blun-king-cli 9.1.564 → 9.1.566

package/standard-skills/translate-native/scripts/language_quality.py

@@ -1,377 +1,377 @@
-#!/usr/bin/env python3
-"""Language identity, bidi, glossary, and signed release-receipt primitives."""
-
-from __future__ import annotations
-
-import base64
-import contextlib
-import hashlib
-import hmac
-import json
-import os
-import re
-import stat
-import time
-import unicodedata
-from pathlib import Path
-from typing import Any
-
-
-VERSION = "6.20.0"
-MAX_SIGNING_KEY_BYTES = 64 * 1024
-DANGEROUS_BIDI = {"\u202a", "\u202b", "\u202c", "\u202d", "\u202e"}
-ISOLATE_OPENERS = {"\u2066", "\u2067", "\u2068"}
-ISOLATE_CLOSER = "\u2069"
-SCRIPT_RANGES = {
-    "Cyrl": ((0x0400, 0x052F),),
-    "Grek": ((0x0370, 0x03FF),),
-    "Arab": ((0x0600, 0x06FF), (0x0750, 0x077F), (0x08A0, 0x08FF)),
-    "Hebr": ((0x0590, 0x05FF),),
-    "Hang": ((0xAC00, 0xD7AF),),
-    "Hani": ((0x3400, 0x4DBF), (0x4E00, 0x9FFF)),
-    "Jpan": ((0x3040, 0x30FF), (0x3400, 0x9FFF)),
-    "Latn": ((0x0041, 0x007A), (0x00C0, 0x024F)),
-}
-LANGUAGE_SCRIPTS = {
-    "ar": "Arab", "fa": "Arab", "ur": "Arab", "he": "Hebr",
-    "el": "Grek", "ru": "Cyrl", "uk": "Cyrl", "bg": "Cyrl",
-    "mk": "Cyrl", "ko": "Hang", "ja": "Jpan", "zh": "Hani",
-}
-
-
-def canonical_text(text: str) -> str:
-    """Normalize transport-only differences without hiding character corruption."""
-    return unicodedata.normalize("NFC", text.removeprefix("\ufeff").replace("\r\n", "\n").replace("\r", "\n"))
-
-
-def canonical_hash(text: str) -> str:
-    return hashlib.sha256(canonical_text(text).encode("utf-8")).hexdigest()
-
-
-def _b64encode(data: bytes) -> str:
-    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
-
-
-def _b64decode(data: str) -> bytes:
-    return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))
-
-
-def _validate_signing_key_stat(details: os.stat_result) -> None:
-    if not stat.S_ISREG(details.st_mode) or stat.S_ISLNK(details.st_mode):
-        raise ValueError("signing key must be a regular file")
-    if details.st_nlink != 1:
-        raise ValueError("signing key must have exactly one hard link")
-    if details.st_size < 32 or details.st_size > MAX_SIGNING_KEY_BYTES:
-        raise ValueError("signing key has an invalid size")
-    if os.name != "nt" and stat.S_IMODE(details.st_mode) & 0o077:
-        raise ValueError("signing key permissions must be owner-only")
-    if hasattr(os, "getuid") and details.st_uid != os.getuid():
-        raise ValueError("signing key has the wrong owner")
-
-
-def _signing_key_identity(details: os.stat_result) -> tuple[int, int, int, int, int, int]:
-    return (
-        details.st_dev,
-        details.st_ino,
-        details.st_nlink,
-        details.st_size,
-        details.st_ctime_ns,
-        details.st_mtime_ns,
-    )
-
-
-def _signing_key_directory_identity(
-    details: os.stat_result,
-) -> tuple[int, int, int, int, int]:
-    return (
-        details.st_dev,
-        details.st_ino,
-        details.st_mode,
-        details.st_uid,
-        details.st_gid,
-    )
-
-
-def _validate_signing_key_directory(path: Path, details: os.stat_result) -> None:
-    if not stat.S_ISDIR(details.st_mode) or stat.S_ISLNK(details.st_mode):
-        raise ValueError(f"signing-key directory is not a directory: {path}")
-    if stat.S_IMODE(details.st_mode) & 0o022:
-        raise ValueError(f"signing-key directory is writable outside its owner: {path}")
-    if hasattr(os, "getuid") and details.st_uid != os.getuid():
-        raise ValueError(f"signing-key directory has the wrong owner: {path}")
-
-
-def _assert_signing_key_directory_unchanged(
-    path: Path, expected: tuple[int, int, int, int, int],
-) -> None:
-    try:
-        current = path.lstat()
-    except OSError as error:
-        raise ValueError(f"signing-key directory cannot be rechecked: {path}") from error
-    _validate_signing_key_directory(path, current)
-    if _signing_key_directory_identity(current) != expected:
-        raise ValueError(f"signing-key directory changed during operation: {path}")
-
-
-def _existing_signing_key_directory_anchor(path: Path) -> Path:
-    candidate = path
-    while True:
-        try:
-            candidate.lstat()
-            return candidate
-        except FileNotFoundError:
-            parent = candidate.parent
-            if parent == candidate:
-                raise ValueError(f"signing-key directory has no existing anchor: {path}")
-            candidate = parent
-
-
-@contextlib.contextmanager
-def _open_signing_key_directory(path: Path, *, create: bool):
-    if os.name == "nt":
-        if create:
-            path.parent.mkdir(parents=True, exist_ok=True)
-        yield None
-        return
-    anchor = Path.home()
-    try:
-        relative = path.parent.relative_to(anchor)
-    except ValueError:
-        anchor = _existing_signing_key_directory_anchor(path.parent)
-        relative = path.parent.relative_to(anchor)
-    flags = (
-        os.O_RDONLY
-        | getattr(os, "O_BINARY", 0)
-        | getattr(os, "O_DIRECTORY", 0)
-        | getattr(os, "O_NOFOLLOW", 0)
-    )
-    descriptor = None
-    current_path = anchor
-    try:
-        try:
-            descriptor = os.open(anchor, flags)
-            _validate_signing_key_directory(
-                anchor, os.fstat(descriptor),
-            )
-            for component in relative.parts:
-                current_path = current_path / component
-                try:
-                    child = os.open(component, flags, dir_fd=descriptor)
-                except FileNotFoundError:
-                    if not create:
-                        raise
-                    try:
-                        os.mkdir(component, mode=0o700, dir_fd=descriptor)
-                    except FileExistsError:
-                        pass
-                    child = os.open(component, flags, dir_fd=descriptor)
-                try:
-                    _validate_signing_key_directory(
-                        current_path, os.fstat(child),
-                    )
-                except Exception:
-                    os.close(child)
-                    raise
-                os.close(descriptor)
-                descriptor = child
-            expected = _signing_key_directory_identity(
-                os.fstat(descriptor),
-            )
-        except ValueError:
-            raise
-        except FileNotFoundError:
-            raise
-        except OSError as error:
-            raise ValueError(
-                f"cannot safely open signing-key directory: {current_path}"
-            ) from error
-        try:
-            yield descriptor
-        finally:
-            _assert_signing_key_directory_unchanged(path.parent, expected)
-    finally:
-        if descriptor is not None:
-            os.close(descriptor)
-
-
-def _signing_key_lstat(path: Path, directory: int | None) -> os.stat_result:
-    if directory is None:
-        return os.lstat(path)
-    return os.stat(path.name, dir_fd=directory, follow_symlinks=False)
-
-
-def _open_signing_key_file(
-    path: Path, directory: int | None, flags: int, mode: int = 0o600,
-) -> int:
-    if directory is None:
-        return os.open(path, flags, mode)
-    return os.open(path.name, flags, mode, dir_fd=directory)
-
-
-def _signing_key_fstat(descriptor: int) -> os.stat_result:
-    return os.fstat(descriptor)
-
-
-def _load_existing_key_at(path: Path, directory: int | None) -> bytes:
-    before = _signing_key_lstat(path, directory)
-    _validate_signing_key_stat(before)
-    descriptor = _open_signing_key_file(
-        path,
-        directory,
-        os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0),
-    )
-    try:
-        opened = _signing_key_fstat(descriptor)
-        _validate_signing_key_stat(opened)
-        if _signing_key_identity(opened) != _signing_key_identity(before):
-            raise ValueError("signing key changed while opening")
-        with os.fdopen(descriptor, "rb", closefd=False) as handle:
-            key = handle.read(MAX_SIGNING_KEY_BYTES + 1)
-        after = _signing_key_fstat(descriptor)
-        if _signing_key_identity(after) != _signing_key_identity(opened):
-            raise ValueError("signing key changed while reading")
-    finally:
-        os.close(descriptor)
-    if len(key) < 32 or len(key) > MAX_SIGNING_KEY_BYTES:
-        raise ValueError("signing key has an invalid size")
-    return key
-
-
-def load_existing_key(path: Path) -> bytes:
-    with _open_signing_key_directory(path, create=False) as directory:
-        return _load_existing_key_at(path, directory)
-
-
-def load_or_create_key(path: Path) -> bytes:
-    env_key = os.environ.get("BLUN_LANGUAGE_GUARD_KEY")
-    if env_key:
-        return hashlib.sha256(env_key.encode("utf-8")).digest()
-    with _open_signing_key_directory(path, create=True) as directory:
-        try:
-            return _load_existing_key_at(path, directory)
-        except FileNotFoundError:
-            pass
-        key = os.urandom(32)
-        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
-        try:
-            descriptor = _open_signing_key_file(path, directory, flags)
-        except FileExistsError:
-            return _load_existing_key_at(path, directory)
-        try:
-            with os.fdopen(descriptor, "wb", closefd=False) as handle:
-                handle.write(key)
-                handle.flush()
-                os.fsync(descriptor)
-            opened = _signing_key_fstat(descriptor)
-            _validate_signing_key_stat(opened)
-            installed = _signing_key_lstat(path, directory)
-            _validate_signing_key_stat(installed)
-            if _signing_key_identity(installed) != _signing_key_identity(opened):
-                raise ValueError("signing key changed while creating")
-        finally:
-            os.close(descriptor)
-        return key
-
-
-def issue_receipt(
-    source: str, target: str, language: str, key: bytes, ttl: int = 86400,
-    content_type: str = "prose", short_text_reviewed: bool = False,
-    purpose: str = "translation",
-) -> str:
-    now = int(time.time())
-    payload = {
-        "v": VERSION,
-        "source_sha256": canonical_hash(source),
-        "target_sha256": canonical_hash(target),
-        "language": language,
-        "purpose": purpose,
-        "content_type": content_type,
-        "short_text_reviewed": short_text_reviewed,
-        "iat": now,
-        "exp": now + max(60, min(ttl, 604800)),
-        "nonce": _b64encode(os.urandom(12)),
-    }
-    encoded = _b64encode(json.dumps(payload, sort_keys=True, separators=(",", ":")).encode())
-    signature = _b64encode(hmac.new(key, encoded.encode(), hashlib.sha256).digest())
-    return f"blg6.{encoded}.{signature}"
-
-
-def verify_receipt(
-    token: str, source: str, target: str, language: str, key: bytes,
-    content_type: str = "prose", short_text_reviewed: bool = False,
-    purpose: str = "translation",
-) -> dict[str, Any]:
-    try:
-        prefix, encoded, signature = token.split(".")
-        expected = _b64encode(hmac.new(key, encoded.encode(), hashlib.sha256).digest())
-        if prefix != "blg6" or not hmac.compare_digest(signature, expected):
-            raise ValueError("invalid signature")
-        payload = json.loads(_b64decode(encoded))
-        checks = {
-            "source": payload.get("source_sha256") == canonical_hash(source),
-            "target": payload.get("target_sha256") == canonical_hash(target),
-            "language": payload.get("language") == language,
-            "purpose": payload.get("purpose") == purpose,
-            "content_type": payload.get("content_type") == content_type,
-            "short_text_reviewed": payload.get("short_text_reviewed") is short_text_reviewed,
-            "version": payload.get("v") == VERSION,
-            "not_expired": int(payload.get("exp", 0)) >= int(time.time()),
-        }
-        return {"valid": all(checks.values()), "checks": checks, "payload": payload}
-    except (ValueError, TypeError, KeyError, json.JSONDecodeError, UnicodeDecodeError) as error:
-        return {"valid": False, "error": str(error)}
-
-
-def bidi_findings(text: str) -> list[dict[str, str]]:
-    findings: list[dict[str, str]] = []
-    stack = 0
-    for character in text:
-        if character in DANGEROUS_BIDI:
-            findings.append({"code": "dangerous-bidi-control", "character": f"U+{ord(character):04X}"})
-        elif character in ISOLATE_OPENERS:
-            stack += 1
-        elif character == ISOLATE_CLOSER:
-            if stack == 0:
-                findings.append({"code": "unpaired-bidi-isolate", "character": "U+2069"})
-            else:
-                stack -= 1
-    if stack:
-        findings.append({"code": "unclosed-bidi-isolate", "count": str(stack)})
-    return findings
-
-
-def _in_script(character: str, script: str) -> bool:
-    point = ord(character)
-    return any(start <= point <= end for start, end in SCRIPT_RANGES.get(script, ()))
-
-
-def script_report(text: str, language: str) -> dict[str, Any]:
-    parts = language.replace("_", "-").split("-")
-    base = parts[0].casefold()
-    explicit = next((part.title() for part in parts[1:] if len(part) == 4), None)
-    expected = explicit or LANGUAGE_SCRIPTS.get(base)
-    if not expected:
-        return {"status": "not-evaluated", "reason": "no deterministic script expectation"}
-    letters = [c for c in text if unicodedata.category(c).startswith("L")]
-    if not letters:
-        return {"status": "fail", "expected_script": expected, "ratio": 0.0}
-    matching = sum(_in_script(c, expected) for c in letters)
-    ratio = matching / len(letters)
-    threshold = 0.45 if expected in {"Hani", "Jpan"} else 0.70
-    return {"status": "pass" if ratio >= threshold else "fail", "expected_script": expected, "ratio": round(ratio, 3)}
-
-
-def glossary_findings(target: str, glossary: dict[str, Any]) -> list[dict[str, str]]:
-    findings: list[dict[str, str]] = []
-    for source_term, rule in glossary.items():
-        if isinstance(rule, str):
-            pattern, flags = re.escape(rule), re.IGNORECASE
-        elif isinstance(rule, dict):
-            value = str(rule.get("target", ""))
-            pattern = value if rule.get("regex") else re.escape(value)
-            flags = 0 if rule.get("case_sensitive") else re.IGNORECASE
-        else:
-            continue
-        if pattern and not re.search(pattern, target, flags):
-            findings.append({"code": "missing-glossary-term", "source": source_term, "expected": pattern})
-    return findings
+#!/usr/bin/env python3
+"""Language identity, bidi, glossary, and signed release-receipt primitives."""
+
+from __future__ import annotations
+
+import base64
+import contextlib
+import hashlib
+import hmac
+import json
+import os
+import re
+import stat
+import time
+import unicodedata
+from pathlib import Path
+from typing import Any
+
+
+VERSION = "6.20.0"
+MAX_SIGNING_KEY_BYTES = 64 * 1024
+DANGEROUS_BIDI = {"\u202a", "\u202b", "\u202c", "\u202d", "\u202e"}
+ISOLATE_OPENERS = {"\u2066", "\u2067", "\u2068"}
+ISOLATE_CLOSER = "\u2069"
+SCRIPT_RANGES = {
+    "Cyrl": ((0x0400, 0x052F),),
+    "Grek": ((0x0370, 0x03FF),),
+    "Arab": ((0x0600, 0x06FF), (0x0750, 0x077F), (0x08A0, 0x08FF)),
+    "Hebr": ((0x0590, 0x05FF),),
+    "Hang": ((0xAC00, 0xD7AF),),
+    "Hani": ((0x3400, 0x4DBF), (0x4E00, 0x9FFF)),
+    "Jpan": ((0x3040, 0x30FF), (0x3400, 0x9FFF)),
+    "Latn": ((0x0041, 0x007A), (0x00C0, 0x024F)),
+}
+LANGUAGE_SCRIPTS = {
+    "ar": "Arab", "fa": "Arab", "ur": "Arab", "he": "Hebr",
+    "el": "Grek", "ru": "Cyrl", "uk": "Cyrl", "bg": "Cyrl",
+    "mk": "Cyrl", "ko": "Hang", "ja": "Jpan", "zh": "Hani",
+}
+
+
+def canonical_text(text: str) -> str:
+    """Normalize transport-only differences without hiding character corruption."""
+    return unicodedata.normalize("NFC", text.removeprefix("\ufeff").replace("\r\n", "\n").replace("\r", "\n"))
+
+
+def canonical_hash(text: str) -> str:
+    return hashlib.sha256(canonical_text(text).encode("utf-8")).hexdigest()
+
+
+def _b64encode(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _b64decode(data: str) -> bytes:
+    return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))
+
+
+def _validate_signing_key_stat(details: os.stat_result) -> None:
+    if not stat.S_ISREG(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise ValueError("signing key must be a regular file")
+    if details.st_nlink != 1:
+        raise ValueError("signing key must have exactly one hard link")
+    if details.st_size < 32 or details.st_size > MAX_SIGNING_KEY_BYTES:
+        raise ValueError("signing key has an invalid size")
+    if os.name != "nt" and stat.S_IMODE(details.st_mode) & 0o077:
+        raise ValueError("signing key permissions must be owner-only")
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise ValueError("signing key has the wrong owner")
+
+
+def _signing_key_identity(details: os.stat_result) -> tuple[int, int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_nlink,
+        details.st_size,
+        details.st_ctime_ns,
+        details.st_mtime_ns,
+    )
+
+
+def _signing_key_directory_identity(
+    details: os.stat_result,
+) -> tuple[int, int, int, int, int]:
+    return (
+        details.st_dev,
+        details.st_ino,
+        details.st_mode,
+        details.st_uid,
+        details.st_gid,
+    )
+
+
+def _validate_signing_key_directory(path: Path, details: os.stat_result) -> None:
+    if not stat.S_ISDIR(details.st_mode) or stat.S_ISLNK(details.st_mode):
+        raise ValueError(f"signing-key directory is not a directory: {path}")
+    if stat.S_IMODE(details.st_mode) & 0o022:
+        raise ValueError(f"signing-key directory is writable outside its owner: {path}")
+    if hasattr(os, "getuid") and details.st_uid != os.getuid():
+        raise ValueError(f"signing-key directory has the wrong owner: {path}")
+
+
+def _assert_signing_key_directory_unchanged(
+    path: Path, expected: tuple[int, int, int, int, int],
+) -> None:
+    try:
+        current = path.lstat()
+    except OSError as error:
+        raise ValueError(f"signing-key directory cannot be rechecked: {path}") from error
+    _validate_signing_key_directory(path, current)
+    if _signing_key_directory_identity(current) != expected:
+        raise ValueError(f"signing-key directory changed during operation: {path}")
+
+
+def _existing_signing_key_directory_anchor(path: Path) -> Path:
+    candidate = path
+    while True:
+        try:
+            candidate.lstat()
+            return candidate
+        except FileNotFoundError:
+            parent = candidate.parent
+            if parent == candidate:
+                raise ValueError(f"signing-key directory has no existing anchor: {path}")
+            candidate = parent
+
+
+@contextlib.contextmanager
+def _open_signing_key_directory(path: Path, *, create: bool):
+    if os.name == "nt":
+        if create:
+            path.parent.mkdir(parents=True, exist_ok=True)
+        yield None
+        return
+    anchor = Path.home()
+    try:
+        relative = path.parent.relative_to(anchor)
+    except ValueError:
+        anchor = _existing_signing_key_directory_anchor(path.parent)
+        relative = path.parent.relative_to(anchor)
+    flags = (
+        os.O_RDONLY
+        | getattr(os, "O_BINARY", 0)
+        | getattr(os, "O_DIRECTORY", 0)
+        | getattr(os, "O_NOFOLLOW", 0)
+    )
+    descriptor = None
+    current_path = anchor
+    try:
+        try:
+            descriptor = os.open(anchor, flags)
+            _validate_signing_key_directory(
+                anchor, os.fstat(descriptor),
+            )
+            for component in relative.parts:
+                current_path = current_path / component
+                try:
+                    child = os.open(component, flags, dir_fd=descriptor)
+                except FileNotFoundError:
+                    if not create:
+                        raise
+                    try:
+                        os.mkdir(component, mode=0o700, dir_fd=descriptor)
+                    except FileExistsError:
+                        pass
+                    child = os.open(component, flags, dir_fd=descriptor)
+                try:
+                    _validate_signing_key_directory(
+                        current_path, os.fstat(child),
+                    )
+                except Exception:
+                    os.close(child)
+                    raise
+                os.close(descriptor)
+                descriptor = child
+            expected = _signing_key_directory_identity(
+                os.fstat(descriptor),
+            )
+        except ValueError:
+            raise
+        except FileNotFoundError:
+            raise
+        except OSError as error:
+            raise ValueError(
+                f"cannot safely open signing-key directory: {current_path}"
+            ) from error
+        try:
+            yield descriptor
+        finally:
+            _assert_signing_key_directory_unchanged(path.parent, expected)
+    finally:
+        if descriptor is not None:
+            os.close(descriptor)
+
+
+def _signing_key_lstat(path: Path, directory: int | None) -> os.stat_result:
+    if directory is None:
+        return os.lstat(path)
+    return os.stat(path.name, dir_fd=directory, follow_symlinks=False)
+
+
+def _open_signing_key_file(
+    path: Path, directory: int | None, flags: int, mode: int = 0o600,
+) -> int:
+    if directory is None:
+        return os.open(path, flags, mode)
+    return os.open(path.name, flags, mode, dir_fd=directory)
+
+
+def _signing_key_fstat(descriptor: int) -> os.stat_result:
+    return os.fstat(descriptor)
+
+
+def _load_existing_key_at(path: Path, directory: int | None) -> bytes:
+    before = _signing_key_lstat(path, directory)
+    _validate_signing_key_stat(before)
+    descriptor = _open_signing_key_file(
+        path,
+        directory,
+        os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0),
+    )
+    try:
+        opened = _signing_key_fstat(descriptor)
+        _validate_signing_key_stat(opened)
+        if _signing_key_identity(opened) != _signing_key_identity(before):
+            raise ValueError("signing key changed while opening")
+        with os.fdopen(descriptor, "rb", closefd=False) as handle:
+            key = handle.read(MAX_SIGNING_KEY_BYTES + 1)
+        after = _signing_key_fstat(descriptor)
+        if _signing_key_identity(after) != _signing_key_identity(opened):
+            raise ValueError("signing key changed while reading")
+    finally:
+        os.close(descriptor)
+    if len(key) < 32 or len(key) > MAX_SIGNING_KEY_BYTES:
+        raise ValueError("signing key has an invalid size")
+    return key
+
+
+def load_existing_key(path: Path) -> bytes:
+    with _open_signing_key_directory(path, create=False) as directory:
+        return _load_existing_key_at(path, directory)
+
+
+def load_or_create_key(path: Path) -> bytes:
+    env_key = os.environ.get("BLUN_LANGUAGE_GUARD_KEY")
+    if env_key:
+        return hashlib.sha256(env_key.encode("utf-8")).digest()
+    with _open_signing_key_directory(path, create=True) as directory:
+        try:
+            return _load_existing_key_at(path, directory)
+        except FileNotFoundError:
+            pass
+        key = os.urandom(32)
+        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+        try:
+            descriptor = _open_signing_key_file(path, directory, flags)
+        except FileExistsError:
+            return _load_existing_key_at(path, directory)
+        try:
+            with os.fdopen(descriptor, "wb", closefd=False) as handle:
+                handle.write(key)
+                handle.flush()
+                os.fsync(descriptor)
+            opened = _signing_key_fstat(descriptor)
+            _validate_signing_key_stat(opened)
+            installed = _signing_key_lstat(path, directory)
+            _validate_signing_key_stat(installed)
+            if _signing_key_identity(installed) != _signing_key_identity(opened):
+                raise ValueError("signing key changed while creating")
+        finally:
+            os.close(descriptor)
+        return key
+
+
+def issue_receipt(
+    source: str, target: str, language: str, key: bytes, ttl: int = 86400,
+    content_type: str = "prose", short_text_reviewed: bool = False,
+    purpose: str = "translation",
+) -> str:
+    now = int(time.time())
+    payload = {
+        "v": VERSION,
+        "source_sha256": canonical_hash(source),
+        "target_sha256": canonical_hash(target),
+        "language": language,
+        "purpose": purpose,
+        "content_type": content_type,
+        "short_text_reviewed": short_text_reviewed,
+        "iat": now,
+        "exp": now + max(60, min(ttl, 604800)),
+        "nonce": _b64encode(os.urandom(12)),
+    }
+    encoded = _b64encode(json.dumps(payload, sort_keys=True, separators=(",", ":")).encode())
+    signature = _b64encode(hmac.new(key, encoded.encode(), hashlib.sha256).digest())
+    return f"blg6.{encoded}.{signature}"
+
+
+def verify_receipt(
+    token: str, source: str, target: str, language: str, key: bytes,
+    content_type: str = "prose", short_text_reviewed: bool = False,
+    purpose: str = "translation",
+) -> dict[str, Any]:
+    try:
+        prefix, encoded, signature = token.split(".")
+        expected = _b64encode(hmac.new(key, encoded.encode(), hashlib.sha256).digest())
+        if prefix != "blg6" or not hmac.compare_digest(signature, expected):
+            raise ValueError("invalid signature")
+        payload = json.loads(_b64decode(encoded))
+        checks = {
+            "source": payload.get("source_sha256") == canonical_hash(source),
+            "target": payload.get("target_sha256") == canonical_hash(target),
+            "language": payload.get("language") == language,
+            "purpose": payload.get("purpose") == purpose,
+            "content_type": payload.get("content_type") == content_type,
+            "short_text_reviewed": payload.get("short_text_reviewed") is short_text_reviewed,
+            "version": payload.get("v") == VERSION,
+            "not_expired": int(payload.get("exp", 0)) >= int(time.time()),
+        }
+        return {"valid": all(checks.values()), "checks": checks, "payload": payload}
+    except (ValueError, TypeError, KeyError, json.JSONDecodeError, UnicodeDecodeError) as error:
+        return {"valid": False, "error": str(error)}
+
+
+def bidi_findings(text: str) -> list[dict[str, str]]:
+    findings: list[dict[str, str]] = []
+    stack = 0
+    for character in text:
+        if character in DANGEROUS_BIDI:
+            findings.append({"code": "dangerous-bidi-control", "character": f"U+{ord(character):04X}"})
+        elif character in ISOLATE_OPENERS:
+            stack += 1
+        elif character == ISOLATE_CLOSER:
+            if stack == 0:
+                findings.append({"code": "unpaired-bidi-isolate", "character": "U+2069"})
+            else:
+                stack -= 1
+    if stack:
+        findings.append({"code": "unclosed-bidi-isolate", "count": str(stack)})
+    return findings
+
+
+def _in_script(character: str, script: str) -> bool:
+    point = ord(character)
+    return any(start <= point <= end for start, end in SCRIPT_RANGES.get(script, ()))
+
+
+def script_report(text: str, language: str) -> dict[str, Any]:
+    parts = language.replace("_", "-").split("-")
+    base = parts[0].casefold()
+    explicit = next((part.title() for part in parts[1:] if len(part) == 4), None)
+    expected = explicit or LANGUAGE_SCRIPTS.get(base)
+    if not expected:
+        return {"status": "not-evaluated", "reason": "no deterministic script expectation"}
+    letters = [c for c in text if unicodedata.category(c).startswith("L")]
+    if not letters:
+        return {"status": "fail", "expected_script": expected, "ratio": 0.0}
+    matching = sum(_in_script(c, expected) for c in letters)
+    ratio = matching / len(letters)
+    threshold = 0.45 if expected in {"Hani", "Jpan"} else 0.70
+    return {"status": "pass" if ratio >= threshold else "fail", "expected_script": expected, "ratio": round(ratio, 3)}
+
+
+def glossary_findings(target: str, glossary: dict[str, Any]) -> list[dict[str, str]]:
+    findings: list[dict[str, str]] = []
+    for source_term, rule in glossary.items():
+        if isinstance(rule, str):
+            pattern, flags = re.escape(rule), re.IGNORECASE
+        elif isinstance(rule, dict):
+            value = str(rule.get("target", ""))
+            pattern = value if rule.get("regex") else re.escape(value)
+            flags = 0 if rule.get("case_sensitive") else re.IGNORECASE
+        else:
+            continue
+        if pattern and not re.search(pattern, target, flags):
+            findings.append({"code": "missing-glossary-term", "source": source_term, "expected": pattern})
+    return findings