@prestack/thread 0.1.2 → 0.1.4

package/dist/derivation/generators/build.js

@@ -10,12 +10,12 @@ import { relative, resolve } from 'node:path';
 import { argv, stderr, stdout } from 'node:process';
 import { pathToFileURL } from 'node:url';
 import { build } from 'esbuild';
-import { descend, reached } from "../../core/descend.js";
-import { existsSync, readFileSync } from "../../core/files.js";
-import { exit, invoked } from "../../core/invoked.js";
-import { valuesIn } from "../../core/rows.js";
-import { findTree } from "../../core/tree.js";
-import { servesBrowser } from "../../integrations/target.js";
+import { descend, reached } from '../../core/descend.js';
+import { existsSync, readFileSync } from '../../integrations/disk.js';
+import { exit, invoked } from '../../core/invoked.js';
+import { valuesIn } from '../../core/rows.js';
+import { findTree } from '../../core/tree.js';
+import { servesBrowser } from '../../integrations/target.js';
 const TREE = findTree();
 const ROOT = TREE.at;
 const OUTSIDE = /(^|\/)node_modules(\/|$)/;

package/dist/derivation/generators/build.ts

@@ -5,7 +5,7 @@ import { pathToFileURL } from 'node:url'
 import { build } from 'esbuild'
 
 import { descend, reached, type Pass } from '../../core/descend.ts'
-import { existsSync, readFileSync } from '../../core/files.ts'
+import { existsSync, readFileSync } from '../../integrations/disk.ts'
 import { exit, invoked } from '../../core/invoked.ts'
 import { valuesIn } from '../../core/rows.ts'
 import { findTree } from '../../core/tree.ts'

package/dist/derivation/generators/check.js

@@ -1,4 +1,4 @@
-import { bodyHash, parseGenerated } from "./determinism.js";
+import { bodyHash, parseGenerated } from './determinism.js';
 export function checkGenerated(expected, read, options = {}) {
     const checks = [];
     const expectedPaths = new Set(expected.map((file) => file.path));

package/dist/derivation/generators/determinism.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { named } from "../../core/scope.js";
+import { named } from '../../core/scope.js';
 export function sortedBy(items, key) {
     return [...items].sort((a, b) => compare(key(a), key(b)));
 }

package/dist/derivation/generators/release.js

@@ -1,14 +1,14 @@
 import { join } from 'node:path';
 import { argv, stderr, stdout } from 'node:process';
-import { marked, wordsIn } from "../../core/answers.js";
-import { existsSync, readFileSync, writeFileSync } from "../../core/files.js";
-import { exit, invoked } from "../../core/invoked.js";
-import { valuesIn } from "../../core/rows.js";
-import { ours } from "../../core/scope.js";
-import { findTree, inTree } from "../../core/tree.js";
-import { CHECKED_BY, KINDS, LISTENS, SAID, WRITES, WRITTEN_BY, kindOf } from "../release.js";
+import { existsSync, readFileSync, writeFileSync } from '../../integrations/disk.js';
+import { exit, invoked } from '../../core/invoked.js';
+import { marked, valuesIn } from '../../core/rows.js';
+import { ours } from '../../core/scope.js';
+import { findTree, inTree } from '../../core/tree.js';
+import { CHECKED_BY, KINDS, LISTENS, SAID, WRITES, WRITTEN_BY, kindOf } from '../release.js';
 const TREE = findTree();
 const MANIFEST = 'package.json';
+const addressed = (rows) => rows.flatMap((one) => [...(one.at === undefined ? [] : [one.at]), ...addressed(one.derives ?? [])]);
 const mark = (one) => marked([one.id ?? '', one.at ?? '']);
 function releases() {
     const at = inTree(TREE, 'derivation.ts');
@@ -22,45 +22,41 @@ function releases() {
         return [];
     }
 }
-function named() {
-    const at = inTree(TREE, 'secrets.ts');
-    if (!existsSync(at))
-        return [];
+function manager() {
     try {
-        const held = valuesIn(readFileSync(at, 'utf8'));
-        return (held.SECRETS ?? []).map((one) => one.id.toUpperCase()).sort();
+        const held = JSON.parse(readFileSync(join(TREE.at, MANIFEST), 'utf8'));
+        const said = typeof held.packageManager === 'string' ? held.packageManager.split('@')[0] : undefined;
+        return said === undefined || said === '' ? 'npm' : said;
     }
     catch {
-        return [];
+        return 'npm';
     }
 }
 function scripted() {
-    try {
-        const held = JSON.parse(readFileSync(join(TREE.at, MANIFEST), 'utf8'));
-        const scripts = held.scripts ?? {};
-        return {
-            build: scripts['build'] === undefined ? 'npm run build' : 'npm run build',
-            start: scripts['start'] === undefined ? 'npm start' : 'npm start',
-        };
-    }
-    catch {
-        return { build: 'npm run build', start: 'npm start' };
-    }
+    const tool = manager();
+    return { build: `${tool} run build`, start: tool === 'npm' ? 'npm start' : `${tool} start` };
 }
 function dockerfile(build, start) {
+    const tool = manager();
+    const corepack = tool === 'npm' ? [] : ['RUN corepack enable'];
+    const lock = tool === 'npm' ? 'package-lock.json*' : `${tool}-lock.yaml*`;
+    const first = tool === 'npm'
+        ? 'RUN npm ci --omit=dev --ignore-scripts || npm install --omit=dev --ignore-scripts'
+        : `RUN ${tool} install --prod --frozen-lockfile --ignore-scripts || ${tool} install --prod --ignore-scripts`;
+    const all = tool === 'npm' ? 'RUN npm install --ignore-scripts' : `RUN ${tool} install --ignore-scripts`;
     return [
-        '# GENERATED by thread — do not edit. It is derived from what this app declares.',
-        '',
         'FROM node:22-slim AS build',
         'WORKDIR /app',
-        'COPY package.json package-lock.json* ./',
-        'RUN npm ci --omit=dev --ignore-scripts || npm install --omit=dev --ignore-scripts',
+        ...corepack,
+        `COPY package.json ${lock} ./`,
+        first,
         'COPY . .',
-        'RUN npm install --ignore-scripts',
+        all,
         `RUN ${build}`,
         '',
         'FROM node:22-slim',
         'WORKDIR /app',
+        ...corepack,
         'ENV NODE_ENV=production',
         'COPY --from=build /app ./',
         `EXPOSE ${String(LISTENS)}`,
@@ -68,28 +64,27 @@ function dockerfile(build, start) {
         '',
     ].join('\n');
 }
-function compose(id, secrets) {
+function compose(id) {
     return [
-        '# GENERATED by thread — do not edit. It is derived from what this app declares.',
-        '',
         'services:',
         `  ${id}:`,
         '    build: .',
         '    ports:',
         `      - "${String(LISTENS)}:${String(LISTENS)}"`,
-        ...(secrets.length === 0
-            ? []
-            : [
-                '    environment:',
-                ...secrets.map((one) => `      ${one}: \${${one}}`),
-            ]),
+        '',
+    ].join('\n');
+}
+function withheld() {
+    return [
+        '.thread',
+        'node_modules',
+        '.git',
         '',
     ].join('\n');
 }
 function made() {
     const found = new Map();
     const rows = releases();
-    const secrets = named();
     const { build, start } = scripted();
     for (const one of rows) {
         const id = one.id;
@@ -100,7 +95,8 @@ function made() {
             continue;
         if (kind === 'docker') {
             found.set('Dockerfile', dockerfile(build, start));
-            found.set('compose.yaml', compose(id, secrets));
+            found.set('compose.yaml', compose(id));
+            found.set('.dockerignore', withheld());
         }
     }
     return found;
@@ -120,7 +116,12 @@ function run() {
             `\`thread create release\` — it is ${KINDS.join(' or ')}, and the prefix on its id says which.\n`);
         return 0;
     }
-    const words = wordsIn(['read']);
+    const words = argv.slice(2).filter((one) => !one.startsWith('-'));
+    if (words[0] !== undefined && words[0] !== 'read') {
+        stderr.write('release: `' + words[0] + '` is not something this command does. `thread release` writes the release, and ' +
+            '`thread release read <mark>` prints one. Nothing was written.\n');
+        return 1;
+    }
     if (words[0] === 'read') {
         const which = words[1];
         const one = rows.find((row) => mark(row) === which);
@@ -132,10 +133,10 @@ function run() {
         }
         const kind = kindOf(one.id ?? '');
         stdout.write(`${String(one.id)} — ${kind === undefined ? 'a release of a kind this generator does not recognise' : SAID[kind]}\n`);
-        for (const file of kind === undefined ? [] : WRITES[kind]) {
-            stdout.write(`\n${file}\n`);
+        for (const one of kind === undefined ? [] : WRITES[kind]) {
+            stdout.write(`\n${one.at} — ${one.describes}\n`);
             try {
-                stdout.write(readFileSync(join(TREE.at, file), 'utf8'));
+                stdout.write(readFileSync(join(TREE.at, one.at), 'utf8'));
             }
             catch {
                 stdout.write('(nothing is there)\n');
@@ -145,6 +146,16 @@ function run() {
     }
     const files = made();
     const checking = argv.includes('--check');
+    const stated = new Set(addressed(rows));
+    const stray = [...files.keys()].filter((one) => !stated.has(one));
+    if (stray.length > 0) {
+        stderr.write(`release: this release produces ${stray.join(', ')}, and no row names ${stray.length === 1 ? 'it' : 'them'}. ` +
+            `Writing ${stray.length === 1 ? 'it' : 'them'} would leave a file this tree does not declare, and the descent ` +
+            'reports that three steps later as a file nobody can account for. Take the release out with `thread remove ' +
+            '<its id>` and declare it again — the maker writes one row per file this kind produces, so all of them arrive ' +
+            'together. Nothing was written.\n');
+        return 1;
+    }
     const shipped = installed();
     if (shipped.length > 0) {
         stderr.write(`release: this app installs ${shipped.join(', ')} as a dependency, and what a host runs may hold ` +
@@ -176,8 +187,10 @@ function run() {
     }
     for (const [at, text] of files)
         writeFileSync(join(TREE.at, at), text, 'utf8');
-    stdout.write(`release: wrote ${[...files.keys()].join(', ')} — built and started by what this app's own manifest ` +
-        `declares, listening on ${String(LISTENS)}, naming ${String(named().length)} secret(s) and holding none of them.\n`);
+    stdout.write('release: wrote ' + [...files.keys()].join(', ') + ' — built and started by what this app\'s own manifest ' +
+        'declares, listening on ' + String(LISTENS) + '.\n' +
+        'release: no secret is named there. A secret is read from the sealed store at the moment it is used, and ' +
+        'naming it here would be telling whoever deploys this to put a credential in the environment instead.\n');
     return 0;
 }
 if (invoked(import.meta.url))

package/dist/derivation/generators/release.ts

@@ -1,10 +1,9 @@
 import { join } from 'node:path'
 import { argv, stderr, stdout } from 'node:process'
 
-import { marked, wordsIn } from '../../core/answers.ts'
-import { existsSync, readFileSync, writeFileSync } from '../../core/files.ts'
+import { existsSync, readFileSync, writeFileSync } from '../../integrations/disk.ts'
 import { exit, invoked } from '../../core/invoked.ts'
-import { valuesIn } from '../../core/rows.ts'
+import { marked, valuesIn } from '../../core/rows.ts'
 import { ours } from '../../core/scope.ts'
 import { findTree, inTree } from '../../core/tree.ts'
 
@@ -17,8 +16,12 @@ const MANIFEST = 'package.json'
 interface Row {
   readonly id?: string
   readonly at?: string
+  readonly derives?: readonly Row[]
 }
 
+const addressed = (rows: readonly Row[]): readonly string[] =>
+  rows.flatMap((one) => [...(one.at === undefined ? [] : [one.at]), ...addressed(one.derives ?? [])])
+
 const mark = (one: Row): string => marked([one.id ?? '', one.at ?? ''])
 
 function releases(): readonly Row[] {
@@ -32,46 +35,44 @@ function releases(): readonly Row[] {
   }
 }
 
-function named(): readonly string[] {
-  const at = inTree(TREE, 'secrets.ts')
-  if (!existsSync(at)) return []
+function manager(): string {
   try {
-    const held = valuesIn(readFileSync(at, 'utf8')) as { SECRETS?: readonly { readonly id: string }[] }
-    return (held.SECRETS ?? []).map((one) => one.id.toUpperCase()).sort()
+    const held = JSON.parse(readFileSync(join(TREE.at, MANIFEST), 'utf8')) as { packageManager?: unknown }
+    const said = typeof held.packageManager === 'string' ? held.packageManager.split('@')[0] : undefined
+    return said === undefined || said === '' ? 'npm' : said
   } catch {
-    return []
+    return 'npm'
   }
 }
 
 function scripted(): { readonly build: string; readonly start: string } {
-  try {
-    const held = JSON.parse(readFileSync(join(TREE.at, MANIFEST), 'utf8')) as {
-      scripts?: Readonly<Record<string, string>>
-    }
-    const scripts = held.scripts ?? {}
-    return {
-      build: scripts['build'] === undefined ? 'npm run build' : 'npm run build',
-      start: scripts['start'] === undefined ? 'npm start' : 'npm start',
-    }
-  } catch {
-    return { build: 'npm run build', start: 'npm start' }
-  }
+  const tool = manager()
+  return { build: `${tool} run build`, start: tool === 'npm' ? 'npm start' : `${tool} start` }
 }
 
 function dockerfile(build: string, start: string): string {
+  const tool = manager()
+  const corepack = tool === 'npm' ? [] : ['RUN corepack enable']
+  const lock = tool === 'npm' ? 'package-lock.json*' : `${tool}-lock.yaml*`
+  const first =
+    tool === 'npm'
+      ? 'RUN npm ci --omit=dev --ignore-scripts || npm install --omit=dev --ignore-scripts'
+      : `RUN ${tool} install --prod --frozen-lockfile --ignore-scripts || ${tool} install --prod --ignore-scripts`
+  const all = tool === 'npm' ? 'RUN npm install --ignore-scripts' : `RUN ${tool} install --ignore-scripts`
+
   return [
-    '# GENERATED by thread — do not edit. It is derived from what this app declares.',
-    '',
     'FROM node:22-slim AS build',
     'WORKDIR /app',
-    'COPY package.json package-lock.json* ./',
-    'RUN npm ci --omit=dev --ignore-scripts || npm install --omit=dev --ignore-scripts',
+    ...corepack,
+    `COPY package.json ${lock} ./`,
+    first,
     'COPY . .',
-    'RUN npm install --ignore-scripts',
+    all,
     `RUN ${build}`,
     '',
     'FROM node:22-slim',
     'WORKDIR /app',
+    ...corepack,
     'ENV NODE_ENV=production',
     'COPY --from=build /app ./',
     `EXPOSE ${String(LISTENS)}`,
@@ -80,22 +81,22 @@ function dockerfile(build: string, start: string): string {
   ].join('\n')
 }
 
-function compose(id: string, secrets: readonly string[]): string {
+function compose(id: string): string {
   return [
-    '# GENERATED by thread — do not edit. It is derived from what this app declares.',
-    '',
     'services:',
     `  ${id}:`,
     '    build: .',
     '    ports:',
     `      - "${String(LISTENS)}:${String(LISTENS)}"`,
-    ...(secrets.length === 0
-      ? []
-      : [
-          '    environment:',
+    '',
+  ].join('\n')
+}
 
-          ...secrets.map((one) => `      ${one}: \${${one}}`),
-        ]),
+function withheld(): string {
+  return [
+    '.thread',
+    'node_modules',
+    '.git',
     '',
   ].join('\n')
 }
@@ -103,7 +104,6 @@ function compose(id: string, secrets: readonly string[]): string {
 function made(): ReadonlyMap<string, string> {
   const found = new Map<string, string>()
   const rows = releases()
-  const secrets = named()
   const { build, start } = scripted()
 
   for (const one of rows) {
@@ -113,7 +113,8 @@ function made(): ReadonlyMap<string, string> {
     if (kind === undefined) continue
     if (kind === 'docker') {
       found.set('Dockerfile', dockerfile(build, start))
-      found.set('compose.yaml', compose(id, secrets))
+      found.set('compose.yaml', compose(id))
+      found.set('.dockerignore', withheld())
     }
   }
   return found
@@ -138,7 +139,14 @@ function run(): number {
     return 0
   }
 
-  const words = wordsIn(['read'])
+  const words = argv.slice(2).filter((one) => !one.startsWith('-'))
+  if (words[0] !== undefined && words[0] !== 'read') {
+    stderr.write(
+      'release: `' + words[0] + '` is not something this command does. `thread release` writes the release, and ' +
+        '`thread release read <mark>` prints one. Nothing was written.\n',
+    )
+    return 1
+  }
   if (words[0] === 'read') {
     const which = words[1]
     const one = rows.find((row) => mark(row) === which)
@@ -153,10 +161,10 @@ function run(): number {
 
     const kind = kindOf(one.id ?? '')
     stdout.write(`${String(one.id)} — ${kind === undefined ? 'a release of a kind this generator does not recognise' : SAID[kind]}\n`)
-    for (const file of kind === undefined ? [] : WRITES[kind]) {
-      stdout.write(`\n${file}\n`)
+    for (const one of kind === undefined ? [] : WRITES[kind]) {
+      stdout.write(`\n${one.at} — ${one.describes}\n`)
       try {
-        stdout.write(readFileSync(join(TREE.at, file), 'utf8'))
+        stdout.write(readFileSync(join(TREE.at, one.at), 'utf8'))
       } catch {
         stdout.write('(nothing is there)\n')
       }
@@ -167,6 +175,19 @@ function run(): number {
   const files = made()
   const checking = argv.includes('--check')
 
+  const stated = new Set(addressed(rows))
+  const stray = [...files.keys()].filter((one) => !stated.has(one))
+  if (stray.length > 0) {
+    stderr.write(
+      `release: this release produces ${stray.join(', ')}, and no row names ${stray.length === 1 ? 'it' : 'them'}. ` +
+        `Writing ${stray.length === 1 ? 'it' : 'them'} would leave a file this tree does not declare, and the descent ` +
+        'reports that three steps later as a file nobody can account for. Take the release out with `thread remove ' +
+        '<its id>` and declare it again — the maker writes one row per file this kind produces, so all of them arrive ' +
+        'together. Nothing was written.\n',
+    )
+    return 1
+  }
+
   const shipped = installed()
   if (shipped.length > 0) {
     stderr.write(
@@ -202,8 +223,10 @@ function run(): number {
 
   for (const [at, text] of files) writeFileSync(join(TREE.at, at), text, 'utf8')
   stdout.write(
-    `release: wrote ${[...files.keys()].join(', ')} — built and started by what this app's own manifest ` +
-      `declares, listening on ${String(LISTENS)}, naming ${String(named().length)} secret(s) and holding none of them.\n`,
+    'release: wrote ' + [...files.keys()].join(', ') + ' — built and started by what this app\'s own manifest ' +
+      'declares, listening on ' + String(LISTENS) + '.\n' +
+      'release: no secret is named there. A secret is read from the sealed store at the moment it is used, and ' +
+      'naming it here would be telling whoever deploys this to put a credential in the environment instead.\n',
   )
   return 0
 }

package/dist/derivation/release.d.ts

@@ -1,8 +1,12 @@
 export declare const PREFIXES: {
-    readonly docker: "dk_";
+    readonly docker: 'dk_';
 };
-export declare const KINDS: readonly ["docker"];
-export declare const WRITES: Readonly<Record<(typeof KINDS)[number], readonly string[]>>;
+export declare const KINDS: readonly ['docker'];
+export interface Written {
+    readonly at: string;
+    readonly describes: string;
+}
+export declare const WRITES: Readonly<Record<(typeof KINDS)[number], readonly Written[]>>;
 export declare const LISTENS = 3000;
 export declare const SAID: Readonly<Record<(typeof KINDS)[number], string>>;
 export declare const kindOf: (id: string) => (typeof KINDS)[number] | undefined;

package/dist/derivation/release.js

@@ -1,7 +1,20 @@
 export const PREFIXES = { docker: 'dk_' };
 export const KINDS = ['docker'];
 export const WRITES = {
-    docker: ['Dockerfile', 'compose.yaml'],
+    docker: [
+        {
+            at: 'Dockerfile',
+            describes: 'How this app becomes an image and what starts it inside one — the build and start commands its own manifest declares, run with the package manager that manifest names, and the port its server listens on.',
+        },
+        {
+            at: 'compose.yaml',
+            describes: 'What runs the image this release builds, named beside it because one row states one address.',
+        },
+        {
+            at: '.dockerignore',
+            describes: 'What a build of this image must never carry out of this directory: the sealed store and the key that opens it, the installed packages, and the history. Without it the build copies everything beside it, and every sealed value goes into the image and into whoever pulls it.',
+        },
+    ],
 };
 export const LISTENS = 3000;
 export const SAID = {

package/dist/derivation/release.ts

@@ -4,8 +4,28 @@ export const PREFIXES = { docker: 'dk_' } as const
 
 export const KINDS = ['docker'] as const
 
-export const WRITES: Readonly<Record<(typeof KINDS)[number], readonly string[]>> = {
-  docker: ['Dockerfile', 'compose.yaml'],
+export interface Written {
+  readonly at: string
+  readonly describes: string
+}
+
+export const WRITES: Readonly<Record<(typeof KINDS)[number], readonly Written[]>> = {
+  docker: [
+    {
+      at: 'Dockerfile',
+      describes:
+        'How this app becomes an image and what starts it inside one — the build and start commands its own manifest declares, run with the package manager that manifest names, and the port its server listens on.',
+    },
+    {
+      at: 'compose.yaml',
+      describes: 'What runs the image this release builds, named beside it because one row states one address.',
+    },
+    {
+      at: '.dockerignore',
+      describes:
+        'What a build of this image must never carry out of this directory: the sealed store and the key that opens it, the installed packages, and the history. Without it the build copies everything beside it, and every sealed value goes into the image and into whoever pulls it.',
+    },
+  ],
 }
 
 export const LISTENS = 3000

package/dist/integrations/attach.d.ts

@@ -2,5 +2,9 @@ import type { Attaching } from '../core/attach.ts';
 export declare const CONCEPTS: readonly {
     readonly id: string;
     readonly describes: string;
+    readonly cites: readonly {
+        readonly on: string;
+        readonly said: string;
+    }[];
 }[];
 export declare const ATTACH: Attaching;