runs} (${check.id})\n`);
+    const code = run(check.runs);
+    stdout.write(`publish: ${at} — exited ${String(code)}\n`);
+    if (code !== 0)
+        refuse(check.id, code, check.because, check.runs);
+}
+const numbered = run('npx thread packaged --release');
+stdout.write(`publish: packaged --release exited ${String(numbered)}\n`);
+if (numbered !== 0) {
+    refuse('packaged', numbered, 'the next release number and its note are written only once every check has passed, and writing them refused, so nothing here carries a number to go out under', 'npx thread packaged --release');
+}
+const handed = vaulted ? { [setting()]: await tokened() } : undefined;
+stdout.write(`\npublish: every check passed. Publishing to ${registry} with ${vaulted ? `${TOKEN} from this repository's vault` : 'the login this machine already holds'}.\n`);
+const sent = run(`pnpm -r publish --registry ${registry} --no-git-checks --access public`, handed);
+if (sent !== 0) {
+    stderr.write(`\npublish: the checks passed and the publish itself exited ${String(sent)}.\n`);
+    stderr.write('publish: the third number of the release moved once for this publish, so if npm refused the version as one that already exists,\n');
+    stderr.write('publish: the release notes here are behind what the registry holds — read the newest entry in each CHANGELOG.md against the registry before running this again.\n');
+    exit(1);
+}
+const SHEET = 'packaging.ts';
+const sheet = inTree(TREE, SHEET);
+const stated = existsSync(sheet)
+    ? (await import(__rewriteRelativeImportExtension(pathToFileURL(sheet).href)))
+    : {};
+const shipped = stated.PACKAGES ?? [];
+function versionAt(folder) {
+    const at = join(ROOT, folder, 'package.json');
+    if (!existsSync(at))
+        return 'no manifest';
+    try {
+        return JSON.parse(readFileSync(at, 'utf8')).version ?? 'no version';
+    }
+    catch {
+        return 'no version';
+    }
+}
+function asked(what) {
+    return (spawnSync('git', what, { cwd: ROOT, encoding: 'utf8' }).stdout ?? '').trim();
+}
+if (asked(['rev-parse', '--is-inside-work-tree']) !== 'true') {
+    stdout.write("\npublish: it's not a repo, so nothing was committed.\n");
+}
+else if (shipped.length === 0) {
+    stdout.write('\npublish: no packaging row names a folder, so there is nothing derived here to commit.\n');
+}
+else {
+    const going = shipped.map((one) => `${named(one.id ?? '')} ${versionAt(one.folder ?? '')}`).join(', ');
+    const branch = asked(['rev-parse', '--abbrev-ref', 'HEAD']);
+    for (const one of shipped)
+        run(`git add ${one.folder ?? ''}`);
+    if (spawnSync('git', ['diff', '--cached', '--quiet'], { cwd: ROOT }).status === 0) {
+        stdout.write(`\npublish: ${going} — what is on disk is already what is committed, so this release added no artifact.\n`);
+    }
+    else {
+        const wrote = run(`git commit -m ${JSON.stringify(`thread publish — ${going}`)}`);
+        stdout.write(`publish: commit exited ${String(wrote)}\n`);
+        if (wrote !== 0) {
+            stderr.write('\npublish: the packages went out and the files that describe them are not committed, so this release has no record in git.\n');
+            stderr.write('publish: commit them by hand — everything is staged.\n');
+            exit(1);
+        }
+        stdout.write(`publish: committed the derived artifacts to ${branch} — ${going}.\n`);
+    }
+}
+stdout.write(`\npublish: done. What went out was derived, then built, then passed the gate, the lint and the seal, in that order. The compile inside \`thread packaged --build\` is the typecheck.\n`);
+exit(0);

package/dist/integrity/generators/rule.d.ts

@@ -0,0 +1,2 @@
+import { type Asked } from '../../core/asking.ts';
+export declare const ASKS: readonly Asked[];