@prestack/thread 0.0.3 → 0.1.1

package/dist/derivation/generators/release.js

@@ -1,41 +1,33 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { argv, stderr, stdout } from 'node:process';
-import { pathToFileURL } from 'node:url';
-import { marked, wordsIn } from "../../core/asking.js";
+import { marked, wordsIn } from "../../core/answers.js";
+import { existsSync, readFileSync, writeFileSync } from "../../core/files.js";
 import { exit, invoked } from "../../core/invoked.js";
+import { valuesIn } from "../../core/rows.js";
 import { ours } from "../../core/scope.js";
 import { findTree, inTree } from "../../core/tree.js";
 import { CHECKED_BY, KINDS, LISTENS, SAID, WRITES, WRITTEN_BY, kindOf } from "../release.js";
 const TREE = findTree();
 const MANIFEST = 'package.json';
 const mark = (one) => marked([one.id ?? '', one.at ?? '']);
-async function releases() {
+function releases() {
     const at = inTree(TREE, 'derivation.ts');
     if (!existsSync(at))
         return [];
     try {
-        const held = (await import(__rewriteRelativeImportExtension(pathToFileURL(at).href)));
+        const held = valuesIn(readFileSync(at, 'utf8'));
         return held.DERIVATION?.derives ?? [];
     }
     catch {
         return [];
     }
 }
-async function named() {
+function named() {
     const at = inTree(TREE, 'secrets.ts');
     if (!existsSync(at))
         return [];
     try {
-        const held = (await import(__rewriteRelativeImportExtension(pathToFileURL(at).href)));
+        const held = valuesIn(readFileSync(at, 'utf8'));
         return (held.SECRETS ?? []).map((one) => one.id.toUpperCase()).sort();
     }
     catch {
@@ -94,10 +86,10 @@ function compose(id, secrets) {
         '',
     ].join('\n');
 }
-async function made() {
+function made() {
     const found = new Map();
-    const rows = await releases();
-    const secrets = await named();
+    const rows = releases();
+    const secrets = named();
     const { build, start } = scripted();
     for (const one of rows) {
         const id = one.id;
@@ -121,8 +113,8 @@ function installed() {
     const held = JSON.parse(readFileSync(at, 'utf8'));
     return Object.keys(held.dependencies ?? {}).filter((one) => ours(one)).sort();
 }
-async function run() {
-    const rows = await releases();
+function run() {
+    const rows = releases();
     if (rows.length === 0) {
         stdout.write(`release: this app declares no release, so there is nowhere for it to go yet. Declare one with ` +
             `\`thread create release\` — it is ${KINDS.join(' or ')}, and the prefix on its id says which.\n`);
@@ -151,7 +143,7 @@ async function run() {
         }
         return 0;
     }
-    const files = await made();
+    const files = made();
     const checking = argv.includes('--check');
     const shipped = installed();
     if (shipped.length > 0) {
@@ -185,9 +177,9 @@ async function run() {
     for (const [at, text] of files)
         writeFileSync(join(TREE.at, at), text, 'utf8');
     stdout.write(`release: wrote ${[...files.keys()].join(', ')} — built and started by what this app's own manifest ` +
-        `declares, listening on ${String(LISTENS)}, naming ${String((await named()).length)} secret(s) and holding none of them.\n`);
+        `declares, listening on ${String(LISTENS)}, naming ${String(named().length)} secret(s) and holding none of them.\n`);
     return 0;
 }
 if (invoked(import.meta.url))
-    exit(await run());
+    exit(run());
 export { CHECKED_BY, WRITES, made };

package/dist/derivation/generators/release.ts

@@ -1,10 +1,10 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { argv, stderr, stdout } from 'node:process'
-import { pathToFileURL } from 'node:url'
 
-import { marked, wordsIn } from '../../core/asking.ts'
+import { marked, wordsIn } from '../../core/answers.ts'
+import { existsSync, readFileSync, writeFileSync } from '../../core/files.ts'
 import { exit, invoked } from '../../core/invoked.ts'
+import { valuesIn } from '../../core/rows.ts'
 import { ours } from '../../core/scope.ts'
 import { findTree, inTree } from '../../core/tree.ts'
 
@@ -21,22 +21,22 @@ interface Row {
 
 const mark = (one: Row): string => marked([one.id ?? '', one.at ?? ''])
 
-async function releases(): Promise<readonly Row[]> {
+function releases(): readonly Row[] {
   const at = inTree(TREE, 'derivation.ts')
   if (!existsSync(at)) return []
   try {
-    const held = (await import(pathToFileURL(at).href)) as { DERIVATION?: { readonly derives?: readonly Row[] } }
+    const held = valuesIn(readFileSync(at, 'utf8')) as { DERIVATION?: { readonly derives?: readonly Row[] } }
     return held.DERIVATION?.derives ?? []
   } catch {
     return []
   }
 }
 
-async function named(): Promise<readonly string[]> {
+function named(): readonly string[] {
   const at = inTree(TREE, 'secrets.ts')
   if (!existsSync(at)) return []
   try {
-    const held = (await import(pathToFileURL(at).href)) as { SECRETS?: readonly { readonly id: string }[] }
+    const held = valuesIn(readFileSync(at, 'utf8')) as { SECRETS?: readonly { readonly id: string }[] }
     return (held.SECRETS ?? []).map((one) => one.id.toUpperCase()).sort()
   } catch {
     return []
@@ -100,10 +100,10 @@ function compose(id: string, secrets: readonly string[]): string {
   ].join('\n')
 }
 
-async function made(): Promise<ReadonlyMap<string, string>> {
+function made(): ReadonlyMap<string, string> {
   const found = new Map<string, string>()
-  const rows = await releases()
-  const secrets = await named()
+  const rows = releases()
+  const secrets = named()
   const { build, start } = scripted()
 
   for (const one of rows) {
@@ -128,8 +128,8 @@ function installed(): readonly string[] {
   return Object.keys(held.dependencies ?? {}).filter((one) => ours(one)).sort()
 }
 
-async function run(): Promise<number> {
-  const rows = await releases()
+function run(): number {
+  const rows = releases()
   if (rows.length === 0) {
     stdout.write(
       `release: this app declares no release, so there is nowhere for it to go yet. Declare one with ` +
@@ -164,7 +164,7 @@ async function run(): Promise<number> {
     return 0
   }
 
-  const files = await made()
+  const files = made()
   const checking = argv.includes('--check')
 
   const shipped = installed()
@@ -203,11 +203,11 @@ async function run(): Promise<number> {
   for (const [at, text] of files) writeFileSync(join(TREE.at, at), text, 'utf8')
   stdout.write(
     `release: wrote ${[...files.keys()].join(', ')} — built and started by what this app's own manifest ` +
-      `declares, listening on ${String(LISTENS)}, naming ${String((await named()).length)} secret(s) and holding none of them.\n`,
+      `declares, listening on ${String(LISTENS)}, naming ${String(named().length)} secret(s) and holding none of them.\n`,
   )
   return 0
 }
 
-if (invoked(import.meta.url)) exit(await run())
+if (invoked(import.meta.url)) exit(run())
 
 export { CHECKED_BY, WRITES, made }

package/dist/integrations/attach.js

@@ -82,7 +82,7 @@ const OWN = [
     },
 ];
 const SEEDED = {
-    attaches: ['@prestack/thread/derivation/attach'],
+    attaches: ['@prestack/thread/derivation/attach', '@prestack/thread/knowledge/attach'],
     id: 'integrations',
     declares: [
         '    {',
@@ -94,18 +94,6 @@ const SEEDED = {
     ].join('\n'),
 };
 const SHIPPED = [
-    {
-        into: 'derivation.ts',
-        list: 'GENERATORS',
-        id: 'target-generator',
-        source: "  {\n    id: 'target-generator',\n    at: 'node_modules/@prestack/thread/dist/integrations/generators/target.js',\n    describes: 'The command that declares a place this app reaches. Asked for nothing it lists every target already here with what it accepts and what it requires, every way a target may be reached and what each way can hold, and every secret this app declares. It then asks what the place is called and how it is reached, puts the prefix on the id, asks which secret is its address and which go into a header, and writes the row — so a target arrives declared with its credential named rather than with an environment variable typed into whatever needed it.',\n    version: 1,\n    by: 'thread create target',\n  },",
-    },
-    {
-        into: 'derivation.ts',
-        list: 'GENERATORS',
-        id: 'secret-generator',
-        source: "  {\n    id: 'secret-generator',\n    at: 'node_modules/@prestack/thread/dist/integrations/generators/secret.js',\n    describes: 'The command that declares a value this app must be given, and the only thing that ever takes one. It asks what the secret is for and who may hold it, puts `sec_` or `pub_` on the id accordingly, and writes the row. Then it asks a person for the value, with the terminal\\'s echo off, and seals it into the store beside the tree under a key it generates and never prints. The value goes from the keyboard into the sealed store and nowhere else: not into the row, not into the output, not into whatever transcript is being kept of the session that ran it.',\n    version: 1,\n    by: 'thread create secret',\n  },",
-    },
     {
         into: 'derivation.ts',
         list: 'GENERATORS',
@@ -118,12 +106,6 @@ const SHIPPED = [
         id: 'inspect-generator',
         source: "  {\n    id: 'inspect-generator',\n    at: 'node_modules/@prestack/thread/dist/integrations/generators/read.js',\n    describes: 'The one command for reading what this app declares. Asked for nothing it prints every sheet and what each holds; asked for a word it prints every row whose id or sentence carries it. It reads the tree rather than the files, which is the whole reason it exists: a row is a nested TypeScript literal and a search over lines answers questions about text while the questions people actually ask are about rows.',\n    version: 1,\n    by: 'thread inspect',\n  },",
     },
-    {
-        into: 'derivation.ts',
-        list: 'GENERATORS',
-        id: 'call-noun',
-        source: "  {\n    id: 'call-noun',\n    at: 'node_modules/@prestack/thread/dist/integrations/generators/target.js',\n    describes: 'The command that makes an already-declared call happen. `thread run call <id>` asks for whatever its path leaves to be filled in — `{like_this}` — by name, and for a call that writes (POST, PUT, PATCH) a JSON body, then resolves the target\\'s address and every credential it requires through the vault at the moment of the call and never before. Nothing here ever names a vendor: a call already states its target, its method and its path, and which one runs is read off its own id, exactly as `thread run trial` reads an operation\\'s.',\n    version: 1,\n    by: 'thread run call',\n  },",
-    },
 ];
 export const ATTACH = {
     attaches: SEEDED.attaches,

package/dist/integrations/attach.ts

@@ -107,7 +107,7 @@ const OWN: readonly { readonly into: string; readonly list: string; readonly id:
 ]
 
 const SEEDED = {
-  attaches: ['@prestack/thread/derivation/attach'] as const,
+  attaches: ['@prestack/thread/derivation/attach', '@prestack/thread/knowledge/attach'] as const,
   id: 'integrations',
   declares: [
     '    {',
@@ -120,18 +120,6 @@ const SEEDED = {
 }
 
 const SHIPPED: readonly { readonly into: string; readonly list: string; readonly id: string; readonly source: string }[] = [
-  {
-    into: 'derivation.ts',
-    list: 'GENERATORS',
-    id: 'target-generator',
-    source: "  {\n    id: 'target-generator',\n    at: 'node_modules/@prestack/thread/dist/integrations/generators/target.js',\n    describes: 'The command that declares a place this app reaches. Asked for nothing it lists every target already here with what it accepts and what it requires, every way a target may be reached and what each way can hold, and every secret this app declares. It then asks what the place is called and how it is reached, puts the prefix on the id, asks which secret is its address and which go into a header, and writes the row — so a target arrives declared with its credential named rather than with an environment variable typed into whatever needed it.',\n    version: 1,\n    by: 'thread create target',\n  },",
-  },
-  {
-    into: 'derivation.ts',
-    list: 'GENERATORS',
-    id: 'secret-generator',
-    source: "  {\n    id: 'secret-generator',\n    at: 'node_modules/@prestack/thread/dist/integrations/generators/secret.js',\n    describes: 'The command that declares a value this app must be given, and the only thing that ever takes one. It asks what the secret is for and who may hold it, puts `sec_` or `pub_` on the id accordingly, and writes the row. Then it asks a person for the value, with the terminal\\'s echo off, and seals it into the store beside the tree under a key it generates and never prints. The value goes from the keyboard into the sealed store and nowhere else: not into the row, not into the output, not into whatever transcript is being kept of the session that ran it.',\n    version: 1,\n    by: 'thread create secret',\n  },",
-  },
   {
     into: 'derivation.ts',
     list: 'GENERATORS',
@@ -144,12 +132,6 @@ const SHIPPED: readonly { readonly into: string; readonly list: string; readonly
     id: 'inspect-generator',
     source: "  {\n    id: 'inspect-generator',\n    at: 'node_modules/@prestack/thread/dist/integrations/generators/read.js',\n    describes: 'The one command for reading what this app declares. Asked for nothing it prints every sheet and what each holds; asked for a word it prints every row whose id or sentence carries it. It reads the tree rather than the files, which is the whole reason it exists: a row is a nested TypeScript literal and a search over lines answers questions about text while the questions people actually ask are about rows.',\n    version: 1,\n    by: 'thread inspect',\n  },",
   },
-  {
-    into: 'derivation.ts',
-    list: 'GENERATORS',
-    id: 'call-noun',
-    source: "  {\n    id: 'call-noun',\n    at: 'node_modules/@prestack/thread/dist/integrations/generators/target.js',\n    describes: 'The command that makes an already-declared call happen. `thread run call <id>` asks for whatever its path leaves to be filled in — `{like_this}` — by name, and for a call that writes (POST, PUT, PATCH) a JSON body, then resolves the target\\'s address and every credential it requires through the vault at the moment of the call and never before. Nothing here ever names a vendor: a call already states its target, its method and its path, and which one runs is read off its own id, exactly as `thread run trial` reads an operation\\'s.',\n    version: 1,\n    by: 'thread run call',\n  },",
-  },
 ]
 export const ATTACH: Attaching = {
   attaches: SEEDED.attaches,

package/dist/integrations/generators/read.js

@@ -1,6 +1,6 @@
 import { stdout } from 'node:process';
 import { exit } from "../../core/invoked.js";
-import { wordsIn } from "../../core/asking.js";
+import { TYPED, wordsIn } from "../../core/answers.js";
 import { descend } from "../../core/descend.js";
 const words = wordsIn([]);
 const looking = words.join(' ').trim().toLowerCase();
@@ -43,7 +43,7 @@ if (looking === '') {
         out.push(`  ${String(held.length).padStart(4)}  ${file}`);
     }
     out.unshift(`${String(files.length)} sheet(s) in this tree, and what each holds:`, '');
-    out.push('', 'Name a word to read the rows themselves — every row whose id, sentence, path, command or', 'requirement carries it, each with what it means:', '', '  npx thread inspect element', '  npx thread inspect variant', '  npx thread inspect <any word above, or any word this tree coins>', '');
+    out.push('', 'Name a word to read the rows themselves — every row whose id, sentence, path, command or', 'requirement carries it, each with what it means:', '', `  ${TYPED} inspect element`, `  ${TYPED} inspect variant`, `  ${TYPED} inspect <any word above, or any word this tree coins>`, '');
     stdout.write(`${out.join('\n')}\n`);
     stdout.write(`read: ${String(rows)} row(s) across ${String(pass.declarations)} declaration(s), ` +
         `and ${String(pass.findings.length)} finding(s) the gate would report.\n`);

package/dist/integrations/generators/read.ts

@@ -1,7 +1,7 @@
 import { stdout } from 'node:process'
 
 import { exit } from '../../core/invoked.ts'
-import { wordsIn } from '../../core/asking.ts'
+import { TYPED, wordsIn } from '../../core/answers.ts'
 import { descend, type Row } from '../../core/descend.ts'
 
 const words = wordsIn([])
@@ -63,9 +63,9 @@ if (looking === '') {
     'Name a word to read the rows themselves — every row whose id, sentence, path, command or',
     'requirement carries it, each with what it means:',
     '',
-    '  npx thread inspect element',
-    '  npx thread inspect variant',
-    '  npx thread inspect <any word above, or any word this tree coins>',
+    `  ${TYPED} inspect element`,
+    `  ${TYPED} inspect variant`,
+    `  ${TYPED} inspect <any word above, or any word this tree coins>`,
     '',
   )
   stdout.write(`${out.join('\n')}\n`)

package/dist/integrations/generators/vault.js

@@ -1,12 +1,5 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync } from "../../core/files.js";
+import { valuesIn } from "../../core/rows.js";
 import { dirname, join, relative } from 'node:path';
 import { argv, stderr, stdout } from 'node:process';
 import { fileURLToPath } from 'node:url';
@@ -31,7 +24,7 @@ function refuse(because) {
 }
 let secrets = [];
 try {
-    const taken = (await import(__rewriteRelativeImportExtension(new URL(`file://${from}`).href)));
+    const taken = valuesIn(readFileSync(from));
     secrets = taken.SECRETS ?? [];
 }
 catch {
@@ -80,7 +73,7 @@ async function taken(file, list) {
     if (!existsSync(at))
         return [];
     try {
-        const held = (await import(__rewriteRelativeImportExtension(new URL(`file://${at}`).href)));
+        const held = valuesIn(readFileSync(at));
         return held[list] ?? [];
     }
     catch {
@@ -187,7 +180,6 @@ if (existsSync(path) && readFileSync(path, 'utf8') === SOURCE) {
     stdout.write(`vault: ${AT} is already yours — it opens ${opening}, read off ${here(from)} as they are declared.\n`);
     exit(0);
 }
-mkdirSync(dirname(path), { recursive: true });
 writeFileSync(path, SOURCE, 'utf8');
 stdout.write(`vault: wrote ${AT} — what opens a secret's value at the moment of use.\n` +
     `  It opens the values sealed under ${SEALED_AT} for the secrets declared in ${here(from)}, and refuses every other name.\n` +

package/dist/integrations/generators/vault.ts

@@ -1,4 +1,5 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, writeFileSync } from '../../core/files.ts'
+import { valuesIn } from '../../core/rows.ts'
 import { dirname, join, relative } from 'node:path'
 import { argv, stderr, stdout } from 'node:process'
 import { fileURLToPath } from 'node:url'
@@ -36,7 +37,7 @@ function refuse(because: string): never {
 
 let secrets: readonly Secret[] = []
 try {
-  const taken = (await import(new URL(`file://${from}`).href)) as { SECRETS?: readonly Secret[] }
+  const taken = valuesIn(readFileSync(from)) as { SECRETS?: readonly Secret[] }
   secrets = taken.SECRETS ?? []
 } catch {
   refuse(`${here(from)} could not be read. Attach \`${packageOf('integrations')}\` first — an app states its secrets there.`)
@@ -86,7 +87,7 @@ async function taken<T>(file: string, list: string): Promise<readonly T[]> {
   const at = inTree(TREE, file)
   if (!existsSync(at)) return []
   try {
-    const held = (await import(new URL(`file://${at}`).href)) as Record<string, readonly T[] | undefined>
+    const held = valuesIn(readFileSync(at)) as Record<string, readonly T[] | undefined>
     return held[list] ?? []
   } catch {
     return []
@@ -201,7 +202,6 @@ if (existsSync(path) && readFileSync(path, 'utf8') === SOURCE) {
   exit(0)
 }
 
-mkdirSync(dirname(path), { recursive: true })
 writeFileSync(path, SOURCE, 'utf8')
 stdout.write(
   `vault: wrote ${AT} — what opens a secret's value at the moment of use.\n` +

package/dist/integrations/module.js

@@ -8,8 +8,10 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 import { spawnSync } from 'node:child_process';
 import { argv, stderr, stdout } from 'node:process';
-import { answer, asking, given, only, wordsIn } from "../core/asking.js";
+import { answer, asking, given, unasked, wordsIn } from "../core/answers.js";
+import { readFileSync } from "../core/files.js";
 import { exit } from "../core/invoked.js";
+import { valuesIn } from "../core/rows.js";
 import { findTree, inTree } from "../core/tree.js";
 import { REACH, reachOf } from "./target.js";
 import { opened } from "./vault.js";
@@ -34,7 +36,7 @@ export async function ran(name) {
     const tree = findTree();
     let targets = [];
     try {
-        const taken = (await import(__rewriteRelativeImportExtension(new URL(`file://${inTree(tree, 'targets.ts')}`).href)));
+        const taken = valuesIn(readFileSync(inTree(tree, 'targets.ts')));
         targets = taken.TARGETS ?? [];
     }
     catch {
@@ -79,7 +81,7 @@ export async function run(declared) {
         return refuse(`\`${method}\` is not a method path — one name, or names joined by dots, e.g. \`customers.list\``);
     }
     const piped = given();
-    only(piped, TAKES, `\`thread run ${declared.name} ${method}\``);
+    unasked(piped, TAKES, `\`thread run ${declared.name} ${method}\``);
     const { ask, shut } = asking(piped);
     const typed = (piped.length > 0
         ? (answer(piped, TAKES[0] ?? 'args') ?? '')

package/dist/integrations/module.ts

@@ -2,8 +2,10 @@ import { spawnSync } from 'node:child_process'
 import { argv, stderr, stdout } from 'node:process'
 
 import type { Env } from '../core/actor.ts'
-import { answer, asking, given, only, wordsIn } from '../core/asking.ts'
+import { answer, asking, given, unasked, wordsIn } from '../core/answers.ts'
+import { readFileSync } from '../core/files.ts'
 import { exit } from '../core/invoked.ts'
+import { valuesIn } from '../core/rows.ts'
 import { findTree, inTree } from '../core/tree.ts'
 
 import { REACH, reachOf, type Target } from './target.ts'
@@ -37,7 +39,7 @@ export async function ran(name: string): Promise<void> {
   const tree = findTree()
   let targets: readonly Target[] = []
   try {
-    const taken = (await import(new URL(`file://${inTree(tree, 'targets.ts')}`).href)) as {
+    const taken = valuesIn(readFileSync(inTree(tree, 'targets.ts'))) as {
       TARGETS?: readonly Target[]
     }
     targets = taken.TARGETS ?? []
@@ -104,7 +106,7 @@ export async function run(declared: {
   }
 
   const piped = given()
-  only(piped, TAKES, `\`thread run ${declared.name} ${method}\``)
+  unasked(piped, TAKES, `\`thread run ${declared.name} ${method}\``)
   const { ask, shut } = asking(piped)
   const typed = (
     piped.length > 0

package/dist/integrations/vault.js

@@ -1,6 +1,7 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import * as disk from 'node:fs';
+import { join } from 'node:path';
+import { existsSync, readFileSync, writeFileSync } from "../core/files.js";
 export const VAULT_DIR = '.thread';
 export const SEALED_NAME = 'vault.sealed.json';
 export const KEY_NAME = 'vault.key';
@@ -48,8 +49,8 @@ export function keyed(root) {
     if (held !== undefined)
         return held;
     const made = randomBytes(KEY_BYTES);
-    mkdirSync(join(root, VAULT_DIR), { recursive: true });
-    writeFileSync(join(root, KEY_AT), `${made.toString('base64')}\n`, { mode: 0o600 });
+    disk.mkdirSync(join(root, VAULT_DIR), { recursive: true });
+    disk.writeFileSync(join(root, KEY_AT), `${made.toString('base64')}\n`, { mode: 0o600 });
     return made;
 }
 export function seal(root, named, env, value) {
@@ -61,7 +62,6 @@ export function seal(root, named, env, value) {
     held[named] = { ...held[named], [env]: [iv, cipher.getAuthTag(), body].map((one) => one.toString('base64')).join('.') };
     const sorted = Object.fromEntries(Object.keys(held).sort().map((one) => [one, held[one]]));
     const at = join(root, SEALED_AT);
-    mkdirSync(dirname(at), { recursive: true });
     writeFileSync(at, `${JSON.stringify(sorted, null, 2)}\n`);
 }
 export const sealedIn = (root, env) => Object.entries(store(root))

package/dist/integrations/vault.ts

@@ -1,8 +1,9 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
+import * as disk from 'node:fs'
+import { join } from 'node:path'
 
 import type { Env } from '../core/actor.ts'
+import { existsSync, readFileSync, writeFileSync } from '../core/files.ts'
 
 export const VAULT_DIR = '.thread'
 
@@ -74,8 +75,8 @@ export function keyed(root: string): Buffer {
   const held = keyOf(root)
   if (held !== undefined) return held
   const made = randomBytes(KEY_BYTES)
-  mkdirSync(join(root, VAULT_DIR), { recursive: true })
-  writeFileSync(join(root, KEY_AT), `${made.toString('base64')}\n`, { mode: 0o600 })
+  disk.mkdirSync(join(root, VAULT_DIR), { recursive: true })
+  disk.writeFileSync(join(root, KEY_AT), `${made.toString('base64')}\n`, { mode: 0o600 })
   return made
 }
 
@@ -88,7 +89,6 @@ export function seal(root: string, named: string, env: Env, value: string): void
   held[named] = { ...held[named], [env]: [iv, cipher.getAuthTag(), body].map((one) => one.toString('base64')).join('.') }
   const sorted = Object.fromEntries(Object.keys(held).sort().map((one) => [one, held[one]]))
   const at = join(root, SEALED_AT)
-  mkdirSync(dirname(at), { recursive: true })
   writeFileSync(at, `${JSON.stringify(sorted, null, 2)}\n`)
 }
 

package/dist/integrity/attach.js

@@ -105,18 +105,6 @@ const SHIPPED = [
         id: 'publish-runner',
         source: "  {\n    id: 'publish-runner',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/publish.js',\n    describes: 'Sends this repository\\'s packages to a registry. It derives what each package says about itself first, then builds, then refuses to send anything until the gate, the typecheck, the lint and the seal have each passed, and commits what it derived once the packages are out. The seal is checked rather than regenerated, because a release that rewrites its own seal can never fail it.',\n    version: 1,\n    by: 'thread publish',\n  },",
     },
-    {
-        into: 'derivation.ts',
-        list: 'GENERATORS',
-        id: 'rule-noun',
-        source: "  {\n    id: 'rule-noun',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/rule.js',\n    describes: 'Declares a rule this app holds itself to. `thread create rule` writes the row and seeds the check beside it, so a new rule goes through the same wizard as everything else rather than being written by hand.',\n    version: 1,\n    by: 'thread create rule',\n  },",
-    },
-    {
-        into: 'derivation.ts',
-        list: 'GENERATORS',
-        id: 'seal-generator',
-        source: "  {\n    id: 'seal-generator',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/seal.js',\n    describes: 'Writes the seal: a hash of every built file the integrity package ships, so an installed copy can prove it is the one that went out. With --check it writes nothing and refuses a seal that no longer matches the built files.',\n    version: 1,\n    by: 'thread seal',\n    runs: 'thread seal --check',\n  },",
-    },
 ];
 export const ATTACH = {
     attaches: SEEDED.attaches,

package/dist/integrity/attach.ts

@@ -123,18 +123,6 @@ const SHIPPED: readonly { readonly into: string; readonly list: string; readonly
     id: 'publish-runner',
     source: "  {\n    id: 'publish-runner',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/publish.js',\n    describes: 'Sends this repository\\'s packages to a registry. It derives what each package says about itself first, then builds, then refuses to send anything until the gate, the typecheck, the lint and the seal have each passed, and commits what it derived once the packages are out. The seal is checked rather than regenerated, because a release that rewrites its own seal can never fail it.',\n    version: 1,\n    by: 'thread publish',\n  },",
   },
-  {
-    into: 'derivation.ts',
-    list: 'GENERATORS',
-    id: 'rule-noun',
-    source: "  {\n    id: 'rule-noun',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/rule.js',\n    describes: 'Declares a rule this app holds itself to. `thread create rule` writes the row and seeds the check beside it, so a new rule goes through the same wizard as everything else rather than being written by hand.',\n    version: 1,\n    by: 'thread create rule',\n  },",
-  },
-  {
-    into: 'derivation.ts',
-    list: 'GENERATORS',
-    id: 'seal-generator',
-    source: "  {\n    id: 'seal-generator',\n    at: 'node_modules/@prestack/thread/dist/integrity/generators/seal.js',\n    describes: 'Writes the seal: a hash of every built file the integrity package ships, so an installed copy can prove it is the one that went out. With --check it writes nothing and refuses a seal that no longer matches the built files.',\n    version: 1,\n    by: 'thread seal',\n    runs: 'thread seal --check',\n  },",
-  },
 ]
 export const ATTACH: Attaching = {
   attaches: SEEDED.attaches,

package/dist/integrity/check-threads.js

@@ -1,4 +1,4 @@
-import { readdirSync } from 'node:fs';
+import { readdirSync } from "../core/files.js";
 import { dirname, join } from 'node:path';
 import { argv, stdout } from 'node:process';
 import { exit, invoked } from "../core/invoked.js";

package/dist/integrity/check-threads.ts

@@ -1,4 +1,4 @@
-import { readdirSync } from 'node:fs'
+import { readdirSync } from '../core/files.ts'
 import { dirname, join } from 'node:path'
 import { argv, stdout } from 'node:process'
 

package/dist/integrity/constraint.d.ts

@@ -1,4 +1,13 @@
 import type { Threaded } from '../core/thread.ts';
+export interface Sourced {
+    readonly at: string;
+    readonly source: string;
+}
+export type Proof = string | {
+    readonly files: readonly Sourced[];
+    readonly at: string;
+};
+export declare function shown(proof: Proof): string;
 export interface Constraint extends Threaded {
     readonly version: number;
     readonly where: {
@@ -8,8 +17,8 @@ export interface Constraint extends Threaded {
     readonly bans: string;
     readonly because: string;
     readonly instead: string;
-    readonly wrong: string;
-    readonly right: string;
+    readonly wrong: Proof;
+    readonly right: Proof;
     readonly governs?: string;
     readonly severity?: 'forbidden' | 'warning';
 }