@prestack/thread 0.1.3 → 0.1.5

package/dist/integrity/slopnators/sl_secret_literal.js

@@ -1,10 +1,3 @@
-/*
- * Credentials that announce themselves.
- *
- * A vendor prefix is the one thing here that is certain rather than probable: nothing else in a
- * source file begins `sk_live_` or `AKIA` followed by twenty characters. These are matched on their
- * own, with no need to look at what they were assigned to.
- */
 const ANNOUNCED = [
     { what: 'a Stripe secret key', pattern: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}/ },
     { what: 'a Stripe restricted key', pattern: /\brk_(?:live|test)_[A-Za-z0-9]{16,}/ },
@@ -19,24 +12,8 @@ const ANNOUNCED = [
     { what: 'a private key', pattern: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/ },
     { what: 'a password inside a connection string', pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]{6,}@/ },
 ];
-/*
- * A value that does not announce itself, read off what it was called.
- *
- * Needs both halves — a name that means credential AND something long enough and mixed enough to be
- * one. Either alone is noise: `const key = 'id'` is a map key, and a long opaque string is as likely
- * to be a hash, a path or a fixture. `process.env.X`, an import, a template hole and a reference to
- * a declared row are all values rather than literals and are not matched at all.
- */
 const NAMED = /\b(?:secret|password|passwd|api_?key|apikey|access_?token|auth_?token|private_?key|client_?secret|credential)s?\b\s*[:=]\s*(['"`])([^'"`\n]{16,})\1/gi;
 const MIXED = /^(?=.*[a-z])(?=.*[A-Z0-9])[A-Za-z0-9_+/=.-]{16,}$/;
-/*
- * What is deliberately NOT a finding.
- *
- * A secret this app declares is a NAME, and naming one is the whole remedy this law recommends — so
- * `sec_stripe_key` sitting in a row, a `requires`, or a call to the vault must never be the thing
- * that trips it. The same for an environment variable, which is a value read at run time rather than
- * a value written down, and for the obvious placeholders people write while wiring something up.
- */
 const NOT = [
     /^(?:sec|pub)_[a-z0-9_]+$/,
     /^\$\{/,
@@ -47,13 +24,6 @@ export const slopnator = {
     holds: (_node, at) => {
         if (!CODE.test(at.filename))
             return false;
-        /*
-         * The sealed store is ciphertext and is meant to be here.
-         *
-         * It is base64 by construction, so the entropy half below would find every value in it — and
-         * the fix it would recommend is the thing the file already is. A law whose refusal has no honest
-         * remedy is one people learn to ignore.
-         */
         if (/(?:^|\/)\.thread\/vault\.sealed\.json$/.test(at.filename))
             return false;
         const text = String(at.text);
@@ -76,14 +46,12 @@ export const slopnator = {
     },
     proves: {
         wrong: [
-            "export const stripe = { apiKey: 'sk_live_51H8xQvL2eZvKYlo2C0Nx9K4mQwErTyUiOp' }\n",
             "const config = { password: 'Hunter2Hunter2Hunter2' }\n",
             "export const db = 'postgres://app:s3cr3tpassword@db.example.com:5432/main'\n",
         ],
         right: [
             "export const stripe = { apiKey: 'sec_stripe_key' }\n",
-            "const config = { password: process.env['DB_PASSWORD'] }\n",
-            "export const node = nd_action(async (hands) => await hands.ht_stripe.charge({ json: { amount: 100 } }))\n",
+            "export const node = nd_action(async (opened) => await opened.ht_stripe.charge({ json: { amount: 100 } }))\n",
         ],
     },
 };

package/dist/integrity/slopnators/sl_secret_literal.ts

@@ -1,12 +1,5 @@
 import type { Slopnator } from '../slopnator.ts'
 
-/*
- * Credentials that announce themselves.
- *
- * A vendor prefix is the one thing here that is certain rather than probable: nothing else in a
- * source file begins `sk_live_` or `AKIA` followed by twenty characters. These are matched on their
- * own, with no need to look at what they were assigned to.
- */
 const ANNOUNCED: readonly { readonly what: string; readonly pattern: RegExp }[] = [
   { what: 'a Stripe secret key', pattern: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}/ },
   { what: 'a Stripe restricted key', pattern: /\brk_(?:live|test)_[A-Za-z0-9]{16,}/ },
@@ -22,26 +15,10 @@ const ANNOUNCED: readonly { readonly what: string; readonly pattern: RegExp }[]
   { what: 'a password inside a connection string', pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]{6,}@/ },
 ]
 
-/*
- * A value that does not announce itself, read off what it was called.
- *
- * Needs both halves — a name that means credential AND something long enough and mixed enough to be
- * one. Either alone is noise: `const key = 'id'` is a map key, and a long opaque string is as likely
- * to be a hash, a path or a fixture. `process.env.X`, an import, a template hole and a reference to
- * a declared row are all values rather than literals and are not matched at all.
- */
 const NAMED = /\b(?:secret|password|passwd|api_?key|apikey|access_?token|auth_?token|private_?key|client_?secret|credential)s?\b\s*[:=]\s*(['"`])([^'"`\n]{16,})\1/gi
 
 const MIXED = /^(?=.*[a-z])(?=.*[A-Z0-9])[A-Za-z0-9_+/=.-]{16,}$/
 
-/*
- * What is deliberately NOT a finding.
- *
- * A secret this app declares is a NAME, and naming one is the whole remedy this law recommends — so
- * `sec_stripe_key` sitting in a row, a `requires`, or a call to the vault must never be the thing
- * that trips it. The same for an environment variable, which is a value read at run time rather than
- * a value written down, and for the obvious placeholders people write while wiring something up.
- */
 const NOT = [
   /^(?:sec|pub)_[a-z0-9_]+$/,
   /^\$\{/,
@@ -54,13 +31,6 @@ export const slopnator: Slopnator = {
   holds: (_node, at) => {
     if (!CODE.test(at.filename)) return false
 
-    /*
-     * The sealed store is ciphertext and is meant to be here.
-     *
-     * It is base64 by construction, so the entropy half below would find every value in it — and
-     * the fix it would recommend is the thing the file already is. A law whose refusal has no honest
-     * remedy is one people learn to ignore.
-     */
     if (/(?:^|\/)\.thread\/vault\.sealed\.json$/.test(at.filename)) return false
 
     const text = String(at.text)
@@ -87,14 +57,12 @@ export const slopnator: Slopnator = {
   },
   proves: {
     wrong: [
-      "export const stripe = { apiKey: 'sk_live_51H8xQvL2eZvKYlo2C0Nx9K4mQwErTyUiOp' }\n",
       "const config = { password: 'Hunter2Hunter2Hunter2' }\n",
       "export const db = 'postgres://app:s3cr3tpassword@db.example.com:5432/main'\n",
     ],
     right: [
       "export const stripe = { apiKey: 'sec_stripe_key' }\n",
-      "const config = { password: process.env['DB_PASSWORD'] }\n",
-      "export const node = nd_action(async (hands) => await hands.ht_stripe.charge({ json: { amount: 100 } }))\n",
+      "export const node = nd_action(async (opened) => await opened.ht_stripe.charge({ json: { amount: 100 } }))\n",
     ],
   },
 }

package/dist/integrity/slopnators/sl_stale_path.js

@@ -1,28 +1,11 @@
-import { existsSync, readdirSync, statSync } from "../../core/files.js";
+import { existsSync, readdirSync, statSync } from '../../integrations/disk.js';
 import { resolve } from 'node:path';
-import { descend } from "../../core/descend.js";
-import { findTree } from "../../core/tree.js";
+import { descend } from '../../core/descend.js';
+import { findTree } from '../../core/tree.js';
 const ROOT = findTree().at;
 const TREE = findTree().name;
 const canonical = (at) => (at.startsWith('threads/') ? `${TREE}/${at.slice('threads/'.length)}` : at);
 const NAMES_A_FILE = /\.[a-z]{1,5}$/;
-/*
- * A FILE A GENERATOR WRITES IS ABSENT UNTIL THE GENERATOR HAS RUN, AND THAT IS NOT A STALE PATH.
- *
- * This law and the descent disagreed about the same file, and the descent was right. A row carrying
- * `by:` names a file a command writes; the descent reports it missing as a WARNING for exactly that
- * reason — "a derived file is absent until it is derived". This read the same path with a bare
- * `existsSync` and refused it, with advice — "fix the path, or delete the sentence naming it" —
- * that would have deleted a correct declaration.
- *
- * Measured 2026-08-29 on a real install: `thread init`, `thread attach @thread/integrations`,
- * `thread gate`, and the sweep was red on `_threads/glossary.ts` — a file `thread glossary` writes,
- * on the first gate run of an app whose author had written nothing. Every other check in that gate
- * answers this state by saying there is nothing to check yet.
- *
- * Read off the tree rather than guessed from the text. The descent already knows which rows carry a
- * `by`, so the two can no longer come apart, and a path nothing derives is refused exactly as before.
- */
 const derived = (() => {
     const found = new Set();
     try {
@@ -36,7 +19,6 @@ const derived = (() => {
                 found.add(one.at);
     }
     catch {
-        /* A tree that cannot be descended is reported by the descent's own step, not swallowed here. */
     }
     return found;
 })();
@@ -49,6 +31,7 @@ const ours = () => {
     }
 };
 const named = (one) => one.key?.name ?? (typeof one.key?.value === 'string' ? one.key.value : undefined);
+const sourced = (properties) => properties.some((one) => named(one) === 'source');
 function proving(ancestors) {
     for (let at = ancestors.length - 1; at >= 0; at -= 1) {
         const held = ancestors[at];
@@ -57,7 +40,7 @@ function proving(ancestors) {
         const properties = held.properties ?? [];
         const files = properties.some((one) => named(one) === 'files' && one.value?.type === 'ArrayExpression');
         const where = properties.some((one) => named(one) === 'at' && one.value?.type === 'Literal');
-        if (files && where)
+        if (where && (files || sourced(properties)))
             return true;
     }
     return false;

package/dist/integrity/slopnators/sl_stale_path.ts

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, statSync } from '../../core/files.ts'
+import { existsSync, readdirSync, statSync } from '../../integrations/disk.ts'
 import { resolve } from 'node:path'
 
 import type { Slopnator } from '../slopnator.ts'
@@ -10,23 +10,6 @@ const TREE = findTree().name
 const canonical = (at: string): string => (at.startsWith('threads/') ? `${TREE}/${at.slice('threads/'.length)}` : at)
 const NAMES_A_FILE = /\.[a-z]{1,5}$/
 
-/*
- * A FILE A GENERATOR WRITES IS ABSENT UNTIL THE GENERATOR HAS RUN, AND THAT IS NOT A STALE PATH.
- *
- * This law and the descent disagreed about the same file, and the descent was right. A row carrying
- * `by:` names a file a command writes; the descent reports it missing as a WARNING for exactly that
- * reason — "a derived file is absent until it is derived". This read the same path with a bare
- * `existsSync` and refused it, with advice — "fix the path, or delete the sentence naming it" —
- * that would have deleted a correct declaration.
- *
- * Measured 2026-08-29 on a real install: `thread init`, `thread attach @thread/integrations`,
- * `thread gate`, and the sweep was red on `_threads/glossary.ts` — a file `thread glossary` writes,
- * on the first gate run of an app whose author had written nothing. Every other check in that gate
- * answers this state by saying there is nothing to check yet.
- *
- * Read off the tree rather than guessed from the text. The descent already knows which rows carry a
- * `by`, so the two can no longer come apart, and a path nothing derives is refused exactly as before.
- */
 const derived = ((): ReadonlySet<string> => {
   const found = new Set<string>()
   try {
@@ -36,7 +19,6 @@ const derived = ((): ReadonlySet<string> => {
     }
     for (const one of pass.derived.values()) if (one.at !== undefined) found.add(one.at)
   } catch {
-    /* A tree that cannot be descended is reported by the descent's own step, not swallowed here. */
   }
   return found
 })()
@@ -62,6 +44,8 @@ interface Keyed {
 
 const named = (one: Keyed): string | undefined => one.key?.name ?? (typeof one.key?.value === 'string' ? one.key.value : undefined)
 
+const sourced = (properties: readonly Keyed[]): boolean => properties.some((one) => named(one) === 'source')
+
 function proving(ancestors: readonly unknown[]): boolean {
   for (let at = ancestors.length - 1; at >= 0; at -= 1) {
     const held = ancestors[at] as Keyed
@@ -69,7 +53,7 @@ function proving(ancestors: readonly unknown[]): boolean {
     const properties = held.properties ?? []
     const files = properties.some((one) => named(one) === 'files' && one.value?.type === 'ArrayExpression')
     const where = properties.some((one) => named(one) === 'at' && one.value?.type === 'Literal')
-    if (files && where) return true
+    if (where && (files || sourced(properties))) return true
   }
   return false
 }

package/dist/integrity/slopnators/sl_twice_meant.js

@@ -1,4 +1,4 @@
-import { here, index, meaningsIn, parses, unreadable } from "./sl_unthreaded.js";
+import { here, index, meaningsIn, parses, unreadable } from './sl_unthreaded.js';
 export const slopnator = {
     holds: (_node, at) => {
         const path = here(at.filename);

package/dist/integrity/slopnators/sl_twice_parented.js

@@ -1,4 +1,4 @@
-import { atsIn, canonical, here, index, parses, unreadable } from "./sl_unthreaded.js";
+import { atsIn, canonical, here, index, parses, unreadable } from './sl_unthreaded.js';
 const ONLY_DECLARES = new Set(['declares']);
 const declaredIn = (text) => atsIn(text, ONLY_DECLARES).map(canonical);
 export const slopnator = {
@@ -45,11 +45,35 @@ export const slopnator = {
             },
         ],
         right: [
-            "const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/one.ts',\n    },\n    {\n      at: 'threads/two.ts',\n    },\n  ],\n}",
-            "const M: Threaded = {\n  derives: [\n    {\n      at: 'threads/one.ts',\n    },\n    {\n      at: 'threads/one.ts',\n    },\n  ],\n}",
+            {
+                files: [
+                    { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly by?: string\n  readonly runs?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+                    { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_derived.ts',\n    },\n  ],\n}\n" },
+                    { at: 'threads/_probe_derived.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const M: Threaded = {\n  derives: [\n    {\n      at: 'threads/glossary.ts',\n      by: 'thread glossary',\n      runs: 'thread glossary --check',\n    },\n    {\n      at: 'threads/glossary.ts',\n      by: 'thread glossary',\n      runs: 'thread glossary --check',\n    },\n  ],\n}\n" },
+                    { at: 'threads/glossary.ts', source: 'export const GLOSSARY = 1\n' },
+                ],
+                at: 'threads/_probe_derived.ts',
+            },
             'const M = { declares: [] }',
-            "const ROW = {\n  at: 'threads/one.ts',\n}\nconst M: Threaded = {\n  declares: [ROW],\n}",
-            "const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/one.ts',\n      declares: [\n        {\n          at: 'threads/two.ts',\n        },\n      ],\n    },\n  ],\n}",
+            {
+                files: [
+                    { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+                    { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_hoisted.ts',\n    },\n  ],\n}\n" },
+                    { at: 'threads/_probe_hoisted.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nconst ROW = {\n  at: 'threads/core.ts',\n}\nexport const M: Threaded = {\n  declares: [ROW],\n}\n" },
+                    { at: 'threads/core.ts', source: 'export const CORE = 1\n' },
+                ],
+                at: 'threads/_probe_hoisted.ts',
+            },
+            {
+                files: [
+                    { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+                    { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_nested.ts',\n    },\n  ],\n}\n" },
+                    { at: 'threads/_probe_nested.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/core.ts',\n      declares: [\n        {\n          at: 'threads/data.ts',\n        },\n      ],\n    },\n  ],\n}\n" },
+                    { at: 'threads/core.ts', source: 'export const CORE = 1\n' },
+                    { at: 'threads/data.ts', source: 'export const DATA = 1\n' },
+                ],
+                at: 'threads/_probe_nested.ts',
+            },
         ],
     },
 };

package/dist/integrity/slopnators/sl_twice_parented.ts

@@ -48,11 +48,35 @@ export const slopnator: Slopnator = {
     },
     ],
     right: [
-      "const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/one.ts',\n    },\n    {\n      at: 'threads/two.ts',\n    },\n  ],\n}",
-      "const M: Threaded = {\n  derives: [\n    {\n      at: 'threads/one.ts',\n    },\n    {\n      at: 'threads/one.ts',\n    },\n  ],\n}",
+      {
+        files: [
+          { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly by?: string\n  readonly runs?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+          { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_derived.ts',\n    },\n  ],\n}\n" },
+          { at: 'threads/_probe_derived.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const M: Threaded = {\n  derives: [\n    {\n      at: 'threads/glossary.ts',\n      by: 'thread glossary',\n      runs: 'thread glossary --check',\n    },\n    {\n      at: 'threads/glossary.ts',\n      by: 'thread glossary',\n      runs: 'thread glossary --check',\n    },\n  ],\n}\n" },
+          { at: 'threads/glossary.ts', source: 'export const GLOSSARY = 1\n' },
+        ],
+        at: 'threads/_probe_derived.ts',
+      },
       'const M = { declares: [] }',
-      "const ROW = {\n  at: 'threads/one.ts',\n}\nconst M: Threaded = {\n  declares: [ROW],\n}",
-      "const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/one.ts',\n      declares: [\n        {\n          at: 'threads/two.ts',\n        },\n      ],\n    },\n  ],\n}",
+      {
+        files: [
+          { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+          { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_hoisted.ts',\n    },\n  ],\n}\n" },
+          { at: 'threads/_probe_hoisted.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nconst ROW = {\n  at: 'threads/core.ts',\n}\nexport const M: Threaded = {\n  declares: [ROW],\n}\n" },
+          { at: 'threads/core.ts', source: 'export const CORE = 1\n' },
+        ],
+        at: 'threads/_probe_hoisted.ts',
+      },
+      {
+        files: [
+          { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+          { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_nested.ts',\n    },\n  ],\n}\n" },
+          { at: 'threads/_probe_nested.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const M: Threaded = {\n  declares: [\n    {\n      at: 'threads/core.ts',\n      declares: [\n        {\n          at: 'threads/data.ts',\n        },\n      ],\n    },\n  ],\n}\n" },
+          { at: 'threads/core.ts', source: 'export const CORE = 1\n' },
+          { at: 'threads/data.ts', source: 'export const DATA = 1\n' },
+        ],
+        at: 'threads/_probe_nested.ts',
+      },
     ],
   },
 }

package/dist/integrity/slopnators/sl_undeclared_crossing.d.ts

@@ -1,2 +1,5 @@
-import type { Slopnator } from '../slopnator.ts';
+import type { Slopnator, SlopnatorContext } from '../slopnator.ts';
+export declare const DOORWAY = "door";
+export declare const HANDED_TO = "hand";
+export declare function judging(at: SlopnatorContext, wanted: string, closing: string): string | false;
 export declare const slopnator: Slopnator;