@prestack/thread 0.1.3 → 0.1.5

package/dist/integrity/generators/compiler.js

@@ -1,12 +1,12 @@
-import { spawnSync } from 'node:child_process';
-import { attached, readdirSync, readFileSync, writeFileSync } from "../../core/files.js";
+import { starts } from '../../integrations/cli.js';
+import { attached, readdirSync, readFileSync, writeFileSync } from '../../integrations/disk.js';
 import { createRequire } from 'node:module';
 import { dirname, join, resolve } from 'node:path';
 import { argv, execPath, stderr, stdout } from 'node:process';
-import { exit } from "../../core/invoked.js";
-import { ROOT, THREAD_AT, descend } from "../../core/descend.js";
-import { MANIFEST } from "../../core/init.js";
-import { forbids, runChecker } from "../../core/finding.js";
+import { exit } from '../../core/invoked.js';
+import { ROOT, THREAD_AT, descend } from '../../core/descend.js';
+import { MANIFEST } from '../../core/init.js';
+import { forbids, runChecker } from '../../core/finding.js';
 function refuse(why) {
     stderr.write(`compiler: ${why}\n`);
     exit(1);
@@ -77,7 +77,8 @@ if (!held.declares) {
     refuse('no TypeScript file in this tree is declared by anything, so every one of them would be left out ' +
         'and the compiler would pass by reading nothing. Declare something with `thread create` first.');
 }
-const leave = [...held.out].sort();
+const NEXT = '.next';
+const leave = [...new Set([...held.out, NEXT])].sort();
 let current;
 try {
     current = JSON.parse(readFileSync(PATH, 'utf8'));
@@ -92,9 +93,7 @@ if (argv.includes('--check')) {
     if (!has) {
         findings.push({
             file: AT,
-            detail: leave.length === 0
-                ? 'leaves out paths this tree declares something under, so the compiler is not reading all of this app'
-                : `does not leave out ${String(leave.length)} path(s) nothing in this tree declares, so the compiler is holding this app to code it never wrote`,
+            detail: `does not leave out ${String(leave.length)} path(s) nothing in this tree declares, so the compiler is holding this app to code it never wrote`,
             instead: 'run `thread compiler`. What the compiler reads is derived from what the tree declares — an edit here is a declaration somebody skipped, and a path put here by hand is taken back out on the next settle',
         });
     }
@@ -120,17 +119,15 @@ if (argv.includes('--check')) {
             'passed against the wrong machine says nothing about this one.\n');
         exit(1);
     }
-    const built = spawnSync(execPath, [cli, '--noEmit'], { cwd: ROOT, stdio: 'inherit' });
-    if (built.error !== undefined)
-        refuse(`the compiler could not be started — ${built.error.message}.`);
-    exit(built.status ?? 1);
+    const built = starts(execPath, [cli, '--noEmit'], { at: ROOT, shows: true });
+    if (!built.there)
+        refuse(`the compiler could not be started — ${built.why}.`);
+    exit(built.code);
 }
 if (has) {
     stdout.write(`compiler: ${AT} already leaves out exactly what this tree declares nothing under.\n`);
     exit(0);
 }
 writeFileSync(PATH, `${wanted}\n`);
-stdout.write(leave.length === 0
-    ? `compiler: wrote ${AT} — every path here has something declared under it, so none is left out.\n`
-    : `compiler: wrote ${AT} — ${String(leave.length)} path(s) left out, declared by nobody: ${leave.join(', ')}.\n`);
+stdout.write(`compiler: wrote ${AT} — ${String(leave.length)} path(s) left out, declared by nobody: ${leave.join(', ')}.\n`);
 exit(0);

package/dist/integrity/generators/compiler.ts

@@ -1,5 +1,5 @@
-import { spawnSync } from 'node:child_process'
-import { attached, readdirSync, readFileSync, writeFileSync } from '../../core/files.ts'
+import { starts } from '../../integrations/cli.ts'
+import { attached, readdirSync, readFileSync, writeFileSync } from '../../integrations/disk.ts'
 import { createRequire } from 'node:module'
 import { dirname, join, resolve } from 'node:path'
 import { argv, execPath, stderr, stdout } from 'node:process'
@@ -99,7 +99,9 @@ if (!held.declares) {
   )
 }
 
-const leave = [...held.out].sort()
+const NEXT = '.next'
+
+const leave = [...new Set([...held.out, NEXT])].sort()
 
 let current: Record<string, unknown>
 try {
@@ -116,10 +118,7 @@ if (argv.includes('--check')) {
   if (!has) {
     findings.push({
       file: AT,
-      detail:
-        leave.length === 0
-          ? 'leaves out paths this tree declares something under, so the compiler is not reading all of this app'
-          : `does not leave out ${String(leave.length)} path(s) nothing in this tree declares, so the compiler is holding this app to code it never wrote`,
+      detail: `does not leave out ${String(leave.length)} path(s) nothing in this tree declares, so the compiler is holding this app to code it never wrote`,
       instead:
         'run `thread compiler`. What the compiler reads is derived from what the tree declares — an edit here is a declaration somebody skipped, and a path put here by hand is taken back out on the next settle',
     })
@@ -151,9 +150,9 @@ if (argv.includes('--check')) {
     exit(1)
   }
 
-  const built = spawnSync(execPath, [cli, '--noEmit'], { cwd: ROOT, stdio: 'inherit' })
-  if (built.error !== undefined) refuse(`the compiler could not be started — ${built.error.message}.`)
-  exit(built.status ?? 1)
+  const built = starts(execPath, [cli, '--noEmit'], { at: ROOT, shows: true })
+  if (!built.there) refuse(`the compiler could not be started — ${built.why}.`)
+  exit(built.code)
 }
 
 if (has) {
@@ -162,9 +161,5 @@ if (has) {
 }
 
 writeFileSync(PATH, `${wanted}\n`)
-stdout.write(
-  leave.length === 0
-    ? `compiler: wrote ${AT} — every path here has something declared under it, so none is left out.\n`
-    : `compiler: wrote ${AT} — ${String(leave.length)} path(s) left out, declared by nobody: ${leave.join(', ')}.\n`,
-)
+stdout.write(`compiler: wrote ${AT} — ${String(leave.length)} path(s) left out, declared by nobody: ${leave.join(', ')}.\n`)
 exit(0)

package/dist/integrity/generators/gate.js

@@ -1,14 +1,13 @@
-import { spawnSync } from 'node:child_process';
+import { starts } from '../../integrations/cli.js';
 import { createHash } from 'node:crypto';
-import { readFileSync as bytesAt } from 'node:fs';
 import { join } from 'node:path';
 import { argv, execPath, stderr, stdout } from 'node:process';
-import { descend } from "../../core/descend.js";
-import { attached, existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "../../core/files.js";
-import { LOADER, exit } from "../../core/invoked.js";
-import { valuesIn } from "../../core/rows.js";
-import { ORGANISATION, ours } from "../../core/scope.js";
-import { findTree, inTree } from "../../core/tree.js";
+import { descend } from '../../core/descend.js';
+import { attached, existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from '../../integrations/disk.js';
+import { LOADER, exit } from '../../core/invoked.js';
+import { valuesIn } from '../../core/rows.js';
+import { ORGANISATION, ours } from '../../core/scope.js';
+import { findTree, inTree } from '../../core/tree.js';
 const TREE = findTree();
 const ROOT = TREE.at;
 const STEP_TIMEOUT = 600_000;
@@ -56,10 +55,10 @@ for (const row of writers) {
 }
 function ran(runs) {
     const said = runs.trim().split(/\s+/);
-    const spent = { cwd: ROOT, stdio: 'inherit', timeout: STEP_TIMEOUT, killSignal: 'SIGKILL' };
+    const spent = { at: ROOT, shows: true, within: STEP_TIMEOUT };
     if (said[0] !== 'thread') {
-        const shelled = spawnSync(runs, { shell: true, ...spent });
-        return shelled.error !== undefined ? 1 : (shelled.status ?? 1);
+        const other = starts(said[0] ?? '', said.slice(1), spent);
+        return other.there ? other.code : 1;
     }
     const of = `thread ${said[1] ?? ''}`;
     const at = written.get(of);
@@ -67,8 +66,8 @@ function ran(runs) {
         stderr.write(`gate: nothing in this tree is written by \`${of}\`, so this step names a command that does not exist here\n`);
         return 1;
     }
-    const spun = spawnSync(execPath, [...LOADER, join(ROOT, at), ...said.slice(2)], spent);
-    return spun.error !== undefined ? 1 : (spun.status ?? 1);
+    const spun = starts(execPath, [...LOADER, join(ROOT, at), ...said.slice(2)], spent);
+    return spun.there ? spun.code : 1;
 }
 function named(flag) {
     const at = argv.indexOf(flag);
@@ -111,8 +110,9 @@ for (const [index, step] of chosen.entries()) {
             `passed against the wrong machine says nothing about this one.\n`);
         continue;
     }
+    const began = Date.now();
     const code = ran(step.runs);
-    stdout.write(`gate: ${at} — exited ${String(code)}\n`);
+    stdout.write(`gate: ${at} — exited ${String(code)} in ${String(Date.now() - began)} ms\n`);
     if (code === 0)
         passed += 1;
     else
@@ -128,7 +128,7 @@ function fingerprint() {
     const hash = (at) => {
         if (!existsSync(join(ROOT, at)))
             return;
-        of[at] = createHash('sha256').update(bytesAt(join(ROOT, at))).digest('hex').slice(0, 16);
+        of[at] = createHash('sha256').update(readFileSync(join(ROOT, at))).digest('hex').slice(0, 16);
     };
     const sheets = join(ROOT, '_threads');
     if (existsSync(sheets)) {

package/dist/integrity/generators/gate.ts

@@ -1,11 +1,10 @@
-import { spawnSync } from 'node:child_process'
+import { starts } from '../../integrations/cli.ts'
 import { createHash } from 'node:crypto'
-import { readFileSync as bytesAt } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { argv, execPath, stderr, stdout } from 'node:process'
 import { fileURLToPath } from 'node:url'
 import { descend } from '../../core/descend.ts'
-import { attached, existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from '../../core/files.ts'
+import { attached, existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from '../../integrations/disk.ts'
 import { LOADER, exit } from '../../core/invoked.ts'
 import { valuesIn } from '../../core/rows.ts'
 import { ORGANISATION, ours } from '../../core/scope.ts'
@@ -82,11 +81,11 @@ for (const row of writers) {
 
 function ran(runs: string): number {
   const said = runs.trim().split(/\s+/)
-  const spent = { cwd: ROOT, stdio: 'inherit', timeout: STEP_TIMEOUT, killSignal: 'SIGKILL' } as const
+  const spent = { at: ROOT, shows: true, within: STEP_TIMEOUT } as const
 
   if (said[0] !== 'thread') {
-    const shelled = spawnSync(runs, { shell: true, ...spent })
-    return shelled.error !== undefined ? 1 : (shelled.status ?? 1)
+    const other = starts(said[0] ?? '', said.slice(1), spent)
+    return other.there ? other.code : 1
   }
 
   const of = `thread ${said[1] ?? ''}`
@@ -96,8 +95,8 @@ function ran(runs: string): number {
     return 1
   }
 
-  const spun = spawnSync(execPath, [...LOADER, join(ROOT, at), ...said.slice(2)], spent)
-  return spun.error !== undefined ? 1 : (spun.status ?? 1)
+  const spun = starts(execPath, [...LOADER, join(ROOT, at), ...said.slice(2)], spent)
+  return spun.there ? spun.code : 1
 }
 
 function named(flag: string): readonly string[] | undefined {
@@ -151,9 +150,10 @@ for (const [index, step] of chosen.entries()) {
     continue
   }
 
+  const began = Date.now()
   const code = ran(step.runs)
 
-  stdout.write(`gate: ${at} — exited ${String(code)}\n`)
+  stdout.write(`gate: ${at} — exited ${String(code)} in ${String(Date.now() - began)} ms\n`)
   if (code === 0) passed += 1
   else failed.push(step)
 }
@@ -169,7 +169,7 @@ function fingerprint(): { readonly of: Record<string, string>; readonly versions
   const of: Record<string, string> = {}
   const hash = (at: string): void => {
     if (!existsSync(join(ROOT, at))) return
-    of[at] = createHash('sha256').update(bytesAt(join(ROOT, at))).digest('hex').slice(0, 16)
+    of[at] = createHash('sha256').update(readFileSync(join(ROOT, at))).digest('hex').slice(0, 16)
   }
   const sheets = join(ROOT, '_threads')
   if (existsSync(sheets)) {

package/dist/integrity/generators/issues.js

@@ -1,11 +1,11 @@
 import { argv, stderr, stdout } from 'node:process';
-import { exit } from "../../core/invoked.js";
-import { uncompiled } from "../../core/descend.js";
-import { THREAD_AT, descend, refusals, trackedFiles, unthreaded } from "../check-threads.js";
-import { CONSTRAINTS } from "../constraint.js";
-import { ruleMessage } from "../lint.js";
-import { ROOT, load, rules } from "../slopnator.js";
-import { sweep, tracked as governed } from "../sweep.js";
+import { exit } from '../../core/invoked.js';
+import { uncompiled } from '../../core/descend.js';
+import { THREAD_AT, descend, refusals, trackedFiles, unthreaded } from '../check-threads.js';
+import { CONSTRAINTS } from '../constraint.js';
+import { ruleMessage } from '../lint.js';
+import { ROOT, load, rules } from '../slopnator.js';
+import { sweep, tracked as governed } from '../sweep.js';
 const WITHIN = '--in';
 const CHECK = '--check';
 const checking = argv.includes(CHECK);

package/dist/integrity/generators/publish.js

@@ -1,53 +1,31 @@
-import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from "../../core/files.js";
-import { valuesIn } from "../../core/rows.js";
+import { calls, starts } from '../../integrations/cli.js';
+import { existsSync, readFileSync } from '../../integrations/disk.js';
+import { valuesIn } from '../../core/rows.js';
 import { join } from 'node:path';
 import { argv, env, execPath, stderr, stdout } from 'node:process';
-import { TYPED } from "../../core/answers.js";
-import { CLI, exit } from "../../core/invoked.js";
-import { named } from "../../core/scope.js";
-import { findTree, inTree } from "../../core/tree.js";
-import { opened, sealedIn } from "../../integrations/vault.js";
+import { CLI, exit } from '../../core/invoked.js';
+import { THING as TYPED, named } from '../../core/scope.js';
+import { findTree, inTree } from '../../core/tree.js';
+import { placedAt } from '../../integrations/target.js';
+import { opened, sealedIn } from '../../integrations/vault.js';
 const TREE = findTree();
 const ROOT = TREE.at;
 const STEP_TIMEOUT = 900_000;
-const REGISTRY = '--registry';
-const DEFAULT = 'https://registry.npmjs.org';
+const REGISTRY = 'ht_registry';
 const CHECKS = [
     {
         id: 'gate',
         runs: 'thread gate',
         because: 'every step this tree declares, in the order it declares them, which is where the descent and the sweep are',
     },
-    {
-        id: 'lint',
-        runs: 'pnpm exec eslint .',
-        because: 'the rules that live on the lint surface, which is the only one carrying a fixer the sweep can report but not repair',
-    },
 ];
-const MINE = /^(?:npx |pnpm )?thread /;
-function run(what, extra) {
-    const ours = MINE.exec(what);
-    if (ours !== null) {
-        const words = what.slice(ours[0].length).split(/\s+/).filter((one) => one !== '');
-        const ran = spawnSync(execPath, [...CLI, ...words], {
-            cwd: ROOT,
-            stdio: 'inherit',
-            timeout: STEP_TIMEOUT,
-            killSignal: 'SIGKILL',
-            env: extra === undefined ? env : { ...env, ...extra },
-        });
-        return ran.error !== undefined ? 1 : (ran.status ?? 1);
-    }
-    const result = spawnSync(what, {
-        shell: true,
-        cwd: ROOT,
-        stdio: 'inherit',
-        timeout: STEP_TIMEOUT,
-        killSignal: 'SIGKILL',
-        env: extra === undefined ? env : { ...env, ...extra },
-    });
-    return result.error !== undefined ? 1 : (result.status ?? 1);
+const PREFIX = /^(?:npx|pnpm)$/;
+const words = (said) => said.split(/\s+/).filter((one) => one !== '');
+function run(given, extra) {
+    const mine = given[0] === 'thread' ? 1 : PREFIX.test(given[0] ?? '') && given[1] === 'thread' ? 2 : 0;
+    const how = { at: ROOT, shows: true, within: STEP_TIMEOUT, holds: extra === undefined ? env : { ...env, ...extra } };
+    const went = mine === 0 ? starts(given[0] ?? '', given.slice(1), how) : starts(execPath, [...CLI, ...given.slice(mine)], how);
+    return went.there ? went.code : 1;
 }
 function refuse(id, code, because, runs) {
     stderr.write(`\npublish: REFUSED — \`${id}\` exited ${String(code)}. NOTHING was published.\n`);
@@ -56,10 +34,9 @@ function refuse(id, code, because, runs) {
     stderr.write(`publish: second copy of a refusal drifts from the first. Run \`${runs}\` alone to work on it.\n`);
     exit(1);
 }
-const flag = argv.indexOf(REGISTRY);
-const registry = flag === -1 ? DEFAULT : (argv[flag + 1] ?? '');
-if (registry === '' || registry.startsWith('-')) {
-    stderr.write(`thread publish ${REGISTRY} <url>   where the packages go. Leave it off for ${DEFAULT}.\n`);
+const given = argv.indexOf('--registry');
+if (given !== -1) {
+    stderr.write('thread publish   takes no url. Where the packages go is the address on the ht_registry row in _threads/targets.ts.\n');
     stderr.write('\nit builds, then runs every check, then publishes. A check that fails publishes nothing.\n');
     exit(1);
 }
@@ -70,6 +47,12 @@ const declared = existsSync(secrets)
     ? (valuesIn(readFileSync(secrets)).SECRETS ?? [])
     : [];
 const vaulted = declared.some((one) => one.id === TOKEN);
+const targets = inTree(TREE, 'targets.ts');
+const registry = placedAt(existsSync(targets) ? (valuesIn(readFileSync(targets)).TARGETS ?? []) : [], REGISTRY).replace(/[/]$/, '');
+if (registry === '') {
+    stderr.write('\npublish: no target row says where the registry is, so there is nowhere for these packages to go. Give ' + REGISTRY + ' an address in _threads/targets.ts, the absolute url of the registry. NOTHING was published.\n');
+    exit(1);
+}
 if (vaulted && !sealedIn(ROOT, PRODUCTION).includes(TOKEN)) {
     stderr.write(`\npublish: ${TOKEN} is declared in _threads/secrets.ts and has no value sealed for ${PRODUCTION}, so nothing was checked and NOTHING was published.\n`);
     stderr.write(`publish: run \`thread create secret set ${TOKEN}\` at a terminal and paste the registry token, or take the row out to publish with the login this machine holds.\n`);
@@ -96,7 +79,7 @@ stdout.write(vaulted
     ? `publish: ${TOKEN} is declared and sealed for ${PRODUCTION}. It is opened only after every check passes, and handed to pnpm as its auth setting for ${registry}.\n`
     : `publish: no row declares ${TOKEN}, so this publish uses ${signedAs}. Declare it with \`thread create secret\` to publish with a token sealed in this repository instead.\n`);
 stdout.write('publish: deriving and building what the packaging rows state first, so every check below reads the files this release ships rather than the source they were written from.\n');
-const made = run(`${TYPED} packaged --build`);
+const made = run(words(`${TYPED} packaged --build`));
 stdout.write(`publish: packaged exited ${String(made)}\n`);
 if (made !== 0) {
     refuse('packaged', made, 'a package whose manifest and release note are not what its rows state would go out describing itself as something nobody declared, and one that did not compile would go out promising files it does not have', `${TYPED} packaged --build`);
@@ -107,28 +90,28 @@ for (const check of CHECKS)
 for (const [index, check] of CHECKS.entries()) {
     const at = `check ${String(index + 1)} of ${String(CHECKS.length)}`;
     stdout.write(`\npublish: ${at} — ${check.runs} (${check.id})\n`);
-    const code = run(check.runs);
+    const code = run(words(check.runs));
     stdout.write(`publish: ${at} — exited ${String(code)}\n`);
     if (code !== 0)
         refuse(check.id, code, check.because, check.runs);
 }
-const numbered = run(`${TYPED} packaged --release`);
+const numbered = run(words(`${TYPED} packaged --release`));
 stdout.write(`publish: packaged --release exited ${String(numbered)}\n`);
 if (numbered !== 0) {
     refuse('packaged', numbered, 'the next release number is written onto the manifests only once every check has passed, and writing it refused, so nothing here carries a number to go out under', `${TYPED} packaged --release`);
 }
 const handed = vaulted ? { [setting()]: await tokened() } : undefined;
 stdout.write(`\npublish: every check passed. Publishing to ${registry} with ${vaulted ? `${TOKEN} from this repository's vault` : signedAs}.\n`);
-const sent = run(`pnpm -r publish --registry ${registry} --no-git-checks --access public`, handed);
+const sent = run(words(`pnpm -r publish --registry ${registry} --no-git-checks --access public`), handed);
 if (sent !== 0) {
     stderr.write(`\npublish: the checks passed and the publish itself exited ${String(sent)}.\n`);
-    const back = run(`${TYPED} packaged`);
+    const back = run(words(`${TYPED} packaged`));
     stderr.write(back === 0
         ? 'publish: the manifests carry the last recorded release again and no note was written, so the next `thread publish` numbers this release once more.\n'
         : `publish: the manifests still carry the number that did not go out. Run \`${TYPED} packaged\` to put the last recorded release back.\n`);
     exit(1);
 }
-const recorded = run(`${TYPED} packaged --record`);
+const recorded = run(words(`${TYPED} packaged --record`));
 stdout.write(`publish: packaged --record exited ${String(recorded)}\n`);
 if (recorded !== 0) {
     stderr.write(`\npublish: the packages went out and the note recording them refused to be written, so the next publish would number this release again. Run \`${TYPED} packaged --record\` and read what it says.\n`);
@@ -151,10 +134,9 @@ function versionAt(folder) {
         return 'no version';
     }
 }
-function asked(what) {
-    return (spawnSync('git', what, { cwd: ROOT, encoding: 'utf8' }).stdout ?? '').trim();
-}
-if (asked(['rev-parse', '--is-inside-work-tree']) !== 'true') {
+const git = calls('cli_git', ROOT);
+const asked = async (what) => (await git.rev_parse(what)).out.trim();
+if ((await asked(['--is-inside-work-tree'])) !== 'true') {
     stdout.write("\npublish: it's not a repo, so nothing was committed.\n");
 }
 else if (shipped.length === 0) {
@@ -162,14 +144,14 @@ else if (shipped.length === 0) {
 }
 else {
     const going = shipped.map((one) => `${named(one.id ?? '')} ${versionAt(one.folder ?? '')}`).join(', ');
-    const branch = asked(['rev-parse', '--abbrev-ref', 'HEAD']);
+    const branch = await asked(['--abbrev-ref', 'HEAD']);
     for (const one of shipped)
-        run(`git add ${one.folder ?? ''}`);
-    if (spawnSync('git', ['diff', '--cached', '--quiet'], { cwd: ROOT }).status === 0) {
+        await git.stage([one.folder ?? ''], true, STEP_TIMEOUT);
+    if ((await git.diff(['--cached', '--quiet'])).ok) {
         stdout.write(`\npublish: ${going} — what is on disk is already what is committed, so this release added no artifact.\n`);
     }
     else {
-        const wrote = run(`git commit -m ${JSON.stringify(`thread publish — ${going}`)}`);
+        const wrote = (await git.commit(['-m', `thread publish — ${going}`], true, STEP_TIMEOUT)).code;
         stdout.write(`publish: commit exited ${String(wrote)}\n`);
         if (wrote !== 0) {
             stderr.write('\npublish: the packages went out and the files that describe them are not committed, so this release has no record in git.\n');
@@ -179,5 +161,5 @@ else {
         stdout.write(`publish: committed the derived artifacts to ${branch} — ${going}.\n`);
     }
 }
-stdout.write(`\npublish: done. What went out was derived, then built, then passed the gate and the lint, in that order. The compile inside \`thread packaged --build\` is the typecheck.\n`);
+stdout.write(`\npublish: done. What went out was derived, then built, then passed the gate, in that order. The compile inside \`thread packaged --build\` is the typecheck.\n`);
 exit(0);

package/dist/integrity/generators/publish.ts

@@ -1,15 +1,15 @@
-import { spawnSync } from 'node:child_process'
-import { existsSync, readFileSync } from '../../core/files.ts'
+import { calls, starts } from '../../integrations/cli.ts'
+import { existsSync, readFileSync } from '../../integrations/disk.ts'
 import { valuesIn } from '../../core/rows.ts'
 import { join } from 'node:path'
 import { argv, env, execPath, stderr, stdout } from 'node:process'
 import { pathToFileURL } from 'node:url'
-import { TYPED } from '../../core/answers.ts'
 import { CLI, exit } from '../../core/invoked.ts'
-import { named } from '../../core/scope.ts'
+import { THING as TYPED, named } from '../../core/scope.ts'
 import { findTree, inTree } from '../../core/tree.ts'
 
 import type { Secret } from '../../integrations/secret.ts'
+import { placedAt, type Target } from '../../integrations/target.ts'
 import { opened, sealedIn } from '../../integrations/vault.ts'
 
 const TREE = findTree()
@@ -17,9 +17,7 @@ const ROOT = TREE.at
 
 const STEP_TIMEOUT = 900_000
 
-const REGISTRY = '--registry'
-
-const DEFAULT = 'https://registry.npmjs.org'
+const REGISTRY = 'ht_registry'
 
 interface Check {
   readonly id: string
@@ -33,37 +31,17 @@ const CHECKS: readonly Check[] = [
     runs: 'thread gate',
     because: 'every step this tree declares, in the order it declares them, which is where the descent and the sweep are',
   },
-  {
-    id: 'lint',
-    runs: 'pnpm exec eslint .',
-    because: 'the rules that live on the lint surface, which is the only one carrying a fixer the sweep can report but not repair',
-  },
 ]
 
-const MINE = /^(?:npx |pnpm )?thread /
-
-function run(what: string, extra?: Record<string, string>): number {
-  const ours = MINE.exec(what)
-  if (ours !== null) {
-    const words = what.slice(ours[0].length).split(/\s+/).filter((one) => one !== '')
-    const ran = spawnSync(execPath, [...CLI, ...words], {
-      cwd: ROOT,
-      stdio: 'inherit',
-      timeout: STEP_TIMEOUT,
-      killSignal: 'SIGKILL',
-      env: extra === undefined ? env : { ...env, ...extra },
-    })
-    return ran.error !== undefined ? 1 : (ran.status ?? 1)
-  }
-  const result = spawnSync(what, {
-    shell: true,
-    cwd: ROOT,
-    stdio: 'inherit',
-    timeout: STEP_TIMEOUT,
-    killSignal: 'SIGKILL',
-    env: extra === undefined ? env : { ...env, ...extra },
-  })
-  return result.error !== undefined ? 1 : (result.status ?? 1)
+const PREFIX = /^(?:npx|pnpm)$/
+
+const words = (said: string): readonly string[] => said.split(/\s+/).filter((one) => one !== '')
+
+function run(given: readonly string[], extra?: Record<string, string>): number {
+  const mine = given[0] === 'thread' ? 1 : PREFIX.test(given[0] ?? '') && given[1] === 'thread' ? 2 : 0
+  const how = { at: ROOT, shows: true, within: STEP_TIMEOUT, holds: extra === undefined ? env : { ...env, ...extra } }
+  const went = mine === 0 ? starts(given[0] ?? '', given.slice(1), how) : starts(execPath, [...CLI, ...given.slice(mine)], how)
+  return went.there ? went.code : 1
 }
 
 function refuse(id: string, code: number, because: string, runs: string): never {
@@ -74,11 +52,10 @@ function refuse(id: string, code: number, because: string, runs: string): never
   exit(1)
 }
 
-const flag = argv.indexOf(REGISTRY)
-const registry = flag === -1 ? DEFAULT : (argv[flag + 1] ?? '')
+const given = argv.indexOf('--registry')
 
-if (registry === '' || registry.startsWith('-')) {
-  stderr.write(`thread publish ${REGISTRY} <url>   where the packages go. Leave it off for ${DEFAULT}.\n`)
+if (given !== -1) {
+  stderr.write('thread publish   takes no url. Where the packages go is the address on the ht_registry row in _threads/targets.ts.\n')
   stderr.write('\nit builds, then runs every check, then publishes. A check that fails publishes nothing.\n')
   exit(1)
 }
@@ -95,6 +72,18 @@ const declared = existsSync(secrets)
 
 const vaulted = declared.some((one) => one.id === TOKEN)
 
+const targets = inTree(TREE, 'targets.ts')
+
+const registry = placedAt(
+  existsSync(targets) ? ((valuesIn(readFileSync(targets)) as { TARGETS?: readonly Target[] }).TARGETS ?? []) : [],
+  REGISTRY,
+).replace(/[/]$/, '')
+
+if (registry === '') {
+  stderr.write('\npublish: no target row says where the registry is, so there is nowhere for these packages to go. Give ' + REGISTRY + ' an address in _threads/targets.ts, the absolute url of the registry. NOTHING was published.\n')
+  exit(1)
+}
+
 if (vaulted && !sealedIn(ROOT, PRODUCTION).includes(TOKEN)) {
   stderr.write(`\npublish: ${TOKEN} is declared in _threads/secrets.ts and has no value sealed for ${PRODUCTION}, so nothing was checked and NOTHING was published.\n`)
   stderr.write(`publish: run \`thread create secret set ${TOKEN}\` at a terminal and paste the registry token, or take the row out to publish with the login this machine holds.\n`)
@@ -129,7 +118,7 @@ stdout.write(
 
 stdout.write('publish: deriving and building what the packaging rows state first, so every check below reads the files this release ships rather than the source they were written from.\n')
 
-const made = run(`${TYPED} packaged --build`)
+const made = run(words(`${TYPED} packaged --build`))
 stdout.write(`publish: packaged exited ${String(made)}\n`)
 if (made !== 0) {
   refuse(
@@ -147,12 +136,12 @@ for (const [index, check] of CHECKS.entries()) {
   const at = `check ${String(index + 1)} of ${String(CHECKS.length)}`
   stdout.write(`\npublish: ${at} — ${check.runs} (${check.id})\n`)
 
-  const code = run(check.runs)
+  const code = run(words(check.runs))
   stdout.write(`publish: ${at} — exited ${String(code)}\n`)
   if (code !== 0) refuse(check.id, code, check.because, check.runs)
 }
 
-const numbered = run(`${TYPED} packaged --release`)
+const numbered = run(words(`${TYPED} packaged --release`))
 stdout.write(`publish: packaged --release exited ${String(numbered)}\n`)
 if (numbered !== 0) {
   refuse(
@@ -167,11 +156,11 @@ const handed = vaulted ? { [setting()]: await tokened() } : undefined
 
 stdout.write(`\npublish: every check passed. Publishing to ${registry} with ${vaulted ? `${TOKEN} from this repository's vault` : signedAs}.\n`)
 
-const sent = run(`pnpm -r publish --registry ${registry} --no-git-checks --access public`, handed)
+const sent = run(words(`pnpm -r publish --registry ${registry} --no-git-checks --access public`), handed)
 
 if (sent !== 0) {
   stderr.write(`\npublish: the checks passed and the publish itself exited ${String(sent)}.\n`)
-  const back = run(`${TYPED} packaged`)
+  const back = run(words(`${TYPED} packaged`))
   stderr.write(
     back === 0
       ? 'publish: the manifests carry the last recorded release again and no note was written, so the next `thread publish` numbers this release once more.\n'
@@ -180,7 +169,7 @@ if (sent !== 0) {
   exit(1)
 }
 
-const recorded = run(`${TYPED} packaged --record`)
+const recorded = run(words(`${TYPED} packaged --record`))
 stdout.write(`publish: packaged --record exited ${String(recorded)}\n`)
 if (recorded !== 0) {
   stderr.write(`\npublish: the packages went out and the note recording them refused to be written, so the next publish would number this release again. Run \`${TYPED} packaged --record\` and read what it says.\n`)
@@ -212,24 +201,24 @@ function versionAt(folder: string): string {
   }
 }
 
-function asked(what: readonly string[]): string {
-  return (spawnSync('git', what, { cwd: ROOT, encoding: 'utf8' }).stdout ?? '').trim()
-}
+const git = calls('cli_git', ROOT)
+
+const asked = async (what: readonly string[]): Promise<string> => (await git.rev_parse(what)).out.trim()
 
-if (asked(['rev-parse', '--is-inside-work-tree']) !== 'true') {
+if ((await asked(['--is-inside-work-tree'])) !== 'true') {
   stdout.write("\npublish: it's not a repo, so nothing was committed.\n")
 } else if (shipped.length === 0) {
   stdout.write('\npublish: no packaging row names a folder, so there is nothing derived here to commit.\n')
 } else {
   const going = shipped.map((one) => `${named(one.id ?? '')} ${versionAt(one.folder ?? '')}`).join(', ')
-  const branch = asked(['rev-parse', '--abbrev-ref', 'HEAD'])
+  const branch = await asked(['--abbrev-ref', 'HEAD'])
 
-  for (const one of shipped) run(`git add ${one.folder ?? ''}`)
+  for (const one of shipped) await git.stage([one.folder ?? ''], true, STEP_TIMEOUT)
 
-  if (spawnSync('git', ['diff', '--cached', '--quiet'], { cwd: ROOT }).status === 0) {
+  if ((await git.diff(['--cached', '--quiet'])).ok) {
     stdout.write(`\npublish: ${going} — what is on disk is already what is committed, so this release added no artifact.\n`)
   } else {
-    const wrote = run(`git commit -m ${JSON.stringify(`thread publish — ${going}`)}`)
+    const wrote = (await git.commit(['-m', `thread publish — ${going}`], true, STEP_TIMEOUT)).code
     stdout.write(`publish: commit exited ${String(wrote)}\n`)
     if (wrote !== 0) {
       stderr.write('\npublish: the packages went out and the files that describe them are not committed, so this release has no record in git.\n')
@@ -240,5 +229,5 @@ if (asked(['rev-parse', '--is-inside-work-tree']) !== 'true') {
   }
 }
 
-stdout.write(`\npublish: done. What went out was derived, then built, then passed the gate and the lint, in that order. The compile inside \`thread packaged --build\` is the typecheck.\n`)
+stdout.write(`\npublish: done. What went out was derived, then built, then passed the gate, in that order. The compile inside \`thread packaged --build\` is the typecheck.\n`)
 exit(0)