@litfamily/litopencode 1.0.7 → 1.0.9

package/skills/lit-diagram-drawer/scripts/office-safety.mjs

@@ -0,0 +1,120 @@
+export function decodeXmlCharacterReferences(value) {
+  try{
+    const decoded=String(value).replace(/&#(?:x([0-9a-fA-F]+)|([0-9]+));/g,(_entity,hex,decimal)=>{
+      const code=Number.parseInt(hex||decimal,hex?16:10);
+      if(!Number.isInteger(code)||!(code===9||code===10||code===13||(code>=32&&code<=0xd7ff)||(code>=0xe000&&code<=0xfffd)||(code>=0x10000&&code<=0x10ffff)))throw new Error('invalid XML character reference');
+      return String.fromCodePoint(code);
+    });
+    return decoded.includes('&#')?null:decoded;
+  }catch{return null;}
+}
+
+export function markupStartTags(source) {
+  const tags = [];
+  for (let offset = 0; offset < source.length;) {
+    const start = source.indexOf('<', offset);
+    if (start < 0) break;
+    if (!/[A-Za-z_:]/u.test(source[start + 1] ?? '')) { offset = start + 1; continue; }
+    let quote = '';
+    let end = start + 2;
+    for (; end < source.length; end += 1) {
+      const char = source[end];
+      if (quote) { if (char === quote) quote = ''; }
+      else if (char === '"' || char === "'") quote = char;
+      else if (char === '>') break;
+    }
+    if (end >= source.length) break;
+    tags.push(source.slice(start, end + 1));
+    offset = end + 1;
+  }
+  return tags;
+}
+
+export function markupTagName(tag) {
+  return /^<\s*([A-Za-z_:][\w:.-]*)/u.exec(tag)?.[1].toLowerCase() ?? '';
+}
+
+export function markupAttributes(tag) {
+  const attributes = [];
+  let index = 1;
+  while (/[A-Za-z_:]/u.test(tag[index] ?? '')) index += 1;
+  while (index < tag.length) {
+    while (/[\s/]/u.test(tag[index] ?? '')) index += 1;
+    if (tag[index] === '>' || index >= tag.length) break;
+    const start = index;
+    while (index < tag.length && !/[\s/=>]/u.test(tag[index])) index += 1;
+    if (index === start) { index += 1; continue; }
+    const name = tag.slice(start, index).toLowerCase();
+    while (/\s/u.test(tag[index] ?? '')) index += 1;
+    let value = '';
+    if (tag[index] === '=') {
+      index += 1;
+      while (/\s/u.test(tag[index] ?? '')) index += 1;
+      const quote = tag[index] === '"' || tag[index] === "'" ? tag[index++] : '';
+      const valueStart = index;
+      if (quote) { while (index < tag.length && tag[index] !== quote) index += 1; }
+      else { while (index < tag.length && !/[\s>]/u.test(tag[index])) index += 1; }
+      value = tag.slice(valueStart, index);
+      if (quote && tag[index] === quote) index += 1;
+    }
+    attributes.push({ name, value });
+  }
+  return attributes;
+}
+
+export function cssUrlsAreSafe(svg,{allowReference=(value)=>/^#[A-Za-z0-9_.:-]+$/.test(value)}={}) {
+  if(decodeXmlCharacterReferences(svg)===null)return false;
+  if(String(svg).includes('<!--'))return false;
+  const source=String(svg);
+  const cssParts=[...source.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match)=>match[1]);
+  const tags=markupStartTags(source);
+  const presentationNames=new Set(['fill','stroke','filter','mask','clip-path','marker-start','marker-mid','marker-end','cursor']);
+  for(const tag of tags){
+    for(const attribute of markupAttributes(tag)){
+      if(attribute.name==='style'||presentationNames.has(attribute.name))cssParts.push(attribute.value);
+    }
+  }
+  const decodedParts=cssParts.map((part)=>decodeXmlCharacterReferences(part.replace(/\/\*[\s\S]*?\*\//g,'')));
+  if(decodedParts.some((part)=>part===null))return false;
+  const cssSource=decodedParts.join('\n');
+  if(cssSource.includes('\\')||/@import\b|\bvar\s*\(|\blocal\s*\(|\bunicode-range\s*:|(?:-webkit-)?image-set\s*\(|\bimage\s*\(|\bsrc\s*\(/i.test(cssSource)||decodedParts.some((part)=>part.includes('&')))return false;
+  const url=/url\s*\(/ig;
+  let match;
+  while((match=url.exec(cssSource))){
+    let quote=null,end=-1;
+    for(let i=url.lastIndex;i<cssSource.length;i++){
+      const char=cssSource[i];
+      if(quote){if(char===quote)quote=null;continue;}
+      if(char==='"'||char==="'"){quote=char;continue;}
+      if(char==='(')return false;
+      if(char===')'){end=i;break;}
+    }
+    if(end<0||quote)return false;
+    let value=cssSource.slice(url.lastIndex,end).trim();
+    if((value.startsWith('"')&&value.endsWith('"'))||(value.startsWith("'")&&value.endsWith("'")))value=value.slice(1,-1).trim();
+    if(!allowReference(value))return false;
+    url.lastIndex=end+1;
+  }
+  return true;
+}
+
+export function officeCssUrlsAreSafe(svg) {
+  return cssUrlsAreSafe(svg);
+}
+
+export function officeHrefRefsAreSafe(svg) {
+  if(decodeXmlCharacterReferences(svg)===null)return false;
+  if(String(svg).includes('<!--'))return false;
+  const source=String(svg);
+  const tags=markupStartTags(source);
+  for(const tag of tags){
+    const decodedTag=decodeXmlCharacterReferences(tag);
+    if(decodedTag===null)return false;
+    if(markupTagName(decodedTag)==='base')return false;
+    for(const {name,value} of markupAttributes(decodedTag)){
+      if(name==='xml:base')return false;
+      if(['href','src'].includes(name)&&!/^#[A-Za-z0-9_.:-]+$/u.test(value.trim()))return false;
+    }
+  }
+  return true;
+}

package/skills/lit-diagram-drawer/scripts/renderer-safety.mjs

@@ -0,0 +1,46 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { cssUrlsAreSafe, decodeXmlCharacterReferences, markupAttributes, markupStartTags, markupTagName, officeHrefRefsAreSafe } from './office-safety.mjs';
+
+const BLOCKED_ELEMENTS = /<\s*(?:script|iframe|object|embed|foreignObject|link|applet|portal|frame|frameset|audio|video|source|track|image|animate(?:Motion|Transform)?|set|discard)\b/iu;
+const EVENT_ATTRIBUTE = /^on[a-z][\w:.-]*$/iu;
+const RESOURCE_ATTRIBUTES = new Set(['srcdoc','srcset','poster','background','manifest','codebase','archive','ping','profile']);
+
+export function fontReferencePortable(value, sourceFile, fontFile) {
+  if (/^#[A-Za-z][\w:.-]*$/u.test(value)) return true;
+  if (/^data:font\/woff2;base64,[A-Za-z\d+/]*={0,2}$/iu.test(value)) return true;
+  if (!sourceFile || !fontFile) return false;
+  try {
+    const skillRoot = path.resolve(fontFile, '../../..');
+    const relativeSource = path.relative(skillRoot, path.resolve(sourceFile));
+    if (relativeSource.startsWith(`..${path.sep}`) || relativeSource === '..' || path.isAbsolute(relativeSource)) return false;
+    const target = new URL(value, pathToFileURL(path.resolve(sourceFile)));
+    return target.protocol === 'file:' && !target.search && !target.hash
+      && fs.realpathSync(fileURLToPath(target)) === fs.realpathSync(fontFile);
+  } catch {
+    return false;
+  }
+}
+
+export function rendererSourceIssue(source, { sourceFile, fontFile } = {}) {
+  const decoded = decodeXmlCharacterReferences(source);
+  if (decoded === null) return 'invalid character references are unsupported';
+  if (source.includes('<!--')) return 'HTML comment markup is unsupported during capture';
+  const activeCheck = source;
+  const declarationSource = activeCheck.replace(/<!doctype\s+html\s*>/giu, '');
+  if (/<!DOCTYPE\b|<!ENTITY\b/iu.test(declarationSource)) return 'DTD and entity declarations are unsupported';
+  if (declarationSource.replace(/^\uFEFF?\s*<\?xml\s+[^?]*\?>/iu, '').includes('<?')) return 'non-XML processing instructions are unsupported';
+  const tags = markupStartTags(activeCheck)
+    .map((tag) => decodeXmlCharacterReferences(tag) ?? tag);
+  if (tags.some((tag) => BLOCKED_ELEMENTS.test(tag))) return 'active or resource-loading elements are unsupported';
+  const attributes = tags.flatMap(markupAttributes);
+  if (attributes.some(({name}) => EVENT_ATTRIBUTE.test(name))) return 'event-handler attributes are unsupported';
+  if (attributes.some(({name}) => RESOURCE_ATTRIBUTES.has(name))) return 'resource-loading attributes are unsupported';
+  if (tags.some((tag) => markupTagName(tag)==='meta' && markupAttributes(tag).some(({name,value})=>name==='http-equiv'&&value.trim().toLowerCase()==='refresh'))) return 'HTML refresh navigation is unsupported';
+  if (!officeHrefRefsAreSafe(activeCheck)) return 'external or redirected href/src references are unsupported';
+  if (!cssUrlsAreSafe(activeCheck, { allowReference: (value) => fontReferencePortable(value, sourceFile, fontFile) })) {
+    return 'external, escaped, or active CSS resources are unsupported';
+  }
+  return null;
+}

package/skills/lit-diagram-drawer/scripts/test-block-registry.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import assert from 'node:assert/strict';
+import { buildBlockRegistry } from './block-registry.mjs';
+
+const source='<svg><rect data-block-id="root" data-block-name="Request &amp; policy" data-block-input="raw request" data-block-output="decision" data-block-constraint="deny by default" data-block-assumption="authenticated" data-block-impl="src/root.ts"/><rect data-block-id="child" data-block-parent="root" data-block-name="Audit" data-block-impl="src/audit.ts"/></svg>';
+const registry=buildBlockRegistry(source,'diagram.html');
+assert.deepEqual(registry.blocks.map((block)=>block.id),['root','child']);
+assert.equal(registry.source,'diagram.html');
+assert.equal(registry.blocks[0].name,'Request & policy');
+assert.equal(Object.hasOwn(registry.blocks[0],'parent'),false);
+assert.equal(registry.blocks[1].parent,'root');
+assert.equal(Object.hasOwn(registry.blocks[1],'input'),false);
+const rejects=(fragment,code)=>assert.throws(()=>buildBlockRegistry('<svg>'+fragment+'</svg>','bad.html'),new RegExp(code));
+rejects('', 'REGISTRY_BLOCKS_MISSING');
+rejects('<rect data-block-id=""/>','REGISTRY_ID_REQUIRED');
+rejects('<rect data-block-id="x"/><rect data-block-id="x"/>','REGISTRY_DUPLICATE_ID');
+rejects('<rect data-block-id="x" data-block-parent="absent"/>','REGISTRY_PARENT_MISSING');
+rejects('<rect data-block-id="x" data-block-parent="y"/><rect data-block-id="y" data-block-parent="x"/>','REGISTRY_CYCLE');
+rejects('<rect data-block-id="x"/><rect data-block-id="y"/>','REGISTRY_ROOT_COUNT');
+console.log('BLOCK_REGISTRY_PASS ordered projection, omitted fields/root parent, duplicate/missing/cycle/root guards');

package/skills/lit-diagram-drawer/scripts/test-brief-contract.mjs

@@ -0,0 +1,27 @@
+import assert from 'node:assert/strict';
+import { checkBrief, parseBrief } from './brief-contract.mjs';
+
+const brief=`- 소스 participates in the labeled relationships below.\n- 대상 participates in the labeled relationships below.\n- Required relationships:\n- 소스 → 대상 (전달)`;
+const good=`<svg><text>소스</text><text>대상</text><path data-from="소스" data-to="대상" data-label="전달"/><text data-edge-for="소스|대상">전달</text></svg>`;
+const parsed=parseBrief(brief);
+assert.deepEqual(parsed.nodes,['소스','대상']);
+assert.deepEqual(checkBrief(good,parsed),{language:'ko',nodes:2,relationships:1,missingNodes:[],missingLabels:[],missingEdges:[],unpairedLabels:[],languageMismatches:[],boundaryMembership:{declared:false,boundaryCount:0,issues:[]}});
+const wrongDirection=good.replace('data-from="소스" data-to="대상"','data-from="대상" data-to="소스"');
+assert.equal(checkBrief(wrongDirection,parsed).missingEdges.length,1,'reversed edge fails');
+const wrongLabel=good.replace('>전달</text>','>전달됨</text>');
+assert.equal(checkBrief(wrongLabel,parsed).missingLabels.length,1,'non-exact label fails');
+const koreanTechnical=`# API 데이터 경로\n- Purpose: 요청은 DB에 전달된다.\n- 게이트웨이 API participates in the labeled relationships below.\n- DB participates in the labeled relationships below.\n- Required relationships:\n- 게이트웨이 API → DB (HTTPS)`;
+const technicalGood=`<svg><text>게이트웨이 API</text><text>DB</text><text>HTTPS</text><path data-from="게이트웨이 API" data-to="DB" data-label="HTTPS"/><text data-edge-for="게이트웨이 API|DB">HTTPS</text></svg>`;
+assert.equal(checkBrief(technicalGood,koreanTechnical).languageMismatches.length,0,'verbatim technical names in a Korean brief remain allowed');
+const mixedLabel=technicalGood.replace('<text>DB</text>','<text>DB build</text>');
+const languageCheck=checkBrief(mixedLabel,koreanTechnical);
+assert(languageCheck.languageMismatches.some((item)=>item.terms.includes('build')),'unlisted English words in Korean visible text fail');
+assert.equal(parseBrief('# Release map\n- Package participates in the labeled relationships below.\n- Build → Package (ready)').language,'en','language follows the semantic labels, not boilerplate headings');
+const membershipBrief=['# Trust boundary','- 모바일 앱 participates in the labeled relationships below.','- API 게이트웨이 participates in the labeled relationships below.','- 작업 소비자 participates in the labeled relationships below.','- 재고 서비스 participates in the labeled relationships below.','- 결제사 participates in the labeled relationships below.','- Trust boundary internal nodes: API 게이트웨이; 작업 소비자; 재고 서비스','- Trust boundary external nodes: 모바일 앱; 결제사'].join('\n');
+const membershipContract=parseBrief(membershipBrief);
+const membershipSource=(workerX,inventoryX)=>'<svg><rect x="195" y="155" width="710" height="408" data-trust-boundary="internal"/><rect x="40" y="304" width="144" height="64" data-node-id="모바일 앱"/><rect x="280" y="304" width="144" height="64" data-node-id="API 게이트웨이"/><rect x="'+workerX+'" y="304" width="144" height="64" data-node-id="작업 소비자"/><rect x="'+inventoryX+'" y="176" width="144" height="64" data-node-id="재고 서비스"/><rect x="910" y="450" width="120" height="64" data-node-id="결제사"/></svg>';
+const membershipDefect=checkBrief(membershipSource(910,910),membershipContract).boundaryMembership;
+assert(membershipDefect.issues.includes('BOUNDARY_NODE_NOT_INTERNAL name=작업 소비자'),'the reviewed worker-outside-boundary defect fails');
+assert(membershipDefect.issues.includes('BOUNDARY_NODE_NOT_INTERNAL name=재고 서비스'),'the reviewed inventory-outside-boundary defect fails');
+assert.deepEqual(checkBrief(membershipSource(740,740),membershipContract).boundaryMembership.issues,[],'declared internal nodes inside and external nodes outside pass');
+console.log('BRIEF_CONTRACT_FIXTURES_PASS exact-nodes labels endpoints direction Korean-language-exempt-terms boundary-membership');

package/skills/lit-diagram-drawer/scripts/test-importers.mjs

@@ -0,0 +1,119 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { deflateRawSync } from 'node:zlib';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const temp=fs.mkdtempSync(path.join(os.tmpdir(),'lit-diagram-importer-'));
+const importers=[
+  {name:'draw.io',script:'drawio-extract.mjs',extension:'.drawio',limit:16*1024*1024,valid:'<mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="a" value="Input" vertex="1" parent="1"/></root></mxGraphModel>'},
+  {name:'Mermaid',script:'mermaid-extract.mjs',extension:'.mmd',limit:4*1024*1024,valid:'flowchart LR\nA[Input] --> B[Store]\n'},
+  {name:'Excalidraw',script:'excalidraw-extract.mjs',extension:'.excalidraw',limit:16*1024*1024,valid:JSON.stringify({type:'excalidraw',elements:[{id:'a',type:'rectangle',x:0,y:0,width:80,height:30}]})}
+];
+function run(importer,file,...args){
+  return spawnSync(process.execPath,[path.join(root,'scripts',importer.script),file,...args],{encoding:'utf8',timeout:30_000,maxBuffer:1024*1024});
+}
+try{
+  for(const importer of importers){
+    const valid=path.join(temp,'valid'+importer.extension);
+    fs.writeFileSync(valid,importer.valid);
+    const accepted=run(importer,valid);
+    assert.equal(accepted.status,0,importer.name+' valid fixture: '+accepted.stderr);
+    assert.equal(JSON.parse(accepted.stdout).schemaVersion,1,importer.name+' emits the normalized schema');
+
+    let encodedActive,encodedUrl;
+    if(importer.name==='draw.io'){
+      encodedActive=importer.valid.replace('value="Input"','value="&amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;"');
+      encodedUrl=importer.valid.replace('value="Input"','value="https&amp;#58;//example.invalid/path"');
+    }else if(importer.name==='Mermaid'){
+      encodedActive='flowchart LR\nA["&lt;script&gt;alert(1)&lt;/script&gt;"] --> B[Store]\n';
+      encodedUrl='flowchart LR\nA["https&#58;//example.invalid/path"] --> B[Store]\n';
+    }else{
+      const scene=JSON.parse(importer.valid);
+      scene.elements.push({id:'label',type:'text',text:'&lt;script&gt;alert(1)&lt;/script&gt;',x:0,y:0,width:80,height:20,containerId:'a'});
+      encodedActive=JSON.stringify(scene);
+      scene.elements.at(-1).text='https&#58;//example.invalid/path';
+      encodedUrl=JSON.stringify(scene);
+    }
+    const activeFile=path.join(temp,'encoded-active'+importer.extension);
+    fs.writeFileSync(activeFile,encodedActive);
+    const encodedAttack=run(importer,activeFile);
+    assert.equal(encodedAttack.status,2,importer.name+' entity-encoded active markup is rejected');
+    assert.match(encodedAttack.stderr,/executable markup/u,importer.name+' identifies unsafe encoded markup');
+
+    const urlFile=path.join(temp,'encoded-url'+importer.extension);
+    fs.writeFileSync(urlFile,encodedUrl);
+    const urlResult=run(importer,urlFile);
+    assert.equal(urlResult.status,0,importer.name+' encoded URL is safely discarded: '+urlResult.stderr);
+    const urlOutput=JSON.parse(urlResult.stdout);
+    assert.equal(urlOutput.discarded.urls,1,importer.name+' accounts for its discarded encoded URL');
+    assert.doesNotMatch(JSON.stringify({title:urlOutput.title,nodes:urlOutput.nodes,relationships:urlOutput.relationships,groups:urlOutput.groups}),/example\.invalid/u,importer.name+' does not preserve the encoded URL');
+
+    const oversized=path.join(temp,'oversized'+importer.extension);
+    const oversizedFd=fs.openSync(oversized,'w');
+    fs.ftruncateSync(oversizedFd,importer.limit+1);
+    fs.closeSync(oversizedFd);
+    const tooLarge=run(importer,oversized);
+    assert.equal(tooLarge.status,2,importer.name+' oversized source is rejected');
+    assert.match(tooLarge.stderr,/exceeds the \d+ MiB limit/u,importer.name+' reports its size bound');
+
+    const symlink=path.join(temp,'linked'+importer.extension);
+    try { fs.symlinkSync(valid,symlink); }
+    catch(error){
+      if(!['EACCES','EPERM','ENOTSUP','EOPNOTSUPP'].includes(error.code)) throw error;
+      continue;
+    }
+    const linked=run(importer,symlink);
+    assert.equal(linked.status,2,importer.name+' symlink source is rejected');
+    assert.match(linked.stderr,/regular file|safely read/u,importer.name+' explains the no-follow boundary');
+  }
+  const drawio=importers[0];
+  const bomb=deflateRawSync(Buffer.alloc(32*1024*1024+1)).toString('base64');
+  const selectedPage=path.join(temp,'selected-page.drawio');
+  fs.writeFileSync(selectedPage,`<mxfile><diagram name="selected">${drawio.valid}</diagram><diagram>${bomb}</diagram><diagram>${bomb}</diagram></mxfile>`);
+  const selected=run(drawio,selectedPage,'--page','0');
+  assert.equal(selected.status,0,'unselected compressed pages are never inflated: '+selected.stderr);
+  assert.equal(JSON.parse(selected.stdout).title,'selected');
+
+  const unsafeTitle=path.join(temp,'unsafe-title.drawio');
+  fs.writeFileSync(unsafeTitle,`<mxfile><diagram name="&lt;script&gt;alert(1)&lt;/script&gt;">${drawio.valid}</diagram></mxfile>`);
+  const unsafeTitleResult=run(drawio,unsafeTitle);
+  assert.equal(unsafeTitleResult.status,2,'encoded active markup in a page name is rejected');
+  assert.match(unsafeTitleResult.stderr,/executable markup/u);
+
+  const urlTitle=path.join(temp,'url-title.drawio');
+  fs.writeFileSync(urlTitle,`<mxfile><diagram name="https://example.invalid/path">${drawio.valid}</diagram></mxfile>`);
+  const normalizedTitle=run(drawio,urlTitle);
+  assert.equal(normalizedTitle.status,0,normalizedTitle.stderr);
+  assert.equal(JSON.parse(normalizedTitle.stdout).title,'Imported diagram');
+  assert.equal(JSON.parse(normalizedTitle.stdout).discarded.urls,1,'URL-bearing page titles are accounted as discarded content');
+
+  for(const [importer,filename] of [[importers[1],'evil<script>.mmd'],[importers[2],'evil<script>.excalidraw']]){
+    const maliciousName=path.join(temp,filename);
+    fs.writeFileSync(maliciousName,importer.valid);
+    const rejectedName=run(importer,maliciousName);
+    assert.equal(rejectedName.status,2,importer.name+' malicious fallback filename is rejected');
+    assert.match(rejectedName.stderr,/executable markup/u);
+  }
+  for(const [importer,filename] of [[importers[1],'https&#58;example.invalid.mmd'],[importers[2],'https&#58;example.invalid.excalidraw']]){
+    const urlName=path.join(temp,filename);
+    fs.writeFileSync(urlName,importer.valid);
+    const cleanedName=run(importer,urlName);
+    assert.equal(cleanedName.status,0,cleanedName.stderr);
+    const normalized=JSON.parse(cleanedName.stdout);
+    assert.equal(normalized.title,'Imported diagram',importer.name+' uses a nonempty fallback after filename URL removal');
+    assert.equal(normalized.discarded.urls,1,importer.name+' accounts for the URL in its fallback filename');
+  }
+
+  const oversizedPage=path.join(temp,'oversized-page.drawio');
+  fs.writeFileSync(oversizedPage,`<mxfile><diagram>${bomb}</diagram></mxfile>`);
+  const oversizedSelected=run(drawio,oversizedPage,'--page','0');
+  assert.equal(oversizedSelected.status,2,'selected compressed page beyond decoded limit is rejected');
+  assert.match(oversizedSelected.stderr,/invalid or oversized compression/u);
+}finally{
+  fs.rmSync(temp,{recursive:true,force:true});
+}
+console.log('IMPORTER_GUARDS_PASS draw.io Mermaid Excalidraw bounded stable regular-file no-follow reads');

package/skills/lit-diagram-drawer/scripts/test-office-safety.mjs

@@ -0,0 +1,67 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { officeCssUrlsAreSafe, officeHrefRefsAreSafe } from './office-safety.mjs';
+
+assert.equal(officeCssUrlsAreSafe('<svg><path fill="url(#arrow-main)"/></svg>'),true);
+assert.equal(officeCssUrlsAreSafe('<svg><style>.x{filter:url( #shadow )}</style></svg>'),true);
+assert.equal(officeCssUrlsAreSafe('<svg><path fill="url(&#35;arrow-main)"/></svg>'),true);
+assert.equal(officeCssUrlsAreSafe('<svg data-note="<style>"><img style="background:url(file:///tmp/a)"/></style></svg>'),false,'style-like attribute text cannot hide CSS-bearing markup');
+for(const value of [
+  'file:///tmp/payload.svg',
+  'ftp://example.invalid/payload.svg',
+  '//example.invalid/payload.svg',
+  'https://example.invalid/payload.svg',
+  '../payload.svg',
+  'data:image/svg+xml;base64,AAAA'
+]){
+  assert.equal(officeCssUrlsAreSafe('<svg><style>.x{fill:url("'+value+'")}</style></svg>'),false,value);
+}
+assert.equal(officeCssUrlsAreSafe('<svg><style>.x{fill:u/**/rl(file:///tmp/a)}</style></svg>'),false);
+assert.equal(officeCssUrlsAreSafe('<svg><style>.x{fill:u\\72l(file:///tmp/a)}</style></svg>'),false);
+assert.equal(officeCssUrlsAreSafe('<svg><style>.x{fill:u&#114;l(file:///tmp/a)}</style></svg>'),false,'decimal XML reference in CSS function name');
+assert.equal(officeCssUrlsAreSafe('<svg><style>.x{fill:u&#x72;l(https://example.invalid/a)}</style></svg>'),false,'hex XML reference in CSS function name');
+assert.equal(officeCssUrlsAreSafe('<svg><style>&#64;import "file:///tmp/a.css";</style></svg>'),false,'numeric XML reference in CSS at-rule');
+assert.equal(officeCssUrlsAreSafe('<svg><path style="&commat;import url(file:///tmp/a.css)"/></svg>'),false,'named HTML reference in CSS attribute');
+assert.equal(officeCssUrlsAreSafe('<svg><style>.x{fill:v&#97;r(--external)}</style></svg>'),false,'numeric XML reference in unsupported var() function');
+assert.equal(officeCssUrlsAreSafe('<svg><style>@font-face{font-family:Pretendard;src:local(Arial)}</style></svg>'),false,'local() cannot spoof the bundled font face');
+assert.equal(officeCssUrlsAreSafe('<svg><style>@font-face{font-family:Pretendard;src:url(font.woff2);unicode-range:U+0020}</style></svg>'),false,'unicode-range cannot make partial font coverage appear complete');
+assert.equal(officeCssUrlsAreSafe('<svg><style>.x{fill:url(file:///tmp/a}</style></svg>'),false);
+assert.equal(officeHrefRefsAreSafe('<svg><use href="#local-symbol"/></svg>'),true);
+for(const reference of ['file:///tmp/a.svg','ftp://example.invalid/a.svg','//example.invalid/a.svg','../a.svg','https://example.invalid/a.svg','&#102;ile:///tmp/a.svg']){
+  assert.equal(officeHrefRefsAreSafe('<svg><image href="'+reference+'"/></svg>'),false,reference);
+}
+assert.equal(officeHrefRefsAreSafe('<svg><image href=file:///tmp/a.svg/></svg>'),false);
+assert.equal(officeHrefRefsAreSafe('<svg><image href="&#35;local-symbol"/></svg>'),true);
+assert.equal(officeHrefRefsAreSafe('<svg data-note="<style>"><img src="https://example.invalid/x"/></style></svg>'),false,'style-like attribute text cannot hide resource references');
+assert.equal(officeHrefRefsAreSafe('<svg><image href="https&colon;&sol;&sol;example.invalid/a.svg"/></svg>'),false,'named HTML references cannot disguise an external URI');
+assert.equal(officeHrefRefsAreSafe('<svg xml:base="https://example.invalid/a.svg"><use href="#local-symbol"/></svg>'),false,'xml:base cannot redirect a fragment reference');
+assert.equal(officeHrefRefsAreSafe('<html><head><base href="https://example.invalid/"></head><svg><use href="#local-symbol"/></svg></html>'),false,'HTML base cannot redirect a fragment reference');
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const temp=fs.mkdtempSync(path.join(os.tmpdir(),'lit-diagram-office-guard-'));
+const exporter=path.join(root,'scripts/export.mjs');
+const cliFixtures=[
+  ['css-import','<svg viewBox="0 0 10 10"><style>&#64;import "file:///tmp/a.css";</style></svg>'],
+  ['css-var','<svg viewBox="0 0 10 10"><style>.x{fill:v&#97;r(--external)}</style></svg>'],
+  ['css-local-font','<svg viewBox="0 0 10 10"><style>@font-face{font-family:Pretendard;src:local(Arial)}</style></svg>'],
+  ['css-font-unicode-range','<svg viewBox="0 0 10 10"><style>@font-face{font-family:Pretendard;src:url(font.woff2);unicode-range:U+0020}</style></svg>'],
+  ['css-url','<svg viewBox="0 0 10 10"><style>.x{fill:u&#114;l(https://example.invalid/a)}</style></svg>'],
+  ['xml-base','<svg viewBox="0 0 10 10" xml:base="https://example.invalid/"><use href="#local-symbol"/></svg>']
+];
+try{
+  for(const [name,svg] of cliFixtures){
+    const input=path.join(temp,name+'.svg'),output=path.join(temp,name+'-out');
+    fs.writeFileSync(input,svg);
+    const result=spawnSync(process.execPath,[exporter,'--input',input,'--out',output,'--scale','1','--office-safe'],{encoding:'utf8'});
+    assert.equal(result.status,2,name+' must fail before output');
+    assert.match(result.stderr,/EXPORT_SOURCE_REJECTED|OFFICE_UNSAFE|OFFICE_UNSUPPORTED/,name);
+    assert.equal(fs.existsSync(output),false,name+' must not create output');
+  }
+}finally{
+  fs.rmSync(temp,{recursive:true,force:true});
+}
+console.log('Office guard passed local-fragment cases and rejected encoded external CSS, unsupported var(), partial-font unicode ranges, unsafe bases, and malformed href/src references in both helper and exporter fixtures.');

package/skills/lit-diagram-drawer/scripts/test-sequence-verifier.mjs

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { analyzeFile } from './diagram-metrics.mjs';
+
+const verifier=fileURLToPath(new URL('./verify-type.mjs',import.meta.url));
+const base='<main data-type="sequence-oauth" data-variant="light"><svg id="diagram-sequence-oauth-light" viewBox="0 0 400 240"><rect x="60" y="60" width="80" height="48" data-node-id="A"/><rect x="160" y="60" width="80" height="48" data-node-id="Mid"/><rect x="260" y="60" width="80" height="48" data-node-id="B"/><path d="M100 140 H300" data-from="A" data-to="B"/><path d="M300 180 H100" data-from="B" data-to="A"/></svg></main>';
+const lifelines='<line x1="100" y1="108" x2="100" y2="180" stroke-dasharray="5 5" data-lifeline-for="A"/><line x1="200" y1="108" x2="200" y2="180" stroke-dasharray="5 5" data-lifeline-for="Mid"/><line x1="300" y1="108" x2="300" y2="180" stroke-dasharray="5 5" data-lifeline-for="B"/>';
+const run=(source,{measure=false}={})=>{
+  const dir=fs.mkdtempSync(path.join(os.tmpdir(),'lit-sequence-verifier-'));
+  try{
+    const file=path.join(dir,'fixture.html');fs.writeFileSync(file,source);
+    return {result:spawnSync(process.execPath,[verifier,'--type=sequence-oauth',file],{encoding:'utf8'}),metrics:measure?analyzeFile(file):null};
+  }finally{fs.rmSync(dir,{recursive:true,force:true});}
+};
+const missing=run(base).result;
+assert.notEqual(missing.status,0,'sequence verifier rejects missing lifelines');
+assert.match(missing.stderr,/SEQUENCE_LIFELINE_MISSING/,'missing lifeline finding is reported');
+const valid=run(base.replace('</svg>',lifelines+'</svg>'),{measure:true});
+assert.equal(valid.result.status,0,valid.result.stderr||'lifelines aligned to boxes and ordered message endpoints pass');
+assert.equal(valid.metrics.arrowCrossings,0,'lifeline intersections are intentional and excluded from arrow-crossing count');
+const outOfOrder=run(base.replace('<path d="M100 140 H300" data-from="A" data-to="B"/><path d="M300 180 H100" data-from="B" data-to="A"/>','<path d="M100 180 H300" data-from="A" data-to="B"/><path d="M300 140 H100" data-from="B" data-to="A"/>').replace('</svg>',lifelines+'</svg>')).result;
+assert.notEqual(outOfOrder.status,0,'sequence verifier rejects messages that are not top-to-bottom');
+assert.match(outOfOrder.stderr,/SEQUENCE_MESSAGE_ORDER/,'message order finding is reported');
+console.log('SEQUENCE_VERIFIER_FIXTURES_PASS missing-lifeline endpoints-and-order');

package/skills/lit-diagram-drawer/scripts/test-visual-quality.mjs

@@ -0,0 +1,68 @@
+import assert from 'node:assert/strict';
+import { visualQuality } from './visual-quality.mjs';
+
+const svg=(texts,shapes='')=>`<svg viewBox="0 0 1080 640"><title>Fixture</title><rect width="1080" height="640" fill="#ffffff"/>${shapes}${texts}</svg>`;
+const text=(label,x,y,size=16,role='',edgeFor='')=>`<text x="${x}" y="${y}" text-anchor="middle" font-size="${size}"${role?` data-role="${role}"`:''}${edgeFor?` data-edge-for="${edgeFor}"`:''}>${label}</text>`;
+const nodes='<rect x="40" y="240" width="150" height="80" data-node-id="A"/><rect x="400" y="240" width="150" height="80" data-node-id="B"/><rect x="198" y="255" width="34" height="50" data-node-id="C"/>';
+const edge='<path d="M190 280 H400" data-from="A" data-to="B" data-label="전달"/>';
+const process=visualQuality(svg(text('LITFAMILY / ARCHITECTURE',500,90,12)),{});
+assert(process.issues.some((issue)=>issue.startsWith('PROCESS_TEXT')),'process and product labels fail');
+const noVisibleTitle=visualQuality(svg(text('서비스',500,285,17,'node')),{enforceCanvas:true});
+assert(noVisibleTitle.issues.some((issue)=>issue.startsWith('TITLE_ROLE_MISSING')),'missing reader-facing title fails');
+const clean=visualQuality(svg(text('예약 요청',540,100,30,'title')+text('서비스',115,195,17,'node')+text('전달',500,472,14,'edge','A|B')+text('저장소',965,495,17,'node'),'<rect x="40" y="150" width="150" height="80" data-node-id="A"/><rect x="890" y="450" width="150" height="80" data-node-id="B"/><path d="M190 190 V490 H890" data-from="A" data-to="B" data-label="전달"/>'),{enforceCanvas:true});
+assert.deepEqual(clean.issues,[],'clean, well-sized connector example passes');
+const geometry=visualQuality(svg(text('전달',295,282,14,'edge','A|B')+text('제목',540,90,22,'title')+text('노드',115,285,12,'node'),nodes+edge),{enforceCanvas:true});
+assert(geometry.issues.some((issue)=>issue.startsWith('EDGE_TEXT_COLLISION')),'label on connector fails');
+assert(geometry.issues.some((issue)=>issue.startsWith('ROUTE_THROUGH_NODE')),'route through non-endpoint node fails');
+assert(geometry.issues.some((issue)=>issue.startsWith('NODE_GAP')),'node gap below 12px fails');
+assert(geometry.issues.some((issue)=>issue.startsWith('FONT_FLOOR')),'small title and node labels fail');
+assert(geometry.issues.some((issue)=>issue.startsWith('CONTENT_FILL')),'sparse content fails fill floor');
+const nearPath=visualQuality(svg(text('전달',280,250,14,'edge','A|B'),'<rect x="40" y="240" width="150" height="80" data-node-id="A"/><rect x="400" y="240" width="150" height="80" data-node-id="B"/><path d="M190 280 H400" data-from="A" data-to="B" data-label="전달"/><path d="M260 250 H400" data-from="A" data-to="B" data-label="다른 경로"/>'),{});
+assert(nearPath.issues.some((issue)=>issue.startsWith('EDGE_LABEL_NEAREST_PATH')),'label anchor must be nearer to its named route than another route');
+assert(nearPath.edgeLabelMaxAnchorDistance===24,'edge association distance is a stated 24px');
+const labelNode=visualQuality(svg(text('ok',396,245,14,'edge','A|B'),'<rect x="40" y="220" width="150" height="80" data-node-id="A"/><rect x="400" y="240" width="150" height="80" data-node-id="B"/><path d="M190 250 H400" data-from="A" data-to="B" data-label="ok"/>'),{});
+assert(labelNode.issues.some((issue)=>issue.startsWith('EDGE_LABEL_NODE_COLLISION ok overlaps B')),'edge labels cannot overlap a node box');
+const faintBoundaryLabel=text('경계',295,160,12,'boundary').replace('font-size="12"','font-size="12" fill="#c9d1d5"');
+const boundary=visualQuality(svg(faintBoundaryLabel+text('제목',540,90,30,'title'),'<rect x="300" y="150" width="500" height="350" fill="none" stroke="#748084" data-trust-boundary="경계"/>'),{enforceCanvas:true});
+assert(boundary.issues.some((issue)=>issue.startsWith('OUTLINE_TEXT_COLLISION')),'boundary and group outlines cannot cross visible labels');
+assert(boundary.issues.some((issue)=>issue.startsWith('BOUNDARY_FONT_FLOOR')),'boundary labels use the 13px connector-label floor');
+assert(boundary.issues.some((issue)=>issue.startsWith('BOUNDARY_CONTRAST_FLOOR')),'boundary labels use the 4.5:1 text contrast floor');
+const arrowSvg=(end)=>`<svg viewBox="0 0 1080 640"><defs><marker id="arrow" markerWidth="10" markerHeight="10" refX="8" refY="3.5" orient="auto"><path d="M0 0 L0 7 L9 3.5 z"/></marker></defs><rect x="40" y="240" width="150" height="80" data-node-id="A"/><rect x="400" y="240" width="150" height="80" data-node-id="B"/><path d="M190 280 H${end}" stroke-width="3" marker-end="url(#arrow)" data-from="A" data-to="B"/></svg>`;
+assert.deepEqual(visualQuality(arrowSvg(396),{}).issues,[],'arrowhead whose tip stops 1px before the target remains fully visible');
+assert(visualQuality(arrowSvg(394),{}).issues.some((issue)=>issue.startsWith('ARROWHEAD_TIP_MISSED_TARGET')),'arrow tips more than 2px from a target edge fail');
+assert(visualQuality(arrowSvg(400),{}).issues.some((issue)=>issue.startsWith('ARROWHEAD_TARGET_OVERLAP')),'arrowhead painted under its target box fails');
+const tinyArrow='<svg viewBox="0 0 1080 640"><defs><marker id="tiny" markerWidth="7" markerHeight="6" refX="6" refY="3" markerUnits="userSpaceOnUse"><path d="M0 0 L0 6 L6 3 z"/></marker></defs><path d="M10 30 H100" stroke-width="2" marker-end="url(#tiny)" data-from="A" data-to="B"/></svg>';
+assert(visualQuality(tinyArrow,{}).issues.some((issue)=>issue.startsWith('ARROWHEAD_SIZE_FLOOR')),'arrowheads shorter than the canvas/stroke floor fail');
+const decision=(edges)=>`<svg viewBox="0 0 1080 640"><rect x="100" y="100" width="160" height="80" data-node-id="검증 통과?" data-node-type="decision" data-outcomes="예|아니오"/><rect x="500" y="100" width="160" height="80" data-node-id="승인"/><rect x="500" y="300" width="160" height="80" data-node-id="변경 제출"/>${edges}</svg>`;
+const oneOutcome=visualQuality(decision('<path d="M260 140 H500" data-from="검증 통과?" data-to="승인" data-label="예"/>'),{});
+assert(oneOutcome.issues.some((issue)=>issue.startsWith('DECISION_OUTCOME_MISSING 검증 통과? 아니오')),'decision nodes must cover each declared outcome');
+const allOutcomes=visualQuality(decision('<path d="M260 140 H500" data-from="검증 통과?" data-to="승인" data-label="예"/><path d="M180 180 V340 H500" data-from="검증 통과?" data-to="변경 제출" data-label="아니오"/>'),{});
+assert(!allOutcomes.issues.some((issue)=>issue.startsWith('DECISION_')),'a decision node with every named outcome passes');
+const boundaryRoute=visualQuality('<svg viewBox="0 0 1080 640"><rect x="300" y="150" width="500" height="350" fill="none" stroke="#748084" data-trust-boundary="zone"/><path d="M100 151 H450" data-from="A" data-to="B"/></svg>',{});
+assert(boundaryRoute.issues.some((issue)=>issue.startsWith('ROUTE_ALONG_BOUNDARY')),'routes cannot run collinear with a boundary edge');
+const routedNodes='<rect x="50" y="100" width="100" height="80" data-node-id="A"/><rect x="300" y="100" width="100" height="80" data-node-id="B"/>';
+const detour=visualQuality(svg('',routedNodes+'<path d="M150 140 V80 H300 V140" data-from="A" data-to="B"/>'),{});
+assert(detour.issues.some((issue)=>issue.startsWith('ROUTE_DETOUR A-&gt;B')||issue.startsWith('ROUTE_DETOUR A->B')),'detours above 1.4× facing-side distance fail');
+assert(detour.issues.some((issue)=>issue.startsWith('ROUTE_ALIGNED_PATH A->B')),'same-row neighbors use one straight segment');
+const straightNeighbors=visualQuality(svg('',routedNodes+'<path d="M150 140 H296" data-from="A" data-to="B"/>'),{});
+assert(!straightNeighbors.issues.some((issue)=>/^ROUTE_(?:DETOUR|BENDS|ALIGNED_PATH)/.test(issue)),'a straight same-row neighbor link passes route simplicity checks');
+const tooManyBends=visualQuality(svg('',routedNodes+'<path d="M150 140 V80 H210 V200 H250 V70 H300 V140" data-from="A" data-to="B"/>'),{});
+assert(tooManyBends.issues.some((issue)=>issue.startsWith('ROUTE_BENDS A->B')),'more than two bends without a boundary fails');
+const crossingBoundary='<rect x="300" y="100" width="400" height="400" data-trust-boundary="internal"/><rect x="50" y="220" width="100" height="80" data-node-id="A"/><rect x="600" y="150" width="100" height="80" data-node-id="B"/>';
+const threeBendsCrossing=visualQuality(svg('',crossingBoundary+'<path d="M150 260 V220 H500 V190 H596" data-from="A" data-to="B"/>'),{});
+assert(!threeBendsCrossing.issues.some((issue)=>issue.startsWith('ROUTE_BENDS A->B')),'three bends are allowed when the edge crosses a boundary');
+const fourBendsCrossing=visualQuality(svg('',crossingBoundary+'<path d="M150 260 V220 H250 V320 H450 V190 H596" data-from="A" data-to="B"/>'),{});
+assert(fourBendsCrossing.issues.some((issue)=>issue.startsWith('ROUTE_BENDS A->B')),'more than three bends across a boundary fails');
+const overlapNodes='<rect x="120" y="20" width="60" height="60" data-node-id="A"/><rect x="120" y="200" width="60" height="60" data-node-id="B"/><rect x="120" y="100" width="60" height="40" data-node-id="C"/><rect x="120" y="180" width="60" height="40" data-node-id="D"/>';
+const sharedSegment=visualQuality(svg('',overlapNodes+'<path d="M150 80 V200" data-from="A" data-to="B"/><path d="M150 140 V180" data-from="C" data-to="D"/>'),{});
+assert(sharedSegment.issues.some((issue)=>issue.startsWith('ROUTE_COLLINEAR_OVERLAP')),'distinct routes cannot share collinear segments');
+const pairNodes='<rect x="40" y="240" width="100" height="120" data-node-id="A"/><rect x="400" y="240" width="100" height="120" data-node-id="B"/>';
+const crossingPair=visualQuality(svg('',pairNodes+'<path d="M140 300 H400" fill="none" data-from="A" data-to="B"/><path d="M400 340 H280 V260 H140" fill="none" data-from="B" data-to="A"/>'),{});
+assert(crossingPair.issues.some((issue)=>issue.startsWith('ROUTE_CROSSING A->B / B->A')),'crossings between routes for the same node pair fail');
+const parallelPair=visualQuality(svg('',pairNodes+'<path d="M140 300 H400" fill="none" data-from="A" data-to="B"/><path d="M400 340 H140" fill="none" data-from="B" data-to="A"/>'),{});
+assert(!parallelPair.issues.some((issue)=>issue.startsWith('ROUTE_CROSSING')),'parallel opposing routes for the same node pair pass');
+const opposed=visualQuality(svg('',routedNodes+'<path d="M150 140 H300" marker-start="url(#arrow)" marker-end="url(#arrow)" data-from="A" data-to="B"/>'),{});
+assert(opposed.issues.some((issue)=>issue.startsWith('ROUTE_OPPOSED_HEADS A->B')),'a single directed polyline cannot carry heads at both ends');
+const missingLifelines=visualQuality('<svg viewBox="0 0 1080 640" data-type="sequence"><rect x="60" y="60" width="80" height="48" data-node-id="Browser"/><rect x="280" y="60" width="80" height="48" data-node-id="API"/><path d="M140 160 H280" data-from="Browser" data-to="API" data-label="요청"/></svg>',{});
+assert(missingLifelines.issues.some((issue)=>issue.startsWith('SEQUENCE_LIFELINE_MISSING')),'sequence participants need lifelines');
+console.log('VISUAL_QUALITY_FIXTURES_PASS process-text edge-association label-node-collision decision-outcomes arrowhead-tip-and-size boundary-label outline route-node boundary-route node-gap font-fill detour bends shared-segment opposed-heads sequence-lifeline');

package/skills/lit-diagram-drawer/scripts/verify-all.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { analyzeFile, root } from './diagram-metrics.mjs';
+import { visualQuality } from './visual-quality.mjs';
+
+const catalog=JSON.parse(fs.readFileSync(path.join(root,'references/type-catalog.json'),'utf8'));
+const paths=[];
+for(const entry of catalog.entries) for(const variant of catalog.variants) paths.push({file:path.join(root,'assets/examples/type-'+entry.id+'-'+variant+'.html'),type:entry.id,variant,kind:'template'});
+for(const entry of fs.readdirSync(path.join(root,'examples'),{withFileTypes:true}).filter((x)=>x.isDirectory())) {
+  const file=path.join(root,'examples',entry.name,'after.html');
+  if(fs.existsSync(file)) {
+    const source=fs.readFileSync(file,'utf8');
+    const type=source.match(/data-type="([a-z0-9-]+)"/)?.[1];
+    paths.push({file,type,variant:'full',kind:'after'});
+  }
+}
+const issues=[];
+const advisories=[];
+function add(file,code){issues.push({file:path.relative(root,file),code});}
+for(const item of paths){
+  if(!fs.existsSync(item.file)){add(item.file,'MISSING');continue;}
+  let source,result;
+  try{source=fs.readFileSync(item.file,'utf8');result=analyzeFile(item.file);}catch(e){add(item.file,'ANALYSIS '+e.message);continue;}
+  const visual=visualQuality(source,{enforceCanvas:item.kind==='after'});
+  for(const issue of visual.issues)add(item.file,'VISUAL '+issue);
+  for(const note of visual.advisories)advisories.push({file:path.relative(root,item.file),code:note});
+  if(!result.hasSvg||!result.viewBox||result.viewBox.w<=0||result.viewBox.h<=0)add(item.file,'SVG_OR_VIEWBOX');
+  if(!result.title||!result.desc||!result.roleImage||!result.ariaLinked)add(item.file,'A11Y');
+  if(!result.textCount)add(item.file,'NO_TEXT');
+  if(result.offCanvas)add(item.file,'OFF_CANVAS '+result.offCanvas);
+  if(result.textOverlaps)add(item.file,'TEXT_OVERLAP '+result.textOverlaps);
+  if(result.objectOverlaps)add(item.file,'SHAPE_OVERLAP '+result.objectOverlaps);
+  if(result.contrastFailures.length)add(item.file,'CONTRAST '+result.contrastFailures.length);
+  if(!result.fontFamilyPresent||!result.localFont||!result.fontFileValid)add(item.file,'PRETENDARD_FONT_ASSET');
+  if(result.humanizer.summary?.block)add(item.file,'HUMANIZER_BLOCK '+result.humanizer.summary.block);
+  if(result.humanizer.errors?.length)add(item.file,'HUMANIZER_ERROR');
+  const entry=catalog.entries.find((x)=>x.id===item.type);
+  if(!entry)add(item.file,'UNKNOWN_TYPE');
+  if(entry&&!source.includes('data-type="'+item.type+'"')&&!source.includes('id="diagram-'+item.type+'-'))add(item.file,'TYPE_ID_MISMATCH');
+  if(entry&&entry.family==='quantitative'&&result.textCount<3)add(item.file,'QUANTITATIVE_LABELS');
+  if(item.type==='heatmap'&&(source.match(/<rect\b/gi)||[]).length<16)add(item.file,'HEATMAP_GRID');
+  if(item.type==='treemap'&&(source.match(/<rect\b/gi)||[]).length<6)add(item.file,'TREEMAP_TILES');
+  if(item.type==='sankey'&&!/<path\b[^>]*stroke-width\s*=\s*["'][1-9]/i.test(source))add(item.file,'SANKEY_WIDTH');
+  if(item.type==='waterfall'&&(source.match(/<rect\b/gi)||[]).length<5)add(item.file,'WATERFALL_STEPS');
+  if(item.type==='beeswarm'&&(source.match(/<circle\b/gi)||[]).length<20)add(item.file,'BEESWARM_MARKS');
+  if(item.type==='bubble'&&(source.match(/<circle\b/gi)||[]).length<6)add(item.file,'BUBBLE_MARKS');
+  if((item.type==='polar'||item.type==='radar')&&!/<polygon\b/i.test(source))add(item.file,'POLAR_OR_RADAR_SHAPE');
+  if(item.type==='tree-block-decomposition'&&!/data-block-id\s*=/.test(source))add(item.file,'BLOCK_ID');
+  if(item.type==='policy-trace-animated'&&!/(rule|policy|allow|deny)/i.test(source))add(item.file,'POLICY_SEMANTIC');
+  if(item.type==='queue-animated'&&!/(queue|buffer|drain|fan-in)/i.test(source))add(item.file,'QUEUE_SEMANTIC');
+  if(item.type==='paved-road-animated'&&!/(boundary|guardrail|secure|policy)/i.test(source))add(item.file,'PAVED_ROAD_SEMANTIC');
+  if(/<animate\b|<set\b|autoplay|infinite/i.test(source))add(item.file,'NON_STATIC_MOTION');
+  if(/<script\b|\bon[a-z]+\s*=|https?:\/\//i.test(result.visibleText))add(item.file,'UNSAFE_TEXT');
+}
+const foilFiles=[];
+for(const dir of fs.readdirSync(path.join(root,'examples'),{withFileTypes:true}).filter((x)=>x.isDirectory())){
+  const file=path.join(root,'examples',dir.name,'constructed-naive-foil.html');
+  if(fs.existsSync(file)){
+    foilFiles.push(file);
+    try{
+      const r=analyzeFile(file);
+      const fails=!r.title||!r.desc||r.textOverlaps>0||r.contrastFailures.length>0||r.humanizer.summary?.block>0;
+      if(!fails)add(file,'FOIL_NOT_FLAGGED');
+    }catch(e){add(file,'FOIL_ANALYSIS '+e.message);}
+  }
+}
+if(paths.filter((x)=>x.kind==='template').length!==183)add(root,'TEMPLATE_COUNT');
+if(paths.filter((x)=>x.kind==='after').length!==8)add(root,'AFTER_COUNT');
+const out={templates:paths.filter((x)=>x.kind==='template').length,afterExamples:paths.filter((x)=>x.kind==='after').length,foilsChecked:foilFiles.length,failures:issues,advisories};
+console.log(JSON.stringify(out,null,2));
+if(issues.length)process.exitCode=1;