@prestack/thread 0.1.3 → 0.1.5

package/dist/integrity/slopnators/sl_unpaired_member.js

@@ -1,7 +1,7 @@
-import { existsSync, readFileSync, readdirSync } from "../../core/files.js";
+import { existsSync, readFileSync, readdirSync } from '../../integrations/disk.js';
 import { resolve } from 'node:path';
-import { foldersGoverned, here, islandsDeclared, rowsIn } from "./sl_unthreaded.js";
-import { findTree } from "../../core/tree.js";
+import { foldersGoverned, here, islandsDeclared, rowsIn } from './sl_unthreaded.js';
+import { findTree } from '../../core/tree.js';
 const ROOT = findTree().at;
 const TREE = `${findTree().name}/`;
 const seeding = (one) => {

package/dist/integrity/slopnators/sl_unpaired_member.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, readdirSync } from '../../core/files.ts'
+import { existsSync, readFileSync, readdirSync } from '../../integrations/disk.ts'
 import { resolve } from 'node:path'
 
 import type { Sourced } from '../constraint.ts'

package/dist/integrity/slopnators/sl_unpaired_slopnator.js

@@ -1,8 +1,8 @@
-import { existsSync, readFileSync } from "../../core/files.js";
+import { existsSync, readFileSync } from '../../integrations/disk.js';
 import { join, resolve } from 'node:path';
-import { SEEDED, SHIPPED, slopnatorName } from "../slopnator.js";
-import { here } from "./sl_unthreaded.js";
-import { findTree } from "../../core/tree.js";
+import { SEEDED, SHIPPED, slopnatorName } from '../slopnator.js';
+import { here } from './sl_unthreaded.js';
+import { findTree } from '../../core/tree.js';
 const ROOT = findTree().at;
 const TREE = `${findTree().name}/`;
 const ID = /^ {4}id:\s*'([^']+)'/gm;

package/dist/integrity/slopnators/sl_unpaired_slopnator.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from '../../core/files.ts'
+import { existsSync, readFileSync } from '../../integrations/disk.ts'
 import { join, resolve } from 'node:path'
 
 import { SEEDED, SHIPPED, slopnatorName, type Slopnator } from '../slopnator.ts'

package/dist/integrity/slopnators/sl_unprefixed_member.js

@@ -1,38 +1,12 @@
-import { inCode, listBounds, matched } from "../../core/rows.js";
-import { PREFIXES } from "../../core/thread.js";
-import { here, parses, unreadable } from "./sl_unthreaded.js";
+import { inCode, listBounds, matched } from '../../core/rows.js';
+import { PREFIXES } from '../../core/thread.js';
+import { here, parses, unreadable } from './sl_unthreaded.js';
 const MEMBERS = 'MEMBERS';
-/*
- * Which prefixes a tree file's member list may hold.
- *
- * The file is the key because the list is named the same in both: `MEMBERS` in the operations tree
- * holds what an app can be asked to do, and `MEMBERS` in the nodes tree holds the spans an operation
- * is built from. Nothing in TypeScript separates them — both are arrays of rows carrying a string id
- * — so an operation declared among the nodes, or a node among the operations, typechecks, attaches,
- * seeds a body and reads as agreed by everything downstream.
- *
- * What an operation may wear is not written here. `@thread/core/thread` pairs each word an
- * operation can be with the prefix its id takes, and `thread create` puts that prefix on — so the
- * command that makes them and the law that refuses them read one list. Written out again here,
- * a kind added over there would be a kind this refuses.
- */
 const TAKES = {
     'operations.ts': Object.values(PREFIXES),
-    'nodes.ts': ['nd_', 'sm_'],
+    'nodes.ts': ['nd_'],
 };
 const ID = /\bid:\s*'((?:[^'\\]|\\.)*)'/;
-/*
- * The id of every row sitting directly in the list, and no deeper.
- *
- * Depth is the whole of it: a member row states its own id, and the `seeds` and `derives` rows under
- * it state theirs, which are neither operations nor nodes — `wf_send_invoice_body` is a body, not
- * something an app can be asked to do. Reading every id in the list would refuse those children for
- * lacking a prefix they were never meant to wear.
- *
- * The braces are read off `inCode`, not off the raw text. Counting characters directly desynced on a
- * `describes:` holding a brace, and this package already ships the mask and the matcher for exactly
- * that — a second, weaker walker beside them is the drift they exist to prevent.
- */
 function directly(text, open, close) {
     const code = inCode(text);
     const found = [];
@@ -107,7 +81,7 @@ export const slopnator = {
                 files: [
                     {
                         at: '_threads/operations.ts',
-                        source: "import type { Member, Threaded } from '../../core/thread.ts'\n\nexport const OPERATIONS: Threaded = {\n  id: 'operations',\n  at: '_threads/operations.ts',\n  describes: 'what an app can be asked to do',\n  version: 1,\n}\n\nexport const MEMBERS: readonly Member[] = [\n  {\n    id: 'wf_send_invoice',\n    at: '_threads/operations.ts',\n    describes: 'sends an invoice',\n    version: 1,\n    seeds: [\n      {\n        id: 'wf_send_invoice_body',\n        at: 'operations/wf_send_invoice.ts',\n        describes: 'the operation itself',\n      },\n    ],\n  },\n]\n",
+                        source: "import type { Member, Threaded } from '../../core/thread.ts'\n\nexport const OPERATIONS: Threaded = {\n  id: 'operations',\n  at: '_threads/operations.ts',\n  describes: 'what an app can be asked to do',\n  version: 1,\n}\n\nexport const MEMBERS: readonly Member[] = [\n  {\n    id: 'wf_prestack_client',\n    at: '_threads/operations.ts',\n    describes: 'sends what you typed to the agent',\n    version: 1,\n    seeds: [\n      {\n        id: 'wf_prestack_client_body',\n        at: 'operations/wf_prestack_client.ts',\n        describes: 'the operation itself',\n      },\n    ],\n  },\n]\n",
                     },
                 ],
                 at: '_threads/operations.ts',

package/dist/integrity/slopnators/sl_unprefixed_member.ts

@@ -6,39 +6,13 @@ import { here, parses, unreadable } from './sl_unthreaded.ts'
 
 const MEMBERS = 'MEMBERS'
 
-/*
- * Which prefixes a tree file's member list may hold.
- *
- * The file is the key because the list is named the same in both: `MEMBERS` in the operations tree
- * holds what an app can be asked to do, and `MEMBERS` in the nodes tree holds the spans an operation
- * is built from. Nothing in TypeScript separates them — both are arrays of rows carrying a string id
- * — so an operation declared among the nodes, or a node among the operations, typechecks, attaches,
- * seeds a body and reads as agreed by everything downstream.
- *
- * What an operation may wear is not written here. `@thread/core/thread` pairs each word an
- * operation can be with the prefix its id takes, and `thread create` puts that prefix on — so the
- * command that makes them and the law that refuses them read one list. Written out again here,
- * a kind added over there would be a kind this refuses.
- */
 const TAKES: Readonly<Record<string, readonly string[]>> = {
   'operations.ts': Object.values(PREFIXES),
-  'nodes.ts': ['nd_', 'sm_'],
+  'nodes.ts': ['nd_'],
 }
 
 const ID = /\bid:\s*'((?:[^'\\]|\\.)*)'/
 
-/*
- * The id of every row sitting directly in the list, and no deeper.
- *
- * Depth is the whole of it: a member row states its own id, and the `seeds` and `derives` rows under
- * it state theirs, which are neither operations nor nodes — `wf_send_invoice_body` is a body, not
- * something an app can be asked to do. Reading every id in the list would refuse those children for
- * lacking a prefix they were never meant to wear.
- *
- * The braces are read off `inCode`, not off the raw text. Counting characters directly desynced on a
- * `describes:` holding a brace, and this package already ships the mask and the matcher for exactly
- * that — a second, weaker walker beside them is the drift they exist to prevent.
- */
 function directly(text: string, open: number, close: number): readonly string[] {
   const code = inCode(text)
   const found: string[] = []
@@ -116,7 +90,7 @@ export const slopnator: Slopnator = {
           {
             at: '_threads/operations.ts',
             source:
-              "import type { Member, Threaded } from '../../core/thread.ts'\n\nexport const OPERATIONS: Threaded = {\n  id: 'operations',\n  at: '_threads/operations.ts',\n  describes: 'what an app can be asked to do',\n  version: 1,\n}\n\nexport const MEMBERS: readonly Member[] = [\n  {\n    id: 'wf_send_invoice',\n    at: '_threads/operations.ts',\n    describes: 'sends an invoice',\n    version: 1,\n    seeds: [\n      {\n        id: 'wf_send_invoice_body',\n        at: 'operations/wf_send_invoice.ts',\n        describes: 'the operation itself',\n      },\n    ],\n  },\n]\n",
+              "import type { Member, Threaded } from '../../core/thread.ts'\n\nexport const OPERATIONS: Threaded = {\n  id: 'operations',\n  at: '_threads/operations.ts',\n  describes: 'what an app can be asked to do',\n  version: 1,\n}\n\nexport const MEMBERS: readonly Member[] = [\n  {\n    id: 'wf_prestack_client',\n    at: '_threads/operations.ts',\n    describes: 'sends what you typed to the agent',\n    version: 1,\n    seeds: [\n      {\n        id: 'wf_prestack_client_body',\n        at: 'operations/wf_prestack_client.ts',\n        describes: 'the operation itself',\n      },\n    ],\n  },\n]\n",
           },
         ],
         at: '_threads/operations.ts',

package/dist/integrity/slopnators/sl_unthreaded.js

@@ -1,6 +1,6 @@
 import { parser } from 'typescript-eslint';
-import { LISTS as LINEAGE, descend, forget as forgetDescent, read, reached as fromThread, threading } from "../../core/descend.js";
-import { findTree } from "../../core/tree.js";
+import { LISTS as LINEAGE, descend, forget as forgetDescent, read, reached as fromThread, threading } from '../../core/descend.js';
+import { findTree } from '../../core/tree.js';
 const TREE_AT = findTree();
 const ROOT = `${TREE_AT.at.split('\\').join('/')}/`;
 const TREE = TREE_AT.name;
@@ -11,7 +11,6 @@ let threaders;
 let tree;
 const parsed = new Map();
 const broke = new Map();
-const SAID = new Set(['at', 'id', 'describes']);
 const keyOf = (property) => {
     if (property.computed === true)
         return undefined;
@@ -38,13 +37,13 @@ function rows(node, list, found, hoisted) {
         const element = one?.type === 'Identifier' && one.name !== undefined ? hoisted.get(one.name) : one;
         if (element === null || element === undefined || element.type !== 'ObjectExpression')
             continue;
+        const strings = {};
         const said = {};
         for (const property of element.properties ?? []) {
             const key = keyOf(property);
             const held = property.value;
-            if (key !== undefined && SAID.has(key) && held?.type === 'Literal' && typeof held.value === 'string') {
-                said[key] = held.value;
-            }
+            if (key !== undefined && held?.type === 'Literal' && typeof held.value === 'string')
+                strings[key] = held.value;
             if ((key === 'governs' || key === 'wears') && held?.type === 'ArrayExpression') {
                 said[key] = (held.elements ?? [])
                     .map((one) => (one?.type === 'Literal' && typeof one.value === 'string' ? one.value : undefined))
@@ -53,6 +52,12 @@ function rows(node, list, found, hoisted) {
             if (key !== undefined && LISTS.has(key) && held?.type === 'ArrayExpression')
                 rows(held, key, found, hoisted);
         }
+        if (strings['at'] !== undefined)
+            said.at = strings['at'];
+        if (strings['id'] !== undefined)
+            said.id = strings['id'];
+        if (strings['describes'] !== undefined)
+            said.describes = strings['describes'];
         if (said.at !== undefined || said.id !== undefined)
             found.push({ list, ...said });
     }
@@ -335,7 +340,6 @@ export const slopnator = {
             },
         ],
         right: [
-            "export const HELD: Threaded = {\n  declares: [\n    {\n      at: 'threads/probe.tsx',\n    },\n  ],\n}",
             {
                 files: [
                     { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },

package/dist/integrity/slopnators/sl_unthreaded.ts

@@ -1,4 +1,4 @@
-import { readFileSync } from '../../core/files.ts'
+import { readFileSync } from '../../integrations/disk.ts'
 import { resolve } from 'node:path'
 
 import { parser } from 'typescript-eslint'
@@ -35,8 +35,6 @@ export interface Meaning {
   readonly describes: string
 }
 
-const SAID = new Set(['at', 'id', 'describes'])
-
 interface Held {
   readonly type?: string
   readonly kind?: string
@@ -83,13 +81,12 @@ function rows(node: Held, list: Reach['list'], found: Reach[], hoisted: Readonly
   for (const one of node.elements ?? []) {
     const element = one?.type === 'Identifier' && one.name !== undefined ? hoisted.get(one.name) : one
     if (element === null || element === undefined || element.type !== 'ObjectExpression') continue
+    const strings: Record<string, string> = {}
     const said: { at?: string; id?: string; describes?: string; governs?: readonly string[]; wears?: readonly string[] } = {}
     for (const property of element.properties ?? []) {
       const key = keyOf(property)
       const held = property.value as Held | undefined
-      if (key !== undefined && SAID.has(key) && held?.type === 'Literal' && typeof held.value === 'string') {
-        said[key as 'at' | 'id' | 'describes'] = held.value
-      }
+      if (key !== undefined && held?.type === 'Literal' && typeof held.value === 'string') strings[key] = held.value
       if ((key === 'governs' || key === 'wears') && held?.type === 'ArrayExpression') {
         said[key] = (held.elements ?? [])
           .map((one) => (one?.type === 'Literal' && typeof one.value === 'string' ? one.value : undefined))
@@ -97,6 +94,9 @@ function rows(node: Held, list: Reach['list'], found: Reach[], hoisted: Readonly
       }
       if (key !== undefined && LISTS.has(key) && held?.type === 'ArrayExpression') rows(held, key as Reach['list'], found, hoisted)
     }
+    if (strings['at'] !== undefined) said.at = strings['at']
+    if (strings['id'] !== undefined) said.id = strings['id']
+    if (strings['describes'] !== undefined) said.describes = strings['describes']
     if (said.at !== undefined || said.id !== undefined) found.push({ list, ...said })
   }
 }
@@ -402,7 +402,6 @@ export const slopnator: Slopnator = {
       },
     ],
     right: [
-      "export const HELD: Threaded = {\n  declares: [\n    {\n      at: 'threads/probe.tsx',\n    },\n  ],\n}",
       {
         files: [
           { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },

package/dist/integrity/slopnators/sl_untranslated_key.js

@@ -1,31 +1,8 @@
-import { existsSync, readFileSync, readdirSync } from "../../core/files.js";
+import { existsSync, readFileSync, readdirSync } from '../../integrations/disk.js';
 import { join } from 'node:path';
-import { named as packageOf } from "../../core/scope.js";
-/*
- * A KEY THE INTERFACE NAMES AND A LANGUAGE DOES NOT ANSWER.
- *
- *   "i18n keys must be translated OR ITS AN ERROR ... a new constraint.ts row and slopnator that
- *    checks i18n entries against the keys in the UI and if there's anything missing in whatever
- *    file, it's a build error, compile error, gate error, everything. Cannot be allowed."
- *                                                            — founder, 2026-08-29
- *
- * The generator already writes a line into every language file for every key it finds, so a key is
- * never structurally absent — what it cannot do is invent the sentence. This is the half that
- * refuses: a line holding nothing is a key nobody has answered, and an app that ships one shows a
- * person an empty button.
- *
- * Deliberately independent of the generator rather than calling it. A check that runs the thing it
- * is checking passes whenever that thing passes, which is no check at all — this reads the files
- * that are actually on disk and compares them to the markup that is actually there.
- */
+import { named as packageOf } from '../../core/scope.js';
 const SKIP = new Set(['node_modules', '.next', '.git', 'dist', '_generated']);
 const CODE = /\.(tsx?|jsx?)$/;
-/*
- * Which props carry a key, read off the installed package's own declarations.
- *
- * A list written here would go stale the first time an element gained a prop — silently, by finding
- * fewer keys than there are, which is the failure this whole law exists to prevent.
- */
 const TYPED = /readonly\s+([A-Za-z][A-Za-z0-9]*)\??\s*:\s*MessageKey\b/g;
 function walk(at, found = []) {
     let entries;

package/dist/integrity/slopnators/sl_untranslated_key.ts

@@ -1,37 +1,13 @@
-import { existsSync, readFileSync, readdirSync } from '../../core/files.ts'
+import { existsSync, readFileSync, readdirSync } from '../../integrations/disk.ts'
 import { join } from 'node:path'
 
 import type { Slopnator } from '../slopnator.ts'
 import { named as packageOf } from '../../core/scope.ts'
 
-/*
- * A KEY THE INTERFACE NAMES AND A LANGUAGE DOES NOT ANSWER.
- *
- *   "i18n keys must be translated OR ITS AN ERROR ... a new constraint.ts row and slopnator that
- *    checks i18n entries against the keys in the UI and if there's anything missing in whatever
- *    file, it's a build error, compile error, gate error, everything. Cannot be allowed."
- *                                                            — founder, 2026-08-29
- *
- * The generator already writes a line into every language file for every key it finds, so a key is
- * never structurally absent — what it cannot do is invent the sentence. This is the half that
- * refuses: a line holding nothing is a key nobody has answered, and an app that ships one shows a
- * person an empty button.
- *
- * Deliberately independent of the generator rather than calling it. A check that runs the thing it
- * is checking passes whenever that thing passes, which is no check at all — this reads the files
- * that are actually on disk and compares them to the markup that is actually there.
- */
-
 const SKIP = new Set(['node_modules', '.next', '.git', 'dist', '_generated'])
 
 const CODE = /\.(tsx?|jsx?)$/
 
-/*
- * Which props carry a key, read off the installed package's own declarations.
- *
- * A list written here would go stale the first time an element gained a prop — silently, by finding
- * fewer keys than there are, which is the failure this whole law exists to prevent.
- */
 const TYPED = /readonly\s+([A-Za-z][A-Za-z0-9]*)\??\s*:\s*MessageKey\b/g
 
 function walk(at: string, found: string[] = []): readonly string[] {

package/dist/integrity/slopnators/sl_unvaulted_secret.d.ts

@@ -0,0 +1,2 @@
+import type { Slopnator } from '../slopnator.ts';
+export declare const slopnator: Slopnator;

package/dist/integrity/slopnators/sl_unvaulted_secret.js

@@ -0,0 +1,107 @@
+import { descend, read, reached } from '../../core/descend.js';
+import { rowsIn } from './sl_unthreaded.js';
+const SECRETS = 'secrets';
+function wears() {
+    const found = new Set();
+    descend();
+    for (const at of reached()) {
+        const text = read(at);
+        if (text === undefined)
+            continue;
+        let waiting = [];
+        for (const one of rowsIn(text)) {
+            if (one.id === undefined)
+                continue;
+            if (one.list === 'declares') {
+                waiting.push(one.id);
+                continue;
+            }
+            if (one.list !== undefined)
+                continue;
+            if (one.id === SECRETS) {
+                for (const id of waiting) {
+                    const cut = id.indexOf('_');
+                    if (cut > 0)
+                        found.add(id.slice(0, cut + 1));
+                }
+            }
+            waiting = [];
+        }
+    }
+    return [...found];
+}
+const HOLDS = 'process';
+const ENV = 'env';
+const isEnv = (one) => one?.type === 'MemberExpression' &&
+    one.object?.type === 'Identifier' &&
+    one.object.name === HOLDS &&
+    one.property?.type === 'Identifier' &&
+    one.property.name === ENV;
+function stated(node, ancestors) {
+    if (node === undefined)
+        return undefined;
+    if (node.type === 'Literal' && typeof node.value === 'string')
+        return node.value;
+    if (node.type !== 'Identifier' || node.name === undefined)
+        return undefined;
+    for (const one of ancestors) {
+        const body = one.body;
+        for (const each of Array.isArray(body) ? body : []) {
+            const line = each;
+            const held = line.type === 'ExportNamedDeclaration' ? line.declaration : line;
+            if (held?.type !== 'VariableDeclaration')
+                continue;
+            for (const said of held.declarations ?? []) {
+                if (said.id?.type !== 'Identifier' || said.id.name !== node.name)
+                    continue;
+                return said.init?.type === 'Literal' && typeof said.init.value === 'string' ? said.init.value : undefined;
+            }
+        }
+    }
+    return undefined;
+}
+export const slopnator = {
+    on: ['MemberExpression'],
+    holds: (node, at) => {
+        const held = node;
+        if (!isEnv(held.object))
+            return false;
+        const up = at.ancestors();
+        const parent = up[up.length - 1];
+        if (parent?.type === 'AssignmentExpression' && parent.left === held)
+            return false;
+        const name = held.computed === true ? stated(held.property, up) : held.property?.name;
+        if (name === undefined) {
+            return ('this takes a value out of the environment under a name nobody reading the file can see, so it can name ' +
+                'any secret this app declares. A declared value is opened by the vault, which refuses a name no row states ' +
+                'and a value nothing sealed, and neither of those refusals can happen here');
+        }
+        const wearing = wears().find((one) => name.toLowerCase().startsWith(one));
+        if (wearing === undefined)
+            return false;
+        return (name +
+            ' wears the prefix ' +
+            wearing +
+            ', so it names a secret, and this takes it from the environment instead of the vault — past the check that a ' +
+            'row declares it, and past the sealed store the value was written to');
+    },
+    proves: {
+        wrong: [
+            'const key = process.env[named.toUpperCase()]',
+            {
+                files: [
+                    { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+                    { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_secrets.ts',\n    },\n  ],\n}\n" },
+                    { at: 'threads/_probe_secrets.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const SECRETS: Threaded = {\n  id: 'secrets',\n  declares: [\n    {\n      id: 'sec_model',\n      at: 'threads/_probe_secrets.ts',\n    },\n  ],\n}\n" },
+                    { at: 'probe.tsx', source: "const key = process.env['SEC_MODEL']\n" },
+                ],
+                at: 'probe.tsx',
+            },
+        ],
+        right: [
+            "const mode = process.env['NODE_ENV']",
+            "const DEPTH = 'THREAD_DEPTH'\n\nconst depth = Number(process.env[DEPTH] ?? '0')",
+            "const held = opened(['sec_model'])",
+        ],
+    },
+};

package/dist/integrity/slopnators/sl_unvaulted_secret.ts

@@ -0,0 +1,132 @@
+import type { Slopnator } from '../slopnator.ts'
+
+import { descend, read, reached } from '../../core/descend.ts'
+import { rowsIn } from './sl_unthreaded.ts'
+
+interface Held {
+  readonly type?: string
+  readonly name?: string
+  readonly value?: unknown
+  readonly computed?: boolean
+  readonly object?: Held
+  readonly property?: Held
+  readonly init?: Held
+  readonly id?: Held
+  readonly declaration?: Held
+  readonly declarations?: readonly Held[]
+  readonly left?: Held
+}
+
+const SECRETS = 'secrets'
+
+function wears(): readonly string[] {
+  const found = new Set<string>()
+
+  descend()
+
+  for (const at of reached()) {
+    const text = read(at)
+    if (text === undefined) continue
+
+    let waiting: string[] = []
+    for (const one of rowsIn(text)) {
+      if (one.id === undefined) continue
+      if (one.list === 'declares') {
+        waiting.push(one.id)
+        continue
+      }
+      if (one.list !== undefined) continue
+      if (one.id === SECRETS) {
+        for (const id of waiting) {
+          const cut = id.indexOf('_')
+          if (cut > 0) found.add(id.slice(0, cut + 1))
+        }
+      }
+      waiting = []
+    }
+  }
+
+  return [...found]
+}
+
+const HOLDS = 'process'
+
+const ENV = 'env'
+
+const isEnv = (one: Held | undefined): boolean =>
+  one?.type === 'MemberExpression' &&
+  one.object?.type === 'Identifier' &&
+  one.object.name === HOLDS &&
+  one.property?.type === 'Identifier' &&
+  one.property.name === ENV
+
+function stated(node: Held | undefined, ancestors: readonly unknown[]): string | undefined {
+  if (node === undefined) return undefined
+  if (node.type === 'Literal' && typeof node.value === 'string') return node.value
+  if (node.type !== 'Identifier' || node.name === undefined) return undefined
+  for (const one of ancestors) {
+    const body = (one as { readonly body?: unknown }).body
+    for (const each of Array.isArray(body) ? (body as readonly unknown[]) : []) {
+      const line = each as Held
+      const held = line.type === 'ExportNamedDeclaration' ? line.declaration : line
+      if (held?.type !== 'VariableDeclaration') continue
+      for (const said of held.declarations ?? []) {
+        if (said.id?.type !== 'Identifier' || said.id.name !== node.name) continue
+        return said.init?.type === 'Literal' && typeof said.init.value === 'string' ? said.init.value : undefined
+      }
+    }
+  }
+  return undefined
+}
+
+export const slopnator: Slopnator = {
+  on: ['MemberExpression'],
+  holds: (node, at) => {
+    const held = node as Held
+    if (!isEnv(held.object)) return false
+
+    const up = at.ancestors()
+    const parent = up[up.length - 1] as Held | undefined
+    if (parent?.type === 'AssignmentExpression' && parent.left === held) return false
+
+    const name = held.computed === true ? stated(held.property, up) : held.property?.name
+
+    if (name === undefined) {
+      return (
+        'this takes a value out of the environment under a name nobody reading the file can see, so it can name ' +
+        'any secret this app declares. A declared value is opened by the vault, which refuses a name no row states ' +
+        'and a value nothing sealed, and neither of those refusals can happen here'
+      )
+    }
+
+    const wearing = wears().find((one) => name.toLowerCase().startsWith(one))
+    if (wearing === undefined) return false
+
+    return (
+      name +
+      ' wears the prefix ' +
+      wearing +
+      ', so it names a secret, and this takes it from the environment instead of the vault — past the check that a ' +
+      'row declares it, and past the sealed store the value was written to'
+    )
+  },
+  proves: {
+    wrong: [
+      'const key = process.env[named.toUpperCase()]',
+      {
+        files: [
+          { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
+          { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_probe_secrets.ts',\n    },\n  ],\n}\n" },
+          { at: 'threads/_probe_secrets.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const SECRETS: Threaded = {\n  id: 'secrets',\n  declares: [\n    {\n      id: 'sec_model',\n      at: 'threads/_probe_secrets.ts',\n    },\n  ],\n}\n" },
+          { at: 'probe.tsx', source: "const key = process.env['SEC_MODEL']\n" },
+        ],
+        at: 'probe.tsx',
+      },
+    ],
+    right: [
+      "const mode = process.env['NODE_ENV']",
+      "const DEPTH = 'THREAD_DEPTH'\n\nconst depth = Number(process.env[DEPTH] ?? '0')",
+      "const held = opened(['sec_model'])",
+    ],
+  },
+}

package/dist/integrity/slopnators/sl_unversioned.js

@@ -1,4 +1,4 @@
-import { here, parses, rowsIn } from "./sl_unthreaded.js";
+import { here, parses, rowsIn } from './sl_unthreaded.js';
 export const slopnator = {
     holds: (_node, at) => {
         const path = here(at.filename);
@@ -25,7 +25,8 @@ export const slopnator = {
                 files: [
                     { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
                     { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_unversioned_probe.ts',\n    },\n  ],\n}\n" },
-                    { at: 'threads/_unversioned_probe.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const L: Threaded = {\n  id: 'a-law',\n  at: 'packages/core/integrity/src/constraint.ts',\n  describes: 'A rule that must be enforced.',\n}\n" },
+                    { at: 'threads/_unversioned_probe.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const L: Threaded = {\n  id: 'a-law',\n  at: 'thread/integrity/constraint.ts',\n  describes: 'A rule that must be enforced.',\n}\n" },
+                    { at: 'thread/integrity/constraint.ts', source: 'export const CONSTRAINTS = []\n' },
                 ],
                 at: 'threads/_unversioned_probe.ts',
             },
@@ -35,11 +36,12 @@ export const slopnator = {
                 files: [
                     { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
                     { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_unversioned_probe.ts',\n    },\n  ],\n}\n" },
-                    { at: 'threads/_unversioned_probe.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const L: Threaded = {\n  id: 'a-law',\n  at: 'packages/core/integrity/src/constraint.ts',\n  describes: 'A rule that must be enforced.',\n  version: 3,\n}\n" },
+                    { at: 'threads/_unversioned_probe.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const L: Threaded = {\n  id: 'a-law',\n  at: 'thread/integrity/constraint.ts',\n  describes: 'A rule that must be enforced.',\n  version: 3,\n}\n" },
+                    { at: 'thread/integrity/constraint.ts', source: 'export const CONSTRAINTS = []\n' },
                 ],
                 at: 'threads/_unversioned_probe.ts',
             },
-            "export const HELPER = {\n  id: 'a-helper',\n  at: 'threads/meta.ts',\n  describes: 'Nothing conforms to this.',\n}",
+            "export const HELPER = {\n  id: 'a-helper',\n  at: 'threads/core.ts',\n  describes: 'Nothing conforms to this.',\n}",
         ],
     },
 };

package/dist/integrity/slopnators/sl_unversioned.ts

@@ -30,7 +30,8 @@ export const slopnator: Slopnator = {
         files: [
           { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
           { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_unversioned_probe.ts',\n    },\n  ],\n}\n" },
-          { at: 'threads/_unversioned_probe.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const L: Threaded = {\n  id: 'a-law',\n  at: 'packages/core/integrity/src/constraint.ts',\n  describes: 'A rule that must be enforced.',\n}\n" },
+          { at: 'threads/_unversioned_probe.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const L: Threaded = {\n  id: 'a-law',\n  at: 'thread/integrity/constraint.ts',\n  describes: 'A rule that must be enforced.',\n}\n" },
+          { at: 'thread/integrity/constraint.ts', source: 'export const CONSTRAINTS = []\n' },
         ],
         at: 'threads/_unversioned_probe.ts',
       },
@@ -40,11 +41,12 @@ export const slopnator: Slopnator = {
         files: [
           { at: 'thread/core/thread.ts', source: "export interface Threaded {\n  readonly id?: string\n  readonly at?: string\n  readonly describes?: string\n  readonly declares?: readonly Threaded[]\n  readonly derives?: readonly Threaded[]\n  readonly seeds?: readonly Threaded[]\n}\n" },
           { at: 'threads/thread.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const THREAD: Threaded = {\n  declares: [\n    {\n      at: 'threads/_unversioned_probe.ts',\n    },\n  ],\n}\n" },
-          { at: 'threads/_unversioned_probe.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const L: Threaded = {\n  id: 'a-law',\n  at: 'packages/core/integrity/src/constraint.ts',\n  describes: 'A rule that must be enforced.',\n  version: 3,\n}\n" },
+          { at: 'threads/_unversioned_probe.ts', source: "import type { Threaded } from '../thread/core/thread.ts'\n\nexport const L: Threaded = {\n  id: 'a-law',\n  at: 'thread/integrity/constraint.ts',\n  describes: 'A rule that must be enforced.',\n  version: 3,\n}\n" },
+          { at: 'thread/integrity/constraint.ts', source: 'export const CONSTRAINTS = []\n' },
         ],
         at: 'threads/_unversioned_probe.ts',
       },
-      "export const HELPER = {\n  id: 'a-helper',\n  at: 'threads/meta.ts',\n  describes: 'Nothing conforms to this.',\n}",
+      "export const HELPER = {\n  id: 'a-helper',\n  at: 'threads/core.ts',\n  describes: 'Nothing conforms to this.',\n}",
     ],
   },
 }

package/dist/integrity/sweep.d.ts

@@ -20,5 +20,6 @@ export declare function sweep(root: string, all: readonly Constraint[], slopnato
     readonly unrun: readonly string[];
     readonly unmet: readonly string[];
     readonly linted: readonly string[];
+    readonly spent: ReadonlyMap<string, number>;
 };
 export {};