@astrale-os/sdk 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/tooling/linter/implementations/source/global.js

@@ -0,0 +1,786 @@
+import ts from 'typescript';
+import { importedSymbol, resolveImportedSymbol, resolveProjectImport, unwrap, visit, } from '../../adapters/typescript/index.js';
+import { DSL_MODULES, SDK_MODULES, ambiguity, definitionOriginAmbiguity, definitionObjects, isDeepPackageImport, isForeignDomain, isLocallyBoundIdentifier, packageRoot, production, propertyExpression, violation, } from './shared.js';
+const CANONICAL_TYPES = new Set([
+    'IdentityId',
+    'MutationAST',
+    'NodeId',
+    'Path',
+    'QueryAST',
+    'QueryResult',
+]);
+const INHERITED = new Set(['name', 'description', 'createdAt', 'updatedAt']);
+export const globalRules = [
+    {
+        id: 'QLT-TYPED-COORD',
+        ruleRevision: '4e0b929414b7526cd4cf2e755a9664eaf03845d79e650abcae7b1e2f4f4b67ce',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                if (file.layer !== 'queries' && file.layer !== 'mutations')
+                    continue;
+                visit(file.source, (node) => {
+                    if (!ts.isCallExpression(node))
+                        return;
+                    const symbol = resolveImportedSymbol(file, node.expression);
+                    if (symbol.kind === 'resolved' &&
+                        symbol.name === 'PropertyKey' &&
+                        schemaAuthoringModule(symbol.module)) {
+                        evidence.push(violation(file, node, 'Graph property coordinate is constructed from a raw key; derive it from a rich Domain definition.'));
+                        return;
+                    }
+                    const expression = unwrap(node.expression);
+                    if (!ts.isPropertyAccessExpression(expression) ||
+                        expression.name.text !== 'from' ||
+                        !node.arguments[0] ||
+                        !ts.isObjectLiteralExpression(unwrap(node.arguments[0]))) {
+                        return;
+                    }
+                    const owner = resolveImportedSymbol(file, expression.expression);
+                    if (owner.kind === 'resolved' &&
+                        owner.name === 'ClassPath' &&
+                        graphAuthoringModule(owner.module)) {
+                        evidence.push(violation(file, node, 'Graph ClassPath is constructed from a structural object; derive it from a rich Domain definition.'));
+                    }
+                });
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'MOD-REQUIRED',
+        ruleRevision: '7792b445dee5c0b0184e3bc00e4bfeba2c5f25db921f9d825a5adfe0c9aba48f',
+        evaluate(project) {
+            const evidence = [];
+            const roots = new Set(project.configuration.rootEntries);
+            for (const layer of project.policy.layers) {
+                if (!layer.required)
+                    continue;
+                const entry = layer.sourcePath.replace(/\/$/, '');
+                if (!roots.has(entry)) {
+                    evidence.push({
+                        kind: 'violation',
+                        evidence: `Required layer ${layer.id} is missing at ${layer.sourcePath}.`,
+                    });
+                }
+            }
+            for (const rootFile of project.policy.rootFiles) {
+                if (!rootFile.required || roots.has(rootFile.sourcePath))
+                    continue;
+                evidence.push({
+                    kind: 'violation',
+                    evidence: `Required root file ${rootFile.sourcePath} is missing.`,
+                });
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'MOD-GOVERNED',
+        ruleRevision: '2fbff878449c8554ae5f9936166c927f7030c79c4a466086b671060cebabda13',
+        evaluate(project) {
+            const governedRoots = new Set(project.policy.rootFiles.map(({ sourcePath }) => sourcePath));
+            return production(project).flatMap((file) => {
+                if (file.layer || governedRoots.has(file.path))
+                    return [];
+                const evidence = `Production source ${file.path} is outside every declared layer and governed root.`;
+                const anchor = file.source.statements[0];
+                return anchor ? [violation(file, anchor, evidence)] : [{ kind: 'violation', evidence }];
+            });
+        },
+    },
+    {
+        id: 'MOD-SUBMODULE',
+        ruleRevision: 'a3e13afa0d5afe01a947210233001b3e7a81eb71b9354ac4a9571e87c4734081',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                if (!file.layer || file.submodule)
+                    continue;
+                const layer = project.policy.layers.find(({ id }) => id === file.layer);
+                const relative = layer ? file.path.slice(layer.sourcePath.length) : file.path;
+                if (relative !== 'index.ts' && relative !== 'index.tsx') {
+                    evidence.push(violation(file, file.source, `Layer-root source ${file.path} has no semantic submodule owner.`));
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'ROOT-FACADE',
+        ruleRevision: '6c209109f819e27a7938edd725d22859cc8cf8e1accb2da484fb3f0ebfb95117',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                if (!file.layer || file.submodule)
+                    continue;
+                const layer = project.policy.layers.find(({ id }) => id === file.layer);
+                const relative = layer ? file.path.slice(layer.sourcePath.length) : file.path;
+                if (relative !== 'index.ts' && relative !== 'index.tsx')
+                    continue;
+                const compositionNames = layerCompositionNames(project, file);
+                for (const statement of file.source.statements) {
+                    if (ts.isImportDeclaration(statement) || ts.isEmptyStatement(statement)) {
+                        continue;
+                    }
+                    if (ts.isExportDeclaration(statement)) {
+                        if (statement.moduleSpecifier && !statement.exportClause) {
+                            evidence.push(violation(file, statement, `Layer facade ${file.path} uses an uncurated wildcard export.`));
+                            continue;
+                        }
+                        if (statement.moduleSpecifier && ts.isStringLiteral(statement.moduleSpecifier)) {
+                            const target = resolveProjectImport(project, file, statement.moduleSpecifier.text);
+                            if (!target) {
+                                const local = statement.moduleSpecifier.text.startsWith('.') ||
+                                    statement.moduleSpecifier.text.startsWith('#');
+                                evidence.push(local
+                                    ? ambiguity(file, statement, `Layer facade export ${statement.moduleSpecifier.text} cannot be resolved.`)
+                                    : violation(file, statement, `Layer facade re-exports external package ${statement.moduleSpecifier.text}.`));
+                            }
+                            else if (target.layer !== file.layer || !target.submodule) {
+                                evidence.push(violation(file, statement, `Layer facade export targets non-submodule source ${target.path}.`));
+                            }
+                        }
+                        else if (statement.exportClause && ts.isNamedExports(statement.exportClause)) {
+                            for (const element of statement.exportClause.elements) {
+                                const sourceImport = importForLocalBinding(file, element.propertyName?.text ?? element.name.text);
+                                if (!sourceImport) {
+                                    evidence.push(ambiguity(file, element, `Layer facade export ${element.name.text} has no statically resolved import owner.`));
+                                    continue;
+                                }
+                                const target = resolveProjectImport(project, file, sourceImport.specifier);
+                                if (!target) {
+                                    evidence.push(sourceImport.specifier.startsWith('.') || sourceImport.specifier.startsWith('#')
+                                        ? ambiguity(file, element, `Layer facade import ${sourceImport.specifier} cannot be resolved.`)
+                                        : violation(file, element, `Layer facade exports external package ${sourceImport.specifier}.`));
+                                }
+                                else if (target.layer !== file.layer || !target.submodule) {
+                                    evidence.push(violation(file, element, `Layer facade export targets non-submodule source ${target.path}.`));
+                                }
+                            }
+                        }
+                        continue;
+                    }
+                    if (layerCompositionStatement(statement, compositionNames))
+                        continue;
+                    evidence.push(violation(file, statement, `Layer facade ${file.path} owns executable or declared value instead of re-exporting a submodule.`));
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'ROOT-COMPOSE',
+        ruleRevision: '412275a5af1e8c25038639bcbc9729a38efaddfce8d70c4c02dd284f239142ef',
+        evaluate(project) {
+            const evidence = [];
+            const compositionRoots = project.policy.rootFiles.filter(({ role }) => role === 'composition');
+            const compositionPaths = new Set(compositionRoots.map(({ sourcePath }) => sourcePath));
+            for (const root of compositionRoots) {
+                const implementation = project.filesByPath.get(root.sourcePath);
+                if (implementation?.role !== 'production')
+                    continue;
+                for (const sourceImport of implementation.imports) {
+                    const target = resolveProjectImport(project, implementation, sourceImport.specifier);
+                    const expectedKind = sourceImport.typeOnly ? 'type-only' : 'composition';
+                    const supportedTarget = target?.layer !== undefined &&
+                        project.policy.dependencies.some((edge) => edge.source === root.id &&
+                            edge.target === target.layer &&
+                            (edge.kind === expectedKind ||
+                                (expectedKind === 'type-only' && edge.kind === 'composition')));
+                    if (target?.layer && !supportedTarget) {
+                        evidence.push(violation(implementation, sourceImport.node, `Composition root ${root.sourcePath} imports ${target.layer} without a permitted ${expectedKind} edge.`));
+                    }
+                    else if (!target && !compositionPackage(sourceImport.specifier)) {
+                        evidence.push(violation(implementation, sourceImport.node, `Composition root ${root.sourcePath} imports provider or unsupported package ${sourceImport.specifier}.`));
+                    }
+                }
+                for (const statement of implementation.source.statements) {
+                    if (compositionStatement(implementation, statement))
+                        continue;
+                    evidence.push(violation(implementation, statement, `${root.sourcePath} contains behavior outside static Domain composition.`));
+                }
+            }
+            const packageRoot = project.policy.rootFiles.find(({ role }) => role === 'package-facade');
+            const entrypoint = packageRoot && project.filesByPath.get(packageRoot.sourcePath);
+            if (packageRoot && entrypoint?.role === 'production') {
+                const packageTargets = new Set(project.policy.dependencies
+                    .filter(({ source }) => source === packageRoot.id)
+                    .map(({ target }) => target));
+                for (const statement of entrypoint.source.statements) {
+                    if (ts.isEmptyStatement(statement))
+                        continue;
+                    if (ts.isExportDeclaration(statement)) {
+                        if (statement.moduleSpecifier && !statement.exportClause) {
+                            evidence.push(violation(entrypoint, statement, `Package facade ${packageRoot.sourcePath} uses an unsupported wildcard export.`));
+                            continue;
+                        }
+                        if (statement.moduleSpecifier && ts.isStringLiteral(statement.moduleSpecifier)) {
+                            const target = resolveProjectImport(project, entrypoint, statement.moduleSpecifier.text);
+                            const supported = target &&
+                                ((compositionPaths.has(target.path) &&
+                                    rootIdForPath(project, target.path) !== undefined &&
+                                    packageTargets.has(rootIdForPath(project, target.path))) ||
+                                    Boolean(target.layer &&
+                                        packageTargets.has(target.layer) &&
+                                        !target.submodule &&
+                                        /\/index\.[cm]?[jt]sx?$/.test(target.path)));
+                            if (!supported) {
+                                evidence.push(target
+                                    ? violation(entrypoint, statement, `Package index.ts bypasses supported facade with ${target.path}.`)
+                                    : ambiguity(entrypoint, statement, `Package export ${statement.moduleSpecifier.text} cannot be resolved to a supported journey.`));
+                            }
+                        }
+                        else if (statement.exportClause && ts.isNamedExports(statement.exportClause)) {
+                            for (const element of statement.exportClause.elements) {
+                                const sourceImport = importForLocalBinding(entrypoint, element.propertyName?.text ?? element.name.text);
+                                if (!sourceImport) {
+                                    evidence.push(ambiguity(entrypoint, element, `Package export ${element.name.text} has no statically resolved import owner.`));
+                                    continue;
+                                }
+                                const target = resolveProjectImport(project, entrypoint, sourceImport.specifier);
+                                const supported = target &&
+                                    ((compositionPaths.has(target.path) &&
+                                        rootIdForPath(project, target.path) !== undefined &&
+                                        packageTargets.has(rootIdForPath(project, target.path))) ||
+                                        Boolean(target.layer &&
+                                            packageTargets.has(target.layer) &&
+                                            !target.submodule &&
+                                            /\/index\.[cm]?[jt]sx?$/.test(target.path)));
+                                if (!supported) {
+                                    evidence.push(target
+                                        ? violation(entrypoint, element, `Package index.ts bypasses supported facade with ${target.path}.`)
+                                        : ambiguity(entrypoint, element, `Package import ${sourceImport.specifier} cannot be resolved to a supported journey.`));
+                                }
+                            }
+                        }
+                        continue;
+                    }
+                    evidence.push(violation(entrypoint, statement, `Package facade ${packageRoot.sourcePath} contains an unsupported declaration or recursive composition.`));
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'TST-NO-PROD-IMP',
+        ruleRevision: '3862d665297486d32b225626f39a1cd8344b3f3bf93a2883e19dc4c94412574a',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                for (const sourceImport of file.imports) {
+                    const target = resolveProjectImport(project, file, sourceImport.specifier);
+                    if (target && target.role !== 'production') {
+                        evidence.push(violation(file, sourceImport.node, `Production source ${file.path} imports test artifact ${target.path}.`));
+                    }
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'DEP-ALLOWLIST',
+        ruleRevision: 'd439d3c539e5ae7ce9f04f69a2d8e750a145ef36633934e34e0460e708aba0b1',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                for (const sourceImport of file.imports) {
+                    const target = resolveProjectImport(project, file, sourceImport.specifier);
+                    if (!file.layer || !target?.layer || file.layer === target.layer)
+                        continue;
+                    const kind = sourceImport.typeOnly
+                        ? 'type-only'
+                        : file.path === 'implementation.ts'
+                            ? 'composition'
+                            : 'runtime';
+                    if (!project.policy.dependencies.some((edge) => edge.source === file.layer &&
+                        edge.target === target.layer &&
+                        (edge.kind === kind ||
+                            (kind === 'type-only' &&
+                                (edge.kind === 'runtime' || edge.kind === 'composition'))))) {
+                        evidence.push(violation(file, sourceImport.node, `Import ${sourceImport.specifier} creates absent ${file.layer} -> ${target.layer} (${kind}) edge.`));
+                    }
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'IMP-FACADE',
+        ruleRevision: 'ff2ba044d23755f9d84c2e8ebdfecfd3310955d87e54f945e4a34f8d96afc854',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                for (const sourceImport of file.imports) {
+                    const localDeepImport = sourceImport.specifier.match(/^#([^/]+)\/[^/]+\/.+/);
+                    if (localDeepImport &&
+                        project.policy.layers.some(({ id }) => id === localDeepImport[1])) {
+                        evidence.push(violation(file, sourceImport.node, `Import ${sourceImport.specifier} reaches private source; use the semantic submodule facade.`));
+                    }
+                    if (isForeignDomain(sourceImport.specifier) &&
+                        isDeepPackageImport(sourceImport.specifier)) {
+                        evidence.push(violation(file, sourceImport.node, `Foreign Domain import ${sourceImport.specifier} bypasses ${packageRoot(sourceImport.specifier)}.`));
+                    }
+                    const target = resolveProjectImport(project, file, sourceImport.specifier);
+                    if (!file.layer ||
+                        !target?.layer ||
+                        file.layer !== target.layer ||
+                        !file.submodule ||
+                        !target.submodule ||
+                        file.submodule === target.submodule) {
+                        continue;
+                    }
+                    const facade = `${target.layer}/${target.submodule}/index.`;
+                    if (!target.path.startsWith(facade)) {
+                        evidence.push(violation(file, sourceImport.node, `Import ${sourceImport.specifier} reaches private ${target.path}; use ${target.layer}/${target.submodule}/index.ts.`));
+                    }
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'IMP-SDK-BOUNDARY',
+        ruleRevision: '6e00f5e402015af4dbd7ddcd289d0b55a5cd2c145856056c0cb43a2035ebcf4a',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                for (const sourceImport of file.imports) {
+                    if (!directKernelAuthoringImport(sourceImport.specifier))
+                        continue;
+                    evidence.push(violation(file, sourceImport.node, `Domain source imports ${sourceImport.specifier} directly; use the matching @astrale-os/sdk semantic subpath.`));
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'IMP-LAYER-ALIAS',
+        ruleRevision: '6709e5e27d952091b5342804b321da1a688c5f0628ecd5ab9f5c9b32e14fde45',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                for (const sourceImport of file.imports) {
+                    if (!sourceImport.specifier.startsWith('.'))
+                        continue;
+                    if (/\.(?:css|less|sass|scss)$/.test(sourceImport.specifier))
+                        continue;
+                    const target = resolveProjectImport(project, file, sourceImport.specifier);
+                    if (!target) {
+                        evidence.push(ambiguity(file, sourceImport.node, `Relative import ${sourceImport.specifier} cannot be resolved statically.`));
+                        continue;
+                    }
+                    const crossesLayer = Boolean(file.layer && target.layer && file.layer !== target.layer);
+                    const crossesSubmodule = Boolean(file.layer === target.layer &&
+                        file.submodule &&
+                        target.submodule &&
+                        file.submodule !== target.submodule);
+                    if (crossesLayer || crossesSubmodule) {
+                        evidence.push(violation(file, sourceImport.node, `Relative import ${sourceImport.specifier} crosses into ${target.path}; use the registered # alias.`));
+                    }
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'IMP-ALIAS-CFG',
+        ruleRevision: 'd66bbf9724c5328b4a6ef1906a9d4b365af27de772d9bfb14fa90a29c65768e2',
+        evaluate(project) {
+            const evidence = [];
+            const expected = new Set(project.policy.aliases.map(({ specifier }) => specifier));
+            const anchor = project.filesByPath.get('index.ts') ?? production(project)[0];
+            for (const alias of project.policy.aliases) {
+                const actualTypescript = project.configuration.typescriptAliases[alias.specifier];
+                const expectedTypescript = [alias.typescriptTarget];
+                if (!actualTypescript ||
+                    actualTypescript.length !== 1 ||
+                    actualTypescript[0] !== expectedTypescript[0]) {
+                    evidence.push(rootEvidence(anchor, `TypeScript alias ${alias.specifier} must be exactly ${JSON.stringify(expectedTypescript)}.`));
+                }
+                if (project.configuration.packageAliases[alias.specifier] !== alias.packageTarget) {
+                    evidence.push(rootEvidence(anchor, `Package alias ${alias.specifier} must be exactly ${alias.packageTarget}.`));
+                }
+            }
+            for (const specifier of Object.keys(project.configuration.typescriptAliases)) {
+                if (specifier.startsWith('#') && !expected.has(specifier)) {
+                    evidence.push(rootEvidence(anchor, `Undeclared TypeScript alias ${specifier}.`));
+                }
+            }
+            for (const specifier of Object.keys(project.configuration.packageAliases)) {
+                if (specifier.startsWith('#') && !expected.has(specifier)) {
+                    evidence.push(rootEvidence(anchor, `Undeclared package alias ${specifier}.`));
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'IMP-STATIC',
+        ruleRevision: '41f0234cf5774884aaa5b3c4d23deb79e7bc524e964b60ec9d5bd4539d11ec9c',
+        evaluate(project) {
+            return production(project).flatMap((file) => file.dependencyIssues.flatMap(({ kind, node }) => {
+                if (kind === 'require' &&
+                    ts.isCallExpression(node) &&
+                    ts.isIdentifier(node.expression) &&
+                    isLocallyBoundIdentifier(node.expression)) {
+                    return [];
+                }
+                return [
+                    violation(file, node, kind === 'require'
+                        ? 'Production dependency uses require instead of analyzable ESM.'
+                        : kind === 'import-equals'
+                            ? 'Production dependency uses import-equals instead of analyzable ESM.'
+                            : 'Production dependency uses a nonliteral dynamic import.'),
+                ];
+            }));
+        },
+    },
+    {
+        id: 'QLT-CANON-VALUES',
+        ruleRevision: '2e236d7a521c771be8eace5689d10a52ae390f5d1071add401d749679d22b023',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project)) {
+                visit(file.source, (node) => {
+                    if (!ts.isAsExpression(node) && !ts.isTypeAssertionExpression(node))
+                        return;
+                    const type = node.type;
+                    const name = ts.isTypeReferenceNode(type)
+                        ? canonicalTypeName(file, type.typeName)
+                        : undefined;
+                    if (name && CANONICAL_TYPES.has(name)) {
+                        evidence.push(violation(file, node, `Unchecked cast fabricates canonical ${name}; use its owning constructor or decoder.`));
+                    }
+                });
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'QLT-DEF-IDS',
+        ruleRevision: '0c51a2194d039facdb5833a288b4ec2eadea94bbd0afb02bd1065994592c6c07',
+        evaluate(project) {
+            const evidence = [];
+            const owners = new Map();
+            const definitions = [
+                { layer: 'queries', name: 'defineQuery', members: [undefined, 'composite'] },
+                { layer: 'mutations', name: 'defineMutation', members: [undefined] },
+                { layer: 'migrations', name: 'defineMigration', members: [undefined] },
+            ];
+            for (const definition of definitions) {
+                for (const file of production(project, definition.layer)) {
+                    for (const member of definition.members) {
+                        for (const candidate of definitionObjects(file, definition.name, member, SDK_MODULES)) {
+                            const uncertain = definitionOriginAmbiguity(file, candidate, `${definition.name}${member ? `.${member}` : ''} definition`);
+                            if (uncertain) {
+                                evidence.push(uncertain);
+                                continue;
+                            }
+                            const { call, object } = candidate;
+                            if (!isTopLevelDefinition(call))
+                                continue;
+                            if (!object) {
+                                evidence.push(ambiguity(file, call, `${definition.name}${member ? `.${member}` : ''} input is not a static object literal.`));
+                                continue;
+                            }
+                            const idExpression = propertyExpression(object, 'id');
+                            const id = idExpression &&
+                                (ts.isStringLiteral(idExpression) ||
+                                    ts.isNoSubstitutionTemplateLiteral(idExpression))
+                                ? idExpression.text
+                                : undefined;
+                            if (!idExpression || !id || !STABLE_DEFINITION_ID.test(id)) {
+                                evidence.push(violation(file, idExpression ?? object, `${definition.name}${member ? `.${member}` : ''} ID must be a stable semantic literal.`));
+                                continue;
+                            }
+                            const key = `${definition.layer}\0${id}`;
+                            const prior = owners.get(key);
+                            if (prior) {
+                                evidence.push(violation(file, idExpression, `${definition.layer} definition ID ${id} is duplicated; first declared in ${prior.file.path}.`));
+                            }
+                            else
+                                owners.set(key, { file, node: idExpression });
+                        }
+                    }
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'NODE-INHERITED',
+        ruleRevision: '0687b60d058bceb2c9833c6279c0e41543ea0e4d3b4a086ee95e8cb9c2275ef4',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project, 'schema')) {
+                for (const definition of definitionObjects(file, 'nodeClass', undefined, DSL_MODULES)) {
+                    const uncertain = definitionOriginAmbiguity(file, definition, 'nodeClass declaration');
+                    if (uncertain) {
+                        evidence.push(uncertain);
+                        continue;
+                    }
+                    const { call, object } = definition;
+                    if (!object) {
+                        if (call.arguments.length > 0) {
+                            evidence.push(ambiguity(file, call, 'nodeClass input is not a static object literal.'));
+                        }
+                        continue;
+                    }
+                    const properties = propertyExpression(object, 'properties');
+                    if (!properties)
+                        continue;
+                    if (!ts.isObjectLiteralExpression(properties)) {
+                        evidence.push(ambiguity(file, properties, 'Node properties are not a static object literal.'));
+                        continue;
+                    }
+                    for (const property of properties.properties) {
+                        if (!('name' in property) || !property.name)
+                            continue;
+                        const name = ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)
+                            ? property.name.text
+                            : undefined;
+                        if (name && INHERITED.has(name)) {
+                            evidence.push(violation(file, property, `Node Class redeclares inherited property ${name}.`));
+                        }
+                    }
+                }
+            }
+            return evidence;
+        },
+    },
+    {
+        id: 'DOM-PUBLIC-DEPS',
+        ruleRevision: '32b41eefe565343a4c5d18ef2c22c428912c71771bfda4b6da52d3c1f62bbbf5',
+        evaluate(project) {
+            const evidence = [];
+            const graphLayers = new Set(['schema', 'queries', 'mutations']);
+            const dependencyPackages = new Set();
+            for (const file of production(project, 'schema')) {
+                for (const definition of definitionObjects(file, 'defineSchema', undefined, DSL_MODULES, 1)) {
+                    const uncertain = definitionOriginAmbiguity(file, definition, 'Schema definition');
+                    if (uncertain) {
+                        evidence.push(uncertain);
+                        continue;
+                    }
+                    const { call, object } = definition;
+                    if (!object) {
+                        evidence.push(ambiguity(file, call, 'defineSchema contract is not a static object literal.'));
+                        continue;
+                    }
+                    const dependencies = propertyExpression(object, 'dependencies');
+                    if (!dependencies)
+                        continue;
+                    if (!ts.isArrayLiteralExpression(dependencies)) {
+                        evidence.push(ambiguity(file, dependencies, 'Schema dependencies are not a static array.'));
+                        continue;
+                    }
+                    for (const element of dependencies.elements) {
+                        const symbol = importedSymbol(file, unwrap(element));
+                        if ((symbol?.module === '@astrale-os/kernel-core/schema' ||
+                            symbol?.module === '@astrale-os/sdk/schema/kernel') &&
+                            symbol.name === 'KernelSchema') {
+                            continue;
+                        }
+                        if (symbol && isForeignDomain(symbol.module))
+                            dependencyPackages.add(packageRoot(symbol.module));
+                        else
+                            evidence.push(ambiguity(file, element, 'Schema dependency cannot be mapped to one foreign Domain facade.'));
+                    }
+                }
+            }
+            const referenced = new Map();
+            for (const file of production(project)) {
+                if (!graphLayers.has(file.layer ?? ''))
+                    continue;
+                for (const sourceImport of file.imports) {
+                    if (isForeignDomain(sourceImport.specifier)) {
+                        referenced.set(packageRoot(sourceImport.specifier), { file, node: sourceImport.node });
+                    }
+                }
+            }
+            for (const [foreignPackage, reference] of referenced) {
+                if (!dependencyPackages.has(foreignPackage)) {
+                    evidence.push(violation(reference.file, reference.node, `Graph reference to ${foreignPackage} lacks one exact defineSchema dependency.`));
+                }
+            }
+            return evidence;
+        },
+    },
+];
+const STABLE_DEFINITION_ID = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/;
+function rootEvidence(file, evidence) {
+    return file ? violation(file, file.source, evidence) : { kind: 'violation', evidence };
+}
+function rootIdForPath(project, path) {
+    return project.policy.rootFiles.find(({ sourcePath }) => sourcePath === path)?.id;
+}
+function isTopLevelDefinition(node) {
+    let current = node.parent;
+    while (current) {
+        if (ts.isFunctionLike(current))
+            return false;
+        if (ts.isSourceFile(current))
+            return true;
+        current = current.parent;
+    }
+    return false;
+}
+function compositionPackage(specifier) {
+    return (specifier === '@astrale-os/sdk' ||
+        specifier.startsWith('@astrale-os/sdk/') ||
+        specifier === '@astrale-os/kernel-core' ||
+        specifier.startsWith('@astrale-os/kernel-core/') ||
+        specifier === '@astrale-os/kernel-dsl' ||
+        specifier.startsWith('@astrale-os/kernel-dsl/'));
+}
+function directKernelAuthoringImport(specifier) {
+    return (specifier === '@astrale-os/kernel-core' ||
+        specifier.startsWith('@astrale-os/kernel-core/') ||
+        specifier === '@astrale-os/kernel-dsl' ||
+        specifier.startsWith('@astrale-os/kernel-dsl/'));
+}
+function schemaAuthoringModule(module) {
+    return (module === '@astrale-os/sdk/schema' ||
+        module === '@astrale-os/kernel-dsl' ||
+        module.startsWith('@astrale-os/kernel-dsl/'));
+}
+function graphAuthoringModule(module) {
+    return module.startsWith('@astrale-os/sdk/graph') || canonicalModule(module);
+}
+function compositionStatement(file, statement) {
+    if (ts.isImportDeclaration(statement) ||
+        ts.isExportDeclaration(statement) ||
+        ts.isInterfaceDeclaration(statement) ||
+        ts.isTypeAliasDeclaration(statement) ||
+        ts.isEmptyStatement(statement)) {
+        return true;
+    }
+    if (ts.isVariableStatement(statement)) {
+        return statement.declarationList.declarations.every((declaration) => {
+            if (!declaration.initializer)
+                return false;
+            const value = unwrap(declaration.initializer);
+            if (ts.isObjectLiteralExpression(value)) {
+                return ts.isIdentifier(declaration.name) && COMPOSITION_BINDING.test(declaration.name.text);
+            }
+            if (!ts.isCallExpression(value))
+                return false;
+            return isDomainDefinitionCall(file, value);
+        });
+    }
+    if (ts.isExportAssignment(statement)) {
+        const value = unwrap(statement.expression);
+        if (ts.isIdentifier(value))
+            return COMPOSITION_BINDING.test(value.text);
+        return ts.isCallExpression(value) && isDomainDefinitionCall(file, value);
+    }
+    return false;
+}
+function isDomainDefinitionCall(file, call) {
+    const expression = unwrap(call.expression);
+    const direct = importedSymbol(file, expression);
+    if (direct?.module.startsWith('@astrale-os/sdk') &&
+        (direct.name === 'defineApplication' || direct.name === 'defineRuntime')) {
+        return true;
+    }
+    if (!ts.isCallExpression(expression))
+        return false;
+    const factory = importedSymbol(file, expression.expression);
+    return factory?.name === 'defineRuntime' && factory.module.startsWith('@astrale-os/sdk');
+}
+const COMPOSITION_BINDING = /^(?:actions|application|integrations|providers|runtime|workflows)$/i;
+function importForLocalBinding(file, localName) {
+    return file.imports.find(({ bindings, namespace }) => namespace === localName || [...bindings.values()].includes(localName));
+}
+function layerCompositionNames(project, file) {
+    const names = new Set();
+    for (const statement of file.source.statements) {
+        if (!ts.isVariableStatement(statement) || !hasExportModifier(statement))
+            continue;
+        for (const declaration of statement.declarationList.declarations) {
+            if (ts.isIdentifier(declaration.name) &&
+                declaration.initializer &&
+                layerCompositionObject(project, file, declaration.initializer)) {
+                names.add(declaration.name.text);
+            }
+        }
+    }
+    return names;
+}
+function layerCompositionStatement(statement, compositionNames) {
+    if (ts.isVariableStatement(statement) &&
+        hasExportModifier(statement) &&
+        statement.declarationList.declarations.every(({ name }) => ts.isIdentifier(name) && compositionNames.has(name.text))) {
+        return true;
+    }
+    if (!ts.isTypeAliasDeclaration(statement) || !hasExportModifier(statement))
+        return false;
+    let derivesFromComposition = false;
+    visit(statement.type, (node) => {
+        if (ts.isTypeQueryNode(node) &&
+            ts.isIdentifier(node.exprName) &&
+            compositionNames.has(node.exprName.text)) {
+            derivesFromComposition = true;
+        }
+    });
+    return derivesFromComposition;
+}
+function layerCompositionObject(project, file, expression) {
+    let target = unwrap(expression);
+    if (ts.isCallExpression(target) &&
+        target.arguments.length === 1 &&
+        ts.isPropertyAccessExpression(unwrap(target.expression)) &&
+        unwrap(target.expression).getText(file.source) === 'Object.freeze') {
+        target = unwrap(target.arguments[0]);
+    }
+    if (!ts.isObjectLiteralExpression(target))
+        return false;
+    const owners = new Set();
+    for (const property of target.properties) {
+        const value = ts.isShorthandPropertyAssignment(property)
+            ? property.name
+            : ts.isPropertyAssignment(property)
+                ? unwrap(property.initializer)
+                : undefined;
+        if (!value || !ts.isIdentifier(value))
+            return false;
+        const sourceImport = importForLocalBinding(file, value.text);
+        const imported = sourceImport && resolveProjectImport(project, file, sourceImport.specifier);
+        if (!imported?.submodule || imported.layer !== file.layer)
+            return false;
+        owners.add(imported.submodule);
+    }
+    return owners.size >= 2;
+}
+function hasExportModifier(node) {
+    return ts.canHaveModifiers(node)
+        ? (ts.getModifiers(node)?.some(({ kind }) => kind === ts.SyntaxKind.ExportKeyword) ?? false)
+        : false;
+}
+function canonicalTypeName(file, name) {
+    if (ts.isIdentifier(name)) {
+        const symbol = importedSymbol(file, name);
+        return symbol && CANONICAL_TYPES.has(symbol.name) && canonicalModule(symbol.module)
+            ? symbol.name
+            : undefined;
+    }
+    const left = leftmostTypeName(name);
+    const sourceImport = file.imports.find(({ namespace }) => namespace === left);
+    return sourceImport &&
+        CANONICAL_TYPES.has(name.right.text) &&
+        canonicalModule(sourceImport.specifier)
+        ? name.right.text
+        : undefined;
+}
+function leftmostTypeName(name) {
+    return ts.isIdentifier(name) ? name.text : leftmostTypeName(name.left);
+}
+function canonicalModule(module) {
+    return (module === '@astrale-os/kernel-core' ||
+        module.startsWith('@astrale-os/kernel-core/') ||
+        module === '@astrale-os/sdk/auth' ||
+        module === '@astrale-os/sdk/mutation' ||
+        module === '@astrale-os/sdk/query' ||
+        module.startsWith('@astrale-os/sdk/graph'));
+}