@astrale-os/sdk 0.5.0-beta.13 → 0.5.0-beta.131

package/dist/tooling/linter/oxlint/run.js

@@ -0,0 +1,253 @@
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { LinterToolError, } from '../diagnostics/index.js';
+import { DOMAIN_OXLINT_IGNORE_PATTERNS } from '../oxlint-config/index.js';
+import { runOxlintProcess } from './process.js';
+const MAX_DIAGNOSTICS = 100_000;
+const MAX_LABELS = 256;
+export async function runOxlint(root, fix, options = {}) {
+    const packageJson = join(root, 'package.json');
+    const projectRequire = createRequire(packageJson);
+    const sdkRequire = createRequire(import.meta.url);
+    const oxlintPackage = resolvePackage('oxlint/package.json', projectRequire, sdkRequire);
+    const bin = join(dirname(oxlintPackage), 'bin', 'oxlint');
+    const config = projectConfig(root) ?? internalConfigPath();
+    const args = ['.', '--format=json', '--no-error-on-unmatched-pattern', '--config', config];
+    // Config-file ignores are rooted at the config's own directory. Enforce the
+    // SDK's traversal boundary at the target process as well so the internal
+    // fallback config and imported presets cannot discover dependency/build trees.
+    for (const pattern of DOMAIN_OXLINT_IGNORE_PATTERNS)
+        args.push('--ignore-pattern', pattern);
+    if (fix)
+        args.push('--fix');
+    const { status, signal, stdout, stderr } = await runOxlintProcess(bin, args, root, options);
+    if (status !== 0 && status !== 1) {
+        const outcome = signal ? `signal ${signal}` : `status ${status ?? 'unknown'}`;
+        const detail = failureDetail(stderr, stdout);
+        throw new LinterToolError(`Oxlint failed with ${outcome}.${detail ? `\n${detail}` : ''}`, {
+            code: 'OXLINT_FAILED',
+        });
+    }
+    let output;
+    try {
+        const parsed = JSON.parse(stdout);
+        output = admitOxlintOutput(parsed, root);
+    }
+    catch (error) {
+        const detail = failureDetail(stderr, stdout) || `Oxlint exited with status ${status}`;
+        throw new LinterToolError(`Oxlint did not produce a diagnostic report.\n${detail}`, {
+            code: 'OXLINT_INVALID_OUTPUT',
+            cause: error,
+        });
+    }
+    return {
+        diagnostics: (output.diagnostics ?? []).map((diagnostic) => normalizeDiagnostic(root, diagnostic)),
+        files: output.number_of_files ?? 0,
+    };
+}
+function resolvePackage(id, projectRequire, sdkRequire) {
+    try {
+        return projectRequire.resolve(id);
+    }
+    catch (projectError) {
+        try {
+            return sdkRequire.resolve(id);
+        }
+        catch {
+            throw new LinterToolError('Oxlint is not installed. Add the scaffolded Oxlint dev dependency and run your package manager install.', { code: 'OXLINT_NOT_INSTALLED', cause: projectError });
+        }
+    }
+}
+function admitOxlintOutput(value, root) {
+    if (!record(value))
+        throw new TypeError('Oxlint report must be an object.');
+    const rawDiagnostics = value.diagnostics === undefined ? [] : value.diagnostics;
+    if (!Array.isArray(rawDiagnostics))
+        throw new TypeError('Oxlint diagnostics must be an array.');
+    if (rawDiagnostics.length > MAX_DIAGNOSTICS) {
+        throw new TypeError(`Oxlint returned more than ${MAX_DIAGNOSTICS} diagnostics.`);
+    }
+    const diagnostics = rawDiagnostics.map((diagnostic, index) => admitOxlintDiagnostic(diagnostic, index, root));
+    const files = value.number_of_files;
+    if (files !== undefined && !nonnegativeInteger(files)) {
+        throw new TypeError('Oxlint number_of_files must be a nonnegative safe integer.');
+    }
+    return { diagnostics, ...(files === undefined ? {} : { number_of_files: files }) };
+}
+function admitOxlintDiagnostic(value, index, root) {
+    if (!record(value))
+        throw new TypeError(`Oxlint diagnostic ${index + 1} must be an object.`);
+    for (const field of ['message', 'code', 'url', 'help', 'filename']) {
+        if (value[field] !== undefined && typeof value[field] !== 'string') {
+            throw new TypeError(`Oxlint diagnostic ${index + 1} ${field} must be a string.`);
+        }
+    }
+    if (value.severity !== undefined &&
+        value.severity !== 'error' &&
+        value.severity !== 'warning' &&
+        value.severity !== 'advice') {
+        throw new TypeError(`Oxlint diagnostic ${index + 1} has invalid severity.`);
+    }
+    const labels = value.labels === undefined ? undefined : admitLabels(value.labels, index);
+    if (typeof value.filename === 'string') {
+        admitOxlintLocation(root, value.filename, labels?.[0]?.span);
+    }
+    return {
+        ...(value.message === undefined ? {} : { message: value.message }),
+        ...(value.code === undefined ? {} : { code: value.code }),
+        ...(value.severity === undefined ? {} : { severity: value.severity }),
+        ...(value.url === undefined ? {} : { url: value.url }),
+        ...(value.help === undefined ? {} : { help: value.help }),
+        ...(value.filename === undefined ? {} : { filename: value.filename }),
+        ...(labels === undefined ? {} : { labels }),
+    };
+}
+function admitLabels(value, diagnosticIndex) {
+    if (!Array.isArray(value)) {
+        throw new TypeError(`Oxlint diagnostic ${diagnosticIndex + 1} labels must be an array.`);
+    }
+    if (value.length > MAX_LABELS) {
+        throw new TypeError(`Oxlint diagnostic ${diagnosticIndex + 1} has too many labels.`);
+    }
+    return value.map((label, labelIndex) => {
+        if (!record(label)) {
+            throw new TypeError(`Oxlint diagnostic ${diagnosticIndex + 1} label ${labelIndex + 1} must be an object.`);
+        }
+        if (label.span === undefined)
+            return {};
+        if (!record(label.span)) {
+            throw new TypeError(`Oxlint diagnostic ${diagnosticIndex + 1} label ${labelIndex + 1} span must be an object.`);
+        }
+        const span = {};
+        for (const field of ['offset', 'length']) {
+            const number = label.span[field];
+            if (number !== undefined && !nonnegativeInteger(number)) {
+                throw new TypeError(`Oxlint diagnostic ${diagnosticIndex + 1} has invalid ${field}.`);
+            }
+            if (number !== undefined)
+                span[field] = number;
+        }
+        for (const field of ['line', 'column']) {
+            const number = label.span[field];
+            if (number !== undefined && !positiveInteger(number)) {
+                throw new TypeError(`Oxlint diagnostic ${diagnosticIndex + 1} has invalid ${field}.`);
+            }
+            if (number !== undefined)
+                span[field] = number;
+        }
+        return { span };
+    });
+}
+function admitOxlintLocation(root, filename, span) {
+    if (!filename)
+        throw new TypeError('Oxlint diagnostic filename must not be empty.');
+    const absolute = isAbsolute(filename) ? resolve(filename) : resolve(root, filename);
+    const child = relative(resolve(root), absolute);
+    if (child === '..' || child.startsWith(`..${sep}`) || isAbsolute(child)) {
+        throw new TypeError(`Oxlint diagnostic path is outside the project root: ${filename}.`);
+    }
+    if (!existsSync(absolute)) {
+        throw new TypeError(`Oxlint diagnostic path does not exist: ${filename}.`);
+    }
+    const realRoot = realpathSync(root);
+    const realFile = realpathSync(absolute);
+    const realChild = relative(realRoot, realFile);
+    if (realChild === '..' || realChild.startsWith(`..${sep}`) || isAbsolute(realChild)) {
+        throw new TypeError(`Oxlint diagnostic real path is outside the project root: ${filename}.`);
+    }
+    if (!span)
+        return;
+    const source = readFileSync(realFile);
+    if ((span.offset === undefined) !== (span.length === undefined)) {
+        throw new TypeError('Oxlint diagnostic span must provide offset and length together.');
+    }
+    if (span.offset !== undefined &&
+        span.length !== undefined &&
+        span.offset + span.length > source.length) {
+        throw new TypeError(`Oxlint diagnostic span is outside ${filename}.`);
+    }
+    if (span.line !== undefined || span.column !== undefined) {
+        if (span.line === undefined || span.column === undefined) {
+            throw new TypeError('Oxlint diagnostic span must provide line and column together.');
+        }
+        const lines = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false })
+            .decode(source)
+            .split('\n');
+        if (span.line > lines.length || span.column > (lines[span.line - 1]?.length ?? 0) + 1) {
+            throw new TypeError(`Oxlint diagnostic line or column is outside ${filename}.`);
+        }
+    }
+}
+function failureDetail(stderr, stdout) {
+    const detail = stderr.trim() || stdout.trim();
+    const limit = 4_000;
+    return detail.length <= limit ? detail : `…${detail.slice(-limit)}`;
+}
+function projectConfig(root) {
+    for (const name of [
+        'oxlint.config.ts',
+        'oxlint.config.js',
+        'oxlint.config.mjs',
+        'oxlint.config.cjs',
+        '.oxlintrc.json',
+        '.oxlintrc.jsonc',
+    ]) {
+        const path = join(root, name);
+        if (existsSync(path))
+            return path;
+    }
+    return undefined;
+}
+function internalConfigPath() {
+    const current = fileURLToPath(import.meta.url);
+    const extension = current.endsWith('.ts') ? '.ts' : '.js';
+    return join(dirname(current), '..', 'oxlint-config', `index${extension}`);
+}
+function normalizeDiagnostic(root, diagnostic) {
+    const id = normalizeCode(diagnostic.code ?? 'oxlint/unknown');
+    const span = diagnostic.labels?.[0]?.span;
+    return {
+        id,
+        source: 'oxlint',
+        scope: 'generic',
+        analysis: 'generic',
+        kind: 'violation',
+        severity: normalizeSeverity(diagnostic.severity),
+        message: diagnostic.message ?? 'Oxlint reported a violation.',
+        ...(diagnostic.help ? { evidence: diagnostic.help } : {}),
+        ...(diagnostic.filename
+            ? {
+                location: {
+                    path: relativePath(root, diagnostic.filename),
+                    line: span?.line ?? 1,
+                    column: span?.column ?? 1,
+                    ...(span?.offset !== undefined ? { offset: span.offset } : {}),
+                    ...(span?.length !== undefined ? { length: span.length } : {}),
+                },
+            }
+            : {}),
+    };
+}
+function normalizeCode(code) {
+    const match = /^([^()]+)\(([^()]+)\)$/.exec(code);
+    return match ? `${match[1]}/${match[2]}` : code;
+}
+function normalizeSeverity(severity) {
+    return severity === 'error' ? 'error' : 'warning';
+}
+function relativePath(root, filename) {
+    const absolute = resolve(root, filename);
+    const path = relative(root, absolute);
+    return sep === '/' ? path : path.split(sep).join('/');
+}
+function record(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function positiveInteger(value) {
+    return Number.isSafeInteger(value) && value >= 1;
+}
+function nonnegativeInteger(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}

package/dist/tooling/linter/oxlint-config/ignore-patterns.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Process-level traversal boundary shared by the source-loaded Oxlint config
+ * and the invocation that roots these patterns in the target project.
+ */
+export declare const DOMAIN_OXLINT_IGNORE_PATTERNS: readonly string[];

package/dist/tooling/linter/oxlint-config/ignore-patterns.js

@@ -0,0 +1,10 @@
+/**
+ * Process-level traversal boundary shared by the source-loaded Oxlint config
+ * and the invocation that roots these patterns in the target project.
+ */
+export const DOMAIN_OXLINT_IGNORE_PATTERNS = Object.freeze([
+    '**/.history/**',
+    '**/dist/**',
+    '**/node_modules/**',
+    '**/coverage/**',
+]);

package/dist/tooling/linter/oxlint-config/index.d.ts

@@ -0,0 +1,4 @@
+import { type OxlintConfig } from 'oxlint';
+export { DOMAIN_OXLINT_IGNORE_PATTERNS } from './ignore-patterns.js';
+export declare const domainOxlintConfig: OxlintConfig;
+export default domainOxlintConfig;

package/dist/tooling/linter/oxlint-config/index.js

@@ -0,0 +1,38 @@
+import { defineConfig } from 'oxlint';
+import { DOMAIN_OXLINT_IGNORE_PATTERNS } from './ignore-patterns.js';
+export { DOMAIN_OXLINT_IGNORE_PATTERNS } from './ignore-patterns.js';
+export const domainOxlintConfig = defineConfig({
+    rules: {
+        'no-unused-vars': ['error', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
+        'no-explicit-any': 'warn',
+        'consistent-type-imports': 'warn',
+        'no-console': 'warn',
+        'prefer-const': 'error',
+        eqeqeq: ['error', 'always'],
+    },
+    ignorePatterns: [
+        ...DOMAIN_OXLINT_IGNORE_PATTERNS,
+        '**/*.js',
+        '**/*.mjs',
+        '**/*.cjs',
+        '**/*.gen.ts',
+        '**/*.gen.tsx',
+    ],
+    overrides: [
+        {
+            files: [
+                '**/__tests__/**/*.ts',
+                '**/*.test.ts',
+                '**/*.perf.ts',
+                '**/*.bench.ts',
+                '**/*.spec.ts',
+            ],
+            rules: {
+                'no-explicit-any': 'off',
+                'no-unused-vars': 'off',
+                'no-console': 'off',
+            },
+        },
+    ],
+});
+export default domainOxlintConfig;

package/dist/tooling/linter/packs/domain.d.ts

@@ -0,0 +1,2 @@
+import type { DomainRulePack } from './index.js';
+export declare const domainRulePack: DomainRulePack;

package/dist/tooling/linter/packs/domain.js

@@ -0,0 +1,7 @@
+import { domainRuleRequirements } from '../requirements/index.js';
+export const domainRulePack = Object.freeze({
+    id: 'astrale.domain',
+    version: '1',
+    requirements: domainRuleRequirements,
+    ruleIds: Object.freeze(domainRuleRequirements.map(({ ruleId }) => ruleId)),
+});

package/dist/tooling/linter/packs/index.d.ts

@@ -0,0 +1,8 @@
+export { domainRulePack } from './domain.js';
+import type { RuleRequirements } from '../requirements/index.js';
+export interface DomainRulePack {
+    readonly id: 'astrale.domain';
+    readonly version: string;
+    readonly requirements: readonly RuleRequirements[];
+    readonly ruleIds: readonly string[];
+}

package/dist/tooling/linter/packs/index.js

@@ -0,0 +1 @@
+export { domainRulePack } from './domain.js';

package/dist/tooling/linter/policy/compile.d.ts

@@ -0,0 +1,2 @@
+import type { DomainPolicy, DomainPolicySource } from './index.js';
+export declare function compileDomainPolicy(source: DomainPolicySource): DomainPolicy;

package/dist/tooling/linter/policy/compile.js

@@ -0,0 +1,271 @@
+import { createHash } from 'node:crypto';
+import { compileRuleCatalog } from '../catalog/index.js';
+import { LinterToolError } from '../diagnostics/index.js';
+const DEPENDENCY_KINDS = new Set(['runtime', 'type-only', 'composition', 'evidence']);
+const TOKEN = /^[a-z][a-z0-9.-]*$/;
+const MAX_LAYERS = 64;
+const MAX_DEPENDENCIES = 1_024;
+const MAX_ROOT_FILES = 64;
+const MAX_ALIASES = 128;
+const MAX_POLICY_STRING_BYTES = 4_096;
+const ROOT_FILE_ROLES = new Set(['configuration', 'composition', 'package-facade', 'tooling']);
+const LAYER_FACADE = /^[a-z][a-z0-9-]*\.[cm]?[jt]sx?$/;
+export function compileDomainPolicy(source) {
+    if (!record(source))
+        invalid('Domain policy source must be an object.');
+    if (typeof source.rules !== 'string')
+        invalid('Domain policy rules must be a string.');
+    const sourceLayers = array(source.layers, 'layers', MAX_LAYERS);
+    const sourceDependencies = array(source.dependencies, 'dependencies', MAX_DEPENDENCIES);
+    const catalog = compileRuleCatalog(source.rules);
+    const layerIds = new Set();
+    const sourcePaths = new Set();
+    const layers = sourceLayers.map((layer, index) => admitLayer(layer, index, layerIds, sourcePaths));
+    if (layers.length === 0)
+        invalid('Domain policy must declare at least one layer.');
+    const sourceRootFiles = array(source.rootFiles, 'root files', MAX_ROOT_FILES);
+    const rootIds = new Set();
+    const rootPaths = new Set();
+    const rootFiles = sourceRootFiles.map((rootFile, index) => admitRootFile(rootFile, index, rootIds, rootPaths));
+    if (rootFiles.filter(({ role }) => role === 'composition').length > 2) {
+        invalid('Domain policy may declare at most two composition root files.');
+    }
+    if (rootFiles.filter(({ role }) => role === 'package-facade').length !== 1) {
+        invalid('Domain policy must declare exactly one package-facade root file.');
+    }
+    const dependencyRootIds = new Set(rootFiles
+        .filter(({ role }) => role === 'composition' || role === 'package-facade')
+        .map(({ id }) => id));
+    const dependencyKeys = new Set();
+    const dependencies = sourceDependencies.map((dependency, index) => {
+        const admitted = admitDependency(dependency, index);
+        if (!layerIds.has(admitted.source) &&
+            !dependencyRootIds.has(admitted.source) &&
+            !isExternalSurface(admitted.source)) {
+            invalid(`Dependency row ${index + 1} has unknown source ${admitted.source}.`);
+        }
+        if (!layerIds.has(admitted.target) &&
+            !dependencyRootIds.has(admitted.target) &&
+            !isExternalSurface(admitted.target)) {
+            invalid(`Dependency row ${index + 1} has unknown target ${admitted.target}.`);
+        }
+        const key = `${admitted.source}\0${admitted.target}\0${admitted.kind}`;
+        if (dependencyKeys.has(key))
+            invalid(`Domain policy has duplicate dependency ${key.replaceAll('\0', ' -> ')}.`);
+        dependencyKeys.add(key);
+        return admitted;
+    });
+    const sourceAliases = array(source.aliases, 'aliases', MAX_ALIASES);
+    const aliasSpecifiers = new Set();
+    const admittedAliases = sourceAliases.map((alias, index) => admitAlias(alias, index, layerIds, layers, aliasSpecifiers));
+    requireAliasPairs(layers, admittedAliases);
+    rejectLayerCycles(layers, dependencies);
+    const payload = { layers, dependencies, rootFiles, aliases: admittedAliases };
+    return Object.freeze({
+        catalog,
+        digest: createHash('sha256')
+            .update(source.rules)
+            .update('\0')
+            .update(JSON.stringify(payload))
+            .digest('hex'),
+        layers: Object.freeze(layers),
+        dependencies: Object.freeze(dependencies),
+        rootFiles: Object.freeze(rootFiles),
+        aliases: Object.freeze(admittedAliases),
+    });
+}
+function admitLayer(layer, index, ids, paths) {
+    if (!record(layer))
+        invalid(`Layer row ${index + 1} must be an object.`);
+    string(layer.id, `Layer row ${index + 1} ID`);
+    string(layer.sourcePath, `Layer ${layer.id} source path`);
+    if (!TOKEN.test(layer.id))
+        invalid(`Layer row ${index + 1} has invalid ID ${layer.id}.`);
+    if (ids.has(layer.id))
+        invalid(`Domain policy has duplicate layer ${layer.id}.`);
+    ids.add(layer.id);
+    if (!/^[a-z][a-z0-9-]*\/$/.test(layer.sourcePath)) {
+        invalid(`Layer ${layer.id} has invalid source path ${layer.sourcePath}.`);
+    }
+    if (paths.has(layer.sourcePath))
+        invalid(`Domain policy has duplicate source path ${layer.sourcePath}.`);
+    paths.add(layer.sourcePath);
+    if (typeof layer.required !== 'boolean')
+        invalid(`Layer ${layer.id} required must be boolean.`);
+    const facade = layer.facade;
+    if (facade !== undefined &&
+        (typeof facade !== 'string' ||
+            !LAYER_FACADE.test(facade) ||
+            facade === 'index.ts' ||
+            facade === 'index.tsx')) {
+        invalid(`Layer ${layer.id} has invalid facade ${String(facade)}.`);
+    }
+    return Object.freeze({
+        id: layer.id,
+        sourcePath: layer.sourcePath,
+        ...(facade === undefined ? {} : { facade }),
+        required: layer.required,
+    });
+}
+function admitDependency(dependency, index) {
+    if (!record(dependency))
+        invalid(`Dependency row ${index + 1} must be an object.`);
+    string(dependency.source, `Dependency row ${index + 1} source`);
+    string(dependency.target, `Dependency row ${index + 1} target`);
+    string(dependency.kind, `Dependency row ${index + 1} kind`);
+    string(dependency.condition, `Dependency row ${index + 1} condition`);
+    if (!TOKEN.test(dependency.source) || !TOKEN.test(dependency.target)) {
+        invalid(`Dependency row ${index + 1} has an invalid endpoint.`);
+    }
+    if (!DEPENDENCY_KINDS.has(dependency.kind)) {
+        invalid(`Dependency row ${index + 1} has invalid kind ${dependency.kind}.`);
+    }
+    if (!dependency.condition || dependency.condition !== dependency.condition.trim()) {
+        invalid(`Dependency row ${index + 1} has an invalid condition.`);
+    }
+    return Object.freeze({ ...dependency });
+}
+function admitRootFile(rootFile, index, ids, paths) {
+    if (!record(rootFile))
+        invalid(`Root file row ${index + 1} must be an object.`);
+    string(rootFile.id, `Root file row ${index + 1} ID`);
+    string(rootFile.sourcePath, `Root file ${rootFile.id} source path`);
+    string(rootFile.role, `Root file ${rootFile.id} role`);
+    if (!TOKEN.test(rootFile.id))
+        invalid(`Root file row ${index + 1} has invalid ID ${rootFile.id}.`);
+    if (ids.has(rootFile.id))
+        invalid(`Domain policy has duplicate root file ${rootFile.id}.`);
+    ids.add(rootFile.id);
+    if (!relativeFile(rootFile.sourcePath)) {
+        invalid(`Root file ${rootFile.id} has invalid source path ${rootFile.sourcePath}.`);
+    }
+    if (paths.has(rootFile.sourcePath)) {
+        invalid(`Domain policy has duplicate root path ${rootFile.sourcePath}.`);
+    }
+    paths.add(rootFile.sourcePath);
+    if (!ROOT_FILE_ROLES.has(rootFile.role)) {
+        invalid(`Root file ${rootFile.id} has invalid role ${rootFile.role}.`);
+    }
+    if (typeof rootFile.required !== 'boolean') {
+        invalid(`Root file ${rootFile.id} required must be boolean.`);
+    }
+    return Object.freeze({
+        id: rootFile.id,
+        sourcePath: rootFile.sourcePath,
+        role: rootFile.role,
+        required: rootFile.required,
+    });
+}
+function admitAlias(alias, index, layerIds, layers, specifiers) {
+    if (!record(alias))
+        invalid(`Alias row ${index + 1} must be an object.`);
+    string(alias.layer, `Alias row ${index + 1} layer`);
+    string(alias.kind, `Alias row ${index + 1} kind`);
+    string(alias.specifier, `Alias row ${index + 1} specifier`);
+    string(alias.typescriptTarget, `Alias row ${index + 1} TypeScript target`);
+    string(alias.packageTarget, `Alias row ${index + 1} package target`);
+    if (!layerIds.has(alias.layer))
+        invalid(`Alias row ${index + 1} has unknown layer ${alias.layer}.`);
+    const layer = layers.find(({ id }) => id === alias.layer);
+    if (alias.kind !== 'facade' && alias.kind !== 'submodule') {
+        invalid(`Alias row ${index + 1} has invalid kind ${alias.kind}.`);
+    }
+    const aliasPattern = alias.kind === 'facade' ? /^#[a-z][a-z0-9-]*$/ : /^#[a-z][a-z0-9-]*\/\*$/;
+    if (!aliasPattern.test(alias.specifier)) {
+        invalid(`Alias row ${index + 1} has invalid specifier ${alias.specifier}.`);
+    }
+    if (specifiers.has(alias.specifier)) {
+        invalid(`Domain policy has duplicate alias ${alias.specifier}.`);
+    }
+    specifiers.add(alias.specifier);
+    const expected = alias.kind === 'facade'
+        ? {
+            typescriptTarget: `./${layer.sourcePath}index.ts`,
+            packageTarget: `./${layer.sourcePath}index.ts`,
+        }
+        : {
+            typescriptTarget: `./${layer.sourcePath}*/index.ts`,
+            packageTarget: `./${layer.sourcePath}*/index.ts`,
+        };
+    if (alias.typescriptTarget !== expected.typescriptTarget) {
+        invalid(`Alias ${alias.specifier} TypeScript target must be ${expected.typescriptTarget}.`);
+    }
+    if (alias.packageTarget !== expected.packageTarget) {
+        invalid(`Alias ${alias.specifier} package target must be ${expected.packageTarget}.`);
+    }
+    return Object.freeze({
+        layer: alias.layer,
+        kind: alias.kind,
+        specifier: alias.specifier,
+        typescriptTarget: alias.typescriptTarget,
+        packageTarget: alias.packageTarget,
+    });
+}
+function requireAliasPairs(layers, aliases) {
+    for (const layer of layers) {
+        const layerAliases = aliases.filter(({ layer: candidate }) => candidate === layer.id);
+        const facades = layerAliases.filter(({ kind }) => kind === 'facade');
+        const submodules = layerAliases.filter(({ kind }) => kind === 'submodule');
+        if (facades.length !== 1 || submodules.length !== 1) {
+            invalid(`Domain policy layer ${layer.id} must declare one facade and one submodule alias.`);
+        }
+        if (submodules[0].specifier !== `${facades[0].specifier}/*`) {
+            invalid(`Domain policy layer ${layer.id} aliases must share one prefix.`);
+        }
+    }
+}
+function isExternalSurface(value) {
+    return value === 'foreign-domain';
+}
+function rejectLayerCycles(layers, dependencies) {
+    const layerIds = new Set(layers.map(({ id }) => id));
+    const graph = new Map(layers.map(({ id }) => [id, []]));
+    for (const dependency of dependencies) {
+        if (dependency.kind !== 'evidence' &&
+            layerIds.has(dependency.source) &&
+            layerIds.has(dependency.target)) {
+            graph.get(dependency.source)?.push(dependency.target);
+        }
+    }
+    const visiting = new Set();
+    const visited = new Set();
+    const visit = (id, route) => {
+        if (visiting.has(id))
+            invalid(`Domain policy dependency cycle: ${[...route, id].join(' -> ')}.`);
+        if (visited.has(id))
+            return;
+        visiting.add(id);
+        for (const target of graph.get(id) ?? [])
+            visit(target, [...route, id]);
+        visiting.delete(id);
+        visited.add(id);
+    };
+    for (const layer of layers)
+        visit(layer.id, []);
+}
+function invalid(message) {
+    throw new LinterToolError(message, { code: 'LINTER_POLICY_INVALID' });
+}
+function array(value, name, maximum) {
+    if (!Array.isArray(value))
+        invalid(`Domain policy ${name} must be an array.`);
+    if (value.length > maximum) {
+        invalid(`Domain policy has ${value.length} ${name}; maximum is ${maximum}.`);
+    }
+    return value;
+}
+function string(value, name) {
+    if (typeof value !== 'string' || Buffer.byteLength(value, 'utf8') > MAX_POLICY_STRING_BYTES) {
+        invalid(`${name} must be a string of at most ${MAX_POLICY_STRING_BYTES} bytes.`);
+    }
+}
+function record(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function relativeFile(value) {
+    return (!value.startsWith('/') &&
+        !value.startsWith('./') &&
+        !value.includes('\\') &&
+        !value.split('/').includes('..') &&
+        !value.endsWith('/'));
+}

package/dist/tooling/linter/policy/configuration.d.ts

@@ -0,0 +1,21 @@
+import type { DomainPolicy, DomainPolicySource } from './index.js';
+export declare const DOMAIN_LINT_CONFIG = "astrale.lint.json";
+export interface DomainLintLayerConfiguration {
+    readonly sourcePath?: string;
+    readonly alias?: string;
+}
+export interface DomainLintConfiguration {
+    readonly layers?: Readonly<Record<string, DomainLintLayerConfiguration>>;
+    readonly disabledRules?: Readonly<Record<string, string>>;
+}
+export interface DisabledRule {
+    readonly ruleId: string;
+    readonly reason: string;
+}
+export interface ProjectDomainLint {
+    readonly policy: DomainPolicy;
+    readonly disabled: readonly DisabledRule[];
+}
+export declare function compileProjectDomainPolicy(root: string, signal?: AbortSignal): Promise<DomainPolicy>;
+export declare function compileProjectDomainLint(root: string, signal?: AbortSignal): Promise<ProjectDomainLint>;
+export declare function configureDomainPolicySource(source: DomainPolicySource, configuration: DomainLintConfiguration): DomainPolicySource;