@skillstech/thunderlang 0.1.6

package/src/core.mjs

@@ -0,0 +1,92 @@
+// @skillstech/thunderlang/core , the BROWSER-SAFE barrel. Every symbol here is pure ESM with
+// ZERO Node.js dependencies (no fs/path/url), so it bundles cleanly into a browser app
+// (SkillsTech Studio's Vite build, Repo Mastery's projections). It is a strict superset of
+// the original AI-core helpers, so existing `@skillstech/thunderlang/core` imports keep
+// working, plus the canonical schema/classification helpers and the pure Intent Runtime.
+
+// AI-implementation helpers (unchanged , keeps existing /core consumers working).
+export * from './ai-core.mjs';
+
+// Classification model (observed/inferred/proposed/... + isFactual). Node-free.
+export { CLASSIFICATIONS, CONFIDENCE, UNSETTLED, classify, isFactual, BLOCKABLE_PHASES } from './classification.mjs';
+
+// Canonical Intent Graph schema constants + JSON Schema + diagnostic catalog. Node-free.
+export {
+  SCHEMA_VERSION, NODE_TYPES, RELATIONSHIP_TYPES, NODE_STATUSES,
+  intentGraphJsonSchema, DIAGNOSTIC_RULES, CORE_DIAGNOSTICS, ALL_DIAGNOSTICS,
+  RULE_PHASES, RULE_OWNERS, RULE_NAMESPACES, VERIFICATION_RULES, ruleNamespace,
+} from './intent-schema.mjs';
+
+// Canonical proof envelope schema (intent-proof-v1) , browser-safe so a signing service or
+// a cert renderer can validate the shared proof shape without a Node build.
+export {
+  PROOF_SCHEMA, CLAIM_STATUSES, PROOF_STATUSES, intentProofJsonSchema, validateProof,
+} from './proof-schema.mjs';
+
+// Human <-> Structured <-> ThunderLang sync (browser-safe) , Studio's proposeIntent/parseToStructured.
+export { parseToStructured, proposeIntent, SYNC_SCHEMA } from './sync.mjs';
+// Structural source editing (browser-safe) , comment-preserving field edits for Studio.
+export { applyEdits, PATCH_SCHEMA } from './patch.mjs';
+
+// Intent IR (intent-ir-v1) , the shared ecosystem semantic representation (browser-safe).
+export {
+  IR_SCHEMA, IR_EMBEDS, IR_NODE_TYPES, IR_RELATIONSHIP_TYPES, PROVENANCE, isFactualProvenance,
+  IR_CONFIDENCE, IR_CONFIDENCE_MEANING, confidenceFromClassification, SENSITIVITY, RETENTION,
+  NODE_FIELDS, validateIR, graphToIR,
+} from './intent-ir.mjs';
+
+// The Intent Runtime , executable intent (evaluate decisions, simulate lifecycles). Pure.
+export { evaluateDecision, simulateLifecycle, checkDecisionCases, RUNTIME_SCHEMA } from './runtime.mjs';
+// Runtime enforcement (browser-safe) , a guard that blocks forbidden actions + redacts secrets.
+export { buildGuard, compileGuard, guardSummary, GUARD_SCHEMA } from './guard.mjs';
+// Prompt -> intent (browser-safe) , scaffold a rigorous draft + gap checklist from a brief.
+export { draftIntent, DRAFT_SCHEMA } from './draft.mjs';
+export { compileExpr, evalExpr, ExprError } from './expr.mjs';
+
+// Style intent , canonical token address space + accessibility vocabulary (browser-safe).
+// Studio and renderers bind to these instead of forking their own design-token trees.
+export {
+  analyzeStyle, styleDiagnostics, toDesignTokens, toCss, STYLE_SCHEMA, DESIGN_TOKENS_SCHEMA,
+  TOKEN_PATHS, BRAND_PATHS, STYLE_ADDRESS_SPACE, ACCESSIBILITY_TARGETS, MODE_VALUES,
+  ACCESSIBILITY_CLASSIFICATION,
+} from './style.mjs';
+
+// ── The compiler proper (now universal: the pure SHA-256 removed the last node:crypto dep) ──
+// One source of truth for parsing, graph-building, analysis, and navigation, so OpenThunder
+// (Node), the CLI (Node), SkillsTech Studio (browser), Repo Mastery (web), and SkillsTech
+// Mobile (React Native) all run the SAME code, never a fork.
+
+// The canonical SHA-256 the ecosystem keys on (intentProofHash, join keys). Node-free.
+export { sha256, sha256hex } from './hash.mjs';
+// Parser: `.intent` source -> Intent AST (+ slug for stable ids, KNOWN_LENSES).
+export { parseIntent, slug, KNOWN_LENSES } from './parse.mjs';
+// IntentLift: code -> inferred candidate intent (in-process, keyless; OT seeds + orchestrates this).
+export { liftSource, liftAll, liftRepo, languageForFile, inferIntent, renderLiftedIntent, SUPPORTED_LANGUAGES, SEED_SCHEMA, normalizeSeeds } from './lift.mjs';
+// Intent Graph builder (intent-graph-v1): AST -> canonical graph.
+export { buildIntentGraph, INTENT_GRAPH_SCHEMA } from './intent-graph.mjs';
+// In-memory compile: AST/source -> every artifact (docs, graphs, plan, proof), no filesystem.
+export { compileSource, renderMarkdown, renderLensDoc, renderMermaid, renderTestplan } from './compile.mjs';
+// Semantic diagnostics (the Fable/scan spine input) , now Node-free.
+export { semanticDiagnostics, buildContractGraph, buildArchitectureGraph, buildImplementationPlan, buildProof } from './emit.mjs';
+// Intent Scanner + Fable: project -> Intent IR + explainable findings + risk themes.
+export { scanIntent, scanProject, SCAN_SCHEMA } from './scan.mjs';
+export { toFinding, universalPack, RISK_CATEGORIES, FABLE_SCHEMA } from './fable.mjs';
+// Focused scan queries (risks/gaps/unverified/coverage/unknowns/contradictions).
+export { VIEW_SCHEMA, VIEWS, coverageView, unverifiedView, gapsView, risksView, unknownsView, contradictionsView } from './scan-queries.mjs';
+// Intent Atlas (whole-system map) + navigation primitives.
+export { buildAtlas, atlasNode, expandNode, searchAtlas, ATLAS_SCHEMA } from './intent-atlas.mjs';
+// Intent Lens: Intent Scope + Focus Graph + Intent Brief (a focused subgraph of the Atlas).
+export { FOCUS_SCHEMA, SCOPE_TYPES, FOCUS_REASONS, makeScope, buildFocusGraph, intentBrief } from './focus.mjs';
+// Comprehension Contract: the C0..C7 understanding level (browser-safe; every product reads it).
+export { COMPREHENSION_SCHEMA, LEVELS as COMPREHENSION_LEVELS, comprehensionLevel, comprehensionReport } from './comprehension.mjs';
+// Code generation: deterministic scaffolds from intent (browser-safe, so the playground renders it).
+export { CODEGEN_SCHEMA, GENERATORS, toTypeScript, toCSharp, toJava } from './codegen.mjs';
+// Change Lens: what a branch/PR changed by meaning (pure; the CLI supplies the git-diffed graphs).
+export { CHANGES_SCHEMA, changeReport } from './changes.mjs';
+export { subjectName, intentRefId, skillRefId } from './parse.mjs';
+// 12-Factor Agents conformance lens (twelve-factor-v1): score an intent against the 13 principles.
+export { TWELVE_FACTOR_SCHEMA, twelveFactorReport, twelveFactorSummary } from './twelve-factor.mjs';
+// Semantic diff + 3-way merge (Change Lens: diff by meaning).
+export { diffGraphs, mergeGraphs } from './semantic-diff.mjs';
+// Graph -> source (native round-trip) so a browser editor can regenerate .intent.
+export { graphToSource, GRAPH_SOURCE_SCHEMA } from './graph-source.mjs';

package/src/data-schema.mjs

@@ -0,0 +1,137 @@
+// Data-shape export: turn a mission's typed input/output fields into a JSON Schema, and the
+// mission itself into an OpenAPI operation. This makes ThunderLang's typed data directly
+// consumable by API tooling (validators, codegen, mock servers) , the data-shape sibling of
+// the DMN/BPMN decision/lifecycle exporters. Deterministic and pure.
+
+// Known semantic types (with formats) and primitives, keyed lowercase. Module-level so the
+// security/type semantic pass (`isRecognizedType`) and the JSON-Schema mapping share ONE
+// source of truth , no drift between "what compiles" and "what the schema knows."
+const SEMANTIC = {
+  email: { type: 'string', format: 'email' },
+  url: { type: 'string', format: 'uri' },
+  uri: { type: 'string', format: 'uri' },
+  date: { type: 'string', format: 'date' },
+  datetime: { type: 'string', format: 'date-time' },
+  timestamp: { type: 'string', format: 'date-time' },
+  duration: { type: 'string', format: 'duration' },
+  uuid: { type: 'string', format: 'uuid' },
+  money: { type: 'number' },
+  currency: { type: 'string' },
+  percentage: { type: 'number', minimum: 0, maximum: 100 },
+  secret: { type: 'string', writeOnly: true },
+  token: { type: 'string' },
+  jwt: { type: 'string' },
+  password: { type: 'string', writeOnly: true },
+  version: { type: 'string' },
+  environmentname: { type: 'string' },
+  idempotencykey: { type: 'string' },
+};
+const PRIMITIVE = {
+  string: { type: 'string' }, text: { type: 'string' },
+  int: { type: 'integer' }, integer: { type: 'integer' }, number: { type: 'number' }, float: { type: 'number' }, decimal: { type: 'number' },
+  bool: { type: 'boolean' }, boolean: { type: 'boolean' },
+  object: { type: 'object' }, any: {},
+};
+
+export const SEMANTIC_TYPES = Object.keys(SEMANTIC);
+export const PRIMITIVE_TYPES = Object.keys(PRIMITIVE);
+
+/**
+ * Is `type` something the compiler recognizes , a known semantic type or primitive, an id
+ * type (`UserId`), a PascalCase entity (opaque object), or a List/Array of a recognized
+ * type? A lowercase word that is none of these is almost always a typo (`emial`, `moeny`).
+ */
+export function isRecognizedType(type) {
+  const t = String(type || '').trim();
+  if (!t) return true; // untyped field , not a type error here
+  const listMatch = t.match(/^(?:List|Array)<(.+)>$/i);
+  if (listMatch) return isRecognizedType(listMatch[1]);
+  const key = t.toLowerCase();
+  if (SEMANTIC[key] || PRIMITIVE[key]) return true;
+  if (/id$/i.test(t)) return true;      // UserId / AccountId ... -> string
+  if (/^[A-Z]/.test(t)) return true;    // PascalCase entity -> opaque object
+  return false;
+}
+
+// Map an ThunderLang semantic type to a JSON Schema fragment. Handles List<X> recursively,
+// known semantic types (with formats), primitives, and opaque custom (PascalCase) types.
+export function typeToJsonSchema(type) {
+  const t = String(type || '').trim();
+  const listMatch = t.match(/^List<(.+)>$/i) || t.match(/^Array<(.+)>$/i);
+  if (listMatch) return { type: 'array', items: typeToJsonSchema(listMatch[1]) };
+
+  const key = t.toLowerCase();
+  if (SEMANTIC[key]) return { ...SEMANTIC[key] };
+  if (PRIMITIVE[key]) return { ...PRIMITIVE[key] };
+  // Unknown PascalCase entity -> an opaque object carrying its name (title), so tooling can
+  // still reference it. Ids (UserId/AccountId/...) are strings.
+  if (/id$/i.test(t)) return { type: 'string', title: t };
+  return { type: 'object', title: t };
+}
+
+// Build an object schema from a list of typed fields. All declared fields are required by
+// default; a field carrying an `optional` modifier is omitted from `required`.
+function fieldsToSchema(fields, title) {
+  const properties = {};
+  const required = [];
+  for (const f of fields || []) {
+    if (!f.name) continue;
+    properties[f.name] = typeToJsonSchema(f.type);
+    if (!(f.modifiers || []).some((m) => /optional|nullable/i.test(m))) required.push(f.name);
+  }
+  const schema = { type: 'object', properties, additionalProperties: false };
+  if (required.length) schema.required = required;
+  if (title) schema.title = title;
+  return schema;
+}
+
+/**
+ * JSON Schema (draft 2020-12) for a mission's data shape. `which` selects 'input' (default),
+ * 'output', or 'both' (an object with input+output sub-schemas).
+ */
+export function toJSONSchema(ast, { which = 'input' } = {}) {
+  const base = { $schema: 'https://json-schema.org/draft/2020-12/schema', $id: `https://skillstech.dev/intent/${slugish(ast.mission)}.schema.json` };
+  if (which === 'output') return { ...base, ...fieldsToSchema(ast.outputs, `${ast.mission || 'Mission'} output`) };
+  if (which === 'both') {
+    return { ...base, title: `${ast.mission || 'Mission'}`, type: 'object', properties: { input: fieldsToSchema(ast.inputs, 'input'), output: fieldsToSchema(ast.outputs, 'output') } };
+  }
+  return { ...base, ...fieldsToSchema(ast.inputs, `${ast.mission || 'Mission'} input`) };
+}
+
+/**
+ * A minimal OpenAPI 3.1 document with the mission as one operation: the input schema is the
+ * request body, the output schema is the 200 response, and declared `errors` become named
+ * error responses. Path/method are taken from a declared `api` block when present, else
+ * defaulted (POST /<mission-slug>).
+ */
+export function toOpenAPI(ast) {
+  const api = (ast.apis || [])[0];
+  const method = (api && api.method ? String(api.method) : 'post').toLowerCase();
+  const path = api && api.path ? String(api.path) : `/${slugish(ast.mission)}`;
+  const opId = camelish(ast.mission || 'operation');
+
+  const responses = {
+    200: { description: 'Success', content: { 'application/json': { schema: fieldsToSchema(ast.outputs, `${ast.mission} output`) } } },
+  };
+  const ERR_STATUS = (name) => (/notfound|missing|unknown/i.test(name) ? '404' : /unauthor|forbidden|denied/i.test(name) ? '403' : /duplicate|conflict|exists/i.test(name) ? '409' : /invalid|bad/i.test(name) ? '400' : '422');
+  for (const e of ast.errors || []) {
+    const status = ERR_STATUS(e.name || '');
+    responses[status] = { description: e.name };
+  }
+
+  const operation = { operationId: opId, summary: ast.title || ast.mission || '', responses };
+  if (ast.goal || ast.problem) operation.description = ast.goal || ast.problem;
+  if ((ast.inputs || []).length) operation.requestBody = { required: true, content: { 'application/json': { schema: fieldsToSchema(ast.inputs, `${ast.mission} input`) } } };
+
+  return {
+    openapi: '3.1.0',
+    info: { title: ast.title || ast.mission || 'Intent API', version: '0.1.0' },
+    paths: { [path]: { [method]: operation } },
+  };
+}
+
+const slugish = (s) => String(s || 'mission').trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'mission';
+const camelish = (s) => {
+  const parts = String(s || 'operation').split(/[^A-Za-z0-9]+/).filter(Boolean);
+  return parts.map((p, i) => (i === 0 ? p[0].toLowerCase() + p.slice(1) : p[0].toUpperCase() + p.slice(1))).join('') || 'operation';
+};

package/src/decision.mjs

@@ -0,0 +1,38 @@
+// Decisions, rules, process semantics (Gap 4). IL owns rule semantics + DETERMINISTIC
+// conflict/coverage detection on the DECLARED decision. OpenThunder verifies the
+// decision's IMPLEMENTATION (rule coverage, decision impl verification, explanation
+// verification). Pure (no Node deps): browser-safe.
+
+const norm = (s) => String(s ?? '').trim().toLowerCase().replace(/\s+/g, ' ');
+
+/**
+ * Static analysis of a decision table. Returns findings (deterministic).
+ * - missing default (what happens when no rule matches?)
+ * - conflicting rules (same condition, different result)
+ * - redundant rules (same condition, same result)
+ * - no rules
+ */
+export function analyzeDecision(dec) {
+  const findings = [];
+  const rules = dec.rules || [];
+
+  if (rules.length === 0) {
+    findings.push({ code: 'IL-DEC-004', message: `Decision "${dec.name}" declares no rules.` });
+  } else if (dec.default == null) {
+    findings.push({ code: 'IL-DEC-001', message: `Decision "${dec.name}" has rules but no default (undefined when no rule matches).` });
+  }
+
+  // Pairwise: same normalized condition -> conflict (different result) or redundant (same).
+  for (let i = 0; i < rules.length; i++) {
+    for (let j = i + 1; j < rules.length; j++) {
+      if (rules[i].when && rules[j].when && norm(rules[i].when) === norm(rules[j].when)) {
+        if (norm(rules[i].result) !== norm(rules[j].result)) {
+          findings.push({ code: 'IL-DEC-002', message: `Decision "${dec.name}": rules "${rules[i].name}" and "${rules[j].name}" have the same condition but different results.` });
+        } else {
+          findings.push({ code: 'IL-DEC-003', message: `Decision "${dec.name}": rules "${rules[i].name}" and "${rules[j].name}" are redundant (same condition and result).` });
+        }
+      }
+    }
+  }
+  return findings.sort((a, b) => `${a.code} ${a.message}`.localeCompare(`${b.code} ${b.message}`));
+}

package/src/distributed.mjs

@@ -0,0 +1,48 @@
+// Distributed + failure semantics (Gap 3). IL owns the failure-policy types and the
+// STATIC declaration checks (a retry needs idempotency, at-least-once needs dedup, a
+// permanent-failure handler needs compensation). OpenThunder verifies these hold in the
+// IMPLEMENTATION (retry safety, duplicate handling, failure simulation). Pure; deterministic.
+
+const has = (arr, re) => (arr || []).some((x) => re.test(String(x)));
+
+/**
+ * Static analysis of distributed/failure declarations. Returns findings (deterministic).
+ * These are declaration-level guarantees; OT proves the implementation honors them.
+ */
+export function analyzeDistributed(ast) {
+  const findings = [];
+  const handlers = ast.handlers || [];
+
+  for (const c of ast.commands || []) {
+    // Retry without idempotency: a retried command that is not idempotent can duplicate work.
+    if (c.retry && !c.idempotencyKey) {
+      findings.push({ code: 'IL-DIST-001', target: c.name, message: `Command "${c.name}" declares retry but no idempotency_key.` });
+    }
+    // A retried / remote command with no timeout can hang forever.
+    if (c.retry && !c.timeout) {
+      findings.push({ code: 'IL-DIST-002', target: c.name, message: `Command "${c.name}" declares retry but no timeout.` });
+    }
+  }
+
+  for (const e of ast.events || []) {
+    // At-least-once delivery duplicates; there must be a duplicate handler for the event.
+    if (e.delivery && /at_least_once/i.test(e.delivery)) {
+      const dedup = handlers.some((h) => /duplicate/i.test(h.trigger || '') && new RegExp(e.name, 'i').test(h.trigger || ''));
+      if (!dedup) findings.push({ code: 'IL-DIST-003', target: e.name, message: `Event "${e.name}" is at_least_once but has no "on duplicate ${e.name}" handler.` });
+    }
+  }
+
+  for (const h of handlers) {
+    // A permanent-failure handler that does not compensate leaves partial state behind.
+    if (/permanent_failure|permanent failure/i.test(h.trigger || '') && (h.compensate || []).length === 0) {
+      findings.push({ code: 'IL-DIST-004', target: h.trigger, message: 'A permanent_failure handler declares no compensation.' });
+    }
+    // A duplicate handler that references an event that is not declared.
+    const m = /duplicate\s+(\w+)/i.exec(h.trigger || '');
+    if (m && !(ast.events || []).some((e) => e.name === m[1])) {
+      findings.push({ code: 'IL-DIST-005', target: h.trigger, message: `Duplicate handler references undeclared event "${m[1]}".` });
+    }
+  }
+
+  return findings.sort((a, b) => `${a.code} ${a.target}`.localeCompare(`${b.code} ${b.target}`));
+}

package/src/draft.mjs

@@ -0,0 +1,101 @@
+// Prompt -> intent, the deterministic half (intent-draft-v1). Authoring intent by hand is
+// friction most developers skip. This removes it: give a STRUCTURED brief (which an AI agent can
+// produce from a free-text request, then a human approves) and IL scaffolds a rigorous,
+// canonically-formatted intent draft AND a review checklist of exactly what is still missing ,
+// an unverified guarantee, an unguarded secret, a goal not stated. No AI here; the draft is a
+// proposal, never marked verified. Pure ESM + the formatter, so it is browser-safe.
+//
+//   draftIntent(brief) -> { schema, source, review, diagnostics }
+
+import { parseIntent } from './parse.mjs';
+import { semanticDiagnostics } from './emit.mjs';
+import { formatSource } from './format.mjs';
+
+export const DRAFT_SCHEMA = 'intent-draft-v1';
+
+const SECRET_TYPES = new Set(['secret', 'password', 'passwd', 'jwt', 'token', 'apikey', 'api_key', 'privatekey', 'private_key', 'credential', 'cvv']);
+const SECRET_NAME = /pass(word|wd)?|secret|token|jwt|ssn|api[-_]?key|apikey|credential|cvv|private[-_]?key|card/i;
+const isSecretField = (f) => f && (SECRET_TYPES.has(String(f.type || '').toLowerCase()) || SECRET_NAME.test(f.name || ''));
+
+function pascalish(text) {
+  const words = String(text || 'Mission').replace(/([a-z0-9])([A-Z])/g, '$1 $2').replace(/[^A-Za-z0-9]+/g, ' ').trim().split(/\s+/);
+  if (words.length === 1) return words[0].charAt(0).toUpperCase() + words[0].slice(1);
+  return words.map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join('');
+}
+
+// Accept a list of strings or { statement, because?, verify? } objects.
+const normRules = (list) => (Array.isArray(list) ? list : []).map((r) => (typeof r === 'string' ? { statement: r } : { ...r })).filter((r) => r.statement);
+
+/**
+ * Scaffold a rigorous intent draft from a structured brief.
+ * @param {object} brief { mission|name, goal, actor, problem, title, profiles, guarantees[],
+ *   neverRules[], inputs[], outputs[], decisions[] }
+ */
+export function draftIntent(brief = {}) {
+  const b = brief || {};
+  const L = [];
+  const review = [];
+  const flag = (kind, message) => review.push({ kind, message });
+
+  const name = pascalish(b.mission || b.name || 'Mission');
+  L.push(`mission ${name}`);
+  const profiles = Array.isArray(b.profiles) && b.profiles.length ? b.profiles : ['product'];
+  for (const p of profiles) L.push(`use ${p}`);
+  L.push('');
+
+  if (b.title) L.push(`title "${String(b.title).replace(/"/g, "'")}"`);
+  if (b.actor) L.push(`for ${b.actor}`);
+  if (b.problem) L.push(`problem "${String(b.problem).replace(/"/g, "'")}"`);
+  if (b.goal) { L.push('goal'); L.push(`  ${b.goal}`); L.push(''); }
+  else flag('missing-goal', 'No goal given , state the outcome this mission exists to achieve.');
+
+  const guarantees = normRules(b.guarantees);
+  for (const g of guarantees) {
+    L.push(`guarantee ${g.statement}`);
+    if (g.because) L.push(`  because ${g.because}`);
+    if (g.verify) L.push(`  verify ${g.verify}`);
+    else flag('guarantee-unverified', `Guarantee "${g.statement}" has no verification , add a test that proves it.`);
+  }
+  if (guarantees.length) L.push('');
+  if (!guarantees.length) flag('no-guarantees', 'No guarantees given , what must always hold?');
+
+  const nevers = normRules(b.neverRules || b.nevers);
+  for (const n of nevers) {
+    L.push(`never ${n.statement}`);
+    if (n.verify) L.push(`  verify ${n.verify}`);
+    else flag('never-unverified', `Never-rule "${n.statement}" has no verification.`);
+  }
+  if (nevers.length) L.push('');
+
+  const inputs = Array.isArray(b.inputs) ? b.inputs : [];
+  if (inputs.length) { L.push('input'); for (const f of inputs) L.push(`  ${f.name}: ${f.type || 'string'}`); L.push(''); }
+  const outputs = Array.isArray(b.outputs) ? b.outputs : [];
+  if (outputs.length) { L.push('output'); for (const f of outputs) L.push(`  ${f.name}: ${f.type || 'string'}`); L.push(''); }
+
+  for (const d of Array.isArray(b.decisions) ? b.decisions : []) {
+    if (!d || !d.name) continue;
+    L.push(`decision ${d.name}`);
+    if (Array.isArray(d.inputs) && d.inputs.length) { L.push('  inputs'); for (const i of d.inputs) L.push(`    ${typeof i === 'string' ? i : i.name}`); }
+    for (const r of Array.isArray(d.rules) ? d.rules : []) {
+      if (!r || !r.name) continue;
+      L.push(`  rule ${r.name}`);
+      if (r.when) L.push(`    when ${r.when}`);
+      if (r.return) L.push(`    return ${r.return}`);
+    }
+    if (d.default) { L.push('  default'); L.push(`    return ${d.default}`); }
+    else flag('decision-no-default', `Decision "${d.name}" has no default , what happens when no rule matches?`);
+    L.push('');
+  }
+
+  // Secret inputs with no never-rule covering them , the highest-value gap to surface.
+  const neverText = nevers.map((n) => n.statement.toLowerCase()).join(' ');
+  for (const f of inputs.filter(isSecretField)) {
+    if (!neverText.includes(String(f.name).toLowerCase()) && !/\b(log|expose|leak)\b/.test(neverText)) {
+      flag('secret-unguarded', `Input "${f.name}" is a secret , add a "never expose ${f.name} in logs" rule.`);
+    }
+  }
+
+  const source = formatSource(`${L.join('\n')}\n`);
+  const diagnostics = semanticDiagnostics(parseIntent(source));
+  return { schema: DRAFT_SCHEMA, source, review, diagnostics };
+}

package/src/drift.mjs

@@ -0,0 +1,177 @@
+// IntentLift round-trip: approve an inferred draft, then check whether the code
+// still matches the approved intent. Deterministic, no AI. This is the
+// compiler-side drift check; OpenThunder does the deeper repo-wide version later.
+//
+//   lift code -> .intent draft -> intent approve -> (code changes) -> intent drift
+
+import { createHash } from 'node:crypto';
+import { parseIntent, slug } from './parse.mjs';
+import { liftSource } from './lift.mjs';
+import { COMPILER_VERSION } from './emit.mjs';
+
+const sha256 = (s) => 'sha256:' + createHash('sha256').update(s).digest('hex');
+
+// Remove a top-level block (header + indented body + one trailing blank).
+function stripBlock(text, keyword) {
+  const lines = text.split('\n');
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    const l = lines[i];
+    if (!/^\s/.test(l) && (l.trim() === keyword || l.startsWith(keyword + ' '))) {
+      i++;
+      while (i < lines.length && /^\s+\S/.test(lines[i])) i++;
+      if (i < lines.length && lines[i].trim() === '') i++;
+      continue;
+    }
+    out.push(l);
+    i++;
+  }
+  return out.join('\n');
+}
+
+/** Hash of the intent content, excluding the approval block, so it is stable. */
+export function intentHash(intentText) {
+  return sha256(stripBlock(intentText, 'approval').trim());
+}
+
+/**
+ * Approve an intent: flip `reviewed` to true, add an `approval` block with the
+ * source hash (of the intent content), reviewer, and time. `approvedAt` is
+ * passed in (never Date.now here) so approval is reproducible in tests.
+ */
+export function approveIntent(intentText, { approvedBy, approvedAt } = {}) {
+  const base = stripBlock(intentText, 'approval')
+    .replace(/^(\s*)reviewed\s+false\b/m, '$1reviewed true')
+    .replace(/\s+$/, '');
+  // Hash the exact content that gets written (post reviewed-flip), so a later
+  // `intent drift` recomputes the same hash when nothing has changed.
+  const hash = sha256(base.trim());
+  const lines = ['approval', '  reviewed true'];
+  if (approvedBy) lines.push(`  approved_by ${approvedBy}`);
+  if (approvedAt) lines.push(`  approved_at ${approvedAt}`);
+  lines.push(`  source_hash ${hash}`);
+  lines.push(`  approved_with SkillsTech Compiler ${COMPILER_VERSION}`);
+  return {
+    text: `${base}\n\n${lines.join('\n')}\n`,
+    approval: { reviewed: true, approvedBy, approvedAt, source_hash: hash },
+  };
+}
+
+/**
+ * Emit the drift handoff pack that OpenThunder consumes. The compiler states the
+ * expectations (what must be true) and the checks OpenThunder should run against
+ * REAL repo evidence (tests executed, routes present, logs/events scanned).
+ * The compiler does not perform repo-wide verification; OpenThunder does, and it
+ * emits `intent-drift-report-v1` in return.
+ */
+export function buildDriftHandoff(approvedIntentText, { generatedAt = null } = {}) {
+  const ast = parseIntent(approvedIntentText);
+  const expectations = [
+    ...ast.guarantees.map((g) => ({
+      kind: 'guarantee', id: g.id, statement: g.statement,
+      expectedEvidence: g.verify, check: 'guarantee_has_passing_evidence',
+    })),
+    ...ast.neverRules.map((n) => ({
+      kind: 'never', id: n.id, statement: n.statement,
+      expectedEvidence: n.verify, check: 'never_rule_not_violated',
+    })),
+    ...ast.inputs.map((f) => ({
+      kind: 'input', name: f.name, type: f.type || 'Unknown',
+      check: 'input_present_in_signature',
+    })),
+    ...(ast.apis || []).map((a) => ({
+      kind: 'api', id: a.id, method: a.method, path: a.path,
+      check: 'route_present',
+    })),
+  ];
+  return {
+    schemaVersion: '0.1.0',
+    kind: 'il-to-ot-drift-v1',
+    generatedBy: `SkillsTech Compiler ${COMPILER_VERSION}`,
+    generatedAt,
+    mission: ast.mission || 'mission',
+    approved: !!(ast.approval && ast.approval.reviewed),
+    approval: ast.approval
+      ? {
+          reviewed: !!ast.approval.reviewed,
+          approvedBy: ast.approval.approved_by || null,
+          approvedAt: ast.approval.approved_at || null,
+          sourceHash: ast.approval.source_hash || null,
+        }
+      : null,
+    mapsTo: (ast.lift && ast.lift.maps_to) || [],
+    expectations,
+    handoff:
+      'OpenThunder verifies these expectations against real repo evidence and emits intent-drift-report-v1. The compiler does not perform repo-wide verification.',
+  };
+}
+
+function verdict(findings) {
+  const blocking = findings.filter(
+    (f) => f.level === 'warning' && /UNSUPPORTED|INPUT_REMOVED|STALE/.test(f.code),
+  ).length;
+  const status = blocking > 0
+    ? 'drift'
+    : findings.some((f) => f.code === 'INTENT_DRIFT_NEW_BEHAVIOR')
+      ? 'review'
+      : 'in_sync';
+  return {
+    status,
+    findings,
+    summary: { status, findings: findings.length, blocking },
+  };
+}
+
+/**
+ * Check whether `codeSource` still satisfies the approved `intentText`. Re-lifts
+ * the code and compares guarantees, never rules, and inputs by normalized slug.
+ */
+export function checkDrift(intentText, codeSource, { language = 'typescript' } = {}) {
+  const ast = parseIntent(intentText);
+  const findings = [];
+  const add = (level, code, message) => findings.push({ level, code, message });
+
+  if (ast.approval?.source_hash) {
+    if (intentHash(intentText) !== ast.approval.source_hash) {
+      add('warning', 'INTENT_DRIFT_STALE_PROOF', 'The approved intent was edited after approval (hash mismatch). Re-approve it.');
+    }
+  } else {
+    add('info', 'INTENT_DRIFT_NOT_APPROVED', 'This intent has no approval block. Approve it first: intent approve <file>.');
+  }
+
+  const lift = liftSource(codeSource, { language });
+  if (!lift.ok) {
+    add('warning', 'INTENT_DRIFT_NO_CODE_EVIDENCE', lift.error || 'Could not analyze the implementation.');
+    return verdict(findings);
+  }
+  const li = lift.lifted;
+  const norm = (s) => slug(s);
+  const codeGuar = new Set(li.guarantees.map((g) => norm(g.statement)));
+  const codeNever = new Set(li.neverRules.map((n) => norm(n.statement)));
+  const codeInputs = new Set(li.inputs.map((i) => norm(i.name)));
+  const intentGuar = new Set(ast.guarantees.map((g) => norm(g.statement)));
+
+  for (const g of ast.guarantees) {
+    if (!codeGuar.has(norm(g.statement))) {
+      add('warning', 'INTENT_DRIFT_GUARANTEE_UNSUPPORTED', `Guarantee "${g.statement}" has no matching evidence in the code (test removed or renamed?).`);
+    }
+  }
+  for (const n of ast.neverRules) {
+    if (!codeNever.has(norm(n.statement))) {
+      add('warning', 'INTENT_DRIFT_NEVER_RULE_UNSUPPORTED', `Never rule "${n.statement}" has no matching error or guard in the code.`);
+    }
+  }
+  for (const f of ast.inputs) {
+    if (!codeInputs.has(norm(f.name))) {
+      add('warning', 'INTENT_DRIFT_INPUT_REMOVED', `Input "${f.name}" is declared in the intent but not found in the code signature.`);
+    }
+  }
+  for (const g of li.guarantees) {
+    if (!intentGuar.has(norm(g.statement))) {
+      add('info', 'INTENT_DRIFT_NEW_BEHAVIOR', `The code has behavior "${g.statement}" that the approved intent does not declare.`);
+    }
+  }
+
+  return verdict(findings);
+}