@entrorove/skill 0.1.70 → 0.1.73

package/local-scope-repository.mjs

@@ -5,7 +5,7 @@ import { promisify } from 'node:util';
 import { builtinModules } from 'node:module';
 import ts from 'typescript';
 import { parse as parseVue, parseCache as vueParseCache } from '@vue/compiler-sfc';
-import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeProbeTarget, scopeRead, scopeTarget, stableScope } from './local-scope-files.mjs';
+import { lineCount, observedScopeRisk, packageBoundary, scopeFail, scopeFiles, scopeProbeTarget, scopeRead, scopeBuildSourceRead, scopeTarget, stableScope } from './local-scope-files.mjs';
 import { sha256 } from './local-integrity.mjs';
 import { workspaceImport, workspaceIndex } from './local-scope-workspaces.mjs';
 import { assertBudgetRunnerAllowed } from './local-budget-reads.mjs';
@@ -19,6 +19,8 @@ import { createScopeRequireContexts } from './local-scope-create-require.mjs';
 import { resolveCreatedRequire } from './local-scope-require-resolution.mjs';
 import { uniConditionalVariants } from './local-scope-uni-conditional.mjs';
 import { createUniBuildInspection } from './local-scope-uni-build.mjs';
+import { createScopeBuildIO } from './local-scope-build-io.mjs';
+import { observeBuildFacts } from './local-scope-build-facts.mjs';
 
 const execute = promisify(execFile);
 const inspectionFreshness = new WeakMap();
@@ -244,6 +246,9 @@ function declarationModules(content, from) {
     && node.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.DeclareKeyword)).map(node => node.name.text));
 }
 async function resolveImport(root, from, specifier, workspace, input, aliases, configPath, declarations) {
+  if (specifier.startsWith('/') || /^[A-Za-z]:/.test(specifier) || specifier.includes('\\') || /[\u0000-\u001f\u007f]/.test(specifier)) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', 'Source module addresses require safe repository-relative or declared package selectors');
+  }
   if (/^(?:https?:|file:|data:)/i.test(specifier)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'remote source imports cannot be inspected as local facts');
   if (declarations.has(specifier)) return null;
   const label = /^[A-Za-z0-9@._/~+-]{1,256}$/.test(specifier) ? specifier : '[unsupported specifier]';
@@ -258,9 +263,9 @@ async function resolveImport(root, from, specifier, workspace, input, aliases, c
   const localPackage = !specifier.startsWith('.') ? workspaceImport(workspace, specifier) : null;
   if (!specifier.startsWith('.') && !localPackage) {
     if (builtinModules.includes(specifier) || (specifier.startsWith('node:') && builtinModules.includes(specifier.slice(5)))) return null;
-    const boundary = await packageBoundary(root, configPath ?? from, input);
+    const boundary = await packageBoundary(root, configPath ?? from, input, scopeBuildSourceRead);
     if (boundary.manifestPath) {
-      const manifest = JSON.parse((await scopeRead(root, boundary.manifestPath, input)).content.toString('utf8'));
+      const manifest = JSON.parse((await scopeBuildSourceRead(root, boundary.manifestPath, input)).content.toString('utf8'));
       const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
       if (['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'].some(field => Object.hasOwn(manifest[field] ?? {}, name))) return null;
     }
@@ -284,25 +289,29 @@ async function externalConfigReference(root, relative, resolved) {
 async function configMetadata(root, relative, input) {
   const target = await scopeProbeTarget(root, relative, dependencyReference(relative));
   if (!target.exists || !target.stat.isFile()) throw Object.assign(new Error(`Missing configuration file: ${relative}`), { code: 'ENOENT' });
-  const read = await scopeRead(root, relative, input), resolved = await fs.realpath(target.target);
+  const read = await scopeBuildSourceRead(root, relative, input), resolved = await fs.realpath(target.target);
   const physical = path.relative(root, resolved).split(path.sep).join('/');
   const outside = physical === '..' || physical.startsWith('../') || path.isAbsolute(physical);
   const realPath = outside ? relative : physical;
   const referenceRoot = outside ? await externalConfigReference(root, relative, resolved) : undefined;
-  return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64'), realPath, referenceRoot };
-}
-async function conditionalBuildDirectory(root, relative, maximumEntries) {
-  const target = relative === '.' ? root : (await scopeTarget(root, relative, false, dependencyReference(relative))).target;
-  const directory = await fs.opendir(target); const environmentFiles = []; let entries = 0;
-  for await (const entry of directory) {
-    if (++entries > maximumEntries) scopeFail('ENTROROVE_SCOPE_LIMIT', 'Conditional build directory exceeds its bounded entry inspection');
-    if (entry.name === '.env' || entry.name.startsWith('.env.')) environmentFiles.push(entry.name);
-  }
-  return { environmentFiles, entries };
+  return { path: relative, sha256: read.sha256, mode: read.mode, contentBase64: read.content.toString('base64'), realPath, referenceRoot };
 }
 function conditionalBuildInspection(root, input) {
-  return createUniBuildInspection(relative => configMetadata(root, relative, input),
-    (relative, maximumEntries) => conditionalBuildDirectory(root, relative, maximumEntries));
+  const io = createScopeBuildIO(root, relative => configMetadata(root, relative, input));
+  return createUniBuildInspection(io.read, io.inspectDirectory, { probe: io.probe, repositoryRoot: root });
+}
+function sourceProjection(content, relative, root) {
+  // Only these pure parsers run here. Filesystem, privacy and budget checks occur
+  // outside this boundary and cannot become a semantic uncertainty.
+  try {
+    const conditional = /\.vue$/i.test(relative) ? uniConditionalVariants(content.toString('utf8'), relative) : undefined;
+    return { conditional, imports: importSpecifiers(content, relative, root, conditional) };
+  } catch (error) {
+    if (error.code !== 'ENTROROVE_IMPORT_UNSUPPORTED') throw error;
+    return { conditional: undefined, imports: { specifiers: [], requires: [], dynamic: true,
+      unresolvedImports: [{ line: error.line ?? 1, column: error.column ?? 1, reason: 'source-projection-unsupported',
+        message: 'Source syntax has no supported static projection; the original hashed source remains read-only' }] } };
+  }
 }
 async function resolveLocalImport(root, relative, required = true) {
   if (relative.startsWith('../') || relative === '..') scopeFail('ENTROROVE_PATH_UNSAFE', 'local import escapes the repository');
@@ -318,6 +327,8 @@ async function resolveLocalImport(root, relative, required = true) {
 }
 export async function importGraph(root, originals, input = { repositoryRoot: root }, limits = {}) {
   const pending = originals.filter(file => file.exists !== false).map(file => file.path); const visited = new Map(); const edges = []; let dynamic = false;
+  const explicitSources = new Set(pending);
+  const graphRead = (actualRoot, relative, binding) => (explicitSources.has(relative) ? scopeRead : scopeBuildSourceRead)(actualRoot, relative, binding);
   let sourceBytes = 0;
   const dynamicSources = [], unresolvedImports = [];
   const pendingCreates = new Set(originals.filter(file => file.exists === false && input.scopeCreatePaths?.includes(file.path)).map(file => file.path));
@@ -334,7 +345,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
       }
       sourceBytes += target.stat.size;
     }
-    const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input);
+    const read = await graphRead(root, relative, input); const boundary = await packageBoundary(root, relative, input, scopeBuildSourceRead);
     visited.set(relative, { path: relative, sha256: read.sha256, module: boundary.path, boundary });
     if (!sourceExtension.test(relative)) continue;
     const contexts = (input.importContexts ?? []).filter(context => relative === context.sourcePrefix || relative.startsWith(`${context.sourcePrefix}/`))
@@ -342,20 +353,23 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     const configPath = contexts[0]?.configPath;
     const aliases = await scopeTsconfigImports(target => configMetadata(root, target, input), relative, configPath);
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
-    const conditional = /\.vue$/i.test(relative) ? uniConditionalVariants(read.content.toString('utf8'), relative) : undefined;
-    if (conditional?.directives.length) for (const observed of await inspectBuild(relative, configPath)) metadata.set(observed.path, observed);
+    const projection = sourceProjection(read.content, relative, root), conditional = projection.conditional;
+    const build = await inspectBuild(relative, configPath, { hasConditionals: Boolean(conditional?.directives.length) });
+    const opaque = await observeBuildFacts(root, build, input, { visited, metadata, dynamicSources, unresolvedImports });
+    dynamic ||= opaque;
     const declarations = declarationModules(read.content, relative);
-    const imports = importSpecifiers(read.content, relative, root, conditional); dynamic ||= imports.dynamic;
+    const imports = projection.imports; dynamic ||= imports.dynamic;
     unresolvedImports.push(...imports.unresolvedImports.map(site => ({ path: relative, ...site })));
-    if (imports.dynamic) dynamicSources.push({ path: relative, sha256: read.sha256 });
+    if (imports.dynamic && !dynamicSources.some(item => item.path === relative)) dynamicSources.push({ path: relative, sha256: read.sha256 });
     for (const specifier of imports.specifiers.sort()) {
       let target;
       try { target = await resolveImport(root, relative, specifier, workspace, input, aliases, configPath, declarations); }
       catch (error) {
         const missing = error.code === 'ENTROROVE_IMPORT_UNRESOLVED' && specifier.startsWith('.')
           ? error.missingCandidates?.filter(candidate => pendingCreates.has(candidate)) : null;
-        if (!missing?.length) throw error;
-        unresolvedImports.push({ path: relative, specifier, reason: 'approved-create-not-present', candidatePaths: missing });
+        if (error.code !== 'ENTROROVE_IMPORT_UNRESOLVED') throw error;
+        unresolvedImports.push({ path: relative, specifier, reason: missing?.length ? 'approved-create-not-present' : 'source-import-unresolved',
+          candidatePaths: missing?.length ? missing : error.missingCandidates ?? [] });
         dynamic = true;
         if (!dynamicSources.some(source => source.path === relative)) dynamicSources.push({ path: relative, sha256: read.sha256 });
         continue;
@@ -372,15 +386,16 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     }
   }
   const nodes = [...visited.values()].sort((a, b) => a.path.localeCompare(b.path));
-  await stableScope(root, nodes, input);
+  await stableScope(root, nodes, input, graphRead);
   await inspectBuild.verify();
   const workspaceMetadata = [...metadata.values()].sort((a, b) => a.path.localeCompare(b.path));
-  await stableScope(root, workspaceMetadata, input);
+  await stableScope(root, workspaceMetadata, input, scopeBuildSourceRead);
   const graph = { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
     dynamic, complete: !dynamic, dynamicSources: dynamicSources.sort((a, b) => a.path.localeCompare(b.path)), workspaceMetadata,
     ...(unresolvedImports.length ? { unresolvedImports } : {}) };
   const actualFiles = [...nodes, ...workspaceMetadata].map(file => ({ path: file.path, sha256: file.sha256 }));
-  inspectionFreshness.set(graph, async () => { await inspectBuild.verify(); await stableScope(root, actualFiles, input); });
+  inspectionFreshness.set(graph, async () => { await inspectBuild.verify(); await stableScope(root, actualFiles, input,
+    (actualRoot, relative, binding) => metadata.has(relative) ? scopeBuildSourceRead(actualRoot, relative, binding) : graphRead(actualRoot, relative, binding)); });
   return graph;
 }
 export async function scopeCandidateImports(root, file, input = { repositoryRoot: root }) {
@@ -389,10 +404,6 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
     .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
   const aliases = await scopeTsconfigImports(relative => configMetadata(root, relative, input), file.path, context?.configPath);
   const conditional = /\.vue$/i.test(file.path) ? uniConditionalVariants(file.content, file.path) : undefined;
-  let inspectBuild;
-  if (conditional?.directives.length) {
-    inspectBuild = conditionalBuildInspection(root, input); await inspectBuild(file.path, context?.configPath);
-  }
   const parsed = importSpecifiers(Buffer.from(file.content), file.path, root, conditional);
   const declarations = declarationModules(Buffer.from(file.content), file.path), edges = [];
   for (const specifier of parsed.specifiers) {
@@ -401,10 +412,9 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
   }
   for (const request of parsed.requires) {
     const resolved = await resolveCreatedRequire(file.path, request.anchor, request.specifier, target => configMetadata(root, target, input));
-    await stableScope(root, resolved.metadata, input);
+    await stableScope(root, resolved.metadata, input, scopeBuildSourceRead);
     edges.push({ from: file.path, to: resolved.external ? null : resolved.target, external: resolved.external, specifier: request.specifier });
   }
-  await inspectBuild?.verify();
   return { edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)), dynamic: parsed.dynamic,
     ...(parsed.unresolvedImports.length ? { unresolvedImports: parsed.unresolvedImports.map(site => ({ path: file.path, ...site })) } : {}) };
 }
@@ -417,17 +427,17 @@ export async function collectScopeFacts(root, requested, baselineRef, knownFiles
       files.push({ path: relative, exists: false, sha256: sha256('entrorove.missing-file/1.0'), bytes: 0, lines: 0, module: previous.module });
       continue;
     }
-    const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input);
+    const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input, scopeBuildSourceRead);
     files.push({ path: relative, exists: true, sha256: read.sha256, bytes: read.bytes, lines: lineCount(read.content), module: boundary.path });
   }
   const graph = await importGraph(root, files, input);
   await contextEvidence(root, graph, input);
   const verifyGraph = inspectionFreshness.get(graph), observedMetadata = graph.workspaceMetadata.map(file => ({ path: file.path, sha256: file.sha256 }));
-  inspectionFreshness.set(graph, async () => { await verifyGraph(); await stableScope(root, observedMetadata, input); });
+  inspectionFreshness.set(graph, async () => { await verifyGraph(); await stableScope(root, observedMetadata, input, scopeBuildSourceRead); });
   const observedGit = await observeGitFacts(root, files, baselineRef, input); const history = observedGit.facts;
   const modules = [...new Map(graph.nodes.map(node => [node.boundary.path, node.boundary])).values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, files, input);
-  await stableScope(root, modules.filter(module => module.manifestPath).map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input);
+  await stableScope(root, modules.filter(module => module.manifestPath).map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input, scopeBuildSourceRead);
   if (history.available && (await scopeGitMetadata(root, ['rev-parse', '--verify', 'HEAD'], input, [128]))?.trim() !== history.head) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Git HEAD changed during scope inspection');
   const sourceLines = files.reduce((sum, file) => sum + file.lines, 0); const bytes = files.reduce((sum, file) => sum + file.bytes, 0);
   // An actual current diff (including empty untracked files) is authoritative; clean Git uses history, unknown Git uses source lines.
@@ -452,12 +462,12 @@ async function contextEvidence(root, graph, input) {
     if (!target.stat.isFile() || target.stat.size > 1_048_576 || (bytes += target.stat.size) > 8_388_608) {
       scopeFail('ENTROROVE_SCOPE_LIMIT', 'Context evidence exceeds its bounded actual file inspection');
     }
-    const read = await scopeRead(root, file.path, input);
+    const read = await scopeBuildSourceRead(root, file.path, input);
     if (read.sha256 !== file.sha256 || metadata.has(file.path) && metadata.get(file.path).sha256 !== read.sha256) {
       scopeFail('ENTROROVE_SCOPE_CHANGED', 'Actual context build evidence changed since its exact review');
     }
     if (!metadata.has(file.path)) metadata.set(file.path, { path: file.path, sha256: read.sha256 });
   }
   graph.workspaceMetadata = [...metadata.values()].sort((left, right) => left.path.localeCompare(right.path));
-  await stableScope(root, graph.workspaceMetadata, input);
+  await stableScope(root, graph.workspaceMetadata, input, scopeBuildSourceRead);
 }

package/local-scope-signature.mjs

@@ -2,7 +2,7 @@ import { createPrivateKey, createPublicKey, randomUUID, sign } from 'node:crypto
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { canonical, sha256 } from './local-integrity.mjs';
-import { scopeFail, scopeRead, scopeControlRead, scopeRoot, stableScope } from './local-scope-files.mjs';
+import { scopeFail, scopeRead, scopeBuildSourceRead, scopeControlRead, scopeRoot, stableScope } from './local-scope-files.mjs';
 import { collectScopeFacts, verifyScopeInspectionFreshness } from './local-scope-repository.mjs';
 import { readScopeSnapshot, verifyFreshScopeSnapshot } from './local-scope-snapshot.mjs';
 import { scopeGitMetadata } from './local-scope-git-reads.mjs';
@@ -51,10 +51,12 @@ async function signingChallenge(input, beforeSign, maximumExpiresAt) {
 async function verifySigningFreshness(input, root, actual) {
   await verifyScopeInspectionFreshness(actual);
   await verifyFreshScopeSnapshot(input, root, actual);
-  await stableScope(root, actual.importGraph.nodes, input);
-  await stableScope(root, actual.importGraph.workspaceMetadata, input);
+  const explicit = new Set(actual.files.map(file => file.path));
+  await stableScope(root, actual.importGraph.nodes, input,
+    (actualRoot, relative, binding) => (explicit.has(relative) ? scopeRead : scopeBuildSourceRead)(actualRoot, relative, binding));
+  await stableScope(root, actual.importGraph.workspaceMetadata, input, scopeBuildSourceRead);
   await stableScope(root, actual.modules.filter(module => module.manifestPath)
-    .map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input);
+    .map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input, scopeBuildSourceRead);
   if (actual.git.available && (await scopeGitMetadata(root, ['rev-parse', '--verify', 'HEAD'], input, [128]))?.trim() !== actual.git.head) {
     scopeFail('ENTROROVE_SCOPE_CHANGED', 'Git HEAD changed before the original context signature');
   }

package/local-scope-state.mjs

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { canonical, sha256, verifySnapshotManifest } from './local-integrity.mjs';
 import { withStateLock } from './local-state-lock.mjs';
-import { scopeFail, scopeRead, scopeControlRead, scopeTarget, stableScope } from './local-scope-files.mjs';
+import { scopeFail, scopeRead, scopeBuildSourceRead, scopeControlRead, scopeTarget, stableScope } from './local-scope-files.mjs';
 
 const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const order = ['lock', 'probe', 'swarm'];
@@ -63,13 +63,13 @@ async function originalSnapshot(input, root, base) {
   }
   return { manifest, directory, digest: manifest.snapshotDigest };
 }
-async function capture(root, files, directory, input) {
+async function capture(root, files, directory, input, readSource = scopeRead) {
   for (const file of files) {
     if (file.exists === false) {
       if ((await scopeTarget(root, file.path, true)).exists) scopeFail('ENTROROVE_SCOPE_CHANGED', 'a deleted source reappeared before preservation');
       continue;
     }
-    const read = await scopeRead(root, file.path, input);
+    const read = await readSource(root, file.path, input);
     if (read.sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope source changed before snapshot preservation');
     const destination = path.join(directory, file.path);
     await fs.mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
@@ -107,16 +107,18 @@ function preservedFiles(facts) {
 }
 async function saveRevision(location, root, state, facts, mode, initial, input) {
   const staged = await fs.mkdtemp(path.join(location.directory, '.revision-'));
+  const explicit = new Set(facts.files.map(file => file.path));
+  const readSource = (actualRoot, relative, binding) => (explicit.has(relative) ? scopeRead : scopeBuildSourceRead)(actualRoot, relative, binding);
   const final = path.join(location.directory, `revision-${state.revision + 1}-${randomUUID()}`); let committed = false;
   try {
     const currentDirectory = path.join(staged, 'current'); await fs.mkdir(currentDirectory, { mode: 0o700 });
-    await capture(root, preservedFiles(facts), currentDirectory, input);
+    await capture(root, preservedFiles(facts), currentDirectory, input, readSource);
     if (initial) {
       const original = path.join(staged, 'original'); await fs.mkdir(original, { mode: 0o700 });
       await preserveSnapshotCopies14(input, initial.directory, initial.manifest, original);
       await fs.writeFile(path.join(original, 'manifest.json'), `${canonical(initial.manifest)}\n`, { flag: 'wx', mode: 0o600 });
     }
-    await stableScope(root, preservedFiles(facts), input); await fs.rename(staged, final);
+    await stableScope(root, preservedFiles(facts), input, readSource); await fs.rename(staged, final);
     const record = historyRecord(state, facts, path.join(final, 'current'), mode);
     const next = { ...state, revision: record.revision, mode, history: [...state.history, record] };
     if (initial) next.originalSnapshot = { ...next.originalSnapshot, directory: path.join(final, 'original') };

package/local-scope-uni-build.mjs

@@ -1,135 +1,85 @@
 import path from 'node:path';
-import ts from 'typescript';
 import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+import { createBuildDataReadset } from './local-scope-build-readset.mjs';
+import { buildConfigurationNames, buildDataPath, buildModuleData, buildScriptReferences } from './local-scope-build-data.mjs';
 
-const controls = /\bUNI_(?:CUSTOM_DEFINE|SCRIPT_(?:DEFINE|ENV)|COMPILER_VERSION|APP_X(?:_DOM2)?|UTS_PLATFORM)\b/;
-const controlKeys = ['UNI_CUSTOM_DEFINE', 'UNI_SCRIPT_DEFINE', 'UNI_SCRIPT_ENV', 'UNI_COMPILER_VERSION', 'UNI_APP_X', 'UNI_APP_X_DOM2', 'UNI_UTS_PLATFORM'];
-const configNames = ['vite.config.js', 'vite.config.mjs', 'vite.config.cjs', 'vite.config.ts',
-  'vite.config.mts', 'vite.config.cts', 'vue.config.js', 'vue.config.cjs'];
-function staticConfiguration(source, filename, fail) {
-  if (controls.test(source)) throw fail('Custom conditional macro or compiler controls require explicit scanner support');
-  const tree = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS), imports = new Map();
-  if (tree.parseDiagnostics.length) throw fail('Conditional build configuration has invalid syntax');
-  let exported = false, nodes = 0;
-  const value = (node, depth = 0) => {
-    if (++nodes > 2048 || depth > 24) throw fail('Conditional build configuration exceeds its static inspection bound');
-    if (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node)) return value(node.expression, depth + 1);
-    if (ts.isStringLiteral(node) || ts.isNumericLiteral(node)
-      || [ts.SyntaxKind.TrueKeyword, ts.SyntaxKind.FalseKeyword, ts.SyntaxKind.NullKeyword].includes(node.kind)) return;
-    if (ts.isArrayLiteralExpression(node)) { for (const item of node.elements) value(item, depth + 1); return; }
-    if (ts.isObjectLiteralExpression(node)) {
-      for (const property of node.properties) {
-        if (!ts.isPropertyAssignment(property) || ts.isComputedPropertyName(property.name)) throw fail('Dynamic build properties cannot establish default conditional macros');
-        value(property.initializer, depth + 1);
-      }
-      return;
-    }
-    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
-      const operation = imports.get(node.expression.text);
-      if (operation === 'uni' && node.arguments.length === 0) return;
-      if (operation === 'defineConfig' && node.arguments.length === 1) return value(node.arguments[0], depth + 1);
-    }
-    throw fail('Dynamic build configuration cannot establish default conditional macros without execution');
-  };
-  for (const statement of tree.statements) {
-    if (ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier)) {
-      const module = statement.moduleSpecifier.text, clause = statement.importClause;
-      if (module === '@dcloudio/vite-plugin-uni' && clause?.name && !clause.namedBindings) imports.set(clause.name.text, 'uni');
-      else if (module === 'vite' && !clause?.name && clause?.namedBindings && ts.isNamedImports(clause.namedBindings)
-        && clause.namedBindings.elements.every(element => (element.propertyName ?? element.name).text === 'defineConfig')) {
-        for (const element of clause.namedBindings.elements) imports.set(element.name.text, 'defineConfig');
-      } else throw fail('Custom build imports cannot establish default conditional macros without execution');
-    } else if (ts.isExportAssignment(statement) && !exported && !statement.isExportEquals) { exported = true; value(statement.expression); }
-    else if (ts.isExpressionStatement(statement) && !exported && ts.isBinaryExpression(statement.expression)
-      && statement.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken
-      && statement.expression.left.getText(tree) === 'module.exports') { exported = true; value(statement.expression.right); }
-    else if (!ts.isEmptyStatement(statement)) throw fail('Custom build statements cannot establish default conditional macros without execution');
-  }
-  if (!exported) throw fail('Conditional build configuration requires a statically inspectable export');
+const controlKeys = ['UNI_CUSTOM_DEFINE', 'UNI_CUSTOM_CONTEXT', 'UNI_SCRIPT_DEFINE', 'UNI_SCRIPT_ENV', 'UNI_COMPILER_VERSION',
+  'UNI_APP_X', 'UNI_APP_X_DOM2', 'UNI_UTS_PLATFORM', 'UNI_INPUT_DIR', 'VITE_ROOT_DIR', 'UNI_CLI_CONTEXT',
+  'UNI_HBUILDERX', 'UNI_HBUILDERX_PLUGINS', 'NODE_PATH', 'NODE_OPTIONS'];
+function assertProcessControls(filename) {
+  const present = controlKeys.filter(key => Object.hasOwn(process.env, key) || Object.hasOwn(process, key));
+  if (present.length) throw uniConditionalError(filename, 0, `Build process override controls are unsupported: ${present.join(', ')}`);
 }
-function packageConfiguration(source, fail) {
-  let manifest;
-  try { manifest = JSON.parse(source); } catch { throw fail('Conditional build package manifest is invalid JSON'); }
-  const scripts = manifest?.['uni-app']?.scripts;
-  if (scripts !== undefined) {
-    if (!scripts || typeof scripts !== 'object' || Array.isArray(scripts)) throw fail('Custom uni-app build scripts are not statically inspectable');
-    for (const configuration of Object.values(scripts)) {
-      if (!configuration || typeof configuration !== 'object' || Array.isArray(configuration)) throw fail('Custom uni-app build entry is not statically inspectable');
-      if (configuration.define !== undefined && (!configuration.define || typeof configuration.define !== 'object'
-        || Array.isArray(configuration.define) || Object.keys(configuration.define).length)) {
-        throw fail('Custom uni-app defines, including builtin macro overrides, require explicit scanner support');
-      }
-      if (controls.test(JSON.stringify(configuration))) throw fail('Custom conditional build environment requires explicit scanner support');
-    }
-  }
-  for (const [name, command] of Object.entries(manifest?.scripts ?? {})) {
-    if (typeof command !== 'string' || controls.test(command)) throw fail('Custom conditional build command requires explicit scanner support');
-    if (/^(?:dev|build)(?::|$)/.test(name) && (!/^(?:cross-env\s+NODE_ENV=(?:development|production|test)\s+)?(?:uni|vite|vue-cli-service\s+uni-(?:build|serve))(?:\s+[A-Za-z0-9_./:@=-]+)*$/.test(command)
-      || /(?:^|\s)(?:--config(?:[=\s]|$)|-c(?:\s|$)|--define(?:[=\s]|$))/.test(command))) {
-      throw fail('Custom conditional build command requires explicit scanner support');
-    }
-  }
+function jsonData(item) {
+  let value; try { value = JSON.parse(Buffer.from(item.contentBase64, 'base64').toString('utf8')); }
+  catch { throw uniConditionalError(item.path, 0, 'Build package data is invalid JSON'); }
+  if (!value || typeof value !== 'object' || Array.isArray(value) || value.scripts !== undefined
+    && (!value.scripts || typeof value.scripts !== 'object' || Array.isArray(value.scripts))) throw uniConditionalError(item.path, 0, 'Build package data requires an object and string script map');
+  return value;
 }
-function parentDirectories(relative, output, fail) {
-  let directory = path.posix.dirname(relative);
-  while (true) {
-    output.add(directory);
-    if (output.size > 128) throw fail('Conditional build roots exceed their 128-directory inspection bound');
-    if (directory === '.') return;
+async function hostData(sourcePath, configPath, state) {
+  let directory = path.posix.dirname(configPath ?? sourcePath);
+  for (let count = 0; count < 128; count++) {
+    const relative = path.posix.join(directory, 'package.json'), item = await state.observe(relative);
+    if (item) return { root: directory, item, manifest: jsonData(item) };
+    if (directory === '.') return { root: path.posix.dirname(configPath ?? sourcePath), item: null, manifest: {} };
     directory = path.posix.dirname(directory);
   }
+  throw uniConditionalError(sourcePath, 0, 'Build host data exceeds its bounded package ancestry');
 }
-function assertProcessControls(filename) {
-  const present = controlKeys.filter(key => Object.hasOwn(process.env, key) || Object.hasOwn(process, key));
-  if (present.length) throw uniConditionalError(filename, 0, `Conditional compilation override controls are unsupported: ${present.join(', ')}`);
-}
+function sourceText(item) { return Buffer.from(item.contentBase64, 'base64').toString('utf8'); }
 export function createUniBuildInspection(read, inspectDirectory) {
-  const inspected = new Map(), directoriesInspected = new Set(); let candidates = 0, bytes = 0, directoryEntries = 0;
-  const inspect = async relative => {
-    if (inspected.has(relative)) return inspected.get(relative);
-    if (++candidates > 2048) throw uniConditionalError(relative, 0, 'Conditional build lookup exceeds its 2048-path bound');
-    let item;
-    try { item = await read(relative); } catch (error) { if (error.code === 'ENOENT') { inspected.set(relative, null); return null; } throw error; }
-    const source = Buffer.from(item.contentBase64, 'base64').toString('utf8'), fail = reason => uniConditionalError(relative, 0, reason);
-    bytes += Buffer.byteLength(source);
-    if (Buffer.byteLength(source) > 1_048_576 || bytes > 8_388_608) throw fail('Conditional build metadata exceeds its bounded inspection size');
-    if (relative.endsWith('package.json')) packageConfiguration(source, fail); else staticConfiguration(source, relative, fail);
-    const observed = { path: item.path, sha256: item.sha256 }; inspected.set(relative, observed); return observed;
-  };
-  const inspectSource = async (sourcePath, configPath) => {
-    const directories = new Set(), fail = reason => uniConditionalError(sourcePath, 0, reason);
-    assertProcessControls(sourcePath);
-    parentDirectories(sourcePath, directories, fail); if (configPath) parentDirectories(configPath, directories, fail);
-    const observations = new Map();
-    for (const directory of directories) {
-      if (!directoriesInspected.has(directory)) {
-        if (typeof inspectDirectory !== 'function') throw fail('Conditional build environment absence requires actual bounded directory inspection');
-        const listing = await inspectDirectory(directory, Math.min(8192, 32768 - directoryEntries));
-        directoryEntries += listing.entries;
-        if (listing.environmentFiles.length) throw fail('Conditional sources with ancestor environment files require explicit scanner support; environment values were not read');
-        directoriesInspected.add(directory);
+  const state = createBuildDataReadset(read, inspectDirectory), contexts = new Map(), modules = new Map(); let controlsRequired = false;
+  const inspectSource = async (sourcePath, configPath, context = { hasConditionals: true }) => {
+    const key = `${sourcePath}:${configPath ?? ''}:${Boolean(context.hasConditionals)}`;
+    if (contexts.has(key)) return contexts.get(key);
+    const host = await hostData(sourcePath, configPath, state), unresolved = new Map(), queue = [], visited = new Set();
+    const mark = (item, reason) => { if (item) unresolved.set(`${item.path}:${reason}`, { path: item.path, sha256: item.sha256, reason }); };
+    const enqueue = async (relative, reason) => {
+      const item = await state.observe(relative); if (item) { mark(item, reason); queue.push(item); } return item;
+    };
+    if (configPath) await state.observe(buildDataPath('.', configPath));
+    for (const name of buildConfigurationNames) await enqueue(buildDataPath(host.root, name), 'opaque-build-config');
+    const scripts = buildScriptReferences(host.manifest, host.item?.path);
+    if (scripts.opaque) mark(host.item, 'opaque-build-command');
+    for (const reference of scripts.references) await enqueue(buildDataPath(host.root, reference), 'opaque-build-loader');
+    if (host.manifest['uni-app']?.scripts !== undefined) mark(host.item, 'custom-build-definitions');
+    const roots = new Set([host.root]);
+    while (queue.length) {
+      const item = queue.shift(); if (visited.has(item.path)) continue; visited.add(item.path);
+      if (visited.size > 128) throw Object.assign(uniConditionalError(item.path, 0, 'Build source data exceeds its 128-module bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+      if (/\.json$/.test(item.path) || /(?:^|\/)\.babelrc$/.test(item.path)) continue;
+      if (item.path.split('/').includes('node_modules')) continue;
+      if (!modules.has(item.path)) modules.set(item.path, buildModuleData(sourceText(item), item.path));
+      const parsed = modules.get(item.path);
+      for (const literal of parsed.literalRoots) {
+        const root = literal.root !== undefined ? buildDataPath(host.root, literal.root)
+          : literal.context !== undefined ? buildDataPath(host.root, literal.context) : host.root;
+        roots.add(literal.envDir === undefined ? root : buildDataPath(root, literal.envDir));
       }
-      for (const name of ['package.json', ...configNames]) {
-        const relative = directory === '.' ? name : `${directory}/${name}`, observed = await inspect(relative);
-        if (observed) observations.set(relative, observed);
+      for (const reference of parsed.references) {
+        const target = buildDataPath(path.posix.dirname(item.path), reference);
+        const candidates = /\.[A-Za-z0-9]+$/.test(target) ? [target]
+          : ['.js', '.cjs', '.mjs', '.ts', '.mts', '.cts', '.json', '/index.js', '/index.cjs', '/index.ts'].map(extension => `${target}${extension}`);
+        for (const candidate of candidates) await enqueue(candidate, 'opaque-build-loader');
       }
     }
-    return [...observations.values()];
-  };
-  inspectSource.verify = async () => {
-    if (!directoriesInspected.size) return;
-    assertProcessControls('conditional-build'); let entries = 0;
-    for (const directory of directoriesInspected) {
-      const listing = await inspectDirectory(directory, Math.min(8192, 32768 - entries)); entries += listing.entries;
-      if (listing.environmentFiles.length) throw Object.assign(uniConditionalError(directory, 0,
-        'Conditional build environment appeared after its actual inspection; environment values were not read'), { code: 'ENTROROVE_SCOPE_CHANGED' });
-    }
-    for (const [relative, expected] of inspected) {
-      let actual;
-      try { actual = await read(relative); } catch (error) { if (error.code !== 'ENOENT') throw error; }
-      if ((actual?.sha256 ?? null) !== (expected?.sha256 ?? null)) throw Object.assign(
-        uniConditionalError(relative, 0, 'Conditional build metadata changed during inspection'), { code: 'ENTROROVE_SCOPE_CHANGED' });
+    if (unresolved.size || context.hasConditionals) {
+      controlsRequired = true; assertProcessControls(sourcePath);
+      for (const root of roots) {
+        const listing = await state.directory(root);
+        if (listing?.environmentFiles.length) {
+          const origin = [...visited].map(path => state.observations.find(item => item.path === path)).find(Boolean) ?? host.item;
+          if (origin) mark(origin, 'build-environment-present');
+          else mark(await state.observe(sourcePath), 'build-environment-present');
+        }
+      }
     }
+    const proof = { sourceProjection: 'raw-source', buildObservation: unresolved.size ? 'opaque' : 'not-observed',
+      get observations() { return state.observations; },
+      unresolvedBuildSources: [...unresolved.values()].sort((a, b) => `${a.path}:${a.reason}`.localeCompare(`${b.path}:${b.reason}`)) };
+    contexts.set(key, proof); return proof;
   };
+  inspectSource.verify = async () => { if (controlsRequired) assertProcessControls('build-data'); await state.verify(); };
   return inspectSource;
 }

package/local-scope-uni-conditional.mjs

@@ -1,5 +1,5 @@
 import { uniDirectives } from './local-scope-uni-directives.mjs';
-import { uniCondition, uniConditionContexts, uniConditionalError } from './local-scope-uni-expressions.mjs';
+import { uniCondition, uniConditionContexts, uniConditionalError, uniConditionalLimitError } from './local-scope-uni-expressions.mjs';
 
 const blank = source => source.replace(/[^\r\n]/g, ' ');
 function conditionalSegments(source, directives, filename) {
@@ -8,10 +8,11 @@ function conditionalSegments(source, directives, filename) {
     segments.push({ start: cursor, end: item.start, guards: stack.map(guard => ({ ...guard })) });
     segments.push({ start: item.start, end: item.end, directive: true }); cursor = item.end;
     const fail = reason => uniConditionalError(filename, item.start, reason, source);
+    const limit = reason => uniConditionalLimitError(filename, item.start, reason, source);
     if (['ifdef', 'ifndef', 'if'].includes(item.kind)) {
-      if (stack.length >= 32) throw fail('Conditional compilation exceeds its 32-level nesting bound');
+      if (stack.length >= 32) throw limit('Conditional compilation exceeds its 32-level nesting bound');
       const condition = uniCondition(item.expression, fail), index = conditions.length;
-      if ((conditionTokens += condition.tokens) > 4096) throw fail('Conditional expressions exceed their 4096-token aggregate inspection bound');
+      if ((conditionTokens += condition.tokens) > 4096) throw limit('Conditional expressions exceed their 4096-token aggregate inspection bound');
       conditions.push(condition); stack.push({ index, negated: item.kind === 'ifndef', syntax: item.syntax, alternative: false });
     } else {
       const active = stack.at(-1);
@@ -29,15 +30,16 @@ function conditionalSegments(source, directives, filename) {
 const activeSegment = (segment, key) => !segment.directive && segment.guards.every(guard => (key[guard.index] === '1') !== guard.negated);
 export function uniConditionalVariants(source, filename) {
   const fail = reason => uniConditionalError(filename, 0, reason, source);
+  const limit = reason => uniConditionalLimitError(filename, 0, reason, source);
   if (typeof source !== 'string') throw fail('Conditional inspection requires actual source text');
   const unchanged = () => ({ directives: [], variants: [{ source, key: '', label: 'unconditional' }] });
   if (!/(?:<!--|\/\/|\/\*)[ \t]*#/i.test(source)) return unchanged();
-  if (Buffer.byteLength(source) > 2_097_152) throw fail('Conditional source exceeds its 2 MiB inspection bound');
+  if (Buffer.byteLength(source) > 2_097_152) throw limit('Conditional source exceeds its 2 MiB inspection bound');
   try {
     const directives = uniDirectives(source, filename);
     if (!directives.length) return unchanged();
     const { conditions, segments } = conditionalSegments(source, directives, filename), contexts = uniConditionContexts(conditions, fail);
-    if (Buffer.byteLength(source) * contexts.length > 33_554_432) throw fail('Conditional source variants exceed their 32 MiB inspection bound');
+    if (Buffer.byteLength(source) * contexts.length > 33_554_432) throw limit('Conditional source variants exceed their 32 MiB inspection bound');
     for (const segment of segments) if (!segment.directive && source.slice(segment.start, segment.end).trim()
       && !contexts.some(context => activeSegment(segment, context.key))) {
       throw uniConditionalError(filename, segment.start, 'Conditional branch has no proven platform context; custom or contradictory build definitions require explicit support', source);
@@ -48,7 +50,7 @@ export function uniConditionalVariants(source, filename) {
       }).join('') }));
     return { directives: directives.map(({ kind, expression, syntax }) => ({ kind, expression, syntax })), variants };
   } catch (error) {
-    if (error instanceof RangeError) throw Object.assign(fail('Conditional syntax exceeds its parser or traversal bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+    if (error instanceof RangeError) throw limit('Conditional syntax exceeds its parser or traversal bound');
     throw error;
   }
 }

package/local-scope-uni-directives.mjs

@@ -1,5 +1,5 @@
 import ts from 'typescript';
-import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+import { uniConditionalError, uniConditionalLimitError } from './local-scope-uni-expressions.mjs';
 
 function directive(source, start, end, text, syntax, filename, output) {
   const match = /^\s*#([a-z]+)\b([\s\S]*)$/i.exec(text);
@@ -10,15 +10,15 @@ function directive(source, start, end, text, syntax, filename, output) {
     || ['else', 'endif'].includes(kind) && expression) {
     throw uniConditionalError(filename, start, 'Conditional directive syntax is unsupported', source);
   }
-  if (output.length >= 256) throw uniConditionalError(filename, start, 'Conditional directives exceed their 256-entry bound', source);
+  if (output.length >= 256) throw uniConditionalLimitError(filename, start, 'Conditional directives exceed their 256-entry bound', source);
   output.push({ start, end, kind, expression, syntax });
 }
-function literalRanges(content, kind) {
+function literalRanges(content, kind, filename, start, source) {
   const parsed = ts.createSourceFile('uni-script.ts', content, ts.ScriptTarget.Latest, true, kind);
   const pending = [parsed], ranges = []; let nodes = 0;
   while (pending.length) {
     const node = pending.pop();
-    if (++nodes > 200_000) throw new RangeError('Conditional lexical inspection exceeds its node bound');
+    if (++nodes > 200_000) throw uniConditionalLimitError(filename, start, 'Conditional lexical inspection exceeds its 200000-node bound', source);
     if (ts.isStringLiteralLike(node) || ts.isRegularExpressionLiteral(node)
       || [ts.SyntaxKind.TemplateHead, ts.SyntaxKind.TemplateMiddle, ts.SyntaxKind.TemplateTail].includes(node.kind)) {
       ranges.push({ start: node.getStart(parsed), end: node.end });
@@ -27,7 +27,7 @@ function literalRanges(content, kind) {
   return ranges.sort((a, b) => a.start - b.start);
 }
 function scriptComments(source, start, end, filename, output, kind) {
-  const content = source.slice(start, end), literals = literalRanges(content, kind); let literal = 0;
+  const content = source.slice(start, end), literals = literalRanges(content, kind, filename, start, source); let literal = 0;
   for (let index = 0; index < content.length;) {
     while (literals[literal]?.end <= index) literal++;
     if (literals[literal]?.start <= index) { index = literals[literal].end; continue; }