@esquadrao/cli 0.0.0-stage → 1.6.0

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "@esquadrao/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.6.0",
+  "description": "Esquadrão CLI and autonomous skill orchestration framework for AI agents",
+  "type": "module",
+  "bin": {
+    "esquadrao": "bin/cli.js",
+    "esquadrao-skill": "bin/cli.js"
+  },
+  "files": [
+    "assets",
+    "bin",
+    "src",
+    "scripts",
+    "skill-orchestrate",
+    "skill-pipeline",
+    "skill-review",
+    "skill-audit",
+    "skill-context",
+    "skill-ui",
+    "skill-product-manager",
+    "skill-system-analyst",
+    "skill-software-architect",
+    "skill-tech-lead",
+    "skill-security-engineer",
+    "skill-software-engineer",
+    "skill-code-reviewer",
+    "skill-sre-engineer",
+    "skill-qa-engineer",
+    "skill-technical-writer",
+    "skill-engineering-manager",
+    "skill-media-producer",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "lint": "node scripts/lint.js",
+    "test": "node --test"
+  },
+  "keywords": [
+    "esquadrao",
+    "esquadrao-de-conteudo",
+    "skills",
+    "agents",
+    "claude",
+    "grok",
+    "codex",
+    "cursor",
+    "orchestration",
+    "studio",
+    "cli"
+  ],
+  "license": "MIT",
+  "dependencies": {},
+  "optionalDependencies": {
+    "@xenova/transformers": "^2.17.2"
+  }
+}

package/scripts/ast_slice.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import process from 'node:process';
+
+// ponytail: regex AST signature slicer; upgrade to tree-sitter for deep AST traversal
+export function sliceAst(code = '', lang = 'auto') {
+  if (typeof code !== 'string') return { lang, declarations: [], outline: '' };
+  const detected = lang && lang !== 'auto'
+    ? (lang.toLowerCase().includes('py') ? 'py' : lang.toLowerCase().includes('ts') ? 'ts' : 'js')
+    : (/^[ \t]*(?:class\s+\w+|(?:async\s+)?def\s+\w+)/m.test(code) ? 'py' : (/\b(?:interface\s+\w+|type\s+\w+\s*=|:\s*(?:string|number|boolean|any|void|unknown|Promise)\b)/.test(code) ? 'ts' : 'js'));
+
+  const decls = [];
+  let curr = null;
+  const isPy = detected === 'py';
+  const startRe = isPy ? /^[ \t]*(?:class\s+\w+|(?:async\s+)?def\s+\w+)/ : /^[ \t]*(?:export\b|(?:async\s+)?function\*?\b|class\b|interface\b|type\b)/;
+  const pyMatch = /^([ \t]*(?:class\s+\w+(?:\([^)]*\))?|(?:async\s+)?def\s+[\w$]+\s*\([^)]*\)\s*(?:->\s*[^:]+)?)\s*:)/;
+  const cleanJs = (s) => (/^[ \t]*export\s*\{/.test(s) ? s.trim() : s.replace(/\s*\{.*\}\s*;?$/, '').replace(/\s*\{.*$/, '').trim());
+
+  for (const line of code.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || (!isPy && (trimmed.startsWith('//') || trimmed.startsWith('/*')))) continue;
+    if (curr) {
+      curr += ' ' + trimmed;
+      if (isPy) {
+        const m = curr.match(pyMatch);
+        if (m) { decls.push(m[1]); curr = null; }
+      } else if (curr.includes('{') || curr.includes(';')) {
+        decls.push(cleanJs(curr));
+        curr = null;
+      }
+    } else if (startRe.test(line)) {
+      if (isPy) {
+        const m = line.match(pyMatch);
+        if (m) decls.push(m[1]);
+        else curr = line.trimEnd();
+      } else if (/^[ \t]*export\s*\{/.test(line) || /^[ \t]*type\b/.test(line)) decls.push(trimmed);
+      else if (line.includes('{')) decls.push(cleanJs(trimmed));
+      else if (line.includes(';') || (!line.includes('(') && !line.includes('function') && !line.includes('class'))) decls.push(trimmed);
+      else curr = trimmed;
+    }
+  }
+  return { lang: detected, declarations: decls, outline: decls.join('\n') };
+}
+
+export default sliceAst;
+
+const isMain = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const args = process.argv.slice(2);
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(`AST Context Slicer\n\nUsage:\n  node scripts/ast_slice.js [file] [flags]\n  cat file | node scripts/ast_slice.js [flags]\n\nFlags:\n  --json           Output JSON object instead of raw outline\n  --lang=js|ts|py  Force language parser\n  --help, -h       Show help`);
+    process.exit(0);
+  }
+  try {
+    const isJson = args.includes('--json');
+    const langFlag = args.find((a) => a.startsWith('--lang='));
+    let lang = langFlag ? langFlag.split('=')[1] : 'auto';
+    const file = args.find((a) => !a.startsWith('-'));
+    if (lang === 'auto' && file) {
+      if (/\.py$/i.test(file)) lang = 'py';
+      else if (/\.tsx?$/i.test(file)) lang = 'ts';
+      else if (/\.c?jsx?$/i.test(file)) lang = 'js';
+    }
+    const raw = file ? readFileSync(file, 'utf8') : readFileSync(0, 'utf8');
+    const res = sliceAst(raw, lang);
+    console.log(isJson ? JSON.stringify(res, null, 2) : res.outline);
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    process.exit(1);
+  }
+}

package/scripts/cutout.py

@@ -0,0 +1,197 @@
+#!/usr/bin/env python3
+"""Recorte de pessoa com troca de fundo (protótipo CLI-14).
+
+Requer: rembg, onnxruntime, opencv-python-headless, numpy, Pillow, ffmpeg.
+O CLI chama este script com --python <interpretador>.
+"""
+import argparse
+import json
+import math
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+import cv2
+import numpy as np
+from PIL import Image
+from rembg import new_session, remove
+
+
+def has_audio(path: str) -> bool:
+    try:
+        r = subprocess.run(
+            ['ffprobe', '-v', 'error', '-select_streams', 'a',
+             '-show_entries', 'stream=codec_type', '-of', 'csv=p=0', path],
+            capture_output=True, text=True, check=False,
+        )
+        return 'audio' in r.stdout
+    except OSError:
+        return False
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument('--input', required=True)
+    ap.add_argument('--background', required=True)
+    ap.add_argument('--output', required=True)
+    ap.add_argument('--fps', type=float, default=15.0)
+    ap.add_argument('--width', type=int, default=1080)
+    ap.add_argument('--height', type=int, default=1920)
+    ap.add_argument('--fg-height', type=int, default=1000)
+    ap.add_argument('--fg-y', type=int, default=None)
+    ap.add_argument('--model', default='u2net_human_seg')
+    ap.add_argument('--crf', type=int, default=20)
+    args = ap.parse_args()
+
+    if args.fps <= 0 or args.fps > 30:
+        print('fps deve estar entre 1 e 30', file=sys.stderr)
+        return 2
+    if not Path(args.input).is_file():
+        print(f'entrada não encontrada: {args.input}', file=sys.stderr)
+        return 2
+    if not Path(args.background).is_file():
+        print(f'fundo não encontrado: {args.background}', file=sys.stderr)
+        return 2
+
+    cap = cv2.VideoCapture(args.input)
+    pack = cv2.VideoCapture(args.background)
+    if not cap.isOpened() or not pack.isOpened():
+        print('não foi possível abrir entrada/fundo', file=sys.stderr)
+        return 2
+
+    src_fps = cap.get(cv2.CAP_PROP_FPS) or 30.0
+    frames_total = int(cap.get(cv2.CAP_PROP_FRAME_COUNT) or 0)
+    duration = frames_total / src_fps if frames_total else 0
+    if duration <= 0:
+        print('duração inválida na entrada', file=sys.stderr)
+        return 2
+    out_frames = max(1, math.ceil(duration * args.fps))
+
+    pack_fps = pack.get(cv2.CAP_PROP_FPS) or 30.0
+    pack_count = max(1, int(pack.get(cv2.CAP_PROP_FRAME_COUNT) or 1))
+    last_pack_idx = None
+
+    def read_bg(i):
+        nonlocal last_pack_idx
+        idx = int(round(i * pack_fps / args.fps)) % pack_count
+        if last_pack_idx is None or idx != last_pack_idx + 1:
+            pack.set(cv2.CAP_PROP_POS_FRAMES, idx)
+        ok, bg = pack.read()
+        if not ok:
+            pack.set(cv2.CAP_PROP_POS_FRAMES, 0)
+            ok, bg = pack.read()
+            idx = 0
+        last_pack_idx = idx
+        if not ok or bg is None:
+            raise RuntimeError('falha ao ler frame do pack de fundo')
+        return cv2.resize(bg, (args.width, args.height), interpolation=cv2.INTER_AREA)
+
+    fg_h = max(1, min(args.fg_height, args.height))
+    fg_y = args.height - fg_h if args.fg_y is None else max(0, min(args.fg_y, args.height - fg_h))
+
+    audio = has_audio(args.input)
+    cmd = [
+        'ffmpeg', '-y', '-loglevel', 'error',
+        '-f', 'rawvideo', '-pix_fmt', 'bgra', '-s', f'{args.width}x{args.height}',
+        '-r', str(args.fps), '-i', '-',
+        '-i', args.input,
+    ]
+    if audio:
+        maps = ['-map', '0:v', '-map', '1:a']
+    else:
+        cmd += ['-f', 'lavfi', '-i', 'anullsrc=channel_layout=stereo:sample_rate=44100']
+        maps = ['-map', '0:v', '-map', '2:a']
+    cmd += maps + [
+        '-c:v', 'libx264', '-preset', 'veryfast', '-crf', str(args.crf),
+        '-pix_fmt', 'yuv420p', '-c:a', 'aac', '-b:a', '128k',
+        '-shortest', '-movflags', '+faststart', args.output,
+    ]
+
+    print(f'Carregando modelo {args.model} (primeira execução pode baixar ~176 MB)...', file=sys.stderr, flush=True)
+    session = new_session(args.model)
+    ff = subprocess.Popen(cmd, stdin=subprocess.PIPE)
+    started = time.time()
+    written = 0
+
+    try:
+        for i in range(out_frames):
+            cap.set(cv2.CAP_PROP_POS_MSEC, i * 1000.0 / args.fps)
+            ok, frame = cap.read()
+            if not ok:
+                break
+            bg = read_bg(i)
+            cut = remove(
+                Image.fromarray(cv2.cvtColor(frame, cv2.COLOR_BGR2RGB)),
+                session=session,
+                post_process_mask=True,
+            )
+            # rembg devolve RGBA em RGB; OpenCV compõe em BGR. Sem esta conversão,
+            # vermelho e azul trocam e a pele fica azul.
+            fg = cv2.cvtColor(np.array(cut), cv2.COLOR_RGBA2BGRA)
+            # Refina a máscara com GrabCut numa faixa ao redor do contorno.
+            # O u2net devolve uma silhueta frouxa (15-50 px de fundo ao redor
+            # da cabeça); sem refino, esse fundo vira um halo escuro no composto.
+            mask = (fg[:, :, 3] > 127).astype(np.uint8) * 255
+            try:
+                kernel = cv2.getStructuringElement(cv2.MORPH_ELLIPSE, (15, 15))
+                core = cv2.erode(mask, kernel)
+                outside = cv2.bitwise_not(cv2.dilate(mask, kernel))
+                gc = np.full(mask.shape, cv2.GC_PR_BGD, np.uint8)
+                gc[outside > 127] = cv2.GC_BGD
+                gc[mask > 127] = cv2.GC_PR_FGD
+                gc[core > 127] = cv2.GC_FGD
+                bgm = np.zeros((1, 65), np.float64)
+                fgm = np.zeros((1, 65), np.float64)
+                cv2.grabCut(frame, gc, None, bgm, fgm, 1, cv2.GC_INIT_WITH_MASK)
+                refined = np.where((gc == cv2.GC_FGD) | (gc == cv2.GC_PR_FGD), 255, 0).astype(np.uint8)
+                if refined.any():
+                    mask = refined
+            except cv2.error:
+                pass
+            a = mask.astype(np.float32) / 255.0
+            fg[:, :, 3] = (cv2.GaussianBlur(a, (3, 3), 0) * 255.0).astype(np.uint8)
+            nw = max(1, int(fg.shape[1] * fg_h / fg.shape[0]))
+            fg = cv2.resize(fg, (nw, fg_h), interpolation=cv2.INTER_AREA)
+            if nw >= args.width:
+                x0 = (nw - args.width) // 2
+                fg = fg[:, x0:x0 + args.width]
+            else:
+                pad = np.zeros((fg_h, args.width, 4), dtype=np.uint8)
+                x0 = (args.width - nw) // 2
+                pad[:, x0:x0 + nw] = fg
+                fg = pad
+
+            alpha = (fg[:, :, 3:4].astype(np.float32) / 255.0)
+            roi = bg[fg_y:fg_y + fg_h, 0:args.width].astype(np.float32)
+            comp = fg[:, :, :3].astype(np.float32) * alpha + roi * (1.0 - alpha)
+            bg[fg_y:fg_y + fg_h, 0:args.width] = np.clip(comp, 0, 255).astype(np.uint8)
+            bgra = cv2.cvtColor(bg, cv2.COLOR_BGR2BGRA)
+            ff.stdin.write(bgra.tobytes())
+            written += 1
+            if written % 100 == 0:
+                print(f'{written}/{out_frames} frames — {time.time() - started:.1f}s', file=sys.stderr, flush=True)
+        ff.stdin.close()
+        rc = ff.wait()
+        if rc != 0:
+            print(f'ffmpeg falhou (exit {rc})', file=sys.stderr)
+            return rc
+    except BrokenPipeError:
+        print('ffmpeg encerrou antes do fim dos frames', file=sys.stderr)
+        return 1
+    finally:
+        cap.release()
+        pack.release()
+
+    print(json.dumps({
+        'status': 'ok',
+        'frames': written,
+        'elapsed_s': round(time.time() - started, 1),
+        'has_audio': audio,
+        'output': args.output,
+    }), flush=True)
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/scripts/dag_validator.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import process from 'node:process';
+
+// ponytail: in-memory Kahn algorithm; upgrade to streaming DAG for 100k+ nodes
+export function validateDAG(tasks = []) {
+  if (!Array.isArray(tasks)) return { valid: false, cycles: [], missing_dependencies: [], waves: [] };
+
+  const inDegree = new Map();
+  const dependents = new Map();
+  const knownIds = new Set(tasks.map((t) => t.id)), missing_dependencies = [];
+
+  for (const t of tasks) {
+    inDegree.set(t.id, 0);
+    dependents.set(t.id, []);
+  }
+
+  for (const t of tasks) {
+    for (const dep of new Set(t.depends_on || [])) {
+      if (!knownIds.has(dep)) { if (!missing_dependencies.includes(dep)) missing_dependencies.push(dep); }
+      else { inDegree.set(t.id, inDegree.get(t.id) + 1); dependents.get(dep).push(t.id); }
+    }
+  }
+
+  const waves = [];
+  let currentWave = [];
+  for (const t of tasks) {
+    if (inDegree.get(t.id) === 0) currentWave.push(t.id);
+  }
+
+  let processed = 0;
+  while (currentWave.length > 0) {
+    waves.push(currentWave);
+    processed += currentWave.length;
+    const nextWave = [];
+    for (const id of currentWave) {
+      for (const nextId of dependents.get(id) || []) {
+        const deg = inDegree.get(nextId) - 1;
+        inDegree.set(nextId, deg);
+        if (deg === 0) nextWave.push(nextId);
+      }
+    }
+    currentWave = nextWave;
+  }
+
+  const valid = processed === tasks.length && missing_dependencies.length === 0;
+  const cycles = valid ? [] : tasks.filter((t) => (inDegree.get(t.id) || 0) > 0).map((t) => t.id);
+
+  return { valid, cycles, missing_dependencies, waves };
+}
+
+export default validateDAG;
+
+const isMain = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  if (process.argv.includes('--help') || process.argv.includes('-h')) {
+    console.log(`DAG Validator
+
+Usage:
+  node scripts/dag_validator.js [tasks.json]
+  cat tasks.json | node scripts/dag_validator.js
+
+Validates DAG acyclicity and computes topological execution waves.`);
+    process.exit(0);
+  }
+
+  try {
+    const raw = process.argv[2] ? readFileSync(process.argv[2], 'utf8') : readFileSync(0, 'utf8');
+    const result = validateDAG(JSON.parse(raw));
+    console.log(JSON.stringify(result, null, 2));
+    if (!result.valid) process.exitCode = 1;
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    process.exit(1);
+  }
+}

package/scripts/lint.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = fileURLToPath(new URL('..', import.meta.url));
+const targetDirs = ['bin', 'src', 'scripts', 'tests'];
+
+function collectJsFiles(dir) {
+  const fullPath = path.join(repoRoot, dir);
+  if (!fs.existsSync(fullPath)) return [];
+  const entries = fs.readdirSync(fullPath, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const entryPath = path.join(fullPath, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectJsFiles(path.relative(repoRoot, entryPath)));
+    } else if (entry.isFile() && entry.name.endsWith('.js')) {
+      files.push(entryPath);
+    }
+  }
+  return files;
+}
+
+const allJsFiles = targetDirs.flatMap(collectJsFiles);
+
+let failed = 0;
+for (const file of allJsFiles) {
+  try {
+    execFileSync(process.execPath, ['--check', file], { stdio: 'inherit' });
+  } catch {
+    failed++;
+  }
+}
+
+if (failed > 0) {
+  console.error(`Lint check failed: ${failed} file(s) with syntax errors.`);
+  process.exit(1);
+}
+
+console.log(`Lint passed: verified ${allJsFiles.length} files with node --check.`);

package/scripts/merkle_verify.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import process from 'node:process';
+
+// ponytail: in-memory linear ledger verifier; upgrade to streaming Merkle tree for 10M+ blocks
+export function canonicalStringify(val) {
+  if (val === null || typeof val !== 'object') return JSON.stringify(val);
+  if (Array.isArray(val)) return `[${val.map((v) => (v === undefined ? 'null' : canonicalStringify(v))).join(',')}]`;
+  const keys = Object.keys(val).filter((k) => val[k] !== undefined).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalStringify(val[k])}`).join(',')}}`;
+}
+
+export function computeBlockHash(block) {
+  if (!block || typeof block !== 'object') return '';
+  const { hash: _, ...payload } = block;
+  return createHash('sha256').update(canonicalStringify(payload)).digest('hex');
+}
+
+export function verifyLedger(blocks) {
+  const list = Array.isArray(blocks) ? blocks : (Array.isArray(blocks?.blocks) ? blocks.blocks : null);
+  if (!list) return { valid: false, blocks_verified: 0, errors: ['Ledger must be an array of blocks'] };
+  if (list.length === 0) return { valid: true, blocks_verified: 0, errors: [] };
+
+  const errors = [];
+  const isGenesisPrevValid = (prev) =>
+    prev === null || prev === undefined || prev === 0 || prev === '0' || prev === '' ||
+    (typeof prev === 'string' && /^[0-9a-fA-F]{64}$/.test(prev));
+
+  for (let i = 0; i < list.length; i++) {
+    const block = list[i];
+    if (!block || typeof block !== 'object') {
+      errors.push(`Block ${i}: block must be an object`);
+      continue;
+    }
+
+    if (i === 0) {
+      if (!isGenesisPrevValid(block.previous_hash)) {
+        errors.push(`Block 0: invalid previous_hash (${block.previous_hash})`);
+      }
+    } else {
+      const prevHash = list[i - 1]?.hash;
+      if (block.previous_hash !== prevHash) {
+        errors.push(`Block ${i}: previous_hash mismatch (expected ${prevHash}, got ${block.previous_hash})`);
+      }
+    }
+
+    const computed = computeBlockHash(block);
+    if (!block.hash || block.hash !== computed) {
+      errors.push(`Block ${i}: hash mismatch (declared ${block.hash}, computed ${computed})`);
+    }
+  }
+
+  return { valid: errors.length === 0, blocks_verified: list.length, errors };
+}
+
+export default verifyLedger;
+
+const isMain = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  if (process.argv.includes('--help') || process.argv.includes('-h')) {
+    console.log(`Merkle Ledger Integrity Verifier
+
+Usage:
+  node scripts/merkle_verify.js [ledger.json]
+  cat ledger.json | node scripts/merkle_verify.js
+
+Validates cryptographic hash continuity and payload integrity across blocks.`);
+    process.exit(0);
+  }
+
+  try {
+    const raw = process.argv[2] ? readFileSync(process.argv[2], 'utf8') : readFileSync(0, 'utf8');
+    const result = verifyLedger(JSON.parse(raw));
+    console.log(JSON.stringify(result, null, 2));
+    if (!result.valid) process.exitCode = 1;
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    process.exit(1);
+  }
+}

package/scripts/wcag_check.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import process from 'node:process';
+
+// ponytail: sRGB/WCAG 2.1 relative luminance; upgrade to APCA/WCAG 3 for perceptual lightness
+export function parseColor(str) {
+  if (str && typeof str === 'object' && typeof str.r === 'number') return str;
+  if (typeof str !== 'string') return null;
+  let h = str.trim().replace(/^#/, '');
+  if (h.length === 3) h = h.split('').map((c) => c + c).join('');
+  if (h.length !== 6 || !/^[0-9a-fA-F]{6}$/.test(h)) return null;
+  const n = parseInt(h, 16);
+  return { r: (n >> 16) & 255, g: (n >> 8) & 255, b: n & 255 };
+}
+
+export function getLuminance(color) {
+  const rgb = parseColor(color);
+  if (!rgb) return 0;
+  const srgb = [rgb.r, rgb.g, rgb.b].map((v) => {
+    const c = v / 255;
+    return c <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+  });
+  return 0.2126 * srgb[0] + 0.7152 * srgb[1] + 0.0722 * srgb[2];
+}
+
+export function getContrastRatio(fg, bg) {
+  const l1 = getLuminance(fg), l2 = getLuminance(bg);
+  return Math.round(((Math.max(l1, l2) + 0.05) / (Math.min(l1, l2) + 0.05)) * 100) / 100;
+}
+
+export function checkWcag(params = {}) {
+  const fg = params.fg ?? params.foreground, bg = params.bg ?? params.background;
+  const validColors = Boolean(parseColor(fg) && parseColor(bg));
+  const ratio = validColors ? getContrastRatio(fg, bg) : 1;
+  const passAA = validColors && ratio >= 4.5, passLarge = validColors && ratio >= 3.0;
+  const width = Number(params.width ?? 44), height = Number(params.height ?? 44);
+  const targetPass = width >= 44 && height >= 44;
+  return {
+    contrast: { ratio, passAA, passLarge },
+    targetSize: { pass: targetPass, width, height },
+    valid: Boolean(passAA && targetPass),
+  };
+}
+
+export default checkWcag;
+
+const isMain = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const args = process.argv.slice(2);
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(`WCAG 2.1 Checker
+
+Usage: node scripts/wcag_check.js --fg="#000" --bg="#fff" [--width=44] [--height=44] [--json]
+Flags: --fg=<hex>, --bg=<hex>, --width=<px>, --height=<px>, --json, --help`);
+    process.exit(0);
+  }
+  const getArg = (k) => {
+    const eq = args.find((x) => x.startsWith(k + '='));
+    if (eq) return eq.slice(k.length + 1).replace(/^["']|["']$/g, '');
+    const idx = args.indexOf(k);
+    return idx !== -1 && args[idx + 1] && !args[idx + 1].startsWith('-') ? args[idx + 1].replace(/^["']|["']$/g, '') : undefined;
+  };
+  const params = {
+    fg: getArg('--fg') ?? '#000000', bg: getArg('--bg') ?? '#ffffff',
+    width: getArg('--width') ? Number(getArg('--width')) : 44, height: getArg('--height') ? Number(getArg('--height')) : 44,
+  };
+  const file = args.find((a) => !a.startsWith('-'));
+  if (file) { try { Object.assign(params, JSON.parse(readFileSync(file, 'utf8'))); } catch {} }
+  const res = checkWcag(params);
+  if (args.includes('--json')) console.log(JSON.stringify(res, null, 2));
+  else console.log(`WCAG 2.1 Audit: ${res.valid ? 'PASSED' : 'FAILED'}
+  Contrast: ${res.contrast.ratio}:1 (AA: ${res.contrast.passAA ? 'PASS' : 'FAIL'}, Large: ${res.contrast.passLarge ? 'PASS' : 'FAIL'})
+  Target Size: ${res.targetSize.width}x${res.targetSize.height}px (${res.targetSize.pass ? 'PASS' : 'FAIL'})`);
+  if (!res.valid) process.exitCode = 1;
+}

package/skill-audit/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: skill-audit
+version: "1.0.0"
+description: "Verify cryptographic Merkle ledgers, validate execution receipts, and enable time-travel replays."
+allowed-tools: ["terminal"]
+---
+
+# Agent Audit
+
+Validate tamper-evident execution ledgers, check cryptographic receipts, and audit historical agent runs.
+
+## When to Use
+
+- Verifying SHA-256 Merkle chain integrity across task executions.
+- Auditing cryptographic receipts and provenance of generated artifacts.
+- Deterministic time-travel replay of prior mission checkpoints.
+
+## NOT for
+
+- Real-time swarm leasing (`skill-orchestrate`).
+- WCAG color contrast checks (`skill-ui`).
+- In-memory AST slicing (`skill-context`).
+
+## Workflow & CLI
+
+Execute via local script:
+
+```bash
+# Verify ledger continuity and payload hashes
+node scripts/merkle_verify.js ledger.json
+```
+
+## UX & Operational Rules
+
+- Ledgers must maintain strict `previous_hash` continuity across all blocks.
+- Genesis blocks must declare valid genesis previous hashes (`0` or null).
+
+## References
+
+- Merkle ledger specification: [references/merkle-ledger-spec.md](references/merkle-ledger-spec.md)
+- Receipt verification: [references/receipt-ed25519-verification.md](references/receipt-ed25519-verification.md)
+- Time-travel replay: [references/time-travel-replay.md](references/time-travel-replay.md)