@getarbiter/cli 0.5.0

package/dist/templates/boundaries/.eslintrc-boundaries.cjs.ejs

@@ -0,0 +1,81 @@
+// .eslintrc-boundaries.cjs — generated by arbiter (M22a)
+// #2272: retained for tooling that still reads eslintrc-format config. The
+// `boundaries` gate itself runs eslint.config.boundaries.mjs (flat config,
+// ESLint v9 removed the legacy --no-eslintrc/-c loader this file needs).
+// Wire in your root ESLint config: extends: ['./.eslintrc-boundaries.cjs']
+// Re-generate: arbiter update
+// Peer deps: npm i -D eslint@^9 eslint-plugin-boundaries @typescript-eslint/parser
+
+/** @type {import('eslint').Linter.Config} */
+module.exports = {
+  parser: '@typescript-eslint/parser',
+  plugins: ['boundaries'],
+  settings: {
+    'boundaries/elements': [
+      { type: 'domain',         pattern: 'src/domain/**' },
+      { type: 'application',   pattern: 'src/application/**' },
+      { type: 'adapters',      pattern: 'src/adapters/**' },
+      { type: 'infrastructure',pattern: 'src/infrastructure/**' },
+    ],
+    'boundaries/include': ['src/**/*.ts', 'src/**/*.tsx'],
+  },
+  rules: {
+    // Layer isolation — default deny; only listed directions allowed
+    'boundaries/element-types': ['error', {
+      default: 'disallow',
+      rules: [
+        { from: 'domain',         allow: [] },
+        { from: 'application',   allow: ['domain'] },
+        { from: 'adapters',      allow: ['application', 'domain'] },
+        { from: 'infrastructure',allow: ['application', 'domain'] },
+      ],
+    }],
+    // No framework/I-O imports in domain via external modules
+    'boundaries/external': ['error', {
+      default: 'allow',
+      rules: [
+        {
+          from: ['domain'],
+          disallow: [
+            'express', 'fastify', 'koa', 'hapi',
+            'react', 'react-dom', 'next', 'vue', 'svelte', 'angular',
+            '@nestjs/*', '@angular/*',
+            'typeorm', 'prisma', '@prisma/*', 'mongoose', 'sequelize',
+            'axios', 'got', 'node-fetch', 'ky',
+            'node:fs', 'node:path', 'node:http', 'node:https',
+            'node:crypto', 'node:os', 'node:child_process', 'node:stream',
+          ],
+        },
+      ],
+    }],
+    'boundaries/no-unknown': 'error',
+    'boundaries/no-unknown-files': 'warn',
+  },
+  overrides: [
+    {
+      // Domain layer: pure of all I/O — no Node built-ins, no browser globals
+      files: ['src/domain/**/*.ts', 'src/domain/**/*.tsx'],
+      rules: {
+        'no-restricted-imports': ['error', {
+          patterns: [
+            { group: ['fs', 'path', 'http', 'https', 'crypto', 'os', 'child_process', 'stream', 'events', 'buffer'],
+              message: 'Domain must not import Node built-ins.' },
+            { group: ['node:fs', 'node:path', 'node:http', 'node:https', 'node:crypto', 'node:os', 'node:child_process', 'node:stream', 'node:events', 'node:buffer'],
+              message: 'Domain must not import Node built-ins.' },
+          ],
+        }],
+        'no-restricted-globals': ['error',
+          { name: 'window',          message: 'Domain must not reference browser globals.' },
+          { name: 'document',        message: 'Domain must not reference browser globals.' },
+          { name: 'localStorage',    message: 'Domain must not reference browser globals.' },
+          { name: 'sessionStorage',  message: 'Domain must not reference browser globals.' },
+          { name: 'fetch',           message: 'Use a port abstraction; domain must not call fetch directly.' },
+          { name: 'navigator',       message: 'Domain must not reference browser globals.' },
+          { name: 'location',        message: 'Domain must not reference browser globals.' },
+          { name: 'history',         message: 'Domain must not reference browser globals.' },
+          { name: 'XMLHttpRequest',  message: 'Domain must not reference browser globals.' },
+        ],
+      },
+    },
+  ],
+};

package/dist/templates/boundaries/.eslintrc-frontend-spa.cjs.ejs

@@ -0,0 +1,79 @@
+<%
+// #1127: framework-aware FSD boundary config.
+// Source of truth: config.frontend.framework ('react'|'vue'|'svelte'|undefined).
+// Default (undefined): react-like glob set — safe for undetected/unknown frameworks.
+const _fw = (typeof frontend !== 'undefined' && frontend && frontend.framework)
+  ? frontend.framework
+  : 'react'
+
+const _globs = _fw === 'vue'
+  ? ['src/**/*.ts', 'src/**/*.vue']
+  : _fw === 'svelte'
+  ? ['src/**/*.ts', 'src/**/*.svelte']
+  : ['src/**/*.ts', 'src/**/*.tsx', 'src/**/*.jsx']
+
+// #2277: resolver extensions track the framework the same way _globs does, and
+// are dual-tracked with the flat twin (eslint.config.frontend-spa.mjs) that the
+// fsd-boundaries gate actually runs.
+// Extensions mirror _globs exactly (plus plain .js): a vue/svelte FSD project's
+// boundaries/include never covers .tsx, so resolving to one could not classify it
+// into an element anyway — and #1127 requires those renders not to mention .tsx.
+const _resolverExts = _fw === 'vue'
+  ? ['.ts', '.vue', '.js']
+  : _fw === 'svelte'
+  ? ['.ts', '.svelte', '.js']
+  : ['.ts', '.tsx', '.js', '.jsx']
+const _resolverExtsLiteral = '[' + _resolverExts.map((e) => `'${e}'`).join(', ') + ']'
+
+const _a11yPlugin = _fw === 'vue'
+  ? 'vuejs-accessibility'
+  : _fw === 'svelte'
+  ? 'svelte'
+  : 'jsx-a11y'
+%>
+// .eslintrc-frontend-spa.cjs — generated by arbiter (#1127)
+// Framework: <%- _fw %>
+// Wire in your root ESLint config: extends: ['./.eslintrc-frontend-spa.cjs']
+// Re-generate: arbiter update
+// Peer deps (react):   npm i -D eslint@^9 eslint-plugin-boundaries eslint-plugin-jsx-a11y @typescript-eslint/parser
+// Peer deps (vue):     npm i -D eslint@^9 eslint-plugin-boundaries eslint-plugin-vuejs-accessibility @typescript-eslint/parser
+// Peer deps (svelte):  npm i -D eslint@^9 eslint-plugin-boundaries eslint-plugin-svelte @typescript-eslint/parser
+
+/** @type {import('eslint').Linter.Config} */
+module.exports = {
+  parser: '@typescript-eslint/parser',
+  plugins: ['boundaries', '<%- _a11yPlugin %>'],
+  settings: {
+    'boundaries/elements': [
+      { type: 'app',      pattern: 'src/app/**' },
+      { type: 'pages',    pattern: 'src/pages/**' },
+      { type: 'widgets',  pattern: 'src/widgets/**' },
+      { type: 'features', pattern: 'src/features/**' },
+      { type: 'entities', pattern: 'src/entities/**' },
+      { type: 'shared',   pattern: 'src/shared/**' },
+    ],
+    'boundaries/include': <%- JSON.stringify(_globs) %>,
+    // #2277: without this, eslint-plugin-boundaries' bundled
+    // eslint-import-resolver-node cannot resolve an extensionless relative import
+    // ('../entities/user') to a .ts file, so every legitimate cross-layer import
+    // classifies as "unknown" and boundaries/no-unknown false-positives on clean,
+    // rule-compliant FSD code. Same setting as the flat twin the gate runs.
+    'import/resolver': { node: { extensions: <%- _resolverExtsLiteral %> } },
+  },
+  rules: {
+    // FSD layer isolation — higher layers may only import from lower layers
+    'boundaries/element-types': ['error', {
+      default: 'disallow',
+      rules: [
+        { from: 'app',      allow: ['pages', 'widgets', 'features', 'entities', 'shared'] },
+        { from: 'pages',    allow: ['widgets', 'features', 'entities', 'shared'] },
+        { from: 'widgets',  allow: ['features', 'entities', 'shared'] },
+        { from: 'features', allow: ['entities', 'shared'] },
+        { from: 'entities', allow: ['shared'] },
+        { from: 'shared',   allow: [] },
+      ],
+    }],
+    'boundaries/no-unknown': 'error',
+    'boundaries/no-unknown-files': 'warn',
+  },
+};

package/dist/templates/boundaries/.importlinter.ejs

@@ -0,0 +1,48 @@
+# .importlinter — generated by arbiter (M22d)
+# Enforces hexagonal layer dependency direction using import-linter.
+# Docs: https://import-linter.readthedocs.io/
+#
+# TODO: replace `yourpkg` below with your actual top-level package name.
+# arbiter cannot auto-detect this reliably across src-layout, flat-layout,
+# and namespace-package projects. Edit once, commit, forget.
+#
+# Run: pip install import-linter && lint-imports
+
+[importlinter]
+root_packages =
+    yourpkg
+
+[importlinter:contract:layers]
+name = Hexagonal layer dependency direction
+type = layers
+layers =
+    yourpkg.infrastructure
+    yourpkg.adapters
+    yourpkg.application
+    yourpkg.domain
+# Layers are listed high to low. Each layer may import only from layers below it.
+# domain imports nothing; application imports only domain; adapters import
+# application + domain; infrastructure may import anything.
+
+[importlinter:contract:domain-purity]
+name = Domain must not import frameworks
+type = forbidden
+source_modules =
+    yourpkg.domain
+forbidden_modules =
+    django
+    flask
+    fastapi
+    starlette
+    sqlalchemy
+    tortoise
+    peewee
+    pymongo
+    redis
+    requests
+    httpx
+    aiohttp
+    celery
+    boto3
+    psycopg
+    asyncpg

package/dist/templates/boundaries/check-boundaries-go.mjs.ejs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+// check-boundaries.mjs — generated by arbiter (M22c)
+// Peer deps: golangci-lint >= 2.0
+import { spawnSync } from 'node:child_process';
+import { readdirSync, readFileSync, existsSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+let failed = 0;
+
+// ─── Layer 1: Domain purity scan (pure Node — no external deps) ──────────────
+// Scans internal/domain/**/*.go for forbidden framework import paths.
+// Runs first so this gate works without golangci-lint installed (e.g. in CI
+// matrix tests). Mirrors eslint-plugin-boundaries' role in M22a and the
+// domain-purity grep in M22b.
+const BANNED_MODULES = [
+  'gorm.io/',               // gorm.io/gorm, gorm.io/driver/...
+  'github.com/gin-gonic/',  // github.com/gin-gonic/gin
+  'github.com/labstack/echo', // echo and echo/v4 (no trailing / catches both)
+  'github.com/gofiber/fiber/', // fiber/v2, fiber/v3
+  'go.uber.org/fx',
+  'go.uber.org/zap',
+  'github.com/go-sql-driver/', // go-sql-driver/mysql
+  'github.com/lib/pq',
+  'github.com/jackc/pgx/',  // pgx/v4, pgx/v5
+];
+const bannedRe = new RegExp(
+  `"(${BANNED_MODULES.map(m => m.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')})`,
+);
+const violations = [];
+
+// Cycle guard (#1555): track visited real directories by device:inode so a
+// hardlink / bind-mount cycle under the domain tree terminates instead of
+// recursing forever and OOM-ing the consumer's CI/hook. Symlinked entries are
+// never descended (and symlinked source files never read), mirroring the
+// dependency-free policy #1521 standardized for arbiter's own walkers.
+const visitedDomainDirs = new Set();
+
+function scanDomain(dir) {
+  if (!existsSync(dir)) {
+    process.stdout.write(`check-boundaries: internal/domain/ not found — skipping domain purity scan\n`);
+    return;
+  }
+  let dirStat;
+  try {
+    dirStat = statSync(dir);
+  } catch {
+    return;
+  }
+  const key = `${dirStat.dev}:${dirStat.ino}`;
+  if (visitedDomainDirs.has(key)) return;
+  visitedDomainDirs.add(key);
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      scanDomain(full);
+    } else if (entry.name.endsWith('.go')) {
+      const src = readFileSync(full, 'utf-8');
+      for (const line of src.split('\n')) {
+        if (bannedRe.test(line)) violations.push(`${full}: ${line.trim()}`);
+      }
+    }
+  }
+}
+
+scanDomain('internal/domain');
+
+if (violations.length > 0) {
+  process.stderr.write('check-boundaries: domain purity violations found:\n');
+  for (const v of violations) process.stderr.write(`  ${v}\n`);
+  failed++;
+}
+
+// ─── Layer 2: depguard via golangci-lint (import boundary rules) ─────────────
+const lint = spawnSync(
+  'golangci-lint',
+  ['run', '--config', '.golangci-boundaries.yml', './...'],
+  { encoding: 'utf-8', shell: false },
+);
+if (lint.error) {
+  process.stderr.write(`check-boundaries: failed to spawn 'golangci-lint': ${lint.error.message}\n`);
+  failed++;
+} else if (lint.signal !== null) {
+  process.stderr.write(`check-boundaries: 'golangci-lint' killed by signal ${lint.signal}\n`);
+  if (lint.stdout) process.stdout.write(lint.stdout);
+  if (lint.stderr) process.stderr.write(lint.stderr);
+  failed++;
+} else if (lint.status !== 0) {
+  if (lint.stdout) process.stdout.write(lint.stdout);
+  if (lint.stderr) process.stderr.write(lint.stderr);
+  failed++;
+}
+
+process.exit(failed > 0 ? 1 : 0);

package/dist/templates/boundaries/check-boundaries-python.mjs.ejs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+// check-boundaries.mjs — generated by arbiter (M22d)
+// Peer deps: pip install import-linter
+import { spawnSync } from 'node:child_process';
+import { readdirSync, readFileSync, existsSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+let failed = 0;
+
+// ─── Layer 1: Domain purity scan (pure Node — no external deps) ──────────────
+// Runs first so this gate is verifiable without Python tooling installed
+// (matrix tests, bootstrap CI). Mirrors M22a/M22b L1 grep approach. Scans
+// src/domain/**/*.py for framework imports. Application layer not scanned —
+// async ports may legitimately reference httpx/asyncio in Protocol/ABC signatures.
+const BANNED_PREFIXES = [
+  'django', 'flask', 'fastapi', 'starlette',
+  'sqlalchemy', 'tortoise', 'peewee',
+  'pymongo', 'redis',
+  'requests', 'httpx', 'aiohttp',
+  'celery', 'boto3', 'psycopg', 'asyncpg',
+];
+// Python import forms:
+//   import X
+//   import X.Y
+//   import X as y
+//   from X import ...
+//   from X.Y import ...
+// The banned prefix always follows `from ` or `import ` at line start.
+// Terminator (?:\.|[\s(]|$) ensures `sqlalchemy_utils` does not match `sqlalchemy`.
+const bannedRe = new RegExp(
+  `^\\s*(?:from|import)\\s+(${BANNED_PREFIXES.join('|')})(?:\\.|[\\s(]|$)`,
+);
+const violations = [];
+
+// Cycle guard (#1555): track visited real directories by device:inode so a
+// hardlink / bind-mount cycle under the domain tree terminates instead of
+// recursing forever and OOM-ing the consumer's CI/hook. Symlinked entries are
+// never descended (and symlinked source files never read), mirroring the
+// dependency-free policy #1521 standardized for arbiter's own walkers.
+const visitedDomainDirs = new Set();
+
+function scanDomain(dir) {
+  if (!existsSync(dir)) {
+    process.stdout.write(`check-boundaries: src/domain/ not found — skipping domain purity scan\n`);
+    return;
+  }
+  let dirStat;
+  try {
+    dirStat = statSync(dir);
+  } catch {
+    return;
+  }
+  const key = `${dirStat.dev}:${dirStat.ino}`;
+  if (visitedDomainDirs.has(key)) return;
+  visitedDomainDirs.add(key);
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      scanDomain(full);
+    } else if (entry.name.endsWith('.py')) {
+      const src = readFileSync(full, 'utf-8');
+      for (const line of src.split('\n')) {
+        if (bannedRe.test(line)) violations.push(`${full}: ${line.trim()}`);
+      }
+    }
+  }
+}
+
+scanDomain('src/domain');
+
+if (violations.length > 0) {
+  process.stderr.write('check-boundaries: domain purity violations found:\n');
+  for (const v of violations) process.stderr.write(`  ${v}\n`);
+  failed++;
+}
+
+// ─── Layer 2: import-linter (dotted-module layer contracts) ──────────────────
+const lintImports = spawnSync(
+  'lint-imports',
+  ['--config', '.importlinter'],
+  { encoding: 'utf-8', shell: false },
+);
+if (lintImports.error) {
+  process.stderr.write(`check-boundaries: failed to spawn 'lint-imports': ${lintImports.error.message}\n`);
+  failed++;
+} else if (lintImports.signal !== null) {
+  process.stderr.write(`check-boundaries: 'lint-imports' killed by signal ${lintImports.signal}\n`);
+  if (lintImports.stdout) process.stdout.write(lintImports.stdout);
+  if (lintImports.stderr) process.stderr.write(lintImports.stderr);
+  failed++;
+} else if (lintImports.status !== 0) {
+  if (lintImports.stdout) process.stdout.write(lintImports.stdout);
+  if (lintImports.stderr) process.stderr.write(lintImports.stderr);
+  failed++;
+}
+
+// ─── Layer 3: ruff banned-api scoped to src/domain/ ──────────────────────────
+const ruff = spawnSync(
+  'ruff',
+  ['check', '--config', 'ruff-boundaries.toml', 'src/domain/'],
+  { encoding: 'utf-8', shell: false },
+);
+if (ruff.error) {
+  process.stderr.write(`check-boundaries: failed to spawn 'ruff': ${ruff.error.message}\n`);
+  failed++;
+} else if (ruff.signal !== null) {
+  process.stderr.write(`check-boundaries: 'ruff' killed by signal ${ruff.signal}\n`);
+  if (ruff.stdout) process.stdout.write(ruff.stdout);
+  if (ruff.stderr) process.stderr.write(ruff.stderr);
+  failed++;
+} else if (ruff.status !== 0) {
+  if (ruff.stdout) process.stdout.write(ruff.stdout);
+  if (ruff.stderr) process.stderr.write(ruff.stderr);
+  failed++;
+}
+
+process.exit(failed > 0 ? 1 : 0);

package/dist/templates/boundaries/check-boundaries-rust.mjs.ejs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// check-boundaries.mjs — generated by arbiter (M22b)
+// Peer deps: cargo install cargo-deny
+import { spawnSync } from 'node:child_process';
+import { readdirSync, readFileSync, existsSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+let failed = 0;
+
+// ─── Layer 1: Domain purity scan (pure Node — no external deps) ──────────────
+// Run first so this gate can be verified without cargo installed (e.g. in CI
+// matrix tests). Mirrors eslint-plugin-boundaries' role in M22a: scans
+// src/domain/**/*.rs for forbidden framework `use` statements. Application
+// layer not scanned — async ports legitimately reference tokio:: in trait signatures.
+const BANNED_PREFIXES = [
+  'sqlx', 'diesel', 'sea_orm', 'axum', 'actix_web',
+  'reqwest', 'tonic', 'rocket', 'warp', 'hyper',
+];
+// Matches bare `use crate::` and re-exports `pub use crate::` / `pub(crate) use crate::`.
+const bannedRe = new RegExp(
+  `^\\s*(?:pub(?:\\([^)]*\\))?\\s+)?use\\s+(${BANNED_PREFIXES.join('|')})[;:]`,
+);
+const violations = [];
+
+// Cycle guard (#1555): track visited real directories by device:inode so a
+// hardlink / bind-mount cycle under the domain tree terminates instead of
+// recursing forever and OOM-ing the consumer's CI/hook. Symlinked entries are
+// never descended (and symlinked source files never read), mirroring the
+// dependency-free policy #1521 standardized for arbiter's own walkers.
+const visitedDomainDirs = new Set();
+
+function scanDomain(dir) {
+  if (!existsSync(dir)) {
+    process.stdout.write(`check-boundaries: src/domain/ not found — skipping domain purity scan\n`);
+    return;
+  }
+  let dirStat;
+  try {
+    dirStat = statSync(dir);
+  } catch {
+    return;
+  }
+  const key = `${dirStat.dev}:${dirStat.ino}`;
+  if (visitedDomainDirs.has(key)) return;
+  visitedDomainDirs.add(key);
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      scanDomain(full);
+    } else if (entry.name.endsWith('.rs')) {
+      const src = readFileSync(full, 'utf-8');
+      for (const line of src.split('\n')) {
+        if (bannedRe.test(line)) violations.push(`${full}: ${line.trim()}`);
+      }
+    }
+  }
+}
+
+scanDomain('src/domain');
+
+if (violations.length > 0) {
+  process.stderr.write('check-boundaries: domain purity violations found:\n');
+  for (const v of violations) process.stderr.write(`  ${v}\n`);
+  failed++;
+}
+
+// ─── Layer 2: cargo-deny (CVE + license + dep bans) ──────────────────────────
+const deny = spawnSync(
+  'cargo',
+  ['deny', 'check', 'bans', 'advisories', 'licenses'],
+  { encoding: 'utf-8', shell: false },
+);
+if (deny.error) {
+  process.stderr.write(`check-boundaries: failed to spawn 'cargo deny': ${deny.error.message}\n`);
+  failed++;
+} else if (deny.signal !== null) {
+  process.stderr.write(`check-boundaries: 'cargo deny' killed by signal ${deny.signal}\n`);
+  if (deny.stdout) process.stdout.write(deny.stdout);
+  if (deny.stderr) process.stderr.write(deny.stderr);
+  failed++;
+} else if (deny.status !== 0) {
+  if (deny.stdout) process.stdout.write(deny.stdout);
+  if (deny.stderr) process.stderr.write(deny.stderr);
+  failed++;
+}
+
+// ─── Layer 3: clippy disallowed types/methods (enforces clippy.toml) ─────────
+// Runs only the disallowed_* lints from clippy.toml — distinct from the broad
+// L1 `cargo clippy -- -D warnings` which does not apply disallowed_types rules
+// in non-hexagonal projects. Here we target those rules explicitly.
+const clippy = spawnSync(
+  'cargo',
+  ['clippy', '--', '-D', 'clippy::disallowed_types', '-D', 'clippy::disallowed_methods', '-D', 'clippy::disallowed_macros'],
+  { encoding: 'utf-8', shell: false },
+);
+if (clippy.error) {
+  process.stderr.write(`check-boundaries: failed to spawn 'cargo clippy': ${clippy.error.message}\n`);
+  failed++;
+} else if (clippy.signal !== null) {
+  process.stderr.write(`check-boundaries: 'cargo clippy' killed by signal ${clippy.signal}\n`);
+  if (clippy.stdout) process.stdout.write(clippy.stdout);
+  if (clippy.stderr) process.stderr.write(clippy.stderr);
+  failed++;
+} else if (clippy.status !== 0) {
+  if (clippy.stdout) process.stdout.write(clippy.stdout);
+  if (clippy.stderr) process.stderr.write(clippy.stderr);
+  failed++;
+}
+
+process.exit(failed > 0 ? 1 : 0);

package/dist/templates/boundaries/check-boundaries.mjs.ejs

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+// check-boundaries.mjs — generated by arbiter (M22a, flat-config #2272)
+// Requires eslint@^9. Runs eslint.config.boundaries.mjs IN ISOLATION via
+// --config/--no-config-lookup (ESLint v9 flat-config era removed the legacy
+// --no-eslintrc/-c loader — #1491-class fix, mirrors eslint.config.frontend-spa.mjs).
+// The legacy .eslintrc-boundaries.cjs is retained for tooling that still reads
+// eslintrc-format config but is NOT used by this gate.
+import { spawnSync } from 'node:child_process';
+
+const r = spawnSync(
+  'npx',
+  [
+    'eslint',
+    '--config', 'eslint.config.boundaries.mjs',
+    '--no-config-lookup',
+    '--no-error-on-unmatched-pattern',
+    'src/',
+  ],
+  {
+    encoding: 'utf-8',
+    shell: false,
+  }
+);
+if (r.error) {
+  process.stderr.write(`check-boundaries: failed to spawn 'npx eslint': ${r.error.message}\n`);
+  process.exit(1);
+}
+if (r.signal) {
+  process.stderr.write(`check-boundaries: eslint terminated by signal ${r.signal}\n`);
+  process.exit(1);
+}
+if (r.stdout) process.stdout.write(r.stdout);
+if (r.stderr) process.stderr.write(r.stderr);
+process.exit(r.status ?? 1);

package/dist/templates/boundaries/clippy.toml.ejs

@@ -0,0 +1,50 @@
+# clippy.toml — generated by arbiter (M22b + M29)
+# Hexagonal boundary enforcement + pedantic static analysis rules.
+# Run via: cargo clippy -- -D warnings
+# Pedantic: cargo clippy -- -W clippy::pedantic -D warnings
+
+# ── Boundary Enforcement (M22b) ────────────────────────────────────────────
+# Disallow framework types from leaking into any layer.
+# Add suppressions with #[allow(clippy::disallowed_types)] + expiry comment.
+disallowed_types = [
+  # SQLx
+  { path = "sqlx::Pool", reason = "framework type: not allowed in hexagonal domain" },
+  { path = "sqlx::PgPool", reason = "framework type: not allowed in hexagonal domain" },
+  { path = "sqlx::SqlitePool", reason = "framework type: not allowed in hexagonal domain" },
+  # Diesel
+  { path = "diesel::PgConnection", reason = "framework type: not allowed in hexagonal domain" },
+  { path = "diesel::SqliteConnection", reason = "framework type: not allowed in hexagonal domain" },
+  # Axum
+  { path = "axum::Router", reason = "framework type: not allowed in hexagonal domain" },
+  { path = "axum::Extension", reason = "framework type: not allowed in hexagonal domain" },
+  # Actix-web
+  { path = "actix_web::App", reason = "framework type: not allowed in hexagonal domain" },
+  { path = "actix_web::web::Data", reason = "framework type: not allowed in hexagonal domain" },
+  # Reqwest
+  { path = "reqwest::Client", reason = "framework type: not allowed in hexagonal domain" },
+  # Tonic
+  { path = "tonic::transport::Channel", reason = "framework type: not allowed in hexagonal domain" },
+]
+
+disallowed_methods = []
+
+disallowed_macros = [
+  # Actix-web route macros
+  { path = "actix_web::get", reason = "framework macro: not allowed in hexagonal domain" },
+  { path = "actix_web::post", reason = "framework macro: not allowed in hexagonal domain" },
+  # Axum route macros (if used)
+]
+
+# ── Static Analysis (M29) ─────────────────────────────────────────────────
+# Configured here so they can be suppressed per-item with #[allow(...)] + reason.
+[lints.clippy]
+# Correctness & panic safety (baseline — always enabled)
+unwrap_used = "warn"
+expect_used = "warn"
+panic = "warn"
+indexing_slicing = "warn"
+<% if (locals.strictnessTier === 'pedantic') { %>
+# Pedantic quality (enabled by strictnessTier = pedantic)
+pedantic = "warn"
+nursery = "warn"
+<% } %>

package/dist/templates/boundaries/deny.toml.ejs

@@ -0,0 +1,56 @@
+# deny.toml — generated by arbiter (M22b)
+# cargo-deny: CVE hygiene + license policy + framework dep bans
+# Docs: https://embarkstudios.github.io/cargo-deny/
+
+[advisories]
+# Deny known vulnerabilities; update db via `cargo deny fetch`
+version = 2
+yanked = "deny"
+
+[licenses]
+version = 2
+allow = [
+  "MIT",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "ISC",
+  "Unicode-DFS-2016",
+  "Zlib",
+]
+# Uncomment to allow copyleft licenses for internal-only crates
+# allow = ["GPL-3.0"]
+
+[bans]
+version = 2
+# Deny duplicate versions of the same crate (warn by default)
+multiple-versions = "warn"
+
+# Framework crates are banned as *direct* dependencies in domain code.
+# The grep-scan in scripts/check-boundaries.mjs enforces the module-level rule.
+# Add per-crate exceptions below with `[bans.skip]` if needed.
+deny = [
+  # Relational DB / query builders
+  { name = "sqlx" },
+  { name = "diesel" },
+  { name = "sea-orm" },
+  # Web frameworks
+  { name = "axum" },
+  { name = "actix-web" },
+  { name = "rocket" },
+  { name = "warp" },
+  # HTTP client
+  { name = "reqwest" },
+  # gRPC
+  { name = "tonic" },
+  # hyper intentionally excluded: it is a transitive dep of reqwest/axum/tonic,
+  # so banning it directly would break any hexagonal project using those frameworks
+  # in adapters. The grep-scan and disallowed_types enforce domain isolation instead.
+]
+
+[sources]
+version = 2
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]