ark-runtime-kernel 1.3.0 → 1.5.0

package/bin/ark-mcp.mjs

@@ -21,6 +21,11 @@
  * stdin, validates the file content a Write/Edit/MultiEdit is about to produce, and exits
  * 2 with the violations on stderr when the write must be blocked (0 otherwise). This is
  * the copy-paste integration for agent runtimes whose hooks run shell commands.
+ *
+ * --session-context runs one-shot and prints a compact contract summary (layers, rule
+ * count, forbidden globals, baseline state, check command) to stdout. Bind it to a
+ * SessionStart hook so the agent has the architecture in context from the first token,
+ * instead of learning it by rejection.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -39,10 +44,12 @@ function parseArgs(argv) {
     configExplicit: false,
     manifest: undefined,
     hook: false,
+    sessionContext: false,
   };
   for (let i = 2; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--hook') args.hook = true;
+    else if (a === '--session-context') args.sessionContext = true;
     else if (a === '--root') args.root = path.resolve(argv[++i]);
     else if (a === '--config') {
       args.config = argv[++i];
@@ -168,7 +175,27 @@ function runHook(gate, config, args) {
   const result = gate.validate(source, { layer, filePath });
   if (result.valid) return;
 
-  const lines = result.violations.map(
+  // Ratchet semantics (same philosophy as ark-check --baseline): an edit is blocked only
+  // when it ADDS violations relative to the file's current on-disk state. Otherwise a
+  // pre-existing violation — frozen in a baseline or predating Ark adoption — would make
+  // every subsequent edit to that file un-writable while CI passes. Keys ignore line
+  // numbers (edits shift them) and collapse duplicates, mirroring ark-check's baselineKey.
+  const violationKey = (violation) => `${violation.ruleId}|${violation.target ?? violation.message}`;
+  let existingKeys = new Set();
+  try {
+    const current = fs.readFileSync(filePath, 'utf8');
+    existingKeys = new Set(
+      gate.validate(current, { layer, filePath }).violations.map(violationKey)
+    );
+  } catch {
+    // New file: nothing pre-exists, every violation is new.
+  }
+  const newViolations = result.violations.filter(
+    (violation) => !existingKeys.has(violationKey(violation))
+  );
+  if (newViolations.length === 0) return;
+
+  const lines = newViolations.map(
     (violation) =>
       `- [${violation.ruleId}] ${violation.message}${violation.line ? ` (line ${violation.line})` : ''}`
   );
@@ -182,12 +209,65 @@ function runHook(gate, config, args) {
   process.exitCode = 2;
 }
 
+/**
+ * One-shot SessionStart context: a compact summary of the contract on stdout so the
+ * agent starts the session already knowing the architecture. Advisory — never blocks
+ * and never exits non-zero for missing optional inputs (e.g. no baseline file).
+ */
+function printSessionContext(config, profile, forbiddenGlobals, args) {
+  const lines = ['Ark architecture contract governs this project (ark.config.json is authoritative).'];
+
+  const configLayers = Array.isArray(config.layers) ? config.layers : [];
+  if (configLayers.length > 0) {
+    lines.push('Layers:');
+    for (const layer of configLayers) {
+      const globals = forbiddenGlobals[layer.name];
+      const globalsNote = globals ? ` — forbidden globals: ${globals.join(', ')}` : '';
+      lines.push(`  - ${layer.name}: ${(layer.patterns ?? []).join(', ')}${globalsNote}`);
+    }
+  } else {
+    lines.push(
+      `Layers: none configured — the default 11-layer profile applies to intent references.`
+    );
+  }
+
+  const denied = (profile.rules ?? []).filter((rule) => !rule.allowed).length;
+  lines.push(
+    `Rules: ${denied} denied layer edge(s). Full contract: ark://manifest MCP resource.`
+  );
+
+  // Advisory output: a malformed baseline must not abort the summary.
+  let baseline;
+  try {
+    baseline = readJson(path.join(args.root, '.ark-baseline.json'));
+  } catch {
+    baseline = undefined;
+  }
+  if (Array.isArray(baseline?.violations)) {
+    lines.push(
+      `Baseline: ${baseline.violations.length} frozen violation(s) — only NEW violations fail; do not add to them.`
+    );
+  }
+
+  lines.push('After edits run: npx ark-check --root . --config ark.config.json --strict-config');
+  lines.push('If Ark reports violations, fix the architecture instead of weakening the gate.');
+  process.stdout.write(`${lines.join('\n')}\n`);
+}
+
 async function main() {
   const args = parseArgs(process.argv);
+  const configPath = resolveInRoot(args.root, args.config);
+
+  // SessionStart contract injection is only meaningful in Ark-governed projects. Bail
+  // out silently (before loading dist) when there is no config, so the hook is safe
+  // even if a user installs it in their GLOBAL settings instead of per-project.
+  if (args.sessionContext && !(configPath && fs.existsSync(configPath))) {
+    return;
+  }
+
   const ark = await loadArk();
   const ts = await loadOptionalTypeScript();
 
-  const configPath = resolveInRoot(args.root, args.config);
   const config =
     (configPath ? readJson(configPath, { required: args.configExplicit }) : undefined) ?? {
       include: ['src'],
@@ -248,11 +328,28 @@ async function main() {
     });
   }
 
+  // Layer → forbidden ambient globals, straight from ark.config.json. Enforced by the
+  // gate only when the target file's layer is known (same data ark-check enforces in CI).
+  const forbiddenGlobals = Object.fromEntries(
+    configLayers
+      .filter(
+        (layer) =>
+          layer.name &&
+          Array.isArray(layer.forbiddenGlobals) &&
+          layer.forbiddenGlobals.some((entry) => typeof entry === 'string')
+      )
+      .map((layer) => [
+        layer.name,
+        layer.forbiddenGlobals.filter((entry) => typeof entry === 'string'),
+      ])
+  );
+
   const gate = ark.createAICodeGate({
     architectureProfile: profile,
     intents,
     enforceIntentAllowlist: intents.length > 0,
     typescript: ts,
+    forbiddenGlobals,
   });
 
   if (args.hook) {
@@ -260,6 +357,11 @@ async function main() {
     return;
   }
 
+  if (args.sessionContext) {
+    printSessionContext(config, profile, forbiddenGlobals, args);
+    return;
+  }
+
   const SERVER_INFO = { name: 'ark-runtime-kernel', version: ark.version };
   const DEFAULT_PROTOCOL = '2024-11-05';
 
@@ -342,6 +444,7 @@ async function main() {
         name: profile.name,
         layers: profile.layers,
         rules: profile.rules,
+        ...(Object.keys(forbiddenGlobals).length > 0 ? { forbiddenGlobals } : {}),
         ...(suggestions.length > 0
           ? {
               suggestedLayers: suggestions,

package/bin/ark-shared.mjs

@@ -69,6 +69,13 @@ export const DEFAULT_RULES = createStrictDenyRules(
   DEFAULT_ALLOWED_FLOWS
 );
 
+/**
+ * Default ambient globals forbidden in the domain layer: a pure domain does no I/O and is
+ * deterministic. `console` is deliberately omitted (too common during adoption); add it per
+ * project via the layer's `forbiddenGlobals` in ark.config.json.
+ */
+export const DEFAULT_DOMAIN_FORBIDDEN_GLOBALS = ['fetch', 'process', 'Date.now', 'Math.random'];
+
 export function createElevenLayerConfig(options = {}) {
   const rootDir = options.rootDir ?? 'src';
   const optional = options.optionalLayers ?? true;
@@ -82,11 +89,55 @@ export function createElevenLayerConfig(options = {}) {
       ),
       intentPrefixes: entry.prefixes,
       optional,
+      ...(entry.layer === 'DomainModel'
+        ? { forbiddenGlobals: DEFAULT_DOMAIN_FORBIDDEN_GLOBALS }
+        : {}),
     })),
     rules: DEFAULT_RULES,
   };
 }
 
+/**
+ * Find uses of forbidden ambient globals in a TypeScript source file.
+ *
+ * Detection is deliberately positional, not scope-aware (kept in sync with
+ * `collectForbiddenGlobalUses` in src/kernel/ai-gate/AICodeGate.ts — the CLIs must not
+ * import from dist):
+ *   - a dotted entry ("Date.now") flags `Date.now` property accesses
+ *   - a bare entry ("console", "fetch") flags property accesses on it (`console.log`),
+ *     direct calls (`fetch(...)`), and constructions (`new WebSocket(...)`)
+ * Bare identifier mentions in other positions (types, shadowed locals, import names) are
+ * NOT flagged, trading a little recall for near-zero false positives without a type checker.
+ *
+ * Returns [{ name, node }] where `name` is the matched forbidden entry.
+ */
+export function collectForbiddenGlobalUses(ts, sourceFile, forbidden) {
+  const entries = new Set(forbidden ?? []);
+  if (entries.size === 0) return [];
+  const uses = [];
+
+  const visit = (node) => {
+    if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression)) {
+      const dotted = `${node.expression.text}.${node.name.text}`;
+      if (entries.has(dotted)) {
+        uses.push({ name: dotted, node });
+      } else if (entries.has(node.expression.text)) {
+        uses.push({ name: node.expression.text, node });
+      }
+    } else if (
+      (ts.isCallExpression(node) || ts.isNewExpression(node)) &&
+      node.expression &&
+      ts.isIdentifier(node.expression) &&
+      entries.has(node.expression.text)
+    ) {
+      uses.push({ name: node.expression.text, node });
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return uses;
+}
+
 const _regexpCache = new Map();
 
 function escapeLiteral(ch) {

package/dist/eslint/index.cjs

@@ -122,10 +122,57 @@ var requirePublishSource = {
     };
   }
 };
+var DEFAULT_FORBIDDEN_GLOBALS = ["fetch", "process", "Date.now", "Math.random"];
+var noForbiddenGlobals = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: 'Disallow ambient globals (e.g. fetch, Date.now) in architecture-governed code; scope the rule to layer directories via ESLint "files" patterns.'
+    },
+    messages: {
+      forbiddenGlobal: 'Ambient global "{{name}}" is forbidden here; inject the capability through a port instead.'
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          globals: { type: "array", items: { type: "string" } }
+        },
+        additionalProperties: false
+      }
+    ]
+  },
+  create(context) {
+    const option = context.options?.[0];
+    const globals = new Set(option?.globals ?? DEFAULT_FORBIDDEN_GLOBALS);
+    const report = (node, name) => context.report({ node, messageId: "forbiddenGlobal", data: { name } });
+    return {
+      // Same positional detection as ark-check's FORBIDDEN_GLOBAL: property accesses on a
+      // forbidden base (console.log, Date.now), direct calls, and constructions. Bare
+      // identifier mentions elsewhere are not flagged (avoids shadowed-local false positives).
+      MemberExpression(node) {
+        const base = node.object?.type === "Identifier" ? node.object.name : void 0;
+        if (!base) return;
+        const dotted = `${base}.${propertyName(node.property) ?? ""}`;
+        if (globals.has(dotted)) report(node, dotted);
+        else if (globals.has(base)) report(node, base);
+      },
+      CallExpression(node) {
+        const callee = node.callee?.type === "Identifier" ? node.callee.name : void 0;
+        if (callee && globals.has(callee)) report(node, callee);
+      },
+      NewExpression(node) {
+        const callee = node.callee?.type === "Identifier" ? node.callee.name : void 0;
+        if (callee && globals.has(callee)) report(node, callee);
+      }
+    };
+  }
+};
 var rules = {
   "no-domain-infra-imports": noDomainInfraImports,
   "no-raw-event-publish": noRawEventPublish,
-  "require-publish-source": requirePublishSource
+  "require-publish-source": requirePublishSource,
+  "no-forbidden-globals": noForbiddenGlobals
 };
 var plugin = { rules };
 plugin.configs = {
@@ -142,6 +189,7 @@ var eslint_default = plugin;
 
 exports.default = eslint_default;
 exports.noDomainInfraImports = noDomainInfraImports;
+exports.noForbiddenGlobals = noForbiddenGlobals;
 exports.noRawEventPublish = noRawEventPublish;
 exports.plugin = plugin;
 exports.requirePublishSource = requirePublishSource;

package/dist/eslint/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/eslint/index.ts"],"names":[],"mappings":";;;;;AAkCA,SAAS,YAAY,IAAA,EAA+C;AAClE,EAAA,OAAO,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,MAAA;AACxD;AAEA,SAAS,aAAa,IAAA,EAA+C;AACnE,EAAA,OAAO,IAAA,EAAM,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA;AACvC;AAEA,SAAS,mBAAmB,IAAA,EAAmC;AAC7D,EAAA,OAAO,YAAA,CAAa,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAC3C;AAEA,SAAS,cAAA,CAAe,MAA2B,IAAA,EAAmC;AACpF,EAAA,OAAO,IAAA,EAAM,YAAY,IAAA,CAAK,CAAC,aAAa,YAAA,CAAa,QAAA,CAAS,GAAG,CAAA,KAAM,IAAI,CAAA;AACjF;AAEA,SAAS,iBAAA,CAAkB,MAA2B,IAAA,EAAuB;AAC3E,EAAA,OAAO,cAAA,CAAe,IAAA,EAAM,IAAI,CAAA,KAAM,MAAA;AACxC;AAEA,SAAS,wBAAwB,IAAA,EAAoC;AACnE,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,IAAA,EAAM,UAAU,CAAA,EAAG,KAAA;AACnD,EAAA,OAAO,iBAAA,CAAkB,UAAU,QAAQ,CAAA;AAC7C;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,OAAO,iIAAA,CAAkI,KAAK,KAAK,CAAA;AACrJ;AAEA,SAAS,aAAa,OAAA,EAA+B;AACnD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,IAAc,IAAK,EAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,SAAS,KAAA,CAAM,IAAI,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC9D,EAAA,OAAO,WAAW,QAAA,CAAS,UAAU,CAAA,IAAK,UAAA,CAAW,SAAS,YAAY,CAAA;AAC5E;AAEA,SAAS,cAAc,SAAA,EAA4B;AACjD,EAAA,MAAM,UAAA,GAAa,UAAU,WAAA,EAAY;AACzC,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,UAAA;AAAA,IACA,gBAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,IACA,IAAA,CAAK,CAAC,UAAU,UAAA,CAAW,QAAA,CAAS,KAAK,CAAC,CAAA;AAC9C;AAEA,SAAS,cAAc,IAAA,EAAwB;AAC7C,EAAA,OAAO,kBAAA,CAAmB,IAAI,CAAA,KAAM,SAAA;AACtC;AAEO,IAAM,oBAAA,GAAgC;AAAA,EAC3C,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,eAAA,EAAiB;AAAA,KACnB;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAkB;AAC/B,MAAA,IAAI,CAAC,YAAA,CAAa,OAAO,CAAA,EAAG;AAC5B,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AACtC,MAAA,IAAI,MAAA,IAAU,aAAA,CAAc,MAAM,CAAA,EAAG;AACnC,QAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,mBAAmB,CAAA;AAAA,MACvD;AAAA,IACF,CAAA;AAEA,IAAA,OAAO;AAAA,MACL,iBAAA,EAAmB,KAAA;AAAA,MACnB,sBAAA,EAAwB,KAAA;AAAA,MACxB,oBAAA,EAAsB;AAAA,KACxB;AAAA,EACF;AACF;AAEO,IAAM,iBAAA,GAA6B;AAAA,EACxC,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,UAAA,EAAY;AAAA,KACd;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,OAAO;AAAA,MACL,eAAe,IAAA,EAAM;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1B,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACnC,QAAA,MAAM,UAAA,GAAa,YAAY,QAAQ,CAAA;AACvC,QAAA,IACE,cAAc,eAAA,CAAgB,UAAU,KACxC,iBAAA,CAAkB,QAAA,EAAU,QAAQ,CAAA,EACpC;AACA,UAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,cAAc,CAAA;AAAA,QAClD;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF;AAEO,IAAM,oBAAA,GAAgC;AAAA,EAC3C,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,aAAA,EAAe;AAAA,KACjB;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,OAAO;AAAA,MACL,eAAe,IAAA,EAAM;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1B,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACnC,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACtC,QAAA,IAAI,wBAAwB,QAAQ,CAAA,IAAK,iBAAA,CAAkB,WAAA,EAAa,QAAQ,CAAA,EAAG;AACjF,UAAA;AAAA,QACF;AACA,QAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,iBAAiB,CAAA;AAAA,MACrD;AAAA,KACF;AAAA,EACF;AACF;AAEA,IAAM,KAAA,GAAQ;AAAA,EACZ,yBAAA,EAA2B,oBAAA;AAAA,EAC3B,sBAAA,EAAwB,iBAAA;AAAA,EACxB,wBAAA,EAA0B;AAC5B,CAAA;AAEA,IAAM,MAAA,GAA0B,EAAE,KAAA;AAElC,MAAA,CAAO,OAAA,GAAU;AAAA,EACf,WAAA,EAAa;AAAA,IACX,OAAA,EAAS,EAAE,GAAA,EAAK,MAAA,EAAO;AAAA,IACvB,KAAA,EAAO;AAAA,MACL,6BAAA,EAA+B,OAAA;AAAA,MAC/B,0BAAA,EAA4B,OAAA;AAAA,MAC5B,4BAAA,EAA8B;AAAA;AAChC;AAEJ,CAAA;AAGA,IAAO,cAAA,GAAQ","file":"index.cjs","sourcesContent":["type RuleContext = {\n  report(descriptor: Record<string, unknown>): void;\n  getFilename?: () => string;\n};\n\ntype RuleListener = Record<string, (node: AstNode) => void>;\n\ntype AstNode = {\n  type?: string;\n  name?: string;\n  value?: unknown;\n  source?: AstNode;\n  callee?: AstNode;\n  property?: AstNode;\n  key?: AstNode;\n  arguments?: AstNode[];\n  properties?: AstNode[];\n};\n\ntype ArkRule = {\n  meta: {\n    type: 'problem';\n    docs: { description: string };\n    messages: Record<string, string>;\n    schema: unknown[];\n  };\n  create(context: RuleContext): RuleListener;\n};\n\ntype ArkEslintPlugin = {\n  rules: Record<string, ArkRule>;\n  configs?: Record<string, unknown>;\n};\n\nfunction stringValue(node: AstNode | undefined): string | undefined {\n  return typeof node?.value === 'string' ? node.value : undefined;\n}\n\nfunction propertyName(node: AstNode | undefined): string | undefined {\n  return node?.name ?? stringValue(node);\n}\n\nfunction calleePropertyName(node: AstNode): string | undefined {\n  return propertyName(node.callee?.property);\n}\n\nfunction objectProperty(node: AstNode | undefined, name: string): AstNode | undefined {\n  return node?.properties?.find((property) => propertyName(property.key) === name);\n}\n\nfunction objectHasProperty(node: AstNode | undefined, name: string): boolean {\n  return objectProperty(node, name) !== undefined;\n}\n\nfunction objectHasMetadataSource(node: AstNode | undefined): boolean {\n  const metadata = objectProperty(node, 'metadata')?.value as AstNode | undefined;\n  return objectHasProperty(metadata, 'source');\n}\n\nfunction looksLikeIntent(value: string): boolean {\n  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\\.[A-Za-z0-9_.]+$/.test(value);\n}\n\nfunction isDomainFile(context: RuleContext): boolean {\n  const filename = context.getFilename?.() ?? '';\n  const normalized = filename.split('\\\\').join('/').toLowerCase();\n  return normalized.includes('/domain/') || normalized.endsWith('/domain.ts');\n}\n\nfunction isInfraImport(specifier: string): boolean {\n  const normalized = specifier.toLowerCase();\n  return [\n    'adapter',\n    'adapters',\n    'infrastructure',\n    'persistence',\n    'repository',\n    'repositories',\n    'integration',\n    'database',\n    'db',\n  ].some((token) => normalized.includes(token));\n}\n\nfunction isPublishCall(node: AstNode): boolean {\n  return calleePropertyName(node) === 'publish';\n}\n\nexport const noDomainInfraImports: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Disallow importing infrastructure or adapters from domain files.',\n    },\n    messages: {\n      forbiddenImport: 'Domain code must not import infrastructure, adapters, repositories, or database modules.',\n    },\n    schema: [],\n  },\n  create(context) {\n    const check = (node: AstNode) => {\n      if (!isDomainFile(context)) return;\n      const source = stringValue(node.source);\n      if (source && isInfraImport(source)) {\n        context.report({ node, messageId: 'forbiddenImport' });\n      }\n    };\n\n    return {\n      ImportDeclaration: check,\n      ExportNamedDeclaration: check,\n      ExportAllDeclaration: check,\n    };\n  },\n};\n\nexport const noRawEventPublish: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require event bus publish calls to use registered intent creators instead of raw event objects or intent strings.',\n    },\n    messages: {\n      rawPublish: 'Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts.',\n    },\n    schema: [],\n  },\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (!isPublishCall(node)) return;\n        const firstArg = node.arguments?.[0];\n        const firstValue = stringValue(firstArg);\n        if (\n          firstValue && looksLikeIntent(firstValue) ||\n          objectHasProperty(firstArg, 'intent')\n        ) {\n          context.report({ node, messageId: 'rawPublish' });\n        }\n      },\n    };\n  },\n};\n\nexport const requirePublishSource: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require event bus publish calls to include source metadata.',\n    },\n    messages: {\n      missingSource: 'Strict Ark publish calls must include metadata.source.',\n    },\n    schema: [],\n  },\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (!isPublishCall(node)) return;\n        const firstArg = node.arguments?.[0];\n        const metadataArg = node.arguments?.[2];\n        if (objectHasMetadataSource(firstArg) || objectHasProperty(metadataArg, 'source')) {\n          return;\n        }\n        context.report({ node, messageId: 'missingSource' });\n      },\n    };\n  },\n};\n\nconst rules = {\n  'no-domain-infra-imports': noDomainInfraImports,\n  'no-raw-event-publish': noRawEventPublish,\n  'require-publish-source': requirePublishSource,\n};\n\nconst plugin: ArkEslintPlugin = { rules };\n\nplugin.configs = {\n  recommended: {\n    plugins: { ark: plugin },\n    rules: {\n      'ark/no-domain-infra-imports': 'error',\n      'ark/no-raw-event-publish': 'error',\n      'ark/require-publish-source': 'error',\n    },\n  },\n};\n\nexport { plugin };\nexport default plugin;\n"]}
+{"version":3,"sources":["../../src/eslint/index.ts"],"names":[],"mappings":";;;;;AAoCA,SAAS,YAAY,IAAA,EAA+C;AAClE,EAAA,OAAO,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,MAAA;AACxD;AAEA,SAAS,aAAa,IAAA,EAA+C;AACnE,EAAA,OAAO,IAAA,EAAM,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA;AACvC;AAEA,SAAS,mBAAmB,IAAA,EAAmC;AAC7D,EAAA,OAAO,YAAA,CAAa,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAC3C;AAEA,SAAS,cAAA,CAAe,MAA2B,IAAA,EAAmC;AACpF,EAAA,OAAO,IAAA,EAAM,YAAY,IAAA,CAAK,CAAC,aAAa,YAAA,CAAa,QAAA,CAAS,GAAG,CAAA,KAAM,IAAI,CAAA;AACjF;AAEA,SAAS,iBAAA,CAAkB,MAA2B,IAAA,EAAuB;AAC3E,EAAA,OAAO,cAAA,CAAe,IAAA,EAAM,IAAI,CAAA,KAAM,MAAA;AACxC;AAEA,SAAS,wBAAwB,IAAA,EAAoC;AACnE,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,IAAA,EAAM,UAAU,CAAA,EAAG,KAAA;AACnD,EAAA,OAAO,iBAAA,CAAkB,UAAU,QAAQ,CAAA;AAC7C;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,OAAO,iIAAA,CAAkI,KAAK,KAAK,CAAA;AACrJ;AAEA,SAAS,aAAa,OAAA,EAA+B;AACnD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,IAAc,IAAK,EAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,SAAS,KAAA,CAAM,IAAI,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC9D,EAAA,OAAO,WAAW,QAAA,CAAS,UAAU,CAAA,IAAK,UAAA,CAAW,SAAS,YAAY,CAAA;AAC5E;AAEA,SAAS,cAAc,SAAA,EAA4B;AACjD,EAAA,MAAM,UAAA,GAAa,UAAU,WAAA,EAAY;AACzC,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,UAAA;AAAA,IACA,gBAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,IACA,IAAA,CAAK,CAAC,UAAU,UAAA,CAAW,QAAA,CAAS,KAAK,CAAC,CAAA;AAC9C;AAEA,SAAS,cAAc,IAAA,EAAwB;AAC7C,EAAA,OAAO,kBAAA,CAAmB,IAAI,CAAA,KAAM,SAAA;AACtC;AAEO,IAAM,oBAAA,GAAgC;AAAA,EAC3C,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,eAAA,EAAiB;AAAA,KACnB;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAkB;AAC/B,MAAA,IAAI,CAAC,YAAA,CAAa,OAAO,CAAA,EAAG;AAC5B,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AACtC,MAAA,IAAI,MAAA,IAAU,aAAA,CAAc,MAAM,CAAA,EAAG;AACnC,QAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,mBAAmB,CAAA;AAAA,MACvD;AAAA,IACF,CAAA;AAEA,IAAA,OAAO;AAAA,MACL,iBAAA,EAAmB,KAAA;AAAA,MACnB,sBAAA,EAAwB,KAAA;AAAA,MACxB,oBAAA,EAAsB;AAAA,KACxB;AAAA,EACF;AACF;AAEO,IAAM,iBAAA,GAA6B;AAAA,EACxC,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,UAAA,EAAY;AAAA,KACd;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,OAAO;AAAA,MACL,eAAe,IAAA,EAAM;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1B,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACnC,QAAA,MAAM,UAAA,GAAa,YAAY,QAAQ,CAAA;AACvC,QAAA,IACE,cAAc,eAAA,CAAgB,UAAU,KACxC,iBAAA,CAAkB,QAAA,EAAU,QAAQ,CAAA,EACpC;AACA,UAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,cAAc,CAAA;AAAA,QAClD;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF;AAEO,IAAM,oBAAA,GAAgC;AAAA,EAC3C,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,aAAA,EAAe;AAAA,KACjB;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,OAAO;AAAA,MACL,eAAe,IAAA,EAAM;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1B,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACnC,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACtC,QAAA,IAAI,wBAAwB,QAAQ,CAAA,IAAK,iBAAA,CAAkB,WAAA,EAAa,QAAQ,CAAA,EAAG;AACjF,UAAA;AAAA,QACF;AACA,QAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,iBAAiB,CAAA;AAAA,MACrD;AAAA,KACF;AAAA,EACF;AACF;AAEA,IAAM,yBAAA,GAA4B,CAAC,OAAA,EAAS,SAAA,EAAW,YAAY,aAAa,CAAA;AAEzE,IAAM,kBAAA,GAA8B;AAAA,EACzC,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EACE;AAAA,KACJ;AAAA,IACA,QAAA,EAAU;AAAA,MACR,eAAA,EAAiB;AAAA,KACnB;AAAA,IACA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,IAAA,EAAM,QAAA;AAAA,QACN,UAAA,EAAY;AAAA,UACV,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,UAAS;AAAE,SACtD;AAAA,QACA,oBAAA,EAAsB;AAAA;AACxB;AACF,GACF;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,GAAU,CAAC,CAAA;AAClC,IAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,MAAA,EAAQ,WAAW,yBAAyB,CAAA;AACpE,IAAA,MAAM,MAAA,GAAS,CAAC,IAAA,EAAe,IAAA,KAC7B,QAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,iBAAA,EAAmB,IAAA,EAAM,EAAE,IAAA,IAAQ,CAAA;AAEvE,IAAA,OAAO;AAAA;AAAA;AAAA;AAAA,MAIL,iBAAiB,IAAA,EAAM;AACrB,QAAA,MAAM,OAAO,IAAA,CAAK,MAAA,EAAQ,SAAS,YAAA,GAAe,IAAA,CAAK,OAAO,IAAA,GAAO,MAAA;AACrE,QAAA,IAAI,CAAC,IAAA,EAAM;AACX,QAAA,MAAM,MAAA,GAAS,GAAG,IAAI,CAAA,CAAA,EAAI,aAAa,IAAA,CAAK,QAAQ,KAAK,EAAE,CAAA,CAAA;AAC3D,QAAA,IAAI,QAAQ,GAAA,CAAI,MAAM,CAAA,EAAG,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,aAAA,IACnC,QAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,MAC/C,CAAA;AAAA,MACA,eAAe,IAAA,EAAM;AACnB,QAAA,MAAM,SAAS,IAAA,CAAK,MAAA,EAAQ,SAAS,YAAA,GAAe,IAAA,CAAK,OAAO,IAAA,GAAO,MAAA;AACvE,QAAA,IAAI,UAAU,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MACxD,CAAA;AAAA,MACA,cAAc,IAAA,EAAM;AAClB,QAAA,MAAM,SAAS,IAAA,CAAK,MAAA,EAAQ,SAAS,YAAA,GAAe,IAAA,CAAK,OAAO,IAAA,GAAO,MAAA;AACvE,QAAA,IAAI,UAAU,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MACxD;AAAA,KACF;AAAA,EACF;AACF;AAEA,IAAM,KAAA,GAAQ;AAAA,EACZ,yBAAA,EAA2B,oBAAA;AAAA,EAC3B,sBAAA,EAAwB,iBAAA;AAAA,EACxB,wBAAA,EAA0B,oBAAA;AAAA,EAC1B,sBAAA,EAAwB;AAC1B,CAAA;AAEA,IAAM,MAAA,GAA0B,EAAE,KAAA;AAElC,MAAA,CAAO,OAAA,GAAU;AAAA,EACf,WAAA,EAAa;AAAA,IACX,OAAA,EAAS,EAAE,GAAA,EAAK,MAAA,EAAO;AAAA,IACvB,KAAA,EAAO;AAAA,MACL,6BAAA,EAA+B,OAAA;AAAA,MAC/B,0BAAA,EAA4B,OAAA;AAAA,MAC5B,4BAAA,EAA8B;AAAA;AAChC;AAEJ,CAAA;AAGA,IAAO,cAAA,GAAQ","file":"index.cjs","sourcesContent":["type RuleContext = {\n  report(descriptor: Record<string, unknown>): void;\n  getFilename?: () => string;\n  options?: unknown[];\n};\n\ntype RuleListener = Record<string, (node: AstNode) => void>;\n\ntype AstNode = {\n  type?: string;\n  name?: string;\n  value?: unknown;\n  source?: AstNode;\n  callee?: AstNode;\n  object?: AstNode;\n  property?: AstNode;\n  key?: AstNode;\n  arguments?: AstNode[];\n  properties?: AstNode[];\n};\n\ntype ArkRule = {\n  meta: {\n    type: 'problem';\n    docs: { description: string };\n    messages: Record<string, string>;\n    schema: unknown[];\n  };\n  create(context: RuleContext): RuleListener;\n};\n\ntype ArkEslintPlugin = {\n  rules: Record<string, ArkRule>;\n  configs?: Record<string, unknown>;\n};\n\nfunction stringValue(node: AstNode | undefined): string | undefined {\n  return typeof node?.value === 'string' ? node.value : undefined;\n}\n\nfunction propertyName(node: AstNode | undefined): string | undefined {\n  return node?.name ?? stringValue(node);\n}\n\nfunction calleePropertyName(node: AstNode): string | undefined {\n  return propertyName(node.callee?.property);\n}\n\nfunction objectProperty(node: AstNode | undefined, name: string): AstNode | undefined {\n  return node?.properties?.find((property) => propertyName(property.key) === name);\n}\n\nfunction objectHasProperty(node: AstNode | undefined, name: string): boolean {\n  return objectProperty(node, name) !== undefined;\n}\n\nfunction objectHasMetadataSource(node: AstNode | undefined): boolean {\n  const metadata = objectProperty(node, 'metadata')?.value as AstNode | undefined;\n  return objectHasProperty(metadata, 'source');\n}\n\nfunction looksLikeIntent(value: string): boolean {\n  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\\.[A-Za-z0-9_.]+$/.test(value);\n}\n\nfunction isDomainFile(context: RuleContext): boolean {\n  const filename = context.getFilename?.() ?? '';\n  const normalized = filename.split('\\\\').join('/').toLowerCase();\n  return normalized.includes('/domain/') || normalized.endsWith('/domain.ts');\n}\n\nfunction isInfraImport(specifier: string): boolean {\n  const normalized = specifier.toLowerCase();\n  return [\n    'adapter',\n    'adapters',\n    'infrastructure',\n    'persistence',\n    'repository',\n    'repositories',\n    'integration',\n    'database',\n    'db',\n  ].some((token) => normalized.includes(token));\n}\n\nfunction isPublishCall(node: AstNode): boolean {\n  return calleePropertyName(node) === 'publish';\n}\n\nexport const noDomainInfraImports: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Disallow importing infrastructure or adapters from domain files.',\n    },\n    messages: {\n      forbiddenImport: 'Domain code must not import infrastructure, adapters, repositories, or database modules.',\n    },\n    schema: [],\n  },\n  create(context) {\n    const check = (node: AstNode) => {\n      if (!isDomainFile(context)) return;\n      const source = stringValue(node.source);\n      if (source && isInfraImport(source)) {\n        context.report({ node, messageId: 'forbiddenImport' });\n      }\n    };\n\n    return {\n      ImportDeclaration: check,\n      ExportNamedDeclaration: check,\n      ExportAllDeclaration: check,\n    };\n  },\n};\n\nexport const noRawEventPublish: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require event bus publish calls to use registered intent creators instead of raw event objects or intent strings.',\n    },\n    messages: {\n      rawPublish: 'Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts.',\n    },\n    schema: [],\n  },\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (!isPublishCall(node)) return;\n        const firstArg = node.arguments?.[0];\n        const firstValue = stringValue(firstArg);\n        if (\n          firstValue && looksLikeIntent(firstValue) ||\n          objectHasProperty(firstArg, 'intent')\n        ) {\n          context.report({ node, messageId: 'rawPublish' });\n        }\n      },\n    };\n  },\n};\n\nexport const requirePublishSource: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require event bus publish calls to include source metadata.',\n    },\n    messages: {\n      missingSource: 'Strict Ark publish calls must include metadata.source.',\n    },\n    schema: [],\n  },\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (!isPublishCall(node)) return;\n        const firstArg = node.arguments?.[0];\n        const metadataArg = node.arguments?.[2];\n        if (objectHasMetadataSource(firstArg) || objectHasProperty(metadataArg, 'source')) {\n          return;\n        }\n        context.report({ node, messageId: 'missingSource' });\n      },\n    };\n  },\n};\n\nconst DEFAULT_FORBIDDEN_GLOBALS = ['fetch', 'process', 'Date.now', 'Math.random'];\n\nexport const noForbiddenGlobals: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description:\n        'Disallow ambient globals (e.g. fetch, Date.now) in architecture-governed code; scope the rule to layer directories via ESLint \"files\" patterns.',\n    },\n    messages: {\n      forbiddenGlobal: 'Ambient global \"{{name}}\" is forbidden here; inject the capability through a port instead.',\n    },\n    schema: [\n      {\n        type: 'object',\n        properties: {\n          globals: { type: 'array', items: { type: 'string' } },\n        },\n        additionalProperties: false,\n      },\n    ],\n  },\n  create(context) {\n    const option = context.options?.[0] as { globals?: string[] } | undefined;\n    const globals = new Set(option?.globals ?? DEFAULT_FORBIDDEN_GLOBALS);\n    const report = (node: AstNode, name: string) =>\n      context.report({ node, messageId: 'forbiddenGlobal', data: { name } });\n\n    return {\n      // Same positional detection as ark-check's FORBIDDEN_GLOBAL: property accesses on a\n      // forbidden base (console.log, Date.now), direct calls, and constructions. Bare\n      // identifier mentions elsewhere are not flagged (avoids shadowed-local false positives).\n      MemberExpression(node) {\n        const base = node.object?.type === 'Identifier' ? node.object.name : undefined;\n        if (!base) return;\n        const dotted = `${base}.${propertyName(node.property) ?? ''}`;\n        if (globals.has(dotted)) report(node, dotted);\n        else if (globals.has(base)) report(node, base);\n      },\n      CallExpression(node) {\n        const callee = node.callee?.type === 'Identifier' ? node.callee.name : undefined;\n        if (callee && globals.has(callee)) report(node, callee);\n      },\n      NewExpression(node) {\n        const callee = node.callee?.type === 'Identifier' ? node.callee.name : undefined;\n        if (callee && globals.has(callee)) report(node, callee);\n      },\n    };\n  },\n};\n\nconst rules = {\n  'no-domain-infra-imports': noDomainInfraImports,\n  'no-raw-event-publish': noRawEventPublish,\n  'require-publish-source': requirePublishSource,\n  'no-forbidden-globals': noForbiddenGlobals,\n};\n\nconst plugin: ArkEslintPlugin = { rules };\n\nplugin.configs = {\n  recommended: {\n    plugins: { ark: plugin },\n    rules: {\n      'ark/no-domain-infra-imports': 'error',\n      'ark/no-raw-event-publish': 'error',\n      'ark/require-publish-source': 'error',\n    },\n  },\n};\n\nexport { plugin };\nexport default plugin;\n"]}

package/dist/eslint/index.d.cts

@@ -1,6 +1,7 @@
 type RuleContext = {
     report(descriptor: Record<string, unknown>): void;
     getFilename?: () => string;
+    options?: unknown[];
 };
 type RuleListener = Record<string, (node: AstNode) => void>;
 type AstNode = {
@@ -9,6 +10,7 @@ type AstNode = {
     value?: unknown;
     source?: AstNode;
     callee?: AstNode;
+    object?: AstNode;
     property?: AstNode;
     key?: AstNode;
     arguments?: AstNode[];
@@ -32,6 +34,7 @@ type ArkEslintPlugin = {
 declare const noDomainInfraImports: ArkRule;
 declare const noRawEventPublish: ArkRule;
 declare const requirePublishSource: ArkRule;
+declare const noForbiddenGlobals: ArkRule;
 declare const plugin: ArkEslintPlugin;
 
-export { plugin as default, noDomainInfraImports, noRawEventPublish, plugin, requirePublishSource };
+export { plugin as default, noDomainInfraImports, noForbiddenGlobals, noRawEventPublish, plugin, requirePublishSource };

package/dist/eslint/index.d.ts

@@ -1,6 +1,7 @@
 type RuleContext = {
     report(descriptor: Record<string, unknown>): void;
     getFilename?: () => string;
+    options?: unknown[];
 };
 type RuleListener = Record<string, (node: AstNode) => void>;
 type AstNode = {
@@ -9,6 +10,7 @@ type AstNode = {
     value?: unknown;
     source?: AstNode;
     callee?: AstNode;
+    object?: AstNode;
     property?: AstNode;
     key?: AstNode;
     arguments?: AstNode[];
@@ -32,6 +34,7 @@ type ArkEslintPlugin = {
 declare const noDomainInfraImports: ArkRule;
 declare const noRawEventPublish: ArkRule;
 declare const requirePublishSource: ArkRule;
+declare const noForbiddenGlobals: ArkRule;
 declare const plugin: ArkEslintPlugin;
 
-export { plugin as default, noDomainInfraImports, noRawEventPublish, plugin, requirePublishSource };
+export { plugin as default, noDomainInfraImports, noForbiddenGlobals, noRawEventPublish, plugin, requirePublishSource };

package/dist/eslint/index.js

@@ -118,10 +118,57 @@ var requirePublishSource = {
     };
   }
 };
+var DEFAULT_FORBIDDEN_GLOBALS = ["fetch", "process", "Date.now", "Math.random"];
+var noForbiddenGlobals = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: 'Disallow ambient globals (e.g. fetch, Date.now) in architecture-governed code; scope the rule to layer directories via ESLint "files" patterns.'
+    },
+    messages: {
+      forbiddenGlobal: 'Ambient global "{{name}}" is forbidden here; inject the capability through a port instead.'
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          globals: { type: "array", items: { type: "string" } }
+        },
+        additionalProperties: false
+      }
+    ]
+  },
+  create(context) {
+    const option = context.options?.[0];
+    const globals = new Set(option?.globals ?? DEFAULT_FORBIDDEN_GLOBALS);
+    const report = (node, name) => context.report({ node, messageId: "forbiddenGlobal", data: { name } });
+    return {
+      // Same positional detection as ark-check's FORBIDDEN_GLOBAL: property accesses on a
+      // forbidden base (console.log, Date.now), direct calls, and constructions. Bare
+      // identifier mentions elsewhere are not flagged (avoids shadowed-local false positives).
+      MemberExpression(node) {
+        const base = node.object?.type === "Identifier" ? node.object.name : void 0;
+        if (!base) return;
+        const dotted = `${base}.${propertyName(node.property) ?? ""}`;
+        if (globals.has(dotted)) report(node, dotted);
+        else if (globals.has(base)) report(node, base);
+      },
+      CallExpression(node) {
+        const callee = node.callee?.type === "Identifier" ? node.callee.name : void 0;
+        if (callee && globals.has(callee)) report(node, callee);
+      },
+      NewExpression(node) {
+        const callee = node.callee?.type === "Identifier" ? node.callee.name : void 0;
+        if (callee && globals.has(callee)) report(node, callee);
+      }
+    };
+  }
+};
 var rules = {
   "no-domain-infra-imports": noDomainInfraImports,
   "no-raw-event-publish": noRawEventPublish,
-  "require-publish-source": requirePublishSource
+  "require-publish-source": requirePublishSource,
+  "no-forbidden-globals": noForbiddenGlobals
 };
 var plugin = { rules };
 plugin.configs = {
@@ -136,6 +183,6 @@ plugin.configs = {
 };
 var eslint_default = plugin;
 
-export { eslint_default as default, noDomainInfraImports, noRawEventPublish, plugin, requirePublishSource };
+export { eslint_default as default, noDomainInfraImports, noForbiddenGlobals, noRawEventPublish, plugin, requirePublishSource };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/eslint/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/eslint/index.ts"],"names":[],"mappings":";AAkCA,SAAS,YAAY,IAAA,EAA+C;AAClE,EAAA,OAAO,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,MAAA;AACxD;AAEA,SAAS,aAAa,IAAA,EAA+C;AACnE,EAAA,OAAO,IAAA,EAAM,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA;AACvC;AAEA,SAAS,mBAAmB,IAAA,EAAmC;AAC7D,EAAA,OAAO,YAAA,CAAa,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAC3C;AAEA,SAAS,cAAA,CAAe,MAA2B,IAAA,EAAmC;AACpF,EAAA,OAAO,IAAA,EAAM,YAAY,IAAA,CAAK,CAAC,aAAa,YAAA,CAAa,QAAA,CAAS,GAAG,CAAA,KAAM,IAAI,CAAA;AACjF;AAEA,SAAS,iBAAA,CAAkB,MAA2B,IAAA,EAAuB;AAC3E,EAAA,OAAO,cAAA,CAAe,IAAA,EAAM,IAAI,CAAA,KAAM,MAAA;AACxC;AAEA,SAAS,wBAAwB,IAAA,EAAoC;AACnE,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,IAAA,EAAM,UAAU,CAAA,EAAG,KAAA;AACnD,EAAA,OAAO,iBAAA,CAAkB,UAAU,QAAQ,CAAA;AAC7C;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,OAAO,iIAAA,CAAkI,KAAK,KAAK,CAAA;AACrJ;AAEA,SAAS,aAAa,OAAA,EAA+B;AACnD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,IAAc,IAAK,EAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,SAAS,KAAA,CAAM,IAAI,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC9D,EAAA,OAAO,WAAW,QAAA,CAAS,UAAU,CAAA,IAAK,UAAA,CAAW,SAAS,YAAY,CAAA;AAC5E;AAEA,SAAS,cAAc,SAAA,EAA4B;AACjD,EAAA,MAAM,UAAA,GAAa,UAAU,WAAA,EAAY;AACzC,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,UAAA;AAAA,IACA,gBAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,IACA,IAAA,CAAK,CAAC,UAAU,UAAA,CAAW,QAAA,CAAS,KAAK,CAAC,CAAA;AAC9C;AAEA,SAAS,cAAc,IAAA,EAAwB;AAC7C,EAAA,OAAO,kBAAA,CAAmB,IAAI,CAAA,KAAM,SAAA;AACtC;AAEO,IAAM,oBAAA,GAAgC;AAAA,EAC3C,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,eAAA,EAAiB;AAAA,KACnB;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAkB;AAC/B,MAAA,IAAI,CAAC,YAAA,CAAa,OAAO,CAAA,EAAG;AAC5B,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AACtC,MAAA,IAAI,MAAA,IAAU,aAAA,CAAc,MAAM,CAAA,EAAG;AACnC,QAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,mBAAmB,CAAA;AAAA,MACvD;AAAA,IACF,CAAA;AAEA,IAAA,OAAO;AAAA,MACL,iBAAA,EAAmB,KAAA;AAAA,MACnB,sBAAA,EAAwB,KAAA;AAAA,MACxB,oBAAA,EAAsB;AAAA,KACxB;AAAA,EACF;AACF;AAEO,IAAM,iBAAA,GAA6B;AAAA,EACxC,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,UAAA,EAAY;AAAA,KACd;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,OAAO;AAAA,MACL,eAAe,IAAA,EAAM;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1B,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACnC,QAAA,MAAM,UAAA,GAAa,YAAY,QAAQ,CAAA;AACvC,QAAA,IACE,cAAc,eAAA,CAAgB,UAAU,KACxC,iBAAA,CAAkB,QAAA,EAAU,QAAQ,CAAA,EACpC;AACA,UAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,cAAc,CAAA;AAAA,QAClD;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF;AAEO,IAAM,oBAAA,GAAgC;AAAA,EAC3C,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,aAAA,EAAe;AAAA,KACjB;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,OAAO;AAAA,MACL,eAAe,IAAA,EAAM;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1B,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACnC,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACtC,QAAA,IAAI,wBAAwB,QAAQ,CAAA,IAAK,iBAAA,CAAkB,WAAA,EAAa,QAAQ,CAAA,EAAG;AACjF,UAAA;AAAA,QACF;AACA,QAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,iBAAiB,CAAA;AAAA,MACrD;AAAA,KACF;AAAA,EACF;AACF;AAEA,IAAM,KAAA,GAAQ;AAAA,EACZ,yBAAA,EAA2B,oBAAA;AAAA,EAC3B,sBAAA,EAAwB,iBAAA;AAAA,EACxB,wBAAA,EAA0B;AAC5B,CAAA;AAEA,IAAM,MAAA,GAA0B,EAAE,KAAA;AAElC,MAAA,CAAO,OAAA,GAAU;AAAA,EACf,WAAA,EAAa;AAAA,IACX,OAAA,EAAS,EAAE,GAAA,EAAK,MAAA,EAAO;AAAA,IACvB,KAAA,EAAO;AAAA,MACL,6BAAA,EAA+B,OAAA;AAAA,MAC/B,0BAAA,EAA4B,OAAA;AAAA,MAC5B,4BAAA,EAA8B;AAAA;AAChC;AAEJ,CAAA;AAGA,IAAO,cAAA,GAAQ","file":"index.js","sourcesContent":["type RuleContext = {\n  report(descriptor: Record<string, unknown>): void;\n  getFilename?: () => string;\n};\n\ntype RuleListener = Record<string, (node: AstNode) => void>;\n\ntype AstNode = {\n  type?: string;\n  name?: string;\n  value?: unknown;\n  source?: AstNode;\n  callee?: AstNode;\n  property?: AstNode;\n  key?: AstNode;\n  arguments?: AstNode[];\n  properties?: AstNode[];\n};\n\ntype ArkRule = {\n  meta: {\n    type: 'problem';\n    docs: { description: string };\n    messages: Record<string, string>;\n    schema: unknown[];\n  };\n  create(context: RuleContext): RuleListener;\n};\n\ntype ArkEslintPlugin = {\n  rules: Record<string, ArkRule>;\n  configs?: Record<string, unknown>;\n};\n\nfunction stringValue(node: AstNode | undefined): string | undefined {\n  return typeof node?.value === 'string' ? node.value : undefined;\n}\n\nfunction propertyName(node: AstNode | undefined): string | undefined {\n  return node?.name ?? stringValue(node);\n}\n\nfunction calleePropertyName(node: AstNode): string | undefined {\n  return propertyName(node.callee?.property);\n}\n\nfunction objectProperty(node: AstNode | undefined, name: string): AstNode | undefined {\n  return node?.properties?.find((property) => propertyName(property.key) === name);\n}\n\nfunction objectHasProperty(node: AstNode | undefined, name: string): boolean {\n  return objectProperty(node, name) !== undefined;\n}\n\nfunction objectHasMetadataSource(node: AstNode | undefined): boolean {\n  const metadata = objectProperty(node, 'metadata')?.value as AstNode | undefined;\n  return objectHasProperty(metadata, 'source');\n}\n\nfunction looksLikeIntent(value: string): boolean {\n  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\\.[A-Za-z0-9_.]+$/.test(value);\n}\n\nfunction isDomainFile(context: RuleContext): boolean {\n  const filename = context.getFilename?.() ?? '';\n  const normalized = filename.split('\\\\').join('/').toLowerCase();\n  return normalized.includes('/domain/') || normalized.endsWith('/domain.ts');\n}\n\nfunction isInfraImport(specifier: string): boolean {\n  const normalized = specifier.toLowerCase();\n  return [\n    'adapter',\n    'adapters',\n    'infrastructure',\n    'persistence',\n    'repository',\n    'repositories',\n    'integration',\n    'database',\n    'db',\n  ].some((token) => normalized.includes(token));\n}\n\nfunction isPublishCall(node: AstNode): boolean {\n  return calleePropertyName(node) === 'publish';\n}\n\nexport const noDomainInfraImports: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Disallow importing infrastructure or adapters from domain files.',\n    },\n    messages: {\n      forbiddenImport: 'Domain code must not import infrastructure, adapters, repositories, or database modules.',\n    },\n    schema: [],\n  },\n  create(context) {\n    const check = (node: AstNode) => {\n      if (!isDomainFile(context)) return;\n      const source = stringValue(node.source);\n      if (source && isInfraImport(source)) {\n        context.report({ node, messageId: 'forbiddenImport' });\n      }\n    };\n\n    return {\n      ImportDeclaration: check,\n      ExportNamedDeclaration: check,\n      ExportAllDeclaration: check,\n    };\n  },\n};\n\nexport const noRawEventPublish: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require event bus publish calls to use registered intent creators instead of raw event objects or intent strings.',\n    },\n    messages: {\n      rawPublish: 'Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts.',\n    },\n    schema: [],\n  },\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (!isPublishCall(node)) return;\n        const firstArg = node.arguments?.[0];\n        const firstValue = stringValue(firstArg);\n        if (\n          firstValue && looksLikeIntent(firstValue) ||\n          objectHasProperty(firstArg, 'intent')\n        ) {\n          context.report({ node, messageId: 'rawPublish' });\n        }\n      },\n    };\n  },\n};\n\nexport const requirePublishSource: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require event bus publish calls to include source metadata.',\n    },\n    messages: {\n      missingSource: 'Strict Ark publish calls must include metadata.source.',\n    },\n    schema: [],\n  },\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (!isPublishCall(node)) return;\n        const firstArg = node.arguments?.[0];\n        const metadataArg = node.arguments?.[2];\n        if (objectHasMetadataSource(firstArg) || objectHasProperty(metadataArg, 'source')) {\n          return;\n        }\n        context.report({ node, messageId: 'missingSource' });\n      },\n    };\n  },\n};\n\nconst rules = {\n  'no-domain-infra-imports': noDomainInfraImports,\n  'no-raw-event-publish': noRawEventPublish,\n  'require-publish-source': requirePublishSource,\n};\n\nconst plugin: ArkEslintPlugin = { rules };\n\nplugin.configs = {\n  recommended: {\n    plugins: { ark: plugin },\n    rules: {\n      'ark/no-domain-infra-imports': 'error',\n      'ark/no-raw-event-publish': 'error',\n      'ark/require-publish-source': 'error',\n    },\n  },\n};\n\nexport { plugin };\nexport default plugin;\n"]}
+{"version":3,"sources":["../../src/eslint/index.ts"],"names":[],"mappings":";AAoCA,SAAS,YAAY,IAAA,EAA+C;AAClE,EAAA,OAAO,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,MAAA;AACxD;AAEA,SAAS,aAAa,IAAA,EAA+C;AACnE,EAAA,OAAO,IAAA,EAAM,IAAA,IAAQ,WAAA,CAAY,IAAI,CAAA;AACvC;AAEA,SAAS,mBAAmB,IAAA,EAAmC;AAC7D,EAAA,OAAO,YAAA,CAAa,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAC3C;AAEA,SAAS,cAAA,CAAe,MAA2B,IAAA,EAAmC;AACpF,EAAA,OAAO,IAAA,EAAM,YAAY,IAAA,CAAK,CAAC,aAAa,YAAA,CAAa,QAAA,CAAS,GAAG,CAAA,KAAM,IAAI,CAAA;AACjF;AAEA,SAAS,iBAAA,CAAkB,MAA2B,IAAA,EAAuB;AAC3E,EAAA,OAAO,cAAA,CAAe,IAAA,EAAM,IAAI,CAAA,KAAM,MAAA;AACxC;AAEA,SAAS,wBAAwB,IAAA,EAAoC;AACnE,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,IAAA,EAAM,UAAU,CAAA,EAAG,KAAA;AACnD,EAAA,OAAO,iBAAA,CAAkB,UAAU,QAAQ,CAAA;AAC7C;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,OAAO,iIAAA,CAAkI,KAAK,KAAK,CAAA;AACrJ;AAEA,SAAS,aAAa,OAAA,EAA+B;AACnD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,WAAA,IAAc,IAAK,EAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,SAAS,KAAA,CAAM,IAAI,EAAE,IAAA,CAAK,GAAG,EAAE,WAAA,EAAY;AAC9D,EAAA,OAAO,WAAW,QAAA,CAAS,UAAU,CAAA,IAAK,UAAA,CAAW,SAAS,YAAY,CAAA;AAC5E;AAEA,SAAS,cAAc,SAAA,EAA4B;AACjD,EAAA,MAAM,UAAA,GAAa,UAAU,WAAA,EAAY;AACzC,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,UAAA;AAAA,IACA,gBAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,IACA,IAAA,CAAK,CAAC,UAAU,UAAA,CAAW,QAAA,CAAS,KAAK,CAAC,CAAA;AAC9C;AAEA,SAAS,cAAc,IAAA,EAAwB;AAC7C,EAAA,OAAO,kBAAA,CAAmB,IAAI,CAAA,KAAM,SAAA;AACtC;AAEO,IAAM,oBAAA,GAAgC;AAAA,EAC3C,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,eAAA,EAAiB;AAAA,KACnB;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAkB;AAC/B,MAAA,IAAI,CAAC,YAAA,CAAa,OAAO,CAAA,EAAG;AAC5B,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AACtC,MAAA,IAAI,MAAA,IAAU,aAAA,CAAc,MAAM,CAAA,EAAG;AACnC,QAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,mBAAmB,CAAA;AAAA,MACvD;AAAA,IACF,CAAA;AAEA,IAAA,OAAO;AAAA,MACL,iBAAA,EAAmB,KAAA;AAAA,MACnB,sBAAA,EAAwB,KAAA;AAAA,MACxB,oBAAA,EAAsB;AAAA,KACxB;AAAA,EACF;AACF;AAEO,IAAM,iBAAA,GAA6B;AAAA,EACxC,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,UAAA,EAAY;AAAA,KACd;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,OAAO;AAAA,MACL,eAAe,IAAA,EAAM;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1B,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACnC,QAAA,MAAM,UAAA,GAAa,YAAY,QAAQ,CAAA;AACvC,QAAA,IACE,cAAc,eAAA,CAAgB,UAAU,KACxC,iBAAA,CAAkB,QAAA,EAAU,QAAQ,CAAA,EACpC;AACA,UAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,cAAc,CAAA;AAAA,QAClD;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF;AAEO,IAAM,oBAAA,GAAgC;AAAA,EAC3C,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EAAa;AAAA,KACf;AAAA,IACA,QAAA,EAAU;AAAA,MACR,aAAA,EAAe;AAAA,KACjB;AAAA,IACA,QAAQ;AAAC,GACX;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,OAAO;AAAA,MACL,eAAe,IAAA,EAAM;AACnB,QAAA,IAAI,CAAC,aAAA,CAAc,IAAI,CAAA,EAAG;AAC1B,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACnC,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,GAAY,CAAC,CAAA;AACtC,QAAA,IAAI,wBAAwB,QAAQ,CAAA,IAAK,iBAAA,CAAkB,WAAA,EAAa,QAAQ,CAAA,EAAG;AACjF,UAAA;AAAA,QACF;AACA,QAAA,OAAA,CAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,iBAAiB,CAAA;AAAA,MACrD;AAAA,KACF;AAAA,EACF;AACF;AAEA,IAAM,yBAAA,GAA4B,CAAC,OAAA,EAAS,SAAA,EAAW,YAAY,aAAa,CAAA;AAEzE,IAAM,kBAAA,GAA8B;AAAA,EACzC,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,WAAA,EACE;AAAA,KACJ;AAAA,IACA,QAAA,EAAU;AAAA,MACR,eAAA,EAAiB;AAAA,KACnB;AAAA,IACA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,IAAA,EAAM,QAAA;AAAA,QACN,UAAA,EAAY;AAAA,UACV,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,OAAO,EAAE,IAAA,EAAM,UAAS;AAAE,SACtD;AAAA,QACA,oBAAA,EAAsB;AAAA;AACxB;AACF,GACF;AAAA,EACA,OAAO,OAAA,EAAS;AACd,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,GAAU,CAAC,CAAA;AAClC,IAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,MAAA,EAAQ,WAAW,yBAAyB,CAAA;AACpE,IAAA,MAAM,MAAA,GAAS,CAAC,IAAA,EAAe,IAAA,KAC7B,QAAQ,MAAA,CAAO,EAAE,IAAA,EAAM,SAAA,EAAW,iBAAA,EAAmB,IAAA,EAAM,EAAE,IAAA,IAAQ,CAAA;AAEvE,IAAA,OAAO;AAAA;AAAA;AAAA;AAAA,MAIL,iBAAiB,IAAA,EAAM;AACrB,QAAA,MAAM,OAAO,IAAA,CAAK,MAAA,EAAQ,SAAS,YAAA,GAAe,IAAA,CAAK,OAAO,IAAA,GAAO,MAAA;AACrE,QAAA,IAAI,CAAC,IAAA,EAAM;AACX,QAAA,MAAM,MAAA,GAAS,GAAG,IAAI,CAAA,CAAA,EAAI,aAAa,IAAA,CAAK,QAAQ,KAAK,EAAE,CAAA,CAAA;AAC3D,QAAA,IAAI,QAAQ,GAAA,CAAI,MAAM,CAAA,EAAG,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,aAAA,IACnC,QAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,MAC/C,CAAA;AAAA,MACA,eAAe,IAAA,EAAM;AACnB,QAAA,MAAM,SAAS,IAAA,CAAK,MAAA,EAAQ,SAAS,YAAA,GAAe,IAAA,CAAK,OAAO,IAAA,GAAO,MAAA;AACvE,QAAA,IAAI,UAAU,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MACxD,CAAA;AAAA,MACA,cAAc,IAAA,EAAM;AAClB,QAAA,MAAM,SAAS,IAAA,CAAK,MAAA,EAAQ,SAAS,YAAA,GAAe,IAAA,CAAK,OAAO,IAAA,GAAO,MAAA;AACvE,QAAA,IAAI,UAAU,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,EAAG,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MACxD;AAAA,KACF;AAAA,EACF;AACF;AAEA,IAAM,KAAA,GAAQ;AAAA,EACZ,yBAAA,EAA2B,oBAAA;AAAA,EAC3B,sBAAA,EAAwB,iBAAA;AAAA,EACxB,wBAAA,EAA0B,oBAAA;AAAA,EAC1B,sBAAA,EAAwB;AAC1B,CAAA;AAEA,IAAM,MAAA,GAA0B,EAAE,KAAA;AAElC,MAAA,CAAO,OAAA,GAAU;AAAA,EACf,WAAA,EAAa;AAAA,IACX,OAAA,EAAS,EAAE,GAAA,EAAK,MAAA,EAAO;AAAA,IACvB,KAAA,EAAO;AAAA,MACL,6BAAA,EAA+B,OAAA;AAAA,MAC/B,0BAAA,EAA4B,OAAA;AAAA,MAC5B,4BAAA,EAA8B;AAAA;AAChC;AAEJ,CAAA;AAGA,IAAO,cAAA,GAAQ","file":"index.js","sourcesContent":["type RuleContext = {\n  report(descriptor: Record<string, unknown>): void;\n  getFilename?: () => string;\n  options?: unknown[];\n};\n\ntype RuleListener = Record<string, (node: AstNode) => void>;\n\ntype AstNode = {\n  type?: string;\n  name?: string;\n  value?: unknown;\n  source?: AstNode;\n  callee?: AstNode;\n  object?: AstNode;\n  property?: AstNode;\n  key?: AstNode;\n  arguments?: AstNode[];\n  properties?: AstNode[];\n};\n\ntype ArkRule = {\n  meta: {\n    type: 'problem';\n    docs: { description: string };\n    messages: Record<string, string>;\n    schema: unknown[];\n  };\n  create(context: RuleContext): RuleListener;\n};\n\ntype ArkEslintPlugin = {\n  rules: Record<string, ArkRule>;\n  configs?: Record<string, unknown>;\n};\n\nfunction stringValue(node: AstNode | undefined): string | undefined {\n  return typeof node?.value === 'string' ? node.value : undefined;\n}\n\nfunction propertyName(node: AstNode | undefined): string | undefined {\n  return node?.name ?? stringValue(node);\n}\n\nfunction calleePropertyName(node: AstNode): string | undefined {\n  return propertyName(node.callee?.property);\n}\n\nfunction objectProperty(node: AstNode | undefined, name: string): AstNode | undefined {\n  return node?.properties?.find((property) => propertyName(property.key) === name);\n}\n\nfunction objectHasProperty(node: AstNode | undefined, name: string): boolean {\n  return objectProperty(node, name) !== undefined;\n}\n\nfunction objectHasMetadataSource(node: AstNode | undefined): boolean {\n  const metadata = objectProperty(node, 'metadata')?.value as AstNode | undefined;\n  return objectHasProperty(metadata, 'source');\n}\n\nfunction looksLikeIntent(value: string): boolean {\n  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\\.[A-Za-z0-9_.]+$/.test(value);\n}\n\nfunction isDomainFile(context: RuleContext): boolean {\n  const filename = context.getFilename?.() ?? '';\n  const normalized = filename.split('\\\\').join('/').toLowerCase();\n  return normalized.includes('/domain/') || normalized.endsWith('/domain.ts');\n}\n\nfunction isInfraImport(specifier: string): boolean {\n  const normalized = specifier.toLowerCase();\n  return [\n    'adapter',\n    'adapters',\n    'infrastructure',\n    'persistence',\n    'repository',\n    'repositories',\n    'integration',\n    'database',\n    'db',\n  ].some((token) => normalized.includes(token));\n}\n\nfunction isPublishCall(node: AstNode): boolean {\n  return calleePropertyName(node) === 'publish';\n}\n\nexport const noDomainInfraImports: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Disallow importing infrastructure or adapters from domain files.',\n    },\n    messages: {\n      forbiddenImport: 'Domain code must not import infrastructure, adapters, repositories, or database modules.',\n    },\n    schema: [],\n  },\n  create(context) {\n    const check = (node: AstNode) => {\n      if (!isDomainFile(context)) return;\n      const source = stringValue(node.source);\n      if (source && isInfraImport(source)) {\n        context.report({ node, messageId: 'forbiddenImport' });\n      }\n    };\n\n    return {\n      ImportDeclaration: check,\n      ExportNamedDeclaration: check,\n      ExportAllDeclaration: check,\n    };\n  },\n};\n\nexport const noRawEventPublish: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require event bus publish calls to use registered intent creators instead of raw event objects or intent strings.',\n    },\n    messages: {\n      rawPublish: 'Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts.',\n    },\n    schema: [],\n  },\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (!isPublishCall(node)) return;\n        const firstArg = node.arguments?.[0];\n        const firstValue = stringValue(firstArg);\n        if (\n          firstValue && looksLikeIntent(firstValue) ||\n          objectHasProperty(firstArg, 'intent')\n        ) {\n          context.report({ node, messageId: 'rawPublish' });\n        }\n      },\n    };\n  },\n};\n\nexport const requirePublishSource: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require event bus publish calls to include source metadata.',\n    },\n    messages: {\n      missingSource: 'Strict Ark publish calls must include metadata.source.',\n    },\n    schema: [],\n  },\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (!isPublishCall(node)) return;\n        const firstArg = node.arguments?.[0];\n        const metadataArg = node.arguments?.[2];\n        if (objectHasMetadataSource(firstArg) || objectHasProperty(metadataArg, 'source')) {\n          return;\n        }\n        context.report({ node, messageId: 'missingSource' });\n      },\n    };\n  },\n};\n\nconst DEFAULT_FORBIDDEN_GLOBALS = ['fetch', 'process', 'Date.now', 'Math.random'];\n\nexport const noForbiddenGlobals: ArkRule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description:\n        'Disallow ambient globals (e.g. fetch, Date.now) in architecture-governed code; scope the rule to layer directories via ESLint \"files\" patterns.',\n    },\n    messages: {\n      forbiddenGlobal: 'Ambient global \"{{name}}\" is forbidden here; inject the capability through a port instead.',\n    },\n    schema: [\n      {\n        type: 'object',\n        properties: {\n          globals: { type: 'array', items: { type: 'string' } },\n        },\n        additionalProperties: false,\n      },\n    ],\n  },\n  create(context) {\n    const option = context.options?.[0] as { globals?: string[] } | undefined;\n    const globals = new Set(option?.globals ?? DEFAULT_FORBIDDEN_GLOBALS);\n    const report = (node: AstNode, name: string) =>\n      context.report({ node, messageId: 'forbiddenGlobal', data: { name } });\n\n    return {\n      // Same positional detection as ark-check's FORBIDDEN_GLOBAL: property accesses on a\n      // forbidden base (console.log, Date.now), direct calls, and constructions. Bare\n      // identifier mentions elsewhere are not flagged (avoids shadowed-local false positives).\n      MemberExpression(node) {\n        const base = node.object?.type === 'Identifier' ? node.object.name : undefined;\n        if (!base) return;\n        const dotted = `${base}.${propertyName(node.property) ?? ''}`;\n        if (globals.has(dotted)) report(node, dotted);\n        else if (globals.has(base)) report(node, base);\n      },\n      CallExpression(node) {\n        const callee = node.callee?.type === 'Identifier' ? node.callee.name : undefined;\n        if (callee && globals.has(callee)) report(node, callee);\n      },\n      NewExpression(node) {\n        const callee = node.callee?.type === 'Identifier' ? node.callee.name : undefined;\n        if (callee && globals.has(callee)) report(node, callee);\n      },\n    };\n  },\n};\n\nconst rules = {\n  'no-domain-infra-imports': noDomainInfraImports,\n  'no-raw-event-publish': noRawEventPublish,\n  'require-publish-source': requirePublishSource,\n  'no-forbidden-globals': noForbiddenGlobals,\n};\n\nconst plugin: ArkEslintPlugin = { rules };\n\nplugin.configs = {\n  recommended: {\n    plugins: { ark: plugin },\n    rules: {\n      'ark/no-domain-infra-imports': 'error',\n      'ark/no-raw-event-publish': 'error',\n      'ark/require-publish-source': 'error',\n    },\n  },\n};\n\nexport { plugin };\nexport default plugin;\n"]}

package/dist/index.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 // src/version.ts
-var version = "1.3.0";
+var version = "1.5.0";
 
 // src/kernel/intent/IntentRegistry.ts
 var IntentRegistry = class {
@@ -2101,6 +2101,33 @@ function tsPublishSourceLiteral(ts, node) {
   const rawMetadata = tsObjectPropertyValue(ts, firstArg, "metadata");
   return tsStringLiteralText(ts, tsObjectPropertyValue(ts, rawMetadata, "source")) ?? tsStringLiteralText(ts, tsObjectPropertyValue(ts, secondArg, "source")) ?? tsStringLiteralText(ts, tsObjectPropertyValue(ts, thirdArg, "source"));
 }
+function analyzeForbiddenGlobals(ts, source, filePath, layer, forbidden) {
+  const entries = new Set(forbidden);
+  if (entries.size === 0) return [];
+  const sourceFile = ts.createSourceFile("generated.ts", source, ts.ScriptTarget.Latest, true);
+  const violations = [];
+  const flag = (name, node) => violations.push(
+    violation("FORBIDDEN_GLOBAL", `${layer} must not use the ambient global "${name}".`, {
+      line: sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1,
+      filePath,
+      target: name,
+      fromLayer: layer,
+      suggestion: "Inject the capability through a port (e.g. a Clock, IdGenerator, or HttpPort) instead of reaching for the ambient global."
+    })
+  );
+  const visit = (node) => {
+    if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression)) {
+      const dotted = `${node.expression.text}.${node.name.text}`;
+      if (entries.has(dotted)) flag(dotted, node);
+      else if (entries.has(node.expression.text)) flag(node.expression.text, node);
+    } else if ((ts.isCallExpression(node) || ts.isNewExpression(node)) && node.expression && ts.isIdentifier(node.expression) && entries.has(node.expression.text)) {
+      flag(node.expression.text, node);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return violations;
+}
 function analyzePublishAst(ts, source, context, profile) {
   const sourceFile = ts.createSourceFile(
     "generated.ts",
@@ -2299,6 +2326,26 @@ function createAICodeGate(options = {}) {
           }
         }
       }
+      if (options.typescript && contextLayer && options.forbiddenGlobals?.[contextLayer]?.length) {
+        try {
+          violations.push(
+            ...analyzeForbiddenGlobals(
+              options.typescript,
+              source,
+              filePath,
+              contextLayer,
+              options.forbiddenGlobals[contextLayer]
+            )
+          );
+        } catch (err) {
+          violations.push(
+            violation(
+              "AST_ANALYZER_ERROR",
+              `TypeScript AST analyzer failed: ${err instanceof Error ? err.message : String(err)}`
+            )
+          );
+        }
+      }
       if (options.typescript) {
         try {
           violations.push(