@entrorove/skill 0.1.69 → 0.1.71

package/local-scope-repository.mjs

@@ -5,7 +5,7 @@ import { promisify } from 'node:util';
 import { builtinModules } from 'node:module';
 import ts from 'typescript';
 import { parse as parseVue, parseCache as vueParseCache } from '@vue/compiler-sfc';
-import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeProbeTarget, scopeRead, scopeTarget, stableScope } from './local-scope-files.mjs';
+import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeProbeTarget, scopeRead, scopeBuildSourceRead, scopeTarget, stableScope } from './local-scope-files.mjs';
 import { sha256 } from './local-integrity.mjs';
 import { workspaceImport, workspaceIndex } from './local-scope-workspaces.mjs';
 import { assertBudgetRunnerAllowed } from './local-budget-reads.mjs';
@@ -17,8 +17,18 @@ import { createScopeImportResolver, unresolvedImportSite } from './local-scope-i
 import { isTypeOnlyReference, isDynamicFunctionReference } from './local-typescript-function-reference.mjs';
 import { createScopeRequireContexts } from './local-scope-create-require.mjs';
 import { resolveCreatedRequire } from './local-scope-require-resolution.mjs';
+import { uniConditionalVariants } from './local-scope-uni-conditional.mjs';
+import { createUniBuildInspection } from './local-scope-uni-build.mjs';
+import { createScopeBuildIO } from './local-scope-build-io.mjs';
+import { observeBuildFacts } from './local-scope-build-facts.mjs';
 
 const execute = promisify(execFile);
+const inspectionFreshness = new WeakMap();
+export async function verifyScopeInspectionFreshness(facts) {
+  const verify = facts && typeof facts === 'object' ? inspectionFreshness.get(facts.importGraph) : null;
+  if (!verify) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Fresh scope verification requires its original in-process graph inspection');
+  await verify();
+}
 async function git(root, args, allowed = [], input = { repositoryRoot: root }) {
   await assertBudgetRunnerAllowed(input);
   const executable = await scopeGitExecutable({ repositoryRoot: root });
@@ -93,6 +103,10 @@ export async function gitFacts(root, files, baselineRef, input = { repositoryRoo
 const scriptKinds = new Map([['.ts', ts.ScriptKind.TS], ['.mts', ts.ScriptKind.TS], ['.cts', ts.ScriptKind.TS],
   ['.tsx', ts.ScriptKind.TSX], ['.js', ts.ScriptKind.JS], ['.mjs', ts.ScriptKind.JS], ['.cjs', ts.ScriptKind.JS], ['.jsx', ts.ScriptKind.JSX]]);
 const dynamicNames = new Set(['eval', 'Function', 'createRequire']);
+function physicalImportSite(site, context) {
+  return { ...site, line: site.line + (context.lineOffset ?? 0),
+    column: site.line === 1 ? Math.max(1, site.column + (context.columnOffset ?? 0) - (context.syntheticPrefix ?? 0)) : site.column };
+}
 function staticString(expression) {
   while (expression && ts.isParenthesizedExpression(expression)) expression = expression.expression;
   if (!expression || (!ts.isStringLiteral(expression) && !ts.isNoSubstitutionTemplateLiteral(expression))) return null;
@@ -108,7 +122,11 @@ function globalObject(expression) {
 function scriptImports(source, filename, context = {}) {
   const parsed = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true,
     scriptKinds.get(path.extname(filename).toLowerCase()) ?? ts.ScriptKind.TS);
-  if (parsed.parseDiagnostics.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'source has invalid or unterminated syntax');
+  if (parsed.parseDiagnostics.length) {
+    const diagnostic = parsed.parseDiagnostics[0], location = parsed.getLineAndCharacterOfPosition(diagnostic.start ?? 0);
+    const site = physicalImportSite({ line: location.line + 1, column: location.character + 1 }, context);
+    scopeFail('ENTROROVE_IMPORT_INVALID', `${context.sourceFilename ?? filename}:${site.line}:${site.column}: source syntax diagnostic ${diagnostic.code}`);
+  }
   const found = new Set(), requires = new Map(), unresolvedImports = [], resolve = createScopeImportResolver(parsed); let dynamic = false;
   const contexts = createScopeRequireContexts(parsed, context.repositoryRoot, context.sourceFilename ?? filename);
   const unresolved = (expression, reason, message) => { dynamic = true;
@@ -160,11 +178,14 @@ function scriptImports(source, filename, context = {}) {
   };
   visit(parsed); return { specifiers: [...found].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
 }
-function vueScripts(source, filename) {
+function vueVariantScripts(source, filename, label) {
   const { descriptor, errors } = parseVue(source, { filename, sourceMap: false,
     templateParseOptions: { expressionPlugins: ['typescript'] } });
   vueParseCache.clear();
-  if (errors.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'component has invalid or unterminated syntax');
+  if (errors.length) {
+    const error = errors[0], location = error.loc?.start;
+    scopeFail('ENTROROVE_IMPORT_INVALID', `${filename}:${location?.line ?? 1}:${location?.column ?? 1}: component syntax diagnostic ${error.code ?? 'invalid'} (${label})`);
+  }
   if (descriptor.customBlocks.length || descriptor.template?.lang || descriptor.template?.src) {
     scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'component dependency inspection requires supported inline template syntax');
   }
@@ -174,29 +195,40 @@ function vueScripts(source, filename) {
     if (!['js', 'javascript', 'ts', 'typescript', 'jsx', 'tsx'].includes(language)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'component script language is unsupported');
     const extension = { javascript: 'js', typescript: 'ts' }[language] ?? language;
     scripts.push({ source: block.src ? `import ${JSON.stringify(block.src)};` : block.content, filename: `${filename}.${extension}`,
-      lineOffset: block.loc.start.line - 1, vueComponent: true, vueSetup: block === descriptor.scriptSetup });
+      lineOffset: block.loc.start.line - 1, columnOffset: block.loc.start.column - 1, vueComponent: true, vueSetup: block === descriptor.scriptSetup });
   }
   const seen = new WeakSet();
   const walk = node => {
     if (!node || typeof node !== 'object' || seen.has(node)) return;
     seen.add(node);
     if (node.type === 7 && ['on', 'for'].includes(node.name) && node.exp?.content) {
-      scripts.push({ source: node.name === 'for' ? `for (${node.exp.content}) {}` : node.exp.content, filename: `${filename}.ts` });
+      scripts.push({ source: node.name === 'for' ? `for (${node.exp.content}) {}` : node.exp.content, filename: `${filename}.ts`,
+        lineOffset: node.exp.loc.start.line - 1, columnOffset: node.exp.loc.start.column - 1, syntheticPrefix: node.name === 'for' ? 5 : 0 });
       seen.add(node.exp);
     }
-    if (node.type === 4 && !node.isStatic && node.content) scripts.push({ source: `void (${node.content});`, filename: `${filename}.ts` });
+    if (node.type === 4 && !node.isStatic && node.content) scripts.push({ source: `void (${node.content});`, filename: `${filename}.ts`,
+      lineOffset: node.loc.start.line - 1, columnOffset: node.loc.start.column - 1, syntheticPrefix: 6 });
     for (const [key, child] of Object.entries(node)) if (!['loc', 'ast', 'parent', 'codegenNode'].includes(key)) {
       if (Array.isArray(child)) child.forEach(walk); else walk(child);
     }
   };
   walk(descriptor.template?.ast); return scripts;
 }
-function importSpecifiers(content, filename, repositoryRoot) {
+function vueScripts(source, filename, conditional) {
+  const { variants } = conditional ?? uniConditionalVariants(source, filename), scripts = [], inspected = new Set();
+  for (const variant of variants) {
+    if (!variant.source.trim() || inspected.has(variant.source)) continue;
+    inspected.add(variant.source); scripts.push(...vueVariantScripts(variant.source, filename, variant.label));
+  }
+  if (!scripts.length && !variants.some(variant => variant.source.trim())) scopeFail('ENTROROVE_IMPORT_INVALID', `${filename}:1:1: component has no inspectable conditional branch`);
+  return scripts;
+}
+function importSpecifiers(content, filename, repositoryRoot, conditional) {
   try {
-    const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename) : [{ source, filename }];
+    const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename, conditional) : [{ source, filename }];
     const specifiers = new Set(), requires = new Map(), unresolvedImports = []; let dynamic = false;
     for (const part of parts) { const parsed = scriptImports(part.source, part.filename, { ...part, repositoryRoot, sourceFilename: filename }); dynamic ||= parsed.dynamic;
-      unresolvedImports.push(...parsed.unresolvedImports.map(site => ({ ...site, line: site.line + (part.lineOffset ?? 0) })));
+      unresolvedImports.push(...parsed.unresolvedImports.map(site => physicalImportSite(site, part)));
       for (const require of parsed.requires) requires.set(`${require.anchor}\0${require.specifier}`, require);
       for (const specifier of parsed.specifiers) specifiers.add(specifier); }
     return { specifiers: [...specifiers].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
@@ -214,6 +246,9 @@ function declarationModules(content, from) {
     && node.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.DeclareKeyword)).map(node => node.name.text));
 }
 async function resolveImport(root, from, specifier, workspace, input, aliases, configPath, declarations) {
+  if (specifier.startsWith('/') || /^[A-Za-z]:/.test(specifier) || specifier.includes('\\') || /[\u0000-\u001f\u007f]/.test(specifier)) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', 'Source module addresses require safe repository-relative or declared package selectors');
+  }
   if (/^(?:https?:|file:|data:)/i.test(specifier)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'remote source imports cannot be inspected as local facts');
   if (declarations.has(specifier)) return null;
   const label = /^[A-Za-z0-9@._/~+-]{1,256}$/.test(specifier) ? specifier : '[unsupported specifier]';
@@ -228,9 +263,9 @@ async function resolveImport(root, from, specifier, workspace, input, aliases, c
   const localPackage = !specifier.startsWith('.') ? workspaceImport(workspace, specifier) : null;
   if (!specifier.startsWith('.') && !localPackage) {
     if (builtinModules.includes(specifier) || (specifier.startsWith('node:') && builtinModules.includes(specifier.slice(5)))) return null;
-    const boundary = await packageBoundary(root, configPath ?? from, input);
+    const boundary = await packageBoundary(root, configPath ?? from, input, scopeBuildSourceRead);
     if (boundary.manifestPath) {
-      const manifest = JSON.parse((await scopeRead(root, boundary.manifestPath, input)).content.toString('utf8'));
+      const manifest = JSON.parse((await scopeBuildSourceRead(root, boundary.manifestPath, input)).content.toString('utf8'));
       const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
       if (['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'].some(field => Object.hasOwn(manifest[field] ?? {}, name))) return null;
     }
@@ -254,12 +289,29 @@ async function externalConfigReference(root, relative, resolved) {
 async function configMetadata(root, relative, input) {
   const target = await scopeProbeTarget(root, relative, dependencyReference(relative));
   if (!target.exists || !target.stat.isFile()) throw Object.assign(new Error(`Missing configuration file: ${relative}`), { code: 'ENOENT' });
-  const read = await scopeRead(root, relative, input), resolved = await fs.realpath(target.target);
+  const read = await scopeBuildSourceRead(root, relative, input), resolved = await fs.realpath(target.target);
   const physical = path.relative(root, resolved).split(path.sep).join('/');
   const outside = physical === '..' || physical.startsWith('../') || path.isAbsolute(physical);
   const realPath = outside ? relative : physical;
   const referenceRoot = outside ? await externalConfigReference(root, relative, resolved) : undefined;
-  return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64'), realPath, referenceRoot };
+  return { path: relative, sha256: read.sha256, mode: read.mode, contentBase64: read.content.toString('base64'), realPath, referenceRoot };
+}
+function conditionalBuildInspection(root, input) {
+  const io = createScopeBuildIO(root, relative => configMetadata(root, relative, input));
+  return createUniBuildInspection(io.read, io.inspectDirectory, { probe: io.probe, repositoryRoot: root });
+}
+function sourceProjection(content, relative, root) {
+  // Only these pure parsers run here. Filesystem, privacy and budget checks occur
+  // outside this boundary and cannot become a semantic uncertainty.
+  try {
+    const conditional = /\.vue$/i.test(relative) ? uniConditionalVariants(content.toString('utf8'), relative) : undefined;
+    return { conditional, imports: importSpecifiers(content, relative, root, conditional) };
+  } catch (error) {
+    if (error.code !== 'ENTROROVE_IMPORT_UNSUPPORTED') throw error;
+    return { conditional: undefined, imports: { specifiers: [], requires: [], dynamic: true,
+      unresolvedImports: [{ line: error.line ?? 1, column: error.column ?? 1, reason: 'source-projection-unsupported',
+        message: 'Source syntax has no supported static projection; the original hashed source remains read-only' }] } };
+  }
 }
 async function resolveLocalImport(root, relative, required = true) {
   if (relative.startsWith('../') || relative === '..') scopeFail('ENTROROVE_PATH_UNSAFE', 'local import escapes the repository');
@@ -275,11 +327,14 @@ async function resolveLocalImport(root, relative, required = true) {
 }
 export async function importGraph(root, originals, input = { repositoryRoot: root }, limits = {}) {
   const pending = originals.filter(file => file.exists !== false).map(file => file.path); const visited = new Map(); const edges = []; let dynamic = false;
+  const explicitSources = new Set(pending);
+  const graphRead = (actualRoot, relative, binding) => (explicitSources.has(relative) ? scopeRead : scopeBuildSourceRead)(actualRoot, relative, binding);
   let sourceBytes = 0;
   const dynamicSources = [], unresolvedImports = [];
   const pendingCreates = new Set(originals.filter(file => file.exists === false && input.scopeCreatePaths?.includes(file.path)).map(file => file.path));
   const workspace = await workspaceIndex(root, input);
   const metadata = new Map(workspace.metadata.map(item => [item.path, item]));
+  const inspectBuild = conditionalBuildInspection(root, input);
   while (pending.length) {
     const relative = pending.shift(); if (visited.has(relative)) continue;
     if (visited.size >= 1000) scopeFail('ENTROROVE_SCOPE_LIMIT', 'import graph exceeds the 1000-file inspection bound');
@@ -290,7 +345,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
       }
       sourceBytes += target.stat.size;
     }
-    const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input);
+    const read = await graphRead(root, relative, input); const boundary = await packageBoundary(root, relative, input, scopeBuildSourceRead);
     visited.set(relative, { path: relative, sha256: read.sha256, module: boundary.path, boundary });
     if (!sourceExtension.test(relative)) continue;
     const contexts = (input.importContexts ?? []).filter(context => relative === context.sourcePrefix || relative.startsWith(`${context.sourcePrefix}/`))
@@ -298,18 +353,23 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     const configPath = contexts[0]?.configPath;
     const aliases = await scopeTsconfigImports(target => configMetadata(root, target, input), relative, configPath);
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
+    const projection = sourceProjection(read.content, relative, root), conditional = projection.conditional;
+    const build = await inspectBuild(relative, configPath, { hasConditionals: Boolean(conditional?.directives.length) });
+    const opaque = await observeBuildFacts(root, build, input, { visited, metadata, dynamicSources, unresolvedImports });
+    dynamic ||= opaque;
     const declarations = declarationModules(read.content, relative);
-    const imports = importSpecifiers(read.content, relative, root); dynamic ||= imports.dynamic;
+    const imports = projection.imports; dynamic ||= imports.dynamic;
     unresolvedImports.push(...imports.unresolvedImports.map(site => ({ path: relative, ...site })));
-    if (imports.dynamic) dynamicSources.push({ path: relative, sha256: read.sha256 });
+    if (imports.dynamic && !dynamicSources.some(item => item.path === relative)) dynamicSources.push({ path: relative, sha256: read.sha256 });
     for (const specifier of imports.specifiers.sort()) {
       let target;
       try { target = await resolveImport(root, relative, specifier, workspace, input, aliases, configPath, declarations); }
       catch (error) {
         const missing = error.code === 'ENTROROVE_IMPORT_UNRESOLVED' && specifier.startsWith('.')
           ? error.missingCandidates?.filter(candidate => pendingCreates.has(candidate)) : null;
-        if (!missing?.length) throw error;
-        unresolvedImports.push({ path: relative, specifier, reason: 'approved-create-not-present', candidatePaths: missing });
+        if (error.code !== 'ENTROROVE_IMPORT_UNRESOLVED') throw error;
+        unresolvedImports.push({ path: relative, specifier, reason: missing?.length ? 'approved-create-not-present' : 'source-import-unresolved',
+          candidatePaths: missing?.length ? missing : error.missingCandidates ?? [] });
         dynamic = true;
         if (!dynamicSources.some(source => source.path === relative)) dynamicSources.push({ path: relative, sha256: read.sha256 });
         continue;
@@ -326,19 +386,25 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     }
   }
   const nodes = [...visited.values()].sort((a, b) => a.path.localeCompare(b.path));
-  await stableScope(root, nodes, input);
+  await stableScope(root, nodes, input, graphRead);
+  await inspectBuild.verify();
   const workspaceMetadata = [...metadata.values()].sort((a, b) => a.path.localeCompare(b.path));
-  await stableScope(root, workspaceMetadata, input);
-  return { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
+  await stableScope(root, workspaceMetadata, input, scopeBuildSourceRead);
+  const graph = { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
     dynamic, complete: !dynamic, dynamicSources: dynamicSources.sort((a, b) => a.path.localeCompare(b.path)), workspaceMetadata,
     ...(unresolvedImports.length ? { unresolvedImports } : {}) };
+  const actualFiles = [...nodes, ...workspaceMetadata].map(file => ({ path: file.path, sha256: file.sha256 }));
+  inspectionFreshness.set(graph, async () => { await inspectBuild.verify(); await stableScope(root, actualFiles, input,
+    (actualRoot, relative, binding) => metadata.has(relative) ? scopeBuildSourceRead(actualRoot, relative, binding) : graphRead(actualRoot, relative, binding)); });
+  return graph;
 }
 export async function scopeCandidateImports(root, file, input = { repositoryRoot: root }) {
-  const parsed = importSpecifiers(Buffer.from(file.content), file.path, root);
   const workspace = await workspaceIndex(root, input);
   const context = (input.importContexts ?? []).filter(item => file.path === item.sourcePrefix || file.path.startsWith(`${item.sourcePrefix}/`))
     .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
   const aliases = await scopeTsconfigImports(relative => configMetadata(root, relative, input), file.path, context?.configPath);
+  const conditional = /\.vue$/i.test(file.path) ? uniConditionalVariants(file.content, file.path) : undefined;
+  const parsed = importSpecifiers(Buffer.from(file.content), file.path, root, conditional);
   const declarations = declarationModules(Buffer.from(file.content), file.path), edges = [];
   for (const specifier of parsed.specifiers) {
     const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);
@@ -346,7 +412,7 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
   }
   for (const request of parsed.requires) {
     const resolved = await resolveCreatedRequire(file.path, request.anchor, request.specifier, target => configMetadata(root, target, input));
-    await stableScope(root, resolved.metadata, input);
+    await stableScope(root, resolved.metadata, input, scopeBuildSourceRead);
     edges.push({ from: file.path, to: resolved.external ? null : resolved.target, external: resolved.external, specifier: request.specifier });
   }
   return { edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)), dynamic: parsed.dynamic,
@@ -361,15 +427,17 @@ export async function collectScopeFacts(root, requested, baselineRef, knownFiles
       files.push({ path: relative, exists: false, sha256: sha256('entrorove.missing-file/1.0'), bytes: 0, lines: 0, module: previous.module });
       continue;
     }
-    const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input);
+    const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input, scopeBuildSourceRead);
     files.push({ path: relative, exists: true, sha256: read.sha256, bytes: read.bytes, lines: lineCount(read.content), module: boundary.path });
   }
   const graph = await importGraph(root, files, input);
   await contextEvidence(root, graph, input);
+  const verifyGraph = inspectionFreshness.get(graph), observedMetadata = graph.workspaceMetadata.map(file => ({ path: file.path, sha256: file.sha256 }));
+  inspectionFreshness.set(graph, async () => { await verifyGraph(); await stableScope(root, observedMetadata, input, scopeBuildSourceRead); });
   const observedGit = await observeGitFacts(root, files, baselineRef, input); const history = observedGit.facts;
   const modules = [...new Map(graph.nodes.map(node => [node.boundary.path, node.boundary])).values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, files, input);
-  await stableScope(root, modules.filter(module => module.manifestPath).map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input);
+  await stableScope(root, modules.filter(module => module.manifestPath).map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input, scopeBuildSourceRead);
   if (history.available && (await scopeGitMetadata(root, ['rev-parse', '--verify', 'HEAD'], input, [128]))?.trim() !== history.head) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Git HEAD changed during scope inspection');
   const sourceLines = files.reduce((sum, file) => sum + file.lines, 0); const bytes = files.reduce((sum, file) => sum + file.bytes, 0);
   // An actual current diff (including empty untracked files) is authoritative; clean Git uses history, unknown Git uses source lines.
@@ -394,12 +462,12 @@ async function contextEvidence(root, graph, input) {
     if (!target.stat.isFile() || target.stat.size > 1_048_576 || (bytes += target.stat.size) > 8_388_608) {
       scopeFail('ENTROROVE_SCOPE_LIMIT', 'Context evidence exceeds its bounded actual file inspection');
     }
-    const read = await scopeRead(root, file.path, input);
+    const read = await scopeBuildSourceRead(root, file.path, input);
     if (read.sha256 !== file.sha256 || metadata.has(file.path) && metadata.get(file.path).sha256 !== read.sha256) {
       scopeFail('ENTROROVE_SCOPE_CHANGED', 'Actual context build evidence changed since its exact review');
     }
     if (!metadata.has(file.path)) metadata.set(file.path, { path: file.path, sha256: read.sha256 });
   }
   graph.workspaceMetadata = [...metadata.values()].sort((left, right) => left.path.localeCompare(right.path));
-  await stableScope(root, graph.workspaceMetadata, input);
+  await stableScope(root, graph.workspaceMetadata, input, scopeBuildSourceRead);
 }

package/local-scope-signature.mjs

@@ -2,9 +2,11 @@ import { createPrivateKey, createPublicKey, randomUUID, sign } from 'node:crypto
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { canonical, sha256 } from './local-integrity.mjs';
-import { scopeFail, scopeRead, scopeControlRead, scopeRoot } from './local-scope-files.mjs';
-import { collectScopeFacts } from './local-scope-repository.mjs';
+import { scopeFail, scopeRead, scopeBuildSourceRead, scopeControlRead, scopeRoot, stableScope } from './local-scope-files.mjs';
+import { collectScopeFacts, verifyScopeInspectionFreshness } from './local-scope-repository.mjs';
 import { readScopeSnapshot, verifyFreshScopeSnapshot } from './local-scope-snapshot.mjs';
+import { scopeGitMetadata } from './local-scope-git-reads.mjs';
+import { captureScopeReadSet } from './local-scope-read-set.mjs';
 import { resolveScopePaths } from './local-scope-context.mjs';
 import { rejectScopePrivileges, verifiedScopeCandidate } from './local-scope-candidate.mjs';
 
@@ -33,7 +35,33 @@ function binding(input, result) {
   for (const field of ['taskDigest', 'chainDigest']) if (!digest.test(String(input[field] ?? ''))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature requires original task and chain digests');
   if (!digest.test(String(result.snapshotDigest ?? ''))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature requires a verified preserved snapshot digest');
 }
-export async function attestScopeFacts(input, result, { maximumExpiresAt } = {}) {
+async function signingChallenge(input, beforeSign, maximumExpiresAt) {
+  if (beforeSign === undefined) return { input, maximumExpiresAt };
+  if (typeof beforeSign !== 'function' || !input.contextRevisionDigest || Object.hasOwn(input, 'handoffCandidate')) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Challenge renewal is restricted to an original context observation');
+  }
+  const fresh = await beforeSign();
+  if (!fresh || Object.keys(fresh).sort().join(',') !== 'challenge,maximumExpiresAt'
+    || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(fresh.challenge ?? '')
+    || !Number.isSafeInteger(fresh.maximumExpiresAt) || fresh.maximumExpiresAt <= Date.now()) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Actual scope signature requires a current exact challenge bound');
+  }
+  return { input: { ...input, challenge: fresh.challenge }, maximumExpiresAt: fresh.maximumExpiresAt };
+}
+async function verifySigningFreshness(input, root, actual) {
+  await verifyScopeInspectionFreshness(actual);
+  await verifyFreshScopeSnapshot(input, root, actual);
+  const explicit = new Set(actual.files.map(file => file.path));
+  await stableScope(root, actual.importGraph.nodes, input,
+    (actualRoot, relative, binding) => (explicit.has(relative) ? scopeRead : scopeBuildSourceRead)(actualRoot, relative, binding));
+  await stableScope(root, actual.importGraph.workspaceMetadata, input, scopeBuildSourceRead);
+  await stableScope(root, actual.modules.filter(module => module.manifestPath)
+    .map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input, scopeBuildSourceRead);
+  if (actual.git.available && (await scopeGitMetadata(root, ['rev-parse', '--verify', 'HEAD'], input, [128]))?.trim() !== actual.git.head) {
+    scopeFail('ENTROROVE_SCOPE_CHANGED', 'Git HEAD changed before the original context signature');
+  }
+}
+export async function attestScopeFacts(input, result, { maximumExpiresAt, beforeSign } = {}) {
   if (maximumExpiresAt !== undefined && (!Number.isSafeInteger(maximumExpiresAt) || maximumExpiresAt < 1)) {
     scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature deadline must be a finite exact bound');
   }
@@ -42,8 +70,12 @@ export async function attestScopeFacts(input, result, { maximumExpiresAt } = {})
     || !Array.isArray(input.importContexts))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Context proof requires its exact contexts and revision digest together');
   if (input.signerConfigPath === undefined || input.signerConfigPath === null) return result;
   binding(input, result);
+  const inspectedInput = canonical(input);
   const root = await scopeRoot(input.repositoryRoot); const snapshot = await readScopeSnapshot(input, root);
-  const actual = await collectScopeFacts(root, await resolveScopePaths(input, root), input.baselineRef, snapshot.known, input);
+  const paths = await resolveScopePaths(input, root);
+  const inspect = () => collectScopeFacts(root, paths, input.baselineRef, snapshot.known, input);
+  const inspection = beforeSign ? await captureScopeReadSet(root, inspect) : { value: await inspect() };
+  const actual = inspection.value;
   actual.snapshotEvidence = await verifyFreshScopeSnapshot(input, root, actual);
   const candidate = await verifiedScopeCandidate(input, root, actual.snapshotEvidence.manifest);
   if (root !== result.repositoryRoot || canonical(actual) !== canonical(result.facts)
@@ -62,13 +94,26 @@ export async function attestScopeFacts(input, result, { maximumExpiresAt } = {})
     if (error.code === 'ENTROROVE_SCOPE_SIGNER_INVALID') throw error;
     scopeFail('ENTROROVE_SCOPE_SIGNER_INVALID', 'scope signer configuration or signing key could not be read');
   }
+  // The independent S scan is complete before requesting its short-lived signing challenge.
+  // The internal callback can change only the nonce and deadline, never observed facts or identity.
+  const originalInput = input;
+  ({ input, maximumExpiresAt } = await signingChallenge(input, beforeSign, maximumExpiresAt));
+  if (canonical(originalInput) !== inspectedInput || root !== result.repositoryRoot
+    || canonical(actual) !== canonical(result.facts) || actual.snapshotEvidence.snapshotDigest !== result.snapshotDigest) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signing preparation changed during challenge renewal');
+  }
+  if (beforeSign) { await inspection.verify(); await verifySigningFreshness(input, root, actual); }
+  if (canonical(originalInput) !== inspectedInput || root !== result.repositoryRoot
+    || canonical(actual) !== canonical(result.facts) || actual.snapshotEvidence.snapshotDigest !== result.snapshotDigest) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signing preparation changed before its actual signature');
+  }
   const now = Date.now();
   const expiresAt = Math.min(now + config.receiptTtlMs, candidate ? Date.parse(candidate.expiresAt) : Infinity,
     maximumExpiresAt ?? Infinity);
   if (expiresAt <= now) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'candidate challenge expired before its actual scope signature');
   const core = { schemaVersion: 'entrorove.scope-facts/1.0', flowId: input.flowId, stepId: input.stepId,
     taskDigest: input.taskDigest, ownerId: input.ownerId, chainDigest: input.chainDigest, repositoryId: input.repositoryId,
-    facts: result.facts, snapshotDigest: result.snapshotDigest, challenge: input.challenge,
+    facts: actual, snapshotDigest: actual.snapshotEvidence.snapshotDigest, challenge: input.challenge,
     issuedAt: new Date(now).toISOString(), expiresAt: new Date(expiresAt).toISOString(),
     nonce: randomUUID(), keyId: config.keyId,
     ...(input.contextRevisionDigest === undefined ? {} : { importContexts: input.importContexts, contextRevisionDigest: input.contextRevisionDigest }) };

package/local-scope-state.mjs

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { canonical, sha256, verifySnapshotManifest } from './local-integrity.mjs';
 import { withStateLock } from './local-state-lock.mjs';
-import { scopeFail, scopeRead, scopeControlRead, scopeTarget, stableScope } from './local-scope-files.mjs';
+import { scopeFail, scopeRead, scopeBuildSourceRead, scopeControlRead, scopeTarget, stableScope } from './local-scope-files.mjs';
 
 const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const order = ['lock', 'probe', 'swarm'];
@@ -63,13 +63,13 @@ async function originalSnapshot(input, root, base) {
   }
   return { manifest, directory, digest: manifest.snapshotDigest };
 }
-async function capture(root, files, directory, input) {
+async function capture(root, files, directory, input, readSource = scopeRead) {
   for (const file of files) {
     if (file.exists === false) {
       if ((await scopeTarget(root, file.path, true)).exists) scopeFail('ENTROROVE_SCOPE_CHANGED', 'a deleted source reappeared before preservation');
       continue;
     }
-    const read = await scopeRead(root, file.path, input);
+    const read = await readSource(root, file.path, input);
     if (read.sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope source changed before snapshot preservation');
     const destination = path.join(directory, file.path);
     await fs.mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
@@ -107,16 +107,18 @@ function preservedFiles(facts) {
 }
 async function saveRevision(location, root, state, facts, mode, initial, input) {
   const staged = await fs.mkdtemp(path.join(location.directory, '.revision-'));
+  const explicit = new Set(facts.files.map(file => file.path));
+  const readSource = (actualRoot, relative, binding) => (explicit.has(relative) ? scopeRead : scopeBuildSourceRead)(actualRoot, relative, binding);
   const final = path.join(location.directory, `revision-${state.revision + 1}-${randomUUID()}`); let committed = false;
   try {
     const currentDirectory = path.join(staged, 'current'); await fs.mkdir(currentDirectory, { mode: 0o700 });
-    await capture(root, preservedFiles(facts), currentDirectory, input);
+    await capture(root, preservedFiles(facts), currentDirectory, input, readSource);
     if (initial) {
       const original = path.join(staged, 'original'); await fs.mkdir(original, { mode: 0o700 });
       await preserveSnapshotCopies14(input, initial.directory, initial.manifest, original);
       await fs.writeFile(path.join(original, 'manifest.json'), `${canonical(initial.manifest)}\n`, { flag: 'wx', mode: 0o600 });
     }
-    await stableScope(root, preservedFiles(facts), input); await fs.rename(staged, final);
+    await stableScope(root, preservedFiles(facts), input, readSource); await fs.rename(staged, final);
     const record = historyRecord(state, facts, path.join(final, 'current'), mode);
     const next = { ...state, revision: record.revision, mode, history: [...state.history, record] };
     if (initial) next.originalSnapshot = { ...next.originalSnapshot, directory: path.join(final, 'original') };

package/local-scope-uni-build.mjs

@@ -0,0 +1,85 @@
+import path from 'node:path';
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+import { createBuildDataReadset } from './local-scope-build-readset.mjs';
+import { buildConfigurationNames, buildDataPath, buildModuleData, buildScriptReferences } from './local-scope-build-data.mjs';
+
+const controlKeys = ['UNI_CUSTOM_DEFINE', 'UNI_CUSTOM_CONTEXT', 'UNI_SCRIPT_DEFINE', 'UNI_SCRIPT_ENV', 'UNI_COMPILER_VERSION',
+  'UNI_APP_X', 'UNI_APP_X_DOM2', 'UNI_UTS_PLATFORM', 'UNI_INPUT_DIR', 'VITE_ROOT_DIR', 'UNI_CLI_CONTEXT',
+  'UNI_HBUILDERX', 'UNI_HBUILDERX_PLUGINS', 'NODE_PATH', 'NODE_OPTIONS'];
+function assertProcessControls(filename) {
+  const present = controlKeys.filter(key => Object.hasOwn(process.env, key) || Object.hasOwn(process, key));
+  if (present.length) throw uniConditionalError(filename, 0, `Build process override controls are unsupported: ${present.join(', ')}`);
+}
+function jsonData(item) {
+  let value; try { value = JSON.parse(Buffer.from(item.contentBase64, 'base64').toString('utf8')); }
+  catch { throw uniConditionalError(item.path, 0, 'Build package data is invalid JSON'); }
+  if (!value || typeof value !== 'object' || Array.isArray(value) || value.scripts !== undefined
+    && (!value.scripts || typeof value.scripts !== 'object' || Array.isArray(value.scripts))) throw uniConditionalError(item.path, 0, 'Build package data requires an object and string script map');
+  return value;
+}
+async function hostData(sourcePath, configPath, state) {
+  let directory = path.posix.dirname(configPath ?? sourcePath);
+  for (let count = 0; count < 128; count++) {
+    const relative = path.posix.join(directory, 'package.json'), item = await state.observe(relative);
+    if (item) return { root: directory, item, manifest: jsonData(item) };
+    if (directory === '.') return { root: path.posix.dirname(configPath ?? sourcePath), item: null, manifest: {} };
+    directory = path.posix.dirname(directory);
+  }
+  throw uniConditionalError(sourcePath, 0, 'Build host data exceeds its bounded package ancestry');
+}
+function sourceText(item) { return Buffer.from(item.contentBase64, 'base64').toString('utf8'); }
+export function createUniBuildInspection(read, inspectDirectory) {
+  const state = createBuildDataReadset(read, inspectDirectory), contexts = new Map(), modules = new Map(); let controlsRequired = false;
+  const inspectSource = async (sourcePath, configPath, context = { hasConditionals: true }) => {
+    const key = `${sourcePath}:${configPath ?? ''}:${Boolean(context.hasConditionals)}`;
+    if (contexts.has(key)) return contexts.get(key);
+    const host = await hostData(sourcePath, configPath, state), unresolved = new Map(), queue = [], visited = new Set();
+    const mark = (item, reason) => { if (item) unresolved.set(`${item.path}:${reason}`, { path: item.path, sha256: item.sha256, reason }); };
+    const enqueue = async (relative, reason) => {
+      const item = await state.observe(relative); if (item) { mark(item, reason); queue.push(item); } return item;
+    };
+    if (configPath) await state.observe(buildDataPath('.', configPath));
+    for (const name of buildConfigurationNames) await enqueue(buildDataPath(host.root, name), 'opaque-build-config');
+    const scripts = buildScriptReferences(host.manifest, host.item?.path);
+    if (scripts.opaque) mark(host.item, 'opaque-build-command');
+    for (const reference of scripts.references) await enqueue(buildDataPath(host.root, reference), 'opaque-build-loader');
+    if (host.manifest['uni-app']?.scripts !== undefined) mark(host.item, 'custom-build-definitions');
+    const roots = new Set([host.root]);
+    while (queue.length) {
+      const item = queue.shift(); if (visited.has(item.path)) continue; visited.add(item.path);
+      if (visited.size > 128) throw Object.assign(uniConditionalError(item.path, 0, 'Build source data exceeds its 128-module bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+      if (/\.json$/.test(item.path) || /(?:^|\/)\.babelrc$/.test(item.path)) continue;
+      if (item.path.split('/').includes('node_modules')) continue;
+      if (!modules.has(item.path)) modules.set(item.path, buildModuleData(sourceText(item), item.path));
+      const parsed = modules.get(item.path);
+      for (const literal of parsed.literalRoots) {
+        const root = literal.root !== undefined ? buildDataPath(host.root, literal.root)
+          : literal.context !== undefined ? buildDataPath(host.root, literal.context) : host.root;
+        roots.add(literal.envDir === undefined ? root : buildDataPath(root, literal.envDir));
+      }
+      for (const reference of parsed.references) {
+        const target = buildDataPath(path.posix.dirname(item.path), reference);
+        const candidates = /\.[A-Za-z0-9]+$/.test(target) ? [target]
+          : ['.js', '.cjs', '.mjs', '.ts', '.mts', '.cts', '.json', '/index.js', '/index.cjs', '/index.ts'].map(extension => `${target}${extension}`);
+        for (const candidate of candidates) await enqueue(candidate, 'opaque-build-loader');
+      }
+    }
+    if (unresolved.size || context.hasConditionals) {
+      controlsRequired = true; assertProcessControls(sourcePath);
+      for (const root of roots) {
+        const listing = await state.directory(root);
+        if (listing?.environmentFiles.length) {
+          const origin = [...visited].map(path => state.observations.find(item => item.path === path)).find(Boolean) ?? host.item;
+          if (origin) mark(origin, 'build-environment-present');
+          else mark(await state.observe(sourcePath), 'build-environment-present');
+        }
+      }
+    }
+    const proof = { sourceProjection: 'raw-source', buildObservation: unresolved.size ? 'opaque' : 'not-observed',
+      get observations() { return state.observations; },
+      unresolvedBuildSources: [...unresolved.values()].sort((a, b) => `${a.path}:${a.reason}`.localeCompare(`${b.path}:${b.reason}`)) };
+    contexts.set(key, proof); return proof;
+  };
+  inspectSource.verify = async () => { if (controlsRequired) assertProcessControls('build-data'); await state.verify(); };
+  return inspectSource;
+}

package/local-scope-uni-conditional.mjs

@@ -0,0 +1,56 @@
+import { uniDirectives } from './local-scope-uni-directives.mjs';
+import { uniCondition, uniConditionContexts, uniConditionalError, uniConditionalLimitError } from './local-scope-uni-expressions.mjs';
+
+const blank = source => source.replace(/[^\r\n]/g, ' ');
+function conditionalSegments(source, directives, filename) {
+  const stack = [], segments = [], conditions = []; let cursor = 0, conditionTokens = 0;
+  for (const item of directives) {
+    segments.push({ start: cursor, end: item.start, guards: stack.map(guard => ({ ...guard })) });
+    segments.push({ start: item.start, end: item.end, directive: true }); cursor = item.end;
+    const fail = reason => uniConditionalError(filename, item.start, reason, source);
+    const limit = reason => uniConditionalLimitError(filename, item.start, reason, source);
+    if (['ifdef', 'ifndef', 'if'].includes(item.kind)) {
+      if (stack.length >= 32) throw limit('Conditional compilation exceeds its 32-level nesting bound');
+      const condition = uniCondition(item.expression, fail), index = conditions.length;
+      if ((conditionTokens += condition.tokens) > 4096) throw limit('Conditional expressions exceed their 4096-token aggregate inspection bound');
+      conditions.push(condition); stack.push({ index, negated: item.kind === 'ifndef', syntax: item.syntax, alternative: false });
+    } else {
+      const active = stack.at(-1);
+      if (!active || active.syntax !== item.syntax) throw fail('Conditional directive has no matching opening in the same source language');
+      if (item.kind === 'else') {
+        if (active.alternative) throw fail('Conditional block has more than one alternative');
+        active.negated = !active.negated; active.alternative = true;
+      } else stack.pop();
+    }
+  }
+  if (stack.length) throw uniConditionalError(filename, directives.at(-1).start, 'Conditional block is missing its matching endif', source);
+  segments.push({ start: cursor, end: source.length, guards: [] });
+  return { conditions, segments };
+}
+const activeSegment = (segment, key) => !segment.directive && segment.guards.every(guard => (key[guard.index] === '1') !== guard.negated);
+export function uniConditionalVariants(source, filename) {
+  const fail = reason => uniConditionalError(filename, 0, reason, source);
+  const limit = reason => uniConditionalLimitError(filename, 0, reason, source);
+  if (typeof source !== 'string') throw fail('Conditional inspection requires actual source text');
+  const unchanged = () => ({ directives: [], variants: [{ source, key: '', label: 'unconditional' }] });
+  if (!/(?:<!--|\/\/|\/\*)[ \t]*#/i.test(source)) return unchanged();
+  if (Buffer.byteLength(source) > 2_097_152) throw limit('Conditional source exceeds its 2 MiB inspection bound');
+  try {
+    const directives = uniDirectives(source, filename);
+    if (!directives.length) return unchanged();
+    const { conditions, segments } = conditionalSegments(source, directives, filename), contexts = uniConditionContexts(conditions, fail);
+    if (Buffer.byteLength(source) * contexts.length > 33_554_432) throw limit('Conditional source variants exceed their 32 MiB inspection bound');
+    for (const segment of segments) if (!segment.directive && source.slice(segment.start, segment.end).trim()
+      && !contexts.some(context => activeSegment(segment, context.key))) {
+      throw uniConditionalError(filename, segment.start, 'Conditional branch has no proven platform context; custom or contradictory build definitions require explicit support', source);
+    }
+    const variants = contexts.map(context => ({ key: context.key, label: context.label,
+      source: segments.map(segment => {
+        const text = source.slice(segment.start, segment.end); return activeSegment(segment, context.key) ? text : blank(text);
+      }).join('') }));
+    return { directives: directives.map(({ kind, expression, syntax }) => ({ kind, expression, syntax })), variants };
+  } catch (error) {
+    if (error instanceof RangeError) throw limit('Conditional syntax exceeds its parser or traversal bound');
+    throw error;
+  }
+}