@entrorove/skill 0.1.69 → 0.1.70

package/local-scope-read-set.mjs

@@ -0,0 +1,66 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+const context = new AsyncLocalStorage();
+const MAX_RECORDS = 32_768, MAX_PATH_BYTES = 4_194_304, MAX_DIRECTORY_ENTRIES = 32_768;
+const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+const changed = () => fail('ENTROROVE_SCOPE_CHANGED', 'Original scope resolver observations changed before signing');
+const fingerprint = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+function record(root, relative, kind, expected, inspect, directoryEntries = 0) {
+  const state = context.getStore();
+  if (!state || state.sealed) return;
+  if (root !== state.root || typeof relative !== 'string' || typeof inspect !== 'function') {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read observations require their original in-process root');
+  }
+  const key = `${kind}:${relative}`, checksum = fingerprint(expected), previous = state.records.get(key);
+  if (previous) { if (previous.checksum !== checksum) changed(); return; }
+  state.pathBytes += Buffer.byteLength(relative);
+  state.directoryEntries += directoryEntries;
+  if (state.records.size >= MAX_RECORDS || state.pathBytes > MAX_PATH_BYTES || state.directoryEntries > MAX_DIRECTORY_ENTRIES) {
+    fail('ENTROROVE_SCOPE_LIMIT', 'Scope resolver observations exceed their bounded in-process read set');
+  }
+  state.records.set(key, { checksum, inspect });
+}
+export function observeScopeAbsence(root, relative, inspect) {
+  record(root, relative, 'absence', false, async () => (await inspect()).exists);
+}
+export function observeScopeRead(root, relative, expected, inspect) {
+  record(root, relative, 'read', expected, inspect);
+}
+export function observeScopeTarget(root, relative, target, inspect) {
+  const kind = value => ({ exists: value.exists, file: value.stat?.isFile() ?? false, directory: value.stat?.isDirectory() ?? false });
+  record(root, relative, 'target', kind(target), async () => kind(await inspect()));
+}
+export function observeScopeDirectory(root, relative, names, inspect) {
+  record(root, relative, 'directory', names, inspect, names.length);
+}
+function sameRoot(before, after) {
+  return after.isDirectory() && !after.isSymbolicLink() && before.dev === after.dev && before.ino === after.ino;
+}
+export async function captureScopeReadSet(root, action) {
+  if (context.getStore() || typeof root !== 'string' || !path.isAbsolute(root) || typeof action !== 'function') {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read capture requires one actual independent observation');
+  }
+  const original = await fs.lstat(root);
+  if (!sameRoot(original, original) || await fs.realpath(root) !== root) {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read capture requires the original real repository root');
+  }
+  const state = { root, records: new Map(), pathBytes: 0, directoryEntries: 0, sealed: false };
+  let value;
+  try { value = await context.run(state, action); } finally { state.sealed = true; }
+  const verify = () => context.run(undefined, async () => {
+    try {
+      if (!sameRoot(original, await fs.lstat(root)) || await fs.realpath(root) !== root) changed();
+      for (const observation of state.records.values()) {
+        if (fingerprint(await observation.inspect()) !== observation.checksum) changed();
+      }
+      if (!sameRoot(original, await fs.lstat(root)) || await fs.realpath(root) !== root) changed();
+    } catch (error) {
+      if (error.code?.startsWith('ENTROROVE_')) throw error;
+      changed();
+    }
+  });
+  return { value, verify };
+}

package/local-scope-repository.mjs

@@ -17,8 +17,16 @@ import { createScopeImportResolver, unresolvedImportSite } from './local-scope-i
 import { isTypeOnlyReference, isDynamicFunctionReference } from './local-typescript-function-reference.mjs';
 import { createScopeRequireContexts } from './local-scope-create-require.mjs';
 import { resolveCreatedRequire } from './local-scope-require-resolution.mjs';
+import { uniConditionalVariants } from './local-scope-uni-conditional.mjs';
+import { createUniBuildInspection } from './local-scope-uni-build.mjs';
 
 const execute = promisify(execFile);
+const inspectionFreshness = new WeakMap();
+export async function verifyScopeInspectionFreshness(facts) {
+  const verify = facts && typeof facts === 'object' ? inspectionFreshness.get(facts.importGraph) : null;
+  if (!verify) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Fresh scope verification requires its original in-process graph inspection');
+  await verify();
+}
 async function git(root, args, allowed = [], input = { repositoryRoot: root }) {
   await assertBudgetRunnerAllowed(input);
   const executable = await scopeGitExecutable({ repositoryRoot: root });
@@ -93,6 +101,10 @@ export async function gitFacts(root, files, baselineRef, input = { repositoryRoo
 const scriptKinds = new Map([['.ts', ts.ScriptKind.TS], ['.mts', ts.ScriptKind.TS], ['.cts', ts.ScriptKind.TS],
   ['.tsx', ts.ScriptKind.TSX], ['.js', ts.ScriptKind.JS], ['.mjs', ts.ScriptKind.JS], ['.cjs', ts.ScriptKind.JS], ['.jsx', ts.ScriptKind.JSX]]);
 const dynamicNames = new Set(['eval', 'Function', 'createRequire']);
+function physicalImportSite(site, context) {
+  return { ...site, line: site.line + (context.lineOffset ?? 0),
+    column: site.line === 1 ? Math.max(1, site.column + (context.columnOffset ?? 0) - (context.syntheticPrefix ?? 0)) : site.column };
+}
 function staticString(expression) {
   while (expression && ts.isParenthesizedExpression(expression)) expression = expression.expression;
   if (!expression || (!ts.isStringLiteral(expression) && !ts.isNoSubstitutionTemplateLiteral(expression))) return null;
@@ -108,7 +120,11 @@ function globalObject(expression) {
 function scriptImports(source, filename, context = {}) {
   const parsed = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true,
     scriptKinds.get(path.extname(filename).toLowerCase()) ?? ts.ScriptKind.TS);
-  if (parsed.parseDiagnostics.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'source has invalid or unterminated syntax');
+  if (parsed.parseDiagnostics.length) {
+    const diagnostic = parsed.parseDiagnostics[0], location = parsed.getLineAndCharacterOfPosition(diagnostic.start ?? 0);
+    const site = physicalImportSite({ line: location.line + 1, column: location.character + 1 }, context);
+    scopeFail('ENTROROVE_IMPORT_INVALID', `${context.sourceFilename ?? filename}:${site.line}:${site.column}: source syntax diagnostic ${diagnostic.code}`);
+  }
   const found = new Set(), requires = new Map(), unresolvedImports = [], resolve = createScopeImportResolver(parsed); let dynamic = false;
   const contexts = createScopeRequireContexts(parsed, context.repositoryRoot, context.sourceFilename ?? filename);
   const unresolved = (expression, reason, message) => { dynamic = true;
@@ -160,11 +176,14 @@ function scriptImports(source, filename, context = {}) {
   };
   visit(parsed); return { specifiers: [...found].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
 }
-function vueScripts(source, filename) {
+function vueVariantScripts(source, filename, label) {
   const { descriptor, errors } = parseVue(source, { filename, sourceMap: false,
     templateParseOptions: { expressionPlugins: ['typescript'] } });
   vueParseCache.clear();
-  if (errors.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'component has invalid or unterminated syntax');
+  if (errors.length) {
+    const error = errors[0], location = error.loc?.start;
+    scopeFail('ENTROROVE_IMPORT_INVALID', `${filename}:${location?.line ?? 1}:${location?.column ?? 1}: component syntax diagnostic ${error.code ?? 'invalid'} (${label})`);
+  }
   if (descriptor.customBlocks.length || descriptor.template?.lang || descriptor.template?.src) {
     scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'component dependency inspection requires supported inline template syntax');
   }
@@ -174,29 +193,40 @@ function vueScripts(source, filename) {
     if (!['js', 'javascript', 'ts', 'typescript', 'jsx', 'tsx'].includes(language)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'component script language is unsupported');
     const extension = { javascript: 'js', typescript: 'ts' }[language] ?? language;
     scripts.push({ source: block.src ? `import ${JSON.stringify(block.src)};` : block.content, filename: `${filename}.${extension}`,
-      lineOffset: block.loc.start.line - 1, vueComponent: true, vueSetup: block === descriptor.scriptSetup });
+      lineOffset: block.loc.start.line - 1, columnOffset: block.loc.start.column - 1, vueComponent: true, vueSetup: block === descriptor.scriptSetup });
   }
   const seen = new WeakSet();
   const walk = node => {
     if (!node || typeof node !== 'object' || seen.has(node)) return;
     seen.add(node);
     if (node.type === 7 && ['on', 'for'].includes(node.name) && node.exp?.content) {
-      scripts.push({ source: node.name === 'for' ? `for (${node.exp.content}) {}` : node.exp.content, filename: `${filename}.ts` });
+      scripts.push({ source: node.name === 'for' ? `for (${node.exp.content}) {}` : node.exp.content, filename: `${filename}.ts`,
+        lineOffset: node.exp.loc.start.line - 1, columnOffset: node.exp.loc.start.column - 1, syntheticPrefix: node.name === 'for' ? 5 : 0 });
       seen.add(node.exp);
     }
-    if (node.type === 4 && !node.isStatic && node.content) scripts.push({ source: `void (${node.content});`, filename: `${filename}.ts` });
+    if (node.type === 4 && !node.isStatic && node.content) scripts.push({ source: `void (${node.content});`, filename: `${filename}.ts`,
+      lineOffset: node.loc.start.line - 1, columnOffset: node.loc.start.column - 1, syntheticPrefix: 6 });
     for (const [key, child] of Object.entries(node)) if (!['loc', 'ast', 'parent', 'codegenNode'].includes(key)) {
       if (Array.isArray(child)) child.forEach(walk); else walk(child);
     }
   };
   walk(descriptor.template?.ast); return scripts;
 }
-function importSpecifiers(content, filename, repositoryRoot) {
+function vueScripts(source, filename, conditional) {
+  const { variants } = conditional ?? uniConditionalVariants(source, filename), scripts = [], inspected = new Set();
+  for (const variant of variants) {
+    if (!variant.source.trim() || inspected.has(variant.source)) continue;
+    inspected.add(variant.source); scripts.push(...vueVariantScripts(variant.source, filename, variant.label));
+  }
+  if (!scripts.length && !variants.some(variant => variant.source.trim())) scopeFail('ENTROROVE_IMPORT_INVALID', `${filename}:1:1: component has no inspectable conditional branch`);
+  return scripts;
+}
+function importSpecifiers(content, filename, repositoryRoot, conditional) {
   try {
-    const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename) : [{ source, filename }];
+    const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename, conditional) : [{ source, filename }];
     const specifiers = new Set(), requires = new Map(), unresolvedImports = []; let dynamic = false;
     for (const part of parts) { const parsed = scriptImports(part.source, part.filename, { ...part, repositoryRoot, sourceFilename: filename }); dynamic ||= parsed.dynamic;
-      unresolvedImports.push(...parsed.unresolvedImports.map(site => ({ ...site, line: site.line + (part.lineOffset ?? 0) })));
+      unresolvedImports.push(...parsed.unresolvedImports.map(site => physicalImportSite(site, part)));
       for (const require of parsed.requires) requires.set(`${require.anchor}\0${require.specifier}`, require);
       for (const specifier of parsed.specifiers) specifiers.add(specifier); }
     return { specifiers: [...specifiers].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
@@ -261,6 +291,19 @@ async function configMetadata(root, relative, input) {
   const referenceRoot = outside ? await externalConfigReference(root, relative, resolved) : undefined;
   return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64'), realPath, referenceRoot };
 }
+async function conditionalBuildDirectory(root, relative, maximumEntries) {
+  const target = relative === '.' ? root : (await scopeTarget(root, relative, false, dependencyReference(relative))).target;
+  const directory = await fs.opendir(target); const environmentFiles = []; let entries = 0;
+  for await (const entry of directory) {
+    if (++entries > maximumEntries) scopeFail('ENTROROVE_SCOPE_LIMIT', 'Conditional build directory exceeds its bounded entry inspection');
+    if (entry.name === '.env' || entry.name.startsWith('.env.')) environmentFiles.push(entry.name);
+  }
+  return { environmentFiles, entries };
+}
+function conditionalBuildInspection(root, input) {
+  return createUniBuildInspection(relative => configMetadata(root, relative, input),
+    (relative, maximumEntries) => conditionalBuildDirectory(root, relative, maximumEntries));
+}
 async function resolveLocalImport(root, relative, required = true) {
   if (relative.startsWith('../') || relative === '..') scopeFail('ENTROROVE_PATH_UNSAFE', 'local import escapes the repository');
   const replacements = /\.js$/.test(relative) ? [relative.replace(/\.js$/, '.ts'), relative.replace(/\.js$/, '.tsx')] : [];
@@ -280,6 +323,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
   const pendingCreates = new Set(originals.filter(file => file.exists === false && input.scopeCreatePaths?.includes(file.path)).map(file => file.path));
   const workspace = await workspaceIndex(root, input);
   const metadata = new Map(workspace.metadata.map(item => [item.path, item]));
+  const inspectBuild = conditionalBuildInspection(root, input);
   while (pending.length) {
     const relative = pending.shift(); if (visited.has(relative)) continue;
     if (visited.size >= 1000) scopeFail('ENTROROVE_SCOPE_LIMIT', 'import graph exceeds the 1000-file inspection bound');
@@ -298,8 +342,10 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     const configPath = contexts[0]?.configPath;
     const aliases = await scopeTsconfigImports(target => configMetadata(root, target, input), relative, configPath);
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
+    const conditional = /\.vue$/i.test(relative) ? uniConditionalVariants(read.content.toString('utf8'), relative) : undefined;
+    if (conditional?.directives.length) for (const observed of await inspectBuild(relative, configPath)) metadata.set(observed.path, observed);
     const declarations = declarationModules(read.content, relative);
-    const imports = importSpecifiers(read.content, relative, root); dynamic ||= imports.dynamic;
+    const imports = importSpecifiers(read.content, relative, root, conditional); dynamic ||= imports.dynamic;
     unresolvedImports.push(...imports.unresolvedImports.map(site => ({ path: relative, ...site })));
     if (imports.dynamic) dynamicSources.push({ path: relative, sha256: read.sha256 });
     for (const specifier of imports.specifiers.sort()) {
@@ -327,18 +373,27 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
   }
   const nodes = [...visited.values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, nodes, input);
+  await inspectBuild.verify();
   const workspaceMetadata = [...metadata.values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, workspaceMetadata, input);
-  return { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
+  const graph = { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
     dynamic, complete: !dynamic, dynamicSources: dynamicSources.sort((a, b) => a.path.localeCompare(b.path)), workspaceMetadata,
     ...(unresolvedImports.length ? { unresolvedImports } : {}) };
+  const actualFiles = [...nodes, ...workspaceMetadata].map(file => ({ path: file.path, sha256: file.sha256 }));
+  inspectionFreshness.set(graph, async () => { await inspectBuild.verify(); await stableScope(root, actualFiles, input); });
+  return graph;
 }
 export async function scopeCandidateImports(root, file, input = { repositoryRoot: root }) {
-  const parsed = importSpecifiers(Buffer.from(file.content), file.path, root);
   const workspace = await workspaceIndex(root, input);
   const context = (input.importContexts ?? []).filter(item => file.path === item.sourcePrefix || file.path.startsWith(`${item.sourcePrefix}/`))
     .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
   const aliases = await scopeTsconfigImports(relative => configMetadata(root, relative, input), file.path, context?.configPath);
+  const conditional = /\.vue$/i.test(file.path) ? uniConditionalVariants(file.content, file.path) : undefined;
+  let inspectBuild;
+  if (conditional?.directives.length) {
+    inspectBuild = conditionalBuildInspection(root, input); await inspectBuild(file.path, context?.configPath);
+  }
+  const parsed = importSpecifiers(Buffer.from(file.content), file.path, root, conditional);
   const declarations = declarationModules(Buffer.from(file.content), file.path), edges = [];
   for (const specifier of parsed.specifiers) {
     const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);
@@ -349,6 +404,7 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
     await stableScope(root, resolved.metadata, input);
     edges.push({ from: file.path, to: resolved.external ? null : resolved.target, external: resolved.external, specifier: request.specifier });
   }
+  await inspectBuild?.verify();
   return { edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)), dynamic: parsed.dynamic,
     ...(parsed.unresolvedImports.length ? { unresolvedImports: parsed.unresolvedImports.map(site => ({ path: file.path, ...site })) } : {}) };
 }
@@ -366,6 +422,8 @@ export async function collectScopeFacts(root, requested, baselineRef, knownFiles
   }
   const graph = await importGraph(root, files, input);
   await contextEvidence(root, graph, input);
+  const verifyGraph = inspectionFreshness.get(graph), observedMetadata = graph.workspaceMetadata.map(file => ({ path: file.path, sha256: file.sha256 }));
+  inspectionFreshness.set(graph, async () => { await verifyGraph(); await stableScope(root, observedMetadata, input); });
   const observedGit = await observeGitFacts(root, files, baselineRef, input); const history = observedGit.facts;
   const modules = [...new Map(graph.nodes.map(node => [node.boundary.path, node.boundary])).values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, files, input);

package/local-scope-signature.mjs

@@ -2,9 +2,11 @@ import { createPrivateKey, createPublicKey, randomUUID, sign } from 'node:crypto
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { canonical, sha256 } from './local-integrity.mjs';
-import { scopeFail, scopeRead, scopeControlRead, scopeRoot } from './local-scope-files.mjs';
-import { collectScopeFacts } from './local-scope-repository.mjs';
+import { scopeFail, scopeRead, scopeControlRead, scopeRoot, stableScope } from './local-scope-files.mjs';
+import { collectScopeFacts, verifyScopeInspectionFreshness } from './local-scope-repository.mjs';
 import { readScopeSnapshot, verifyFreshScopeSnapshot } from './local-scope-snapshot.mjs';
+import { scopeGitMetadata } from './local-scope-git-reads.mjs';
+import { captureScopeReadSet } from './local-scope-read-set.mjs';
 import { resolveScopePaths } from './local-scope-context.mjs';
 import { rejectScopePrivileges, verifiedScopeCandidate } from './local-scope-candidate.mjs';
 
@@ -33,7 +35,31 @@ function binding(input, result) {
   for (const field of ['taskDigest', 'chainDigest']) if (!digest.test(String(input[field] ?? ''))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature requires original task and chain digests');
   if (!digest.test(String(result.snapshotDigest ?? ''))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature requires a verified preserved snapshot digest');
 }
-export async function attestScopeFacts(input, result, { maximumExpiresAt } = {}) {
+async function signingChallenge(input, beforeSign, maximumExpiresAt) {
+  if (beforeSign === undefined) return { input, maximumExpiresAt };
+  if (typeof beforeSign !== 'function' || !input.contextRevisionDigest || Object.hasOwn(input, 'handoffCandidate')) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Challenge renewal is restricted to an original context observation');
+  }
+  const fresh = await beforeSign();
+  if (!fresh || Object.keys(fresh).sort().join(',') !== 'challenge,maximumExpiresAt'
+    || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(fresh.challenge ?? '')
+    || !Number.isSafeInteger(fresh.maximumExpiresAt) || fresh.maximumExpiresAt <= Date.now()) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Actual scope signature requires a current exact challenge bound');
+  }
+  return { input: { ...input, challenge: fresh.challenge }, maximumExpiresAt: fresh.maximumExpiresAt };
+}
+async function verifySigningFreshness(input, root, actual) {
+  await verifyScopeInspectionFreshness(actual);
+  await verifyFreshScopeSnapshot(input, root, actual);
+  await stableScope(root, actual.importGraph.nodes, input);
+  await stableScope(root, actual.importGraph.workspaceMetadata, input);
+  await stableScope(root, actual.modules.filter(module => module.manifestPath)
+    .map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input);
+  if (actual.git.available && (await scopeGitMetadata(root, ['rev-parse', '--verify', 'HEAD'], input, [128]))?.trim() !== actual.git.head) {
+    scopeFail('ENTROROVE_SCOPE_CHANGED', 'Git HEAD changed before the original context signature');
+  }
+}
+export async function attestScopeFacts(input, result, { maximumExpiresAt, beforeSign } = {}) {
   if (maximumExpiresAt !== undefined && (!Number.isSafeInteger(maximumExpiresAt) || maximumExpiresAt < 1)) {
     scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature deadline must be a finite exact bound');
   }
@@ -42,8 +68,12 @@ export async function attestScopeFacts(input, result, { maximumExpiresAt } = {})
     || !Array.isArray(input.importContexts))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Context proof requires its exact contexts and revision digest together');
   if (input.signerConfigPath === undefined || input.signerConfigPath === null) return result;
   binding(input, result);
+  const inspectedInput = canonical(input);
   const root = await scopeRoot(input.repositoryRoot); const snapshot = await readScopeSnapshot(input, root);
-  const actual = await collectScopeFacts(root, await resolveScopePaths(input, root), input.baselineRef, snapshot.known, input);
+  const paths = await resolveScopePaths(input, root);
+  const inspect = () => collectScopeFacts(root, paths, input.baselineRef, snapshot.known, input);
+  const inspection = beforeSign ? await captureScopeReadSet(root, inspect) : { value: await inspect() };
+  const actual = inspection.value;
   actual.snapshotEvidence = await verifyFreshScopeSnapshot(input, root, actual);
   const candidate = await verifiedScopeCandidate(input, root, actual.snapshotEvidence.manifest);
   if (root !== result.repositoryRoot || canonical(actual) !== canonical(result.facts)
@@ -62,13 +92,26 @@ export async function attestScopeFacts(input, result, { maximumExpiresAt } = {})
     if (error.code === 'ENTROROVE_SCOPE_SIGNER_INVALID') throw error;
     scopeFail('ENTROROVE_SCOPE_SIGNER_INVALID', 'scope signer configuration or signing key could not be read');
   }
+  // The independent S scan is complete before requesting its short-lived signing challenge.
+  // The internal callback can change only the nonce and deadline, never observed facts or identity.
+  const originalInput = input;
+  ({ input, maximumExpiresAt } = await signingChallenge(input, beforeSign, maximumExpiresAt));
+  if (canonical(originalInput) !== inspectedInput || root !== result.repositoryRoot
+    || canonical(actual) !== canonical(result.facts) || actual.snapshotEvidence.snapshotDigest !== result.snapshotDigest) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signing preparation changed during challenge renewal');
+  }
+  if (beforeSign) { await inspection.verify(); await verifySigningFreshness(input, root, actual); }
+  if (canonical(originalInput) !== inspectedInput || root !== result.repositoryRoot
+    || canonical(actual) !== canonical(result.facts) || actual.snapshotEvidence.snapshotDigest !== result.snapshotDigest) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signing preparation changed before its actual signature');
+  }
   const now = Date.now();
   const expiresAt = Math.min(now + config.receiptTtlMs, candidate ? Date.parse(candidate.expiresAt) : Infinity,
     maximumExpiresAt ?? Infinity);
   if (expiresAt <= now) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'candidate challenge expired before its actual scope signature');
   const core = { schemaVersion: 'entrorove.scope-facts/1.0', flowId: input.flowId, stepId: input.stepId,
     taskDigest: input.taskDigest, ownerId: input.ownerId, chainDigest: input.chainDigest, repositoryId: input.repositoryId,
-    facts: result.facts, snapshotDigest: result.snapshotDigest, challenge: input.challenge,
+    facts: actual, snapshotDigest: actual.snapshotEvidence.snapshotDigest, challenge: input.challenge,
     issuedAt: new Date(now).toISOString(), expiresAt: new Date(expiresAt).toISOString(),
     nonce: randomUUID(), keyId: config.keyId,
     ...(input.contextRevisionDigest === undefined ? {} : { importContexts: input.importContexts, contextRevisionDigest: input.contextRevisionDigest }) };

package/local-scope-uni-build.mjs

@@ -0,0 +1,135 @@
+import path from 'node:path';
+import ts from 'typescript';
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+
+const controls = /\bUNI_(?:CUSTOM_DEFINE|SCRIPT_(?:DEFINE|ENV)|COMPILER_VERSION|APP_X(?:_DOM2)?|UTS_PLATFORM)\b/;
+const controlKeys = ['UNI_CUSTOM_DEFINE', 'UNI_SCRIPT_DEFINE', 'UNI_SCRIPT_ENV', 'UNI_COMPILER_VERSION', 'UNI_APP_X', 'UNI_APP_X_DOM2', 'UNI_UTS_PLATFORM'];
+const configNames = ['vite.config.js', 'vite.config.mjs', 'vite.config.cjs', 'vite.config.ts',
+  'vite.config.mts', 'vite.config.cts', 'vue.config.js', 'vue.config.cjs'];
+function staticConfiguration(source, filename, fail) {
+  if (controls.test(source)) throw fail('Custom conditional macro or compiler controls require explicit scanner support');
+  const tree = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS), imports = new Map();
+  if (tree.parseDiagnostics.length) throw fail('Conditional build configuration has invalid syntax');
+  let exported = false, nodes = 0;
+  const value = (node, depth = 0) => {
+    if (++nodes > 2048 || depth > 24) throw fail('Conditional build configuration exceeds its static inspection bound');
+    if (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node)) return value(node.expression, depth + 1);
+    if (ts.isStringLiteral(node) || ts.isNumericLiteral(node)
+      || [ts.SyntaxKind.TrueKeyword, ts.SyntaxKind.FalseKeyword, ts.SyntaxKind.NullKeyword].includes(node.kind)) return;
+    if (ts.isArrayLiteralExpression(node)) { for (const item of node.elements) value(item, depth + 1); return; }
+    if (ts.isObjectLiteralExpression(node)) {
+      for (const property of node.properties) {
+        if (!ts.isPropertyAssignment(property) || ts.isComputedPropertyName(property.name)) throw fail('Dynamic build properties cannot establish default conditional macros');
+        value(property.initializer, depth + 1);
+      }
+      return;
+    }
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
+      const operation = imports.get(node.expression.text);
+      if (operation === 'uni' && node.arguments.length === 0) return;
+      if (operation === 'defineConfig' && node.arguments.length === 1) return value(node.arguments[0], depth + 1);
+    }
+    throw fail('Dynamic build configuration cannot establish default conditional macros without execution');
+  };
+  for (const statement of tree.statements) {
+    if (ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier)) {
+      const module = statement.moduleSpecifier.text, clause = statement.importClause;
+      if (module === '@dcloudio/vite-plugin-uni' && clause?.name && !clause.namedBindings) imports.set(clause.name.text, 'uni');
+      else if (module === 'vite' && !clause?.name && clause?.namedBindings && ts.isNamedImports(clause.namedBindings)
+        && clause.namedBindings.elements.every(element => (element.propertyName ?? element.name).text === 'defineConfig')) {
+        for (const element of clause.namedBindings.elements) imports.set(element.name.text, 'defineConfig');
+      } else throw fail('Custom build imports cannot establish default conditional macros without execution');
+    } else if (ts.isExportAssignment(statement) && !exported && !statement.isExportEquals) { exported = true; value(statement.expression); }
+    else if (ts.isExpressionStatement(statement) && !exported && ts.isBinaryExpression(statement.expression)
+      && statement.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken
+      && statement.expression.left.getText(tree) === 'module.exports') { exported = true; value(statement.expression.right); }
+    else if (!ts.isEmptyStatement(statement)) throw fail('Custom build statements cannot establish default conditional macros without execution');
+  }
+  if (!exported) throw fail('Conditional build configuration requires a statically inspectable export');
+}
+function packageConfiguration(source, fail) {
+  let manifest;
+  try { manifest = JSON.parse(source); } catch { throw fail('Conditional build package manifest is invalid JSON'); }
+  const scripts = manifest?.['uni-app']?.scripts;
+  if (scripts !== undefined) {
+    if (!scripts || typeof scripts !== 'object' || Array.isArray(scripts)) throw fail('Custom uni-app build scripts are not statically inspectable');
+    for (const configuration of Object.values(scripts)) {
+      if (!configuration || typeof configuration !== 'object' || Array.isArray(configuration)) throw fail('Custom uni-app build entry is not statically inspectable');
+      if (configuration.define !== undefined && (!configuration.define || typeof configuration.define !== 'object'
+        || Array.isArray(configuration.define) || Object.keys(configuration.define).length)) {
+        throw fail('Custom uni-app defines, including builtin macro overrides, require explicit scanner support');
+      }
+      if (controls.test(JSON.stringify(configuration))) throw fail('Custom conditional build environment requires explicit scanner support');
+    }
+  }
+  for (const [name, command] of Object.entries(manifest?.scripts ?? {})) {
+    if (typeof command !== 'string' || controls.test(command)) throw fail('Custom conditional build command requires explicit scanner support');
+    if (/^(?:dev|build)(?::|$)/.test(name) && (!/^(?:cross-env\s+NODE_ENV=(?:development|production|test)\s+)?(?:uni|vite|vue-cli-service\s+uni-(?:build|serve))(?:\s+[A-Za-z0-9_./:@=-]+)*$/.test(command)
+      || /(?:^|\s)(?:--config(?:[=\s]|$)|-c(?:\s|$)|--define(?:[=\s]|$))/.test(command))) {
+      throw fail('Custom conditional build command requires explicit scanner support');
+    }
+  }
+}
+function parentDirectories(relative, output, fail) {
+  let directory = path.posix.dirname(relative);
+  while (true) {
+    output.add(directory);
+    if (output.size > 128) throw fail('Conditional build roots exceed their 128-directory inspection bound');
+    if (directory === '.') return;
+    directory = path.posix.dirname(directory);
+  }
+}
+function assertProcessControls(filename) {
+  const present = controlKeys.filter(key => Object.hasOwn(process.env, key) || Object.hasOwn(process, key));
+  if (present.length) throw uniConditionalError(filename, 0, `Conditional compilation override controls are unsupported: ${present.join(', ')}`);
+}
+export function createUniBuildInspection(read, inspectDirectory) {
+  const inspected = new Map(), directoriesInspected = new Set(); let candidates = 0, bytes = 0, directoryEntries = 0;
+  const inspect = async relative => {
+    if (inspected.has(relative)) return inspected.get(relative);
+    if (++candidates > 2048) throw uniConditionalError(relative, 0, 'Conditional build lookup exceeds its 2048-path bound');
+    let item;
+    try { item = await read(relative); } catch (error) { if (error.code === 'ENOENT') { inspected.set(relative, null); return null; } throw error; }
+    const source = Buffer.from(item.contentBase64, 'base64').toString('utf8'), fail = reason => uniConditionalError(relative, 0, reason);
+    bytes += Buffer.byteLength(source);
+    if (Buffer.byteLength(source) > 1_048_576 || bytes > 8_388_608) throw fail('Conditional build metadata exceeds its bounded inspection size');
+    if (relative.endsWith('package.json')) packageConfiguration(source, fail); else staticConfiguration(source, relative, fail);
+    const observed = { path: item.path, sha256: item.sha256 }; inspected.set(relative, observed); return observed;
+  };
+  const inspectSource = async (sourcePath, configPath) => {
+    const directories = new Set(), fail = reason => uniConditionalError(sourcePath, 0, reason);
+    assertProcessControls(sourcePath);
+    parentDirectories(sourcePath, directories, fail); if (configPath) parentDirectories(configPath, directories, fail);
+    const observations = new Map();
+    for (const directory of directories) {
+      if (!directoriesInspected.has(directory)) {
+        if (typeof inspectDirectory !== 'function') throw fail('Conditional build environment absence requires actual bounded directory inspection');
+        const listing = await inspectDirectory(directory, Math.min(8192, 32768 - directoryEntries));
+        directoryEntries += listing.entries;
+        if (listing.environmentFiles.length) throw fail('Conditional sources with ancestor environment files require explicit scanner support; environment values were not read');
+        directoriesInspected.add(directory);
+      }
+      for (const name of ['package.json', ...configNames]) {
+        const relative = directory === '.' ? name : `${directory}/${name}`, observed = await inspect(relative);
+        if (observed) observations.set(relative, observed);
+      }
+    }
+    return [...observations.values()];
+  };
+  inspectSource.verify = async () => {
+    if (!directoriesInspected.size) return;
+    assertProcessControls('conditional-build'); let entries = 0;
+    for (const directory of directoriesInspected) {
+      const listing = await inspectDirectory(directory, Math.min(8192, 32768 - entries)); entries += listing.entries;
+      if (listing.environmentFiles.length) throw Object.assign(uniConditionalError(directory, 0,
+        'Conditional build environment appeared after its actual inspection; environment values were not read'), { code: 'ENTROROVE_SCOPE_CHANGED' });
+    }
+    for (const [relative, expected] of inspected) {
+      let actual;
+      try { actual = await read(relative); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+      if ((actual?.sha256 ?? null) !== (expected?.sha256 ?? null)) throw Object.assign(
+        uniConditionalError(relative, 0, 'Conditional build metadata changed during inspection'), { code: 'ENTROROVE_SCOPE_CHANGED' });
+    }
+  };
+  return inspectSource;
+}

package/local-scope-uni-conditional.mjs

@@ -0,0 +1,54 @@
+import { uniDirectives } from './local-scope-uni-directives.mjs';
+import { uniCondition, uniConditionContexts, uniConditionalError } from './local-scope-uni-expressions.mjs';
+
+const blank = source => source.replace(/[^\r\n]/g, ' ');
+function conditionalSegments(source, directives, filename) {
+  const stack = [], segments = [], conditions = []; let cursor = 0, conditionTokens = 0;
+  for (const item of directives) {
+    segments.push({ start: cursor, end: item.start, guards: stack.map(guard => ({ ...guard })) });
+    segments.push({ start: item.start, end: item.end, directive: true }); cursor = item.end;
+    const fail = reason => uniConditionalError(filename, item.start, reason, source);
+    if (['ifdef', 'ifndef', 'if'].includes(item.kind)) {
+      if (stack.length >= 32) throw fail('Conditional compilation exceeds its 32-level nesting bound');
+      const condition = uniCondition(item.expression, fail), index = conditions.length;
+      if ((conditionTokens += condition.tokens) > 4096) throw fail('Conditional expressions exceed their 4096-token aggregate inspection bound');
+      conditions.push(condition); stack.push({ index, negated: item.kind === 'ifndef', syntax: item.syntax, alternative: false });
+    } else {
+      const active = stack.at(-1);
+      if (!active || active.syntax !== item.syntax) throw fail('Conditional directive has no matching opening in the same source language');
+      if (item.kind === 'else') {
+        if (active.alternative) throw fail('Conditional block has more than one alternative');
+        active.negated = !active.negated; active.alternative = true;
+      } else stack.pop();
+    }
+  }
+  if (stack.length) throw uniConditionalError(filename, directives.at(-1).start, 'Conditional block is missing its matching endif', source);
+  segments.push({ start: cursor, end: source.length, guards: [] });
+  return { conditions, segments };
+}
+const activeSegment = (segment, key) => !segment.directive && segment.guards.every(guard => (key[guard.index] === '1') !== guard.negated);
+export function uniConditionalVariants(source, filename) {
+  const fail = reason => uniConditionalError(filename, 0, reason, source);
+  if (typeof source !== 'string') throw fail('Conditional inspection requires actual source text');
+  const unchanged = () => ({ directives: [], variants: [{ source, key: '', label: 'unconditional' }] });
+  if (!/(?:<!--|\/\/|\/\*)[ \t]*#/i.test(source)) return unchanged();
+  if (Buffer.byteLength(source) > 2_097_152) throw fail('Conditional source exceeds its 2 MiB inspection bound');
+  try {
+    const directives = uniDirectives(source, filename);
+    if (!directives.length) return unchanged();
+    const { conditions, segments } = conditionalSegments(source, directives, filename), contexts = uniConditionContexts(conditions, fail);
+    if (Buffer.byteLength(source) * contexts.length > 33_554_432) throw fail('Conditional source variants exceed their 32 MiB inspection bound');
+    for (const segment of segments) if (!segment.directive && source.slice(segment.start, segment.end).trim()
+      && !contexts.some(context => activeSegment(segment, context.key))) {
+      throw uniConditionalError(filename, segment.start, 'Conditional branch has no proven platform context; custom or contradictory build definitions require explicit support', source);
+    }
+    const variants = contexts.map(context => ({ key: context.key, label: context.label,
+      source: segments.map(segment => {
+        const text = source.slice(segment.start, segment.end); return activeSegment(segment, context.key) ? text : blank(text);
+      }).join('') }));
+    return { directives: directives.map(({ kind, expression, syntax }) => ({ kind, expression, syntax })), variants };
+  } catch (error) {
+    if (error instanceof RangeError) throw Object.assign(fail('Conditional syntax exceeds its parser or traversal bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+    throw error;
+  }
+}

package/local-scope-uni-directives.mjs

@@ -0,0 +1,96 @@
+import ts from 'typescript';
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+
+function directive(source, start, end, text, syntax, filename, output) {
+  const match = /^\s*#([a-z]+)\b([\s\S]*)$/i.exec(text);
+  if (!match) return;
+  const kind = match[1].toLowerCase(), expression = match[2].trim();
+  if (!['ifdef', 'ifndef', 'if', 'else', 'endif', 'elif', 'elseif', 'exec', 'include', 'define', 'exclude', 'endexclude'].includes(kind)) return;
+  if (!['ifdef', 'ifndef', 'if', 'else', 'endif'].includes(kind) || /[\r\n]/.test(expression)
+    || ['else', 'endif'].includes(kind) && expression) {
+    throw uniConditionalError(filename, start, 'Conditional directive syntax is unsupported', source);
+  }
+  if (output.length >= 256) throw uniConditionalError(filename, start, 'Conditional directives exceed their 256-entry bound', source);
+  output.push({ start, end, kind, expression, syntax });
+}
+function literalRanges(content, kind) {
+  const parsed = ts.createSourceFile('uni-script.ts', content, ts.ScriptTarget.Latest, true, kind);
+  const pending = [parsed], ranges = []; let nodes = 0;
+  while (pending.length) {
+    const node = pending.pop();
+    if (++nodes > 200_000) throw new RangeError('Conditional lexical inspection exceeds its node bound');
+    if (ts.isStringLiteralLike(node) || ts.isRegularExpressionLiteral(node)
+      || [ts.SyntaxKind.TemplateHead, ts.SyntaxKind.TemplateMiddle, ts.SyntaxKind.TemplateTail].includes(node.kind)) {
+      ranges.push({ start: node.getStart(parsed), end: node.end });
+    } else ts.forEachChild(node, child => { pending.push(child); });
+  }
+  return ranges.sort((a, b) => a.start - b.start);
+}
+function scriptComments(source, start, end, filename, output, kind) {
+  const content = source.slice(start, end), literals = literalRanges(content, kind); let literal = 0;
+  for (let index = 0; index < content.length;) {
+    while (literals[literal]?.end <= index) literal++;
+    if (literals[literal]?.start <= index) { index = literals[literal].end; continue; }
+    if (content.startsWith('//', index)) {
+      let next = index + 2; while (next < content.length && !['\r', '\n'].includes(content[next])) next++;
+      directive(source, start + index, start + next, content.slice(index + 2, next), 'js', filename, output); index = next;
+    } else if (content.startsWith('/*', index)) {
+      const finish = content.indexOf('*/', index + 2), next = finish < 0 ? content.length : finish + 2;
+      directive(source, start + index, start + next, content.slice(index + 2, finish < 0 ? next : finish), 'js', filename, output); index = next;
+    } else index++;
+  }
+}
+function quoteEnd(source, index, quote, end = source.length) {
+  for (let cursor = index + 1; cursor < end; cursor++) {
+    if (source[cursor] === '\\') cursor++;
+    else if (source[cursor] === quote) return cursor + 1;
+  }
+  return end;
+}
+function styleComments(source, start, end, filename, output) {
+  for (let cursor = start; cursor < end;) {
+    if (['"', "'"].includes(source[cursor])) cursor = quoteEnd(source, cursor, source[cursor], end);
+    else if (source.startsWith('/*', cursor)) {
+      const finish = source.indexOf('*/', cursor + 2), next = finish < 0 || finish >= end ? end : finish + 2;
+      directive(source, cursor, next, source.slice(cursor + 2, next - 2), 'css', filename, output); cursor = next;
+    } else cursor++;
+  }
+}
+function tagEnd(source, start) {
+  for (let cursor = start; cursor < source.length; cursor++) {
+    if (['"', "'"].includes(source[cursor])) cursor = quoteEnd(source, cursor, source[cursor]) - 1;
+    else if (source[cursor] === '>') return cursor + 1;
+  }
+  return source.length;
+}
+function interpolationEnd(source, start) {
+  for (let cursor = start + 2; cursor < source.length; cursor++) {
+    if (['"', "'", '`'].includes(source[cursor])) cursor = quoteEnd(source, cursor, source[cursor]) - 1;
+    else if (source.startsWith('}}', cursor)) return cursor + 2;
+  }
+  return source.length;
+}
+export function uniDirectives(source, filename) {
+  const output = []; let inTag = false;
+  for (let cursor = 0; cursor < source.length;) {
+    if (source.startsWith('<!--', cursor)) {
+      const finish = source.indexOf('-->', cursor + 4), next = finish < 0 ? source.length : finish + 3;
+      directive(source, cursor, next, source.slice(cursor + 4, finish < 0 ? next : finish), 'html', filename, output); cursor = next;
+    } else if (inTag && ['"', "'"].includes(source[cursor])) cursor = quoteEnd(source, cursor, source[cursor]);
+    else if (source.startsWith('{{', cursor)) cursor = interpolationEnd(source, cursor);
+    else {
+      const block = /^<(script|style)\b/i.exec(source.slice(cursor, cursor + 16));
+      if (block) {
+        const start = tagEnd(source, cursor), closing = new RegExp(`</${block[1]}\\s*>`, 'ig'); closing.lastIndex = start;
+        const match = closing.exec(source), end = match?.index ?? source.length;
+        if (block[1].toLowerCase() === 'script') {
+          const header = source.slice(cursor, start), language = /\blang\s*=\s*['"]([^'"]+)['"]/i.exec(header)?.[1];
+          scriptComments(source, start, end, filename, output, ['ts', 'typescript'].includes(language) ? ts.ScriptKind.TS : ts.ScriptKind.TSX);
+        }
+        else styleComments(source, start, end, filename, output);
+        cursor = match ? closing.lastIndex : source.length; inTag = false;
+      } else { if (source[cursor] === '<') inTag = true; else if (source[cursor] === '>') inTag = false; cursor++; }
+    }
+  }
+  return output;
+}