@entrorove/skill 0.1.22 → 0.1.24

package/local-archguard-components.mjs

@@ -0,0 +1,177 @@
+import { parse as parseVue, compileTemplate } from '@vue/compiler-sfc';
+import { parse as parseSvelte } from 'svelte/compiler';
+import { analyzeArchguardLanguage } from './local-archguard-language-ast.mjs';
+
+export function archguardComponentLanguage(path) {
+  return new Map([['vue', 'vue'], ['svelte', 'svelte'], ['wxml', 'wxml']]).get(path.split('.').at(-1)) ?? null;
+}
+function offsets(source) {
+  const output = [0];
+  for (let index = 0; index < source.length; index += 1) {
+    if (source[index] === '\r' && source[index + 1] === '\n') { output.push(index + 2); index += 1; }
+    else if (source[index] === '\n' || source[index] === '\r') output.push(index + 1);
+  }
+  return output;
+}
+function position(index, lineOffsets) {
+  let low = 0; let high = lineOffsets.length;
+  while (low + 1 < high) { const middle = Math.floor((low + high) / 2); if (lineOffsets[middle] <= index) low = middle; else high = middle; }
+  return { line: low + 1, column: index - lineOffsets[low] + 1 };
+}
+function merge(target, part, base, prefix, lineOffsets) {
+  const rebase = location => {
+    const start = Math.max(0, (location.start ?? 0) - prefix) + base;
+    return { ...location, ...position(start, lineOffsets), start, end: Math.max(0, (location.end ?? 0) - prefix) + base };
+  };
+  if (part.diagnostics?.length) {
+    target.diagnostics.push(...part.diagnostics.map(item => {
+      const start = item.start ?? 0; return { ...item, ...rebase({ ...item, start, end: item.end ?? start }) };
+    }));
+    return;
+  }
+  const sourceLocations = locations => locations.filter(location => (location.start ?? 0) >= prefix).map(rebase);
+  for (const [id, locations] of part.builtin) target.builtin.get(id).push(...sourceLocations(locations));
+  for (const [id, selected] of part.selected) target.selected.get(id).locations.push(...sourceLocations(selected.locations));
+  target.dependencies.push(...sourceLocations(part.dependencies));
+  for (const key of ['maxNestingDepth', 'maxFunctionLines']) target[key] = Math.max(target[key], part[key]);
+  for (const key of ['animations', 'transitions']) target[key] += part[key];
+}
+function scriptLanguage(block) {
+  const language = block.lang ?? 'js';
+  if (!['js', 'javascript', 'ts', 'typescript'].includes(language) || block.src) throw new Error('ARCH-AST-EMBEDDED-LANGUAGE-UNSUPPORTED');
+  return ['ts', 'typescript'].includes(language) ? 'ts' : 'js';
+}
+function styleLanguage(block) {
+  if ((block.lang && block.lang !== 'css') || block.src) throw new Error('ARCH-AST-EMBEDDED-LANGUAGE-UNSUPPORTED');
+}
+function walk(value, visit, depth = 0, seen = new WeakSet()) {
+  if (!value || typeof value !== 'object' || seen.has(value)) return;
+  seen.add(value); const next = visit(value, depth);
+  for (const [key, child] of Object.entries(value)) if (!['loc', 'ast', 'parent', 'codegenNode'].includes(key)) {
+    if (Array.isArray(child)) child.forEach(item => walk(item, visit, next, seen));
+    else walk(child, visit, next, seen);
+  }
+}
+function expressions(ranges) {
+  const unique = [...new Map(ranges.map(item => [`${item.start}:${item.end}`, item])).values()];
+  return unique.filter(item => !unique.some(other => other !== item && other.start <= item.start && other.end >= item.end));
+}
+function syntaxError(error, parser, lineOffsets) {
+  const start = error.loc?.start?.offset ?? error.position?.[0] ?? error.start?.character ?? 0;
+  return { code: error.code ?? 'COMPONENT-SYNTAX', parser, message: error.message ?? String(error),
+    start, end: start, ...position(start, lineOffsets) };
+}
+function addStyle(target, source, rules, content, base, lineOffsets, property = '') {
+  const header = `.archguard{${property}`;
+  const analysis = analyzeArchguardLanguage({ path: 'fragment.css', content: `${header}${content}}` }, rules);
+  analysis.maxNestingDepth = Math.max(0, analysis.maxNestingDepth - 1);
+  merge(target, analysis, base, header.length, lineOffsets);
+}
+function vueSections(file) {
+  const parsed = parseVue(file.content, { filename: file.path, sourceMap: false,
+    templateParseOptions: { expressionPlugins: ['typescript'] } });
+  if (parsed.errors.length) return { errors: parsed.errors };
+  const descriptor = parsed.descriptor;
+  if (descriptor.customBlocks.length || descriptor.template?.lang) throw new Error('ARCH-AST-EMBEDDED-LANGUAGE-UNSUPPORTED');
+  return { scripts: [descriptor.script, descriptor.scriptSetup].filter(Boolean), styles: descriptor.styles,
+    template: descriptor.template?.ast, errors: [] };
+}
+function wxmlAttributeRanges(value, file, analyzeScript) {
+  const quoted = ['"', "'"].includes(value.loc.source[0]);
+  const base = value.loc.start.offset + (quoted ? 1 : 0);
+  const source = file.content.slice(base, value.loc.end.offset - (quoted ? 1 : 0));
+  const ranges = []; let cursor = 0;
+  while ((cursor = source.indexOf('{{', cursor)) !== -1) {
+    const start = cursor + 2; let end = source.indexOf('}}', start); let accepted = false;
+    while (end !== -1) {
+      const parsed = analyzeScript({ path: 'binding.ts', content: `void (${source.slice(start, end)});` }, []);
+      if (!parsed.diagnostics.length) { ranges.push({ start: base + start, end: base + end }); accepted = true; break; }
+      end = source.indexOf('}}', end + 1);
+    }
+    if (!accepted) throw Object.assign(new Error('WXML attribute binding is not a valid expression'), { position: [base + start] });
+    cursor = end + 2;
+  }
+  return ranges;
+}
+function vueTemplate(target, root, file, rules, lineOffsets, analyzeScript) {
+  const ranges = [];
+  walk(root, (node, depth) => {
+    const next = node.type === 1 ? depth + 1 : depth; target.maxNestingDepth = Math.max(target.maxNestingDepth, next);
+    if (((node.type === 4 && !node.isStatic && node.content) || (node.type === 8 && node.ast)) && node.loc) ranges.push({ start: node.loc.start.offset,
+      end: node.loc.end.offset, statement: node.archguardStatement === true });
+    if (node.type === 7 && node.name === 'on' && node.exp) node.exp.archguardStatement = true;
+    if (file.path.endsWith('.wxml') && node.type === 6 && node.value) ranges.push(...wxmlAttributeRanges(node.value, file, analyzeScript));
+    const style = (node.type === 6 && node.name === 'style') || (node.type === 7 && node.name === 'bind' && node.arg?.content === 'style');
+    if (style) target.builtin.get('no-inline-style').push({ ...position(node.loc.start.offset, lineOffsets),
+      start: node.loc.start.offset, end: node.loc.end.offset, syntaxKind: 'Attribute', parser: 'vue/compiler-sfc' });
+    if (node.type === 6 && node.name === 'style' && node.value) {
+      const base = node.value.loc.start.offset + (/^["']/.test(node.value.loc.source) ? 1 : 0);
+      addStyle(target, file.content, rules, node.value.content, base, lineOffsets);
+    }
+    return next;
+  });
+  return expressions(ranges);
+}
+function svelteAttribute(node, name) {
+  return node.attributes?.find(item => item.type === 'Attribute' && item.name === name)?.value?.[0]?.data;
+}
+function svelteTemplate(target, root, file, rules, lineOffsets) {
+  const ranges = [];
+  walk(root, (node, depth) => {
+    const next = ['RegularElement', 'Component', 'IfBlock', 'EachBlock', 'AwaitBlock', 'SnippetBlock', 'KeyBlock'].includes(node.type) ? depth + 1 : depth;
+    target.maxNestingDepth = Math.max(target.maxNestingDepth, next);
+    if (typeof node.type === 'string' && (node.type.endsWith('Expression') || ['Literal', 'Identifier'].includes(node.type))
+      && Number.isInteger(node.start) && Number.isInteger(node.end)) ranges.push({ start: node.start, end: node.end, statement: false });
+    if ((node.type === 'Attribute' && node.name === 'style') || node.type === 'StyleDirective') {
+      target.builtin.get('no-inline-style').push({ ...position(node.start, lineOffsets), start: node.start,
+        end: node.end, syntaxKind: node.type, parser: 'svelte/compiler' });
+      const text = Array.isArray(node.value) && node.value.length === 1 && node.value[0].type === 'Text' ? node.value[0] : null;
+      if (text) addStyle(target, file.content, rules, text.data, text.start, lineOffsets, node.type === 'StyleDirective' ? `${node.name}:` : '');
+    }
+    return next;
+  });
+  return expressions(ranges);
+}
+function wxmlSections(file) {
+  const compiled = compileTemplate({ source: file.content, filename: file.path, id: 'archguard-inspection',
+    transformAssetUrls: false, compilerOptions: { comments: true } });
+  return { template: compiled.ast, scripts: [], styles: [], errors: compiled.errors };
+}
+export function analyzeArchguardComponent(file, rules, analyzeScript) {
+  const language = archguardComponentLanguage(file.path); const lineOffsets = offsets(file.content);
+  const target = { selected: new Map(rules.filter(rule => rule.engine === 'ast').map(rule => [rule.id, { rule, locations: [] }])),
+    builtin: new Map(['no-eval', 'no-debug', 'no-inline-style', 'no-hardcoded-color', 'no-magic-number'].map(id => [id, []])),
+    dependencies: [], maxFunctionLines: 0, maxNestingDepth: 0, animations: 0, transitions: 0, diagnostics: [] };
+  try {
+    let sections; let ranges;
+    if (language === 'svelte') {
+      const parsed = parseSvelte(file.content, { filename: file.path, modern: true });
+      const scripts = [...new Set([parsed.instance, parsed.module, ...(parsed.js ?? [])].filter(Boolean))];
+      sections = { scripts: scripts.map(node => ({ content: file.content.slice(node.content.start, node.content.end),
+        start: node.content.start, lang: svelteAttribute(node, 'lang'), src: svelteAttribute(node, 'src') })),
+        styles: parsed.css ? [{ content: parsed.css.content.styles, start: parsed.css.content.start, lang: svelteAttribute(parsed.css, 'lang') }] : [], errors: [] };
+      ranges = svelteTemplate(target, parsed.fragment, file, rules, lineOffsets);
+    } else {
+      sections = language === 'vue' ? vueSections(file) : wxmlSections(file);
+      ranges = vueTemplate(target, sections.template, file, rules, lineOffsets, analyzeScript);
+    }
+    if (sections.errors.length) { target.diagnostics.push(...sections.errors.map(error => syntaxError(error, language, lineOffsets))); return target; }
+    for (const block of sections.scripts) {
+      const kind = scriptLanguage(block); const start = block.start ?? block.loc.start.offset;
+      merge(target, analyzeScript({ path: `${file.path}.${kind}`, content: block.content }, rules), start, 0, lineOffsets);
+    }
+    for (const block of sections.styles) {
+      styleLanguage(block); const start = block.start ?? block.loc.start.offset;
+      merge(target, analyzeArchguardLanguage({ path: `${file.path}.css`, content: block.content }, rules), start, 0, lineOffsets);
+    }
+    for (const range of ranges) {
+      const source = file.content.slice(range.start, range.end); const prefix = range.statement ? '' : 'void (';
+      merge(target, analyzeScript({ path: `${file.path}.ts`, content: `${prefix}${source}${range.statement ? '' : ');'}` }, rules),
+        range.start, prefix.length, lineOffsets);
+    }
+    return target;
+  } catch (error) {
+    if (error.message?.startsWith('ARCH-AST-SELECTOR-')) throw error;
+    target.diagnostics.push(syntaxError(error, language, lineOffsets)); return target;
+  }
+}

package/local-archguard-contract.mjs

@@ -0,0 +1,109 @@
+import { withArchguardMutationFence } from './local-archguard-mutation-fence.mjs';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { context, canonical, sha256, readBytes, readJson, atomicJson, seal, unseal,
+  withExclusiveLock, verifyAuthority, appendLedger, readLedger, atomicBytes, fail, safeId } from './local-archguard-state.mjs';
+
+async function evaluator() { return import('./local-archguard-evaluate.mjs'); }
+const CONTRACT_PATH = 'arch.contract.yaml';
+export async function contractFile(ctx) {
+  const bytes = await readBytes(path.join(ctx.root, CONTRACT_PATH), false, ctx);
+  const contract = await (await evaluator()).parseArchguardContract(bytes.content.toString('utf8'));
+  return { contract, contractDigest: sha256(canonical(contract)), rawDigest: sha256(bytes.content), raw: bytes.content };
+}
+export async function loadContractLock(ctx, required = true) {
+  try { return await unseal(ctx, await readJson(path.join(ctx.repositoryState, 'contract-lock.json'))); }
+  catch (error) { if (!required && error.code === 'ENOENT') return null; throw error; }
+}
+export async function freezeContract(ctx) {
+  const current = await contractFile(ctx); const lock = await loadContractLock(ctx, false);
+  if (lock && (lock.contractDigest !== current.contractDigest || lock.rawDigest !== current.rawDigest)) fail('ARCH_CONTRACT_DRIFT', 'architecture contract changed outside an explicitly confirmed version update');
+  if (!lock) await atomicJson(path.join(ctx.repositoryState, 'contract-lock.json'), await seal(ctx, {
+    repositoryDigest: ctx.repositoryDigest, contractDigest: current.contractDigest, rawDigest: current.rawDigest,
+    revision: current.contract.revision, usedConfirmations: [] }));
+  return current;
+}
+async function confirmation(ctx, input, action, next, previous) {
+  const verified = await verifyAuthority(ctx, input.confirmation, 'entrorove.archguard-contract-confirmation/1.0');
+  const value = verified.value; const nextDigest = sha256(canonical(next));
+  if (!verified.authority.actors.includes(value.actor) || typeof value.reason !== 'string' || !value.reason.trim()) fail('ARCH_CONFIRMATION_ACTOR', 'confirmation actor and reason must be explicit and trusted');
+  if (value.action !== action || value.contractDigest !== nextDigest || value.contractRevision !== next.revision
+    || value.previousDigest !== previous) fail('ARCH_CONFIRMATION_BINDING', 'confirmation does not bind the exact contract digest and revision');
+  return value;
+}
+async function saveContract(ctx, next, permit, lock, exclusive) {
+  const raw = Buffer.from(canonical(next) + '\n'); const contractDigest = sha256(canonical(next));
+  const file = path.join(ctx.root, CONTRACT_PATH); const temporary = path.join(ctx.root, `.arch-contract-${permit.nonce}.tmp`);
+  const old = await readBytes(file, true, ctx);
+  if (exclusive && old.exists) fail('ARCH_CONTRACT_EXISTS', 'architecture contract already exists');
+  await readLedger(ctx);
+  const protectedPaths = [file, path.join(ctx.repositoryState, 'contract-lock.json'), path.join(ctx.directory, 'ledger.jsonl'), path.join(ctx.directory, 'head.json')];
+  const protectedFiles = await Promise.all(protectedPaths.map(async target => ({ target, original: await readBytes(target, true, target === file ? ctx : null) })));
+  let projectWritten = false;
+  try {
+    await fs.writeFile(temporary, raw, { flag: 'wx', mode: old.exists ? old.mode : 0o600 });
+    if (exclusive) { await fs.link(temporary, file); projectWritten = true; await fs.unlink(temporary); }
+    else await fs.rename(temporary, file);
+    projectWritten = true;
+    await atomicJson(path.join(ctx.repositoryState, 'contract-lock.json'), await seal(ctx, {
+      repositoryDigest: ctx.repositoryDigest, contractDigest, rawDigest: sha256(raw), revision: next.revision,
+      usedConfirmations: [...(lock?.usedConfirmations ?? []), permit.nonce] }));
+    const ledgerEntry = await appendLedger(ctx, `contract-${exclusive ? 'create' : 'update'}`, {
+      contractDigest, revision: next.revision, previousDigest: permit.previousDigest,
+      actor: permit.actor, reason: permit.reason, confirmationDigest: sha256(canonical(permit)) });
+    return { schemaVersion: 'entrorove.archguard-contract-result/1.0', contract: next, contractDigest, ledgerEntry };
+  } catch (error) {
+    for (const item of protectedFiles) {
+      if (item.target === file && !projectWritten) continue;
+      try {
+        if (item.original.exists) await atomicBytes(item.target, item.original.content, item.original.mode);
+        else await fs.rm(item.target, { force: true });
+      } catch { fail('ARCH_CONTRACT_RECOVERY_FAILED', 'contract transaction recovery failed; explicit repair is required'); }
+    }
+    throw error;
+  } finally { await fs.rm(temporary, { force: true }); }
+}
+async function assertNoBlockedCheckpoints(ctx) {
+  const directory = path.join(ctx.stateRoot, 'flows', ctx.repositoryDigest);
+  let flows; try { flows = await fs.readdir(directory); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
+  for (const flowId of flows) {
+    safeId(flowId, 'stored flowId');
+    const ledger = await readLedger({ ...ctx, flowId, directory: path.join(directory, flowId) });
+    const last = ledger.entries.filter(item => item.event === 'checkpoint').at(-1);
+    if (last?.data.status === 'blocked') fail('ARCH_CONTRACT_BLOCKED_UPDATE', 'a blocked checkpoint must be corrected under its locked contract before a version update');
+  }
+}
+export async function archguardContractCreate(input) {
+  const next = await (await evaluator()).normalizeArchguardContract(input.contract);
+  if (next.revision !== 1) fail('ARCH_CONTRACT_REVISION', 'initial contract revision must be 1');
+  return withArchguardMutationFence(input, async () => {
+    const ctx = await context(input);
+    return withExclusiveLock(path.join(ctx.repositoryState, 'mutation.lock'), async () => {
+    const permit = await confirmation(ctx, input, 'create', next, null);
+    const lock = await loadContractLock(ctx, false);
+    if (lock) fail('ARCH_CONTRACT_EXISTS', 'architecture contract authority already exists');
+    return saveContract(ctx, next, permit, null, true);
+  });
+  }, { bootstrap: true, paths: [CONTRACT_PATH] });
+}
+export async function archguardContractGet(input) {
+  const ctx = await context(input); const current = await contractFile(ctx); const lock = await loadContractLock(ctx, false);
+  if (lock && (lock.contractDigest !== current.contractDigest || lock.rawDigest !== current.rawDigest)) fail('ARCH_CONTRACT_DRIFT', 'architecture contract digest no longer matches its authority lock');
+  return { schemaVersion: 'entrorove.archguard-contract-result/1.0', contract: current.contract, contractDigest: current.contractDigest,
+    authoritative: Boolean(lock), contractPath: CONTRACT_PATH };
+}
+export async function archguardContractUpdate(input) {
+  const next = await (await evaluator()).normalizeArchguardContract(input.contract);
+  return withArchguardMutationFence(input, async () => {
+    const ctx = await context(input);
+    return withExclusiveLock(path.join(ctx.repositoryState, 'mutation.lock'), async () => {
+    const current = await freezeContract(ctx); const lock = await loadContractLock(ctx);
+    await assertNoBlockedCheckpoints(ctx);
+    if (input.expectedDigest !== current.contractDigest) fail('ARCH_CONTRACT_STALE', 'expected contract digest is stale');
+    if (next.revision !== current.contract.revision + 1) fail('ARCH_CONTRACT_REVISION', 'confirmed update must increment contract revision by exactly one');
+    const permit = await confirmation(ctx, input, 'update', next, current.contractDigest);
+    if (lock.usedConfirmations.includes(permit.nonce)) fail('ARCH_CONFIRMATION_REPLAY', 'confirmation nonce already consumed');
+    return saveContract(ctx, next, permit, lock, false);
+  });
+  }, { bootstrap: true, paths: [CONTRACT_PATH] });
+}

package/local-archguard-contracts.mjs

@@ -0,0 +1,42 @@
+import { array, integer, ledgerIdentifier as id, nullable, object, paths, relativePath, sha256, text } from './local-contract-types.mjs';
+import { WORKFLOW_ACCEPTED_PLAN_SCHEMA, WORKFLOW_LOCAL_LEASE_SCHEMA } from './workflow-local-contracts.mjs';
+import { archguardOperationSchemas } from './local-archguard-evaluate.mjs';
+
+const native = await archguardOperationSchemas();
+const repositoryDigest = { type: 'string', pattern: '^[0-9a-f]{32}$' };
+const signature = { type: 'string', pattern: '^[A-Za-z0-9_-]{86}$' };
+const timestamp = { type: 'string', pattern: '^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$' };
+const exact = fields => object(fields, Object.keys(fields));
+const signed = { repositoryDigest, flowId: id, issuedAt: timestamp, expiresAt: timestamp, nonce: id, keyId: sha256, signature };
+const confirmation = exact({ ...signed, schemaVersion: { const: 'entrorove.archguard-contract-confirmation/1.0' },
+  action: { enum: ['create', 'update'] }, actor: text, reason: text, previousDigest: nullable(sha256), contractDigest: sha256, contractRevision: integer(1) });
+const direction = exact({ ...signed, schemaVersion: { const: 'entrorove.archguard-human-direction/1.0' },
+  action: { const: 'resume-correction' }, actor: text, reason: text, ledgerHeadDigest: sha256, contractDigest: sha256 });
+const scope = exact({ ...signed, schemaVersion: { const: 'entrorove.archguard-scope-authorization/1.0' },
+  stepId: id, ownerId: id, leaseId: id, generation: integer(1), taskDigest: sha256, chainDigest: sha256,
+  scopeArtifactDigest: sha256, contractDigest: sha256, paths, snapshotDigest: sha256, passDigest: sha256 });
+const base = { repositoryRoot: text, home: text, flowId: id };
+const requiredBase = ['repositoryRoot', 'flowId']; const step = { ...base, stepId: id }; const requiredStep = [...requiredBase, 'stepId'];
+const contract = native['contract-get'].input.properties.contract;
+export const ARCHGUARD_LOCAL_OPERATION_SCHEMAS = Object.freeze({
+  'archguard-capabilities': object({}), 'archguard-help': object({}),
+  'archguard-intake': native.intake.input, 'archguard-template-list': object({}),
+  'archguard-contract-create': object({ ...base, contract, confirmation }, [...requiredBase, 'contract', 'confirmation']),
+  'archguard-contract-get': object(base, requiredBase),
+  'archguard-contract-update': object({ ...base, contract, expectedDigest: sha256, confirmation }, [...requiredBase, 'contract', 'expectedDigest', 'confirmation']),
+  'archguard-snapshot': object({ ...step, paths, snapshotId: id }, [...requiredStep, 'paths']),
+  'archguard-checkpoint': object({ ...step, snapshotId: id, gatePassPath: text, scopeAuthorization: scope, path: relativePath, blockId: id,
+    workerId: id, leaseId: id }, [...requiredStep, 'snapshotId', 'gatePassPath', 'scopeAuthorization', 'path', 'blockId']),
+  'archguard-scope-request': object({ ...step, snapshotId: id, gatePassPath: text, acceptedPlan: WORKFLOW_ACCEPTED_PLAN_SCHEMA,
+    lease: WORKFLOW_LOCAL_LEASE_SCHEMA, scopeArtifactDigest: sha256, workerId: id, leaseId: id },
+  [...requiredStep, 'snapshotId', 'gatePassPath', 'acceptedPlan', 'lease', 'scopeArtifactDigest']),
+  'archguard-rules-scan': object({ ...base, paths }, [...requiredBase, 'paths']),
+  'archguard-complexity-report': object({ ...base, paths }, [...requiredBase, 'paths']),
+  'archguard-drift-status': object(base, requiredBase),
+  'archguard-ledger-init': object(base, requiredBase),
+  'archguard-ledger-query': object({ ...base, event: { enum: ['contract-create', 'contract-update', 'ledger-init', 'snapshot', 'checkpoint', 'human-resume'] },
+    status: { enum: ['passed', 'blocked'] }, ruleId: id }, requiredBase),
+  'archguard-human-resume': object({ ...base, confirmation: direction }, [...requiredBase, 'confirmation']),
+  'archguard-human-direction-request': object({ ...step, acceptedPlan: WORKFLOW_ACCEPTED_PLAN_SCHEMA,
+    lease: WORKFLOW_LOCAL_LEASE_SCHEMA, scopeArtifactDigest: sha256 }, [...requiredStep, 'acceptedPlan', 'lease', 'scopeArtifactDigest']),
+});

package/local-archguard-evaluate.mjs

@@ -0,0 +1,120 @@
+import { createHash } from 'node:crypto'
+import { readFile } from 'node:fs/promises'
+import Ajv from 'ajv'
+import { evaluateArchguardFiles, validateArchguardAstRules } from './local-archguard-ast.mjs'
+
+const ASSET = 'archguard-runtime-v7.0.44.mjs'
+const ASSET_SHA256 = '836f20b270139371bef43e3934fa7232371e42d46371c513db2a5e3c5622b215'
+const ajv = new Ajv({ allErrors: true, strict: false })
+const validators = new Map()
+let runtimePromise
+
+function fail(message) { throw new Error(`ENTROROVE_ARCHGUARD_INVALID: ${message}`) }
+function canonical(value) {
+  if (value === null || ['string', 'boolean'].includes(typeof value)) return JSON.stringify(value)
+  if (typeof value === 'number' && Number.isFinite(value)) return JSON.stringify(value)
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`
+  if (!value || typeof value !== 'object') fail('Finite JSON is required')
+  return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`
+}
+const digest = value => createHash('sha256').update(canonical(value)).digest('hex')
+
+async function loadPinnedRuntime() {
+  for (const url of [new URL(`./runtime/${ASSET}`, import.meta.url), new URL(`../../assets/${ASSET}`, import.meta.url)]) {
+    let source
+    try { source = await readFile(url) } catch (error) { if (error.code === 'ENOENT') continue; throw error }
+    if (createHash('sha256').update(source).digest('hex') !== ASSET_SHA256) fail('Pinned runtime digest mismatch')
+    return import(url.href)
+  }
+  fail('Pinned Archguard runtime is unavailable')
+}
+const runtime = () => runtimePromise ??= loadPinnedRuntime()
+
+function assertSchema(key, schema, value) {
+  let validate = validators.get(key)
+  if (!validate) { validate = ajv.compile(schema); validators.set(key, validate) }
+  if (!validate(value)) fail(`${key}: ${ajv.errorsText(validate.errors, { dataVar: key })}`)
+}
+
+export async function normalizeArchguardContract(value) {
+  const module = await runtime()
+  assertSchema('contract', module.OPERATION_SCHEMAS['contract-get'].input.properties.contract, value)
+  validateArchguardAstRules(value.rules.custom)
+  const result = await module.run({ schemaVersion: 'archguard.skill.request/1.0', requestId: digest(value), operation: 'contract-get', input: { contract: value } })
+  return result.output.contract
+}
+
+export async function parseArchguardContract(source) {
+  if (typeof source !== 'string' || Buffer.byteLength(source) > 1_000_000) fail('Contract text must be at most 1 MB')
+  const { parseDocument } = await import('yaml')
+  const document = parseDocument(source, { uniqueKeys: true, version: '1.2' })
+  if (document.errors.length) fail(`Contract YAML is invalid: ${document.errors[0].message}`)
+  const value = document.toJS({ maxAliasCount: 0 })
+  return normalizeArchguardContract(value)
+}
+
+export async function archguardOperationSchemas() { return (await runtime()).OPERATION_SCHEMAS }
+
+export async function runPureArchguardOperation(operation, input, requestId = digest({ operation, input })) {
+  const module = await runtime()
+  const schema = module.OPERATION_SCHEMAS[operation]
+  if (!schema) fail('Unknown Archguard operation')
+  assertSchema(`input.${operation}`, schema.input, input)
+  if (input.contract) input = { ...input, contract: await normalizeArchguardContract(input.contract) }
+  const result = await module.run({ schemaVersion: 'archguard.skill.request/1.0', requestId, operation, input })
+  if (result.output.contract) await normalizeArchguardContract(result.output.contract)
+  if (['rules-scan', 'complexity-report'].includes(operation)) {
+    const scan = evaluateArchguardFiles(input.contract, input.files)
+    const findings = operation === 'rules-scan' ? scan.findings : scan.findings.filter(item => item.category === 'complexity')
+    result.status = scan.findings.some(item => item.blocking) ? 'blocked' : 'succeeded'
+    result.findings = scan.findings
+    result.output = operation === 'rules-scan' ? { findings, summary: { total: findings.length, blocking: findings.filter(item => item.blocking).length } }
+      : { metrics: scan.metrics, findings }
+  }
+  return result
+}
+
+export async function createArchguardContract(input) {
+  return (await runPureArchguardOperation('contract-create', input)).output
+}
+
+export async function evaluateArchguardDrift(ledger) {
+  await runPureArchguardOperation('drift-status', { ledger })
+  const recent = ledger.slice(-10)
+  let shared = new Set(); let consecutiveBlocks = 0
+  for (let index = recent.length - 1; index >= 0; index--) {
+    const entry = recent[index]
+    if (entry.status !== 'blocked') break
+    const rules = new Set(entry.blockingRuleIds)
+    const intersection = consecutiveBlocks ? new Set([...shared].filter(id => rules.has(id))) : rules
+    if (!intersection.size) break
+    shared = intersection; consecutiveBlocks++
+  }
+  const blockedBlocks = recent.filter(entry => entry.status === 'blocked').length
+  const trend = consecutiveBlocks >= 3 ? 'red' : blockedBlocks || !ledger.length ? 'yellow' : 'green'
+  return { trend, totalBlocks: ledger.length, recentBlocks: recent.length, blockedBlocks,
+    violationRate: recent.length ? Math.round(blockedBlocks / recent.length * 1e3) / 10 : 0,
+    consecutiveBlocks, repeatedRuleIds: [...shared].sort(), action: trend === 'red'
+      ? 'interrupt-and-request-human-confirmation' : trend === 'yellow' ? 'warn-and-correct-next-block' : 'continue' }
+}
+
+export async function evaluateArchguardCheckpoint(value, block, history) {
+  const contract = await normalizeArchguardContract(value)
+  const module = await runtime()
+  assertSchema('checkpoint', module.OPERATION_SCHEMAS.checkpoint.input, { contract, block, history })
+  if (block.path !== block.path.normalize('NFC') || block.path.startsWith('/') || block.path.includes('\\')
+    || /[\u0000-\u001f\u007f:]/.test(block.path) || block.path.split('/').some(part => !part || part === '.' || part === '..')) fail('Unsafe checkpoint path')
+  const scan = evaluateArchguardFiles(contract, [{ path: block.path, content: block.content }])
+  const native = await module.runTrustedLocalCheckpoint({ schemaVersion: 'archguard.skill.request/1.0', requestId: digest({ contract, block, history }),
+    operation: 'checkpoint', input: { contract, block, history } }, scan.findings)
+  const blocking = scan.findings.filter(item => item.blocking)
+  const ledgerEntry = { ...native.output.ledgerEntry, status: blocking.length ? 'blocked' : 'passed',
+    ruleIds: [...new Set(scan.findings.map(item => item.ruleId))].sort(), blockingRuleIds: [...new Set(blocking.map(item => item.ruleId))].sort(), rollbackRequired: blocking.length > 0 }
+  const drift = await evaluateArchguardDrift([...history, ledgerEntry])
+  if (drift.trend === 'red') { ledgerEntry.status = 'blocked'; ledgerEntry.rollbackRequired = true }
+  return { checkpoint: { status: ledgerEntry.status, writeAllowed: !ledgerEntry.rollbackRequired,
+    rollbackRequired: ledgerEntry.rollbackRequired, findings: scan.findings, metrics: scan.metrics[0], drift,
+    instruction: drift.trend === 'red' ? 'rollback-block-and-interrupt-aimlock' : ledgerEntry.rollbackRequired ? 'rollback-block-and-correct' : 'accept-block' }, ledgerEntry }
+}
+
+export { evaluateArchguardFiles }

package/local-archguard-language-ast.mjs

@@ -0,0 +1,165 @@
+import Parser from 'web-tree-sitter';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+await Parser.init({ locateFile: name => require.resolve(`web-tree-sitter/${name}`) });
+const grammars = new Map();
+for (const language of ['css', 'python', 'java', 'rust']) {
+  grammars.set(language, await Parser.Language.load(require.resolve(`tree-sitter-wasms/out/tree-sitter-${language}.wasm`)));
+}
+const EXTENSIONS = new Map([['css', 'css'], ['wxss', 'css'], ['py', 'python'], ['java', 'java'], ['rs', 'rust']]);
+const ROOTS = { css: 'stylesheet', python: 'module', java: 'program', rust: 'source_file' };
+const FUNCTIONS = { css: [], python: ['function_definition', 'lambda'], java: ['method_declaration', 'constructor_declaration', 'lambda_expression'],
+  rust: ['function_item', 'closure_expression'] };
+const CONTROLS = new Set(['if_statement', 'for_statement', 'while_statement', 'do_statement', 'enhanced_for_statement',
+  'switch_expression', 'switch_statement', 'try_statement', 'catch_clause', 'except_clause', 'with_statement',
+  'match_statement', 'case_clause', 'if_expression', 'for_expression', 'while_expression', 'loop_expression', 'match_expression']);
+const SELECTORS = {
+  css: { FunctionDeclaration: [], FunctionExpression: [], ArrowFunction: [], MethodDeclaration: [], Constructor: [],
+    ClassDeclaration: [], ImportDeclaration: ['import_statement'], ExportDeclaration: [], CallExpression: ['call_expression'],
+    NewExpression: [], PropertyAssignment: ['declaration'], Block: ['block', 'keyframe_block_list'],
+    StringLiteral: ['string_value'], NumericLiteral: ['integer_value', 'float_value'], Identifier: ['identifier', 'property_name'],
+    IfStatement: [], ForStatement: [], WhileStatement: [], ReturnStatement: [] },
+  python: { FunctionDeclaration: ['function_definition'], MethodDeclaration: ['function_definition'], FunctionExpression: ['lambda'],
+    ArrowFunction: ['lambda'], ClassDeclaration: ['class_definition'], ImportDeclaration: ['import_statement', 'import_from_statement'],
+    ExportDeclaration: [], CallExpression: ['call'], NewExpression: [], Block: ['block'], StringLiteral: ['string'],
+    NumericLiteral: ['integer', 'float'], Identifier: ['identifier'], IfStatement: ['if_statement'],
+    ForStatement: ['for_statement'], WhileStatement: ['while_statement'], ReturnStatement: ['return_statement'],
+    ThrowStatement: ['raise_statement'], TryStatement: ['try_statement'], AwaitExpression: ['await'],
+    PropertyAccessExpression: ['attribute'], BinaryExpression: ['binary_operator', 'comparison_operator', 'boolean_operator'] },
+  java: { FunctionDeclaration: [], MethodDeclaration: ['method_declaration'], Constructor: ['constructor_declaration'],
+    FunctionExpression: ['lambda_expression'], ArrowFunction: ['lambda_expression'], ClassDeclaration: ['class_declaration'],
+    InterfaceDeclaration: ['interface_declaration'], ImportDeclaration: ['import_declaration'], ExportDeclaration: [],
+    CallExpression: ['method_invocation'], NewExpression: ['object_creation_expression'], Block: ['block', 'constructor_body'],
+    StringLiteral: ['string_literal'], NumericLiteral: ['decimal_integer_literal', 'decimal_floating_point_literal', 'hex_integer_literal'],
+    Identifier: ['identifier'], IfStatement: ['if_statement'], ForStatement: ['for_statement', 'enhanced_for_statement'],
+    WhileStatement: ['while_statement'], ReturnStatement: ['return_statement'], ThrowStatement: ['throw_statement'],
+    TryStatement: ['try_statement'], PropertyAccessExpression: ['field_access'], BinaryExpression: ['binary_expression'] },
+  rust: { FunctionDeclaration: ['function_item'], MethodDeclaration: ['function_item'], FunctionExpression: ['closure_expression'],
+    ArrowFunction: ['closure_expression'], ImportDeclaration: ['use_declaration', 'extern_crate_declaration'], ExportDeclaration: ['use_declaration'],
+    CallExpression: ['call_expression'], NewExpression: [], Block: ['block'], StringLiteral: ['string_literal', 'raw_string_literal'],
+    NumericLiteral: ['integer_literal', 'float_literal'], Identifier: ['identifier'], IfStatement: ['if_expression'],
+    ForStatement: ['for_expression'], WhileStatement: ['while_expression'], ReturnStatement: ['return_expression'],
+    AwaitExpression: ['await_expression'], PropertyAccessExpression: ['field_expression'], BinaryExpression: ['binary_expression'] },
+};
+export function archguardNativeLanguage(path) { return EXTENSIONS.get(path.split('.').at(-1)) ?? null; }
+function location(node, language) {
+  return { line: node.startPosition.row + 1, column: node.startPosition.column + 1, start: node.startIndex,
+    end: node.endIndex, syntaxKind: node.type, parser: `tree-sitter/${language}` };
+}
+function method(node, language) {
+  for (let parent = node.parent; parent; parent = parent.parent) {
+    if (language === 'python' && parent.type === 'class_definition') return true;
+    if (language === 'rust' && parent.type === 'impl_item') return true;
+    if (FUNCTIONS[language].includes(parent.type)) return false;
+  }
+  return false;
+}
+function selectorMatch(node, pattern, language, types) {
+  if (!types.includes(node.type)) return false;
+  if (['python', 'rust'].includes(language) && ['FunctionDeclaration', 'MethodDeclaration'].includes(pattern)) {
+    return method(node, language) === (pattern === 'MethodDeclaration');
+  }
+  if (language === 'rust' && pattern === 'ExportDeclaration') return node.namedChildren.some(child => child.type === 'visibility_modifier');
+  return true;
+}
+function nodeDepth(node, language) {
+  if (language === 'css') return ['block', 'keyframe_block_list'].includes(node.type) ? 1 : 0;
+  if (CONTROLS.has(node.type)) return 1;
+  if (!['block', 'constructor_body'].includes(node.type)) return 0;
+  if (language === 'python' && node.parent?.type === 'class_definition') return 0;
+  return CONTROLS.has(node.parent?.type) || ['else_clause', 'finally_clause'].includes(node.parent?.type) ? 0 : 1;
+}
+function stringValue(node) {
+  if (node.text.startsWith('"')) { try { return JSON.parse(node.text); } catch { return node.text.slice(1, -1); } }
+  return node.text.startsWith("'") ? node.text.slice(1, -1) : node.text;
+}
+function dependencies(node, language) {
+  if (language === 'python' && node.type === 'import_from_statement') {
+    const source = node.childForFieldName('module_name'); return source ? [{ dependency: source.text.split('.')[0], namespace: source.text }] : [];
+  }
+  if (language === 'python' && node.type === 'import_statement') return node.namedChildren.map(child => {
+    const source = child.type === 'aliased_import' ? child.childForFieldName('name') : child;
+    return { dependency: source.text.split('.')[0], namespace: source.text };
+  });
+  if (language === 'java' && node.type === 'import_declaration') {
+    const source = node.namedChildren.find(child => ['scoped_identifier', 'identifier'].includes(child.type));
+    if (!source) return [];
+    const dependency = source.text.startsWith('org.apache.commons.logging.') ? 'commons-logging' : source.text;
+    return [{ dependency, namespace: source.text }];
+  }
+  if (language === 'rust' && ['use_declaration', 'extern_crate_declaration'].includes(node.type)) {
+    const source = node.childForFieldName(node.type === 'use_declaration' ? 'argument' : 'name');
+    return source ? [{ dependency: source.text.replace(/^::/, '').split('::')[0], namespace: source.text }] : [];
+  }
+  if (language === 'css' && node.type === 'import_statement') {
+    const output = []; function collect(child) { if (child.type === 'string_value') output.push({ dependency: stringValue(child) });
+      else child.namedChildren.forEach(collect); } collect(node); return output;
+  }
+  return [];
+}
+function callName(node, language) {
+  if (language === 'python' && node.type === 'call') return node.childForFieldName('function')?.text ?? '';
+  if (language === 'java' && node.type === 'method_invocation') {
+    const object = node.childForFieldName('object')?.text; const name = node.childForFieldName('name')?.text;
+    return object ? `${object}.${name}` : name ?? '';
+  }
+  if (language === 'rust' && ['call_expression', 'macro_invocation'].includes(node.type)) {
+    return node.childForFieldName(node.type === 'macro_invocation' ? 'macro' : 'function')?.text ?? '';
+  }
+  if (language === 'css' && node.type === 'call_expression') return node.namedChildren[0]?.text ?? '';
+  return '';
+}
+function builtin(node, language) {
+  const output = []; const name = callName(node, language);
+  if ((language === 'python' && ['eval', 'exec', 'builtins.eval', 'builtins.exec'].includes(name))
+    || (language === 'java' && (name === 'eval' || name.endsWith('.eval')))
+    || (language === 'rust' && name === 'eval')) output.push('no-eval');
+  if ((language === 'python' && ['print', 'breakpoint'].includes(name))
+    || (language === 'java' && ['System.out.print', 'System.out.println', 'System.err.print', 'System.err.println'].includes(name))
+    || (language === 'rust' && node.type === 'macro_invocation' && ['dbg', 'println', 'eprintln'].includes(name))) output.push('no-debug');
+  if (language === 'css' && (node.type === 'color_value' || ['rgb', 'rgba', 'hsl', 'hsla'].includes(name))) output.push('no-hardcoded-color');
+  if (['integer', 'float', 'decimal_integer_literal', 'decimal_floating_point_literal', 'integer_literal', 'float_literal'].includes(node.type)
+    && Number(node.text.replace(/_/g, '')) > 1) output.push('no-magic-number');
+  return output;
+}
+export function analyzeArchguardLanguage(file, rules) {
+  const language = archguardNativeLanguage(file.path); if (!language) throw new Error('ARCH-AST-LANGUAGE-UNSUPPORTED');
+  const selected = new Map();
+  for (const rule of rules.filter(rule => rule.engine === 'ast')) {
+    const types = rule.pattern === 'SourceFile' ? [ROOTS[language]] : SELECTORS[language][rule.pattern];
+    if (!types) throw new Error(`ARCH-AST-SELECTOR-LANGUAGE-UNSUPPORTED: ${rule.pattern} in ${language}`);
+    selected.set(rule.id, { rule, types, locations: [] });
+  }
+  const parser = new Parser(); parser.setLanguage(grammars.get(language));
+  const tree = parser.parse(file.content);
+  try {
+    const diagnostics = [];
+    function errors(node) {
+      if (node.type === 'ERROR' || node.isMissing) diagnostics.push({ ...location(node, language), code: node.type === 'ERROR' ? 'ERROR' : 'MISSING' });
+      node.children.forEach(errors);
+    }
+    if (tree.rootNode.hasError) { errors(tree.rootNode); return { diagnostics: diagnostics.length ? diagnostics : [{ code: 'ERROR', line: 1, column: 1 }] }; }
+    const result = { selected, builtin: new Map(['no-eval', 'no-debug', 'no-inline-style', 'no-hardcoded-color', 'no-magic-number'].map(id => [id, []])),
+      dependencies: [], maxFunctionLines: 0, maxNestingDepth: 0, animations: 0, transitions: 0, diagnostics: [] };
+    function visit(node, depth) {
+      const next = depth + nodeDepth(node, language); result.maxNestingDepth = Math.max(result.maxNestingDepth, next);
+      if (FUNCTIONS[language].includes(node.type)) result.maxFunctionLines = Math.max(result.maxFunctionLines, node.endPosition.row - node.startPosition.row + 1);
+      for (const item of selected.values()) if (selectorMatch(node, item.rule.pattern, language, item.types)) {
+        item.locations.push({ ...location(node, language), semanticSyntaxKind: item.rule.pattern });
+      }
+      for (const id of builtin(node, language)) result.builtin.get(id).push(location(node, language));
+      for (const dependency of dependencies(node, language)) result.dependencies.push({ ...dependency, ...location(node, language) });
+      if (language === 'css') {
+        if (node.type === 'keyframes_statement') result.animations += 1;
+        if (node.type === 'declaration') {
+          const property = node.namedChildren.find(child => child.type === 'property_name')?.text;
+          if (['animation', 'animation-name'].includes(property)) result.animations += 1;
+          if (['transition', 'transition-property'].includes(property)) result.transitions += 1;
+        }
+      }
+      node.namedChildren.forEach(child => visit(child, next));
+    }
+    visit(tree.rootNode, 0); return result;
+  } finally { tree.delete(); parser.delete(); }
+}